Fresh From the Facebook Hackathon

Barring any discussion on ethics or privacy or anything else related to whether an applicaiton like this should be used, I think that this applicaiton has a number of uses within the security space. For those of you that have been doing this for a while may remember a tool called "Silent Runner", which was a sophisticated visual analyzer.

SilentRunner's applied at the time what was considered state-of-the-art correlation and visualization capabilities to visually monitor and investigate the flow of content moving through internal and external networks for security breaches.

It was referred as a "protocol analyzer on steroids". As it had the ability to save network activity to session files and visually represent the activity in 3-D in order to display trends and anomalies in traffic.

The problem with this tool was that it was created by some very smart people at Raytheon and poorly priced and marketed by the same organization.

So what was created is not new, but could be tailored by a smart security person to build an amazing 3D look at what is traversing their network internally or externally. Also, if you have done any study into the limitations how humans process and retain information, you would see that this type of application could actually assist personnel that monitor networks to make critical decisions based of what they are seeing in real time 3D as opposed to lines of data.

I would love to get my hands on this application to play with it.

Mary and DJ:

I suppose what I'm a little quixotic in my wish to find merchants/providers who realize that privacy is a strong loyalty-builder. An example I'll give is from the brick and mortar world. One of my favorite bookstores of all time is the Tattered Cover in Denver. They have a huge selection of books, and make a point to carry any book that has ever been banned. What's more, they have a FIERCE belief in the privacy of their patrons. The owner of the shop has been to court many times to defend that privacy.

Because of the store's unswerving protection of privacy, they've earned my loyalty as a customer. Even when I can save a few bucks by ordering from Amazon or Barnes and Noble, I send my business to the Tattered Cover.

Contrast that with the likes of Yahoo and Google and Microsoft behavior in China.

Bottom line? Guarantee my right to privacy, and follow through on that guarantee with actions, and you'll have gained a loyal customer.

Quixotic. Yep, that's what I am. 

I completely agree with the idea that you shouldn't do online what you wouldn't do in a public forum. People must become aware that every word you type and every image you post has an electronic footprint that can be traced and tracked, not only by strangers, but by your employer, etc.

It's kind of like shopping or riding an elevator these days. I've gotten used to the idea that cameras are probably recording my movements, at least part of the time. Does that bother me? Not really, since I don't think the photos will be used unless a crime is committed where they need to be reviewed.

On the other hand, it does bother me that Facebook has information that isn't used for law enforcement but instead for commercial purposes. And I do think they should be held partially accountable for the problems that occur on their site. After all, if they can be technically proficient enough to gather data on me, they can certainly invest in protecting my account.

Leland,

I agree with what your saying.  I think the real challenge is that people think they are anonymous on the web when you really are not.  My point is that we should assume that what we are doing on websites is like acting in public.  If you wouldn't push the button in public you shouldn't from your home.  That being said we feel safe in our homes and that is why people act anonymous.  But we have to remember that websites are hosted on somebody elses hardware and can be anywhere in the world.  There are no international privacy laws or international privacy expectations.  Until such time we have to be prudent consumers of any service rather than sheep willing to accept every invitation or to participate in membership of organizations.

I disagree with holding Facebook accountable for these actions.  People voluntarily join and post their information to sites like this.  They can only be as secure as the user who generates their account.  Email accounts are easy to come by and passwords, especially dictionary words, are extremely easy to hack.  A simple 7 character password can be hacked in minutes through brute force attacks.

These sites while intriguing and providing a electronic version of socializing is no less risky than going into the public.  I would challenge that in some ways these sites are more risky because they can be accessed from any where in the world and allow bad guys to identify targets based on a variety of criteria.  The communities or groups of interest that these sites provide allow the bad guys to develop a profile sharing their desired criteria and are able to quickly filter through networking.  The rest is left to hacking or social engineering for exploitation. 

The fact that organizations like FaceBook have this data is not overly surprising to me.  It is obvious that they have been collecting this data and just found a nice graphical way to demonstrate this.  The disturbing fact is that people continue to put sensitive information on these sites.  I would suggest that people need to gather some common sense and if you are not willing to print the page and all of its content out and hand it to a stranger then you should not be putting it on one of these sites.  I am not sure if people are actually this naive or if they feel anonymous because they are not physically in front of another person but there is a wealth of personal information that is passed through these sites.  We have seen a couple of instances here in the US of where intent to commit a crime was published on a person's page.  We cannot, however, hold law enforcement accountable for missing such intentions.

You mean they HAVEN'T already taken over the world? 

 Yes, I am very skeptical that Facebook, or Google, or anyone with 'click histories' on us would have any sort of incentive to keep that data private. Instead, they have every reason to sell that data to a host of users, including government agencies, retailers, and anyone else with a buck.  

Yes, thanks for that ray of holiday sunshine; and I quite agree: God help us all if Facebook, Google, or Microsoft ever take over the world and start culling our browsing and online histories and holding us accountable for all those clicks and ticks.

If I'm reading between the lines correctly in your comment, you also seem to be casting doubt on the authenticity (or durability) of that phrase "non-user-identifiable data." Non-identifiable by whom? For how long? And stored where?

Happy Thanksgiving, indeed.