IRA FLATOW, HOST:
A recent survey of American voters showed that more than half - that's 55 percent - say that Edward Snowden is a whistleblower rather than a traitor. The Quinnipiac University poll showed that opinion about an NSA contractor who leaked those secret documents. That opinion crosses all parties, gender and income lines, with accusations and denials by Google, Apple, Facebook, Microsoft that Prism had open access to private photos, emails and records. With all those denials, people are still worried, and they're looking for ways to keep where they go, what they send and whom they talk to, keep all that stuff private.
Your data on the Internet, you know, really has never been private. If you sign up for Gmail or Facebook, you agree that they can grab your information, too. But disclosure about Prism has gotten many people really upset, and they want to know what they can do about it. There are a few services that may make your online surfing a little more private, and we'll be talking about them today. Our number is 1-800-989-8255 if you'd like to join in our conversation.
You can tweet us @scifri, S-C-I-F-R-I. Let me introduce my first guest. Jon Xavier is a digital producer for the Silicon Valley Business Journal, and he has tested out a few of these services. He joins us from Stanford University. Welcome to SCIENCE FRIDAY.
JON XAVIER: Hi. Thanks for having me.
FLATOW: You know, I was actually experimenting with some of these myself yesterday and today, about stuff that you can do, and there are something like secure private browsers. There's Tor. There's search engines that say they're the most private thing in the world. Is that true?
XAVIER: Yeah. Well, you know, after the sort of the news broke about the NSA snooping, I wanted to look into it and see, you know, what the real options were for people that wanted to protect their privacy. And it's true. There are a lot of secure options that are available on the Internet right now. Many of them are free, which is great. But one of the things I did run into is that when you are looking to secure your privacy, there's sort of a continuum of privacy versus convenience. So while there are a lot of services...
FLATOW: Right.
XAVIER: ...they're not always convenient as the services you might be used to. So it does take a little bit of work to secure your privacy online.
FLATOW: One of the Web surfing devices I used when I went to a website, it said we can not load the flash video. That would be a problem.
XAVIER: Right. Yeah.
FLATOW: So that's the kind of inconvenience you're talking about.
XAVIER: Well, what's interesting is a lot of people don't realize how much every website is gathering data on them, and a lot of that data is being used to sort of customize the user experience to you. So, for example, when you go on Google and you type in a search query, Google is, like, scarily accurate about what you're looking for. Usually, you find it in the first couple, you know, search results. You know, sometimes, it tells you what you're looking for before you even finish the query.
The reason it can do that is it's gathered a lot of data about you and what you're looking for, where you're at, what you've searched for recently, and it uses that to tailor that service to you. So if you use like a more secure search page, like Startpage, it's not going to give you as good a result.
FLATOW: All right. Jon Xavier - Jon, hang on - is with us. We'll be right back with Jon Xavier, talking about how some of the tools you can use if you want to surf more privately. We'll be back right after this break. Stay with us.
(SOUNDBITE OF MUSIC)
FLATOW: I'm Ira Flatow. This is SCIENCE FRIDAY, from NPR.
(SOUNDBITE OF MUSIC)
FLATOW: This is SCIENCE FRIDAY. I'm Ira Flatow. We're talking about online security, tools and tips with Jon Xavier, digital producer at the Silicon Valley Business Journal. Jon, I mentioned Tor, the Web browsing - what do you think of Tor?
XAVIER: Yeah. So, Tor is great. It's one of the most private ways you can browse the Internet. What it basically does is it's like - if you've ever seen a hacking movie from the early '90s, say "Hackers," they always say, oh, I'm going to bounce myself through a bunch of servers, so you can't trace me. That's basically what Tor does. It - rather than having you connect directly to the server that's serving up the website, it sticks a random amount of servers all over the world between you and that, and then it encrypts it so that that website cannot actually see where the traffic that it's receiving is coming from when it comes from Tor. So Tor is great if you want to disable any sort of Web tracking.
FLATOW: How about options for protecting searches? That's for Web browsing. How about something instead of Google Search?
XAVIER: Yeah, yeah. Well, one I mentioned earlier, obviously, is Startpage, which is a - one of a few sort of private search engines that have sprung up. They were kind of a thing a little while ago, because people were looking for ways to position themselves against Google. Obviously, it's the, you know, market leader. You need something to set yourself apart, and one of the things that people can hit on was privacy. So there are a number of ones. There's one called Start Page.
FLATOW: Right.
