Cybersecurity Project

2010-01-29T02:50:36Z

Jharrow:

File:Amazon3.png

2010-01-29T02:49:26Z

Jharrow:

File:Amazon2.png

2010-01-29T02:47:44Z

Jharrow:

File:Amazon1.png

2010-01-29T02:45:31Z

Jharrow:

Cybersecurity Project

2010-01-29T02:45:12Z

Jharrow: /* More on the Stronger Password Feature */

Saying that cybersecurity is a "difficult problem" is like saying that reversing global warming is a difficult problem: it's true, but it doesn't quite capture how devilishly complicated and multifaceted the problems really are. There's no single reason why creating a more secure global network is so difficult; it in part has to do with the radically-distributed architecture of the Net, in part with some deep flaws computer software, and in part just from its sheer size and importance to our daily lives. (For more on this, see the nice [[Cybersecurity]] backgrounder.)

So we came in not with the goal of providing a magical elixir that would make all credit card transactions magically secure and make it impossible for hackers to [http://googleblog.blogspot.com/2010/01/new-approach-to-china.html compromise Gmail's security]. Instead, we wanted to offer suggestions with minimal implementation headaches and maximal benefit to users, from novices to experts. This page has a short video overview of the ideas, explains some of the details of our proposal, and even has an alpha-release Firefox plugin that you can download and try out (thanks to [http://www.elance.com/ Elance] for this, by the way).

==Overview==

We discussed this topic at length in an in-class presentation on January 19. [http://www.vimeo.com/9036735 This] 9-minute video summarizes and extends the presentation we gave that day.

==Specific Proposals==

===Public Service Announcement===

We created a Public Service Announcement for generating public awareness for the cybersecurity problem, and showed in class on January 19. It's online [http://vimeo.com/8937782 here] but is password-protected. Please email us if you were in the class and would like the password. In sum, we don't think a direct public awareness campaign will be very effective. We want to nudge users and change their behavior by changing the way browsers and websites work, not by scolding people.

===SafeWord===

====What is SafeWord?====

SafeWord is a real, working FireFox plugin designed to nudge users into keeping safer and more unique passwords, though it's too unstable and unrefined to be considered anything buy alpha software. It's available for download [http://www.jasonharrow.com/safeword-1.0.0-fx.xpi here]. To install, save that file to your disk, select File --> Open in Firefox 3.5 or above, and install it. You will need to restart Firefox before it takes effect. Thanks to Elance for helping with the coding on very short notice.

We have created a video demonstration of one of the key features of SafeWord [http://vimeo.com/9031865 here].

====What Are The Goals of SafeWord?====

SafeWord begins with a simple proposition: online passwords should be strong and different for different sites, and your browser should help you acheie that goal. Studies continue to show that most users use very simple passwords; see, for instance, [http://www.nytimes.com/2010/01/21/technology/21password.html this] ''New York Times'' that gets right to the point. "If your password is 123456," reads the headline, "just make it HackMe." Moreover, most users also fall into the "dirty habit" of using the same password across multiple online accounts, which can lead to a disaster if only one of the accounts is able to be compromised. An extremely detailed analysis of a 2009 attack that compromised many online accounts of Twitter employees is [http://www.techcrunch.com/2009/07/19/the-anatomy-of-the-twitter-attack/ here].

====More on The Unique Password Feature====

=====A Scary Story, and A Word About Annoyance=====

Even readers who are all for stronger passwords in general may nonetheless be skeptical of what can happen to "regular people" who can't be bothered to remember so many passwords, here's a very scary story - which is taken directly from the [http://www.techcrunch.com/2009/07/19/the-anatomy-of-the-twitter-attack/ Twitter attack analysis] cited above - of what can happen if users employ the same password at multiple important sites:

# HC [the hacker's alias] accessed Gmail for a Twitter employee by using the password recovery feature that sends a reset link to a secondary email. In this case the secondary email was an expired Hotmail account, he simply registered it, clicked the link and reset the password. Gmail was then owned.
# HC then read emails to guess what the original Gmail password was successfully and reset the password so the Twitter employee would not notice the account had changed.
# HC then used the same password to access the employeeâs Twitter email on Google Apps for your domain, getting access to a gold mine of sensitive company information from emails and, particularly, email attachments.
# HC then used this information along with additional password guesses and resets to take control of other Twitter employee personal and work emails.
# HC then used the same username/password combinations and password reset features to access AT&T, MobileMe, Amazon and iTunes, among other services. A security hole in iTunes gave HC access to full credit card information in clear text. HC now also had control of Twitterâs domain names at GoDaddy.
# Even at this point, Twitter had absolutely no idea they had been compromised.

