Hacker trades 272 million passwords for social media likes

Found on CNet News on Wednesday, 04 May 2016
Browse Internet

The passwords and usernames belonged to accounts from Russia's largest email provider, Mail.Ru, as well as a smaller number of accounts each from Gmail, Yahoo Mail and Microsoft Hotmail. Though it doesn't mean there was a breach of the email services themselves, the cache, first reported by Reuters, contains a huge amount of data.

Even though the hacker practically gave the login information away for free in the data dump revealed Wednesday, it's valuable to email users, who would do well to change their passwords often and never reuse them on other accounts, Holden said.

People better get used to those numbers. It looks like password dumps get bigger every time, even though everybody talks about security.

Slack bot token leakage exposing business critical information

Found on Detectify on Thursday, 28 April 2016
Browse Internet

The problem is that many developers tend to include Slack tokens – credentials tied to their personal Slack account – directly in the code when building Slack bots. These projects are also shared publicly on GitHub. Now, because the code contains these tokens, the developer is actually giving anyone – that finds the token – access to the developer’s company’s internal chats and files on Slack.

People check all and everything into GitHub. Private SSH keys are there, password list, and lots of other interesting information.

Former Top Gear team sets sights on domination of the four-wheeled Internet

Found on Ars Technica on Wednesday, 27 April 2016
Browse Internet

When things ended badly with the BBC, Clarkson, May, and Hammond were snapped up by Amazon with a budget reported to be $7 million (£4.5 million) per episode. But they evidently want more. On Monday Variety revealed that the gang, together with a tech entrepreneur called Ernesto Schmitt, want to create a digital home on the Internet for car people.

Meanwhile, over at the BBC Top Gear lives on, recreating itself for at least the third time. Headed by UK radio and TV presenter Chris Evans, and joined by a massive cast that includes Matt LeBlanc, Sabine Schmitz, and Chris Harris, the show has been dogged by negative coverage in the UK's newspapers and a bit of a controversy involving someone drifting near the Cenotaph (a war memorial in London).

Au contraire. Top Gear died on the day when the three left the BBC.

Website extortionists rake in over $100,000 without lifting a finger

Found on The Register on Monday, 25 April 2016
Browse Internet

"Our attacks are extremely powerful – sometimes over 1Tbps per second. And we pass CloudFlare and others' remote protections! So, no cheap protection will help," the email warns.

"Our conclusion was a bit of a surprise: we've been unable to find a single incident where the current incarnation of the Armada Collective has actually launched a DDoS attack," said Matthew Prince, CEO of CloudFlare.

There are groups out there performing actual attacks if they don't get a ransom, he said, but this isn't one of them. So if you get an email from the Armada Collective, there's no reason to pay up.

It's actually an easy way to make some money: just claim you are someone else and demand to be paid.

Shortened URLs Make File Sharing Less Secure, Cornell Researchers Find

Found on eWEEK on Thursday, 21 April 2016
Browse Internet

In a paper published in April, two researchers revealed that the 5- and 6-character URLs produced by popular shortening services could be easily searched to discover sensitive documents inadvisedly shared by their owners. Attackers could scan shortened URLs at a sustained rate of 2.6 lookups every second, and would only have to pay $36,700 to rent the cloud computing time necessary to do so, co-authors Martin Georgiev and Vitaly Shmatikov stated in the report.

That should be pretty obvious. Same goes not only for shortened URLs, but also for file hosters. Instead of living with this insecurity, just encrypt the file before you upload it.

Can Switzerland become a safe haven for the world's data?

Found on The Daily Dot on Wednesday, 20 April 2016
Browse Internet

As United States and European Union regulators debate a sweeping new data-privacy agreement, Switzerland is presenting itself as a viable neutral location for storing the world’s data thanks to strict privacy laws and ideal infrastructure.

“Swiss law contains things that we call blocking statutes,” Benz said, “which mean that foreign authorities can’t conduct their authority’s functions on Swiss soil unless they follow the proper judicial channels.”

Switzerland had not too many problems giving up the privacy of customers when the US wanted to know more about bank accounts over there.

Web host 123-reg deletes sites in clean-up error

Found on BBC News on Monday, 18 April 2016
Browse Internet

The company, which hosts 1.7m sites in the UK, said an error made during maintenance "effectively deleted" what was on some of its servers.

The company said it was performing a "clean up" operation on its VPS systems when an coding error in its software "effectively deleted" customer websites.

Another marketing attempt?

Facebook’s bots are already revolting

Found on Ars Technica on Wednesday, 13 April 2016
Browse Internet

Facebook has become a social network for cyborgs. It happened yesterday at Facebook developer conference F8 while everyone was busy eye-rolling over Mark Zuckerberg's keynote about saving the world. The company has launched a bot revolution, and ironically (or not), these bots will eventually replace tech workers in the exact emerging markets that Zuck vowed to rescue with his largesse.

Bots will make it easy to leapfrog over apps, but they will also do something that bots always do—at least, in science fiction. They will replace humans. Already, many of us spend time talking to bots on the phone, learning to enunciate our account numbers clearly enough for their voice recognition systems. With Facebook's help, we'll be talking to them a lot more. Bots will be the automated service workers of the next five years, allowing you to circumvent humans in your quest to get everything from tech support to airline tickets.

Thanks, but no thanks.

Zuck: You're still using non-Facebook websites ... I'll put an end to that

Found on The Register on Tuesday, 12 April 2016
Browse Internet

Having everyone online is nice, but Facebook is a commercial behemoth and its raison d'etre is to sell people's data to advertisers. As such, the company has unveiled its latest tools for developers to do just that.

Facebook also wants to get more into managing your identity. Facebook is now the largest single sign-on service in the world, claimed Deborah Liu, Facebook director of product management.

Too bad Zucky, but not everybody will jump on the bandwagon that's heading for your little bubble. It's much better to have Facebook blocked and ignored.

WordPress pushes free default SSL for hosted sites

Found on The Register on Monday, 11 April 2016
Browse Internet

"Today we are excited to announce free HTTPS for all custom domains hosted on WordPress," Abrahamson says.

It means millions of websites will be safer from spying and interception techniques.

Considering that Wordpress is a blog, meant for presenting ramblings to the public, there isn't that much else one can spy on. Granted, the logins are encrypted now, but that's pretty much the only real benefit.