We Say We Want Privacy But…
By: Rob Weiter
Tags: Privacy, Tips, Pc Security, Internet, Smartphones

Each day my email box fills up with reports of cyberattacks, privacy violations, stolen consumer and business information. It’s an everyday common thing now. Privacy advocates, cybersecurity researchers, consumer protection advocates, and counterintelligence consultants routinely issue press releases, write articles and attend industry meetings and professional conferences discussing the increasing problem of privacy, identity theft and cybersecurity. Local, state and nationally elected officials hold hearings — and more hearings. (Their questions often indicate that many of these elected men and women are often clueless or at least poorly informed about how the Internet, our computers, smartphones, cloud computing, servers and so on, work, interact.)

Everyone says, “something must be done”. Hosting and data providers increasingly require strong passwords — those that include long strings of letters, special symbols and both upper and lowercase letters. Internet Security Software companies continue working on new products for consumers, small businesses, corporations to surf more safely online, to hopefully prevent infection and compromise of our electronic devices. The battle between the good guys and the black hat hacker community and other sponsoring criminal or foreign government organizations continues and escalates.

It would be easy to say that the elderly and those who do not have a good grasp of our current interconnected technology are the biggest risk of being ripped off. That may be true for phone scams that use fake caller ID but the astounding thing is that most of us who love the convenience of this interconnected technology put our personal and financial information at risk just because of the comfort which many of us feel with the technology and being accustomed to free or very inexpensive apps. And many of us grew up and are living fully in the “digital world” but few of us, unless computer geeks, really understand our devices, how the hardware and software / apps work, what they do that we don’t see and can’t control.

I was thinking about this the other day as I was looking for an app to record telephone calls on my Android smartphone to help with phone interviews and business calls once connected through my switchboard — just like I was sitting at my desk where the company line records calls. It’s not that I want a FREE product or even an inexpensive product. I want an app that 1.) works with my smartphone regardless of whether I use wired headset, Bluetooth or the speakerphone, 2.) was secure, not sending any data back the app developers, first party or third-party trackers. 3.) was developed and marketed by an actual software company with real, traceable contact information, a real business address and support. In short, I wanted, even in the Android environment a functional app with the transparency and services that I was used to getting from companies from the earliest days of PC computing. When we use mobile security programs that come with our PC security packages, or Adobe® Creative Cloud products or Microsoft®, which are all paid products get that kind of support — but for most stand-alone applications, which are either ad supported or sold as “premium versions” for a small fee or ongoing subscriptions. Individual apps often don’t provide contact information other than some generic Gmail address and the privacy policy links, if such exist, go to empty pages or to the generic Google® privacy policy.

Google® type reviews by random users with various needs, ages and technical sophistication as provided by the don’t impress me because they aren’t helpful in understanding really what’s going on “under the hood” on these apps. For that, one needs to know have technical sophistication and often more apps (on the phone) or code editors on a computer on to which one stores the app -and, of course, to know exactly what an app is doing, one also needs Android programming knowledge.

Permissions, which are supposed to be the “gatekeepers” of an Android user’s privacy, are ignored and accessed even when those permissions are denied by the user, according to an article published by C-NET on July 8, 2019.

All of these are harmful to our privacy and often our security but operate in different ways — not only without consent but also when a user specifically denies consent.

Some of these apps harvest information from unprotected files stored on our smartphones, including documents, analyze our WIFI connections and on and on to harvest more and more data about us. We are not only the consumer. We are the product as well and too many of us have traded our privacy, our personal information, including personal details about the most intimate details which then is harvested to provide a more complete profile, which can further refine marketing efforts, propaganda, misinformation (or perhaps some real information) all targeted to each of us. Some are by unknown developers, but others are distributed by or using registered trademarks from major companies — including motion picture studios. Still others, according to the article, are developed by and distributed by at least one major smartphone manufacturer — Samsung.

