If Facebook Becomes The Internet's Authentication System, Can Citizen Scores Around The World Be Far Behind?

from the network-effects dept

One of the reasons the digital world is so exciting -- and so attractive to startups and investors -- is that network effects help companies to grow quickly, until they end up with what amounts to a monopoly in a sector. A particularly powerful monopoly that is exercising people at the moment is Facebook, and for multiple reasons. Its huge user base is making it so attractive to advertisers that traditional publishers are badly impacted. Another issue is that its reach is so great that it is hard to stop so-called "fake news" from being shared rapidly and widely across the social network, with potentially serious real-world effects.

But there's a third aspect, so far little remarked upon, that is brought out well in a post by Jason Ditzian on The Bold Italic site. For the last decade, he's been a keen user of City CarShare, a nonprofit car-sharing service with vehicle stations around the Bay Area. Here's what happened:

City CarShare was recently bought by a corporation, Getaround. And Getaround built its platform on top of Facebook. So when I went to migrate my account over to them, I found that there's literally no way to do it as a non-Facebook user. If I want to share cars with my fellow city dwellers, I’m compelled to strike a Faustian bargain.

To access the services of Getaround, one must authenticate their identity through Facebook.

Ditzian writes that the Getaround site is so tightly integrated with Facebook that it claims there's no way to provide alternative authentication systems. As more companies choose to do the same, using Facebook as the foundation of their services, they too will inevitably require users to possess a Facebook account. That, in its turn, will make Facebook's authentication system even more powerful, driving even more companies to use it -- and even more people to sign up to Facebook just so they can use these services.

Leaving aside the serious issue of Facebook extending its online monopoly to become the Internet's de facto authentication system, there's another concern. As more and more services build on top of Facebook, Facebook's terms and conditions may require access to some or even all of the extra information they can provide about their users' activities and interests. That would enable the social network to fine-tune the deal it offers to advertisers, something it is naturally keen to do so that it can boost its rates to drive sales and profits. As Ditzian writes:

If we give in to the sheer gigantic sweep of Facebook and the convenience it creates, and feed all our collective information into its ever-more-intelligent algorithms; if news is read and messages are sent primarily within the Facebook network so that each of these interactions sows new data points in our profiles; and if we build up thousands upon thousands of these innocuous-seeming interactions over years and years, and those interactions are overlaid with face-recognized images, marketing data from online purchases, browsing histories and, now, GPS-tracked driving data, is this total bartering of privacy worth the buy-in to Zuckerberg's "supportive," "safe," "informed," "civically engaged," global community?

The greatest threat here may not be from Facebook itself, which, after all, is a business that wants to make as much money as possible, rather than a Machiavellian scheme to enslave mankind. But there are other powerful actors -- national governments -- that would love to have access to that rich store of information in order to use it not for profit but for the purposes of political and social control. As Techdirt has reported, China is already creating its own "citizen score" system that will draw heavily on information provided by social networks. The US, too, is starting to carry out "mandatory social media checks" as part of increased scrutiny of visa applications from some areas in the world. A single sign-on for key services makes gathering that information much easier.

The more Facebook becomes the point of control for using the Internet, the more governments will be inclined to require its "cooperation," in the form of providing access to its data, as a condition of allowing it to become the Internet's authentication service in their territory. Paradoxically, the more useful that Facebook becomes, the more vulnerable it will be to the threat of exclusion from a country. That may not be to Facebook's liking, but it's another consequence of the network effects that have made it so successful.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: authentication, scoring
Companies: facebook

Nissan Forgets Security Exists, Opens Leaf Owners To Remote Attack

from the Internet-of-unsecured-things dept

You can add Nissan to the laundry list of companies that aren't making security a priority in the Internet of Things era. A hacker this week revealed that vulnerabilities in the Nissan Leaf companion app allows an attacker to not only track a driver's driving behavior, but to physically control the Leaf's heating and cooling systems. Not quite as severe some other car vulnerabilities that open vehicles to total control, the vulnerability still allows a hacker to cause some notable trouble by running down the Leaf's batteries, potentially leaving an owner stranded.

