Apple Account part 2

So quick recap. I got an email saying a new iphone 5 has logged in to my imessage account. Problem is, I don't own an iphone, I don't know what imessage is, and the email in the salutation isn't mine. The account has someone else's name and contact information, someone from Finland, but MY EMAIL ADDRESS as the verified account.

I've gone through the find my apple id, and all the info is right when I log in that way, using MY EMAIL ADDRESS for the recovery. When I log in with the apple id it emailed me, I get my stuff in English. When I use my email address as the apple id, nothing is right.

So after I got home, I did some more digging. I found out how to at least "disable" the account even though I couldn't permanently delete it.

Going through itunes, yes I had to install it, I could see that person's information. Not all of it, but some of it. Name, address etc. Same stuff I could see via the apple site.

More checking between the two accounts, I note that my email apple ID is verified, my other one is not. But both accounts have the same email address. Ok, I'll verify it on the account where everything is in English. Only the site won't let me. It's already been verified elsewhere and in use.

WTF...

The best I can figure out, Apple is using email addresses as their primary keys for the accounts now. Something they were not doing when I first signed up in 2005. Since I first signed up they are verifying accounts as well. Once verified that becomes another account  key, secondary, or primary in a second table. The problem is, someone not me was able to get my address listed as their verified address and their account.

I ended up un-associated MY ADDRESS With the account, and sent it off in to never land. I hope they have good luck getting their information and account back. I've verified my email address, and have now set it as my account name, with a 30 character password. I'd turn on two factor auth, but I don't own an apple device and that's required.

So the short version of the story. Someone got their Apple account associated with my email address. Claimed my address as their own and got it verified somehow. I got a notification when they used a new phone to log in to the account. Took control of the account, because they had used my email address, de-associated the account with my email address, and then made sure that my account was verified with my email address.

Apple Account part 1

So today, I got a strange email. I chalked it up to a phishing attempt at first, but it actually turned out to be something way more interesting.

The way it started:

Dear Paula,Your Apple ID (my email address) was used to sign in to iMessage on an iPhone 5 named “iPhone (Paula)”If you have not recently set up an iPhone with your Apple ID, then you should change your Apple ID password. Learn more.Apple Support

Well that's odd, my name isn't Puala, and while I own an IPod Color from 2005, I don't use apple products. In fact I have no idea where that IPod is.

Wait a tick, didn't I get an email a few months ago asking to to verify my apple id? The other email I thought was a phishing spam... (it's been more than 30 days and I deleted it when it came in).

Well no way this is right. I know, I'll prove it's spam. I'm not going to click shit. I'm going to go to apple.com and try to log in.

So I go there, try logging in with my email address, and told invalid password. WTF, okay lets try reset password. And Lo I get an email with the steps to reset my password, and I follow suit.

Go to the account page, some one in Finland, with a UK phone number. WTF. Well this can't be right. Someone set up an account, with a verified email address of MY EMAIL ADDRESS, but that's not me. So thinking someone popped my un-used account.

After not being able to get past the Finish security questions, I decide to call Apple Support. I open a case, and talk to a guy. He tried to help, but in the end, without my IPod or some other way to prove my account (the credit card number wasn't mine either). There was little he could do for me. I will say this for Apple, they do try to take your account security seriously, even if they won't let you delete your account.

The Apple Guy did think of one thing he could do. He walked me through the find my apple id part of the stie. It asked for my name, email address, other possible email address, home address, etc. The next page my DOB (month and day) and then the next page that asked for my security question. A question I wasn't expecting, but knew it was mine. One that only I would know the answer to. And then I was able to change my password.

Then I get an email. Saying my id, yet another one, has had it's password changed. Talk about more confusion. But it was time to leave for ISSA, and I was on my marry way, knowing that both accounts had 30 character random passwords.

to be contenuied

Really?

Dallas Police Depart@DallasPD

Our apologies for the fruit Ninja tweet sent earlier. One of our kids played the game on our iPhone and unknowingly tweeted their score.

12:22am · 27 Jan 13 · Twitter for iPhone

Really? Seriously? I'm left wondering. Was this IPhone issued by the department? If it was, why was it where a child could reach it. If I was his superior, I would seriously be asking some questions. Maybe I'm jaded from the bs that happened with the ex-Mayor in Detroit.

