Sex, Lies and Instant Messenger mk II

this slide intentionally left blank@alecmuffett sex, lies and instant messenger

sex, lies, & instant-messenger @alecmuffett www.alecmuffett.com green lane security www.greenlanesecurity.com v2.0@alecmuffett sex, lies and instant messenger

What should come of this?@alecmuffett sex, lies and instant messenger

When using the Web for private communication...@alecmuffett sex, lies and instant messenger

be aware 1) what can go wrong unexpectedly?@alecmuffett sex, lies and instant messenger

be aware 2) what risks you protecting against?@alecmuffett sex, lies and instant messenger

be aware 3) what must you do/not do?@alecmuffett sex, lies and instant messenger

Goal “Keep control of your data.”@alecmuffett sex, lies and instant messenger

disclaimer (1) All examples appearing in this work are fictitious. Any resemblance to real events or to real persons, living or dead, is mostly coincidental.@alecmuffett sex, lies and instant messenger

disclaimer (2) Advice given here is necessarily incomplete; information security is a huge discipline and a full set of risks cannot be conveyed in 30 minutes.@alecmuffett sex, lies and instant messenger

1) what can go wrong unexpectedly?@alecmuffett sex, lies and instant messenger

passwords!@alecmuffett sex, lies and instant messenger

do not use secrets as passwords!@alecmuffett sex, lies and instant messenger

my history • Crack • First “smart” password cracker • 1991..96 • http://tinyurl.com/2jnzpy • CrackLib • password checking library • 1994..now@alecmuffett sex, lies and instant messenger

issue passwords are secret, but...@alecmuffett sex, lies and instant messenger

issue ...secrets make bad passwords@alecmuffett sex, lies and instant messenger

passwords guessable@alecmuffett sex, lies and instant messenger

000000 1 1111 11111 111111 11111111 112233 123 123123 123321 1234 12345 123456 1234567 12345678 123456789 123abc 123qwe 1q2w3e 1q2w3e4r 222222 55555 654321 666666 7777 7777777 a aaaaaa abc123 adidas admin amanda andrew angel angel1 angels anthony apple asdf asdfasdf asdfgh ashley asshole austin baby bailey banana bandit baseball batman benjamin biteme blabla blahblah blessed blessing blink182 bubbles buster canada cassie charlie cheese chelsea chicken chris christ church cocacola compaq computer cookie cool corvette creative dakota dallas daniel danielle david destiny dexter diamond digital dragon eminem emmanuel enter faith flower foobar football football1 forever forum freedom friend friends fuckoff fuckyou fuckyou1 gateway genesis george ginger god google grace green guitar hahaha hallo hannah happy hardcore harley heaven hello hello1 helpme hockey hope hotdog hunter ilovegod iloveyou iloveyou! iloveyou1 iloveyou2 internet james jasmine jason jasper jennifer jessica jesus jesus1 john john316 jordan jordan23 joseph joshua junior justin killer kitten knight letmein london looking love lovely loving lucky maggie master matrix matthew maverick maxwell merlin michael michelle mickey microsoft mike monkey mother muffin mustang mylove myspace1 nathan nicole nintendo none nothing onelove online orange pass passw0rd password password1 peace peaches peanut pepper phpbb pokemon poop power praise prayer prince princess purple qazwsx qwert qwerty qwerty1 rachel rainbow red123 richard robert rotimi samantha sammy samuel saved scooby scooter secret shadow shalom silver single slayer smokey snoopy soccer soccer1 sparky spirit startrek starwars stella summer sunshine superman taylor test testing testtest thomas thunder tigger trinity trustno1 victory viper welcome whatever william winner wisdom zxcvbnm 250 top passwords - http://goo.gl/xPCq@alecmuffett sex, lies and instant messenger

“You’ll never guess my password, it’s in Klingon!”@alecmuffett sex, lies and instant messenger

