Tag: Privacy

Tracking

2017-07-11, 8:22 am
Categories: Politics, Stream of Consciousness, Tech

I wrote a post about VPNs a few months back, referring to the recent repeal of Obama-era regulations that would have prevented ISPs from selling customer browsing history.

There's a common refrain I've seen from people who favor the repeal, both in the government and in Internet comments sections: "Google and Facebook track you and sell your data, and the government doesn't stop them from doing it, so it's not fair to stop your ISP from doing it!"

Now, this argument is fundamentally dishonest, for the following reasons, off the top of my head:

  • Your ISP sits between you and every single site you visit. Google and Facebook have extensive tracking operations, but not that extensive.

  • You can use the Internet without using Facebook or Google. It may not be easy, but it's possible. You can't use the Internet without your ISP.

  • Google and Facebook's business model is that they provide a service and, in exchange, you allow them to gather your personal data and resell it to third parties. Your ISP's business model is that it provides service and, in exchange, you pay them eighty fucking dollars a month. Did I say eighty? They just kicked it up to one-thirty, if you want unlimited data.

    When you give your personal data to Facebook or Google to sell to third parties, you get their service in return. When you give your personal data to your ISP to sell to third parties, you get fucking nothing in return, because you're already paying your ISP money in exchange for Internet service. Is your ISP going to lower your bill in exchange for taking your personal information to sell to third parties? LOLno.

  • Google and Facebook have competitors. Those competitors don't have the dominant market position that Google and Facebook do; hell, maybe they're just plain not as good. But they exist. They're options.

    There is no significant broadband competition in the US. If I don't like my ISP, I can't just switch to another one, because there is no other one available at my address. My choices consist of Cox, no Internet, and moving.

    There's no incentive for your ISP to behave ethically. There's no incentive for your ISP to charge you fairly. There's no incentive for your ISP to provide quality service. My ISP is a monopoly. Yours probably is too. Or, at best, it might have one competitor that does all the same shit.

  • Google and Facebook have pages where you can opt out of tracking.

But. Despite the intellectual dishonesty of the "but Google and Facebook track you!" argument, there is a kernel of truth in there: yes, Google and Facebook track you, yes it's difficult to avoid that tracking, and no, there are no regulations in place to protect your data. This is a problem.

So, shortly after writing that post, I removed the Google Analytics code from this site. And now I've also updated the site so that the fonts it uses are hosted here at corporate-sellout.com, not called from Google Fonts (hat tip to the Disable Google Fonts WordPress plugin). I'm still using a Google Captcha on the Contact page for now, but I'm looking at alternatives. Plus, there are YouTube videos embedded on this site...and, well, there's nothing I can really do about preventing Google from tracking you when you load YouTube videos. Sorry about that.

I'm also planning on adding SSL to the site, eventually, but I haven't gotten around to it yet.

This blog's not a business. Occasionally somebody buys something through an Amazon Associates link, or buys my book (thanks!), but I've got a day job; I'm not here to make money. I write stuff here because I like to write stuff. Sometimes people like it, and that's cool, and it's cool to know that people are reading. But that's as far as my interest in analytics goes.

I don't resell data; I don't do SEO or A/B headlines or clickbait or any other kind of crap to try and drive people here -- hell, I hate all that shit. But I like looking at site stats once in awhile to see where people are coming from, where somebody's mentioned me, and to laugh at search terms like "did stan lee bone at jack kirby's wife".

So I'm looking for a new stats package. Server-side; just for me, not Google.

Meanwhile, I am looking for ways to use Google as little as possible, not just on this site but in general. I think I can probably get a few more posts out of that subject.

Resources for pfSense, Private Internet Access, Netflix, and Hulu

2017-04-02, 3:32 pm
Categories: Politics, Tech

You've probably heard by now that the US Congress just repealed Obama-era regulations preventing Internet service providers from selling their users' browsing data to advertisers. I'll probably talk more about that in future posts. For now, I'm going to focus on a specific set of steps I've taken to prevent my ISP (Cox) from seeing what sites I visit.

I use a VPN called Private Internet Access, and a hardware firewall running pfSense. If that sentence looked like gibberish to you, then the rest of this post is probably not going to help you. I plan on writing a post in the future that explains some more basic steps that people who aren't IT professionals can take to protect their privacy, but this is not that kind of post.

So, for those of you who are IT professionals (or at least comfortable building your own router), it probably won't surprise you that streaming sites like Netflix and Hulu block VPNs.

