schneier

Zoom transmits your info through China, and uses non-standard encryption, researchers say

“Researchers conclude that Zoom uses non-industry-standard cryptographic techniques with identifiable weaknesses and is not suitable for sensitive communications.”

Facial recognition isn't just bad because it invades privacy: it's because privacy invasions fuel discrimination

Bruce Schneier writes in the New York Times that banning facial recognition (as cities like San Diego, San Francisco, Oakland, Brookline and Somerville have done) is not enough: there are plenty of other ways to automatically recognize people (gait detection, high-resolution photos of hands that reveal fingerprints, voiceprints, etc), and these will all be used for the same purpose that makes facial recognition bad for our world: to sort us into different categories and treat us different based on those categories. Read the rest

Schneier: "It's really too late to secure 5G networks"

Bruce Schneier's Foreign Policy essay in 5G security argues that we're unduly focused on the possibility of Chinese manufacturers inserting backdoors or killswitches in 5G equipment, and not focused enough on intrinsic weakness in a badly defined, badly developed standard wherein "near-term corporate profits prevailed against broader social good." Read the rest

Documentation Gathering, Sanitization, and Storage: an excerpt from "A Public Service"

[Yesterday, we published my review of Tim Schwartz's new guide for whistleblowers, A Public Service: Whistleblowing, Disclosure and Anonymity; today, I'm delighted to include this generous excerpt from Schwartz's book. Schwartz is an activist whom I've had the pleasure of working with and I'm delighted to help him get this book into the hands of the people who need to read it. -Cory]

Collection As you collect documents and bring new information to light, be aware that you are in an escalating digital arms race. There will always be new ways that data forensics can identify you, or uncover information based on data that you inadvertently leave in your files, or data that is retained in logs noting who has accessed what files on what network. Recently it was discovered that noise from electrical grids can be used to quite accurately pinpoint when, and potentially where, an audio recording was made. The best way to win this war—or at least to avoid becoming collateral damage—is to work outside the standard methods and find partners who have experience. Read the rest

Model stealing, rewarding hacking and poisoning attacks: a taxonomy of machine learning's failure modes

A team of researchers from Microsoft and Harvard's Berkman Center have published a taxonomy of "Failure Modes in Machine Learning," broken down into "Intentionally-Motivated Failures" and "Unintended Failures." Read the rest

How (and why) to become a tech policy activist

Caroline McCarthy is a journalist and ex-googler who now works as an ad-tech exec for a startup that Fox bought and they transfered to Disney when the two companies merged; in this great, impassioned Tedx talk, she lays out the case for being a "tech policy activist" and explains how the field of tech policy, though neglected by politicians and pollsters, is vital to many aspects of our daily lives, and how it fails to decompose neatly on left-right lines and nevertheless demands our close attention lest it be formulated in ways that disappoint or even harm us. It's a great talk, akin in some ways to Schneier's plea for "public interest technologists." Read the rest

Beyond antitrust: the anti-monopoly movement and what it stands for

During a lunch break at the “New Future for Antitrust” conference at the University of Utah, Lina Khan (previously), Marshall Steinbaum (previously), and Tim Wu (previously) drafted "https://onezero.medium.com/the-utah-statement-reviving-antimonopoly-traditions-for-the-era-of-big-tech-e6be198012d7"The Utah Statement, setting out a program for fighting monopolies beyond the mere revival and exercise of antitrust law, premised on the notion "that concentrated private power has become a menace, a barrier to widespread prosperity." Read the rest

The top FBI lawyer who tried to force Apple to backdoor its crypto now says working crypto is essential to public safety and national security

Jim Baker served as the FBI's general counsel from 2014 until 2017, and he presided over the the FBI's attempt to force Apple to undermine its cryptography under the rubric of investigating the San Bernadino shooters; he has long been a prominent advocate for mass surveillance, but he has had a change of heart: in a long, detailed essay on Lawfare, Baker explains why he believes that governments should not seek to introduce defects into cryptographic systems. Read the rest

Bruce Schneier makes the case for "public interest technologists"

Law school grads routinely go to work for crusading nonprofits and even those in private practice do pro bono work, thanks to a widespread understanding that lawyers have a professional duty to work for the public interest -- after all, understanding and navigating the law is a necessary precondition for freedom and fairness. Read the rest

After banning working cryptography and raiding whistleblowers, Australia's spies ban speakers from national infosec conference

Australian politics are a revolting mess of unstable governments dominated by xenophobic, climate-denying far-right oligarchs, and the only check on their power is the fact that Australian governments are so riven by internal strife and unhinged authoritarianism that they tend to collapse on a quarterly basis, triggering new elections and/or leadership contests. Read the rest

Assessing the security of devices by measuring how many difficult things the programmers tried to do

The Cyber Independent Testing Lab is a security measurement company founded by Mudge Zadko (previously), late of the Cult of the Dead Cow and l0pht Heavy Industries and the NSA's Tailored Access Operations Group; it has a unique method for assessing the security of devices derived from methods developed by Mudge at the NSA. Read the rest

Why haven't cyberinsurers exerted more pressure on companies to be better at security?

For decades, people (including me) have predicted that cyberinsurers might be a way to get companies to take security seriously. After all, insurers have to live in the real world (which is why terrorism insurance is cheap, because terrorism is not a meaningful risk in America), and in the real world, poor security practices destroy peoples' lives, all the time, in wholesale quantities that beggar the imagination. Read the rest

Alex Stamos schools Apple after they whine about Google revealing a whack of Ios zero-days

Early this month, Google's Project Zero revealed a breathtaking attack on multiple OSes, including Apple's Ios, in which a website that served Uyghur people was found to be hosting at least five different kinds of Ios malware that exploited previously unknown defects in Apple's code (the attack is presumed to have been the work of the Chinese state, which has been prosecuting a genocidal campaign against Uyghurs, whose high-tech fillips have seen both cities and apps suborned to aid in the pogrom). Read the rest

Notpetya: the incredible story of an escaped US cyberweapon, Russian state hackers, and Ukraine's cyberwar

Andy Greenberg (previously) is Wired's senior security reporter; he did amazing work covering Russian cyberwarfare in Ukraine, which he has expanded into a forthcoming book: Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers (I read it for a blurb and a review; it's excellent). Read the rest

Defeating Apple's Faceid's proof-of-life by putting tape over glasses' lenses

Apple's Faceid -- a facial recognition tool that unlocks mobile devices -- has a countermeasure that is designed to prevent attackers from scanning an sleeping/unconscious (or dead) person's face to unlock their phone, by scanning the face for signs of consciousness. Read the rest

Design competition to create graphics to illustrate cybersecurity stories

Illustrating abstract articles is a pain in the ass, and in the age of social media, a post without an illustration is likely to disappear without attaining any kind of readership, which leaves those of us who cover the field endlessly remixing HAL9000 eyes using walls of code, Matrix text-waterfalls, or variations on hacker-in-a-hoodie. Read the rest

Siemens contractor hid "logic bomb" in complicated spreadsheet, guaranteeing future maintenance work

David Tinley developed complex spreadsheets under contract to Siemens, which used them to manage its equipment orders; Tinley hid "logic bombs" in the spreadsheets' scripts that caused them to malfunction every couple of years, which would gin up new work for him as he was called in to fix them. Read the rest

Next page