Open Source News » Tags

Feeds

34757 items (30244 unread) in 5 feeds

OpenSource

Security

Linux

199 items tagged "privacy"

Most CCTV Systems Come With Trivial Exploits

Posted: May 17th, 2012, 3:25pm CEST by timothy

Tags: privacy

An anonymous reader writes "The use of CCTV cameras for physical surveillance of all kinds of environments has become so pervasive that most of us don't give the devices a second thought anymore. But, those individuals and organizations who actually use and control them should be aware that most of them come with default settings that make them vulnerable to outside attacks. According to Gotham Digital Science researcher Justin Cacak, standalone CCTV video surveillance systems by MicroDigital, HIVISION, CTRing, and many other rebranded devices are not only shipped with remote access enabled by default, but also with preconfigured default accounts and passwords that are banal and easy to guess."

Read more of this story at Slashdot.

UK Police Roll Out On-the-Spot Mobile Data Extraction System

Posted: May 17th, 2012, 6:34am CEST by samzenpus

Tags: privacy

Qedward writes "The Metropolitan Police has rolled out a mobile device data extraction system to allow officers to extract data 'within minutes' from suspects' phones while they are in custody. 'Ostensibly, the system has been deployed to target phones that are suspected of having actually been used in criminal activity, although data privacy campaigners may focus on potentially wider use.'"

Read more of this story at Slashdot.

Kickstarter Leaves Project Ideas Exposed

Posted: May 14th, 2012, 8:00pm CEST by Soulskill

Tags: privacy

netbuzz writes "Crowd-funding startup Kickstarter is taking a public-relations hit today after it was reported that some 70,000 not-yet-public project ideas were left exposed on the company's Web site for more than two weeks. Kickstarter insists that no financial information was compromised and that only a few dozen of the projects were actually accessed. 'Obviously our users' data is incredibly important to us, the company said in a blog post. 'Even though limited information was made accessible through this bug, it is completely unacceptable.'"

Read more of this story at Slashdot.

Homeland Security: New Body Scanners Have Issues

Posted: May 9th, 2012, 2:13pm CEST by Soulskill

Tags: privacy

Fluffeh writes "Although the DHS has spent around $90 million upgrading magnetometers to the new body scanners, federal investigators 'identified vulnerabilities in the screening process' at domestic airports using the new machines, according to a classified internal Department of Homeland Security report. Exactly how bad the body scanners are is not being divulged publicly, but the Inspector General's report (PDF) made eight separate recommendations on how to improve screening. To quiet privacy concerns, the authorities are also spending $7 million to 'remove the human factor from the image review process' and replace the passenger's image with an avatar."

Read more of this story at Slashdot.

Rand Paul Has a Quick Fix For TSA: Pull the Plug

Posted: May 4th, 2012, 8:29pm CEST by Soulskill

Tags: privacy

suraj.sun quotes from Politico: "Rand Paul has a reform plan for the Transportation Security Administration: Scrap the whole thing. A personal message from Paul (R-Ky.) came atop emails this week from the Campaign for Liberty Vice President Matt Hawes, asking for readers to sign a petition in support of Paul's 'End the TSA' bill. A Paul spokeswoman said that legislation is being finalized next week. 'Every inch of our person has become fair game for government thugs posing as "security" as we travel around the country. Senator Rand Paul has a plan to do away with the TSA for good, but he needs our help,' reads the petition, which also asks signers to 'chip in a contribution to help C4L mobilize liberty activists across America to turn the heat up on Congress and end the TSA's abuse of our rights.' 'The American people shouldn't be subjected to harassment, groping, and other public humiliation simply to board an airplane. As you may have heard, I have some personal experience with this, and I've vowed to lead the charge to fight back,' Paul wrote at the top of a C4L fundraising pitch, according to blogs that received the email. 'Campaign for Liberty is leading the fight to pressure Congress to act now and restore our liberty. It's time to END the TSA and get the government's hands back to only stealing our wallets instead of groping toddlers and grandmothers.'"

Read more of this story at Slashdot.

Mozilla Calls CISPA an "Alarming" Threat to Privacy

Posted: May 2nd, 2012, 11:13pm CEST by samzenpus

Tags: privacy

Sparrowvsrevolution writes "Mozilla has taken a public stand against the controversial Cyber Intelligence Sharing and Protection Act, saying that it has a 'broad and alarming reach' that 'infringes on our privacy.' That makes it the first major tech firm to speak out against CISPA. Facebook, Microsoft, IBM, Intel, Oracle and Symantec are all included among the companies that support the bill, which passed the House late last month and is now being considered in the Senate. Google has so far declined to take a stand supporting or opposing the bill."

Read more of this story at Slashdot.

Hacked Skype IP Address Search Shows Who's Speaking From Where

Posted: May 1st, 2012, 6:52pm CEST by timothy

Tags: privacy

mask.of.sanity writes "An online search portal has been launched that reveals the IP addresses of any Skype user. The portal needs only a Skype username entered in a search bar for it to produce the IP address of a target user. It then uses IP addresses to geo-locate users on a map and reveal their ISP information."

Read more of this story at Slashdot.

TSA Tests Automated ID Authentication

Posted: April 23rd, 2012, 1:40am CEST by timothy

Tags: privacy

CowboyRobot writes "Last year, a Nigerian man boarded a plane from N.Y. to L.A. using an invalid ID and a boarding pass issued to another person. A week later he was caught again with 10 expired boarding passes. In response to this and similar events, the Transportation Security Administration has begun testing a new system at Washington's Dulles International Airport that verifies an air traveler's identity by matching photo IDs to boarding passes and ensures that boarding passes are authentic. The test will soon be expanded to Houston and Puerto Rico."

Read more of this story at Slashdot.

Whistleblower: NSA Has All of Your Email

Posted: April 21st, 2012, 2:26pm CEST by timothy

Tags: privacy

mspohr writes with this excerpt from Democracy Now!: "National Security Agency whistleblower William Binney reveals he believes domestic surveillance has become more expansive under President Obama than President George W. Bush. He estimates the NSA has assembled 20 trillion 'transactions' — phone calls, emails and other forms of data — from Americans. This likely includes copies of almost all of the emails sent and received from most people living in the United States. Binney talks about Section 215 of the USA PATRIOT Act and challenges NSA Director Keith Alexander's assertion that the NSA is not intercepting information about U.S. citizens." The parts about National Security Letters in particular are chilling, even though the issue is not new.

Read more of this story at Slashdot.

Europe Agrees To Send Airline Passenger Data To US

Posted: April 20th, 2012, 8:44am CEST by samzenpus

Tags: privacy

Qedward writes "The European Parliament has approved the controversial data transfer agreement, the bilateral PNR (passenger name register), with the US which requires European airlines to pass on passenger information, including name, contact details, payment data, itinerary, email and phone numbers to the Department of Homeland Security. Under the new agreement, PNR data will be 'depersonalized' after six months and would be moved into a 'dormant database' after five years. However the information would still be held for a further 15 years before being fully 'anonymized.'"

Read more of this story at Slashdot.

Company Designs "Big Brother Chip"

Posted: April 9th, 2012, 2:52pm CEST by samzenpus

Tags: privacy

Taco Cowboy writes "Here comes a chip that can pinpoint you in-door and out, it can even tell others on which floor of a building you are located. It's the Broadcom 4752 chip. It takes signals from global navigation satellites, cell phone towers, and Wi-Fi hot spots, coupled with input from gyroscopes, accelerometers, step counters, and altimeters The company calls abilities like this 'ubiquitous navigation,' and the idea is that it will enable a new kind of e-commerce predicated on the fact that shopkeepers will know the moment you walk by their front door, or when you are looking at a particular product, and can offer you coupons at that instant."

Read more of this story at Slashdot.

Aviation Security Debate: Bruce Schneier V. Kip Hawley (Former TSA Boss)

Posted: March 31st, 2012, 12:31am CEST by Soulskill

Tags: privacy

Fluffeh writes "A nice summary at TechDirt brings word that Bruce Schneier has been debating Kip Hawley, former boss of the TSA, over at the Economist. Bruce has been providing facts, analysis and some amazing statistics throughout the debate, and it makes for very educational reading. Because of the format, the former TSA administrator is compelled to respond. Quoting: 'He wants us to trust that a 400-ml bottle of liquid is dangerous, but transferring it to four 100-ml bottles magically makes it safe. He wants us to trust that the butter knives given to first-class passengers are nevertheless too dangerous to be taken through a security checkpoint. He wants us to trust that there's a reason to confiscate a cupcake (Las Vegas), a 3-inch plastic toy gun (London Gatwick), a purse with an embroidered gun on it (Norfolk, VA), a T-shirt with a picture of a gun on it (London Heathrow) and a plastic lightsaber that's really a flashlight with a long cone on top (Dallas/Fort Worth).""

Read more of this story at Slashdot.

Verizon Says Hactivists Now Biggest Corporate Net Threat

Posted: March 22nd, 2012, 4:42pm CET by timothy

Tags: privacy

alphadogg writes "Hactivists — not cybercriminals — were responsible for the majority of personal data stolen from corporate and government networks during 2011, according to a new report from Verizon. The Verizon 2012 Data Breach Investigation Report found that 58% of data stolen in 2011 was the result of hactivism, which involves computer break-ins for political rather than commercial gain. In previous years, most hacking was carried out by criminals, Verizon said. Altogether, Verizon examined 855 cybersecurity incidents worldwide that involved 174 million compromised records. This is the largest data set that Verizon has ever examined, thanks to its cooperation with law enforcement groups including the U.S. Secret Service, the Dutch National High Tech Crime Unit and police forces from Australia, Ireland and London."

Read more of this story at Slashdot.

The Average Consumer Thinks Data Privacy Is Worth Around 65 Cents

Posted: March 14th, 2012, 8:00pm CET by samzenpus

Tags: privacy

chicksdaddy writes "Threatpost is reporting today on the findings of an ENISA study that looked at whether consumers would pay more for goods in exchange for more privacy. The answer — 'Sure...just not much more.' The report (PDF): 'Study on Monetizing Privacy: An Economic Model for Pricing Personal Information' presents the findings of a laboratory study in which consumers were asked to buy identical goods from two online vendors: one that collected minimal customer information and another that required the customer to surrender more of their personal information to purchase the item, including phone number and a government ID number. The laboratory experiment showed that the majority of consumers value privacy protections. When the prices of the goods offered by both the privacy protecting and the privacy violating online retailers were equal, shoppers much preferred the privacy protecting vendor. But the preference for more privacy wasn't very strong, and didn't come close to equaling consumers' preference for lower prices. In fact, consumers readily switched to a more privacy-invasive provider if that provider charged a lower price for the same goods. How much lower? Not much, researchers discovered. A discount of just E0.50 ($0.65) was enough to sway consumers away from a vendor who would protect the privacy of their personal data."

Read more of this story at Slashdot.

The Ineffectiveness of TSA Body Scanners

Posted: March 7th, 2012, 6:14am CET by Soulskill

Tags: privacy

TheNextCorner points out a video that lays bare a glaring flaw in the TSA body scanners used in airports to detect weapons and explosives. In such scans, citizens are depicted in light colors, while metallic objects show as very dark. The problem comes when you consider that the images are taken with a dark background. From the transcript: "Yes that’s right, if you have a metallic object on your side, it will be the same color as the background and therefore completely invisible to both visual and automated inspection. It can’t possibly be that easy to beat the TSA’s billion dollar fleet of nude body scanners, right? The TSA can’t be that stupid, can they? Unfortunately, they can, and they are. To put it to the test, I bought a sewing kit from the dollar store, broke out my 8th grade home ec skills, and sewed a pocket directly on the side of a shirt. Then I took a random metallic object, in this case a heavy metal carrying case that would easily alarm any of the “old” metal detectors, and walked through a backscatter x-ray at Fort Lauderdale-Hollywood International Airport. On video, of course. While I’m not about to win any videography awards for my hidden camera footage, you can watch as I walk through the security line with the metal object in my new side pocket."

Read more of this story at Slashdot.

Startup Wants To Peek Through Your Home's Wired Cameras

Posted: March 2nd, 2012, 9:05pm CET by Soulskill

Tags: privacy

alphadogg writes "The little cameras in your home are multiplying. There are the ones you bought, perhaps your SLR or digital camera, but also those that just kind of show up in your current phone, your old phone, your laptop, your game console, and soon your TV and set-top box. Varun Arora, founder of startup GotoCamera in Singapore, wants you to turn them all on and let his company's algorithms analyze what they show, then sell the results as marketing data, in a sort of visual version of what Google and other firms do with search results and free email services."

Read more of this story at Slashdot.

EFF's HTTPS Everywhere Detects and Warns About Cryptographic Vulnerabilities

Posted: February 29th, 2012, 10:28pm CET by samzenpus

Tags: privacy

Peter Eckersley writes "EFF has released version 2 of the HTTPS Everywhere browser extension for Firefox, and a beta version for Chrome. The Firefox release has a major new feature called the Decentralized SSL Observatory. This optional setting submits anonymous copies of the HTTPS certificates that your browser sees to their Observatory database allowing them to detect attacks against the web's cryptographic infrastructure. It also allows us to send real-time warnings to users who are affected by cryptographic vulnerabilities or man-in-the-middle attacks. At the moment, the Observatory will send warnings if you connect to a device has a weak private key due to recently discovered random number generator bugs."

Read more of this story at Slashdot.

State Legislatures Attempt To Limit TSA Searches

Posted: February 23rd, 2012, 5:42pm CET by timothy

Tags: privacy

OverTheGeicoE writes "Here's a familiar story: a breast cancer survivor's mastectomy scars showed up on a TSA scan, which forced a horrifying pat-down ('feel-up' in her words) of the affected area. The woman decided that she would not subject herself to that again, and was barred from a later flight from Seattle to Juneau for that reason. But now the story takes an interesting turn: the woman is Alaska State Rep. Sharon Cissna, and once she finally made it back to Alaska she started sponsoring legislation to restrict TSA searches. Her many bills, if passed, would criminalize both pat-downs and 'naked scanning,' as well as require better health warnings for X-ray scanners and even studies of airport screenings' physical and psychological effects. Other states, including Utah and Texas, are considering similar legislation. For example, Texas State Rep. David Simpson is preparing to reintroduce his Traveler Dignity Act again in 2013 if he is re-elected. The last time that bill was being considered the Federal government threatened to turn all of Texas into a 'no-fly zone'."

Read more of this story at Slashdot.

Transparency Grenade Collects and Leaks Sensitive Data

Posted: February 21st, 2012, 10:28pm CET by Soulskill

Tags: privacy

Zothecula writes "If you thought WikiLeaks was a disruptive idea, the transparency grenade is going to blow you away. This tiny bit of hardware hidden under the shell shaped like a classic Soviet F1 hand grenade allows you to leak information from anywhere just by pulling a pin. The device is essentially a small computer with a powerful wireless antenna and a microphone. Following 'detonation,' the grenade intercepts local network traffic and captures audio data, then makes the information immediately available online."

Read more of this story at Slashdot.

Do You Like Online Privacy? You May Be a Terrorist

Posted: February 2nd, 2012, 7:03pm CET by timothy

Tags: privacy

schwit1 passes on this snippet from Public Intelligence: "A flyer designed by the FBI and the Department of Justice to promote suspicious activity reporting in internet cafes lists basic tools used for online privacy as potential signs of terrorist activity. The document, part of a program called 'Communities Against Terrorism,' lists the use of 'anonymizers, portals, or other means to shield IP address' as a sign that a person could be engaged in or supporting terrorist activity. The use of encryption is also listed as a suspicious activity along with steganography, the practice of using 'software to hide encrypted data in digital photos' or other media. In fact, the flyer recommends that anyone 'overly concerned about privacy' or attempting to 'shield the screen from view of others' should be considered suspicious and potentially engaged in terrorist activities. ... The use of PGP, VPNs, Tor or any of the many other technologies for anonymity and privacy online are directly targeted by the flyer, which is distributed to businesses in an effort to promote the reporting of these activities."

Read more of this story at Slashdot.

Surveillance Cameras Used To Study Customer Behavior

Posted: January 31st, 2012, 7:04pm CET by samzenpus

Tags: privacy

An anonymous reader writes "Technology Review reports on a startup with software used by stores to track, count and log people captured by security cameras. Prism Skylab's technology can produce heatmaps showing where people went and produce other statistics that the company claims offer tracking and analytics like those used online for the real world. One use case is for businesses to correlate online promotions and deals — such as Groupon offers — with real world footfall and in-store behavior."

Read more of this story at Slashdot.

O2 Fixes 'Accidental' Leak of Phone Numbers

Posted: January 26th, 2012, 5:09pm CET by timothy

Tags: privacy

judgecorp writes "British mobile operator O2 says it has stopped sharing users phone numbers with all websites, and says the breach was an accident. Yesterday, users found that the operator was automatically passing their mobile numbers to any site they visited, while using O2's mobile network,"

Read more of this story at Slashdot.

The Web's Worst Privacy Policy

Posted: January 25th, 2012, 11:05pm CET by samzenpus

Tags: privacy

Sparrowvsrevolution writes "With much of the web upset over about Google's latest privacy policy changes, it's helpful to remember it could be much worse: A search engine called Skipity offers the world's worst privacy policy (undoubtedly tongue-in-cheek), filled with lines like this: 'You may think of using any of our programs or services as the privacy equivalent of living in a webcam fitted glass house under the unblinking eye of Big Brother: you have no privacy with us. If we can use any of your details to legally make a profit, we probably will.' The policy gives the company the right to sell any of your data that it wants to any and all corporate customers, send you limitless spam, track your movements via GPS if possible, watch you through your webcam, and implant a chip in your body that is subject to reinstallation whenever the company chooses."

Read more of this story at Slashdot.

