| #: |
From / Date: |
Question / Answer: |
| 6203. |
Gary
Grand Rapids Age: 43 Jul 28, 2009
|
#6195, personal checks
JJ, personal checks always have account holder's name and account number embedded in a checking transaction. Don't you feel it is a privacy vulnerability to your home's location to have your name and personal bank account number paying the taxes for certain property?
...
I assure you, no check of mine would ever tie me in to a home address! (The only address the bank has is a PO Box in Fairbanks, Alaska. The bank does not have my phone number.)
|
| 6202. |
Janet
Ellicott City, MD Age: 25 Jul 28, 2009
|
License plates.in 2 states
If I want to get a license plate from two states, so I can look like a local as I'm driving in each, does that mean I have to get two different auto insurance policies? One policy for each state?
...
No.
|
| 6201. |
Seth
collbran, co Age: 50 Jul 27, 2009
|
Document security
"I am in need of a way to keep a lot of extensive notes/journals of which I can access daily. However, I do not want to keep a hand written copy as anyone who happens to find them can read it. I am also concerned about having the notes on a computer file as the file can be hacked or accessed without my consent. I do have an old computer I can use for typing the information (not connected to internet). What alternatives do I have for storing the information?"
You have many alternatives, but the first thing you have to do is decide just how secure your data needs to be, and whom you place your trust in when obtaining secure devices.
There is an old axiom, by Benjamin Franklin I think, that says "Three people can keep a secret, if two of them are dead."
With this in mind, understand that if you are attempting to hide information from three-letter federal agencies, the chances of success are quite small and the methods are beyond anything you'll find here.
If you're trying to protect information from criminals, hackers, snoops and even foreign governments, you have some options, but doing so with certainty requires rather a lot of effort and retraining of your attitudes and habits.
If your concern is more prosaic, and you just want to keep snoops at bay, you have many options.
Recognize that the biggest hole in any security system (or privacy effort for that matter) is YOU, and your family, and your friends. Loose lips sink ships, and that's how most secrets are revealed. When it comes to computers, the biggest mistakes are using unsecure passphrases, giving passphrases out to untrustworthy people, and writing them down. So the first change you have to make is to resolve to keep your secrets SECRET, and take to the grave the passphrases you use to protect your truly valuable information. Never write it down, commit it to memory, make it a secure and lengthy passphrase, and keep it to yourself.
If you do this, for protecting information from casual snooping, almost any off-the-shelf encryption program or system will be sufficient to protect your data. Modern encryption packages are pretty much unbreakable these days so long as you also RETAIN CONTROL OF THE DATA. If someone steals the encrypted data and can work on cracking the password without being detected, only the most sophisticated systems will keep your information safe. So controlling physical access is as important as encryption and secure passwords.
The most effective physical security is the "purloined letter" method where the data appears to be something it's not, some innocuous object that no one would think hides information.
But since you need to access this information daily, that's not really going to be workable.
My best suggestion at this point for keeping computerized data about as safe as you can possibly keep it is to obtain an IronKey USB drive and store all data on this device, and either keep it physically in your possession (not on your keyring) or in a safe when it's not in use.
This device is as secure as any I've found. It encrypts data coming to and from the chip "on the fly" so the data is never left in an unencrypted state except when you're actually viewing it. It also has one unique feature that makes it head-and-shoulders above all the rest; it has an auto-destruct function that physically frys the encryption module if you enter the wrong password ten times in a row. This prevents brute-force cracking attempts in case the device is lost.
In addition, you would want to consider a program called "TrueCrypt" for your computer, which is an on-the-fly encryption program that keeps all data on your computer's hard disc encrypted at all times. It also allows you to create a "hidden partition" on the disk where data can be stored in a manner that, they claim, cannot be distinguished from random data.
Using a computer that is NEVER connected to the Internet (take the telephone modem, wifi and network cards out of the machine completely to avoid temptation and to prevent someone from sneaking in and hooking it up while you're not home) and that you boot up from a removable disk, either a hard disk or DVD with your system files burned onto it as the boot drive, and you've protected against pretty much anything other than a physical attack on your computer (installation of a key logger or other physical monitoring device) or a Tempest attack (monitoring your computer by radio frequency reception), so long as you use good security procedures to make sure that you control the boot disk at all times to prevent copying or inserting of malware or spyware into your system files.
