sex, lies, & instant-messenger                    @alecmuffett                 www.alecmuffett.com                 green l...
What should come of this?@alecmuffett                      sex, lies and instant messenger
When using the Web               for private communication...@alecmuffett                        sex, lies and instant mes...
be aware        1) what can go wrong unexpectedly?@alecmuffett                    sex, lies and instant messenger
be aware        2) what risks you protecting against?@alecmuffett                      sex, lies and instant messenger
be aware               3) what must you do/not do?@alecmuffett                       sex, lies and instant messenger
Goal               “Keep control of your data.”@alecmuffett                        sex, lies and instant messenger
disclaimer (1)  Almost all examples appearing in this work    are fictitious. Any resemblance to real   events or to real ...
disclaimer (2)         Advice given here is necessarily   incomplete; information security is a huge    discipline and a f...
1) what can go wrong unexpectedly?@alecmuffett                    sex, lies and instant messenger
passwords!@alecmuffett                sex, lies and instant messenger
do not use secrets as passwords!@alecmuffett                          sex, lies and instant messenger
my history               • Crack                • First “smart” password cracker                 • 1991..96               ...
issue               passwords are secret, but...@alecmuffett                        sex, lies and instant messenger
issue               ...secrets make bad passwords@alecmuffett                        sex, lies and instant messenger
passwords                guessable@alecmuffett                sex, lies and instant messenger
000000 1 1111 11111 111111 11111111 112233 123 123123 123321 1234 12345 123456    1234567 12345678 123456789 123abc 123qwe...
“You’ll never guess my password,                    it’s in Klingon!”@alecmuffett                      sex, lies and insta...
@alecmuffett   sex, lies and instant messenger
passwords               brute-forceable@alecmuffett                 sex, lies and instant messenger
from: AAAA@alecmuffett                sex, lies and instant messenger
to: zzzzzzzzzzzz@alecmuffett                 sex, lies and instant messenger
via:               t5gn9LF$*RJ#@alecmuffett              sex, lies and instant messenger
more than 1,000,000 guesses/second!@alecmuffett                  sex, lies and instant messenger
sometimes more than               9 billion guesses/second@alecmuffett                      sex, lies and instant messenger
google:               imhoff password cracking                 hashcat performance@alecmuffett                      sex, l...
however...@alecmuffett                sex, lies and instant messenger
password               a window into your mind?@alecmuffett                     sex, lies and instant messenger
password               reveals something about you?@alecmuffett                        sex, lies and instant messenger
password               reflects your tastes?@alecmuffett                     sex, lies and instant messenger
password               is known to your spouse?@alecmuffett                      sex, lies and instant messenger
also               • reuse = self-incrimination                • ...which is bad...                 • ...more later...@ale...
basic password discipline               • use a password management tool                • use 12/more random characters   ...
next: instant messenger!@alecmuffett                      sex, lies and instant messenger
do not Skype IM with your lover!@alecmuffett                      sex, lies and instant messenger
Skype               • peer to peer architecture                • robust, replicated, flexible               • excellent se...
virtually impossible to expunge                    a recent conversation@alecmuffett                          sex, lies an...
deletion can make things worse          messages resurrect from the dead!@alecmuffett                     sex, lies and in...
(zombie data is not good)@alecmuffett                      sex, lies and instant messenger
Avoid XMPP with a lover...               • Also called Jabber Protocol               • Implementations:                • G...
XMPP               • Initial message is multicast                • sent to all logged-in instances               • eg: “he...
Other IM systems?               • Not really wise...                • AIM now multicast                • YIM likewise     ...
next: social media!@alecmuffett                    sex, lies and instant messenger
do not Twitter with your lover!@alecmuffett                          sex, lies and instant messenger
typos of doom!@alecmuffett                    sex, lies and instant messenger
D alice can i have you for dinner?@alecmuffett              sex, lies and instant messenger
@alice can i have you for dinner?@alecmuffett             sex, lies and instant messenger
...and, worse...@alecmuffett                      sex, lies and instant messenger
D bob Nude! http://twitpic.com/b0gu5@alecmuffett              sex, lies and instant messenger
Twitter App Risks               • Third-party apps get access to DMs                • Twitter clients...                • ...
do not Facebook your lover!@alecmuffett                       sex, lies and instant messenger
too easy to get wrong@alecmuffett                     sex, lies and instant messenger
Dropping Hints         homepage displays with whom you             communicate frequently@alecmuffett                   se...
