Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Researchers Propose a Revocable Identity-Based Encryption Scheme

timothy posted about half an hour ago | from the now-who-was-I? dept.

Encryption 5

jd writes Identity-based public key encryption works on the idea of using something well-known (like an e-mail address) as the public key and having a private key generator do some wibbly-wobbly timey-wimey stuff to generate a secure private key out if it. A private key I can understand, secure is another matter. In fact, the paper notes that security has been a big hassle in IBE-type encryption, as has revocation of keys. The authors claim, however, that they have accomplished both. Which implies the public key can't be an arbitrary string like an e-mail, since presumably you would still want messages going to said e-mail address, otherwise why bother revoking when you could just change address?

Anyways, this is not the only cool new crypto concept in town, but it is certainly one of the most intriguing as it would be a very simple platform for building mostly-transparent encryption into typical consumer apps. If it works as advertised. I present it to Slashdot readers to engender discussion on the method, RIBE in general and whether (in light of what's known) default strong encryption for everything is something users should just get whether they like it or not.

Ask Slashdot: Is iOS 8 a Pig?

timothy posted 12 hours ago | from the not-intended-to-denigrate-pigs dept.

IOS 334

kyjellyfish writes I've been using iOS 8 for several days and aside from a few gimmicks and add-ons that attempt to achieve parity with Android, my experience has been overwhelmingly unsatisfactory. My chief complaint is that the vast majority of my apps are slow to boot and noticeably sluggish in operation. I want to point out that all of these apps have been "upgraded" specifically for iOS 8 compatibility. Previous operating system upgrades have been relatively seamless, so I'm asking whether other slashdotters have experienced this degraded performance.

Wired Profiles John Brooks, the Programmer Behind Ricochet

timothy posted 13 hours ago | from the bouncy-bouncy dept.

Encryption 44

wabrandsma writes with this excerpt from Wired: John Brooks, who is just 22 and a self-taught coder who dropped out of school at 13, was always concerned about privacy and civil liberties. Four years ago he began work on a program for encrypted instant messaging that uses Tor hidden services for the protected transmission of communications. The program, which he dubbed Ricochet, began as a hobby. But by the time he finished, he had a full-fledged desktop client that was easy to use, offered anonymity and encryption, and even resolved the issue of metadata—the "to" and "from" headers and IP addresses spy agencies use to identify and track communications—long before the public was aware that the NSA was routinely collecting metadata in bulk for its spy programs. The only problem Brooks had with the program was that few people were interested in using it. Although he'd made Ricochet's code open source, Brooks never had it formally audited for security and did nothing to promote it, so few people even knew about it.

Then the Snowden leaks happened and metadata made headlines. Brooks realized he already had a solution that resolved a problem everyone else was suddenly scrambling to fix. Though ordinary encrypted email and instant messaging protect the contents of communications, metadata allows authorities to map relationships between communicants and subpoena service providers for subscriber information that can help unmask whistleblowers, journalists's sources and others.

Secret Service Critics Pounce After White House Breach

timothy posted yesterday | from the owen-wilson-has-the-president-well-protected dept.

Government 187

HughPickens.com writes On Friday evening, a man jumped the White House fence, sprinted across the North Lawn toward the residence, and was eventually tackled by agents, but not before he managed to actually enter the building. Now CBS reports that the security breach at the White House is prompting a new round of criticism for the Secret Service, with lawmakers and outside voices saying the incident highlights glaring deficiencies in the agency's protection of the president and the first family. "Because of corner-cutting and an ingrained cultural attitude by management of 'we make do with less,' the Secret Service is not protecting the White House with adequate agents and uniformed officers and is not keeping up to date with the latest devices for detecting intruders and weapons of mass destruction," says Ronald Kessler. "The fact that the Secret Service does not even provide a lock for the front door of the White House demonstrates its arrogance." But the Secret Service must also consider the consequences of overreaction says White House correspondent Major Garrett. "If you have a jumper and he is unarmed and has no bags or backpacks or briefcase, do you unleash a dog and risk having cell phone video shot from Pennsylvania Avenue of an unarmed, mentally ill person being bitten or menaced by an attack dog?" But Kessler says Julia Pierson, the first woman to head the Secret Service, has some explaining to do. "If the intruder were carrying chemical, biological or radiological weapons and President Obama and his family had been in, we would have had a dead president as well as a dead first family."

Emails Cast Unflattering Light On Internal Politics of Healthcare.gov Rollout

timothy posted yesterday | from the wanna-be-absolutely-clear dept.

Democrats 354

An anonymous reader writes with this report from The Verge linking to and excerpting from a newly released report created for a committee in the U.S. House of Representatives, including portions of eight "damning emails" that offer an unflattering look at the rollout of the Obamacare website. The Government Office of Accountability released a report earlier this week detailing the security flaws in the site, but a report from the House Committee on Oversight and Government Reform released yesterday is even more damning. Titled, "Behind the Curtain of the HealthCare.gov Rollout," the report fingers the Centers for Medicare and Medicaid Services, which oversaw the development of the site, and its parent Department of Health and Human Services. "Officials at CMS and HHS refused to admit to the public that the website was not on track to launch without significant functionality problems and substantial security risks," the report says. "There is also evidence that the Administration, to this day, is continuing its efforts to shield ongoing problems with the website from public view." Writes the submitter: "The evidence includes emails that show Obamacare officials more interested in keeping their problems from leaking to the press than working to fix them. This is both both a coverup and incompetence."

