Question time with reverse engineer, Mike Perry

As more and more people - Internet pros and newbies alike - begin to use social networking Web sites, do you think online security demands will change?

I'm not sure. I certainly hope so. However, while Internet security pros are well aware of these issues, they are a minority.

Without widespread publicity to create a market differentiator around web security, it is going to be hard for people to 'vote with their feet' to avoid insecure sites.

By taking this issue to the public and releasing this tool, I am trying to create this differentiator. It's my opinion that sites that are willfully negligent in securing their users do not deserve any customers at all.

What does a reverse engineer like yourself do? What sparked your interest in privacy, security and censorship resistance?

In general, reverse engineers help to bridge knowledge gaps by figuring out how systems behave so that products and services can interoperate together. At least this is the most common legal form of reverse engineering.

I actually came to privacy, security, and censorship resistance through my independent study of reverse engineering in University.

Right around the turn of the century, all of these ideas came under attack in my country [USA] via rather draconian laws such as the PATRIOT Act and the DMCA. Because of the vague nature of these laws and the climate of surveillance and fear, it was necessary to be very careful about what I studied and how, while the legal climate stabilised.

It has since become a bit more clear exactly what is legal and what is not, but for a student facing these very vague and overreaching laws while just trying to learn, it was a very frightening time, and I naturally sought ways to protect myself.

We still have a long way to go, of course. Many security professionals and computer researchers are still afraid to travel to the USA, and several that do face extreme difficulty at customs. I've even heard cases where they have been flat out refused entry.

What is your opinion of privacy - or lack thereof - in today's world? What is your opinion of information-rich companies like Google?

It's pretty scary. Many companies are compiling a large amount of data about us, and often simply because we willingly cede it over to them without thinking about the consequences.

Privacy policies are often a joke and riddled with exceptions, loopholes, rapidly changing terms, and I believe not even regarded as binding contracts by the courts.

I don't think society has had time to evaluate the consequences of all of this data being accumulated by these organisations. From the fact that it can be stolen or leaked; used in lawsuits, divorce cases, or custody battles, or the fact that it will rapidly become a political weapon used to manipulate our public officials, the consequences of all this data being gathered (and often sold), even if it is held under the strictest of safeguards, is very dangerous.

It is my hope that the more enlightened companies will begin to realise the importance of allowing people to 'opt-out' of this constant surveillance.

Google in particular is showing some signs of understanding the need for projects like Tor (an anonymity, privacy, and censorship resistance network which I volunteer for) to exist and mature, to allow this 'opt-out' option. But only time will tell how it will all shake out.

fightingfiresecuritywith