• Home
  •  » High Street
  •  » The Bush-Obama-Trump Whitehouse - Your privacy down the shitter

#953 2016-05-05 16:49:35

Passwords, which go back to the big iron days when a single extra character was worth your left testicle, are completely out of date, especially with the power that your average laptop or PC has.  Passwords are required to be, effectively, human difficult but machine easy.  Any free password cracking program will long figure out "Ad0i0asdfd!" before it could ever decrypt "My dinosaur is purple and his name is Barney."  In fact, some experts have determined that such a pass phrase is beyond anything even the NSA could handle, especially with 256 bit encryption.

And, making you change your password periodically makes things even worse.  Most of the more savvy users use the hack of Password01@ changed to Password02@, rinse, lather, repeat, which totally defeats the purpose.

Change password fields to a variable length phrase of between 20 characters and 100.  (with no characters being invalid including spaces)

Offline

 

#954 2016-05-05 17:06:36

Baywolfe wrote:

Passwords, which go back to the big iron days when a single extra character was worth your left testicle, are completely out of date, especially with the power that your average laptop or PC has.  Passwords are required to be, effectively, human difficult but machine easy.  Any free password cracking program will long figure out "Ad0i0asdfd!" before it could ever decrypt "My dinosaur is purple and his name is Barney."  In fact, some experts have determined that such a pass phrase is beyond anything even the NSA could handle, especially with 256 bit encryption.

And, making you change your password periodically makes things even worse.  Most of the more savvy users use the hack of Password01@ changed to Password02@, rinse, lather, repeat, which totally defeats the purpose.

Change password fields to a variable length phrase of between 20 characters and 100.  (with no characters being invalid including spaces)

It's important to teach users that the internet is far more risky than a password list kept under your keyboard.  So change them, use sentences when available and write them down.  Running your ATM card through the pump scanner at your local gas station is far more dangerou than writing it down at home.

Offline

 

#955 2016-05-05 17:11:43

Emmeran wrote:

Running your ATM card through the pump scanner at your local gas station is far more dangerous than writing it down at home.

Home isn't where the biggest problem is.  It's been shown repeatedly that users will have the same password for multiple systems, sites, etc.  So if compromised in one place, compromised everywhere.

As for using your debit card at the gas pump, sure someone might have a skimmer on the pump, but the onus of responsibility falls to the bank.  You'll get your money back.

Offline

 

#958 2016-05-10 00:36:54

http://arstechnica.com/tech-policy/2016 … ta-mining/

In another sign that tensions between Silicon Valley and the US government are strong, Twitter is now barring US intel agencies from a service that analyzes the micro-blogging service's entire feed.

San Francisco-based Twitter has informed business partner Dataminr to cut off access to the CIA, NSA, and other government surveillance outfits.

Offline

 

#960 2016-05-12 23:49:34

Somewhat tangential, but still related.

For most of our history, records of judicial proceedings were always accessible to the public, a practice inherited from English common law courts. Limited exceptions only began to appear around the turn of the 20th century, mostly in divorce, adoption, or juvenile proceedings. In 1915, the Supreme Court first encountered a judicial sealing order, which Justice Holmes denounced as "a judicial fiat" having "no judicial character" and "in excess of the jurisdiction of the lower court" before granting a writ of mandamus to revoke it.

That traditional aversion to court secrecy has been overcome in the last few decades. To take but one example, the case name In re Sealed Case first appeared in 1981; it is now the most common case name on the D.C. Circuit Court of Appeals docket. Another telling sign is that the government is far more aggressively (and successfully) asserting evidentiary privileges than ever before.

Last edited by square (2016-05-13 00:08:11)

Offline

 

#963 2016-05-15 19:23:07

Surely, any American can't truly expect to have a private conversation without carrying around one of these at all times?

https://cruelery.com/uploads/72_portable-cone-of-silence.jpg

Auto-edited on 2020-08-02 to update URLs

Offline

 

#964 2016-05-15 20:53:46

square wrote:

Surely, any American can't truly expect to have a private conversation without carrying around one of these at all times?

https://cruelery.com/uploads/72_portable-cone-of-silence.jpg

I thought we had a separate thread for shit like that.

Auto-edited on 2020-08-02 to update URLs

Offline

 

#965 2016-05-17 23:44:36

Apparently "the dog ate my homework" is standard procedure for the CIA.

