-
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
Module: Privacy
Professor Trent Jaeger Penn State University
1
Module: Privacy Professor Trent Jaeger Penn State University - - PowerPoint PPT Presentation
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
1
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
encryption algorithms. Law enforcement agencies are operating surveillance drones domestically (not to mention traffic cameras and satellites). Commercial entities like Google, Facebook and Amazon have vast data on your internet behavior. The average Joe has sophisticated video-shooting and sharing technology in his pocket, meaning your image can be spread anywhere anytime. Your private health, financial, etc. data is protected by under-funded IT organizations which are not under your control. Is privacy even a valid consideration anymore, or is it simply obsolete? If you think you can maintain your privacy, how do you go about it?"
2
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
3
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
participation in the government", from privo "to deprive" (Wikipedia)
people (Google)
about themselves and thereby reveal themselves selectively (Wikipedia)
intrusion or disturbance in one's private life or affairs: the right to privacy (Dictionary.com)
4
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
to have some control over how your personal or health information is properly collected, stored, used or released
government agencies or organisations handle personal information such as age, address, physical or mental health records
the right to go about our daily lives without being surveilled or have all our actions caught on camera.
5
≠
be left alone
Documents PERSONAL belongings Section 1.1 teachers What is Privacy?
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
Australia ¡
h+p://www.ipc.nsw.gov.au/privacy/privacy_forgovernment/ govt_privacy/privacy_faqprivacy.html ¡
The ¡Privacy ¡Act ¡1988 ¡(Privacy ¡Act) ¡regulates ¡ how ¡personal ¡informa@on ¡is ¡handled. ¡The ¡ Privacy ¡Act ¡defines ¡personal ¡informa@on ¡as: ¡ …informa3on ¡or ¡an ¡opinion ¡(including ¡ informa3on ¡or ¡an ¡opinion ¡forming ¡part ¡of ¡a ¡ database), ¡whether ¡true ¡or ¡not, ¡and ¡whether ¡ recorded ¡in ¡a ¡material ¡form ¡or ¡not, ¡about ¡an ¡ individual ¡whose ¡iden3ty ¡is ¡apparent, ¡or ¡can ¡ reasonably ¡be ¡ascertained, ¡from ¡the ¡ informa3on ¡or ¡opinion. ¡ Personal ¡informa@on ¡includes ¡informa@on ¡ such ¡as: ¡ your ¡name ¡or ¡address ¡ bank ¡account ¡details ¡and ¡credit ¡card ¡ informa@on ¡ photos ¡ informa@on ¡about ¡your ¡opinions ¡and ¡ what ¡you ¡like. ¡
6
EU - Data Protection Directive
http://epic.org/privacy/intl/eu_data_protection_directive.html
The EU Commission's strategy sets out proposals on how to modernize the EU framework for data protection rules through a series of the following key goals:
the collection and use of personal data is limited to the minimum necessary. Individuals should also be clearly informed in a transparent way on how, why, by whom, and for how long their data is collected and
consent to the processing of their personal data, for example when surfing online, and should have the "right to be forgotten" when their data is no longer needed or they want their data to be deleted.
Single Market Dimension by reducing the administrative burden on companies and ensuring a true level-playing field. Current differences in implementing EU data protection rules and a lack of clarity about which country's rules apply harm the free flow of personal data within the EU and raise costs.
strengthening and further harmonizing the role and powers of Data Protection Authorities. Improved cooperation and coordination is also strongly needed to ensure a more consistent application of data protection rules across the Single Market.
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
Brandeis article, according to William Prosser, American common law has recognized four types of actions for which one can be sued in civil court for invasion of privacy.
health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that may be made of such information without patient
examine and obtain a copy of their health records, and to request corrections.
7
Systems and Internet Infrastructure Security (SIIS) Laboratory Page
8
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
9
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
knowledge about a subject or database. A subject's sensitive information can be considered as leaked if an adversary can infer its real value with a high confidence.
date or condition or ...
confidence
records (anonymization of data) will prevent inference attacks?
10
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
11
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
12
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
13
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
14
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
medical records, voter registration information, email usage) with the goal
while preserving the privacy of the users whose information the data set contains.
epsilon-differentially private if for all data sets D1 and D2 that differ in
sets
15
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
16
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
17
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
register (storage of phone numbers in telephony system) is not a search because the "petitioner voluntarily conveyed numerical information to the telephone company." Since the defendant had disclosed the dialed numbers to the telephone company so they could connect his call, he did not have a reasonable expectation of privacy in the numbers he dialed. The court did not distinguish between disclosing the numbers to a human operator or just the automatic equipment used by the telephone company.
18
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
19
Table 3: Potential privacy violations by 20 of the studied applications. Note that three applications had multiple violations, one of which had a violation in all three categories. Observed Behavior (# of apps) Details Phone Information to Content Servers (2) 2 apps sent out the phone number, IMSI, and ICC-ID along with the geo-coordinates to the app’s content server. Device ID to Content Servers (7)∗ 2 Social, 1 Shopping, 1 Reference and three other apps transmitted the IMEI number to the app’s content server. Location to Advertisement Servers (15) 5 apps sent geo-coordinates to ad.qwapi.com, 5 apps to admob.com, 2 apps to ads.mobclix.com (1 sent location both to admob.com and ads.mobclix.com) and 4 apps sent location† to data.flurry.com.
∗ TaintDroid flagged nine applications in this category, but only seven transmitted the raw IMEI without mentioning such practice in the EULA.
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
20
http://www.abine.com/
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
21
Protecting Browser State from Web Privacy Attacks : Jackson et al.
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
22
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
23
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
24
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
25
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
your browser
Variable quality, block content and tracking
26
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
27
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
28
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
29
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
30
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
31
(X Connect to Y, ) (Y Connect to Z, )
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
32
Initiator Responder Public Network W X Y Z
Figure 5: Use of an Onion
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
33
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
be compromised, use per-hop keys that are deleted when no longer in use
34
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
35
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
36
CMPSC443 - Introduction to Computer and Network Security Page
It took a long time for web experts to come to anything resembling a consensus on how it should be implemented, and the process isn't over yet. Microsoft took criticism for enabling the do-not-track setting by default in Internet Explorer. While it sounds good in theory, many worried it would just spur websites to completely disregard the setting (and some, like Yahoo, did just that). Now, Microsoft has reversed their stance. The do-not-track setting will not be enabled by default in the company's future browsers.
software does not contain any backdoors that could be used by the NSA or
the Open Crypto Audit Project found that the encryption tool is not vulnerable to being compromised. However, the software was found to contain a few other security vulnerabilities…
37
Systems and Internet Infrastructure Security Laboratory (SIIS) Page
phones)
38