Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Senate Bill Would Ban Most Bulk Surveillance

Soulskill posted 4 hours ago | from the assuming-they-can-pass-anything dept.

Government 129

An anonymous reader writes: Today Senator Patrick Leahy (D-VT) introduced a bill that would ban bulk collection of telephone records and internet data for U.S. citizens. This is a stronger version of the legislation that passed the U.S. House in May, and it has support from the executive branch as well. "The bill, called the USA Freedom Act, would prohibit the government from collecting all information from a particular service provider or a broad geographic area, such as a city or area code, according to a release from Leahy's office. It would expand government and company reporting to the public and reform the Foreign Intelligence Surveillance Court, which reviews NSA intelligence activities. Both House and Senate measures would keep information out of NSA computers, but the Senate bill would impose stricter limits on how much data the spy agency could seek."

Ask Slashdot: Preparing an Android Tablet For Resale?

timothy posted yesterday | from the link-free-cloth-and-a-.45 dept.

Privacy 110

UrsaMajor987 (3604759) writes I have a Asus Transformer tablet that I dropped on the floor. There is no obvious sign of damage but It will no longer boot. Good excuse to get a newer model. I intend to sell it for parts (it comes with an undamaged keyboard) or maybe just toss it. I want to remove all my personal data. I removed the flash memory card but what about the other storage? I know how to wipe a hard drive, but how do you wipe a tablet? If you were feeling especially paranoid, but wanted to keep the hardware intact for the next user, what would you do?

Private Data On iOS Devices Not So Private After All

timothy posted 3 days ago | from the it's-totally-intuitive dept.

IOS 100

theshowmecanuck (703852) writes with this excerpt from Reuters summarizing the upshot of a talk that Jonathan Zdziarski gave at last weekend's HOPE conference: Personal data including text messages, contact lists and photos can be extracted from iPhones through previously unpublicized techniques by Apple Inc employees, the company acknowledged this week. The same techniques to circumvent backup encryption could be used by law enforcement or others with access to the 'trusted' computers to which the devices have been connected, according to the security expert who prompted Apple's admission. Users are not notified that the services are running and cannot disable them, Zdziarski said. There is no way for iPhone users to know what computers have previously been granted trusted status via the backup process or block future connections. If you'd rather watch and listen, Zdziarski has posted a video showing how it's done.

FBI Studied How Much Drones Impact Your Privacy -- Then Marked It Secret

timothy posted 3 days ago | from the awfully-suggestive dept.

Government 139

v3rgEz writes When federal agencies adopt new technology, they're required by law to do Privacy Impact Assessments, which is exactly what the FBI did regarding its secretive drone program. The PIAs are created to help the public and federal government assess what they're risking through the adoption of new technology. That part is a little trickier, since the FBI is refusing to release any of the PIA on its drone project, stating it needs to be kept, er, private to protect national security.

Russia Posts $110,000 Bounty For Cracking Tor's Privacy

Soulskill posted 4 days ago | from the what-happens-in-siberia-stays-in-siberia dept.

Encryption 97

hypnosec writes: The government of Russia has announced a ~$110,000 bounty to anyone who develops technology to identify users of Tor, an anonymising network capable of encrypting user data and hiding the identity of its users. The public description (in Russian) of the project has been removed now and it only reads "cipher 'TOR' (Navy)." The ministry said it is looking for experts and researchers to "study the possibility of obtaining technical information about users and users' equipment on the Tor anonymous network."

Sony Agrees To $17.75m Settlement For 2011 PSN Attack

Unknown Lamer posted 5 days ago | from the claim-your-prize-now dept.

Sony 66

mrspoonsi (2955715) writes with word that Sony has agreed to settle a class action lawsuit brought by PSN users affected by the 2011 breach. From the article: Sony has finally agreed to a preliminary settlement of $15m, which may be able to appease most of the customers that suffered from this attack. The PlayStation Network users that did not partake in the "Welcome Back" program that Sony unveiled shortly after their online services were brought back will be able to choose from two of several options for compensation: One PlayStation 3 or PlayStation Portable game selected from a list of 14 games; three PlayStation 3 themes selected from a list of six themes; or a three-month subscription to PlayStation Plus free of charge. Claiming these benefits will be done on a first come, first serve basis ...The settlement isn't just about free games or services. Customers with documented identity theft charges are eligible for up to $2,500 per claim.

Dropbox Head Responds To Snowden Claims About Privacy

samzenpus posted 5 days ago | from the protect-ya-neck dept.

Security 175

First time accepted submitter Carly Page writes When asked for its response to Edward Snowden's claims that "Dropbox is hostile to privacy", Dropbox told The INQUIRER that users concerned about privacy should add their own encryption. The firm warned however that if users do, not all of the service's features will work. Head of Product at Dropbox for Business Ilya Fushman says: "We have data encrypted on our servers. We think of encryption beyond that as a users choice. If you look at our third-party developer ecosystem you'll find many client-side encryption apps....It's hard to do things like rich document rendering if they're client-side encrypted. Search is also difficult, we can't index the content of files. Finally, we need users to understand that if they use client-side encryption and lose the password, we can't then help them recover those files."