In reality, if all you are doing is using the computer as a typewriter, and you have no need for any of the programs, a simple computer works quite well. Unfortunately, most new operating systems REQUIRE that you connect to the Internet for validation and activation of the software, and Windows will shut down if you do not regularly connect to the Internet so Microsoft can snoop your hard drive to see if you're stealing software. Trust me, ALL major software vendors, particularly OS vendors, insert their own "spyware" in their programs if for no other reason than to keep track of customers, so if you undertake this effort, you have to learn to adapt to not using the Internet AT ALL, EVER with your secure computer. This means that you will have to become a self-educated software expert about YOUR software, because this also means that you can NEVER take your computer into a repair shop for repairs, lest they connect to the internet, which they will, for diagnostic purposes.
You should run an open-source freeware version of Linux or Unix that does not require on-line registration, purchased using a straw man buyer so it's not traceable to you.
You have quite a lot of self-education ahead of you if you truly need to be absolutely secure, so the real question is just how secure you really need to be. You can be "Bourne Agenda" paranoid, or you can be rational about your security needs. Either way, you'll be spending a lot of time on line figuring out your system.
The most important thing to know about ALL encryption systems is that they are either crackable by brute force (which means NSA supercomputers) or they have back doors which allow the government to snoop at will. The only one I know of that doesn't is open-source PGP, and I don't know what the current state of encryption cracking is. I used to keep up with it, but gave up a while back because I no longer had a need to be ultra-secure.
But you can be certain that every encryption program produced in the US, especially those that have a license from the government for export out of the US are crackable by the US government. This is a requirement of obtaining an export license for encryption programs, which are considered "munitions" under federal law, and thus are controlled-export items. Even the IronKey is vulnerable to government decryption. I asked them specifically about export restrictions, and they are only prohibited for export to places like Iran and North Korea and a few others on the "enemies" list. They refused to answer whether or not there is a government/manufacturer "back door" into the system.
This is the problem with any system you use where you have to trust the manufacturer. You simply have no way of knowing if they have a back door or if they are willing to cooperate with federal authorities (or state and local authorities for that matter) if your storage media needs to be unencrypted for national security or criminal reasons. So if you are engaged in anything shady or illegal, know that you're not invulnerable, ever.
Keep in mind also, that any time you reenter the US, Customs has legal authority to copy everything on your computer or drives/storage devices and examine it. Whether they can force you to give up the password is another matter, but if you refuse, they can keep your computer indefinitely. Some people have lost computers for up to 3 months.
So, your travel plans also have to take this into account.
To help you any further, I'd have to know more about what your specific needs are to give you advice on the level of security you might need.
Submitted Link #1: https://www.ironkey.com...
|
| 6200. |
Drake
LA, CA Age: 34 Jul 27, 2009
|
6194 - Document Security
Type on your old computer, directly to an encrypted USB drive stick, (like IronKey), into a steganography program as suggested by Mr. Luna, that is running TrueCrypt.
Keep photos of landscapes or portraits on the IronKey and rename the TrueCrypt program so it looks like another batch of photos.
Save each photo or document with a file name and password that reminds you what is pictured. If you know you notes are only in the photos of mountain blue birds, you can believably forget that password longer than the others.
Now you can bore your inquisitors to death before they even realize you've got notes in there, somewhere.
|
| 6199. |
Sam
Poway, California Age: 63 Jul 27, 2009
|
Credit Card in Professional Name
I read your suggestion, and contacted my two credit card companies. One said they do not do this. The other said they will do it, but I must apply for a separate business account, which will have an annual fee. The annual fee is not so much a concern as is applying for another account and resupplying all my info. I told them they have my info., but they say they are a different division of the same company and so I need to give them my info again. This sounds odd to me.
I would be using his card mostly for hotels. If I use a card to pay for air travel or rental cars, they insist that the name on the card match my passport or DL name. With few exceptions, I use a card only for those businesses such as airlines, hotels and car rental companies that demand them. I do not use them for other purchases - an acquaintance who works in the industry tells me that they track not only who you do business with, but what you buy, ostensibly so they may target you with sales offers, but in reality for other purposes also.
Other than hotels, for what types of purposes do you use your card that shows your "professional name"?
...
