Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Sex, Lies and Instant Messenger v1

8,651 views

Published on

Adultery is one of the oldest of human preoccupations, but the modern world of social networking and instant messaging is ill-suited to discreet and deniable infidelities. In this talk we will describe what can go wrong with your intra-affair communications, how to avoid such mistakes, and what lessons can be learned.

Published in: Education, Technology

Sex, Lies and Instant Messenger v1

  1. 1. this slide intentionally left blank@alecmuffett sex, lies and instant messenger 1
  2. 2. sex, lies, & instant-messenger @alecmuffett www.alecmuffett.com green lane security www.greenlanesecurity.com@alecmuffett sex, lies and instant messenger 2
  3. 3. disclaimer@alecmuffett sex, lies and instant messenger 3
  4. 4. by following these rules you may or may not get away with an affair...@alecmuffett sex, lies and instant messenger 4
  5. 5. ...but there are amusing mistakes which you can/should avoid@alecmuffett sex, lies and instant messenger 5
  6. 6. DON’T@alecmuffett sex, lies and instant messenger 6
  7. 7. do not use secrets as passwords@alecmuffett sex, lies and instant messenger 7
  8. 8. my history • Crack • First “smart” password cracker • 1991..96 • http://tinyurl.com/2jnzpy •CrackLib • password checking library • 1994..now@alecmuffett sex, lies and instant messenger 8
  9. 9. issue passwords are secret, but...@alecmuffett sex, lies and instant messenger 9
  10. 10. issue secrets make bad passwords@alecmuffett sex, lies and instant messenger 10
  11. 11. passwords guessable@alecmuffett sex, lies and instant messenger 11
  12. 12. passwords brute-forceable@alecmuffett sex, lies and instant messenger 12
  13. 13. passwords reveal stuff you dont want revealed@alecmuffett sex, lies and instant messenger 13
  14. 14. your password reveals something about you?@alecmuffett sex, lies and instant messenger 14
  15. 15. your password reflects your tastes?@alecmuffett sex, lies and instant messenger 15
  16. 16. your password is known to your spouse?@alecmuffett sex, lies and instant messenger 16
  17. 17. password reuse=self-incrimination (which is bad)@alecmuffett sex, lies and instant messenger 17
  18. 18. do not Skype@alecmuffett sex, lies and instant messenger 18
  19. 19. Skype • “peer to peer” architecture • robust, replicated, flexible • excellent security • ...unless you’re up against the USA • ...or China • ...and maybe the UK@alecmuffett sex, lies and instant messenger 19
  20. 20. virtually impossible to expunge a recent conversation@alecmuffett sex, lies and instant messenger 20
  21. 21. brute-force Skype deletion makes things worse messages resurrect from the dead@alecmuffett sex, lies and instant messenger 21
  22. 22. losing control of information is not good@alecmuffett sex, lies and instant messenger 22
  23. 23. do not XMPP/Jabber • Google chat, • some Facebook chat • other systems@alecmuffett sex, lies and instant messenger 23
  24. 24. do not XMPP/Jabber • Initial message is “multicast” • to all logged-in instances • eg: “hello sexy” • ...arrives on the Home PC • ...when you are at work@alecmuffett sex, lies and instant messenger 24
  25. 25. -@alecmuffett sex, lies and instant messenger 25
  26. 26. do not Twitter@alecmuffett sex, lies and instant messenger 26
  27. 27. do not Twitter too many risks@alecmuffett sex, lies and instant messenger 27
  28. 28. D alice can i have you for dinner?@alecmuffett sex, lies and instant messenger 28
  29. 29. @alice can i have you for dinner?@alecmuffett sex, lies and instant messenger 29
  30. 30. ...and, worse...@alecmuffett sex, lies and instant messenger 30
  31. 31. D bob Nude! http://twitpic.com/b0gu5@alecmuffett sex, lies and instant messenger 31
  32. 32. Twitter App Risks • Apps can get access to DMs • Twitpic? Flickr? Yfrog? • Is that really wise?@alecmuffett sex, lies and instant messenger 32
  33. 33. do not Facebook@alecmuffett sex, lies and instant messenger 33
  34. 34. too easy to get wrong@alecmuffett sex, lies and instant messenger 34
  35. 35. friends-of-friends != friends@alecmuffett sex, lies and instant messenger 35
  36. 36. Homepage displays whom you communicate with frequently@alecmuffett sex, lies and instant messenger 36
  37. 37. Your own Facebook account is too rich a software ecosystem to viably trust it with secrets@alecmuffett sex, lies and instant messenger 37
  38. 38. beware Google@alecmuffett sex, lies and instant messenger 38
  39. 39. do not use Google services / your normal Google account • Mail = heavily stored / indexed • Chat = Mail • Chrome Bookmarks = Docs • Toolbar = Docs • Android = Google Everything@alecmuffett sex, lies and instant messenger 39
  40. 40. do not smartphone@alecmuffett sex, lies and instant messenger 40
