Posts Tagged

Privacy

Zoom pauses new feature development to focus on privacy, security

Zoom has decided to cease development of new product features so it can focus on fixing various privacy and security issues.

The company has seen a surge in the use of its platform in recent weeks, as self isolation in response to the Covid-19 pandemic ramps up the demand for video software. As its popularity has boomed – both for business and personal use – and the company’s stock price rocketed, underlying vulnerabilities in the platform have become apparent. 

“Zoom-bombing,” where intruders have been able to access video meetings that were not password protected, has led to serious privacy concerns, with uninvited attendees harassing online A.A. meetings and church meetings, for example. The FBI this week warned of unauthorized access to virtual classrooms and recommended that users change security settings to protect meetings. 

Meanwhile, Elon Musk’s SpaceX aerospace company apparently banned the use of Zoom by its 6,000 employees because of privacy and security worries, according to  Reuters. Zoom has also come under fire for a vulnerability that enabled hackers to steal passwords on Windows devices, though that flaw has since been addressed.

Zoom CEO apologizes for recent issues

In response to the growing concerns, Zoom CEO Eric Yuan published a blog post Wednesday detailing the company’s response. He said that over the next 90 days Zoom will direct necessary resources to “better identify, address, and fix issues proactively.

“We are also committed to being transparent throughout this process. We want to do what it takes to maintain your trust,” he said. 

Measures include a “freeze” on feature development, with Zoom engineers told to focus on “trust, safety and privacy issues.”

The company also plans to work with “third-party experts” to review security for consumer use of its platform; create a council of CISOs to discuss security best practices; create a transparency report in relation to “requests for data, records, or content;” expand Zoom’s bug bounty program; and conduct white box penetration tests to identify other security issues. 

Yuan will also host weekly webinars to provide privacy and security updates.  

Zoom needs to prove it’s enterprise-ready

Zoom is going “above and beyond” by putting its roadmap on hold to address recent concerns, said Raul Castanon, senior analyst for workforce collaboration at 451 Research / S&P Global Market Intelligence. “This should help restore confidence with enterprise users, assuming the company comes up with a clear list of improvements after the 90-day period.

“Zoom is getting a lot of attention with the pandemic, and the security issues could actually be an opportunity for the company to prove it can address privacy and security for its enterprise customers,” he said.

However, Zoom still has a way to go in terms of ensuring that its platform is ready for enterprise use.

“Yuan contradicts himself with his comment about Zoom being developed for enterprise customers ‘with full IT support’ and not a ‘broader set of users,’” Castanon said. “It is true that the pandemic is uncovering opportunities for improvement – not just for Zoom, but for most vendors – but the security flaws that have come up show the platform is not quite enterprise-grade. Yuan could have been better off without that remark.”

In another privacy incident, Zoom is being sued in California for sharing user data with Facebook. Zoom said in a March 29 blog post that it “has never sold user data in the past and has no intention of selling users’ data going forward,” and would remove the Facebook SDK (software development kit) from its iOS client, which it said was responsible for collecting device data.

Castanon commended the way Zoom handled privacy issues related to the Facebook SDK.

“Zoom will be okay, but this incident will further damage Facebook’s reputation,” he said. “Mark Zuckerberg should pay close attention to Eric Yuan’s detailed response about how Zoom is addressing security and privacy concerns.”

Copyright © 2020 IDG Communications, Inc.



Source link

Apple wants privacy laws to protect its users

Your iPhone (like most smartphones) knows when it is picked up, what you do with it, who you call, where you go, who you know – and a bunch more personal information, too.

The snag with your device knowing all this information is that once the data is understood, that information can be shared or even used against you.

Information is power

Jane Horvath, Apple’s senior director for global privacy, appeared at CES 2020 this week to discuss the company’s approach to smartphone security. She stressed the company’s opposition to the creation of software backdoors into devices, and also said:

“Our phones are relatively small and they get lost and stolen. If we’re going to be able to rely on our health data and finance data on our devices, we need to make sure that if you misplace that device, you’re not losing your sensitive data.”

