Monthly Shaarli

All links of one month in a single page.

February, 2020

FCC Proposes to Fine Wireless Carriers $200M for Selling Customer Location Data — Krebs on Security
The Facts: Mozilla’s DNS over HTTPs (DoH) - Open Policy & Advocacy

The current insecure DNS system leaves billions of people around the world vulnerable because the data about where they go on the internet is unencrypted. We’ve set out to change ...

EU Commission to staff: Switch to Signal messaging app – POLITICO

The move is part of EU’s efforts to beef up cybersecurity, after several high-profile incidents shocked diplomats and officials.

Chrome deploys deep-linking tech in latest browser build despite privacy concerns • The Register

It's not a bug, it's a feature, explains the Chocolate Factory

Exclusive: Google users in UK to lose EU data protection - sources - Reuters
South Korea switching their 3.3 million PCs to Linux | FOSS Linux

The reasoning behind the switch is two-fold.  South Korea was looking to reduce its reliance on Microsoft and Windows and cut down on software licensing costs.  

Restore Privacy | Your online privacy resource center

Your online privacy resource center

Crimea, Kashmir, Korea — Google redraws disputed borders, depending on who’s looking - The Washington Post
Deirdre Connolly¹ sur Twitter : "Now in @CryptoVillage, snooping Telegram messages. 🕵️‍♀️ #DEFCON" / Twitter
What is “Island”
Russian Censorship of Telegram - Schneier on Security
Calls for backdoor access to WhatsApp as Five Eyes nations meet | World news | The Guardian

Countries focus on increasingly effective encryption of communications

Signal Is Finally Bringing Its Secure Messaging to the Masses | WIRED

The encryption app is putting a $50 million infusion from WhatsApp cofounder Brian Acton to good use, building out features to help it go mainstream.

Facebook Dating launch blocked in Europe after it fails to show privacy workings | TechCrunch
Software error exposes the ID numbers for 1.26 million Danish citizens | ZDNet
Microsoft Begins Showing an Anti-Firefox Ad in the Windows 10 Start Menu

New Microsoft Edge now displayed on Windows 10

Personal info of 6m. Israelis leaked after Likud uploads voter info | The Jerusalem post

'I've seen many breaches in my life, but I've never seen such a ridiculous breach like this that did this much damage,' says senior programmer.

Librem 5 phone hands-on—Open source phone shows the cost of being different | Ars Technica

It's not finished, but many of the basics for an open source smartphone are here.

Tesla Remotely Removes Autopilot Features From Customer's Used Tesla Without Any Notice [Updated]

One of the less-considered side effects of car features moving from hardware to software is that important features and abilities of a car can now be removed without any actual contact with a given car. Where once de-contenting involved at least a screwdriver (or, if you were in a hurry, a hammer), now thousands of dollars of options can vanish with the click of a mouse somewhere. And that’s exactly what happened to one Tesla owner, and, it seems many others.

Partial freezing of the User-Agent string · Issue #467 · w3ctag/design-reviews · GitHub

Goedenavond TAG! This is not your typical spec review, and is highly related to #320. But, because @torgo asked nicely, I'm opening up a review for a specific application of UA-CH as a replacem...

opensnitch/README.md at master · evilsocket/opensnitch · GitHub

OpenSnitch is a GNU/Linux port of the Little Snitch application firewall - evilsocket/opensnitch

Can You Tell Which of These Amazon Prime Purchases Are Real? | Wirecutter

Telling whether the product that arrived in your Amazon box is what you meant to order can be puzzling. Can you guess which ones of these are the imposters?

Bromite author here (https://www.bromite.org ); I was contacted some time ago ab... | Hacker News
Smartphone startups put privacy first

We know our digital devices are logging our every move, yet we still trust in Apple, Facebook and Android. What if we "unGoogled" ourselves and took back control of our data? Two startups hope we will do just that.

London to deploy live facial recognition to find wanted faces in a crowd | Ars Technica

Tech from NEC aimed at spotting wanted persons on the streets to alert officers.

Wearable Microphone Jamming
Facebook uses its ad policies to block apps that compete with its dating service

Facebook Dating was always doomed to be as dystopian and inhumane as a speech from Mark “I’m not a robot, I swear it” Zuckerberg, but who could have guessed that the company would consider cheating and hookup sites its direct competition. The creators of an app called #Open recently started a petition demanding Facebook stop its …

Delisting Startpage.com

Dear PrivacyTools community,

On the 15th of October, it was brought to our attention that Startpage.com was
reportedly (partially?) taken over
[https://www.reddit.com/r/privacy/comments/di5rn3/startpage_is_now_owned_by_an_advertising_company/]
by a company called the Privacy One Group, which is in turn owned by a company
called System1. We found this quite remarkable as the two companies seem to have
conflicting business models. Startpage has been known for basing their
advertisements on what

Thomas 🐦 sur Twitter : "@bradfitz @sh1mmer @harryh 1. 1:1 E2E chats use archaic, broken crypto. 2. N:N group chats aren’t encrypted at all. 3. Telegram claims TLS protects messages. 4. 1:1 E2E is opt-in. I get that it’s a pleasant app. Not here to rant a…
Amazon’s new one-tap ratings could help the fake review problem - Vox

The company’s new one-tap star rating feature seeks to get more customer feedback ... from actual customers.