Look, I get that Chefs bring their own knives, and that mechanics bring their own tools. However... BYOD is a bad idea. Tell me when has an accountant, a CEO, Lawyer, or any other business unit brought their own filing cabinet, corporate ledger, etc. Ok I know they have the briefcases, file folios and the like, but the damage is smaller with those. It's not everything.

I understand we have commoditized computers and technology, but people really need to think about what that piece of tech does before that hand it someone else.

Sure there are some questions, was it a work phone or a personal phone. If it's personal why does it have work stuff on it? If it's business why is he being handed to a kid, I'd be worried about them reading the other stuff on the phone.

Lastly I'm curious, would this officer hand his service weapon to his child to play with, or leave it laying around where the kid could get it? I'm sure he is shamed by this point, but seriously it is time to have grown up conversations about BYOD and how the devices are used outside of work.  

One of the ones I didn't like

So I mentioned in the Plan for IA240 blog post, I had some other ideas. Ones that I decided to not go with for various reasons.

One to those ideas that I rejected:

Using a tablet, with my cell phone as a tether. I tried using my cellphone in class the first night. It didn't work too well. It was rather slow Googling questions the professor was asking.

I also didn't like the idea for a hand full of reasons. I could be wrong, because I don't understand all the tech.

First the tethering. I have a rooted (running cyanogen mod) cell phone, but every time I tried, I get messages saying the network I have for service is blocking it.

I'm still creating a wireless network that someone could try attacking. Other people wanting to connect. Not saying people would, but hacking wifi isn't that hard, and if they're willing to go after a laptop, why not go easier with a wifi connection.

I've only used Shark for Root sparingly. As I understand it, it can do 3g packet captures. I'm not sure if that's only for the phone it's on, or if it can grab any 3g signal. I also haven't found much documentation on it. I also don't have the equipment to test it properly at this time. Maybe we can set something like that up to EMU's IA Club, where we can play around with it and see what it does.

Just one of the ideas, I tossed to the side. I'll talk about another one some other time.

Well Tails works...

Sitting at Eastern Michigan University on the wireless network using T.A.I.L.S. It's a little slow, but that's ok. I'm riding across TOR to an exit node in germany.

To get this to work:
I loaded the system from the Live CD.

Then using the unsafe browser, I was able to get to the capture portal. To do that, you need to go to a non-https site. I like to use www.sluggy.com. Going to www.google.com got grabbed by HTTPSeverywhere, and was dragged to encrypted.google.com. Sadly that doesn't work with EMU's capture portal.

After that, started the ice-weasel browser to make sure it worked right. Which it did. Then shutdown the unsafe browser.

So this works.

Can't wait for Friday

I found out tonight that the IASA (Information Assurance Student Association) is having their kick off meeting Friday. At 5. Time sucks, but meh.

I'm actually thinking of tossing my id in the bit-bucket for an officer position. Don't know which one yet. I'm sure that'll fly like the NX37602. There are some things I think we could do better as students. Yeah it means more work for us, but in the long run, it makes us better students. No it's not hacking each other. Although some Saturday CTF in L6 would't be too bad. If allowed.

I also got to do some reading on T.A.I.L.S. tonight. I figured I could't be the only one that was having problems with capture portals (have to log in to use wireless). Looks like I was right. And I have something to test on Friday now.

Also, new version of T.A.I.L.S came out tonight. Version 0.13.0.

Plan for IA-240 at Eastern Mi.

** This has been updated:

So one of the classes I'm taking this term is required for my degree. And I have to worry about protecting my computer in it.

The course:
IA 240. The main point of the class, that I took away from the first night, is to learn how to write Analyst reports. The over all goal is to give us the skills required to go work for a government agency. (The program has a lot of students leave and get jobs in the public sector).

The Final:
The professor will assign us something to do an analysis report on at the end of the semester. To teach us on Operational Security, we have to protect our final project from our class mates. He gives extra credit for each student we got information from.

The Problem:
The professor has already said we are required to bring laptops to class, and class mates, as in the past, will try hacking that computer to get your final project. **Update-1: This was said in a warning, not in a you will be hacking each other in this class.

Over all, knowing the above, one really wants to get your hacks in early, get a back door, and be able to come in to the classmates boxes at will. Lots of way to do that. But I'm about not being an easy target. In fact I don't want my system compromised.

Options to protect me:
- Change operating systems every class, either local install, from USB, or DVD / CD.
- Run Backtrack, and use that as the the desktop (not meant for that).
- Run TAILS
- buy dedicated machine, and use nothing on it, doing forensics on it at the end of the semester, and keep nothing on it.
- Be really evil... (run vm or a dedicated box with a sticky honeypot).

