People Search, Phishing, MyLife, and All That

I recently wrote about getting information from the naive, though I phrased more harshly. This was at  http://martesmartes.blogspot.com/2011/04/how-to-get-personal-information-from.html. Then last week I saw a TV ad for mylife.com, offering to show a person who is searching for him or her.

First, I don't know how they can do this without the cooperation of Google or some of the alternative search engines. MyLife seems to be the same as the previously-discussed phishing sites. It asks for personal information, shows a picture of the user's neighborhood from Google Streetview, and then offers to to take a credit card number for outrageous ($13 per month and up) fees to provide results.

There is, however, an inconspicuous little link in the upper right to continue with free, limited access. I clicked. First, it took me to my profile--my fault, I entered personal info. How do I delete it? However, the page was surprising, with links to a couple family members and my ex-wife. I seriously dislike this site.

There was a link to my profile, but no option to delete. However, I was able to edit my profile, but the only meaningful field worth changing was my birthdate, which I changed to a wildly inaccurate value.

This site goes into my hosts file mapped to 127.0.0.1.

My best guess is that it the for-pay tell me who is searching for me feature, is simply internal: a record of people who have searched for me from within mylife.com. So, ultimately, it's a phishing site that thinks it's yet another redundant social media site.

Personal Data in Amazon MP3s

In December I discussed the buyer ID data that Amazon is placing in MP3 files, noted that the standard tools seem to not notice these IDs, and expressed a desire to write a script to display these IDs. See http://martesmartes.blogspot.com/2010/12/need-to-write-my-own.html and http://martesmartes.blogspot.com/2010/12/personal-information-in-amazon-mp3.html.

First, the script:

// Time-stamp: <2011-05-27 22:23:37 jdm>

// JFlex script to look for UID tags in an MP3 received from Amazon. If
// such a tag is encountered, it is displayed. Otherwise, there is no
// output.

// Compiling (assuming JFlex is installed)
//
// jflex findUID.lex
// javac Yylex.java

// Running:
//
// java Yylex <MP3 file name>

// Bugs:
//
// A left angle bracket, <, within the UID will cause the tag to not be
// displayed.
// Even though the MP3s that I have seen with UID tags have the tags
// near the beginning of the file and only one UID tag per file, this
// searches the entire (possibly long) file and will display multiple
// UIDs if found. Though this is probably not a bug, it does cause a
// perceptible delay.

%%

%standalone

%unicode
%int

openAngle  = <
uid        = UID
stuff      = [^<]+
tagEnd     = "</UID"
closeAngle = >
tag        = {openAngle}{uid}{stuff}{tagEnd}{closeAngle}

%%

{tag} { System.out.println(yytext()); return 0; }

.     { return 0; }

\n     { return 0; }

\r     { return 0; }

As mentioned in the comments, this is a JFlex script. JFlex's lineage dates back to the standard Unix lexical analyzer-building tool, lex, which was superseded by flex. JLex has been well-known in the Java community for awhile, but work on it seems to have ceased. JFlex, however, appears to be an active project (and an Ubuntu package). Of course, it works on Windows, too.  See http://jflex.de/

It turns out that Amazon informs the consumer when an MP3 will contain identifying information. I did not notice this before Michael D. pointed it out to me in January. The Amazon notice is in the product details and says "Record Company Required Metadata: Music file contains unique purchase identifier." Then they have a "Learn More" link. This is what Amazon has to say:

Record Company Required Metadata

The record company that supplies this song or album requires all companies that sell its downloadable music to include identifiers with the downloads.  Embedded in the metadata of each purchased MP3 from this record company are a random number Amazon assigns to your order, the Amazon store name, the purchase date and time, codes that identify the album and song (the UPC and ISRC), Amazon's digital signature, and an identifier that can be used to determine whether the audio has been modified.  In addition, Amazon inserts the first part of the email address associated with your Amazon.com account, so that you know these files are unique to you. Songs that include these identifiers are marked on their product detail page on Amazon.com.  These identifiers do not affect the playback experience in any way.

The idea seems to be that the record companies are requiring Amazon to put the information in, and Amazon is being honest about what's in there, though most consumers likely never see this information and never notice the link to it.

