Archive for the Technology Category

Hand over your privacy me hearties!

I was reading Phorm’s website this weekend and notice that they have started a new website called Stop Phoul Play(did you see what they did there?).  This is to respond to the various critics to their software, which I guess includes me. This site describes it’s critics as “Privacy Pirates” and attempts to address the various criticisms of it’s software. Phorm of course has every right to defend it’s position and to emphasise their privacy policy and correct any misconceptions about it’s system, but by using the term privacy pirate it shows a lack of willingness to engage with it’s critics. What the hell is a privacy pirate anyway? do we set sail upon the wild piva-sea and attack poor impoverishes multi billion pound multinationals armed only with our sharp tongues and steely gazes? ”Prepare to be boarded me hearties and have your encryption keys at the ready”. Perhaps we should retaliate and compare Phorm to the East India Company, profiteering from out personal data, trading our lives to the highest bidder, the data slavers of  world wide web.

So given the choice I think I would choose to be the Captain Jack Black of the datashpere every time.

Big Brother is watching you.

You will be glad to know as of Today the fact that you have visited my blog is now recorded by your ISP and stored for the next 12 months. This is just in case you are an international terrorist who has mistaken my blog for a site that contains fiendish plots to bring down the UK government. Now I am all for bringing down this bloody awful government but I wish to do so via the normal democratic process. I am not saying I am somehow special by the way, in fact all of your web activity is being recorded by your ISP. And not just your web browsing but also your email, in fact every email you receive or send from now on will be logged and recorded. This is in addition to your mobile phone activity which is already being recorded by HM Government.

So, do you feel safer knowing that all your electronic communications are now being monitored, knowing that Gordon “IAM” Brown will be able to check back to see what You Tube films you have watched, who you are talking to on face-book, what news articles you are viewing on the BBC. Or, like me, do you feel this is just another nail in the coffin for freedom and privacy in this country. Will this actually be used for anti terrorist behaviour, or, like the Regulation of Investigatory Powers act, be used by local authorities to track down “Serious Criminals” such as those who would send their children to the wrong school. Perhaps a disgruntled and violent policeman will use it to trace his abused parner after she has gone into hiding. The one thing I can absolutely guarantee is this power will not once be used to trace or convict a terrorist. The truth is that criminals will hide their web activity behind web proxies and false email accounts so the only people being recorded is you and me, well as you read this it is actually just you. Feel safer?

So what next for Gordon, what new goodies does this paranoid PM have in store for us in the future? perhaps we should all have cameras in our houses, just like ID cards, if you have nothing to hide then you have nothing to fear, and I am sure most parents will be happy that some stranger in a CCTV monitoring room is there to watch your children getting dressed for bed, ensuring no harm comes to then. well what do you think? sounds okay doesn’t it? will you sleep safer at night under the ever watching eye of big brother?

BBC Article : http://news.bbc.co.uk/1/hi/technology/7985339.stm

Correction, It has been brought to my attention that the BBC News article was incorrect (it has now been corrected) and Mr B will not be collecting our web history, just our emails and phone calls, so that is okay then! 

National Rail Enquiries (update)

In an earlier post (This weeks greediest corporation award goes too….) I named and shamed Network Rail. I also wrote to them to outline my anger and accused them of sharp and uncompetitive practice. This was their reply.

Network Rail Email

Dear [The Daily Male]

Thank you for your eMail.

I am sorry to hear that you are unhappy with the cost of the National Rail Enquiries iPhone Application and the subsequent withdrawal of the MyRail Lite iPhone Application.

I can confirm that we did not withdraw the real time licence for MyRail Lite as the application was never licensed to use that data in the first place.

Although the MyRailLite application was not licenced to use National Rail Enquiries real time data, National Rail Enquiries did suggest an alternative solution to enable the product to continue but the developers refused.

National Rail Enquiries has not imposed a limitation on developing rail applications for iPhone. Timetable data is widely available and developers are free to use such data to develop applications if they wish having sought the relevant permissions from the industry data providers.

National Rail Enquiries provides a number of mobile web services including the iPhone application, which does have a one time £4.99 download fee. Our other services include WAP (though iPhones do not support WAP) and our PDA site at pda.ojp.nationalrail.co.uk, which are free to use.