  41. 41. massive comedy potential@alecmuffett sex, lies and instant messenger 41
  42. 42. iPhone screenlock@alecmuffett sex, lies and instant messenger 42
  43. 43. applications which pop-up alerts above the screenlock@alecmuffett sex, lies and instant messenger 43
  44. 44. Locked?@alecmuffett sex, lies and instant messenger 44
  45. 45. ...and the punchline is...@alecmuffett sex, lies and instant messenger 45
  46. 46. don’t combine this with Skype@alecmuffett sex, lies and instant messenger 46
  47. 47. iPhone • All backed up by iTunes: • SMS • call logs • geolocation (see recent press) • ...possibly with password@alecmuffett sex, lies and instant messenger 47
  48. 48. Android • basically ditto • ...but backed up on Google@alecmuffett sex, lies and instant messenger 48
  49. 49. Smartphone Apps • backed up on network • or on iTunes • same story as elsewhere@alecmuffett sex, lies and instant messenger 49
  50. 50. the problem is with data getting out of your control@alecmuffett sex, lies and instant messenger 50
  51. 51. Geolocation@alecmuffett sex, lies and instant messenger 51
  52. 52. avoid sharing geolocation • Foursquare, Twitter, etc • “...but your Twitter messages said that you were in Essex?” • Do you have an in-car GPS? • Learn to wipe that, too • Does your spouse expect GPS? • Oops.@alecmuffett sex, lies and instant messenger 52
  53. 53. do not MMORPG@alecmuffett sex, lies and instant messenger 53
  54. 54. MMORPG • WoW • SecondLife • EQ • EVE Online@alecmuffett sex, lies and instant messenger 54
  55. 55. held to lower standard than IM@alecmuffett sex, lies and instant messenger 55
  56. 56. heavily-integrated software • game • voice • webcam • other third party stuff@alecmuffett sex, lies and instant messenger 56
  57. 57. game logs • comprehensive • intricate • messy • ...therefore hard to clean up@alecmuffett sex, lies and instant messenger 57
  58. 58. Most important...@alecmuffett sex, lies and instant messenger 58
  59. 59. do not send porny pictures to each other@alecmuffett sex, lies and instant messenger 59
  60. 60. do not use the shared family computer@alecmuffett sex, lies and instant messenger 60
  61. 61. do not use work-related hardware@alecmuffett sex, lies and instant messenger 61
  62. 62. work hardware • not your machine • not your data? • automated backups • network access logged • may be taken from you • eg: bankruptcy, fired, updated • old hardware auctioned@alecmuffett sex, lies and instant messenger 62
  63. 63. and...@alecmuffett sex, lies and instant messenger 63
  64. 64. do not post an accurate description of yourself • including grammatical quirks • to a swingers/fetish website • in the public members index • where Google can cache it • bookmarking it • on the family computer • with photos@alecmuffett sex, lies and instant messenger 64
  65. 65. Why?@alecmuffett sex, lies and instant messenger 65
  66. 66. Things Geeks Do • Enumerate all possible URLs: • tinyurl.com • bit.ly • is.gd • t.co • ...and save the good ones@alecmuffett sex, lies and instant messenger 66
  67. 67. Things Geeks Do • Trawl... • Picasa • Twitpic • Yfrog • etc... • ...to much the same ends@alecmuffett sex, lies and instant messenger 67
  68. 68. Things Geeks Do • buy hardware from Ebay • “undelete” files • desktops • laptops • printers • storage • hard disks • thumb drives@alecmuffett sex, lies and instant messenger 68
  69. 69. Things Geeks Do • buy phones from Ebay • restore deleted SMS • retrieve e-mail passwords@alecmuffett sex, lies and instant messenger 69
  70. 70. recreational computer forensics for teh lulz@alecmuffett sex, lies and instant messenger 70
  71. 71. What to do!@alecmuffett sex, lies and instant messenger 71
  72. 72. create a disposable identity@alecmuffett sex, lies and instant messenger 72
  73. 73. use a fake, boring, common pseudonym • good • edward wilson • carole smith • bad • sexxxy4uinwokingham • anything that’s unique@alecmuffett sex, lies and instant messenger 73
  74. 74. legal? • You’re probably breaking contractual “terms of service” • Is it criminal to lie? • maybe?@alecmuffett sex, lies and instant messenger 74
  75. 75. avoid linking real/fake identities • use a random password • never used before • never use anywhere else@alecmuffett sex, lies and instant messenger 75
  76. 76. avoid intermingled filestore • set up different “users” • keep sensitive files in one place • ...hopefully • ...mostly • ...except for logs@alecmuffett sex, lies and instant messenger 76
  77. 77. cryptography • try to get encrypted swap • avoid sleep/hibernation • try to get full disk encryption • at least encrypted home directory • bundled with OSX • avoid “master keys”@alecmuffett sex, lies and instant messenger 77