@alecmuffett sex, lies and instant messenger

passwords brute-forceable@alecmuffett sex, lies and instant messenger

from: AAAA@alecmuffett sex, lies and instant messenger

to: zzzzzzzzzzzz@alecmuffett sex, lies and instant messenger

via: t5gn9LF$*RJ#@alecmuffett sex, lies and instant messenger

more than 1,000,000 guesses/second!@alecmuffett sex, lies and instant messenger

sometimes more than 2 billion guesses/second ( google: imhoff password cracking )@alecmuffett sex, lies and instant messenger

however...@alecmuffett sex, lies and instant messenger

password a window into your mind?@alecmuffett sex, lies and instant messenger

password reveals something about you?@alecmuffett sex, lies and instant messenger

password reflects your tastes?@alecmuffett sex, lies and instant messenger

password is known to your spouse?@alecmuffett sex, lies and instant messenger

also • reuse = self-incrimination • ...which is bad... • ...more later...@alecmuffett sex, lies and instant messenger

basic password discipline • use a password management tool • use 12/more random characters • use different passwords at each website • never reuse passwords • never share passwords • change annually/more often • change when someone discovers one!@alecmuffett sex, lies and instant messenger

next: instant messenger!@alecmuffett sex, lies and instant messenger

do not Skype IM with your lover!@alecmuffett sex, lies and instant messenger

Skype • peer to peer architecture • robust, replicated, flexible • excellent security • ...unless you’re up against the USA • ...or China • ...or maybe the UK@alecmuffett sex, lies and instant messenger

virtually impossible to expunge a recent conversation@alecmuffett sex, lies and instant messenger

deletion can make things worse messages resurrect from the dead!@alecmuffett sex, lies and instant messenger

(zombie data is not good)@alecmuffett sex, lies and instant messenger

Avoid XMPP with a lover... • Also called Jabber Protocol • Implementations: • GoogleChat • Some Facebook chat • Other systems@alecmuffett sex, lies and instant messenger

XMPP • Initial message is multicast • sent to all logged-in instances • eg: “hello sexy” • ...also arrives on the home PC • ...whilst you are at work@alecmuffett sex, lies and instant messenger

Other IM systems? • Not really wise... • AIM now multicast • YIM likewise • Go for something simple • Avoid specialist IM-client software • Use web-based systems@alecmuffett sex, lies and instant messenger

next: social media!@alecmuffett sex, lies and instant messenger

do not Twitter with your lover!@alecmuffett sex, lies and instant messenger

typos of doom!@alecmuffett sex, lies and instant messenger

D alice can i have you for dinner?@alecmuffett sex, lies and instant messenger

@alice can i have you for dinner?@alecmuffett sex, lies and instant messenger

...and, worse...@alecmuffett sex, lies and instant messenger

D bob Nude! http://twitpic.com/b0gu5@alecmuffett sex, lies and instant messenger

Twitter App Risks • Third-party apps get access to DMs • Twitter clients... • Web Apps... • Proliferation of data is unwise • more backups • more caches • more access@alecmuffett sex, lies and instant messenger

do not Facebook your lover!@alecmuffett sex, lies and instant messenger

too easy to get wrong@alecmuffett sex, lies and instant messenger

Dropping Hints homepage displays with whom you communicate frequently@alecmuffett sex, lies and instant messenger

“Transitive trust” friends-of-friends may not be friends@alecmuffett sex, lies and instant messenger

Facebook Software Ecology Facebook is not really Facebook@alecmuffett sex, lies and instant messenger

Analogy if you want to be private, don’t throw your diary into a pub full of gossips and journalists@alecmuffett sex, lies and instant messenger

next: phones!@alecmuffett sex, lies and instant messenger

do not smartphone with your lover!@alecmuffett sex, lies and instant messenger

massive comedy potential@alecmuffett sex, lies and instant messenger

iPhone screenlock@alecmuffett sex, lies and instant messenger

applications which pop-up alerts above the screenlock@alecmuffett sex, lies and instant messenger

Locked?@alecmuffett sex, lies and instant messenger

punchline:@alecmuffett sex, lies and instant messenger

Don’t combine this with Skype@alecmuffett sex, lies and instant messenger

do not go gaming with your lover!@alecmuffett sex, lies and instant messenger

MMORPGs • EQ • SecondLife • EVE Online • Warhammer • WoW • etc...@alecmuffett sex, lies and instant messenger

held to lower standard than IM@alecmuffett sex, lies and instant messenger

heavily-integrated software • game • voice • webcam • other third party stuff@alecmuffett sex, lies and instant messenger

game logs • logfiles are... • comprehensive • disparate • spattered all over the hard drive • ...and therefore hard to remove@alecmuffett sex, lies and instant messenger

next...@alecmuffett sex, lies and instant messenger

Geolocation can hurt you!@alecmuffett sex, lies and instant messenger

avoid sharing geolocation • Foursquare, Twitter, etc • “...but your Twitter messages said that you were in Essex?”@alecmuffett sex, lies and instant messenger

