Month: July 2016

UPDATE (14 August 2016): I’m told that SSA has removed the mandatory cell phone text messaging access requirement that was strongly criticized in the original posting below. I appreciate that SSA has now done the right thing in this case. Perhaps in the future they’ll think these things through better ahead of time!

– – –

If you don’t have a cell phone, or some other means to receive SMS text messages (and have them enabled, and know how to deal with them), you won’t be able to access your Social Security Administration “My Social Security” online account starting next month.

The SSA is currently sending out emails announcing that SSA online users MUST receive an SMS text message with a two-factor authentication code to access their accounts starting in August.

UPDATE (29 July 2016): Here is the official SSA announcement.
UPDATE (14 August 2016): SSA has now deleted this referenced announcement page since they have removed the mandatory cell phone text messaging login requirement, as noted in the update at the start of this posting.

According to Congressional testimony in May, SSA “expects” to make other two-factor methods available at some point in the future.

While the “expectation” of additional two-factor options at some unspecified time down the line is interesting, the move to now block users who do not have cell phones, or text message capable cell phones, or do not have text messaging enabled, or do not know how to access and read text messages — IS UNACCEPTABLE, especially on such short notice to SSA users.

Two-factor authentication systems are very important, but keep in mind that SSA by definition is dealing mostly with older users who may have only recently become comfortable with online services, and may not make any use of text messaging. Many do not have cell phones or somebody to receive text messages for them. There are also many people living in rural areas where cell phone service simply is not available at all!

Additionally — and ironically — text messaging is considered to be a substandard means of receiving two-factor authentications. And — get this boys and girls — NIST (the USA’s National Institute of Standards and Technology) — just a few days ago officially declared that text messaging based two-factor should no longer be used at all — it’s simply not safe and secure. The possibility of crooks leveraging this SSA text messaging system with fake messages targeting this particularly vulnerable user population is also very real.

It appears that SSA has really mucked this one up. This isn’t secure two-factor, it’s a three-ring circus. And it’s going to leave many SSA users out in the cold.

–Lauren–
I have consulted to Google, but I am not currently doing so — my opinions expressed here are mine alone.

When most Internet users think about the security and privacy of their communications, they tend to think mainly about the associated practices of the sites they visit on the Net. Rarely do they think much about their ISPs in this regard, even though by definition the ISP has access to the entirely of their communications usage over that ISP (we can assume that in most cases this does not include the ability to read encrypted, e.g. SSL/TLS data, though man-in-the-middle attacks on that secured data are not at all impossible).

But have you ever thought about how the practices of your ISP might affect the security of your local network — and data that (at least ostensibly) never leaves the confines of your local net?

Though best security practices include running your own routers and firewalls (if not even more secure systems using FIDO security keys or other similar advanced technologies) the truth is that most consumer and small business users who run local nets (that is, communications between some number of local machines at their site or sites) depend on the firewalls and security mechanisms configured into ISP-provided modems.

The thing is that you’re often not the only one in control of those modems.

Leased cable or other wireless or wireline data modems typically provide the ability for the ISP to control and configure the modem remotely. Even if you buy an approved modem on your own when that’s permitted, network provisioning and maintenance/support requirements may still permit your ISP a great deal of control over the device.

Another truth is that most consumers and organizations tend to run rather lax security (if any at all) behind what they assume to be secure modem firewalls, meaning that if that firewall is breached, their local net is pretty much wide open.

In an ideal world, we could all employ methodologies similar to Google’s excellent BeyondCorp security model, which puts a well-deserved nail in the coffin of firewalls. Unfortunately, this usually isn’t practical for most non-techie consumers.

Fundamentally, the question boils down to this — can your ISP remotely change modem configurations that could give them or third parties inappropriate access to data on your local network?

For example, some ISPs now provide the means for customers to reconfigure the Wi-Fi on their modems via the ISP’s website. In the case of Time Warner Cable (aka Charter, Spectrum, or whatever they’re called this week), their site allows users to view and change Wi-Fi passwords, change or even disable Wi-Fi security completely, and more.

Handy? Yeah. But what happens if TWC’s super-deluxe website gets hacked? Or perhaps law enforcement or intel agencies come around and want to use loopholes in the laws to try access your local network data without your even knowing about it?

You can see the problem. If your local net has typically lax security, and you don’t have your own firewall downstream of that ISP modem, the modem Wi-Fi security could be disabled remotely, your local network sucked dry late one night, and security restored by the morning. You might not even have a clue that any of this occurred.

