Working on computer security can lead one to become very risk averse.

When is it safe to give out a social security number?That question was impressed on this blogger recently on an excursion for a new wireless service provider. Walking into a store at a mall in Chicago area, everything started out on a good note: new phone, better conditions and finally good-bye to Verizon incompetence. One catch: applying for this service required completing an applicaiton that involved providing SSN. Nothing unusual about this–in the US service providers are dependent on the monthly subscription fees. Customers pay only a small fraction of the cost of the actual device, which is why that fancy unit can retail for $50. Few subscribers notice that the offer comes with strings attached, typically in the form of a 1-2 year commitment to that provider. The massive profit margins on wireless service easily offset the subsidies for the device. (This is also the reason that phones in the US are “locked”; they can only be used with one provider’s network. Europe places much greater emphasis on customer choice and preventing lock-in opportunities; phones are typically unlocked and IIRC there is a requirement that providers unlock phones if the customer chooses to. Bad news for providers and good news for hand-set manufacturers: consumers walk into a store asking for the latest Nokia model and they do not have to worry about which provider it can work with. US mobile phone service is still archaic by comparison.)

For this business model to work, the providers must be able to count on the customer making good on their payments for the 2 years they are locked in. And what better way to gauge that probability than a credit check?  This is where the SSN comes in: major credit bureaus will not do a credit check without SSN, for good reason.

That brings us back to the scenario in that Chicago mall: consumer is supposed to recite his/her SSN to the salesperson, who is typing that information into a computer. This is an improvement over filling out a form, where the data also exists in paper copy but still there are too many attack vectors to list: do you trust that person? What about fellow employees watching over her shoulder, as the SSN sits on the screen while we work through the application? (and customer for that matter because the layout of that particular store featured “islands” in the middle of the store where the terminals were located.) Even if the employees are diligient, is that computer infected with spyware? It is a general purpose PC and it has Internet connectivity for sure, because the application data is shipped to Verizon. Were they keeping up with the patches? Did one of the employees use this PC for surfing the web, clicking “yes” to everything along the way?

In the end, this blogger decided against signing up for the service. The staff were very courteous and tried their best: the representative helping us asked if we would be more comfortable if I got to type in the SSN directly in to the application. No dice. (Buying the phone only without a subscription was not an option, because of the economics of subsidized units alluded to earlier.) Greatest irony: after I walked out to browse a completely unrelated store, she tracked me down in another part of the mall, and said that her managed decided it was OK for me to sign up without providing an SSN! Why? Probably because they had decided looking at me (and my significant other, she was present the entire time) that we were a good credit risk. It could have been the way we were dressed or more likely the fact that we were even worried about identity theft enough to pause over providing our SSN suggested we had something to lose. Either way, being concerned enough about providing SSN removed any doubts that a credit check would be necessary. That’s one bit of unintended social engineering to keep in mind for future use.

cemp

Returning to blogging after a break.

In the next fews day, we will shift gears and focus on home entertainment– specifically the problems of getting devices from independent vendors to cooperate and stream music to a standard home stereo system. Along the way there is going to be plenty discussion of gadgets and flashbacks to the book “Why things bite back” by Edward Tanner. It turns out a good chunk of the problems can be traced to identity management.

Recap: speaking of “digital distribution” in music, what we mean is the content is delivered in digital format over the Internet, instead of stamped on physical media the way LPs and CDs were. This shift creates a gap between the computing and the home entertainment camp of devices. The typical high-end stereo system is connected to decent speakers and boasts a receiver with multiple digital inputs, such as optical or coaxial ready to receive noise free binary. But when it comes to networking, this system is a complete Luddite: it has no connectivity to speak of, no notion of iTunes or downloading. By contrast, the average PC is loaded with music editing software, peer-to-peer file sharing and smarts to go download track information from an Internet database when the user inserts a CD into the tray. This smart device however is stuck with a sound card made out of cheese, and lousy speakers that make Edith Piaff sound like Britney Spears.

Many solutions have come up over the years to fix the problem, to bridge this gap. Appropriately enough one of the first ones was the Soundbridge by Roku. Soundbridge can connect wirelesly or via Ethernet to a home network and stream music from a device supporting UPnP and HTTP, such as Windows Media Connect. More importantly, it could use the coaxial input on a standard receiver, avoiding analog losses on the way. Expected set up is a PC running Windows Media Connect hosting the music, the Soundbridge connected to the home network and feeding its output to the receiver. There is one problem and it is one of authentication: M1000 only supports WEP for wireless security. For the paranoid ones running their wireless network on WPA, that is a deal breaker. (Adding a second wireless router on WEP to create a subnet does not help: if the Soundbridge can access your music, so can the adversaries that break WEP. And the RIAA would be very upset if your music collection became world-readable.) A simple work around is to use an Ethernet bridge such as the excellent Buffalo Wireless-G Ethernet Convert, which supports WPA to connect to your home network and then acts as bridge to allow other devices to connect using the standard Ethernet ports.

(Continued)

cemp