US Judge Rules Defendant Can Be Forced To Decrypt Hard Drive

Posted: January 24th, 2012, 6:19am CET by Soulskill

Tags: privacy

A Commentor writes "Perhaps to balance the good news with the Supreme Court ruling on GPS, a judge in Colorado has ordered a defendant to decrypt her hard drive. The government doesn't have the capability to break the PGP encryption, and 'the Fifth Amendment is not implicated by requiring production of the unencrypted contents' of the defendant's computer."

Read more of this story at Slashdot.

Teens Share Passwords As a Form of Intimacy

Posted: January 19th, 2012, 6:14pm CET by Soulskill

Tags: privacy

nonprofiteer writes "The New York Times claims that the hot new trend among teenagers in love is to share passwords to their email and Facebook accounts, as the ultimate form of trust. According to Pew, 33% of teens surveyed say they do this. One expert says the pressure to share passwords is akin to the pressure to have sex. Forbes says don't do it! 'There is something pure and romantic about the idea of sharing everything, and having no secrets from one another. But it's romantic the same way that Romeo and Juliet is romantic, in a tragic, horrible, everyone-is-miserable-and-dies-at-the-end kind of way.' Sam Biddle at Gizmodo writes about which passwords are okay to share (like Netflix), but says to stay away from handing over email or Facebook passwords. 'We all need whatever scraps of privacy we have left, and your email is just that.'"

Read more of this story at Slashdot.

Data Exposed In Stratfor Compromise Analyzed

Posted: December 28th, 2011, 7:19pm CET by Unknown Lamer

Tags: privacy

wiredmikey writes with an excerpt from an article in Security Week: "Following news that security and intelligence firm Stratfor is downplaying the recent hack of its systems, Identity Finder today shared a detailed analysis of the data released so far by the attackers. Based on the analysis, 50,277 Individual Credit Card Numbers were exposed, but 40,626 are expired, leaving just 9,651 that are not expired. In terms of emails, 86,594 Email addresses were claimed to be exposed by the hackers, but only 47,680 were unique. The hackers have released personal information for Stratfor subscribers whose first names begin with A through M, with N through Z expected to be released soon. In addition to the presently published data compromised during the attack, the attackers claim that 200GB of company email containing 2.7 million emails was captured as well." As of posting, Stratfor's website is still down.

Read more of this story at Slashdot.

GnuPG Short ID Collision Has Occurred.

Posted: December 27th, 2011, 5:17am CET by Unknown Lamer

Tags: privacy

kfogel writes "Asheesh Laroia now has two GPG different keys with the same short ID (70096AD1) circulating on keyservers. One of them is an older 1024-bit DSA key, the other is a newer 4096-bit RSA key. Oops. Asheesh argues that GPG's short IDs are too short to be the default anymore — collisions are too easy to create: he did it on purpose and openly, but others could do it on purpose and secretly. More discussion (and a patch by dkg) are in this bug report."

Read more of this story at Slashdot.

Moxie Marlinspike Answers Your Questions

Posted: December 19th, 2011, 6:40pm CET by samzenpus

Tags: privacy

A few weeks ago you asked security guru Moxie Marlinspike about all manner of security issues, being searched at the border, and how to come up with a good online name. He's graciously answered a number of your inquiries which you will find below.

Read more of this story at Slashdot.

IT Pros Can't Resist Peeking At Privileged Info

Posted: December 5th, 2011, 5:38pm CET by samzenpus

Tags: privacy

Orome1 writes "IT security staff will be some of the most informed people at the office Christmas party this year. A full 26 per cent of them admit to using their privileged log in rights to look at confidential information they should not have had access to in the first place. It has proved just too tempting, and maybe just human nature, for them to rifle through redundancy lists, payroll information and other sensitive data including, for example, other people's Christmas bonus details."

Read more of this story at Slashdot.

Browser History Sniffing Is Back

Posted: December 5th, 2011, 12:33am CET by timothy

Tags: privacy

An anonymous reader writes "Remember CSS history sniffing? The leak is plugged in all major browsers today, but there is some bad news: in a post to the Full Disclosure mailing list, security researchers have showcased a brand new tool to quickly extract your history by probing the cache, instead. The theory isn't new, but a convincing implementation is."

Read more of this story at Slashdot.

Ask Slashdot: To Hack Or Not To Hack?

Posted: December 2nd, 2011, 10:34pm CET by Soulskill

Tags: privacy

seeread writes "I discovered how to hack into and secure user accounts of a rising mobile payment start-up. Account info includes credit card details and usage. The company has big name financial backing and an IRL presence, but very few in-house developers, and they don't seem terribly concerned about security. Good samaritan that I am for now, I sent them an e-mail explaining the lapse on their part, but the responses I have received thus far are confused, aloof and unconvinced. So, I am wondering: what is the appropriate next step? Should I do a proof of concept? Should I go to the investors, or should I post about it somewhere? The representatives haven't been too receptive, despite the fact that their brand seems to be at risk, not to mention all of those users' credit cards. I almost feel like it's my responsibility to blow them out of the water if they have made it this far while compromising such trusted data. And although I would love to be in the paper, this hack is just too easy for it to be respectable, though I am sure the FBI could still be interested in all those credit card numbers."

Read more of this story at Slashdot.

WikiLeaks Launches New Platform, Privacy Study

Posted: December 1st, 2011, 5:03pm CET by timothy

Tags: privacy

itwbennett writes "WikiLeaks has launched a new submissions platform, along with a study of the global trade in surveillance products. WikiLeaks founder Julian Assange told press conference attendees in London that all the iPhone, BlackBerry, and Gmail users in the crowd were 'screwed.' 'The reality is intelligence contractors are selling right now to countries across the world mass surveillance systems for all of those products,' Assange said."

Read more of this story at Slashdot.

News Corp. Hacking Scandal Spreads To Government

Posted: November 30th, 2011, 7:52pm CET by samzenpus

Tags: privacy

wiredmikey writes "The scandal revolving around the News Corporation's now defunct British tabloid, News of the World, has entered a new phase with news that the hacking extended into areas of national security, as detectives working for the Murdoch media empire may have hacked into the computer of a government minister responsible for Northern Ireland. Scary stuff, yet the enterprise security community seems strangely quiet on the topic, aside from showing other journalists how easy it is to do. Potentially, if you know the correct mobile number and you can guess four digits, you too can be listening to your elected leaders' personal messages. The chances are pretty good that it could be their birthday."

Read more of this story at Slashdot.

Attackers Leak UN Usernames and Passwords

Posted: November 30th, 2011, 7:10pm CET by Unknown Lamer

Tags: privacy

Orome1 writes "A group of hackers that go by the name of 'Teamp0ison' has apparently compromised one (or more) of UN's servers and dumped over 1000 email addresses, usernames, and passwords of their staff." The BBC has a bit more, including a denial that anything of value was compromised.

Read more of this story at Slashdot.

Tor-Enabled Browser For the iPad, and Easy Tor Nodes on EC2

Posted: November 15th, 2011, 6:23pm CET by timothy

Tags: privacy

An anonymous reader writes "While there has been a port of Tor for jailbroken iOS devices for a long time, there was no way to use it if you did not want to lose your warranty. Now it looks like Apple has approved a Web browser for the iPad called Covert Browser, which includes a Tor client. If you look at the first screenshot on the author's page it looks like you can even select the Exit node. According to App Shopper it already hit place 64 in the iPad/Utilites category." And from another (of course) anonymous reader comes a link to CmdrTaco's take on another instance of Tor breaking into the world of "real users." As he notes, the Tor Cloud Project has posted simple instructions for installing EC2 Tor nodes using free-tier VMs (or paid nodes for roughly $30/month).

Read more of this story at Slashdot.

Anonymous Hacks Finland

Posted: November 8th, 2011, 9:03am CET by Unknown Lamer

Tags: privacy

First time accepted submitter spuguli writes with more exploits of Anonymous. "From Helsingin Sanomat: 'A data leak was uncovered in Finland on Saturday, in which personal details ... of around 16,000 people were uploaded onto a file-sharing website.' Anonymous has claimed responsibility for the cracking of several databases."

Read more of this story at Slashdot.

Carbonite Privacy Breach Leads To Spam

Posted: November 2nd, 2011, 9:43pm CET by samzenpus

Tags: privacy

richi writes "It looks like Carbonite, Inc. has been giving out customers' personal information. The company has admitted to giving customer email addresses to a third party, in direct contravention of its privacy policy. A company statement reads: 'Carbonite has discovered an advertiser misappropriated our e-mail list during the process of one of our e-mail marketing campaigns. When Carbonite launches an e-mail marketing campaign, it provides a suppression list to e-mail advertisers so that Carbonite customers do not receive promotion emails from Carbonite (since they’re already customers) and importantly, so that people who have opted out of receiving emails from Carbonite do not receive future email from us. This list was mishandled by an advertiser and we have taken immediate remedial efforts. As an online backup company, the security and privacy of our customer data is our top priority. We take all matters related to privacy very seriously. The matter will be addressed privately with the involved third parties and we will ensure that all customer e-mail addresses are permanently removed from their database.'"

Read more of this story at Slashdot.

Ask Slashdot: How To Securely Share Passwords?

Posted: November 1st, 2011, 6:00pm CET by timothy

Tags: privacy

THE_WELL_HUNG_OYSTER writes "My tech-savvy father died suddenly and unexpectedly. He did everything online: bill-pay, banking, eBay sales (and other auction sites), PayPal, investing, etc. When he died, he still had online auctions up for sale, items I had no idea how to fulfill when sold. He still had unprocessed auction refunds, people claiming they returned items and are waiting for a refund. Fortunately, he left Gmail open and logged in when he died, so I was able to configure his account to forward to mine for any future emails he received. He even had his health insurance automatically debited from his checking account (who needs health insurance when they're dead?) I had no way to log into these systems to cancel pending transactions. I called every institution; some were willing to help while others required me to fax/mail death certificates and proof of executorship (which I didn't have yet). Meanwhile, auctions were selling for items I had no idea how to fulfill; debits from his checking account were occurring even though they were irrelevant; etc. You get the idea. How can I share my login credentials with my siblings so they don't have to go through this when I'm gone? I change my passwords every month and never use the same password on more than one site. I don't want my siblings to be able to impersonate me unless I'm dead, so publishing a monthly list to them won't help and would be insecure."

Read more of this story at Slashdot.

UK Government Pushing For 'Trusted Computing'

Posted: October 23rd, 2011, 6:33pm CEST by timothy

Tags: privacy

Motor writes "As has long been expected — we are now beginning to see governments pushing for the use of so-called 'trusted computing' — chips installed in all computers that effectively remove control of the PC from its owner. While there may be security advantages to some of the ideas, few can doubt that it represents a fundamental shift in the IT world. A radical move away from an open technology landscape and towards a system that denies all access unless you have the right credentials. Governments will demand the right credentials to access their services — meaning approved software stacks (i.e Windows) with the right digital signatures. Vernor Vinge had it right ."

Read more of this story at Slashdot.

Researchers ID Skype, BitTorrent Users

Posted: October 21st, 2011, 7:45pm CEST by Soulskill

Tags: privacy

itwbennett writes "Researchers have figured out a way to link online Skype users to their activity on peer-to-peer networks like BitTorrent. The team was able to sift out the nodes through which Skype calls are routed and determine the user's real IP address by sniffing the packets. To correlate the identified Skype users with files shared on BitTorrent, the researchers built tools to collect BitTorrent file identifiers, a BitTorrent crawler to collect IP addresses on the network and a verifier to match an online Skype user with an online BitTorrent user (PDF). 'As soon as the BitTorrent crawler detects a matching IP address, it signals the verifier, which immediately calls the corresponding Skype user and, at the same time, initiates a handshake with the BitTorrent client,' they wrote."

Read more of this story at Slashdot.

German State Confesses To, Downplays Government Spyware

Posted: October 11th, 2011, 4:19pm CEST by timothy

Tags: privacy

First time accepted submitter clickforfreepizza writes with this news on the German 'state trojan' analyzed by the CCC: '[The] Bavarian Interior Minister [confirmed] that state officials had indeed used the software, but argued that the use had been conducted legally. [...] [A] lawyer said his client had had the software in question installed on his computer during a customs check. That software, which could be legally used for monitoring telecommunications, had been altered to allow it to grab screen shots.' The H's sister site heise.de reports this case involves nothing like terrorism, but legal substances which 'may become' illegal when exported. (German original) The Bavarian press release (German original) also says the code analyzed by the CCC might be an earlier test version."

Read more of this story at Slashdot.

FBI Plans Nationwide Face-Recognition Trials In 2012

Posted: October 8th, 2011, 2:25pm CEST by timothy

Tags: privacy

hessian writes with this excerpt: "The FBI by mid-January will activate a nationwide facial recognition service in select states that will allow local police to identify unknown subjects in photos, bureau officials told Nextgov. The federal government is embarking on a multiyear, $1 billion overhaul of the FBI's existing fingerprint database to more quickly and accurately identify suspects, partly through applying other biometric markers, such as iris scans and voice recordings."

Read more of this story at Slashdot.

SAIC Loses Data of 4.9 Million Patients

Posted: October 4th, 2011, 8:37pm CEST by Unknown Lamer

Tags: privacy

An anonymous reader writes "Government contractor SAIC just can't seem to get a break. Still fresh off of the Citytime scandal, they've now had a data breach in which backup tapes holding 4.9 million personal health records were stolen from an employee's car. To add insult to injury, evidently the tapes were not encrypted either: 'Tricare did not indicate whether SAIC encrypted the information on the stolen tapes, but Raley said, "It's very hard to encrypt a backup tape."'"

Read more of this story at Slashdot.

Wikimedia Foundation Enables HTTPS For All Projects

Posted: October 4th, 2011, 6:01am CEST by Soulskill

Tags: privacy

An anonymous reader writes "The Wikimedia Foundation has enabled HTTPS for all of its projects (Wikipedia, Wikimedia Commons, etc.), to enable secure log-in and browsing privacy. Their blog post goes into detail about how the service is configured, linking to configuration files and implementation documentation. It also mentions that HTTPS Everywhere will have updated rules for this change soon."

Read more of this story at Slashdot.

Permalink for 'Slashdot__IT/2011/09/22/Borders_Bust_Means_B_amp_N_May_Get_Your_Shopping_History'

Borders Bust Means B&N May Get Your Shopping History

Posted: September 22nd, 2011, 7:14pm CEST by timothy

Tags: privacy

coondoggie writes "To perhaps no one's surprise, Borders bookstore collected a ton of consumer information — such as personal data, including records of particular book and video sales — during its normal course of business. Such personal information Borders promised never to share without consumer consent. But now that the company is being sold off as part of its bankruptcy filing, all privacy promises are off. Reuters wrote this week that Barnes & Noble, which paid almost $14 million for Borders' intellectual assets (including customer information) at auction last week, said it should not have to comply with certain customer-privacy standards recommended by a third-party ombudsman."

Read more of this story at Slashdot.

Ask Slashdot: P2P Liability On a Shared Connection?

Posted: September 10th, 2011, 8:42pm CEST by timothy

Tags: privacy

An anonymous reader writes "I have a roommate that insists on using BitTorrent without taking any kind of precautions. He has an affinity for downloading material that is extremely popular and high-risk. He's received a warning from a well-known media giant in the past about his file sharing, but hasn't been sued. We've recently begun living in an apartment together (with one other person) and share our Internet connection and IP address. If his p2p activity leads to someone attempting to take legal action, could I be held liable? How would our accusers differentiate between our computers if we all share the same IP address? Would they just sue the lot of us?" Some lawyers would certainly like to get a look at everything on the other side of the connection. Has anyone out there faced legal problems as a result of someone else's use of your connection?

Read more of this story at Slashdot.

Are Some CAs Too Big To Fail?

Posted: September 7th, 2011, 10:10pm CEST by samzenpus

Tags: privacy

Trailrunner7 writes "In the wake of this weekend's revelations of the seriousness of the attack on certificate authority DigiNotar, security experts have renewed criticism of the Internet's digital certificate infrastructure, with some wondering if larger certificate authorities (CAs) might be too big to fail. Would Mozilla and Microsoft and Google have revoked trust in root certificates from VeriSign or Thawte had they been compromised? Unlikely. 'It's not a simple matter of removing certificates from a database, because they're not in any databases,' says researcher Moxie Marlinspike, who presented an alternative approach to the current SSL infrastructure last month at DEFCON. 'We may never track them all down.'"

Read more of this story at Slashdot.

The Crypto Project Revives Cypherpunk Ethic

Posted: August 31st, 2011, 8:23am CEST by Soulskill

Tags: privacy

Trailrunner7 writes "When a small group of activists announced the debut of The Crypto Project earlier this year, for many, ahem, mature, security and privacy advocates it brought to mind memories of the original cypherpunk movement that began in the 1990s and that group's seminal efforts to encourage the use of strong cryptography and anonymity online, as well as its successes and failures. The two groups are not allied by anything other than ideology, but The Crypto Project's leaders are aiming to follow in the footsteps of the cypherpunks, build on their accomplishments and make security and privacy tools freely available to the masses. The group is working on a number of projects right now, including setting up an anonymous remailer, putting up a Convergence notary and setting up a Tahoe-LAFS grid. Threatpost has an interview with Sir Valiance, one of the leaders of the project, who talks about the need for better privacy and anonymity online and why the cypherpunks are still important today."

Read more of this story at Slashdot.

Scotland Yard Confirms It's Using Facial Recognition Tech

Posted: August 12th, 2011, 4:13pm CEST by Soulskill

Tags: privacy

nonprofiteer writes "Scotland Yard confirms that it's using facial recognition technology to identify rioters in London. 'A law enforcement official, who spoke to the Associated Press on condition of anonymity, said that facial recognition is one of many tools police are using to hunt suspects still at large.' Meanwhile, the vigilante group trying an amateur stab applying facial recognition to the riot photos abandoned the project because the results sucked. This is the big test of the surveillance state that London has become. Are all those cameras effective, or just taking a toll on privacy without bringing added security?"

Read more of this story at Slashdot.