The cost of the iPhone Application is not for the data but development and support costs. The data is offered to users of the application for free and the same data can be accessed through other channels such as the website.

Regards,

[removed]

Customer Services

www.nationalrail.co.uk

The implication from this email is that rail timetable data is FREE to use and only the app development costs have led to the £5 cost of the rail enquiries app. This is even worse. They have admitted that they are providing free data to their own app developers but restricting the flow of this free data to any or all rivals based on their own licensing rules. This is most definitely uncompetitive behaviour and my next course of action will be to contact the OFT (Office of fair trading) and request an investigation into Network Rail Enquiries practices.

This weeks greediest corporation award goes too….

Network Rail.

Why? well let me explain. I have an Apple iTouch, a fantastic piece of kit and especially because you can download loads of funky new apps. One in particular, MyRail, a FREE app, was very good indeed and allowed you to view live departure and arrival information for any train station. However this app no longer works because Network Rail have not renewed the licence for the app owners to use their live data. At the same time Network Rail have introduced their own app that does exactly the same job except they want us to pay a fiver to use it. The greedy bast%*#s.

Here is my call to all iPhone and iTouch users… Boycott the Network Rail app.

Jolly poor Phorm

I see in the news this week (http://news.bbc.co.uk/1/hi/technology/7959099.stm) that the Open Rights Group have written to several large Internet companies to ask them to block their content being used by Phorm. In case you are unaware, Phorm produce a rather worrying piece of software they want to have installed on your ISP’s servers. Basically what this software does is scan every web page you visit looking for keywords and creating a profile of your browsing habits. This information is then used to create targeted advertising. They make a big song and dance over their privacy controls to ensure that your browsing habits can not be traced to any individual but speaking with my tecky hat on I can not see how they can guarantee this.  If you want the technical stuff please read the stuff at the end of this article.

I have grave worries about any piece of software that examines every web page I visit, even if they allow an Opt Out or Opt In I have my doubts that this will alleviate the security risks. I hope these companies decide to block Phorm and that the whole venture goes the way of the Sinclair C5.

 I currently use BT for my broadband, they are one of the companies thinking of using this and if they do I will be one of the first customers to switch ISP.

This is the technical bitTheir argument goes like this, we don’t record anything personal about you and only associate your browsing details with a unique random number. This random number will be stored in a cookie (a local file stored on your pc) and it will be this number that all the adverising links will be attached to. All well and good, but if I have the a website with a simple piece of code on it that can read this cookie whenever a person visits my page I can easily obtain your Phorm id. Voila, I now know what you Phorm id is and can also collect lots of other information such as your IP address (the number that uniquely identifies your computers connection to the internet). I can then generate a fake cookie with your phorm ID and within a few seconds gather a list of all the adevrtising tags you have been associted with. Is that really private? I don’t think so.

Top 10 reasons why ID cards are a bad idea

You may ask what gives me the right to pontificate about this, well, I have over 22 years and an IT professional and have worked with data and database in many industries and for many clients. I understand Data and Data Security in a way that makes most people want to kill themselves. The ID card system as defined by the government is flawed in so many ways but they spin the truth and lie about the benefits to try to deceive the public about the benefits of the system. In this article I hope I can explain in “Non techy” terms why the ID card scheme must be stopped.

Note: these are my thoughts alone and do not reflect any views or opinions of the no2id campaign group.

10. It won’t stop terrorism. Honestly, how could it, home grown terrorists will have legitimate ID cards and I am sure when they apply for one they will not state that their ambition is “… to bring down the state and install sharia law through random acts of mindless violence”. Foreign terrorists will not need an ID card so it can not help there.

9. It won’t stop organised crime. In fact the ID card will be just another tool of the trade of organised criminals. They will target ways to get their hands on ID cards or create fake ones in order to make money and continue their criminal activities.

8. It won’t stop ID theft. Far from it, in fact it may make things worse. If a criminal can duplicate your ID and falsify the electronic details they will have a piece of id that will make them unchallengingly you. You may argue that this is impossible because your details are also stored on a central register but as the system will hardly ever challenge the central data and will generally just check your identity against the data held on the card they will be able to fake your identity with more certainty.

