Digg.com sent out a system message the other day letting everyone know that a number of things had been updated, one of them being the privacy policy.  Now, I’m just like most other folks in that I rarely read the entire privacy policy – after all, what is the point?  If you don’t accept it, you can’t get an account/order stuff/whatever you came to the web site to do in the first place.

Since I am taking a Privacy class this semester, I thought that I might as well have a look at the policy.  Almost immediately, I noticed something very interesting.  Under the section entitled, “Sharing Your Information”, Digg has what one might consider to be an admirable privacy policy.  To quote, “Because Digg enables people to discover and share information with one another, information about the people who use Digg is an integral part of the Digg experience. Rest assured that we neither rent nor sell your personal information to anyone and that we will share your personal information only as described below.”

The text in bold is my emphasis, not Digg’s.  I highlighted it because one of the ways in this section in which Digg says that they can share your personal information is (quoting again), “Business Transfers: In some cases, we may choose to buy or sell assets. In these types of transactions, user information is typically one of the business assets that is transferred. Moreover, if Digg, or substantially all of its assets, were acquired, user information would be one of the assets that is transferred.”

Okay, so I’m confused here.  In the section header they say they will neither rent nor sell my personal information, yet some five lines below this they say that they consider it an asset that can be bought or sold whenever they choose.   Hmmmm.  A bit duplicitous, wouldn’t you say?

Now, I don’t mean to finger Digg.  They are by far not alone in doing these sorts of things.  I just wish that they and others would save us a lot of hassle and just come out with a really simple privacy policy.  Here is my idea for one:

We at <insert site name here> value the privacy of your personal information.  Not only that, but we think that others will value it as well and that those third parties may even be willing to pay us some money for it.  To that end anything that you are foolish enough to tell us (or that we are able to discern from server logs) should be considered information that we will sell, rent, trade, etc. at any point in time to any entity we choose.

In my mind, this would be much simpler and say the same thing that the long winded privacy notices that you see on the websites.

For my part, I will do everything I can to give sites as little information as possible.  I will use disposable email addresses, fictitious mailing information, and whatever other measures I can to prevent these pirates from getting any more info than I really choose to offer.  I suggest that you consider doing the same.

One of the email subscriptions that I get is WXPNews that is sent out by Sunbelt Software. Sunbelt sells a variety of utilities for Microsoft operating systems and applications. I generally find the information to be useful and the author often adds a touch of humor. Sure, it is a marketing thing and advertisements for their products are sprinkled throughout, but the information is generally pretty good.

One of the ads got my blood pressure up today. Specifically, Sunbelt is hawking their Sunbelt Personal Firewall, which used to be the Kerio Personal Firewall, but was discontinued by Kerio and purchased by Sunbelt. Now, there is nothing wrong with the Sunbelt Firewall per se – (other than the fact that when I tested it about six months or so ago, it caused repeated blue screens on my XP box until I removed it). I’m sure that whatever problem there was with the firewall has since been resolved and then again, when I get through a computer, it can be none to stable to begin with. No, the issue I had was the headline, which states, “The Windows XP Firewall is worse than Useless – it gives you a false sense of security.”

Now, for something to be worse than useless, it stands to reason that you would be better off with nothing. Anyone who knows anything about security knows that running Windows XP with no firewall of any kind is a really foolish mistake. On my XP system, I run just the Windows XP firewall and I have never had a hacking problem (that I knew about). The purported advantage of the Sunbelt Firewall is that unlike XP’s firewall, it is two way in that it filters both incoming and outgoing data. I tried plenty of third party firewalls and quite frankly, I got sick of the constant pop ups asking me to approve every single program that wanted to connect to the Internet. The problem with these idiot announcements is that a typical user (such as my mother) is not going to be able to interpret their often cryptic questions and as soon as they learn that simply clicking “Allow” grants them access to whatever it was they wanted off of the ‘net in the first place, they will merrily click away. At this point, the two way firewall has lost any advantage that it has over Windows’ built-in firewall.

I had an experience some months ago where a worm got loose within my organization.  This particular worm attacked an older version of Symantec Anti-Virus (our corporate AV application).  Unfortunately, since the AV app is centrally controlled, we were all running the unpatched version.  Our corporate policy at the time was to turn off the Windows Firewall as it interfered with some of our legacy  software.  I am not a big stickler for policy so my firewall was turned on.  The worm had no chance and my system was one of the few that was not affected.  I would hardly call that “worse than useless.”

If we apply the same logic as in the advertisement, one could argue that having a two way firewall is worse than useless.  It gives you an even greater sense of security, but the fact is that the bad guys are getting smarter.  Malware today is not going to try and go out a new port – it is going to be smart and use existing ports or piggyback on top of  IE or Firefox.  In some cases, it may simply just rewrite the security rules in the firewall and allow itself access.  Granted, not all malware is going to be that smart and a two way firewall (if properly used by someone who knows that they are doing) is going to be more useful than a one way firewall.  A two way firewall decreases your attack surface more than a one way firewall does, but a one-way firewall is still much better than nothing at all.

Okay, so I was paying my bills yesterday and came across something interesting.  One of the bills from the U Mass Memorial Medical Group gives me the option to pay by credit card.  Okay, cool.  I like that option since I get points for every credit purchase, so I might as well take advantage of it.  Looking over the form, it asks the usual information:

• Card Type (Visa/MasterCard)
• Card Number
• Expiration Date
• Amount
• Signature
• CVV2 Code

Okay, wait a minute on that last one.  The CVV2 code?  This is the little 3 digit number printed on the back of your Visa/MasterCard or the four digit number printed on the front of the American Express card.  No harm in providing that right?  Wrong.  With the addition of that code, a credit card thief has all that they need to encode the mag stripe on a fake card.  The CVV2 code was intended to serve as a validity check for a non-person to person transaction such as over the phone.  The intent is that the CVV2 information is to be entered directly into a secure processing system, validated and immediately destroyed.  According to the Payment Card Industry (PCI) Data Security Standard (DSS), the CVV2 information is one of the things that must never be stored.  Some data such as card number and expiration date can be stored as long as it is encrypted, but the PCI DSS expressly forbids the storage of the CVV2 number encrypted or not.

So what does that mean for our example?  Well, like it or not, if I were to supply my CVV2 number and send it in, UMass Memorial Medical Group has now violated the PCI Standard.  As long as this piece of paper is sitting in their facility, they are technically storing this non-storable data.  Never mind that something sitting in the bottom of a mailbag is largely inaccessible – what happens if a mailbag falls off the back of a truck or some of the envelopes get lost?  We have a data breach.  The bottom line is that the CVV2 should never be written down anywhere.  A vendor does not need this information to process payment unless they are using a secure entry system as discussed earlier.  You should never commit your CVV2 number to paper and you should question anyone who insists that you do.  Granted, as I said in my last post, if your credit card gets stolen, it’s really more the bank’s problem than yours, but it is good to get in the habit of protecting your privacy regardless of your ultimate liability.  Companies are lazy and will only change their practices when held to account.  Let’s start making some trouble.