LifeLock: the plot thickens

(Follow-up from earlier post)

The past few weeks had more developments on the story of LifeLock, the company that promises identity theft protection and challenges would-be criminals with the social security number of the CEO. New York Times published an article on May 24th covering this story. The overall tone of the article is fairly negative on the value proposition of this service:

“…a fraud alert is more like a burglar alarm. And if the alert repeatedly fires off false alarms, forcing creditors to constantly double-check the identities of LifeLock customers who have never been victims of fraud, it is possible that those credit issuers will pay less attention to them. Experian is so worried about this, along with other issues, that it has filed suit against LifeLock.”

Strangely the company has found a new ally in Bruce Schneier who came out swinging in defense of LifeLock.  BS portrays the issue purely as a conflict of business models between the triumvirate of credit reporting bureaus (Equifax, Experian and TransUnion) and Lifelock. Credit reporting agencies prefer that the process of completing a credit check and clearing an applicant is easy. Lifelock’s mission in life is to make that process as difficult as possible for the lender, in order to reduce the risk that the application was fraudulent.

“The reason lenders don’t routinely verify your identity before issuing you credit is that it takes time, costs money and is one more hurdle between you and another credit card. (Buy, buy, buy — it’s the American way.) So in the eyes of credit bureaus, LifeLock’s customers are inferior goods; selling their data isn’t as valuable. LifeLock also opts its customers out of pre-approved credit card offers, further making them less valuable in the eyes of credit bureaus.”

And later in the same approving vein: (links in the original)

“It’s pretty ironic of the credit bureaus to attack LifeLock on its marketing practices, since they know all about profiting from the fear of identity theft. Facta also forced the credit bureaus to give Americans a free credit report once a year upon request. Through deceptive marketing techniques, they’ve turned this requirement into a multimillion-dollar business.”

One point where everyone is in agreement is that the services are not worth it from a purely financial point of view. Most of the actions taken on behalf of subscribers by the commercial services can also be taken by individuals directly for free. Convenience is the main selling point. For example anyone can request to have an alert put on their credit file but these expire after 90 days.

The original Wired article covering allegations that the service does not work appears to have been removed. Not to worry: Kim Zetter (full disclosure– she is a friend) writing on the ThreatLevel blog has missile lock on the company. In a series of posts, she highlighted an original piece from the Phoenix New Times that surfaced questionable past connections of the co-founder. LifeLock announced in response that he was resigning from the company.

cemp

Debian/OpenSSL vulnerability: subtle and fatal (1/2)

Most vulnerabilities in COTS software are quite blatant about their root causes and direct in their impact. A remote code execution vulnerability can be traced to a low level programming error and its immediate effect is likely an 0wned machine, or the next billion dollar self-propagating malware. Once in a while, a new extremely creative type of bug is introduced that defies this pattern. The flaw in the OpenSSL random number generator that affected Debian and Ubuntu is one of those rarities.

The short version: Debian developers attempted to fix a problem in OpenSSL that was flagged by static analysis software. (For other takes on the problem: my colleague Ben Laurie has taken the Debian maintainers to task and added some clarifications about the response, XKCD has neatly summed up the issue with a comic strip and Garntner argued that this incident is indicative of a deeper problems in open-source, just in time for a Coverity report that gave glowing reviews to open source projects for fixing issues identified by their technology.) It turned out the fix was much worse than the ailment