Australian security researcher Troy Hunt stated he gave Nissan a month to fix the vulnerability before publicizing it, acting in part because he was already seeing online forum posters providing a web address used to spoof the app. Basically, Hunt notes that people simply need to write down a Leaf owner's VIN number, and they'd be able to use a web browser to fool Nissan's servers into controlling the Leaf's systems remotely. Like so many IOT flaws, Hunt notes that security wasn't just weak, it was non-existent. As in, no attempt at authentication at all:

"The right thing to do at the moment would be for Nissan to turn it off altogether," Mr Hunt told the BBC. "They are going to have to let customers know. And to be honest, a fix would not be hard to do. "It's not that they have done authorisation [on the app] badly, they just haven't done it at all, which is bizarre."

Again, that's a major automaker not just imposing bad security, but not even bothering with security period. Hackers can use the trick to collect Leaf owners' names, as well as the duration, time and distance of recent trips. It's also relatively simple to write a script that would move through potential VIN numbers to find cars to control -- and people's days to ruin:

"The initial characters of a Vin refer to the brand, make of car, and country of manufacture/location of the firm's headquarters. So, Mr Hunt said, it would only be the final numbers that varied between different Nissan Leafs based in the same region. Normally it's only the last five digits that differ," he explained. "There's nothing to stop someone from scripting a process that goes through every 100,000 possible cars and tries and turn the air conditioning on in every one. "They would then get a response that would confirm which vehicles exist."

Fortunately for Leaf owners, this is a fix that doesn't require waiting for Nissan, since simply unregistering the CarWings companion app prevents the attack. Nissan has yet to comment, likely because the company, like most automakers, is moving glacially to understand and replicate the vulnerability. GM, you'll recall, took five years to fix a flaw that allowed total remote control of some of its vehicles, a glacial cadence that's just not going to cut it in the IOT age.

Filed Under: authentication, iot, nissan leaf, security
Companies: nissan

DailyDirt: Passwords Suck, But What's Better?

from the urls-we-dig-up dept

Every service wants you to create a username and password... and it all begins to pile up after a while. Users try to make things easier for themselves by re-using passwords, but you're really not supposed to do that. What are you supposed to do? Well, password management software exists, but only the truly paranoid folks spend the time to figure out which one of those is the one that works best for particular use cases and then actually set it up. (And then shit happens anyway.) Some companies are trying to figure out other solutions -- here are a few of them.

• Apple has its fingerprint sensor, but a 4-digit PIN will be replaced by a 6-digit PIN soon. Yippee! It's not much of an improvement, but a brute force attack will take a bit longer for the bad guys. [url]
• Would you want to replace a password with a brainwave measurement? Electroencephalograms (EEGs) could verify your 'pass-thoughts' for allowing access to a secure system. Maybe it'll be harder to forget your 'pass-thoughts' or maybe it won't? Or someone might say, "Don't think about your password!" and run off with your EEG waves before you stop yourself from thinking... [url]
• Google is working on a way to identify users from their usage patterns -- how different people type or swipe or interact. It's supposedly "up to" 10x better than other methods, but what happens if you hurt your wrist or something? [url]
• Paypal is suggesting an 'ingestible' (embeddable or injectable) device to serve as a person identification dongle. Implanted devices better be painless to inject and remove! Is it safe? [url]

After you've finished checking out those links, take a look at our Daily Deals for cool gadgets and other awesome stuff.

Filed Under: authentication, biometrics, brainwaves, brute force attacks, dongles, eeg, ingestibles, pass-thoughts, passwords, pin, security
Companies: apple, google, paypal

TV Networks Finally Discover Live Streaming; Still Get It Really, Really Wrong

from the of-course-they-do dept

Over and over again people have pointed out that one of the reasons people flock to "unauthorized" versions of content is that legitimate versions aren't available. For a decade or so, it's been odd that network TV has been generally resistant to embracing the internet. A big part of the reason, of course, is money driven, since they make so much cash from cable deals (even if their content is free over the air). The fight with Aereo, of course, is not so much about copyright as it is about retransmission fees that the networks can get from cable. So it might seem like a bit of progress to see that the networks are finally moving towards live streaming of content.