“Transitive trust”       friends-of-friends may not be friends@alecmuffett                     sex, lies and instant messe...
Tommy Jordan!                 YouTube Video:     Facebook Parenting: For the troubled teen@alecmuffett                    ...
Facebook Software Ecology               Facebook is not really Facebook@alecmuffett                         sex, lies and ...
Analogy             if you want to be private,               don’t throw your diary     into a pub full of gossips and jou...
next: phones!@alecmuffett                   sex, lies and instant messenger
do not smartphone with your lover!@alecmuffett                     sex, lies and instant messenger
massive comedy potential@alecmuffett                      sex, lies and instant messenger
iPhone screenlock@alecmuffett                  sex, lies and instant messenger
applications which pop-up               alerts above the screenlock@alecmuffett                        sex, lies and insta...
Locked?@alecmuffett   sex, lies and instant messenger
punchline:@alecmuffett                sex, lies and instant messenger
Don’t combine this with Skype@alecmuffett                        sex, lies and instant messenger
do not go gaming with your lover!@alecmuffett                     sex, lies and instant messenger
MMORPGs               • EQ               • SecondLife               • EVE Online               • Warhammer               •...
held to lower standard than IM@alecmuffett                         sex, lies and instant messenger
heavily-integrated software               • game               • webcam               • voice                • third party...
game logs               • logfiles are...                • comprehensive                • disparate                • spatt...
next...@alecmuffett             sex, lies and instant messenger
Geolocation can hurt you!@alecmuffett                      sex, lies and instant messenger
avoid sharing geolocation               • Foursquare, Twitter, etc                • “...but your Twitter messages said    ...
Do you have an in-car GPS?          ...and do you know how to wipe it?@alecmuffett                      sex, lies and inst...
next, an obvious thing that’s often missed:@alecmuffett                    sex, lies and instant messenger
do not send porny naked pictures              of yourselves, to each other@alecmuffett                      sex, lies and ...
homebrew porn               • webcam temporary copy                • potentially restorable@alecmuffett                   ...
homebrew porn               • desktop copy                • backup/time machine copy                • image-management too...
homebrew porn               • IM server copy                • or: duplicate Skype transfers                • plus: transfe...
homebrew porn               • remote copies                • remote backup/time machine                • remote image-mana...
homebrew porn               • Took it with iPhone?                • backed up to iTunes                 • backed up to iCl...
homebrew porn               • boyfriend’s archive copies                • ...for sharing when you break up@alecmuffett    ...
do not use the family computer@alecmuffett                         sex, lies and instant messenger
there’s a reason it’s called                  a family computer@alecmuffett                         sex, lies and instant ...
do not use work-related hardware@alecmuffett                     sex, lies and instant messenger
work hardware               • not your machine                • thus: “not your data”                • may be taken from y...
summary@alecmuffett             sex, lies and instant messenger
If you are going to live a double life                then please do it right.@alecmuffett                        sex, lie...
2) what risks are you protecting against?@alecmuffett                    sex, lies and instant messenger
(apart from spouses and lawyers)@alecmuffett                      sex, lies and instant messenger
recreational computer forensics!@alecmuffett                          sex, lies and instant messenger
for teh lulz!@alecmuffett                   sex, lies and instant messenger
Things Geeks Do               • Enumerate all possible URLs:                • tinyurl                • bit.ly             ...
Things Geeks Do               • Trawl...                • Picasa                • Twitpic                • Yfrog          ...
Things Geeks Do               • buy hardware from Ebay                • undelete data files                 •   desktops  ...
Things Geeks Do               • buy phones from Ebay                • restore deleted SMS                • retrieve e-mail...