OpenPush - A Free, Decentralized Push Messaging Framework for Android | F-Droid - Free and Open Source Android App Repository

Push messages are an essential part of connected mobile devices. They are also one of the critical missing pieces in the open source Android ecosystem. Until...

Multi-Account Containers Add-on Sync Feature | Mozilla Security Blog

The Multi-Account Containers Add-on will now sync your container configuration and site assignments. Firefox Multi-Account Containers allows users to separate their online identities into different ...

Watching you watch: the tracking system of over-the-top TV streaming devices – the morning paper

Watching you watch: the tracking ecosystem of over-the-top TV streaming devices, Moghaddam et al., CCS’19 The results from this paper are all too predictable: channels on Over-The-Top (OTT) s…

Living Without a SIM Card | habd.as

A year later. Getting by without a SIM card in my smartphone.

Even With A $199 Laptop, Clear Linux Can Offer Superior Performance To Fedora Or Ubuntu - Phoronix

Phoronix is the leading technology website for Linux hardware reviews, open-source news, Linux benchmarks, open-source benchmarks, and computer hardware tests.

What to Know Before You Buy or Install Your Amazon Ring Camera | Electronic Frontier Foundation

So, you own or are thinking of buying a Ring camera. This post outlines a list of privacy and civil liberties concerns we have with Amazon’s Ring system so that you can be a more informed consumer, or—if you already own a Ring camera—be a more considerate neighbor. If You’re Thinking of Buying...

Twitter says an attacker used its API to match usernames to phone numbers | ZDNet
Google Chrome's fear of Microsoft Edge is revealing its bad side | Laptop Mag

Chrome is trying to lure Edge users away from the Microsoft browser by issuing provocative messages on their platforms.

Google is moving EU citizens data to US
Release 1.25.0 · gorhill/uBlock · GitHub

From now on uBO will CNAME-uncloak network requests. CNAME-uncloaked network requests will appear as blue entries in the popup panel and the logger. The uncloaked entries in the popup panel will also show the related aliases (in smaller characters underneath the canonical names):

Discord Is Not An Acceptable Choice For Free Software Projects
Windows 10 could start bullying people into using a Microsoft account to install | TechRadar

Microsoft doesn’t want users to set up with a local account, it would seem – and less choice is never a good thing.

En quittant Facebook… - Le Temps

OPNION. Pour cette nouvelle décennie, notre chroniqueur Frédéric Koller a procédé à un suicide numérique en guise de bonne résolution

Activate This ‘Bracelet of Silence,’ and Alexa Can’t Eavesdrop - The New York Times

Microphones and cameras lurk everywhere. You may want to slip on some privacy armor.

Privacy browser Waterfox appears to be sold to System1, a U.S. pay-per-click ad company that recently bought a majority of the Startpage search engine - privacy
Telegram Bug ‘Exploited’ By Chinese Agencies, Hong Kong Activists Claim
Shelter | F-Droid - Free and Open Source Android App Repository

© 2010-2019 F-Droid Limited and Contributors

More on Backdooring (or Not) WhatsApp - Schneier on Security
A reminder, because this sometimes surprises people, and feel free to correct me... | Hacker News

A reminder, because this sometimes surprises people, and feel free to correct me if the facts have changed recently:

Telegram supports end-to-end encryption only in 1:1 private chats.

End-to-end encryption is disabled by default.

Telegram does not support end-to-end encryption, at all for group chats, its most popular use case.

Instead, Telegram claims that those group chats are "encrypted" by dint of the TLS connection between Telegram clients and the Telegram servers, which can, in this model, read all group traffic.

People like to dunk on the weirdness of the limited E2E crypto Telegram does have; it's archaic and idiosyncratic and people have published research results about it, though none to my understanding are of real practical impact. I support people dunking on bad crypto. But that has nothing to do with why Telegram is an inferior secure messenger.

By comparison, Signal, which Durov has repeatedly talked down:

  • has modern, ratchet-based forward secure end-to-end crypto, always, in both group and private messaging;

  • won the Levchin Prize, refereed by some of best-known names in academic cryptography, for the design and implementation of that cryptosystem, as well as for its implementation at WhatsApp;

  • ha repeatedly foregone basic messaging app features simply to avoid collecting user metadata; Signal didn't even have user profiles until they could figure out a way to implement it in a privacy-preserving manner, and even their GIF sharing feature has a purpose-built anonymity system; we'll only this year potentially get usernames instead of phone numbers because it took that long to design a trustworthy social graph that didn't leave Signal with a giant pile of subpoenable metadata.

Use whatever messaging app you want.

Wacom drawing tablets track the name of every application that you open | Robert Heaton

I have a Wacom drawing tablet. I use it to draw cover illustrations for my blog posts, such as this one.

Imperiled information | Harvard John A. Paulson School of Engineering and Applied Sciences
Critical Security Flaw Found in WhatsApp Desktop Platform Allowing Cybercriminals Read From The File System Access

Critical Security Flaw Found in WhatsApp Desktop Platform Allowing Cybercriminals Read From The File System Access