For my Ethical Hackers. Reads like an April Fools joke, but remember that few users know how their browsers work. Also, we should look for some place that lists the world's “Opt Outs,” because no one seems to be doing it. Business opportunity?

Meet the Online Tracking Device That is Virtually Impossible to Block

by Julia Angwin ProPublica, July 21, 2014, 9 a.m. This story was co-published with Mashable.

A new, extremely persistent type of online tracking is shadowing visitors to thousands of top websites, from WhiteHouse.gov to YouPorn.com.

First documented in a forthcoming paper by researchers at Princeton University and KU Leuven University in Belgium, this type of tracking, called canvas fingerprinting, works by instructing the visitor’s Web browser to draw a hidden image. Because each computer draws the image slightly differently, the images can be used to assign each user’s device a number that uniquely identifies it.

Like other tracking tools, canvas fingerprints are used to build profiles of users based on the websites they visit profiles that shape which ads, news articles, or other types of content are displayed to them.

But fingerprints are unusually hard to block: They can’t be prevented by using standard Web browser privacy settings or using anti-tracking tools such as AdBlock Plus.

The researchers found canvas fingerprinting computer code, primarily written by a company called AddThis, on 5 percent of the top 100,000 websites. Most of the code was on websites that use AddThis’ social media sharing tools. Other fingerprinters include the German digital marketer Ligatus and the Canadian dating site Plentyoffish. (A list of all the websites on which researchers found the code is here).

Rich Harris, chief executive of AddThis, said that the company began testing canvas fingerprinting earlier this year as a possible way to replace “cookies,” the traditional way that users are tracked, via text files installed on their computers.

“We’re looking for a cookie alternative,” Harris said in an interview.

Harris said the company considered the privacy implications of canvas fingerprinting before launching the test, but decided “this is well within the rules and regulations and laws and policies that we have.”

He added that the company has only used the data collected from canvas fingerprints for internal research and development. The company won’t use the data for ad targeting or personalization if users install the AddThis opt-out cookie on their computers, he said.

Arvind Narayanan, the computer science professor who led the Princeton research team, countered that forcing users to take AddThis at its word about how their data will be used, is “not the best privacy assurance.”

Device fingerprints rely on the fact that every computer is slightly different: Each contains different fonts, different software, different clock settings and other distinctive features. Computers automatically broadcast some of their attributes when they connect to another computer over the Internet.

Tracking companies have long sought to use those differences to uniquely identify devices for online advertising purposes, particularly as Web users are increasingly using ad-blocking software and deleting cookies.

In May 2012, researchers at the University of California, San Diego, noticed that a Web programming feature called “canvas” could allow for a new type of fingerprint by pulling in different attributes than a typical device fingerprint.

In June, the Tor Project added a feature to its privacy-protecting Web browser to notify users when a website attempts to use the canvas feature and sends a blank canvas image. But other Web browsers did not add notifications for canvas fingerprinting.

A year later, Russian programmer Valentin Vasilyev noticed the study and added a canvas feature to freely available fingerprint code that he had posted on the Internet. The code was immediately popular.

But Vasilyev said that the company he was working for at the time decided against using the fingerprint technology. “We collected several million fingerprints but we decided against using them because accuracy was 90 percent,” he said, “and many of our customers were on mobile and the fingerprinting doesn’t work well on mobile.”

Vasilyev added that he wasn’t worried about the privacy concerns of fingerprinting. “The fingerprint itself is a number which in no way is related to a personality,” he said.

AddThis improved upon Vasilyev’s code by adding new tests and using the canvas to draw a pangram “Cwm fjordbank glyphs vext quiz” a sentence that uses every letter of the alphabet at least once. This allows the company to capture slight variations in how each letter is displayed.

AddThis said it rolled out the feature to a small portion of the 13 million websites on which its technology appears, but is considering ending its test soon. “It’s not uniquely identifying enough,” Harris said.

AddThis did not notify the websites on which the code was placed because “we conduct R&D projects in live environments to get the best results from testing,” according to a spokeswoman.

She added that the company does not use any of the data it collects whether from canvas fingerprints or traditional cookie-based tracking from government websites including WhiteHouse.gov for ad targeting or personalization.

The company offered no such assurances about data it routinely collects from visitors to other sites, such as YouPorn.com. YouPorn.com did not respond to inquiries from ProPublica about whether it was aware of AddThis’ test of canvas fingerprinting on its website.

