privacy implications of cloud-based security

in my continuing efforts to get caught up on my rss feeds (i'll get there eventually) i came across an interesting post at the stopbadware blog about establishing expectations for av vendors. it raises some interesting concerns about data collection and lack of transparency / informed consent.

this is a tough call. recall that when trend bought hijack this and added a button to send the log to trend for analysis people went ape over the idea that it was sending data without informing the user (even though the behaviour seemed clear to me just by looking at what the UI stated).

all cloud-based security inherently is going to collect data and send it into the cloud - that's how you leverage the cloud for security. clearly there is the potential for a privacy violation if the vendor isn't careful and there is certainly room for people to assume there already is a privacy violation. some people are inevitably going to cry foul if you tell them that their security software is sending data into the cloud.

and yet on the other hand if you don't tell them then they can't make intelligent, informed decisions about whether they want to accept the risk associated with cloud-based security technologies and so may fall into a false sense of privacy (not unlike a false sense of security).

i'm a big fan of informed decisions - i think that given enough information, reasonable people will be able to make intelligent decisions and hopefully that works out in the vendor's favour (if they're doing enough to protect customer's privacy).

i think security vendors absolutely need to inform their users, and i think the failure to do so should be considered a badware sort of behaviour. i think the risk of backlash can be mostly mitigated by informing the user HOW their privacy is being protected in spite of the data collection (ie. exactly what data is being collected and how the data is being anonymized - maybe even let them audit the data being sent). assuming the vendor is doing an adequate job of protecting users' privacy, only unreasonable people should continue to have a problem in the face of such transparency - and there isn't really much you can do for unreasonable people. all cloud-based technologies involve data collection, so those unreasonable folks will simply have to learn to be reasonable or seek out one of the dwindling number of products that don't have any cloud-based components.

badware busters - a 'me too' effort

i read yesterday that the folks at stopbadware.org and consumer reports webwatch are starting a community called badware busters to help ordninary people get malware off their computers...

the stated reasoning is that there's no central place where people can get this help, and they're correct there is no single central place, rather there are dozens of them... some of them even have the slashdot-esque features that badware busters seem to hope will set them apart....

that is if the folks at badware busters are even aware that there are so many communities already doing this... i'm really not sure what they're thinking or how they expect to become the central community for this sort of thing when there's already places like wilders security forums, castle cops, the communities that just about each and ever av vendor seems to set up, the long list of communities you can go to for help with hijackthis logs (and generally don't deal exclusively in hijackthis log analysis), various usenet newsgroups, etc...

dare to dream, guys/gals, but i just can't see you displacing all the other communities that are already out there (and castle cops takes this kind of assistance giving very seriously) and becoming the place to go for all your malware removal needs...

google search malware warning

a while ago (2 months?) google added a malware warning feature to their search engine that utilizes the stopbadware.org project and looks a little like this


i only saw it first hand for the first time today (despite being an avid google user) and i already have concerns...

the first is that you don't see the warning until you click on the result from their results page... why not save the user some hassle and just mark up the results page like siteadvisor does? i mean, really, it shouldn't be that hard (it might make siteadvisor redundant, however)...

the second is worse, however... of the options it gives the user for continuing from the warning page, the easiest one for the user to choose is to go on to the bad site... this is backwards - if google really wants to help people they should make the safest option the easiest one to choose - that means it needs a backlink, a box to enter a new query, and something that makes it more difficult to click on the mal-link like a checkbox that says "i understand that the site contains badware and want to visit it anyways" that must be checked before the mal-link can be click on...

come on, folks... this is basic secure UI design, surely all those big brains in the googleplex understand such a basic principle as making the right choice the easiest choice...

stopbadware.org should check their own sources

in the recently released report on kazaa, stopbadware.org states:

Sharman Networks claims that Kazaa has "NO SPYWARE", based on a highly restricted definition of spyware (namely, that no personally identifiable information is sent by the program). However, Kazaa's installation includes several bundled programs that are considered spyware under the common definition of spyware as software that subverts the computer's operation for the benefit of a third party (see Anti-Spyware Coalition and Wikipedia's article on "Spyware").

unfortunately, if they'd actually read the anti-spyware coalition's glossary they'd know that in technical settings the anti-spyware coalition uses a definition not unlike sharman networks' definition...