Our reliance on our smartphones and the massive information brokers, Google®, Facebook®, Twitter®, Snapchat® and Instagram®, for example, to provide integrated products and services that make our lives easier and often with little or no money out of our pocket, market us to make money. We know this or most of us do and we make that bargain.

I remember what my Dad always taught me, “You get what you pay for” and that’s so true especially in this case. Apps, which hopefully everybody knows, are just special kinds of software whether on a smartphone, a PC, Apple PC, iPhone or any other computer. They usually take lots of time and money to develop. There are some notable exceptions of open source programs and apps written freely by groups of hobbyists over years, but these still take time and often some money to develop. It’s just volunteered time and donated money. We either pay for the software/app directly at an actual price that reflects actual development costs, marketing and reasonable markup or we pay indirectly not only through the displayed ads but also by becoming a product ourselves as our data is harvested and our psychometric, consumer profile is expanded — and sold.

While we all read about the bad guy scammers, much of what these companies harvest is completely legal. We generally give permission without even knowing it when accessing websites, using apps on our phones and computers and intentionally installing software on our PCs, laptops and tablets. It’s buried in those lengthy “TOS” (Terms of Service) and Privacy Policies to which we agree by accessing websites, installing apps and software, making use of products and services. Most of us don’t read those because, of course, they’re usually pages long and very boring legalese. We just want to use the website, software, app or service and it’s really easy to click “accept” and go on our merry way doing what we’re wanting even though we may have just agreed to strip away more of our privacy and it some cases, control over our own words, posts and so on.

Most people are also too trusting. How much do we really know about the online company with whom we’re dealing — especially on Google® Play Store? (I can’t speak for iPhone since I don’t own one, but my assistant tells me the process is similar.) Even online, unless the company is well known or we take the time to research them, we can’t be sure of how carefully or honestly a company follows its published privacy policy and terms of service.

Searching for reviews of providers, services and products can be daunting because there are so many “review” sites that show up on a search engine and many of these are simply affiliate sites with revenue producing links to the product or service for which we search.

Even with all the warnings that the news media tells us about being careful what links on which we click in email, individuals and companies are too often compromised because someone clicks on a link in an email that looks legit and exposes login and other sensitive information.

Cybersecurity experts tell us to use a different password for each website, online streaming service, cloud provider, product or service that we access. Consumer Reports® recently published an article that stresses how important this is in ways that most people might not even think of. They point out these passwords must be “strong” to be secure. Most expects consider a “strong password” to be at least 6 characters, upper case, lower case and special symbols such as “@” , “$” and “&”. The longer the password, the more complicated, the more difficult it is for hackers and hacking software to break into a system.

So that people don’t have to remember so many passwords various computer security software companies have released password managers which save and secure passwords we use for browsing and some can also secure local folders to make it more difficult or impossible to breach these in ransomware attacks.

As the editors point out, we need to secure many of our interconnected “smart devices”. These include “smart-home devices such as routers, webcams, TVs, toys, and even some high-end refrigerators. Many come with default passwords that should be changed the moment you take the product out of the box. There’s no easier password to hack than one you can find in a manual or online.”

As Maria Varmazis wrote in a cybersecurity blog, “Even worse in some cases, the default password can’t be changed. Unfortunately, that gives the illusion of security to unwitting device owners — because it has a password — but leaving a default password in place isn’t much of an improvement over having no password at all.”

What few people realize is that these smart devices operate as basic servers, like those that send email and serve websites, and are basically simple, focused computers. By hacking these smart devices, criminals can penetrate home and office networks and often send out spam email or include these devices as pat of a bot network. This has been an ongoing problem for years. NBC reported on compromised smart refrigerators in 2014. Earlier this year, the Detroit News published a chilling article about digital home invasions using the Nest® camera security system, watching a family and cursing at them through smart device speakers and messing with the settings on their thermostat. This problem affected Nest users across the country and The Washington Post wrote an extensive article in April about how and why this is able to happen so easily.

