Monday, November 27, 2006

How to Fake Fingerprints

With all the buzz of fingerprinting this and that, fingerprint these instructions on how copy and fake fingerprints :

"In order to fake a fingerprint, one needs an original first. Latent fingerprints are nothing but fat and sweat on touched items. Thus to retrieve someone elses fingerprint (in this case the fingerprint you want to forge) one should rely on well tested forensic research methods. Which is what's to be explained here."

Bow to the CCC's full disclosure shedding more light on a common sense insecurity. While it can be tackled by both ensuring the quality of the fingerprinting process, and by technological means such as adding extra layers or cross-referencing through different databases, multiple-factor authentication's benefits are proportional with their immaturity and usability issues. Fancy? For sure. Cutting-edge security? Absolutely from a technological point of view. But when fingerprints start getting more empowerment and integration within our daily lifes, malicious parties would have already taken notice, and again be a step ahead of the technological bias on fingerprinting. Coming up with new identities may indeed end up as a commodity neatly stored in a central database, or perhaps ones collected from elsewhere.

Global Map of Security Incidents and Terrorist Events

Outstanding project demonstrating the benefits of open source intelligence positioned on Google Maps while providing you with the very latest global security and suspicious events in categories such as :

- Airport/Aviation Incidents
- Arson/Fire Incidents
- Biological Incidents/ Threats/ Anthrax Hoaxes etc
- Bomb Incidents/Explosives/ Hoax Devices
- Chemical Incident
- Dam Incident
- Radiation Incidents/ Smuggling/ Proliferation
- Chemical Attack
- Other Suspicious Activity
- Shipping/Maritime/Ports/Cargo/Waterways Security
- Assassination/ Assassination Attempt
- Railways/Train Stations
- Bus Stations/ Bus Security/ Bus Related Incidents
- Bridge / Tunnel Incidents and Security
- Shootings / Sniper Incidents/ Etc
- Terrorist Arrests/Captured/Killed Locations

No more "slicing the threat on pieces", now you can see the big picture for yourself.

To Publish a Privacy Policy or Not to Publish a Privacy Policy

Here's an article arguing that "publishing a privacy statement may be more harmful than not publishing one"only if enforcement, implementation and monitoring don't intersect as they should :

"This case demonstrates a complication relating to companies' claiming that they have security measures to protect their end users' privacy. Large, established companies, like Eli Lilly, understand this issue but may still have problems ensuring compliance to their privacy policy. But many emerging companies immediately post their claimed privacy policies on their company websites. These companies often fail to assess the potential risks, burdens and liabilities associated with publishing a privacy policy. They do not realize that publishing a privacy statement may be more harmful than not publishing one."

Privacy exposure assessments still remain rather unpopular among leading companies, and compliance with industry specific requirements for processing and storing personal information continue indirectly replacing what a Chief Privacy Officer would have done in a much more adaptive manner. Can we that easily talk about Total Privacy Management (TPM), the way talk about Total Quality Management (TQM) as an internal key objective for strengthening a company's reputation as a socially-oriented one? It would definitely turn into a criteria for the stakeholders, and a differentiating point for any company in question in the long term. The future of privacy? Don't over-empower the watchers or you'll have the entire data aggregation model of our society used against your rights for the sake of protecting you from "the enemy or the threat of the day".

You may also find some comments from a previous post on "Examining Internet Privacy Policies" relevant to the topic :

"Accountability, public commitment, or copywriters charging per word, privacy policies are often taken for fully enforced ones, whereas the truth is that actually no one is reading, bothering to assess them. And why would you, as by the time you've finished you'll again have no other choice but to accept them in order to use the service in question -- too much personal and sensitive identifying information is what I hear ticking. That's of course the privacy conscious perspective, and to me security is a matter of viewpoint, the way you perceive it going beyond the basics, the very same way you're going to implement it -- Identity 2.0 as a single sign on Web is slowly emerging as the real beast."

How to Tell if Someone's Lying to You

Interactive slideshow providing ten tips on how to tell if someone's lying to you. These can of course be interpreted in different ways and applied under specific circumstances only. Some are very practical though :

01. Watch Body Language
02. Seek Detail
03. Beware Unpleasantness
04. Observe Eye Contact
05. Signs of Stress
06. Listen for the Pause
07. Ask Again
08. Beware Those Who Protest Too Much
09. Know Thyself
10. Work on Your Intuition

Two more I can add -- answering without being asked, and on purposely stating the possibility as a negative statement already. Here's the article itself, as well as several more handy tips on detecting lies. Don't forget - if someone's being too nice with you, it means they're beating you already.

Ear whisper courtesy of Cartoonstock.com