  • Motivation: specific problem flagged by the automatic analysis of source code was an instance of using uninitialized memory– something that ought not occur in an ordinary application and is almost always a bug. But a library implementing cryptographic functionality has unusual requirements. In this case the OpenSSL designers were intentionally using uninitialized memory to seed the randomness pool. C/C++ language lawyers will jump up and down at this point screaming that use of uninitialized variables on the stack is undefined by the language. “Undefined” meaning that the compiler is free to optimize out the code, insert an easter egg, cause the application to crash if it reaches that instruction etc. Pragmatically speaking on most CPUs, operating systems and compilers that OpenSSL will likely reach, the memory ends up retaining the junk that was written last time, and this unpredictability is exactly what is required for randomness.
  • Neglected wisdom: important point is that the bug was not causing OpenSSL to crash or misbehave. In the worst case, the memory region contained predictable data such as all zeroes, so there was no benefit in seeding a randomness pool with that. No problem because there were many other sources of randomness used. This is a good time to remember the classic engineering adage: “if it ain’t broke, don’t fix it.” Debian developers did “fix” it, but in doing so they removed the addition of all entropy to the pool, instead of simply removing the one instance that was questionable.
  • Outcome: OpenSSL random number generator was completely broken. This is a major problem when dealing with cryptography. Everything depends on keeping secrets; encryption only works to protect data from people who do not have the decryption key. When keys are not just random patterns but generated according to a very predictable pattern, they are no longer a secret. The surprising part is that the code did not have a “vulnerability” in the classical sense: OpenSSL would not crash on malformed data because of this, it would not start running somebody else’s code or cause the machine to become the latest inductee into a botnet. A security researcher looking for yet another buffer overrun would be disappointed to realize that nothing of the sort was introduced as a result of the Debian update.

(continued)

cemp

“Unauthorized charger” and other device restrictions

One of the common complaints about electronic gadgets is that nearly each one requires a different power adapter. The diversity can not be explained by the difference in power consumption; a laptop that burns 90W could just easily be powered by an adapter that is rated to 100W. The price would at best go up increase very slightly with maximum rating and this difference would be likely compensated for by the economy of scales from standardizing on a small number of models. Yet manufacturers continue to insist on not standardizing their adapters in the hopes of generating additional revenue.

Mobile phones are an interesting case. As smart-phones proliferate they require both power and data connectivity. The other end of the data connection is likely going to be USB. A sufficiently arrogant company could insist on their own Firewire (or is that IEEE1394?) technology in left field as the original iPods were but most consumer electronics have settled on USB2.0 fortunately. Speaking of the iPod it was one of the first that combined data and power into a single cable. Mobile phones are following suit now.

So it is something of surprise to see the Razor V3m display “unauthorized charger” when connected to a MacBook Pro. It is not a smart-phone so there is hardly any data to synchronize but USB is still good as a power source. There is no good reason for the phone to reject it. If this is by design and not just flakiness on the part of the handset, it is yet another pointless attempt to go against the current of interoperability in order to lock in consumers into a single brand of peripherals.

cemp

Suburban sprawl in numbers

A Sierra Club handout from the unimpressive NYC Green Festival shows a country that is sprawling in very uneven ways. On the one hand there are boom-towns exemplified by Charlotte: it’s population increase 63% between 1970 and 1990. That by itself is not out of line with a ~2% average population growth the US itself has experienced during the same time. But Charlotte’s “urbanized area” (a misnomer since this largely describes the expansion of suburbs) expanded by 129%. Kansas City showed a modest 16% increase in population but over triple that growth in area at 55%. Even Chicago which maintained its population more or less unchanged expanded by a quarter. Then there is Pittsburgh that managed to expand 30% in spite of a drop of 9% in population.

On the other side is Seattle with an almost perfectly balanced 41% population growth over 42% sprawl increase. (It’s a safe assumption that the miserable climate has deterred more people from moving to the Pacific Northwest.) A few cities even became more “dense” during these two decades: Las Vegas population grew threefold but it’s land area only doubled. Salt Lake City shows the same pattern.

These are the exceptions. US Department of Housing report cited claims that nationwide urban areas expand at about twice the rate of population growth. This is the great suburban flight all over again. (Strangely a survey for Pew Center found sprawl tied with crime as top local concern for most Americans– the same ones checking out of urban centers because of intractable problems such as crime.) Sierra Club attributes the problem to misguided government subsidies that encourage development at the fringe while robbing the urban cores of resources necessary for education, as well as haphazard planning at the state level. Cue in the usual refrain about investing in public transportation, mixed-use approach which blends residential areas with commercial ones and not encroaching on wildlife habitat for building the next subdivision. The New Urbanists have been beating this drum for a while without much success. If anything the housing bubble has aggravated the problem of the  Suburban Nation by making it more attractive to purchase property in what appeared to be the next up-and-coming regions such as Phoenix, Arizona. The report concludes with a somber reflection on the connection of sprawl to population but no viable solution aside from the same platitudes.

cemp

CFP2008: Deep thoughts on deep packet inspection

DPI came up on the Friday morning discussion of network neutrality and when exactly an ISP has crossed the line. There is a material distinction between “content” and “meta-data” of communications. For example the rules around a pen register / trap-trace and different and more stringent than those governing a full wiretap. For IP communications, the parallel for phone number is the header of an IP packet, which might describe its destination, how much data it contains and perhaps hint at the protocol.  Looking past that into the payload of the packet is what can be termed “deep packet inspection.”

