July 28, 2015

avatar

Too many SSNs floating around

In terms of impact, the OPM data breach involving security clearance information is almost certainly the most severe data breach in American history. The media has focused too much on social security numbers in its reporting, but is slowly starting to understand the bigger issues for anyone who has a clearance, or is a relative or neighbor or friend of someone with a clearance.

But the news got me thinking about the issue of SSNs, and how widespread they are. The risks of SSNs as both authentication and identifier are well known, and over the past decade, many organizations have tried to reduce their use of and reliance on SSNs, to minimize the damage done if (or maybe I should say “when”) a breach occurs.

In this blog post, I’m going to describe three recent cases involving SSNs that happened to me, and draw some lessons.

Like many suburbanites, I belong to Costco (a warehouse shopping club ideal for buying industrial quantities of toilet paper and guacamole, for those not familiar with the chain). A few months ago I lost my Costco membership card, so I went to get a new one, as a card is required for shopping in the store. The clerk looked up my driver’s license number (DL#) and couldn’t find me in the system; searching by address found me – but with my SSN as my DL#. When Costco first opened in my area, SSNs were still in use as DL#s, and so even though my DL# changed 20 years ago, Costco had no reason to know that, and still had my SSN. Hence, if there were a Costco breach, it’s quite possible that in addition to my name & address, an attacker would also get my SSN, along with some unknown number of other SSNs from long-term members. Does Costco even know that they have SSNs in their systems? Perhaps not, unless their IT staff includes old-timers!

A recent doctor’s visit had a similar result. The forms I was asked to fill out asked for my insurance ID (but not my SSN), however the receipt helpfully provided at the end of my visit included my SSN, which I had provided the first time I saw that doctor 25 years ago. Does the doctor know that his systems still have SSNs for countless patients?

Last fall I did a TV interview; because of my schedule, the interview was taped in my home, and the cameraman’s equipment accidentally did some minor damage to my house (*). In order to collect payment for the damage, the TV station insisted on having my SSN for a tax form 1099 (**), which they helpfully suggested I email in. I had to make a decision – should I email it, send it via US mail, or forgo the $200 payment? (Ultimately I sent it via US mail; whether they then copied it down and emailed it, I have no idea.) I got the check – but I suspect my SSN is permanently in the TV station’s records, and most likely accessible to far too many people.

These cases got me thinking where else my SSN is floating around, perhaps in organizations that don’t even realize they have SSNs that need to be protected. The grocery store probably got my DL# decades ago when it was still my SSN so I could get a check cashing card, and that number is probably still on file somewhere even though I haven’t written a check in a grocery store for 10 or 20 years. The car dealer that sold me my car five years ago has my SSN as part of the paperwork to file for a title with the Department of Motor Vehicles, even if they don’t have it from my DL#. Did they destroy their copy once they sent the paperwork to DMV? I’m not betting on it. I cosigned an apartment lease for my daughter before she had her own credit history close to 10 years ago, and that required my SSN, which is probably still in their files. I met a sales person 20 years ago who had his SSN on his business card, to make it easier for his customers in the classified world to look him up and verify his clearance. (I probably have his business card somewhere, but luckily for him I’m not very organized so I can’t find it.) Many potential employers require an SSN as part of a job application; who knows how many of those records are floating around. Luckily, many of these files are paper records in a file cabinet, and so mass breaches are unlikely, but it’s hard to know.  Did any of them scan all of their old files and post them on a file server, before destroying the paper copies?

As many people have suggested, it’s time to permanently retire SSNs as an authenticator, and make them just an identifier. Unfortunately, that’s much easier said than done. Todd Davis, CEO of Lifelock, famously put his SSN on his company’s advertising, and was then the victim of identity theft. We all know that the “last four” of your SSN has become a less intrusive (and even less secure!) substitute authenticator.

