The Implacable Iron Fist of Google

Yesterday, after a nice walk in the autumn woods, I came home and found several emails and Twitter notices from friends that my blogs were gone. I checked the addresses and this is what I received:

"This blog is no longer accessible. The name is unavailable for new accounts."

WTF?!?!

After following the breadcrumb trail left for me by Blogger, I got to a page that informed me:

"There has been suspicious activity related to this account. To confirm you are the account holder, Google must send you either a text message or a voice message with a code you must enter..."

After I entered a phone number and got the Confirm Code, my blogs were immediately accessible again.

* * * * * * * * * * * * *

Google pretends to be helpful

For the past two weeks, every time I logged in to post on my blogs I've had an interrupt page from Google, stating that "for my convenience should I lose my passwords" it would be handy to have a phone number to use as another confirmation. There's also been a link in that page that said "skip this step" so of course I did; my password is very strong, nonverbal and would be pretty hard to break unless under a sustained and targeted attack. No robo-sniffer or password dictionary cracker is going to get it.

With Google suggesting it would be a good idea and also offering me a link to skip this step, it's implied that this is not a required condition of using Google products (in this case my blogs on Blogger, unfortunately snapped up by Google recently).


The real deal

This morning's research session was dedicated to what Google calls "Two-step Verification Process" which was launched in mid-February and is just getting around to all your Google accounts.

"Over the next few days you should see a link on your Google Account Settings page that allows you to enabled 2-step verification. This new feature adds an extra layer of security to your Google account by requiring a special passcode in addition to your normal password."

Google Adds 2-Factor Security to Gmail, Apps [Krebs]

Here's a big blah-blah page from Google about "two-step verification"

"2-step verification helps protect a user’s account from unauthorized access should someone manage to obtain their password. Even if a password is cracked, guessed, or otherwise stolen, an attacker can’t sign in without access to the user’s verification codes, which only the user can obtain via their own mobile phone. Requirements: a mobile phone that can receive the verification code via text message or phone call, or an Android, BlackBerry, or iPhone. These devices use the Google Authenticator mobile app to generate the verification code. "

"You enable 2-step verification for your domain in your Google Apps control panel. The user enrolls in 2-step verification... Note: You can’t force your users to use 2-step verification, they must opt-in themselves."

* * * * * * * * * * * * *

Real security

I've talked before about secure passwords: 16-character non-word, alphanumeric+special characters passwords kept on a single password-protected file on your computer/usb key and using copy/paste for logins, or using something like Passkey to hold your passwords.

I've also spoken about the "security measure" of "secret questions" - giving an associated (in your mind) answer to such questions as "What was your childhood pet's name?" in light of social networking and the fact that once something is posted to the net, it's out there forever (using tools like the Wayback Machine). So I recommend choosing your question (if this alternative is offered) or using an answer that is completely unrelated to the questions but associated in your mind with the question:


Q. What was your childhood pet's name? A. Squanomish
Q. Where were you born? A. inmymotherswomb
Q. What was your favorite sport? A. escapingbullies

Combine those with the ASCII and spelling variants: Squ@nomiish, inmeyem0therzw0mb, ezkapeingbullieyes and you have a second layer of security, not easily guessed.

And the final simple rule: never use the same password for more than one service.

So the password:
6D9F1$%&3[invisible space/ascii character Alt + 255]15~>#b+

is going to be pretty hard to crack by an automated dictionary-cracker. Combined with the type of answer to the above typical "security questions" and the best-practice of never using the same password for more than one service, your account is going to be much more secure than someone using the password "Fluffy" for all their accounts.

The fact is that, like a house, you can never be completely secure, but you can make it very difficult for a burglar to break in. Given that option most burglars, especially the random, doorknob-turning kind, will go elsewhere to much easier targets. Like a house, if you are the specific target of a dedicated cracker, nothing is going to stop them, but such cases are a lot rarer than you think. I mean, unless you're a multi-billion-dollar CEO, an attorney in a messy divorce case or a bank, who is going to specifically target you?

* * * * * * * * * * * * *

The Google Two-Step

It's obvious by now that all this blah-blah about "enrolling" and "allowing" and "opt-in" is plain bullshit. So is the supposed "security" offered.

The 30-day browser cookie set by users that click the "Remember verification for this computer" checkbox means that if your computer is stolen, the thief can still access your account without having to provide the second step of verification, and likely not even the password if your computer was just sleeping and browser already open.

You'll have to repeat this process every 30 days, meaning Google's going to require a constant correlation between your username and your phone number. Change numbers? You're going to have to go through hoops to restore access to your accounts. Change computers between laptop, desktop, netbook or tablet? Delete all cookies on browser close to get rid of trackers, spies and supercookies? Same deal. Google wants to know where you are and what phone number you are using every 30 days.