A few comments are in order.

• My script displays the UID tag and contents, but does not modify or remove it. I have no intention of providing such a script.
• People share MP3s at their own risk. As someone who has made good money developing software, I understand their need to earn a living. I even understand, though am less sympathetic toward, the RIAA's outrageous damage claims in suits. Any individual's decision to share, or not, is between him, his conscience, and the RIAA.
• The UID is the user's Amazon user ID. On the MP3s containing the UID that I have, my script displays this:  <UID version="1">martensjd</UID>. That's me. 
• Amazon says there is other identifying information embedded in the MP3. Read the statement above. So stripping this out will not be sufficient to hide the original buyer.
• I would rather not have this in my media files, but I don't object strongly enough to go through the files stripping it all out.

4G In Catonsville

I used to be a Xohm customer, and then Xohm switched to Clear. In time I was unhappy enough with Clear's service that it became time to switch myself, to Verizon FiOS. Xohm and Clear offered 802.16 (WiMAX) to home and mobile users at around, optimistically, 4Mb/s. FiOS is faster, typically 15Mb/s at my tier.

Clear (http://www.clear.com/) is now marketing their wireless Internet vaguely as 4G. They are also advertising lower speeds than before, which makes it unclear what technology they are using. 4G is a marketing term, and from an engineering or technical perspective, meaningless. Granted, WiMAX is also a marketing term (IEEE originally referred to 802.16 as Wireless MAN), but at least WiMAX actually means something.

Xohm marketed their service as WiMAX, and reading the fine print it was clearly 802.16. Clear has dummied their web site down to the extent that there is nary a clue what technology they are using. Actually, a bit more digging leads to a release at http://corporate.clearwire.com/releasedetail.cfm?ReleaseID=570046 that mentions legacy and mobile WiMAX, but also mentions partners using other technologies. Perhaps Clear is still predominantly 802.16, but advertised at a lower rate, which is consistent with what I was seeing when I canceled my Clear service. It may be that they are simply provisioning their towers at a lower rate per customer. The dumbing down of their web site is unfortunate.

Of course, Verizon is vague at their web site about what FiOS is, and I think there is an intentional effort on the parts of corporations in general to make it difficult for consumers to compare what different vendors are actually providing.

Why do I care? I just got my latest Verizon FiOS bill. It was $55, which is a lot for Internet service. Clear is $35, which is high for the poor performance they offer. So it was time to look around. Also time to reevaluate whether I really need Internet access at home.

One of the appealing things about Xohm when they came to Baltimore was the promise of $35 per month  for Internet access for life. But then Clear came in and reduce the service level. So it goes.

Of course, Judgment Day is today so maybe this is the beginning of my five months of torment.

Catonsville Nine Commemoration

Some of the real heroes of the Vietnam era anti-war movement are being commemorated Saturday 5/21. From the Indypendent Reader at   http://www.indyreader.org/content/catonsville-nine-commemoration:


CATONSVILLE NINE COMMEMORATION


May 21, 2011 - 12:00 - 14:00
CATONSVILLE NINE COMMEMORATION SATURDAY 21 MAY, 12N



The Baltimore Phil Berrigan Memorial Chapter of Veterans For Peace on Saturday 21 May
at 12 noon will commemorate the Catonsville Nine Viet Nam draft file burning action taken
by the chapter's namesake Phil Berrigan and 8 others.  Forty three years ago on May 17th
9 peace activists took draft files from the Catonsville Draft Board office and burned them
with homemade napalm in a Catonsville parking lot, and were eventually sentenced to jail
for their action.


At noon Baltimore VFP will gather at the Catonsville Post Office at Frederick Road and
Beaumont across from the Catonsville Public Library to vigil and hand out flyers, and will
later adjourn to the Knights of Columbus parking lot across the street for recollections
and fellowship. Please join us. Bring banners and posters. For information call Ellen
Barfield at 410-243-5876, or e-mail ellene4pj@yahoo.com.


Location


Catonsville Post Office
Frederick Road and
Baltimore, MD
United States
39° 36' 32.3712" N, 77° 42' 18.1764" W

How to get Personal Information from Morons, Part II

Saturday I spent a few minutes messing with a phishing site that was trying to mess with me, webspyapp.com. I stopped at the point that it wanted a cell number, and rejected made-up ones. I didn't have a number I was willing to give them in order to receive their texts. This morning a colleague donated his recently-disused number, so I gave it another shot.

I ended up at http://gtoffers.com/coreg/entry.php?p=bg266533g6&sid=p1&limit=2&phone=7178914944&redirect=http%3A%2F%2Fofferlabs.com%2Fc.php%3Fa%3D119%26o%3D183%26sid%3Dp1&head=http://d18j1d26sau8be.cloudfront.net/user_images/13016043631131154035370.png, which tried to install a browser extension.

At this point I stopped.

How to get Personal Information from Morons

I block ads when I can, and here's a reason why: webspyapp.com. This is essentially a phishing site, designed to get people to give up person information. Here's the scam: offer a mark the ability to see who is searching for him. The mark clicks on the webspyapp link, and is taken to a page that asks him for his name and ZIP. I claimed to be Fred Snerdling with a UMBC ZIP:

When the mark enters his information, webspyapp claims to have found some people searching for the mark, but wants the mark's cell number:

I especially like the fuzzy images of people searching for Fred Snerdling at 21250--nice touch. I entered a fake cell number, but unfortunately they wanted a real one:

I considered using the cell number of a wrong number who rang me a couple times last week, but that would be bad--even if the phishers have the wrong name and ZIP, they would have some poor sucker's cell number, and she doesn't deserve that.

Epsilon, No Delta

A number of organizations with which I have (or had) financial relations have recently sent e-mails saying they have lost some of my personal information. At first I was unconcerned, because the impression I got was that it was just my e-mail address, and it was just Best Buy, or just Best Buy and Verizon, or just Best Buy, Verizon, and TIAA-CREF, or, well, around the time I got the TIAA-CREF mail I started to get concerned. This is a major financial institution, and, one might hope, one not cavalier about my personal information.

Here is the list of companies that have notified me to date:

• Best Buy, 4/4
• Verizon, 4/5
• TIAA-CREF, 4/6
• Chase, 4/6
• M&T Bank, 4/8

All of these organizations, and I'm sure others, are informing their customers that an apparently inept contractor called Epsilon has lost their e-mail addresses. The first thing to note is that the financial institutions were the slowest to inform me. This may be just coincidence, but it is easy to believe that Best Buy was more responsive than M&T Bank. Kudos of a wry sort to Best Buy.

So the bad guys have many e-mail addresses, and can connect individuals to accounts. So what? Well apparently some people are getting phishing mails claiming to be from organizations that have lost data through Epsilon. So what? Well, this will make it easier to tailor and target phishing attacks more precisely.

Clearly data leaks all the time. Excerpted from a recent posting by Martin McKeay: I’m no longer surprised when I go into an assessment and somewhere halfway through a conversation a manager says, “Wait a minute, why haven’t I haven’t heard of this data repository/network connection/export to sales before now?” But this is a shallower problem, not an inadvertent leak to marketing or sales, but an intentional transfer of data to an outside organization unable to protect the data.

The situation is exacerbated for Verizon customers since Verizon encourages users to log in to its site without SSL/TLS. So, if users think that a picture of a padlock and the word "secure" next to the login text boxes actually indicates anything they will be more vulnerable to phishing. Surprisingly, Verizon is the only organization from this list training users to ignore TLS. A few years ago this seemed more common, though I have just a very small sample here.

IMHO the Chase leak is the most egregious, since I have had no dealings with them since canceling my card in March 2008. I guess they consider me a potential future customer, but since I do not have a current relationship with them, it would be nice if they would delete my info. I managed to log in to my dormant Chase account, but cannot send them a "secure message" because every attempt results in "Error 500:", which looks like there should be a description after the error number. Yes, I remain unimpressed with the competence of Chase.

