1. Chapter 12 & 13: Privacy, Security and Polite Society
TECH
Prof. Jeff Cheng

2. Chapter 12 Computer in Polite Society

3. Improving the Effectiveness of Email
Limitations of
Conveying emotion
Emphasis
Conversational pace
Ambiguity
Flame-a-thons

4. Conveying Emotion Difficult to convey subtle emotions using email
Medium is too informal, impersonal, and casually written
Conversational cues are missing
Emoticons are popular
Tags a sentence indicating the emotion we mean to communicate
:-)

5. Emphasis Typing for emphasis can convey the wrong meaning
Text in all caps can be interpreted as yelling
is still largely ASCII based and may not allow italics or underlining
Asterisks and underscores can represent bold and italics

6. Conversational Pace Asynchronous medium makes dialog difficult
For interactive purposes (like negotiation) synchronous medium like telephone may be best
IM better?

7. Ambiguity Text can be interpreted in ways we don't intend
People often don't proofread what they write in to avoid ambiguity

8. Flames Flame is slang for inflammatory email
Flame-a-thon is ongoing exchange of angry s
When angered by , it's best to delay answering until you cool down

9. Netiquette Rules to promote civilized email usage
Ask about one topic at a time
Include context (include the question with your answer)
Use an automated reply if unable to answer mail for a period of time
Answer a backlog of s in reverse order
Get the sender's permission before forwarding
Use targeted distribution lists (don't send the latest joke to every person you've ever exchanged mail with)

10. Creating Good Passwords
The Role of Passwords
To limit computer or system access to only those who know a sequence of keyboard characters
Breaking into a Computer without a Password
Trying all possible passwords algorithmically would eventually find correct password, but software usually limits the number of tries
Forgetting a Password
Passwords are scrambled or encrypted and stored, so system administrator usually can't tell you your password if you forget it

11. Guidelines for Selecting a Password
It's not a good idea to choose something easily guessed, but should be easy for you to remember
Should have at least 6-8 characters
Mix of uppercase and lowercase letters, numbers, punctuation characters
Sequence not found in dictionaries
No personal association (like your name)

12. Heuristics for picking a password
Select a personally interesting topic
Always select passwords related to topic
Develop a password from a phrase rather than a single word
Encode the password phrase
Make it short by abbreviating, replace letters and syllables with alternate characters or spellings

13. Changing Passwords Should be changed periodically Managing Passwords
Using a single password for everything is risky; using a different password for everything is hard to remember
Passwords can be recycled
Make slight changes to good passwords or
Rotate passwords

14. Viruses and Worms It's a Zoo Out There
Virus is a program that "infects" another program by embedding a copy of itself. When the infected program runs, the virus copies itself and infects other programs
Worm is an independent program that copies itself across network connections
Trojan is a program that hides inside another useful program, and performs secret operations
May record keystrokes or other sensitive data, or load malicious software
Exploit is a program that takes advantage of security hole
Backdoor access enters computer and reconfigures it for remote control
Computer is infected when it runs noticeably slow, or is running unauthorized programs

15. How to "Catch" a Virus
attachments. Do not open attachments before checking
Is this from someone I know?
Is the message a sensible follow-up to the last message from the sender?
Is the content of the message something the sender would say to me?
Is there a reason for the sender to include an attachment?
When in doubt, be cautious

16. How to "Catch" a Virus (cont'd)
Copying software from infected computer
Peer-to-Peer Exchange
Downloading files from unreliable sources
New Software
Any software is a potential source of infected code
Most software distributors are careful to avoid infection

17. Virus-Checking Software
Three companies are McAfee, Norton, and Sophos, Inc.
Programs check for known viruses, worms, etc.
New viruses are created all the time, so update often

18. Phishing Password harvesting fishing
Users are sent SPAM s asking for credit card or banking information
Message is disguised to appear to be from a bank or business
Often reports a security problem the user needs to address
When the user clicks legitimate looking link, they are linked to bogus sites set up to steal the information entered

