Posts

Use an ePrivacy Filter to prevent Visual Hacking

/in /by

In an average year I’ll tally 75,000 airline miles. In an average week while waiting for the plane to board or while in flight I’ll see multiple laptop screens flipped open with an over the shoulder view of emails being sent and received, PowerPoint presentations being tweaked, proposals being written and various client and employee records being crawled through. The fact is, I’m a good guy with no bad intentions, but I can’t help seeing what I see, it’s distracting. The screens are bright and propped right in my face. If I was a bad guy, this would be considered “visual hacking”.

2PHacking can be done without viruses: with just one’s eyes. The visual hacker prowls the public, seeking out computer screens displaying sensitive data. The company 3M now offers the ePrivacy Filter. This software, when paired with a traditional 3M Privacy Filter, which blacks out content that can be viewed from side angles where hackers can lurk, alerts the user to snoops peering over their shoulders from just about every angle. I’m seeing more and more of these in flight. Which frankly, is nice, and less distracting.

More people will merely state that they prize visual privacy than will actually do something to protect this, according to a recent 3M study. The study revealed that 80 percent of the professionals who responded believed that prying eyes posed at least some threat to their employers.

Strangely, most of these workers opted not to give their visual privacy any protection when they were accessing information with an unprotected computer in a public location of high traffic.

Employees have a funny way of asserting a belief but acting otherwise. This shows that businesses need to educate employees on the risks of data leaking out to visual hackers.

The fact is employees more mobile than ever. And with corporate secrets being Wikileaked, “Snowdened”, and just plain hacked, customers require more assurance than ever that their data is protected.

An ePrivacy Filter, coupled with a laptop or desktop privacy filter helps protect visual privacy from virtually every angle. Compatible with devices that use Windows operating systems, the ePrivacy Filter will alert the user to an over-the-shoulder snooper with a pop-up image of his or her face, identifying the privacy offender. However, you don’t have to worry about your data if you step or look away briefly. The screen will be blurred and will only unlock when you return thanks to its intelligent facial recognition feature.

Please, stop hijacking my attention and get a privacy filter.

Robert Siciliano is a Privacy Consultant to 3M discussing Identity Theft and Privacy on YouTube. Disclosures.

The Right to Privacy

/in /by

The more technological advanced we become, the higher the degree the potential exists for an invasion of our privacy. Imagine how difficult it must have been for people’s personal information to get stolen—10,000 years ago.

2PWe now live in a world where someone half-way around it from you can nab your most personal information in seconds.

Our right to privacy is just as strong now as it ever was, despite the ease at which criminals and snoops can get your personal data.

Famed attorney and associate justice on the U.S. Supreme Court Louis Brandeis was a champion of a person’s right to privacy, and defined the right of a person “to be let alone” as “the most comprehensive of rights, and the right most valued by civilized men.”

To keep up with the increasing ease of stealing a person’s data, legal remedies and privacy enabling software have been developed.

The Internet is infested with spammers, scammers, and hackers. Do you know that these spammers and hackers can easily monitor your online activities and steal your personal data like credit card information and passwords?

Even your Internet Service Provider (ISP) spies on you! They monitor, track, and keep a record of all your web activities. The websites you visit, the software you download, your online purchases, and everything else are recorded and saved by your ISP.

If this bothers you, you now have options available to protect your privacy and identity. Just download and use Hotspot Shield software. It acts as an IP hider to mask or change your IP address and protect your privacy, while securing your Web browsing session at the same time.

“THE RIGHT TO PRIVACY,” by Samuel D. Warren and Louis D. Brandeis, appeared in the Harvard Law Review in December of 1890.

From that are derived six applicable limitations:

1. “The right to privacy does not prohibit any publication of matter which is of public or general interest.” Warren and Brandeis give elaboration on this exception to the right to privacy by stating:

In general, then, the matters of which the publication should be repressed may be described as those which concern the private life, habits, acts, and relations of an individual, and have no legitimate connection with his fitness for a public office which he seeks or for which he is suggested, . . . and have no legitimate relation to or bearing upon any act done by him in a public or quasi public capacity.

2. The right to privacy does not prohibit the communication of any matter, though in its nature private, when the publication is made under circumstances which would render it a privileged communication according to the law of slander and libel.

3. The law would probably not grant any redress for the invasion of privacy by oral publication in the absence of special damage.

4. The right to privacy ceases upon the publication of the facts by the individual, or with his consent.

5. The truth of the matter published does not afford a defense. Obviously this branch of the law should have no concern with the truth or falsehood or the matters published.