Verizon's Offer: Let Us Track You, Get Free Stuff

samzenpus posted 5 days ago | from the do-your-worst dept.

Verizon 75

mpicpp points out a new program from Verizon that is perfect if you don't mind being tracked. Are you comfortable having your location and Web browsing tracked for marketing purposes? If so, Verizon's got a deal for you. The wireless giant announced a new program this week called 'Smart Rewards' that offers customers credit card-style perks like discounts for shopping, travel and dining. You accrue points through the program by doing things like signing onto the Verizon website, paying your bill online and participating in the company's trade-in program. Verizon emphasizes that the data it collects is anonymized before it's shared with third parties. The program is novel in that offers Verizon users some compensation for the collection of their data, which has become big business for telecom and tech companies. Some privacy advocates have pushed data-collecting companies to reward customers for their personal information in the interest of transparency.

Privacy Lawsuit Against Google Rests On Battery Drain Claims

Soulskill posted about a week ago | from the discovery-will-be-powered-by-bing dept.

Google 175

Jason Koebler writes: According to plaintiffs in a class-action lawsuit against Google, personal information about you and your browsing, email, and app-using habits that is regularly sent between apps on you Android phone is harming your battery life. As odd as it sounds, this minor yet demonstrable harm is what will allow their lawsuit to go forward. A federal judge ruled that the claim "requires a heavily and inherently fact-bound inquiry." That means there's a good chance we're about to get a look into the ins and outs of Google's advertising backbone: what information is shared with whom, and when.

EFF Releases Wireless Router Firmware For Open Access Points

Soulskill posted about a week ago | from the secure-is-as-secure-does dept.

Electronic Frontier Foundation 56

klapaucjusz writes: The EFF has released an experimental router firmware designed make it easy to deploy open (password-less) access points in a secure manner. The EFF's firmware is based on the CeroWRT fork of OpenWRT, but appears to remove some of its more advanced routing features. The EFF is asking for help to further develop the firmware. They want the open access point to co-exist on the same router as your typical private and secured access point. They want the owner to be able to share bandwidth, but with a cap, so guests don't degrade service for the owner. They're also looking to develop a network queueing, a minimalist web UI, and an auto-update mechanism. The EFF has also released the beta version of a plug-in called Privacy Badger for Firefox and Chrome that will prevent online advertisers from tracking you.

Black Hat Presentation On Tor Cancelled, Developers Working on Bug Fix

Soulskill posted about a week ago | from the you-can't-say-that-on-television dept.

Privacy 51

alphadogg writes A presentation on a low-budget method to unmask users of a popular online privacy tool Tor will no longer go ahead at the Black Hat security conference early next month. The talk was nixed by the legal counsel with Carnegie Mellon's Software Engineering Institute after a finding that materials from researcher Alexander Volynkin were not approved for public release, according to a notice on the conference's website. Tor project leader Roger Dingledine said, "I think I have a handle on what they did, and how to fix it. ... Based on our current plans, we'll be putting out a fix that relays can apply that should close the particular bug they found. The bug is a nice bug, but it isn't the end of the world." Tor's developers were "informally" shown materials about the bug, but never saw any details about what would be presented in the talk.

Exodus Intelligence Details Zero-Day Vulnerabilities In Tails OS

timothy posted about a week ago | from the compared-to-what? dept.

Operating Systems 132

New submitter I Ate A Candle (3762149) writes Tails OS, the Tor-reliant privacy-focused operating system made famous by Edward Snowden, contains a number of zero-day vulnerabilities that could be used to take control of the OS and execute code remotely. At least that's according to zero-day exploit seller Exodus Intelligence, which counts DARPA amongst its customer base. The company plans to tell the Tails team about the issues "in due time", said Aaron Portnoy, co-founder and vice president of Exodus, but it isn't giving any information on a disclosure timeline. This means users of Tails are in danger of being de-anonymised. Even version 1.1, which hit public release today (22 July 2014), is affected. Snowden famously used Tails to manage the NSA files. The OS can be held on a USB stick and leaves no trace once removed from the drive. It uses the Tor network to avoid identification of the user, but such protections may be undone by the zero-day exploits Exodus holds.

A New Form of Online Tracking: Canvas Fingerprinting

Unknown Lamer posted about a week ago | from the subverting-features-for-evil-and-profit dept.

Privacy 194

New submitter bnortman (922608) was the first to write in with word of "a new research paper discussing a new form of user fingerprinting and tracking for the web using the HTML 5 <canvas> ." globaljustin adds more from an article at Pro Publica: Canvas fingerprinting works by instructing the visitor's Web browser to draw a hidden image. Because each computer draws the image slightly differently, the images can be used to assign each user's device a number that uniquely identifies it. ... The researchers found canvas fingerprinting computer code ... on 5 percent of the top 100,000 websites. Most of the code was on websites that use the AddThis social media sharing tools. Other fingerprinters include the German digital marketer Ligatus and the Canadian dating site Plentyoffish. ... Rich Harris, chief executive of AddThis, said that the company began testing canvas fingerprinting earlier this year as a possible way to replace cookies ...