Find hardware in the street...@alecmuffett                         sex, lies and instant messenger
...investigate it...@alecmuffett                      sex, lies and instant messenger
...discover secrets.@alecmuffett                     sex, lies and instant messenger
Your challenge is to make that hard@alecmuffett                     sex, lies and instant messenger
3) what must you do/not do?@alecmuffett                       sex, lies and instant messenger
do use separate identities,                 do not link identities!@alecmuffett                        sex, lies and insta...
create a disposable identity,               start with an e-mail address@alecmuffett                         sex, lies and...
use a fake, boring,                common pseudonym               • good                • edward wilson                • c...
is this legal?               • probably breaking terms of service                • is it criminal to lie?                 ...
idea:               Use a disposable Gmail account               to set up a fake Yahoo account                        or ...
do not bookmark your secret identity@alecmuffett                     sex, lies and instant messenger
do use a random password               • never used before               • never use anywhere else               • keep th...
do not store the secret identity password      in your normal password manager!@alecmuffett                    sex, lies a...
do minimise data proliferation,                  do not leave footprints!@alecmuffett                          sex, lies a...
do not access your secret identity               from your normal phone@alecmuffett                       sex, lies and in...
iPhone               • All backed up by iTunes:                • SMS                • call logs                • geolocati...
Android               • basically ditto                • ...but backed up on Google instead@alecmuffett                   ...
Do not access your secret identity           using your normal laptop “login”@alecmuffett                       sex, lies ...
avoid intermingled filestore               put no pseudonym files               amongst personal files@alecmuffett        ...
set up different “users”               • keep sensitive files in one place                • ...hopefully                • ...
set up encrypted hard disks               resistant to post-Ebay forensics;                  do this prior to any usage@al...
use browsers which support          private browsing modes, and        which delete cookies/history on exit@alecmuffett   ...
Example workflow:@alecmuffett                  sex, lies and instant messenger
Chrome               “day-to-day”@alecmuffett                  sex, lies and instant messenger
Safari               • Guests and visitors               • Logging into a website without                 logging-out of F...
Firefox               • Ideal for...                •   porn                •   shagging                •   dubious e-mail...
technical reference@alecmuffett                    sex, lies and instant messenger
browser settings (1)               • clear cookies on exit               • clear history on exit               • dont acce...
browser settings (2)               • dont save form input               • dont save history               • switch off aut...
plugins / similar               • Flash Player                • Visit the security settings panel                • purge F...
Firefox extensions               • Tor                • better: Tor Browser Bundle               •SSL Everywhere          ...
Adium / Pidgin for IM               • use OTR encryption                • not the same as OTR in GoogleChat!              ...
remember:@alecmuffett               sex, lies and instant messenger
all this also applies to your phone@alecmuffett                        sex, lies and instant messenger
speaking of phones...@alecmuffett                     sex, lies and instant messenger
use a PAYG dumbphone               • pay cash (where possible)               • top-up with cash               • enable PIN...
use voice calls@alecmuffett                     sex, lies and instant messenger
do not leave voicemails@alecmuffett                      sex, lies and instant messenger
wipe your SMS messages regularly@alecmuffett                     sex, lies and instant messenger
dumbphone SMS               • lowest common denominator                • messages still logged on backend                 ...
if you must use smartphone               • do not link this phone to your usual                 Google Account@alecmuffett...
if you must use smartphone               • check out:                • WhatsApp                • TigerText                ...
finally...@alecmuffett                sex, lies and instant messenger
decommission old hardware               • computers                • DBAN - Darik’s Boot & Nuke                 • Free sui...
bottom lines               • the more copies of data exist                • the harder it is to remove them               ...
when mistakes happen...               • clean up calmly               • do not amplify the mistake@alecmuffett            ...
remember               • your lover has the same data                • but may not be taking care of it               • ed...