6. The absence of “malice” in the publisher does not afford a defense.

With regard to remedies, a plaintiff may institute an action for tort damages as compensation for injury or, alternatively, request an injunction.

A closing point to make is that Warren and Brandeis recommend that criminal penalties be imposed for violations of the right to privacy, but they decline to elaborate further on the matter, deferring rather to the authority of the legislature.

Source: http://faculty.uml.edu/sgallagher/Brandeisprivacy.htm

Robert Siciliano is an Identity Theft Expert to Hotspot Shield. He is the author of 99 Things You Wish You Knew Before Your Identity Was Stolen See him discussing internet and wireless security on Good Morning America. Disclosures.

Recognize Your Willingness to give up your Privacy

/in /by

If a stranger stopped you on the street and requested your e-mail address and birthdate, would you give it to that person? A rational person would never give up this information.

1PThis is the same guard you should have when giving out your personal information to set up an online account, setting up a social account or to get some bargain or great deal on a product or service. Most people will give up all their data for 10% off at a shoe store.

Many people blindly give out personal information online or in person to get that bargain. Sometimes, these choices are made by people who claim to value their privacy.

Those same people may not know that every time you log into free unencrypted WiFi you are most likely revealing everything you communicate on a PC, laptop or mobile? This is why an encrypted connection like one provided with Hotspot Shield is very necessary.

A study from Carnegie Mellon University, conducted by Alessandro Acquisti, turned up some very interesting results.

He sent some graduate students to a shopping mall near Pittsburgh. The students were instructed to offer a $10 discount card, with an extra $2 discount to shoppers in exchange for their shopping information. Half turned down the extra offer. The $2 wasn’t enough to get them to reveal their shopping cart items.

Another group of shoppers was offered a $12 discount and the choice to exchange it for $10 if they desired to keep their shopping data private. Ninety percent decided to keep the $12 discount, which meant they were willing to reveal their shopping data.

What gives?

It looks as though if people already have ownership of private data from the get-go, they’re more likely to value it. If it’s yet to be acquired, however, the value placed on it is less.

So getting back to cyber space then, have you ever wondered if the data, that the online advertising industry collects on you, is truly scrambled so that it’s not possible to identify individuals?

Acquisti conducted another experiment. With a webcam he took snapshots of about 100 campus students. It took only minutes for him to identify about 30 percent of these nameless students by using facial recognition software.

He then went a step further and gathered enough information on about a quarter of the identified students via Facebook to guess a portion of their Social Security numbers.

Acquisti showed how simple it is to identify people from scratch because they leave a data trail in cyber space—and this includes photos. This shows how easy it is for criminals to use Facebook to steal a person’s identity.

Though it would violate Facebook’s terms of service to register a fake birthdate, the user needs to be aware of the tradeoff: Identity thieves love to find birthdates.

Facebook says that the user can control who sees personal information. So you just have to weigh the pros and cons. Is receiving well wishes on your birthday worth the risk of a thief using your basic information to steal your identity?

And by the way, thieves can use your Facebook profile photo to help steal your identity. Maybe this is why some people use their baby’s or dog’s photo for their Facebook photo?

Robert Siciliano is an Identity Theft Expert to Hotspot Shield. He is the author of 99 Things You Wish You Knew Before Your Identity Was Stolen See him discussing internet and wireless security on Good Morning America. Disclosures.

Can your Privacy Policy be Read by a 5th Grader?

/in /by

Zero. The number of people who have ever read word for word—and understood—a website’s privacy policy.

2PWell, maybe not zero, but the actual number is pretty close to it. And this excludes the lawyers who compose these thick walls of tiny text that are filled with legalese.

How many people even open the link to the privacy policy? After all, it’s almost always at the bottom of the site page, called “Privacy Policy,” in a font that doesn’t even stand out.

It’s time that the privacy policy (aka transparency statement) be short, sweet and simple, with an attractive graphic to catch the visitor’s attention. The purpose of a privacy policy seems to be to inform the website visitor/user just how that person’s data will be used by the business or enterprise that the site is for.

But more accurately, the purpose is for the statement to protect the business in the event of a dispute.

Why don’t businesses introduce a short, in-plain-English statement with the sole purpose of explaining privacy and data protocols; right to the point, no legalese filler fluff? And easy to access while they’re at it. The larger, complicated privacy policy could back up the short, simple transparency statement. Over time, the way the big, and the little, statements work in tandem could be refined.

