Will Facebook ever get privacy right?

Originally published 05/12/2011 on lubbockonline.com

Nishant Yoshi reported on Symantec's official blog that third party Facebook applications have had accidental access to much more of Facebook users info and pages than anyone knew:

Third parties, in particular advertisers, have accidentally had access to Facebook users’ accounts including profiles, photographs, chat, and also had the ability to post messages and mine personal information. Fortunately, these third-parties may not have realized their ability to access this information. We have reported this issue to Facebook, who has taken corrective action to help eliminate this issue.

Symantec's researchers estimate that over 100,000 apps may be leaking data. Over 600,000,000 people have Facebook accounts. Because of an oversight, 100,000 third parties, both known and unknown, may have had access to their information, no matter how tightly they had controlled the privacy settings. The only saving grace of this news is that few, if any, of those third parties may have realized the treasure they were sitting on.

Facebook has to start taking privacy more seriously. But they never will if users don't demand it because the Facebook business model is to get as many users as possible and encourage them to put as much data as possible, as openly as possible, on the site so Facebook can sell access to it. As it turns out, Facebook had actually given away the keys to the kingdom, but fortunately, nobody seems to have noticed.

A few steps to staying more private online.

Originally published 04/08/2011 at lubbockonline.com

The breach at Epsilon has started discussion on how serious having your email address stolen really is. The fact is, having your email address stolen is as dangerous as you allow it to be. To help with keep the danger level down, here are some things you can do to protect yourself:

1. Don't click on links in email. If you want to go to the site, type in the URL in your browser yourself. With HTML email it is childs play to disguise an email as being from someone you trust and hide malicious links behind what looks like a legitimate link.

2. Use the latest version of Firefox for your web browser. You can argue over what is the most secure browser, but Firefox has some very handy addons.

3. Once you have Firefox, there are two very helpful addons: https-everywhere and NoScript. Noscript can be found using the Firefox addons and https everywhere can be downloaded from the eff.org website.

4. Update your software.

5. Keep your mouth shut and your fingers off the keyboard. Before you give anyone any information about yourself, think about whether you need to.

6. Open a garbage email account. Give it to websites that require you to register. Use your main email account for friends and family.

7. Install anti-virus and anti-spyware and keep them updated.

These are just a few of the things you can do to protect your identity online, but they are a good start.

updated to add important information

Kroger, Chase suffer data breach

Originally published 4/04/11 on lubbockonline.com/glasshouses

Emily Fox of Dallasnews.com reports that Epsilon, a marketing firm based in Irving, TX, suffered a data breach including email addresses of customers of Kroger and JP Morgan Chase. Supposedly that is all that was stolen, but Chase is investigating further.

If you are a customer of either company you can learn more by going to their respective websites at: http://www.chase.com and http://www.kroger.com

Killeen ISD student records found "blowing in the wind"

Originally published 3/28/11 on lubbockonline.com/glasshouses

Andy Ross of the Killeen Daily Herald reports that Killeen Independent School District documents containing students identifying information, including Social Security numbers, were found "blowing in the wind."

According to a school district spokesperson, the school district doesn't have policies on shredding documents. It hasn't used Social Security numbers to identify students since 2008, so these documents may be older than that. Not that it matters, since about the only way you can change your Social Security number is to go into the Witness Protection program.

The school district does have guidelines regarding personal information on staff and students, but if it doesn't include shredding documents before disposal it doesn't mean much. Dumpster diving is still one of the best ways to get information on individuals or businesses - and apparently these records weren't even in a dumpster.

There are state and federal laws covering the use of student data. I suspect some of them may have been broken here, but whether it was the school or someone they payed to dispose of the records I have no idea.

I wonder what policies and procedures LISD has in place to protect and properly dispose of student records? I hope that LISD's policies are more comprehensive and better enforced that those in Killeen.

Cord Blood Registry suffers breach

Originally published 3/17/11 on lubbockonline.com/glasshouses

Last month Scamsafe.com reported that Cord Blood Registry (CBR), a company that stores umbilical cord for future use, suffered a data breach in December of 2010:

A CBR computer and data backup tapes were stolen from an employee's locked automobile. The stolen tapes contained customer names, Social Security numbers, driver's licenses and/or credit card numbers. This is the "mother load" of personal identifying information for identity thieves.

This is a pretty serious breach, and a good (sic) example of how not to handle any type of data, but especially sensitive customer data. The thief broke into the car through the window. Never leave your computer in the passenger compartment where it can be seen. Even if you've encrypted the data, which CBR didn't do. It's even more tempting to some thieves than a purse.

Because unencrypted customer data was kept on the seat of a car 300,000 people are at risk for identity theft. If this was the first time this had happened it might be understandable. But there have been several widely publicized breaches involving stolen or lost laptops, including a breach more than 100 times the size of this one at the Department of Veteran Affairs. There is no excuse for a business allowing unencrypted data anywhere, but especially not on laptops or portable media.

McDonalds suffers data breach

Salon.com reports that McDonalds has suffered a data breach. According McDonald's the servers breached contained email addresses, birthdates and other info, but no social security numbers or financial information.

That's very nice, but with an email address and birthdate you can probably steal an identity. If the email address includes a full name, you can definitely steal an identity. With an identity you can get driver's license, credit cards, jobs, etc. In the modern connected world, there is no minor data breach.

Maine high court limits damage claims in data breaches

A little over two years ago Hannaford Brothers, a large grocery retailer in the Eastern U.S., suffered one of the worst data breaches (bankinfosecurity.com) up to that time. There were many lawsuits filed as a result of the breach. This week the high court in Maine ruled on the validity in some of those cases.

According to a report on WGME 13 in Portland, Maine, the high court ruled that you cannot sue for damages unless you suffer "financial losses, physical harm or identity theft."

I'm sure this disappointed the people trying to regain money for the time they spent straightening out the mess caused because their credit card info was stolen in Hannafords' breach. I'm not sure I agree with the court decision, but I can understand it. I think. On the one hand, the time and effort spent was directly related to the data breach. On the other hand, there was no financial cost, no damage, nothing that was "lost" (except time, the one thing you can't replace), and the cost of paying reparation to people who didn't suffer any actual harm could open the gateway for all kinds of lawsuits with dubious claims that would tie up the courts, often with little chance of success.

The law is different in every state, so the Maine decision may not have any bearing on lawsuits filed anywhere else - but it is a precedent, and lawyers will pull precedents from where ever they can find them. Only time will tell how much affect this decision will have outside of Maine.