Today the FCC is voting to remove rules for Internet Neutrality that were adopted February 26, 2015. Removing these rules would allow the few Internet Service Providers (ISP) to manipulate your Internet traffic as they see fit. Comcast was found to be throttling BitTorrent traffic in 2011 and did not stop until the current rules were adopted. I applauded these new rules in this blog in 2015. Now the FCC wants to remove these rules and allow ISPs to treat us however they want with few alternatives for consumers.
Imagine if the government removed all the NFL rules and football games were played with no rules. How would you know the score? There would be no penalties and fans could jump on the the field (what’s a field) and run away with the ball (we don’t need a ball). Crazy, right! To let ISP make the rules and not tell anyone (both Comcast and CenturyLink did this with data download limits) will make consumers confused, frustrated and angry with no where to turn for help.
The FCC is suppose to help U.S. citizens, not delivery us to corporations for their profit. Comcast and CenturyLink did not invent the Internet, the U.S. government did with citizen funding, so we invented it, we want rules to protect the Internet’s democratization and our use of it. If the current administration cannot work for us, we need to find a way to do it ourselves.
It maybe to late to comment on the action, but give it a try at the FCC web site.
The Founding Fathers created the Bill of Rights to protect citizens’ rights including the Fourth Amendment (Amendment IV) to the United States Constitution that states:
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
Today the Trump Administration has given your personal information to the cable and telephone industry so they can sell your data and increase their already high profits. Now they can join the new growth industry in the United States of selling citizens data for profit. And I bet these business will not share it with you.
The U.S. government has demanding that Apple create a way for the FBI to break the encryption of an iPhone while at the same time persecuting U.S. citizens for invading the government’s secret information.
We all have secrets. Many people profess to being an open book, until their wife or husband finds out they are on Ashley Madison. The U.S. government stated many times the Patriot Act was not being used to spy on American citizens.
Privacy is good for all of us. It is also good for a limited time for our government in order to prevent tipping off criminals and enemies of the state. But intentionally weakening encryption schemes and eliminating privacy protections will provide limited benefit with widespread and long lasting harm.
Accessing a web site sends information back and forth as you access pages and click on links. This data travels through numerous computers on its way to the web site’s server and to your computer. This varies depending on your Internet provider and the provider of the web site. Recently, I traced my access to this site and counted 13 computers passing my data, to and fro. And I only control one of them. Many more people have access to these 13 computers and their connections.
The Hypertext Transfer Protocol (HTTP) is the foundation of data communication for the World Wide Web. HTTP Secure (HTTPS) provides authentication of the website and associated web server and provides bidirectional encryption of communications between a client and server, which protects against eavesdropping and tampering with or forging the contents of the communication. In practice, this provides a reasonable guarantee that one is communicating with the website and ensuring that the contents of communications between the user and site cannot be read or forged by any third party.
HTTPS is especially important over insecure networks (such as public WiFi access points), as anyone on the same local network can packet sniff and discover sensitive information (user name, password, etc.) not protected by HTTPS.
The security of HTTPS is that of the added Transport Layer Security (TLS) protocol, which uses public key encryption to generate a session key which is then used to encrypt the data flow between client and server. To validate public keys, certificate authorities (CA) and public key certificates are necessary to verify the relation between the certificate and its owner, as well as to generate, sign, and administer the validity of certificates. Certificate authorities are trusted by web browser creators to provide valid certificates. The top three certificate authorities, in 2016, issued over 75% of all certificates in use.
- Comodo CA – certificates for $63.95 to $809.10/year.
- Symantec Corp. – $399.00/year.
- GoDaddy – $62.99 to $269.99/year.
As of April 5, 2016, 41.7% of the Internet’s 141,160 most popular websites have a secure implementation of HTTPS. That adds up to a lot of revenue for CAs using standard protocols and freely available software. The certificate costs are only a few cents to generate a certificate and a few dollars to administer. That makes selling TLS certificates one of the biggest cash cows in the world. All the certificates are exactly the same! Otherwise they would not work in our browsers. The only difference in certificates is marketing hype. Even Comodo CA sells cheaper certificates for $9.00/year through their PositiveSSL brand.
