Notices tagged with security, page 12

@dominiksteiger

#Security nightmare:

#Microsoft’s new #Windows11 feature, #Recall, makes the #SciFi movie #TotalRecall almost look like a fairy tale by comparison.

Everything you ever saw or wrote on your device, even if deleted, will remain in definitely remain available and searchable for users of the device, including #hackers.
Opting out requires work.

Also, in my view, I doubt that it is #GDPDR compliant in its current form.
Beware.

Excellent analysis:

https://swiss.social/@dominiksteiger/112551118126679215

I published a DRAFT of my new article “Installing Alpine Mail on Windows (featuring Fastmail settings)”
https://www.ii.com/installing-alpine-mail-on-windows/

#AlpineMail #Alpine-Mail #PC-Alpine #PCAlpine #WindowsAlpine #WinAlpine
#Checksum #Email #Fastmail #IMAP #IUseThis #GPG #Uses #Messaging #Privacy #Security #Windows
#InfiniteInk #Byℵ #ByNM

TL;DR: Copyright, privacy and security will take a further backseat amidst the deluge of AI leveraged productivity tools that are deeply integrated with existing workflows and with great usability for normies. To protect privacy, copyright and security users have to be much more conscious and use additional tools and settings. This will add to increased effort, cost and cognitive load. Most of us will succumb.

Privacy conscious users have read and understood that Microsoft's new Windows 11 Recall is a privacy nightmare. Accordingly, they will advocate no usage or very restricted usage and I would agree with them. I also agree with them when they raise similar serious privacy concerns about Facebook, WhatsApp, YouTube etc.

But none of these concerns have slowed the usage of WhatsApp, Facebook, YouTube etc. Big Tech continue to actively develop and upgrade these flagship products since they significantly impact both the top line and bottom line. Big Tech will also continue to claim and promote data and user security while actually leveraging the metadata to offer personalized services and targeted advertising, leading to increased recurring revenue. Another interesting approach is to integrate with existing services and apps to garner critical mass as rapidly as possible.

Recall on Copilot+ PCs cannot be an exception to this approach. It is just a matter of time before more such similar AI assisted tools will be available. Even though Microsoft Recall does not perform content moderation and will not hide information such as passwords or financial account numbers, it will not deter most users if the usability is good enough for the user. Microsoft has full access to its own Windows 11 ecosystem and also has deep pockets to incrementally and frequently improve usability to enhance the feel of seamless integration with Windows ecosystem and increased productivity. As per this blog, the investment is already remarkable.We are excited to extend the Microsoft Copilot stack to Windows with Windows Copilot Runtime. We have infused AI into every layer of Windows, including a fundamental transformation of the OS itself to enable developers to accelerate AI development on Windows. I sometimes request not to take screenshots when I remotely share my desktop screen though collaboration tools. Now I also have to remember to also pause snapshots and strongly suggest to do the same from the Recall icon in the system tray. I am also aware that many privacy focussed cross platform tools will be threatened. I don't think Big Tech considers the users of these tools as mainstream users (read normies) yet. To minimize this threat, developers and users have to increase their effort and cost.Filtering apps and websites from your snapshots
You can filter out apps and websites from being saved as snapshots. You can add apps and websites at any time by going to Settings > Privacy & security > Recall & snapshots on your PC.
Filtering out specific websites will only work in supported browsers such as Microsoft Edge, Firefox, Opera, and Google Chrome. You always have the option to filter out all browsing activity by adding an app filter for a browser. To add support for website filtering, developers need to implement Recall activity APIs.
Recall won’t save any content from your private browsing activity when you’re using Microsoft Edge, Firefox, Opera, Google Chrome, or other Chromium-based browsers.It is a wishful thinking that Microsoft AI “Recall” feature does not gain enough traction and is eventually withdrawn. Big Tech seems to be committed to leverage AI to help consumers traverse their digital workspaces more effectively.