Privacy should not be a leaking bucket

Her approach is correct, of course. After all, once you create a security backdoor for one government, you’ll be forced to share it with every government. Once that happens, it’s only a matter of time before that information leaks into the hands of bad actors, with the result that no one’s data is safe.

Enterprise data will also become less safe, which threatens the security of connected infrastructure across the board.

Think of a security backdoor as being a hole in a bucket that only gets larger over time. Eventually the bucket stops working, water gets everywhere and all your secrets slip.

How Apple sees things

Apple’s approach to security:

  1. It tries to minimize the amount of personal information it gathers about its users, and tries to disconnect that data from a person’s identity.
  2. It aims to create services that require minimal personal data while using on-device AI to personalize user experiences – that way the data is never seen or used by the company. Differential privacy, CoreML, and assigning Siri and Maps requests to a random number rather than using a person’s Apple ID form part of this effort.
  3. It offers iCloud as a secured space in which customers can store their documents, images and other information.
  4. It attempts to empower users with tools with which to control their privacy.

What’s important to understand with this model is that while much of the information your device gathers is protected (unless you grant permission to specific apps to access it), data held in iCloud is not subject to the same protection and can be made available subject to warrant.

At the same time, Apple’s privacy protections can be confusing; the company’s recent decision to make it possible for people to opt out of sharing Siri recordings for “grading” was welcome, but the tools are still rather opaque.

iCloud thinks different

This is why Apple has teams whose job it is to help law enforcement with criminal/security queries. The information on your device is impossible to access, while data held in iCloud is accessible once a warrant is presented and accepted.

Not only can a great deal of information concerning location also be gathered by a request from cellular providers, but some of the most incriminating information is almost certainly available in the less-secured iCloud account.

Horvath referred to this during her CES appearance when she confirmed the company uses a set of tools to scan iCloud Photo libraries for child pornography.

To me, it seems reasonable to assume that those aren’t the only egregious acts Apple might monitor accounts for. That Apple actively already works to protect the public rather undermines the argument that even more access to personal data is required.

Privacy is a confusing mess

On an industry-wide basis, there’s still too much confusion. Internet services have been offering convenience in exchange for personal information for so long that many people have become accustomed to sharing data.

Added to that, the lack of a consistent set of principle or access protocols regarding  user privacy makes for a lack of a core set of consumer privacy standards.

Apple seems to believe government regulation is required in order to help promote a more consistent approach to privacy.

“We should consider a strong privacy law that is consistent across all 50 states that provides all consumers, regardless of where they live, the same protections,” said Horvath.

We’ve some way to go, as continued attempts to force tech firms to create those security backdoors in their products prove some in government don’t grasp the challenge of privacy in a digital age. (Though some do get it.)

While we wait for the industry and government to figure out a consistent approach, here are some guides to help iOS users manage their privacy using the tools Apple provides:

Finally, I currently recommend iPhone users take a look at the incredibly useful Jumbo app. This provides a range of privacy management and monitoring tools designed to easily put you in charge of what entities such as Apple, Facebook, Google or others are doing with your information.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Copyright © 2020 IDG Communications, Inc.





Source link

Apple’s wants privacy laws to protect its users

Your iPhone (like most smartphones) knows when it is picked up, what you do with it, who you call, where you go, who you know – and a bunch more personal information, too.

Information is power

The snag with your device knowing all this information is that once the data is understood than that information can be shared or even used against you.

Jane Horvath, Apple’s senior director for global privacy, appeared at CES 2012 to discuss the company’s approach to smartphone security.

She stressed the company’s opposition to the creation of software backdoors into devices, and also said:

“Our phones are relatively small and they get lost and stolen. If we’re going to be able to rely on our health data and finance data on our devices, we need to make sure that if you misplace that device, you’re not losing your sensitive data.”

Privacy should not become a leaking bucket

Her approach is correct, of course. After all, once you create a security backdoor for one government, you’ll be forced to share them with every government.

Once this happens it’s only a matter of time before that information leaks into the hands of bad actors, with the result that no one’s data is safe.

Enterprise data will also become less safe, which threatens the security of connected infrastructure across the board.

