Is Your Internet Company Protecting Your Privacy?

BEST AND WORST COMPANIES FOR INTERNET PRIVACY

See how Comcast, AT&T, Snapchat measure up

Published: 14 hours ago

 BOB UNRUH About | Email | Archive

 Subscribe to feed

• 
• Text smaller
• Text bigger

     280

A consumer organization concludes that when it comes to protecting customer information from government requests, Snapchat has a dismal record of failure, and Comcast, AT&T and Amazon aren’t far behind.

The report by the Electronic Frontier Foundation,”Who Has Your Back,”  surveyed major Web companies from Adobe to Yahoo regarding their policies and practices regarding the personal information of customers.

The report examines how 26 of the top technology companies handle customer privacy in six categories.

Snapchat was found to be publishing law-enforcement guidelines but not requiring a warrant for delivering content, not telling users about government data requests, not publishing transparency reports and not fighting for users’ privacy rights in court or in Congress.

EFF Activism Director Rainey Reitman credited Edward Snowden, the former NSA contractor who leaked thousands of classified documents, with forcing changes.

“The sunlight brought about by a year’s worth of Snowden leaks appears to have prompted dozens of companies to improve their policies when it comes to giving user data to the government,” Reitman said. “Our report charts objectively verifiable categories of how tech companies react when the government seeks user data, so users can make informed decisions about which companies they should trust with their information.”

EFF’s report awards up to six gold stars for best practices in categories such as “require a warrant for content” and “publish transparency reports.” Last year, just two companies surveyed earned a full six stars – Sonic, a California ISP and Twitter.

This year, Apple, CREDO Mobile, Dropbox, Facebook, Google, Microsoft and Yahoo all joined Sonic and Yahoo in receiving six full stars. Several others – LinkedIn, Pinterest, SpiderOak, Tumblr, Wickr and WordPress – only missed getting all six stars because they did not have to bring public court battles on behalf of their users, EFF said.

See all the privacy-related reports at WND’s Superstore, including “Police State, U.S.A.,” “One Nation Under Surveillance” and “How American is Becoming a Police State.”

Significantly, most of the companies surveyed “have made a formal commitment to inform users when their data was sought,” adopting a practice pioneered by Twitter, the report said.

“Additionally, 20 of the companies EFF reviewed published transparency reports detailing government requests for user data, which is a striking increase from last year, when only seven companies in EFF’s report published them. This is now a new standard in the tech industry: corporations are actively and voluntarily working to shed light on the government attempts to access user data,” the report said.

“Snapchat joins AT&T and Comcast in failing to require a warrant for government access to the content of communications. That means the government can obtain extraordinarily sensitive information about your activities and communications without convincing a judge that there is probable cause to collect it,” said EFF Staff Attorney Nate Cardozo. “We urge these companies to change course and give their users this simple and needed protection from government overreach.”

EFF reported that the legal landscape for consumer privacy right now remains unsettled.

“Both Congress and President Obama are negotiating legislative reform that could curtail or even end bulk surveillance programs, while other congressional proposals would instead enshrine them into law. In multiple recent public opinion polls, the American people attest that they believe government surveillance has gone to far,” the EFF report said.

“In the face of unbounded surveillance, users of technology need to know which companies are willing to take a stand for the privacy of their users.”

The report points out some areas of concern.

“Amazon earns two stars in this year’s ‘Who Has Your Back’ report. Amazon should be commended for repeatedly fighting in court to protect the privacy of its users’ book purchases and for requiring a warrant before giving data to government. However, Amazon has not publicly adopted industry best practices in other categories, such as providing notice to users about government data requests.”

The report expressed disappointment that AT&T was “silent on the issue of mass surveillance.”

“In 2006, EFF sued AT&T for its cooperation and collaboration with the NSA spying program, which was confirmed by whistleblower documents. In 2008, Congress passed retroactive immunity for AT&T, which ended our case but not the telecom’s participation in mass surveillance.”

The report said Comcast has not joined other technology companies in publicly opposing mass surveillance.

EFF said Snapchat earned the lowest score, with only one star.

