Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Friday, August 10, 2012

Keepin (De)m dmb n apy...


In response to the news of the man behind the BBCs Hardtalk coming up with a program focusing on socio-political problems in India on Newslaundry.com and then my ramblings... I've been feeling a little more frustrated than I'm accustomed to with the system and need to vent a bit :)

Moderating? Are we talking about OUR politicians and bureaucrats appearing on this? The only way they can be 'moderated' is if they're cut off the way is done on our live debates, allowed to edit the recorded footage heavily enough for them to sound at least a lot more decent than they are, or handle 15 hours (patiently over possibly months) of footage that's heavily edited into a 10 minute package for mass consumption because they keep repeating the same irrelevant [argument/reason/explanation/excuse/allegation/agitation; take your pick], sometimes even creatively - in 15 different ways.

If he can pull this one off, it's going to be great. It might be hilarious, where all people sit and explain how great our system is and how we're better off than the failing Europe and the faltering oil suckers because our economy is still standing, it's now a question of 'for how long at the current burn rate?'. I figure it might be informative to a point, but I'm wondering what actual information any of these guys might have that would be interesting other than which scams they've been associated with and why.

Sure, money's come back from the Swiss banks in the form of foreign investments... they're eager to bring in FDI - which may be needed in any case, but not really just so they have an easier route to bring their money back. This money was incidentally made more than a little more valuable while the government watched the Rupee slide.

This article about the government supplying mobile phones to all Below Poverty Line (BPL) families on The Indian Express web site is one more possibility for a fresh scam. I'm just wondering whose relative started a company that's going to be one side of a 7000 crore partnership deal for supply of phones and services. Will due diligence happen this time?  Will common knowledge be announced in public at some point and shock us all? Is now the right time to push the diesel hike through to let the Rupee slide just a little more... FDI's not through yet... in the meantime, they've been busy arguing about things (the UPAs 'bastardisation' of the government), some which don't happen all that often like this minor disagreement - that are reminiscent of the divide and conquer tactic that's been used upon us repeatedly to rule us over time, and some which probably do (how long was that pornographic clip those politicians were watching on public time again?) in the house. I can completely understand why they haven't really gotten around to solving too many of that large stack of problems let alone getting around to prosecuting the corrupt or even introducing legislature that allows money KNOWN to be swindled from the public to be returned. No matter... they're VIPs and live by a different set of rules - at the expense of general public is not uncommon; you get stuck in a 3 hour traffic jam because the traffic police stop traffic so that said VIP has a clear route to work - this used to regularly happen on my way to Gurgaon from the south east of Delhi during the CWG fiasco. What is a VIP anyway? Someone we elected who needs the best of the police to protect them from... us??? Real leaders lead from the front and by example - and should not have to fear for their lives by stepping out among the masses without z-level security or whatever they get that allows happy-to-be-violent-ministers to justify kicking people who decide to protest by saying the complaint should be against the accusers for entering a high security zone (too close to their little prince was it?).

How do they get away with all of this while they're showing off that they're better than us with the red lights on the white cars with the "भारत सर्कार" printed on the back in red, or with the fancy 'VIP plates' that you can now officially buy. For some it may just be a statement of your own chosen self worth in the eyes of the general public...

So y r v keepin (De)m dmb n apy?

This is what the corporates try to do to us more often than not when it comes to sales and marketing strategies. Whether it's the promise of many girls being magically, magnetically attracted to a plain looking guy or all the Rajni jokes, we're being pushed in the direction of the marketers choice... and politicians started up with them possibly before the corporates found these marketing geniuses.


I'm not really sure what to make out of the votes-for-phones scheme that was announced today. Have they done enough research to know that this is what will win the elections? Have the greater masses come to a point of knowledge (or lack of) where they can be bribed by cellular phones that would have to be designed to last for days on very little charge - seeing as electricity is a problem in many villages, towns, cities, metropolises and other areas across our nation? Don't worry though - the technology would be simple and cheap enough... we just need to hope that the company tasked with setting this up for all the poor people who can't afford food will let enough money trickle down for them to pay some amount of money after 200 minutes free - will the transparency on charges after this limit be kept high enough for these (Rs.32/day) families to not be held liable to pay large (completely unaffordable) bills after this allowance? Many people in the country are getting smarter - if they're kept in debt, the scope of them affording an education is lowered... then they might vote for the fools providing them with mobile phones or TVs without first providing basic food, shelter, infrastructure or electricity to power the phones they're distributing using 'small' quantities of our money. But hang on... if you can handle the logistics and cost to hand out mobile phones and monthly minutes to families who earn less than Rs.32/day, shouldn't you first see to it that they get something in terms of sustenance that actually reaches them? How about cleaning up some space for a medical facility or two?