The Plan:
I don't have the money for the dedicated machines.

I thought about putting my money where my mouth is and installing Backtrack, on an old hard drive, then harden it. This would fit in with my Linux Hardening applied to BackTrack talk. However don't like the idea of swapping the hardware that often. Trying to hack my class mates would be un-ethical in my eyes anyway.

I don't have an interest in hacking my class mates. Just not being hacked.

So, I've already got Full Disk Encryption, I'm going run with The Amnesic Incognito Live System (TAILS). I'll take an energy hit, the main hard drive won't be touched.

The only thing I have to worry about is saving my work from class (not that I type much in class, I'm more about pen and paper). But if there is something I need to save, I have things for that. I'm using Google's two factor authentication. I also could look into doing File System over SSH. Not sure if I'll have to go that far.



*Update-1: the professor was not giving permission. he was giving a warning.

passwords below

yes, I know I posted passwords below. The only place they were ever used, to my knowledge, was on Gawker, and they have been changed since then.

lock picking

So I got a new set of Lock Picks. The old M No.1 is giving me problems with the new set. I bought a No3 today. I have picked it several times.

I'm finding though, I probably have more picks than I really need. I probably could have gotten away with either this set, or this set.

When I ordered my set, I had a question. I emailed and asked. I got a very quick response. I know I'll be buying some of my practice locks from there.

Finally

I don't remember when I started reading it, but I have finally finished Bruce Schneier's Beyond Fear. It was worth the read, but just took forever.

I finished it lat night at work, while waiting for virtual servers to identify themselves on boot, so they could be put in the right places.

3 things

1) TGU with the 16kg, is suffering the same problems with stablity on the left as the 24kg. I used to be able to do these in my sleep. I might have to take a video and post it for the few RKCs I know to critique.

I did 5 rounds of warm up, 7 sets of left right TGU

2) I've been doing some light running lately. Yesterday was the latest bit. Ran from my parking lot to another one after work to see what was going on. Lots of cop cars (resident passed away). Ran from the golf course to my apartment and back last night. I had my telescope out, and ran back to get the moon filter. My buddy Tom was with the scope. Spent about 2 hours out side looking at the night sky, wish it was a little darker.

3) (this item cross posted)
I think I made some people mad last night. We had our community watch meeting at the Apartment last night. What was supposed to be a 45 to 60 minute meeting turned into an hour and a half complaint-fest. There were people there to sign up their kids for the after school program, and I dragged them into the complaints as well. They started to have them.

Also turns out the security service we're paying for, only has ONE "courtesy" officer at night and not all night, or every night. I basically tore into both management and security with problems and concerns. Both the owner of the security company and the operations manager gave me they're business cards last night. I also raised enough complaints that the site manager is supposed to contact me (not going to hold my breath).

I'm also taking over the coordinator position for the community watch. There are going to be some changes made to how it's ran, and availability of access to information. Right now, the only way we know anything is IF we're told anything. I'm going to pester people. I'm going to provide snacks. I'm going to set up a website with the data. Only thing that's going to really cost me anything is the snacks, and the new domain name.

Between now and the meeting next month I want to try to:
- Read Machiavelli's The Prince (half way done), Saul Alinsky Rules for Radicals and Reveille for Radicals, and Bruce Schneier's Beyond fear, and figure out a revised version of Robert's Rules of Order to run the meetings (Not a big fan of the RRO over all, but think it's a good frame work).

- Set up one of my spare computers (saved to use as cheap home servers anyway) to run word press with a domain name for the community watch.

- Figure out security related guests to have come and talk to people about things (instead of "body magic" sales people they tried to push off on us last night). I might just take the first one and do a small topic on Online Safety.

I'm jumping on the band wagon...

...I'm just late that's all.

So I'm thinking about passwords lately. With Black Hat and Defcon this week, the report that some big name Infosec people had their accounts broke into, a friend's tweet on getting 400 followers, and me having to change my FB password today, I thought I'd share how I come up with passwords.

Now for fun the other night, driving back from Tang Soo Do on a long and lonesome highway east of Omaha... I came up with about 15 or so passwords based off a tv show I liked. They were between 8 to 10 characters each.

So there are a few ways I do it. There are 2 examples in each.