The CIA inspector general's office -- the spy agency's internal watchdog -- has acknowledged it "mistakenly" destroyed its only copy of a mammoth Senate torture report at the same time lawyers for the Justice Department were assuring a federal judge that copies of the document were being preserved, Yahoo News has learned.

Offline

 

#966 2016-05-18 00:59:54

The drip becomes a stream; soon to be a flood?

We are, beginning today, publishing in installments the NSA's internal SIDtoday newsletters, which span more than a decade beginning after 9/11. We are starting with the oldest SIDtoday articles, from 2003, and working our way through the most recent in our archive, from 2012. Our first release today contains 166 documents, all from 2003, and we will periodically release batches until we have made public the entire set.

Offline

 

#967 2016-05-20 00:46:37

https://medium.com/@RonWyden/shaking-my … 1b60db9086

Sen. Ron Wyden wrote:

Last month, at the request of the Department of Justice, the Courts approved changes to the obscure Rule 41 of the Federal Rules of Criminal Procedure, which governs search and seizure. By the nature of this obscure bureaucratic process, these rules become law unless Congress rejects the changes before December 1, 2016.

Today I, along with my colleagues Senators Paul from Kentucky, Baldwin from Wisconsin, and Daines and Tester from Montana, am introducing the Stopping Mass Hacking (SMH) Act (bill, summary), a bill to protect millions of law-abiding Americans from a massive expansion of government hacking and surveillance.

Offline

 

#968 2016-05-23 23:15:28

Just report your concerns through the chain of command, eh?

During dozens of hours of interviews, [former Department of Defense Assistant Inspector General John] Crane told me how senior Defense Department officials repeatedly broke the law to persecute [NSA whistleblower Thomas] Drake. First, he alleged, they revealed Drake's identity to the Justice Department; then they withheld (and perhaps destroyed) evidence after Drake was indicted; finally, they lied about all this to a federal judge.

The supreme irony? In their zeal to punish Drake, these Pentagon officials unwittingly taught Snowden how to evade their clutches when the 29-year-old NSA contract employee blew the whistle himself. Snowden was unaware of the hidden machinations inside the Pentagon that undid Drake, but the outcome of those machinations - Drake's arrest, indictment and persecution - sent an unmistakable message: raising concerns within the system promised doom.

Offline

 

#969 2016-05-25 16:22:09

https://cruelery.com/sidepic/crystaeyelball.png


WP Forecasts Our Future.

Auto-edited on 2020-08-02 to update URLs

Offline

 

#970 2016-05-26 00:11:00

Another technique where the Chinese are leading: 1/2% of social media posts are covert government propaganda.

China's government fabricates about 488 million social media comments a year -- nearly the same as one day of Twitter's total global volume -- in a massive effort to distract its citizens from bad news and sensitive political debates, according to a study.

Three scholars led by Gary King, a political scientist at Harvard University who specializes in using quantitative data to analyze public policy, ran the first systematic study of China's online propaganda workers, known as the Fifty Cent Party because they are popularly believed to be paid by the government 50 Chinese cents for every social media post.

Contrary to popular perception inside China, the Fifty Cent Party avoids engaging in debates with critics and doesn't make fun of foreign governments. Instead, it mostly works to distract public attention away from hot topics by highlighting the positive, cheering the state, symbols of the regime, or the Communist Party's revolutionary past.

Offline

 

#971 2016-05-26 09:12:31

We already have politics, religion, and television to distract our citizens.

Bah, the Chinese are pikers compared to us.

Offline

 

#972 2016-05-28 17:28:58

Because what the FBI needs is a freer hand.

A provision snuck into the still-secret text of the Senate's annual intelligence authorization would give the FBI the ability to demand individuals' email data and possibly web-surfing history from their service providers without a warrant and in complete secrecy.

If passed, the change would expand the reach of the FBI's already highly controversial national security letters. The FBI is currently allowed to get certain types of information with NSLs -- most commonly, information about the name, address, and call data associated with a phone number or details about a bank account.

Since a 2008 Justice Department legal opinion, the FBI has not been allowed to use NSLs to demand "electronic communication transactional records," such as email subject lines and other metadata, or URLs visited.

Offline

 

#973 2016-05-28 18:54:41

square wrote:

Because what the FBI needs is a freer hand.

Dude, you obviously just aren't faithful enough, we can't stop Emmanuel Goldstein if we don't work together on this.  The danger Goldstein represents is far more horrible than a little intrusion on your privacy.

Offline

 

#974 2016-06-01 01:51:03

Eric Holder: Snowden did a public service, but I still want him to face capital charges.

Offline

 

#975 2016-06-02 01:44:32

Eric Holder = גוי של שבת

Offline

 

#976 2016-06-03 01:04:16

A small victory, but still a victory.

As part of our ongoing commitment to transparency, Yahoo is announcing today the public disclosure of three National Security Letters (NSLs) that it received from the Federal Bureau of Investigation (FBI). This marks the first time any company has been able to publicly acknowledge receiving an NSL as a result of the reforms of the USA Freedom Act.

Offline

 

#977 2016-06-04 14:51:01

I'm trying to figure out if Yahoo is just trying to play "too big to shush". At some point one of these multi-billion dollar communications companies will realize that the FBI really doesn't have the power, even if they have the legal justification, to suppress NSLs. After all, once the cow is out of the barn, no amount of fine or jail time will get it back in. The FBI knows they have been an untenable solution, they just aren't creative enough to come up with a replacement that wouldn't get leaked just as quickly.

Two people can keep a secret, if....

Offline

 

#978 2016-06-04 20:56:41

Certainly the big boys have a lot more lawyers to throw at this.  Some of them choose to prioritize user rights, and some of them don't. Almost nobody seems to be willing to take things so far as to risk actual jail, though.

Offline

 

#979 2016-06-04 21:39:22

square wrote:

Almost nobody seems to be willing to take things so far as to risk actual jail, though.

https://cruelery.com/img/whohasyourbackup.png

The only legible text was Bigcat's ascii art, I promise!

Auto-edited on 2020-08-02 to update URLs

Offline

 

#980 2016-06-06 23:07:28

Les Propheties...

https://cruelery.com/sidepic/1984-versionAfront.jpg


~ click ~

Auto-edited on 2020-08-02 to update URLs

Offline

 

#982 2016-06-09 23:54:05

Turns out the insider who got a slap on the wrist (because, of course, he's such a good guy) was a lot more chatty than we were told.

"There is a recorded conversation between [David] Petraeus and, inter alia, Washington Post reporters, which, based on the information and belief of your affiant, occurred in or about March 2011," Special Agent Diane Wehner wrote. "In the conversation, Petraeus stated, 'I would really love to be on background as a senior military officer.' Later in the recording, Petraeus discusses sensitive military campaigns and operations, some of which, on the basis of a preliminary review ... is believed to contain classified information, including information at the Top Secret level."

Offline

 

#983 2016-06-10 00:18:24

square wrote:

Turns out the insider who got a slap on the wrist (because, of course, he's such a good guy) was a lot more chatty than we were told.

They always are when a chantoozie temptress plays lead.

Last edited by choad (2016-06-10 05:36:55)

Offline

 

#984 2016-06-11 10:57:55

If you carry a significant amount of cash, you're already subject to having it stolen by forfeited to the cops.  Now the same is true for your cards.

And fortunately for them, there's no warrant required for them to go fishing.

Offline

 

#985 2016-06-11 11:11:32

Watching the watchers is so much easier when you just agree with whatever they want.

Offline

 

#986 2016-06-16 08:09:18

choad wrote:

Les Propheties...

https://cruelery.com/sidepic/1984-versionAfront.jpg


~ click ~

The telescreen watches you as you watch it.

Auto-edited on 2020-08-02 to update URLs

Offline

 

#987 2016-06-19 19:56:22

Smile, you're on Candid Camera:

According to the GAO Report, FBI's Facial Analysis, Comparison, and Evaluation (FACE) Services unit not only has access to FBI's Next Generation Identification (NGI) face recognition database of nearly 30 million civil and criminal mug shot photos, it also has access to the State Department's Visa and Passport databases, the Defense Department's biometric database, and the drivers license databases of at least 16 states. Totaling 411.9 million images, this is an unprecedented number of photographs, most of which are of Americans and foreigners who have committed no crimes.