So why must you actually know all this?@alecmuffett                   sex, lies and instant messenger
Well...@alecmuffett             sex, lies and instant messenger
- shagging@alecmuffett                sex, lies and instant messenger
- journalists and sources@alecmuffett                       sex, lies and instant messenger
- employees and whistleblowers@alecmuffett                         sex, lies and instant messenger
- activists in repressive regimes@alecmuffett                           sex, lies and instant messenger
- good data hygiene@alecmuffett                   sex, lies and instant messenger
- separating work and home data/life@alecmuffett                    sex, lies and instant messenger
@alecmuffett   sex, lies and instant messenger
Future@alecmuffett            sex, lies and instant messenger
...?@alecmuffett          sex, lies and instant messenger
bonne chance@alecmuffett                  sex, lies and instant messenger
Upcoming SlideShare
Loading in …5
×

Sex, Lies & Instant Messenger v3

733 views

Published on

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
733
On SlideShare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
10
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Sex, Lies & Instant Messenger v3

  1. 1. sex, lies, & instant-messenger @alecmuffett www.alecmuffett.com green lane security www.greenlanesecurity.com v3.0@alecmuffett sex, lies and instant messenger
  2. 2. What should come of this?@alecmuffett sex, lies and instant messenger
  3. 3. When using the Web for private communication...@alecmuffett sex, lies and instant messenger
  4. 4. be aware 1) what can go wrong unexpectedly?@alecmuffett sex, lies and instant messenger
  5. 5. be aware 2) what risks you protecting against?@alecmuffett sex, lies and instant messenger
  6. 6. be aware 3) what must you do/not do?@alecmuffett sex, lies and instant messenger
  7. 7. Goal “Keep control of your data.”@alecmuffett sex, lies and instant messenger
  8. 8. disclaimer (1) Almost all examples appearing in this work are fictitious. Any resemblance to real events or to real persons, living or dead, is probably coincidental.@alecmuffett sex, lies and instant messenger
  9. 9. disclaimer (2) Advice given here is necessarily incomplete; information security is a huge discipline and a full set of risks cannot be conveyed in 30 minutes.@alecmuffett sex, lies and instant messenger
  10. 10. 1) what can go wrong unexpectedly?@alecmuffett sex, lies and instant messenger
  11. 11. passwords!@alecmuffett sex, lies and instant messenger
  12. 12. do not use secrets as passwords!@alecmuffett sex, lies and instant messenger
  13. 13. my history • Crack • First “smart” password cracker • 1991..96 • http://tinyurl.com/2jnzpy • CrackLib • password checking library • 1994..now@alecmuffett sex, lies and instant messenger
  14. 14. issue passwords are secret, but...@alecmuffett sex, lies and instant messenger
  15. 15. issue ...secrets make bad passwords@alecmuffett sex, lies and instant messenger
  16. 16. passwords guessable@alecmuffett sex, lies and instant messenger
  17. 17. 000000 1 1111 11111 111111 11111111 112233 123 123123 123321 1234 12345 123456 1234567 12345678 123456789 123abc 123qwe 1q2w3e 1q2w3e4r 222222 55555 654321 666666 7777 7777777 a aaaaaa abc123 adidas admin amanda andrew angel angel1 angels anthony apple asdf asdfasdf asdfgh ashley asshole austin baby bailey banana bandit baseball batman benjamin biteme blabla blahblah blessed blessing blink182 bubbles buster canada cassie charlie cheese chelsea chicken chris christ church cocacola compaq computer cookie cool corvette creative dakota dallas daniel danielle david destiny dexter diamond digital dragon eminem emmanuel enter faith flower foobar football football1 forever forum freedom friend friends fuckoff fuckyou fuckyou1 gateway genesis george ginger god google grace green guitar hahaha hallo hannah happy hardcore harley heaven hello hello1 helpme hockey hope hotdog hunter ilovegod iloveyou iloveyou! iloveyou1 iloveyou2 internet james jasmine jason jasper jennifer jessica jesus jesus1 john john316 jordan jordan23 joseph joshua junior justin killer kitten knight letmein london looking love lovely loving