So what should we do? If you’re a CIO or in a corporate IT department, think about all the places where SSNs may be hiding. They’re not always obvious, like personnel records, but may be in legacy systems that have never been cleaned up, as is probably the case for Costco and my doctor. And once you get finished with your electronic records, think about where they’re hiding in paper records. Those are certainly lower risk for a bulk theft, but they’re at some risk of insider theft. Can the old (paper) records simply get shredded? Does it really matter if you have records of who applied for a job or a check cashing card 15 years ago?

I’m not optimistic, but I’ll keep my eyes open for other places where SSNs are still hiding, but shouldn’t be.

(*) Since you insist: one of the high intensity lights blew up, and the glass went flying, narrowly missing the producer. Two pieces melted into the carpet, ruining small sections. The staff were very apologetic, and there was no argument about their obligation to reimburse me for the damage. The bigger damage was that I spent an hour being interviewed on camera, and they used about 10 seconds in the TV piece.

(**) Yes, I know they shouldn’t need an SSN for reimbursement, but I unsuccessfully tilted at that windmill.

avatar

Congress’ Fast Track to Bad Law

Congress appears poised to pass Trade Promotion Authority, otherwise known as “fast track,” for the Trans Pacific Partnership Agreement (TPP). If this happens, it will likely close the door to any possibility of meaningful public input about TPP’s scope and contours. That’s a major problem, as this “21st century trade agreement” encompassing around 800 million people in the United States and eleven other countries, will impact areas ranging from access to medicine (who gets it) to digital privacy rights (who has them). But, unless you are a United States Trade Representative (USTR) “cleared advisor” (which almost always means that you represent an industry, like entertainment or pharmaceuticals), or, under certain limited circumstances, an elected official, your chief source of TPP information is WikiLeaks. In other words, if Julian Assange gets his hands on a draft TPP text, you might see it, once he decides that it should be made public. Of course, you’ll have to hope that the copy that you see is current and accurate.

There have been no – not one – formal releases of the TPP’s text. Thus, this 21st century agreement has been negotiated with 19th century standards of information access and flow. Indeed, TPP has been drafted with a degree of secrecy unprecedented for issues like intellectual property law and access to information. Some degree of secrecy and discretion is necessary in any negotiation, but the amount of secrecy here has left all but a few groups in the informational dark.

This process, if you want to call it that, defies logic. Margot Kaminski has labeled the entire process “transparency theater.” Perhaps most problematically, “transparency theater” has caused widespread opposition to TPP, like mine, that might otherwise not have materialized. Standing alone, the TPP’s negotiation process is sufficient to cause opposition. Additionally, the process has seemingly led to bad substance, which is a separate reason to oppose TPP. Imagine if bills in Congress were treated this way?

Meanwhile, fast track will mean that Congress will simply vote yes or no on the entire deal. Therefore, fast track will exacerbate that informational vacuum, and the public will not be able to do much more than accept whatever happens. In essence, an international agreement negotiated with no meaningful public input – and to some unknown degree written by a few industries —  is about to be rushed through the domestic legislative process. [Note: I submitted testimony in the case referenced in the previous hyperlink by Yale Law School’s Media Freedom and Information Access Clinic].

At this point, if you are at all concerned about the TPP’s process, the best thing that you can do is contact your Representatives and urge them to vote “no” on fast track. You could also join the call to formally release the TPP’s text before fast track is voted upon (i.e., right now). Finally, you could help assure that two other important international agreements currently in negotiation but in earlier stages – the Transatlantic Trade and Investment Partnership and Trade in Services Agreement – are negotiated more openly. How? By paying attention, and calling your elected officials and the USTR when things remain murky. I’ll have much more to say about these processes in the coming months.

avatar

An empirical study of Namecoin and lessons for decentralized namespace design

[Let’s welcome to Freedom to Tinker first-year grad student Miles Carlsten, who, with fellow first-years Harry Kalodner and Paul Ellenbogen, worked on a neat study of Namecoin. — Arvind Narayanan]

Namecoin is a Bitcoin-like cryptocurrency that aims to create a secure decentralized namespace — that is, an online system that maps names to values, but without the need for a central authority to manage the mappings [1]. In particular, Namecoin focuses on establishing a censorship-resistant alternative to the current centralized Domain Name System (DNS).

