GPS monitoring without prying eyes

"If you are paranoid, it does not mean that you no one was watching". The development of the Internet has transferred this statement to a qualitatively new level. To follow is already possible from the comfort of home, and all information voluntarily gives himself the object of observation. People upload their personal information, but do not always think about who they can be available. Username/password and the "Show only friends" down. It creates the illusion that we control the privacy of their own data. But there are still administrators and authorities who shall all men know that they are interested in, without permission and without your knowledge.

This is a problem of all systems centrally, serving multiple clients. For example, any of the popular social network has single repository of data (possibly distributed) that is available for business purposes to a certain range. Users are gradually beginning to understand the threat: there are peer-to-peer social network (see links in article about Pandora), but they struggle to make their way.

Similar situation with privacy holds for systems of monitoring of transport. They can offer a fundamentally different approach, which will allow the user to fully control the access to their data. The idea is simple – to give each their own dedicated server in the cloud!

Watch yourself, be careful!

GPS tracking system multiply like mushrooms after rain. You can think of a dozen scenarios for their use. For example, the company monitors its own fleet, the couple — each other, parents for children, children for dogs, someone else just for their own machine. Usual for such systems is a web interface that allows any device connected to the Internet to learn not only where the object of observation is now, but also to see the history of movements (tracks) or statistics. It's convenient but is it safe?

Don't tell that to your movement no one cares! Tracks can tell a lot about the shape of your life: where and when you are and potentially what they do. Where you live, where you work? In what stores? What time are you usually not home? Whether you are now in the country or on vacation in another country? And as you do not want to place the data on another server. It would be nice to have your own and keep all under personal supervision.

This service is also offered on the market. Many companies are willing for a fee to install a monitoring system on your server. If, of course, you have (statistics, probably not). And where is the guarantee that it is suitable, compatible operating system and the installed components? And hardly you have a desire for someone to let something to adjust. This is one way to have a separate server solely for monitoring. But not every IT expert will be able to deploy your server, and correctly (!) to configure it, but for the average user or company without costing sysadmin, it generally seems unmanageable — complexity, or the money — task. Therefore, the process of obtaining and server settings should be as automated and cost of ownership — not very big. Thus, we are talking about a personal vehicle monitoring system oriented just regular people (probably far from IT) or on small companies.

Ease, are available only for the cloud

Fortunately, there are cloud providers. You can use the services of AWS, which include EC2 Micro Instance is a virtual cloud server minimum power sufficient to observe a dozen of objects. Not less than pleased that he is free for a trial period, i.e. for the whole year.
Usually for a server you need to specify one of a plurality of virtual modules AMI containing the images of preconfigured operating systems, and set a number of parameters. For the unprepared person it is not easy, and for advanced — boring, though, and is at a certain skill for 20 minutes. For the monitoring system will need a prepared AMI, and a fully automated process of installation and system setup.

The problem remains, check on Amazon and pre-configure the account. Here no effort from the user is not enough. In fact, all that is required is to fill out some forms and place a checkmark in the right places in the management console. For capacitates this may seem a trifle, but, again, we are talking about the most ordinary users. For them, filling out forms, especially not localized, can become non-trivial task. In what format to enter your phone? Why have an address 2 line? What to do if there is no credit card or do not want to enter the information? In General, we need a detailed step by step instructions, created by the results of observation of a test group of users.

As a result, the user receives a file with keys generated by AWS. These keys are transmitted to the server system installation to 5 minutes to access settings to my new server. During this time, the scripts set the AMI, create Amazon S3 (Simple Storage Service) for data and backup, configure the server and its components, generate random passwords, launch the monitoring system and sent to the user access parameters.

It may seem that transfer of keys is a bottleneck from the viewpoint of safety, because the installation script can save them in a database. So these paranoid yourself better to change all the keys and passwords after installation without the assistance of third parties.

Domus sua cuique est tutissimum refugium

(~ my home is my castle)

The use of a personal server gives you additional benefits:
the

the
• On a common server problems of one customer can affect others. Here, the system is yours and no one else there can not be.
the
• Theoretical security is higher due to the smaller number of potentially vulnerable seats: available scripts, queries, forms to enter. Logging on to your site, an outsider can not go past the first page without authentication.
the
• other server applications are not limited in any way. If desired, and some experience it is possible to store there any data or raise a spare FTP. And you can forget about the monitoring of transport — a good way to get a server set up in 5 minutes.

And it's not even the most important thing. There is a sense that the concept of personal servers can dramatically change the entire Internet. It would therefore be very interesting to know the opinion of professionals on this approach.

Monitoring system, that implements these principles, already developed in the framework of the "proof-of-concept", it's free and is available for review, but before you finalize it and present to the General public, wanted to put the idea to the test and to receive from abrasheva portion of constructive criticism and its security weaknesses.

Article based on information from habrahabr.ru