Basically, to make home devices easier for consumers to use — convenience — the tech companies make compromises in security. Rather than including more cumbersome countermeasures to login and make the system more secure, the companies are concerned about “friction”, which is the amount of time it takes a consumer to access and use a smart device, software or service.

It’s all about speed and ease of use. As tech company executive, Aaron Levie, CEO of Box, wrote, “If you’re making the customer do any extra amount of work, no matter what industry you call home, you’re now a target for disruption. … And as more and more of the hard work of building infrastructure, managing computing, and installing and monetizing applications is abstracted from what necessarily goes into launching a company today, differentiation is going to come from solutions that create the best (read: simplest) experience.” (“The Simplicity Thesis” Fast Company, May 5, 2012)

Put simply, if a tech product is not easy to use for consumers, even with low technical knowledge, it may not sell well because easy of use and speed are what’s important to consumers.

Perhaps we should be asking ourselves, do we really need all these internet connected devices? A traditional hardwired monitored alarm service works well for many businesses and homeowners and has no chance of getting hacked over the Internet because it does not use the Internet and cameras can be hardwired with secure onsite storage again reducing chances of tampering. We don’t need to set our thermostat or check our fridge over our smartphones. We may like the convenience — but that’s a want not a need. Are we really that lazy that we can’t just walk to where the physical thermostat is in our home or office to set it?

Do we really to see on our smart phone or tablet what the inside of our refrigerators so we know what we need to buy, what’s spoiling?

Do we really need to post every daily update to Facebook® or another social media site? Sure, it’s convenient to do so and to read about our friends and families recent adventures?

In the “old days” such information was shared online through private email discussion groups and closed discussion boards and was not harvested for consumer data. The ability to set up private email lists still exists on servers and can be set up simply if people take the time to learn how to do so — and are certainly more secure than posting on the public social media sites.

We’re continuing to feed the big data machine that targets and analyses us to further target those ads promoting products that they wish to sell to us, or to manipulate us to make choices affecting our political future for example. The interference in our last elections should serve as a warning.

The easier a smart device, smartphone, laptop, table or computer is to access, the easier it is for bad guys to access it and to steal or otherwise manipulate what they find.

We can protect ourselves if we stop wanting access to be so simple and by becoming more careful online. This takes a certain amount of work, just like learning any new skills. It also requires that we resist the urge to buy every new connected gadget that companies design to make our lives “easier” and more dependent on their technology.

We can and should expect tech companies and other consumer products and services to improve their security, to honor their terms of service and privacy policies, but we too need to make changes in our consumer behavior. If we really want privacy, we need to be informed, careful consumers of online services. We need to update and patch our computers, tablets and smart devices regularly. We need to use appropriate computer security products by known, recognized computer security companies, such as McAfee®, Trend Micro® , Sophos® or Eset® and we need to be willing to pay for our security software. That is not something one should skimp on. No security program is perfect. Some detect certain types of virus, bots and other malware better than others, but the companies mentioned here all have good reputations and robust products if one doesn’t just rely on their free tools. These are good for checking a system prior to install of the paid products but do not provide ongoing live scanning and continuous security that users really need.

We should install the mobile security software on our smartphones that comes from our paid security software provider. As WIRED Magazine recently put it, “MOST ANDROID ANTIVIRUS APPS ARE GARBAGE”. That is, most of the free or really cheap, often ad supported, sometimes paid, stand alone antivirus apps on the Google® Play store, according to extensive testing and research conducted by European security testing company, AV Comparatives. The complete report, with methodology, results and recommendations is here.

We should update our operating systems regularly and all the software / apps we use whether on PC, a Mac, our tablets, our Android devices and our iPhones. This is so incredibly important, yet both businesses and individuals often overlook this with disastrous results, including recent ransomware attacks that have severely damaged individuals, communities, healthcare facilities and businesses, costing an estimated $11.5 billion this year, plus the permanent loss of irreplaceable data.