While many shows are now available online, they usually aren't available until hours (or sometimes days or weeks) after things air. And while, yes, we're now a DVR world, where people don't always watch shows when they air, there is still a sizable population of fans of shows that like to watch them in real-time. In fact, many have said that the supposedly evil internet is actually making them more interested in watching live, because they can share the cultural experience more widely via things like Twitter and Facebook. So, recognizing that reality, making it easier for people to view the content live at the same time, such as via online streaming, makes a lot of sense. Kudos to the networks for recognizing that, about a decade later than they should have.

Disney's ABC network will become the first broadcast network to stream its shows live online through an ongoing service, starting with viewers of its TV stations in New York and Philadelphia on May 14 and expanding to its other stations by the end of the summer.

Okay, that's the good part. But, given who we're talking about, of course there's a catch. There's always a catch:

Starting on July 1, Disney will only provide its WATCH ABC service to subscribers of cable, satellite and other TV subscription services that have agreements with ABC to offer the service to their subscribers in New York and Philadelphia. Subscribers must provide an authentication code to be granted access to the shows.

Later this summer, Disney said it will expand use of its WATCH ABC service to authenticated subscribers that receive its TV stations in Los Angeles, Chicago, San Francisco, Houston, Raleigh-Durham and Fresno, California.

Remember, this is free, over the air, network television we're talking about. But they're so frightened of pissing off the cable/satellite guys from whom they make boatloads of money, they won't offer the content to cord cutters -- only to people who are already paying ridiculous sums for cable/satellite TV.

Oh, and rather than make it work on any platform, it appears to be specific to certain devices:

The app will initially allow users to be able to watch the service on Apple's iPad and iPhone and on the Kindle Fire device, and later this summer on Samsung Galaxy devices.

Oh, and they're not done with the bad ideas either:

The report also claims that in the future, ABC will “withhold its most recent TV episodes from the free versions of Hulu and ABC.com, further limiting access to paying subscribers of cable and satellite providers only.”

Way to take a good idea (live streaming) and make it completely crappy and pointless again (locking it to devices and existing overpriced pay TV offerings while taking away the value for everyone else and further fragmenting the space).

Filed Under: authentication, cord cutting, fragmentation, live streaming, network tv, pay tv, tv
Companies: abc, disney

Art Authenticator Sues The New Yorker, Claiming Profile Defamed Him

from the this-could-get-interesting dept

Last year, we wrote about a fascinating (and very long) New Yorker piece by David Grann all about famed art authenticator, Peter Paul Biro. What struck us as interesting about the story was the way in which mere claims of "science" can get people to not necessarily explore some details further. Also, it was just a well-written story, and acted as a nice contrast to a documentary (in which Biro appears) called Who the #$&% Is Jackson Pollock?. If you have the time, I suggest watching both the movie and reading the story.

I wouldn't have thought much more about it, but we started to notice some odd comments on that original post soon after it went up, with people making rather nasty claims against David Grann. In fact, there were three comments in close proximity to each other, each from different "names" but all having the same IP address, as identified by the little icons next to their names. Even if it was three different people posting from the same router/computer, the fact that they were all so interested in the story seemed curious. It got weirder still when one of them claimed that my headline was defamatory, and then started posting additional claims of other publications being forced to issue corrections or changes to the story. When asked if this person, "Elizabeth" had any direct interest in the story, she denied it, but the singular infatuation with the story certainly raised some questions. We also thought it was interesting that she would accuse us of defamation, when one of the people commenting from her same IP address made all sorts of very direct, and quite possibly defamatory, claims about David Grann, including that he was a "drunkard." There was also the hilarious claim that some organization I've never heard of gave The New Yorker (in general) a "70% accuracy rating." I have no idea what that means, but this "Elizabeth" insisted that it meant, definitively, that 30% of every article was made up. Interesting use of statistics.

Either way, it seemed like there was some sort of effort under way, no matter how amateurish, to claim that Grann's article was not at all accurate. And, now we may get to see some actual evidence either way, because Peter Paul Biro has officially sued Conde Nast and Grann for defamation.

Biro says Grann's 16,000-word article, "purports to be an in-depth study of the science of forensic examination of art works, and of the use of fingerprint technology to advance that science." But, Biro says, "It is nothing of the sort, but rather a false and defamatory screed against plaintiff, written and published with malice and an indifference to the standards of responsible journalism.

"The article relies to a significant extent on anonymous sources, many of whom are no longer alive, and repeats defamatory statements made by those sources.

