Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
News

VP.NET Publishes SGX Enclave Code: Zero-Trust Privacy You Can Actually Verify 12

VP.NET has released the source code for its Intel SGX enclave on GitHub, allowing anyone to build the enclave and verify its mrenclave hash matches what's running on the servers. This takes "don't trust, verify" from marketing to reality, making privacy claims testable all the way down to hardware-enforced execution.

A move like this could set a new benchmark for transparency in privacy tech.
AI

McDonald's AI Hiring Bot Exposed Millions of Applicants' Data To Hackers 25

An anonymous reader quotes a report from Wired: If you want a job at McDonald's today, there's a good chance you'll have to talk to Olivia. Olivia is not, in fact, a human being, but instead an AI chatbot that screens applicants, asks for their contact information and resume, directs them to a personality test, and occasionally makes them "go insane" by repeatedly misunderstanding their most basic questions. Until last week, the platform that runs the Olivia chatbot, built by artificial intelligence software firm Paradox.ai, also suffered from absurdly basic security flaws. As a result, virtually any hacker could have accessed the records of every chat Olivia had ever had with McDonald's applicants -- including all the personal information they shared in those conversations -- with tricks as straightforward as guessing the username and password "123456."

On Wednesday, security researchers Ian Carroll and Sam Curryrevealedthat they found simple methods to hack into the backend of the AI chatbot platform on McHire.com, McDonald's website that many of its franchisees use to handle job applications. Carroll and Curry, hackers with along track record of independent security testing, discovered that simple web-based vulnerabilities -- including guessing one laughably weak password -- allowed them to access a Paradox.ai account and query the company's databases that held every McHire user's chats with Olivia. The data appears to include as many as 64 million records, including applicants' names, email addresses, and phone numbers.

Carroll says he only discovered that appalling lack of security around applicants' information because he was intrigued by McDonald's decision to subject potential new hires to an AI chatbot screener and personality test. "I just thought it was pretty uniquely dystopian compared to a normal hiring process, right? And that's what made me want to look into it more," says Carroll. "So I started applying for a job, and then after 30 minutes, we had full access to virtually every application that's ever been made to McDonald's going back years."
Paradox.ai confirmed the security findings, acknowledging that only a small portion of the accessed records contained personal data. The company stated that the weak-password account ("123456") was only accessed by the researchers and no one else. To prevent future issues, Paradox is launching a bug bounty program. "We do not take this matter lightly, even though it was resolved swiftly and effectively," Paradox.ai's chief legal officer, Stephanie King, told WIRED in an interview. "We own this."

In a statement to WIRED, McDonald's agreed that Paradox.ai was to blame. "We're disappointed by this unacceptable vulnerability from a third-party provider, Paradox.ai. As soon as we learned of the issue, we mandated Paradox.ai to remediate the issue immediately, and it was resolved on the same day it was reported to us," the statement reads. "We take our commitment to cyber security seriously and will continue to hold our third-party providers accountable to meeting our standards of data protection."
News

VP.net Promises "Cryptographically Verifiable Privacy" (torrentfreak.com) 36

TorrentFreak spotlights VP.net, a brand-new service from Private Internet Access founder Andrew Lee (the guy who gifted Linux Journal to Slashdot) that eliminates the classic "just trust your VPN" problem by locking identity-mapping and traffic-handling inside Intel SGX enclaves. The company promises 'cryptographically verifiable privacy' by using special hardware 'safes' (Intel SGX), so even the provider can't track what its users are up to.

The design goal is that no one, not even the VPN company, can link "User X" to "Website Y."

Lee frames it as enabling agency over one's privacy:

"Our zero trust solution does not require you to trust us - and that's how it should be. Your privacy should be up to your choice - not up to some random VPN provider in some random foreign country."

The team behind VP.net includes CEO Matt Kim as well as arguably the first Bitcoin veterans Roger Ver and Mark Karpeles.

Ask Slashdot: Now that there's a VPN where you don't have to "just trust the provider" - arguably the first real zero-trust VPN - are trust based VPNs obsolete?

Comment Re: But I dont want to only get paid for 32 hours/ (Score 1) 181

I've generally preferred to pay people a salary, when reasonable to do so.

I hire(d) people (I still employ some people directly) to do a job. So long as the job was done properly, I'm not a big stickler when it comes to spending time at work. If the job can be done in 4 days, so be it. My concern is that the work is done on time and properly. It's also not important to me how they did the work, so long as it was done right.

I'm all for a 4 hour work week, so long as their wages match what they'd make for a 40 hour work week. Yes, minimum wage is too low. Then again, I'd never consider paying someone the least amount I could pay them by law. That's just a kick in the proverbial nuts and pretty damned degrading. "I'd pay you less, but the law won't allow it."

