Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re:Is this technically impossible - no. (Score 5, Informative) 191

Very likely, if I can read my mail, so can he. It's only logical.

The fact that an organization acts as a conduit for delivering messages does not necessitate that they have the ability to read the contents of those messages. The one does not follow from the other. It may be likely that the two go hand-in-hand, but by no means is it logical that they would do so.

The various white papers and other security documents Apple has released over the last year or two make it clear that they claim they do not hold the private keys necessary to decrypt their users' data. Those private keys reside on the devices of the users, with unique keys being generated for each device and unique copies of the data being maintained separately for each device. For instance, in the case of iMessages, here's how Apple claims they work:
1) I type up an iMessage to send to another Apple user and press Send.

2) My device queries Apple's servers for the public key(s) of the recipient, which could be numerous if they've configured iMessages to arrive on multiple devices.

3) My device creates and encrypts one copy of the message for each device, using the public key that is specific to each device for the copy going to it.

4) My device signs the copies using its private key.

5) The iMessage is sent to Apple, who then forwards it and immediately deletes it, unless they can't deliver it, in which case it'll stay queued for up to 7 days.

6) The recipient's device verifies the signature against my public key and then decrypts the message using its own private key.

Assuming the system works as described, Apple shouldn't have access to the content of the messages. Whether or not you believe that it works as described is a matter of how much faith you put in corporations and/or the governments that might be compelling them to insert backdoors. For instance, there are trivial ways that they can circumvent their own systems to gain access to messages, without having to compromise the private keys at all. The easiest way I can imagine would be to simply provide the public key of a wiretapping device in addition to the other keys in step #2 above. Unless you're sniffing your own traffic to ensure that you're sending EXACTLY what you're expecting to send, you'd never notice that you've sent out an extra copy of the message, and would be entirely unaware that it had landed on a government agent's device as well.

But again, it isn't logical that they would have that sort of access. "Likely", given the state of things? Sure. But logical? By no means. Again, the one does not follow from the other. Particularly so in the case of Apple, since their money comes from hardware sales, not from monetizing the user's information, so it's in their best interests to make those devices as secure to use as possible.

Comment Re:Here's another idea... (Score 1) 243

And don't come back with the "US is too biiiiig!" excuse. You have electricity, water and gas, don't you? How did you get that if the area you live in is "Too biiiig!" The density where I live is no more than a place like Nashville, or Arlington Heights, or Jacksonville, or Albuquerque, or Portland, or Anytown, USA.

I largely agree with your post, but I wanted to quibble on this point, since you've overlooked an important fundamental difference between those utilities and the Internet: connectedness. The water line for the suburban-without-a-nearby-urban area where I live (pop: ~210K) is managed by my local municipality. They draw its supply from the river that runs through this area. We don't have to run a pipe a hundred miles to the nearest major city to get water. Likewise, we have power plants in our immediate vicinity, including a nuclear plant, and our local municipality supplies all of our power needs. We don't have to go to a major city to get our power. Neither do most of the nearby cities and towns, since they either produce their own or can get their power from nearby towns like us that have an overabundance. As you get more remote, things become less connected and the lines get smaller and smaller, but they still work, since it's perfectly possible to function without having to draw your entirely supply from a more central location.

In contrast, for our Internet connections to work, we have to run backbone lines that supply all of our bandwidth to the major cities, given that the whole point of the Internet is that it's actually networked together. The town I live in has a population density that's not meaningfully different than places like the cities you mentioned, but because we're located in a "remote" location, it's been incredibly difficult to get quality Internet service out here. In fact, our service has been so bad that it was even making it into tech news last year, since prices for some tiers of service were 34x higher (not a typo) than comparable markets around the country.

All of which to say, it's not entirely about density, nor is it entirely about size: there's also a question of the quantity and proximity of the clusters to one another. I don't pretend to have a magic formula to define what makes it easy or hard to network a country, but even a quick glance at a population map should make it quite apparent that it's comparatively trivial to network countries like Japan or South Korea, where population centers run right into one another, as opposed to the US, where the in-between areas are absolutely massive, yet still house a large portion of the population.

Of course, none of what I've said justifies or explains why Americans in urban centers still have crappy Internet, nor was I intending to provide an explanation for that issue. I lay the fault for that problem squarely at the feet of the ISPs, as you do.

Comment Three copies + versioning (Score 1) 268

At any time, a proper setup involves maintaining a minimum of three copies of any important data:
1) The copy you use.
2) Your local backup.
3) Your off-site backup.

How you choose to implement those can vary. For instance, if you have the cash, I think most of us would agree that maintaining separate RAID arrays for your in-use and local backups would be ideal. The reason you'd keep them separate is because of the all-important mantra: RAID is not the same as having a backup (you don't seem to be under this misconception, but it bears repeating, nonetheless). RAID can protect against certain forms of hard drive failure, meaning that you wouldn't even need to resort to using your backups in the case of those sorts of failure, but it does nothing to protect against your data being corrupted by the file system or deleted by an accidental action on your part.

