May 2025

S M T W T F S
    1 23
45678910
11 1213141516 17
18 192021222324
25262728293031

Navigation

Page Summary

Active Entries

Style Credit

Expand Cut Tags

No cut tags

(morning writing, privacy)

elainegrey: Inspired by Grypping/gripping beast styles from Nordic cultures (Default)
Friday, November 22nd, 2024 07:56 am

TL;DR if you have an Android phone go turn off the tracking ID: https://www.eff.org/deeplinks/2022/05/how-disable-ad-id-tracking-ios-and-android-and-why-you-should-do-it-now

Yay we have fiber. This has gone as well as possible, really. Except now all our LAN (local area network) lives in the cloud. My threat perimeter has just become as big as a publicly traded company i never heard of called Calix. I am well aware all my network traffic went through ShinyFast's little paws and, y'know, wasn't thrilled. I'm sure enough of that traffic is revealing. Certainly linking me to this identity through the hostname in the URL. But now every device that is on our local network is visible to Calix and ShinyFast, that is every phone, computer, tablet, and network device - -which printer, etc etc. And inventory of what systems might be hacked, if you will.

I've spent time being irritated and getting little comfort from reddit folks about Calix security. Sure, no CVE for Calix but if all the equipment is managed by the telecoms why would the CVEs need to be public. And bleeping searches for Calix and security bring up pages and pages from Calix. On the other hand, the public filings have reasonable security risk disclaimers and the security reporting agreement doesn't seem particularly problematic: i like the explicit call out that security research is important and they grant permission within the terms of the agreement. So that's a plus.

Still. Ew. If i had a choice about broadband providers i might not be so -- irritated. Not having a choice and finding ShinyBright so railroading of decisions, incorrect in various assertions (lying?), doesn't help restore trust that i'm trying to ground in the premise, "Their copper service is the pits because they are focusing on fiber; fiber is their focus."

Good news after some power blinks when apparently some trees hit the lines in town: the network stayed up!

Current research is into getting an additional router to have on our side of the fancy shiny Calix router. Keep the now-VOIP phone which requires  Calix's router -- an additional number is useful since marketers have twigged that you might have many email addresses but phone numbers are surely good correlates for an identity [1] -- and see about using a VPN to isolate traffic, including DNS, from ShinyFast.

Security perimeter:

With new router, information about specific devices stays at home. Eg: right now my phone is on the home network and in airplane mode. If we had a router, external observation wouldn't know whether the phone was here or not.

However, ShinyFast would still see lots of chatter with Samsung, presumably to hosts that are correlated with phone service, and that chatter stops at times correlated to when my phone leaves the house.

With a router based VPN and careful routing of DNS requests, ShinyFast would just see use of that VPN (and ideally the work VPN would not go through the household VPN). It's also possible we would let the TV be exempt from the VPN, because i am not sure i trust any of the media services anyhow so, fine, ShinyFast, you have at that data too (reducing any VPN bandwidth charges, latency, or throttling).

--== ∞ ==--

I am so aware of just how visible so much of my digital life is, how little protection there is for that in the US. In New Jersey there's a law to protect the addresses, phone numbers of law enforcement and the judiciary, and marketers slurping up this data don't follow it. Probably fail to follow California and laws in a few other states.  And evidence in Europe -- i don't think i saved the reference -- is that even when you make a clear assertion to a website, no thank you, no tracking -- they do it anyway  because they consent code isn't wired in correctly to the site code.

https://krebsonsecurity.com/2024/10/the-global-surveillance-free-for-all-in-mobile-ad-data/

I'm preparing to present how Google's change in plans regarding third party cookies will affect authentication flows for research and higher ed, so i am in the deep end of tracking information this week.  My searches to find out if Google has announced the new consent mode now? what about now? (to distract a little from the Justice department break-up recommendation?) turn up so many articles about how marketers can continue to track post third party cookies. (Slides are due before the end of the month for a ..10 December?... presentation. I'm guessing a slide for "and the latest news" that's blank is going to be how this goes down.)

