PBU-Blocking_Your_Metadata

Encrypt your MetaData

Prism BreakupEyebeamGabriella Levine

Gabriellalevine.com | [email protected]

Sunday, October 6, 13

http://goo.gl/yxS0Z3




1 hour

1. What does Metadata look like?

2. cryptographic protocols

3. See what’s happening on your network

4. Some ways to block your data


Protect your metadata.

1. Delete cookies

2. Alternate Web Browser & Online Storage

3. Your Documents (text, images...)

4. Chat / Skype / Twitter / Facebook / SMS

5. VPN / Little Snitch


Data about Data...

“electronic DNA”

What is MetaData?Sunday, October 6, 13

Where does it come from?Sunday, October 6, 13

Where is it kept?

1. In the “cloud”

2. On the client’s server

3. On your local machine (cookies)

4. The client’s client’s server

...where else?


NSA data centersSunday, October 6, 13

Bluffdale, UtahSunday, October 6, 13

MetaData Syntax

NISO categories of metadata: Structural, Descriptive, Administrative

Markup Languages : syntax to express metadata

Different syntaxes:XML, HTML, JSON, RDF, plain text...


MetaData Standards

ISO - endorsed Dublin Core

1. Title2. Creator3. Subject4. Description5. Publisher6.Contributor7. Date8. Type9. Format10.Identifier11.Source12.Language13.Relation14.Coverage15.Rights


What does it look like? Sunday, October 6, 13

TwitterSunday, October 6, 13

EmailSunday, October 6, 13

Cookies?Sunday, October 6, 13

What are cookies?

First party cookies

Third party cookies


Where is it stored?Sunday, October 6, 13

How does it get there?Sunday, October 6, 13

How to see my cookies?Sunday, October 6, 13

chrome://settings/cookiesSunday, October 6, 13

What with my cookies?

- Track how many people visit a website- Store Login / password info- E-Commerce sites store customer preferences - Easy checkout info- Sell your cookie info to telemarketers- Sell statistics

...all based on info you’ve input to an form online


Cookies across multiple sites?Sunday, October 6, 13

Chrome Incognito?

⌘-shift-N

Doesn’t store cookies to your local disk

Metadata is still stored on the client’s site


Delete cookies

Downsides?

-passwords-preferences-autocomplete...


How does it effect me?Sunday, October 6, 13

Advertisements (AdSense)Sunday, October 6, 13

AdvertisementsSunday, October 6, 13

Airline flights?

how else...?


Security Certificates

-Communication protocol over a network

-HTTPS vs. HTTP

-HTTP sends data as plain text

-HTTPS encrypts data with SSL (secure socket layer)

-HTTPS layers HTTP on top of SSL / TLS


SSL : Secure Socket Layer

-Perform authentications-Encrypt communications

-Uses a certificate-CA (certificate authority) has a private key

used to sign other certificates

-CA resources : Thawte, Verisign...-Free ones: CAcert, StartSSL, godaddy.com ...


RSA encryption

- SSL Certificates have a key pair: a public and a private key.

- These keys work together to establish an encrypted connection.

- RSA: an algorithm for public key encryption


Public key encryptionSunday, October 6, 13

Security certificate not trustedSunday, October 6, 13

Value = Trustworthiness

Anyone can create a key pair

Verisign makes DIGITAL CERTIFICATES, by signing public keys

This certificate is seen by my browser, which has a list of trusted providers

Trusted providers vs. not trusted providers (self-signed)

Verisign is expensive ($1000)


in Adium: View CertificateSunday, October 6, 13

HTTPS everywhereSunday, October 6, 13

Metadata that is tracked

IP address to identify your general location

“We may also select advertising based on information about your computer or device, such as your device model, browser type, or sensors in your device like the accelerometer.”

http://www.google.com/policies/technologies/ads/


http://www.google.com/policies/privacy/key-terms/#toc-terms-ip

http://www.google.com/policies/privacy/key-terms/#toc-terms-ip



Some cool diagnostic toolsSunday, October 6, 13

IP Lookup: whatismyipaddress.com


whatismyipaddress.com/ip-lookup


Little SnitchSunday, October 6, 13

Little Snitch Network MonitorSunday, October 6, 13

Little Snitch ConfigurationSunday, October 6, 13

WireShark: what’s on your network?


Protect your metadata.

