THE PROBLEM WITH TRUSTING TECHNOLOGY WE DON'T UNDERSTAND

I've spent a lot of time over the past year learning about digital privacy, smartphone security, encryption, isolation, and all the different ways that are advertised to us as ways of protecting our personal information.

And one of the things I keep coming back to is just how much trust we place in technology that most of us don't really understand, and that almost nobody actually takes the time to look into and try to understand.

Take your smartphone, for example.

We use these things every single day. We store our photographs, conversations, financial information, passwords, and all kinds of personal information on them. Some of our most personal and sensitive information is stored on these devices.

We install applications without knowing who developed them. We grant permissions without even reading them to understand what they do. We connect our most sensitive accounts to applications and services, and we just assume that everything is being handled securely.

But how do we actually know?

How do we know that the company or service being provided to us isn't intentionally designed to harvest our information, learn more about us, or build profiles based on our activities?

That's where I start questioning things.

I'm not saying that every application is malicious or that companies aren't doing anything to protect our information. Because they are. Modern smartphones have some pretty extensive security protections built into them.

Take iPhones, for example.

Apple devices are known for having strong security protections. That has a lot to do with the hardware, the software, and the tightly controlled ecosystem Apple has developed, all the way down to the chips that run these devices and the secure hardware used to protect cryptographic keys and perform certain cryptographic operations.

All of these things working together form a very strong, fortified device.

However, who's protecting you from Apple?

And that's where I think we need to start making some distinctions.

There's a difference between protecting your device from an outsider, an outside attacker trying to compromise your phone, and protecting your information from the applications and services you've already decided to trust.

I think that's something a lot of people overlook.

And to me, that's really the heart of the issue.

UNDERSTANDING WHAT WE'RE ACTUALLY TRUSTING

Let's take application permissions.

Application permissions are one of the primary ways that applications obtain access to sensitive information and capabilities on our devices. They're also one of the ways that applications can potentially abuse the access we've given them.

And that's why I think permissions are one of the most important things people should understand about how their smartphones work.

Applications are a central part of using our devices. We install software to communicate, manage our finances, store information, take photographs, and perform countless other tasks.

Some of those applications need access to certain information or device capabilities to perform the functions we're asking them to perform.

But that doesn't mean they need access to everything they're requesting.

To understand why this matters, we need to understand a little bit about how applications operate.

APPLICATION ISOLATION AND SANDBOXING

On Android, applications generally operate inside their own sandbox.

That means one application is separated from the others and ordinarily isn't supposed to be able to freely access another application's private information, memory, or internal storage.

An application has its own private area where it stores data and operates. Other applications aren't supposed to be able to simply reach into that space, read its private files, or inspect its process memory.

Android uses operating-system security mechanisms to enforce these boundaries.

This is intentional.

Isolation is one of the strongest principles in computer security, and it's something modern operating systems, including Android, implement extensively.

It's a very significant security protection.

But now let's say I install an application and grant it access to my photographs, location, contacts, or microphone.

I've now authorized that application to access certain information or capabilities it otherwise may not have been able to access through the normal permission system.

And that's where things become interesting.

Because malicious applications can request permissions they don't actually need. Even applications that aren't intentionally malicious can request excessive access or collect more information than is necessary to provide their services.

So one of the cardinal things I think people should look for when installing applications is whether those applications truly need the permissions they're requesting.

If I download a calculator, for example, why would it need access to my contacts?

Why would a simple flashlight application need my location?

There may occasionally be legitimate reasons for unusual permissions, depending on the application's functionality, but those reasons should be understandable.

And if they aren't, I think that's something worth questioning.

Permissions aren't the only way applications can obtain information, either. Some information is available through ordinary system interfaces, network connections, or data that we voluntarily provide.

That's why it's important to look at the application as a whole, not just the permissions it requests.

WHAT IS THE APPLICATION ACTUALLY DOING WITH MY INFORMATION?

This is where my questions start going a little deeper.

What is the application actually doing with the information I'm giving it?

Is it processing everything locally on my device?

And by locally, I mean is it using my own phone's hardware to perform the computations, run the software, and carry out the actions necessary to provide the service?

Or is it sending my information to a server?

A server is essentially another computer, usually operated by a company or service provider, that performs tasks, stores information, or provides resources to applications connecting to it.

So when I use an application, is the work actually being done on my device, or am I sending my information to somebody else's computer and depending on them to process it?

And if that information is being transmitted, is it encrypted?

If it's encrypted, who controls the keys that unlock it?

Those are the kinds of questions I'm interested in.

And I think those are the kinds of questions more people should be asking.

Because encryption alone doesn't necessarily mean that nobody else can access your information.

Encryption protects information according to how the system is designed and who has access to the keys.

If the service provider controls the keys needed to decrypt your information, then you're still depending on that provider to protect it and handle it appropriately.

That isn't the same thing as having exclusive control over your own encryption keys.

And that brings me to something I've thought about quite a bit.

WHY BE A GUEST IN THE HOUSE OF YOUR OWN DATA?

Why should I have to ask somebody else for the keys to unlock my own information?