Think of a security backdoor as being a hole in a bucket that only gets larger over time.

Eventually the bucket stops working, water gets everywhere and all your secrets slip.

How Apple sees things

Apple’s approach to security:

  1. It tries to minimize the amount of personal information it gathers about its users, and tries to disconnect that data it does gather from a person’s identity.
  2. It aims to create services that require minimal personal data while using on-device AI to personalize user experiences – that way the data is never seen or used by the company. Differential privacy, CoreML, and sending Siri and Maps requests assigned to a random number rather than using a person’s Apple ID form part of this attempt.
  3. It offers iCloud as a secured space in which customers can store their documents, images and other information.
  4. It attempts to empower users with tools with which to control their privacy.

What’s important to understand with this model is that while much of the information your device gathers is protected (unless you grant permission to specific apps to access it), data held in iCloud is not subject to the same protection and can be made available subject to warrant.

At the same time, Apple’s privacy protections can be confusing – it’s recent decision to make it possible for people to opt out of sharing Siri recordings for ‘grading’ was welcome, but the tools are still rather opaque.

iCloud thinks different

This is why Apple has teams whose job it is to help law enforcement with criminal/security queries.

The information on your device is impossible to access, while data held in your iCloud is accessible once a warrant is presented and agreed.

Not only can a great deal of information concerning location also be gathered by request from cellular providers, but some of the most incriminating information is almost certainly available in the less-secured iCloud account.

Horvath referred to this during her CES 2020 appearance when she confirmed the company uses a set of tools to scan iCloud Photo libraries for child pornography.

To me it seems reasonable to assume that those aren’t the only egregious acts Apple might monitor accounts for. That Apple actively already works to protect the public rather undermines the argument that even more access to personal data is required.

Privacy is a confusing mess

On an industry-wide basis, there’s still too much confusion.

Internet services have been offering convenience in exchange for personal information for so long that many people have become accustomed to sharing data.

Added to which, the lack of a consistent set of principle or access protocols with regard to user privacy makes for a lack of a core set of agreed consumer privacy standards.

Apple seems to believe government regulation is required in order to help promote a more consistent approach to privacy.

“We should consider a strong privacy law that is consistent across all 50 states that provides all consumers, regardless of where they live, the same protections,” said Horvath.

We’ve some way to go, as those continued attempts to force tech firms to create those security backdoors in their products prove some in government don’t grasp the challenge of privacy in a digital age. (Though some do get it).

While we wait for the industry and government to figure out a consistent approach, here are some guides to help iOS users manage their privacy using the tools Apple provides:

Finally, I currently recommend iPhone users take a look at the incredibly useful Jumbo app. This provides a range of privacy management and monitoring tools designed to easily put you in charge of what entities such as Apple, Facebook, Google or others are doing with your information.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Copyright © 2020 IDG Communications, Inc.





Source link

Amid privacy and security failures, digital IDs advance

Frustration over a growing number of privacy and security failures in recent years is driving the creation of digital identities controlled only by those whose information they contain.

Known as “self-sovereign identities,” the digital IDs will be used by consumers, businesses, their workers and governments over the next few years to verify everything from credit worthiness and college diplomas to licenses and business-to-business credentials.

“We are slowly graduating from crawling to walking. It takes one to two years ’til we have reliable capabilities to spark meaningful decentralized identity adoption,” said Homan Farahmand, a senior research director at Gartner. “A major non-technical hurdle is for organizations to learn the concept and take the necessary steps to appropriately adapt their business processes to decentralized identity ecosystems.”

A growing number of organizations is looking to better understand decentralized identity technology, which is predicated on blockchain electronic ledgers. Currently, there are more proof-of-concept projects than production systems involving a small number of organizations. The pilots, being trialed in government, financial services, insurance, healthcare, energy and manufacturing, don’t yet amount to an entire ecosystem, according to Farahmand.

“While these projects help identify gaps such as governance, user experience, standardization and interoperability issues, none of them [rise to the level of] a practical decentralized ecosystem to bootstrap pervasive adoption at this point,” Farahmand said.

What is a self-sovereign identity?