They've systematically tried to erode any scope of education in the country by coming up with ridiculous plans, schemes, rules and laws. Politicians decide that cartoons that have been in text books for years should be removed as they're 'disrespectful' of 'leaders' (some of whom have expressed appreciation for the satirical value of these cartoons). Initially, I doubt any of the political folks had any ill intent as far as the growth of the country was concerned - as long as they were growing well, they'd do good by it. It's moved from there to 'I will do good by me even if it causes the country to slide straight to hell'. Some fool decides to waste court time on taking technology companies to court over pictures that have been posted because they're not in 'good taste'... meaning they mock political parties and/or the cartoons (leaders??) that form them.

Education is just one small part of how they're keeping them dumb. If you don't have time to learn anything because you're too busy walking for water or running away from floods, you're not really going to get much smarter. This was an incidental fallout from a suggestion made in the 50s - build a national water network - if designed properly it could have been high on the initial cost, but done at minimal energy cost. A water 'grid' so to speak... this way when one place floods, water can be routed to places that are seeing an acute water shortage. Needless to say, most of what we see right now in agriculture is crop failures because of flooding or drought for lack of balance in vision or process. Heck, if it had been built and was crumbling (much like our electrical network - the crumbling of which some people maintain was because of a coal scam, others think is part of an attempt to sabotage Anna's fast), it'd still be a massive improvement.

In the interest of destruction of our nation in favour of our 'sibalisation', our HRD minister decided to involve the school results in selection at the IITs (our premier engineering institutes which used to have complete autonomy on the entrance examinations). The 'cut-off' scores for most of Delhi university colleges were in the high 90s. Now, many of the folks who are trying to get into IIT will also try getting higher board scores - this is likely to drag the cut-off further up (hang on... where do you go from 100%?). The first list will be a bunch of folks who might not have managed to get into IIT, so will take a course in say physics from a good DU college for a year while they study for their next attempt at IIT. This will reduce the numbers of people who complete their degrees, increase the competition to get into any course at all, waste space in the few colleges we actually have in the country, increase the number of people who'd go to private universities (which usually have pretty heavy political backing and investment), which will make more money while the quality of education imparted to the people goes down again.

It gets worse though. They've gotten us to a point where most of the middle class have resigned themselves to their fates and are not patient enough to go through 4 days of processes when half an hour should have been enough. Bribing the small guys to do their jobs at an only slightly slower than standard pace has become an accepted norm. In their eyes, if you bribe, you're stupid for wasting so much time. If that little guy is helping you, you build a rapport with him... and you don't want him to move from there so that your work can be done through someone you 'know'. In other words, many of us would like to keep people from growth. One of our neighbours  had issues with how much we were paying someone to do some odd jobs for us - we were told that if we paid that much then they'd have to pay that much and the guy would get enough money and skill to move on to better work - and they'd have to find someone else to do their work for them. I find this attitude quite disturbing. As many folks in India do, we've had a maid working with us for a couple of decades now. We've helped her put her kids through school and college and they're able to help out now with the mounting household expenses. While it's a little sad that they've now got less respect for their mother's work than they had before, it's also good that they've been given the tools to carve out a better life for themselves. Isn't this what being human is about? Everyone should have the opportunity to grow and growth should be encouraged.

All these issues that have cropped up run so much deeper than the corruption that caused them. Still, I have hope for the future... if we start hitting the problems one by one, we might just get out of this rut, but in my opinion, we need to clean up the cause one person at a time first...

Friday, February 04, 2011

De Shopping Experience

With e-commerce set to jump out of the bag with the coming of actual broadband and 3G in India, you'd think it's safe to get out there and buy stuff online here...

WRONG!


It's neither safe, nor prudent to give any of these web sites too much of a chance till they start respecting privacy and/or up the security on the data that you have to give them. I've had some pretty sad experiences with spam happening from places I'd have least expected it to come.

The Setup
It all started with me getting so much spam on my old Hotmail account that I more or less stopped using it altogether. It had been relegated to that old account where I had a few subscriptions, or that I gave to any website that required registration... and my personal address? Well, that's personal... why let anyone see that at all?

Unfortunately, I found that I was getting more spam in my inbox than in my "Junk mail folder", and the spam management and amazing search functionality on Hotmail just didn't help at all (searching for the word "dentist" yielded no results despite the fact that bulk of my inbox was filled with mail with the same word in the subject). I needed another way to sort through that account - frankly, I only wanted to keep it since it's one of my first e-mail addresses and if anyone still uses it they should be able to (eventually) elicit a response from it, so once a month I check it.

