Danish Police Aim to End Anonymity on the Internet

Found on PC World on Tuesday, 28 June 2011
Browse Internet

The proposal would require open Internet locations, such as cafes and libraries, to confirm a user's identity before granting access to the Web. Data harvested from the open Internet locations--including, but not limited to, IP addresses, browser histories, and records of who the user has interacted with--will then be reported to the Danish government under the guise of helping to combat terrorism.

This is on par with the censorship enacted by traditionally stricter countries such as Iran and China.

The effect of such a law? A strong push for the development of truly anonymous services that will make look Tor like a toy. The Ministry of Justice should focus on laws which are really needed, like stopping clueless people from thinking about systems they don't understand at all.

Hackers put Telstra in filter bind

Found on Australian IT on Friday, 24 June 2011
Browse Internet

The voluntary internet filter for child abuse is facing a major setback, with Telstra wavering on the commitment it made to the scheme last July.

"One option being considered is the blocking of a list of illegal child sexual abuse sites identified as being the worst globally by international policing body Interpol."

It is understood Telstra was last night still grappling with the decision as to whether to commit to the voluntary filter because of fears of reprisals from the internet vigilantes behind a spate of recent cyber attacks.

It always starts with "would somebody please think of the children", but this is just am excuse to get the filters in place because if you oppose those filters, you favor child abuse. Politicians know this and use it, what turns abused children into nothing but a tool. Blocking is pointless anyway since it won't make it magically go away.

ICANN approves plan to vastly expand top-level domains

Found on Ars Technica on Sunday, 19 June 2011
Browse Internet

ICANN apparently recognized that there's a continued interest in expanding gTLDs, and set about creating a mechanism to handle requests as they come in, rather than to consider them in batches on an ad-hoc basis.

Still, the FAQ also makes it clear that grabbing a gTLD won't be an exercise in casual vanity. Simply getting your application processed will cost $185,000 and, should it be approved, you'll end up being responsible for managing it.

As if there aren't any more important problems to solve, like the tight control and abuse of .com domain names by the US government. ICANN should first become truly independant before thinking about how to squeeze more money out of the DNS system. Not to mention that soon there will be domains like pay.pal, e.bay, g.mail, face.book, master.card or visa.card; and all that after users finally learned to pay a little attention to the links they click.

Facebook readying launch of iPad app?

Found on CNet News on Saturday, 18 June 2011
Browse Internet

The social-networking giant plans to introduce a free app in the coming weeks that is designed and tailored especially for the tablet computer's touch-screen interface.

iPad users have been begging Facebook for an iPad-native app since Apple began selling the device in April 2010, and it's likely that both Facebook and Apple would benefit from such an app.

A social network that's ridiculously overrated releases an app for a device that's ridiculously overrated from a company that's ridiculously overrated. Privacy violations just got cubed.

Man says he lost $500,000 in virtual currency heist

Found on The Register on Wednesday, 15 June 2011
Browse Internet

Rumors of the heist have been swirling since Monday, when a Bitcoin user named Allinvain claimed 25,000 Bitcoins, technically valued at close to $500,000, had mysteriously been transferred to an unknown user's account.

"Bitcoins technical details are complex cryptography and there's no way for us (as developers) to figure whether there was a real theft or not," Nils Schneider.

The true value of the loss "would be more like $300,000 and cause the price to drop to around $10. Also, at the time he acquired the coins they probably were worth only $1000 or less. So the loss is in terms of USD is more a theoretical value."

Bitcoin naturally still has its share of problems, some of which are design flaws. As pointed out before, having every user download the entire blockchain (which contains every transaction ever made) to verify it may be a key part in the validation of transactions in the p2p network, but it delays the first use by hours; not to mention the needed resources for the validation. You'll run into the same problem if you don't start the Bitcoin client for a longer time: it will download all blocks since the last run and validate them. What's even more of a issue is the lack of encrytion. Bitcoin tells users again and again to securely store the wallet (e.g. in a Truecrypt container) instead of having the wallet encrypted by default so that you cannot open it, or make a single transaction, without knowing the password. At times where users rely on passwords like 12345 it is almost a sin to assume they would set up Truecrypt. That all aside, the user in question did everything he could to get robbed: no encryption and keeping the wallet on an trojaned system even after he noticed it. The anonymity of Bitcoin is not to blame here, it's the user. It's like leaving a suitcase full of cash on your front lawn and then crying when someone takes it at night. There's no way to get the money back then either.