"Through selective omission, innuendo and malicious sarcasm, the article paints a portrait of plaintiff which has no bases in reality, and which has been highly damaging to his reputation.

"The intent of the article is apparent from the very subtitle, which implies that plaintiff finds fingerprints where they do not exist, and which represents an editorial attempt to prejudice the reader in advance of the narrative which follows."

I figure this could make for an interesting trial. The bar to proving defamation for a public persona, as Biro clearly is, is pretty high. And despite the claims of "Elizabeth," The New Yorker actually has one of the best reputations around when it comes to fact checking. Perhaps there's something more that will come out during the trial, but I'd guess that it'll be difficult to get the defamation claim to stick.

Filed Under: art, authentication, david grann, new yorker, peter paul biro
Companies: conde nast

Forging Science: The Story Of How Famed Painting Authenticator Likely Duped The Art World

from the fingerprint-this dept

A couple years ago, on a whim, knowing nothing at all about the movie, I rented the documentary Who the #$&% Is Jackson Pollock?. It's a really amazing documentary. Compelling, well-done and really entertaining. The reviewers loved it too. It tells the story of a truck driver woman, who bought a painting for $5 at a garage sale, and is convinced that it's actually done by Jackson Pollock. The movie has numerous amusing scenes with famed art experts staring at the painting and dismissing it in the most... condescending of tones. Eventually, the "hero" of the film is a guy named Peter Paul Biro, who matches a fingerprint on the back of the painting to one he found in Pollock's (still preserved) studio. The movie ends and you're absolutely convinced that the painting is really by Pollock -- even if the art world won't recognize it. At the end of the film, the truck driver who bought the painting has turned down a $2 million and a $9 million offer for the painting, holding out for the $50 million she's sure it's worth. I highly recommend watching it (though, oddly, I can't seem to find any video clips of it online -- not even a trailer for the flick).

Remembering that, I was fascinated to see that The New Yorker recently did a long feature piece on Peter Paul Biro and dove in to read it. The first half of the article covers Biro's rise to fame. How a few of these "fingerprinting" authentications had made him quite famous, with that documentary ratcheting up his fame level even higher. The key point that everyone keeps noting is that, rather than the traditional form of authentication -- the condescending art experts in the documentary who are ripe for mocking and use what often feel like extremely subjective techniques -- this involved science. After all, if the fingerprints matched, how can you question that?

But, then, the article takes a turn. There are a few cracks in the story, and someone who knows Biro well suggests that the reporter, David Grann, look a bit more deeply into Biro's (and his family's) history. It turns out that they were involved in several lawsuits years earlier involving selling what were later found to be forged artwork. Of course, painting forgeries are nothing new, but as Grann dug deeper and deeper he kept coming across evidence that Biro's "authentications," may have involved questionable practices -- including planting faked fingerprints on some of the paintings he was supposed to be authenticating. It's an amazing and gripping article -- and totally calls into question pretty much all of Biro's work. At the end of it, I was just as convinced that the truck driver's "Pollock" painting is not by Pollock, as I was that it was by Pollock at the end of the documentary!

But I found most interesting of all was the reasons why so many people were convinced that Biro's authentications were real. It wasn't just the use of "science." And it wasn't just that people had this natural inclination to believe that so-called "art experts" don't know what they're talking about, but that Biro appears (and, for what it's worth, Biro denies the allegations in the article) to have used what are effectively social engineering tricks to make this work. There's a certain brilliance in realizing that rather than forging paintings, there may be money to be made in authenticating works by effectively forging fingerprints on top of other works -- which then gives it the air of legitimacy-via-science. Honestly, the whole idea that someone would go in and forge fingerprints on top of a piece of art work just doesn't seem in the realm of possibility, and so most people didn't even consider it.

I had started reading the article last week (as mentioned, it's pretty long), but ended up finishing it up now, because I was thinking some more about the recent story of those glass negatives that have been "authenticated" as being from Ansel Adams -- which Ansel Adams' estate is vehemently denying are Adams' work. After reading The New Yorker piece, it's difficult not to be increasingly skeptical of the claims of these new negatives, even with all of the "scientific" evidence that has been mentioned by the team involved in the authentication.

Filed Under: authentication, forgery, jackson pollock, painting, peter paul biro, social engineering