XAVIER: There's one called DuckDuckGo. What they do is, basically, they give you a search, and they don't track any information about you. They don't save your searches. They don't install any cookies. And the idea being that that way, if the government comes calling and says, give us information about this searcher, they don't have any information to give you.
FLATOW: And they also - some of them claim, you know, we're not made in America. We don't reside in America, and our country protects us from getting the data.
XAVIER: Yeah. Well, I mean, that's what they say. And certainly the - so Startpage is based in Europe, and Europe has much stronger privacy protections than the United States. That's why companies like Google are always getting sued by, like, the French government for, you know, having too much data-gathering on people that use their services. But at the end of the day, I mean, the sort of things that the NSA is doing are the kinds of things that, you know, intelligence agencies all over the world do. So there's that claim, and I'm sure that there's sort of the reality, and they may not be the same.
FLATOW: How about securing your email? What kind of email client might you want?
XAVIER: Well, it's interesting. Email is obviously - it's the big thing, because what the NSA was looking at was mostly email records. And there are a number of options to secure your email if you want. The most secure thing is obviously to set up your own email server, and then use a desktop client like Thunderbird, which has a pretty good plug-in called Enigmail that will encrypt all your emails before they leave your computer, so that there - it would be really hard to intercept those and read them. But that requires a bit of tech knowledge, obviously, to set something like that up.
So there're other options, like a service called Hushmail, which is basically an encrypted webmail server. So it's like a Gmail, but it's encrypted. It doesn't store the data beyond a certain amount of time. So it's more secure, although, that one comes with the caveat that they have worked with governments in the past to track criminals who are using the service to, you know, do crimes.
FLATOW: What about text messaging? Can you encrypt a text message?
XAVIER: Yes, you can, actually. And one of the great things about modern phone calls is everything is digital. So anything that you can send through a phone, you can encrypt. There's some great options for Android. There's an app called RedPhone, which is free, and it has a sister app called TextSecure, which is also free. And what they do is they encrypt your phone call and your text message before it leaves your phone. The problem with it is that, in order for it to be encrypted, you have to be calling or texting someone who also has that app.
And that's one of the problems you run into with a lot of these services, is that you - in order to really communicate securely, you have to sign the other person up. Edward Snowden even ran into that problem when he was trying to give these documents to Glenn Greenwald. He said I need you to encrypt your emails before I do this. And Glenn Greenwald came back and said, well, I don't know how. So, you know, there's - even for really savvy people, that's barrier.
FLATOW: Here's a tweet from Paul Sproge, who says: What about Bitmessage and Bitcoin?
XAVIER: Well, Bitcoin is not a communication paradigm. It's basically decentralized currency based around cryptography. You know, you can use Bitcoin. One of the problems with Bitcoin is a lot of the - at the end of the day, you can't buy everything you want to buy with Bitcoin. And so most people, at a certain point, needed to convert Bitcoin back into dollars, and they're going to have to use the major sort of currency exchanges for that - for Bitcoin currency exchanges. And the government has been cracking down on those hard. So it's become a lot harder to do Bitcoin purchases than it was in the past.
FLATOW: Let's go to the phones. 1-800-989-8255. Mark in Arlington, Mass. Hi, Mark.
MARK: Hi. How are you doing?
FLATOW: Hey, there.
MARK: Hi. I've been a software engineer for many decades, and I've been thinking for a while that I really ought to download Tor and try it out. But then I started thinking, well, you know, I'll probably be downloading the binaries, and how do I know that the binaries do what's claimed? Well, the alternative is to download the source code and compile it myself, and that assumes that I have the time to spend to read through the entire source code and really understand what it's doing, which most people don't, and most people don't even have the ability to do that.
And then if you want to take this one step further and get completely paranoid about it, you should take a look at an article I think was published in the ACM - Journal of the ACM sometime in the late '70s, early '80s. It's from a talk given by Ken Thompson, one of the inventors of UNIX, and it's entitled "Reflections on Trusting Trust." And it's an absolutely fascinating presentation on how they managed to come up with a way to sneak into a compiler, the ability for that compiler to insert surreptitious code into any code that it was compiling and have that - have the code that was sneaking this code in not actually even appear in the source code from the compiler itself.
FLATOW: So somebody is - so you're saying that you have to trust who you trust. You have to trust somebody, that they haven't put something, you know, inside the code that you're downloading. What do you say about that, Jon?