In a new paper to be presented at WEIS 2015, we report the results of an empirical study of Namecoin. Our primary finding is that so far Namecoin hasn’t succeeded at this goal — out of about 200,000 registered names, only 28 represent non-squatted domains with non-trivial content. We argue that there’s a crucial game-theoretic component to namespaces that must be designed properly for such systems to be successful.

[Read more…]

avatar

The story behind the picture of Nick Szabo with other Bitcoin researchers and developers

Reddit seems to have discovered this picture of a group of 20 Bitcoin people having dinner, and the community seems intrigued by Nick Szabo’s public presence. It’s actually an old picture, from March 2014. I was the chief instigator of that event, so let me tell the story of how that amazing group of people happened to be assembled at Princeton’s Prospect House.

Photo credit: Matt Green

[Read more…]

avatar

Bitcoin faces a crossroads, needs an effective decision-making process

Joint post with Andrew Miller.

Virtually unknown outside the Bitcoin community, a debate is raging about whether or not to increase the maximum size of Bitcoin blocks. Blocks are created in Bitcoin roughly once every ten minutes and are currently limited to a size of 1 megabyte, putting a limit on the rate at which the network can handle transactions. At first sight this might seem like a technical decision for the developers to make and indeed it’s largely being treated that way. In reality, it has far-reaching consequences for the Bitcoin ecosystem as it is the first truly contentious decision the Bitcoin community has faced. In fact, the manner in which the community reaches — or fails to reach — consensus on this issue may set a crucial precedent for Bitcoin’s long-term ability to survive, adapt, grow, and govern itself. [1]


[Read more…]

avatar

The Error of Fast Tracking the Trans-Pacific Partnership Agreement

National media reported yesterday that a Congressional agreement has been reached on so-called “fast track” authority for the Trans-Pacific Partnership Agreement (TPP). This international agreement, having been negotiated under extreme secrecy by 12 countries including the United States, Australia, Canada, Japan, Malaysia and Singapore, is supposed to be an “ambitious, next-generation, Asia-Pacific trade agreement that reflects U.S. economic priorities and values.” Indeed, if it comes into effect, it will be the largest such agreement in history, covering some 800 million people. Unfortunately, its chances of meeting that laudable goal have been severely diminished by the aforementioned secrecy.

In theory, “fast track” authority should allow the President to more thoroughly and forcefully negotiate trade agreements with other governments by streamlining the domestic political process. By eliminating much of Congress’s review and amendment process that could force the TPP negotiators back to the table, “trade promotion authority” allows for complex international trade agreements to receive a swift and decisive Congressional sign-off. However, because the TPP has been negotiated largely in secret, with only a precious few outside the government (almost exclusively representing the entertainment and pharmaceutical industries) privy to its text, fast track will have the effect of eliminating the last possibility for anyone outside the above select few to change the contours of the agreement. That’s a significant concern, as the TPP (based upon leaks) covers issues ranging from access to medicine to liability for linking to allegedly copyright-infringing content on the Internet. Democracy deserves better.

To be sure, even without fast track, the chances of realistically being able to change the TPP once it hits Congress would be slim. Requiring negotiators to go back to the table after the TPP text is agreed upon in international negotiations is a significant undertaking that would be discouraged. But with fast track in place, the chances of offering any meaningful amendments to the final text are near zero. As a result, the moment that TPP’s negotiators announce that they have a final text will also be the effective end of the opportunity for small businesses, labor, civil society groups, and even the general public to impact the provisions of the agreement. Their only play will be to oppose TPP outright (which, in fairness, some may do regardless of how TPP was negotiated).

