Monthly Shaarli

All links of one month in a single page.

August, 2017

Sun on Privacy: 'Get Over It' | WIRED

At the Monday night launch of Sun Microsystems' new Jini technology, CEO Scott McNealy calls consumer privacy a non-issue. The Federal Trade Commission has another view. By Polly Sprenger.

Google to Comply With EU Search Demands to Avoid More Fines - Bloomberg

Google will comply with Europe’s demands to change the way it runs its shopping search service, a rare instance of the internet giant bowing to regulatory pressure to avoid more fines.

Bitdefender: Heap Buffer Overflow via 7z LZMA | landave's blog

Blog about anti-virus software and its issues.

Advisory: AccuWeather iOS app sends location information to data monetization firm

The AccuWeather application for iOS requests location access under the premise of providing users localized severe weather alerts, critical…

How Google is secretly recording you through your mobile, monitoring millions of conversations

DID you know that Google has been recording you without your knowledge?

Chromium Blog: Next steps toward more connection security

In January, we began our quest to improve how Chrome communicates the connection security of HTTP pages. Chrome now marks HTTP pages as “Not secure” if they have password or credit card fields. Beginning in October 2017, Chrome will show the “Not secure” warning in two additional situations: when users enter data on an HTTP page, and on all HTTP pages visited in Incognito mode.

[Support] uBlock Origin - Add-on Support - Mozilla Discourse
  • Chromium-based browsers do not support user styles
  • Chromium-based browsers can’t block data URI-based requests through the webRequest API.
  • Chromium-based browsers are being “infested” by Instart Logic tech which works around blockers and worst, around browser privacy settings (they may start “infecting” Firefox eventually, but that is not happening now).
  • I am not aware of any anti-fingerprinting initiative taken up with Chromium, unlike with Firefox.
  • Etc.

There is much more I could list here. It baffles me that some people thinks Firefox is becoming a “Chrome clone”, it’s just not the case, it’s just plain silly to make such statement.

Italy’s Trento province to boost open source in schools | Joinup

The autonomous province of Trento (Italy) is revitalising its promotion of the use of free and open source software in education. In the coming months, the province will provide schools with training on free software and open standards.

Sci-Hub’s cache of pirated papers is so big, subscription journals are doomed, data analyst suggests | Science | AAAS
Amazon (AMZN) owns a whole collection of secret brands, USPTO trademark filings reveal — Quartz

You've probably been buying way more things from Amazon than you realize.

Facebook : les sites rapides favorisés dans le fil d'actualité

Trop d'abandons en cours de route

Des appareils Apple victimes de ransomwares

Une demande de rançon de 50 $ se répand

Broadpwn: Remotely Compromising Android and iOS via a Bug in Broadcom’s Wi-Fi Chipsets | Exodus Intelligence
kp-documentation/Backup-Intro.md at master · kororaproject/kp-documentation · GitHub

kp-documentation - Documentation for all of Korora

Krita Foundation: Update | Krita

Krita.org

Rust-based framework to contain untrustworthy apps in AppContainers - rust
flying-sandbox-monster/README.md at master · trailofbits/flying-sandbox-monster · GitHub

flying-sandbox-monster - Sandboxed, Rust-based, Windows Defender Client

Personal Info of 650,000 Voters Discovered on Poll Machine Sold on Ebay

When 650 thousand Tennesseans voted in the Memphis area, they probably didn’t expect their personal information would eventually be picked apart at a hacker conference at Caesars Palace Las Vegas.

FYI, This "Better History" extension in Chrome has a history of selling browser ... | Hacker News
The odd post requests I noticed to uaswitcher.org in wireshark while I was tryin... | Hacker News
Google’s new program to track shoppers sparks a federal privacy complaint - The Washington Post

A program hailed as an advertising breakthrough leads to a privacy complaint before a federal agency.

Le pilote MesInfos, 1 an après | MesInfos
Patently creepy: Facebook’s plan to ‘read emotions’ through your smartphone — RT Viral
Demain, ces robots aspirateurs vendront peut-être les secrets de votre logement à Google

Le PDG d’iRobot souhaiterait partager les données cartographiques amassées par ses machines sur l’intérieur de ses clients avec un géant américain comme Google, Amazon ou Apple.