Method One:
I'll take a phrase, the longer the better, and modify it.
The quick red fox jumps over the lazy brown dog (a well known pangram , ie uses all the characters in the English language) or I'm here to chew bubble gum and kick arse and I'm all out of bubble gum (mainly because I'm fond of quotes).
I'll take the phrase, and use camel case (mixed case), with numbers, special characters (anything over the number keys), and letters. I'll then mix them up like below:

Th3Qu!ckBrownF0xJump3s_Over_the_L2zy_red_dog

I'm_h3r3_2ch3w_BubbleGum&kick@rse.&I'm@ll0ut_ofBubbleGum

I can mix them other ways too. For example, I swapped brown and red, just to make it a little different.

Method Two:
I'll take a song lyric or a line from a movie, tv show, or whatever and I'll modify it by using just the first letter of each word, and the some of the other steps above. Examples I'll uses are Seger's Turn the Page, and a line from Cool Hand Luke.

"On an long and lonesome highway east of Omaha" becomes:

0@L&lh3oO!

"What we've got here is... failure to communicate. Some men you just can't reach. So you get what we had here last week, which is the way he wants it... well, he gets it"

Wwgh!F2c.SmUjcr=SugWwhHlw,W!twhWi_whg!! (to be honest, I'd modify it a little more, and weighing in around 30 characters, I'd use that for a pass phrase for my encrypted hard drive).

There are some other rules I use, if you notice, I have 2 characters side by side, 1 will be cap, 1 will not be. I tend to use the 2 interchangeably at home and at work, so we have phrase on some boxes, and the vegitable soup on others.

Lastly Method 3, which I only use on rare occasions is:
pwgen (password generator) from the linux command line. I'll add options like at least 1 special character, 1 upper case, 1 number and set it to be 10 to 12 characters long.

and finally...
I tend to use password safes, with things divided in them. Keepass and Password Safe.

I have had a few users complain when I give them a 10 to 12 character password based on something they said in the conversation. 1 about being long, and 2 about being so random, but when I tell them I use 24 to 26 character passwords regularly they tend to think it's not that bad and they seem to remember what they got fairly well.

There are other ways to make passwords too, and if you google them, I suggest googling site:lifehacker.com

Have fun, be safe online and for extra credit, figure out why I think this is a bad password. BwDn$b! (there are 2 reasons I don't like it).

People that don't know what they're talking about

So there is a show on Detroit Public Television right now. It's called Due Process. They have a couple of people on the tv, that really don't' know what they're talking about, about computers and privacy. One is Susan Crawford, Professor of Internet Law at the University of Michigan. The other is Patrick Corbet Professor of Criminal Law at Thomas ME. Cooley Law School.

They're talking about the person who cracked into Palin's private email. And how her privacy wasn't protected because someone was able to use publicly available information to get past the "security questions". The lady, missed her name, is saying that email should be protected by privacy between her and the provider. If you send it clear text, you have no privacy END OF STORY.

Now they're talking about company acceptable use policies. It seems like the 3 talking heads are all lawyers, but still.

Just annoying, completely. They have little clue on the technology side of things, and trying to explain the INTERNET should be. They're trying to sound like experts. And people will believe them because they're law professors.

Sigh

Edit 1, put their names in, and added information.

edit 2: SCREAMS AT THE TV. Moderator asked if there was a way to completely clean a hard drive. They both said no. They'll always be able to get some of the data back.

I can think of several computer programs that take hard drive as close as possible to out of the box fresh state. I know the NSA uses one of those too.

It shouldn't be THAT easy

I've sold my manager, and director on Encrypted IM... We're running a small test right now, in the IT group (the IT people, we'll fold the rest of the IS people in later (the developers, dbas and etc).

We're using Pidgin, with Pidgin-encryption. Really easy to set up. Install Pidgin. Install Pidgin-encryption. Works with all major IM servers, and Operating Systems.

After installing, set your user accounts (don't have to, but that is the way I like to do it), then go and turn on the plugin for pidgin-encryption under options>plugins.

When you turn it on, by selecting the check box, it creates rsa keys for all accounts in the client. Click on configure plugin button, and go to the second tab. Highlight the account, press regenerate key. Change the key size to 2048. The bigger the key the harder it is to break. I have mine set at 4096 (the largest size supported by the client at this time).