#BigTech #Microsoft #AI #Privacy #Security #Recall #IrresponsibleTech #PrivacyMatters #DataProtection

“Data-Hungry Dating Apps Are Worse Than Ever for Your Privacy”

https://foundation.mozilla.org/en/privacynotincluded/articles/data-hungry-dating-apps-are-worse-than-ever-for-your-privacy/

#Dating #Privacy #Security #Love #AI #Philippines #Data #DataPrivacy #YourOnlyOne

Regular user: I want to feel safe and private.

Google: cool, anyways here's an AI that listens to your calls.

Microsoft: word, how about an AI that takes screenshots of everything you do?

#Google #AI #Microsoft #privacy #security #safety #cybersecurity #infosec

Is it just me, or has Microsoft gone completely crazy? They are implementing spyware that takes screenshots every second and forcing AI integration. Why would anyone willingly purchase this? Anyone with experience in computer or information security knows that it is a bad idea, even if it is locally done. Just don't do it. Yet, here we are, and they are doubling down on this idea. https://arstechnica.com/gadgets/2024/05/microsofts-new-recall-feature-will-record-everything-you-do-on-your-pc/ #privacy #security

This is totally nothing new, but your Wi-Fi network doubles as a total surveillance device for not only Big Tech, but for governments and law enforcement as well.

Case in point: https://krebsonsecurity.com/2024/05/why-your-wi-fi-router-doubles-as-an-apple-airtag/

To (partially) opt-out: add _nomap (for Apple, Google, Mozilla) and _optout (Microsoft) right after the SSID name.

Example: HomeWiFi_nomap_optout

#PSA #tip #privacy #security #wifi

Are all Linux vendor kernels insecure? A new study says yes, but there's a fix https://zdnet.com/article/are-all-linux-vendor-kernels-insecure-a-new-study-says-yes-but-theres-a-fix/ by @sjvn

#Linux experts have long known that enterprise Linux distros have #security problems; now we have hard evidence of those problems and an answer for them

An #NGO in #Japan has been dealing with weeks of criticism & turmoil for having a foreign logo in a presentation they submitted to the government.

The reason? Essentially, copying & pasting of copyrighted images & not realizing they were watermarked. It could have been avoided w/ some basic #data and #security practices.

- Only use #CreativeCommons or your own photos/images/graphics.
- Clear metadata from any images you share publicly.
- Share PDFs, not powerpoints.

#WhatsApp uses the open-source #Signal protocol… However, encryption isn’t the whole story… WhatsApp and, by extension, all #Meta organizations know you sent something, when you sent it, and who you sent it to…

https://proton.me/blog/whatsapp-safe-private-photos

#Privacy #Security

@adnan Maybe the #Fediverse would benefit from some kind of "listed and fediverse-public but not external-public" level of post visibility that would allow people to have their posts on hashtags propagated across the fediverse and visible internally within the federated timeline but not visible via pages like the non-authenticated external search on most instances to people who are not logged in 🤔

#abuse #fedisafety #MastoDev #privacy #safety #security

#StormyDaniels says she believed that #Trump's Aug 2023 all-caps tweet, "If you go after me, I'm coming after you!,' was about her, bc he had just filed a suit against her in Florida.

#Hoffinger asks Daniels about the impact that telling her story had on her life.

Daniels said she had to hire #security, move a couple of times & take extra precautions bc of her daughter.

Asked if publicly telling the truth has been a net positive or net negative, Daniels responds "negative."

#law #TrumpTrial

Important security update for GLib and D-Bus, thanks to @pwithnall

https://discourse.gnome.org/t/security-fixes-for-signal-handling-in-gdbus-in-glib/20882

If you are a downstream distributor of GLib, GTK, or GNOME-related projects, remember to follow the distributor tag on Discourse.

#glib #security

went down to the hotel lobby to retrieve my dinner delivery in a yoga outfit + snuggly cardigan + face mask.

some men with #RSAC2024 lanyards exited the elevator as I re-entered; they turned back to look at me and one said (very loudly, very pointedly staring at me) to the other, “I was like, did you hire me a hooker?”

if you are a man attending #rsac, please shut that kind of shit down when your peers do it. let’s not let insecurity rule our #security industry.

