Security

To Keep or Cancel Linkedin

by

In my part 1 of My Great Social Media Purge of 2019 i outlined my objectives with assessing my use case of each social media platform I use. Part 2 covered Twitter. Part 3 covered Reddit. In Part 4 I will cover Linkedin. its a short one since the decision was pretty straight forward.

Linkedin is a tough one. I feel for professional reasons it is necessary. The data mining that is creepy in other platforms may land me a job opportunity on Linkedin. Funny irony right? I would like to remain blissfully unaware of anything creepy that happens on this platform or what they do with my data. That way I will not dig further into it and get spooked by whatever I find.

I even need to use this platform more to promote myself professionally. Its a keeper. So if you have creepy stories about LinkedIn, I do not want to know.

To Keep or Cancel Reddit

by

In my part 1 of My Great Social Media Purge of 2019 i outlined my objectives with assessing my use case of each social media platform I use. Part 2 covered Twitter. Part 3 covers Reddit. Yup i started reading some stuff on Reddit.

I started using Reddit in 2019. I broke down and signed up. I haven’t posted anything. I joined a few sub-Reddit’s. That in and of itself helps build a profile on me and what I like and read. I am not a fan of that. I do find following along in each community I find informative. It is targeted discussions and some of them have been useful. That value however comes at the price of Reddit knows I am interested in specific things. For now I am not really sure if my lurking there for some information is worth that model on what i am interested in. For now I am paying that price.

I may just cancel my account and have direct links to some sub-Reddit’s i want to read. Then i could try to use a TOR Browser on VPN to just read without having the linkage to me. That work around does require much more effort to do so not sure if the cost benifit is worth it.

In the end I think I “should” delete Redit. That being said the cost “i think” for keeping it is low compared to other providers so I am neutral on it, for now.

To Keep or Cancel Twitter?

by

In my part 1 of My Great Social Media Purge of 2019 i outlined my objectives with assessing my use case of each social media platform I use. I am starting off with Twitter.

I surprisingly find value in using Twitter. I only ever post to twitter to share links to my blog. My reasoning is my blog is public anyway. At this moment I do not believe there is a downside to the linkage of my blog to my twitter account. I may come to regret that however for now I am ok with that linkage. I do have lists of peoples twitter accounts that i follow. Mainly i look at FinTech companies twitter accounts. Some security journalists and a few tech industry people. I also will look at a few comedian’s or The Onion. Even that information starts to build a profile on me. The limited amount of value there I am ok with.

Other uses for Twitter have been in the past I found huge value in having a list to track emergency management accounts. When i was in a pure operations role that came in very handy when Hurricane Sandy hit. Or when a few other big snow storms hit NY. Some of that linkage i am not happy with however that linkage would exist if i followed some of these companies or twitter accounts via Twitter or if i used an RSS feed.

As I wrote this post I unfollowed a bunch of people and friends who never post. What is left i am happy enough with. I think i will have to revisit Twitter again in the future however for now i am ok to keep using it the way i do. I may limit my usage (again) to a secured VM).

Verdict, for now a Keep.

My Great Social Media Purge of 2019 (Part 1)

by

In recent months i have been thinking (again) about my digital data in relation to my privacy. I have been thinking about what my objective is regarding keeping my digital data safe. From who, and why? This is topical because more and more details have been coming out about Facebook and other social media’s use and collection of data.

I have been pondering what my own personal next actions on my social media exposure was. Then I watched the Netflix Documentary The Great Hack. That movie reinforced to me that I am not able to justify keeping my some social media accounts. And the way I use others needs to change. First thing in my mind was do I keep or cancel Facebook. Even after scrubbing data off the account regularly there are just some things you cannot get rid of. I have been diligent not to post almost anything that is not already public. I just haven’t been 100% great at it all the time. The question that kept bothering me is what will I / can I do about it. That brought me to question what I was worried about? From there I started asking myself what my threat model.

I had to think for a while to figure out what is my threat model for data collected by social media companies. At first I just feel it is a bit creepy that any one company can have that much information on me. That is not a threat model. It just got me to further realise in this day and age there will be data about my life leaked to companies. What I do not want is one or a few companies having a huge collection of my life. That morphed my objective to see how can i minimise my data leakage so to speak. At the same time still getting value out of some of the services i use. That for me is the key. What am I really getting value out of? That is subjective to everyone. For me it came down to what is my social media use case? If I am going to keep hugging Twitter, Facebook, and even LinkedIn I should be clear to myself what my use case is of each of those services. Only then can I weigh the risks of what each platform collects on me. After that I can decide what I want to do about it. I use each platform and others for different reasons so each one has its own use case.

I got analyitcial and wrote up my own assesment of my use for each. As I wrote them out I realized this is more than one post. I will publish each as a post with their own summary of what i am going to do with the service. At present there are about 6 parts (this is part 1). First up on my list is Twitter.