One solution to this is to use a VPN that gives you a dedicated IP (I hear good things about NordVPN but I haven't used it myself); Netflix and Hulu are less likely to see that you're using a VPN if they don't see a bunch of connections coming from the same IP address. But there are problems with this approach:

  • It costs more.
  • You're giving up a good big chunk of the anonymity that you're (presumably) using a VPN for in the first place; your ISP won't be able to monitor what sites you're visiting, but websites are going to have an easier time tracking you if nobody else outside your household is using your IP.
  • There's still no guarantee that Netflix and Hulu won't figure out that you're on a VPN and block your IP, because VPNs assign IP addresses in blocks.

So I opted, instead, to set up some firewall rules to allow Netflix and Hulu to bypass the VPN.

The downside to this approach is obvious: Cox can see me connecting to Netflix and Hulu, and also Amazon (because Netflix uses AWS). However, this information is probably of limited value to Cox; yes, they know that I use three extremely popular websites, when I connect to them, and how much data I upload and download, but that's it; Netflix, Hulu, and Amazon all force HTTPS, so while Cox can see the IPs, it can't see the specific pages I'm going to, what videos I'm watching, etc. In my estimation, letting Cox see that I'm connecting to those sites is an acceptable tradeoff for not letting Cox see any other sites I'm connecting to.

There are a number of guides on how to get this set up, but here are the three that helped me the most:

OpenVPN Step-by-Step Setup for pfsense -- This is the first step; it'll help you route all your traffic through Private Internet Access. (Other VPNs -- at least, ones that use OpenVPN -- are probably pretty similar.)

Hulu Traffic -- Setting up Hulu to bypass the VPN is an easy and straightforward process; you just need to add an alias for a set of FQDNs and then create a rule routing connections to that alias to WAN instead of OpenVPN.

Netflix to WAN not OPT1 -- Netflix is trickier than Hulu, partly because (as mentioned above) it uses AWS and partly because the list of IPs associated with AWS and Netflix is large and subject to change. So in this case, instead of just a list of FQDNs, you'll want to set up a couple of rules in pfBlockerNG to automatically download, and periodically update, lists of those IPs.

That's it. Keep in mind that VPN isn't a silver bullet solution, and there are still other steps you'll want to take to protect your privacy. I'll plan on covering some of them in future posts.

E-Mails and Passwords

2015-10-01, 8:49 am
Categories: E-Mail, Stream of Consciousness, Tech

So the other day I decided it was past time to reset all my passwords.

I'm pretty good about password hygiene. I've been using a password locker for years, with a unique, randomly-generated* password for every account I use. But I'll admit that, like most of us, I don't do as good a job of password rotation as I might. That's probably because I've managed to amass over 150 different accounts across different sites, and resetting 150 different passwords is a giant pain in the ass.

(I'm thinking that, from here on in, I should pick a subset of passwords to reset every month, so I never wind up having to reset all 150 at once again. It would also help me to clear out the cruft and not keep logins for sites that no longer exist, or which I'm never going to use again, or where I can't even find the damn login page anymore.)

There was one more reason I decided now was a good time to do a mass update: I've got two E-Mail addresses that have turned into spam holes. As I've mentioned previously, I'm currently looking for work and getting inundated with job spam; unfortunately I went and put my primary E-Mail address at the top of my resume, which in hindsight was a mistake. Never post your personal E-Mail in any public place; always use a throwaway.

Which I do, most of the time -- and that's created a second problem: I've been signing up for websites with the same E-Mail address for 15 years, and also used to use it in my whois information. (I've since switched to dedicated E-Mail addresses that I use only for domain registration.) So now, that E-Mail has turned into a huge spam hole; it's currently got over 500 messages in its Junk folder, and that's with a filter that deletes anything that's been in there longer than a week. My spam filters are well-trained, but unfortunately they only run on the client side, not the server side, so any time Thunderbird isn't running on my desktop, my spam doesn't get filtered. (If I'm out of the house, I can tell if the network's gone down, because I start getting a bunch of spam in my inbox on my phone.)

So now I've gone and created two new E-Mail addresses: one that's just for E-Mails about jobs, and another as my new all-purpose signing-up-for-things address.

My hope is that the companies hammering my primary E-Mail address with job notifications will eventually switch to the new, jobs-only E-Mail address, and I'll get my personal E-Mail address back to normal. And that I can quit using the Spam Hole address entirely and switch all my accounts over to the new address. Which hopefully shouldn't get as spam-filled as the old one since I haven't published it in a publicly-accessible place like whois.

