This Week In Privacy: Jan 2, 2009

CNET

A Funny Thing Happened On The Way To a Birthday Greeting
An interesting take on privacy and revealing a piece of information that most people wouldn’t think twice about when signing up for a new online account.

WOAI

The 500 Most Common Passwords
1 in 9 people use at least one password from this list and one out of 50 use one of the top 20 most common passwords. Is yours on the list?

ReadWriteWeb

Top Online Security Threats For 2009
One new infected Web page is discovered every 4.5 seconds. Here’s a look at the top security threats you should be looking out for in 2009.

This Week In Privacy: Dec 26, 2008

The Olympian

Watch Out For ID Theft While Online
If you have some gift money burning a hole in your pocket and want to grab online post-Christmas bargains, beware of ID thieves hoping to make you the next victim.

ZDNet

5 Security Precautions To Take For The Holiday Break
The following last-minute precautions should probably be on your To Do list for just before leaving the office this holiday.

The Recorder & Times

Internet Security Tests Show All’s Not Right In The City
Anyone with a laptop and the right software could slip onto someon’s home wireless network to steal bandwidth to get free internet access or worse to steal sensitive information.

This Week In Privacy, Nov 7, 2008

Telegraph UK

Internet Black Boxes To Record Email And Website Visit
Every telephone call, email and internet visit made in the UK may soon be collected and stored before being sent off to a giant central database.

Tradingmarkets.com

E-mail Scams Move To Phones
You may know what Phishing Scams are. But are you curious as to what Vishing is? Here’s a post briefly describing VoIP Phishing.

IT Pro

Is The Password Ill- Equipped For The Modern World?
A well written and in-depth look at how passwords fair in a hectic business world environment.

Inactive Buy Now Button – Fixed

Yesterday (Nov. 5) we received a bunch of emails about problems with the Buy Now button when trying to upgrade their accounts to Passpack Pro. It seems that when users clicked on the button, they weren’t able to make a purchase.

What Happened

Before releasing Pro to the public, we ran all of our own testing. For security purposes we had an IP block set up. This was not removed before going live and is the cause of why the Buy Now button wasn’t working properly.

It’s Been Fixed

We’ve deactivated the IP block and everything is set to go, so your Buy Now button should now take you to a 3 step payment process. Thanks for your patience. Going Pro is a bit bumpier than we’d thought : )

One More Issue

It also appears that Paypal is not immediately notifying us when a successful purchase has been made. This means that it could take up to 24 hours from when your purchase is made to when your account is actually upgraded (if not contact us here). We’re working on making the process more immediate but, until then thanks again for your patience.

FIXED: 1 Click Login Button

We were just contacted by a research group formed by Ben Adida at Harvard University, Adam Barth at Berkeley University and Collin Jackson at Stanford University. They alerted us of a security issue concerning the Passpack It! button (aka 1Click Login bookmarklet). Not to worry. We fixed it immediately (within 20 minutes of being notified to be exact.

UPDATE BY TARA, OCT. 12:

I’d like to give more information on the nature of the issue and how we fixed it. I apologize as this information should have been included in the the original post, it was not.

How the issue was discovered — The three researchers mentioned above are preparing an in-depth study on bookmarklets. The Passpack It! button is one of them. We were able to quickly fix this thanks to the open collaboration of the research group.

Technical description — When building 1 Click Login process, we noticed that some sites were arriving back to the server without the referring URL information. To avoid having to refuse 1 Click Login access, the button gathered the originating URL information (saved as an encrypted token) as well as the referring URL in the page header. In the event the referring URL was missing, the URL gathered by the button was used instead by the server in deciding which encrypted login information to reply with. The researchers therefore intentionally suppressed the referring URL header, and redefined a Javascript method in the URL collection process to manipulate the URL information collected by the button.

An example in Layman’s terms — Jack opens his Passpack account and turns on 1 Click Login. Jack starts browsing the internet and happens upon a malicious website built to fool him into pressing his Passpack It! button. Jack falls for it and presses his button. The malicious site then pretends to be, for example, delicious. If Jack has an entry saved in his pack for delicious, the site would be able to retrieve the login credentials for delicious.

The scope of the problem — The malicious site needs to include code written specifically for the Passpack 1 Click Login, generic code would not work. Additionally, Jack must be effectively fooled into clicking his button when visiting the site. This may be achieved by typical phishing techniques where the malicious site has copy-catted another well-known site. Jack must both have an entry for the copycatted site in his account and have 1 Click Login activated in that exact moment.

