An Ignoble Experiment

eBook | Getting to DevOps (And Getting the Payoff)

In a letter Thursday to the Chief Privacy Officer of Facebook and the General Counsel of messaging service provider WhatsApp Inc., the director of the Federal Trade Commission's Bureau of Consumer Protection, Jessica Rich, advised Facebook that WhatsApp's public promises about guaranteeing its users' complete privacy will apply to Facebook following its planned acquisition of the company.

"The statements in WhatsApp's privacy policy, combined with the recent public statements by both Facebook and WhatsApp," wrote Rich, "constitute clear promises to consumers about the collection and use of their data by WhatsApp and, following WhatsApp's purchase, Facebook. As you know, the FTC has brought many cases alleging that the failure to keep promises made about privacy constitutes a deceptive practice under Section 5 of the FTC Act. In addition, the FTC has made clear that, absent affirmative express consent by a consumer, a company cannot use data in a manner that is materially inconsistent with promises made at the time the data was collected, and that such use of data could be an unfair practice under Section 5."

Rich goes on to remind both parties that Facebook as a company, and CEO Mark Zuckerberg personally, have repeatedly made comments to the press promising not to change WhatsApp's privacy policy. That policy, she notes, states that WhatsApp user data will not be collected for advertising or other commercial purposes.

Facebook's receipt of the FTC letter, which phrases the acquisition as a continuing possibility, was taken by the company to be tacit approval of the acquisition. The company made a public statement to that effect Thursday afternoon, effectively praising the Commission, though the FTC had yet to issue a statement to that effect by close-of-business.

In August 2012, the FTC settled its complaint against Facebook for its privacy violations, requiring the social network to give customers prominent notices before it attempts to use customer data beyond the extent of their current privacy settings.

While Director Rich holds Facebook to its promises under penalty of law, those promises in recent days stop short of saying that Facebook will refrain from generating its own data on customers who use WhatsApp, apart from the mechanisms WhatsApp already has put in place. What would enable Facebook to do this? It's difficult to imagine WhatsApp, in the future, not offering an option to log in using Facebook credentials. Conceivably, Facebook could collect some data on users who happen to be using WhatsApp, and who will have simultaneously logged into Facebook, under the current privacy policies that govern Facebook use.

In other words, Facebook would not have to alter WhatsApp in any way to get that login. As first reported Wednesday in The Verge, Facebook has already begun giving users an incentive to log onto a different messaging app, by starting the shutdown of its own inline messaging service.

Though WhatsApp has historically portrayed itself in somewhat of an angelic light with respect to its own privacy promises, it has more than once proven to be one of the least secure apps on the planet. As recently as last October, malicious users have taken to YouTube to demonstrate the use of apps such as "WhatsAppSniffer" to capture some conversations that remain unencrypted. If Facebook opts to not make changes to WhatsApp's infrastructure, conceivably the same tools could be used to anonymously sniff out other users' conversations about their Facebook activities.

For more:
- see the FTC letter to Facebook and WhatsApp (.pdf)

Read more about: consumer protection
back to top

This week's sponsor is New Relic.

Companies employing DevOps techniques report faster development cycles and higher-quality software. This FierceEnterpriseCommunications eBook covers step-by-step guidance on implementing DevOps for CIOs and IT and application development managers. Download this eBook today.

2. Heartbleed logo, marketing trigger some panic

By Scott M. Fulton III

Comment |

4. NTCA seeks rural broadband promotional campaigns

First of all, what do you call the class of thing that Heartbleed is? Even local TV news websites have done a relatively good job the past few days in using the appropriate language to describe Heartbleed, usually by way of running the Associated Press story with little or no alterations.

It is certainly a gaping security hole, though it's a hole in a system that wasn't exactly watertight to begin with (for more, see exhibit A, exhibit B, exhibit C and exhibit D... shall I go on?). As FierceEnterpriseCommunications reported Wednesday, its cause is most likely the use of a library code shortcut that wasn't properly checked for bounds violations, enabling a type of function call called a "heartbeat" to reveal chunks of memory to which it's not entitled.

But what we call it is important, because as journalists, our job should be to present the facts that prevent fear and panic. At least a few local TV news broadcasts Wednesday were guilty of mischaracterizing Heartbleed as a "breach" or a "virus" that steals passwords. And one San Diego reporter went so far as to interpret Heartbleed as a fake Web site that enters your own computer and steals your passwords and financial data.

"Once someone allows a fake Web Site to enter, Heartbleed can gain access to memory storage and steal financial data of credit card numbers and other sensitive information," the reporter really did write. "It compromises passwords and has stolen some Yahoo passwords reported yesterday on CNET site this morning."