Anyway, some things to take into account with E-Mail and passwords:

  • Don't use your personal E-Mail address for anything but personal communication. Don't give it to anyone you don't know.
  • Keep at least one secondary E-Mail address that you can abandon if it gets compromised or filled up with spam. It's not necessarily a bad idea to have several -- in my case, I've got one for accounts at various sites, several that I use as contacts for web domains, and one that's just for communication about jobs.
  • Use a password locker. 1Password, Keepass, and Lastpass are all pretty highly-regarded, but they're just three of the many available options.
  • Remember all the different devices you'll be using these passwords on.
    • I'm using a Linux desktop, an OSX desktop, a Windows desktop, and an Android phone; that means I need to pick a password locker that will run on all those different OS's.
    • And have some way of keeping the data synced across them.
    • And don't forget that, even with a password locker, chances are that at some point you'll end up having to type some of these passwords manually, on a screen keyboard. Adding brackets and carets and other symbols to your password will make it more secure, but you're going to want to weigh that against the hassle of having to dive three levels deep into your screen keyboard just to type those symbols. It may be worth it if it's the password for, say, your bank account, but it's definitely not worth it for your Gmail login.
  • Of course, you need a master password to access all those other passwords, and you should choose a good one. There's no point in picking a bunch of unique, strong passwords if you protect them with a shitty unsecure password. There are ways to come up with a password that's secure but easy to remember:
    • The "correct horse battery staple" method of creating a passphrase of four random words is a good one, but there are caveats:
      • You have to make sure they're actually random words, words that don't have anything to do with each other. Edward Snowden's example, "MargaretThatcheris110%SEXY.", is not actually very secure; it follows correct English sentence structure, "MargaretThatcher" and "110%" are each effectively one word since they're commonly-used phrases, the word "SEXY" is common as fuck in passwords, and mixed case and punctuation don't really make your password significantly more secure if, for example, you capitalize the beginnings of words or entire words and end sentences with periods, question marks, or exclamation points. Basically, if you pick the words in your passphrase yourself, they're not random enough; use a computer to pick the words for you.
      • And this method unfortunately doesn't work very well on a screen keyboard. Unless you know of a screen keyboard that autocompletes words inside a password prompt but won't remember those words or their sequence. I think this would be a very good idea for screen keyboards to implement, but I don't know of any that do it.
    • There are programs and sites that generate pronounceable passwords -- something like "ahx2Boh8" or "ireeQuaico". Sequences of letters (and possibly numbers) that are gibberish but can be pronounced, which makes them easy to remember -- a little less secure than a password that doesn't follow such a rule, but a lot more secure than a dictionary word. But read reviews before you use one of these services -- you want to make sure that the passwords it generates are sufficiently random to be secure, and that it's reputable and can be trusted not to snoop on you and send that master password off to some third party. It's best to pick one that generates multiple passwords at once; if you pick one from a list it's harder for a third party to know which one you chose.
  • Of course, any password is memorable if you type it enough times.
  • And no password is going to protect you from a targeted attack by a sufficiently dedicated and resourceful attacker -- if somebody's after something you've got, he can probably find somebody in tech support for your ISP, or your registrar, or your hosting provider, or your phone company, or some company you've bought something from, somewhere, who can be tricked into giving him access to your account. Or maybe he'll exploit a zero-day vulnerability. Or maybe one of the sites you've got an account with will be compromised and they'll get everybody's account information. Password security isn't about protecting yourself against a targeted attack. It's about making yourself a bigger hassle to go after than the guy sitting next to you, like the old joke about "I don't have to outrun the tiger, I just have to outrun you." And it's about minimizing the amount of damage somebody can do if he does compromise one of your accounts.
  • And speaking of social engineering, security questions are deliberate vulnerabilities, and they are bullshit. Never answer a security question truthfully. If security questions are optional, do not fill them out. If they are not optional and a site forces you to add a security question, your best bet is to generate a pseudorandom answer (remember you may have to read it over the phone, so a pronounceable password or "correct horse battery staple"-style phrase would be a good idea here, though you could always just use letters and numbers too -- knowing the phonetic alphabet helps) and store it in your password locker alongside your username and password.
  • You know what else is stupid? Password strength indicators. I once used one (it was Plesk's) that rejected K"Nb\:uO`) as weak but accepted P@55w0rd as strong. You can generally ignore password strength indicators, unless they reject your password outright and make you come up with a new one.

* For the purposes of this discussion, I will be using the words "random" and "pseudorandom" interchangeably, because the difference between the two things is beyond the scope of this post.

Props to Perry

2013-06-18, 8:44 pm
Categories: Politics, Stream of Consciousness, Tech

There's a lot I don't like about Rick Perry -- about his state, its legislature, his party.