Most operating systems come with “end of life” cycle, which means no support or patches once that date has ended. Perhaps people don’t want to invest in the updated operating system because these aren’t free in most cases, but it’s vital that we do so.

When surfing the web, we should use the latest edition of our browsers and, if possible, install active anti-tracking add-ons or extensions to further protect our privacy online. Two popular ones that I personally recommend are Ghostery® and AdBlock Plus®. Both install on all popular browsers.

These are usually free, although some of the organizations that put these out also offer enhanced services for a subscription fee.

If we become smart users of our computers and devices, rather than simply learning how to turn them on and use specific apps, we are safer. As the saying goes, “Knowledge is power.”

That doesn’t mean everybody needs to become programmers or cybersecurity experts, but it does mean taking appropriate precautions, updating paid security software, taking extreme care when opening emails and downloading a new app to our phone or computer and not using 3rd party app stores. We should be willing to take the extra steps to be secure and protect ourselves if we claim we want privacy and security. We need to be willing to budget for and pay for the services, apps and software we use — and to expect, for our money, a secure environment where we are not tracked for social profiling or marketing purposes.

We need to change our expectations of immediate gratification and especially cheap or free resources, as many are on Google’s Play store. That game or useful app that so many downloaded and love may have a bigger price than the micro-transactions that are often encouraged or required to use the full features, play the full game or to progress. It may be harvesting our private data. If we do important things, like work communications on our smartphones, it’s a better practice not to install those various popular game apps on our smartphones. And, we need to make certain that “automatic WIFI” connection is not automatically enabled to turn on when our smartphone detects a strong public WIFI signal. These non-secured networks at businesses, hospitals, hotels, etc. are not secure and are easily breached so that hackers can detect what one is doing, including sensitive information, if we must use a public network, we should use a paid VPN provider which specially encrypts our online network and sends it through a special secured network. We need to always visit the secured version of sites whenever possible — shown by the lock symbol on most browsers. We should also consider whether to link and sync browsers between systems because that provides the browser developers and sometimes third-parties use this data to further track us.

When possible we’re more secure to use the email from our ISP, cable provider or company operated on their own servers, but this is part of our paid service and, if we want to access from our smartphones, somewhat cumbersome for those with little technical knowledge to configure.

Google’s insistence that the smartphone’s operation be tied to Gmail accounts encourages the use of Gmail as our primary email program because of its integration into the Android operating system and extreme convenience and ease of use. It also allows Google to scan the content of your emails and to allow third-party app developers to access and scan the content of your Gmail when you sign up for third-party services like itinerary planning apps, Until mid-2017, Google® scanned the content of all email for customized ad delivery and, although that policy has officially changed, Google® recently admitted to the U.S. Congress that it still lets third-party app developers scan and read the content of our emails. It’s part of their business model as a for-profit company. The legal language that allows it to do that is published in Google’s Terms of Service and Privacy Policy buried in the legal language. It’s the way, in part, that we pay for all the “free” products and services that Google® provides to us. Every time we use any of the major search engines, our searches are analyzed and added to our profile, using tracking technologies.

Instead of using one of the major search engines that track and profile us, we should consider using one or more of the private search engines which do not track and profile us (such as https://duckduckgo.com, privacy policy here; https://www.qwant.com, privacy policy here, main company English language site here, https://www.startpage.com/en/?, privacy policy here).

The European Union has become a leader in citizens’ privacy protection with its strict data and personal privacy protection laws, including ones like the “Right to be Forgotten” — policies and regulations which the United States has not implemented or even proposed anything close. These laws protect both Europeans, Americans and others living in Europe, but do not protect Europeans and others living in the United States. Those of us in the United States, if we care really care about our privacy, should insist that our elected officials implement something similar to the EU’s regulations, but, in the meantime, take actions to protect our own privacy. Unless we change ourselves and really demand change from the industry, we really will never get the privacy online most of us say we want. We can do this if we have the will.

Note: The author does not receive any payments for any links in this article and is not affiliated with any of the companies or services which are mentioned in the article.