Personal Data Security in the Shadow of the Big Company

All my non-technical friends, or those with limited technical abilities, are increasingly frustrated with how Apple, Android, or any other major platform works. I constantly hear them complaining about wanting to do something simple, only to find that their device or service won’t allow it. A recent example: a friend wanted to use iTunes parental controls to filter out violent zombie apps from appearing in App Store search results for their kids, but discovered there’s no way to do it—their children are still seeing apps with zombies chewing people’s heads off.

I believe the trend toward walled-garden environments with app stores, the app-centric interaction model, and the shift from owning music (CDs or audio files) to renting streaming subscriptions is deeply problematic. These increasingly locked-down features of modern devices represent a disturbing pattern that continues to grow. With data being managed by and hidden behind apps and big companies—touted as a “convenience” feature—users of these consumption-oriented devices are being distanced from direct control of their own data. The systems even hide the fact that their data, music, or applications consist of multiple files that could, in theory, be shared between devices, re-encoded, and modified for personal needs. But the app doesn’t allow it. It tries to lock you in: you can only watch the movie on your X-branded phone, X-branded TV device, or X-branded tablet. You cannot transcode it for your own needs, cannot separate the audio from the movie to create a ringtone. However, you can buy the right to use a ringtone—from a limited set of approved choices, of course.

I can’t believe what’s happened to something as simple as music these days. I have a large MP3/OGG/FLAC library. Some files were acquired illegally, but those won’t survive my next spring cleaning—if I like the music, I buy it anyway. My collection is carefully sorted and labeled. Meanwhile, “normal people” face endless confusion about what’s compatible with what, and shed tears when they waste money on incompatible content. Consider a user without a PC who has built up a large iTunes library, then buys an Android phone. “Wait, what do you mean I can’t listen to my music anymore?” At this point, it’s not just a security issue—the big company is essentially saying: if you don’t buy our products, if you buy from someone else, you can’t enjoy your music anymore. This is blackmail, legally supported and actively pushed. It makes their content completely worthless to anyone who thinks critically about it.

Apple can push updates silently to devices without asking permission or even notifying users. Skype produces encrypted traffic even when you’re not actively using it. Its binary is obfuscated against decompiling, so nobody has yet been able to determine what it really does. Dropbox has confirmed that it opens and reads your documents. These are serious security and privacy problems.

But there’s a way out of this trap. Here’s my setup that anyone can use, even without hardcore technical or computer skills:

• Video calls and chat: Use a SIP client—I recommend Linphone. SIP is more mature and secure than Skype, truly peer-to-peer with strong encryption, so no unauthorized parties will listen in on your calls.
• Folder sharing: Use BitTorrent Sync or OwnCloud.
• Music: Use FLAC, OGG, or even MP3 file formats. These formats are compatible with all your devices and provide much better bitrate and quality than streamed music. There are tons of players available to manage and play your library.
• Web search: DuckDuckGo
• Browse privately: Always use a VPN or proxy to browse the web. I use Tor for everything. It not only renders stupid UK site blockers useless but also encrypts and anonymizes my traffic.
• Encrypt your drives: Encrypt all your hard drives, especially on laptops. But don't use closed-source software—there's surely a reason they're hiding the code from scrutiny. BitLocker, for example, will decrypt your data for court orders without needing your password. I use Linux's built-in dm-crypt and ZFS encryption in FreeBSD. These encryption methods have proven safe even against intelligence agencies.
• Teach critical thinking: Don't let your children use DRM-only, big-company-locked devices for more than 30 minutes a day—well, if you want to raise hackers rather than passive consumers. I don't have any of these devices at home, so my kids are safe. :)
• QUESTION EVERYTHING!