Long gone were the days of networking when the end-users were aware of where she’s connected to and what are the live connections opened at any particular time. Then came the ever-wonderful browser application and its simplistic and vulnerable cross-domain policy, under the umbrella of “good fit” of the capability to refer from a single source anywhere without requiring or even consider the user consent or awareness of what is going on. Partly for this reason the recent European Commission proposal to require the service providers (those who provide the service, the application, not the networking is considered here) to acquire end-users legitimate consent to the cookies they impose upon them. Practically this has been implemented in many cases as various dialogue boxes asking for permissions, even when the requirement of content is a wider concept.
There was a DeepSec conference some years ago in Vienna, in which a session was organised to discuss something like default privacy, or specifically cookie and encryption, settings for end-users. This was considered from the point of view that what were the reasons for vendors to ship many of their apps by all privacy and encryption turned off. This was commented for example by Google, who claimed from the audience, that they do this in order to serve the customer better, in order to ensure the customer experience. But at the same time the audience commented that the cookie settings are permissive by default for any parties because of the vendors are themselves engages in the grey business involved in privacy markets and advertisement.
From the similar reasoning, one could assume, raises the permissive mode of the operating systems and browser applications to allow arbitrary software vendors to initiate whatever connections and storage they consider necessary for whatever reason, by the cost of the end-user and her privacy. At the same time there are a multitude of application and vendors selling “security”, but in effect not blocking or providing any of the awareness to the end-user to make such decisions or become aware of vulnerable or illegitimate applications, but instead collect information of the running binaries from the end-users property in order to better run their signatures and hence sell their products.
So, it's argued here, that software vendors should educate themselves in their understanding of ethics and respect of individual also from the compassionate point of view that is some user retrieves their page or uses their application does not constitute a consent that the user could be transferred or forwarded to any other place. Currently, the case is that like an airport where the destination on the gate screen was unreliable and could lead you to anywhere in the world without your practical means to divert the route. Similarly, the infrastructure application vendors should consider if their applications should be considered to be in the need to improve, as they clearly give the end-user an incomplete awareness as of what she is doing and to where she is connecting to.
As infrastructure does not provide such awareness, there are various miscellaneous utility applications which of some try to support such awareness building. However, these either lack the in-process binding, let alone the in-HTML contextual mapping or proper user interfaces for the user to manage and understand the mappings (such as definition that “let this application connect there and there, but let me know when and if it behaves anomaly”, or “any application that tries to connect to any known advertisement server, is denied”, or “if an application tries to create sub-connections to X or more destinations, block it and report suspicious behaviours”. The point here is that some of these can be implemented with current solutions, but mostly they are either unusable, only partial or implemented out of the scope of end-users domain.
Author
Kristo Helasvuo, Guest Author.