Open thread: smartphone security

There are masses of important recent news stories on the topic of smartphone security. I have been filing them below posts like this one, this one, and this one, but they really deserve a spot of their own.

First news story: Micro Systemation makes software that allows people to bypass the 4-digit lock code on an iPhone in seconds. This could be important for people crossing borders, people who get arrested at political protests, etc.

Using rsync to backup local folders to DreamHost’s backup accounts

One awesome thing about DreamHost is that they provide all hosting customers with 50GB of free online backup space. It can be accessed using ftp, sftp, and rsync.

I am trying to use it to make a backup of my USB key. I am always moving between computers, so documents that I am actively working on tend to follow me on the key. Having a backup would be useful in case it got lost or damaged.

I am trying to figure out what the correct terminal command would be to synchronize a folder from Mac OS X to DreamHost using rsync. I think it should be something like:

rsync -aP --protocol=29 /Volumes/USBKEYNAME/* BACKUPUSERACCOUNT@BACKUPUSERSERVER.dreamhost.com::keybackup

Is that right? If any rsync gurus are out there, I would really appreciate their input on what options and syntax to use.

The Starbucks archipelago

For a person on the move, the world’s countless Starbucks locations provide a lot of very useful infrastructure. They provide caffeine, wireless internet access (even at night when they are closed), a place to sit, bathrooms, electrical outlets, and tolerable food. Their bagels with cream cheese are affordable, reasonably filling, and not spectacularly unhealthy when consumed in moderation.

Starbucks has been key for me on a great many trips. For instance, when I was in Washington D.C. photographing the Keystone XL protests. It is especially useful and important when I am traveling somewhere where Fido’s data roaming rates are evil. I can orient myself with Google Maps, make calls with Skype, check email, upload images to Flickr, and update websites all through the glory of Starbucks WiFi – and all while keeping my iPhone safely in ‘airplane mode’. And it can all be done with the accompaniment of a half-litre of highly caffeinated brew.

In Oxford, Starbucks locations were part of my meandering reading system. I generally can’t just sit in one place for hours and pay attention to the documents in front of me. I do much better when moving periodically from place to place: from one library to another to a Starbucks and on to a different library. If I do start a PhD, I will probably resume similarly peripatetic habits when dealing with large volumes of reading material.

Just as coaling stations were once essential support infrastructure for coal-fired ocean-going ships, the vast scattering of near-identical Starbucks locations around the world provide the necessities of life for those away from home everywhere. If they just added some coffin hotel style sleeping berths, there would be no real need to rely on any other businesses when visiting a strange city.

Ubiquitous surveillance

We now live in a world where it is highly likely that various web companies, your government, and your internet service provider are tracking your web browsing. Where facial recognition software identifies you at borders, airports, and subway stations. Where your DNA may be sampled if you are arrested. Where new face tracking software gets used with old photo archives and video camera footage. Where data on what you buy and how you repay your debts is sold between companies. Where cameras track your automobile license plate to build up a database of your movements. Where drones may watch you from the sky. Where computers transcribe your speech and handwriting into searchable text. Where you can be identified at a distance by the cards in your wallet. Where your emails, phone calls, and text messages are scanned for keywords, archived forever, and used to build up webs of your known associates. Where governments and private organizations use data mining techniques against you. Where your cell phone can easily be turned into a bug that passes on what you say and type, as well as where you are. Where your Google searches may be used as evidence against you. Where anyone can listen to your cell phone calls. Where the metadata in the photos and videos you make identifies you. Where the DNA of your family members may be used to incriminate you. Where anyone on your wireless network can archive and access all your web traffic, as well as steal website sessions. Where no encryption software you can acquire does much good. Where insecure means of communication are marketed as secure. Where archives containing your sensitive personal data can be broken into (or bought) by those who wish to cause you trouble. And where anything ill-considered you did as a teenager may re-emerge to cause embarrassment or worse decades later.

The appropriate responses to this are not clear. You can simply accept that your life is an open book that anyone who cares to can pretty easily read from. You can opt out of some services (like Facebook) and employ some available countermeasures. You can move to the remote countryside and become a technology-shunning subsistence farmer (which is not to imply that all farmers shun technology, nor manage only to subsist). You can try to drive legislative, regulatory, and technological changes that address some of the issues above. What else can you do?

Hillis Plot on a 13″ MacBook Pro

The Hillis Plot is a beautiful way of displaying the common ancestry of all life on Earth. The Hillis and Bull Lab at the University of Texas has several images of the plot on their website. Included among them is a PDF version with effectively infinite resolution which they say is free for “non-commercial, educational purposes”. The relationships between life forms shown in this plot were determined using rRNA sequences.

In Cambridge, Massachusetts there is a shop called danger!awesome that burns patterns onto materials like wood, metal, and plastic using powerful CO2 infrared lasers.

