Private Browsing – Jupiter Broadcasting

Privacy Perspectives | TechSNAP 409

Wes Payne — Fri, 09 Aug 2019 00:15:30 +0000

Show Notes: techsnap.systems/409

The post Privacy Perspectives | TechSNAP 409 first appeared on Jupiter Broadcasting.

A Future Without Servers | TechSNAP 358

chris — Thu, 01 Mar 2018 10:07:07 +0000

RSS Feeds:

HD Video Feed | MP3 Audio Feed | iTunes Feed | Torrent Feed

Become a supporter on Patreon:

Show Notes:

Revamp of ‘Pwned Passwords’ Boosts Privacy and Size of Database

In V2 of Pwned Passwords, launched last week, Hunt updated his password data set from 320 million passwords to 501 million new passwords, pulled from almost 3,000 breaches over the past year.

AgileBits Blog | Finding Pwned Passwords with 1Password

First, 1Password hashes your password using SHA-1. But sending that full SHA-1 hash to the server would provide too much information and could allow someone to reconstruct your original password. Instead, Troy’s new service only requires the first five characters of the 40-character hash.

Troy Hunt: I’ve Just Added 2,844 New Data Breaches With 80M Records To Have I Been Pwned

tl;dr – a collection of nearly 3k alleged data breaches has appeared with a bunch of data already proven legitimate from previous incidents, but also tens of millions of addresses that haven’t been seen in HIBP before. Those 80M records are now searchable

Apple’s China data migration includes iCloud keys, making data requests easier for authorities

Now, according to Apple, for the first time the company will store the keys for Chinese iCloud accounts in China itself. That means Chinese authorities will no longer have to use the U.S. courts to seek information on iCloud users and can instead use their own legal system to ask Apple to hand over iCloud data for Chinese users, legal experts said.

Microsoft’s Big Email Privacy Case Heads to the Supreme Court Tomorrow

Researchers Propose Improved Private Web Browsing System

In a paper (PDF) describing Veil, Frank Wang – MIT Computer Science and Artificial Intelligence Laboratory (CSAIL), Nickolai Zeldovich – MIT CSAIL, and James Mickens – Harvard, explain that the system is meant to prevent information leaks “through the file system, the browser cache, the DNS cache, and on-disk reflections of RAM such as the swap file.”

Your private browsing isn’t as incognito as you want it to be

Nearly 8,000 Security Flaws Did Not Receive a CVE ID in 2017

A record-breaking number of 20,832 vulnerabilities have been discovered in 2017 but only 12,932 of these received an official CVE identifier last year, a Risk Based Security (RBS) report reveals.

What is Serverless Architecture? What are its criticisms and drawbacks?

Serverless architectures refer to applications that significantly depend on third-party services (knows as Backend as a Service or “BaaS”) or on custom code that’s run in ephemeral containers (Function as a Service or “FaaS”), the best known vendor host of which currently is AWS Lambda.

The big promise:

NO SERVER MANAGEMENT

There is no need to provision or maintain any servers. There is no software or runtime to install, maintain, or administer.
FLEXIBLE SCALING

Your application can be scaled automatically or by adjusting its capacity through toggling the units of consumption (e.g. throughput, memory) rather than units of individual servers.

HIGH AVAILABILITY

Serverless applications have built-in availability and fault tolerance. You don’t need to architect for these capabilities since the services running the application provide them by default.

NO IDLE CAPACITY

You don’t have to pay for idle capacity. There is no need to pre- or over-provision capacity for things like compute and storage. For example, there is no charge when your code is not running.

Develop, test and deploy in a single environment, to any cloud provider. You don’t have to provision infrastructure or worry about scale. Serverless teams cut time to market in half.

Maybe the ultimate layer of abstraction.
Your not paying for un-utilized hardware/server time
The vendor, like Amazon, is patching/maintaining the server base for you. Removing the developer from the process.
Traditional server management roles may start to transition to service management, configuration, and manage all the abstractions AWS gives you. IE the admins role goes from one wrangeling the operating system, to wrangling layers of abstraction and independent services.

The big constraint:

No local disk, you send data in, and data comes out.
Not ideal for ongoing workloads.