I use the alternate card only for hotels, and I did not have any problem getting the second card on the same account. This was several years ago. Perhaps times have changed.
|
| 6198. |
Josh
Seattle, Wash. Age: 36 Jul 27, 2009
|
Re: Payment of property taxes (Gary; #6195)
Option #1: Go to your bank and get a cashier's check. Instruct the teller to leave the purchaser field blank or to use "Owner" instead of your name.
Option #2: Use money orders. Go to a local store where you can buy a Western Union money order, using cash, for a nominal fee. Depending on the amount of the property taxes, you may need to get multiple money orders.
|
| 6197. |
Chris
Charlottesville, VA Age: 44 Jul 27, 2009
|
RE: 6192
RE: anonymous payments for Utilities
Most utility companies take credit cards. So you can get a Visa gift card at the local supermarket and use it to pay the bill.
I also try to use a pseudonym or business name for my utilities.
|
| 6195. |
Gary
Grand Rapids, MI Age: 43 Jul 27, 2009
|
property taxes
What is a common way for privacy seekers to pay their property taxes for the house they live in? The bill can be thousands of dollars and even if you have a bank account in another name (like a business name) it still has your SSN in the paperwork that opened the bank account.
Is paying cash the only way? Do they let you pay cash at county building?
...
Most of us just mail them a personal check. It does not affect the information on the county database.
|
| 6194. |
Iris
King George, VA Age: 40 Jul 27, 2009
|
Document security
I am in need of a way to keep a lot of extensive notes/journals of which I can access daily. However, I do not want to keep a hand written copy as anyone who happens to find them can read it. I am also concerned about having the notes on a computer file as the file can be hacked or accessed without my consent. I do have an old computer I can use for typing the information (not connected to internet). What alternatives do I have for storing the information?
...
Use your old computer and encrypt the file. You might even try steganography. (If someone accesses the file, it will appear to be some boring pictures or illustrations. Other readers may have additional or better ideas.
|
| 6193. |
Melissa
Houston, TX Age: 23 Jul 26, 2009
|
TSA
Jack, I am wondering if you or your readers have any insight on how the new TSA rules will actually impact commercial airline passengers in the US after they are implemented on August 15, 2009? This date is fast approaching, and I have yet to hear much discussion on the topic in the privacy world.
From what my travel agent tells me, I am required to provide my full legal name, birthdate, and gender to the airlines when I purchase my ticket for flights taking place after August 15th. Failure to comply will result in "severe delays and the possibility of not being able to fly", according to my travel agent. Apparently, passengers who don't provide this information will not be able to print boarding passes in advance or use the self-service kiosk at the airport.
Usually, I avoid using my unique middle name, which does happen to be printed on my passport & drivers license. I would strongly prefer to avoid providing this and my birthdate to the airlines. What do you predict will be the best way to handle this issue?
TSA press release link:
tsa.gov/press/releases/2009/0521.shtm
Submitted Link #1: http://www.usatoday.com/travel/flights/2008-10-22-...
|
| 6192. |
Brian
Detroit, MI Age: 22 Jul 26, 2009
|
anonymous payments for Utilities
I'd like to hear setups for paying utility bills, specifically about bills that normally accrue on a monthly basis like Cable TV, Electricity, Telephone, Cell Phone, etc.
Do you travel to the service provider office and pay this bill in cash every month (or send a money order). or do you find that service providers tend to have "prepay setups" where you can pay 6 months to a year in advance and they deduct your service costs from this prepayment. This way you only have to be bothered with getting them a payment every 6 months or even yearly instead of once a month.
I've looked into this a little for Cable TV and the setup appeared to be that the company would bill you monthly, but you would have to pay a $100 up front as a security deposit which they hold onto. But your stuck having to pay them monthly with cash or money order for your monthly bill.