Anyhow, it's all depressing and it's depressing to live in a country where i don't begin to believe any civil liberties rules will be passed that make it less easy for anyone to surveil  and spy, and any tech bro who can think to make an exploitive buck... OK, i gotta go to work.

I will say i really think the Chrome engineers i am working with really do want to make a safer, more private internet. On the other hand, the UK's been enforcing a unfair marketing competition decision about Chrome and Google for a while, so Chrome can't just quit doing things like Safari and Firefox can. So stop using that browser and switch to Firefox. Or Safari, but that's Apple as a benevolent overlord.

[1] I am happy to expand on this if you ask

Tags:

(games, reading notes, elder care, us, privacy)

elainegrey: Inspired by Grypping/gripping beast styles from Nordic cultures (Default)
Thursday, August 3rd, 2023 01:11 pm
I continue in this cycle of feeling crinkly and dissatisfied and frustrated since mid-early June -- essentially from the point when "I'm recovering from surgery" ceased being an explanation for anything. There have been many excuses, and on the whole i lean towards accepting that i was carrying things in emotional and social dimensions that limited my spoons in the take care of self and yard dimensions.

The video game distraction, though, is real. Squee! I admit that, having watched Christine work out how to solve various issues in Jedi Survivor, i have faith in some of the hand-eye coordination passages instead of having the "maybe there's something else i should be doing/have done." I've managed to complete some bits that got her stuck because i know it's just a matter of timing and coordination. I also began by helping her, noticing visual cues and calling them to her attention, including "There's another one behind you."

And i've been reading. Sunday i read three novels -- the Iroshi trilogy by Cary Osborne -- that bother me a bit with something stuck in my metaphorical mental teeth. I like the justification for swords in space: weapons that are going to puncture habitat and ship walls are problematic. The alien cause of telepathy powers is interesting, although the aliens really aren't so very alien. Maybe what bothers me is the narrative omission: once the main character trusts the aliens in the first book, there's a gap between books where the hard work of recruiting others to trust the aliens occurs? And maybe the universe building feels just a little sketchy? Again, a gap between the first and second books takes a "nobody" to a politically significant persona. It doesn't compare favorably to Arkady Martine's A memory called empire.

I had an interaction with Dad today that left me feeling fragile: i was doing my best to accommodate his sense of urgency to get rid of some stuff (by coming over and taking a look). I don't think he really heard my repeat of "earliest possible time" in the spirit it was said. I'm glad we rescheduled, but i'm a little resentful at the pressure (particularly since he had other plans for the evening and was trying to squeeze me in. I called my sister to vent, she reciprocated with frustration over Dad's recalcitrance in handling his hearing issues. I don't know how we're going to get him to deal with his hearing. He doesn't withdraw, nor does he continue as he was with assumptions and not listening, so all that's good. But the way he interrogates about the words he doesn't hear (generally, he wasn't expecting to hear the word and he knows he didn't hear it right) puts the other person as the one with the issue. The other person used a strange or surprising word. Or pronounced it oddly. Or whatever. He's not taking the responsibility still. SIGH.

Christine's elephants have been around off and on. [Here "elephants" derive from "elephant in the room" and refer to issues that are Christine's and not mine to share in a broad way. I stretch the metaphor.] My toes were trampled on once, and then the elephants caused a significant change of her plans to do something nice for herself. She's worked hard on her own, but she's been unhappy with how the ways she's coped constrained her. I've pointed out that maybe there were other solutions someone could help her with for ... a while now. But when the elephants stood on my toes, it reached the point of me saying she should go get help. The way the elephants changed her plans underscored the severity of the issue. She's off for an intake appointment after lots of back and forth about all the paperwork and documents she was asked to fill out before meeting the person. The first person she reached out to wouldn't budge -- although this maybe clinic staff enforcing a practice without asking higher ups about requirements.