  78. 78. use a secure browser • do not use your daily browser@alecmuffett sex, lies and instant messenger 78
  79. 79. example workflow@alecmuffett sex, lies and instant messenger 79
  80. 80. Chrome “day-to-day”@alecmuffett sex, lies and instant messenger 80
  81. 81. Safari • Guests and visitors • Logging into a website without logging-out of Facebook first@alecmuffett sex, lies and instant messenger 81
  82. 82. Firefox • Ideal for... • dubious e-mail links • porn • shagging • security malware research@alecmuffett sex, lies and instant messenger 82
  83. 83. browser configuration@alecmuffett sex, lies and instant messenger 83
  84. 84. browser settings • clear cookies • clear history • dont accept 3rd-party cookies • block popups@alecmuffett sex, lies and instant messenger 84
  85. 85. more browser settings • dont save form input • dont save history • switch off autosuggest • set to private browser mode • ...permanently, if possible • else auto/delete cookies on exit@alecmuffett sex, lies and instant messenger 85
  86. 86. major surgery • SSL Everywhere • if available for the browser • will cause hassle • Disable Java • might cause hassle • nb: not JavaScript (see NoScript)@alecmuffett sex, lies and instant messenger 86
  87. 87. Firefox extensions • NoScript • AdBlock Plus • Ghostery • “block all web-bugs” mode • Tor / Torbutton • or: Tor browser bundle • advanced, but worth it@alecmuffett sex, lies and instant messenger 87
  88. 88. Safari plugins • ClickToFlash • ...others?@alecmuffett sex, lies and instant messenger 88
  89. 89. Flash • Flash Player • global security settings panel • purge flash cookies / sites • set flash db size to zero@alecmuffett sex, lies and instant messenger 89
  90. 90. HTML5 • set HTML5 db size to zero • watch for other/new issues@alecmuffett sex, lies and instant messenger 90
  91. 91. this also applies to your phone browser@alecmuffett sex, lies and instant messenger 91
  92. 92. do use webmail from the secure browser • use HTTPS/SSL at minimum • use Tor if/when possible@alecmuffett sex, lies and instant messenger 92
  93. 93. do not bookmark nor save the password of your secret webmail@alecmuffett sex, lies and instant messenger 93
  94. 94. where not to save passwords • not in Keychain.app • not in “1password” • not in browser • not in phone browser • not in phone mail app@alecmuffett sex, lies and instant messenger 94
  95. 95. keep it in your brain@alecmuffett sex, lies and instant messenger 95
  96. 96. why? • rubber-hose cryptanalysts • or divorce lawyers • prettymuch the same thing@alecmuffett sex, lies and instant messenger 96
  97. 97. Suggestions@alecmuffett sex, lies and instant messenger 97
  98. 98. Use a Gmail account to set up a Yahoo account@alecmuffett sex, lies and instant messenger 98
  99. 99. Yahoo for webmail • Less obvious than Google • Less temptingly integrated with phone@alecmuffett sex, lies and instant messenger 99
  100. 100. AIM for IM • can enforce 1 session at a time • remote session disconnect • use “OTR”@alecmuffett sex, lies and instant messenger 100
  101. 101. übergeeks • “truecrypt” • “live-cd” • “virtualisation”@alecmuffett sex, lies and instant messenger 101
  102. 102. use a PAYG dumbphone • pay cash (where possible) • top-up with cash • enable PIN lock • avoid ... • paper billing • web integration@alecmuffett sex, lies and instant messenger 102
  103. 103. use voice calls@alecmuffett sex, lies and instant messenger 103
  104. 104. do not leave voicemails@alecmuffett sex, lies and instant messenger 104
  105. 105. dumbphone SMS • lowest common denominator • phone-to-phone is good • messages still logged on backend • but overall exposure is less@alecmuffett sex, lies and instant messenger 105
  106. 106. wipe your SMS messages regularly@alecmuffett sex, lies and instant messenger 106
  107. 107. if you must use smartphone • dont’ link to your real GoogleID • check out.... • WhatsApp • TigerText@alecmuffett sex, lies and instant messenger 107
  108. 108. decommission old hardware • computers • DBAN - Darik’s Boot & Nuke • phones • Remove SIM • SMS may be on SIM as well as phone • check if “factory reset” works • if not, drive a car over it repeatedly@alecmuffett sex, lies and instant messenger 108
  109. 109. bottom line the more copies of data exist the harder it is to remove them & when data escapes from your control its available forever@alecmuffett sex, lies and instant messenger 109
  110. 110. remember • your lover has the same data • but may not be taking care of it • educate them gently • his/her systems will also one day be sold on eBay@alecmuffett sex, lies and instant messenger 110
  111. 111. when mistakes happen... clean up calmly, and do not amplify the mistake@alecmuffett sex, lies and instant messenger 111
  112. 112. bonne chance@alecmuffett sex, lies and instant messenger 112

×