If you don't have the money for RAID, you could start out by just putting your in-use and local backup copies on separate hard drives (which it sounds like you're already doing), the first of which backs up to the second. That'll work most of the time and in most cases, but it means that hard drive failures will be more of a threat and an inconvenience, since you'll have to be more reliant on your other copies being intact, given that you'll be suspending your use of the damaged copy while you replace the drive and restore the data to it.

In addition to your local copies, you should have an off-site backup in a location that is geographically removed from you, that way if natural disaster does its worst, you don't lose your data. CrashPlan is the one I use and is a good place to start, since it offers multiple options for backing up off-site, including a free option where you and a friend provide off-site backups for each other. Their for-pay options are reasonable in price (though they have more than doubled since I joined a few years back), offer unlimited storage, and provide the ability to set your own encryption key (i.e. keeps them from being able to pry into your data if they're served with a warrant).

So, at a minimum: a drive for your in-use copy, a drive for a local backup, and CrashPlan backups to a friend, all of which would only cost you as much as the hard drives involved.

Ideally, however, you'd also do something to protect against corrupted data or accidental deletions on your part, which means storing multiple versions of your backups, and doing so both locally and off-site. CrashPlan subscriptions all provide full versioning of anything you backup in perpetuity, so if your data becomes backed up in an incorrect state, you can rollback to a previous version easily. Even so, you should still have versioning stored locally in some form or fashion, that way you're not dependent on CrashPlan always being around and always working. If you're a Mac user, Time Machine can serve this purpose (it should be in addition to any other local backups mentioned above), and you can even backup your Time Machine data off-site if the off-site backup system you choose doesn't offer built-in versioning like CrashPlan does. I'm sure others can make some recommendations for Windows and Linux alternatives to Time Machine.

And yes, you should keep the tapes around, if only so that you can demonstrate ownership should any legal questions come up. But once you verify that the copies you've made are all correct and working, you can probably box them up and put them in an out-of-the-way spot in the attic where you'll never have to bother with them again.

Comment Re:Some thoughts (Score 4, Insightful) 635

There's an audio file linked from the article which pretty much confirms that #1 and #2 from your list are the prevailing theories for why this is happening. Basically, as warmer air comes through, more of the land-based ice melts and moves into the sea, which is supported by measurements on land indicating that the land-based ice has been steadily decreasing in mass for some time now.

Additionally, warmer air also brings more moisture, which equates to more precipitation than is usual. Precipitation naturally has a lower salinity than the ocean waters on which it lands, causing the water to more easily freeze.

The audio file also indicated that this really doesn't have any impact on the major climate models since scientists have known for some time that the Antarctic ice may respond in a fashion similar to this, but it also pointed out that it runs contrary to public perception of how things are supposed to work.

Comment Re:Missing the point (Score 4, Insightful) 108

The first six seasons of Big Bang Theory are on blu-ray as a set for $86 on Amazon right now. You could probably pick up the entire series for less than you pay in a month, and you'd have it forever. You could repeat the same process again with your kids' shows, and you'd likely get even more bang for your buck. SyFy makes most or all of their series available via their website and Hulu for free (though you have to wait a month after air date, but that only feels weird for the first month, after which it feels like normal).

Just cut the cable for one month. One month. Divert that cash into buying the shows you can't find elsewhere for free and still want to see (you'll be shocked at how much stuff you actually don't miss once it's gone). Go get season passes from iTunes or Amazon or wherever if there's something you absolutely have to see as it's coming out that isn't on Hulu or whatnot. Repeat the process for as long as you need. My bet is that within three months you won't be spending anywhere close to the full $130/month.

Comment Re:I can't see this happening (Score 1) 108

Look at print media. Niche publications are dying out left and right, yet we have an abundance of media covering more niches than ever. Granted, many of these new media forms, such as blogs, are of a decidedly less formal and professional nature than those that have preceded them, but we're by no means starved for the content we want, since if the demand still exists, someone will put it together. Tech magazines in many cases had to appeal to the masses if they wanted to be able to stay afloat, but most blogs have no such demands being placed on them. It's perfectly possible for a person to employ themselves by going sufficiently in-depth on a topic.

By that same token, some of the smartest media folks I've seen have started betting big on YouTube channels, video streaming, and other, newer forms for getting video footage in front of eyeballs. They may not have the production values of a news room or studio setup, but they have a faster turnaround, no obligation to fill a time slot, more direct control over their revenue stream, and more immediate feedback both from and regarding their viewers.

It's pretty clear that the days of old-style broadcast TV are numbered and that in a few more years "cable TV" either won't exist or won't resemble what it does now. The upcoming generations have no concept of broadcast schedules or what it even means to miss an episode, since everything is on-demand and always available.