“It does not keep pace with industry competitors when it comes to transparency around data requests, giving users notice when their data is sought by the government, or requiring a warrant for user content. Snapchat also does not publicly oppose mass surveillance.”

Secure Your Website, Don't Get Hacked!

EFF: Websites Must Use HSTS In Order To Be Secure

April 4, 2014 by Electronic Frontier Foundation 

 14 5

 

 1 39

This article, written by Electronic Frontier Foundation technologist Jeremy Gillula, was originally published on the organization’s website on April 4.

You would think that by now the Internet would have grown up enough that things like online banking, email, or government websites would rely on thoroughly engineered security to make sure your data isn’t intercepted by attackers. Unfortunately when it comes to the vast majority of websites on the Internet, that assumption would be dead wrong. That’s because most websites (with a few notable exceptions) don’t yet support a standard called HSTS—HTTPS Strict Transport Security.

Why is lack of HSTS even an issue? To see what could go wrong, imagine the following common scenario. You’re in a coffee shop and you want to check your bank account. You pop open your laptop, connect to the free wifi, load up your web browser, and type in your bank’s URL. No security alerts pop up when you load the page, and there’s even a padlock icon next to the address, so you go ahead and login. Unfortunately, you could very well have just sent your login information to a potential attacker.

The way the attack worked is as follows. When your browser first tried to contact the bank’s server and load its homepage via HTTP, the attacker intercepted the request to connect and prevented it from getting there (perhaps by having his laptop pretend to be that free wifi hot-spot). He then sent your request to the bank’s server himself. When he got the response back (i.e. the webpage to load, the images to display, etc.) he stripped out any links that would initiate a secure HTTPS connection, modified the page so that it would show the padlock icon next to the address (by setting a padlock as the favicon), and sent it back to your laptop. Of course these kinds of attacks have been automated. The result is a page that looks identical in your web browser—the only difference is that it’s not secured, and the attacker can read everything you send to the server and everything that gets sent back.

But why couldn’t your browser detect the attack? The problem is that modern browsers display prominent security alerts only when a website’s security credentials appear suspicious—if a website connects over a secure channel and everything appears OK nothing much happens, and the same is true if the website connects over a normal, insecure channel. Without HSTS, browsers have no way of knowing that a website should be delivered securely, and so cannot alert you when a website that ought to be loaded securely (e.g. your bank’s website) is instead loaded via a normal connection (i.e. the unencrypted version the attacker sends to you instead). HSTS fixes that by allowing servers to send a message to the browser saying “Hey! Connections to me should be encrypted!” and allowing browsers to understand and act on that message.

So why haven’t more websites enabled HSTS? The biggest reason, we fear, is that web developers just don’t know about it.1 Another problem is that support for HSTS in browsers has been incomplete: only Chrome, Firefox, and Opera have had HSTS support for a significant period. This is changing though: we noticed that Apple quietly added HSTS support to Safari in OS X 10.9. For now, Internet Explorer doesn’t support HSTS—which means that there’s basically no such thing as a secure website in IE.

In response to questions from EFF about this situation, a Microsoft spokesperson told EFF that the company would now commit to supporting HSTS in the next major release of Internet Explorer (we aren’t sure whether we have persuaded Microsoft to implement HSTS sooner, though that seems quite likely, and is great news). This means that with the next major release of IE, every major browser will support properly secured websites.

In the mean time, what can users do to make sure their connections are secure? One option would be to use EFF’s HTTPS Everywhere browser extension. HTTPS Everywhere automatically tells your browser to use secured connections on many (but not all) websites that support them; on many domains it functions like a client-initiated equivalent of the serverside HSTS mechanism.

But what if you’re stuck using a browser that doesn’t support HSTS or HTTPS Everywhere, or a website that doesn’t support HSTS? For now all a savvy user can do is to always carefully examine the address of the site you’ve loaded, and verify that it’s secure by checking to make sure it has “https” in the front and is the precise address you want to visit.2 Unfortunately this assumes that you know ahead of time (and remember) whether or not a site should be secure, and are meticulous with every website you visit. This is obviously a huge burden to place on users—it makes a lot more sense to automate the process via HSTS, and it’s about time website operators the world over picked up the slack and did so.