NVIDIA Launches Maxwell-Based GeForce GTX 980 and GeForce GTX 970 GPUs

timothy posted 2 days ago | from the upgrade-treadmill dept.

Upgrades 122

MojoKid (1002251) writes NVIDIA has launched two new high-end graphics cards based on their latest Maxwell architecture. The GeForce GTX 980 and GTX 970 are based on Maxwell and replace NVIDIA's current high-end offerings, the GeForce GTX 780 Ti, GTX 780, and GTX 770. NVIDIA's GeForce GTX 980 and GTX 970 are somewhat similar as the cards share the same 4GB frame buffer and GM204 GPU, but the GTX 970's GPU is clocked a bit lower and features fewer active Streaming Multiprocessors and CUDA cores. The GeForce GTX 980's GM204 GPU has all of its functional blocks enabled. The fully-loaded GeForce GTX 980 GM204 GPU has a base clock of 1126MHz and a Boost clock of 1216MHz. The GTX 970 clocks in with a base clock of 1050MHz and Boost clock of 1178MHz. The 4GB of video memory on both cards is clocked at a blisteringly-fast 7GHz (effective GDDR5 data rate). NVIDIA was able to optimize the GM204's power efficiency, however, by tweaking virtually every part of the GPU. NVIDIA claims that Maxwell SMs (Streaming Multiprocessors) offer double the performance of GK104 and double the perf per watt as well. NVIDIA has also added support for new features, namely Dynamic Super Resolution (DSR), Multi-Frame Sampled Anti-Aliasing (MFAA), and Voxel Global Illumination (VXGI). Performance-wise, the GeForce GTX 980 is the fastest single-GPU powered graphics card ever tested. The GeForce GTX 970 isn't as dominant overall, but its performance was impressive nonetheless. The GeForce GTX 970 typically performed about on par with a GeForce GTX Titan and traded blows with the Radeon R9 290X.

Why the iPhone 6 Has the Same Base Memory As the iPhone 5

timothy posted 2 days ago | from the enough-is-enough-for-anybody dept.

Upgrades 232

Lucas123 writes When the iPhone 5 was launched two years ago, the base $199 (with wireless plan) model came with 16GB of flash memory. Fast forward to this week when the iPhone 6 was launched with the same capacity. Now consider that the cost of 16GB of NAND flash has dropped by more than 13% over the past two years. So why would Apple increase capacity on its $299 model iPhone 6 to 64GB (eliminating the 32GB model), but but keep the 16GB in the $199 model? The answer may lie in the fact that the 16GB iPhone is, and has been, by far the best selling model. IHS analyst Fang Zhang believes Apple is using that to push users to its iCloud storage service. Others believe restricting storage capacity allows Apple to afford the new features, like NFC and biometrics.

Data Archiving Standards Need To Be Future-Proofed

timothy posted 2 days ago | from the nothing-is-totally-future-proof dept.

Data Storage 110

storagedude writes Imagine in the not-too-distant future, your entire genome is on archival storage and accessed by your doctors for critical medical decisions. You'd want that data to be safe from hackers and data corruption, wouldn't you? Oh, and it would need to be error-free and accessible for about a hundred years too. The problem is, we currently don't have the data integrity, security and format migration standards to ensure that, according to Henry Newman at Enterprise Storage Forum. Newman calls for standards groups to add new features like collision-proof hash to archive interfaces and software.

'It will not be long until your genome is tracked from birth to death. I am sure we do not want to have genome objects hacked or changed via silent corruption, yet this data will need to be kept maybe a hundred or more years through a huge number of technology changes. The big problem with archiving data today is not really the media, though that too is a problem. The big problem is the software that is needed and the standards that do not yet exist to manage and control long-term data,' writes Newman.

Microsoft Kills Off Its Trustworthy Computing Group

timothy posted 2 days ago | from the but-you-can-totally-trust-it dept.

Microsoft 98

An anonymous reader writes Microsoft's Trustworthy Computing Group is headed for the axe, and its responsibilities will be taken over either by the company's Cloud & Enterprise Division or its Legal & Corporate Affairs group. Microsoft's disbanding of the group represents a punctuation mark in the industry's decades-long conversation around trusted computing as a concept. The security center of gravity is moving away from enterprise desktops to cloud and mobile and 'things,' so it makes sense for this security leadership role to shift as well. According to a company spokesman, an unspecified number of jobs from the group will be cut. Also today, Microsoft has announced the closure of its Silicon Valley lab. Its research labs in Redmond, New York, and Cambridge (in Massachusetts) will pick up some of the closed lab's operations.

