The same category as the ones who could do the exact same thing...
except they're doing it faster and more efficiently. Same as the guys who took to courthouses and county offices putting personal information online to make identity theft easier. And after a while a lot of those records got pulled again, and there's laws in many parts of the world about keeping personal information and making it available...
Look, it could be that burglars are really as stupid as everyone seem sto be saying here, and various flimflammers and con artists who generally use this kind of info will miss out on this one, but even if you're absolutely right about that... that doesn't mean that the people concerned about privacy are irrational, which is the theme of a lot of the comments on this page. At the worst they're pessimists.
Burglar bars (these people have something to protect), nicer than average cars, nicer than average lawn, all the same things the burglar looks for when they're looking for houses to investigate further, except they don't have to actually drive around rubbernecking and attracting attention, and they can do it so much faster.
Do you really think that the hamburglar, armed with a list of houses with no visible security, is going to be any less inconvenienced by all of the things that can't be determined by google street view?
Of course not. He's going to look for the houses that have visible but ineffective security, like burglar bars.
So in the end, he'd have to come and "case" the house anyway?
I already said that.
At that point, what makes using google street view any different than randomly driving through neighborhoods?
It's faster and safer and more efficient. He can go through the first pass in a fraction of the time.
And for contract builder scammers, having an old photo of the house to compare it with is a double benefit.
You're right, crooks are too stupid to take advantage of technology. No crooks ever make any use of computers, they'd never think of sending spam, building botnets, and doing any of that other foolish hollywood-movie sci-fi nonsense that nobody in the real world needs to care about...
How are you going to case a house from street view?
Casing a house doesn't just mean "check if nobody's home". There's all kinds of tells to look for, and if you can check out thousands of houses at once you can look for better opportunities for an in-person visit MUCH more effectively.
If privacy is really that much of a concern, you should be more worried about whether or not your neighbor has a webcam than the Google-mobile driving by.
Until Google creates "Google realtime webcam search" a bunch of independent webcams, unindexed, unsearchable, unnavigable, is far less of a concern.
Making personal data searchable changes the nature of the data in a fundamental way.
Do you understand that when the Internet was first invented people scientific documents and articles all over the place. It wasn't as easily available, but there was lots of information which has been removed due to the implications it could lead to if it did become easily available.
Um, yes, I've been around a fair while.
Do you know that a lot of personally identifiable information was made available on the Internet early on, and then when it became clear what the implications of making that information freely available were, that stalkers and con-artists and other not-so-nice people were using it to locate targets, it was removed?
This is not information which could not already be gained by simply going to the location.
This was not information that couldn't already be gained by going to the right courthouse with a couple of bucks for a photocopy machine. Changing the availability of information changes the nature of the information.
In this case, simply going to the location takes hours, looking at a picture takes seconds. You can "visit" thousands of times as many prospective targets with a tool like this.
If I went around taking pictures in Los Angeles I can't be arrested.
Well, um, depending on where you were and what you took the pictures of, you could certainly get unwanted attention from the authorities, but that's beside the point. Nowhere have I said that this was a crime. Just because something is legal that doesn't mean it's a good idea.
I don't think holding back technology out of fear for people using it incorrectly is exactly the correct solution.
That's a different issue than "it's just a picture". "It's going to happen anyway" at least recognizes the problem. It's going to happen anyway, yes, the transparent society is inevitable, but let's at least have some public debate over HOW it's going to happen before blithely going out and doing it.
Some con artist is going to break into a bank and realize they built a police station next door between pictures.
Possibly some bank robber is going to be that stupid, but more likely they're going to use the pictures to narrow down the candidates a lot quicker and more safely than driving past all of them. So they only have to study 3 banks instead of 30.
The longer they are indoors looking at a computer screen, the smaller the chance of me getting conned or robbed or whatever you're implying people are going to do.
If they can identify a dozen possible marks in half an day in front of a computer screen, instead of spending several days looking for half that many possibilities, then they have more time to set up the job.