But as I noted a few weeks back, that legislature just passed a landmark E-Mail privacy bill.

And last week, Perry signed it.

Obviously, in the intervening weeks there have been some stark reminders about why government snooping on E-Mail should be reined in. And I'm sure that informed Perry's decision.

But the bottom line is, he did the right thing. At this moment in time, the governor of Texas has a better record on E-Mail privacy than the President of the United States.

There are moments -- they're rare, but there are moments, like this one -- where I see the Republican Party live up to its promise. Where it demonstrates that it can defend individual liberties from runaway government. That I think, y'know, maybe they've got something here. Maybe they can be a force for good.

And then I see a photo like this one
Pat Robertson and Donald Trump
and I'm like, "Oh, right. Republicans."

But what the hell -- Jonathan Strickland, the guy who sponsored this bill and, I assume, the son of Hank Hill's boss, is 29 years old. He'll be around long after those two assholes are dead. If guys like him and Derek Khanna represent the future of the Republican Party, then it's a future where I could maybe someday see myself aligning more with the Republicans than the Democrats.

They're really gonna have to do something about that whole anti-gay, anti-woman, anti-minority, anti-poor people, anti-science thing first, though.

(And I really should be careful about that "Republicans I'd consider voting for" label. I voted for McCain in 2004 and look how that turned out.)

(I also voted for Jan Brewer in 2006. Though in my defense, I was misled into believing I was voting for Janet Napolitano.)

(Come to think of it, the "Democrats I'd consider voting for" list hasn't gone so well for me either.)

Photo courtesy of Talking Points Memo, as linked by Mark Evanier.

James Clapper and Other Disgraces

2013-06-11, 9:44 pm
Categories: Comics, Politics, Stream of Consciousness

So I mentioned last night that asking the question, "Is Snowden a hero or a traitor?" completely misses the fucking point.

Here now to completely miss the fucking point are The New Yorker's John Cassidy ("hero") and Jeffrey Toobin ("traitor").

I guess we should applaud The New Yorker for showing its journalistic integrity by presenting both sides of the not-actually-the-fucking-story.

Look. I don't give a goddamn if Edward Snowden raped a bear in his meth lab while canceling Firefly. First of all, he'd still be less of an asshole than Dick Cheney, and second, if you think it's okay for the government to spy on your phone and Internet habits, you should probably come up with a better reason than "Well, I'm for it because that bear rapist is against it!"

Now, I happen to believe, based on the limited information we have at the moment, that Snowden did the right thing, and also that Snowden has gigantic balls. But I don't believe he's the most important person in this story. I don't think he's even in the top fifty.

Someone who is in the top fifty is James Clapper, perjuring fuck and Director of National Intelligence, who recently testified before Congress that the government is totally not collecting surveillance information on millions or hundreds of millions of Americans. Here, go watch John Oliver kill it on his first episode as fill-in host of The Daily Show (and be sure to stick around for the Moment of Zen where 2006 Joe Biden explains how this sort of thing is totally not okay when a Republican does it).

Fred Kaplan at Slate advocates firing Clapper, because, among other reasons, he has proven himself totally incapable of discussing this subject in an intellectually honest fashion or any other kind of honest fashion.

Among other reasons, here's Clapper's inept fucking explanation for why his lie was actually true:

Rambling on in his rationalization to Mitchell, he focused on Wyden’s use of the word “collect,” as in “Did the NSA collect any type of data ... on millions of Americans?” Clapper told Mitchell that he envisioned a vast library of books containing vast amounts of data on every American. “To me,” he said, “collection of U.S. persons’ data would mean taking the book off the shelf and opening it up and reading it.”

Jesus Christ. Between this asshole and Petraeus, I'm beginning to worry that our entire intelligence apparatus is made up of people who can't even come up with a convincing lie if they're given months of warning and an entire team of speechwriters.

Hey Clapper -- this is my comic book collection.

Image: My comic book collection.

I haven't read most of those books in years. Does that mean they're no longer part of my collection? Or does reading them once count? Does that mean the comics I bought last week and haven't gotten around to reading aren't part of my collection yet? Is this some kind of quantum physics shit where my collection is altered by the act of observing it?

What about garbage collection? Does it only count as collecting my garbage if the sanitation workers break open the bags and root through 'em? Because I've never seen them do that, and yet the city keeps charging me a garbage collection fee anyway.

You get the point. He's claiming his lie is not actually a lie because he was using a definition of a word that he just completely made up. Like how I had sex with Natalie Portman. It's not a lie because when I say "had sex" I actually mean "sat on the couch" and by "with Natalie Portman" I mean "and played Nintendo".