Widespread Hijacking of Search Traffic In the US

Posted: August 5th, 2011, 2:50pm CEST by Soulskill

Tags: privacy

Peter Eckersley writes "The Netalyzr research project from the ICSI networking group has discovered that on a number of U.S. ISPs' networks, search traffic for Bing, Yahoo! and sometimes Google is being redirected to proxy servers operated by a company called Paxfire. In addition to posing a grave privacy problem, this server impersonation is being used to redirect certain searches away from the user's chosen search engine and to affiliate marketing programs instead. Further analysis is available in a post at the EFF."

Read more of this story at Slashdot.

Hundreds of Bank Account Details Left In London Pub

Posted: August 5th, 2011, 11:18am CEST by timothy

Tags: privacy

twoheadedboy writes "Another day, yet another data security failure. Two companies have been found in breach of the Data Protection Act after tens of thousands of tenants' details were left at a London pub, alongside 800 records with bank account details. A contractor who had stored data from two different companies on an unencrypted USB drive was responsible. We've all lost things on a night out, but rarely is it other people's banking information. The two firms involved have been told to get a grip on their security procedures, but they escaped a fine from the ICO."

Read more of this story at Slashdot.

How Face Recognition Can Uncover SSNs

Posted: August 1st, 2011, 5:42pm CEST by CmdrTaco

Tags: privacy

nonprofiteer writes "Building on previous work showing that social security numbers are not random, CMU researchers ran experiments in which they predicted students' social security numbers after taking a photo of them with a cheap webcam. Using off-the-shelf facial recognition technology and data-mining publicly available Facebook photos and profile information, they were able to come up with the social security numbers of several of the students. (More impressive, as they note that 60% of the students were foreign, and had no SSNs, leaving them a pool of less than 50)."

Read more of this story at Slashdot.

Court Allows Webcam Spying On Rental Laptops

Posted: July 20th, 2011, 11:13am CEST by Soulskill

Tags: privacy

tekgoblin writes "Back in May there was a class action lawsuit filed against the rental company Aaron's, which had secretly installed spying software that would turn on a laptop's webcam, take pictures and then send them back to the company. Overall it seemed like a large invasion of privacy, which should at least warrant an injunction to stop use of the software until the case is settled, right? Not to the judge, who refused to order an injunction on the grounds that the family was no longer in possession of the laptop. As for everyone else still using their Aaron's laptops, the judge had this to say to them (PDF): 'Moreover, it is purely conjecture that the other members of the putative class will be subjected to remote access of personal information.'"

Read more of this story at Slashdot.

TSA Announces Pilot of Trusted Traveler Program

Posted: July 15th, 2011, 6:50pm CEST by Soulskill

Tags: privacy

Bob the Super Hamste writes "CNN reports that the TSA has announced the pilot of their trusted traveler program. This is the program where an individual gives up additional information to the government and then gets expedited security. The pilot program will only be available to certain frequent fliers on Delta passengers flying out of Atlanta and Detroit, and to American Airlines passengers flying out of Miami and Dallas. Plans are in the work to expand this to other airports and other airlines as well."

Read more of this story at Slashdot.

Apple Store Artist Raided By Secret Service

Posted: July 9th, 2011, 1:51pm CEST by timothy

Tags: privacy

An anonymous reader writes "Artist Kyle McDonald wanted to create something that captured people's expressions as they stared at computers. So the 25-year-old artist installed a program on computers in two New York Apple Store locations that would automatically take a photo every minute of whoever was standing in front of the computer. McDonald then uploaded the photos to his Tumblr blog, 'People Staring at Computers,' made a video with the photographs, and set up 'an exhibition' at the Apple stores to show what he had found. Within days, the Secret Service, which investigates computer crimes, had raided McDonald's house, seizing his two laptops, two flash drives and iPod."

Read more of this story at Slashdot.

Despite Controversy, Federal Wiretaps On the Rise

Posted: July 1st, 2011, 4:22am CEST by timothy

Tags: privacy

coondoggie writes with a report that "Federal and state requests for court permission to intercept or wiretap electronic communications increased 34% in 2010 over 2009 with California, New York, and New Jersey accounting for 68% of all wire taps approved by state judges. According to the 2010 Wiretap Report, released today by the Administrative Office of the United States Courts (AOUSC) the most frequently noted location in wiretap requests was 'portable device,' a category that includes cellular telephones and digital pagers."

Read more of this story at Slashdot.

Anonymous Leaks New Batch of Data

Posted: June 30th, 2011, 11:54pm CEST by timothy

Tags: privacy

Orome1 writes "Anonymous has made available for download another batch of data, including those belonging to the Zimbabwean government, Mosman Municipal Council, Universal Music Group Partners (umusic.com's usernames/passwords and other data), Viacom (internal mapping of Viacom and its servers) and Brazilian Government (dumps and passwords)."

Read more of this story at Slashdot.

LulzSec Document Dump Shows Cops' Fear of iPhones

Posted: June 24th, 2011, 11:04pm CEST by Soulskill

Tags: privacy

jfruhlinger writes "People are starting to comb through the details of the law enforcement documents made public by LulzSec. Blogger Kevin Fogarty noticed one interesting trend: The cops seem very anxious about iPhones, particularly apps that would allow encounters with police officers to be recorded. Ironically, the cops seem extremely concerned with protecting their own privacy, but the documents encourage police to examine iPhones during the course of interacting with the public to see what apps they have."

Read more of this story at Slashdot.

"Expert Body" To Decide Which Sites To Block For Copyright Infringement

Posted: June 23rd, 2011, 4:15am CEST by samzenpus

Tags: privacy

Barence writes "Rights holders in the UK are proposing to appoint a 'council' and an 'expert body' to decide which websites should be blocked by ISPs for infringing copyright. The controversial Digital Economy Act made provisions for sites accused of hosting copyrighted material to be blocked by British ISPs. 'The cost of the proposed scheme is not indicated, but is likely to be substantial, including the running cost of two non-judicial independent bodies and the cost to ISPs of permanently blocking websites,' Consumer Focus said."

Read more of this story at Slashdot.

Permalink for 'Slashdot__IT/2011/06/13/Nissan_LEAF_Leaks_Speed__amp__Location_To_RSS_Feed'

Nissan LEAF Leaks Speed & Location To RSS Feed

Posted: June 13th, 2011, 11:54pm CEST by Soulskill

Tags: privacy

thecarchik writes "An intrepid tinkerer has discovered yet another security issue with the Nissan Leaf: it could be revealing your location and speed to websites around the globe. The issue stems from CARWINGS, the telematics system that Nissan devised for the Leaf. '... when Leaf owners use Nissan's RSS reader to access sites like CNN, the New York Times, or this one, CARWINGS supplies ... the exact location of the vehicle — latitude and longitude — and even the speed at which the vehicle is traveling at the time of the request.'"

Read more of this story at Slashdot.

EFF Publishes Study On Browser Fingerprinting

Posted: June 3rd, 2011, 2:51pm CEST by Soulskill

Tags: privacy

Rubinstien writes "The Electronic Frontier Foundation investigated the degree to which modern web browsers are susceptible to 'device fingerprinting' via version and configuration information transmitted to websites. They implemented one possible algorithm, and collected data from a large sample of browsers visiting their Panopticlick test site, which we've discussed in the past. According to the PDF describing the study, browsers that supported Flash or Java on average supplied at least 18.8 bits of identifying information, and 94.2% of those browsers were uniquely identifiable in their sample. My own browser was uniquely identifiable from both the list of plugins and available fonts, among 1,557,962 browsers tested so far."

Read more of this story at Slashdot.

Sony Compromised, Again

Posted: June 3rd, 2011, 1:49am CEST by timothy

Tags: privacy

Konsalik writes "The hacker group LulzSec on Thursday posted information it took from Sony Entertainment and Sony BMG on its site, called the LulzBoat. Lulz Security said it broke into servers that run SonyPictures.com. The information includes about a million usernames and passwords of customers in the US, the Netherlands and Belgium and is available for download and posted on the group's site."

Read more of this story at Slashdot.

Call Interception Demonstrated On New Cisco Phones

Posted: May 13th, 2011, 4:00pm CEST by Soulskill

Tags: privacy

mask.of.sanity writes "Researchers have demonstrated a series of exploits that turn Cisco IP phones into listening bugs, and could allow a denial of service attack capable of silencing a call center. It allows internal staff and competitors with a little publicly-available information to hijack the phones, wiretap calls and eavesdrop on confidential meetings. The attacks work through a sequence of exploits against the latest Cisco phones enabled to run off the shelf. Most people are vulnerable, the researchers say, because they do not harden their systems in line with recommended security requirements."

Read more of this story at Slashdot.

Confusion Surrounds UK Cookie Guidelines

Posted: May 10th, 2011, 8:23am CEST by Soulskill

Tags: privacy

pbahra writes "The Information Commissioner's Office has, with just over two weeks to go, given its interpretation on what websites must do to comply with new EU regulations concerning the use of cookies. The law, which will come into force on 26 May 2011, comes from an amendment to the EU's Privacy and Electronic Communications Directive. It requires UK businesses and organizations running websites in the UK to get informed consent from visitors to their websites in order to store and retrieve information on users' computers. The most controversial area, third-party cookies, remains problematic. If a website owner allows another party to set cookies via their site (and it is a very common practice for internet advertisers) then the waters are still muddy. And embarrassingly for the Commission — it's current site would not be compliant with its new guidelines as it simply states what they do and does not seek users' consent."

Read more of this story at Slashdot.

Ask Slashdot: Alternatives To Tor Browser Bundle For Windows?

Posted: May 8th, 2011, 7:50pm CEST by timothy

Tags: privacy

SonnyJim writes "I frequently use Tor for my anonymous browsing needs, via the Tor Firefox bundle for Windows. I noticed that there are many other applications out there that use Tor as a proxy as well (Janus VM, ChrisPC, etc.) Are any of them more secure than the original Tor bundles, or am I just wasting my time trying these other applications? Is there anything more secure than Tor, as far as anonymous browsing goes?"

Read more of this story at Slashdot.

Vendors Say Data Protection Software Too Complicated To Use

Posted: May 5th, 2011, 1:14am CEST by samzenpus

Tags: privacy

jfruhlinger writes "With a series of major data breaches over the past few months, you'd think more and more companies would be investing in data protection software, which can help keep data secure even on systems that have been compromised. Unfortunately, even organizations that have paid good money for this software often don't use it, because, as one of the vendors admits, it's often too complicated to use."

Read more of this story at Slashdot.

Chrome, IE To Allow Users To Delete Flash Cookies

Posted: May 4th, 2011, 6:48pm CEST by CmdrTaco

Tags: privacy

Trailrunner7 writes "The upcoming release of Adobe Flash Player 10.3 will give users of most of the major browsers the ability to delete Flash cookies in much the same way that they're able to erase normal Web cookies, thanks to a better integration with privacy settings in Internet Explorer and Google Chrome. The addition of the ability for users to delete the cookies set by plug-ins and browser add-ons gives them better control of the security and privacy of the content on their machines and is designed to address a serious issue that's been plaguing Flash for some time. Security and privacy experts have warned about the implications of so-called Flash cookies, which are set by Flash and difficult for users to find and delete."

Read more of this story at Slashdot.

Mediacom Using DPI To Hijack Searches, 404 Errors

Posted: April 27th, 2011, 3:36pm CEST by CmdrTaco

Tags: privacy

Verteiron writes "Cable company Mediacom recently began using deep packet inspection to redirect 404 errors, Google and Bing searches to their own, ad-laden 'search engine.' Despite repeated complaints from customers, Mediacom continues this connection hijacking even after the user has opted out of the process. Months after the problem was first reported, the company seems unwilling or unable to fix it and has even experimented with injecting their own advertising into sites like Google. How does one get a company infamous for its shoddy customer service and comfortable, state-wide cable monopolies to act on an issue like this?"

Read more of this story at Slashdot.

Apple: "We must Have Comprehensive Location Data"

Posted: April 24th, 2011, 5:44pm CEST by samzenpus

Tags: privacy

An anonymous reader writes "Apple's iPhone 3G, iPhone 3GS, the iPhone 4, and iPad models are keeping track of consumers whereabouts. Mac computers running Snow Leopard and even Windows computers running Safari 5 are being watched. But the question is why? 'To provide the high quality products and services that its customers demand, Apple must have access to the comprehensive location-based information,' Apple says."

Read more of this story at Slashdot.

Turning GPS Tracking Devices Against Their Owners

Posted: April 23rd, 2011, 12:59am CEST by timothy

Tags: privacy

ancientribe writes "Those low-cost embedded tracking devices in your smartphone or those personal GPS devices that track the whereabouts of your children, your car, your pet, or a shipment can easily be intercepted by hackers, who can then pinpoint their whereabouts, impersonate them, and spoof their physical location. A researcher demonstrated at SOURCE Boston how he was able to hack Zoombak's popular personal tracking devices."

Read more of this story at Slashdot.

Michigan Police Could Search Cell Phones During Traffic Stops

Posted: April 20th, 2011, 12:50am CEST by timothy

Tags: privacy

SonicSpike writes "The Michigan State Police have a high-tech mobile forensics device that can be used to extract information from cell phones belonging to motorists stopped for minor traffic violations. The American Civil Liberties Union (ACLU) of Michigan last Wednesday demanded that state officials stop stonewalling freedom of information requests for information on the program. A US Department of Justice test of the CelleBrite UFED used by Michigan police found the device could grab all of the photos and videos off of an iPhone within one-and-a-half minutes. The device works with 3000 different phone models and can even defeat password protections. 'Complete extraction of existing, hidden, and deleted phone data, including call history, text messages, contacts, images, and geotags,' a CelleBrite brochure explains regarding the device's capabilities." Popular Mechanics has a short conversation with a 4th Amendment lawyer about the practice of slurping cellphone data, too, though it's unclear if the Michigan police are actually using these devices to their full potential.

Read more of this story at Slashdot.

White House Releases Trusted Internet ID Plan

Posted: April 17th, 2011, 8:05pm CEST by samzenpus

Tags: privacy

angry tapir writes "From the Computerworld article: 'the U.S. government will coordinate private-sector efforts to create trusted identification systems for the Internet, with the goal of giving consumers and businesses multiple options for authenticating identity online, according to a plan released by President Barack Obama's administration.'"

Read more of this story at Slashdot.

White House To Drop Details of Cyber ID On Tax Day

Posted: April 14th, 2011, 9:49pm CEST by timothy

Tags: privacy

BeatTheChip writes "Dept. of Commerce Scry. Gary Locke plans to release solidified details of the National Strategy for Trusted Identities in Cyberspace [NSTIC] program starting 11 AM on Tax Day. Technologies and new policies will be demonstrated and discussed to attending press. NSTIC, a federal cyber identity program, drew criticisms earlier this year on initial announcement for similarities to a national identity program. It was deemed 'Real ID for the Internet' by some privacy and civil liberty organizations. NSTIC is a national online authentication program for public use under the oversight of the Dept. of Homeland Security."

Read more of this story at Slashdot.

Personal Info of 3.5 Million Texans Was Publicly Accessible

Posted: April 11th, 2011, 11:25pm CEST by Soulskill

Tags: privacy

SpaceGhost writes "The Houston Chronicle reports, 'Personal information of about 3.5 million Texans — including names, mailing addresses and Social Security numbers — was posted on a publicly accessible server at the state comptroller's office, much of it for more than a year.' Many of the records were for retired teachers and the unemployed, and they sometimes included DOB and drivers license numbers."

Read more of this story at Slashdot.

Involuntary Geolocation To Within One Kilometer

Posted: April 8th, 2011, 3:26pm CEST by Soulskill

Tags: privacy

Schneier's blog tips an article about research into geolocation that can track down a computer's location from its IP address to within 690 meters on average without voluntary disclosure from the target. Quoting: "The first stage measures the time it takes to send a data packet to the target and converts it into a distance – a common geolocation technique that narrows the target's possible location to a radius of around 200 kilometers. Wang and colleagues then send data packets to the known Google Maps landmark servers in this large area to find which routers they pass through. When a landmark machine and the target computer have shared a router, the researchers can compare how long a packet takes to reach each machine from the router; converted into an estimate of distance, this time difference narrows the search down further. 'We shrink the size of the area where the target potentially is,' explains Wang. Finally, they repeat the landmark search at this more fine-grained level: comparing delay times once more, they establish which landmark server is closest to the target."

Read more of this story at Slashdot.

Epsilon Data Breach Bigger Than Just Kroger Customers' Data

Posted: April 3rd, 2011, 5:04am CEST by timothy

Tags: privacy

wiredmikey writes with an update to the previously reported Epsilon breach: "It turns out that Kroger is only one of many customers affected by the breach at Epsilon, which sends over 40 billion emails annually and counts over 2,500 clients, including 7 of the Fortune 10, to build and host their customer databases. It has been confirmed that the customer names and email addresses, and in a few cases other pieces of information, were compromised at several major brands, a list which continues to grow ..." An anonymous reader points out that U.S. Bank is on the list of affected companies; I wonder how many more phishing attempts this will mean.

Read more of this story at Slashdot.

Epsilon Data Breach Bigger Than Just Kroger Customers' Data

Posted: April 3rd, 2011, 5:04am CEST by timothy

Tags: privacy

Read more of this story at Slashdot.

Hackers Steal Kroger's Customer List

Posted: April 2nd, 2011, 4:30pm CEST by timothy

Tags: privacy

wiredmikey writes "Kroger, the nation's largest traditional grocery retailer with more than 338,000 associates, notified customers today of a breach of the database that stores its customers' names and email addresses. The company said the incident occurred at Epsilon, the third-party vendor Kroger uses to manage its customer email database." Reader SatanClauz SatanClauz quotes the email that went out to Kroger customers ("We were notified and became aware of unauthorized access to our email list by someone outside our company. We want to assure you that the only information that was obtained were names and email addresses."), writing "At least they were smart enough to separate the email db from the rest of customer information! — or so they say..."

Read more of this story at Slashdot.