ESPN is merely Twitch for sports lovers. They just haven't realized it yet. Or, if they have, it's scared the crap out of them.

Comment Re:Scan here for a free 'whatever' sucker. (Score 1) 730

My original claim is not false, nor was it unfounded (though it was unsubstantiated until I posted the links). And the links I provided were intended to show you how simple it would have been for you to find this info on your own (as you apparently just did), since I gave you the search results from Slashdot, the first relevant summary, and the article from the summary.

Moreover, I said it was a substantially more difficult process than the other guy made it out to be, and it is, as you've confirmed. That said, the process I linked you is by no means the only way to acquire a spoofed fingerprint. The original technique I saw demonstrated was less reliable but much simpler, and it's what I was referencing up above. Even so, while it may be simpler, it is by no means simple.

As for spoofed vs. hacked, you're quite right that "spoofed" is a much more precise word to use to refer to the type of attack. That said, spoofing is a type of hack, so trying to say it's a spoof and not a hack is an inaccurate distinction. Either way though, it really doesn't matter. I'm merely corroborating what someone else said regarding Touch ID being vulnerable to a form of attack. If you feel that we shouldn't have called it what we did, then I'm fine with only referring to it as spoofing, since it doesn't change what I intended to convey earlier. Plus, it should have been apparent what I was intending to convey, given that I described the mechanism for the attack.

P.S. You're misusing Betteridge's Law. It only works with headlines that contain a question. The one I linked you doesn't. Moreover, citing that law as an excuse to disregard something is a form of the appeal to authority logical fallacy.

Comment Re:Hot Damn! (Score 2) 730

For users who preferred larger screens, obviously Apple was lacking in that regard, but aside from screen size, let me ask a dumb question (I'm a recovering Apple fanboy, so you'll have to pardon me :P): in what other aspects of the hardware were they considered behind in a meaningful way, prior to today?

Obviously, that "meaningful" qualifier will mean different things to different people (e.g. most differences in pixel density don't matter to me, so long as they're beyond the threshold where my not-so-great eyes can distinguish individual pixels), but I'd be curious to hear some of Slashdot's take on which features mattered to them that the Galaxy 5 had and the iPhone 5s didn't. I know iPhones have been dinged for a lack of removable battery, lack of expandable storage, and their comparatively small screens, but I'm always interested in learning about what my blind spots are.

To follow that up, I'm aware of several areas that matter to me where they were (I believe) still ahead:
- 64-bit CPU
- Hardware encryption
- Touch ID (I know the Galaxy 5 has fingerprint scanning, but by all accounts I've heard, it isn't that great)

(There are more, but those ones immediately stand out to me.)

All of which is to say, even though you meant it as a joke, your comment got me wondering how much truth was in what you said.

Comment Re:Immediate Loss of 10% of the Market (Score 1) 730

Flip it over.

It's symmetrical about the x axis.

Not strictly true. The crown is offset towards the top of the device, and there's another button next to the crown that's closer to the bottom of the device. It's likely they can be flipped without any real issue, but where would Slashdot be if we didn't all play the pedant with each other?

(don't answer that)

Comment Re:Scan here for a free 'whatever' sucker. (Score 1) 730

Don't be daft.

http://slashdot.org/index2.pl?...

http://apple.slashdot.org/stor...

http://istouchidhackedyet.com/

If you still wanted a link after my previous post, you could have asked for it more politely than with such a specious line, but I trusted that you were smart enough to find such things on your own once someone corroborated what the troll said, so I saw little reason in doing your work for you.

Comment Re:One day battery life in Apple Watch too? (Score 1) 730

Why? What's so much better about taking your watch off every three nights instead of every night?

With the post-2007 smartphones, their benefits over what we had at the time were SO apparent that few of us really complained much when we sacrificed a significant amount of battery life to acquire those benefits. But with smartwatches, most of us here seem to be confused over what benefits they offer that are compelling enough to even justify the cost, let alone the other drawbacks like poorer battery life compared to existing watches. If the barrier keeping someone from buying a smartwatch is its battery life, a larger battery life may make all the difference to them since it'd be significantly more tolerable.

Even the difference between one day and two can make a huge difference for people, since "one day" really just means "it'll die over the course of the day if I use it heavily".

Comment Re:Scan here for a free 'whatever' sucker. (Score 1) 730

It actually was cracked fairly quickly (a few days after it was released), but it's not nearly as trivial of a process as his comment might suggest. More or less, if you have a really nice scanner, a somewhat specialized printer, a detailed copy of their fingerprints, and at least a day or two to sit around waiting for ink that's been printed on top of ink to dry, then for glue to cure, you can do it, but the up-front cost is in the thousands of USD, so it's not something someone is going to casually do, and by the time they'd have had a chance to do it, you'd have had every chance to remotely disable Apple Pay/your entire phone.

Slashdot Top Deals

"The medium is the massage." -- Crazy Nigel

Working...