4231
DuckDuckGo Searches Are Not Anonymous
DuckDuckGo didn't log IPs, but favicons loaded from Amazon S3 leaked every search term in the Referer header. It was fixed two days after I posted.
New
The latest blog posts to take off on Hacker News. 4,337 posts.
4232
Worst-Case Thinking
At a security conference recently, the moderator asked the panel of distinguished cybersecurity leaders what their nightmare scenario was. The answers were the predictable array of large-scale attacks: against our communications infrastructure, against the power grid, against the financial system, in combination with…
4233
4234
Facebook leaks user's IP addresses
Actually this is a common method of combatting spam, all of the various spam providers will block facebook as a whole if they don't include this information, which would obviously be a devastating annoyance. Go and send an e-mail from hotmail, or any kind of mailserver.. normal e-mail client, gmail, etc.. and you will…
4235
The Evolution of Privacy on Facebook
Facebook is a great service. I have a profile , and so does nearly everyone I know under the age of 60.
4236
Why Aren't There More Terrorist Attacks?
As the details of the Times Square car bomb attempt emerge in the wake of Faisal Shahzad’s arrest Monday night, one thing has already been made clear: Terrorism is fairly easy. All you need is a gun or a bomb, and a crowded target. Guns are easy to buy. Bombs are easy to make. Crowded targets—not only in New York, but…
4237
The Security Mindset
Uncle Milton Industries has been selling ant farms to children since 1956. Some years ago, I remember opening one up with a friend. There were no actual ants included in the box. Instead, there was a card that you filled in with your address, and the company would mail you some ants. My friend expressed surprise that…
4238
Fun with your bank's secret questions & answers
My new bank, Ally Bank , configures a security question and answer for customer service calls. In addition to your SSN, date of birth, and mother's maiden name they also ask you the question you specify and wait for the answer you've provided. This is good, because many standard questions are…
4239
Deceiving Users with the Facebook Like Button
Facebook just launched a super-easy widget called "The Facebook Like Button". Website owners can add a simple iframe snippet to their html, enabling a nice "Like" button with a count of other people's "Likes" and a list of faces of people if any of them are your friends. The advantage of this new tool is that you…
4240
4241
4242
4243
There’s a rootkit in the closet
Part 1: Finding the rootkit It's monday morning and I am for coffee in downtown Thessaloniki, a partner calls: - On machine XXX mysqld is not starting since Saturday. - Can I drink my coffee and come over later to check it ? Is it critical ? - Nope, come over anytime you can... Around
4244
Rackspace passwords are visible to customer service
I just had a very disturbing conversation with a Rackspace Cloud CSR. It went something like this: CSR: Can I have your account user name a...
4245
Return-Oriented Programming without Returns (on the x86)
We show that on the x86 it is possible to mount a return-oriented programming attack without using any return instructions. Our new attack instead makes use of certain instruction sequences that behave like a return; we show that these sequences occur with sufficient frequency in large Linux libraries to allow…
4246
The Awful Anti-Pirate System That Will Probably Work
So, when I read that Assassin's Creed 2 for the PC would fight piracy by requiring a live internet connection all the time when you were pla...
4247
Automatically followed by abusive ex-husband (and his friends) on Google Buzz
I use my private Gmail account to email my boyfriend and my mother. There’s a BIG drop-off between them and my other “most frequent” contacts. You know who my third most frequent …
4248
4249
4250
Don’t Hash Secrets
Building secure systems is difficult. It would be nice if we had a bunch of well-designed crypto building blocks that we could assemble in all sorts of ways and be certain that they would, no matte…
4251
4252
Schneier on Security: Technology Shouldn't Give Big Brother a Head Start
China is the world’s most successful Internet censor. While the Great Firewall of China isn’t perfect, it effectively limits information flowing in and out of the country. But now the Chinese government is taking things one step further. Under a requirement taking effect soon, every computer sold in China will have to…
4253
4254
4255
Would you have spotted the fraud?
Pictured below is what’s known as a skimmer, or a device made to be affixed to the mouth of an ATM and secretly swipe credit and debit card information when bank customers slip their cards into the machines to pull out money. Skimmers have been around for years, of course, but thieves are constantly improving them…
4256
4257
Intercepting Predator Video
Sometimes mediocre encryption is better than strong encryption, and sometimes no encryption is better still. The Wall Street Journal reported this week that Iraqi, and possibly also Afghan, militants are using commercial software to eavesdrop on U.S. Predators, other unmanned aerial vehicles, or UAVs, and even piloted…
4258
4259
Schneier's response to Eric Schmidt
Schmidt said: I think judgment matters. If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place. If you really need that kind of privacy, the reality is that search engines—including Google—do retain this information for some time and it’s important, for example…
4260
Schneier: The Value of Privacy
Last week, revelation of yet another NSA surveillance effort against the American people has rekindled the privacy debate. Those in favor of these programs have trotted out the same rhetorical question we hear every time privacy advocates oppose ID checks, video cameras, massive databases, data mining, and other…