Man, I have had so much sex with Natalie Portman.

I don't know if I'm even as bothered by his lying -- hell, that's his job, I'd expect nothing less -- as the sheer fucking laziness of his lying. It's downright goddamned insulting. It lacks even the sublime, recursive absurdity of "That depends on what your definition of is is." It's just worthless. And so is Clapper.

I don't really think throwing him out on his ass is going to change things. Throwing the Republicans out of the White House sure as hell didn't.

But what the hell, they still deserved to be thrown out, and so does he.

Firing Clapper certainly wouldn't guarantee we'd have an honest national discussion about the nature of our government's various spying programs.

But not firing Clapper will guarantee that we won't.

The Real Questions

2013-06-10, 9:11 pm
Categories: Politics, Stream of Consciousness

I was going to write a post about Edward Snowden.

But then I realized: that's bullshit.

Because this isn't about Edward Snowden.

I just read a great piece by Matt Taibbi titled As Bradley Manning Trial Begins, Press Predictably Misses the Point. He argues, persuasively, that focusing on Manning is what the government wants. It wants the story to be about a person instead of about the information he disclosed.

The NSA story isn't about Snowden, any more than the military leaks are about Manning or Assange. "Hero or traitor?" is a bullshit question.

There are real questions we should be asking. Here are a few courtesy of Bruce Schneier:

We need details on the full extent of the FBI's spying capabilities. We don't know what information it routinely collects on American citizens, what extra information it collects on those on various watch lists, and what legal justifications it invokes for its actions. We don't know its plans for future data collection. We don't know what scandals and illegal actions -- either past or present -- are currently being covered up.

We also need information about what data the NSA gathers, either domestically or internationally. We don't know how much it collects surreptitiously, and how much it relies on arrangements with various companies. We don't know how much it uses password cracking to get at encrypted data, and how much it exploits existing system vulnerabilities. We don't know whether it deliberately inserts backdoors into systems it wants to monitor, either with or without the permission of the communications-system vendors.

And we need details about the sorts of analysis the organizations perform. We don't know what they quickly cull at the point of collection, and what they store for later analysis -- and how long they store it. We don't know what sort of database profiling they do, how extensive their CCTV and surveillance-drone analysis is, how much they perform behavioral analysis, or how extensively they trace friends of people on their watch lists.

All that said: I can't resist linking the petition for Obama to debate Snowden. Obviously it's not going to happen, but if it gets 100,000 signatures, the White House will have to issue an official response.

And presumably up the signature requirement for an official response to 150,000 for next time.

Sanity from Texas

2013-05-29, 9:27 pm
Categories: Politics, Stream of Consciousness, Tech

The Texas legislature's passage of a landmark E-Mail privacy bill is something of a Nixon-goes-to-China moment: nobody is going to accuse Texas of being soft on crime or caving to the ACLU.

Perry hasn't signed it yet, and there's still a chance he could veto it. But the nice thing about having a Democrat in the White House is that Republicans suddenly remember that government invasions of privacy are bad.

I've been saying for years that Republicans had real potential to reverse some of the excesses of the post-9/11 security apparatus, if only they would realize they could use it as a bludgeon against Obama and still keep their reputation as the Tough On Terror, Tough On Crime, Strong On National Security Party.

(In this case, of course, "post-9/11 security apparatus" is an oversimplification, as current computer privacy law dates back to 1986. Still, I think my point stands.)

Perry's still got the opportunity to continue on with the status quo. But there's a real opportunity here. We're living in a nation with a toxic mix of archaic technology law and cutting-edge surveillance techniques, and opportunists in both the public and private sector who are all too happy to exploit the disparity.

The Two Lying Bastards Show, Season 14, Episode 2

2012-10-16, 9:52 pm
Categories: Politics, Stream of Consciousness, TV

All right, I missed the season premier and the All-Sidekick Special. But I caught this one.

On the whole I think Obama pulled this one out but they both did pretty well. Romney was at his best when he was criticizing Obama's record, his failures and broken promises -- and I think that speaks to the fundamental weakness of each campaign. Obama has failed to be the President he promised to be four years ago, but on the other hand, Romney is essentially running the same campaign John Kerry was eight years ago -- nobody's voting for him, they're voting against the incumbent.

Today's top story was Secretary Clinton's mea culpa on the attack in Benghazi. This was an opening for Romney; to my mind the Administration has bungled its narrative on the attack over the past few weeks, sticking to the "spontaneous attack over a YouTube video" story well after it became clear it was a coordinated terrorist strike.