Hackers Steal Kroger's Customer List

Posted: April 2nd, 2011, 4:30pm CEST by timothy

Tags: privacy

Read more of this story at Slashdot.

Samsung Plants Keyloggers On Laptops

Posted: March 31st, 2011, 12:16am CEST by samzenpus

Tags: privacy

Saint Aardvark writes "Mohammed Hassan writes in Network World that he found a keylogger program installed on his brand-new laptop — not once, but twice. After initial denials, Samsung has admitted they did this, saying it was to 'monitor the performance of the machine and to find out how it is being used.' As Hassan says, 'In other words, Samsung wanted to gather usage data without obtaining consent from laptop owners.' Three PR officers from Samsung have so far refused comment."

Read more of this story at Slashdot.

Samsung Plants Keyloggers On Laptops

Posted: March 31st, 2011, 12:16am CEST by samzenpus

Tags: privacy

Read more of this story at Slashdot.

$110,000 Fine Is First Under MA Data Privacy Law

Posted: March 30th, 2011, 1:14am CEST by timothy

Tags: privacy

chicksdaddy writes "A Massachusetts restaurant chain was the first company fined under the state's toughest-in-the-nation data breach law, according to a statement by the Massachusetts Attorney General. The Briar Group, which owns a number of bars and restaurants in Boston, is charged with failing to protect patrons' personal information following an April, 2009 malware infestation. It was ordered to pay $110,000 in penalties and, essentially, get its *&@! together. Among the revelations from the settlement: Briar took six months to detect and remove the data stealing malware, continuing to take credit and debit cards from patrons even after learning of the data breach, said Massachusetts Attorney General Martha Coakley."

Read more of this story at Slashdot.

Attacking and Defending the Tor Network

Posted: March 29th, 2011, 9:31pm CEST by CmdrTaco

Tags: privacy

Trailrunner7 writes "In a talk at the USENIX LEET workshop Tuesday, Nick Mathewson of the Tor Project discussed the group's recent challenges in responding to suppression efforts by governments in Egypt, China and elsewhere. What the Tor members have learned in these recent incidents is that while governments are becoming more up front about their willingness to shut off Internet access altogether or censor content, users are also becoming more resourceful. Mathewson said that the group is working on methods for alleviating the problems that national-level restrictions cause for Tor users. One method involves moving to a modular transport method in order to get around some of the throttling that ISPs perform on encrypted traffic in order to make Tor usage more difficult. In a separate talk at LEET, Stevens LeBlond of INRIA in France presented research on methods for tracing Tor users back to their IP address. One of the attacks, which LeBlond and his co-authors titled 'Bad Apple,' used an exit node that the researchers controlled in order to trace the streams of data sent by users of BitTorrent over Tor back to their IP addresses."

Read more of this story at Slashdot.

Half of Used Phones Still Contain Personal Info

Posted: March 24th, 2011, 1:04pm CET by samzenpus

Tags: privacy

jhernik writes "More than half of second-hand mobile phones still contain personal information of the previous owner, posing a risk of identity fraud. A study found 247 pieces of personal data stored on handsets and SIM cards purchased from eBay and second-hand electronics shops. The information ranged from credit card numbers to bank account details, photographs, email address and login details to social networking sites like Facebook and Twitter. According to data security firm CPP, 81 percent of previous owners claim they have wiped personal data from their mobile phones and SIM cards before selling them. However, deleting the information manually is 'a process that security experts acknowledge leaves the data intact and retrievable.'"

Read more of this story at Slashdot.

Man Finds Divorce Papers, Tax Docs On "New" Laptop

Posted: March 23rd, 2011, 4:16pm CET by samzenpus

Tags: privacy

An anonymous reader writes "25-year-old Hidayat Sudirman found that his new laptop came loaded with more than just the usual software, it also contained 10GB of someone else's documents. From the article: "A buyer on the lookout for a new laptop got more than he bargained for at his local computer fair when the 'new' device came loaded with over 10GB of personal documents — including divorce papers and tax returns."

Read more of this story at Slashdot.

Twitter Joins the HTTPS By Default Party

Posted: March 16th, 2011, 2:37pm CET by CmdrTaco

Tags: privacy

wiredmikey writes "Following a trend in allowing users to automatically utilize the secure HTTPS protocol when accessing Web based services, Twitter announced this week that it has added the option for users to force HTTPS connections by default when accessing Twitter.com. The reasons to utilize HTTPS when accessing any personal accounts aren't new, but an easy to use extension for FireFox called 'FireSheep,' released in October 2010, spiked concern, as it enables HTTP session hijacking for the masses."

Read more of this story at Slashdot.

Iris-Scan ID Cards For Children In Mexico

Posted: March 16th, 2011, 12:22am CET by timothy

Tags: privacy

An anonymous reader writes "Today the first ID cards that include iris and fingerprint biometric information were registered and issued in the Mexican state of Guanajuato. (Original article in Spanish.) The juicier part of the story is that for now, only children will be enrolled in this national biometric database. It is intended that by December 2012 all children in the country will be registered. The alleged purpose of the new ID card is to hinder the abduction of children and prevent child exploitation. The first ID cards are being issued in the same city that last year started implementing a mandatory iris scan for convicted felons and voluntary members of the public in a Minority Reportesque plan to combat delinquency that features iris readers in public transport and ATMs. This comes from the country that last year attempted and failed to create a national database of mobile phone users, again with the purported intention to tackle extortion and kidnappings."

Read more of this story at Slashdot.

TSA To Retest Full Body Scanners For Radiation

Posted: March 12th, 2011, 9:46pm CET by Soulskill

Tags: privacy

cultiv8 writes with this excerpt from USA Today: "The Transportation Security Administration announced Friday that it would retest every full-body X-ray scanner that emits ionizing radiation — 247 machines at 38 airports — after maintenance records on some of the devices showed radiation levels 10 times higher than expected. The TSA says that the records reflect math mistakes and that all the machines are safe. Indeed, even the highest readings listed on some of the records — the numbers that the TSA says were mistakes — appear to be many times less than what the agency says a person absorbs through one day of natural background radiation. Even so, the TSA has ordered the new tests out of 'an abundance of caution to reassure the public,' spokesman Nicholas Kimball says. The tests will be finished by the end of the month, and the results will be released 'as they are completed,' the agency said on its website."

Read more of this story at Slashdot.

Unmasking Anonymous Email Senders

Posted: March 8th, 2011, 8:46pm CET by CmdrTaco

Tags: privacy

alphadogg writes "Just because you send an email anonymously doesn't mean people can't figure out who you are anymore. A new technique developed by researchers at Concordia University in Quebec could be used to unmask would-be anonymous emailers by sniffing out patterns in their writing style from use of all lowercase letters to common typos. Their research, published in the journal Digital Investigation, describes techniques that could be used to serve up evidence in court, giving law enforcement more detailed information than a simple IP address can produce."

Read more of this story at Slashdot.

Police Chief Teaches Parents To Keylog Kids

Posted: February 20th, 2011, 11:23am CET by Soulskill

Tags: privacy

Hugh Pickens writes writes "LiveScience reports that James Batelli, the police chief of Mahwah, NJ, and his detectives conduct seminars that teach parents how to outfit a computer with keystroke logging software, giving them access to the full spectrum of their kids' online activities. Batelli explains that kids put themselves in potentially dangerous situations online every day, especially on Facebook, where they run the risk of coming into contact with child predators who troll the social networking site. 'When it comes down to safety and welfare of your child, I don't think any parent would sacrifice anything to make sure nothing happens to their children,' he says."

Read more of this story at Slashdot.

Americans Trust Docs, But Not Computerized Records

Posted: February 17th, 2011, 11:30pm CET by timothy

Tags: privacy

Lucas123 writes "A soon-to-be-released survey from CDW shows that Americans trust their physicians to use their health information responsibly, but they're very concerned that once in electronic format, their personal health information may suddenly show up on the Internet. Their fears may not be unfounded. CDW said that survey data showed 30% and 34% of doctors lack basic anti-virus software and network firewalls, respectively. Most amusingly, however, nearly a quarter of the 1,000 patient respondents said they don't even trust themselves with access to their own electronic health records."

Read more of this story at Slashdot.

Cyber War Mass Hysteria Is Hindering Security

Posted: February 17th, 2011, 4:59pm CET by CmdrTaco

Tags: privacy

jhernik writes "International cyber threat initiatives are in danger of becoming overblown, the US government's security chief told the RSA Conference in San Francisco. 'Cyber war is a terrible metaphor,' said the US government's cybersecurity czar Howard Schmidt. 'Don't make it something it's not.' Internet attacks from hackers, spies and terrorist groups deserves serious attention, he said, but this should not be 'to the extent of mass hysteria.'"

Read more of this story at Slashdot.

Unsecured IP Cameras Accessible To Everyone

Posted: January 18th, 2011, 8:48pm CET by CmdrTaco

Tags: privacy

Orome1 writes "In the last couple of decades, we have become so accustomed to the idea that the public portion of our everyday life is watched and recorded — in stores, on the street, in institutions — that we often don't even notice the cameras anymore. Analog surveillance systems were difficult to hack into by people who lacked the adequate knowledge, but IP cameras — having their own IPs — can be quite easily physically located and their stream watched in real-time by anyone who has a modicum of computer knowledge and knows what to search for on Google."

Read more of this story at Slashdot.

Mozilla Posts File Containing Registered User Data

Posted: December 28th, 2010, 11:14am CET by Soulskill

Tags: privacy

wiredmikey writes "Mozilla yesterday sent an email to registered users of its addons.mozilla.org site, letting them know that it had mistakenly posted a file to a publicly available Web server which contained data from its user database including email addresses, first and last names, and an md5 hash representation of user passwords."

Read more of this story at Slashdot.

Memo Details Gawker Security Strategy

Posted: December 21st, 2010, 2:04am CET by Soulskill

Tags: privacy

Trailrunner7 writes "After a hack of systems belonging to online publishing giant Gawker Media that yielded more than one million passwords, the online media company's chief technology officer has announced new defense strategies aimed at placating their users and preventing further humiliating data breaches. Thomas Plunkett issued a company-wide memo on Friday that lays out the new security measures and suggests the company overlooked security concerns in the rush to develop new features."

Read more of this story at Slashdot.

Sheriff's Online Database Leaks Info On Informants

Posted: December 14th, 2010, 2:14pm CET by Soulskill

Tags: privacy

Tootech writes with this snippet from NPR: "A Colorado sheriff's online database mistakenly revealed the identities of confidential drug informants and listed phone numbers, addresses and Social Security numbers of suspects, victims and others interviewed during criminal investigations, authorities said. The breach potentially affects some 200,000 people, and Mesa County sheriff's deputies have been sifting through the database to determine who, if anyone, is in jeopardy. ... The FBI and Google Inc. are trying to determine who accessed the database, the sheriff said. Their concern: That someone may have copied it and could post it, WikiLeaks-style, on the Internet. 'The truth is, once it's been out there and on the Internet and copied, you're never going to regain total control,' Hilkey said. Thousands of pages of confidential information were vulnerable from April until Nov. 24, when someone notified authorities after finding their name on the Internet. Officials said the database was accessed from within the United States, as well as outside the country, before it was removed from the server."

Read more of this story at Slashdot.

Permalink for 'Slashdot__IT/2010/12/06/A_Nude_Awakening__mdash__the_TSA_and_Privacy'

A Nude Awakening — the TSA and Privacy

Posted: December 6th, 2010, 11:08pm CET by Soulskill

Tags: privacy

DIplomatic writes "The Oklahoma Daily has a well-written editorial about the current state of airport security. Though the subject has overly-commented on, this article is well worth the read. Quoting: 'The risk of a terrorist attack is so infinitesimal and its impact so relatively insignificant that it doesn't make rational sense to accept the suspension of liberty for the sake of avoiding a statistical anomaly. There's no purpose in security if it debases the very life it intends to protect, yet the forced choice one has to make between privacy and travel does just that. If you want to travel, you have a choice between low-tech fondling or high-tech pornography; the choice, therefore, to relegate your fundamental rights in exchange for a plane ticket. Not only does this paradigm presume that one's right to privacy is variable contingent on the government's discretion and only respected in places that the government doesn't care to look — but it also ignores that the fundamental right to travel has consistently been upheld by the Supreme Court. If we have both the right to privacy and the right to travel, then TSA's newest procedures cannot conceivably be considered legal. The TSA's regulations blatantly compromise the former at the expense of the latter, and as time goes on we will soon forget what it meant to have those rights.'"

Read more of this story at Slashdot.

Whitehat Hacker Moxie Marlinspike's Laptop, Cellphones Seized

Posted: November 20th, 2010, 6:06am CET by timothy

Tags: privacy

Orome1 writes "The well-known whitehat hacker and security researcher who goes by the handle Moxie Marlinspike has recently experienced firsthand the electronic device search that travelers are sometimes submitted to by border agents when entering the country. He was returning from the Dominican Republic by plane, and when he landed at JFK airport, he was greeted by two US Customs officials and taken to a detention room where they kept him for almost five hours, took his laptop and two cell phones and asked for the passwords needed to access the encrypted material on them."

Read more of this story at Slashdot.

Web-Users Fall For Fake Anti-Virus Scams

Posted: November 15th, 2010, 5:19pm CET by CmdrTaco

Tags: privacy

jhernik writes "Fearing their computers may be prone to viruses, many web-users download fake anti-virus software, only to find later that their bank details have been hacked. According to the latest research by GetSafeOnline.org, the UK's national internet security initiative, a rising nunber of organised criminal gangs are tricking security-conscious intenet-users into purchasing anti-virus software to access their bank details. Posing as legitimate IT helpdesks, these fraudsters target internet users concerned about protecting their computers. By offering free virus checks, they normally tell consumers that their machines are infected and offer fake security software protection – usually costing around £30 – which is actually malicious software in disguise." The fact that there is such a thriving market for fake AV scams really says something about the present state of the legitimate AV market.

Read more of this story at Slashdot.

Permalink for 'Slashdot__IT/2010/10/30/Herding_Firesheep_In_NYC__mdash__Do_Users_Care_'

Herding Firesheep In NYC — Do Users Care?

Posted: October 30th, 2010, 1:14am CEST by timothy

Tags: privacy

An anonymous reader writes "Following the Firesheep uproar, I spent some time telling people who don't read Slashdot about the vulnerability that open WiFi networks create in what seemed like the most effective way possible: by sidejacking their accounts and sending them messages about how it happened. The results were surprising — would users really rather leave their accounts open to intruders rather than stay off Facebook at Starbucks? The link recounts the experience, and also lists some rough numbers of how many accounts could be compromised at a popular NY Starbucks location."

Read more of this story at Slashdot.

Un-killable 'Evercookie' Killed ... Sometimes

Posted: October 20th, 2010, 12:22am CEST by CmdrTaco

Tags: privacy

Trailrunner7 writes "The persistent method that security researcher Samy Kamkar introduced last week for storing tracking data on a user's machine, known as the 'Evercookie,' is even more worrisome when used on mobile devices, according to another researcher's analysis. The Evercookie is a simple method for forcing a user's machine to retain browser cookies by storing the data in a number of different locations. The method also has the ability to recreate deleted cookies if it finds that the user has removed them. Created by Kamkar as a demonstration of a way that sites could use to persistently track users even after they clear their browser cookies, the Evercookie has drawn the attention of a number of other researchers who have spent some time looking for methods to defeat it. A researcher in South Africa took a look at the way the the Evercookie works on both Safari on the desktop and on mobile devices, and found that it can be undone in some circumstances. However, he also found that the mobile version of Safari fares far worse in its handling of the Evercookie than the standard version does."

Read more of this story at Slashdot.

New Class of Malware Will Steal Behavior Patterns

Posted: October 8th, 2010, 3:32pm CEST by Soulskill

Tags: privacy

KentuckyFC writes "The information within huge, supposedly anonymized data sets can be used to build a detailed picture of an individual's lifestyle and relationships. This data is hugely valuable, which is why many companies already mine the pattern of links in their data to help them build things like recommender systems. Now a group of computer scientists say it is inevitable that a new class of malware will emerge for stealing this behavioral pattern data from social networks. They've analyzed the types of strategies this malware will use to collect information from a real mobile phone database of 800,000 links between 200,000 phones. They point out that the theft of behavioral data can be much more serious than the theft of other personal information. If somebody steals your credit card or computer password, for example, you can just get another card or change your password, thereby limiting the damage. That can't be done with behavioral data, they say. Who would be willing or able to change their real world pattern of person-to-person relationships, friendships and family ties?"

Read more of this story at Slashdot.

GoogleSharing, Now With No Trust Required

Posted: October 5th, 2010, 1:58am CEST by Soulskill

Tags: privacy

An anonymous reader writes "GoogleSharing, the popular Google anonymizing service created by well known privacy advocate and security researcher Moxie Marlinspike, has released a major new version today. The biggest change is leveraging Google's SSL search option to provide an anonymizing service which doesn't require you to trust either Google or GoogleSharing. This means that anyone who wishes to opt out of Google's data collection practices can now do so without having to trust the operator of the anonymizing service."

Read more of this story at Slashdot.

Iris Scanning Set To Secure City In Mexico

Posted: September 27th, 2010, 2:17am CEST by timothy

Tags: privacy

kkleiner writes "The million-plus citizens of Leon, Mexico are set to become the first example of a city secured through the power of biometric identification. Iris and face scanning technologies from Global Rainmakers, Inc. will allow people to use their eyes to prove their identify, withdraw money from an ATM, get help at a hospital, and even ride the bus. Whether you're jealous or intimidated by Leon's adoption of widespread eye identification you should pay attention to the project – similar biometric checkpoints are coming to locations near you. Some are already in place."

Read more of this story at Slashdot.