With this upgrade in the “privacy policy,” visitors to sites will be able to make better choices and have a firmer grip on how the site manages their data.

Just think how much smoother things would be if every website had a link titled “Transparency Statement” that took you to a one-page document with a friendly font size and no legalese. Better yet, why not call the “transparency statement” something like, “How we handle your private information.”

Robert Siciliano is an Identity Theft Expert to AllClearID. He is the author of 99 Things You Wish You Knew Before Your Identity Was Stolen See him knock’em dead in this identity theft prevention video. Disclosures.

Your Customers’ High Cost of Privacy

/in /by

This writer has said numerous times that privacy is waning and dying. Partly because we have allowed it with our bazillion posts to social and partly because of the shift from print advertising to digital. During that shift, lots of creative types figured out how to figure you out and get inside your digital head. But all at a cost of your privacy.

1PArwa Mahdawi in the Gurdian brilliantly posed “Privacy isn’t dead, but it’s getting very expensive.” So true.

Ask yourself: as a decision maker for your business or employer, when it comes to protecting your organization’s customers’ or clients’ personal data, how proactive are you? And even if you’re proactive, are you aware of just what is involved on the part of the customer/client to ensure that their personal information doesn’t get into the wrong hands?

Or perhaps you’re not very active in this realm at all, figuring that it’s “up to the customer” to figure out how to secure their data, or that it’s the responsibility of the banks and credit card companies.

I contend that businesses who collect valuable data from customers and profit from it – from email addresses, to credit cards to SSNs – have the responsibility to protect the data collected. Otherwise customers inclined to do so must pay a fee to have their personal information protected. That business is booming.

It’s fair to speculate that if businesses, such as retailers and healthcare organizations, had an excellent history of keeping customers’ data airtight, the protection of privacy wouldn’t have become something that people must pay for.

Of course, there are ways that consumers can protect their privacy without paying for it, such as giving up the use of credit and debit cards, always remembering to disconnect their mobile device in public when they don’t need to be online, never seeing doctors, disabling their cookies, etc.

But let’s face it, these free approaches are impractical or even impossible. How many Internet users even know how to disable their cookies, or even what a cyber cookie is? How many know what a VPN is?

Consumers should not have to be tech savvy or have a lot of money or make impractical lifestyle changes in order for their private information to be leak-proof.

Robert Siciliano is an Identity Theft Expert to AllClearID. He is the author of 99 Things You Wish You Knew Before Your Identity Was Stolen See him knock’em dead in this identity theft prevention video. Disclosures.

Private Identifiers Not Private

/in /by

Today’s commerce occurs very much online, with products and services ranging from A to Z. Hence, these many online merchants have hundreds of millions of people around the globe registered with them for convenient purchases.

1PTo verify authentication as the true user of these services, the registrant must supply personal data. If cyber criminals get ahold of this data, much of it can be changed by the user after the breach, such as user name, password and even the address they’ve been using.

However, the Social Security Number and date of birth cannot be changed. When cyber crooks get personal data off of these online retailers and service providers, it invades the customer’s privacy.

Online enterprises must take full responsibility for stolen data. It’s a real serious issue when permanent (“static”) data like DOB and SSN is breached, as opposed to temporary data like a password or answer to a security question.

Of course, the registrants to these sites do bear some culpability when they post their personal data in the public domain. But business sites make posting personal data a requirement to use their site. Unique data like the SSN should not be a requirement.

The online commerce world should know that such a requirement destroys confidence in current and potential customers, and that their competitors who abandon this practice will have the upper hand in gaining and retaining business.

More and more users are realizing that the security systems of online enterprises are weak, putting users at risk for identity theft—a risk that they’re catching onto.

NSS Labs, Inc., a world leader in information security research and advisement, has the following recommendations:

  • Online businesses should limit requiring data that can be shared among other enterprises.
  • Online enterprises should be designed with the anticipation of possible data breaches; this way they’ll minimize risk and be more prepared to mitigate problems.
  • Third-party data breaches should be analyzed by online companies to protect users if data seeps out.
  • “At risk” users should be able to be re-authenticated.
  • Governments need to reassess the idea of using static data like DOB and SSN.
  • Online enterprises must embrace the possibility that legislation will eventually make it illegal to require SSNs from users.