Self-sovereign identity envisions consumers and businesses eventually taking control of their identifying information on electronic devices and online, enabling them to provide validation of credentials without relying on a central repository, as is done now. Self-sovereign identity technology also takes the reins away from the centralized ID repositories held by the social networks, banking institutions and government agencies.

A person’s credentials would be held in an encrypted digital wallet for documenting trusted relationships with the government, banks, employers, schools and other institutions. But it’s important to note that self-sovereign ID systems are not self-certifying. The onus on whom to trust depends on the other party. Whoever you present your digital ID to has to decide whether the credentials in it are acceptable.

“For example, If I apply for a job…, and they require me to prove I graduated from a specific school and need to see my diploma, I can present that in digital form.” said Ali. “And, most likely that credential would have to be cryptographically signed by the school that issued it. So the relying party – my place of work – would have to decide when I present the credential if the signing key is something they trust.”

For example, a place of employment could issue an electronic confirmation or “credential” that could be stored in that employee’s digital wallet saying you work for the XYZ Company. Even something as simple as a health club membership verification could be added to a user’s wallet and presented through a mobile app.

For consumers who are mindful of their online information – credit card numbers, date of birth, annual income, etc. – a blockchain-based network means the user controls who can see their data or get purchasing approval without releasing details such as their annual income or their age and address.

For businesses such as banks, rules such as know-your-customer (KYC) regulations  make blockchain-based digital identities attractive.

How a self-sovereign ID works

Self-sovereign identities can work like this: the user has a bank confirm a credit limit or an employer confirm annual income; that confirmation information is encrypted, but available, on a public blockchain ledger to which the consumer holds the private and public cryptographic keys.

A consumer who wants a car loan from an auto dealership, for example, can give the dealer permission through a public key to confirm that he or she has enough credit or annual income to buy a vehicle – without revealing an exact dollar amount. So, for example, if the dealer wants to ensure a consumer earns more than $50,000 a year, that’s all the blockchain ledger will confirm (not that the person actually earns, say,  $72,587 or some other exact figure).

The confidentiality technique is known as zero-knowledge proof (ZKP), a cryptography technology that allows a user to prove that funds, assets or identifying information exist without revealing the details behind it.

Who’s leading the charge?

Self-sovereign identities extend to businesses or other organizations that want to be able to verify – or be verified – for transactions with other businesses or government agencies. For example, Ernst & Young has created a public blockchain that lets companies use ZKPs to complete business transactions confidentially without exposing sensitive business data.

In another example, CULedger, a cooperative owned by dozens of credit unions for the purpose of providing back-office services, worked with blockchain company R3 to create CUPay, a secure electronic funds transfer (EFT) payment network that is built on R3’s Corda blockchain platform. CUPay acts as an settlement rail for cross-border customer payments.

The blockchain-based settlement system also acts as a distributed identity platform, enabling users to be verified by their credit union and then take their digital ID with them for use in cross-border payments, no matter what country they’re in or what financial institutions are involved.

CUPay utilizes R3’s Corda for organizational identity and CULedger’s MyCUID, a personal digital ID technology created through a partnership with the Sovrin Foundation and digital ID company Evernym. The solution provides integrated KYC and AML services and can be integrated into multiple networks, eliminating the need for manual entry of recipient details and providing built-in compliance management for credit unions.

“So, the PoC they developed was built to use the SWIFT payment rail, but they can use whatever rail they want, and it can even use a cryptocurrency to settle [a financial transaction] if they need it to,” said Abbas Ali, R3’s head of identity management.

R3, created five years ago by a consortium of leading financial services firms, heads up a group of more than 300 companies working to build distributed applications on top of Corda, their blockchain platform. Third parties can develop dApps (known as CorDapps), for use on the Corda platform in any number of industries, including financial services, insurance and healthcare.

“In simple terms, you can think of the [blockchain] platform kind of like the operating system. It provides all parts of identity on the network; it provides a protocol for participants to communicate with each other, but that’s as far as it goes. Any specific use case or business application on top of that would be based in the form of a CorDapp,” Ali said.

“At the application level, we have a lot of partners developing identity access management solutions using what’s called decentralized identity [DiD],” he added.

