“Sex, lies & instant messenger” - Alec Muffet at Hacks/Hackers

Tonight is the last Hacks/Hackers London meet-up of the year, featuring Stephen Grey and Dan Mcquillan, but delving through a folder of notes the other day I find these I made on Alec Muffet’s Hacks/Hackers talk back in August but never got around to posting. So here they are.

Alec Muffet spun a terrifying tail of the information exhaust that we leave around the internet. The dubious, but entertaining, premise of his talk was to give a list of things you shouldn’t do if you are trying to have an affair. He suggested...

Don’t use secrets as passwords. Passwords are guessable, and can give you away. Why is your password also the name of the intern dear?

Passwords can also be used to deduce other information about you. It is quite common to choose a password of someone of the gender that you fancy. Think about what that might say about your sexuality to anyone who was able to steal it.

Password re-use is self-incriminating.

Don’t use Skype to conduct an affair. It is almost impossible to delete records of Skype conversations. Even if you uninstall the software, next time it is reinstalled it will do its best to recreate the peer-to-peer conversation records it previously held.

Don’t let apps have access to your direct messages on Twitter.

Think carefully about your privacy settings on Facebook. “Friends of friends” is a very different proposition to friends. If you have 120 friends, and they each have 120 friends, you’ve potentially opened your data up to 14,000 strangers. Your Facebook account is “too rich a software ecosystem to viably trust it with secrets.”

Don’t use Android phones. All the data is remotely backed up and held by Google. If you need to destroy the evidence, hammering the phone to smithereens will not help you.

In fact, don’t use Google.

By this point, the audience were now convinced that they in fact shouldn’t use any tech for anything at all, let alone conducting an extra-marital affair.

And it got worse.

Alec talked about the kinds of things that developers do for “recreational computer forensics”. Like enumerating all the possible URLs on Twitpic, and running the resulting images through a program that detects fleshtone to find the ones that might be the most “entertaining”. Or buying old hardware from eBay and undeleting everything on it for the fun of the challenge.

As everyone in the room mentally renewed their vows of fidelity, Alec made a more serious point. All of these techniques can be used not just to discover and provide evidence of an affair, but also of evidence that a journalist has been contacting a source. When using the all-pervasive technology of our age, journalists need to be aware that they are leaving digital footprints everywhere.

What did he recommend?

He suggested creating disposable web identities, using unique, tricky, random passwords each time. “You need to keep your digital life partitioned” he said.

He suggested making use of different profiles within a browser like Firefox, with it set not to remember anything. “You want it to reset to stupid every time you switch it off.”

In terms of covering your tracks and disposing of data on gadgets, Alec said “if you have any doubt, drive a car over it a few times.”

And, echoing the dilemma that always seems to happen when someone mis-tweets i.e. ignore, apologise or delete, he suggested that “when mistakes happen, clean up calmly and do not amplify the mistake.”

A bit like if I spill red wine, and in my panic can’t remember if you are meant to clean it up with white wine, vinegar, salt, scrubbing it, not scrubbing it, or just by having more red wine...

Mary Hamilton made a Storify of the talk, and you can view the original slides here.