The big secure:

Serverless Security: What’s Left to Protect?

Open Source FaaS:

OpenFaaS – Serverless Functions Made Simple

Serverless Functions Made Simple for Docker and Kubernetes

Feedback

The post A Future Without Servers | TechSNAP 358 first appeared on Jupiter Broadcasting.

STOP SOPA! | TechSNAP 32

chris — Thu, 17 Nov 2011 19:50:19 +0000

The Internet is facing its greatest challenge yet, we explain why the fight against online piracy has taken a turn towards Internet censorship.

PLUS – Steam and NASA were hacked this week, find out how bad the fallout is, and why Private browsing mode, might not be that private!

All that and more, on this week’s episode of TechSNAP!

Thanks to:

GoDaddy.com Use our codes TechSNAP10 to save 10% at checkout, or TechSNAP20 to save 20% on hosting!

New special offer: techsnap11 $1.99 per month Economy Hosting for 3 months! – Expires Dec 31st 2011.

Direct Download Links:

Subscribe via RSS and iTunes:

Fill out my Wufoo form!

Show Notes:

Romanian hacker accused of breaking into NASA

Authorities of the Romania Directorate for Investigating Organized Crime and Terrorism (DIICOT) have arrested a 26 year old who is accused to breaking in to multiple servers at NASA
The authorities claim that the attacker destroyed protected data and restricted access to it, resulting in a loss of over $500,000
Charges against Robert Butyka include:
obtaining unauthorized access and causing severe disruptions to a computer system
modifying, damaging and restricting access to data without authorization
possession of hacking programs
“Through criminal activity, the accused severely affected the operation of computer servers by introducing, modifying and damaging electronic data and restricting access to it,” DIICOT said in a statement.
He is to be tried in Romania, as there has been no extradition request.

Valve: Hackers Accessed Steam Users’ Encrypted Passwords, Credit Cards

Attackers managed to gain access to the user database
The database contained: username, email address, hashed and salted password, game purchase history, billing address, and encrypted credit card data.
Valve had not yet determined if the database had been copied or viewed
Valve originally believed that only the user forums had been compromised, but during the investigation it was determined that the compromised extended to all user data
Valve reports that they have not noticed an increase in login attempts and have not received any reports of misused credit cards. This suggests that the data was either not taken, or is sufficiently protected to delay its use.
If the database was taken, I would expect to see a spear phishing attack, using the name, username and email address of the users to ask them to ‘reset’ their steam password.
All forum accounts will require a password reset, however valve is not forcing a password reset on all steam accounts.

Private Browsing may not be as private as advertised

Private Browsing mode stops the browser from recording history, and isolates your cookies, not sending cookies from regular browsing mode, and removing the new cookies when you leave private mode.
Research has found that many plugins do not respect private mode, especially Adobe Flash, which has its own separate cookie system. This means a site that you visited in private mode, could read those cookies even in regular mode, and vice versa . Flash has since been fixed, make sure you upgrade.
Chrome and Internet Explorer have taken to automatically disabling plugins in private mode

Feedback:

Roger Writes… 3 Questions for you guys…
Allan does use windows, for gaming, and for doing the podcast
For a list of the advantages of ZFS, you should watch the ZFS episode of TechSNAP. For the other file systems, really you can only compare them against another file system. UFS has advantages over ext2/3, specifically with its ability to store millions of files in a single directory.
For checking your email over 3G/4G, you should still use SSL in your phone’s mail client.
Arturo writes… Degree or Certs?

Round Up:

We already have dns level blocking of websites in Belgium. This is what you get when going to the piratebay…
Facebook confirms images of porn and violence, is investigating UPDATE: Facebook identifies those behind coordinated spam attack
[Duqu computer virus Detected by Iran civil defense organization (https://thehackernews.com/2011/11/duqu-computer-virus-detected-by-iran.html)
Researchers are fairly confident that Duqu was written by the same group as Stuxnet, and that is has more capabilities than we know about
Ebury, a new SSH trojan
Microsoft spends $7.5m on IP addresses
Bind 9 has a potential 0 day exploit

SOPA Box:

The post STOP SOPA! | TechSNAP 32 first appeared on Jupiter Broadcasting.