How often does this kind of scenario occur in practice? I have no way to know. But it’s clearly possible.

Luckily, this is a case where there are steps you definitely can take to minimize these risks.

First, make sure that your local network is internally as secure as possible. You can’t simply assume that just because a machine is on your local network with a local IP address that it necessarily is a friend!

Second, consider putting your own firewall downstream of the ISP modem. Routers/switches with this capability are plentiful and relatively inexpensive.

Third, consider not using the ISP modem Wi-Fi at all. Those routers I mentioned just above often have their own built-in Wi-Fi that you can configure, making it unnecessary to use the ISP modem Wi-Fi, and permitting a more comprehensive firewall under your complete control.

I’m not suggesting that you go into a panic and start ripping Ethernet cables out of the walls or cease using Wi-Fi. But it would be wise to start thinking now about how you can reconfigure your local network for maximal security in a world of expanding network security concerns.

–Lauren–
I have consulted to Google, but I am not currently doing so — my opinions expressed here are mine alone.

Unless Pokémon GO turns out to be a relatively short-lived popular phenomenon (and actually even if it is, since PoGo will be but the progenitor of many future augmented reality games and other applications) it appears likely that the full real world impacts of the game were seemingly not completely considered before launch, leading to a growing collection of alarming situations.

There were signs of some sloppiness from the outset, when it was noted that the PoGo iOS app was asking for far more account permissions than was appropriate. The actual privacy risk in this case was minimal, but the mere fact that the app got out the door this way — given the intense concerns about app permissions generally — suggested a possible lack of due diligence in key respects.

While various of the problematic reports we’ve seen about PoGo can be chalked up to user inattention (plowing a car into a tree, driving off a cliff, etc.), many others cannot be blamed on the users alone, per se.

To note but a sampling, these include PoGo being used to attract players to be robbed, a registered sex offender who was supposed to stay away from children using the game to partner with a young child, and very recently, two players who were shot at by a homeowner when they were prowling a residential neighborhood at 1 AM. An array of other trespass-related occurrences have been noted, including players entering restricted areas at a nuclear power plant.

Of broader impact is the swarming of neighborhoods, parks, and other public places by far larger numbers of people than they were designed for — or that local authorities are prepared for — at all hours of the day and night. There are serious public safety concerns involved.

Such gaming activities become especially inappropriate when they occur at locations that are utterly unsuitable for gaming, like ordinarily quiet and respectful cemeteries and Holocaust museums.

Fans of PoGo enthusiastically declare that it’s a great way to meet new people and get exercise. Perhaps. In some locales at least, it seems that players are mostly driving around in their cars to reach designated targets, but we’ll let that pass for the moment.

One suspicion that’s difficult to shake is that seemingly there wasn’t much (if any?) attention given to purging inappropriate locations from PoGo’s ancestor game — Ingress — before deploying them in PoGo. The need for such a purge should have been obvious, given that PoGo would have been reasonably expected to attract far more users than Ingress (as it indeed dramatically has) and would also be far more attractive to children.

Historical side note: Ingress was originally developed at Google (in fact, I was one of its earliest players, I believe while it was still in beta), then spun off to a separate company — Niantic — in which Google holds a major stake.

As I noted above, PoGo is but the beginning of what will certainly be a long line of innovative and important augmented reality mobile apps. And that makes getting the real world implications of this tech in line with real world requirements and impacts as quickly as possible — without stifling innovation.

The most important requirement is to give more control to municipalities and persons who are impacted by these applications and their users.

For example, it doesn’t exactly take rocket science to figure out that sending users wandering around quiet residential areas in the middle of the night is a recipe for potentially dangerous (even lethal) confusion and confrontations, or that flooding a small park with thousands of people at once — without prior warning to local authorities — can easily lead to serious problems.

Niantic needs to immediately work toward providing much better mechanisms for involved homeowners, business owners, municipalities, and other associated entities, to request removal of specific locations from the PoGo location database (much as you can request removal of locations from Google Street View currently). And there should be ways to specify PoGo app operation “curfews” for specific locales as well — especially in residential neighborhoods, or areas with special concerns about the safety of late night visitors.

It is also crucial that accessing this kind of request/control system not require use of the PoGo app itself, nor ideally use of the Internet in any way — given that many affected persons may not even have Internet access. 

