lookout.net

Chris Weber's personal homepage

Children, devices, and going online. A guide to security and privacy.

06 Apr 2017

This guide is meant to be a quick look at some of the risks facing you and your kid as they start going online with an iPhone or other mobile device. Much of the content is equally relevant to a laptop or other computing device, the problem statement being something like.

Oh shit, my kid is now on the Internet, help me!

TL;DR If this is too much to read, skip straight to the suggestions for what you can do to save your child's mind and soul from the manipulative matrix of the Archons, the suggestions are split into two main threads:

I also talk a lot about setting boundaries for children, which means having clear rules. I'm sharing some of my own contracts that I've created and pushing them to the front of this article because they are sort of foundational.

Certainly there are many ways to vary these contracts, but I wanted to keep my own simple one pager. Something I could read over with my own kids, and they would understand. Going through this process was better than not doing it, as it raised more questions and perspectives, and set a minimum bar for everyone's understanding.

Furthermore, it's important to understand who the actors are that impact you and your child's privacy. I know, I'm already veering of the 'child' focus and yes this does all extend to grown ups too. The actors who are interested in collecting and exploiting your data (from browsing histories to email communications) include foreign and domestic governments to vast advertising networks (consider them all listening to everything all the time), to more isolated criminals, bullies, and trolls. It's not about "I have nothing to hide" - we are far beyond that, this is about regaining some level of control over your life.

Table of Contents

A Little Background

Consider a recent article in Wired called 'Tim Berners-Lee, Inventor of the Web, Plots a Radical Overhaul of His Creation'. Sir Tim Berners-Lee has been an advocate of user privacy since the Web was born, and recognizes that:

"Today, huge companies like Amazon, Facebook, Google, and Netflix dominate the web. These corporate giants enjoy an enormous amount of control not only over what people see and do online but over users’ private data."

The state of the Web today, what got us here, is the advertising-centric business model of the Web that has led masses of people to expect services for free, and to almost without any thought willingly hand over all of their transactional and communication information to service providers. However, the tide may be turning, as people start to see the Internet in the way it was originally seen, a network where the people control their own information. Sir Tim Berners-Lee and others believe that we are in a transition period where people are just starting to recognize the value of their personal data, and that:

"A tipping point could be reached where people will realize ‘that data belongs to me'"

He is working on a new project to decentralize the Web, and give users control over their own data. For more perspective from Sir Tim Berners-Lee, read his article 'Three challenges for the web, according to its inventor' written on March 12, 2017, the Web's 28th birthday.

There are many highly-respected advocates for privacy and for a new Web that recharts the current advertising-centric course we are on. Jaron Lanier, inventor of Virtual Reality, has the ear of many Silicon Valley elite and has been suggesting they offer users alternatives to 'free' services that are supported purely by advertising. His concepts of rewarding artists and content creators through a micropayment economy, along with the negative economic effects that the current advertising model of the Web will lead us to, are explored in his book Who Own's the Future.

My guide here was originally meant to explore some of the privacy, security, and psychological risks facing children as they go online into this Brave New World that welcomes them with a vast, largely invisible, corporate and government surveillance system, and offer suggestions for how to protect them. Consider the following illustration - a mind map outlining the content.

Psychological

The psychological aspects of owning a mobile device range from the threats of addiction to the benefits of knowing your kid's location at any given moment.

Threats

From addiction to bullying to coming across horrific and mind-altering content that should never have been seen, the Internet has plenty to offer.

Addiction

Any parent who has used their iPad as a babysitter knows the addiction-effect all too well. Are you reading this with a glass of wine as your child veges out on their iPad? Are you one of those people who takes their kids to dinner and let's them zone out on the thing for the entire time? Maybe you're the addicted one eh?

Screen addiction

Of course kids have addictions, and this will be one of them. Prepare yourself, you probably don't like seeing people walk down the street while staring into their devices, texting friends while eating dinner with their family, or driving with one hand on the wheel and another on their device. This will be them if given a clear runway, so setting up some clear boundaries can help.

'Like' addiction

Once they get into any social environment, addiction will take a new form. It turns from device addiction into 'like' addiction, the impulsive want to see others liking their post, image, or comment. It seems like an important area to explore with the child, not in a way that you have to control it, but in a way that you can talk about it with them.