Search engines *improve* productivity. The problem is they don't just improve productivity for the good guys.
The cameras take like one, maybe two pictures of you and then it's gone.
It's not just a picture. It's not the picture, it's the search engine and universal access to the picture... nicely tagged by street address, cross-indexed into the google search engine, just the thing for con artists and shady contractors looking for marks, burglars looking for houses to break into, who knows what else...
Depends on what the things are. If you make personal information easier to find, even if it's personal information that is so obvious when it's not something you're searching for that you don't think of it as private, you're opening up all kind of abuse. The law of unintended consequences has driven that point home often enough.
Let's put it this way, is it evil to have any residential areas as backgrounds in a movie, or on TV?
Movies and TVs don't provide a search engine for burglars looking for houses to case.
This is a human use question not a technological one. Those who have a right to look to the side of the road... should look at side of the road pictures. Those who do not have a reason to look along the side of the road--who are upstanding and considerate individuals should not look at those pictures.
So which category do burglars using Street View to "pre-case" thousands of houses without showing their faces or number plates in the neighborhood fall into?
If it's taboo to spy on your neighbors then don't use Google's street view. Or at the very least keep the view centered on the road.
I've tried three times to write a polite response to this comment, and I don't think I can manage it. If you really can't understand people's response to the transparent society then you're just not human.
Rather than just say "here is some extra code and ifdefs so it runs on Windows" is make changes to Windows so "your Linux code compiles without changes". Now let's ignore X, which is a mess, and I can't blame them for not emulating that. But they need to provide a working, default, POSIX-like environment.
You mean "they should ship Interix with Windows by default"?
Absolutely. That's the biggest thing they could do to turn around the view of Microsoft. The fact that they won't do it is continuing proof that no matter what they say it's all vapor.
So rather than the x80/x86 being the only Intel CPU to have mass-market success, it's in fact a third-party design that Intel started with, and they're batting 0.000?
They've done better in the embedded market, with chips like the 8048/8051 and the i960 family.
The scheme is accepting liability for that particular transaction.
It's not accepting liability for other transactions that someone using the flaws in the scheme for phishing would make.
When I buy via Paypal, I get redirected to Paypal's site, I can verify that it's Paypal's site, and that I'm not entering my authentication information into a third party site.
There's no need for Javascript authentication (on the client side!) and frames that hide the identity of the verification site and enable cross-site scripting attacks.
I agree that in a technical conference people will more likely be exposed, but it doesn't mean it SHOULD.
What part of "Not that the guys who did it were justified, and they're lucky they were just booted out" did you miss?
For the sake fo changing the car analogy, think of a firing range. When you go there, you are specifically told you shoot in a particular area, and told NOT to shoot wildly at will.
On the other hand, you're also not supposed to wander down the range to have a look at the targets, even though everyone's supposed to stop shooting when there's people on the range. Going to a geek conference (let alone Black Hat) and NOT using an an end-to-end encrypted connection is like ambling down the range while there's live firing going on.
One Usenix there was an announcement that everyone who had used Kerberos to log in from the terminal room needed to set up new keys. Another finished with a paper on what someone had sniffed on the Wifi LAN.
So it's no bloody surprise it's happened at Black Hat. Not that the guys who did it were justified, and they're lucky they were just booted out, but anyone who doesn't use encrypted VPNs or encrypted tunnels at ANY technical conference is asking for trouble.
I realize that there must be people who have never had occasional thoughts that there would be less war if more of the people involved had to face the results of their actions, but I'm not sure I'd want to meet one.
Slashdot Mirror
I mean, if they were interested in security patches they wouldn't be using pHP in the first place.
The same category as the ones who could do the exact same thing...
except they're doing it faster and more efficiently. Same as the guys who took to courthouses and county offices putting personal information online to make identity theft easier. And after a while a lot of those records got pulled again, and there's laws in many parts of the world about keeping personal information and making it available...