Credit unions are in the thick of it

CULedger’s CUPay eliminates the need for user names and passwords and relieves  credit union call centers from the obligation of resetting them when a customer loses them. The digital identity, which is encrypted using a public key infrastructure (PKI), is controlled solely by the credit union customer.

CUPay differs from modern payment rail systems in that a user’s identity is attached to every transaction they make. Current systems, such as SWIFT’s settlement rail, don’t send the user’s identity with a wire transfer; it remains separate from the wire instructions, meaning only the bank sending the money knows who is sending it.

“The advantage is for the receiving party,” Ali said. “For them, this is just one example of the use case they developed this PoC for, but they have a bigger vision. They want people to have flexibility to move between different providers. You have an identity on your phone or, let’s say your credit union-issued application…. [If] you decide to transfer to a new state or country or change credit union provider, you can take that identity with you. That’s the bigger use case there.”

CULedger’s MyCUID mobile app  >  Examples CULedger

How CULedger’s MyCUID mobile app works: The image on the left shows a credit union member being asked to verify their identity. The second image (right) shows the member confirming it is indeed them. Had the member pressed “no,” the credit union would be alerted that they might be dealing with be a bad actor or non-member.

The financial services industry as a whole is focused on developing decentralized identity systems that would eliminate today’s method of identifying users by keeping their information in siloes controlled by one company or a federation of partner companies, Ali said.

Key to a DID is that no one entity or person verifies a business’s or person’s identity. The onus for identification verification is on the relying party.

“Whoever you present your digital identity to has to decide if the proofs you’re presenting through the wallet are acceptable,” Ali said. “What’s most important isn’t what you say about yourself but what a trusted organization says about you.”

That means a bank, government, healthcare organization or any other entity verifying information about a self-sovereign identity user becomes responsible for ensuring the info can be trusted.

Self-sovereign academic credentials

For example, in 2017, MIT began piloting Blockcerts, a blockchain-based network and application for storing and sharing academic credentials. MIT worked with Digital ID company Learning Machine to develop the application.

Today, Blockcerts is up and running and used by 69% of graduates. In the last graduating class of 3,718 students, 2,561 opted to have their diplomas digitized and made available through the blockchain-based application, according to Mary Callahan, MIT’s registrar.

Blockcerts creates a single digital identity wallet a graduate can present through a link to would-be employers or other schools to verify academic achievements.

mit Blockcert MIT

MIT’s Blockcerts mobile application stores verified digital diplomas that students can share with potential employers or other schools.

“As you might imagine, having… a piece of paper that indicates you graduated is a valuable commodity in the world. So fraud was an issue,” Callahan said. “There’s also the opportunity to really recognize a student’s lifelong learning. For our students, this is one stop along their learning trajectory. They may be obtaining certificates, badges, masters degrees, PhDs, and this can put them all together in one simple portfolio of their credentials.” 

MIT has aggressively marketed Blockcerts to students through the school’s newspaper, display boards and the administrators of various academic departments – an effort that lead to a doubling of its uptake over the past year, according to Peter Hayes, assistant registrar at MIT.

“One thing we’re doing in terms of outreach now is working with the career services office to raise the profile for potential employers. They host career fairs with 400 to 500 employers on campus,” Hayes said.

Last year alone, the Blockcert application was used 4,124 times to verify graduate credentials, Hayes said. “So, while students haven’t given us direct feedback, we can see … numbers [that] indicate they are using it,” he said.

The movement is real

The self-sovereign identity movement spans industries, according to Gartner.

Examples of efforts to create DID infrastructures include:

A growing number of startups and traditional identity and security vendors are also entering the decentralized identity market directly or indirectly, according to Gartner’s Farahmand.

For decentralized identity and verifiable claim exchanges to become ubiquitous, however, there needs to be industry standardization, interoperability, and autonomous operation by pushing some legal agreements and policies into the decentralized protocols (e.g. smart contracts).

“That’s where we hope to see more collaboration between decentralized identity and blockchain communities to leverage smart contracts and initiatives such as [the] Accord project,” Farahmand said. (The Accord project an ongoing effort to make it easier for anyone to build smart contracts and documents on a neutral platform.)