19. What Can Be Done About Phishing?
Never respond to requests for personal information like passwords via ; legitimate businesses do not request information this way
Do not click on links or pre-typed addresses because they can be spoofed; type the URL yourself
Check to make sure the website is using encryption
Routinely review credit card and bank statements for unusual activity
Report suspected abuses to proper authorities

20. Protecting Intellectual Property
Intellectual property is any human creation like photograph, music, textbooks, cartoons, etc.
Licensing of software
You don't buy software; you lease it
License gives you the right to use personally, but not sell or give away
Try before you buy
Shareware allows you to download and try software for free, then pay the person who built it if you like it (honor system)

21. Open Source Software
Software for which the program is publicly available
Mozilla Firefox
Who pays for the technology and how do companies make money?
Selling specialized corporate versions, providing customer support, selling other related software
Open source software is worked on and improved by many others

22. Copyright on the Web
A person automatically owns copyright of what he creates in the U.S. and most nations
Copyright protects owner's right to
Make a copy of the work
Use a work as the basis for a new work (derivative work)
Distribute or publish the work, including electronically
Publicly perform the work
Publicly display the work

23. Copyright on the Web (cont'd)
Free Personal Use
You are free to read, view or listen to protected work
When is permission needed?
Information placed in public domain is free for anyone to use
Otherwise you must get permission from owner

24. Copyright on the Web (cont'd)
The Concept of Fair Use
Allows use of copyrighted material for educational or scholarly purposes, to allow limited quotation for review or criticism, to permit parody
When Is It Fair Use?
What is the planned use?
What is the nature of the work in which the material is to be used?
How much of the work will be used?
What effect would this use have on the market for the work, if the use were widespread?

25. Ensuring the Reliability of Software
Safety-Critical Applications (systems that support life or control hazardous devices or materials)
Hardware failures can be avoided or resolved using redundancy
Have three computers perform all computations of safety-critical system
Burn-in
Most errors show up after a few hours of operation

26. Fail-Soft and Fail-Safe Software
Fail-soft means the program continues to operate under stress, providing a possibly degraded level of functionality
Fail-safe means the system stops functioning to avoid causing harm
Perfectly safe software is just as impossible as perfectly correct software; there is always a risk

27. Chapter 13 Privacy and Digital Security

28. Privacy: Whose Information Is It?
What is privacy? Examine a transaction of buying Dating for Total Dummies
Information linking the purchase with the customer
How can the information be used?
Book merchant collecting information is ordinary business practice
Book merchant sending advertisements to customer is ordinary business practice
What about merchant selling information to other businesses?

29. Privacy: Whose Information Is It?
What is privacy? Examine a transaction of buying Dating for Total Dummies
Information linking the purchase with the customer
How can the information be used?
Book merchant collecting information is ordinary business practice
Book merchant sending advertisements to customer is ordinary business practice
What about merchant selling information to other businesses?

30. Modern Devices and Privacy
People leaves behind digital trails. Modern devices make it possible to violate people's privacy without their knowledge
In 1890, Brandeis wrote that individuals deserve "sufficient safeguards against improper circulation" of their images

31. Controlling the Use of Information
Spectrum of control spans four main possibilities:
No uses. Information should be deleted when the store is finished with it
Approval or Opt-in. Store can use it for other purposes with customer's approval
Objection or Opt-out. Store can use it for other purposes if customer does not object
No limits. Information can be used any way the store chooses
Fifth possibility is internal use—store can use information to continue conducting business with you

32. A Privacy Definition
Privacy: The right of people to choose freely under what circumstances and to what extent they will reveal themselves, their attitude, and their behavior to others
Threats to Privacy: Government and business
Voluntary Disclosure: We choose to reveal information in return for real benefits (doctor, credit card company)

33. Fair Information Practices
OECD (Organization of Economic Cooperation and Development) in 1980 developed the standard eight-point list of privacy principles.
Limited Collection Principle
Quality Principle
Purpose Principle
Use Limitation Principle
Security Principle
Openness Principle
Participation Principle
Accountability Principle