lucky maggie master matrix matthew maverick maxwell merlin michael michelle mickey microsoft mike monkey mother muffin mustang mylove myspace1 nathan nicole nintendo none nothing onelove online orange pass passw0rd password password1 peace peaches peanut pepper phpbb pokemon poop power praise prayer prince princess purple qazwsx qwert qwerty qwerty1 rachel rainbow red123 richard robert rotimi samantha sammy samuel saved scooby scooter secret shadow shalom silver single slayer smokey snoopy soccer soccer1 sparky spirit startrek starwars stella summer sunshine superman taylor test testing testtest thomas thunder tigger trinity trustno1 victory viper welcome whatever william winner wisdom zxcvbnm 250 top passwords - http://goo.gl/xPCq@alecmuffett sex, lies and instant messenger
  18. 18. “You’ll never guess my password, it’s in Klingon!”@alecmuffett sex, lies and instant messenger
  19. 19. @alecmuffett sex, lies and instant messenger
  20. 20. passwords brute-forceable@alecmuffett sex, lies and instant messenger
  21. 21. from: AAAA@alecmuffett sex, lies and instant messenger
  22. 22. to: zzzzzzzzzzzz@alecmuffett sex, lies and instant messenger
  23. 23. via: t5gn9LF$*RJ#@alecmuffett sex, lies and instant messenger
  24. 24. more than 1,000,000 guesses/second!@alecmuffett sex, lies and instant messenger
  25. 25. sometimes more than 9 billion guesses/second@alecmuffett sex, lies and instant messenger
  26. 26. google: imhoff password cracking hashcat performance@alecmuffett sex, lies and instant messenger
  27. 27. however...@alecmuffett sex, lies and instant messenger
  28. 28. password a window into your mind?@alecmuffett sex, lies and instant messenger
  29. 29. password reveals something about you?@alecmuffett sex, lies and instant messenger
  30. 30. password reflects your tastes?@alecmuffett sex, lies and instant messenger
  31. 31. password is known to your spouse?@alecmuffett sex, lies and instant messenger
  32. 32. also • reuse = self-incrimination • ...which is bad... • ...more later...@alecmuffett sex, lies and instant messenger
  33. 33. basic password discipline • use a password management tool • use 12/more random characters • use different passwords at each website • never reuse passwords • never share passwords • change annually/more often • change when someone discovers one!@alecmuffett sex, lies and instant messenger
  34. 34. next: instant messenger!@alecmuffett sex, lies and instant messenger
  35. 35. do not Skype IM with your lover!@alecmuffett sex, lies and instant messenger
  36. 36. Skype • peer to peer architecture • robust, replicated, flexible • excellent security • ...unless you’re up against the USA • ...or China • ...or maybe the UK@alecmuffett sex, lies and instant messenger
  37. 37. virtually impossible to expunge a recent conversation@alecmuffett sex, lies and instant messenger
  38. 38. deletion can make things worse messages resurrect from the dead!@alecmuffett sex, lies and instant messenger
  39. 39. (zombie data is not good)@alecmuffett sex, lies and instant messenger
  40. 40. Avoid XMPP with a lover... • Also called Jabber Protocol • Implementations: • GoogleChat • Some Facebook chat • Other systems@alecmuffett sex, lies and instant messenger
  41. 41. XMPP • Initial message is multicast • sent to all logged-in instances • eg: “hello sexy” • ...also arrives on the home PC • ...whilst you are at work@alecmuffett sex, lies and instant messenger
  42. 42. Other IM systems? • Not really wise... • AIM now multicast • YIM likewise • Go for something simple • Avoid specialist IM-client software • Use web-based systems@alecmuffett sex, lies and instant messenger
  43. 43. next: social media!@alecmuffett sex, lies and instant messenger
  44. 44. do not Twitter with your lover!@alecmuffett sex, lies and instant messenger
  45. 45. typos of doom!@alecmuffett sex, lies and instant messenger
  46. 46. D alice can i have you for dinner?@alecmuffett sex, lies and instant messenger
  47. 47. @alice can i have you for dinner?@alecmuffett sex, lies and instant messenger
  48. 48. ...and, worse...@alecmuffett sex, lies and instant messenger
  49. 49. D bob Nude! http://twitpic.com/b0gu5@alecmuffett sex, lies and instant messenger
