NetSafe TV 16– 22 May (2m):

Related links:

• Google Street View ’single biggest breach of privacy in history’
• Online list puts street in touch
• Online expert: Shocks will turn to yawns
• MGM v. Grokster

dee dellee dee dellee (x-files music)

At some point around April in 2009, the Google blog announced the release of another one of it’s many products: Google Profile. My friend Rory was telling me about this yesterday because he uses it with his Android enabled smart phone to great success. I say great success because, a.) he has an android smart phone (see Chris H’s posts for more on netsafe staff smart phone lust) and, b.) he has ’starred’ certain contacts on his android phone, and those contacts get special entry to his google profile. This means they get more information about him because they’re trusted viewers that he has decided to share more info with (kind of like friends on Facebook as opposed to network members).

You can include, for example, links to your blog, online photos, and other profiles such as Facebook, LinkedIn, and more. You have control over what others see. Your profile won’t display any private information unless you’ve explicitly added it.

Sounds promising. So with due scientific rigour A-B testing blah de blah I took a screenshot of my current google digitial footprint:

It’s a bit small here but, it’s pretty standard – NetSafe links on my name for the two entries, then a zoominfo aggregate of me, Facebook and LinkedIn portals, another NetSafe and then a report from my research project on sexual violence. So on the whole, I’m doing pretty well anyway, with Facebook and LinkedIn high up the list. Time to see what happens after I do my Google Profile.

So, as I go through it’s all pretty obvious. I’m not sure why Google wants to know where I have lived and what Universities I went to, but whatever. There’s a mildly annoying condescending geek question “what is your super-power” – which I think is totally unnecessary (everyone already knows I am ginger). Google, also found my youtube login associated with my account and put that on there for me to keep or remove. I could supposedly add other accounts, but I had to go back to my google search on my name to get the specific URLs for my facebook and linked in pages (as Facebook hides the URL once you’re on there). Anyway, done all that. Uploaded my photo and submitted and I am on the web! Again. University info and all. It turns out the where have you lived bit, is for the pin-up map thing – and somehow to make it easier to find you when there are multiples of your name.

Then I get to part 2 of this where I can add all the ’scary’ bits (actually it turns out I could have done that before but it was just on another sheet of the sign-up page – not overly intuitive). Anyway, email, phone all added in – and I am given the option to share this info with all my contacts on gmail or a subset of them. So this only makes this part useful for people with a gmail account (and with contacts on their gmail accounts). Anyway, I’ve done that and made a customised group who can view my contact details (Note to self – ask Rory about ’starring’).

Now it’s time for the test. I re-enter my name on google and get Chris H to check too:

BaaBow. Fail. Nothing changed on my Google name search. Perhaps it will take a while to populate through the web. Back on my profile page, clicking on the “your profile may be featured” link, I am given another page on with tips on making my profile more useful, including this wee gem:

When you or others search for your name on Google, a link to your Google profile may appear at the bottom of the search results next to your profile picture.

I love the “may appear” caveat! I will report back as soon as the situation changes. In the mean time at some point hopefully I will have a profile on Google that will give my friends my contact details and give others the opportunity to email me directly without knowing my email address. That’s cool.

The challenges will come when people set up false and/or abusive profiles about other people. Google offers the ability to verify your profile, but this seems more about giving a profile a bit more credence than another – and actually just going there gave me absolutely no direction about what I was supposed to do there – so points off for not easily finding how to report abuse of the google profile, finding ways to actually authenticate it, not actually being there when finished, but kudos for enabling people to author their own contribution to the web – well on Google anyway.

Ok, so maybe the two companies have been battling it out for years already, testing each other’s defences. Some quick examples – Google ‘owns’ web search so Microsoft invents Bing. Microsoft has a big share of the handheld PDA market so Google comes up with Android to appeal to smartphone users. Microsoft is office productivity software for the masses but Google goes the software as a service route and launches Google Docs.

Yesterday things moved up a notch with the announcement by Google that they’re working on the Chrome Operating System. This is big news – maybe not on the scale of the death of Michael Jackson – but it had the bloggers and tweeters of the world reaching for the hyperboles.

Take the TechCrunch headline: Google Drops A Nuclear Bomb On Microsoft. And It’s Made of Chrome. MG Siegler describes how Google is going to be seeking help from the open source community and writes “They might as well set up enlistment booths on college campuses for their war against Microsoft.”

But how does this affect the world of cybersafety? It might just be a dig at the company famous for the blue screen of death but one paragraph in the news release stands out by a mile to me:

…we are going back to the basics and completely redesigning the underlying security architecture of the OS so that users don’t have to deal with viruses, malware and security updates. It should just work.

How about that for bold? Once I have my netbook running Google Chrome I won’t have to worry about anti-virus software, keyloggers and trojans. The machine will be safe and secure and I can do my online banking, email my friends and family and carry on as a good cyber citizen safe in the knowledge my OS is insulating me from all those net nasties. Or can I?

NetSafe’s NetBasics project last year was designed purely to educate New Zealanders about the need to keep up to date with computer security issues. The key messages:

• run anti-virus and anti-spyware software
• update your OS and software applications regularly
• use a firewall to protect yourself from port scanning

So if Chrome OS solves the most common Windows security issues – it just works – does that mean NetSafe can rest easy? If only that were true.

The financial community certainly reacted to the announcement:

Investors seemed to be betting on Google Wednesday as its shares rose $5.86, or 1.5 percent, to close at $402.49. Shares in Redmond, Washington-based Microsoft inched up 3 cents to $22.56.

Whilst I admire Google’s efforts to tackle the obvious point that “computers need to get better”, it faces several major hurdles before cybersafety experts can retire.

Firstly, Google may have armies of engineers ready to crank out code, but even they can still make mistakes when it comes to writing operating systems as was witnessed when security expert Charlie Miller exposed an Android flaw that let hackers hijack the Web browser on the just released G1 phone. (My NetSafe colleague Lee Chisholm attended the latest New Zealand Information Security Forum breakfast briefing yesterday where the lack of smartphone security was highlighted).

Secondly, when the company speaks the world certainly listens. But that doesn’t always convert into the world getting up and embracing the new technology on offer. Just look at the uptake of the Chrome browser – trumpeted in September last year it has only managed to claim a tiny share of the web browser market, precisely 2.3% of NetSafe website visitors.

Most importantly though, Google will never be able to fully solve the biggest problem of all – the human user. No matter how safe your operating system is, cyber criminals and scammers in general will always be trying to stay one step ahead. Curiousity and a general desire to keep up with current events are just one human trait exploited by those looking to steal passwords.

NetSafe and other organisations around the world will continue to educate internet users on the need to keep passwords secure, avoid dangerous downloads and delete phishing emails. And we haven’t even started on digital footprints and securing your workplace IT.