Robert Siciliano is an Identity Theft Expert to AllClearID. He is the author of 99 Things You Wish You Knew Before Your Identity Was Stolen See him knock’em dead in this identity theft prevention video. Disclosures

Security is about Layers and Attitude

/in /by

Installing a home security system and keeping doors and windows locked is not the end of your crime prevention regimen; it’s only the beginning. And the beginning is YOU.

2HYou are your greatest weapon against crime, wherever you are located at any given moment. Unfortunately, that “mama bear” or “papa bear” mentality has been driven out of many people by modern-day living and an influx of etiquette books and manners training.

Of course, modern-day living allows us to behave civilly so that we don’t punch out the next person who disagrees with our political views. By the same token, we’ve been conditioned to be softies when it comes to truly threatening situations. Or, we’ve become desensitized to possible threats.

An example of this civilized conditioning is mothers teaching their children, “Respect authority.” But what should a child do when an authorative adult tells a child his mother is sick so he must get on the van to go see her? It’s this conflict with civility and survival that predators prey upon.

We need to take more responsibility towards uncivilized people, predators are all around us. We need to aim for maximal security, while realizing that nobody or no location or setting can ever be 100 percent secure.

Security must be layered.

Security that’s founded in layers will go a long way at slashing your level of risks, and a long way at making a criminal’s intentions all the more difficult to carry out. Let’s get as close to that 100 percent as possible with some careful planning.

A classic example of layered security is that of a large bank:

  • Large windows, which make would-be robbers realize they’ll be more easily seen by people walking by.
  • Doors with locks
  • An alarm system which includes motion detectors and glass-break alerts
  • Bullet proof glass
  • Video surveillance
  • Armed guards
  • GPS and dye packs to locate stolen cash
  • A safe

So how can you parallel this kind of layered security for your house? You can start with a home security system that comes with all the bells and whistles, such as motion detection, motion sensitive outdoor lights, cameras, door/window sensors, remote access via smartphone or PC, a blaring siren and home automation components like the Lynx Touch 5100 by Honeywell. And that’s just one component of additional layers of home security.

Make sure windows have special coverings on the glass to make it impenetrable, and that window wells are covered with locked lids that can’t be lifted off.

Do your homework on how to secure your main door as solidly as possible with the best lock systems and door reinforcement technologies.

Now, what about your body? Take up martial arts. If possible, install a striking bag in your home and work out on it. Enroll your kids in martial arts, particularly a school where kids are taught to fight from a ground position. Make no excuses; do what you can to come up with the money and get going. A trained 120-pound woman can disable an untrained, much bigger and stronger man.

Train with weights to make your body stronger and tougher. A strong body not only is more likely to win a fight, but is also more likely to walk away from a crisis situation with minimal injury.

Plus, the stronger your body is, the more likely you’ll be able to assist someone else in an emergency situation. Nothing creates a sense of security like knowing you can pick up and carry heavy objects. And once you know how to save your own life or the life of another, every other decision in life is relatively simple. Understanding self defense and home security gives a person an enormous amount of perspective.

Be your Family’s Chief Security Officer

/in /by

Schlage is all about safety and security. But you need not be in the profession of security analyst to be vigilant about your home and family’s security. And when it comes to security, this doesn’t just mean protection from home invasions and burglaries, but anything and everything, such as online security and guarding against viruses, hackers and other fraudulent invasive cyber crimes that can really mess things up for you or a family member.

1HBe your family and home’s Chief Security Officer, even if your job outside the home is unrelated to security measures. Make sure everything is safe and sound inside your home. This includes child-proofing the house; senior-proofing if there are elderly occupants; and just in general, making the environment safe—e.g., cleaning up spills on the floor to prevent a disastrous fall.

I won’t lie: This kind of vigilance requires a lot of thought to get it rolling. It’s not second nature to many people, but they can work on that element and improve over time so that it’s automatic to put the alarm system on when going to bed.

You must be fierce so that fires don’t start in your home, and so that you don’t end up in the news as a victim of a crime.

Sometimes, a person’s greatest enemy is themselves. So you have all the windows penetration-proofed, triple bolts on all the doors, maybe a protection dog and an extensive video surveillance system…but one second…you get lazy and don’t lock your doors and after you leave and you took the dog with you, then some bad guy chooses your home simply because he saw you leave. Locking your doors, that little extra effort might have saved all kinds of heartache.

So it takes a little extra time to create a safety system, and then stick with it, to prevent bad things from happening. If you can’t make time for safety and security, you’ll have to make time for catastrophe. When you make security a habit, it really doesn’t require that much effort after a while. Lead your family and home as its Chief Security Officer.