Then when you IM a someone, you'll notice somewhere in the text window (here at work it's on the top of the window) a little lock. Click it, and it turns on the encryption. If the person on the other side has the plugin installed, you'll get their key. You should have 2 locks at that point. with arrows pointing to each other. You're encrypted and good to roll. If you're sending an im to someone without encryption, just turn off the crypto, by hitting that little green lock.

So what does encryption do again? It makes it so no one else can read your messages, unless they are supposed to. Encrypted IM rocks. This is really fast, easy to set up, and simple to use. You don't have to worry about someone, like Google (if using Google talk), storing your IMs and giving them to the cops. Because It's encrypted. However, the cops can make you give up your key, at least in the United States. But, if you're transferring Intellectual Property (YOUR OWN, or YOUR EMPLOYER'S) you don't have to worry about the competitor getting your data.

So what shouldn't be that easy? Getting upper management to buy in on this. I've been trying for 2 years. They both said yes today. The director said to bring it up at the next team meeting, and we'll work it out.

hmm... time for the weekend review

Like most weeks, I don't remember most of them, but this is my first weekend off in a month. So I burnt it so far, at my computer. Muhahaha.

Here is what I remember that's worth it (most of the week is a blur).

Tuesday, I cooked. 2 tofurkies, with the oil and soy sauce baste. I cooked them on a bed of red potatoes, onions, and carrots. I also made cranberry sauce. yummm...

Wednesday I over ate at the pot luck.

Thursday, I went to Martial Arts. It was good. I liked it. My endurance level appears to be one of the highest ones there. Which is a little sad. I'm basing this off of people moving away from me in free fighting, while sucking wind. I'll be breathing heavy, but they are sucking wind.

Fell pretty bad too. Landed on my elbow pretty hard, buy my knee much harder. It's still bruised. I had a hard time walking Friday. Of course, I had to walk all around the building, which did help it some, even if I did limp most of the time.

Thursday it snowed. I fell on the ice outside, before going to class. Wasn't that bad in that case, just had one leg go out from under me, and was able to turn it into a kneel, before crashing. I tend to do that a lot when I fall on the ice. End up in a one knee kneel. The drive home sucked, once I got near the airport, went to a complete stand still.

Earlier Thursday, the director emailed me about a wireless access point showing near his office. They're pretty paranoid there about that stuff. I really don't care too much myself. To a point. Once a month I walk around with a laptop, looking for wireless access points. I'd much rather have a better tool, that finds the non-broadcast SSIDs too, but it makes them feel good. Anyway, it looks like someone set up a new access point across the freeway and we're getting bleed over. One troublesome thing though. Thursday during the quick initial scan. I found one that really did bother me. It was an ad-hoc peering point called "Free Public Internet". Ad-hoc networks are computers without a router, that can access each other no problem. Lets just put it this way, it is a bad thing to find. Turns out it was on the CFO's laptop. A VERY BAD THING. Basically anyone could sit out in the parking lot, or even across the freeway (with a directional antenna, which can be made with a pringles can), connect to the computer and get files from it.

I get to do a computer security class in a few months. It's for the Executives and the Sales people. Should be fun. I'm going to write the manual from scratch.

Friday, wandered around, then spent the majority of the afternoon at my desk being bored. Could have done some other stuff, but didn't feel like it at the time.

Today, I had fun. I set up some neato computer stuff, GnuPG, and the ability to encrypt my google email. (Encryption is good, it prevents people from reading what they are not meant to be). The way it works, you make a key pair. One is public, one is private. The public one you share. The private one you hide. When they want to send you an email, only you can read, they encrypt it with your public key, and usually sign it with their private key (because you're public key is public, anyone can get it and say they are so and so, but signing it with their own private key means it's from them). As long as you have their public key, you can read the message, after decrypting it with your private key, and can confirm it's from them, by checking they're signature against their public key. It sounds harder than it really is. Which is probably why so few use it. It took me all of 30 minutes to get set up.

I also looked up the details on creating a spice mister. Going to make some capsaicin oil to try with it in a few weeks.

I also got caught up on some tv. Watched about 4 hours of it today. About all I could stand. Read a lot of neat stuff on the web. Instructables and Life Hacker rock.

Only other thing of note, was I got the Ultimate bond, 42 discs. 21 movies (Doctor No through Casino Royal, minus Never Say Never Again). I finally saw Casino. It was decent. I look forward to seeing Quantum now.

Oh and I think I'm going to push and try to sell the idea of encrypted IM clients at work this week to the upper management.

