Public or Private (1)

Transcription

1 100% Results from Tutorial 2012 Public or Private (1) 90% 80% 70% 60% CCST Mar, 2013 Dr. Hayden Kwok-Hay So Department of Electrical and Electronic Engineering 50% 40% 30% 20% 10% 0% No Depends Yes 2 Defining Public vs. Private n It is extremely difficult to define what is public information and what is private information n It depends on context, intention, convention, social norm, legal system, etc. n All of them very difficult to have a solid definition From Private to Public (1) E.g. Consider the fact that you like the girl sitting next to you. 1. You keep it to yourself without telling anybody Private to you, public to nobody else. 2. You tell the girl you like her, started to date each other, but you don t want other people to know about it Private to you and your girlfriend only 3 4

2 From Private to Public (2) 3. You two decided to let your closest friends knows about your relationship Public information among your friends, but not other people. 4. You two decided to get married Public to everybody And many more variations Variation on the situation n Before stage 3, you and your girlfriend are shopping in a public shopping mall, acting like a couple. Situation 1 A stranger on the street saw you two, and realized you two are dating each other Situation 2 Your parent walked by and saw you two, and realized you two are dating each other Do you feel your privacy being violated in either scenarios? 5 6 Some Definitions of Privacy n The issue isn t privacy but control: control of our information and our identities -- Jeff Jarvis, Public Parts, p.93. n privacy is not about controlling information, but about having the ability to control a social situation. -- dana boyd Reverse of Default n Note that in the earlier example, information starts from being private and progress into public information. è Public through effort n A new generation, pioneered by Facebook, has a reverse default that information is public by default è Private through effort E.g. message on a FB wall is viewable by all your friends/public by default, made private by setting it explicitly 7 8

3 Evolution of Facebook Default A visualization by Matt McKeon Questions to Ponder Upon n What kind of information about you is available, both offline and online? n How do you control the access to the information? n How do you control how your information can be used? n Where do you draw a line between public and private information? n How do you protect your private information? n Why do you need to protect your private information? 9 10 Content of your s/IMs n Almost 100% of the students said the contents of their s should remain private. Survey from CCST But are they really private? 11 12

4 A packet passes through many networks! All your conversations Tier 3 Tier-2 Tier-2 Tier 1 Tier 1 Tier-2 Sending Letters are transmitted as data packets that travel across the Internet. Everybody in the middle can take a look at your message. NAP Tier 1 Do you expect the postmen to read your content of your letter before they deliver your mail? Tier-2 Tier-2 Photo by gbaku Sending Postcards Content is wide open Are s/ims more like sealed letters or postcards? Do you expect the postmen to read the content of your postcard before they deliver your mail? 14 What makes the difference? Sealing envelope è do not expect people to see the content inside Photo by JohnnyEnglish - A. Letter B. Postcard 15 16

5 Encrypting your messages n One way to avoid people reading your IMs (and s) while it travels across the Internet is to encrypt the messages n Many kinds of encryption: Encrypting the content Application layer Encrypting the traffic Transport layer Encrypting the physical network And more Without Encryption Transport Layer Encryption With Server in Between 9c8sk 9c8sk e.g. When you type https in the web browser e.g. You may be connected to an e-commerce site securely with https, but the site relay your information insecurely

6 Caveats n The server in the middle will know all your /IM content The server knows exactly where and who are you talking to An adversary breaks into the server has the same knowledge n User do not know exactly what kind of encryption is used Usually just a simple encrypt chat button n Not all /IMs provide built-in encryption End-to-end Encryption Orange Orange b6c70 Orange Orange Built-in Encryption Facility? ICQ/AIM Yahoo Messenger Google Talk MSN messenger An adversary may obtain the transmitted information but true meaning is still hidden Example: Dorabella Cipher n Supposedly an encrypted message by music composer Edward Elgar to Miss Dora Penny in 1897 n True meaning remains unsolved until today n An example of Application Layer end-to-end encryption Application Layer Encryption n For example, if you and your friend understand apple means YES; orange means NO. Then everybody else will only see apple and orange But n You need different ways to code your message to different friends n Also, with insecure lower layer, you increase the chance that someone can break your encryption n E.g. It s quite easy to decrypt simple codebook messages like above if a bad person knows something about you 23 24

7 Encryption Summary n Transport layer encryption provides endto-end connection between two machines on the Internet n But many applications rely on the presence of a centralized server The server might be able to see all content in some cases n True, application-layer encryption avoid any entity in the middle to decrypt the content Administrivia n Quiz next week Covers lecture & tutorial materials since last quiz n Homework 1 is being graded Results will be available next week n Homework 2 will be posted by end of this week Individual homework Due 5 April 20% penalty per late day Submit through Moodle Automatic plagiarism check through integrated Turnitin function 27 28

8 Current Location n In the same survey from 2012 ~60% said private ~20% said depends n Most of you said depends on how precise the location information is OK if it is about the level of city NOT OK if it is very precise How well modern technologies can track your position? Knowing your Location n IP address n Global positioning system n WiFi access point association n Cellphone tower association n Digital photos n Many more 31 32

9 Identifying Computer n Computers are identified by the IP address on the Internet n Current standard (2012), IPv4 address expressed as 4 numbers between 0 to 255, separated by a dot E.g n Each computer MUST have a unique public IP address on the Internet Maximum about 4 billion addresses in IPv4 Locating IP Addresses n IP addresses are allocated by an international body called Internet Assigned Numbers Authority (IANA) n IP addresses allocated hierarchically IANA è Regional Internet Registries (RIR) RIR è Internet Service Provider () n The ownership of each IP address can be traced n i.e. A lot can be found out from just the IP address Information from IP address n From your IP address, many of the following information can be found: Your location Your The corresponding name n Try looking up the following IPs: n Free online tools: Other Information Exposed n Apart from IP address, many more information can be obtained about you: n E.g. Browser Screen resolution Your computer platform n Try:

10 Using your IP location? Datacenter Co-Location Localized Recommendations n Large companies have their data replicated across the globe through colocation E.g. Google, YouTube, Yahoo, etc Allow much faster access to data by redirecting your traffic to the nearest datacenter geographically n Localized service Local search results from Google Localized advertisements Targeted Advertisement n 37 Geographical Location Restrictions 38 Discussion Companies restrict contents to particular physical locations Do you mind your current IP address be known to the webserver (e.g. Facebook, YouTube) you are connected to? A. Yes B. No C. I have no choice 39 40

11 Hiding your IP n One way (there are many ways) to obscure your IP address is to use a proxy server Originally designed for performance enhancement/ management n Instead of connecting from A to B Connect from A to C Ask C to connect to B Web server Returns the result to A proxy Tradeoff in using Proxy Server n Now all your traffic has to go through the proxy server It knows all your content Why would someone wants to redirect your content? For profit? n On the other hand, some companies, countries require the use of proxy servers All contents are managed Filter out unwanted contents Content audit With proxy Without proxy client 41 42