LastPass password vault reportedly not so secure

Found on CNet News on Wednesday, 27 July 2016
Browse Internet

A security researcher with an established record of tracking down security flaws has found a so-called zero-day hole -- a software vulnerability that the software's makers don't know about -- that could let hackers remotely break into LastPass' millions of accounts. It takes only a visit to a malicious website to become a victim.

The idea of having all your passwords stored online is an insecure approach already.

Russian Censor Bans Comodo... Doesn't Realize Its Own Security Certificate Is From Comodo

Found on Techdirt on Tuesday, 26 July 2016
Browse Internet

As pointed out by Fight Copyright Trolls, it appears that Roskomnadzor may have gone a bit overboard recently, in response to a court ruling that had a massive list of sites to be banned (over a thousand pages). Apparently, as part of that, various sites associated with Comodo were all banned.

It's not entirely clear the impact of this, but the Rublacklist site appears to be implying (via my attempt at understanding Google translate's translation...) that this also means that sites that rely on Roskomnadzor's registry of sites to block... may be blocked from accessing the list. Because its own site is effectively blocked by the list.

Comodo could just revoke all certificates issues to .ru domains and see how that works out. If someone does not want to do business with you, you don't do business with them. Easy.

Google tests ads that load faster and use less power

Found on BBC News on Saturday, 23 July 2016
Browse Internet

The company said the ads would also be less taxing on the handsets' processors, meaning their batteries should last longer.

"This ensures that every device gets the best experience it can deliver and makes sure that ads cannot have a negative impact on important aspects of the user experience such as scrolling."

The best ads are those which are blocked. After years and years of being bombarded with all sorts of useless, and often even dangerous ads, the only choice is to block them as much as possible.

Verizon to disconnect unlimited data customers who use over 100GB/month

Found on Ars Technica on Thursday, 21 July 2016
Browse Internet

Verizon Wireless customers who have held on to unlimited data plans and use significantly more than 100GB a month will be disconnected from the network on August 31 unless they agree to move to limited data packages that require payment of overage fees.

"Because our network is a shared resource and we need to ensure all customers have a great mobile experience with Verizon, we are notifying a very small group of customers on unlimited plans who use an extraordinary amount of data that they must move to one of the new Verizon Plans by August 31, 2016," a Verizon spokesperson told Ars.

In other words, Verizon sold more capacity than it could offer in the past to lure in customers, and now that those paying customers make use of the unlimited contract, they force them off their network.

Google piracy report criticised by music industry

Found on BBC News on Wednesday, 13 July 2016
Browse Internet

Google says it has created more than $2bn (£1.5bn) for content owners via YouTube's piracy-tackling Content ID tool.

But the BPI, which represents the UK's recorded music industry, dismissed the document as "greenwash".

The International Federation of the Phonographic Industry (IFPI) described Content ID as being "ineffective".

99.99% of the music created these days is not worth listening to anyway. It's a collection of remakes, remixes and overhyped songs. Actually, some of the better music is even released for free by musicians who do not want to deal with the dying music industry anymore.

FTC: Warner Bros. paid YouTubers for positive reviews

Found on Ars Technica on Monday, 11 July 2016
Browse Internet

While the FTC’s complaint against Warner Bros. (PDF) does not mention any specific influencer, the commission’s press release calls out PewDiePie, the world's top-earning YouTube video creator, as one of the so-called influencers that took the studio’s money.

The commission noted that the sponsored videos for Shadow of Mordor were viewed 5.5 million times, with PewDiePie’s sponsored video raking in more than 3.7 million of those views. The Swedish YouTube star was criticized in 2015 for making what some viewers saw as an excessive amount of money, which he deflected in a video that garnered 13 million views.

Money makes the world turn around. Just because some are hailed as newcomer stars who acts like your neighbour from across the street does not mean that they won't take bribes support money and lie try to influence you. It's all about business.

Ashley Madison admits using fembots to lure men into spending money

Found on Ars Technica on Friday, 08 July 2016
Browse Internet

The scam was simple: when a man signed up for a free account, he almost immediately got a chat or private message from a "woman" whose profile showed a few sexy pictures. To reply to his new lady friend, the man had to pay for an account. In reality, that lady was a few lines of PHP code.

Also in internal company e-mails, executives discussed openly that only about five percent of the site's members were real females.

There's an old rule that still applies: if it sounds too good to be true, it probably is.

Hordes of Fake Users Scamming Social Media, eCommerce Sites

Found on eWEEK on Sunday, 03 July 2016
Browse Internet

Why do tech companies and other startups create fake users? As with Pied Piper, one reason is to convince real users that a Web-based service is popular and, therefore, more appealing.

Amazon recently filed lawsuits against three sellers for using sock puppet accounts to post fake reviews. (They posed as consumers but were in fact "reviewing" their own products. And these sellers were allegedly prolific—some 30 to 45 percent of the companies' reviews were fake.

According to one report, about 8 percent of presidential candidate Donald Trump and 7 percent of Hillary Clinton's Twitter followers are fake accounts. That estimate is conservative—some reports say the majority of the candidates' social media followers are fake.

Shocking news? No. That should not surprise anybody who has spent more than 5 minutes online. Often sockpuppets are easy to spot, especially on sites where you can buy something. So it is only logical to assume that apart from those bad puppets there are more better ones. In times where likes, views and followers are everything, people stopped caring about who truly is behind those numbers.

Facebook crushes Belgian attempt to ban tracking of non-users

Found on The Register on Wednesday, 29 June 2016
Browse Internet

Back in November, the social network was ordered by a Belgian court to kill tracking cookies within 48 hours for people not signed up to – or logged into – its service, or face a daily fine of €250,000.

The Belgian Privacy Commission is not pleased, but has yet to say whether it will take the case further. Meanwhile, Facebook is delighted: "We are pleased with the court's decision and look forward to bringing all our services back online for people in Belgium," it said in a statement.

It's 2016. Still accepting all cookies? Seriously?

HTML5 Ads Aren't That Safe Compared to Flash, Experts Say

Found on Softpedia on Friday, 24 June 2016
Browse Internet

HTML5 was officially released in October 2014, and slowly but surely, it started to replace Flash in the advertising market, where many ad networks such as Google and Amazon announced they'd stop taking static Flash ads, even if still allowing Flash for video ads.

A malicious ad creator can use their ability to send third-party JavaScript to the ad via AdParameter values. Instead of user tracking code or ad delivery instructions, they can very easily deliver malicious code instead. At no point does it matter to them if the ad was created in Flash or HTML5.

Just require that content can only be delivered from the same host as the main website and effectively disable remote includes from third party servers (same origin policy).