Entries Tagged "web"

Page 3 of 14

Teenagers and Privacy

Good article debunking the myth that young people don’t care about privacy on the Intenet.

Most kids are well aware of risks, and make “fairly sophisticated” decisions about privacy settings based on advice and information from their parents, teachers, and friends. They differentiate between people they don’t know out in the world (distant strangers) and those they don’t know in the community, such as high school students in their hometown (near strangers). Marisa, for example, a 10-year-old interviewed in the study (who technically is not allowed to use Facebook), “enjoys participating in virtual worlds and using instant messenger and Facebook to socialize with her friends”; is keenly aware of the risks—especially those related to privacy; and she doesn’t share highly sensitive personal information on her Facebook profile and actively blocks certain people.

[…]

Rather than fearing the unknown stranger, young adults are more wary of the “known other”—parents, school teachers, classmates, etc.—for fear of “the potential for the known others to share embarrassing information about them”; 83 percent of the sample group cited at least one known other they wanted to maintain their privacy from; 71 percent cited at least one known adult. Strikingly, seven out of the 10 participants who reported an incident when their privacy was breached said it was “perpetrated by known others.”

Posted on April 10, 2012 at 10:21 AM • View Comments

Blue Coat Products Enable Web Censorship in Syria

It’s illegal for Blue Coat to sell its technology for this purpose, but there are lots of third-parties who are willing to act as middlemen:

“Blue Coat does not sell to Syria. We comply with US export laws and we do not allow our partners to sell to embargoed countries,” [Blue Coat spokesman Steve] Schick told the Bureau. “In addition, we do not allow any of our resellers, regardless of their location in the world, to sell to an embargoed country, such as Syria.”

However, Schick did not rule out the possibility that the equipment could have been bought via a third party re-seller, noting that Blue Coat equipment can be found on websites like eBay.

Bet you anything that the Syrian Blue Coat products are registered, and that they receive all the normal code and filter updates.

EDITED TO ADD (11/14): The Wall Street Journal confirms it:

The appliances do have Blue Coat service and support contracts. The company says it has now cut off contracts for the devices.

Posted on October 24, 2011 at 1:39 PM • View Comments

Facebook Patent to Track Users Even When They are Not Logged In to Facebook

Patent application number 2011/023240:

Communicating Information in a Social Network System about Activities from Another Domain

Abstract: In one embodiment, a method is described for tracking information about the activities of users of a social networking system while on another domain. The method includes maintaining a profile for each of one or more users of the social networking system, each profile identifying a connection to one or more other users of the social networking system and including information about the user. The method additionally includes receiving one or more communications from a third-party website having a different domain than the social network system, each message communicating an action taken by a user of the social networking system on the thirdparty website. The method additionally includes logging the actions taken on the third-party website in the social networking system, each logged action including information about the action. The method further includes correlating the logged actions with one or more advertisements presented to the one or more users on the third-party website as well as correlating the logged actions with a user of the social networking system.

Facebook denies that this is a patent for that. Although Facebook does seem to track users even when they are not logged in, as well as people who aren’t even Facebook users.

EDITED TO ADD (10/24): Facebook claims that, while they do collect information on non-users, they don’t use it for profiling. This feels like hair-splitting to me; I get emails from Facebook with lists of friends who are already on the site.

EDITED TO ADD (10/24): It’s a patent application, not a patent.

Posted on October 24, 2011 at 6:42 AM • View Comments

Random Passwords in the Wild

Interesting analysis:

the hacktivist group Anonymous hacked into several BART servers. They leaked part of a database of users from myBART, a website which provides frequent BART riders with email updates about activities near BART stations. An interesting aspect of the leak is that 1,346 of the 2,002 accounts seem to have randomly-generated passwords-a rare opportunity to study this approach to password security.

Posted on October 20, 2011 at 6:25 AM • View Comments

Insecure Chrome Extensions

An analysis of extensions to the Chrome browser shows that 25% of them are insecure:

We reviewed 100 Chrome extensions and found that 27 of the 100 extensions leak all of their privileges to a web or WiFi attacker. Bugs in extensions put users at risk by leaking private information (like passwords and history) to web and WiFi attackers. Web sites may be evil or contain malicious content from users or advertisers. Attackers on public WiFi networks (like in coffee shops and airports) can change all HTTP content.

Posted on September 29, 2011 at 7:07 AM • View Comments

Man-in-the-Middle Attack Against SSL 3.0/TLS 1.0

It’s the Browser Exploit Against SSL/TLS Tool, or BEAST:

The tool is based on a blockwise-adaptive chosen-plaintext attack, a man-in-the-middle approach that injects segments of plain text sent by the target’s browser into the encrypted request stream to determine the shared key. The code can be injected into the user’s browser through JavaScript associated with a malicious advertisement distributed through a Web ad service or an IFRAME in a linkjacked site, ad, or other scripted elements on a webpage.

Using the known text blocks, BEAST can then use information collected to decrypt the target’s AES-encrypted requests, including encrypted cookies, and then hijack the no-longer secure connection. That decryption happens slowly, however; BEAST currently needs sessions of at least a half-hour to break cookies using keys over 1,000 characters long.

The attack, according to Duong, is capable of intercepting sessions with PayPal and other services that still use TLS 1.0­which would be most secure sites, since follow-on versions of TLS aren’t yet supported in most browsers or Web server implementations.

While Rizzo and Duong believe BEAST is the first attack against SSL 3.0 that decrypts HTTPS requests, the vulnerability that BEAST exploits is well-known; BT chief security technology officer Bruce Schneier and UC Berkeley’s David Wagner pointed out in a 1999 analysis of SSL 3.0 that “SSL will provide a lot of known plain-text to the eavesdropper, but there seems to be no better alternative.” And TLS’s vulnerability to man-in-the middle attacks was made public in 2009. The IETF’s TLS Working Group published a fix for the problem, but the fix is unsupported by SSL.

Another article.

EDITED TO ADD: Good analysis.

Posted on September 23, 2011 at 1:37 PM • View Comments

1 2 3 4 5 … 14

Sidebar photo of Bruce Schneier by Joe MacInnis.