Offline

 

#988 2016-06-20 10:10:08

square wrote:

Smile, you're on Candid Camera:

According to the GAO Report, FBI's Facial Analysis, Comparison, and Evaluation (FACE) Services unit not only has access to FBI's Next Generation Identification (NGI) face recognition database of nearly 30 million civil and criminal mug shot photos, it also has access to the State Department's Visa and Passport databases, the Defense Department's biometric database, and the drivers license databases of at least 16 states. Totaling 411.9 million images, this is an unprecedented number of photographs, most of which are of Americans and foreigners who have committed no crimes.

To be fair, what do you think the government does with all of the required passport sized photos that you have to provide or have taken for a digital ID? Throw them away? Print them and stick them in a card catalog?

Offline

 

#989 2016-07-08 00:29:50

Going dark?  Hardly.

That means that in 2015, out of 4,148 total wiretaps, only 11 encountered a form of encryption law enforcement could not break. That's about one quarter of 1 percent.

Plus, you gotta love those checks and balances.

The 2015 Wiretap Report also notes that judges denied none of the 4,148 wiretap orders sought by police -- revealing an overwhelming deference to law enforcement on the part of courts.

Last edited by square (2016-07-08 00:31:32)

Offline

 

#990 2016-07-08 13:31:39

square wrote:

Plus, you gotta love those checks and balances.

The 2015 Wiretap Report also notes that judges denied none of the 4,148 wiretap orders sought by police -- revealing an overwhelming deference to law enforcement on the part of courts.

Especially because many of the wiretaps are for "Unknown Subject" and the purpose being specified is "Conspiracy" without providing further details.

Offline

 

#991 2016-07-12 01:53:20

Who will police the police?

More than 800 UK police staff inappropriately accessed personal information between June 2011 and December 2015, according to a report from activist group Big Brother Watch. . . .

In total, 2,315 incidents of inappropriate access or distribution of data were reported.

The majority of incidents, 1,283, ended up with no disciplinary action taking place, while 297 ended in a resignation or dismissal, 258 resulted in a written or verbal warning, and 70 led to a criminal conviction or caution.

Look forward to more as the major proponent of the new Snooper's Charter, which sets forth massive new databases of citizens' Internet histories and other details, will become the next Prime Minister in a few days.

Offline

 

#992 2016-07-13 00:57:09

Senators Ron Wyden and Martin Heinrich warn against efforts to slip extra surveillance in to various bills.

The reality is that getting access to people's web browsing history is almost like spying on their thoughts. This level of surveillance absolutely ought to come with court oversight. Yet a number of senators are moving to go in the opposite direction. The annual intelligence bill would let any FBI field office issue something called a National Security Letter to demand this information. These letters are essentially administrative subpoenas and often come with gag orders that prevent the company that receives them from discussing them publicly. . . .

But the FBI already has at least two separate ways they can quickly obtain these electronic records with court oversight. First, under the Patriot Act's section 215, the FBI can get a court order from the Foreign Intelligence Surveillance Court to obtain a suspect's electronic records. The president's surveillance review group, which included former top intelligence officials, said this kind of court oversight should be required for this kind of information. Second, in emergency situations where the FBI believes it needs to move immediately, it already has the authority to get these records first, and then settle up with the court afterward.

Offline

 

#993 2016-07-13 01:37:51

Offline

 

#994 2016-07-16 23:05:30

There are search options, if you will use them.

Offline

 

#995 2016-07-17 00:16:27

At least some courts don't want to give every shortcut to the feds.

In a case closely watched by much of the tech industry, an appellate court has ruled in favor of Microsoft, finding that the company does not have to turn over the contents of an Outlook.com user's inbox to American investigators because that user's data is held abroad, in Ireland. . . .

The US government, could, however, use the Mutual Legal Assistance Treaty process as a way to contact Irish authorities to serve a local warrant upon Microsoft's Irish subsidiary, which controls the data center, to obtain the data. That procedure, which may have already been undertaken, is likely slower than a SCA [Stored Communications Act] warrant.

Offline

 

#996 2016-08-26 01:00:05

Long-term aerial dragnet surveillance is now a charitable activity.

The firm, Persistent Surveillance Systems (PSS), has been actively trying to get new contracts with large cities nationwide. When Ars profiled the company in 2014, company CEO Ross McNutt said PSS was trying to work with Chicago after having controversially flown for nine days over Compton, California--adjacent to Los Angeles--in 2012.

