14-05-2020, 08:53 AM
A fair chunk of my career, which is still ongoing, is in CTO roles in the finance industry where security is a key concern.
This includes PII (personally identifiable information), which is leaked everywhere and all the time and was one of the key drivers behind the GDPR regulations. Just having a mobile phone leaks all sorts of metadata.
e.g. WhatsApp may be encrypted end to end (and it is, unlike zoom who made that claim but were not) but the app leaks metadata like crazy to Facebook, who own them: number contacted, friends, message size, attachment types, location, phone type and os version, signal quality, numbers contacted (and by association, the numbers of your called or calling partner), the groups you are in etc etc.
Which is why, of course, many use Signal for anything sensitive.
Most of the social media and many other apps are just as bad. Websites are often not great either...
There is a tonne of stuff that is of little or no interest to the public at large, but it's a fascinating and complex field. Network security is a miniscule part - security has to be looked at holistically. The biggest risks are the humans involved in any system - they are relatively easy to compromise.
One of the issues is that folk agree to the privacy policies of the app providers without reading them - WhatsApp do say what they collect, but only a tiny fraction of folk read that before agreeing or declining.
There's risk everywhere - as with everyday life, what you need to do is:
Edit: note that whilst you can do a lot to protect yourself, you cannot defend against a state-sponsored actor, e.g. GCHQ, NSA, Unit 8200, or indeed any of the APT groups.
If they want your data, they'll get it.
This includes PII (personally identifiable information), which is leaked everywhere and all the time and was one of the key drivers behind the GDPR regulations. Just having a mobile phone leaks all sorts of metadata.
e.g. WhatsApp may be encrypted end to end (and it is, unlike zoom who made that claim but were not) but the app leaks metadata like crazy to Facebook, who own them: number contacted, friends, message size, attachment types, location, phone type and os version, signal quality, numbers contacted (and by association, the numbers of your called or calling partner), the groups you are in etc etc.
Which is why, of course, many use Signal for anything sensitive.
Most of the social media and many other apps are just as bad. Websites are often not great either...
There is a tonne of stuff that is of little or no interest to the public at large, but it's a fascinating and complex field. Network security is a miniscule part - security has to be looked at holistically. The biggest risks are the humans involved in any system - they are relatively easy to compromise.
One of the issues is that folk agree to the privacy policies of the app providers without reading them - WhatsApp do say what they collect, but only a tiny fraction of folk read that before agreeing or declining.
There's risk everywhere - as with everyday life, what you need to do is:
- Identify the risks
- Mitigate all that you reasonably can
- Accept or reject what's left
Edit: note that whilst you can do a lot to protect yourself, you cannot defend against a state-sponsored actor, e.g. GCHQ, NSA, Unit 8200, or indeed any of the APT groups.
If they want your data, they'll get it.
sıʌǝɹq ɐʇıʌ `ɐƃuol sɹɐ
ʞɔıu
ʞɔıu
