WhatsApp won't comply with India's order to delete user data (updated)

Found on Engadget on Thursday, 29 September 2016
Browse Legal-Issues

According to Mashable, however, WhatsApp has no plan to comply with the court order and it will have "no impact on the planned policy and terms of service updates."

The case before the Delhi High Court was brought by two Indian students who alleged the new terms of service will jeopardize the privacy and "severely compromises" the rights of over 100 million active WhatsApp users in their country.

WhatsApp has now issued a statement saying it will follow the court order in India.

Facebook tested the water and failed. In the end, India could have blocked WhatsApp and Facebook, what would drive a lot of users to other services; and thanks to the networking nature, other users would have followed.

HP: Disabling 3rd-party ink ensures “best printing experience”

Found on Ars Technica on Wednesday, 28 September 2016
Browse Hardware

HP Inc. today said it will restore the ability of certain OfficeJet printers to use third-party ink cartridges, after being criticized for issuing a firmware update that rejects non-HP ink.

This customer-friendly move may just be a one-time thing. HP said it will continue to use security features that "protect our IP including authentication methods that may prevent some third-party supplies from working."

Excuses. The industry sells printers for cheap because they plan on making money from ink and toner by abusing IP when replacements from 3rd parties work just as fine. That's like a car manufacturer who does not want to let you fill up your tank on a station of your choice and instead forces you to buy their own overpriced gasoline.

Facebook told to stop collecting German WhatsApp data

Found on BBC News on Tuesday, 27 September 2016
Browse Legal-Issues

"After the acquisition of WhatsApp by Facebook two years ago, both parties have publicly assured [users] that data will not be shared between them," said commissioner Johannes Caspar in a statement.

EU and US regulators reacted with caution, saying that the update needed to be investigated. The UK's Information Commissioner is also looking into the changes.

Promises are worth nothing, especially when they are standing between a company and money.

As we speak, teen social site is leaking millions of plaintext passwords

Found on Ars Technica on Monday, 26 September 2016
Browse Internet

A social hangout website for teenage girls has sprung a leak that's exposing plaintext passwords protecting as many as 5.5 million user accounts. As this post went live, all attempts to get the leak plugged had failed.

It's bad enough that a SQL-injection vulnerability that dumps passwords remained unfixed even after it was privately reported. It's even worse that the database contained plaintext passwords.

Storing passwords in plaintext should be a criminal offense. There just is no excuse for it.

DDoS Attacks Heading Toward 1-Terabit Record

Found on eWEEK on Sunday, 25 September 2016
Browse Internet

On Sept. 20, Krebs tweeted that his site was hit with a DDoS attack of 665G bps. A day later, on Sept. 21, Octave Klaba, founder of OVH tweeted that his network was affected on Sept. 20 by simultaneous DDoS attacks approaching 1T bps. The peak attacks came in at 191G bps and 799G bps.

Akamai decided on Sept. 22 to drop support for Krebs, who had been a pro bono customer on the platform. An Akamai spokesperson said that decision to drop support for Krebs wasn't made lightly, but the costs and impact of defending against the large DDoS were non-trivial.

That should be pretty obvious. Connections are getting faster, available bandwidth increases and more and more (IoT) devices are going online. It's just a natural development. It would be way more newsworthy if the attacks stay the same.

Key lawmakers accuse Russia of campaign to disrupt U.S. election

Found on Washington Post on Saturday, 24 September 2016
Browse Politics

“At the least, this effort is intended to sow doubt about the security of our election and may well be intended to influence the outcomes,” the statement said. “We believe that orders for the Russian intelligence agencies to conduct such actions could come only from very senior levels of the Russian government.”

White House officials have repeatedly insisted that they are awaiting the outcome of a formal FBI investigation, even though U.S. intelligence are said to have concluded with “high confidence” that Russia was responsible for the DNC breach and other attacks.

They don't need Russia for scaremongering. Irregularities have happened before, and electronic voting has been proven to be insecure. Plus, all that aside, it's not like the US has never attempted to influence the elections of other countries.

Double KO! Capcom's Street Fighter V installs hidden rootkit on PCs

Found on The Register on Friday, 23 September 2016
Browse Various

Capcom claims it uses the driver to stop players from hacking the high-def beat 'em up to cheat. Unfortunately, the code is so badly designed, it opens up a full-blown local backdoor.

It switches off a crucial security defense in the operating system, then runs whatever instructions are given to it by the application, and then switches the protection back on.

Another example why it might not be a bad idea to be able to hold a company liable when making obvious security mistakes.

Police accidentally record themselves trumping up charges, lawsuit says

Found on CNet News on Thursday, 22 September 2016
Browse Legal-Issues

What is then heard seems to be a discussion of what charges might be brought against Picard.

"So, we can hit him with reckless use of the highway by a pedestrian and creating a public disturbance, and whatever he said," says Jacobi.

Torneo adds: "And then we claim that, um, in backup, we had multiple people, um, they didn't want to stay and give us a statement, so we took our own course of action."

To the lay ear, this all sounds suspicious and precisely the sort of thing some citizens fear happens too often.

With officers like that it is no surprise that the citizens don't trust them.

Contentious Windows 10 upgrade ads removed from Windows 7, 8.1

Found on Ars Technica on Wednesday, 21 September 2016
Browse Software

Broadly speaking, the Get Windows 10 program seems to have been successful. Windows 10's uptake was unprecedented for a Windows release, with more than 350 million people now using the operating system—a number that hasn't been updated for several weeks.

The removal of the software isn't going to undo the reputational harm that Microsoft deliberately caused itself with the aggressive upgrade tactics, but it should at least provide some reassurance that Windows 7 or 8.1 will never again try to push a major update.

Successful? If you want to called forced upgrades which are shoved down users' throats by malware- and scareware-like tactics successful, then yes.

CloudFlare offers web encryption up the wazoo

Found on The Register on Tuesday, 20 September 2016
Browse Internet

Just over a week since Google warned it would start labeling HTTP websites as "not secure," CloudFlare promises to help the many, many website owners who have a mix of both secure and insecure content on their sites, through what it is calling "automatic HTTPS rewrites."

CloudFlare is offering – incorporated into its existing services for no additional fee – a cutting-edge level of encryption that is mildly useful right now but should become increasingly useful as the drive to move to an encrypted internet becomes a reality.

You definatively do not want to use CloudFlare along with SSL. No matter what, they require you to give up on full enryption between you and your visitors. CloudFlare can, and will, analyze all traffic, so essentially breaking the security and privacy visitors think they have.