They know you more than you

Privacy is one of the most talked about topics of the information age. With more and more information generated it's bound to aggravate. As I see it privacy is two fold in our usage. One is the derived form (non-voluntary). The other is more straightforward where we submit our information to another party (voluntary). Many people are knowledgeable on what they submit to the World Wide Web or at least intrinsically think twice before doing so. If not, at least a bit of commonsense would do. This is of course assuming that you're really bothered about your personal information and hence privacy. But what about the other form, where someone else derives certain information on you based on various data? Additionally, you may think on the lines of a personality test. The first (and the last) time I sat for one, I scored pretty well. But a web based company could be in a better position of judging you with the amount of information gathered throughout the years. I intend of giving you some goose bumps largely based on these.

When we upload photos to Facebook, or post crazy status updates we are well aware of who could see them and the fact that Facebook stores it on their servers. Furthermore these sites have their own 'Terms of Use' & 'Privacy Policy' posted publicly although more often than not people really don't care reading them. As per internet statistics, the most popular, used and visited websites are Google, Facebook, Youtube, Yahoo, Live, etc. and are run by US based companies. This eventually creates a certain web centricity towards a certain geopolitical location as well. This blog is no exception either. Privacy when coupled with politics can be a tricky issue, where it's sometimes even referred to as intelligence. But the gravity of infiltration, harnessing and action taken upon depends on the country's laws and regulations.

Just imagine the amount of information your Gmail or Yahoo mailbox contains. From passwords & bank/credit card account information to communication with crushes, your fetishes and even porn are only a few to mention. Not excluding religious and political stuff as well. And it's not only free web mail services, but chat software such as Gtalk, Yahoo, MSN, etc might record your chat history although you may have opted to go-off the record. If you think that's all, just consider the amount of searching you'd done throughout the years using all those popular search engines. What's the assurance that these companies wouldn't store your search queries or for that matter any personally identifiable information including location data. Google even has a function that allows you to delete/manage your search history termed 'Google Web History'. So if you're still the kind of person who thinks that Google doesn't know anything about your multiple accounts, I say wakeup! that's such an insignificant thing.

Data mining technologies are the most used in deriving information or patterns from this data. In fact, our search & browsing patterns, Facebook likes, email contents and anything similar is sufficient of determining our personality and interests. This helps in creating a somewhat virtual personality of you. The integration or interconnection of social and other major web platforms have only helped it.

Then there are the types who say, "So what? I don't care what any web company or country knows about me, I feel totally OK with it". Actually I myself belong in that category. The purpose of this post was to enlighten the extra-cautious individuals who aren't very comfortable with this issue and not to drive you off the web. Who knows, someday we might just have to admit that's how it is. After all, wouldn't it be nice to see Google predict what you'd be up to this coming weekend? ☺

Now why do I hear someone mutter "creepy…".

You have a new text message (email)!

Few months ago I was having a requirement of getting notified whenever my office mail box received an email. The preferred notification-media was SMS. So basically whenever there was a new email to my official email account, I would get notified with its subject and sender via sms.

Now then, there were several obstacles I had to conquer in order to accomplish this task.

1. Accessing & Reading my email inbox hosted at the place I work.
2. Accessing it frequently (at least every few minutes).
3. Hosting the program (script) that would do the above, on a server that’s available throughout the day.
4. Protecting sensitive/personal data from third parties (in this case it was my password).

Our office uses a Microsoft Exchange Server as its mail server. Performing programmatic tasks on MS Exchange using PHP was a very rare occurrence. So I had to rely on Mr. Google in seeking a suitable code snippet that would help me in this endeavour. And guess what, I did stumble upon a blog on how to use XML-formatted WebDAV requests to fulfil my requirement.

Building on it I developed a modified version of that script, which would send an XML request to the server, read the response (it was XML too), process it, check for new mail messages, log it (because I need to keep track of what’s new & old), and sms it to my mobile. An sms was sent for each email in case of many.

I could see the inquisitive mind wondering… ;-)

A facility called ‘email2sms’ provided by my network operator was utilised in delivering the sms to my handset. This whole process was carried out every 5 minutes and the scripts that were responsible of performing this function were hosted on two web servers hosted elsewhere. That’s because my office PC is powered on during office hours only and email relaying to external destinations aren’t allowed. Moreover I don’t have permission of using the office web server for this purpose. Keep in mind that these weren’t mentioned as obstacles at the beginning of this article, as this doesn’t serve any official purpose but one of my ‘private’ needs.

Hence, I had to host the scripts on two web servers situated in different places, they both belonging to a couple of my friends (thanks guys). These servers are operational 24*7 and the every-five-minute request was handled by a simple Linux cron job.

Did you notice me mentioning 2 web servers? Wondered why? This is to overcome obstacle no. 4. In the aforesaid script there arose a need of hard-coding my email account’s password into it. This is required for the script to access my inbox since credentials need to be given. But if anyone was to open up and read the script (this wouldn’t normally happen, but my contentment of information security wouldn’t be satisfied otherwise) my password was there for his/her taking. To avoid this happening, I considered the use of cryptography.

Using the MCRYPT_CAST_256 cipher I was able to generate the encoded (cipher) text and a relevant key. The key was hosted on the server that initiates the request while the decrypt function and cipher text were on the second. The latter would perform the core activities mentioned earlier. Splitting these elements was necessary as it would make no sense to have the key, cipher text and decryption algorithm in the same place. If anyone was to try fetching the password on the second server by performing a ‘cipher text only’ attack, still they would need an extensive amount of brute-forcing to be performed. However this was evaluated by me as computationally secure for a long time.

Something worth mentioning is the disguising of the key when it’s transmitted from the first server to the second; care was taken to avoid any logging on the latter’s part so that no readable trace of it was leftover.

Although I’m not using this service these days (cos spammers occupy a decent share of my inbox ultimately filling up my sms inbox too!), the learning and application of learned theory was something to admire in solitude.