7. It is not secure Part I. The government talks a lot about data security (at the same times as they lose millions of records of our private data) without actually explaining what that actually means. Let me try to explain, without sending you to sleep, why the system is insecure. Your most private and sensitive data will be copied from the secure central database onto a small plastic data chip card. The data on this card will be encrypted using a single key system, similar to the way your data is stored on a chip and pin card.  As you may or may not know the chip and pin algorithm has been cracked and because all the cards use the same algorithm that once you have cracked it once the  data on ALL the cards is accessible. The same will be true of ID cards, the criminal fraternity will be working overtime to crack the algorithm, once it is done the whole ID card system is compromised, the only solution is to re encrypt all the cards or re issue new cards, but any old cards will be compromised and there will be millions of them, how do you ensure these old cards are destroyed? and more importantly who is going to pay to issue all these new cards and dispose of the old ones? yes, you guessed it, us. And if you think it is impossible to break these codes then read on and I will explain how it can be done.

6 It is not secure Part II. So how do you crack a secure encryption system? well there are many ways, but the most important starting point is to have an example of encrypted data, well that is easy as there will be millions of them out there, the ID card itself. Next it would help if you have access to some device that decrypts the data, a sort of enigma machine if you will. Well again there will be thousands of them, the ID card readers. The first chip and pin decryption scams were achieved by modifying the hand held chip and pin readers. The next thing that would help would be “an inside man”. This may seem a bit far fetched but remember all these ID card readers will have to be manufactured by outside agencies and will almost certainly be made in China. There will be a lot of people in the manufacturing chain that will have access to the encryption algorithm data, I wonder how much it would cost to bribe or extort the data from a Chinese manufacturer. And remember, because this is a single key system (ie each card uses the same key to decrypt it) once one cards system is cracked, all cards are accessible. Even without the inside man it is likely the system will be cracked in a few years maybe only a few months, ask Sky TV how often they have to issue new viewing cards because hackers have broken the encryption systems.

5. It costs so much, maybe as much as 15 billion to create and maintain the system. Let me write that out in full to make it clear £15,000,000,000.00 . And if you lose your card you will HAVE to buy another at a cost of £40 or more. and if you move house you will have to tell the ID register and have a new card issued, more cost. Get married or change name, new card, more cost. Fail to do so will be a criminal offence with a hefty fine.

4. It isn’t voluntary. Oh yes it is, I hear you cry, OH NO IT ISN’T I reply in true pantomime style. The government say it is voluntary but in truth other, non ID card laws, are being created to give the police the right to demand to see your ID at any time thus enforcing compulsion via the back door.

3. It won’t stop benefit fraud. No, not even this, most benefit fraudsters do not lie about their identity but instead lie about their circumstances, how many kids they have, if they are working, if they are disabled, none of this will be stopped with the ID card.

2. It breaches every single rule of good Data Protection. You never, ever, ever, and I can not stress this enough, ever allow data to be copied from a secure central database onto a removable data store (be it card, cd, chip stick etc) unless you absolutely have to. Once data had be removed from the central store it is no longer secure, even if it is encrypted. When the data is still in the central database, you can control it, see who is accessing it, check that it is still accurate. Once the data is removed it is lost, you can  not know who has it, what it says and what it is being used for. It is no coincidence that ALL the embarrassing data loses that the government have committed over the years have ALL happened because data was taken from a secure central database and placed on a removable media. So what do the government propose to do, send out this data on millions of plastic chip cards, unbelievable!

And the big number 1, THE CARD IS THE WEAK LINK. Why have a card with a copy of my thumb print or retina scan on it when I pretty much always have my thumb and eye with me at all times. If the police want to check my ID then they can scan my thumb print, send the data to the central data along with my name and the central system can confirm my identity, simple, no need for any sensitive data to have ever left the database, WHAT IS THE BLOODY POINT OF THE ID CARD AND ALL THOSE OFFLINE READER MACHINES? Having a central database of all my data is bad enough and totally unnecessary in my opinion, but to then send all that data out via the post is like setting off a huge data bomb, it is utterly and totally moronic and doomed to failure.

|