(Related) Is this the solution to all our security concerns? (Students who answered “Yes” will be shot!)

http://www.bespacific.com/stop-sneaky-online-tracking-effs-privacy-badger/?utm_source=rss&utm_medium=rss&utm_campaign=stop-sneaky-online-tracking-effs-privacy-badger

Stop Sneaky Online Tracking with EFF’s Privacy Badger

by Sabrina I. Pacifici on Jul 21, 2014

“The Electronic Frontier Foundation (EFF) has released a beta version of Privacy Badger, a browser extension for Firefox and Chrome that detects and blocks online advertising and other embedded content that tracks you without your permission. Privacy Badger was launched in an alpha version less than three months ago, and already more than 150,000 users have installed the extension. Today’s beta release includes a feature that automatically limits the tracking function of social media widgets, like the Facebook “Like” button, replacing them with a stand-in version that allows you to “like” something but prevents the social media tool from tracking your reading habits. “Widgets that say ‘Like this page on Facebook’ or ‘Tweet this’ often allow those companies to see what webpages you are visiting, even if you never click the widget’s button,” said EFF Technology Projects Director Peter Eckersley. “The Privacy Badger alpha would detect that, and block those widgets outright. But now Privacy Badger’s beta version has gotten smarter: it can block the tracking while still giving you the option to see and click on those buttons if you so choose.” EFF created Privacy Badger to fight intrusive and objectionable practices in the online advertising industry. Merely visiting a website with certain kinds of embedded images, scripts, or advertising can open the door to a third-party tracker, which can then collect a record of the page you are visiting and merge that with a database of what you did beforehand and afterward. If Privacy Badger spots a tracker following you without your permission, it will either block all content from that tracker or screen out the tracking cookies.”

Since when has, “I prefer to be ignorant” been a hallmark of senior management?

http://www.securityweek.com/survey-highlights-communications-levels-between-security-pros-and-executives

Survey Highlights Communications Levels Between Security Pros and Executives

According to a survey of nearly 5,000 IT security professionals around the globe, 31 percent of cyber-security teams never speak with their executive team about cyber-security. Of those that did, 23 percent did so annually. Only one percent spoke to executives weekly, while 11 percent did so quarterly.

… Fifty-two percent said their companies do not provide cyber-security education to their employees, and only four percent plan to do so in the next 12 months. Only 38 percent believe their company is investing enough in personnel and technologies to be effective in executing its cyber-security objectives.

… A complete copy of the report, including survey methodology, consolidated results and individual response rates by country can be read here.

This could be amusing... My Computer Security students know that you should never allow “backdoors” into your secure ecosystem. You never know who might be hitching a ride,

http://www.makeuseof.com/tag/apple-spying-facebook-launches-pocket-rival-tech-news-digest/

Security Researcher Finds iPhone Backdoor

A security researcher by the name of Jonathan Zdziarski claims to have found backdoors built into every iOS device. The accusation is that Apple put these access points in on purpose along with undocumented services designed to allow encrypted data to be retrieved at will.

Zdziarski also claims these services are always running in the background potentially leaking data, and that switching off your iPhone or iPad is the only way of securing that data. He suggests, rather ironically, that Apple has made progress in securing iOS against typical attacks while ensuring the company itself can easily access the 600 million iOS devices currently in the wild.

Apple has responded to the claims, actually admitting the existence of the backdoor. However, it denies it has anything to do with “any government agency” maintaining it is solely used by “IT departments, developers and Apple for troubleshooting technical issues.” We’re not sure if that makes it OK, but you can make your own minds up.

EU rules, French rules, German rules, Italian rules – Google has to Google the rules it operates under.

http://www.zdnet.com/google-gets-18-month-deadline-to-overhaul-data-handling-in-italy-7000031862/

Google gets 18-month deadline to overhaul data handling in Italy

The relationship between Google and Italy hasn't always been an easy one.

… Now it's the turn of Italy's data protection authority, the Garante della protezione dei dati personali, to tackle the company. Yesterday, the data watchdog brought in new regulations that will force the Mountain View-based company to change its data handling practices.

Google will have to alter the way it informs users how their data is being collected, ask for prior consent before using it to build up a profile for targeted advertising and other purposes, and modify its data retention practices. Google will have 18 months to bring itself into line with the provisions.

Will this change research for my students? Probably not.

http://www.forbes.com/sites/amitchowdhry/2014/07/21/facebook-improves-news-feed-with-a-save-feature/

Facebook Improves News Feed With A 'Save' Feature

Today Facebook announced a new feature that lets you “save” items that are posted on the News Feed. You will be able to save links, news stories, video clips, music and places from the News Feed to be viewed later. Your saved items will be kept private, unless you decide to share them. Facebook will sometimes show you reminders for the saved items if you do not look at them for a while.