Now there are free certificates available issued by Let’s Encrypt certificate authority sponsored by Cisco, Hewlett Packard Enterprise, mozilla, and facebook among others. These certificates work the same as the certificates costing much more. You can verify this using Qualys SSL Labs’ SSL Server Test for this site which uses a Let’s Encrypt certificate.
There seems to be a trend in web security that requires that you type your password, no pasting allowed!
This combined with other password “requirements” are creating problems for people like me that use very secure long passwords. That means I use a password safe that generates long random strings of letters and numbers like:
BTW, this password is random and not used by me, anywhere!
So when I sign up for a site that does not allow pasting my really secure password, but requires that I type it manually, I end up with passwords like:
Making my password much less secure. Also most sites use the “onpaste=return false;” trick. This only stops the stupid people, as 5-15 minutes with a Greasemonkey script will defeat that “security” feature. So let’s not think that every idea about password security is a good idea.
Even the following idea is probably not that secure given that password crackers use dictionaries that contain the words: correct, horse, battery, and staple.
Another annoyance is sites that do not tell me what the maximum length is for a password on their site. Almost no one tells you this even though they tell you, you must enter at least 8 characters, using letter and numbers…. Since I have had several sites truncate my password, without error or warning, I now have to look at the HTML source code to see if a hint is there.
So here is some password advice for web-site developers and their customers.
- Do tell us the minimum and maximum lengths, characters allowed (numbers, letters, symbols, etc.). Make the maximum something like 255, to allow secure passwords and phrases.
- Do use a hashing algorithm to store passwords for you password protected applications. This also allows for very long passwords, but fixes the hash value length that you need to store to authenticate your users. A really useful function is the Unix crypt() library function that is implemented in numerous languages including C, Perl, PHP, Python, and Ruby.
- Do use standard HTML for accepting passwords for compatibility with more devices.
- Do not disable pasting which causes users to create weaker passwords.
- Do not store passwords in plain text on any system. For clients, use a password safe program to generate and store passwords. For applications and servers, use a strong hashing algorithm to store and compare passwords.
- Do not reuse passwords for multiple sites.
For more advice on password security:
Today my Junk folder filled up and would not accept anymore messages! 39,019 junk/spam email messages since January 1, 2015 and that is just the blatantly junk messages. I receive many more messages from organizations that I have contact with that can “legally” send me emails from their push marketing campaigns. Guess what? I do not read most of these emails and if I do I will be less likely to do business with your organization! Sending me an email every other day will not cause me to buy your product more often. In fact, the opposite will happen and I will buy less or none at all! Selecting the “Do Not Email” preference does not seem to work with most organizations.
Barracuda Central reports that of 440,517,446 emails received 10/15/2015, by networks that use their products, only 62,534,611 (14.2%) are legitimate emails and 371,958,217 (84.44%) are spam!
The Economist reports:
[spam] is also bad for the environment. According to a report from an environmental consultancy, ICF International, commissioned by McAfee, a computer-security company, some 62 trillion unsolicited e-mails were sent in 2008, using 33 terawatt hours of electricity. That is equivalent to the energy consumed by 1.5m American homes or 3.1m cars over a year. If generated by coal-fired power stations it would release 17m tonnes of carbon dioxide, some 0.2% of global emissions of this greenhouse gas.
We need to find ways of securing the Internet email systems to prevent the overwhelming deluge of spam email. And now I receive junk texts! We need to act now before these good technologies become worthless for real communication.
Today the FCC adopted new rules for governing the Internet in the United States. These rules will protect and insure a open and neutral Internet. The FCC’s Open Internet Order contains the following rules.
- No Blocking;
- No Throttling;
- No Paid Prioritization;
- Standard for Future Conduct;
- Greater Transparency;
- Reasonable Network Management;
- Reclassification of broadband Internet access service as a telecommunications service under Title II;
- Major Provisions of Title II that the Order WILL APPLY:
- No unjust or unreasonable practices or discrimination,
- Allows investigation of consumer complaints,
- Protects consumer privacy,
- Ensures fair access to poles and conduits by providers,
- Protects people with disabilities,
- Bolsters universal service fund support for broadband service in the future.