Decentralized identity and verifiable claim exchanges are key to enabling functions such as user authentication, digital signature, consent and verifiable claims, according to Farahmand. “While we observe implementation of all these use cases for consumers, workforce and business-to-business scenarios, verifiable claim exchange is by far the most impactful because it can disrupt the way we exchange identity data,” he said.

A verifiable claim exchange could be relevant across many industries such as finance, healthcare, education, retail, professional services and even IoT.

R3’s Ali agreed, saying it will take a greater standards effort to advance a global decentralized identity network.

“You need to remove one of biggest hurdles, which is lack of interoperability,” Ali said. “You need interoperability, because we don’t believe one blockchain can rule them all.”

Copyright © 2020 IDG Communications, Inc.



Source link

When does protecting privacy morph into invading privacy?

Recently, I tried to toy around with some of the better security apps for my iPhone and checked out a very impressive package called Lookout. One of its features seeks to make identity theft a little more difficult. So far, so good.

The service says that it searches the dark web and various databases looking for any leak, quite likely from a breach. That sounds worth doing.

So I start filling out the online forms, and before long my head was filled with the protesting voices of every chief privacy officer I have ever spoken with. Lookout starts by asking for all of your email addresses and phone numbers, before moving on to complete driver’s license number, medical insurance card numbers and full passport number. It also seeks full banking account details (routing numbers, too), all credit and debit card numbers and Social Security number, and asks to connect to Facebook, Twitter, LinkedIn and Instagram.

To be fair, I do see what Lookout is doing — and, in an interview, Lookout’s senior director of product management, David Richardson, stressed that customers can skip all or some of those questions — but my first reaction was, “Hey! We just met. Why are you doing your best to sound like the most blatant identity thief this side of the North Pole?”

Given that Lookout’s goal is clearly stated (I have no reason to doubt the company, at this time), what is the concern? A few things. One, merely having that extensive a range of PII in one place about one individual is dangerous. If a breach against Lookout does somehow happen — no security is perfect — it would be a bonanza for the cyberthief. From a security perspective, this company’s marketing about this service could itself make identity and cyber thieves attracted to the site. They might spend extra resources and effort to break in, which is truly not what a customer wants.

Two, it sends the wrong message. Privacy advocates rightly argue to never give anyone or any site more information than they absolutely need (“need to know” is appropriate here). And when the company is directly asking for such a gold mine of PII data (it was probably the passport data request that really sent me soaring), it makes people worried. What, people may wonder, if that page is a phishing page that was designed to merely look like a Lookout page? How is a user supposed to tell the difference?

Three, in 2020 (OK, when we’re this close to 2020), no company is an island. What if one of its employees turned to the dark side? What if the company you use for backup gets breached? What if the firm used for disaster recovery gets breached? What if your cloud vendor gets breached?  

Mostly, though, this is a perception issue about privacy. What if a police department offered a service where it maintained an online listing of all of your most valuable possessions, to speed up recovery and insurance efforts should you be the victim of a burglar? Sounds attractive. Then you go to the PD’s page and it asks for the cost of your most valuable possessions, where they are located, your safe’s combination (in case the police need to quickly gain access, to dust for fingerprints), days and hours when you expect the house to be empty, the nature and passcodes for any security system, where you leave your house keys, the code to access your garage door, etc. Wouldn’t it raise more concerns than offer comfort? Even if it’s legitimate, wouldn’t the sensitivity of the questions (and the fact that it is a wishlist of everything a burglar would want to know) suggest that it’s a bad idea?

Privacy is not just a concrete concept. It’s also abstract and it needs people to change how they think about PII. It needs an attitude adjustment, to encourage people to be far more cautious and careful. Enterprise CISOs and CIOs want and need this perception change to happen. No matter how excellent an offering Lookout and other similar products and services are, they must support the perception change. Starting the registration process by asking for everything we want people to never reveal except in need-to-know situations is probably suboptimal. Very suboptimal.

Copyright © 2019 IDG Communications, Inc.



Source link