Look, it could be that burglars are really as stupid as everyone seem sto be saying here, and various flimflammers and con artists who generally use this kind of info will miss out on this one, but even if you're absolutely right about that... that doesn't mean that the people concerned about privacy are irrational, which is the theme of a lot of the comments on this page. At the worst they're pessimists.
Burglar bars (these people have something to protect), nicer than average cars, nicer than average lawn, all the same things the burglar looks for when they're looking for houses to investigate further, except they don't have to actually drive around rubbernecking and attracting attention, and they can do it so much faster.
Do you really think that the hamburglar, armed with a list of houses with no visible security, is going to be any less inconvenienced by all of the things that can't be determined by google street view?
Of course not. He's going to look for the houses that have visible but ineffective security, like burglar bars.
So in the end, he'd have to come and "case" the house anyway?
I already said that.
At that point, what makes using google street view any different than randomly driving through neighborhoods?
It's faster and safer and more efficient. He can go through the first pass in a fraction of the time.
And for contract builder scammers, having an old photo of the house to compare it with is a double benefit.
The good old slashdot fallback, "argument by abuse".
You're right, crooks are too stupid to take advantage of technology. No crooks ever make any use of computers, they'd never think of sending spam, building botnets, and doing any of that other foolish hollywood-movie sci-fi nonsense that nobody in the real world needs to care about...
Ah yes, there's no difference between asking someone "which way's main street" and "which houses have burglar bars"?
How are you going to case a house from street view?
Casing a house doesn't just mean "check if nobody's home". There's all kinds of tells to look for, and if you can check out thousands of houses at once you can look for better opportunities for an in-person visit MUCH more effectively.
If privacy is really that much of a concern, you should be more worried about whether or not your neighbor has a webcam than the Google-mobile driving by.
Until Google creates "Google realtime webcam search" a bunch of independent webcams, unindexed, unsearchable, unnavigable, is far less of a concern.
Making personal data searchable changes the nature of the data in a fundamental way.
Do you understand that when the Internet was first invented people scientific documents and articles all over the place. It wasn't as easily available, but there was lots of information which has been removed due to the implications it could lead to if it did become easily available.
Um, yes, I've been around a fair while.
Do you know that a lot of personally identifiable information was made available on the Internet early on, and then when it became clear what the implications of making that information freely available were, that stalkers and con-artists and other not-so-nice people were using it to locate targets, it was removed?
This is not information which could not already be gained by simply going to the location.
This was not information that couldn't already be gained by going to the right courthouse with a couple of bucks for a photocopy machine. Changing the availability of information changes the nature of the information.
In this case, simply going to the location takes hours, looking at a picture takes seconds. You can "visit" thousands of times as many prospective targets with a tool like this.
If I went around taking pictures in Los Angeles I can't be arrested.
Well, um, depending on where you were and what you took the pictures of, you could certainly get unwanted attention from the authorities, but that's beside the point. Nowhere have I said that this was a crime. Just because something is legal that doesn't mean it's a good idea.
Stopped beating your wife yet, mister innuendo?
I don't think holding back technology out of fear for people using it incorrectly is exactly the correct solution.
That's a different issue than "it's just a picture". "It's going to happen anyway" at least recognizes the problem. It's going to happen anyway, yes, the transparent society is inevitable, but let's at least have some public debate over HOW it's going to happen before blithely going out and doing it.
Some con artist is going to break into a bank and realize they built a police station next door between pictures.
Possibly some bank robber is going to be that stupid, but more likely they're going to use the pictures to narrow down the candidates a lot quicker and more safely than driving past all of them. So they only have to study 3 banks instead of 30.
The longer they are indoors looking at a computer screen, the smaller the chance of me getting conned or robbed or whatever you're implying people are going to do.
If they can identify a dozen possible marks in half an day in front of a computer screen, instead of spending several days looking for half that many possibilities, then they have more time to set up the job.
