Apple says opening its Pay app to banks would 'fundamentally diminish' security

Found on CNet News on Wednesday, 10 August 2016
Browse Various

It turns out Apple doesn't take well to banks teaming up to get their own products on the iPhone.

Apple responded to the banks' request last week with a strongly worded letter that came to light on Tuesday, explaining that letting the banks have their way would "fundamentally diminish the high level of security Apple aims to have on our devices."

If you cannot give someone full access to a device that is generally available to public for security reason then the security model is flawed by design. It's the backend that has to take care of the incoming data and filter out the bad from the good requests.

Facebook to force feed you web ads, whether you like it or not

Found on The Register on Tuesday, 09 August 2016
Browse Internet

The new policy calls for the social network to serve up ads regardless of the presence of ad-blocking software, and in exchange give users greater control over their ad preferences to cut down on intrusive or annoying ads.

The social network notes that, as a free service, it has to use the ads to bring in revenues.

Free service? Maybe users don't pay money, but they of course pay with their most private informations, their contacts, their lives. All of which is used by Facebook to make money; so that is not exactly free. However, if you never had an account with that harvester you could not care less.

Hackers Make the First-Ever Ransomware for Smart Thermostats

Found on Motherboard on Monday, 08 August 2016
Browse Hardware

Luckily, Andrew Tierney and Ken Munro, the two security researchers who created the ransomware, actually have no ill intention. They just wanted to make a point: some Internet of Things devices fail to take simple security precautions, leaving users in danger.

“It actually works, it locks the thermostat,” Munro, who last year found that a Samsung smart fridge leaked Gmail passwords, said sitting next to three thermostats that were displaying the famous quote from the movie Hackers: “Hack The Planet.”

People should be happy about this because it finally proves what researches have said over and over again: IoT devices are in most cases a total mess when it comes to security. The more you depend on them, the worse the problems can be.

More than 30 states offer online voting, but experts warn it isn’t secure

Found on Washington Post on Sunday, 07 August 2016
Browse Politics

Security experts and some senior Obama administration officials fear there is not enough protection for any ballots transmitted over the Internet. They are warning states that any kind of online voting is not yet secure and most likely will not be for years to come.

Experts say that states will not be able to protect themselves from experienced hackers, including foreign countries who could meddle with a U.S. election. That is one of the reasons that Ron Rivest, an Internet security expert and professor at the Massachusetts Institute of Technology, gives online voting security “a big fat F.”

Online votes are rigged, classic paper votes are rigged. Not much has changed.

Three times as bad as malware: Google shines light on pay-per-install

Found on The Register on Saturday, 06 August 2016
Browse Internet

The issue of PPI is three times greater than malware: no less than 60 million download attempts every week. That's something that the authors say represents "a major security threat". They estimate as many as five per cent of all browsers have been affected.

Some software builds in a 20-day delay before waking up so users don't immediately associate it with the free download they just installed. Some check in the computer's registry for anti-virus and that they're not already installed.

A major reason for this problem to even exist is the fact that the majority of users don't pay any attention during an installation and just happily click "Next" until everything is done.

Mozilla 404s '404 Not Found' pages: Firefox fills in blanks with archive.org copies

Found on The Register on Friday, 05 August 2016
Browse Internet

The "404 No More" feature uses copies of webpages from the Internet Archive's Wayback Machine to replace 404 "not found" errors with something more useful. If you visit a link to a page that's disappeared, Firefox will fetch from archive.org a version of the page before it vanished.

To try "404 No More", Firefox users will have to install Firefox Test Pilot, a browser plugin for English-language Windows, OS X and Linux Firefox builds that lets you experiment with in-development features.

The 404 return code exists for a reason, and Mozilla is in no position to change the behaviour. Enough websites out there use custom 404 pages to notify visitors about what happened. Breaking expected behaviour is not a decision Mozilla should do. A browser has to stick to protocol specification only; but Mozilla has made enough mistakes in the past, so this will only be another one on their list.

First Click: Apple should stop selling four-year-old computers

Found on The Verge on Thursday, 04 August 2016
Browse Hardware

Apart from the 12-inch MacBook, which was refreshed in April, every single Mac line from the mini to the Pro is designated as "Don’t Buy" because of how long it’s been since Apple updated them.

The Mac mini has gone 657 days since its last update, which was controversial in itself since Apple removed quad-core options and made the product harder to upgrade after purchase.

As long as enough fanbois put they cash on the counter, why bother to sell them better hardware?

Seagate inflates 12TB helium drives, floats them to IT bods to test

Found on The Register on Wednesday, 03 August 2016
Browse Hardware

Seagate thinks it can grow and profit from the world's expanding need for storage for reliably increasing exabytes-shipped demand, which flash has no hope of significantly denting in the next five to ten years.

In Seagate's view, the high-capacity disk sweet spot is 8TB over the next few quarters, and it has a cost advantage as its air-filled 8TB drive has fewer heads and platters than WD's 8TB helium-filled drive. Western Digital thinks it will be a 10TB sweet spot instead.

Seagate did not have the most reliable drives in the past; hopefully that changes with the new drives.

Black Hats control Jeep's steering, kill brakes

Found on The Register on Tuesday, 02 August 2016
Browse Various

Car hackers Charlie Miller and Chris Valasek have again hacked a 2014 Jeep Cherokee, this time by physically linking a laptop to commandeer its steering and kill the brakes.

The localised attack is similar to other CAN bus attacks in which researchers have popped locks, compromised steering, and brakes.

The pair say they've penned a paper, to be revealed at Black Hat, in which they recommend vehicle manufacturers should better lock down CAN buses. To help auto-makers along, the pair have built an intrusion detection system that can detect their attacks.

It will require a couple of deaths and lawsuits until an industry changes its behaviour and makes security the most important aspect in development.

Here's how to get Window 10 for free -- still

Found on CNet News on Monday, 01 August 2016
Browse Software

You qualify for the free upgrade if you use assistive technologies, which include such features as a magnifier to better see the screen, a narrator to read text aloud, keyboard shortcuts and an on-screen keyboard.

Microsoft has not announced a deadline for the free offer for users of assistive technologies, so those of you who still want Windows 10 should grab the freebie while it lasts.

10 has failed expectations and people do not want to upgrade unless forced. Prolonging the deadline won't magically increase the marketshare; Microsoft is simply headed into the entirely wrong direction.