On the panel it was pointed out that DPI simply not commercially feasible until recently. The hardware required to look at every packet flying by a high-speed gigabit link is not exactly stocked at the local BestBuy. According to David Reed, initial demand was driven by intelligence applications. But Moore’s law does not discriminate between military and commercial use. As soon as the capability was within striking distance for large ISPs, people started looking for ways to capitalize on it: in other words, a solution in search of a problem. As with most of these contrived, artificially created uses of technology that start from the ISDN position (“innovations-subscribers-don’t-need”) the first attempt has proved less than brilliant.

The proposals from Charter and British-Telecom cross the line from dubious into no-doubt-about-it nefarious. This is the one scenario where less intrusive solutions are not possible because the business model favors collecting more data about customers. There is an interesting correlation between how far into the IP packet the ISP must look and the social acceptability of its objectives. Comcast can manage its scarce resources by simply counting bits– looking at the size of the IP packets sent, without regard for its destination or port. As it turned out their first crude, inept attempt did look at port numbers and single out BitTorrent. Luckily bandwidth is bandwidth and while the ISP has every right to create different pricing models that may require limiting resources consumed by the heaviest users, it has no business deciding which protocol the customer will use or what endpoints they choose to communicate with. Looking at the size of the IP packet and keeping tabs on usage is good enough for this purpose.

Looking at more data in the packet cranks up the intrusiveness level. Destination address will reveal the websites the customer is visiting. Advertising networks have traditionally relied on this information for targeting. This is the same data Charter and British-Telecom are going after. The final step will involve looking past the header and directly into the contents of the packet. Moore’s law is not on the side of privacy in this case. The CFP discussion and Peter Ohm’s ideas about the ECPA connection are very timely.

cemp

Ford Motor Company and the long-anticipated rude awakening

According to CNN/Money, Ford Motor Company concedes that high gas prices are here to stay, and as a result the company will not be able to execute on its profitability plan by 2009 as forecasted earlier.  Readers maybe wondering why this is news. Detroit has been a single trick-pony for a long time. All three manufacturers had established businesses in light-to-heavy trucks and SUVs. These bet paid off handsomely through the 1990s and well into the first half of this decade with the exception of the brief recession following dot-com implosion. Meanwhile the passenger car market was ceded to foreign imports and there was virtually no interest in new fuel efficient alternatives. But such over-specialization is extremely dangerous: it is generally recognized that dependence on a single product line creates a major vulnerability. The technology parallel is MSFT, a perennial two-trick pony with operating systems and productivity software. The difference is MSFT has been very aggressively trying to diversity into online services, gaming consoles and automative computing, to name a few. Ford has been forging full speed ahead.

It’s not clear whether Ford management failed to see this coming or if the internal structure prevent action. A more charitable interpretation is that Ford did not hedge correctly on price of oil. The last decade of the 20th century showed a clear upward trend in price of crude and gasoline, with long periods when the price of the refined product seemingly “unhinged” from the price of the underlying commodity. Yet the fluctuations did not appreciably change lifestyles. There was no price elasticity, commentators argued, because the amount of fuel consumed is decided a long time in advance based on the commute and vehicle. Once individuals migrate to the exurbs and commit to 45 minutes of rush-hour driving with the 8000lb SUV, it’s difficult to respond to changes in pricing.

