Mud Puddle Test

In her 2014 book “Dragnet Nation,” journalist Julia Angwin describes a quick and dirty test to determine the security of online services – the mud-puddle test.

“Imagine you drop your device in a mud puddle, slip in the mud, and crack your head so that you forget your password to access your data,” she writes. “Now, can you get your data back from the service you were using? If the answer is yes, then you have left a data trail. … If you are using a service that lets you recover your lost password, then the service has access to your data.”

It isn’t just that services that let users recover lost passwords are more vulnerable, it’s that they’re also susceptible to being forced to turn over user data to government officials. An October 2016, Reuters report revealed that Yahoo had developed software to search all incoming messages on its email and provide the content to intelligence and law enforcement officials. In a statement, the company responded to the allegations with the explanation, “Yahoo is a law abiding company, and complies with the laws of the United States.”

Yahoo had no choice but to comply with the government’s order to turn over user data without notifying the individuals being watched. When Yahoo seriously attempted to fight U.S. officials over data collection in 2008, it faced a daily fine that began at $250,000 and doubled each week. In less than eight months of defying the federal government, Yahoo would have been forced to pay more money than exists in the world.

There is, however, another option. While companies may be compelled to provide user data to government officials, they don’t have to build their systems in a manner in which they can access that data in the first place. If an online service doesn’t have the ability to reset someone’s password, it also doesn’t have the ability to turn over that data to government monitors without the user’s knowledge or consent.

Signal, for example, designed its system so that when a federal grand jury issued a subpoena earlier this year to produce information related to two phone numbers, one with a Signal account and one without, the only information Open Whisper Systems was able to provide was when the account was created and the last time it connected to Signal’s servers. Even as it fully complied with law enforcement demands, Signal was able to completely protect the privacy of its users. This security can come with a price, though: losing the data on your account when you lose your password, which happens to even the most tech-savvy people. After leaking a trove of government secrets to the media and fleeing to Russia, former NSA contractor Edward Snowden had an account with the now-defunct encrypted email service Lavabit. At one point, Snowden forgot his password and, because Lavabit administrators had designed the system to lock themselves out of user accounts, the best they could do was restore the account from scratch – losing all of Snowden’s data.