DuckDuckGo Search Engine Erects Tor Hidden Service

Posted: September 25th, 2010, 8:00am CEST by timothy

Tags: privacy

An anonymous reader writes "Viewable with Tor installed, search engine DuckDuckGo has erected a hidden service for secure, encrypted searches through the Tor network. While past attempts at hidden service search engines failed due to uptime or quality issues, DuckDuckGo marks the first time a real company operating a public search engine has offered a solid search engine as a hidden service for Tor users."

Read more of this story at Slashdot.

Introducing the Invulnerable Evercookie

Posted: September 22nd, 2010, 2:54pm CEST by CmdrTaco

Tags: privacy

An anonymous reader writes "Using eight different techniques and locations, a 'security' guy has developed a cookie that is very, very hard to delete. If just one copy of the cookie remains, the other locations are rebuilt. My favorite storage location is in 'RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out' — awesome."

Read more of this story at Slashdot.

US Gov't Makes a Mess of Classifying Sensitive Data

Posted: September 14th, 2010, 2:01am CEST by Soulskill

Tags: privacy

coondoggie writes "Protecting and classifying sensitive information such as social security numbers shouldn't be that hard, but (perhaps not surprisingly) the US government has elevated complicating that task to an art form. It seems that designating, safeguarding, and disseminating such important information involves over 100 unique markings and at least 130 different labeling or handling routines, reflecting a disjointed, inconsistent, and unpredictable system for protecting, sharing, and disclosing sensitive information." This was the conclusion of a recent report (PDF) by the Government Accountability Office, which also "found areas where sensitive information is not fully safeguarded and thus may remain at risk of unauthorized disclosure or misuse."

Read more of this story at Slashdot.

NYT Password Security Discussion Overlooks Universal Logins

Posted: September 7th, 2010, 6:02pm CEST by timothy

Tags: privacy

A recent NYT piece explores the never-ending quest for password-based security, to which reader climenole responds with a snippet from ReadWriteWeb that argues it's time to think more seriously about life beyond passwords, at least beyond keeping a long list of individual login/password pairs: "These protective measures don't go very far, according to the New York Times, because hackers can get ahold of passwords with software that remotely tracks keystrokes, or by tricking users into typing them in. The story touches on a range of issues around the problem, but neglects to mention the obvious: the march toward a centralized login for multiple sites."

Read more of this story at Slashdot.

UN Telecom Chief Urges Blackberry Data Sharing

Posted: September 2nd, 2010, 9:26pm CEST by timothy

Tags: privacy

crimeandpunishment writes "The top man in telecommunications at the United Nations is weighing in on the Blackberry battle ... and he says share the data. The UN's telecom chief says governments have legitimate security concerns, and Research in Motion should give them access to its customer data. In an interview with the Associated Press, Hamadoun Toure said 'There is a need for cooperation between governments and the private sector on security issues.'"

Read more of this story at Slashdot.

Germany To Roll Out ID Cards With Embedded RFID

Posted: August 22nd, 2010, 11:17am CEST by Soulskill

Tags: privacy

An anonymous reader writes "The production of RFID chips, an integral element of the new generation of German identity cards, has started after the government gave a 10-year contract to the chipmaker NXP in the Netherlands. Citizens will receive the mandatory new ID cards starting from the first of November. The new card allows German authorities to identify people with speed and accuracy, the government said. These authorities include the police, customs and tax authorities and of course the local registration and passport granting authorities. There are some concerns that the use of RFID chips will pose a security or privacy risk, however. Early versions of the electronic passports, using RFID chips with a protocol called 'basic access control' (BAC), were successfully hacked by university researchers and security experts."

Read more of this story at Slashdot.

Is RFID Really That Scary?

Posted: August 19th, 2010, 8:54pm CEST by timothy

Tags: privacy

tcd004 writes "Defcon participant Chris Paget demonstrated his ability to capture RFID data from people hundreds of feet away for the PBS NewsHour. Paget went through the regular laundry list of security concerns over RFID: people can be tracked, their information accessed, their identities comprimised. Not so fast, says Mark Roberti of RFID Journal. Mark challenges Paget to point to a single instance where RFID was successfully used for nefarious purposes. The signals are too weak and the data is too obscure, according to Roberti. So who is right? Has RFID yet lead to a single instance of identity theft, illegal monitoring, or other security compromise?"

Read more of this story at Slashdot.

Permalink for 'Slashdot__IT/2010/08/16/75%_Use_Same_Password_For_Social_Media__amp__Email'

75% Use Same Password For Social Media & Email

Posted: August 16th, 2010, 7:19pm CEST by CmdrTaco

Tags: privacy

wiredmikey writes "Over 250,000 user names, email addresses, and passwords used for social networking sites can easily be found online. A study of the data collected showed that 75 percent of social networking username and password samples collected online were identical to those used for email accounts. The password data was gathered from blogs, torrents, online collaboration services and other sources. It was found that 43 percent of the data was leaked from online collaboration tools while 21 percent of data was leaked from blog postings. Meanwhile, torrents and users of other social hubs were responsible for leaking 10 percent and 18 percent of user data respectively...."

Read more of this story at Slashdot.

Blackberry Gives India Access To Servers

Posted: August 14th, 2010, 6:30am CEST by timothy

Tags: privacy

Meshach writes "As happened earlier in Saudi Arabia Blackberry has reached a deal that allows Indian authorities access to the transmissions of hand held devices. Much of the fear comes from worries about terrorists: Pakistani-based militants used mobile and satellite phones in the 2008 attacks that killed 166 people in Mumbai."

Read more of this story at Slashdot.

Loss of Personal Info As Stressful As Losing a Job

Posted: August 11th, 2010, 3:47pm CEST by CmdrTaco

Tags: privacy

An anonymous reader writes "Americans feel most vulnerable about the loss or theft of their personal or financial information, according to a national survey. 54% of Americans said the prospect of losing this data 'extremely concerned' them. Losing personal or financial information ranked similar to concern over job loss and not being able to provide healthcare for their family. In terms of specific risks within the online threat landscape, identity theft ranked as the chief fear. Nearly a third of Americans reported identity theft as their greatest concern to personal safety and security on the Internet. The fear of someone hacking into their financial information or accounts ranked a close second, with a quarter of Americans listing it as their greatest worry."

Read more of this story at Slashdot.

Denials Aside, Feds Storing Body Scan Images

Posted: August 4th, 2010, 6:36pm CEST by timothy

Tags: privacy

The new generation of body scanners employed at airports (and many other places) can record detailed, anatomically revealing pictures of each person scanned, which is one reason they've raised the hackles of privacy advocates as well as ordinary travelers. Now, AHuxley writes "The US Transportation Security Administration claimed last summer that 'scanned images cannot be stored or recorded.' It turns out that some police agencies are storing the controversial images. The US Marshals Service admitted that it had saved ~35,314 images recorded with a millimeter wave system at the security checkpoint of a single Florida courthouse. The images were stored on a Brijot Gen2 machine. The Electronic Privacy Information Center, an advocacy group, has filed a lawsuit asking a federal judge to grant an immediate injunction to stop the TSA's body scanning program."

Read more of this story at Slashdot.

RIM's Encryption 'Too Secure' For Indian Government's Taste

Posted: August 1st, 2010, 10:33pm CEST by timothy

Tags: privacy

climenole writes "Research in Motion, the creator of the widely used enterprise-cum-consumer BlackBerry device, has an uncertain position in India. The Indian government's internal security and intelligence services cannot break the encryption of the device, which makes countering terror threats and national security matters difficult — especially for a region which faces constant threats and attacks from domestic Maoist insurgents and extremist Islamic groups." Does it make you wonder how much safer everyone would be if parkas, mailing envelopes, cash, and superglue were all evaluated on the same basis?

Read more of this story at Slashdot.

China Pushes Real Name System For Online Games

Posted: August 1st, 2010, 1:50am CEST by timothy

Tags: privacy

oxide7 writes "Starting from August 1, Chinese Internet users will have to register using their real names for playing online games, China Daily reported on Saturday. The regulation, issued by the Ministry of Culture on June 22, is said to be part of a nationwide campaign to improve management of the virtual gaming industry and protect minors from unwholesome content. It applies to all multiplayer role-playing and social networking games."

Read more of this story at Slashdot.

Privacy Flaws In Chatroulette Expose Users

Posted: July 14th, 2010, 6:16pm CEST by CmdrTaco

Tags: privacy

itwbennett writes "In a paper posted online this week, researchers from the University of Colorado at Boulder and McGill University outline three different types of attacks that could be launched against Chatroulette users. While the new research doesn't expose any gaping privacy holes, it does show how the service could be misused by determined criminals. For example, the researchers were able to use IP-mapping services to get a general idea of users' location (a public Web site, called Chatroulettemap.com already does this). Then by searching Facebook using information obtained in chats and comparing pictures, researchers were able to identify chatters. 'Even in a city as big as Chicago, you can drill down and find the person you're actually talking to,' said Richard Han, an associate professor with the University of Colorado who co-authored the paper."

Read more of this story at Slashdot.

Long-Term Liability For One-Time Security Breaches?

Posted: July 12th, 2010, 7:46pm CEST by Soulskill

Tags: privacy

An anonymous reader writes "Not a month goes by where we don't hear about a theft of some organization's laptop containing sensitive personal information, not to mention the even more frequent — but often kept secret — breaches into company networks and databases. It is definitely true that you should be responsible for the security of your information when you handle it, but what happens when the theft of your information is not your fault? You have handed over this information to a company or organization and trusted them to keep is secure, but they failed. They might notify you of the breach or theft, and they might even set up a credit monitoring service for you for a year or two, but the problem is that this information may be used years from now. Is it fair that you have to worry for decades and pay for further credit monitoring when they are to blame for your information ending up in the wrong hands?"

Read more of this story at Slashdot.

Internet Censorship Arms Race Gets New Weapon From Georgia Tech

Posted: July 10th, 2010, 1:10am CEST by timothy

Tags: privacy

coondoggie writes "Trying to get out in front of what they call a censorship arms race, a team of researchers has come up with technology that lets users exchange messages through heavily censored networks in countries such as China and North Korea in hidden channels via user-generated content sites such as Twitter or Flickr. Researchers with the Georgia Tech School of Computer Science will demo the technology known as Collage for the first time at next month's Usenix security conference and ideally have a working package the public can download by the end of August."

Read more of this story at Slashdot.

US Shows Interest In Zombie Quarantine Code

Posted: June 26th, 2010, 8:00am CEST by timothy

Tags: privacy

bennyboy64 writes "Barack Obama's cyber-security coordinator has shown interest in an e-security code of practice developed in Australia that aims to quarantine Internet users infected by malware, also known as zombie computers. He reportedly said it would be a useful role model for the US to adopt. One suggestion within the code is to put infected users into a 'walled garden,' which limits Internet access to prevent further security problems until quarantined. Another is to throttle the speed of an infected users' Internet connection until their computer fixed. The code is also being considered by other Asia-Pacific countries, ZDNet reports."

Read more of this story at Slashdot.

Experts Say Wiretap Law Needs Digital Era Update

Posted: June 25th, 2010, 7:50pm CEST by Soulskill

Tags: privacy

GovTechGuy writes "Experts at a Congressional hearing Thursday said the government needs to update the Electronic Communications Privacy Act to reflect changes in technology, notably location-based services. On one hand, legal experts argue tracking a mobile user's location should require a higher burden of proof than simply intercepting their communications. On the other hand, first responders may need location data in order to save lives and respond to 911 calls. Either way, expect legislation from the committee later this year."

Read more of this story at Slashdot.

Twitter To Establish Information Security Program

Posted: June 25th, 2010, 1:58am CEST by timothy

Tags: privacy

An anonymous reader writes "Twitter has agreed to settle Federal Trade Commission charges that it deceived consumers and put their privacy at risk by failing to safeguard their personal information, marking the 30th case the FTC has brought targeting faulty data security, and the agency's first such case against a social networking service. Under the terms of the settlement, Twitter will be barred for 20 years from misleading consumers about the extent to which it maintains and protects the security, privacy, and confidentiality of nonpublic consumer information, including the measures it takes to prevent authorized access to information and honor the privacy choices made by consumers."

Read more of this story at Slashdot.

Employee Monitoring

Posted: June 17th, 2010, 1:57pm CEST by samzenpus

Tags: privacy

CWmike writes "Michael Workman, an associate professor at the Florida Institute of Technology's Nathan M. Bisk College of Business, estimates that monitoring responsibilities take up at least 20% of the average IT manager's time. Yet most IT professionals never expected they'd be asked to police their colleagues and co-workers in quite this way. How do they feel about this growing responsibility? Workman says he sees a split among tech workers. Those who specialize in security issues feel that it's a valid part of IT's job. But those who have more of a generalist's role, such as network administrators, often don't like it. Computerworld contributor Tam Harbert found a wide variety of viewpoints from IT managers, ranging from discomfort at having to 'babysit' employees to righteous beliefs about 'protecting the integrity of the system.'"

Read more of this story at Slashdot.

FBI Investigating iPad E-Mail Leaks

Posted: June 11th, 2010, 4:56am CEST by timothy

Tags: privacy

CWmike writes "The Federal Bureau of Investigation has opened an investigation into the leak of an estimated 114,000 Apple iPad user e-mail addresses. Hackers belonging to a group called Goatse obtained the e-mail addresses after uncovering a web application on AT&T's website that returned an iPad user's e-mail address when it was sent specially written queries. After writing an automated script to repeatedly query the site, they downloaded the addresses, and then handed them over to Gawker.com. Now the FBI is trying to figure out whether this was a crime. US law prohibits the unauthorized accessing of computers, but it is unclear whether the script that the Goatse group used violated the law, said Jennifer Granick, civil liberties director with the Electronic Frontier Foundation. 'The question is, when you do an automated test like this, [are you] getting any type of unauthorized access or not,' she said. If it turns out the data in question was not misused, it is unlikely that federal prosecutors will press charges, she added."

Read more of this story at Slashdot.

Permalink for 'Slashdot__IT/2010/06/10/AT_amp_T_Leaks_Emails_Addresses_of_114_000_iPad_Users'

AT&T Leaks Emails Addresses of 114,000 iPad Users

Posted: June 10th, 2010, 3:56am CEST by samzenpus

Tags: privacy

Hugh Pickens writes "Daily Tech reports that in what is one of the biggest leaks of email addresses in recent history, a group called Goatse Security has published the personal email addresses of 114,067 iPad 3G purchasers in what appears to be a legal fashion by querying a public interface that AT&T accidentally left exposed. Apparently AT&T left a script on its public website, which when handed an ICC-ID would respond back with the email address of the subscriber. This apparently was intended for an AJAX-style response inside AT&T's web apps. Gawker reports that it's possible that confidential information about every iPad 3G owner in the US has been exposed. 'This is going to hurt the telecommunications company's already poor image with iPhone and iPad customers, and complicate its very profitable relationship with Apple,' writes Ryan Tate, adding that the leak is likely to unnerve customers thinking of buying iPads that connect to AT&T's cellular network. 'Although the security vulnerability was confined to AT&T servers, Apple bears responsibility for ensuring the privacy of its users, who must provide the company with their email addresses to activate their iPads.' In a statement, AT&T says that the issue was escalated to the highest levels of the company and that it has essentially turned off the feature that provided the email addresses. 'We are continuing to investigate and will inform all customers whose email addresses and ICC IDS may have been obtained,' says AT&T. 'We take customer privacy very seriously and while we have fixed this problem, we apologize to our customers who were impacted.'"

Read more of this story at Slashdot.

Facebook Throws Privacy Advocates a Bone

Posted: May 15th, 2010, 6:31pm CEST by Soulskill

Tags: privacy

sarysa writes "In response to a week-long assault by privacy advocates, and following a well publicized all-hands meeting, Facebook has introduced two new security features in response to privacy concerns. One feature allows users to whitelist devices associated with a Facebook account, and the other allows users who verify their identity to view previous logins. While both are useful features, they do nothing to address the recent privacy complaints."

Read more of this story at Slashdot.

Taiwanese Researchers Plug RFIDs As Disaster Recovery Aids

Posted: May 15th, 2010, 5:03am CEST by timothy

Tags: privacy

Velcroman1 writes "Scientists tag animals to monitor their behavior and keep track of endangered species. Now some are asking whether all of mankind should be tagged too. Looking for a loved one? Just Google his microchip. Taiwanese researchers postulate that the tags could help save lives in the aftermath of a major earthquake. And IBM advocated chips for humans in a speech earlier this week. The ACLU disagrees. 'Many people find the idea creepy,' spokesman Jay Stanley told FoxNews.com."

Read more of this story at Slashdot.

Why Tor Users Should Be Cautious About P2P Privacy

Posted: May 1st, 2010, 2:30am CEST by timothy

Tags: privacy

An anonymous reader writes "I went across your post a few days ago saying that a machine connected to the Internet was all one needed to spy on most BitTorrent users of the Internet. I followed the link to find out that those researchers from INRIA claimed their attacks also worked for BitTorrent users on Tor. I didn't believe it at first, but then today I found this link on the Tor Project. It seems their attacks don't only link your real IP to your BitTorrent files on Tor but also to the web pages that you're browsing! Tell me it's a joke." No joke, but according to Jacob Appelbaum (a Tor developer), the security flaw is more nuanced — and the fault of software outside of Tor. Read on for his explanation of how the privacy benefits of Tor can be easily lost.

Read more of this story at Slashdot.

Mass. Data Security Law Says "Thou Shalt Encrypt"

Posted: April 25th, 2010, 8:28pm CEST by timothy

Tags: privacy

emeraldd writes with this snippet from SQL Magazine summarizing what he calls a "rather scary" new data protection law from Massachusetts: "Here are the basics of the new law. If you have personally identifiable information (PII) about a Massachusetts resident, such as a first and last name, then you have to encrypt that data on the wire and as it's persisted. Sending PII over HTTP instead of HTTPS? That's a big no-no. Storing the name of a customer in SQL Server without the data being encrypted? No way, Jose. You'll get a fine of $5,000 per breach or lost record. If you have a database that contains 1,000 names of Massachusetts residents and lose it without the data being encrypted, that's $5,000,000. Yikes.'"