The very secrecy around TPP could be its undoing, as it was with the failed Anti-Counterfeiting Trade Agreement. Therefore, it is well past the time that the negotiators should make the text public. If it isn’t released, and soon, “fast track” could become a fast track to failure of this multi-year negotiating process – which, depending on the terms of the agreement, could be the right result.

avatar

Bitcoin is a game within a game

In this series on Bitcoin and game theory, I’ve argued that Bitcoin’s stability is fundamentally a game-theoretic proposition and shown how we’ve had blind spots for years in our theoretical understanding of mining strategy. In this post, I’ll get to the question of the discrepancy between theory and practice. As I pointed out, even though there are many theoretical weaknesses in Bitcoin’s consensus mechanism, none of these ever appear to have been exploited. [Read more…]

avatar

Decertifying the worst voting machine in the US

On Apr 14 2015, the Virginia State Board of Elections immediately decertified use of the AVS WinVote touchscreen Direct Recording Electronic (DRE) voting machine. This seems pretty minor, but it received a tremendous amount of pushback from some local election officials. In this post, I’ll explain how we got to that point, and what the problems were.

As one of my colleagues taught me, BLUF – Bottom Line Up Front. If an election was held using the AVS WinVote, and it wasn’t hacked, it was only because no one tried. The vulnerabilities were so severe, and so trivial to exploit, that anyone with even a modicum of training could have succeeded. They didn’t need to be in the polling place – within a few hundred feet (e.g., in the parking lot) is easy, and within a half mile with a rudimentary antenna built using a Pringles can. Further, there are no logs or other records that would indicate if such a thing ever happened, so if an election was hacked any time in the past, we will never know.
[Read more…]

avatar

Scan This or Scan Me? User Privacy & Barcode-Scanning Applications

[Please welcome guest bloggers Eric Smith and Nina Kollars. Eric Smith serves as the Chief Information Security Officer (CISO) for a higher ed consortium with membership consisting of Bucknell University, Franklin & Marshall College and Susquehanna University. Nina Kollars is assistant professor of government at Franklin & Marshall college, where her scholarship examines the ways in which individual user creativity affects the development of technology and practices.]

QR (Quick Response) codes—the two-dimensional barcodes designed by the Denso Wave company in 1994—were originally intended to track and inventory millions of parts on assembly lines. Since then, these nearly ubiquitous black and white squares have been applied to an ever-broader range of uses including business cards, patient-tracking systems, and mobile coupon clipping. In order to make use of these codes, the vast majority of consumers utilize smart phone technologies in order to convert the codes into usable information. However, neither Apple’s iOS nor Google’s Android operating systems include a robust native capability to scan and decode printed barcodes. As a result, users of these devices must download third-party applications that will do this work for them.

Research Question and Findings:

Our research question was straightforward: are there privacy and security risks associated with this emerging QR app ecosystem? In an attempt to answer this, we installed and analyzed over twenty of the most popular QR code applications. Our findings suggest that a majority of the most popular QR code readers found in the Apple App and Google Play marketplaces are not passive systems of information routing, but instead capture and transmit additional data about the device and the user back to the application developer. (For full details see our paper.)

Our findings reveal that many smartphone barcode scanning applications represent a significant threat to the privacy and, potentially, security of their users. On both platforms studied, the most popular QR code scanning apps, according to search result rankings were shown to transmit the contents of all scanned QR codes, as well as GPS location data, to a third-party server.
[Read more…]

avatar

Where is Internet Congestion Occurring?

In my post last week, I explained how Netflix traffic was experiencing congestion along end-to-end paths to broadband Internet subscribers, and how the resulting congestion was slowing down traffic to many Internet destinations. Although Netflix and Comcast ultimately mitigated this particular congestion episode by connecting directly to one another in a contractual arrangement known as paid peering, several mysteries about the congestion in this episode and other congestion episodes that persist. In the congestion episodes between Netflix and Comcast in 2014, perhaps the biggest question concerns where the congestion was actually taking place. There are several theories about where congestion was occurring; one or more of them are likely the case. I’ll dissect these cases in a bit more detail, and then talk more generally about some of the difficulties with locating congestion in today’s Internet, and why there’s still work for us to do to shed more light on these mysteries.
[Read more…]