Romney fucked that up.

The bit where he claimed Obama didn't refer to it as a "terrorist attack" on day one, and Crowley checked the transcript and confirmed that he had? That was the strongest audience reaction of the night, and we'll be seeing it in the highlight reel. Romney's best line of attack on foreign policy is effectively neutralized.

(The Republican talking point now appears to be that Crowley lied and Obama never used the phrase "terrorist attack". Per the transcript, the actual phrase he used was "acts of terror" -- claiming that the two phrases are not equivalent is absurd hairsplitting.)

Crowley was great, too; she gave the candidates rope when it was appropriate and reined them in when it was appropriate to do that. I only heard a bit of the first debate, but what I heard was consistent with what everyone said about Lehrer afterward: he was a moderator in name only and the debate was completely out of his control. Crowley owned it.

On the whole I'm still not happy with Obama. (And that he's got the balls to go up there and criticize Romney for supporting China in conducting surveillance on its own citizens, even as he's ramped up domestic surveillance beyond even Bush Administration levels...) I'm leaning Stein at this point. But I still prefer Obama to the alternative and hope he wins. If I were in a swing state, I might bite the bullet and vote for him -- but I'm not. There's a single poll showing Obama running within the margin of error in Arizona; the New York Times explains why it's best taken with a grain of salt (tl;dr the sample is too small and if Arizona were to go blue it would be part of a nationwide surge in Obama's favor).

All in all, a decent episode but I'm not sure it was good enough for me to stick around for the finale. Not nearly as good as the new episode of Walking Dead the other night.

Nymwars

2012-07-25, 5:36 pm
Categories: Politics, Stream of Consciousness, Tech

Yesterday Google started encouraging YouTube commenters to use their Google+ accounts. Google claims that this will make YouTube commenters use their real names and, therefore, not act like such assholes all the time.

I think it's more to do with Google desperately trying to get people to use Google+ after everybody tried it for a month and then went back to Facebook. But the notion of "realname enforcement" as a deterrent to trolls is a pipe dream and it's been pretty roundly torn apart already. So, I present to you this post, a reworked version of something I wrote last October.

John Gabriel's Greater Internet Fuckwad Theory posits that ordinary people, given anonymity and an audience, turn into total fuckwads. I agree with this assessment wholeheartedly.

Which is why the suggestion that removing people's anonymity so they've got to stand by their words is so appealing: at least some people would be a little less obnoxious on the Internet if they had their real name attached to everything they said, right?

Which would probably be true if it could actually be implemented, but it can't. This argument essentially mirrors the DRM argument: intelligent, tech-savvy people understand that it doesn't fucking work, but idiots continue to support it because it sounds like something that should work. So we wind up with something that does fuck-all to stop people who are misbehaving, while managing to create an obnoxious inconvenience for people who have done nothing wrong.

To wit: All "realname enforcement" means is that a troll has to use a plausible-sounding name like "John Smith". Meanwhile, people who have actual unusual names get hassled and held up, as noted in the Washington Post article Offbeat Name? Then Facebook's No Friend. (Some people really are named "Batman" or "Yoda"!)

All that aside, there are legitimate reasons to use a pseudonym on the Internet. Fortune gets it; danah boyd (no relation) really gets it.

Another site has popped up called "My Name Is Me" where people vocalize their support for pseudonyms. What's most striking is the list of people who are affected by "real names" policies, including abuse survivors, activists, LGBT people, women, and young people.

Over and over again, people keep pointing to Facebook as an example where "real names" policies work. This makes me laugh hysterically. One of the things that became patently clear to me in my fieldwork is that countless teens who signed up to Facebook late into the game chose to use pseudonyms or nicknames. What's even more noticeable in my data is that an extremely high percentage of people of color used pseudonyms as compared to the white teens that I interviewed. Of course, this would make sense...

The people who most heavily rely on pseudonyms in online spaces are those who are most marginalized by systems of power. "Real names" policies aren't empowering; they're an authoritarian assertion of power over vulnerable people.

I use my real name online -- but I'm a straight, middle-class white boy between the ages of 18 and 35. Worst thing that's going to happen to me is somebody asks me about my political opinions in a job interview, or posts satellite pictures of addresses you can find if you run a whois on my website.