Do you have an in-car GPS? ...and do you know how to wipe it?@alecmuffett sex, lies and instant messenger

next, an obvious thing that’s often missed:@alecmuffett sex, lies and instant messenger

do not send porny naked pictures of yourselves, to each other@alecmuffett sex, lies and instant messenger

homebrew porn • webcam temporary copy • potentially restorable@alecmuffett sex, lies and instant messenger

homebrew porn • desktop copy • backup/time machine copy • image-management tool copy@alecmuffett sex, lies and instant messenger

homebrew porn • IM server copy • or: duplicate Skype transfers • plus: transfer logs@alecmuffett sex, lies and instant messenger

homebrew porn • remote copies • remote backup/time machine • remote image-management tool@alecmuffett sex, lies and instant messenger

homebrew porn • Took it with iPhone? • backed up to iTunes • backed up to iCloud?@alecmuffett sex, lies and instant messenger

homebrew porn • boyfriend’s archive copies • ...for sharing when you break up@alecmuffett sex, lies and instant messenger

do not use the family computer@alecmuffett sex, lies and instant messenger

there’s a reason it’s called a family computer@alecmuffett sex, lies and instant messenger

do not use work-related hardware@alecmuffett sex, lies and instant messenger

work hardware • not your machine • thus: “not your data” • may be taken from you • eg: bankruptcy, fired, updated • old hardware auctioned • automated backups? • network access logged?@alecmuffett sex, lies and instant messenger

summary@alecmuffett sex, lies and instant messenger

IF YOU ARE GOING TO LIVE A DOUBLE LIFE, THEN PLEASE DO IT RIGHT.@alecmuffett sex, lies and instant messenger

2) what risks are you protecting against?@alecmuffett sex, lies and instant messenger

(apart from spouses and lawyers)@alecmuffett sex, lies and instant messenger

recreational computer forensics!@alecmuffett sex, lies and instant messenger

for teh lulz!@alecmuffett sex, lies and instant messenger

Things Geeks Do • Enumerate all possible URLs: • tinyurl • bit.ly • is.gd • t.co • ...and save the good ones@alecmuffett sex, lies and instant messenger

Things Geeks Do • Trawl... • Picasa • Twitpic • Yfrog • ...to much the same ends@alecmuffett sex, lies and instant messenger

Things Geeks Do • buy hardware from Ebay • undelete data files • desktops • laptops • printers (!) • storage • hard disks • thumb drives • SD cards@alecmuffett sex, lies and instant messenger

Things Geeks Do • buy phones from Ebay • restore deleted SMS • retrieve e-mail passwords@alecmuffett sex, lies and instant messenger

Find hardware in the street...@alecmuffett sex, lies and instant messenger

...investigate it...@alecmuffett sex, lies and instant messenger

...discover secrets.@alecmuffett sex, lies and instant messenger

Your challenge is to make that hard@alecmuffett sex, lies and instant messenger

3) what must you do/not do?@alecmuffett sex, lies and instant messenger

do use separate identities, do not link identities!@alecmuffett sex, lies and instant messenger

create a disposable identity, start with an e-mail address@alecmuffett sex, lies and instant messenger

use a fake, boring, common pseudonym • good • edward wilson • carole smith • bad • sexxxy4UinBasingstoke • anything else that’s unique@alecmuffett sex, lies and instant messenger

is this legal? • probably breaking terms of service • is it criminal to lie? • maybe...@alecmuffett sex, lies and instant messenger

idea: Use a disposable Gmail account to set up a fake Yahoo account or vice-versa.@alecmuffett sex, lies and instant messenger

do not bookmark your secret identity@alecmuffett sex, lies and instant messenger

do use a random password • never used before • never use anywhere else • keep the password in your brain@alecmuffett sex, lies and instant messenger

do not store the secret identity password in your normal password manager!@alecmuffett sex, lies and instant messenger

do minimise data proliferation, do not leave footprints!@alecmuffett sex, lies and instant messenger

do not access your secret identity from your normal phone@alecmuffett sex, lies and instant messenger

iPhone • All backed up by iTunes: • SMS • call logs • geolocation (see recent press) • ...possibly password protected • You’re using a different password, yes?@alecmuffett sex, lies and instant messenger

Android • basically ditto • ...but backed up on Google instead@alecmuffett sex, lies and instant messenger