It is easy to expose users' secret web habits, say researchers - BBC News

Porn browsing habits and confidential documents are found in supposedly anonymised data.

Time Well Spent
The Secret Psychology of Facebook
Why email is addictive (and what to do about it) – Mind Hacks
Data Selfie _ Home

Data Selfie is a browser extension that tracks you while you are on Facebook to show you your own data traces and reveal how machine learning algorithms use your data to gain insights about your personality.

The tool explores our relationship to the online data we leave behind as a result of media consumption and social networks - the information you share consciously and unconsciously.

Arrière, foutues notifications ! | Denys Malengreau | Pulse | LinkedIn

Sans faire preuve de cynisme quelconque, je pense qu’il est important de souligner que nous, les utilisateurs, et eux, les plates-formes « gratuites », nous avons des objectifs singulièrement antinomiques. Les nôtres, c'est de passer plus de temps avec nos proches, d'organiser nos vacances ou encore de faire aboutir ce projet qui nous tient à cœur. Les leurs, c'est de nous faire passer un maximum de temps sur leur plate-forme, de nous faire cliquer et scroller le plus possible et de nous exposer au plus grand nombre de publicités. Ces objectifs sont fondamentalement opposés. Personne ne se dit sur son lit de mort : « J'aurais aimé passer plus de temps sur Facebook » ou « si seulement j’avais pu être un peu plus narcissique ».

As others have pointed out, it's an advertising technique called retargeting. He... | Hacker News
Axolotl: A Keylogger for iPhone and Android – Tomas Reimers – Medium

A Guide to Reasoning About Unintuitive Machine-Learning Problems

When it comes to internet privacy, be very afraid, analyst suggests | Harvard Gazette

Cybersecurity expert Bruce Schneier, a fellow with the Berkman Klein Center for Internet & Society, discusses what consumers can do to protect themselves from government and corporate surveillance.

Reverse Engineering My Home Security System: Decompiling Firmware Updates

...still thinking of a genius subtitle, but I break things.

How Google is secretly recording YOU through your mobile, monitoring millions of conversations every day and storing the creepy audio files
Google Online Security Blog: Moving towards a more secure web

To help users browse the web safely, Chrome indicates connection security with an icon in the address bar. Historically, Chrome has not explicitly labelled HTTP connections as non-secure. Beginning in January 2017 (Chrome 56), we’ll mark HTTP pages that collect passwords or credit cards as non-secure, as part of a long-term plan to mark all HTTP sites as non-secure.

[META] Support anti-fingerprinting protection

As part of the Tor uplift project, we are going to implement anti-fingerprinting protection [1] in Firefox.

This bug is used as the meta bug of all anti-fingerprinting features.

Reference:
[1] Cross-Origin Fingerprinting Unlinkability
https://www.torproject.org/projects/torbrowser/design/#fingerprinting-linkability

Reverse image search algorithm

This demo showcases a reverse image search algorithm which performs 2D affine transformation-invariant partial image-matching in sublinear time. The algorithm compares an input image to its database of preprocessed images and determines if the input matches any image in the database. The database need not contain the original image as inputs can be matched to any 2D affine transformation of the original. This means that images which have been scaled (uniformly or non-uniformly), skewed, translated, cropped or rotated (or have undergone any combination of these transformations) can be identified as coming from the same source image (Figure 1).

The algorithm runs in sublinear time with respect to the number of images in the database regardless of the number of transformations applied. Note that if image-matching could not be done in sublinear time it would not function at the scale that the likes of Google or Microsoft require.

Children work in Congolese mines where cobalt is extracted for smartphones | Hacker News
Troy Hunt: Passwords Evolved: Authentication Guidance for the Modern Era

In the beginning, things were simple: you had two strings (a username and a password) and if someone knew both of them, they could log in. Easy. But the ecosystem in which they were used was simple too, for example in MIT's Time-Sharing Computer, considered to be the first computer

The NSA Uses Powerful Toolbox in Effort to Spy on Global Networks - SPIEGEL ONLINE

The NSA's TAO hacking unit is considered to be the intelligence agency's top secret weapon. It maintains its own covert network, infiltrates computers around the world and even intercepts shipping deliveries to plant back doors in electronics ordered by those it is targeting.