Go ahead; try to opt-out, sucker

From more than a dozen posts explaining how to "turn off two-step verification" from both Google and many bloggers, you get this information:

Q.16) How can I turn off 2-step verification on my Google Account
A.16) You can turnoff 2-step verification, by going to Google Accounts –> Using 2-step verification –> click on Turn off 2-step verification…

Here's the separate section on "how to turn off two-step verification"

Another article telling you how to turn off two-step verification


"In order to turn off two-step verification, visit this page or log in to your Google account and go to Settings >> Account Recovery Options >> Recovering your password. That page will tell you you can "add more information to your account to increase your account-recovery options."

Both ways will take you to this:

click the picture for the Big Picture

Notice that if you have not "opted-in" or "enrolled" or "allowed" this process previously, you will still have to fork over a phone number, receive a verification code and enroll in the program in order to reach the settings page where you can turn off the process, which will happen every 30 days.

Remind you of Facebook much? It should. There's no way to opt-out currently without first opting-in, and all Google's fanboy press and mealy-mouthing about "opting-in" or "enrolling" or "allowing" are straight-out lies. The interrupt-page I was receiving for the previous two weeks whenever I logged in offering to be "helpful" and offering me a link to "skip this step" was a smokescreen.

* * * * * * * * * * * * *

FSCK Google


Am I alarmed by this? I certainly am. I am alarmed by Google pretending this is an opt-in service, repeating that idea in various words and meaning absolutely the opposite.

fsck: a Unix-based system utility for checking the consistency of a file system. Generally, fsck is run automatically at boot time when the operating system detects that a file system is in an inconsistent state. [fsck is analogous to the Windows utility chkdsk]

I am alarmed by Google's persistent and consistent efforts to delete anonymity from the net; to consolidate its holdings and bring them into line with its stated mission of becoming an "Identity Provider"; Google's connection to OpenID and the National Strategy for Trusted Identities in Cyberspace [PDF link to whitehouse paper], which Google calls the Kantara Initiative (shades of the D.H.A.R.M.A. Initiative!).

I'm not the only one.

Identity Crisis: The Delusion of NSTIC

Real Names: Google+, Government & The Identity Ecosystem

Google & NSTIC Leading the March to Digital Totalitarianism?

Botgirl's curated “Nymwars News and Commentary” site

* * * * * * * * * * * * *

After yesterday's little adventure and today's research, I am accelerating my efforts to completely remove myself from the Google ecosystem by using viable alternatives to every single product Google offers. I do not like liars and Google has proven to be no better than Facebook in regarding me as a slab of meat to be bought and sold for their profit, telling press about "optional" services that are in fact compulsory now.

Google has now proven to me that they are in fact dead-set on "doing evil."

Google must have forgotten everything it knew about the net; I can think of a dozen ways to get around this type of forced identification and access off the top of my head and during the coming weeks I will be researching even more ways to keep my electronic privacy protected.

What you do is up to you.

* * * * * * * * * * * * *

[double-posted at Netpolitik]

66:75:63:6b:20:47:6f:6f:67:6c:65

* * * * * * * * * * * * *

PSN Breach, the Cloud and Caution

Taking a short breather inbetween my Reply series and circling back to the issue of "transparency," I'm reading the breaking news about Sony's Playstation Network/Qriocity network breach and it doesn't look too good:


"... an unauthorized person has obtained the following information that you provided: name, address (city, state, zip), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID. It is also possible that your profile data, including purchase history and billing address (city, state, zip), and your PlayStation Network/Qriocity password security answers may have been obtained. If you have authorized a sub-account for your dependent, the same data with respect to your dependent may have been obtained. While there is no evidence at this time that credit card data was taken, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained."

- from Patrick Seybold, Sr. Director, Corporate Communications & Social Media



Newer reports from the forensic team indicate all personal data stored with your PSN account has been compromised. Everything including name, address, birth date, the answers to your account reset questions, email address, and passwords.

Coming on the heels of this great post from the Guardian, it simply reinforces the reasons we all originally wanted to get away from the monolithic IBM corp and their "dumb terminal" model of client-server processing. Companies ask me to "trust them" with all kinds of information that is a terrible security risk. It has been demonstrated many times now that most of these companies will either neglect to properly secure their network, fail to use even the simplest security procedures (storing passwords in plaintext, no encryption) or will even sell your data to the highest bidder.


And they want me to trust them with my data? Because it makes their targeted marketing easier and more profitable? And for that I get to pay them money?


At this point in time, no one really trusts Sony anymore to give them the whole truth, especially coming on the heels of their settlement with GeoHot for hacking the "other OS" functionality which was originally a major selling point for the PS3 and which Sony subsequently disabled in several "updates" to the console. Rumors abound of Sony rebuilding their network to destroy the regained functionality of the firmware-modded PS3.