Obviously, different areas, regions, and countries will have their own individual attitudes and concerns about participation in the PoGo ecosystem, and we can reasonably expect the sorts of location removal and/or Pogo app curfew requests received to vary widely around the globe.

But it is not appropriate for these decisions to be made wholly by Niantic alone. And unless they and we get a handle on the real world impacts of augmented reality apps in short order, you can be sure that politicians — already expressing concerns about this area — will be moving in with their own “control ideas” — that will likely not be of the form that many of us would want, nor that would protect innovation going forward.

–Lauren–
I have consulted to Google, but I am not currently doing so — my opinions expressed here are mine alone.

Over the last few days, we’ve dramatically seen the force of Internet live video streaming, and the obvious hints of policy battles to come regarding this powerful technology are clearly emerging.

Beyond the tragic images of a man shot to death by police in his car, and then live scenes of a sniper in Dallas who ultimately killed five officers, we’ve already seen other ugly shadows of what might become the new normal, including a streamed rape and suicide — both streamed by the perpetrators themselves for maximal publicity.

And yes, this is only the beginning. For while it has been possible to stream live video from portable devices since years ago, only now has the concept reached a critical mass, an “inflection” point where it is likely to have enormous impact on society at large.

While most of the attention to date has been on Facebook’s video streaming app, Google and other firms also have live streaming services, and that number can only be expected to grow for the foreseeable future, around the world.

Notably, these streaming systems typically include the means for viewers to comment live back to the video originators during the streams themselves, to do everything from expressing admiration or condemnation, to “simply” urging them on.

The positive public interest and probative value in the streaming of many public events is fairly obvious in most cases.

But even in the public space the associated dilemmas are vast.

Unfortunately, large audiences can bring out the worst in some people, and there is an enormous range of potential abuse for this technology in an ecosystem of unfiltered live streaming — in terms of risk-taking behavior to please your streaming audience, encouraging violence (either explicitly or implicitly), privacy attacks, and other abuses.

Even when no harm is actually intended, the mere fact of a live streamed dramatic event with a significant viewership will in some situations lead to potentially dangerous “flash crowds” as nearby viewers rush to participate in person.

And while these risks exist aplenty even with streaming from public places, the potential problems likely multiple by orders of magnitude when we consider live video streaming from private homes or businesses, perhaps by surreptitious means.

The bottom line is that live video streaming is a quintessential tool. It can be used for enormous good that could greatly enhance public knowledge and participatory democracy. It can also provide a morbid audience and incentive for hideous monsters (including both individuals and groups) whose real world streamed depravities could make fictional “torture porn” films pale by comparison.

So we find ourselves facing a familiar dilemma. If live video streaming firms don’t do the hard policy work required to provide reasonable controls over and filtering of this content, we can be sure that governments around the world — both of their own volition and pressured by their citizens — will move forcefully to enact control and censorship regimes to meet their perceived agendas.

And history tells us that once that kind of censorship takes hold, it’s extremely difficult to stop from spreading in all directions.

This makes it more imperative than ever that we move forward toward establishing best practices and policies to harness this uber-powerful technology in a reasonable manner, before governments move in with possibly knee-jerk “solutions” that will almost certainly make matters worse, not better.

I don’t claim to have any magic wands available for addressing these complicated issues, though my gut feeling is that we should be able to harness the enormous crowdsourcing power of the Net to rapidly categorize streams in real time and trigger filtering or other actions as appropriate.

But just sitting on our hands about this is not a viable option. That is, unless our goal is to see an incredibly useful technology being branded as “the enemy” just as it’s really beginning to flower.

–Lauren–
I have consulted to Google, but I am not currently doing so — my opinions expressed here are mine alone.

Many of us tend to assume that here in U.S. we have the most advanced technologies on the planet. So it may be startling to learn that by global Internet standards, numerous experts consider us to be living in something of a Stone Age Internet nation.

The reality is stark. Many countries in the world pay far less for their Internet services than we do, and get much faster and more reliable services in the bargain. While many countries have set a national goal of fiber optics directly connecting every home and business, here in the United States phone companies still are arguing that snail’s pace Net connections should qualify as broadband.