Le blog de nlehuby | Florilège de requêtes Overpass utiles pour les bus
Slain activist's lawyers latest known targets of spyware sold to Mexican government - Technology & Science - CBC News

The text messages looked innocuous enough — but they actually contained links to a specially crafted webpage designed to silently infect smartphones with powerful surveillance software.

WikiLeaks - Vault 7: Projects

Dumbo can identify, control and manipulate monitoring and detection systems on a target computer running the Microsoft Windows operating sytem. It identifies installed devices like webcams and microphones, either locally or connected by wireless (Bluetooth, WiFi) or wired networks. All processes related to the detected devices (usually recording, monitoring or detection of video/audio/network streams) are also identified and can be stopped by the operator. By deleting or manipulating recordings the operator is aided in creating fake or destroying actual evidence of the intrusion operation.

> it actually hides the malware in a .jpg file that appears benign at first (pro... | Hacker News
Choosing Secure Passwords - Schneier on Security
Security of Password Managers - Schneier on Security
UK police arrest man via automatic face recognition tech | Ars Technica UK

Camera-equipped van in South Wales apparently spotted man whose face was in a database.

How to Disable All of Windows 10’s Built-in Advertising

Windows 10 has a lot of built-in advertising. This isn’t just about the free upgrade offer: Even if you purchase a new PC that comes with a Windows 10 license or spend $200 for a copy of Windows 10 Professional, you’ll see ads in your operating system. You can, however, disable a lot of it.

Our Copyfish extension was stolen and adware-infested
Sur Instagram, l’insupportable tyrannie du cool - L'actu Médias / Net - Télérama.fr
Une seconde d'attente suffit à stresser l’utilisateur d’un smartphone

Enfin, on peut distinguer trois groupes d’âge suivant les réactions. Les moins de 24 ans, qu’Ericsson range dans la catégorie "millennials" se montrent les plus intolérants. Ainsi au bout d’une seconde de délai, ils voient leur stress augmenter de 40% contre 29% pour les plus de 35 ans.

« Sur son lit de mort, personne ne se dit : "J’aurais aimé passer plus de temps sur Facebook" »
Ubuntu: Installation des codecs non libres
LibreOffice sort sa version 5.4, interopérabilité et légèreté accrues - ZDNet
Pour Saint-Gobain, NotPetya se traduit par 250 M€ de manque à gagner

Le passage de NotPetya va amputer le chiffre d’affaires annuel de Saint-Gobain de 250 millions d’euros. Si l’impact est majeur, le groupe bénéficie d’une conjoncture favorable permettant d’en diluer les effets.

Facebook Ads: real identity and cross-device tracking | Facebook for Business

Try these 4 advanced facebook ad strategies to target people (not cookies) and reach the exact target audience you want.

To Survive in Tough Times, Restaurants Turn to Data-Mining - NYTimes.com
Positive Technologies - learn and secure : Disabling Intel ME 11 via undocumented mode
Our team of Positive Technologies researchers has delved deep into the internal architecture of Intel Management Engine (ME) 11, reveali...
AccuWeather caught sending user location data, even when location sharing is off | ZDNet

A security researcher has found that the popular weather app sends private location data without the user's explicit permission to a firm designed to monetize user locations.

Taxonomy of Humans According to Twitter – The New Inquiry
Communicating the Dangers of Non-Secure HTTP | Mozilla Security Blog

In order to clearly highlight risk to the user, starting this month in Firefox 51 web pages which collect passwords but don’t use HTTPS will display a grey lock icon with a red strike-through in the address bar.

Life Is About to Get a Whole Lot Harder for Websites Without HTTPS
Sites on which uBO Extra is useful · gorhill/uBO-Extra Wiki · GitHub

The purpose of Instart Logic technology is to disguise 3rd-party requests as 1st-party requests, thus bypassing content blockers, and even the ability of browsers to block 3rd-party cookies (because they are stored as 1st-party cookies)

Note: The extension is useful only for Chromium-based browsers. There is no need for such an extension so far on Firefox, and thus there is no version for Firefox.