This post is titled My Great Social Media Purge of 2019 (Part 1). I wrote it in the Fall of 2019. It is still very relevant however I only now am getting around to posting it.

The Last remnant of My Google Presence is Finally Swept Away

by

As of 9-September 2019 I have deleted my last Google account. I have not actively used Google services other than ocasuonally an android phone here or there in years. Up until now I kept my original Gmail account in case I need it. That was mainly for nostalgia reasons. I barely ever log into it. I haven’t used it actively in over a decade. After my abrupt stopping use of my Motorola G7 (see my post on that) I finally decided to take the final step in purge my entire Google presence.

Since I have deleted other accounts before the entire process was pretty easy to back up and delete everything. I have absolutely no regrets. More importantly its not even a nuisance (so far) that i don’t have an account. Every so often i want to save a YouTube video for referencing later. Pocket or Trello is great for capturing that stuff so my designer to have functionality google offers is fleeting.

Now all I need to do is nudge M a little bit to finish moving off of her Gmail account. I’m proud that on her own she asked me to set up a new domain name and email address for her somewhere else. We’ve been down this road before so we’ll see if she finishes migrating.

The State of My Private Cloud in 2019

by

I have been maintaining my private cloud network powered by Resilio Sync for a few years now. I have talked about it before. See this search for all those posts. When I built the original version of my private cloud the intentions were for it to provide a 321 backup solution for my stuff. The effort involved in maintaining the system turned out to be more time involvement than I would like. Overall even with more work than i thought it still has been largely a success for me.

At the time when I built the network my intention was to use Raspberry PI’s as my remote nodes. As my use of the system evolved that stopped being a viable solution. One of my first Raspberry Pi remote nodes had to be replaced. The drive i deployed just wasn’t big enough. That wasn’t a Pi specific issue. The next thing that happened was I ran into significant challenges around the amount of memory available on the a Pi II. Resilio would crash the Raspberry Pi. The reason was the app would consume all of the available memory until the OS froze. I had the same challenge on my Synology disk station at one point. That was fixable with a $15 4 gig memory upgrade. I was not able to do anything like that with the raspberry pi II.

To work around the limitations of the Raspberry Pi 2 was that I bought more powerful and thus more expensive computers. The two remote machines that I had running were fanless zotac z-boxes. They were great. The only downside was the cost that was significantly more than a pi. I bought a low-end Celeron version of the Zotac for around $150 plus memory and drives. The costs were about 4 times as much as a similar Pi 2 setup. At the time I had no good alternatives.

Then someone at work put me onto buying a Hardkernel ODROID-HC1 that was designed as a personal cloud type machine. It came with a case to put an internal hard drive in. The beauty of these machines were they had two gigs of memory and were not that much more expensive than a Pi 2 at around $50. I think I maybe spent $70 including memory card etc, not counting the hard drive. The hard drive was an internal one so cost to get one was cheaper than using an external one for the PI.

I purchased two ODROID’s within a year. One was at a friends house. The other was replicating data at home. I had problems with what I think was corruption of the OS on the SD card on both machines. The remote host had to be rebuilt twice. By the 3rd time it had a problem I gave up. I just didn’t want to spend the time troubleshooting it. I’m not sure why they continued to get corrupted. I still have one of them at home that has been pretty stable this year. I gave the remote one to my friend who hosted it for me. He was going to see if he could use it for something. The ODROID was a good idea however it did not turn into a long-term solution for me.

When I first started this private cloud project the public or consumer file storage services did not really offer zero knowledge encryption. The only service at the time that was financially viable for me to use was MEGA. I tried that out and it wasn’t seamless for me so I abandon a public cloud solution. I went with my private cloud. Today there are a few service providers that cater to people looking for zero knowledge encryption for remote storage. There still aren’t a lot of them however I was glad to see the landscape had evolved since I started this project.

I’m not sure what triggered my research into public clouds again. I started looking at what the cost benefit would be to go with a zero knowledge encryption public cloud provider instead of continuing to build my own network over last summer. I found a provider I liked, Tresorit. They ticked all the boxes for me on what I was looking for. The challenge was for 2 TB monthly cost over £20 a month. There only cheaper solution was not enough space for my needs.

When calculating the lifecycle of the hardware I buy for my own private cloud network versus the service costs of the provider it’s probably cheaper to keep doing it myself. Originally that was not true. From when I started this investigation in moving to a service provider until today there was a change in what kit was availible. The Raspberry Pi 4 came out. Having a need to replace the ODROID and possibly one Zotac at a minimum in the next 3 years would have been several hundred pounds. The Pi 4 was clocks in for the 4gig model at around £60 for the computer and all the accessories I needed minus a hard drive. I am recycling a hard drive so there is no additional cost there. When they announced the latest pi4 I immediately put in order for one of the 4gb models. My hopes were that it would perform well enough to use in my private cloud network. On paper it solves the memory usage issue of the Pi 2 & 3.