I've found that the best (and easiest) way to track spam is to use your own domain with a mailbox there for every site you may have low trust issues with. It's quite convenient for companies (like amazon.co.uk@mydomain. com) so you remember the login details (since if you reached the website, you're bound to know what email address you've passed them). I've managed to take it to a level where it takes a matter of seconds to setup an account for someone, access it automatically with a password shared across accounts, and with limits only on the collective size of inbox, I've found I'm relatively sorted on this part. Once you're sure that they're not evil spammers, you can give them your proper e-mail address.

So there I was... I felt comfortable with this system of distributing email addresses. It confuses people and gets funny at times as well... I've been asked a few times if I work with Dell (while on the phone with support).

I'm guessing majority of the leaks start at customer care. We need to educate the call centre employees on privacy and ethics. Most of them wouldn't think twice about giving anyone their own addresses and phone numbers out and wouldn't think of it as a breach of agreement or even privacy. I don't think anyone would bother trying to hack into many of the customer databases... it's easier to hang out outside the call centre (I'm sure it wouldn't be difficult to get the location/address through the phone) and offer someone a couple of hundred rupees for all the email addresses.

To help or not to help
It's really sad where all I get spam from. Oxfam India was responsible for my receipt of mail offering to "Make it stronger. Last a lot longer." It should be good enough that I contribute to their causes in cash - why would they sell my data?

Travel issues
You want to book flight, train or bus tickets or a hotel room from/in India online? Yatra delivers quite a good experience on the actual business side... on the side business, I've received spam from LIC (which IMHO is just about acceptable seeing as it's a respected Insurance company - just the source of the email address and the option to opt out should be included in the mail). One thing I DIDN'T expect from them was to get a Facebook invite from Shalini Ahuja - you're thinking this would possibly be a bot or a very lonely person? The invite said :
Lowest Fares on www . EaseMyTrip . com Just Compare Fares Once Before Issuing Tickets Online.... Also Earn Upto Rs.50,000/Month or More by Joining EMT Franchise Network !!
Sounds like a competitor to me... does this mean all Yatra customers were sent FB invites from EaseMyTrip?

A company that wanted to sell projectors and services related to projectors has contacted me on my Yatra account. This information also seems to have reached an "offers" website, who have offered me "Resort homes" in India.

Does this mean that Yatra sells user data? Probably not - one rogue employee or someone may have given this data out. I don't get too much spam through them... a total of 4 emails that I've managed to track - it's a little bit of work. In fact, I'd spoken with some pretty senior people (at Yatra) about this and haven't received any more spam on that address.

Khojguru has managed to get my Dominos pizza email address and send me mail about it. They even included a link to allow me to unsubscribe from their list - I didn't want to click on it since this would confirm that it's an active address and allow the spammer (Khojguru) to validate this as a "good lead". The next mail I got on this address (some insurance comparison site) actually said that it was being sent from kgurumail.com, so at least when Khojguru sends my mail address on to more spammers, they keep me in the loop.

An online auction site sent me spam at my book my show address, and were nice enough to include a coupon just above the (unused) unsubscription link.

There's an email provider here who (apparently) pays you back for using their email service and in the spam they've sent to my Dominos account (again via Khojguru), they've even mentioned a donation they've made to charity, aside from offering me great deals.

Dominos gets the prize for versatility though... from email that pays you to use it to "Compete in yacht size? Nowadays it is of no use - boost your bed energy!"

The Bad
Okay, so now the story gets a bit murky... an internet provider (Spectranet) sent my Ferns and Petals account a flyer about affordable long distance calling... heck, if an internet provider buys/obtains this data illegally, who's stopping them from sharing their customers data or even spying on the actual data that's being exchanged by users online?

My Ferns and petals account also received junk from The Economist offering me a subscription - hey at least they're keeping it classy! Or maybe not... IndusLadies sent me a newsletter, and offered to take feedback/unsubscription requests which lead to a "sendfnpemail.com" url, but then ALL links do... it's almost like they're running campaigns for people who want publicity and using their customers mail addresses to send all of this crap out. Bad, bad FnP! No Froyo for you!

All of these so far are just standard sites or organisations that are either too stupid/enethical to hold my data with a degree of respect. They're not really very big on the online shopping front.

I've had so much spam at my Ngpay address it's not funny. Ngpay is a service which partners with online retailers, travel sites, gift sites, movie sites... it's an aggregator of sorts, but it's mobile! It delivers a near seamless experience (or had in the past when I used to use it), but since they have to pass on your contact details to their partners, someone or the other (read: fnp.in) would start sending you spam. I don't hold this against them, but would like them to try it the Google way... not pass the actual email address, but a time limited alias which could be deactivated on confirmation from the customer.