How Citigroup hackers broke in 'through the front door'

Found on Daily Mail on Monday, 13 June 2011
Browse Internet

They simply logged on to the part of the group's site reserved for credit card customers - and substituted their account numbers which appeared in the browser's address bar with other numbers.

It allowed them to leapfrog into the accounts of other customers - with an automatic computer programme letting them repeat the trick tens of thousands of times.

If that is all that it took - rotating through a bunch of numbers - it doesn't even qualify as a hack anymore. It also makes you wonder who the security professionals are these banks pay to avoid exactly those embarrassing mistakes.

Chrome extension allows users to hop WSJ's paywall

Found on CNet News on Sunday, 12 June 2011
Browse Internet

"Read WSJ" is the latest vulnerability in the armor of the paywall as a concept in the newspaper business. Work-arounds for the New York Times' paywall were being announced before it even went live, and the paper asked Twitter to shut down a feed that also attempted to circumvent the wall.

CNET reached Sara Blask, a spokesperson for DowJones--the Wall Street Journal's parent company, which itself is owned by Rupert Murdoch's News Corp.--on Sunday, who confirmed that the company is working with Google to have the extension taken down, but it has already proliferated to be available for download on other app markets and websites.

Rupert could simply implement the paywall he loves so much correctly: without logging in with your paid account, you cannot read any article. On the other hand, this would drastically lower the news in Google's index. Too bad, isn't it Rupert?

A cloud hangs over the sysadmin

Found on The Register on Friday, 10 June 2011
Browse Internet

Cloud computing will not result in job losses, not least because whatever promise such models may hold in principle, they will take years to enact in practice.

Cloud computing may not be about to put us all out of work, but it may change how some things are done.

The answer depends on whether we are talking about private or public cloud. In the first, an organisation both manages and exploits the cloud infrastructure; in the second the organisation exploits somebody else's infrastructure.

I really can't hear it anymore: cloud here, cloud there, as if it is the next big thing after sliced bread. It's the whole dot-com bubble again where everybody jumped onto what was the cloud back then: the Internet. People, as well as companies, are running towards these clouds like lemmings, only to realize, when it is too late, that it is not what they thought it would be. Then they will whine and blame others for believing some fairy-tales about how the cloud will increase their success by several orders of magnitude. Everybody is shocked when another company gets hacked and the personal information of millions leaks, yet they happily push every bit onto cloud services where nobody knows how secure they really are. So stop getting wet over that cloud and switch your brain on again, because it is nothing more than your old Internet.

Citigroup latest bank to disclose hack: 200k accounts compromised

Found on Ars Technica on Wednesday, 08 June 2011
Browse Internet

The system breached was Citi Account Online, which contains names, addresses, account numbers, and similar information. Citi claimed that more sensitive data-such as dates of birth, social security numbers, and the CVV card security codes-was held elsewhere, and has not been compromised.

The company said that the hacking was detected in early May by routine account monitoring, but offered no information on how the information was taken or by whom it might have been taken. Nor did Citi state whether the information had been used to perform fraudulent transactions.

More interesting than who did this is why the data was stored on Internet-facing servers in the first place. Citi may try to downplay the attack, but the leaked information is still good enough for more coordinated attacks against individuals, like spear-phishing.

LulzSec claims FBI affiliate hacked

Found on Boinboing on Friday, 03 June 2011
Browse Internet

The data posted online includes the personal info for 180 users at Infragard, which is a private-public partnership between the FBI and U.S. businesses "designed to protect IT systems from hacker attacks and other intrusions."

Though encrypted, the Infragard passwords were also cracked. Of their wide reuse for personal email and other online services, LulzSec adds: "they should be considered imbeciles from this moment until their moment of death."

Behind the public faces of the governments, things are dirty and an endless orgy of "he said, she said" accusations. If this project continues, some of the information and rumours will be so unbelievable and far-fetched that nobody would believe them; but at the same time, at least some parts are true.