But the laws of economics were not permanently suspended. There is a price point where even existing owners may change their consumption pattern. More importantly before that point is reached another pressure appears: prospective car buyers will gravitate towards higher milage options. Ford CEO Alan Mulally says: “We saw a real change in the industry demand in pickups and SUV in the first two weeks of May. It seems to us we reached a tipping point.” This acknowledgment is an important first step but arrives about 5 years too late. Interesting enough Mulally was vice president at Boeing earlier, another company very vulnerable to oil prices and no easy way out: there is no such thing as a hybrid 747 although Virgin airlines grabbed headlines with a brief biodiesel experiment. Fortunately airlines unlike consumers have always factored efficiency into their purchasing decisions. Bringing this insight into Ford could be one of his main contributions. Meanwhile Ford remains unlikely to garner a “buy” recommendation any time soon.

cemp

CFP 2008: Network neutrality and the end of flat pricing models

(Reflections on the past Computers, Freedom and Privacy conference.)

The event had no coherent theme this year unlike the relevance of copyright in 2002, electronic voting in 2004 at Berkeley, the panopticon of commercial surveillance in 2005 at Seattle and the corresponding questions around intelligence in 2006 in DC. Network neutrality and the recent overtures from Comcast, British Telecom and Charter may have been the closest to a shared preoccupation with the crisis-of-the-day.

One welcome development is that the audience on the whole had moved beyond the particulars of Comcast blocking BitTorrent, discussed earlier here. Many people including Paul Ohm and David Reed (who coined Reed’s law describing the value of collaborative networks) made the point that the purported goal of managing scarce upstream bandwidth could have been managed by much less intrusive means including metering usage regardless of the protocol involved. Network neutrality principle rules out any justification for picking on one protocol or application– even if Comcast network engineers decided empirically that one protocol was responsible for the lion’s share of bandwidth usage. And there is no excuse for injecting bogus network traffic (forged reset packets) in response to perceived usurping of bandwidth. Comcast to its credit had a recent moment of clarity and announced a more nuanced approach for managing its available capacity, emphasizing “protocol agnostic.”

As the CFP discussion made clear, BitTorrent and its alleged use for sharing copyrighted content is a red herring, a distraction from the core issue that is purely economical. It is the question of who is paying for bandwidth and exactly how much. Throughout much of the 1990s residential Internet access remain slow, primitive and uncommon. Dial-up connections were the norm and subscribers paid for amount of bandwidth used. In this environment bits were precious, applications were designed to eke out the greatest utilization from the modest bandwidth available and spam literally cost money by driving up usage charges. Eventually as the amount of capacity expanded everywhere, from the massive amounts of fiber underground bulking up the backbone to upgrades in the so-called last mile to the home, it became possible for ISPs to enter the market with a disruptive business model: flat monthly fee for unlimited usage. When AOL switched over to this structure in 1996, it was overwhelmed by the response.

During the transition from dial-up to broadband this tradition of all-you-can-eat pricing was inherited. Granted, service tiers still existed and greater bandwidth could be purchased for higher monthly fees. Within a particular tier it made no difference if the subscriber surfed the web all day along or rarely powered up her computer. This was either the realization of an old prediction made about nuclear energy (“electricity to cheap to meter”) realized in the context of bandwidth, or a sign that everyone was on board with the arrangement of infrequent users subsidizing the high-demand households. It would not have been the first time: similar subsidies occur all the time in technology, including for example different SKUs for software where enterprises pay far above cost to enable consumer versions to be sold at deep discounts.

Either way, the tacit agreement between subscribers and ISPs has continued. Until now. As predictable as the post World War II euphoria over nuclear energy making electricity essentially free disappeared in the Cold War anxiety as the long term problems were better understood, the visions of exponentially improving bandwidth quickly disappeared. Unlike CPU and memory, it proved surprisingly resilient to Moore’s law. Broadband access by DSL or cable still costs comparable to what it did several years ago, and while available network speeds increased gradually, it was a far cry from the doubling every 18 months rate that other components of the PC experienced.

The major disruption instead was the rise of new bandwidth hungry applications, particularly those clamoring for upstream bandwidth. Peterson’s law says that work expands to fill the time available. Internet applications did the same thing for bandwidth. Streaming video may have brought us to an inflection point. All-you-can-eat makes sense when the subsidies are reasonable; in other words the expected range of consumption lies in a narrow band, where the difference between heaviest users and less demanding ones is small. (That is a proxy for the amount of subsidization going on. Less frequent users are missing out on that much value and the heavy users get a corresponding free ride.) In the good old days of narrowband, the difference between the Internet addicts and infrequent users may have been insignificant. Today the difference between checking email and streaming a Netflix movie can be two orders of magnitude.