Useful "New" Firefox Feature

I am not a fan of GUI-based spellcheckers since it is so easy to miss a misspelling. I much prefer ispell within emacs. In particular, ispell does a great job (compared to any GUI I've seen) of suggesting alternatives, emacs and ispell together do a great job of accepting words for a session across multiple documents, and emacs understands various file formats and doesn't try to tell me that, for example, an HTML tag is not a valid English word. Well, it has long been a common opinion that GUIs are great for beginners but don't particularly reward more experienced users with better productivity. I particularly dislike spell checking within OpenOffice, since when adding to the dictionary one has to always specify which dictionary to save a word to, even if there is only one dictionary. Make the common case fast? I don't think that's a concept OpenOffice developers are familiar with.

So how can one make it less likely to miss misspellings before sending an e-mail, submitting a form, etc? Firefox 3.6 and newer has a nice feature that's a pain to enable, ui.SpellCheckerUnderlineStyle. See http://kb.mozillazine.org/Ui.SpellCheckerUnderlineStyle. I particularly like option 4, which places a double line under each misspelled word. But the article just cited does not give explicit instructions for enabling the feature.

1) Open about:config
2) Right click in the list of preferences and select new.
3) For the new preference name, use ui.SpellCheckerUnderlineStyle.
4) For the type, use integer.
5) For the value, use your preferred value from the MozillaZine article. 5 is the default, a wavy red line. My preference is 4, a double line.

Iceland: Do the Right Thing

Vote no. Corrupt bankers took down the financial system, European governments bailed the banks out, and now have presented Iceland with the bill. If Iceland refuses to pay, perhaps the British and Dutch governments will be motivated to pursue those actually responsible for the collapse, the wealthy, corrupt bankers.

http://www.guardian.co.uk/commentisfree/2011/apr/08/iceland-referendum-conspiracy-financiers

Keeping Work and Personal E-mail Separated

A group in Michigan has submitted a Freedom off Information Act
request for all e-mail from University of Michigan, Michigan State,
and Wayne State faculty mentioning the labor brouhaha in Wisconsin.
Similarly, but less broadly, the Wisconsin Republican Party requested records from a University of Wisconsin History
professor. The Michigan request seems very broad, asking for all
e-mails mentioning “Scott Walker,” “Madison,” “Wisconsin” or “Rachel
Maddow.” I can imagine this request would net much mail not related to
labor issues.

I think this should serve as a reminder, especially to state
employees, to keep personal and work e-mail separate.

Source: http://www.nytimes.com/2011/03/30/education/30professors.html

Using the Hosts File to Block Advertising

A small chunk of my linkedin page is to the right. My machine doesn't look up the IP address for doubleclick, and so I never see their content. A drawback is that it also thwarts any attempt I make to click on a targeted advertising link from Google within Gmail. That's okay.

Here's my /etc/hosts file:

127.0.0.1       localhost
127.0.1.1       asusCG

127.0.0.1       ad.doubleclick.com
127.0.0.1       ad.doubleclick.net
127.0.0.1       ad2.netshelter.net
127.0.0.1       adbrite.com
127.0.0.1       ads.adsonar.com
127.0.0.1       ads.vrx.adbrite.com
127.0.0.1       an.tacoda.net
127.0.0.1       assets.bizjournals.com
127.0.0.1       b.scorecardresearch.com
127.0.0.1       itemnotfound.com
127.0.0.1       netshelter.net
127.0.0.1       pagead2.googlesyndication.com
127.0.0.1       s24.sitemeter.com
127.0.0.1       scorecardresearch.com
127.0.0.1       sitemeter.com
127.0.0.1       sitemeter.com
127.0.0.1       static.2mdn.net
127.0.0.1       stimpy.musicbrainz.com
127.0.0.1       stimpy.musicbrainz.org
127.0.0.1       tacoda.net
127.0.0.1       vrx.adbrite.com
127.0.0.1       www.itemnotfound.com
127.0.0.1       www.sitemeter.com
127.0.0.1       www.spoke.com
127.0.0.1       www.tacoda.net
127.0.0.1       wwwv.itemnotfound.com
127.0.0.1       wwwwv.itemnotfound.com


# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

You can edit your /etc/hosts, but I'd suggest leaving the stuff at the top of the file (above the doubleclick entries) and the bottom (below wwwwv.itemnotfound.com) alone.