It ain't pretty.

We admit from installing SafeWord on our computer that the aspect of the program that requires you to use a different password for each new login is, well, pretty damn annoying. Complying with its demands to keep generating unique passwords might even require some old-fashioned tricks, like the creation of some sort of heuristic for generating memorable but unique passwords or keeping a card in your wallet with your various logins. But we think that the cost/benefit analysis weighs in favor of life being just a little more annoying in this area, because as our scary story illustrates, there are '''lots''' of ways in to our various accounts, and '''lots''' of random people out there who would love to hack those accounts for financial gain or to get their kicks.

=====Why Do It This Way?=====

There are other solutions out there that automatically generate secure, unique passwords for each site you visit; [https://lastpass.com/features_free.php LastPass] is a particularly nifty one. But they all share several key points of failure: they rely on a master password, and they store your passwords in the cloud. Relying on a master password is particularly problematic, because a compromise of that password can lead to the same disastrous chain of events that we are trying to prevent. The only way to truly reduce the risk of this type of threat is to decentralize everything. And if that takes encouraging people to work a little harder, we at least want to make people aware that this just might be worth the hassle.

=====Extension v. Built-in Feature=====

Initially, we hoped to build this extension to make a pitch to Mozilla that they should think about building this kind of functionality into the browser. But as I have a now-working copy of SafeWord in my browser - admittedly, it's an alpha copy that's not even close to ready for prime-time - I (i.e. jharrow) see that it's just too intrusive for mainstream users. If the average, busy user gets a pop-up every time he comes across a new website and tries to use an old password, he will get angry at the browser. If this happens a few times, he will probably switch. So right now, the idea works best as an extension for people who really believe in password security and want a little nudge. It will be supremely difficult to think of a solution in this area that can truly capture the masses.

====More on the Stronger Password Feature====

On the other hand, the idea of adding a feature that helps users create more secure passwords is a simple fix that should enhance the browsing experience for most users.

Increasingly, many websites are giving users some guidelines on password security. For instance, Yahoo!'s sign-up page looks like this:

[[Image:Yahoo.png]].

We think that's great. But not all sites have that feature. For instance, you get no visual feedback if you sign-up for an Amazon account with a weak password:

File:Yahoo.png

2010-01-29T02:40:43Z

Jharrow:

Cybersecurity Project

2010-01-27T23:58:38Z

Jharrow:

2010-01-07T18:25:00Z

Jharrow:

Day 4 Predictions

2010-01-07T18:24:21Z

Jharrow:

Amanda: I am very interested to hear Chuck's take on the relationship between the government, large corporations like Microsoft, and the defcon-attending hacker community (like the L0pht group mentioned in the Wired article). Is the government receptive to both groups? I imagine the relationship specifically between the hacker community and the government can become tense because the interests of both groups is not exactly aligned and is sometimes conflicting. Have they been able to successfully work together around a common threat like cybersecurity? While I imagine the government often tries to recruit from the hacker community, and I'm interested to hear where they draw the lines legally as far as subversive behavior within the hacker community (ie do they bend the rules for the sake of potential advances in cybersecurity?).
:Of course there are great advances yet to be made in the relationship between white-hat hackers and corporations like Microsoft. Skepticism abounds from both sides for obvious reasons, as well as entrenched interests and preconceptions based on past interactions ("Hackers are simply criminals", or on the other side "Microsoft is The Man").

Vickie: I'm going to dovetail from Amanda's comment and say that I think Chuck is going to speak more specifically about the ID program he was talking about the other day as a possible solution to cybersecurity. Just as in the Wired article - identification solves a large percent of the problem, mostly through accountability. However, this seems too Orwellian for my blood. Unlike a passport that is shown in person - a computer ID is never going to be checked person to person. The computer will always be the intermediary. Moreover, this type of program may deter people from doing things on the Internet that they normally would do - if it wasn't anonymous. Visit certain political sites, fetish sites etc. etc. At what point is our fear balanced by our need for an Internet that is not being surveyed.