Even when relatively “high” Internet access speeds are available via cable, they tend to be mainly in the downstream direction. For example, I have the highest cable modem speed available in my location here in L.A., which is 300 Mb/s downstream — but only 20 Mb/s up. Obviously, high upstream speeds are important for a range of applications (not just limited to obvious ones like remote data backup). Cable modem speeds are getting better, but the fundamentals of cable system technology continue to dampen upstream speeds.

You might reasonably ask how so many other countries have been able to get much better Internet access to their residents, compared with us here in the country that invented the Internet.

The detailed reasons are complicated technically, legally, and very much politically, but the bottom line is that the Internet ecosystem here in the U.S. has long been rigged against effective competition, a direct outgrowth of early telecommunications monopoly environments.

One example of this may be visible right outside your window.

Have you ever wondered who owns those “telephone” poles throughout your community, or the underground cables and conduits in some towns?

The short answer is: What a mess!

Poles may be owned by power companies, by phone companies, by cable companies, or in some cases by communities themselves — or various combinations thereof. 

The land that these poles are planted in typically is in the form of an “easement” — a specific area of land still owned by the main property owner, but with access and other rights granted by government to various utilities and other firms. It works basically the same way with underground cables and conduits.

As you might imagine, easements can be the subject of complex and varied legal entanglements and disputes, even though most are granted when housing or commercial developments are being initially planned.

But for the sake of our discussion here right now, the most interesting aspect of easements is in older communities (for example, areas built up prior to the AT&T divestiture of 1984).

History matters in this context (as in so many other aspects of life) because when these easements were granted to communications companies back in the day, they were usually “monopoly” grants. That is, while we would probably agree even now that assuming a single water and/or power company would be logical, those historic easements were usually assuming only a single communications (phone) company, or later the original incumbent phone company plus a single cable TV company.

This is incredibly relevant today, because the entities controlling these easements, and that usually own the poles, cables, and conduits that everyone must use to provide landline communications services to homes or businesses, are quite powerfully in the catbird seat.

Here’s why.

In many countries, governments have national Internet plans that provide for robust competition in various ways. But here in the U.S., if you want to bring — for example — high speed fiber Internet to a community, you often have to deal with the incumbent telecom or other utility firms to gain access to those poles and/or underground facilities.

And those firms — like AT&T, Verizon, and the rest of the gang you likely are familiar with — have very little incentive to be particularly cooperative with new competitors bringing in far better services. In fact, the old guard firms have frequently pushed through laws — and/or filed lawsuits — aimed at preventing communities from encouraging or even permitting such competition.

So we find it not uncommon for the incumbents to demand exorbitant “pole attachment” or other access fees, or to delay and obfuscate as long as possible.

It’s important to remember that these incumbent firms typically only control these access assets because of those original monopoly grants from many decades ago — giving them exclusivity that is nonsensical and unfair so many years later. But they’ve become experts at milking every last possible dollar out of the jolly old monopoly days, even now!

If this sounds bad, it gets worse for the captive residents of many apartment buildings and commercial developments.

Building owners and landlords frequently view Internet access as a massive personal profit center, and engage in restrictive shenanigans — some of which can be viewed as illegal — to strike lucrative, and yes, monopoly deals with telecom firms, demanding sweetheart payments for access to their tenants, and treating those tenants as if they were medieval serfs. For more on this particularly seamy side of Internet access, please see Susan Crawford’s excellent recent article: “Dear Landlord: Don’t Rip Me Off When it Comes To Internet Access — When building owners get kickbacks from big providers it’s the tenants who lose.”

You might think that this sorry state of affairs would be pretty much obvious to everyone, but in our toxic political environment that would be very far from the truth.

In fact, there are many in Congress who don’t see any consumer problems here at all. Whether or not one chooses to consider these access issues under the “network neutrality” umbrella, many politicians who have long enjoyed the “generosity” of the incumbent telecom firms are lined up to block any attempts to improve the competitive landscape for Internet consumers, thereby condemning us to continued laughingstock status in the eyes of most other countries.

We do have some power though — in the voting booth. These issues tend to have local, state, and often federal components, and we’re unlikely to see significant improvements while lapdog beneficiaries of dominant Big Telecom remain in political control.

Or perhaps you’re satisfied with exorbitant prices and “Flintstones-class” Internet access throughput. Frankly, this far into the 21st century, I strongly believe that we can do much better than having so many of us running at bare feet pedal power Internet speeds.

Yabba dabba doo!

–Lauren–
I have consulted to Google, but I am not currently doing so — my opinions expressed here are mine alone.