  50. 50. Twitter App Risks • Third-party apps get access to DMs • Twitter clients... • Web Apps... • Proliferation of data is unwise • more backups • more caches • more access@alecmuffett sex, lies and instant messenger
  51. 51. do not Facebook your lover!@alecmuffett sex, lies and instant messenger
  52. 52. too easy to get wrong@alecmuffett sex, lies and instant messenger
  53. 53. Dropping Hints homepage displays with whom you communicate frequently@alecmuffett sex, lies and instant messenger
  54. 54. “Transitive trust” friends-of-friends may not be friends@alecmuffett sex, lies and instant messenger
  55. 55. Tommy Jordan! YouTube Video: Facebook Parenting: For the troubled teen@alecmuffett sex, lies and instant messenger
  56. 56. Facebook Software Ecology Facebook is not really Facebook@alecmuffett sex, lies and instant messenger
  57. 57. Analogy if you want to be private, don’t throw your diary into a pub full of gossips and journalists@alecmuffett sex, lies and instant messenger
  58. 58. next: phones!@alecmuffett sex, lies and instant messenger
  59. 59. do not smartphone with your lover!@alecmuffett sex, lies and instant messenger
  60. 60. massive comedy potential@alecmuffett sex, lies and instant messenger
  61. 61. iPhone screenlock@alecmuffett sex, lies and instant messenger
  62. 62. applications which pop-up alerts above the screenlock@alecmuffett sex, lies and instant messenger
  63. 63. Locked?@alecmuffett sex, lies and instant messenger
  64. 64. punchline:@alecmuffett sex, lies and instant messenger
  65. 65. Don’t combine this with Skype@alecmuffett sex, lies and instant messenger
  66. 66. do not go gaming with your lover!@alecmuffett sex, lies and instant messenger
  67. 67. MMORPGs • EQ • SecondLife • EVE Online • Warhammer • WoW • etc...@alecmuffett sex, lies and instant messenger
  68. 68. held to lower standard than IM@alecmuffett sex, lies and instant messenger
  69. 69. heavily-integrated software • game • webcam • voice • third party stuff • Ventrillo • Mumble • ...@alecmuffett sex, lies and instant messenger
  70. 70. game logs • logfiles are... • comprehensive • disparate • spattered all over the hard drive • ...and therefore hard to remove@alecmuffett sex, lies and instant messenger
  71. 71. next...@alecmuffett sex, lies and instant messenger
  72. 72. Geolocation can hurt you!@alecmuffett sex, lies and instant messenger
  73. 73. avoid sharing geolocation • Foursquare, Twitter, etc • “...but your Twitter messages said that you were in Essex?”@alecmuffett sex, lies and instant messenger
  74. 74. Do you have an in-car GPS? ...and do you know how to wipe it?@alecmuffett sex, lies and instant messenger
  75. 75. next, an obvious thing that’s often missed:@alecmuffett sex, lies and instant messenger
  76. 76. do not send porny naked pictures of yourselves, to each other@alecmuffett sex, lies and instant messenger
  77. 77. homebrew porn • webcam temporary copy • potentially restorable@alecmuffett sex, lies and instant messenger
  78. 78. homebrew porn • desktop copy • backup/time machine copy • image-management tool copy@alecmuffett sex, lies and instant messenger
  79. 79. homebrew porn • IM server copy • or: duplicate Skype transfers • plus: transfer logs@alecmuffett sex, lies and instant messenger
  80. 80. homebrew porn • remote copies • remote backup/time machine • remote image-management tool@alecmuffett sex, lies and instant messenger
  81. 81. homebrew porn • Took it with iPhone? • backed up to iTunes • backed up to iCloud?@alecmuffett sex, lies and instant messenger
  82. 82. homebrew porn • boyfriend’s archive copies • ...for sharing when you break up@alecmuffett sex, lies and instant messenger
  83. 83. do not use the family computer@alecmuffett sex, lies and instant messenger
  84. 84. there’s a reason it’s called a family computer@alecmuffett sex, lies and instant messenger
  85. 85. do not use work-related hardware@alecmuffett sex, lies and instant messenger
  86. 86. work hardware • not your machine • thus: “not your data” • may be taken from you • eg: bankruptcy, fired, updated • old hardware auctioned • automated backups? • network access logged?@alecmuffett sex, lies and instant messenger
