security

Fine Print Link

Ever get frustrated by the convoluted fine print in credit card contracts that also enable the banks to modify the terms at any time? Dmitry Agarkov did something about it: Disappointed by the terms of the unsolicited offer for a credit card from Tinkoff Credit Systems in 2008, a 42-year-old Dmitry Agarkov from the city of Voronezh decided to hand write his own credits terms. No way this would pass here in the US.

Storage for Photographers Link

Paul Stamatiou gives a run down of his data storage system using Glacier. I still prefer my Synology system for on-site backup. Over the internet backup is still important too. Synology integrates easily with Glacier.

Dropbox Hacking Past Two-Factor Authentication Link

From SecurityAffairs.co: For example to attack the DropBox account zuz.85@hotmail.com the hacker could register a fake account zuz……85@hotmail.com In the second step of hacking process the attacker has to enable two-factor authentication for the fake account he created to obtain the emergency code generated at the end of the process. The code allows DropBox users to disable two factor authentication from his account in case of loss or theft.

Facebook Shadow Profiles Link

From Violet Blue at ZDNet: Facebook was accidentally combining user’s shadow profiles with their Facebook profiles and spitting the merged information out in one big clump to people they ‘had some connection to’ who downloaded an archive of their account with Facebook’s Download Your Information (DYI) tool. According to the admissions in its blog, posted late Friday afternoon, Facebook appears to be obtaining users' offsite email address and phone numbers and attempting to match them to other accounts.

Don't Even THINK of Using Encryption Software to Escape NSA Scrutiny Link

From the The Daily Kos: It gets worse. For those who seek to preserve their privacy by encrypting their communications, in effect shielding themselves from the ominipresent “Eye”, the gloves come off and they can be declared non-U.S. citizens for purposes of sidestepping any pesky “Constitutional” restrictions I think this is just the beginning of the privacy arms-race. Get ready for a very long cat and mouse game.

Persuading David Simon Link

That Maciej guy is super smart and very reasonable. This is how I want to argue on the internet. But Simon is not a fogey who doesn’t understand how powerful computers have become (though I feel that there are such people in positions of oversight in the House and Senate). I believe his error is in assuming that the analysis of these ‘computer-runs’ is any kind of bottleneck. There are powerful techniques for surfacing interesting features in any comprehensive list of interactions between human beings.

Giving it Away

Funny, I’ve been collecting and reading references for a very different article than this. But yesterday I deleted all of the words because The Guardian changed the story. The danger of ad companies like Google and Facebook isn’t that they are selling aggregated personal data. The danger is that they are aggregating unprecedented amounts of information. I applaud Google for fighting against the Justice Department but the problem, as The Guardian has shown, is that Google will lose much more than they will win.

The Real Story of Stuxnet Link

IEEE.org has a really nice overview of how Stuxnet worked. Simply sophisticated and terrifying. People think I don’t like to put everything in Google because of Google. The truth is I don’t like all of my life aggregated into one database because of things like Stuxnet. This is still the dark ages in electronic surveillance but Google and Facebook are kings right now. I’d be an idiot to assume they are not at the top of the hit list for every criminal and government hacking group.

The More You Know 1Password Password Generator

The 1Password browser plugin is great for generating strong randomly generated passwords. Did you know that you can add your own customization to the generated passwords or test your own for strength? In Safari, just open the password generate and generate a new password. Now click in the text box and add any string to it you like. If you want to test your own password, delete the generated one and type in yours.

Backup Doesn't Necessarily Mean Restorable Link

Eddie Smith on backups: A recent personal revelation: Backblaze, a system I just started using, doesn’t include .dmg files. If you thought the important documents in your secure disk images would be in your Backblaze backup during a data crisis, you’d be wrong. It’s disappointing since I just subscribed to Backblaze for a year. I already use Arq and S3 for backing up my encrypted disk images. I guess I’ll keep doing that.