Distraction

What were we talking about? Did I miss something?

Notification nightmare

Who really likes notifications? Ding, buzz, whoot, constant noise and vibration about events that are almost always insignificant and can wait.

Lose ability to focus

It's not just notifications though, it's the devices and information overload in general which are leading us to a culture devoid of patience and focus. Too many screens to flip through, too many messages to parse I'll just read the headlines. How can we cultivate focus? Reading, drawing, journaling, watching birds, karate, there are so many ways.

Bullying

This is a big one for a lot of parents, especially those who have witnessed just how nasty some kids can get. Bullying can really mess with someone's head, kid or adult. How it's integrated and handled really depends on how psychologically mature someone is and how they can move through the moment.

Most of us probably don't want our kids to go out of their way to verbally assault and threaten another person, and we sure don't like it when they're on the receiving end. We've heard or witnessed tragic stories, from physical attacks to middle school girls committing suicide.

Situational awareness

I've heard from law enforcement that criminals see easy targets in people walking down the street with screens in their faces. Anyone who's checked out, who's busy texting or looking at their screen will lose some situational awareness. An assailant will take advantage of that and attack.

Be aware, always be aware.

Relational dysfunction

All of us who work in tech know the old phrase, that engineers prefer working with computers because they're much easier to understand than humans. Carry that forward to today where this comforting, reassuring, understandable piece of tech that always listens and does what I say is now with me 24x7.

Well, I don't really know how much more dysfunctional our relationships can get, but I suppose there's always room to fall. Human relationships are easy when events are on the surface, or when times are good. But go deeper, add a dose of stress, some conflict, a life trauma, or a bitter disagreement, and things get hard.

Maturing is the process of relating to each other in ethically responsible ways through a variety of challenging situations. Dysfunction could be treating another person in an ethically unresponsible way, only thinking about one's self, being a narcissist. Or it could just be the awkard ways in which we interact and respond to each other.

Hijacking the imagination

Do kids give up day dreaming? Do they lose ability to focus on an imaginary story? Does their curiosity get stunted? I'm not saying that, I'm saying their imagination is hijacked, it's taken from them.

This one seems to be related to how much time they spend on the device and whether they have any usage rules.

We've all heard about how Disney or Hollywood in general hijacks the imagination, because audio and video are one of our most powerful and influential mediums. The stories get into our minds, into our dreams, into our imaginations. It's truly an awesome medium, but what happens when we're immersed in it every day? When does our imagination have it's own space to exist, to be hungry, to seek, without being fed?

Criminals

When kids start to go online many parents share a common concern about child predators, scammers, and general sleaze balls. I dare not explore all the possibilities here, or review the historical cases, because well, I just don't want to.

This can be mitigated by having rules around information sharing, checking in on what your kids are doing, and listening to what they like to do so you can learn more about their habits.

Content

Of course there's this threat that the Internet is full of some of the most disturbing content one could ever imagine, and many could never imagine. These are dark corners where most of us do not tread, and we certainly don't want our kids treading there. Make them aware that they may come across things they won't like, or far far worse, things that they will never forget.

Mitigations

Here are some things you can do to protect and reduce the chance that something bad will happen, or the impact of it when it does. Also, these are generally good hygiene habits to start building now.

Establish rules, talk through them

To curb unconstrained addictions and distractions, implement a set of clear rules, present them to your child in the form of a contract, read them over together, and have the child sign. Review these rules every now and again, once or twice a year, as a refresher or to make changes.

For reference, I am sharing my own Child Computer Use Agreement for you to use or modify.

Determine times and places of use

Rules should describe things like times of use and usage locations. For example, some people want to keep devices out of the bedroom, others are ok with that but don't want them in there over night, instead using a charging table in the hall or other public area for over-nights. Times of use could something like limiting to 1 hour per day, or 4 days on and 3 days off each week.

For reference, I am sharing my own Child Technology Contract for you to use or modify.

Discuss bullying and ways to handle it

The rule here is, in a nutshell, if a chat or other conversation is starting to get nasty or make you feel bad, then get away from it, ignore it.

We told our kids that if they ever feel like someone is being mean or hurtful, then they should come find us so we can take a look and talk about it. It can be good to look at these things together, and talking about it can help kids learn to let go of things, not get attached to them. Bullies and trolls are just trying to bait people, and life is too short.