Charlie Stross has a wonderful analysis of everything that's wrong with realname enforcement under the title Why I'm not on Google Plus; notably, it quotes Patrick McKenzie's Falsehoods Programmers Believe About Names. I'm going to follow Charlie's lead and quote Patrick's list of falsehoods in its entirety:

  1. People have exactly one canonical full name.
  2. People have exactly one full name which they go by.
  3. People have, at this point in time, exactly one canonical full name.
  4. People have, at this point in time, one full name which they go by.
  5. People have exactly N names, for any value of N.
  6. People’s names fit within a certain defined amount of space.
  7. People’s names do not change.
  8. People’s names change, but only at a certain enumerated set of events.
  9. People’s names are written in ASCII.
  10. People’s names are written in any single character set.
  11. People’s names are all mapped in Unicode code points.
  12. People’s names are case sensitive.
  13. People’s names are case insensitive.
  14. People’s names sometimes have prefixes or suffixes, but you can safely ignore those.
  15. People’s names do not contain numbers.
  16. People’s names are not written in ALL CAPS.
  17. People’s names are not written in all lower case letters.
  18. People’s names have an order to them. Picking any ordering scheme will automatically result in consistent ordering among all systems, as long as both use the same ordering scheme for the same name.
  19. People’s first names and last names are, by necessity, different.
  20. People have last names, family names, or anything else which is shared by folks recognized as their relatives.
  21. People’s names are globally unique.
  22. People’s names are almost globally unique.
  23. Alright alright but surely people’s names are diverse enough such that no million people share the same name.
  24. My system will never have to deal with names from China.
  25. Or Japan.
  26. Or Korea.
  27. Or Ireland, the United Kingdom, the United States, Spain, Mexico, Brazil, Peru, Russia, Sweden, Botswana, South Africa, Trinidad, Haiti, France, or the Klingon Empire, all of which have "weird" naming schemes in common use.
  28. That Klingon Empire thing was a joke, right?
  29. Confound your cultural relativism! People in my society, at least, agree on one commonly accepted standard for names.
  30. There exists an algorithm which transforms names and can be reversed losslessly. (Yes, yes, you can do it if your algorithm returns the input. You get a gold star.)
  31. I can safely assume that this dictionary of bad words contains no people’s names in it.
  32. People’s names are assigned at birth.
  33. OK, maybe not at birth, but at least pretty close to birth.
  34. Alright, alright, within a year or so of birth.
  35. Five years?
  36. You’re kidding me, right?
  37. Two different systems containing data about the same person will use the same name for that person.
  38. Two different data entry operators, given a person’s name, will by necessity enter bitwise equivalent strings on any single system, if the system is well-designed.
  39. People whose names break my system are weird outliers. They should have had solid, acceptable names, like 田中太郎.
  40. People have names.

Now, it's true that Internet Fuckwads use pseudonyms to behave in a way that they probably wouldn't if they were forced to use their real names.

However, any potential benefit of such realname enforcement is negated by the fact that -- and those of you familiar with my opinions on swear filters and DRM may notice a trend here -- realname enforcement doesn't fucking work.

Stross also links a Gary Walker piece, A Firsthand Examination of the Google+ Profile Reporting Process, which pretty much takes a wrecking ball to any notion that Google+'s realname enforcement is, well, even slightly competent.

To wit:

He set up a second Gary Walker account, and used the same avatar -- which isn't personally identifying, just a Lolcat.

Then he reported the second account as an impersonator. To file such a report, he had to prove his original account was the "real" Gary Walker. To do this, he Photoshopped a crooked scan of his picture onto the McLovin ID from Superbad, and replaced "McLovin" with his own name, in a different font from the rest of the ID.

Google accepted this as a valid ID, and temporarily blocked the second Gary Walker account.

To prove his identity, Gary responded from the second account, taking the same fake ID and Shopping a picture of Jared fucking Loughner on it.

The account was reinstated.

In short, in a revelation that should surprise absolutely fucking nobody, realname enforcement doesn't stop anybody from using pseudonyms -- it just forces them to use pseudonyms that sound, plausibly, like real names.

Meanwhile, both honest people who want to use pseudonyms and people with unusual real names are penalized.

So yeah, I think the comparison to DRM and swear filters is apt: legitimate users get fucked, abusive ones don't even have to break stride.

That was where my original post ended. The rest of the thread is well worth reading; a number of the guys on the board note that as far as they're concerned, their handles are their real names at this point. Forumgoer Kayin, creator of cult gaming hit I Wanna Be the Guy, is best known on the Internet as Kayin; nobody knows who the fuck Michael O'Reilly is. (And, as I note, even O'Reilly tends to fuck with "realname" parsers, due to the apostrophe.) I've met some of these guys and still didn't address them by their real names; Kazz will always be Kazz. Sei won't even tell us his real name.