To save something that you see on Facebook, click on the “Save” button in the bottom-right of a post or click the down-arrow icon at the top right of the item and select “Save”:

For my students who can read!

http://www.thinkinghumanity.com/2014/07/free-books-100-legal-sites-to-download-literature.html?m=1

Free books: 100 legal sites to download literature

So my students can addict their children.

http://www.freetech4teachers.com/2014/07/ten-resources-for-helping-students.html#.U85jzED5d8o

Ten Resources for Helping Students Learn to Code and Program

In many of my presentations I tell the story of the first time that I wanted to stay after school. That was in the sixth grade when we could sign-up to use one of my elementary school's two computers to program things in Logo Writer. Today we have many more ways to introduce students to programming and coding. Here are some good resources that you can use to introduce students to programming and coding.

I see no practical use, buy it purely for the “cool factor.” But thinking outside the box, could this project animated tattoos?

http://dailygadgetry.com/ritot-projects-notifications-onto-hand/4058

Ritot Projects Notifications onto your Hand

Ritot, a new wristband concept device projects your notifications, such as emails and incoming calls straight onto your hand.

Ritot is expected to retail for around $120 and will ship starting in early 2015.

Parts of two long (and interesting) articles. Looks like ignorance of the law is a defense for “educators.”

EPIC Obtains FERPA Complaints from Education Department

From EPIC:

EPIC has obtained documents from the Department of Education detailing parent and student complaints about the misuse of educational records. The Department released the documents in response to an EPIC Freedom of Information Act request. The documents reveal that schools and districts have disclosed students’ personal records without consent, possibly in violation of the Family Educational Rights and Privacy Act. The documents also reveal that the Department failed to investigate many FERPA complaints. EPIC is expecting to receive more documents about the agency’s enforcement of the federal student privacy law. For more information, see EPIC: Student Privacy and EPIC: Open Government.

Having read through all the files EPIC shared, I think it would be more accurate to say that the Family Policy Compliance Office (FPCO) decided that no investigation was warranted in the vast majority of the complaints due to some common misunderstandings about what rights FERPA provides.

(Related) Also lloks like “educators” can't (or like students, don't bother to) read. TL;DR?

FERPA does not require data breach disclosure

Over on PogoWasRight.org, I’ve recapped the U.S. Education Department’s responses to privacy complaints filed by parent and students under the Family Educational Rights and Privacy Act (FERPA). In going through the data provided to EPIC in response to their Freedom of Information Act request, I noted that in a few cases, the Family Policy Compliance Office (FPCO) either responded to an inquiry about a data breach or reached out to university or school to offer technical assistance to help them comply with FERPA if they had had a data breach.

Here is part of their boilerplate response in 2011 to an entity that had experienced a breach involving missing folders with education records:

The preamble to the December 8, 2009, FERPA regulations explains the necessity for educational agencies and institutions to ensure that adequate controls are in place so that the education records of all students are handled in accordance with FERPA’s privacy protections.

Laws follow technology like shovels follow a snow storm.

http://www.bespacific.com/consumer-cloud-robotics-fair-information-practice-principles/?utm_source=rss&utm_medium=rss&utm_campaign=consumer-cloud-robotics-fair-information-practice-principles

Consumer Cloud Robotics and the Fair Information Practice Principles

by Sabrina I. Pacifici on Jul 20, 2014

Proia, Andrew A. and Simshaw, Drew and Hauser, Kris, Consumer Cloud Robotics and the Fair Information Practice Principles: Recognizing the Challenges and Opportunities Ahead (2014). Minnesota Journal of Law, Science & Technology, Forthcoming. Available for download at SSRN: http://ssrn.com/abstract=2466723

“Rapid technological innovation has made commercially accessible consumer robotics a reality. At the same time, individuals and organizations are turning to “the cloud” for more convenient and cost effective data storage and management. It seemed only inevitable that these two technologies would merge to create cloud robotics, “a new approach to robotics that takes advantage of the Internet as a resource for massively parallel computation and sharing of vast data resources.” By making robots lighter, cheaper, and more efficient, cloud robotics could be the catalyst for a mainstream consumer robotics marketplace. However, this new industry would join a host of modern consumer technologies that seem to have rapidly outpaced the legal and regulatory regimes implemented to protect consumers. Recently, consumer advocates and the tech industry have focused their attention on information privacy and security, and how to establish sufficient safeguards for the collection, retention, and dissemination of personal information while still allowing technologies to flourish. Underlying a majority of these proposals are a set of practices that address how personal information should be collected, used, retained, managed, and deleted, known as the Fair Information Practice Principles (“FIPPs”). This Article examines recent frameworks which articulate how to apply the FIPPs in a consumer setting, and dissects how these frameworks may affect the emergence of cloud-enabled domestic robots. By considering practical observations of how cloud robotics may emerge in a consumer marketplace regulated by the FIPPs, this research will help both the information privacy and robotics fields in beginning to address privacy and security challenges from a law and policy perspective, while also fostering collaboration between roboticists and privacy professionals alike.”

