5.6 Safe Computing

What you need to know

• Personally identifiable information (PII) is information that can be used to identify a person: name, address, Social Security number, date of birth, biometric data, medical and financial records, and more.
• PII is collected through search history, location, cookies, and app activity. Combining seemingly harmless pieces can identify someone. Once online, information is hard to remove.
• PII enables useful personalization but can be used for stalking, identity theft, and targeted manipulation. It is often collected and sold without users' full awareness.
• Authentication proves identity. Strong passwords are long and not reused. Multifactor authentication requires two or more of: something you know (password), something you have (phone, key), something you are (fingerprint).
• Encryption scrambles data so it's unreadable without a key. Symmetric encryption uses one shared key for both encrypting and decrypting. Public key (asymmetric) encryption uses a public key to encrypt and a private key to decrypt — anyone can send you a secret message, only you can read it.
• Certificate authorities issue digital certificates that verify a website's public key really belongs to that site. This is what makes HTTPS trustworthy.
• Attacks to know: malware (software designed to damage or gain unauthorized access), virus (malware that attaches to other programs and spreads), phishing (fake messages that trick people into revealing information), keylogging (recording keystrokes), rogue access points (fake Wi-Fi that intercepts traffic).
• Data traveling over an unsecured network can be intercepted; encryption (like HTTPS) protects it in transit.
• Software updates patch known security vulnerabilities — running old versions leaves known holes open.
• Users should read what data an app collects, limit permissions, and recognize that free services are often paid for with personal data.

Worked example

Public key encryption in one paragraph: Alice publishes her public key anywhere. Bob uses it to encrypt a message. Only Alice's private key — which she never shares — can decrypt it. Even if someone intercepts the message and has Alice's public key, they can't read it, because the public key only locks. That asymmetry is what lets strangers communicate securely over an open network without first meeting to share a password.

Multifactor in one line: password (know) + code texted to your phone (have) = two factors. Two passwords is still one factor.

Going deeper

The nuance, edge cases, and connections that turn a 3 into a 5.

• PII — personally identifiable information — includes name, address, SSN, date of birth, phone, email, biometrics, medical and financial records, and anything that in combination can identify a person. The CED emphasizes combination: ZIP code + birthdate + gender identifies most Americans uniquely.
• PII is collected through search history, location data, cookies (small files sites store in your browser to recognize you), app permissions, purchase records, and social media activity. Much of it is collected automatically and combined by data brokers.
• The CED's concern: PII can be used to enhance the user experience (personalization) but also to stalk, steal identities, and manipulate (targeted ads, targeted misinformation). Once information is public, it's essentially impossible to remove.
• Authentication verifies identity. Three factor types: something you know (password, PIN), something you have (phone, hardware key), something you are (fingerprint, face). Multifactor authentication uses two or more different types. Two passwords = one factor.
• Strong passwords are long, not reused across sites, and not based on personal information. Length matters more than complexity. Password managers exist because humans can't remember dozens of unique long passwords.
• Encryption transforms data so it's unreadable without a key. Symmetric: one shared key encrypts and decrypts — fast, but you have to get the key to the other party securely. Public key (asymmetric): a public key (shared freely) encrypts; only the matching private key decrypts. Solves the key-exchange problem.
• Public key in practice: your browser gets a website's public key, encrypts a message only the site can read, and they use that to set up a fast symmetric session. That's HTTPS. Certificate authorities vouch that the public key really belongs to that site, so an attacker can't substitute their own.
• Attacks to distinguish: malware is the umbrella (software intended to harm). A virus is malware that attaches to other programs and spreads when they run. Phishing tricks the user into giving up information via fake messages or sites. Keylogging records keystrokes to capture passwords. A rogue access point is a fake Wi-Fi network that intercepts everything you send. Unencrypted traffic on any network can be read by anyone on that network.
• Software updates matter because they patch known vulnerabilities. An unpatched system has holes that attackers know about. Delaying updates is a security decision.
• Free services are typically paid for with your data. Reading what an app collects, limiting permissions, and being skeptical of unexpected requests for information are the user-side defenses the CED expects you to know.
• Security is a cost-benefit question, not absolute. No system is perfectly secure; the goal is to make attacks expensive enough that they're not worth attempting for the value at stake.

Mistakes that cost points

• Calling two passwords multifactor. Same factor type. Multifactor needs different types: know + have, know + are, etc.
• Sharing the private key. In public key encryption, the private key is never shared. The public key is the one you give out.
• Mislabeling attacks. Fake email asking for your password = phishing. Software recording keystrokes = keylogging. Fake Wi-Fi = rogue access point. Each has one definition.
• Thinking encryption is compression. Encryption hides; compression shrinks. Different goals, different tools.
• Assuming individual data points are harmless. The exam's point is that combination identifies. ZIP + birthday + gender is PII in combination.

Practice questions

Written in the style of the real exam. Try each one before revealing the answer.