Comment Re: You cant run fiber in walls as structured cabl (Score 1) 97

My house was built before CAT6 came out. It should be easy to upgrade as everything runs through in-wall conduit. I figured I'd do that for future-proofing.

I've not really seen a need to upgrade. It works well enough and there are jacks in most rooms. I also don't have the bandwidth to make it matter much, though fiber will be here before too long. Upgrading then may matter. (Fiber wasn't going to come up my road, but I contacted the company and a couple of neighbors and I will pay for the fiber to be run.)

Cat5e should still be fine. I'm not going to bother paying for full GB service, as I don't need that much bandwidth. I'll be fine with half of that and CAT5e should be viable.

This is about the 'inadequate' comment you made.

I could see it being inadequate for some people. As for me, it's still holding up and still fit for purpose. I've lived in a bandwidth-impoverished area for going on two decades. So, my needs, perhaps better said expectations, are different. I don't even see a reason to go full boar on the GB speeds. As I am technically a business, they say I can request even higher speeds. I'm simply not interested in that.

Then again... We'll see how I feel after a few months. I may end up wanting to splurge and increase my speeds. It could happen.

Comment Re: You know what... (Score 1) 375

You'd think so, but you won't feel a thing. You won't have to adjust your diet because you'll naturally lose weight. Then, well, you won't even suffer a headache, a toothache, a stubbed toe, or any of those other painful things.

Hmm... This needs a pithy statement that can be summed up enough to fit on a bumper sticker.

Comment Re:You know what... (Score 1) 375

I dunno... I'm a doctor and if you're dead then you're in perfect health. You no longer have any ailments of any kind. You're not going to catch any diseases.

Just to be clear, I'm not a medical doctor. I don't even play a medical doctor on TV. But, I am a doctor - though I don't tend to use the honorary, for a variety of reasons.

Comment Re:cheap EVs (Score 2) 140

This may be of interest, so I'll share it...

https://core.verisk.com/Insigh...

This doesn't mean that EV fires aren't important, it's just that they seem to happen less often (per 100,000 cars) than ICE-powered vehicles. There are other citations, some newer, but I just grabbed the first one from Google.

EV fires still suck to get under control, especially for small volunteer fire departments without a lot of money to upgrade what they have. EV fires still release some pretty awful stuff - but so don't ICE-powered vehicles.

Comment Re:reminds me of Technology Connections (Score 1) 162

For better or worse, Nissan's are often sold (here in the US) to people with poor credit. No, I do not know all the details. I suspect Google knows, but that's the perception. The end result of this is that they're often in horrible condition and driven by drivers who did not care.

And no, it's not a 'classist' thing. I'm sure there's some confirmation bias but they're frequently in horrible condition, to the point of being unsafe. Then, of course, there are the drivers who have less care about their driving habits. Again, that could be some confirmation bias going on, but that's generally why there's a negative view here in the US.

One of my favorite vehicles was a pickup truck that I owned a long time ago. It was just called 'Nissan'. The side helpfully said, 'Pickup'. It was just 2WD but went anywhere I asked of it. The inline 6 cyl engine was amazingly reliable. The body was less reliable and rust was the eventual killer of the truck - but it was already in poor condition when I bought it.

Comment Re:Excess Ph'Ds (Score 2) 78

I'm reminded of Archaeology grad students. I'm convinced they get the worst treatment.

They are quite literally started off by shoveling dirt. Well, that's if they don't start by sifting dirt, but that's usually a volunteer task on a popular dig site.

Over their scholastic career, they'll shovel literal tons of dirt. They'll do more of that after they graduate but at least they have grad students to work down to the good stuff.

Comment Re: As they should (Score 1) 96

Sadly, from my observations, not everyone is in a position to save any significant amounts of money.

Even with 40 hours a week, it'd be difficult to survive on minimum wage while still having anything that qualifies as a satisfactory life.

Working multiple jobs and needing to split resources with roommates is not a very good life and is outside the bounds where I'd consider it a reasonable solution.

Comment Re:Excess Ph'Ds (Score 1) 78

That was similar, though school-provided jobs were paying less than I could otherwise earn. I did some TA work but not as much as some folk did. I'd also taken a bit of a break and was then married, meaning I had to work pretty hard to cover those living expenses. Fortunately, I had other skills (willingness to work) and could work around my schedule. The then-wife worked when she was able/willing. It was expensive to live in the Greater-Boston area.

Slashdot Top Deals

Hotels are tired of getting ripped off. I checked into a hotel and they had towels from my house. -- Mark Guido

Working...