Marcus Zillman's lists are always large and complete.

http://www.bespacific.com/new-llrx-information-quality-resources/?utm_source=rss&utm_medium=rss&utm_campaign=new-llrx-information-quality-resources

New on LLRX – Information Quality Resources

by Sabrina I. Pacifici on Jul 20, 2014

Via LLRX.com - Information Quality Resources - Marcus P. Zillman’s guide focuses on the increasingly important topic of identifying reliable and actionable Information resources on the internet, a task specifically critical for researchers in all sectors. With the proliferation of non attributable, un-vetted, un-sourced information churning 24/7 through a spectrum of social media sites, getting it right takes time and skill, but is well worth the effort.

Another nudge toward mandatory full disclosure? Perhaps with statutory fines for incomplete information?

Vendini Ticketing Breach May Have Affected More Than 3 Million Customers – Attorneys

Remember the Vendini breach last year? Jeanne Price of idRADAR.com reports that according to attorneys representing plaintiffs in a class action lawsuit that has reached a settlement, over 3 million ticket purchasers were likely affected by the breach.

[From the idRADAR article:

The number of Americans now wondering who or what a ‘Vendini’ is now known to run into the millions. Many consumers had never heard of the company before this week when they received notification of a proposed lawsuit settlement involving a data breach that Vendini reluctantly disclosed early last summer. It now appears that the breach was bigger than several other recent big headliner breaches including one at Michaels Stores nationwide.

You may be unfamiliar with the name. It never appears when you buy tickets online or at the box office but the odds are good that if Ticketmaster isn’t involved, Vendini will have hands on your transaction.

So now everyone knows that you purchased ________. Shame on you!

Buyer Beware: NYU Researchers Uncover Security Breach That Reveals eBay Purchases

From PRNewswire:

Buyers and sellers using the online marketplace eBay may be revealing far more than their interest in vintage furniture or video games. Researchers at the New York University Polytechnic School of Engineering and NYU Shanghai have discovered a privacy flaw that allows site visitors to view a buyer’s complete purchase history—including sensitive items like gun accessories and at-home medical tests for pregnancy or HIV.

[...]

The privacy flaw operates as follows: Every eBay user’s profile includes a “Feedback as a Buyer” page, where those who have sold items to that person can post comments. An estimated 70 percent of sellers leave feedback for buyers, and this section is entirely public—a user need not even sign into eBay to access this information. Along with their comments, the seller also leaves a record of his or her own username and the time of sale but does not disclose the actual item purchased. By visiting the seller’s feedback page, however, it is relatively easy to match the time stamp of the sale and thus identify the item that was purchased.

In the event that more than one sale matches the time stamp, which may happen with automated sales, the researchers still found it fairly straightforward to identify purchase histories. eBay assigns a pseudonym to each username listed in sales records, and that pseudonym follows a formula that makes deriving the username possible in nearly every case: In a test database of 5,580 feedback records, the researchers matched 96 percent of buyers’ feedback records to a single seller feedback record, complete with purchase details.

In some cases, the researchers were able to take this attack one step further: Among a database of nearly 131,000 eBay usernames, they were able to link 17 percent to Facebook profiles, thus revealing the users’ real names.

[...]

This research was partially funded by grants from the National Science Foundation. The full paper is available at https://petsymposium.org/2014/papers/Minkus.pdf.

Read more from PRNewswire.

Another technology to tap. The NSA should be very interested in “off the grid” communications.

http://dailygadgetry.com/gotenna-modern-day-walkie-talkie/4049

GoTenna The Modern Day Walkie Talkie

Off the grid connectivity is now possible thanks to GoTenna, which gives people the ability to communicate with no data, network or signal connection.

GoTenna has been designed to connect your phone over Bluetooth and use a longer-range, low frequency radio to communicate to other GoTenna’s up to several miles away.

… GoTenna is specifically designed to be used when your phone is offline and out of cellular range and as long as the person you need to communicate with also has a GoTenna, you will be able to get through.