XAVIER: Yeah. Actually, I mean, that is a major concern when you're look at these cryptography-based or secure communications solutions. The real problem is that as a lay person, you know, even as a fairly sophisticated person, a developer, you'd often don't have the time or the expertise to really evaluate something, because cryptography is a science in itself. It's a very technical subject, and there's a lot of ways to get it wrong.
So a good example of that actually is a program called Cryptocat, which was a secure chat program. Basically, you could log in to a chat room. Everything was encrypted, so you could say that no one was snooping in on it. The problem with that is it was out for a couple of years. It was very popular, because it was really easy to use. Security researchers looked at that a few months ago and they said: You know what? Actually, this is completely wrong. They made some really rookie mistakes when they were implementing the cryptography, so that, in fact, it's no more secure than a regular chat program would be.
So, you know, as a user of Cryptocat, you have no way of knowing that. And even the developers probably thought it was secure, but they had made a mistake, and there was no one to evaluate that.
FLATOW: But isn't the Internet a little more self-correcting now, where everybody's looking at this stuff and putting out the word on, you know, channels we never had before chat rooms, comments, places like that?
XAVIER: Certainly, yeah. I mean - and that's really the way - I mean, there's no Consumer Protection Bureau for computer code.
FLATOW: Yeah.
XAVIER: So that's the way the word gets out. But Cryptocat has been in use for more than two years, and this only came out a couple of years - you know, a couple of months ago. So it's like all the people that were using it for two years thought it was secure, and it was only recently that people dug into it and found out that it was not.
FLATOW: Let me bring on someone else. You know how much the information in your email account is worth, but do you know what it's worth to cyber criminals? I want to bring on a guest who's trying to figure that out. Chris Kanich is an associate professor of computer science, University of Illinois at Chicago. And the research behind - he has a security tool called Cloudsweeper. Welcome to SCIENCE FRIDAY.
CHRIS KANICH: Hi, Ira. Thanks for having me.
FLATOW: Tell us what Cloudsweeper does.
KANICH: Cloudsweeper is a project that allows you to get a better idea of what the data in your account is worth to criminals, and try to get a better idea of how to control that data and how it gets stored, how it can be accessed in order to make your life more secure. And so we have two different tools that are available right now. One gives you an account theft audit that will take a look at and say, OK, well, I see you have a Twitter account, maybe an Amazon account, things like that.
Then we also know through looking at underground forums where bad guys are trading these accounts, buying and selling them, about how much those are worth to them. And so we can actually just tally up and give you a really rough, hypothetical guess about how much a cyber criminal could actually make by taking over your account and then selling everything that's inside of it.
FLATOW: Well, I'd like you to know that I used Cloudsweeper, and my account was worth a total of $8.
KANICH: Well, there you go.
FLATOW: But the other part that you're talking about, the idea that you can go through someone's Google mail and find out what's - passwords and things are stored in there, and what people can steal from you?
KANICH: Yeah. That's the other side of what we're doing here. And so beyond the account theft audit, we're also taking a look at what data is actually stored in there. And the biggest part there is that as the Internet is maturing and as we can kind of settle down and, ooh, there's a new service here, a new service there, I know I've had my Gmail account for coming up on eight or nine years now.
So what are the chances that somebody emailed me something that I don't necessarily want others to see? And because Gmail just lets me store this stuff for free, you know, years and years and years of data. If a bad guy got in and said, well, I don't just want to use Chris' account to send some spam. I want to use Chris' account to dig through and find something that I could actually use to make a whole bunch of money, maybe commit identity theft on him, things along those lines, that's what we're really trying to look at and help people control by saying: Let's find what data in here is a liability for you instead of...
FLATOW: Right.
KANICH: ...something that's useful for you, and try to put a damper on that, maybe make it harder to access, or maybe make it so that you can only access that in certain ways after encrypting it, things along those lines.
FLATOW: And it tells you what to get rid of. Does it tell you what dangerous things are in there?
KANICH: Yeah. So this is the beginning of a larger project. And the first thing that we thought of is, well, there are a lot of services that aren't so good at security, and they have been known to send you your password back in the clear. So say I sign up for a free service, and I'm like, OK, this is my super-secret password. I don't want to use it for anything else. And then they say, oh, thanks for signing up for this service, Chris.
If you forget, your password is blah. And while a lot of services have gotten a lot better about this, there's a decent chance - and as we've seen by looking at this that there is a whole lot of stuff in there that people don't necessarily want to keep around. So trying to sweep up what's in there is probably a good idea if we're going to be keeping these accounts for years or decades.
