Hannu Ahola has an interesting story to tell.
His story takes place in a virtual world that many of us who are too busy in the real world never visit. Hannu is an active player of an online role-playing game called World of Warcraft. What is he doing then when he is “playing”? In the World of Warcraft, players from all over the world buy accounts and create characters. By accomplishing different missions, these characters gain skills and virtual wealth that other players envy.
So, when does the game end? Never – much to the relief of its 11 million active players.
Hannu’s story started about 4 years ago. His friends were urging him to play World of Warcraft. At first, he was not interested. But after a little convincing, he bought an account from an acquaintance, which turned out to be mistake. But Hannu didn’t know that yet.
He found himself spending more and more time playing. He estimates that during those first two years he played 8-10 hours per day. Every day. The result was an impressive character that accumulated a substantial amount of wealth and talents. The character was so good that people might have been willing to pay real world money for it.
And this fact did not escape the acquaintance who originally owned the account. Using the original account information, this 18-year old boy was able to take control of Hannu’s character and the virtual wealth Hannu had been building for years. And it seemed that there was nothing Hannu could do about it.
Most of us have trouble understanding this kind of loss. Hannu explained it to me: “What if you had collected stamps passionately for 2 years. You had put all your spare time into it and then someone took it away. How would that make you feel?”
After he figured out that it was his acquaintance who stole his character, Hannu contacted the boy – who promptly ignored him. He then contacted the boy’s mother but got no help.
Stealing is punishable in the real world, but did not seem to matter in the virtual world. Except to Hannu. He hired a lawyer and took the issue to court.
After a 1,5 year battle, the young boy was sentenced to pay Hannu 4000 euros for the character Hannu finally never got back. But Hannu had won the moral battle: there are limits to what you can do in the virtual world. Hannu’s case represents the first time that a real world court in Finland dealt with a matter related to virtual worlds, and I have the feeling there’s more to come.
(For more about Hannu and the value of virtual world commodities, check out Sean from the F-Secure Labs on “What is a World of Warcraft Account Worth?“)
The boundaries between virtual worlds and the real world are blurring. World of Warcraft accounts get phished all the time. Children are bullied in virtual worlds. In China, even murders have been committed because of virtual world events. But they also provide a lot of opportunities for enjoyment and self-expression – as long as we obey the law. And for that to happen, we’re going to need a lot more people like Hannu.
So good job, my friend!
Many techie terms in the headlines lately. Supercookies, supertrackers, HTTP headers and X-UIDH. If you just skim the news you will learn that this is some kind of new threat against our privacy. But what is it really? Let’s dig a bit deeper. We will discover that this is an issue of surprisingly big importance. Cookies are already familiar to most of us. These are small pieces of information that a web server can ask our browser to store. They are very useful for identifying users and managing sessions. They are designed with security and privacy in mind, and users can control how these cookies are used. In short, they are essential, they can be a privacy problem but we have tools to manage that threat. What’s said above is good for us ordinary folks, but not so good for advertisers. Users get more and more privacy-aware and execute their ability to opt out from too excessive tracking. The mobile device revolution has also changed the game. More and more of our Internet access is done through apps instead of the browser. This is like using a separate “browser” for all the services we use, and this makes it a lot harder to get an overall picture of our surfing habits. And that’s exactly what advertisers want, advertising is like a lottery with bad odds unless they know who’s watching the ad. A new generation of supercookies (* were developed to fight this trend. It is a piece of information that is inserted in your web traffic by your broadband provider. Its purpose is to identify the user from whom the traffic comes. And to generate revenue for the broadband provider by selling information about who you really are to the advertisers. These supercookies are typically used on mobile broadband connections where the subscription is personal, meaning that all traffic on it comes from a single person. So why are supercookies bad? They are inserted in the traffic without your consent and you have no way to opt out. They are not visible at all on your device so there is no way to control them by using browser settings or special tools. They are designed to support advertisers and generate revenue for the mobile broadband provider. Your need for privacy has not been a design goal. They are not domain-specific like ordinary cookies. They are broadcasted to any site you communicate with. They were designed to remain secret. They are hidden in an obscure part of the header information that very few web administrators need to touch. There are two ways to pay for Internet services, with money or by letting someone profile you for marketing purposes. This system combines both. You are utilized for marketing profit by someone you pay money to. But what can and should I do as an ordinary user? Despite the name, this kind of supercookies are technically totally different from ordinary cookies. The privacy challenges related with ordinary cookies are still there and need to be managed. Supercookies have not replaced them. Whatever you do to manage ordinary cookies, keep doing it. Supercookies are only used by some mobile broadband providers. Verizon and AT&T have been most in the