this isn't a deal-killer... at least some of the adware bundled with kazaa is also spyware (even by narrow definitions like my own or the anti-spyware coalition's narrow spyware definition), so sharman networks' claim of no spyware is false...

the problem is what is being communicated to the reader... stopbadware.org is using wikipedia's entry alone as their definition and in my experience wikipedia is not a good authoritative source (a fine informative source, mind you) on much of anything malware related... as the anti-spyware coalition's glossary clearly states, that is not the industry agreed upon definition for spyware - it is a colloquialism that they are forced to recognize in popular usage...

so what? well think about this: with the people backing stopbadware.org, they are invariably going to be regarded by most as authorities in the field - so their use of colloquial definitions rather than formal technical definitions will only serve to reinforce the misconceptions those colloquial definitions represent and lead astray those members of the public who are actually trying to distill meaning out of the various souces in this field...

part of me is tempted to say oh well... after all, what do you expect from people who invented the term "badware" (apparently not aware that the "mal" in malware comes from latin and means "bad") to describe "malicious software that tracks your moves online and feeds that information back to shady marketing groups", which basically boils down to advertising-related spyware (which is a much more descriptive term, come to think of it)... but you know what, misinformation coming from a source this high profile and seemingly authoritative is just not a good thing...

practical suggestions for bundling adware

i was reading a blog post over at stopbadware.org about adware bundling and it struck me that there doesn't really seem to be much in the way of constructive practical suggestions for those software developers who are in the unfortunate position of needing financial assistance from an adware company...

as the stopbadware post suggests, if the adware you bundle with is bad you are going to be held accountable for it's actions because you chose to bundle it so lets go through some steps that may help to avoid that...

1. be up front about the presence of the adware, say right on your front page or on your download page (and not in a small font) that the software is ad supported... you should even go so far as to specify the adware provider so that people downloading your product know what they're getting... i know this will probably drive away customers because of the bad name adware has (often deservedly so) but if you don't tell them then it will be much worse for the long term viability of your product... better to have slow adoption than a big backlash...
2. take personal responsibility for the quality of the adware you're bundling - make sure it's not buggy, make sure it doesn't contain spyware or take any other actions that would send personal information back to anyone, make sure it doesn't install silently/secretly, make sure it uninstalls cleanly, make sure it doesn't install anything unexpected or provide a platform for advertisers to install things secretly/silently through the ad windows themselves, make sure it doesn't interfer with what the user is trying to do by popping up lots of windows or playing with window z order or any other tricks to put their ads overtop of what the user is working on...
3. make sure your contract with the adware company clearly specifies what kind of behaviour is acceptable from their adware so they can't play any kind of bait and switch game using an innocuous test version and an offensive upgrade, and make sure they can't change the terms of that contract unilaterally...
4. research the company's history in order to get some idea of how likely they are to keep their word/not violate that contract, also to get an idea of what kind of ethics they've displayed in the past and how good they've been about fixing bugs and addressing concerns...
5. keep up to date on issues relating to the adware in your bundle... for example if there's a bug, post information about it on your site and direct affected users to where ever they need to go to correct the problem...
6. inform your users of the exact measures you go through to make sure the adware you're bundling with is safe for them to install...

i know that sounds like an aweful lot of work but guess what, there's no such thing as a free lunch and making the choice to bundle adware isn't a way to get free money...

i don't know how easy it will be to find an adware provider that meets these requirements, perhaps there aren't any yet but you know what? adware companies don't get any money unless people bundle their software so as much as you may need them they need you too so don't be afraid to put some pressure on them to get the terms you want, eventually an adware company will come along that's willing to do business on those terms if there's enough demand for it... they're businesses after all and they have to bend to market pressure or go out of business... it's just another form of voting with your wallet...

and what should you do if you still feel like you have no leverage over the adware company? do what many groups of 'little guys' have done before you - organize... find like-minded software developers who also need the help of an adware company but are uncomfortable with the typical adware's shenanigans and go after what you want as a united group... and i'm not just talking about folks who haven't signed up with an adware company yet; there are plenty of folks who came before who wish their current agreement with their adware partner was better than it is - these are people who are in the market for a new adware partner and so can be added to your collective voice...