On the flip side, if your kid is the bully, then it may be time for a humility check. I'll ask the psychologists to chime in here on tools and techniques that can help when a child feels compelled to beat up another child. But my hunch is that, that need is based in the age-old power struggle. Bullies are usually making up for an emotional gap, a fear and shortcoming.

Kid wants power, kid finds a weaker victim, kid beats them up and feels powerful. Temporary dopamine rush. It's the hero / anti-hero, and your kid is now the anti-hero. So in this case, maybe a life lesson in shame needs to be surfaced. Some psychologists tie this behavior back to the way our Western culture has abandoned the old rites of passage. A rite of passage can be a powerfully humbling experience, but it requires an event that doesn't fit into our normal day to day. This could be something like a 'vision quest' which pits a growing child against their own mortality and forces them to see their relationship with others in a new light. Typically these events are saved for older children as they move into adulthood. In the Pacific Northwest, there are plenty of opportunities for something like a vision quest rite of passage, through church groups, wilderness organizations, etc.

I don't really have any advice to offer that would help a bully recognize their responsibility to others, and move more into a hero role. But it feels like talking to them, getting them outside, out of their element, in a position where they have to help others less fortunate, rather than hurt them, might be a good way to think about it.

Exercise a parents right to spot check

Another important rule to get clear on is the parent's right to 'spot audit'. In short, your child must understand that the parent can and will search their device, read their messages, look at their browsing history, and anything else because you know, it's for the kid's safety. Implement this right, and exercise it before you face a battle of losing it.

And, you must actually do this. Tell the kid, okay, you're getting audited, and actually look over their device. Skim through messages, look at what apps are installed, and review the browser history.

Set rules about information sharing

We want our kids to be smart, but smartness comes from experience, and we don't want the experience of unaddressed bullying or a child predator.

Teach kids that they never give out the following information:

Or their parents information, or basically anything about themselves. My general rule here is - if you want to tell someone online something personal that identifies you, then come talk with a parent about it first and let us decide together.

Disconnect for god's sake

Who doesn't like to disconnect? I've heard some people fear the idea of not being able to check their email, a business deal might fall through, or some other emergency might go unnoticed. And then they do it, and thank god, they love it.

Go outdoors for a hike, leave your device at home or disable it. Take one weekend per month and make a no-computer family weekend. Shake things up.

Content filtering

Content filtering blocks porn, violent, and other disturbing sites that can leave lasting impressions. The kinds of things you wish you never saw, but you can never un-see.

Imagine the crime-fighters at Facebook, Microsoft, and other companies who's job is to review horrifying content. They have to deal with serious psychological, emotional trauma from witnessing some of the photos and videos they review.

None of us want our children to see that stuff. Some of the best content filters are VPNs like Freedome, or DNS providers like OpenDNS.

Benefits

Of course this was supposed to be something like a threat model, but now it's time to stray and consider some of the benefits with your kid owning their own mobile device. I'm sure there are many benefits I'm not thinking about or haven't listed here, so consider this just a start.

Location awareness

Location sharing is a feature built into Apple's iPhone, making it super easy for parents to see where their kids are located at any time. It exists on other platforms as well as other applications. On your kid's iPhone, you can just enable location sharing and then see where they are located from your own iPhone.

Flashlight

It's always good to have a flashlight available. Make sure you're kid knows how to turn it on.

Communication

Knowing your kid can get in touch with you and you them can be comforting. Make sure they know how to dial 911 and how to call you or an emergency contact. Go through the drill with them a few times so they have it practiced.

Technical

This section intends to focus more on the technical threats to privacy and security, and provides a list of things you can do to easily protect your kid, and yourself for that matter.

Platform Choice

You may be all over the place, using Apple, Windows, and Google tech simultaneously, or you may decide you want to settle on one platform.

Apple, Android, or Windows?

Quite simply, which device do you get your child? You have to choose a platform. If you were to ask me, when it comes to mobile devices, I am a fan of the Apple iPhone for a variety of reasons:

1) Tim Cook has made privacy a high priority and has voiced this publicly, and stood behind it legally. "You are the product" for other manufacturers, who rely on your data to subsidize the costs of their devices and software. For Apple, you pay the higher premium for iPhones and iPads so that your data is protected, not exploited.

