Firefox, you know you tapped Cloudflare for DNS-over-HTTPS?

Found on The Register on Thursday, 27 February 2020
Browse Internet

On January 23 this year, ISC received a report of a breakdown with .net domains. When it investigated, it discovered crucial A and AAAA records, which glue .net domain names to their IPv4 and IPv6 network addresses, were missing.

ISC quickly figured out – within five minutes, according to its timeline – that the issue lay with internet nodes it operates in partnership with Cloudflare, and escalated the issue to the web infrastructure business.

As one veteran internet engineer, Bill Woodcock, noted on Twitter: “What happens when critical functions of the public Internet are co-opted for private benefit? Transparency and accountability are lost, infrastructural spending cut, things break.”

With core elements, like DNS, you need systems as independant and numerous as possible to avoid a central control. Mozilla in bed with Cloudflare is doing exact the opposite.

Firefox turns encrypted DNS on by default to thwart snooping ISPs

Found on Ars Technica on Wednesday, 26 February 2020
Browse Internet

Firefox will start switching browser users to Cloudflare's encrypted-DNS service today and roll out the change across the United States in the coming weeks.

DNS over HTTPS helps keep eavesdroppers from seeing what DNS lookups your browser is making, potentially making it more difficult for Internet service providers or other third parties to monitor what websites you visit.

So based on rumours about thousands of snooping ISPs, Mozilla decides to send every single DNS query to Cloudflare instead. Or Google. That's even worse because it makes profiling easier by several orders of magnitude. Plus, let's not forget, it also means that the local hosts file where you can override lookups and block bad domains system-wide, is ignored so expect more advertising and tracking (and less security if you push your Intranet hostnames to public nameservers). To continue the list of massive faults, baking DNS lookups into every single piece of software makes it impossible for the user to control its systems. By force-feeding DoH down the throats of their users, Mozilla actually takes the control of their systems out of their hands. If you want encryption, just use DNS over TLS.

Pets 'go hungry' after smart feeder goes offline

Found on BBC News on Tuesday, 25 February 2020
Browse Internet

Owners of a device designed to release food for pets say their animals were left hungry during a week-long system failure.

Nearly 60% of the 554 customer reviews left on the US site have given the device a rating of either one or two stars.

"Robots and automated systems have hiccups along the way, it's something we need to get used to."

No, we do not need to get used to "hiccups". We just don't need a "smart" device for every little piece of crap: KISS principle, heard of it?

We found 6 critical PayPal vulnerabilities – and PayPal punished us for it

Found on Cybernews on Monday, 24 February 2020
Browse Internet

Ever since PayPal moved its bug bounty program to HackerOne, its entire system for supporting bug bounty hunters who identify and report bugs has become more opaque, mired in illogical delays, vague responses, and suspicious behavior.

When we pushed the HackerOne staff for clarification on these issues, they removed points from our Reputation scores, relegating our profiles to a suspicious, spammy level. This happened even when the issue was eventually patched, although we received no bounty, credit, or even a thanks.

Lesson learned? Either sell your PayPal exploits on underground markets, or make them immediately public as 0-days and let them deal with it that way. No good deed goes unpunished when it comes to PayPal.

Google Is Letting People Find Invites to Some Private WhatsApp Groups

Found on Motherboard on Sunday, 23 February 2020
Browse Internet

Google is indexing invite links to WhatsApp group chats whose administrators may want to be private. This means with a simple search, random people can discover and join a wide range of WhatsApp group chats.

App reverse-engineer Jane Wong added in a tweet that Google has around 470,000 results for a simple search of "chat.whatsapp.com," part of the URL that makes up invites to WhatsApp groups.

So people post links to "secret" groups somewhere on the Internet and are supposed to be surprised because Google indexes them? People are dumber than you would think.

Mark Zuckerberg: Facebook boss urges tighter regulation

Found on BBC News on Sunday, 16 February 2020
Browse Internet

Facebook boss Mark Zuckerberg has called for more regulation of harmful online content, saying it was not for companies like his to decide what counts as legitimate free speech.

The Facebook founder urged governments to come up with a new regulatory system for social media, suggesting it should be a mix of existing rules for telecoms and media companies.

It's too expensive for Facebook and does not generate any revenue, but only bad PR because of the censoring, so naturally Zuck wants to offload these decisions to the governments. Sure he would not want tighter regulations for the (ab)use of the users' most private and personal data for advertising, profiling and sales, because that is something completely different.

500 Chrome extensions secretly uploaded private data from millions of users

Found on Ars Technica on Friday, 14 February 2020
Browse Internet

The extensions were part of a long-running malvertising and ad-fraud scheme that was discovered by independent researcher Jamila Kaya. She and researchers from Cisco-owned Duo Security eventually identified 71 Chrome Web Store extensions that had more than 1.7 million installations.

“This was done in order to connect the browser clients to a command and control architecture, exfiltrate private browsing data without the users’ knowledge, expose the user to risk of exploit through advertising streams, and attempt to evade the Chrome Web Store’s fraud detection mechanisms.”

The discovery of more malicious and fraudulent browser extensions is a reminder that people should be cautious when installing these tools and use them only when they provide true benefit.

People should have learned by now not to install random things they find online; plugins can be just as bad as everything else.

WhatsApp to stop working on millions of phones

Found on BBC News on Monday, 03 February 2020
Browse Internet

Android and iPhone devices which only support outdated operating systems will no longer be able to run the Facebook-owned app.

It is the latest in a series of moves after the messaging app withdrew support for numerous devices in 2016, and then from all Windows phones on 31 December, 2019.

In other news, productivity and social interactions suddenly are on the rise.

Leaked Documents Expose the Secretive Market for Your Web Browsing Data

Found on Vice on Wednesday, 29 January 2020
Browse Internet

The documents, from a subsidiary of the antivirus giant Avast called Jumpshot, shine new light on the secretive sale and supply chain of peoples' internet browsing histories. They show that the Avast antivirus program installed on a person's computer collects data, and that Jumpshot repackages it into various different products that are then sold to many of the largest companies in the world.

Until recently, Avast was collecting the browsing data of its customers who had installed the company's browser plugin, which is designed to warn users of suspicious websites. Security researcher and AdBlock Plus creator Wladimir Palant published a blog post in October showing that Avast harvest user data with that plugin.

The line between malware and anti-malware is getting very very thin here.

Facebook's new privacy tool lets you manage how you're tracked across the web

Found on CNet News on Tuesday, 28 January 2020
Browse Internet

In a blog post on Data Privacy Day, Facebook CEO Mark Zuckerberg announced that its "Off-Facebook Activity" tool -- which lets you manage how Facebook tracks you across the internet -- will finally be launched globally. Zuckerberg had promised this feature since May 2018, when he called it a "Clear History" button.

Along with deleting your history through the tool, the Off-Facebook Activity feature also allows you to turn off future tracking, making sure that your online history isn't a continuous chore that you have to keep cleaning on Facebook.

This is Facebook. History has proven more than once that they are not worth to be trusted. Tracking and profiling is the core of their business model; it's hard to believe that this can be turned off now.