34. US Laws Protecting Privacy
Privacy Act of 1974 covers interaction with government
Interactions with business:
Electronic Communication Privacy Act of 1986
Video Privacy Protection Act of 1988
Telephone Consumer Protection Act of 1991
Driver's Privacy Protection Act of 1994
Health Insurance Privacy and Accountability Act of 1996
These all deal with specific business sectors—not an omnibus solution

35. Privacy Principles: European Union
Two points of disagreement between FTC (US) and OECD (Europe):
Opt-in/Opt-out
When can an organization use information it collects for one purpose, for a different purpose?
Opt-out is US standard except for highly sensitive data; Opt-in is European standard
Compliance/Enforcement
US has "voluntary compliance," EU has offices to control data

36. A Privacy Success Story
Do-Not-Call List
Telemarketing industry's "self-policing" mechanism required individuals to write a letter or pay an on-line fee to stop telemarketing calls
US government set up Do-Not-Call List. Over 107,000,000 households are on the list and telemarketing industry has largely collapsed

37. The Cookie Monster
Cookie: Record containing seven fields of information that uniquely identify a customer's session on a website. Cookie is stored on customer's hard drive.
Abuse: Third-party cookie
Third party advertisers on web site enter client/server relationship with customer as page loads
Advertiser can set cookies, and can access cookies when user views other websites that advertiser uses

38. The Cookie Monster (Cont'd)
Browser options:
Turn off cookies
Ask each time a server wants to set a cookie
Accept all cookies

39. Identity Theft Americans do not enjoy the Security Principle
Those who hold private information are obliged to maintain its privacy against unauthorized access and other hazards
Identity theft is the crime of posing as someone else for fraudulent purposes
Using information about person like credit card numbers, social security numbers

40. Managing Your Privacy
Purchase up-to-date anti-virus/anti-spyware software
Adjust your cookie preferences to match your comfort level
Read the privacy statement of any website you give information to
Review protections against phishing scams

41. Managing Your Privacy (cont'd)
Patronize reputable companies for music, software, etc.
Be skeptical
Stay familiar with current assaults on privacy
Lobby for US adoption of Fair Information Practices

42. Encryption And Decryption
Encryption Terminology
Encryption: Transform representation so it is no longer understandable
Cryptosystem: A combination of encryption and decryption methods
Cleartext or Plaintext: Information before encryption
Cipher text: Information in encrypted form
One-way cipher: Encryption system that cannot be easily reversed (used for passwords)
Decryption: Reversing encryption process

44. XOR: An Encryption Operation
Exclusive OR: Interesting way to apply a key to cleartext
Combines two bits by rule: If the bits are the same, the result is 0; if the bits are different, the result is 1
XOR is its own inverse (to decrypt back to original text)

45. Example of Using XOR for Encryption and Decryption
Original bit pattern: Key: 1001 Encryption: 0101 XOR Decryption:

46. Public Key Cryptosystems
People who want to receive information securely publish a key that senders should use to encrypt messages
Key is chosen so only receiver can decode

47. Example of Public Key Cryptosystem: RSA
Named after its inventors
Relies on large prime numbers to create public keys with special mathematical properties for encryption and decryption

48. Data Backup: Redundancy Is Very, Very, Very Good
Precautions against data disasters include backups and system redundancy (having a hot spare up and running)

49. A Fault Recovery Program for Business
Keep a full copy of everything written on the system as of some date and time—full backup
Create partial backups—copies of changes since last full backup
After disaster, start by installing the last full backup copy
Re-create state of system by making changes stored in partial backups, in order
All data since last backup (full or partial) will be lost

50. Backing Up a Personal Computer
How and What to Back Up
You can buy automatic backup software that writes to zip drive or writeable CD
For manual backups, you do not have to backup data that
Can be re-created from some permanent source, like software
Was saved before but has not changed
You don’t care about

51. Recovering Deleted Information
Backups also protect from accidental deletions
Can save evidence of crime or other inappropriate behavior
Remember that two copies of are produced when sender hits send—one in sent mail file and one somewhere else, which the sender probably can't delete