I'm interested in finding out whether most companies require a monthly payment schedule or if whether prepayment allows consumers flexibility in determining when bills come due for them.
|
| 6191. |
Mike
Worcester, Mass. Age: 49 Jul 26, 2009
|
Auto insurance/SSN
Most insurance companies insist on having your SSN so they can run a credit report on you and use that as a factor in determining your rate. Here in Mass., credit worthiness cannot be used for that purpose (by law). However, the insurance company may still request your SSN and run credit on you to prove your identity. In most cases, not giving your SSN to your insurer is a moot point anyway. Most insurers have access to the DMV databases in the states where they do business, so by giving out your driver's license number, they can look up your SSN. And one other note on Mass. You can't hide you car's VIN here for 2 reasons, 1) you will fail inspection(!), and 2) your VIN and license plate number are now printed on your window inspection sticker. This seems to be a growing trend in several states.
|
| 6190. |
Elizabeth
Monterey, CA Age: 54 Jul 25, 2009
|
license plate cameras in NV
I'm sure this Orwellian subject has been mentioned here before, but you can add Boulder City, NV, to the list of cities that record license plates. (See link below.) They make it sound like such a good thing, but I shudder to think of the possible misuses.
Submitted Link #1: http://www.lasvegassun.com/news/2009/jul/25/new-te...
|
| 6189. |
brian
Detroit Age: 22 Jul 25, 2009
|
Auto Insurance
Does one HAVE to give social security number to obtain Auto Insurance?
It's impossible to get a driver's license without giving a SSN. Has everyone here had to give their SSN to get Auto insurance?
...
Yes, most do give their SSN. This does not present a great danger, IMHO.
|
| 6187. |
Randy
Johnston, IA Age: 46 Jul 23, 2009
|
NY POST story: Don't Get That College Degree
Is this the story that Tommy (#6184) is looking for?
Submitted Link #1: http://www.nypost.com/seven/06282009/postopinion/o...
...
It appears to at least similar, if not the same. Thanks, Randy.
|
| 6186. |
Jay
Phoenix, AZ Age: 40 Jul 23, 2009
|
Car rental companies and your personal information
The most recent issue of 2600 magazine has an excellent article of the horrible security on car rental companies and your personal information. EXAMPLE: go to the Alamo website. Click 'Membership'. Click 'Sign me up now'. The next screen has the following, "We can use information from your past Alamo rentals to fill in most of the required fields for your membership profile. If you have never rented with Alamo before, you will be brought to the next step in enrollment. Please provide the requested information below."
All anyone needs is your name, DOB and license number to get your information and create a membership. If you've given Alamo your true address, home phone number, work number, etc. (as opposed to a PO Box on your license) all will display.
The article is not available online but here is a list of places that sell 2600
Submitted Link #1: http://www.2600.com/magazine/2600locations/...
|
| 6185. |
Josh
Seattle, Wash. Age: 36 Jul 23, 2009
|
Re: PayPass (Dan; #6183)
A Google search on disable paypass yields some informative results. I've listed one of the links here. Also, you may be able to contact your card provider to request a replacement card without the feature (no RFID).
Submitted Link #1: http://blogs.howstuffworks.com/2008/11/11/diy-disa...
|
| 6184. |
Tommy
NY 10708 Age: 54 Jul 23, 2009
|
NY Post College story
JJ,
Kindly repost the wonderful NY Post story from weeks back regarding why you should not attend college. It was great reading and I lost the link!!!
...
Sorry, but I deleted it and no longer have the URL.
|
| 6183. |
Dan
Hazel Green, WI Age: 36 Jul 23, 2009
|
Mastercard PayPass...
Greetings Jack,
I just received my new credit card in the mail and it contains the following unwanted feature: Mastercard PayPass.
Apparently you can make payments from up to two inches away from the credit card reader using this card, which is two inches too far for me!
Do any of your readers know how to disable or foil (perhaps literally) this mechanism?
Thanks and keep up the great work,
Dan
Submitted Link #1: http://www.paypass.com/...
|
| 6182. |
Maria
Texas Age: 40 Jul 23, 2009
|
social security # and college
My son applied at a local college as was told they needed his social. He didn't have it and didn't know it so they enrolled anyway and said he could give it later. He never did. I received a letter stating they needed it so I called and explained it was missing and we would have to reapply for a new card. This was not entirely the truth. I asked why it was needed and was told to prove residency and as a student I.D. I said he has a passport to prove citizenship. At that point he back peddled and said never mind we will just use his student I.D. There are foreign students and illegals going to school here and they don't have socials. The school does not need it. I had to practice having this conversation with others and in the mirror to become calm and proficient. Try it. Bring up the fact you have a passport and see tell them because of theft you will not give out your social. The man told he really didn't need it anyway. Maria
...
Excellent work, Maria. Well done!
|
|
|
 |