The PDF of the Hillis Plot is not ideal for burning into an Apple laptop because the circle in the middle is too small. It would go underneath the translucent Apple logo. Thankfully, a very helpful employee named Jesse Ashcraft-Johnson was willing to custom-modify the file so that it would fit around the logo. He also tweaked the text so the whole thing would fit well on the back of my 13″ MacBook Pro. He was also willing to run the laser for more than 30 minutes, and run it in a vector mode where the beam traced each of the lines of descent in the plot. The final result looks awesome.

Media:

danger!awesome is located at 10 Prospect Street. Their phone number is 617-714-5829 and they can be emailed at info@dangerawesome.co

Fun fact: the laser cutters at danger!awesome were first used to burn an animation into pieces of toast for an OK Go video: Last Leaf.

Googling the Cyborg

In his engaging essay “Googling the Cyborg”, William Gibson effectively argues that the expectation that ‘the cyborg’ will be a human being with an electronic eye and a robot arm is mistaken. The cyborg – he argues – exists in the physical interactions between human beings and machines: “The electrons streaming into a child’s eye from the screen of the wooden television are as physical as anything else. As physical as the neurons subsequently moving along that child’s optic nerve”. (The terminology there is strangely incorrect. Cathode ray tube televisions emit photons, which are produced when the electrons fired from the back of the vacuum tube hit a phosphor screen – and the optic nerve is made of neurons, it isn’t a channel that conveys them. No matter.)

Gibson argues that the cyborg is the “extended communal nervous system” that humanity has grown for itself, with all these sensors and processors and network connections.

He also argues that there is a short-changing that occurs, when we deny that the humans who are behind machines are using them as true extensions of their own being. In the context of remote-controlled rovers on Mars, he says:

Martian jet lag. That’s what you get when you operate one of those little Radio Shack wagon/probes from a comfortable seat back at an airbase in California. Literally. Those operators were the first humans to experience Martian jet lag. In my sense of things, we should know their names: first humans on the Red Planet. Robbed of recognition by that same old school of human literalism.

Gibson, William. Distrust that Particular Flavor. p.251 (hardcover)

I am not sure what should be counted as the first cyborg on Mars. Specifically, did it need to be able to move on human command? Or is moving camera shutters enough to count? In any case, hardly anyone knows the name of the person who was controlling it when it first activated on the Martian surface.

Twitter grabbing address books from phones

Here’s an example of what I mean about the internet creating all sorts of new security vulnerabilities. Twitter has recently confessed to grabbing entire address books from the smartphones of people using the service.

As well as being a violation of privacy, this is a practice that could seriously endanger people. Consider all those brave protestors in Egypt and other Middle Eastern countries, using Twitter to help organize a pro-democracy movement. If Twitter is grabbing their address books, it is assembling a perfect tool for the intelligence services of governments to round up everyone involved in protests. The same is true for people pressing for democracy in China, or doing anything else that is laudable but unpopular with the people in charge.

Technology companies need to recognize that there will be people who want to use their records and capabilities for nefarious purposes, and they need to design their technology and procedures to protect against such attacks and reduce how serious they are when they take place.

The companies that make operating systems for smartphones should also assume that applications can be ineptly designed or malicious, and should work to protect the data on the phone from potential eavesdroppers.

Internet surveillance in Canada

The Conservative government is proposing a new law that would require internet service providers to monitor and record what Canadians do online, and to provide that information to the authorities without a warrant.

As well as being an obvious violation of the Charter of Rights and Freedoms (§8 “Everyone has the right to be secure against unreasonable search or seizure.”), I think this is an example of thinking badly about security. Obviously, having the government monitor everything that happens online could prevent some bad things from happening. At the same time, it is virtually certain that the capability would be abused or that security breaches will allow it to be hijacked by those with nefarious purposes. The abuse could happen at the governmental level – say, with discreet inquiries being made into the private correspondence of members of competing political parties. It could be done within the police and intelligence services – say, a jilted ex tracking the emails of their former partner. It could be done within internet service providers – say, some low-paid tech at Bell or Telus deciding to earn a bit of extra cash by blackmailing customers.

The archives of internet use would be an irresistible target for malefactors of every type, from nosy bosses and spouses to spammers and rogue political operatives. Maintaining and trying to secure these archives would also be a major burden for internet service providers. Instead of being in the business of helping their clients communicate, they will be forced into the business of keeping tabs on their clients on behalf of the government.

The security risks created by internet surveillance are greater than the risks that it might help reduce. Furthermore, allowing the creation of internet surveillance systems violates the Charter-protected rights of Canadians. What Canadians do online is their private business. It is not something that governments have the right to monitor, just because doing so will occasionally allow them to catch people committing crimes. Hopefully, this proposal will never become law.