:Ramesh: I wonder what Chuck would say are the benefits to anonymity on the internet, and whether they are outweighed by the security risks. It seems like there could be a creditable argument saying just that. Also, I wonder about problems in scaling up ID programs -- one would assume that many countries would not participate, but if desirable content could only be accessed by an ID, perhaps consumers would then demand their nations also issue internet IDs.

Hector: Some of Chuck's points from his remarks on Tuesday that stuck with me most were the strengthening of internet identification and alternative networks that use something else than TCP. I hope that he elaborates on the possible applications of the latter.

Lien: I'm very interested to hear (i) what Chuck thinks the biggest cybersecurity risk is that Microsoft and other simular major private companies face and (ii) how the company is prepared for attack on its system and will react on it. I however predict he's not gonna answer that question...

Reuben: On Tuesday we spent a great deal of time on the attribution problem of cybersecurity which is related to deterrence and retaliation. I'd like to hear more about that, but I'd also like to hear about how we shore up our own defenses and incentivize security. I'll be interested to hear who Chuck thinks should be responsible for security. There is a dilemma for a company like Microsoft that may not want to have the burden of cybersecurity thrust upon them, but may also resist government mandates and control. I think Chuck will probably recognize that both public and private sector have a role to play, but he will emphasize the need for government to provide more leadership in the area.

Jason: Especially since we have already had some discussion on the security issue, I think the class will be able to offer some interesting solutions, especially high-up in the stack, like user behavior, software, ID schemes, and other things that happen at the end node. But I predict that we'll be somewhat flummoxed about what's going on and what to do about the fundamental nature of the network, like the implications of the stuff that Clark was talking about in [http://www.ischool.berkeley.edu/newsandevents/events/sl20090304 his talk] that we listened to. I certainly am - at least for now.

Day 3 Thoughts

2010-01-07T18:17:08Z

Jharrow:

Tyler: I am wondering if the terms in AMT's conditions of use that works prepared by turkers are to be considered works for hire would be considered valid. My initial instinct is that it would not necessarily be so.

: To paraphrase, the Copyright Act defines a work for hire as (17 U.S.C. 101):

* 1) a work prepared by an employee within the scope of his or her employment
** The factors to make determination were listed in the CCNV v Reid case (790 U.S. 730, 1989)
*** The two most important factors are provision of employee benefits and tax treatment (from Aymes v. Bonelli, 980 F.2d 857, 1992)
* OR 2) a work specially ordered or commissioned for use as a contribution to a collective work if:
** 1. category: is one of:
*** part of a motion picture or other audiovisual work
*** a translation
*** a supplementary work â adjunct to a work made by another author
*** a compilation
*** an instructional text â systematic instructional activities
*** a test
*** answer material for a test
*** an atlas
** 2. intent: if the parties expressly agree in a written instrument signed by them that the work shall be considered a work made for hire
must fit into one of the 8 categories to be a contracted work made for hire (p132)
Most work produced for HITs would not seem to fall into either of these categories.

::Michael: I think many works produced through HITs are going to be considered compilations or collective works. Certainly David's Sheep or 100 Dollar Bill are compilations so long as they are taken as a whole. Even in any attempt to monetize the individual elements, the Turk Participation Agreement states that any works which cannot be considered works for hire are assigned to the requester. (full text copied below)

::Section 3(a): "As a Provider, the Requester for whom you provide Services is your client, and as such, you agree that the work product of any Services you perform is deemed a "work made for hire" for the benefit of the Requester, and all ownership rights, including worldwide intellectual property rights, will vest with the Requester immediately upon your performance of the Service. To the extent any such rights do not vest in Requester under applicable law, you hereby assign or exclusively grant (without the right to any compensation) all right, title and interest, including all intellectual property rights, to such work product to Requester." [https://www.mturk.com/mturk/conditionsofuse The full policy can be found here.]

::Jason: Michael just sort of stole my mojo - I was about to say a similar thing - but Tyler, I guess I too don't see why you think HITs are not works-for-hire under test 2. Take the book about cats: it seems to me that Bjoern specifically ordered those stories for his compilation, which would fall under the rule. I guess there could be a problem of asymmetry if both parties need to know that they work is being commissioned, since in many cases only the commissioner might know what it's being used for. But given the Mechanical Turk terms of service that Michael reproduces above - which probably constitutes a "written instrument" - I think the Turker would be hard-pressed to argue that he had zero notice, even if he didn't know specifically what his work would be used for.

:::Andrew: I think there's certainly enough wiggle room in the words "specially ordered or commissioned" to support a claim that the AMT contract does not effect WMFH status, at least in some cases. Take the cats book: When it was ordered, Bjorn himself didn't know what he was going to do with the cats when he got them. How could he argue that he had "specially ordered or commissioned" them for that compilation at the time of the contract? More generally, I think the 'meeting of the minds' aspect is more important than Jason suggests, given that it's the basis of so much doctrine in contract interpretation. That is, I think it's an open question whether a task which the performer does not know to have a certain purpose can be said to be "specially ordered or commissioned" for that purpose with regard to the written instrument.

::Sharona: While I agree with Jason and Michael that this is probably a work made for hire, do you think this may run into contracts of adhesion problems? Or, do you think if the average turker was aware of what his "original" (after all, to be copyrightable, it must be original) work would be used for, he would have agreed to the Participation Agreement? Does it matter?

::Tyler: To follow up on my original thought, I agree that an argument could be made for HITs to be WMFH, but I see big problems with the "specially ordered or commissioned" language as Andrew mentioned. Also, I'm not sure mention in the terms of service would qualify as a written instrument signed by both parties.

:::Jason: Hmmm, that's interesting. After doing a bit more reading, I agree that the WMFH requirements are a bit stricter than I thought they were, so I do see your point, even though I stand by the view that the cat book contributions likely qualify as works made for hire. Maybe we need to find a HIT that becomes a creative work and then sue the compiler for copyright violation to find out? Sure, it'd be an ironic copyright suit coming from this group, but we can work around that.

Victoria: I think what bothers me most about Ub. Hum. Comp. through tools like Mechanical Turk and re-Captcha is the lack of transparency. I think a lot of the fear about these programs - that lead to the Iranian hypo stem from a lack of transparency. The task master is not required to say what the micro task is for. However, what I found to be a fascinating comment last night in response to this came from Bjoern. After publishing the cat book he said he asked a test group if it was OK to publish the book without asking first. Bjoern reported that the Turkers seemed to be OK with it. I wonder if it is just the non-Turkers (like myself) that have a problem with the lack of transparency and dream up these dystopic problems.

Secondly in addition to transparency I have a problem with the micro-tasking. Although Aaron's artwork is completely beautiful - Crowdflower kind of makes me feel uneasy at times - especially when thinking that it could eventually be tapped into on an IPhone app during a person's idle time and that a security guard is doing it while he is supposed to be engaged in surveillance. By making the tasks so short and small Turk infuses money-making into every aspect of life. It makes everything a cost-benefit analysis. Should I go to the beach and read a Magazine or make money. Should I stand in line and think about what I have to cook later or make money? Should I spend time with my family or make money?

Day 3 Thoughts

2010-01-07T07:51:31Z

Jharrow:

2010-01-05T19:26:55Z

Jharrow: New page: I'm a 2L at Harvard Law School, though I am reconsidering the wisdom of that decision with every day I spend in sunny California. You can follow me on twitter [http://twitter.com/jharrow21...

I'm a 2L at Harvard Law School, though I am reconsidering the wisdom of that decision with every day I spend in sunny California. You can follow me on twitter [http://twitter.com/jharrow216 @jharrow216].