Excuse me, I have the plague.

No not really, I have a sinus infection, and an ear infection. But still.

So after I posted about encryption. The day after, I found a few mentions to a new project that was making it's rounds. Not a new project in a good way.

It turns out that the way RAM works now, it doesn't forget everything once the power is off. Including your encrypted password to boot your FDE box. Instead, SDRAM slowly suffers bit rot, and if you cool the chips it holds the data even longer.

The same day, /. came out with an spot about a new way to hack cell phone calls. All you need is about 1000.00 of storage and some other equipment. It's not like cell phones are secure, but it's becoming easier for people who aren't the government or the phone company to snoop.

Yes I sound paranoid at times, but I am paid to be. The first company spent lots of money to make me this way. :)

Censor this.

Why do people have no clue? Seriously first it was China with their great firewall. A laughable joke. Proxies and the like make it easy to get around. Heck there is a service I heard about a few years ago, where you can sign up, they allow an encrypted connection to your PC and use your bandwidth to get around the firewall.

Now it's the Wikileaks.org issue. Wikileaks is a web site that allows anonymous whistle blowing. A swiss bank had the whistle blown on them, about money laundering. So they found a moron symptomatic judge (bought and paid for most likely) to have the domain name taken away. It appears that it is better to protect the company than it is the consumer. A sad thing that is getting bigger and bigger in the US.

Seriously people, the companies and the government want to know what you are talking about. They want to control you. FISA and the like aren't about saving people, it's about control.

Its time to up the game. Use Tor, use PGP / GPG, SSH, SFTP, Password Safe, and TrueCrypt.

Tor will let you surf the web more anonymously. It makes the job of finding out where your going, and where you are harder. Basically it bounces you around a bunch of other computers before you get to the web server.

PGP / GPG, encrypt your email. Make it so only those you want to read your email can. Yes you can get it to work with gmail too.

SSH and SFTP encrypt your connection to terminal and ftp servers. Normally your password is sent in plain text, and anyone with a packet sniffer can see what that password is. SSH and SFTP encrypt the connection between you and the server. Meaning that they can't read your password, or what your getting from a packet sniffer.

Passowrd Safe securely store your user names and passwords. It has a nice gui in windows. It stores the data in an encrypted file. You can double click an entry and it will securely copy it to your clipboard for pasting, and the clears the clipboard when it minimizes or closes.

Lastly TrueCrypt offers Full Disk Encryption (as of version 5.0) that requires pre-boot authentication (for windows, need to check on Linux, and Mac OSX is planed for later). It provides some other nifty things too, like encrypted containers, that you can hide a second encrypted container in. That way if your computer is stolen, your data isn't accessible. Well after it powers off. It also works well on USB drives. I recently got an 8 gig drive, that I've put an encrypted container on. When I plug the drive it, it pops up the auto run menu, and asks if I want to mount the drive. I don't have to. I do have some stuff outside the encrypted section, but that's encrypted in a different way. There are some other tools that can do the Full Disk Encryption, like PGP, but Truecrypt is open source and only costs the price of the download.

My Senator is a Traitor living in Fear

This is a letter I sent to Senator Carl Levin of Michigan today.

Dear Mr. Levin,

I just watched you supporting the Specter / Whitehouse amendment to the FISA bill.

What you basically said, yes the telcos broke the law, but that's fine as long as no one can show they were hurt. If citizens can show they were damaged (by secret laws) then they can have a day in court. You statement was that because the telcos were acting in "good faith with the administration" it is ok to break the laws of the nation. This country is supposed to be above secret laws, and you're advocating them.

That is akin to you approaching me to murder someone for you, saying as long as I hide the body well enough, I won't be prosecuted. Even though we both know that I'd be breaking the law.

Everyone is damaged by the Telecommunication companies that broke the law, because U.S. Citizens can no longer trust that their conversations are private, and not being listened to illegally.

You sir disgust me. Stop living in fear.

Read this and remember

You can not have security without privacy. It just can not happen.

Bruce Schneier on the government's view of security.

There is really nothing more I can add to this. Mr. Schneier hit all the relevant points.

The scariest part is when he points out, that the government wants you to entrust your privacy to the government and their hand picked companies. The very people who do not have your privacy in their best interest.

I take it back, the Protect America Act is going to die this week (most likely). It's part of the FISA bill. Call your Senators, call your Congress people. Tell them to not be afraid and give us back our privacy.