2) They control their own ecosystem which means their devices are consistently maintained and updated, the app store is relatively ok at finding naughty apps, and the attack surface available to a malicious app is smaller than it is for Android devices.

3) I like their family sharing stuff. It's not perfect, but it is nice that I can setup a shared credit card, and require my kids to request app purchases which I will be able to approve or deny. Plus, family sharing allows us to make one app or content/movie/music purchase and share it across our devices.

I love Microsoft as well, but more for their business applications like Office 365 and .NET Core, and Google for their core services.

Threats

Let's count some of the ways these powerful tools can be used against your child.

A mobile device is a surveillance tool.

A mobile device is a surveillance tool. Get that straight in your mind. Just the process of switching from cell tower to cell tower gives telcos a tracking capability, and we haven't even talked about GPS and Wi-Fi yet, browser activity, searches, apps, photos, etc.

Now this is the typical pros and cons thing, because in the unlikely situation that something happened and a legal investigation needed to be started, then this location information would be extremely valuable and comforting. But this same information can be abused by naughty businesses out there who make a living tracking people and collecting data without consent.

A lifetime of surveillance

You may have heard that privacy is dead, well given mass surveillance and behemoth search, social, and advertising conglomerates that exist it sure seems that way, but it's not really dead, it just requires some awareness and knowledge. I'm planning to write a privacy guide that goes into detail about protections, so for now I will keep it brief.

Consider that kids getting online today are entering an increasingly sophisticated surveillance system that will become even more advanced over their lifetimes. It's reasonable to think that these kids could have their entire digital footprint aggregated from multiple sources and stored basically forever.

Imagine the year 2030, when someone with access to 15 or 20 years of your child's data can do things like:

Identity theft

I don't want to scare the crap out of you, but this will scare the crap out of you. As if all the other threats weren't bad enough, children are becoming an increasingly sought after target for identity thieves. Consider the key findings from a 2011 Report on Child Identity Theft

Child Identity Theft

These findings do not look good for child identity theft.

With recent health care industry breaches, criminals have acquired mounds of valuable identity data including social security numbers, home addresses, parent names, full names, health records, and more. They may choose to sell this on the black market or sit on some of the identities until a future date.

Hacked

I don't like using the word hacked to describe your device getting pwned. Normally we'd call this a breach, a compromise, or an attack. But 'hacked' works too.

Security is important if you care at all about what's stored on your kid's device, and from photos to email to browser search history and private conversations, I'm betting it's important to you.

Information stolen

A jealous boyfriend hacks his girlfriends phone, and starts rifling through her messages and email.

Some hacker at school gets into the phone just for fun, and then dumps the information to a public website or social network.

There are many scenarios to consider, bottom line is, you probably don't want your kids information getting stolen.

Identity impersonation

Now that your kid's phone has been hacked, their identity can be impersonated. That means whoever has hacked the device, can send email messages as your kid, visit sites under the guise of your kid's identity, or otherwise look like them in whatever actions they do.

This attacker will also gain access to VPNs, Wi-Fi networks, and any other systems that the device has been configured to automatically log into.

Mitigations

Things you can do to protect and reduce the chance that something bad will happen, or the impact of it when it does. Also, these are generally good hygiene habits to start building now.

Get a private and secure email account

Maybe you've been using the same free email for the last 10 or 15 years, giving your email provider and their third party partners free reign to mine your messaging data, link it up with millions of other inboxes, and build valuable trends and predictive analytics that feed the colassal advertising empire. And as your life's correspondence is gathered, stored, and analyzed, you are making those companies billions of dollars. And that's not even considering the other actors who are interested in wholesale communication collection, such as foreign and domestic government surveillance programs.

While the best things in life are free, the best things on the Internet are not. Get Protonmail https://protonmail.com accounts for yourself and your family. You can start with the free account, but I suggest paying for the Protonmail Plus account. Protonmail is beautifully engineered from a company based in Switzerland and has many useful features, it's a pleasure to use. Protonmail will give you secure and private email, that's fully encrypted, so that even the staff at Protonmail can't read your messages. There is no advertising, no trackers, and no third-parties snooping in on your inbox and conversations.

Hushmail is another good alternative from a Canadian company, and I suggest the paid account if you go with them. And if you go with Apple as your platform of choice, an iCloud email account is an okay way to get started.

Get Brave

Brave is a new Web browser created by Brendan Eich, inventor of JavaScript and co-founder of Mozilla, who brought us the Firefox Web browser. JavaScript is the most important programming language that powers the Web, it's practically synonymous with the World Wide Web. The Brave browser has a radical mission to set the Web on a new course, by rewarding site content creators with optional micropayments, and by replacing problematic trackers and advertisers with a more secure and private Ad platform.

Get Brave for your kid and for yourself, it's built on Google Chrome's core Web browser technology.

Set a strong passcode

You know that default 4-digit PIN that you setup with your phone? Ya, change that right away. Change the passcode to the stronger password option, and use a non-guessable password, something that's not a simple word or combination of words. The best passwords are a collection of random letters, numbers, and special characters.

Enable fingerprint security

On iPhone this is called TouchId, and you can turn it on to gain an extra layer of security. Many apps support TouchId, so if the phone gets hacked, it provides an extra layer of protection that will prevent the attacker from opening the app.

Install a VPN

A Virtual Private Network (VPN) provides numerous privacy and security benefits. For privacy, a VPN encrypts your network communications so they cannot be intercepted, tampered, logged, or otherwise spied on.

VPN's can also provide content protection, blocking known sites that are categorized as porn, violent, criminal, or some other thing you don't want your child exposed to.

Some options include ProtonVPN by the makers of Protonmail. Also, Freedome VPN by F-Secure.

With a VPN installed, I would run it basically all the time, but many people will find it imperative while traveling or on public Wi-Fi networks (school, library, hotel).

Get OpenDNS

OpenDNS home and family shield is free, get it - https://www.opendns.com/home-internet-security/

It will give you several benefits:

OpenDNS has a vast network of domain data that's always updated. They categorize sites in a variety of ways so that you can easily block sites that host porn, violence, criminal, or other content. They also help to block trackers and other advertising sites that may abuse privacy.

Get encrypted messaging

So, here's the thing about messaging. Consider the default or normal set of messaging apps to essentially be like passing a letter across the classroom to its intended recipient, where everybody it passes by has a chance to read it, including the teacher.

SMS is definitely insecure, avoid it when possible. Who knows what telcos do with those messages, they have a lot of leeway to sell data to third parties, and I consider it untrusted.

To get straight to the point, iMessage is much better, and I am fine with the kids using that. It's actually really good, as Apple designed it so that messages are encrypted on their servers, so even Apple cannot read messages sent over iMessage.

If you prefer another step up, get Signal by Whisper Systems.

Your kid may want to use Snapchat or something similar, but they do not offer any encryption at the time I'm writing this. WhatsApp does offer end-to-end encryption, but they have suffered from several rookie mistakes over the years, and I'm not sure where they're at now.

Install Ghostery

Ghostery is a Web browser plugin that blocks a variety of trackers. A tracker is some technology that literally tracks your Web activity, what sites you visit, what links you click, and sometimes more like what search terms you enter or other information you provide.

https://www.ghostery.com/

Install this in each of your browsers.

Raise awareness

Let's get something straight. Online privacy isn't just a matter of "oh I don't care that Google can read all of my Gmail." The scope of privacy is huge, massive, well beyond any one service provider. It's a state of mind and a state of our future reality.

Let's start with the social media masters first. Consider this, you are logged into your Facebook or Twitter account. You open another tab in your browser, do a search, click a link, and open a webpage on a new site. In many cases, Facebook and Twitter will be notified of all those activities and the exact site and webpage you opened. This is because of how trackers work, the way sites share information with each other on the surface, through your browser.

Whenever you see a Facebook 'like' button on a page or a Twitter 'tweet this' button, those sites have already been notified that you loaded that page, before you even click to like or tweet. And they've been notified of how you arrived there.

Consider the philosophy of privacy

Sit down with your kids from time to time and explain a few things to them. But don't just lecture, we all get enough of that, and I'm probably doing it right now. Instead ask them some questions, and help them find answers and really, deeply understand more about the technology they are using, and the implications of mass government or corporate surveillance. If you're not comfortable with your own knowledge here, then follow some of my links below and educate yourself a bit, or see what your kid responds with, maybe they already know more than you do.

