VPN Provider Accused of Sharing Customer Traffic With Online Advertisers

Found on Bleeping Computer on Tuesday, 08 August 2017
Browse Internet

In a 14-page complaint, the CDT accuses AnchorFree — the company behind the Hotspot Shield VPN — of breaking promises it made to its users by sharing their private web traffic with online advertisers for the purpose of improving the ads shown to its users.

"Hotspot Shield’s marketing claims that it does not track, log, or sell customers’ information, but its privacy policy and a source code analysis reveal otherwise," the CDT wrote in a press release yesterday.

Not much of a surprise actually, and sadly many won't really care much because they already give up their privacy already everywhere.

LinkedIn: It’s illegal to scrape our website without permission

Found on Ars Technica on Monday, 31 July 2017
Browse Internet

A small company called hiQ is locked in a high-stakes battle over Web scraping with LinkedIn. It's a fight that could determine whether an anti-hacking law can be used to curtail the use of scraping tools across the Web.

Both Kerr's view that running a public website implicitly gives the public authorization to access it and LinkedIn's view that companies can rescind authorization on a case-by-case basis are plausible interpretations of the law.

If you don't want the data to be accessed, don't publish it. Even if you argue that bots are not the target group of the publishing website, some might just outsource the scraping to a crowd of underpaid workers in India. Then you have humans browsing the website, and the data still gets collected. At that point, the topic of search engines which scrape and index the website to direct visitors there (while profiting by placing ads on the search results) has not even been touched.

systemd'oh! DNS lib underscore bug bites everyone's favorite init tool, blanks Netflix

Found on The Register on Monday, 24 July 2017
Browse Internet

The issue emerged July 22, when Gentoo user Dennis Schridde submitted this bug report to the Systemd project. Essentially, he described a failure within systemd-resolve (sic), a Systemd component that turns human-readable domain names into IP addresses for software, like web browsers, to connect to.

The library was stripping underscores from some domain names – such as Netflix's ipv6_1-cxl0-c088 node – and that caused everything relying on the resolver to fail, Schridde reported.

Why on earth would a piece of software that was started as an init system contain its own resolver? It would not be too surprising if it just gets a "notabug wontfix" reply from Poettering; after all, it looks like systemd-resolved has lots of problems.

It’s Trivially Easy to Hack into Anybody’s Myspace Account

Found on Motherboard on Monday, 17 July 2017
Browse Internet

A security researcher has discovered that it's relatively easy to abuse this mechanism to hack into anyone's account. All a wannabe hacker needs is the target's full name, username, and date of birth.

Scott Helme, a security researcher who acted as one of the guinea pigs to test the flaw, said that Myspace's account recovery feature is "insane."

What's even more insane is that people use their real name and DOB on a website.

Facebook Messenger gets adverts added to app

Found on BBC News on Thursday, 13 July 2017
Browse Internet

For now, adverts will appear only in the app's inbox list of recent chats and not within the conversations themselves.

"So, Facebook has been looking around for different ways to make money from Messenger and has obviously shifted its strategy a bit to think people will accept some ads within it."

Not only is your data sold to advertisers, you're also receiving more ads. Zucky is milking and butchering his cows.

Crashed RadioShack flogs off its IPv4 stash

Found on The Register on Saturday, 08 July 2017
Browse Internet

The 32,000-odd addresses will be sold off in /24 and /20 subnets by auction site IPv4Auctions.com, which specializes in the sale and resale of the increasingly valuable online space.

In April of this year, the Massachusetts Institute of Technology threw open the doors on that approach when it announced it wanted to sell its very large /8 block of 16 million addresses in order to fund expansion of its IPv6 network.

Free market at work. Although IPv6 has been around for so long, IPv4 is still alive and kicking; and will be for many more years.

Stream-ripping is 'fastest growing' music piracy

Found on BBC News on Friday, 07 July 2017
Browse Internet

Record labels claim that "tens, or even hundreds of millions of tracks are illegally copied and distributed by stream-ripping services each month".

"As soon as we think we've come up with an innovative solution [to piracy], the pirates seem to come up with an even more innovative infringement tactic," said Pippa Hall, Chief Economist at the IPO.

Sounds like a new Betamax case is coming up.

Amazon and eBay images broken by Photobucket's 'ransom demand'

Found on BBC News on Tuesday, 04 July 2017
Browse Internet

Denver-based Photobucket is now seeking a $399 (£309) annual fee from those who wish to continue using it for "third-party hosting" and is facing a social media backlash as a consequence.

"People who have used Photobucket for hosting these images successfully for over 10 years are finding that they will have to literally start again with what for some, amounts to a lifetime's work."

Welcome to the cloud. It's not some magical service where everything will be available forever; if the owner decides to shut down its service, your data is gone. If you want to have your images hosted for free, at least keep backups; and if you run a forum, provide the option to store uploaded data on your servers, or you will end up crippled some day. Photobucket has pretty much committed suicide: for that price you can easily host tons of images on your own server, including backups while being in full control of your data.

Revealed: Facebook exposed identities of moderators to suspected terrorists

Found on The Guardian on Friday, 16 June 2017
Browse Internet

Of the 1,000 affected workers, around 40 worked in a counter-terrorism unit based at Facebook’s European headquarters in Dublin, Ireland. Six of those were assessed to be “high priority” victims of the mistake after Facebook concluded their personal profiles were likely viewed by potential terrorists.

The moderator said that others within the high-risk six had their personal profiles viewed by accounts with ties to Isis, Hezbollah and the Kurdistan Workers Party. Facebook complies with the US state department’s designation of terrorist groups.

The real security lapse is not the bug itself, but that moderators who patrol terrorist content are doing so with their own accounts that makes it possible to identify them.

Google Drive will soon back up your entire computer

Found on The Verge on Wednesday, 14 June 2017
Browse Internet

Soon, instead of files having to live inside of the Drive folder, Google will be able to monitor and backup files inside of any folder you point it to. That can include your desktop, your entire documents folder, or other more specific locations.

They sure won't backup my data. Not a single bit.