Why should I store my most sensitive information in a vault where somebody else controls the keys?

Think about a storage unit.

When you rent a storage unit, you're paying somebody to provide you with a place to store your belongings.

But you wouldn't necessarily want the storage company to have unrestricted access to everything you've put inside.

You want to control the lock.

You want to hold the keys.

You want to decide who gets access to your belongings.

So why shouldn't we approach our digital information in a similar way?

Why can't a company provide the infrastructure to store our information while we retain control over the keys needed to decrypt it?

They provide the storage. We control access to the contents.

That's the kind of relationship I would prefer.

Now, I understand that digital systems are more complicated than physical storage units. Some services need to process information to provide their functionality, and certain features require different technical approaches.

But when a service is simply storing information on my behalf, I think it's reasonable to question why that provider should need the ability to read it.

I'm not saying every company with access to encryption keys is abusing that access.

But if they possess the keys and have access to the encrypted information, then they may have the technical ability to decrypt it.

And that's the distinction I'm interested in.

I don't just want somebody to promise me that they won't access my information. I want to understand whether the system is designed so that they can access it in the first place.

That's a very different security model.

WHY I PREFER OPEN-SOURCE SOFTWARE

This is one of the reasons I've become so interested in open-source applications.

I like being able to examine how something works.

I like knowing that the source code is available for other people to inspect, test, challenge, and independently verify.

Now, that doesn't automatically make an application secure.

An open-source application can still have vulnerabilities. It can still be malicious, just like any other piece of software. And just because the code is publicly available doesn't mean somebody has thoroughly audited it.

That's something I think people should understand.

Open source isn't a guarantee of security.

Just like anything else, software should be thoroughly evaluated before we decide to trust it with sensitive information.

And if you can't inspect the code yourself, which most people can't, then I think it's worth looking for software that has been independently examined by people who have the technical knowledge to do so.

Look at the project's development history. Look at the security research available. Look at whether vulnerabilities are being identified and addressed.

And understand that even an audit isn't an absolute guarantee.

But with open-source software, at least there's an opportunity for independent verification.

With proprietary software, you're generally much more dependent on the company developing it, the documentation it publishes, the claims it makes about its security and privacy protections, and whatever independent research is available.

That doesn't mean proprietary software is automatically insecure.

There are proprietary systems with excellent security engineering, and there are open-source projects with serious security problems.

But the amount of independent visibility you have into how those systems operate can be very different.

And in the end, you're still making decisions about who and what you're willing to trust.

That's where I become skeptical.

I don't necessarily want to take somebody's word for it when it comes to protecting my most personal information.

I want to understand what protections are actually in place, how those protections work, what their limitations are, and what alternatives I have.

WHAT I'M DOING DIFFERENTLY

That's part of why I personally use GrapheneOS.

I like its approach to application isolation, exploit protection, and giving users more control over how their devices operate.

I also use applications like KeePassDX, WireGuard, and other privacy-focused tools because I want more control over my passwords, network connections, and personal information.

I want to understand what's happening on my devices.

I want to know what information applications have access to, where that information is going, and who has the ability to access it.

And I want to be in control of those things as much as reasonably possible.

But I don't think everybody needs to use exactly what I use.

What works for me might not be the best solution for somebody else.

Some people have different needs, different priorities, and different levels of technical experience.

And security isn't simply about installing a particular operating system or downloading a collection of applications.

It's about understanding the protections you're using, the risks you're trying to address, and the limitations of the tools you've chosen.

WHAT I WANT PEOPLE TO UNDERSTAND

The important thing is understanding what you're using, what information you're giving it access to, and what you're actually getting in return.

I don't think people should have to become cybersecurity professionals just to understand what their phones are doing.

But I do think they should have the opportunity to learn.

And I think the companies providing these services should be held to a much higher standard when it comes to explaining how our information is collected, stored, processed, and protected.

Because these devices aren't just phones anymore.

They're where we keep our conversations, our photographs, our financial information, our personal documents, and an enormous amount of information about our daily lives.

And we've become so accustomed to handing that information over to applications and services that we rarely stop to question what we're actually agreeing to.

That's something I want to change, at least for the people I can reach.

I want people to start asking questions.

Who developed this application?

What information does it need?

Why does it need that information?

Where is that information being stored?

Who controls the encryption keys?

And what happens if I decide I no longer want to use the service?

Can I take my information with me?

Can I access it independently?

Or am I dependent on somebody else's permission to access something that belongs to me?

These are the kinds of things I want to explore through The Digital Guardian Podcast.

Not because I believe every company is malicious or that every piece of technology is inherently dangerous.

But because I believe people should understand the technology they're depending on and have the ability to make informed decisions about how they use it.

And I want to help people learn how to do that.

That's really what I'm trying to accomplish.

Don't just USE it. UNDERSTAND it....

Because the future of is a technology filled future and understanding these things is of the utmost importance.

Stay tuned for daily content and I will be launching the first podcast tomorrow!

God bless and please ask any questions you may have.

- The DigitalGuardian

0 comments

THE PROBLEM WITH TRUSTING TECHNOLOGY WE DON'T UNDERSTAND