The Loophole Obscuring Facebook and Google's Transparency Reports

samzenpus posted about a week ago | from the fuzzy-math dept.

Facebook 18

Jason Koebler writes The number of law enforcement requests coming from Canada for information from companies like Facebook and Google are often inaccurate thanks to a little-known loophole that lumps them in with U.S. numbers. For example, law enforcement and government agencies in Canada made 366 requests for Facebook user data in 2013, according to the social network's transparency reports. But that's not the total number. An additional 16 requests are missing, counted instead with U.S. requests thanks to a law that lets Canadian agencies make requests with the U.S. Department of Justice.

Activist Group Sues US Border Agency Over New, Vast Intelligence System

samzenpus posted about a week ago | from the lets-see-what-you-have-there dept.

Government 82

An anonymous reader writes with news about one of the latest unanswered FOIA requests made to the Department of Homeland Security and the associated lawsuit the department's silence has brought. The Electronic Privacy Information Center (EPIC) has sued the United States Customs and Border Protection (CBP) in an attempt to compel the government agency to hand over documents relating to a relatively new comprehensive intelligence database of people and cargo crossing the US border. EPIC's lawsuit, which was filed last Friday, seeks a trove of documents concerning the 'Analytical Framework for Intelligence' (AFI) as part of a Freedom of Information Act (FOIA) request. EPIC's April 2014 FOIA request went unanswered after the 20 days that the law requires, and the group waited an additional 49 days before filing suit. The AFI, which was formally announced in June 2012 by the Department of Homeland Security (DHS), consists of "a single platform for research, analysis, and visualization of large amounts of data from disparate sources and maintaining the final analysis or products in a single, searchable location for later use as well as appropriate dissemination."

Researcher Finds Hidden Data-Dumping Services In iOS

samzenpus posted about a week ago | from the don't-take-my-data-bro dept.

Privacy 98

Trailrunner7 writes There are a number of undocumented and hidden features and services in Apple iOS that can be used to bypass the backup encryption on iOS devices and remove large amounts of users' personal data. Several of these features began as benign services but have evolved in recent years to become powerful tools for acquiring user data.

Jonathan Zdziarski, a forensic scientist and researcher who has worked extensively with law enforcement and intelligence agencies, has spent quite a bit of time looking at the capabilities and services available in iOS for data acquisition and found that some of the services have no real reason to be on these devices and that several have the ability to bypass the iOS backup encryption. One of the services in iOS, called mobile file_relay, can be accessed remotely or through a USB connection can be used to bypass the backup encryption. If the device has not been rebooted since the last time the user entered the PIN, all of the data encrypted via data protection can be accessed, whether by an attacker or law enforcement, Zdziarski said.
Update: 07/21 22:15 GMT by U L : Slides.

Snowden Seeks To Develop Anti-Surveillance Technologies

samzenpus posted about a week ago | from the snowden-brand dept.

Privacy 129

An anonymous reader writes Speaking via a Google Hangout at the Hackers on Planet Earth Conference, Edward Snowden says he plans to work on technology to preserve personal data privacy and called on programmers and the tech industry to join his efforts. "You in this room, right now have both the means and the capability to improve the future by encoding our rights into programs and protocols by which we rely every day," he said. "That is what a lot of my future work is going to be involved in."

Ars Editor Learns Feds Have His Old IP Addresses, Full Credit Card Numbers

samzenpus posted about two weeks ago | from the no-stone-left-unturned dept.

United States 216

mpicpp writes with the ultimate results of Ars's senior business editor Cyrus Farivar's FOIA request. In May 2014, I reported on my efforts to learn what the feds know about me whenever I enter and exit the country. In particular, I wanted my Passenger Name Records (PNR), data created by airlines, hotels, and cruise ships whenever travel is booked. But instead of providing what I had requested, the United States Customs and Border Protection (CBP) turned over only basic information about my travel going back to 1994. So I appealed—and without explanation, the government recently turned over the actual PNRs I had requested the first time.

The 76 new pages of data, covering 2005 through 2013, show that CBP retains massive amounts of data on us when we travel internationally. My own PNRs include not just every mailing address, e-mail, and phone number I've ever used; some of them also contain: The IP address that I used to buy the ticket, my credit card number (in full), the language I used, and notes on my phone calls to airlines, even for something as minor as a seat change.

Australian Website Waits Three Years To Inform Customers of Data Breach

Unknown Lamer posted about two weeks ago | from the better-never-than-late dept.

Privacy 35

AlbanX (2847805) writes Australian daily deals website Catch of the Day waited three years to tell its customers their email addresses, delivery addresses, hashed passwords, and some credit card details had been stolen. Its systems were breached in April 2011 and the company told police, banks and credit cards issuers, but didn't tell the Privacy Commissioner or customers until July 18th.

Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...