One person told her that she had to sign things so they could contact insurance, which - NOT TRUE. HIPAA expressly allows patient information to flow to insurers. https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html The second office seemed to be insisting and, after Christine let them know she'd be looking elsewhere, the admin checked with the clinic director who said only the consent to receive treatment was necessary. The director then entered into communication with Christine about the paperwork because they wanted to address any unclear terms. (Including screen grabs of their own documents?) The consent to receive treatment document ended with a sentence fragment.

Does no one but Christine and I read this stuff? Rhetorical. Sigh.
Tags:

(354, privacy, health)

elainegrey: Inspired by Grypping/gripping beast styles from Nordic cultures (Default)
Thursday, June 15th, 2023 06:18 am
I will admit i am in a bit of a mood.

On the other hand, when i receive a text from a short code that asks, "Please complete your patient form in advance of your appointment.
https://examappointments.com/CDN/dif/tv/dif.html?[more URL]" the first thing that comes to mind is phishing. ( It wasn't, but.... )
Tags:

(no subject)

elainegrey: Inspired by Grypping/gripping beast styles from Nordic cultures (Default)
Saturday, May 29th, 2021 06:54 am
Such happy news: Dad's exhaustion is gone and i am not taking next week to do respite. Dad has been taking medication for tachycardia for years. Years ago, if i recall correctly, he had an adrenaline attack, and following up found he'd had an unobserved, unidentified heart attack (years before that) and he was diagnosed with tachycardia, and went on meds for it. It was astounding how stressed out in reacting to things he would be with the higher pulse rate, and how much more pleasant (patient) he could be on the meds.

In the past few years he has intentionally lost MUCH WEIGHT. (Me, yes, there's some weight i want to loose but, i dunno, i don't think i want to be skinny or thin or lithe.) Turns out the tachycardia meds are too much, and slow his heart way down, and he is now back to himself. I do wonder about emotional regulation and whether he'll be accessing his patience as well, but fingers crossed.

He's still going to have the person he's hired, B, in three days a week. And i'm trying to encourage him to budget his energy to take care of himself first and of strategic planning and let his hire take care of house cleaning etc.

--== ∞ ==--

Do you care about IETF RFC's? https://datatracker.ietf.org/doc/draft-wkumari-not-a-draft/ is a work of art.

Meanwhile the brief

Farrell, S, and H Tschofenig. “RFC-7258: Pervasive Monitoring Is an Attack.” Best Current Practice. IETF, May 2014. https://tools.ietf.org/html/rfc7258.


underscores what i came to realizes in a workshop this week. The IETF (the architects of internet protocols) and the W3C (the architects of the web, depending on the IETF work) belive the web is broken by the pervasive tracking so if they implement something that breaks stuff that has been working for 20 years to mitigate tracking, that's OK because the web is already broken.

And authentication looks like tracking.

I am tempted -- based on a respected colleague's idea raised in an argument with a couple leading browser manufacturers in a meeting leading up to the workship -- to submit an RFC to suggest a new cookie tag. Authentication space folks were frustrated when browser manufacturers made understanding the lifetime of what were called session cookies (cookies that did not have a lifetime or explicit expiration date) very hard. Well i don't want to name the flag and it really isn't in my work remit.

It won't fix RFC-7258 either, so i will leave that unless someone brings it back up.

Meanwhile, this workshop had the people involved in authenticating you -- someone with a diverse 20 year history now at Facebook, a Microsoft guru, folks who define the standards for OAuth, some SAML folks, Google authentication -- AND the browser folks -- Safari, Firefox, Chrome, Edge.

The browser folks are full in on stopping tracking, which i appreciate every moment i am not working and sometimes even while i am. For meeting the demands of getting library patrons to resources i am pretty worried ... but do see some opportunities and some costs other companies might have to bear. It's a weird swirl of emotion and ideas. I have succeeded in raising the NISO OpenURL standard to a little visibility (and the NISO folks have said they'd engage with the W3C Privacy CG to raise awareness), but i think that cross-site functions mediated by the browser are not long for this world.

Thank you greedy advertising marketing people and scammers. Between spam and pervasive monitoring, you are (part of) why we can't have a nice internet.