It’s clear that ISP networks are over provisioned: there is not enough capacity to deliver 10Mbps to every user at the same time even though that is the advertised service level. As long as the average demand works out to below some threshold, everyone is happy. That situation calls for a mix of connection profiles: some idling, others engaged in low bandwidth-intensive tasks and another fraction going full throttle. When more subscribers start maxing out their usage and disparities in consumption grows, the flat pricing model can not survive. Not surprising for a telco, Comcast tried to solve this problem in the most crude and heavy-handed way by trying to “take out” one protocol and suppress demand. Equally predictably, it just dug itself into a deeper hole, sparking a new round of debate on network neutrality and even stirring government into action.

Future predictions? Instituting pay-as-you-go may be a challenge, even when it is most efficient allocation of bandwidth. Customers are used to the flat fee structure. Instead we might expect two things. First is a global cap on amount of bandwidth available per month, similar to wireless plans, with overcharges or reduced service levels when the cap is reached. The second response would be an increasing number of service tiers: for example a “file-sharing plan”  (obviously named something more acceptable) may offer higher upstream bandwidth and greater caps. All of these are consistent with network neutrality: the subscriber gets an allotment of bandwidth in terms of maximum available, sustained over a period of time and perhaps for the duration of a month. The user is free to exercise this bandwidth any way they choose: any protocol, any website, any time etc. without interference from the ISP. Limitations imposed on exceeding the expected demand level are transparent and fixed in advance. More importantly the customer can decide to opt for the next service tier when necessary.

cemp

LifeLock proves social security numbers can not be defanged

“I’m Todd Davis, CEO of LifeLock. And ..-…-…. is my real social security number.”

This was the full page advertisement in New York Times Sunday magazine. Except the SSN was not blanked out and this was no careless redaction error. LifeLock had developed an identity theft solution so reliable that the CEO was willing to disclose his own social security number to prove it. Brave indeed: SSN is by far more dangerous than the credit card numbers for many reasons: the card networks have already accepted the risk of payment card fraud and absorb losses (at least in the US; your mileage may vary by jurisdiction), cards can be revoked and the damages are bounded by the spending limits on cards. SSN on the other hand enables so-called “new account fraud” because it is used as an authenticator: knowing the SSN for a person counts as proof of being that person. Lenders are happy to extend credit based on this ludicrous authentication protocol and there is no Visa/Mastercard to underwrite that risk by refunding consumers for losses. (Full disclosure: more on this distinction appears in a chapter this blogger contributed to an upcoming book by Stanford press.)

This distinction has implications for a breach. Having a credit card number made public is easily recoverable and often with minimal damage. In the 2006 FTC Survey on identity theft, the median losses from existing card fraud were exactly $0. It would not be quite as impressive if the LifeLock CEO had published his credit card number in the newspaper, except it may run a foul of the card-holder agreement in case there are any requirements towards “due diligence” in security. But the social security number is an identifier US residents are stuck with for life. It can not be revoked or easily changed. If any protection service could control the risk to the point that an individual can publish their SSN in a newspaper, that would have been a major breakthrough.

Today a Wired article shows it’s too early for celebration. LifeLock is getting sued on behalf of three customers who claim that the service does not work. The attorney filing the charges points to the fact that the there have been 87 attempts to fraudulently use the identity of the CEO– including one that succeeded where the perpetrator succeeded in taking out a payday loan in Texas. In addition the article concedes:

“Davis said it’s possible driver’s licenses have been issued to other people in his name because of the widespread availability of his personal information – and because of what he described as the flimsy mechanisms in place to report that kind of fraud.”