The Ugly
Shop Your World... this one actually deserves a separate post, but hey, I'm not here very often :)

I got a flyer from one of my banks telling me I could now shop on Amazon.com or bestbuy.com in Indian Rupees, have the product shipped to India, and get to see the complete cost (delivery to my doorstep) upfront... they'll handle purchase, shipping, customs duty and delivery, and I get what I bought at the US price plus a bit on shipping and tax. It winds up a lot more cost effective for me to buy this way... it also winds up a lot more convenient - at one point, if you bought something from a US store and had them ship it here, they'd give you a call when it reached customs and you'd have to go pay and get it out.

Great concept! Ebay.in has a similar concept, but they only handle particular suppliers from the US and ONLY ebay listings. Now I can get stuff from the US or UK at a reasonable price (Services here are cheap and involve cut-throat competition, but many products are generally much more expensive here), and I don't need to have an address abroad or have anyone pick it up, or have anyone bring it down... it reaches my door for a few rupees more.

A serious shopping site is the LAST place I'd expect to get spam from... one that my BANK recommends? I registered, left my mobile number, email address, house address, "spam" mobile number; a freely distributed number, and a phone in the shopping cart. I got spam from MTV. The spam was addressed to "Dear Sunil", so they hadn't just sold the address... the name was specified as well. I managed to catch an online agent to chat with and asked if they sold information. When I was told that this was against policy (as I'd already seen on their website), I persisted and was told that they didn't. If they're not selling or distributing my data and someone else has it, there's only one other natural assumption that springs to mind... they're low on security and/or have been hacked into, and data stolen. I don't really think I want to use an e-commerce site that's been hacked into, especially with the response I got from the agent... I had the transcript emailed to me. So far no one has gotten back to me - heck, maybe they lost my data :-D

The transcript of the conversation:
info: Please wait for a site operator to respond.
info: You are now chatting with 'Aditya'
info: Your Issue ID for this chat is LTK166010377008X
Aditya: Welcome to Shop Your World
Aditya: How may I help?
shopyourworld.com@mydomain. com: Hi Aditya, I'd registered on your site and had considered buying some things from there. I created a specific email address for your site
shopyourworld.com@mydomain. com: I received spam on this email address yesterday
shopyourworld.com@mydomain. com: I would like to know if you are distributing/selling my data
shopyourworld.com@mydomain. com: because this goes against the privacy policy mentioned on your website
Aditya: We do not share our Customer's Database with any other Company
shopyourworld.com@mydomain. com: then your system has been hacked into
shopyourworld.com@mydomain. com: which is even more of a concern
Aditya: I will pass this Information to the IT team
shopyourworld.com@mydomain. com: the only place this email address has ever been typed is on shopyourworld.com
Aditya: Ok
shopyourworld.com@mydomain. com: not good enough
shopyourworld.com@mydomain. com: I'd like you to have your management team contact me as this is a rather serious issue
shopyourworld.com@mydomain. com: I'm just glad I didn't buy anything from you or my credit card details might have been floating around the internet as well
Aditya: Like I said, I will share this Information with the IT Team to look into the matter and check if there are any gates open for the hackers to peep into our database.
Aditya: As of now we haven't received such Complaints, but considering this is the first, we would like to do something about it and avoid such complaints in future
shopyourworld.com@mydomain. com: if I don't get a revert from your management team in the next three days I'll blog this.
shopyourworld.com@mydomain. com: I don't think you're getting how serious this issue is
Aditya: The Credit Card Details are not stored in our database any which way as we use a 3D secure payment gateway
Aditya: You will have to go through VISA or Mastercard verified gateway for every transaction
shopyourworld.com@mydomain. com: I'm not going to waste any more time chatting with you. Please make sure someone contacts me about this in the next three days
Aditya: So security of your Card details shouldn't be a concern at all
info: Your chat transcript will be sent to shopyourworld.com@mydomain. com at the end of your chat.
shopyourworld.com@mydomain. com: selling the data would be enough of an issue - I got spam from rishik85@gmail.com with the subject MTV GANG NEXT 2.0 Auditions, which would suggest you've sold my information to an MTV affiliate.
shopyourworld.com@mydomain. com: the mail was sent from a Tata Teleservices internet account
shopyourworld.com@mydomain. com: 114.143.128.162 was the IP
Aditya: We will have this checked
shopyourworld.com@mydomain. com: please have whoever contacts me at the given mail address provide a contact number
shopyourworld.com@mydomain. com: I will call back
Aditya: I have passed on the Information to the concern team
Aditya: We have your contact details registered with this Email ID
shopyourworld.com@mydomain. com: now you're getting my point - I've given you more details than I'd typically give to an untrusted site. So you can have them call me on my mobile.
Aditya: Sure
Aditya: You should get a call within 24 - 48 hours
shopyourworld.com@mydomain. com: thanks
Aditya: Cheers!
It's been a week and a day... should have been enough time for them to get back to me... they haven't. Maybe HDFC (and ICICI) should consider security of their partner sites - the sites themselves don't seem to care too much.