Comment "gaps in the security of digital certificates" (Score 2) 34
So the gap is "the secret key must be kept secret"? I don't see that as a digital certificate failing. It's also the reason we have revocation lists.
Comment Why not send a hash of the email addresses (Score 1) 134
The 3rd party would only ever get the intersection of "do not mail" and their own marketing list. And emails wouldn't be sitting around in clear text in a database / filesystem..
Comment What are Supercookies - in 20seconds (Score 1) 45
Here's what 'supercookies' actually are (from the horse's mouth: http://cyberlaw.stanford.edu/node/6715)
* you hit a page which includes a wlHelper.js script
* wlHelper.js is served with header that tell your browser - cache this forever
* wlHelper.js contains code something like this:
var unique_id = 'RANDOM_LOOKING_STRING_JUST_FOR_YOU'
if MUID cookie doesn't already exist
set MUID cookie to unique_id
You delete your MUID cookie - but next time you hit a page that contains wlHelper.js the cached version is pulled form your browser. unique_id is there in the cached code, so the cookie gets set again.
Australian Stats Agency Goes Open Source 51
jimboh2k writes "The Australian Bureau of Statistics will use the 2011 Census of Population and Housing as a dry run for XML-based open source standards DDI and SDMX in a bid to make for easier machine-to-machine data, allowing users to better search for and access census datasets. The census will become the first time the open standards are used by an Australian Federal Government agency."
Comment Re:How does centralized login solve keylogging? (Score 1) 127
Combine centralized and "multi-factor"? Build more PCs with smart card readers?
I'd like to see google offer some form of multifactor on their openid provider. A keyring token generator, or maybe a smartphone app?
Comment Pay Amazon Turk to "crowdsource" it (Score 1) 221
Here's someone who has already done it..
http://waxy.org/2008/09/audio_transcription_with_mechanical_turk/
Split up the audio into 5 min pieces.
Set up a template on Amazon Turk for'workers' to grab the 5 min mp3 files, and pay them $2 for each file translated.
More info in the comments. http://www.audiobookcutter.com/ is capable of chopping up the file at the silences for you.
Comment Re:Working as a dialler coder... (Score 1) 234
Could be "call back" spam, i.e. I look at my phone and see "missed call from 555-1234". I swear I didn't hear that ring, but I call the number back anyways - and I get a recorded message selling some crap. So I generally google / don't call numbers I don't recognise now. If someone has something important to tell me they'll leave a message.
Comment worm potential (Score 1) 436
I'm surprised a nasty worm hasn't propagated via torrent client exploits. Get a list of IPs from a tracker AND the client/version they are using. Not only that: all the users would've opened the port on their router..
Comment Re:Anthropology (Score 1) 311
X-files has gone off TV?
Comment Re:The new way to shut ppl down who you don't like (Score 5, Interesting) 123
Can you easily implicate people by registering their IP address with a tracker? From the article:
...requests to BitTorrent trackers can also use CoralCDN, as these are simply HTTP GETs with a client's relevant information encoded in the tracker URL's query string, e.g., http://denis.stalker.h3q.com.6969.nyud.net/announce?info_hash=(hash)&peer_id=(name)&port=52864&uploaded=231374848&downloaded=2227372596&left=0&corrupt=0&key=E0591124&numwant=200&compact=1&no_peer_id=1. Notice that the HTTP request includes a peer's unique name (a long random string) and a port number, but notably does not include an IP address for that client. It's an optional parameter in the specification that many BitTorrent clients don't include. (In fact, even if the request includes this IP parameter, some trackers ignore it.) Instead, the tracker records the network-level IP address from where the HTTP request originated (the other end of the TCP connection), together with the supplied port, as the peer's network address.
In this case CoralCDN was effectively acting as a proxy - the IP address wasn't being falsified. Although these guys did appear to have some luck with falsified IP addresses: Why My Printer Received a DMCA Takedown Notice.
Comment Re:Strike 2 (Score 1) 197
Two more strikes and Google gets their internet connection cut? Oh, no!
Comment Re:Does it self propagate? (Score 1) 215
whoops: (i was in the process of RTFA)
[09:04] First i was curious to how far something like this would actually spread, i think what most people were unaware of is the fact it IS a worm and every phone that got infected with it was spreading it (I initially only infected 3 phones when I woke up i checked google and found out a fair few people were hit with it)
Comment Does it self propagate? (Score 1) 215
I get the impression it doesn't. Just connects SSH, and sends some commands to change your desktop.
No self propagation = not really a worm.
Comment How does this work (in 20 seconds) (Score 5, Informative) 351
what usually happens:
* you request a cert common-name=serverbox.mydomain.com from a Certificate Authority (CA)
* CA determines you are authorized to make this request on behalf of mydomain.com
* serverbox.mydomain.com serves down the signed cert, your browser makes sure website == common-name == serverbox.mydomain.com
what these clever guys discovered:
* you can request a cert common-name=paypal.com\0.mydomain.com
* CA determines you are authorized to make this request on behalf of mydomain.com
* man-in-the-middle sits in between you and paypal.com, serves down this cert, victim's browser makes sure website == common-name == paypal.com (whoops!)
* victim sees paypal.com in their browser with that reassuring padlock
Comment Re:Go after the software companies (Score 1) 130
How does the company paying commission make money off this? Redirecting your browser to their spammy search engine, pop up ads?
