Security

Out of curiosity, I recently installed the controversial Green Dam Youth Escort software on my (soon to be replaced) home computer.  This is the content filter software mandated by the People’s Republic of China, billed as providing a “green, healthy and harmonious internet environment”. 

It is currently aimed at restricting online pornography but could be used for … (sinister flourish) … other purposes. From July 1st 2009, all personal computers sold within mainland China (included imported ones) must contain this software either preloaded or packaged for easy installation.

This is clearly a far-reaching move, particularly because most people are unlikely to toy around with the software pre-installed in the factory, and are certainly unlikely to re-install the operating system (there is no option to uninstall GDYE in Windows Add/Remove Programs - perhaps native Chinese speakers can find an option somewhere within the program).

When launching the quaint, dated installer program, a cartoony splash-screen pops up which is clearly encourages us to “think of the children!”. This reminds me of the youth-centric motive behind this software - it must be installed on all computers bought within China, but there must be a way for adults to control its behaviour otherwise why limit it as a ‘Youth Escort’?  Unfortunately, I cannot test this with my limited powers in Chinese linguistics (how many people do you know who can even say the words for ‘hello’, or ‘yes’, let alone read them in their native typography?)

The remainder of the installation process is - for those unable to read Chinese - an exercise in intuition and guesswork.  Sometimes there are a choice of three buttons - presumably OK, Cancel, and … ? - labelled with characters my home computer is not even set up to display.

There is a licence agreement which, if you scroll down, has a translation in English.  This is a third-party package included with the GDYE - namely the Intel Open Source Computer Vision Library.  The original text of the licence shipped with this framework is faithfully reproduced (there is no licence agreement provided in English for the content filter itself).

The inclusion of this “Computer Vision” library is - at first - perplexing.  It is an image-processing toolkit, specifically aimed at “facial recognition, motion tracking and mobile robotics”.  A little imagination leads to fears that the software uses the on-board webcam most laptops today ship with, to identify the user of the computer.  But the truth is not as sinister - Green Dam ostensibly uses this library to detect images of nudity displayed in a web brower for example, and block them.

As the installation proceeds, several more chinese prompts are displayed and then there is a promising disappearence and system reboot as we gather the software has been successfully installed. Perhaps the contents of my home computer are now being long-hauled back to China?

I try a few URLs to test the pornographic filter (pure imagination of course, I don’t have them committed to memory).  I cannot get them to load in Firefox: successful block. I call up a few sites that are outside the advertised jurisdiction of GDYE’s content policies but may be considered sensitive by the Chinese government - Wikipedia, Amnesty International, Twitter, BBC News (including some pages about Tiananmen Square).  All loaded as I’d expect, however this is not surprising, as the sophisticated and comprehensive Golden Shield Project already exists in China to block censored information at the network level.

In a moment of disturbed clarity I run a command to find out whether the program has opened an information pipeline between my computer and China.  There were no unusual internet addresses listed, although this does not prove that the program does not periodically ‘phone home’, or whether a hidden back door has been left open on the latch.

From this very brief experiment, Green Dam appears to be just another page in the vast encyclopedia of Chinese censorship techniques.  Although the dam has its holes, these are more than adequately patched by a raft of strategies on many levels in China today.

I decide I’ve had enough fun with my colourful escort for today, so I take my usual route to remove a recently installed program.  But it’s not listed.  In all fairness, no less can be expected from a government-mandated content filter. I’m not sure which software I’d prefer installed on my computer - a virus hell-bent on identity theft distributed by a motley crew of hackers, or a program colourful in name and appearance originating from the Chinese government to protect children.

I’m glad I kept my recovery CD.

Up to now, I’ve always declined to set up security questions on my Yahoo Mail account, simply because I have no fears of forgetting my password.  I’ve never really thought much about the whole thing. But to my annoyance, today I was forced to select two security questions and answers, before I could even log into my account.  Through pure annoyance I nearly lapsed into parody (Question: “Do I really give a F—?”) but then realised this would leave my account wide open for somebody to easily recover my password! This caused me to realise just how big a loophole the security question model is.  Upon reflection, I felt was being forced to provide an additional - and less secure - means of access to my account.  Even if I selected one of the provided questions (”What was the name of the hospital you were born in?”), this could be easily learned through a little social engineering.  Most likely, family members and those in close relationships would have a good chance at correctly answering the security questions for each other. But a further gap exists where it is possible to provide your own question and answer, which may not be chosen with security in mind.  How many people will opt for “What is my favourite colour?” (even a stranger could guess that after a few tries), or even worse “Do I really give a f—” as I nearly set up in my annoyance (the answer to this rhetorical question is obvious). Ideally, we would all set up our own question which only we can answer, but in practice a lot of people will be lax on this. I wonder why Yahoo made security questions mandatory all of a sudden? Presumably I did not choose any when I registered, and perhaps Yahoo are spending a lot of money manually recovering accounts. Although there needs to be a way to recover lost email accounts, the security question model seems far from ideal.  Is there a better way to recover lost email accounts without invoking a manual process?  To answer this, we are really asking the question of “what alternatives are there to passwords - which I can easily forget”?