Robert Siciliano home security expert to Schlage discussing home security and identity theft on TBS Movie and a Makeover. Disclosures. For Roberts FREE ebook text- SECURE Your@emailaddress -to 411247.

Businesses fail in Customer Privacy

/in /by

The U.S. Consumer Confidence Index, released by TRUSTe®, shows an alarming trend: A high percentage of U.S. people over age 18 are unnerved about their online privacy, and this trend is worsening.

2PThis survey was conducted online among 2,019 U.S. adults and reveals that 92 percent of the participants are on edge, at least some of the time, concerning online privacy. Nearly three-quarters of Internet users in the U.S. are worried about privacy more so than a year ago. And more users worry about business data collection versus government surveillance programs.

Many businesses are not taking measures to mitigate this concern among users. This can backfire on businesses, e.g., more people not willing to download apps or click on ads. Protecting consumers is crucial to a company’s success—not just with customers but with competitors; companies should not cut corners here.

What are the top reasons for privacy concerns? The top two responses: 1) Businesses sharing personal data, and 2) Businesses tracking online behavior.

More specific findings:

  • 58 percent of respondents were worried about businesses giving out their personal information with other businesses
  • 47 percent worried about businesses tracking their online actions
  • Only 38 percent named media attention to government surveillance programs as a cause for concern.

What are consumers doing about all this?

  • 83 percent are leery of ad clicking.
  • 80 percent won’t use smartphone apps that apparently don’t protect privacy.
  • 74 percent aren’t comfortable enabling location tracking on their smartphone.

Other findings of the TRUSTe survey:

  • User concerns over online privacy are climbing: 92 percent of users worry about privacy.
  • Trust with businesses is declining, coming in at 55 percent currently.
  • 89 percent of consumers will refrain from conducting business with a company they don’t feel is protecting their online privacy.

The public wants more:

The tides of privacy are turning and the public is waking up. Businesses who fail to take action will surely be met with customer defection.

Robert Siciliano is an Identity Theft Expert to AllClearID. He is the author of 99 Things You Wish You Knew Before Your Identity Was Stolen See him knock’em dead in this identity theft prevention video. Disclosures.

Why Should You Care About a Site’s Privacy Policy

/in /by

Most websites should have a privacy policy (although I don’t think it’s always the easiest thing to find). And then once you do find it, you’ll see a huge amount of what I consider to be legal mumbo jumbo. And because you really should care about this stuff, the question becomes how do you sort through all this stuff?

2PMost privacy policies usually begin with something around them collecting, using and sharing your personal information or data. For example, here’s how Google, Twitter and Apple’s privacy policies start out:

  • Google (http://www.google.com/policies/privacy/) – “There are many different ways you can use our services – to search for and share information, to communicate with other people or to create new content.”
  • Twitter (https://twitter.com/privacy) – “This Privacy Policy describes how and when Twitter collects, uses and shares your information when you use our Services. Twitter receives your information through our various websites, SMS, APIs, email notifications, applications, buttons, widgets, and ads (the “Services” or “Twitter”) and from our partners and other third parties.”
  • Apple (http://www.apple.com/privacy/) – “Your privacy is important to Apple. So we’ve developed a Privacy Policy that covers how we collect, use, disclose, transfer, and store your information.”

Here’s what you really need to understand about a website’s privacy policy as this can affect you

  • How it gathers information – sites usually use cookies to collect or track information.
  • The type of information it gathers – it is keeping track of your name, age, or email address.
  • What it is doing with the information – make sure you understand how the site is using your information, whether it’s just to provide a better experience for you when you return to the site or it is sharing your data with third parties.
  • Security measures it has in place – how a site is protecting your information that it gathers is critical. This should be not only when the data is being transmitted to them, but also once they have it.

And why is this important? Those factors above can affect you if the site is not taking care of your personal information. It could lead to unwanted spam, identity theft and financial fraud depending on what type of information they have gathered from you and how they are using it or taking care of it.

You should also know that the sites should provide options for you to opt in or opt out of how they share your information. Another key thing is to find out how long the site keeps your information. Some sites keep it forever, while others delete it after a certain amount of time. For instance, you should know what happens to your data if you delete your account.

Yes this is something else for you to check. But in our digitally connected world, it’s something you just gotta do.

Robert Siciliano is an Online Security Expert to McAfee. He is the author of 99 Things You Wish You Knew Before Your Mobile was Hacked!  Disclosures.