Facebook bug could give spammers names, photos

Found on PC World on Wednesday, 11 August 2010
Browse Internet

It turns out that if someone enters the e-mail address of a Facebook user along with the wrong password, Facebook returns a special "Please re-enter your password" page, which includes the Facebook photo and full name of the person associated with the address.

The login page shows images of people, even when they've properly set their privacy settings to keep this information private, said Agarwal.

Facebook blamed the issue on a recently introduced bug.

Blaming a bug? Seriously? I know that bugs can be responsible for all sorts of strange behaviour, but this sounds more like a design failure. On the other hand, Facebook has never been much pro-privacy.

Defense Dept. demands that Wikileaks return files

Found on CNet News on Wednesday, 04 August 2010
Browse Internet

Geoff Morrell, the department's press secretary, said the military "demands that Wikileaks return immediately to the U.S. government all versions of documents obtained directly or indirectly from the Department of Defense databases or records" and permanently delete them.

But the problem with censoring Wikileaks is the difficulty of convincing an Internet service provider in Sweden--or the Swedish government, for that matter--that material that irks the Pentagon is necessarily also illegal under Swedish law.

Some members from congress probably like the idea of invading Sweden to get those files back. The same files which have been made available online and copied hundreds or thousands of times all around the world. The cat is out, there is no "returning" them.

Details of 100m Facebook users collected and published

Found on BBC News on Tuesday, 27 July 2010
Browse Internet

Ron Bowles used a piece of code to scan Facebook profiles, collecting data not hidden by the user's privacy settings.

Mr Bowles said he published the data to highlight privacy issues, but Facebook said it was already public information.

Earlier this year there was a storm of protest from users of the site over the complexity of Facebook's privacy settings. As a result, the site rolled out simplified privacy controls.

Well, it is public data; but all information entered should be considered private by default unless the user decides to make it public.

IE and Safari lets attackers steal user names and addresses

Found on The Register on Monday, 19 July 2010
Browse Internet

Among the most serious is a vulnerability in Apple's Safari and earlier versions of Microsoft's IE that exposes names, email addresses, and other sensitive information when a user visits a booby-trapped website. The attack exploits the browsers' autocomplete feature used to automatically enter commonly typed text into websites.

Grossman's research take those findings to new highs. In addition to the weaknesses in IE and Safari, he has uncovered flaws in Mozilla Firefox and Google Chrome that can expose passwords stored by the browsers.

Auto-completition is one of the first things being disabled in any browser setup. I've never considered that a good option from a security point of view. People try their best to have good passwords (except for a few) but at the same time let their browser save them; possibly even uncencrypted, defeating the whole purpose.

What's Really Going on Behind Murdoch's Paywall?

Found on Newser on Friday, 16 July 2010
Browse Internet

My sources say that not only is nobody subscribing to the website, but subscribers to the paper itself-who have free access to the site-are not going beyond the registration page. It's an empty world.

"Why would I get any of my clients to talk to the Times or the Sunday Times if they are behind a paywall? Who can see it? I can't even share a link and they aren't on search. It's as though their writers don't exist anymore."

So the Times and Sunday Times will vanish from the world of interesting sites. Big deal. There are enough ways to get the latest information online; it's not like Rupert has the only right to deliver news. This isn't the kind of competition he grew up with.

Google says China licence renewed by government

Found on BBC News on Saturday, 10 July 2010
Browse Internet

"We are very pleased that the government has renewed our ICP (internet content provider) licence and we look forward to continuing to provide web search and local products to our users in China," Google's lawyer David Drummond said in an e-mailed statement.

In January, Google said it might pull out of China following what it called a "sophisticated" cyber attack originating from the country.

"But many of the issues around why Google shut down its Chinese search page in the first place are still there."

Probably issues like censorship and handing over information to authorities. So much for standing up against a dictatorship, it seems.

Woot Asks AP To Pay Up For Quoting Woot Blog Post

Found on Techdirt on Monday, 05 July 2010
Browse Internet

In today's Woot offering, they mock the Associated Press for its coverage of the Woot acquisition, because the AP just happens to have also copied text from the awesome Woot letter.

The same AP that threatens bloggers for copying headlines and snippets. The same AP that insists it needs "hot news" to protect others from "free riding" on its work. And, most importantly, the same AP that has a famously ridiculous pricelist for quoting five words or more from an AP article.

And thus, the smart folks at Woot calculated that the AP owes Woot $17.50 for quoting Woot without permission.

Well, I think AP now starts to realize that their idea of a pricelist for quotes will backfire badly.

Blizzard To Require Real First and Last Names For Forums

Found on Slashdot on Monday, 05 July 2010
Browse Internet

Today, Blizzard announced that it intends to require usage of the real names of Battle.net posters for its StarCraft II forums before release, and for its World of Warcraft forums shortly before the release of World of Warcraft: Cataclysm.

"These changes will go into effect on all StarCraft II forums with the launch of the new community site prior to the July 27 release of the game, with the World of Warcraft site and forums following suit near the launch of Cataclysm."

That will work perfectly fine because nobody will ever think about registering with a fake name. It will also work because no player will be under 13. It will also work because no name exists twice. To enforce this requirement, Blizzard needs to verify users by having them send in offical/legal documents proving their identiy. Even if I would just remotely consider playing those games, I would refrain from doing so now.

Facebook moves to limit application's access to data

Found on BBC News on Wednesday, 30 June 2010
Browse Internet

Facebook has begun to roll out changes to the site in its efforts to appease critics of its privacy practices.

Last month it was forced to simplify its privacy settings after storms of protest from users and privacy groups.

When they were introduced, Facebook founder Mark Zuckerberg admitted the older settings had become too unwieldy and difficult for users.

Privacy on Facebook? Like that's going to happen.

China Falling in Domain Name Standings

Found on Enterprise Networking Planet on Saturday, 12 June 2010
Browse Internet

A year ago, the .cn county code Top Level Domain (ccTLD) for China was gaining fast and looked like it might overtake .com. In 2010, that's not quite the case, as overall demand for ccTLD registrations slowed, and VeriSign is reporting that .cn was actually on the decline.

"Many of these are low-priced promotional names that have now come up for renewal at a higher price," Pat Kane, vice president of naming services at VeriSign, told InternetNews.com. "The .cn registration decline was also based on the CNNIC (China Internet Network Information Center) registry's implementation of the real names directive from the Chinese government primarily around verifiable 'whois' data."

The .cn TLD isn't really something that great. 99% of the cases I've seen it, it's somewhat related to phishing, spam, pills, fakes and similar things; just like .biz domains. Combine that with the requirement for real whois information and voila, there's your reason.