headlines, but at least AT&T seems to be ramping down as a result of the bad press. Some other operators are affected as well. If you use a device with a mobile broadband connection, you can test if your provider inserts them. Go to this page while connected over the device’s own data connection, not WiFi. Check what comes after “Broadcast UID:”. This field should be empty. If not, then your broadband provider uses supercookies. Changing provider is one way to get rid of them. Another way is to use a VPN-service. This will encapsulate all your traffic in an encrypted connection, which is impossible to tamper with. We happen to have a great offering for you, F-secure Freedome. Needless to say, using Freedome on your mobile device is a good idea even if you are not affected by these supercookies. Check the site for more details. Last but not least. Even if you’re unaffected, as most of you probably are, this is a great reminder of how important net neutrality is. It means that any carrier that deliver your network traffic should do that only, and not manipulate it for their own profit. This kind of tampering is one evil trick, throttling to extort money from other businesses is another. We take neutrality and equal handling for granted on many other common resources in our society. The road network, the postal service, delivery of electricity, etc. Internet is already a backbone in society and will grow even more important in the future. Maintaining neutrality and fair rules in this network is of paramount importance for our future society. Safe surfing, Micke PS. The bad press has already made AT&T drop the supercookies, which is great. All others involved mobile broadband providers may have done the same by the time you are reading this. But this is still an excellent example of why net neutrality is important and need to be guaranteed by legislation. (* This article uses the simplified term supercookie for the X-UIDH -based tracker values used by Verizon, AT&T and others in November 2014. Supercookie may in other contexts refer to other types of cookie-like objects. The common factor is that a supercookie is more persistent and harder to get rid of than an ordinary cookie. Image by Jer Thorp
It's like a press conference anyone can join from anywhere. And even if you don't have a question, you can upvote the ones you don't like and downvote the ones you do. President Obama did one. Snoop Dogg/Snoop Lion did one. An astronaut did one from outer space. And our Mikko Hypponen will sit down for his second Reddit AMA on December 2 at 9 AM ET. If you have something you've wanted to ask him about online security, great. If not, here are five resources that document some of Mikko's more than two decades in the security industry to prod you or prepare you. 1. Check out this 2004 profile of his work from Vanity Fair. 2. Watch his 3 talks that have been featured on TED.com. [protected-iframe id="7579bbf790267cc081ac7d92d951262c-10874323-9129869" info="https://embed-ssl.ted.com/talks/mikko_hypponen_fighting_viruses_defending_the_net.html" width="640" height="360" frameborder="0" scrolling="no" webkitallowfullscreen="" mozallowfullscreen="" allowfullscreen=""] [protected-iframe id="fdf818f4afa2f7dcb179c5516c44918c-10874323-9129869" info="https://embed-ssl.ted.com/talks/mikko_hypponen_three_types_of_online_attack.html" width="640" height="360" frameborder="0" scrolling="no" webkitallowfullscreen="" mozallowfullscreen="" allowfullscreen=""] [protected-iframe id="54be2fe9bce28ae991becbe3d4291e56-10874323-9129869" info="https://embed-ssl.ted.com/talks/mikko_hypponen_how_the_nsa_betrayed_the_world_s_trust_time_to_act.html" width="640" height="360" frameborder="0" scrolling="no" webkitallowfullscreen="" mozallowfullscreen="" allowfullscreen=""] 3. Check out his first AMA, which took place just after his first talk at TEDglobal was published. 4. Take a trip to Pakistan with Mikko to meet the creators of the first PC virus. [protected-iframe id="8c0605f62076aa901ed165dbd3f4fcd7-10874323-9129869" info="//www.youtube-nocookie.com/v/lnedOWfPKT0?version=3&hl=en_US&rel=0" width="640" height="360"] 5. To get a sense of what he's been thinking about recently, watch his most recent talk at Black Hat "Governments as Malware Creators". [protected-iframe id="54b24406f022e81b15ad6dadf2adfc93-10874323-9129869" info="//www.youtube-nocookie.com/v/txknsq5Z5-8?hl=en_US&version=3&rel=0" width="640" height="360"] BONUS: Make sure you follow him on Twitter to get a constant stream of insight about online security, privacy and classic arcade games. Cheers, Sandra
Social media is here to stay and it definitively changes our way to communicate. One new trend is the ability to communicate instantly without writing or saying anything. Good examples are Facebook’s Like-button and the indicators for what you are doing or feeling. Facebook’s Like-button is no doubt the most popular and important feature in this category. You really can’t be a Facebook user without getting in touch with it. But the big question is what you really mean by clicking Like? It sounds simple, but may be more complex than you think. You do not only express support for the post you like, it is also a social gesture towards the poster. You show that you have read the post and want to stay in touch. Another interesting question is how to deal with good posts about bad things. We see them almost daily. Someone is writing an excellent post about something that is very wrong. You really dislike the topic of the post even if you think it’s good that someone brings it up. You agree about something you dislike. Should you click Like? Does a like target the post or the topic of a post? There’s no generic rule for this and we all act differently. More activity, likes and comments, boost a post and makes it more visible. So it would make sense to like the post as we want to spread awareness about the problem. But it still feels wrong to like something that makes you feel sick. So that’s the poll question for today. How do you act when you see a good post about something bad? Do you click Like? [polldaddy poll=8445608] Safe surfing, Micke