  87. 87. summary@alecmuffett sex, lies and instant messenger
  88. 88. If you are going to live a double life then please do it right.@alecmuffett sex, lies and instant messenger
  89. 89. 2) what risks are you protecting against?@alecmuffett sex, lies and instant messenger
  90. 90. (apart from spouses and lawyers)@alecmuffett sex, lies and instant messenger
  91. 91. recreational computer forensics!@alecmuffett sex, lies and instant messenger
  92. 92. for teh lulz!@alecmuffett sex, lies and instant messenger
  93. 93. Things Geeks Do • Enumerate all possible URLs: • tinyurl • bit.ly • is.gd • t.co • ...and save the good ones@alecmuffett sex, lies and instant messenger
  94. 94. Things Geeks Do • Trawl... • Picasa • Twitpic • Yfrog • ...to much the same ends@alecmuffett sex, lies and instant messenger
  95. 95. Things Geeks Do • buy hardware from Ebay • undelete data files • desktops • laptops • printers (!) • storage • hard disks • thumb drives • SD cards@alecmuffett sex, lies and instant messenger
  96. 96. Things Geeks Do • buy phones from Ebay • restore deleted SMS • retrieve e-mail passwords@alecmuffett sex, lies and instant messenger
  97. 97. Find hardware in the street...@alecmuffett sex, lies and instant messenger
  98. 98. ...investigate it...@alecmuffett sex, lies and instant messenger
  99. 99. ...discover secrets.@alecmuffett sex, lies and instant messenger
  100. 100. Your challenge is to make that hard@alecmuffett sex, lies and instant messenger
  101. 101. 3) what must you do/not do?@alecmuffett sex, lies and instant messenger
  102. 102. do use separate identities, do not link identities!@alecmuffett sex, lies and instant messenger
  103. 103. create a disposable identity, start with an e-mail address@alecmuffett sex, lies and instant messenger
  104. 104. use a fake, boring, common pseudonym • good • edward wilson • carole smith • bad • sexxxy4UinBasingstoke • anything else that’s unique@alecmuffett sex, lies and instant messenger
  105. 105. is this legal? • probably breaking terms of service • is it criminal to lie? • maybe...@alecmuffett sex, lies and instant messenger
  106. 106. idea: Use a disposable Gmail account to set up a fake Yahoo account or vice-versa.@alecmuffett sex, lies and instant messenger
  107. 107. do not bookmark your secret identity@alecmuffett sex, lies and instant messenger
  108. 108. do use a random password • never used before • never use anywhere else • keep the password in your brain@alecmuffett sex, lies and instant messenger
  109. 109. do not store the secret identity password in your normal password manager!@alecmuffett sex, lies and instant messenger
  110. 110. do minimise data proliferation, do not leave footprints!@alecmuffett sex, lies and instant messenger
  111. 111. do not access your secret identity from your normal phone@alecmuffett sex, lies and instant messenger
  112. 112. iPhone • All backed up by iTunes: • SMS • call logs • geolocation (see recent press) • ...possibly password protected • You’re using a different password, yes?@alecmuffett sex, lies and instant messenger
  113. 113. Android • basically ditto • ...but backed up on Google instead@alecmuffett sex, lies and instant messenger
  114. 114. Do not access your secret identity using your normal laptop “login”@alecmuffett sex, lies and instant messenger
  115. 115. avoid intermingled filestore put no pseudonym files amongst personal files@alecmuffett sex, lies and instant messenger
  116. 116. set up different “users” • keep sensitive files in one place • ...hopefully • ...mostly • ...except for logs@alecmuffett sex, lies and instant messenger
  117. 117. set up encrypted hard disks resistant to post-Ebay forensics; do this prior to any usage@alecmuffett sex, lies and instant messenger
  118. 118. use browsers which support private browsing modes, and which delete cookies/history on exit@alecmuffett sex, lies and instant messenger
  119. 119. Example workflow:@alecmuffett sex, lies and instant messenger
  120. 120. Chrome “day-to-day”@alecmuffett sex, lies and instant messenger
  121. 121. Safari • Guests and visitors • Logging into a website without logging-out of Facebook first@alecmuffett sex, lies and instant messenger
