Privacy? What's that?

from here and here

Ring is in some serious trouble over it's abject failure to protect the privacy of it's customers from it's own employees and others, but the thing that stood out to me wasn't that there was an employee abusing his/her access to the video feeds, but rather the mere fact that there were video feeds coming from people's bedrooms and bathrooms. I don't know about you but I wouldn't want people peeping on me while I poop.

You'd think they'd have better defenses

from here and here

Who the heck is in charge of the DoD's app store, and how did so-called "unapproved" apps get into it? I feel like if it's in the store that is implicit approval. Maybe the person responsible didn't have the authority to make that approval but then they probably shouldn't be in a position where they're able to do that - which brings us back to the question of who the heck is in charge.

Too much faith in technology

from here and here

A networking failure shouldn't cause lights to get stuck in the ON position, and not anticipating those kinds of failures in your design is a pretty good indication that you didn't anticipate malicious misuse either. A good engineer anticipates failure. A good security engineer also anticipates malicious misuse. There are probably a number of security vulnerabilities in the system in addition to this lighting control DoS.

How do you mess up water and detergent that bad?

from here and here

Now, I'll grant you even a dumb washing machine could theoretically short circuit, but this short circuit is apparently controllable with software, which makes me think maybe software shouldn't be involved.

It's more "secure"

from here and here

There are some scenarios where I can see fingerprint biometrics providing a lot of additional security, but phones and laptops aren't among them. It's like a combination lock with the combination written on it. They do provide convenience, and maybe that's what we should be caring about, but we shouldn't try to pretend it's for security

Flunking Cryptography 101

from here and here

The revelation that Microsoft Office uses ECB (electronic codebook) mode for it's encryption (not just now but as far back as 2010) is stunning. If you've read a book on cryptography then you would know better than to use ECB mode. If you haven't read a book on cryptography then what the heck are you doing writing the crypto code in something as important as Microsoft Office? 

How do you put someone so green in such a position? Alternatively, if it wasn't a mistake, if it wasn't a matter of a lack of experience (because the failings of ECB were widely known long, long before the creation of Office 2010 - I knew about it in university in the 90s) then could this have actually been a kind of backdoor?

What could possibly go wrong?

from here and here

The idea that if Twitter already has one spy on the payroll there's no harm in getting more is just so bizarre. It's like they're applying the logic people use to rationalize littering to spies. That just leads to more and more litter (and spies), though, so definitely don't follow that logic.

Clean your own house first

from here and here

I realize that Microsoft Defender is a lot better than MSAV was, and that it may even be good enough for PCs, but I don't think it's reached the point of making PCs safer than Macs yet.

In addition to that, I have difficulty imagining most Mac owners using an antivirus at all, never mind one by the makers of Windows. Many Mac owners joke that Windows IS a virus.

Maybe some day MS Defender for Macs will make sense, but not before they clean up their reputation and their own platform.

So much for trustworthy computing

from here and here

Windows 11 Pornado Edition seems like the obvious conclusion to Microsoft's experiments with putting ads into the operating system. I wonder if they had that in mind.

Security for the Horde

from here

WoW has had 2 factor authentication since 2008 (if not earlier). They used a hardware token but have switched to a software token. Banks, meanwhile, were slow to adopt 2FA, and the best you seem to be able to hope for is SMS based authentication.

So much for serving and protecting

from here

It's not just that they let this one bad apple into the police, it's that if this is the the standard of care that was taken when vetting police officers, how many more bad apples are there in there? 

If you say you don't trust the police, well I can't say that I'd blame you. Under the circumstances it's hard to imagine anyone trust them.

Gonna need AdBlock for Windows

from here

I don't know whose idea it was to put ads in the operating system, but clearly it was a bad idea and they should be fired because of how obvious it should have been even without a concrete example of problems in the OS itself. Ads have been a pox on the web for decades and they just get more and more toxic. The people in charge of the OS should have noped right out of that meeting.

I mean, do we have to see malvertizing on the desktop before people clue in?

The Incompetent Revenue Service

from here

The only kind of contract Equifax should be getting is the one where someone pays them lots of money to never touch data again. Here's a million dollars now get the fuck out of business. Obviously that is not the kind of contract the IRS awarded them, much to the IRS' dismay. I don't know what the IRS was expecting. (This may be old news, but still, what WERE they thinking?)

How not to protect your identity

from here

It's bad enough not wearing a mask (in a pandemic, no less) to an event such as that, but to walk around with your identity printed on a card hanging around your neck? You might as well just have a sticker on your shirt that says "Hi, my name is _________". No doubt while the authorities were struggling to put a name to a face for most of the other perpetrators, in this guy's case all they had to do was read.

They take the security of your data, seriously

from here

It's difficult to believe an organization could be so lax, but they're actually being ordered by the court to hire a CISO six years after the breach. My dudes, what the actual fuck have you been doing for the past six years?

When your threat model isn't to scale

from here

You might also ask why there are school police, but I suppose in a country where school shootings are common-place, there might be a compelling argument in favour of a dedicated police presence.

But event that threat model, as scary as it is, doesn't call for armoured vehicles and grenade launchers.

When all you have is a hammer, everything looks like a nail

from here

I really hope NSO group does not get any contracts to do contact tracing. I don't want to see their human-rights-abuse-facilitating tools get broader adoption than they already have. I realize contact tracing can help, but there's got to be a better way than using those particular tools. Maybe something like what's described in this comic.

On an unrelated note, today I learned that that saying in the title about hammer is actually know as Maslow's Hammer or the Law of the Instrument. Yes, the same Maslow that gave us the hierarchy of needs.

Someone is trying to level up to supervillain

from here

While I can certainly imagine motives for launching cyberattacks against the WHO, I can't imagine having the balls to risk disrupting the work that organization is doing right now.

So they can do better crimes

from here

Not only does cryptocurrency seem like the last thing ordinary North Koreans would need or could use, but to so openly flaunt authorities when you know what you're doing is illegal? It's almost like someone wanted to get caught.

Let's call a spade a spade

from here

I saw the term surveillanceware used in this Ars Technica article and it got under my skin. I've also seen stalkerware and creepware, and they all facilitate the same thing - spying on the person using the device the malware is installed on. Why do we need all these terms for the same thing? Do they add anything meaningful? Not that I can see.

The term surveillanceware is particularly bad. Compared to "spy", the word "surveillance" is harder to spell, harder to say, and unfamiliar to the less educated members of society. If I were trying to give spyware a PR make-over, surveillanceware seems like a good way to do it, and that begs the question: who would try to do such a thing?