PSS has evidently now succeeded in Baltimore. As Businessweek reported, the Baltimore project was funded by two Texan philanthropists, John and Laura Arnold, who said that if the company could find a city to partner with, they would fund it. . . .

"In December 2015, BCF [Baltimore Community Foundation] received a gift of $120,000 from the Fidelity Charitable Fund for the Baltimore Police Foundation Special Grants Fund, one of those 800 funds at BCF," according to the statement sent by Andrew Waldman. Waldman went on to explain that the Baltimore Police Foundation Special Projects Fund then paid the same $120,000 to Persistent Surveillance Systems. "Recent payments from this fund have been used to purchase food for community events, trophies for sports teams, and items for the city police museum."

Offline

 

#997 2016-08-26 01:23:17

NSA hacks, and continues to hack, Cisco networking gear.  Well actually, now everyone can even if they weren't doing so before.

Recently released code that exploits Cisco System firewalls and has been linked to the National Security Agency can work against a much larger number of models than many security experts previously thought.

An exploit dubbed ExtraBacon contains code that prevents it from working on newer versions of Cisco Adaptive Security Appliance (ASA), a line of firewalls that's widely used by corporations, government agencies, and other large organizations. When the exploit encounters 8.4(5) or newer versions of ASA, it returns an error message that prevents it from working. Now researchers say that with a nominal amount of work, they were able to modify ExtraBacon to make it work on a much newer version. While Cisco has said all versions of ASA are affected by the underlying vulnerability in the Simple Network Messaging Protocol, the finding means that ExtraBacon poses a bigger threat than many security experts may have believed. . . .

As Ars previously reported, the zero-day exploit allows remote attackers who have already gained a foothold in a targeted network to take full control of a firewall. It was one of more than a dozen highly advanced attacks that was part of a mysterious leak by a previously unknown group calling itself the ShadowBrokers. Researchers say digital fingerprints left inside the code all but prove the attacks belonged to the Equation Group, an elite hacking crew with ties to the NSA-sponsored Stuxnet and Flame malware that targeted Iran and the Middle East.

But somehow they don't think it was necessary to tell all those American companies relying on the same equipment.

Yet surely by every criterion of evaluation [federal cybersecurity coordinator Michael] Daniel himself lays out, the Cisco vulnerability--key to an exploit tool codenamed ExtraBacon--was a prime candidate for disclosure. It's a high-severity vulnerability that would allow an attacker to effectively monitor all traffic on a compromised network, affecting the leading manufacturer of network routing equipment, and thus leaving a vast number of both American and foreign companies subject to attack. For precisely those reasons, of course, the ExtraBacon exploit would have been of great value to the NSA, and the temptation to at least temporarily make use of it must have been equally strong. The decision to do so may well have been correct initially. Yet failing to notify Cisco of such a grave security hole for three full years is simply indefensible--and as we now know, left users and firms alike at the mercy of the malicious actors who had obtained the code. (The past tense is actually inappropriate here: As of this writing Cisco has not yet released a full patch, and many networks will doubtless remain vulnerable for some time even after a fix is available.) Almost by definition, a process that led to this outcome is dysfunctional.

This hack also ought to give pause to anyone swayed by the government's assurances that we can mandate government backdoors in encryption software and services, allowing the "good guys" (law enforcement and intelligence agencies) to access the communications of criminals and terrorists without compromising the security of millions of innocent users. If even the NSA's most closely guarded hacking tools cannot be secured, why would any reasonable person believe that keys to cryptographic backdoors could be adequately protected by far less sophisticated law enforcement agencies?

Offline

 

#998 2016-08-26 08:57:19

Square you're starting to drift off into Kathy's territory.

Offline

 

#999 2016-08-26 09:12:30

Baywolfe wrote:

Square you're starting to drift off into Kathy's territory.

As someone who works for a "big name" IT company I can assure you this is very real and HUGE topic in IT security circles.

Offline

 

#1000 2016-08-26 09:47:37

Baywolfe wrote:

Square you're starting to drift off into Kathy's territory.

Industry titans and colluding nation states across the planet are spending obscene amounts to deploy vast dark armies in search of two elusive grails; how do they keep what they've stolen and how do they get more. It won't end well.

Offline

 
  • Home
  •  » High Street
  •  » The Bush-Obama-Trump Whitehouse - Your privacy down the shitter

Board footer

cruelery.com