Impossibly high living costs are pushing #Arctic peoples into the hands of Elon Musk and Jeff Bezos. Billionaire control of information technologies https://www.cbc.ca/newsinteractives/features/northern-connections and #food are not in #Canada's interests or in the #security of northern peoples. https://www.cbc.ca/news/canada/north/canada-post-nunavut-amazon-free-shipping-loophole-1.7193037

#cdnpoli

#Microsoft ties executive pay to #security following multiple failures and breaches

https://arstechnica.com/?p=2021673

🆕 blog! “Bank scammers using genuine push notifications to trick their victims”

You receive a call on your phone. The polite call centre worker on the line asks for you by name, and gives the name of your bank. They say they're calling from your bank's fraud department. "Yeah, right!" You think. Obvious scam, isn't it?…

👀 Read more: https://shkspr.mobi/blog/2024/05/bank-scammers-using-genuine-push-notifications-to-trick-their-victims/
⸻
#bank #CyberSecurity #phishing #scam #security

Bank scammers using genuine push notifications to trick their victims
https://shkspr.mobi/blog/2024/05/bank-scammers-using-genuine-push-notifications-to-trick-their-victims/

You receive a call on your phone. The polite call centre worker on the line asks for you by name, and gives the name of your bank. They say they're calling from your bank's fraud department.

"Yeah, right!" You think. Obvious scam, isn't it? You tell the caller to do unmentionable things to a goat. They sigh.

"I can assure you I'm calling from Chase bank. I understand you're sceptical. I'll send a push notification through the app so you can see this is a genuine call."

Your phone buzzes. You tap the notification and this pops up on screen:

This is obviously a genuine caller! This is a genuine pop-up, from the genuine app, which is protected by your genuine fingerprint. You tap the "Yes" button.

Why wouldn't you? The caller knows your name and bank and they have sent you an in-app notification. Surely that can only be done by the bank. Right?

Right!

This is a genuine notification. It was sent by the bank.

You proceed to do as the fraud department asks. You give them more details. You move your money into a safe account. You're told you'll hear from them in the morning.

Congratulations. You just got played. Scammers have stolen your life savings.

This is reasonably sophisticated, and it is easy to see why people fall for it.

1. The scammer calls you up. They keep you on the phone while...
2. The scammer's accomplice calls your bank. They pretend to be you. So...
3. The bank sends you an in-app alert.
4. You confirm the alert.
5. The scammer on the phone to your bank now has control of your account.

Look closer at what that pop is actually asking you to confirm.

We need to check it is you on the phone to us.

It isn't saying "This is us calling you - it is quite the opposite!

This pop-up is a security disaster. It should say something like:

Did you call us?
If someone has called you claiming to be from us hang up now
[Yes, I am calling Chase] - [No, someone called me]

I dare say most people would fall for this. Oh, not you! You're far too clever and sceptical. You'd hang up and call the number on your card. You'd spend a terrifying 30 minute wait on hold to the fraud department, while hoping fraudsters haven't already drained your account.

But even if you were constantly packet sniffing the Internet connection on your phone, you'd see that this was a genuine pop-up from your genuine app. Would that bypass your defences? I reckon so.

Criminals are getting increasingly good at this. Banks are letting down customers by having vaguely worded security pop-up which they know their customers don't read properly.

And, yes, customers can sometimes be a little gullible. But it is hard to be constantly on the defensive.

You can read the original story from the victim on Reddit. See more comments on Mastodon.

https://shkspr.mobi/blog/2024/05/bank-scammers-using-genuine-push-notifications-to-trick-their-victims/

#bank #CyberSecurity #phishing #scam #security

Permission-based systems are bad. See #XUL getting replaced by #WebExtensions for example. It didn't stop #malware from getting into the #browser or the extension store. On the contrary, the malware problem only got worse after the complete replacement of XUL extensions, which is often disparaged as "insecure" because it allowed users to pretty much change how their browser fundamentally works.

Who knew that distrusting your users and not giving them control leads to more malicious software and user #security being broken more often. :seija_coffee:

RE: https://mamot.fr/users/gnomelibre/statuses/112371181710549606