  122. 122. Firefox • Ideal for... • porn • shagging • dubious e-mail links • security malware research@alecmuffett sex, lies and instant messenger
  123. 123. technical reference@alecmuffett sex, lies and instant messenger
  124. 124. browser settings (1) • clear cookies on exit • clear history on exit • dont accept 3rd-party cookies • block popups@alecmuffett sex, lies and instant messenger
  125. 125. browser settings (2) • dont save form input • dont save history • switch off autosuggest • set to private browser mode • ...permanently, if possible • else auto/delete cookies on exit@alecmuffett sex, lies and instant messenger
  126. 126. plugins / similar • Flash Player • Visit the security settings panel • purge Flash cookies and sites • set Flash db size to zero • HTML5 settings • set HTML5 db size to zero • watch for other/new issues@alecmuffett sex, lies and instant messenger
  127. 127. Firefox extensions • Tor • better: Tor Browser Bundle •SSL Everywhere •NoScript •RequestPolicy •AdBlock Plus •Ghostery@alecmuffett sex, lies and instant messenger
  128. 128. Adium / Pidgin for IM • use OTR encryption • not the same as OTR in GoogleChat! • solves the point-to-point chat issue • beware local logfiles@alecmuffett sex, lies and instant messenger
  129. 129. remember:@alecmuffett sex, lies and instant messenger
  130. 130. all this also applies to your phone@alecmuffett sex, lies and instant messenger
  131. 131. speaking of phones...@alecmuffett sex, lies and instant messenger
  132. 132. use a PAYG dumbphone • pay cash (where possible) • top-up with cash • enable PIN lock • avoid ... • paper billing • web integration@alecmuffett sex, lies and instant messenger
  133. 133. use voice calls@alecmuffett sex, lies and instant messenger
  134. 134. do not leave voicemails@alecmuffett sex, lies and instant messenger
  135. 135. wipe your SMS messages regularly@alecmuffett sex, lies and instant messenger
  136. 136. dumbphone SMS • lowest common denominator • messages still logged on backend • but overall exposure is less@alecmuffett sex, lies and instant messenger
  137. 137. if you must use smartphone • do not link this phone to your usual Google Account@alecmuffett sex, lies and instant messenger
  138. 138. if you must use smartphone • check out: • WhatsApp • TigerText • ...other SMS replacements • take time to understand how they work@alecmuffett sex, lies and instant messenger
  139. 139. finally...@alecmuffett sex, lies and instant messenger
  140. 140. decommission old hardware • computers • DBAN - Darik’s Boot & Nuke • Free suicide pill / CDROM for PCs • phones • Remove SIM • SMS may be on SIM as well as phone! • Check whether factory reset actually works • if not, smash it & drive a car over it repeatedly@alecmuffett sex, lies and instant messenger
  141. 141. bottom lines • the more copies of data exist • the harder it is to remove them • when data escapes your control • its available forever@alecmuffett sex, lies and instant messenger
  142. 142. when mistakes happen... • clean up calmly • do not amplify the mistake@alecmuffett sex, lies and instant messenger
  143. 143. remember • your lover has the same data • but may not be taking care of it • educate them gently • his/her systems will also one day be sold on eBay@alecmuffett sex, lies and instant messenger
  144. 144. So why must you actually know all this?@alecmuffett sex, lies and instant messenger
  145. 145. Well...@alecmuffett sex, lies and instant messenger
  146. 146. - shagging@alecmuffett sex, lies and instant messenger
  147. 147. - journalists and sources@alecmuffett sex, lies and instant messenger
  148. 148. - employees and whistleblowers@alecmuffett sex, lies and instant messenger
  149. 149. - activists in repressive regimes@alecmuffett sex, lies and instant messenger
  150. 150. - good data hygiene@alecmuffett sex, lies and instant messenger
  151. 151. - separating work and home data/life@alecmuffett sex, lies and instant messenger
  152. 152. @alecmuffett sex, lies and instant messenger
  153. 153. Future@alecmuffett sex, lies and instant messenger
  154. 154. ...?@alecmuffett sex, lies and instant messenger
  155. 155. bonne chance@alecmuffett sex, lies and instant messenger

×