I personally am wary of the rush to distributed computing which goes by the trendy and amazin' *insert sparklies here* name of "cloud computing." The infrastructure is being pushed together hastily; security auditing is often minimal in the "rush to market" and the time-honored wisdom of 'not putting all your eggs in one basket' seems to have gone the way of most sensible and tested business advice and ideas in this modern rush for "newersexierbetterMOAR! because... it's the internet!"

That, on top of the hundreds of stories of company malfeasance, collusion with marketeers and underhanded dealings with consumers (Sony rootkit, anyone?) makes me wary of trusting companies who want my trust and yet have not demonstrated a reason for me to believe their interests coincide with mine as a consumer. And it makes me wary of putting all my data "out there in the cloud" instead of on my desktop where I can control access.

And oh yeah... there's that little Apple iPhone tracking problem too...

*-*-*-*-*-*-*-*-*-*-*-*-*

By the way, in case you hadn't heard, I am now a military acronym for Psyops; just a little tidbit from the propaganda war. That is all.

WordPress.com hacked- CHANGE PASSWORDS

For those of you using WordPress, this announcement today from WordPress:

"Tough note to communicate today: Automattic had a low-level (root) break-in to several of our servers, and potentially anything on those servers could have been revealed.

We have been diligently reviewing logs and records about the break-in to determine the extent of the information exposed, and re-securing avenues used to gain access. We presume our source code was exposed and copied. While much of our code is Open Source, there are sensitive bits of our and our partners’ code. Beyond that, however, it appears information disclosed was limited."

CHANGE YOUR PASSWORDS.

• Use a strong password, meaning something random with numbers and punctuation.
• Use different passwords for different sites.
• If you have used the same password on different sites, switch it to something more secure.

(Tools like 1Password, LastPass, and KeePass make it easy to keep track of different unique logins.)

Here is a tip I have given to many, many people who think such passwords are hard to remember or type:

Make one text file. Call it something innocuous or stupid like "MomsCherryPieRecipie". DO NOT CALL IT PASSWORDS.TXT.

Use this text file to store long, strong and untypeable passwords. Keep this file on your drive somewhere and also on a/several USB keys. Make a shortcut to a folder somewhere with, again, an innocuous name like CLASS-SCHEDULE. Password-protect THIS FILE with a password you can remember. Do not use any of the passwords contained in the file for this text file.

Use cut and paste to log in to sites.

The Steve Gibson password generator is a good one which allows several methods; some for extended characters, some for plain alpha-numeric and others.

... and a little more on this "transparency" thing...

Having been gently strongarmed into getting a FeceBook and Tweety, here's a little article from the Wall Street Journal on data scrapers and aggregators. You should read it, particularly if you're one of the people pushing for "transparency everywhere" and the like.

Somehow, the people pushing this don't seem to consider the realities. Of course, perhaps they haven't had their email broken into and friendships destroyed by that, as I have. Perhaps they haven't made the connection between thinking or trusting some entity out there to "respect their privacy" in the same way they'd think phone taps would "respect their privacy if they aren't doing anything wrong."

From the article: "many firms offer to collect personal, and potentially incriminating, data about users from their social networking profiles and discussions. Many companies even collect online conversations and personal details from social networks, job sites and forums where people might discuss their lives and even potentially sensitive data, such as health issues."

See that?

Still think you have "nothing to hide"? How about the fact that you have high blood pressure, which you mentioned to someone once in SL or on Tweetbook, which your insurance company paid to have scraped, which resulted in triple rates for you, or being dropped from your policy? How about cancer, thyroid problems, depression, some strange fungus on your foot... or that you once made a joke in a forum/chat session like this when you were 15:

"What's white, then black, then white, then black, then white, then red?"

"A nun rolling downhill into a wood chipper."

A joke almost any Catholic school inmate might find hilarious? Or potential terrorism???

Really, if you don't think of these consequences you don't really understand the technology you are using and nothing you have to say to me will be of value. If you want to lecture me on why I should allow every piece of conversation or talk or aside or remark or whatever I chose to make to be connected to my physical being in perpetuity, you are entirely ignorant of the tools and environment you are using. It only shows me your profound ignorance and willful denial of the reality of online data.

And lest you start with the tin-foil hat and paranoia stuff, do some reading. I'd rather be classified as 'boring' or 'not with it' than have stuff out there that might come back to bite me in 10 or 20 years time.

I still believe in free speech and the right to anonymity.

ps - I posted this in Comments but it deserves to be in the main article:

Here's a little reading for people:

Wikipedia - Text Mining

Take a look at the "Commercial software and applications" section - these are just the open and admitted apps. Follow the companies - IBM, Microsoft, Lockheed-Martin...