This is not completely surprising: virtually all of the identity theft protection services depend on the triumvirate of credit bureaus for detection. Any new loan applications will be reported to these companies (in fact even the existence of a credit-check prior to granting the loan is recorded) and can be periodically queried. But a new driver’s license will not appear on the radar. This is not surprising: SSN is used in an open, distributed ecosystem without a centralized clearing point. Payment card networks have complete visibility into all transactions involving the card. Actions involving the SSN can only be reconstructed by putting together fragments of records from data brokers such as the credit reporting bureaus, Axciom, Choicepoint and Seisint (now owned by Lexis-Nexis) The case against LifeLock suggests that this patchwork solution is far from being a reliable identity theft defense.

cemp

Website monitoring: canary in the mine for traffic shaping?

Website monitoring is an established business. Perhaps the best known example is Keynote, whose statistics carry a weight akin to Neilsen ratings minus the subjective element of user preference. These systems measure the performance of websites as perceived by customers. Typically they have an array of sensors, distributed across the globe– the more dispersed, the better a picture that emerges– that periodically pings a website to check how quickly the pages load, whether any errors are returned or key services such as authentication experience an outage.

So far none of them have stepped up to the plate and offered to detect traffic shaping. Considering that network neutrality is under attack from all directions, this could be the next application. Suppose an ISP in North America decides to put the brakes on downloads from Netflix while prioritizing streaming video traffic from a competing website. (It’s not a stretch to imagine a kickback, revenue sharing model or even past grudge against Netflix could motivate this behavior.) An extensive sensor array would reveal this anomaly, provided there is at least one sensor inside this ISP boundary. The measurement may reveal an unexpected latency compared to other network locations in the same region or strange bandwidth caps in effect over time.

That still leaves open one question: whether the web service provider could have any legal recourse once they discover their traffic was being discriminated against.

cemp

Next version of MSFT office to support open document format

The times they are changing for MSFT. A recent announcement that the next version of the Office suite will support new open source formats may be the most revealing example.

Interoperability is a complex strategic game but can be summarized this way: interop always helps the smaller competitors against a large established player. This is a standard consequence of network effects. Before Word had significant market share and was the small, scrappy upstart trying to gain a beachhead position against Word Perfect, it was imperative to read and write WP documents. This allowed customers to switch to Word but still continue to interoperate with the majority of people still using the more ubiquitous application. The developers for Word Perfect, on the other hand, have no incentive to help accelerate this switch, so their application would not recognize the new format. Here is a divergence from the golden rule of getting along in a network world: “be conservative in what you send out and generous in what you accept.” If interoperability were the only objective, every application would be able to open documents published by any other formats while itself using a very well narrowly-scoped that would be easy for these other applications to understand.

The same pressure applied to Excel when it was competing for market share against Lotus Notes. As MSFT Office became the de facto standard in the enterprise and eventually for consumers, this pressure gradually eased even though the import/export capability for the “legacy” formats remained. At some point the scales tipped and the burden shifts to the competing applications with smaller market share to work with the leading formats.

Open source software follows the same path: it was imperative for Open Office to be able to accept Word documents, as well as save new documents in Word format. This mean that every new release of Office required catch-up effort from the community to add necessary interop functionality. (It did not help that the office formats were largely undocumented and had to be reverse engineered until the XML based Open Office XML specification, which itself fueled another line of controversy during its push for standardization.) Same goes for cloud services: it is no coincidence that Word documents, Excel spreadsheets and PowerPoint presentations can be uploaded.

The announcement that MSFT Office will support the new open-source formats is not due to a tipping point in market share. Its current position remains virtually unassailable. Even the Apple commercials that try to mock PC platform as a square, clueless fellow are forced to pay a backhanded complement by emphasizing that the latest generation of Macs can run Office. Is this the sign that demand for interoperability has arrived? Is the golden rule a more compelling option than trying to create lock-in effects by using proprietary formats and breaking changes on every release that force open source alternatives to play catch-up? At least the European Union is not convinced and announced its own intentions to verify this:

“The Commission will investigate whether the announced support of Open Document Format in Office leads to better interoperability and allows consumers to process and exchange their documents with the software product of their choice.”

Between the competition from free Open Office, disruptive Google Apps for the Enterprise, Adobe trying to unify presentation layer with PDF and now additional regulatory scrutiny, it is getting interesting for the future of desktop productivity software.

cemp