Of course, the problem is not just the browser. Apple's iOS policing is one thing; but who is policing all the smart devices. A colleague explained how he was using DNS in his house to block calls from his TV to tracking services, and how the software is smart enough now to know to call around the configured DNS to one like Google's 8.8.8.8.
Tags:

First significant procratination of year (procrastination, watching notes, privacy, quaker notes)

elainegrey: Inspired by Grypping/gripping beast styles from Nordic cultures (Default)
Tuesday, January 12th, 2021 06:35 am
I've tried watching Bridgerton. The first episode didn't grab me. Episodes 2, with the moody Duke's backstory, did engage me, so i found myself binging episodes 3 and 4, which sort of wrapped up an arc of Daphne's debutante season. But, that done, i am less excited about watching the next episode. It is, apparently, a Queen focused episode. A friend really likes the Queen's character and i suppose her wit is made more plain in episode 5?

Spent all Monday morning before work on parsing the data release authorization and the privacy policy for the in home covid test. They want you to use their app and link up your fitness tracker. They've got all sorts of tests that i can see someone with a mysterious autoimmune or nutrient based condition wanting to take regularly to try and figure out what causes what. I am fascinated by what could be learned and horrified about what one might reveal. Until there is better granular control, i am so not interested in the possible benefits over the risks. I can imagine a level of misery at which i would be, though.

Things i avoided Monday:

* preparing meeting for business, i think it's the continued sense of dislocation about purpose.
* recruiter who is good with me working from home, because i feel i should waste an hour of both of our time, but i am very unlikely to want to consider it. [OK, replied]
* replying to a fiend about a time to talk because there's an odd tension in our Dec communications plus Christine went porcupine and i need to decipher the prickles. I don't want more drama.

Fie, there's a length limit on titles.
Tags:

Privacy

elainegrey: Inspired by Grypping/gripping beast styles from Nordic cultures (Default)
Thursday, August 15th, 2019 09:13 am
There was a somewhat blown out of proportion article about sharing your phone number on the NY Times, so i did a search on mine. I found out a page i had up to provide contact information on LJ was public. Ugh. What other free information was less concerning - the area code is associated with a place i haven't lived for 19 years, the carrier associated with the number is no longer the carrier, at least two random other names were associated with the number as well as Christine's.

It did lead me to go look at my privacy settings at twitter. You don't need a phone number there anymore, since they've long left their SMS dependency, so i removed it there. There was a setting that indicated i was allowing myself to be found by phone number, but i didn't find any results searching for my phone number before removing it.

I can be found on Telegram with my phone number, and i keep it open to chat with two people.

Obviously, someone who paid a data aggregator will get plenty of more or less accurate information (which drove the panic of the NY Times story). The state of North Carolina makes voting history (the elections in which you voted, by what method you voted) as well as gender, race, party affiliation, and residence all public, given first and last name (and includes a "sounds like" search on those fields). That database is available via other interfaces online that have indexed it differently. It seems Ohio and Florida are similarly free with their data (http://voterlist.electproject.org/states) while other states charge fees. I didn't look at all 50, but i did find those three states to be rather curious compared to other states pricing from $2.50 to $30 (California) to thousands of dollars to tens of thousands.
Tags:

Identity providers in the SAML sense and some things they can do

elainegrey: Inspired by Grypping/gripping beast styles from Nordic cultures (Default)
Friday, September 2nd, 2011 10:04 pm
For my friends who are interested in the nymwars and the US government's National Strategy on Trusted Identities in Cyberspace (NSTIC), this is a long post that hopes to establish how the technical term "Identity Provider" is a little different from establishing an online Identity.

It's late, i've left out lots, but there's lots of detail, that i think if you don't understand how the SAML Identity Provider technology works, you may misread in some technical discussion.

( Read more... )
Tags:

(no subject)

elainegrey: Inspired by Grypping/gripping beast styles from Nordic cultures (Default)
Monday, October 25th, 2010 07:22 am
I can't decide if i want Google to think i'm female or not:


From http://www.google.com/intl/en/privacy_tools.html & the Ads Preferences Manager.
Tags:
OSZAR »