Search engines *improve* productivity. The problem is they don't just improve productivity for the good guys.
The cameras take like one, maybe two pictures of you and then it's gone.
It's not just a picture. It's not the picture, it's the search engine and universal access to the picture... nicely tagged by street address, cross-indexed into the google search engine, just the thing for con artists and shady contractors looking for marks, burglars looking for houses to break into, who knows what else...
Concerned people everywhere in the world have pointed out Higuchi's same privacy concerns about Google Street View.
So what? That doesn't mean he's wrong about Google Street View. At most he's wrong about Japan.
What's evil about making things easier to find?
Depends on what the things are. If you make personal information easier to find, even if it's personal information that is so obvious when it's not something you're searching for that you don't think of it as private, you're opening up all kind of abuse. The law of unintended consequences has driven that point home often enough.
Let's put it this way, is it evil to have any residential areas as backgrounds in a movie, or on TV?
Movies and TVs don't provide a search engine for burglars looking for houses to case.
This is a human use question not a technological one. Those who have a right to look to the side of the road... should look at side of the road pictures. Those who do not have a reason to look along the side of the road--who are upstanding and considerate individuals should not look at those pictures.
So which category do burglars using Street View to "pre-case" thousands of houses without showing their faces or number plates in the neighborhood fall into?
If it's taboo to spy on your neighbors then don't use Google's street view. Or at the very least keep the view centered on the road.
I've tried three times to write a polite response to this comment, and I don't think I can manage it. If you really can't understand people's response to the transparent society then you're just not human.
Street View is too intrusive for residential neighborhoods in the USA.
Stick to city centers, airports, freeways. Stay out of neighborhoods. Don't be evil.
Rather than just say "here is some extra code and ifdefs so it runs on Windows" is make changes to Windows so "your Linux code compiles without changes". Now let's ignore X, which is a mess, and I can't blame them for not emulating that. But they need to provide a working, default, POSIX-like environment.
You mean "they should ship Interix with Windows by default"?
Absolutely. That's the biggest thing they could do to turn around the view of Microsoft. The fact that they won't do it is continuing proof that no matter what they say it's all vapor.
So rather than the x80/x86 being the only Intel CPU to have mass-market success, it's in fact a third-party design that Intel started with, and they're batting 0.000?
They've done better in the embedded market, with chips like the 8048/8051 and the i960 family.
The scheme is accepting liability for that particular transaction.
It's not accepting liability for other transactions that someone using the flaws in the scheme for phishing would make.
When I buy via Paypal, I get redirected to Paypal's site, I can verify that it's Paypal's site, and that I'm not entering my authentication information into a third party site.
There's no need for Javascript authentication (on the client side!) and frames that hide the identity of the verification site and enable cross-site scripting attacks.
I agree that in a technical conference people will more likely be exposed, but it doesn't mean it SHOULD.
What part of "Not that the guys who did it were justified, and they're lucky they were just booted out" did you miss?
For the sake fo changing the car analogy, think of a firing range. When you go there, you are specifically told you shoot in a particular area, and told NOT to shoot wildly at will.
On the other hand, you're also not supposed to wander down the range to have a look at the targets, even though everyone's supposed to stop shooting when there's people on the range. Going to a geek conference (let alone Black Hat) and NOT using an an end-to-end encrypted connection is like ambling down the range while there's live firing going on.
One Usenix there was an announcement that everyone who had used Kerberos to log in from the terminal room needed to set up new keys. Another finished with a paper on what someone had sniffed on the Wifi LAN.
So it's no bloody surprise it's happened at Black Hat. Not that the guys who did it were justified, and they're lucky they were just booted out, but anyone who doesn't use encrypted VPNs or encrypted tunnels at ANY technical conference is asking for trouble.
Thanks, toby, for doing the research I neglected to. :)
I realize that there must be people who have never had occasional thoughts that there would be less war if more of the people involved had to face the results of their actions, but I'm not sure I'd want to meet one.