Read more of this story at Slashdot.

Proposal To Limit ISP Contact Data Draws Fire

Posted: April 8th, 2010, 11:00pm CEST by timothy

Tags: privacy

An anonymous reader writes "A proposal to let Internet service providers conceal the contact information for their business customers is drawing fire from a number of experts in the security community, who say the change will make it harder to mitigate the threat from spam and malicious software, according to a story at Krebsonsecurity.com. From the piece: 'The American Registry for Internet Numbers (ARIN) — one of five regional registries worldwide that is responsible for allocating blocks of Internet addresses — later this month will consider a proposal to ease rules that require ISPs to publish address and phone number information for their business customers. Proponents of the plan couch it in terms of property rights and privacy, but critics say it will only lead to litigation and confusion, while aiding spammers and other shady actors who obtain blocks of addresses by posing as legitimate businesses.'"

Read more of this story at Slashdot.

Cold War Warrantless Wiretapping

Posted: April 4th, 2010, 2:18pm CEST by kdawson

Tags: privacy

somanyrobots writes "President Gerald Ford secretly authorized the use of warrantless domestic wiretaps for foreign intelligence and counterintelligence purposes soon after coming into office, according to a declassified document. The Dec. 19, 1974, White House memorandum, marked Top Secret / Exclusively Eyes Only and signed by Ford, gave then-Attorney General William B. Saxbe and his successors in office authorization 'to approve, without prior judicial warrants, specific electronic surveillance within the United States which may be requested by the Director of the Federal Bureau of Investigation.'" And reader jlaprise1 adds, "My research [from 2009] makes the news! President Ford authorized warrantless wiretaps in December 1976 and laid the foundation (PDF) for US telecommunications security policy."

Read more of this story at Slashdot.

Tor Users Urged To Update After Security Breach

Posted: January 22nd, 2010, 3:47am CET by timothy

Tags: privacy

An anonymous reader writes "If you use Tor, you're cautioned to update now due to a security breach. In a message on the Tor mailing list dated Jan 20, 2010, Tor developer Roger Dingledine outlines the issue and why you should upgrade to Tor 0.2.1.22 or 0.2.2.7-alpha now: 'In early January we discovered that two of the seven directory authorities were compromised (moria1 and gabelmoo), along with metrics.torproject.org, a new server we'd recently set up to serve metrics data and graphs. The three servers have since been reinstalled with service migrated to other servers.' Tor users should visit the download page and update ASAP."

Read more of this story at Slashdot.

Facebook Master Password Was "Chuck Norris"

Posted: January 21st, 2010, 8:56pm CET by samzenpus

Tags: privacy

I Don't Believe in Imaginary Property writes "A Facebook employee has given a tell-all interview with some very interesting things about Facebook's internals. Especially interesting are all the things relating to Facebook privacy. Basically, you don't have any. Nearly everything you've ever done on the site is recorded into a database. While they fire employees for snooping, more than a few have done it. There's an internal system to let them log into anyone's profile, though they have to be able to defend their reason for doing so. And they used to have a master password that could log into any Facebook profile: 'Chuck Norris.' Bruce Schneier might be jealous of that one."

Read more of this story at Slashdot.

MiFi Attack Exploits GPS To Reveal User's Location

Posted: January 16th, 2010, 9:20pm CET by timothy

Tags: privacy

An anonymous reader writes "Security researcher Adam Baldwin has identified that the Sprint and Verizon MiFi devices are vulnerable to a multitude of attacks. Combining these attacks together, an attacker can gain the GPS location of the MiFi device without the user becoming immediately aware. The attack can be successfully executed without authentication and even if the GPS has been disabled by the administrator." There's a video, but a handy text summary, too. Upshot: "Any MiFi user that visits a specially crafted page will give up their GPS location to the attacker."

Read more of this story at Slashdot.

Can Imaging Technologies Save Us From Terrorists?

Posted: January 5th, 2010, 5:08pm CET by timothy

Tags: privacy

itwbennett writes "In the aftermath of the failed Christmas Day terrorist attack, full body scanning technologies such as millimeter wave and backscatter are regaining popularity, writes blogger Steven J. Vaughan-Nichols in a recent post. But, he asks, do they really work? The TSA seems to think so. It has just issued a contract to purchase more millimeter wave scanners from L3 Communications. Michael Chertoff, the former homeland security secretary, told the New York Times that if these scanners had been in place, they would have caught the would-be bomber. Ben Wallace, the Conservative Member of Parliament in the United Kingdom, disagrees, saying that the technologies can't detect the kind of low-density explosive that the would-be terrorist tried to use on December 25th."

Read more of this story at Slashdot.

Kodak Wireless Picture Frames Open To Public

Posted: January 5th, 2010, 2:07pm CET by kdawson

Tags: privacy

Jaxoreth writes "The Kodak Easyshare Wireless Digital Picture Frame displays images via a per-frame RSS feed hosted by FrameChannel. Each frame's URL is identical except for a parameter matching its particular MAC address, enabling public browsing of users' feeds. And worse, if you reach the feed of a not-yet-activated frame, it gives you the code to activate it, allowing you to preload it with whatever content you choose."

Read more of this story at Slashdot.

Subverting Fingerprinting

Posted: December 8th, 2009, 2:15am CET by kdawson

Tags: privacy

squizzar writes in with news of a 27 year old Chinese woman who was discovered to have had her fingerprints surgically swapped between hands in order to fool Japanese immigration. "It is Japan's first case of alleged biometric fraud, but police believe the practice may be widespread. ... The apparent ability of illegal migration networks to break through hi-tech controls suggests that other countries who fingerprint visitors could be equally vulnerable — not least the United States, according to BBC Asia analyst Andre Vornic." Time for some biometric escalation. Could iris scans be subverted as easily?

Read more of this story at Slashdot.

RFID Fingerprints To Fight Tag Cloning

Posted: November 21st, 2009, 6:00am CET by Soulskill

Tags: privacy

Bourdain writes with news out of the University of Arkansas, where researchers are looking for ways to combat counterfeit RFID tags. Passive tags typically wait for a reader to transmit a signal of the appropriate strength and frequency before sending their own transmission. The scientists found that the amount of power required to trigger this varies quite a bit from one tag to the next, especially when many different frequencies are sampled. This and other physical characteristics give the tag its own "fingerprint" that is independent of the signal information stored in its memory, which the researchers say will facilitate the detection of cloned tags.

Read more of this story at Slashdot.

How To DDoS a Federal Wiretap

Posted: November 12th, 2009, 8:15pm CET by timothy

Tags: privacy

alphadogg writes "Researchers at the University of Pennsylvania say they've discovered a way to circumvent the networking technology used by law enforcement to tap phone lines in the US. The flaws they've found 'represent a serious threat to the accuracy and completeness of wiretap records used for both criminal investigation and as evidence in trial,' the researchers say in their paper, set to be presented Thursday at a computer security conference in Chicago. Following up on earlier work on evading analog wiretap devices called loop extenders, the Penn researchers took a deep look at the newer technical standards used to enable wiretapping on telecommunication switches. They found that while these newer devices probably don't suffer from many of the bugs they'd found in the loop extender world, they do introduce new flaws. In fact, wiretaps could probably be rendered useless if the connection between the switches and law enforcement are overwhelmed with useless data, something known as a denial of service (DOS) attack."

Read more of this story at Slashdot.

Canadian Copyright Lobby Fights Anti-Spyware Legislation

Posted: October 17th, 2009, 6:09am CEST by Soulskill

Tags: privacy

An anonymous reader writes "New Canadian anti-spam and anti-spyware legislation is scheduled for a key vote on Monday. Michael Geist reports that the copyright lobby has been pushing to remove parts of the bill that would take away exceptions which currently allow spyware to be installed without authorization. 'The copyright lobby is deeply concerned that this change will block attempts to track possible infringement through electronic means.' There have also been proposals to extend the exemptions granted to telecom providers to include the installation of programs without the user's express consent, which Geist says will 'leave the door open to private, surreptitious surveillance.'"

Read more of this story at Slashdot.

Permalink for 'Slashdot__IT/2009/10/14/3D_Fingerprinting__mdash__Touchless__More_Accurate__and_Faster'

3D Fingerprinting — Touchless, More Accurate, and Faster

Posted: October 14th, 2009, 10:00pm CEST by timothy

Tags: privacy

kkleiner writes "For all the glory it gets, the fingerprint has evolved very little in the last 60 years. They’re still two dimensional. The US Department of Homeland Security and the National Institute of Justice are hoping to change that. They've given grants to dozens of companies to perfect touchless 3D fingerprinting. Two universities (University of Kentucky and Carnegie Mellon) and their two respective start-up companies (Flashscan 3D and TBS Holdings) have succeeded. Fingerprints have reached the third dimension and they are faster, more accurate, and touchless."

Read more of this story at Slashdot.

Identity Theft Is Usually an Unsophisticated Crime

Posted: October 3rd, 2009, 7:28pm CEST by Soulskill

Tags: privacy

apatrick writes "A recent research report by Heith Copes (University of Alabama at Birmingham) and Lynne Vieraitis (University of Texas at Austin) has examined identity thieves and their methods. Copes and Vieraitis searched federal court records in the US for people convicted of identity theft and then tried to find out where they were serving their sentences. They were able to find 297 inmates, from which they sampled 59 inmates in 14 prisons across the country. The convicts agreed to do detailed interviews, in private, to talk about themselves and their crimes, and the results are reported in a recent issue of Criminal Justice Review. According to Copes and Vieraitis, 'it is best categorized as an economic crime committed by a wide range of people from diverse backgrounds through a variety of legitimate (e.g., mortgage broker) and illegitimate (e.g., burglar) occupations.' As to the issue of whether these are white-collar criminals, the authors say: 'Despite public perceptions of identity theft being a high-tech, computer driven crime, it is rather mundane and requires few technical skills. Identity thieves do not need to know how to hack into large, secure databases. They can simply dig through garbage or pay insiders for information. No particular group has a monopoly on the skills needed to be a capable identity thief.'"

Read more of this story at Slashdot.

Children's Watch Allows Parents To Track Their Kid

Posted: September 21st, 2009, 2:09pm CEST by kdawson

Tags: privacy

pickens writes "The Telegraph reports that a new wristwatch called num8 has a GPS tracking device and satellite positioning system concealed inside so parents can locate the wearer to within 10 feet with Google maps. The watch sends an alert if it is forcibly removed. The makers of the watch claim it gives peace of mind to parents and makes children more independent. 'Losing your child, if only for a brief moment, leads to a state of panic and makes parents feel powerless. The overriding aim of num8 is to give children their freedom and parents peace of mind,' says a company spokesman. Critics of the watch say tagging children is a step too far in paranoia about child safety. 'Is the world really that unsafe that parents need to track their children electronically? I don't think so,' says Dr Michele Elliott, director of children's charity Kidscape."

Read more of this story at Slashdot.

Using Encryption Garners Exemption For Data Breach Notification

Posted: September 19th, 2009, 11:59pm CEST by timothy

Tags: privacy

Combat Wombat writes with this excerpt from the Register: "New data breach rules for US healthcare providers have come under criticism from a security firm that specialises in encryption. As part of the Health Information Technology for Economic and Clinical Health (HITECH) Act, which comes into effect from 23 September, health organisations in the US that use encryption will no longer be obliged to notify clients of breaches."

Read more of this story at Slashdot.

Security / Privacy Advice?

Posted: September 18th, 2009, 1:27am CEST by kdawson

Tags: privacy

James-NSC writes "My employer is changing its policy towards employee use of social networks. I've been asked to give a 40-minute presentation to the entire company, with attendance mandatory, on the security and privacy concerns relating to social networking. While I was putting it together, I ended up with some miscellaneous information that pertains to security/privacy in general, for example: the emerging ATM skimming (mainly for our European employees), a reminder that email is not private, malware/drive-by in popular search results, etc. Since these topics don't directly relate to the subject I've been asked to address, I've ended up with a section titled 'While I have you...' I'm going to have the mandatory attention of every employee and I thought it would be a great opportunity to give advice on security/privacy issues across the board. As it's an opportunity that one seldom gets, I certainly want to utilize it fullly. If you had the attention of an entire company with employees in the US, UK, Asia, and Australia, what security / privacy advice would you give?"

Read more of this story at Slashdot.

How Much Is Your Online Identity Worth?

Posted: September 10th, 2009, 8:49pm CEST by timothy

Tags: privacy

itwbennett writes "Answer a few questions about your personal Internet use, and a new tool from Symantec will calculate your net worth on the black market. You'll get three results: how much your online assets are worth, how much your online identity would sell for on the black market, and your risk of becoming a victim of identity theft. The tool is intended to raise consumer awareness about cybercrime, said Marian Merritt, Internet security advocate for Symantec. It's unlikely the average consumer would read an Internet Security Threat Report, she added, but a simply illustrated example might get the same point across. 'It's shocking how little value criminals place on your credit card,' she said."

Read more of this story at Slashdot.

Fear of Porn URL Exposure Discourages Firefox 3 Upgrade

Posted: August 26th, 2009, 7:54pm CEST by timothy

Tags: privacy

Barence writes "Mozilla's Security team has disclosed a very interesting piece of research which suggests people refused to upgrade to Firefox 3 because they were afraid the browser would expose their porn collection. Mozilla's research found that the number one reason for not upgrading was the new location bar, and the fact that it delved into people's bookmark collections to suggest sites as they typed. 'When we expanded the capabilities of the location bar to search against all history and bookmarks in Firefox 3, a lot of people contacted us to say that they had certain bookmarks they didn't really want to have displayed,' Firefox's principal designer, Alex Faaborg, tactfully explains. 'In some cases users had intentionally hidden these bookmarks in deep hierarchies of folders, somewhat similar to how one might hide a physical object.'"

Read more of this story at Slashdot.

Can We Abandon Confidentiality For Google Apps?

Posted: August 4th, 2009, 11:53pm CEST by kdawson

Tags: privacy

An anonymous reader writes "I provide IT services for medium-sized medical and law practices. Lately I have been getting a lot of feedback from doctors and lawyers who use gmail at home and believe that they can run a significant portion of their practice IT on Google Apps. From a support standpoint, I'd be happy to chuck mail/calendar service management into the bin and let them run with gmail, but for these businesses, there is significant legal liability associated with the confidentiality of their communications and records (e.g., HIPAA). For those with high-profile celebrity clients, simply telling them 'Google employees can read your stuff' will usually end the conversation right there. But for smaller practices, I often get a lot of push-back in the form of 'What's wrong with trusting Google?' and 'Google's not interested in our email/calendar.' Weighing what they see as a tiny legal risk against the promise of Free IT Stuff(TM) becomes increasingly lopsided given the clear functionality / usability / ubiquity that they experience when using Google at home. So my question to the Slashdot community is: Are they right? Is it time for me to remove the Tin Foil Hat on the subject of confidentiality and stop resisting the juggernaut that is Google? If not, what is the best way to clarify the confidentiality issues for these clients?"

Read more of this story at Slashdot.

Social Security Numbers Can Be Guessed

Posted: July 7th, 2009, 1:14am CEST by timothy

Tags: privacy

BotScout writes "The nation's Social Security numbering scheme has left millions of citizens vulnerable to privacy breaches, according to researchers at Carnegie Mellon University, who for the first time have used statistical techniques to predict Social Security numbers solely from an individual's date and location of birth. The researchers used the information they gleaned to predict, in one try, the first five digits of a person's Social Security number 44 percent of the time for 160,000 people born between 1989 and 2003. A Social Security Administration spokesman said the government has long cautioned the private sector against using a social security number as a personal identifier, even as it insists 'there is no fool-proof method for predicting a person's Social Security Number.'" Update: 07/07 00:01 GMT by T : Reader angrytuna links to Wired's coverage of the SSN deduction system, and links to the researchers' FAQ at Carnegie Mellon, which says that the research paper will be presented at BlackHat Las Vegas later this month.

Read more of this story at Slashdot.

Crowdsourcing Big Brother In Lancaster, PA

Posted: June 22nd, 2009, 8:58pm CEST by timothy

Tags: privacy

sehlat writes "From the Los Angeles Times comes word that in Lancaster, Pennsylvania, 165 public surveillance cameras are being set up to be monitored by a 'non profit coalition' of volunteers. The usual suspects, including 'the innocent have nothing to fear' are being trotted out to justify this, and the following quote at the end of the article deserves mention: 'But Jack Bauer, owner of the city's largest beer and soft drink distributor, calls the network "a great thing." His store hasn't been robbed, he said, since four cameras went up nearby. "There's nothing wrong with instilling fear," he said.'"

Read more of this story at Slashdot.

The "Hidden" Cost Of Privacy

Posted: June 15th, 2009, 6:57pm CEST by ScuttleMonkey

Tags: privacy

Schneier points out an article from a while back in Forbes about the "hidden" cost of privacy and how expensive it can be to comply with all the various overlapping privacy laws that don't necessarily improve anyone's privacy. "What this all means is that protecting individual privacy remains an externality for many companies, and that basic market dynamics won't work to solve the problem. Because the efficient market solution won't work, we're left with inefficient regulatory solutions. So now the question becomes: how do we make regulation as efficient as possible?"

Read more of this story at Slashdot.