Currently, the GoTenna only supports text based chat however, unlike other off-the grid communication devices it does not use satellites or require a monthly fee to remain activated.

GoTenna is completely free to use and each network is self contained.

… GoTenna can currently be pre-ordered for $150 for two devices.

Yesterday I noted that Facebook and Twitter were making it easier for users to buy stuff without leaving their systems. Could they be next?

http://www.informationweek.com/mobile/mobile-business/eu-tells-apple-google--limit-in-app-purchasing/d/d-id/1297420?piddl_msgid=235834#msg_235834

EU Tells Apple, Google: Limit In-App Purchasing

As U.S. regulators continue to press mobile platform providers for failing to prevent children from making unauthorized purchases in apps, European regulators are doing the same.

… EU Consumer Protection Cooperation (CPC) authorities have decided that games advertised as "free" should not misrepresent the cost to consumers. In response, Google has removed the term "free" from Google Play store listings that describe games containing its In-app Billing API, even if that API is not actually used.

In so doing, Google has gone above and beyond regulatory requirements. The CPC rules require only that "an online game cannot be marketed as 'free' where the consumer cannot, without making in-app purchases, play the game in a way that he/she would reasonably expect." In many "free" games, in-app purchases are not required; they generally improve the player's situation without being critical to in-game advancement.

For my Ethical Hackers: “Hey kids! There's a McDonalds ahead! Mom & Dad can buy you a Happy Meal!”

http://www.upstartmagazine.com/new-toyota-minivan-helps-parents-yell-at-their-kids/295634/

New Toyota Minivan Helps Parents Yell at Their Kids

… Toyota Sienna minivan has a so-called “Driver Easy Speak” feature. It has a mounted microphone to amplify a parent’s voice through the speakers in the back seats.

For my students who read. Mortimer Adler wrote “How to read a book.” Perhaps now we need “How to read a Kindle.”

http://www.bespacific.com/better-online-reader-new-yorker/?utm_source=rss&utm_medium=rss&utm_campaign=better-online-reader-new-yorker

Being a Better Online Reader – The New Yorker

by Sabrina I. Pacifici on Jul 19, 2014

“Certainly, as we turn to online reading, the physiology of the reading process itself shifts; we don’t read the same way online as we do on paper. Anne Mangen, a professor at the National Centre for Reading Education and Research at the University of Stavanger, in Norway, points out that reading is always an interaction between a person and a technology, be it a computer or an e-reader or even a bound book. Reading “involves factors not usually acknowledged,” she told me. “The ergonomics, the haptics of the device itself. The tangibility of paper versus the intangibility of something digital.” The contrast of pixels, the layout of the words, the concept of scrolling versus turning a page, the physicality of a book versus the ephemerality of a screen, the ability to hyperlink and move from source to source within seconds online—all these variables translate into a different reading experience.”

[From the article:

… the more reading moved online, the less students seemed to understand.

… Was the digital format to blame for their superficial approaches, or was something else at work?

(Related) Now find something to read and write about.

http://www.bespacific.com/discovery-hub/?utm_source=rss&utm_medium=rss&utm_campaign=discovery-hub

Discovery Hub

by Sabrina I. Pacifici on Jul 19, 2014

“Exploratory search - Discovery Hub is an exploratory search engine built on top of the famous encyclopedia on the web, Wikipedia. The exploratory search is a new way to search the web, not to find what you are searching, but to find what you are not searching, and might be interesting for you! It allows performing queries in an innovative way and helps you to navigate rich results. As a hub, it proposes redirections to others platforms to make you benefit from your discoveries (Youtube, Deezer and more).”

• “The DBpedia data set uses a large multi-domain ontology which has been derived from Wikipedia. The English version of the DBpedia 3.9 data set currently describes 4.0 million “things” with 470 million “facts”. In addition, we provide localized versions of DBpedia in 119 languages. All these versions together describe 24.9 million things, out of which 16.8 million overlap (are interlinked) with concepts from the English DBpedia. The full DBpedia data set features labels and abstracts for 12.6 million unique things in up to 120 different languages; 24.6 million links to images and 27.6 million HTML links to external web pages; 45.0 million data links into external RDF data sets, 67.0 million links to Wikipedia categories, and 41.2 million YAGO categories. The dataset consists of 2.46 billion pieces of information (RDF triples) out of which 470 million were extracted from the English edition of Wikipedia, 1.98 billion were extracted from other language editions, and about 45 million are data links to external RDF data sets.”