Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×

Comment Re:Oh Look (Score 1) 87

But it looks like Apple is playing catchup to Sling TV.

Very true, but we already have and use an Apple TV. We have very little Apple-purchased content so it wouldn't be financially hard to switch to a different device (and I think we're out of HDMI ports so we'd more or less have to), but it'd be nicely convenient if we could get that content on what we're used to.

Yeah, we could do some AirPlay workaround but the Wife Approval Factor starts dropping quickly when that gets involved.

Comment Re:Not just for government. (Score 2) 155

Fortunately, more informed parties disagree with you:

HTTP/2 doesn't require you to use TLS (the standard form of SSL, the Web's encryption layer), but its higher performance makes using encryption easier, since it reduces the impact on how fast your site seems.

In fact, many people believe that the only safe way to deploy the new protocol on the "open" Internet is to use encryption; Firefox and Chrome have said that they'll only support HTTP/2 using TLS.

They have two reasons for this. One is that deploying a new version of HTTP across the Internet is hard, because a lot of "middleboxes" like proxies and firewalls assume that HTTP/1 won't ever change, and they can introduce interoperability and even security problems if they try to interpret a HTTP/2 connection.

The other is that the Web is an increasingly dangerous place, and using more encryption is one way to mitigate a number of threats. By using HTTP/2 as a carrot for sites to use TLS, they're hoping that the overall security of the Web will improve.

So stick with plaintext HTTP/1.0 as long as you want, but the rest of us are moving to secure-by-default.

Comment Re:Not just for government. (Score 1) 155

Not all sites deal in private information.

Yes, they do. The information I transmit to the site in the form of an HTTP request is something I want to be private from prying eyes. I don't care if it's not anything particularly incriminating! It's just no one else's business but mine and that website.

The things my mom texts me aren't sensitive - "Hi son! Here's a picture of my dog napping outside!" - but they're certainly private and I'd be pissed if I thought anyone was reading them. Every web request, every chat message, every email should be considered private until explicitly proven otherwise.

Comment Re:Only on some... (Score 1) 155

Static sites without forms, uploads, or sign ins, do not have any security benefit.

First, lots of things are sensitive. Would you want someone in the coffee shop watching you browse the NIH website for sexually transmitted diseases? It would be hideously expensive for each government agency to classify each and every URL as "OK for snooping" or "visitors probably want privacy", certainly several orders of magnitude harder and costlier than just saying that everything is sensitive and treating it accordingly.

Second, what's you're requirement for not having the security benefit? Given that certs are about $10 a year and require negligible resources, what is your compelling reason for not having encryption by default?

Third, there's a real and enormous benefit to having everything encrypted. If encryption is only applied to critical things, then the presence of encryption is a red flag that something is critical. When it's the normal, boring default mode and everything is encrypted, its presence is no longer an indicator that something sensitive is taking place.

Comment Re:Oh Look (Score 1) 87

This isn't an Apple TV thing. From the article:

Apple declined to comment on the reports. But the Journal said its sources suggested the tech giant is aiming for a June unveiling, ahead of a September launch of the TV service, compatible with all devices running iOS, including iPhones, iPads, and Apple TV boxes.

That's a pretty big deal for a lot of people, and the rumors are that it'll be unveiled at WWDC. I like stories like this: plausible, and soon enough to be interesting.

Comment Buying in on day one (Score 0) 87

I am so, so ready to be done with Comcast. I'd pick this up in a heartbeat to get away from their ludicrously priced packaging (I don't want to rent a DVR just so I can watch baseball in HD!). Toss in the unbundled HBO subscription and this is close to my cord cutting dream.

Oh, and NBC? I'll be subsidizing this by dropping my Hulu Plus subscription. Don't for a second think that your programming is so valuable that I'll pay extra for it a la carte. This would be an excellent time to make nice with Apple and get over yourself.

Comment My life has been missing this (Score 4, Funny) 95

"Self", I said, "you haven't been feeling fully integrated into today's online society. What could you do to make sure that a major corporation with a history of disdain for its users and their privacy could come to have possession of your financial data? Banks are so old fashioned. Your checking account should be social!"

Today is a happy day indeed.

Comment Missing the point (Score 4, Insightful) 155

I don't take Uber (or more often: Lyft) because it's cheaper. I use these services because 1) the car actually shows up, 2) when it's supposed to, and 3) I know ahead of time how much it will cost. Even if it's a couple of bucks more, that's well worth the vastly better customer service.

Comment Not Apple Pay: banks (Score 1) 269

Apple isn't responsible for banks' security or lack thereof. Some backs apparently let you activate any card you have the information off of. My credit union (not an employee, just a very happy customer) went live with Apple Pay this morning and it was nothing like the story described. I added my debit card, and the Passbook app popped up a notice that I had to call my CU, including a button to push to dial them. The customer service rep asked for my "phone and chat authorization password", which is a password they required me to set up earlier and is not the same as my banking login password. Then she asked me to describe my most recent debit card purchase and for the name of the company that direct deposits my salary. Only then did she authorize my debit card for Apple Pay.

It was mildly inconvenient in exactly the way I want my banking security to be. It wasn't enough for me to take a picture of some random credit card I'd found. Instead, I had to call my CU and convince an actual human that I'm who I claim to be. It wasn't perfect, sure: she didn't require a DNA sample or a retina scan, but it was vastly more secure than any other debit or credit card transaction I've ever made before.

Some banks (again, not Apple) are playing fast and loose with security for the short term convenience of their users. It sucks in the long term, sure, when the bank lets a thief authorize a stolen debit card and their customer has to get a new one issued, but someone did the math and decided this was a good idea. That's a problem with those banks, though, and not a design flaw in the system. Apple can't do much to improve that unless they wanted to man-in-the-middle security checks between a bank and its customers.

Crime

Fraud Rampant In Apple Pay 269

PvtVoid writes with this report from the New York Times, excerpting: An industry consultant, Cherian Abraham, put the fraud rate [for Apple Pay] at 6 percent, compared with a traditional credit card fraud rate that is relatively minuscule, 10 cents for every $100 spent. [i.e. one tenth of one percent]. The vulnerability in Apple Pay is in the way that it — and card issuers — "onboard" new credit cards into the system. Because Apple wanted its system to have the simplicity for which it has become famous and wanted to make the sign-up process "frictionless," the company required little beyond basic credit card information about a user. Nor did it provide much information to the banks, like full phone numbers and addresses, that might help them detect fraud early. The banks, desperate to become their customers' default card on Apple Pay — most add only one to their iPhones — did little to build their own defenses or to push Apple to provide more detailed information about its customers. Some bank executives acknowledged that they were were so scared of Apple that they didn't speak up.

Slashdot Top Deals

Living on Earth may be expensive, but it includes an annual free trip around the Sun.

Working...