(Hell, I've been mostly-using my real name online since 1990, but there are still some people out there who think "X" is actually my middle initial. I used to know a guy who always addressed me, in person, as Thad "X" Boyd. As in "Hi, Thad 'X' Boyd. How are things, Thad 'X' Boyd?")

Google+ did add support for pseudonyms a few months after the criticism started, so that, say, Madonna can sign up as Madonna, but it still requires that the pseudonyms be "established" -- as vaguely defined by some guy in an office somewhere. Kazz and Sei, presumably, don't qualify. I guess Kayin might, but I doubt it, and to my knowledge he hasn't tested it -- last I heard he'd deleted his Google+ account.

Anyway. If all that's not enough to convince you that realname enforcement doesn't work, consider this: do you generally think of Facebook as a place where people are polite and don't say offensive or insulting things?

And consider this: I post under my real name, and have been for over twenty years -- and it hasn't stopped me from posting things with titles like Nintendo President Still a Fucking Idiot, Experts Say.

Stalkerin'

2012-07-17, 7:28 pm
Categories: Stream of Consciousness

Last night, when I was digging for old Sonic the Hedgehog fanfic I wrote when I was 11, I ran across a page that had set up a profile for me.

Nothing I'd signed up for; a site that had apparently trawled search engines and found things out about me.

For example, it had an address and phone number on it that were both, at various times, attached to my domain registration information for this site. It asterisked out the last four digits of the phone number, as well as the street numbers of the address -- but I don't know how much that would prevent anyone from finding the house, seeing as the site's got a satellite photo of it with an arrow pointing to it.

Now, I haven't lived at that house in years. And I've been pretty good about keeping my current address off the Internet for most of this century. But you know, I did pick up a stalker once who posted vaguely threatening satellite photos of old addresses he'd found by Googling my name. He was laughably incompetent at the whole stalker thing, but it was still a little on the creepy side.

There are other things about that site that made me curious about its data aggregation. I know where it got my (old) address and phone number, but it also knew my brother's name, and I'm curious where it found that. (Not like it's a secret or anything, I'm just wondering where and how the scraper found it.) It also listed my age -- as "early 40's", which I have to admit makes me feel a little better about turning 30 in a couple months.

But you know, it's a bit disquieting to know that that address and phone number will be associated with me forever (or at least for years to come). If I ever attract any competent crazies, that could mean harrassment for whoever lives in those two places now. (My domain is now registered to the address and phone number of the hosting company. Please don't go after them if I piss you off, either; they're an understaffed local business and their job is tough enough as it is.)

There was a story a few months back about Spike Lee retweeting what he believed to be the address of accused child-murderer George Zimmerman but turned out to belong to a couple of elderly retirees. You can imagine how that went.

So, you know, not that I believe that the sort of gibbering maniac who stalks people who make him angry on the Internet will heed this advice, but here it is anyway: do not engage in Internet Mob Justice. You want to send an angry E-Mail to a public address or call in a complaint to a public number, okay, but leave personal phones and home addresses out of it. Not just because that's basic human decency, but because you might get the wrong person.

But Internet Mob Justice could make for a whole other post, or a whole series of them. (And, mind, I haven't actually been subjected to any, beyond the weirdo with the satellite photos a few years ago, nor do I expect to; I'm just indulging in general musing right now.)

But back to the point. Back when I used my real, personal addresses and phone numbers as contact for this domain, I wasn't thinking about long-term effects or unintended consequences. And I think that's an ongoing problem in the era of social networking.

Back in April, Cult of Mac wrote a feature on an app called Girls Near Me, which used Facebook and FourSquare location data to help users find people in the area and pull up their profiles. Charlie Stross had further comments.

At minimum, the app had potential for simple skeeze -- sliding up to a girl at a bar and pretending to coincidentally be interested in the same things she was. At maximum, well, full-on stalking. The app was pulled in pretty short order, but the app was just an aggregator -- people still post location data and personal information; that information is still out there, whether or not it's aggregated by a skeezy-looking app.

People post about being on vacation, and their houses get robbed. You'll recall I was out of town this past weekend -- but I didn't mention it until I got back. (I even scheduled two posts to go up while I was gone, to keep up my post-a-day streak.) Now, as I said, I don't think my current address is available anywhere on the Internet -- and my readership is far too small to pose any kind of statistical likelihood that somebody's waiting for a chance to rob my house -- but at this point it's just a best-practices thing.

I dunno. Guess I'm not going anywhere in particular with this. It's just weird, the amount of shit that's out there, the amount that's accurate, the amount that once was, and the amount that's just pure goofy-ass bullshit. (Still wondering where that aggregator got the idea I'm in my forties.) Something to think about.