NSA Ill-Suited For Domestic Cybersecurity Role

Posted: June 12th, 2009, 10:13pm CEST by Soulskill

Tags: privacy

Hugh Pickens writes "Former CIA counterterrorism analyst Stephen Lee has an interesting article in the Examiner asserting that the National Security Agency is 'a secretive, hidebound culture incapable of keeping up with innovation,' with a history of disregard for privacy and civil liberties. Lee says that for most of its sixty-year history, the NSA has been geared to cracking telecom and crypto gear produced by Soviet and Chinese design bureaus, but at the end of the cold war became 'stymied by new-generation Western-engineered telephone networks and mobile technologies that were then spreading like wildfire in the developing world and former Soviet satellite countries.' When the NSA finally recognized that it needed to get better at innovation, it launched several mega-projects, tagged like 'Trailblazer' and 'Groundbreaker,' that have been spectacular failures, costing US taxpayers billions. More recently, the NY Times reported that the NSA has been breaking rules set by the Obama administration to peer even more aggressively into American citizens' phone traffic and email inboxes. Whistleblower reports portray NSA domestic eavesdropping programs as unprofessional and poorly supervised, with intercept technicians ridiculing and mishandling recordings of citizens' private 'pillow talk' conversations. Lee concludes that 'if the Federal government must play a role, then Congress and President Obama should turn to another agency without a record of creating mistrust — perhaps even a new entity. Meanwhile, NSA should focus on listening in on America's enemies, instead of being an enemy of Americans and their enterprises.'"

Read more of this story at Slashdot.

UK Police Want Plug-In Computer Crime Detectors

Posted: June 3rd, 2009, 10:20pm CEST by timothy

Tags: privacy

An anonymous reader writes "UK police are talking to private companies about using plug-in USB devices that can scour the hard drive of any device they are attached to, searching for evidence of illegal activity. The UK's Association of Chief Police Officers is considering using commercial devices that can perform targeted searches of text, pictures and computer code on hard drives, allowing untrained cops to detect anything from correspondence on stolen goods to child pornography. Police in the UK are desperate for a way of slashing the backlog of machines seized by the police in raids, with many forces having a backlog that will take a year to process." Maybe they shouldn't seize so many computers.

Read more of this story at Slashdot.

Hard Drive With Clinton-Era Data Missing From Nat'l Archives

Posted: May 21st, 2009, 12:24am CEST by timothy

Tags: privacy

CWmike writes "An external hard drive that's believed to contain nearly 1TB of data from the Clinton Administration is missing from the US National Archives and Recording Administration (NARA). The drive includes more than 100,000 Social Security numbers and home addresses of people who visited or worked at the White House. Among those whose information is on the list is one of then-Vice President Al Gore's three daughters. The drive also contained details on the security procedures used by the Secret Service at the White House, as well as event logs, social gathering logs, political records and other information from the Clinton administration. Rep. Darrell Issa, (R-Calif.) said the Archives was in the process of converting information from the drive to a digital records system when it apparently disappeared. The hard drive was apparently removed from a secure storage area to a workplace where at least 100 'badge-holders' had access to it, Issa noted."

Read more of this story at Slashdot.

Break-In Compromises 160k Medical Records At UC Berkeley

Posted: May 12th, 2009, 6:57pm CEST by timothy

Tags: privacy

nandemoari writes "Hackers have reportedly infiltrated restricted computer databases at the University of California Berkeley, putting the private data of 160,000 students, alumni, and others at risk. According to UC Berkeley, computer administrators determined on April 9, 2009 that electronic databases in University Health Services had been breached by overseas criminals. The breakins began in October 2008. Information contained on the breached databases included Social Security numbers, health insurance information, and non-treatment medical information such as records of immunization and names of treating physicians."

Read more of this story at Slashdot.

Cone of Silence 2.0

Posted: May 10th, 2009, 8:22pm CEST by kdawson

Tags: privacy

Village Idiot sends word of a patent granted to MIT researchers for a cone of silence a la Maxwell Smart. This one doesn't use plastic, but rather active and networked sensors and speakers embedded in a (probably indoor) space such as an open-plan office. "In 'Get Smart,' secret agents wanting a private conversation would deploy the 'cone of silence,' a clear plastic contraption lowered over the agents' heads. It never worked — they couldn't hear each other, while eavesdroppers could pick up every word. Now a modern cone of silence that we are assured will work is being patented by engineers Joe Paradiso and Yasuhiro Ono of the Massachusetts Institute of Technology. ... Instead of plastic domes, they use a sensor network to work out where potential eavesdroppers are, and speakers to generate a subtle masking sound at just the right level. ... The array of speakers... aims a mix of white noise and randomized office hubbub at the eavesdroppers. The subtle, confusing sound makes the conversation unintelligible." One comment thread on the article wonders about the propriety of tracking people around an office in order to preserve privacy.

Read more of this story at Slashdot.

A Look Into the FBI's "Everything Bucket"

Posted: May 1st, 2009, 4:07pm CEST by kdawson

Tags: privacy

Death Metal notes an EFF report on information wrested from the FBI over the last three years via Freedom of Information requests. The report characterizes what Ars Technica calls the FBI's "Everything Bucket" — its Investigative Data Warehouse. (Here's the EFF's introduction and the report itself.) The warehouse, at least 7 years in the making, "...appears to be something like a combination of Google and a university's slightly out-of-date custom card catalog with a front-end written for Windows 2000 that uses cartoon icons that some work-study student made in Microsoft Paint. I guess I'm supposed to fear the IDW as an invasion of privacy, and indeed I do, but given the report's description of it and my experiences with the internal-facing software products of large, sprawling, unaccountable bureaucracies, I mostly just fear for our collective safety."

Read more of this story at Slashdot.

How Tor Helps Both Dissidents and the Police

Posted: April 23rd, 2009, 9:18pm CEST by timothy

Tags: privacy

Al writes "Technology Review has a in-depth article about the anonymous networking software Tor and how it is helping dissidents spread information in oppressive regimes such as Syria, Zimbabwe and Mauritania, and opening up the unfiltered web for users in many more countries. In China, for instance, the computers found in some web cafes are configured to use Tor automatically. Interestingly, some police agencies even use the software to hide their activity from suspects. As filtering becomes ever more common in democratic countries such as the US, perhaps Tor (and similar tools such as I2P), will become even more valuable."

Read more of this story at Slashdot.

Anonymous Network I2P 0.7.2 Released

Posted: April 19th, 2009, 11:42pm CEST by timothy

Tags: privacy

Mathiasdm writes "The Invisible Internet Project, also known as I2P, has seen its 0.7.2 release (download). I2P uses multiple encryption layers, and routing through several other computers to hide both sender and receiver of messages. On top of the network, regular services such as mail, browsing, file sharing and chatting are supported. This release (and all of the releases since 0.7) is at the start of a new development period, in which the I2P developers wish to spread the word about the secure network. This new release includes performance improvements, a first edition of an experimental new desktop interface and security improvements (by limiting the number of tunnels a single peer can participate in)."

Read more of this story at Slashdot.

MIT Tracking Campus Net Connections Since 1999

Posted: April 19th, 2009, 12:44am CEST by timothy

Tags: privacy

An anonymous reader writes "MIT has been monitoring student internet connections for the past decade without telling them. There is no official policy and no student input." The Tech article says, though, that the record keeping is fairly limited in its scope (connection information is collected, but not the data transferred) and duration (three days, for on-campus connections).

Read more of this story at Slashdot.

Researchers Can ID Anonymous Twitterers

Posted: March 26th, 2009, 11:48pm CET by timothy

Tags: privacy

narramissic writes "In a paper set to be delivered at an upcoming security conference, University of Texas at Austin researchers showed how they were able to identify people who were on public social networks such as Twitter and Flickr by mapping out the connections surrounding their network of friends. From the ITworld article: 'Web site operators often share data about users with partners and advertisers after stripping it of any personally identifiable information such as names, addresses or birth dates. Arvind Narayanan and fellow researcher Vitaly Shmatikov found that by analyzing these 'anonymized' data sets, they could identify Flickr users who were also on Twitter about two-thirds of the time, depending on how much information they have to work with.'"

Read more of this story at Slashdot.

UK Gov't May Track All Facebook Traffic

Posted: March 18th, 2009, 8:20pm CET by timothy

Tags: privacy

Jack Spine writes "The UK government, which is becoming increasingly Orwellian, has said that it is considering snooping on all social networking traffic including Facebook, MySpace, and bebo. This supposedly anti-terrorist measure may be proposed as part of the Intercept Modernisation Programme according to minister Vernon Coaker, and is exactly the sort of deep packet inspection web inventor Sir Tim Berners-Lee warned about last week. The measure would get around the inconvenience for the government of not being able to snoop on all UK web traffic."

Read more of this story at Slashdot.

CA Senator Pushing For Tightened Data Breach Notification

Posted: March 9th, 2009, 11:22pm CET by ScuttleMonkey

Tags: privacy

California State Senator Joe Simitian has introduced new legislation designed to tighten data breach notification requirements, forcing businesses to provide more information about any data that has been leaked in addition to notifying state authorities. What was not included in the legislation was imposed compensation requirements for data breach victims, and according to Simitian are not likely to be for quite some time. "Instead, the next focus of legislation, he said, would likely be on who should bear the cost of sending out notifications to consumers. For example, should a credit card processing company that experiences a breach be responsible for the cost of notifying bank customers? When retailer TJX discovered in 2006 that hackers had accessed credit and debit card numbers passing through its network, banks were left notifying the customers, then had to sue TJX to get compensation for those costs. Heartland Payment Systems, which experienced a breach of credit and debit card numbers in January, has recently been sued by banks to recover their breach notification costs."

Read more of this story at Slashdot.

UK School Introduces Facial Recognition

Posted: March 6th, 2009, 11:10am CET by timothy

Tags: privacy

Penguin_me writes "A UK school has quietly introduced new facial recognition systems for registering students in and out of school: 'HIGH-TECH facial recognition technology has swept aside the old-fashioned signing of the register at a school. Sixth-formers will now have their faces scanned as they arrive in the morning at the City of Ely Community College. It is one of the first schools in the UK to trial the new technology with its students. Face Register uses the latest high-tech gadgets to register students in and out of school in just 1.5 seconds.'"

Read more of this story at Slashdot.

Accessing Medical Files Over P2P Networks

Posted: February 28th, 2009, 3:18pm CET by Soulskill

Tags: privacy

Gov IT writes with this excerpt from NextGov: "Just days after President Obama signed a law giving billions of dollars to develop electronic health records, a university technology professor submitted a paper showing that he was able to uncover tens of thousands of medical files containing names, addresses and Social Security numbers for patients seeking treatment for conditions ranging from AIDS to mental health problems. ... The basic technology that runs peer-to-peer networks inadvertently exposed the files probably without the computer user's knowledge, Johnson said. A health care worker might have loaded patient files onto a laptop, for example, and taken it home where a son or daughter could have downloaded a peer-to-peer client onto the laptop to share music."

Read more of this story at Slashdot.

US District Ct. Says Defendant Must Provide Decrypted Data

Posted: February 26th, 2009, 11:31pm CET by timothy

Tags: privacy

An anonymous reader writes "If you're planning on traveling internationally with a laptop, consider the following: District Court Overturns Magistrate Judge in Fifth Amendment Encryption Case. Laptop searches at the border have been discussed many times previously. This is the case where a man entered the country allegedly carrying pornographic material in an encrypted file on his laptop. He initially cooperated with border agents during the search of the laptop then later decided not to cooperate citing the Fifth Amendment. Last year a magistrate judge ruled that compelling the man to enter his password would violate his Fifth Amendment right against self-incrimination. Now in a narrow ruling, US District Judge William K. Sessions III said the man had waived his right against self-incrimination when he initially cooperated with border agents." sohp notes that "the order is not that he produce the key — just that he provide an unencrypted copy."

Read more of this story at Slashdot.

Combining BitTorrent With Darknets For P2P Privacy

Posted: February 24th, 2009, 12:05am CET by kdawson

Tags: privacy

CSEMike writes "Currently popular peer-to-peer networks suffer from a lack of privacy. For applications like BitTorrent or Gnutella, sharing a file means exposing your behavior to anyone interested in monitoring it. OneSwarm is a new file sharing application developed by researchers at the University of Washington that improves privacy in peer-to-peer networks. Instead of communicating directly, sharing in OneSwarm is friend-to-friend; senders and receivers exchange data using multiple intermediaries in an overlay mesh. OneSwarm is built on (and backwards compatible with) BitTorrent, but includes numerous extensions to improve privacy while providing good performance: point-to-point encryption using SSL, source-address rewriting, and multi-path and multi-source downloading. Clients and source are available for Linux, Mac OS X, and Windows."

Read more of this story at Slashdot.

Vodafone Hands Data To Egyptian Police

Posted: February 11th, 2009, 8:52pm CET by timothy

Tags: privacy

Jack Spine writes "A Vodafone exec has admitted the company handed communications data to the Egyptian police following riots over food shortages last year, to aid the identification of suspects. Egyptian law enforcement has a habit of torturing and murdering detainees, or of having them 'disappear.' This is similar to Yahoo handing details of Chinese dissidents over to the authorities in 2005. It's nice to have it confirmed that multinational service providers shelve morals in the pursuit of cash."

Read more of this story at Slashdot.

Data Privacy Day Wrap-Up

Posted: January 29th, 2009, 2:22am CET by timothy

Tags: privacy

Several companies, government bodies and other groups have decided to label January 28th as an annual tech holiday of sorts, Data Privacy Day. Mortimer.CA writes "Various organizations had events on it including Intel, Microsoft, Google, and the Privacy Commissioner of Canada. It seems to have been mostly a quiet affair this time around, but hopefully it will grow over time."

Read more of this story at Slashdot.

Mumbai Police To Enforce Wi-Fi Security

Posted: January 10th, 2009, 7:22pm CET by Soulskill

Tags: privacy

caffeinemessiah writes "In the wake of the recent terrorist attacks in Mumbai, India, the local police are going to be sniffing out unsecured wi-fi access points and ordering the owners to secure them. The article notes that 'terror mails were sent through unsecured Wi-Fi connections' before bomb blasts in other Indian cities. No word on if they'll be walking around using Kismet, or if people who use pathetically weak WEP encryption will be ordered to switch to more advanced protocols. Unfortunately, a gesture like this does not take into account the insidious scenario of walking into a cafe, buying a coffee and then (legally) using the cafe's wi-fi. Or the fact that terrorists might actually be able to pay to use a cybercafe, and know what VPNs are." On the other hand, the Mumbai police may still be keeping track of the mandatory keyloggers that went into the area's cybercafes in 2007.

Read more of this story at Slashdot.

Security Checkpoints Predict What You Will Do

Posted: January 1st, 2009, 7:27pm CET by timothy

Tags: privacy

An anonymous reader writes "New security check points in 2020 will look just like something out of the futuristic movie, The Minority Report. The idea of the new checkpoints will allow high traffic to pass through just as you were walking at a normal pace. No more waving a wand to get through checkpoints — the new checkpoint can detect if you have plans to set off a bomb before you even enter the building."

Read more of this story at Slashdot.

Data Breach Notices Show Tip of the Iceberg

Posted: December 17th, 2008, 1:39am CET by kdawson

Tags: privacy

d2d writes "The Data Loss Database has released a new feature: The Primary Sources Archive, a collection of breach notification letters gathered from various state governments as a result of data breach notification legislation. The documents include breaches that were largely unreported in the media, many of which are significant incidents of data loss. This lends credence to the iceberg theory of data-loss reporting, where many incidents never break the surface. Now, thanks to the Open Security Foundation, we can 'dive' for them."

Read more of this story at Slashdot.

UK Cops Want "Breathalyzers" For PCs

Posted: December 11th, 2008, 8:52pm CET by timothy

Tags: privacy

An anonymous reader writes "One of the UK's top cyber cops, detective superintendent Charlie McMurdie, says the top brass want to develop the equivalent of a breathalyzer for computers, a simple tool that could be plugged into a machine during a raid and retrieve evidence of illegal activity. McMurdie said the device was needed because of a record number of PCs were being seized by police and because the majority of cops don't have the skills to forensically analyse a computer."

Read more of this story at Slashdot.

A Linux-Based "Breath Test" For Porn On PCs

Posted: November 4th, 2008, 7:00pm CET by timothy

Tags: privacy

Gwaihir the Windlord writes "A university in Western Australia has started beta testing a tool that's described as 'a random breath test' to scan computers for illicit images. According to this article it's a clean bootable Linux environment. Since it doesn't write to the hard drive, the evidence is acceptable in court, at least in Australia. They're also working on versions to search for financial documents in fraud squad cases, or to search for terrorist keywords. Other than skimming off the dumb ones, does anyone really expect this to make a difference?" The article offers no details on what means the software uses to identify suspicious files.

Read more of this story at Slashdot.

A Linux-Based "Breath Test" For Porn On PCs

Posted: November 4th, 2008, 7:00pm CET by timothy

Tags: privacy

Read more of this story at Slashdot.

Verizon Exposes the Wrong 1,200 Email Addresses

Posted: October 10th, 2008, 9:22pm CEST by timothy

Tags: privacy

netbuzz writes "If you're going to market your expertise by inviting 1,200 IT professionals to a seminar about securing data and protecting personal information, it's probably a good idea to protect the personal information of those you invite. On Tuesday, Verizon forgot that advice and blasted each of the 1,200 email addresses to everyone on the list ... and they did it 17 times."

Read more of this story at Slashdot.

Palin Email Hacker Found

Posted: September 21st, 2008, 7:01pm CEST by Soulskill

Tags: privacy

mortonda writes to tell us that the person responsible for breaching Sarah Palin's private email account has been found. We discussed the breach last Wednesday, shortly before the hacker, a University of Tennessee-Knoxville student, posted a message detailing his methods. Wired has a story examining the potential legal consequences for the hacker.

Read more of this story at Slashdot.

The Electronic Bastille

Posted: September 5th, 2008, 10:19am CEST by timothy

Tags: privacy

smooth wombat writes "Imagine a database whose aim is to centralize and analyze data on people aged 13 or above who are active in politics or labor unions, who play a significant institutional, economic, social or religious role, or who are 'likely to breach public order.' At first glance one might think the country in question is Russia or Zimbabwe but the truth is, it's a democratic nation which is implementing this database. Specifically, France. Now, with the summer break over and as the people of France return to work, there is a small but growing movement to storm this electronic Bastille. Michel Pezet, a lawyer and former member of a body charged with protecting French citizens from electronic prying, had this to say about this new data-gathering law: 'The Edvige database has no place in a democracy. There is nothing in the decree that sets limits or a framework. Whether the database is used with or without moderation depends only on orders from up high. The electronic Bastille is upon us.'"