At the time of writing this I have had my first Pi 4 running in “production” for almost 3 months. The software has been pretty stable. I am running it within a docker container on a Pi 4. So far the system is consuming way less than 50% of memory. Ussually somewhere between 1 to 1.5 gig. One of the other clean up things i did was consolidate the many shares I had into 5 total shares. The Pi replicates 4 of them.

With the extra space i have on a remote node can also take local copies of the replicated data on that remote machine. That should complete my 321 backup strategy. Since I want to add extra resiliency into my plan I will continue to take annual point in time offline copies of most of my data.

Since I am reusing hard drives right now (i over bought on size I needed on the last upgrade and the drives are great) that means i can get another Pi 4 for £60 pounds and have a refreshed pair of remote nodes. I continue to use my Synology, my laptop, and a Linux server for the other nodes at home.

My costs this year are on target to be £60-£120. That is half the price of one year of cloud storage service. The new machines should give me 2 to 3 years of service easily. Especially since I’m deploying them with 5 TB drives and I’m only using about 1.3 TB for what I’m backing up today.

I am pleased that the build my own system is cheaper and continuing to work out vs the public cloud option. As long as maintaining the system is not a lot of trouble I picked the right option.

A Note To My Future Self On Why I Do Not Use Android Phones

by

In July before my trip to Bangkok i picked up a mid range Android Phone. I opted for the Motorola G7 since it offered dual SIM cards. I got the phone for less than 200 pounds. An iPhone that would do that was several times more than that. My need was for a dual SIM phone so i could keep my UK SIM and have a Bangok one. Then when I went to NY for most of August I would also have a US SIM and my UK SIM card.

My intentions mostly worked out the way i wanted it. As much as I prefer iOS for many reasons the new Android was ok. I liked the big screen for a cheap price. I wasn’t happy about some of the security trade off’s however i was letting that go and being in deial about it.

I then put in a Pi-hole as my DNS at home. Looking at the metrics from that made it impossible to be in denial as to how bad my Android phone probibly was to violating my privacy after i clicked on agreeing to whatever terms and conditions. The cover photo is a graph of my entire DNS queries in my house for a 24 hour period. The part on the right where there is a huge spike is purely my Motorola G7 making calls out to the internet. Doing what i am not 100% clear since i wasn’t using the phone. It just got on wifi and started phoning home alot.

The photo below shows that the same Android phone is one the chattiest device on my network at home and also gets its requests blocked more than any other device. For a phone that i dont use alot and wasn’t in my house for most of the 24 hour period measured that is pretty creepy. To put it in context M and i have iPhones and iPads and none of them get blocked or “talk” on the internet that much if we are not using them.

The Motorola G7 in question is being reset to factory defaults and wiped as I write this article. It will get sold on ebay shortly. This entire episode highlights why I had reservations about Android as a technology in the first place. It is slick however the trade off on my privacy is not worth it. i would rather save longer and keep using iOS.

Newish Challenges To Moving to a New Phone

by

It used to be all I had to do to set up a new phone was say restore from backup. I have many services tied to two factor authentication. I use several apps on my phone for that.

Nowadays that means before I can switch phones I have to remember to install the 2FA applications and configure them prior to wiping out the old phone. The challenge is that most of these apps do not restore when you restore from backup. That’s actually a good thing for security reasons however it is a gotcha I need to remember to pay attention to.

I was reminded of this when I got my iPhone XS Max for a few days last year before I decided to return it and keep my iPhone X.

Now I hope that I remember this critical step when I do eventually replace my iPhone.

The Great Facebook Purge of 2018

by

With the news in April about a 3rd party company stealing tons of Facebook user data is in the headlines it envouge to delete Facebook accounts.  For me I have limited my Facebook exposure for years.  I deleted my account once a in 2013 and started over with no content.  I have also limited what goes onto the platform.  Prior to deleting my account i looked for a way to purge en mass content.  Facebook suprise doesn’t make it easy for you to do that.  That was why i deleted my account in the first place.

Early last year I stopped looking at and updating Facebook.  Late last year I came back for specific reasons I wrote about here.  Those reasons still are valid so I do not want to go as far as deleting my Facebook account however I have little trust in their motives to collect so much data about me or their ability to safeguard that data.

Instead of deleting my account I found a script that sort of worked to remove content or hide content from the past 6 months. It scrubbed posts, likes, etc.  It is perfect for my use.  It should have worked for my entire timeline however i had issues with it. Thankfully I have been very sparce on my usage of Facebook over the years so cleaning up manually was not too bad. For anyone who used it every day for years may not be able to do the same thing.

What I am now left with is simply posts from my blog that are public on the internet. A few group discussions i took part in and mainly birthday posts from people. What I am not able to get rid of easily is tags of me in posts. I had to settle for manually hiding them from my timeline.

For many what i did in an hour or two would not be possible without significant effort due to the volume o content people post and the fact that Facebook does not let you easily get rid of stuff.