As another news site describes it: "Seen as possibly the worse case scenario for such a virus this one wasn't found on one website, or even multiple websites, but in fact part of code that was initially designed to keep servers secure." Such substantiations of Heartbleed as not only a virus but a malicious actor may have prompted the U.S. Congress to enact security breach protocols, as reported by Roll Call, the day-to-day journal of Congressional activities, which itself described Heartbleed as a malicious virus.

What's more, TV broadcasts are presenting the Heartbleed logo (when you think about it, when does a bug get its own logo?) in an ominous motif, like a calling card left by hackers or an anonymous activist group.

You have to admit, as a marketing tool, the trade name and the logo did their job in getting the word out to Internet users. But as Codenomicon--the security firm that discovered Heartbleed--openly admits, there isn't really much that users can actually do about it, except apply pressure on websites using OpenSSL to upgrade to version 1.0.1g.

It's usually malware that gets the comic-book-villain motif treatment. As the man who helped coin the name for one of the first huge, worldwide worms told me seven years ago, in retrospect, the application of motifs in the first place not only confuses everyday users, but opens up more possibilities for the "script kiddie" variety of malicious user to make use of the malware before the software it threatens is patched.

FEC asked Codenomicon spokesperson Ari Takanen how it was that a security hole came to have its own, high-class marketing logo, as well as a blog, just minutes after someone in the security development field blurted out the hole's existence?

"We felt pain while analyzing and recovering from the bug," responds Takanen. "Based on our past experiences in reporting vulnerabilities, we had a feeling that this one called for a 'Vulnerability Coordination 2.0' approach to get the information out to everyone in a democratic way."

One of the firm's own experts came up with the name, Takanen continues, and the team declared it fitting. The domain with that name was registered, and the firm's own artist drew up the logo.

"We wrote a Q&A to support the vulnerability coordination when reaching out to the vendors and service providers," he goes on. "Much faster than expected, others went public with the bug, and we felt that the Q&A could help the public as well."

Indeed, the complete information provided by Codenomicon did result in less than the usual amount of confusion from the general press about the nature of the bug. While there were cases of panic, they were isolated; for most third-party sites, the story was more often mutated by bad grammar than by miscomprehension.

Sadly, it takes a discovery of this magnitude of ignorance of basic security to prompt any substantive public discussion of the integrity--or lack thereof--of the Internet at large.

For more:
- see the examiner.com article
- this NewsChannelDaily article

Read more about: Verizon
back to top

By Scott M. Fulton III

Comment |

5. Analytics confirms mobile users prefer apps to browsers

Last May, the Pew Research Center's estimate of U.S. households receiving broadband service (or, if you prefer specificity, households that believe they have broadband service) rose to 70 percent. That means three U.S. households out of ten don't receive broadband, and an estimated 27 percent of households don't receive Internet service at all.

The rural broadband association NTCA--not to be confused with the cable television association NCTA, which can easily be done--declared in a report released Friday (.pdf) that "a significant segment of society is not using the Internet." Citing figures from the FCC, NTCA spotted exactly where that segment resides: While some 98.2 percent of metropolitan U.S. residents have access to connections of 3 Mbps or above, only 76.3 percent of rural U.S. residents have the same access to bandwidth.

NTCA declared this a national danger: "As long as there are Americans who have access to broadband service yet do not avail themselves of the benefits that broadband can allow, there will be a net deadweight loss to society as a whole."

In other words, country folk who aren't online are weighing us all down.

One reason, NTCA believes--again, citing Pew Research numbers--is that more than one-third of folks who don't use the Internet don't believe it to be relevant to their lives. They can afford it; they're just not interested.

The way to overcome this obstacle, NTCA suggests, is to reach these people where they live. Since they don't live online, any educational campaign targeted at disinterested rural citizens must reach them where they do live, with the media they do use. At the top of NTCA's list: inserted messages in their monthly utility bills.

The key to overcoming the relevance barrier is to make non-adopters aware of the numerous ways that the Internet can have a positive impact on their lives. One way that this can be accomplished is through focused educational campaigns that could be comprised of bill inserts, ads in local newspapers and television and radio spots. These campaigns could be further focused to pinpoint those demographic groups with lower overall take rates.

Another suggestion NTCA offers is to set up demonstrations of broadband use at shopping malls and county fairs.

While the U.S. Government is currently settling on the 3 Mbps mark as the low end of the broadband scale, both practical experience and documented studies suggest that high-definition video requires something more on the order of 20 Mbps. According to the Dept. of Commerce, for 2012, the number of total U.S. households with access to 25 Mbps bandwidth or greater was 78 percent. But that 78 percent was concentrated to only 317 of the nation's 3,144 counties. Only 82 percent of Americans had access, in 2012, to a 6 Mbps or greater connection.

So you can try to set up a demo at a county fair or a Winn Dixie, but good luck trying to get a signal.

For more:
- see Pew's report and research
- this TechZone360 article
- download the report from NTCA (.pdf)

Read more about: Pew Research
back to top

By Scott M. Fulton III

Comment |