1. Delete cookies

2. Alternate Web Browser & Online Storage

3. Your Documents (text, images...)

4. Chat / Skype / Twitter / Facebook / SMS

5. VPN / Little Snitch


Shields

1. Firewall - protect your computer from data from the internet)

2. VPN (virtual private network - protect your data on the internet)

3. Little Snitch (protects your private data from being sent out)


FirewallSunday, October 6, 13

http://www.engadget.com/2006/05/30/how-to-build-your-own-network-firewall/

FirewallSunday, October 6, 13





VPN: Hotspot ShieldSunday, October 6, 13

Hotspot Shield: IP Hider MaskSunday, October 6, 13

Little SnitchSunday, October 6, 13

Alternate Online Storage

SpiderOak


Spideroak.comSunday, October 6, 13

Alternate Browsers & Networks

Tor (free software for enabling online anonymity through a network)

Duck Duck Go (an anonymous internet search engine)

Project Meshnet + cjdns (an encrypted network, with the goal of a sustainable decentralized alternative internet)

HyperBoria + cjdns (a global decentralized network, alternative internet)


duckduckgo.comSunday, October 6, 13

TorSunday, October 6, 13

Project MeshnetSunday, October 6, 13

Hyperboria.netSunday, October 6, 13

cjdns.infoSunday, October 6, 13

evbogue.comSunday, October 6, 13

Mozilla’s DoNotTrackSunday, October 6, 13

Email

RiseUp

HushMail ($$)

Zoho ($$)

BlueHost ($$)

Thunderbird + Mozilla’s DoNotTrack option


mail.RiseUp.netSunday, October 6, 13

Thunderbird + DoNotTrackSunday, October 6, 13

Text files, photos, videos...

•Microsoft Office (Word, Powerpoint...)

•Adobe (Photoshop, Illustrator...)


XMP standard

Extensible Metadata Platform

Microsoft Office

Adobe


MS Word

•Your name•Your initials•Your company or organization name•The name of your computer•The name of the network server or hard disk where you saved the document•Other file properties and summary information•Non-visible portions of embedded OLE objects•The names of previous document authors•Document revisions•Document versions•Template information•Hidden text•Comments


Open Source Alternatives

•Gimp•Formulate Pro•Open Office•....


MS WordSunday, October 6, 13

Photos

•Your name•What type of camera•GPS location photo taken•Photo date / time•Size, formate •linked files•fonts•properties•copyrights•edit history


PhotosSunday, October 6, 13

Adobe BridgeSunday, October 6, 13

Adobe BridgeAdobe BridgeSunday, October 6, 13

Startup ScriptSunday, October 6, 13

Minimize metadata

MICROSOFT : http://support.microsoft.com/default.aspx?scid=kb;EN-US;290945

ADOBE: http://help.adobe.com/en_US/acrobat/X/pro/using/WS4E397D8A-B438-4b93-BB5F-E3161811C9C0.w.html


http://support.microsoft.com/default.aspx?scid=kb;EN-US;290945




http://help.adobe.com/en_US/acrobat/X/pro/using/WS4E397D8A-B438-4b93-BB5F-E3161811C9C0.w.html






The downsides?

Not searchable


Chat ServicesSunday, October 6, 13

Adium.imSunday, October 6, 13

Link your accountsSunday, October 6, 13

OTR MessagingSunday, October 6, 13

Toggle EncryptionSunday, October 6, 13

Accept EncryptionSunday, October 6, 13

Chat OTRSunday, October 6, 13

G-Chat LogSunday, October 6, 13

GibberbotSunday, October 6, 13

ChatSecure for iOSSunday, October 6, 13

Twitter

•crabgrass•status.net


status.netSunday, October 6, 13

crabgrassSunday, October 6, 13

VoIP

Adium plugin for SKYPE:

http://www.adiumxtras.com/index.php?a=xtras&xtra_id=5011

ostel.co


















The downsides?

•Alternate browsers?•Getting rid of your metadata on documents?

•Alternative social networks?•...


Why are these interfaces so shitty?


Small alternative browsers or networks? vs. working around current ones (chrome, etc.)Sunday, October 6, 13

Why open source?Sunday, October 6, 13

Encrypt your MetaData

Prism BreakupEyebeamGabriella Levine

Gabriellalevine.com | [email protected]


Immersion.media.mit.eduSunday, October 6, 13

XMPP servicesSunday, October 6, 13

XMPP.netSunday, October 6, 13

register an XMPP chatserver


Create New XMPP Sunday, October 6, 13

jabber.chaotic.deSunday, October 6, 13

1. Now I know how to use Adium to encrypt my chats, and I use chatserver or gibberbot for sending texts, and I use Rise Up for gmail, but what can I do because everyone uses gmail still?

2. All of these platforms are messy and hard to use - can we come up with 3 solutions for better, more user friendly interface?


PBU-Blocking_Your_Metadata

Technology

Transcript of PBU-Blocking_Your_Metadata