FLATOW: And if people want to get a hold of Cloudsweeper, they can just find it on the Internet.
KANICH: That's correct. You should be able to Google search for Cloudsweeper right now, and it'll be in the top few results.
FLATOW: Jon Xavier, what's your comment on that?
XAVIER: I mean, I think that's a great tool, because it's - one of the first things I think you need to do when you're thinking about security and privacy is you really need to understand what's at stake. And a lot of people, I think, don't realize how central their email is and how having their email compromised could compromise pretty much every other service that they use online.
So doing a real security audit and finding out, you know, what their exposure is, I think that's a great - that's a great first step for anyone to take.
FLATOW: This is SCIENCE FRIDAY, from NPR. I'm Ira Flatow, talking with Jon Xavier, and also with Chris Kanich. How about Twitter? So many people use Twitter. Is Twitter a - can you make that secure? Is it possible?
XAVIER: Well, not really. Because one of the issues is with the services that a lot of people use - Twitter, Facebook, things like that - they are not going to want to do this sort of cryptography that you would need to do to really protect yourself from something like the NSA. The saying kind of in Silicon Valley is that if you're using a service and you don't pay for it, you are the product.
And what that means, basically, is that companies, basically, that give free services are a lot of times making money by capturing data about their users, and then using that to make money either by selling ads or selling it to other people. You know, that's sort of Google's model. That's Facebook's model. Twitter does that, to a certain extent, as well.
So there's not really a motivation there for these companies to want to secure themselves the way you would need to, to protect yourself from the NSA. But there are alternatives. You can use other types of peer-to-peer social networks - Diaspora, something like that. There's one called Mask, which is actually encrypted. And then WikiLeaks, the leaking site, actually has its own social network called FOWL, Friends of WikiLeaks, which you can use, where all the things are encrypted before they reach the server.
FLATOW: How about...
XAVIER: Of course, then you...
FLATOW: I'm sorry. Go ahead.
XAVIER: Of course, the problem there is you have to sign up everybody you know in order to social network with them.
FLATOW: Well, some other service you have to sign up is Skype. How secure is Skype?
XAVIER: The answer is not very. The problem there is - so Microsoft was one of the companies that was sort of fingered in this leak, and just recently, actually, just yesterday, there were some memos that were released about how much they were actually providing to the NSA. And one of the things that Skype is actually - Skype calls are encrypted, but apparently the NSA had data access to it before it was actually encrypted.
So, you know, a service like Skype, it's like - just like anything else. It's not going to be as secure. I mean, there are alternatives. There's something called Silent Circle, which is actually an iPhone app that provides, among other things, secure, encrypted video chat.
FLATOW: Hmm. Any other ones in about - we have about a minute left. Any other services or apps you might suggest?
XAVIER: One I really like - if you guys use Dropbox.
FLATOW: Yes.
XAVIER: Dropbox is great, but that was one of the ones that - one of the memos that was leaked, said it was coming online. So if you want to do file storage and synching, there's another service called Tresorit, which basically encrypts your file before it gets stored on the server in the cloud. So what that means is, basically, if the NSA wanted to get access to that, all they would be accessing would be an encrypted file which they would have to then decrypt, which is a big problem for them.
FLATOW: Mm-hmm.
XAVIER: So that's a good alternative to Dropbox. It works basically the same, almost identically.
FLATOW: What about Boxcryptor? I know there was - there's one that - or would any one that encrypts in advance of you dropping it into the drop box work?
XAVIER: Yeah. Well, the main thing is you want it to be client-side encryption. So you want it actually encrypt before it gets to the server. If it encrypts on the server, you run into the same issues that you would with Skype.
FLATOW: All right. Thank you gentlemen very much. Very interesting stuff for us. Chris Kanich, associate professor of computer science at the University of Illinois at Chicago. Jon Xavier, digital producer, Silicon Valley Business Journal. Thank you both for taking time to be with us today.
KANICH: Thank you.
FLATOW: We're going to take a...
XAVIER: Thanks a lot.
FLATOW: You're welcome. We're going to take a short break, and when we come back, we're going to talk about UK SETI. SETI is being set up in, you know, search for extraterrestrial intelligence in the UK, also. So stay with us. We'll be right back after this break. I'm Ira Flatow. This is SCIENCE FRIDAY, from NPR. Transcript provided by NPR, Copyright NPR.