The New Copycats: How Facebook Squashes Competition From Startups - WSJ

Facebook uses an internal database to track rivals, including young startups performing unusually well, people familiar with the system say. The database stems from Facebook’s 2013 acquisition of a Tel Aviv-based startup, Onavo, which had built an app that secures users’ privacy by routing their traffic through private servers. The app gives Facebook an unusually detailed look at what users collectively do on their phones, these people say.

The tool shaped Facebook’s decision to buy WhatsApp and informed its live-video strategy, they say. Facebook used Onavo to build its early-bird tool that tips it off to promising services and that helped Facebook home in on Houseparty.

Meet Dorsen, 8, who mines cobalt to make your smartphone work

Sky News - First for Breaking News, video, headlines, analysis and top stories from business, politics, entertainment and more in the UK and worldwide.

How Facebook News Feed Works | TechCrunch

This is the ultimate guide to how Facebook chooses what to show in your News Feed, and how you can get your content seen by more people. Understanding how..

Kaspersky lance une version gratuite de son antivirus

Du moment que l'interface est agréable, que le logiciel a de bonnes critiques, est bien noté sur les tests, je me résous à l'installer. Sans savoir si mes données partent en Chine (Qihoo360, CM...), en Roumanie (Bitdefender), en République Tchèque (Avast, AVG...), en Allemagne (Avira) ou en Angleterre (Sophos)...

C'est vrai que m'a toujours un peu dérangé de devoir confier toutes les clefs de ma vie numérique, à de parfaits inconnus, qui arrivent avec juste marqué "Antivirus" sur le front. Sans vraiment savoir à quoi ils ont accès sur ordinateur personnel.

Why Apple and other tech companies are fighting to keep devices hard to repair - The Verge
Securing Microsoft Windows 8: AppContainers
AppContainer Isolation (Windows)
Microsoft didn’t sandbox Windows Defender, so I did | Trail of Bits Blog

Microsoft exposed their users to a lot of risks when they released Windows Defender without a sandbox. This surprised me. Sandboxing is one of the most effective security-hardening techniques. Why …

Piratée, l’enceinte connectée Amazon Echo peut se transformer en micro de surveillance
It's a bad weekend for Chrome Extensions, it seems. https://media.defcon.org/DE... | Hacker News
This is the second extension that I use on chrome that has been hijacked. The f... | Hacker News
I guess this is as good a place as any to post that I noticed something similar ... | Hacker News
Tirana passe au cloud open source

La capitale de l'Albanie, qui compte plus de 800.000 habitants, poursuit son évolution vers les logiciels libres, en adoptant un service de cloud privé, cloud.tirana.al, rapporte l'Observatoire de l'open source (diffusé par la Commission européenne).

La municipalité a migré le 11 juin de ownCloud à NextCloud après deux mois d'utilisation, sur la proposition de l'équipe informatique. Outre les qualités du second en terme de sécurité et de performance, le fait qu'il soit entièrement open source a pesé dans la décision. Il sera utilisé par plus de 600 fonctionnaires municipaux pour le partage de fichiers et diverses applications.

7 plugins WordPress pour lutter contre les attaques par force brute
This Is How Your Fear and Outrage Are Being Sold for Profit

The story of how one metric has changed the way you see the world

Quel est votre degré de résistance au numérique ? | Denys Malengreau | Pulse | LinkedIn
The Psychology of Checking Your Email
Facebook songe à lire vos émotions pour personnaliser votre fil d'actualité - Tech - Numerama

Facebook a déposé un brevet pour le moins curieux : le réseau social aimerait s'appuyer sur la webcam ou l'appareil photo de smartphone de ses utilisateurs pour connaître leur réaction à la lecture des publications de leur fil d'actualité. Et ainsi leur proposer un contenu personnalisé en fonction des émotions visibles sur leur visage.

En vrac du lundi - Standblog
Un historique de navigation Internet n’est jamais vraiment « anonymisé »

Une expérience présentée à la conférence DEF CON confirme ce que plusieurs études montraient déjà : il est simple de « désanonymiser » des historiques de navigation.

Hertz fait les frais de la loi Lemaire : 40 000 euros d’amende

Pour avoir insuffisamment sécurisé les données des adhérents à son programme de fidélité, le loueur de voitures Hertz est sanctionné d’une amende par la CNIL. Une première permise par la loi pour une République numérique.