Do not access your secret identity using your normal laptop “login”@alecmuffett sex, lies and instant messenger

avoid intermingled filestore@alecmuffett sex, lies and instant messenger

set up different “users” • keep sensitive files in one place • ...hopefully • ...mostly • ...except for logs@alecmuffett sex, lies and instant messenger

set up encrypted hard disks resistant to post-Ebay forensics@alecmuffett sex, lies and instant messenger

use browsers which support private browsing modes, which delete cookies & history on exit@alecmuffett sex, lies and instant messenger

example workflow@alecmuffett sex, lies and instant messenger

Chrome “day-to-day”@alecmuffett sex, lies and instant messenger

Safari • Guests and visitors • Logging into a website without logging-out of Facebook first@alecmuffett sex, lies and instant messenger

Firefox • Ideal for... • porn • shagging • dubious e-mail links • security malware research@alecmuffett sex, lies and instant messenger

technical reference@alecmuffett sex, lies and instant messenger

browser settings (1) • clear cookies on exit • clear history on exit • dont accept 3rd-party cookies • block popups@alecmuffett sex, lies and instant messenger

browser settings (2) • dont save form input • dont save history • switch off autosuggest • set to private browser mode • ...permanently, if possible • else auto/delete cookies on exit@alecmuffett sex, lies and instant messenger

plugins / similar • Flash Player • Visit the security settings panel • purge Flash cookies and sites • set Flash db size to zero • HTML5 settings • set HTML5 db size to zero • watch for other/new issues@alecmuffett sex, lies and instant messenger

Firefox extensions • Tor • better: Tor Browser Bundle •SSL Everywhere •NoScript •RequestPolicy •AdBlock Plus •Ghostery@alecmuffett sex, lies and instant messenger

Adium / Pidgin for IM • use OTR encryption • not the same as “OTR” in GoogleChat! • can solve the point-to-point chat issue@alecmuffett sex, lies and instant messenger

remember:@alecmuffett sex, lies and instant messenger

all this also applies to your phone@alecmuffett sex, lies and instant messenger

speaking of phones...@alecmuffett sex, lies and instant messenger

use a PAYG dumbphone • pay cash (where possible) • top-up with cash • enable PIN lock • avoid ... • paper billing • web integration@alecmuffett sex, lies and instant messenger

use voice calls@alecmuffett sex, lies and instant messenger

do not leave voicemails@alecmuffett sex, lies and instant messenger

wipe your SMS messages regularly@alecmuffett sex, lies and instant messenger

dumbphone SMS • lowest common denominator • messages still logged on backend • but overall exposure is less@alecmuffett sex, lies and instant messenger

if you must use smartphone • don’t link to your normal Google Account@alecmuffett sex, lies and instant messenger

if you must use smartphone • check out: • WhatsApp • TigerText • other SMS replacements@alecmuffett sex, lies and instant messenger

finally...@alecmuffett sex, lies and instant messenger

decommission old hardware! • computers • DBAN - Darik’s Boot & Nuke • Free suicide pill / CDROM for PCs • phones • Remove SIM • SMS may be on SIM as well as phone! • Check whether factory reset actually works • if not, smash it and drive a car over it repeatedly@alecmuffett sex, lies and instant messenger

bottom line • the more copies of data exist • the harder it is to remove them • when data escapes your control • its available forever@alecmuffett sex, lies and instant messenger

when mistakes happen... • clean up calmly • do not amplify the mistake@alecmuffett sex, lies and instant messenger

remember • your lover has the same data • but may not be taking care of it • educate them gently • his/her systems will also one day be sold on eBay@alecmuffett sex, lies and instant messenger

so why must you actually know all this?@alecmuffett sex, lies and instant messenger

answer...@alecmuffett sex, lies and instant messenger

1) shagging@alecmuffett sex, lies and instant messenger

2) journalists and sources@alecmuffett sex, lies and instant messenger

3) employees and whistleblowers@alecmuffett sex, lies and instant messenger

4) activists in repressive regimes@alecmuffett sex, lies and instant messenger

5) separating work and home data/life@alecmuffett sex, lies and instant messenger

6) good data hygiene@alecmuffett sex, lies and instant messenger

bonne chance@alecmuffett sex, lies and instant messenger

http://dropsafe.crypticide.com	300
http://www.skepticule.co.uk	260
http://feeds2.feedburner.com	144
http://lanyrd.com	14
http://a0.twimg.com	2
http://skeprec.blogspot.co.uk	2
http://ranksit.com	1

Sex, Lies and Instant Messenger mk II

by alecmuffett

Accessibility

Categories

Upload Details

Usage Rights

7 Embeds 723

Statistics

Sex, Lies and Instant Messenger mk II Presentation Transcript