Read more of this story at Slashdot.

Hashing Email Addresses For Web Considered Harmful

Posted: August 29th, 2008, 1:01am CEST by timothy

Tags: privacy

cce writes "The MicroID standard, despite getting thrashed soundly by Ben Laurie two years ago, has since been recommended by the DataPortability Project and published on the user profiles of millions of users at Digg and Last.fm. MicroID is basically a hash calculated using a user's profile page URL and registered email address, producing a token that makes the email address vulnerable to dictionary attacks. To see how easy it was to crack these tokens, I conducted a small study, choosing 56,775 random Digg users, and cracking the email addresses of 14,294 of them (25%) using just their MicroID, username, and a list of popular email domains. Digg has more than 2 million users, and that means half a million of them — mostly people who had never heard of MicroID, and had probably not logged in for a long time — had their email addresses exposed to this trivial attack. I also applied this attack to Last.fm (19%) and ClaimID (34%). Digg and Last.fm have since removed support for MicroID, but the lesson is clear: don't publish a hash of my email address online, guys!"

Read more of this story at Slashdot.

Best Western Loses Details On 8 Million Customers

Posted: August 24th, 2008, 1:42pm CEST by timothy

Tags: privacy

Albanach writes "Scotland's Sunday Herald newspaper has an exclusive report that the Best Western hotel chain has lost the personal details of each and every guest who has stayed at any of its 1300 hotels in the past 12 months. This amounts to details on 8 million customers and includes information such as name, address, credit card details and employment details. The data even includes future booking details, causing speculation that homes could be targeted for burglary when it's anticipated they will be unoccupied. A Best Western spokesperson is quoted as saying 'Best Western took immediate action to disable the compromised log-in account in question. We are currently in the process of working with our credit card partners to ensure that all relevant procedural standards are met, and that the interests of our guests are protected.'"

Read more of this story at Slashdot.

As of October, FBI To Allow Warrantless Investigations

Posted: August 22nd, 2008, 11:34pm CEST by timothy

Tags: privacy

I Don't Believe in Imaginary Property writes "Attorney General Michael Mukasey has agreed to allow Congressional hearings, but not to delay, the implementation of new FBI regulations that would allow them to spy on American citizens who are not suspected of any crime. As an editorial in the New York Times points out, this is a power that has a history of abuse. In times past, it was used to wiretap Rev. Martin Luther King, Jr. and to spy on other civil rights and anti-war protesters." As Dekortage points out, "Several senators have formally complained that citizens could be investigated 'without any basis for suspicion,' which the Justice Department denies."

Read more of this story at Slashdot.

Wealthy Mexicans Getting Chipped in Case of Abduction

Posted: August 22nd, 2008, 10:44pm CEST by samzenpus

Tags: privacy

Because the number of abductions in Mexico has jumped almost 40% in the past 3 years, the wealthy are getting subcutaneous transmitters so they can be tracked when kidnapped. Xega, the Mexican security firm which makes the chips, has seen a sales jump of 13% this year. The company injects the crystal-encased chip, the size and shape of a grain of rice, into clients' bodies with a syringe. The chip then sends radio signals to a larger device carried by the client with a global positioning system in it. A satellite can then be used to find the location of the missing person. Things must be a lot worse in Mexico than I thought.

Read more of this story at Slashdot.

UK Gov't Lost Personal Data On 4M People In One Year

Posted: August 22nd, 2008, 10:36am CEST by timothy

Tags: privacy

An anonymous reader writes "The U.K. government has lost the personal information of up to four million citizens in one year alone. The astonishing figures, calculated by the BBC, added up as Whitehall departments slowly released their annual reports for the year to April. And the trend has not stopped — in the latest revelation, HM Revenue Customs, which infamously lost the details of 25 million child benefits claimants last November on two unencrypted discs, experienced 1,993 data breaches between 1 October last year and 24 June." (More below.)

Read more of this story at Slashdot.

McCain Releases Technology Platform

Posted: August 16th, 2008, 2:14pm CEST by Soulskill

Tags: privacy

I Don't Believe in Imaginary Property writes "John McCain has finally released a technology platform. Most of it is the same old stuff; lower corporate taxes, protect children from porn, and avoid Internet regulation unless 'necessary.' Alas, in his view, helping the RIAA's War on Sharing is necessary to stop the 'global epidemic' of piracy, while Net Neutrality is something he 'does not believe in.' Ars Technica has a review of McCain's platform." A brief analysis is also available from Federal Computer Week. In addition to the technology policy, McCain has also released a paper describing his stance on security and privacy. We've previously contrasted his views with those of Barack Obama. Obama's technology policies are also available online.

Read more of this story at Slashdot.

"Clear" Air-Travel Pass Data Stolen From SFO

Posted: August 5th, 2008, 6:12pm CEST by timothy

Tags: privacy

Kozar_The_Malignant writes "A laptop containing the unencrypted security data for 33,000 travelers using the Clear system was stolen at San Francisco International Airport on July 26, according to CBS5 Television. The Clear system allows travelers who register and pay a $100.00 annual fee to speed through airport security by using a smart card at special kiosks in some airports. TSA has suspended new registrations in the system, which is run by a private contractor, Verified Identity Pass, Inc., a subsidiary of GE. The laptop was apparently stolen from a locked office at SFO. The company has now decided that it might be a good idea to encrypt the data in their systems. They are in the process of notifying customers that all of their personal data, including name, address, SSi number, passport number, date of birth, etc. has been compromised."

Read more of this story at Slashdot.

Is Hushmail Still Safe?

Posted: August 3rd, 2008, 5:07pm CEST by Soulskill

Tags: privacy

Ringo Kamens writes to ask if the use of Hushmail can still be considered a secure method of communication: "For a long time, Hushmail was considered a very secure email provider until an affidavit (PDF) from a DEA agent in 2007 showed that they had handed over 12 CDs of possibly decrypted data to law enforcement. Now, Cryptome has posted that the Hushmail encryption program is no longer the same program for which Hushmail releases their source. Is Hushmail even safe to use anymore?"

Read more of this story at Slashdot.

Schneier, UW Team Show Flaw In TrueCrypt Deniability

Posted: July 17th, 2008, 11:29pm CEST by timothy

Tags: privacy

An anonymous reader writes "Bruce Schneier and colleagues from the University of Washington have figured out a way to break the deniability of TrueCrypt 5.1a's hidden files. What about the spanking-new TrueCrypt 6? Schneier says that 'The new version will definitely close some of the leakages, but it's unlikely that it closed all of them.' Meanwhile, PC World is reporting that the problems Schneier and colleagues found are bigger than just TrueCrypt. Among their discoveries: Word auto-saves the contents of encrypted files to the unencrypted portions of your disk, and this problem should apply to all non-full disk encryption software. Their research paper will appear at Usenix HotSec '08."

Read more of this story at Slashdot.

Sweden's Snoop Law Targets Russia

Posted: July 9th, 2008, 9:42pm CEST by timothy

Tags: privacy

praps writes "There's been much controversy lately over Sweden's new law which allows the signal intelligence agency (FRA) to monitor all data traffic within the country's borders. The Swedish government has kept curiously quiet about the new law's objectives but sources close to the intelligence community say that Russia is the prime target. '"80 percent of Russia's contacts with large parts of the world travel through cables in Sweden. That is the core of the issue," said one source.'" Related: EuroConcerned writes "Many things are happening in Sweden after the new legislation on wiretapping has been voted. TorrentFreak has an article on what's going on, including massive protests and Google moving their servers away from the country."

Read more of this story at Slashdot.

German Survey Company Loses 41,000 Survey Records

Posted: July 7th, 2008, 4:15am CEST by timothy

Tags: privacy

mister_woods writes "It's not just governments that lose private data. Germany's Chaos Computer Club (CCC) reports that market research firm TNS Infratest/Emnid has lost 41,000 private data records of their survey participants. By simply changing the customer ID number in the browser's address bar access could be gained to comprehensive survey results, including names, addresses, dates of birth, email addresses, phone numbers and much more sensitive data. A CCC spokesman described this as 'unprofessional, grossly negligent and above all deeply worrying' and sees this loss as a vindication for its calls for strict regulations for public and private sector data collectors."

Read more of this story at Slashdot.

FBI's New Eye Scan Database Raising Eyebrows

Posted: June 30th, 2008, 7:06pm CEST by timothy

Tags: privacy

mattnyc99 writes "The FBI has confirmed to Popular Mechanics that it's not only adding palm prints to its criminal records, but preparing to balloon its repository of photos, which an agency official says 'could be the basis for our facial recognition.' It's all part of a new biometric software system that could store millions of iris scans within 10 years and has privacy advocates crying foul. Quoting: 'The FBI's Next Generation Identification (NGI) system, which could cost as much as $1 billion over its 10-year life cycle, will create an unprecedented database of biometric markers, such as facial images and iris scans. For criminal investigators, NGI could be as useful as DNA some day — a distinctive scar or a lopsided jaw line could mean the difference between a cold case and closed one. And for privacy watchdogs, it's a dual threat — seen as a step toward a police state, and a gold mine of personal data waiting to be plundered by cybercriminals.'"

Read more of this story at Slashdot.

SSL Encryption Coming To The Pirate Bay

Posted: June 22nd, 2008, 5:20pm CEST by Soulskill

Tags: privacy

An anonymous reader writes "The Pirate Bay, in response to Sweden's new wiretapping law, will start offering SSL encryption to its user base this week. Although copyright issues really have little to do with national security, The Pirate Bay knows its population is uneasy with the recent legal change. The encryption will mostly benefit Swedish users living under the current law. Since The Pirate Bay and its servers are not hosted in Sweden, the additional security offered to outside users could be comparatively minimal."

Read more of this story at Slashdot.

ID Theft In US Continues Apace Despite Data Breach Laws

Posted: June 8th, 2008, 10:34pm CEST by timothy

Tags: privacy

4roddas points out an article at Techworld about the continued scourge of identify theft in the US, which begins: "Over the past five years, 43 US states have adopted data breach notification laws, but has all of this legislation actually cut down on identity theft? Not according to researchers at Carnegie Mellon University who have published (PDF) a state-by-state analysis of data supplied by the US Federal Trade Commission (FTC). 'There doesn't seem to be any evidence that the laws actually reduce identity theft,' said Sasha Romanosky, a Ph.D student at Carnegie Mellon who is one of the paper's authors. Since 1999 the FTC has invited identity theft victims to log information about their cases on its Web site. The data are then made accessible to law enforcement, which uses the information to help analyze crime trends."

Read more of this story at Slashdot.

Permalink for 'Slashdot__IT/2008/06/06/Google_Health_Open_Platform_Is_Great__mdash__Or_Awful'

Google Health Open Platform Is Great — Or Awful

Posted: June 6th, 2008, 5:25pm CEST by timothy

Tags: privacy

JackPowers writes "The Google Health APIs enable portable, standardized, open architecture, extensible personal health records, which is nice but boring if they're just used to manage the paperwork of the doctor/patient relationship. But once the data is set free, all kinds of Web 1.0, Web 2.0 and Web 3.0 apps are possible. This article looks ahead 10 years at Best Case Scenarios. A follow-up article lists the Worst Case Scenarios."

Read more of this story at Slashdot.

Full Disclosure and Why Vendors Hate It

Posted: May 31st, 2008, 4:39pm CEST by CowboyNeal

Tags: privacy

An anonymous reader writes "Well known iPhone hacker Jonathan Zdziarski gave a talk at O'Reilly's Ignite Boston 3 this week in which he called for the iPhone hacking community to embrace full disclosure and stop keeping secrets that were leading to the iPhone's demise. He has followed up with an article about full disclosure and why vendors hate it. He argues that vendor-only disclosure protects the vendors and not the consumer, and that vendors easily abuse this to downplay privacy concerns while continuing to sell insecure products. In contrast, he paints full disclosure as a capitalist means to keep the vendor accountable, and describes how public outcry can be one of the best motivating factors to get a vulnerability addressed."

Read more of this story at Slashdot.

US Firms Read Employee E-mail On a Massive Scale

Posted: May 22nd, 2008, 3:12pm CEST by timothy

Tags: privacy

An anonymous reader writes "In its fifth annual study of outbound e-mail and data loss prevention issues, Proofpoint found that 41% of the largest companies surveyed (those with 20,000 or more employees) reported that they employ staff to read or otherwise analyze the contents of outbound e-mail. 22% of these companies said they employ staff primarily or exclusively for this purpose."

Read more of this story at Slashdot.

Securing Your Notebook Against US Customs

Posted: May 15th, 2008, 6:21pm CEST by timothy

Tags: privacy

Nethemas the Great points out a piece from Bruce Schneier running in the UK's Guardian newspaper with some tips for international travelers on securing notebook computers for border crossings. A taste of the brief article: "Last month a US court ruled that border agents can search your laptop, or any other electronic device, when you're entering the country. They can take your computer and download its entire contents, or keep it for several days. ... Encrypting your entire hard drive, something you should certainly do for security in case your computer is lost or stolen, won't work here. The border agent is likely to start this whole process with a 'please type in your password.' Of course you can refuse, but the agent can search you further, detain you longer, refuse you entry into the country and otherwise ruin your day."

Read more of this story at Slashdot.

Lawyers Would Rather Fly Than Download PGP

Posted: April 29th, 2008, 2:19am CEST by kdawson

Tags: privacy

An anonymous reader writes "The NYTimes is running a front-page story about lawyers for suspects in terrorism-related cases fearing government monitoring of privileged conversations. But instead of talking about the technological solutions, the lawyers fly halfway across the world to meet with their clients. In fact, nowhere in the article is encryption even mentioned. Is it possible that lawyers don't even know about PGP?" The New Yorker has a detailed piece centering on the Oregon terrorism case discussed by the Times.

Read more of this story at Slashdot.

Your Identity Is Worth Less Than $15

Posted: April 9th, 2008, 2:12pm CEST by kdawson

Tags: privacy

I Don't Believe in Imaginary Property writes "One of the more interesting tidbits in Symantec's Global Internet Threat Report (PDF, 105 pages) is the price sheet, which suggests that someone's 'full identity' is worth in the range of $1-$15. Your email password goes for $4-$30 and your bank account might fetch $10-$1000. With those prices, I wonder how often they pay more for the bank account than is actually in it? There's also an executive summary (PDF, 36 pages)."

Read more of this story at Slashdot.

Open Source News » Tags » privacy

Feeds

199 items tagged "privacy"

Posted: May 17th, 2012, 3:25pm CEST by timothy

Tags: privacy

Posted: May 17th, 2012, 6:34am CEST by samzenpus

Tags: privacy

Posted: May 14th, 2012, 8:00pm CEST by Soulskill

Tags: privacy

Posted: May 9th, 2012, 2:13pm CEST by Soulskill

Tags: privacy

Posted: May 4th, 2012, 8:29pm CEST by Soulskill

Tags: privacy

Posted: May 2nd, 2012, 11:13pm CEST by samzenpus

Tags: privacy

Posted: May 1st, 2012, 6:52pm CEST by timothy

Tags: privacy

Posted: April 23rd, 2012, 1:40am CEST by timothy

Tags: privacy

Posted: April 21st, 2012, 2:26pm CEST by timothy

Tags: privacy

Posted: April 20th, 2012, 8:44am CEST by samzenpus

Tags: privacy

Posted: April 9th, 2012, 2:52pm CEST by samzenpus

Tags: privacy

Posted: March 31st, 2012, 12:31am CEST by Soulskill

Tags: privacy

Posted: March 22nd, 2012, 4:42pm CET by timothy

Tags: privacy

Posted: March 14th, 2012, 8:00pm CET by samzenpus

Tags: privacy

Posted: March 7th, 2012, 6:14am CET by Soulskill

Tags: privacy

Posted: March 2nd, 2012, 9:05pm CET by Soulskill

Tags: privacy

Posted: February 29th, 2012, 10:28pm CET by samzenpus

Tags: privacy

Posted: February 23rd, 2012, 5:42pm CET by timothy

Tags: privacy

Posted: February 21st, 2012, 10:28pm CET by Soulskill

Tags: privacy

Posted: February 2nd, 2012, 7:03pm CET by timothy

Tags: privacy

Posted: January 31st, 2012, 7:04pm CET by samzenpus

Tags: privacy

Posted: January 26th, 2012, 5:09pm CET by timothy

Tags: privacy

Posted: January 25th, 2012, 11:05pm CET by samzenpus

Tags: privacy

Posted: January 24th, 2012, 6:19am CET by Soulskill

Tags: privacy

Posted: January 19th, 2012, 6:14pm CET by Soulskill

Tags: privacy

Posted: December 28th, 2011, 7:19pm CET by Unknown Lamer

Tags: privacy

Posted: December 27th, 2011, 5:17am CET by Unknown Lamer

Tags: privacy

Posted: December 19th, 2011, 6:40pm CET by samzenpus

Tags: privacy

Posted: December 5th, 2011, 5:38pm CET by samzenpus

Tags: privacy

Posted: December 5th, 2011, 12:33am CET by timothy

Tags: privacy

Posted: December 2nd, 2011, 10:34pm CET by Soulskill

Tags: privacy

Posted: December 1st, 2011, 5:03pm CET by timothy

Tags: privacy

Posted: November 30th, 2011, 7:52pm CET by samzenpus

Tags: privacy

Posted: November 30th, 2011, 7:10pm CET by Unknown Lamer

Tags: privacy

Posted: November 15th, 2011, 6:23pm CET by timothy

Tags: privacy

Posted: November 8th, 2011, 9:03am CET by Unknown Lamer

Tags: privacy

Posted: November 2nd, 2011, 9:43pm CET by samzenpus

Tags: privacy

Posted: November 1st, 2011, 6:00pm CET by timothy

Tags: privacy

Posted: October 23rd, 2011, 6:33pm CEST by timothy