You can read the entire FCC statement at http://www.fcc.gov/document/fcc-adopts-strong-sustainable-rules-protect-open-internet or a PDF version here.
I usually do not make New Year’s resolutions because I mostly forget them by the Super Bowl. But this year I am getting my online life more secure.
- I will change all my passwords to 20+ random characters.
- I will store these passwords in a secure format.
- I will encrypt more email.
The first 2 are pretty easy since I have used a password safe program for many years. When the Heartbleed web security bug hit, I changed many passwords and upgraded to 20+ character length passwords in the process.
The third resolution will be more difficult! Sending an encrypted email to someone requires setting up both the sender and the receiver with software and cryptographic keys. The “easiest” setup seems to be using Thunderbird with Enigmail add-on with versions available for Linux, Mac OS X, and Windows. Now I just need to convince someone else to do it.
So declared Brian Dye, Symantec’s senior vice president for information security. “We don’t think of antivirus as a moneymaker in any way.” Mr. Dye went on to say “antivirus now catches just 45% of cyberattacks.”
So because they cannot make money, this segment of the software industry is dead? Maybe they are not any good at it! Or maybe it is the wrong solution to the problem. Or maybe it is too narrow of a solution.
I believe that this problem can only be dealt with effectively at the operating system level. But the stage was set by Microsoft years ago when they allowed third party companies to deal with the problem of poor security on Microsoft Windows. But that is just like plugging holes in a leaking boat, it just slows down the problem.
Microsoft has made feeble attempts to increase security on Windows® with equally feeble results. A code-signing mechanism was introduced in Windows called Authenticode, but even Microsoft does not use this technology to protect the integrity of all of its software. Microsoft finally added a firewall application, in a usable form, to the Windows operating system in 2004.
The problem of malicious access and modification of computer systems needs to be dealt with at the lowest levels and with a variety of methods. Intrusion prevention and intrusion detection software are both needed to prevent system attacks. Many intrusion prevention solutions exist in the form of stand-alone systems like routers and applications that can be installed on end-user systems. For Linux systems numerous intrusion detection applications can be found such as AIDE and Tripwire. There is even an cross-platform, open-source application called OSSEC that runs on Windows based systems.
Some of these solutions are not the “next big thing” required by most “for profit” companies. So many solutions will come from the open-source community.
If you are using Microsoft Internet Explorer (IE), there are hackers actively using a software bug to gain control of Microsoft Windows computers. Stop using IE now! This is twice as dangerous as the Heartbleed Bug because an attacker can take control of your computer and do whatever they want with it.
US-CERT issued an alert about the active exploitation of a use-after-free vulnerability in Microsoft Internet Explorer. This vulnerability affects IE versions 6 through 11 and allows a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
US-CERT recommends that users and administrators review Microsoft Security Advisory 2963983 for mitigation actions and workarounds. If you are still using Windows XP, Microsoft will not provide updates or solutions and you should consider installing and using an alternate browser such as Mozilla Firefox (free) or Google Chrome (free).
For more details, please see VU#222929 and FireEye’s Blog entry.
That about covers the risks. Now what can you do about it? First, update your computer (Windows, Mac OS X or Linux/Unix), right now! Before you read the rest of this post.
Most software vendors/service providers recognized the serious nature of this bug and updated their software (the easy part). So getting the fix is usually easy. The biggest problem is trying to determine if your information has been compromised. You can’t! Attacks leave no trace or very little on the computers that gave up their private secrets. This bug has been out in the wild for 2 years! Maybe nobody found it and took advantage OR somebody did and has all our passwords. N.S.A is that you? The actual risk is probably somewhere in between those extremes.
Most security experts are recommending that we change all our passwords and replace all of our SSL certificates. At the very least change your password on you bank account log-in, but you probably don’t need to change your Facebook password (everybody has all that info). And definitely change your password if you use one password for everything. Yea, it is hard to remember all of them, but you can let your computer do the remembering. Start using a password safe like KeePass or KeePassX to create and store long secure password using one password, that you have to remember, to save them on your system in an encrypted file.
More info about Heartbleed Bug: