Public or Private (1)

Transcription

1 Pi Day: 3.14 Public or Private (1) CCST Mar, 2012 Dr. Hayden Kwok-Hay So Department of Electrical and Electronic Engineering Results from Tutorial Compare to Results from % 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Age Gender Birth date address content Web page currently viewing Web browsing history Current Location Content of your IM School grades Photos of you Video of you Your phone call content Phone numbers you have dialed in the past week Bank account number Bank account password Mobile phone number What's on your mind Relationship status What you did yesterday night when you were on the street Political view No Depends Yes % 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Age Age Gender Gender Birth date address Birth date address content content Web browsing history Web page currently viewing Web page currently Web browsing history Current Location Content of your IM Current Location Content of your IM School grades School grades Photos of you Photos of you Video of you Your phone call content Video of you Your phone call content Bank account number Phone numbers you have Bank account number Phone numbers you have Mobile phone number Bank account password Mobile phone number Bank account password Relationship status What's on your mind Relationship status What's on your mind What you did yesterday What you did yesterday Political view Political view 3 4 Defining Public vs. Private n It is extremely difficult to define what is public information and what is private information n It depends on context, intention, convention, social norm, legal system, etc. n All of them very difficult to have a solid definition From Private to Public (1) E.g. Consider the fact that you like the girl sitting next to you. 1. You keep it to yourself without telling anybody Private to you, public to nobody else. 2. You tell the girl you like her, started to date each other, but you don t want other people to know about it Private to you and your girlfriend only 5 6 1

2 From Private to Public (2) 3. You two decided to let your closest friends knows about your relationship Public information among your friends, but not other people. 4. You two decided to get married Public to everybody And many more variations Variation on the situation n Before stage 3, you and your girlfriend are shopping in a public shopping mall, acting like a couple. Situation 1 A stranger on the street saw you two, and realized you two are dating each other Situation 2 Your parent walked by and saw you two, and realized you two are dating each other Do you feel your privacy being violated in either scenarios? 7 8 Some Definitions of Privacy n The issue isn t privacy but control: control of our information and our identities -- Jeff Jarvis, Public Parts, p.93. n privacy is not about controlling information, but about having the ability to control a social situation. -- dana boyd Reverse of Default n Note that in the earlier example, information starts from being private and progress into public information. è Public through effort n A new generation, pioneered by Facebook, has a reverse default that information is public by default è Private through effort E.g. message on a FB wall is viewable by all your friends/public by default, made private by setting it explicitly 9 10 Evolution of Facebook Default A visualization by Matt McKeon Questions to Ponder Upon n What kind of information about you is available, both offline and online? n How do you control the access to the information? n How do you control how your information can be used? n Where do you draw a line between public and private information? n How do you protect your private information? n Why do you need to protect your private information?

3 14/3/12 Content of your s/IMs n Almost 100% said the contents of their s/IMs should remain private. But are they really private? 13 A packet passes through many networks! All your conversations Tier 3 Tier-2 Tier 1 Tier 1 Tier-2 Tier-2 Do you expect the postmen to read your content of your letter before they deliver your mail? Tier-2 Tier-2 15 Sending Postcards Content is wide open Are s/ims more like sealed letters or postcards? Do you expect the postmen to read the content of your postcard before they deliver your mail? Photo by JohnnyEnglish - What makes the difference? Sealing envelope è do not expect people to see the content inside 14 are transmitted as data packets that travel across the Internet. Everybody in the middle can take a look at your message. Photo by gbaku - Sending Letters NAP Tier 1 A. Letter B. Postcard 18 3

4 Encrypting your messages n One way to avoid people reading your IMs (and s) while it travels across the Internet is to encrypt the messages n Many kinds of encryption: Encrypting the content Application layer Encrypting the traffic Transport layer Encrypting the physical network And more Without Encryption Transport Layer Encryption With Server in Between e.g. When you type https in the web browser 21 e.g. You may be connected to an e-commerce site securely with https, but the site relay your information insecurely. 22 End-to-End Encryption Encryption Summary n Transport layer encryption provides endto-end connection between two machines on the Internet n But many applications rely on the presence of a centralized server The server might be able to see all content in some cases n True, application-layer encryption avoid any entity in the middle to decrypt the content

5 Application Layer Encryption Example n For example, if you and your friend understand apple means YES; orange means NO. Then everybody else will only see apple and orange But n You need different ways to code your message to different friends n Also, with insecure lower layer, you increase the chance that someone can break your encryption n E.g. It s quite easy to decrypt simple codebook messages like above if a bad person knows something about you 25 Caveats n The server in the middle will know all your IM content Unless application-layer (end-to-end) encryption is used n In any case, the server knows exactly where and who are you talking to n User do not know exactly what kind of encryption is used Usually just a simple encrypt chat button n Not all IMs provide built-in encryption Built-in Encryption Facility? ICQ/AIM Yahoo Messenger Google Talk MSN messenger Administrivia n Quiz next week Covers lecture & tutorial materials since last quiz n Homework 1 is being graded Results will be available next week n Homework 2 will be posted by end of this week Individual homework Due in 5 April 20% penalty per late day Submit through Moodle Mandatory plagiarism check through integrated Turnitin function 29 Administrivia Project Component Mark Remark Midterm Presentation Final Presentation 4 3 Minutes presentation, 1 slide 8 8 minute presentation + 2 minutes Q&A No limit on # of page Recommend 1 or 2 presenters Summarize results Be entertaining too! Website 12 Use Wordpress as a content management system Account created based on your HKU Information will be sent to your address A blank site template will be created for each group Each group member may modify and insert content for the project 15 mins introduction next week during tutorial Final report (individual) 6 Part 1 (4 pts) Summarize project findings and your role in the project Part 2 (2 pts) review of 5 other projects 30 5

6 Quick Demo of Project Current Location n ~60% said private n ~20% said depends n Most of you said depends on how precise the location information is OK if it is about the level of city NOT OK if it is very precise How well modern technologies can track your position? Knowing your Location n IP address n Global positioning system n WiFi access point association n Cellphone tower association n Digital photos n Many more Identifying Computer n Computers are identified by the IP address on the Internet n Current standard (2012), IPv4 address expressed as 4 numbers between 0 to 255, separated by a dot E.g n Each computer MUST have a unique public IP address on the Internet Maximum about 4 billion addresses in IPv

7 14/3/12 Locating IP Addresses Information from IP address n IP n From your IP address, many of the following information can be found: addresses are allocated by an international body called Internet Assigned Numbers Authority (IANA) n IP Your location Your The corresponding name addresses allocated hierarchically IANA è Regional Internet Registries (RIR) RIR è Internet Service Provider () n Try n The ownership of each IP address can be traced n Free n i.e. A lot can be found out from just the IP address looking up the following IPs: online tools: Using your IP location? Other Information Exposed Localized Recommendations n Apart from IP address, many more information can be obtained about you: n E.g. Browser Screen resolution Your computer platform n Try: Targeted Advertisement Geographical Location Restrictions Datacenter Co-Location n Large companies have their data replicated across the globe through colocation Companies restrict contents to particular physical locations E.g. Google, YouTube, Yahoo, etc n Allow much faster access to data by redirecting your traffic to the nearest datacenter geographically n Localized service Local search results from Google Localized advertisements

8 Discussion Do you mind your current IP address be known to the webserver (e.g. Facebook, YouTube) you are connected to? A. Yes B. No C. I have no choice Hiding your IP n One way (there are many ways) to obscure your IP address is to use a proxy server Originally designed for performance enhancement/ management n Instead of connecting from A to B Connect from A to C Ask C to connect to B Web server Returns the result to A proxy With proxy Without proxy client Tradeoff in using Proxy Server n Now all your traffic has to go through the proxy server It knows all your content Why would someone wants to redirect your content? For profit? n On the other hand, some companies, countries require the use of proxy servers All contents are managed Filter out unwanted contents Content audit Next time n Global Positioning System n WiFi n Mobile Phone