Friday, 21 August 2015

Not-so-plausible deniability for clients at Ashley Madison

In our house, we have two computers. My wife has the laptop, and I prefer the one you can't lug around. We share an an email address, which is used as our online identity for I don't know how many site logins connected to a large number of largely forgotten passwords.

I also have my own private email address not connected to the laptop, so my wife need not be annoyed by my political junk, while browsing her stuff.

So, I wonder: since my email is listed on my blog sent to (I assume) billions of people around the world, has anyone used it to set up an account on the adultery web site Ashely Madison?

If so, the site's founder and CEO Noel Biderman says I have plausible deniability. If my email is discovered among the 30-odd million addresses — made public by a hacker group that revealed Ashley Madison's client list — I can claim I've been hacked.

Wasn't me! Someone absconded my email for hookup opportunities! In 30-odd million cases!

In my case, I trust my wife would believe me. I am terrible at keeping secrets and there's no way I could hide or plausibly explain away an adulterous affair to someone as insightful as my wife. Not that I've ever thought about that. Really.

But 30-odd million people thought they could get away with it. And now their email identities are public.

A whole lot of them work for government agencies, and used their government emails to sign up as a person seeking to cheat on their spouse, looking for someone who is also seeking to cheat on their spouse. And paying for the hookup service with a credit card. Setting themselves up for some pretty serious blackmail.

Ray Boisvert, a former assistant director of Canadian Security Intelligence Service asked the question that immediately pops up. Why on earth would you use your username, client ID from your credentials at work to log in and create an account on an adultery web site like Ashely Madison?

Well, obviously, so the spouse wouldn't find out. Better your boss at the school board, the attorney general's office, the RCMP or the other guys in the executive suite. Better any of them than your spouse.

One of the exposed emails belongs to the executive director of the Louisiana Republican Party, John Doré. He claims he signed on for research purposes.

Those of us with memories of the former Alberta government know how that goes.

But until Thursday at least, Noel Biderman was claiming Ashely Madison did not verify the emails of their clients for exactly this reason: someone could be falsely using your email account to look for hookups. He suggested out-of-date emails that no one uses anymore can be “harvested” by hackers and sold to people for this purpose.

No one can prove it's you out there cheating on your marriage, right? So you're OK. Thirty million-odd times.

Josh Duggar is a guy I never heard of before. He's a star (or used to be) of a reality TV show on the TLC network 19 Kids and Counting, about him and his devout fundamentalist Christian family.

Now we know he molested girls as a teenager, likes porn — and was a client for Ashley Madison. Another day, another tearful confession.

One wonders about the tearful confessions now being heard in the Pentagon, FBI, U.S. Homeland Security, Treasury, Justice, Department of State, to name a few Obama administration offices where service emails were used to compromise horny staff with sensitive portfolios.

Is everyone on the set of Homeland these days?

Duggar is reported to have paid just under a thousand dollars over the last three years for services rendered by Ashely Madison. Multiply that by 30 million and you can see how the site's owners want to sell an IPO, valuing the business at $1 billion.

Ashely Madison owns little more than a database and some rather vulnerable disks to store it on.

The hacker group says Ashley Madison's business plan is stupid, their entire client base is stupid and the whole $1 billion “thing” should be shut down.

Biderman believes he can plausibly deny this.

Ashley Madison is Toronto-based. There is a Canadian class action lawsuit filed against them seeking $760 million for the losses suffered by their sex-seeking clients who were outed by the hacker group's data leak. Who would be stupid enough to sign up for that?

The site has a button to click where you can pay them to delete and erase your client identity. The hacker group says that's impossible, and you would be stupid to use it.

Biderman and millions of others may be in deep denial these days. But plausible? Not so much.

Josh Duggar said two honest things when he came public: one is to admit that he is a hypocrite — which in his circles is a pretty serious thing. The other is to say you can choose your actions, but you can't choose the consequences.

1 comment: