Abstractions Privacy and Security l l l Why

Abstractions: Privacy and Security l l l Why does phishing work? Ø What is whaling? Birthday+zip=knowledge Ø Who are you? What should Congress know? Ø Annie Anton Ø Latanya Sweeney Ø Lorrie Cranor Compsci 82, Fall 2009 11. 1

Cookies: Big picture overview l Cookies help http Ø http is stateless server client get fb. com 1. 3. 2. 4 content back Cart? ? Buy this, buy that! Compsci 82, Fall 2009 11. 2

Cookie overview continued l l http: //en. wikipedia. org/wiki/HTTP_cookie Ø Reasonable overview Cookie is a small textfile, not code/executable Ø Expires at end of session or in the future Ø Stored on your computer Ø Comes from a server you “visit” • Third party cookes l How can a cookie track you? It can’t (well, ok) Ø Helps client-server back and forth and. . . Compsci 82, Fall 2009 11. 3

www. si. com l 40 cookies Ø Ø Ø l cnn. com si. com tacoda. net doubleclick. net revsci. net Dependencies: Ø Content comes from many places Ø Scripts, content, images, ads Compsci 82, Fall 2009 11. 4

Cookies from websites nbc. com l 43 cookies Ø Ø Ø Ø google. com doubleclick. net quantserve. com bluekai. com tacoda. net atwola. com advertising. com crwdcntrl. com Compsci 82, Fall 2009 People. com l 36 cookies Ø Ø Ø Ø doubleclick. net atwola. com tacoda. net google. com quantserve. com revsci. net advertising. com 2 o 7. net 11. 5

College Newspaper Cookies School Paper # cookies Cookie Sites Duke Chronicle Daily Tarheel 8 Duke, Google 15 Tarheel, doubleclick, youtube, Stanford Daily 9 Stanford, Google, Sharethis facebook, Google Harvard Crimson 20 Harvard, tribalfusion, Google, Daily Dartmouth Yale Daily News 8 Dartmouth, paperg, Google 13 Yale, Google, doubleclick, MIT Compsci 82, Fall 2009 adtmt, burstnet, quantserve, doubleclick, quantserve, youtube 7 MIT, Google 11. 6

Anony [ mity | mous ] Packin' the K (Eugene Kaspersky) Compsci 82, Fall 2009 11. 7

What can you say, where can you say? l Rush Limbaugh and the NFL Ø Source, story, repercussions l Steinbuch v Cutler Ø Blog, private becomes public, politics l Ciolli v Iravani Ø Auto. Admit: Juicy. Campus for law school? Compsci 82, Fall 2009 11. 8

Anonymous and wannabe-anonymous l Limbaugh forced out of NFL-owner/bid Ø Why? Who? What? When? Wikiquote • “The quotes were added by a user with the IP address of 69. 64. 213. 146” steyonline. com • Rick Sanchez CNN tweets: “i've know rush. in person, i like him. his rhetoric, however is inexcusably divisive. he's right tho. we didn't confirm quote. our bad. ” Ø Can l an IP address be spoofed? Mainstream news hasn’t picked this up, all over the blogosophere Compsci 82, Fall 2009 11. 9

Steinbuch v Cutler (and Hachette) l Washingtonienne blog by Jessica Cutler Ø Risqué too mild: what she did with “RS” Ø Robert Steinbuch sues, $20 million Ø Wonkette blog links, sued too l Communications Decency Act Ø Some struck down: First Amendment Ø Section 230 protects thirdparty/websites Compsci 82, Fall 2009 11. 10

John Doe v “man walks into bar” l Auto. Admit and Anthony Ciolli Ø Anonymous and in 2007 gossipy Ø Two female Yale Law students targeted • Subsequently one doesn’t get job offers, why? Google! Ø Anonymous, l l defamation online High profile, likely pro bono defenders Ø Ciolli countersues, section 230 Slimed Online article summarizing issues Ø If Heller and Iravani identify… trouble? Compsci 82, Fall 2009 11. 11

Juicy? They're Back and They're Bad Compsci 82, Fall 2009 11. 12

Anonymity on the Internet What's different about Juicy Campus is that vicious, anonymous attacks are the site's raison d’être, not unfortunate by-products. The 20 -year old at the heart of web’s most anarchic and influential site Compsci 82, Fall 2009 11. 13

The Onion Router (TOR) l Online Anonymity Ø Trusted network ensures anonymity Ø How can we know it’s trusted? l For Alice to talk to Bob, need three relays Ø Alice talks to R 1 ->R 2 ->R 3 ->talks to Bob Ø Secure protocols/handshaking help Ø Open source BSD license, “free” Compsci 82, Fall 2009 11. 14

Who Uses Tor? (torproject. org), l 300, 000 daily users Ø Why does each group use TOR? Ø China? Iran? l Can you Tor? Ø Usability Compsci 82, Fall 2009 11. 15

How is Tor like bittorrent like p 2 p? l l What does peer-to-peer mean? Ø Who are the peers, how organized? Ø Centralized, distributed, … Ø Why do we want p 2 p connections? Commons Compsci 82, Fall 2009 11. 16