Day 2 Predictions

2010-01-05T19:23:39Z

Jharrow: /* Mark */

= Mark =

Sheel: Cisco, with its involvement in China's Golden Shield Project and $16 Billion investment (http://www.socialfunds.com/news/article.cgi/2825.html), doesn't want to have to deal with issues of human rights that might diminish ROI. Notable quote from article and 2008 testimony: Chandler said, "Cisco does not customize, or develop specialized or unique filtering capabilities, in order to enable different regimes to block access to information." My guess: Mark Chandler will affirm this statement tomorrow, but the real reason is that following the GNI principles would be a poor business decision and CISCO isn't willing to make any sacrifice.
: Elisabeth: we might push back on the idea that this would be a poor business decision, and solicit Cosson and Hope's opinions. Yahoo and Google have faced real backlash for their actions, and GNI serves as something of a safety net against that backlash. We could also ask Chandler if he can imagine how GNI could be structured such that it would be worthwhile for Cisco to join--it would be interesting to see if what he says matches up with what Cosson says GNI needs to do to recruit new members.
:: Andrew: I doubt Chandler would be cynical (frank?) enough to respond this way, but Cisco may be shielded from the kind of "PR risks" that Yahoo/Google/Microsoft face, since their products and services reside below the content layer and are less intuitively understandable to the general public. Along these lines, I hope to hear some discussion about the sources of contention between stakeholders at different architectural layers. How do differences in the type of actions governments request from these companies translate to materially different policy preferences, given the extreme broadness of the principles at issue?
:: Hector: I agree with Andrew and wonder whether Cisco will go to lengths to emphasize the hardware-side of its products/services. This may be a more palatable version of JZ's "gun's don't kill people" framing: "Look, we provide hardware and the software interfaces that are infinitely customizable." Such an argument works only to the extent that the products/services are general-use (generative?) and the extent that CISCO is '''truly''' removed from any immoral end-use.
: Jason: I doubt that he will emphasize ROI and the need to make money to a group like ours - or, at least he won't explicitly mention his company's desire to make billions of dollars. Instead, I suspect that Mark will emphasize the need for more Internet infrastructure in developing countries, and the uncertain effect of the GNI in terms of continuing to do business everywhere. He would be right about that need - see, for instance, the Internet density map [http://www.chrisharrison.net/projects/InternetMap/medium/worlddotblack.jpg here]. So he can ask us rhetorically, "What is Cisco supposed to do? Don't you cyberlaw students want people in China and Southeast Asia and the Middle East and Africa to get online, too? If so, those countries need our hardware - and we can't choose who runs their governments!" And you know what? If he says this, he will have a very, very good point.

Daniel: I believe Chandler will provide his professional - and hopefully personal - account on the role CISCO plays in [facilitating / enabling / providing neutral tools] to allow for "different regimes" to control their nationals' internet experience. Cosson and Hope will probably dedicate more time to in depth discussion of two issues: involvement of industry actors other than the GNI founding members and the types of incentives that are needed for that, including legal alternatives and public exposure of "do some evil" firms. Also, given that we will not have representatives from Google and Yahoo, these companies are likely to figure prominently in the examples of events, actions and concessions to be avoided.

Sanford Lewis: I predict that Mr. Chandler will not discuss in very much depth the extent to which external stakeholder and stockholder pressure has shaped company policy, unless he is prompted by student questions to discuss this.

Lien: The GNI principles are so general and an "implementation / repetition" of international standards. If a certain company (for whatever reason) does not want to join the GNI, this company still has to comply with these standards. To play the devil's advocate, does joining the GNI change anything in reality or is it just a good thing to join because of the company's image and reputation? Furthermore, the concept of the GNI (sort of self- regulation) is a very American concept. European companies are not very familiar with the kind of approach. The GNI might be a good starting point for a company to obey the certain principles. However, the privacy principles are so broadly written, that if a company would obey to these principles, it would still not be comply with European Privacy legislation. Why would a European company then join the initiative and do all the efforts (e.g. audit, ...), knowing that it would still not comply with European legislation?
: Elisabeth: I also wonder how true it is that these are "international" standards, rather than American or American/European standards.

= Dunstan =
Tyler: I believe Dunstan will try and draw a distinction between situations involving two types of countries. The first type is countries with laws in accordance with GNI principles but that are not enforced or poorly enforced. The second type is countries with laws that on their face are violative of GNI principles. I hope Dunstan will discuss strategies that corporations should use for situations that arise involving both types of countries and the different approaches that GNI stakeholders can collectively take to preemptively forestall problems in each of the two types of countries.
: Daniel: It would be great if we further explored the (blurring) division between these two country-types. Was Google's first move in the negotiation with Turkey - accepting to block videos insulting AtatÃ¼rk, but only within the country's limits - OK under the GNI principles? How much can a country legitimately curb freedom of speech, according to the GNI framework? IMO, its diplomatic language allows for an "American" interpretation, but also for an "European" one and perhaps others even more restrictive.

= Chuck =

Tyler: I expect Chuck to express frustration that more corporations have not signed up for GNI and identify some specific reasons why he thinks GNI has so far been unable to recruit any additional corporations from the initial roster of three (Yahoo!, Google, Microsoft). I also hope that Chuck discusses what preparations Microsoft has made to allow GNI auditors access the sensitive Microsoft information.