The way this works is as a shortcut to name resolution, e.g., I can place an IP address and a domain name on a line in this file and rather than going out to the DNS to look up the name, it uses the IP address in the first column of the line. So, any lookup to tacoda.net
resolves to the IP loop-back address, which is my machine. I don't have a web server at that port, so the connection attempt fails.

This is a very common technique, and one can google to find other people's hosts files with lists of sites they block.

For simplicity of adding entries, I place my hosts file in a subdirectory writable by my account, and then place a soft link from /etc/hosts there.

For Windows people, the file is (as of a few years ago) hosts.txt, and I think it was buried somewhere in the system32 subdirectory. Of course, Windows doesn't support links, soft links, or anything like that. Windows does support shortcuts, but these aren't within the file system, and so are much less generally useful.

Some question the ethics of freeloading on advertiser-supplied content by blocking the ads. I have three responses:
(1) Advertising often contains scripting which threatens the safety and stability of my system. If they stop using insecure scripting languages, I might revisit this issue.
(2) Advertising sometimes starts unwelcome sound or video content, including animated gifs. This is intrusive and disruptive. Advertising scripts also often eat up many CPU cycles. If advertisers start treating users with more respect, I might revisit this issue.
(3) The above two points greatly reduce the value of the content presented along with the advertising, to the point that I would be less likely to visit any particular page. They cannot argue in the general case that they are losing revenue due to my blocking advertisements, because in many cases I simply would not visit the page.

I endorse a multilayered approach against intrusive advertisement: Adblock Plus, NoScript, and the hosts file. IMHO if a machine has private data on it, e.g., student grades, then the owner has a responsibility to block scripts from questionable source, e.g., advertisers. With personal information, e.g., financial information, it is foolish to not block these things.

Blocking myUMBC Alerts

I suggest AdBlock Plus for disabling myUMBC alerts. I find it distracting to see that I have alerts. What if it's something worth looking at? It's never happened, but there could be a first time. Today I received two "personalized" alerts telling me it's windy outside. How much time is wasted campus-wide by these things?

I realize the country has been quaking in its collective boots since fall 2001, and campuses fall victim to fear mongers, like E2Campus, who have been profiting off the Virginia Tech shootings, but this whole notion that UMBC needs an alert system is silly, and the way it is currently misused is strong evidence of that fact.

Will I get an alert that it's dark outside tonight? Nope, I know how to use Adblock Plus.

My Recent Trip to Greece

The pictures are here:

• Athens Day One
• Diakofto and Kalavryta
• Archaeology Museum and Filopappou Hill
• Cape Sounion and the Acropolis Museum
• Delphi
• The Peloponnese
• The Saronic Gulf

Google Attempting to Coerce Picasa Users

For the past few weeks I have been prompted by Picasa to link my photos to my Google profile. This nagware appears every time I visit Picasa. It also appears I cannot comment on even my own photos without linking my Picasa account with my Google profile. I got rid of the nagging (or so it seems) by deleting my Google profile. It seems I've done this before.

Google has no regard whatsoever for its users' privacy.

The Value Added by Radio Shack

Why do people pay a premium to buy from Radio Shack rather from other, less expensive, sources? Is it the expertise of their sales people? Probably not.

Today I was in need of an SD card for a digital camera, and the camera is a few years old, so it had to be SD, and not SDHC. I wanted the card today, and the HH Gregg web site wouldn't tell me clearly whether the local store had SD in stock, but both of the closest Radio Shacks did. So I went to the Radio Shack on Wilkins Ave. I guess immediate acquisition and convenience are two reasons to go to Radio Shack.

At Radio Shack, I found the SD/SDHC/USB Flash display, but the SD items were empty. So I went to the register and asked if they had SD in stock. The salesperson proceeded to show me an SDHC card. I told him that was SDHC and I needed SD. He said "same thing." I told him no, and he came up with a 2 GB SD card.

The reason people go to Radio Shack certainly can't be the helpful, knowledgeable salespeople.