Tinfoil 2.0: November 2009

Sunday, November 15, 2009

Blocking Adobe Flash® for Fun and Profit

Blocking Flash elements on a web page not only has performance advantages (page load time, CPU usage, power-battery-heat-fan, etc.), but it is also one of several basic necessities for web privacy.

FlashBlock is an extension for Firefox that replaces each flash element on a page with a click-to-load button. It gives you full control to only load the elements you really want, and has a whitelist to bypass blocking on specific sites.

ClickToFlash is a freeware (donations accepted) WebKit plug-in alternative for Safari on Mac OS X. Is has similar one-click Flash loading and a whitelist, but also has a preference that lets you force YouTube to load h.264 video instead of Flash, ~~with no extra click needed~~. Be sure to customize the settings, particularly by unclicking the "Automatically load invisible Flash views" box, which will then also block small (< 8x8 pixel) Flash bugs.

FlashBlock and ClickToFlash addresses the performance issues, and to some small extent privacy by limiting the number of Flash elements that can access your hard drive, but more controls are needed to address even basic privacy concerns.

Adobe Flash is nearly ubiquitous on personal computers and very few people are aware of, let alone know how to effectively manage, the extensive and intrusive Local Stored Objects (AKA LSOs, Flash cookies, or Persistent Identification Elements - PIE) it reads and writes on your hard drive. Even Adobe's own (obscure) web-based management tool is incomplete and not effective for all scenarios. Find the Macromedia folder on your system... you may be quite surprised what, and how much, you find there. These files can store large amounts of personalized data, and they can be accessed across browsers (and potentially by other applications too). In other words, a Flash cookie set by a web site you browsed to in Safari can be read by a web site you later browse to in Firefox.

There are a variety of procedures and tools for managing Flash "cookies", but the BetterPrivacy extension for Firefox is one of the easiest and most complete.

BetterPrivacy is a simple tool to manage both Flash cookies and DOM Storage (another kind of obscure but persistent file read and written by web sites). It let's you choose to delete Flash cookies and their directories on browser start-up, exit, and even on a timed interval (as long as the browser is open). Again, be sure to customize the settings.

Unless (or until) web sites better disclose and provide opt-outs and major browsers build in controls for effectively managing these persistent files, I'll continue to use the nuclear option: keeping these and all other kinds of tracking data purged on a regular basis.

Thursday, November 12, 2009

Surveillance via Blank Paper

How do I surveille thee?* Let me count the ways...™

Be careful what you do with that nice shiny new ream of paper:

We introduce a new method for measuring the three-dimensional surface of a page using only a commodity scanner and without modifying the document in any way. From this physical feature, we generate a concise fingerprint that uniquely identifies the document. Our technique is secure against counterfeiting and robust to harsh handling; it can be used even before any content is printed on a page. It has a wide range of applications, including detecting forged currency and tickets, authenticating passports, and halting counterfeit goods. Document identification could also be applied maliciously to de-anonymize printed surveys and to compromise the secrecy of paper ballots.

Wednesday, November 11, 2009

Surveillance via License Plates

How do I surveille thee?* Let me count the ways...™

Just when you thought it was safe to go for a drive:

If you are behind the wheel of your car, someone may be on to you. More and more cities are equipping patrol officers, toll booths and even access roads with computer sidekicks that can keep track of vehicle movements... Automated license-plate-recognition systems (ALPRs) mounted in patrol cars are capable of processing 1,500 license plates a minute, capturing a vast amount of data about the movements of both criminals and law-abiding citizens.

Los Angeles joins an expanding list of areas using some kind of automated license-plate-recognition systems (some examples: Memphis, DC, Tiburon California, UK). And if optical scanning wasn't bad enough, the US DOT wants to develop an RFID-enabled license plate:

The U.S. Department of Transportation's Small Business Innovation Research (SBIR) Program has posted online its solicitation for the fiscal year. The document includes a project for the development of a radio frequency-enabled license-plate system that would assist government agencies in the enforcement of traffic laws... but it's also important to ensure that people aren't tracked without their knowledge for nefarious reasons. A female rider, for instance, could be tracked with the technology by a stalker. This is one concern with the PASS Card program, in fact—the tags can be read from 20 or 30 feet away without anyone's knowledge, and if you can associate a random serial number with, say, Mark Roberti, then you could use RFID to track Mark Roberti.

But as Nicole Ozer, a technology expert for the California ACLU told the San Francisco Chronicle:

Innocent people should be able to go about their daily lives without being tracked and monitored.

Tuesday, November 10, 2009

Surveillance via Hair

How do I surveille thee?* Let me count the ways...™

It may now be possible to establish a geolocation trail by analyzing hair:

A group of researchers from the LGC Chemical Metrology Laboratory in the UK havs teamed up with the University of Oviedo, Spain. Together they have developed a "laser ablation" method that makes it possible “to detect variations in the sulfur isotopes of a single hair over time”, says Science Daily. This means that scientists will be able to track a person’s movements between different countries, as the sulphur isotopes reveal changes in eating habits.