What we did to fix this — We now strictly enforce that server only responds to calls from the 1 Click Login button that are accompanied by a referring URL.

What it means for you — This will cause sites that repress the referring URL to not work with 1 Click Login.

Button reinstall is not needed — Initially, as you can see in the crossed out section of this post below, we thought it best to require a button reinstall. In fact, our first fix involved both a server side change (refusing to accept no-refferer) and a change to the 1 Click Login button itself. However, by simply ignoring the collected URL information, we can achieve the same effect without having to enforce a button reinstall on everyone.

Please Delete your current PasspackIt! button! It will no longer work. Then simply reinstall it by going into your Passpack Account >> Auto-login tab >> Install a new button. If you still need help, feel free to submit a request for assistance here.

Sorry for the inconvenience guys.
Thanks Adam, Ben and Collin!

The Evolution of Privacy

Online Identity is a topic close to my heart. Passwords may be directly related to authentication — but Passpack’s relationship with Online Identity runs deeper than that.

Let me share with you our ultimate vision for Passpack: in our personal lives, we all have public and private spheres. The latter is completely missing in our virtual life. Passpack wants to give you back your privacy.

What Privacy Is

Privacy is the right to choose what to share, how much of it we want shared and with whom.

Privacy is not secretive. Privacy is not having something to hide. Privacy is not asocial.

Web 2.0, better known as – the social web, is based on a mass collective exchange of information – and one perfect example is lifestreaming.

Your online identity is diffused across various social networking platforms – by nature they are limited in privacy. This is by no means implying such platforms don’t follow privacy standards but applications like Facebook, Twitter, Myspace, FriendFeed are born specifically to share information beyond your ring of contacts.

But, sometimes we need to share things – like personal messages, health records and so much more and we need to share these things with particular people in complete confidentiality. Being able to do so… that is privacy. And it requires one key factor – Trust.

The Ring of Trust

Welcome to The Ring of Trust. It may not sound familiar, because it hasn’t existed until now.

Trust is that area that overlaps public and private. It’s pulling a select person or company into my private sphere long enough to entrust them (and only them) with something. I know that they will keep it confidential and will not share it with others. If they live up to my expectation, they may earn more excursions into my private sphere. Some people earn a permanent slot. But I decide.

As a professional, I need to share sensitive data with my colleagues and not wanting to send it to them by email (knowing they are just like online postcards), I would invite them into my Ring of Trust.

Privacy: Beyond a Concept

Passpack is and always will be an online password manager and now we will also take on the responsibility of being an online privacy manager as well. Privacy is not only made up of passwords, it’s made of people and powered by technology.

This technology is what we have called Shared Host-Proof Hosting*. It finally gives users the unique experience of securely exchanging personal information, adding the necessary private sphere to our (sometimes too) public identities.

I am sure that I am not the only one who has felt the essential need for a new concept of privacy. And now,  we have an answer to fulfill just this need.

Let privacy evolve. Let’s start building our own Ring of Trust.

*US Patent Pending

Passpack And OpenID: Under the Hood

Happy September everyone! Last week we threw around some ideas on which OpenID providers to accept and more importantly which not to accept.

There was a ton of feedback (thank you!) and in the end we decided that instead of a “whitelist”, the Sign In page will display icons of OpenID providers which work well with Passpack, and we’d work something out so that no one would be excluded – icon or not.

The icon list may grow with time, as does everything at Passpack. But I wanted to take a moment and explain the way we’re implementing OpenID integration before we release it.

What Does It All Mean To You, the User?

If you have an OpenID account, signing into Passpack with it will look something like this: you type in your OpenID name (or type in your nickname and click your provider icon) and you should then be prompted to complete your OpenID login process into Passpack. Easy as pie.

Now what if there is not an icon for your provider? What if you are using your very own OpenID from your very own server? Or worst case scenario – what if your provider is a registered phishing site?

Here is a quick chart which gives you more or less an idea of what the user sees when signing in under any of the circumstances mentioned above.

Still Curious? Here’s a Look Under the Hood

The following is a chart of the full process, including the backend, when logging into Passpack with OpenID. You may not see all of this happening, but we sure do.

If you can make heads or tails of that diagram… then you’re a genius! [wink]

Looking forward to your feedback. Please do chime in.