Basics - how does the Internet work kids? Well most simply, it's a network of nodes that can send messages to each other. It's a lot like nature's first Internet - mycellium, a substrate of mushrooms' root system where messages can travel great distances, many miles in some cases. Ya, I had to throw that out there.

Footprints - imagine kids, that as you walk across the Internet, you leave footprints in the sand, only the ocean never washes them away - they are forever. Make sure the kid gets that every message they send, every search they make, every webpage they visit, becomes a part of their permanent record. Not unlike the Akashic record, in that everything done online leaves an imprint and in this case it all links back to you as a person. Yes, we can learn a lot about you after 10 years of Internet activity.

That brings us to privacy. Think of privacy as a right, use it or lose it. This is our new reality of global surveillance and what privacy really means.

Discuss it. Go watch Edward Snowden's original disclosure interview with Glenn Greenwald. Don't get caught up with what you think of him, if he's a traitor or a heretical hero, or what you've heard, just go spend the 10 minutes to listen to the very first disclosure about mass surveillance ever released - https://www.youtube.com/watch?v=0hLjuVyIIrs.

Then, talk about the value of privacy. Do some research if you have to. Look up 'the chilling effect', go learn how Phil Zimmermann enabled human rights activists to report out from hostile and murderous regimes in the 90's by giving them tools to encrypt email - https://philzimmermann.com/EN/letters/index.html.

Think about the ethical responsibility around privacy, and how those ethics have been abused or completely ignored by some corporations and governments. Research how advertising companies have exploited vulnerabilities in the Web to track user activity when they were not supposed to.

Change your search engine to DuckDuckGo

Yes there are alternatives to Google, and yes their name is pretty weird. The good news - the results are good, they collect zero information about you, and they have some pretty neat features.

What can you learn about someone from 5 years of their search history, 10 years, a lifetime even? What if it's combined with email, known relationships, friends and family, and expand that out to demographic areas of all sorts. Data is useful stuff.

But do you want all that data collected, on your kid? DuckDuckGo is built on a concept of privacy, that was and is it's main goal, to protect your privacy. It has some pretty nifty features too, aside from not collecting data on you, it has instant answers, !bang search functionality, and other useful searching tools. Try it out https://duckduckgo.com/bang.

Start using a password manager

As you've probably noticed from most of the things on this list, they are all things you can be doing for yourself as well. That goes especially true for this one.

Get your kid using a password manager early. Teach them how to generate random passwords for new applications and sites that need them. Get away from the idea of re-using a few passwords, and get away from the idea of using 'memorable' passwords. Those days are over.

Install updates immediately

If you see an update come through for the device, install it immediately. Most often these address significant security issues, and waiting to install them means opening the window of opportunity for a vulnerability to be exploited. Attackers won't often be targeting your kid. Rather, attackers are interested in building automation that can attack a whole bunch of devices en masse, in order to compromise them and add them to their zombie botnet collection.

Subscribe to an identity theft monitoring service

Sign up for a credit and identity theft monitoring service, and do it for your entire family, kids included, all the way to infant age. I won't tell you which service to get, not in this article anyway. There are so many out there and I haven't studied them all, but I'm sure you can figure out which are reputable and which are not. The big 3 credit monitoring companies offer these services, as do several other tech-focused companies that specialize in this field.

The choice is yours. Consider it like insurance, it is a cost you have to pay to mitigate a potential risk.

Links

To dive deeper in the technical topics, with tutorials, tools, and other perspectives, check out some of the following links, which serve as excellent references.

Conclusion

As far as the focus on children, I did aim for that initially, and have talked through topics like bullying, addiction, setting boundaries through rules and contracts, protecting their privacy from digital surveillance, and subscribing to identity monitoring services. After writing this and reading through it though, I realize that it's more than a guide for safeguarding children when they get their first mobile device or start going online.

This can serve as an introductory guide to becoming aware of privacy and security issues and ways to protect anyone from those issues. There are details left out, and more significant measures that could be included depending on one's level of paranoia or desire to master this reality. Still I think this can serve as a good guide for anyone from novice to amateur level of experience with this topic. It's important to recognize that there is a huge battle taking place around us. There are government entities and corporations who want to get rid of all consumer privacy rights, and there are corporations and advocates who are fighting hard to protect privacy rights. Our future depends on understanding this landscape and making up your mind based on useful information rather than ambivalence and outside influence.