Google's Doubleclick Ad Servers Exposed Millions of Computers To Malware

timothy posted 2 days ago | from the but-zedo-is-awesome dept.

Advertising 218

wabrandsma (2551008) writes with this excerpt from The Verge: Last night, researchers at Malwarebytes noticed strange behavior on sites like Last.fm, The Times of Israel and The Jerusalem Post. Ads on the sites were being unusually aggressive, setting off anti-virus warnings and raising flags in a number of Malwarebytes systems. After some digging, researcher Jerome Segura realized the problem was coming from Google's DoubleClick ad servers and the popular Zedo ad agency. Together, they were serving up malicious ads designed to spread the recently identified Zemot malware. A Google representative has confirmed the breach, saying "our team is aware of this and has taken steps to shut this down."

Dropbox and Google Want To Make Open Source Security Tools Easy To Use

Soulskill posted 2 days ago | from the bang-your-head-on-the-screen-to-unlock-your-forehead-profile dept.

Open Source 24

An anonymous reader writes: Dropbox, Google, and the Open Technology Fund have announced a new organization focused on making open source security tools easier to use. Called Simply Secure, the initiative brings together security researchers with experts in user interaction and design to boost adoption rates for consumer-facing security solutions. The companies point out that various security options already do exist, and are technically effective. Features like two-factor authentication remain useless, however, because users don't adopt them due to inconvenience or technical difficulty.

TrueCrypt Gets a New Life, New Name

Soulskill posted 2 days ago | from the and-hopefully-won't-disappear-into-the-void dept.

Encryption 246

storagedude writes: Amid ongoing security concerns, the popular open source encryption program TrueCrypt may have found new life under a new name. Under the terms of the TrueCrypt license — which was a homemade open source license written by the authors themselves rather than a standard one — a forking of the code is allowed if references to TrueCrypt are removed from the code and the resulting application is not called TrueCrypt. Thus, CipherShed will be released under a standard open source license, with long-term ambitions to become a completely new product.

Home Depot Says Breach Affected 56 Million Cards

Soulskill posted 2 days ago | from the going-for-the-high-score dept.

Security 77

wiredmikey writes: Home Depot said on Thursday that a data breach affecting its stores across the United States and Canada is estimated to have exposed 56 million customer payment cards between April and September 2014. While previous reports speculated that Home Depot had been hit by a variant of the BlackPOS malware that was used against Target Corp., the malware used in the attack against Home Depot had not been seen previously in other attacks. "Criminals used unique, custom-built malware to evade detection," the company said in a statement. The home improvement retail giant also that it has completed a "major payment security project" that provides enhanced encryption of payment card data at point of sale in its U.S. stores. According to a recent report from Trend Micro (PDF), six new pieces of point-of-sale malware have been identified so far in 2014.

Next Android To Enable Local Encryption By Default Too, Says Google

timothy posted 3 days ago | from the keep-it-to-yourself-bub dept.

Encryption 126

An anonymous reader writes The same day that Apple announced that iOS 8 will encrypt device data with a local code that is not shared with Apple, Google has pointed out that Android already offers the same feature as a user option and that the next version will enable it by default. The announcements by both major cell phone [operating system makers] underscores a new emphasis on privacy in the wake of recent government surveillance revelations in the U.S. At the same time, it leaves unresolved the tension between security and convenience when both companies' devices are configured to upload user content to iCloud and Google+ servers for backup and synchronization across devices, servers and content to which Apple and Google do have access.

Apple Will No Longer Unlock Most iPhones, iPads For Police

timothy posted 3 days ago | from the just-what-they-want-you-to-think-part-827398 dept.

Encryption 502

SternisheFan writes with this selection from a story at the Washington Post: Apple said Wednesday night that it is making it impossible for the company to turn over data from most iPhones or iPads to police — even when they have a search warrant — taking a hard new line as tech companies attempt to blunt allegations that they have too readily participated in government efforts to collect user data. The move, announced with the publication of a new privacy policy tied to the release of Apple's latest mobile operating system, iOS 8, amounts to an engineering solution to a legal dilemma: Rather than comply with binding court orders, Apple has reworked its latest encryption in a way that makes it almost impossible for the company – or anyone else but the device's owner – to gain access to the vast troves of user data typically stored on smartphones or tablet computers. The key is the encryption that Apple mobile devices automatically put in place when a user selects a passcode, making it difficult for anyone who lacks that passcode to access the information within, including photos, e-mails, recordings or other documents. Apple once kept possession of encryption keys that unlocked devices for legally binding police requests, but will no longer do so for iOS8, it said in a new guide for law enforcement. "Unlike our competitors, Apple cannot bypass your passcode and therefore cannot access this data," Apple said on its Web site. "So it's not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8."

US Military Aware Only Belatedly of Chinese Attacks Against Transport Contractor

timothy posted 3 days ago | from the oh-did-that-happen? dept.

China 13

itwbennett writes The Senate Armed Service Committee released on Wednesday an unclassified version of a report (PDF) commissioned last year to investigate cyberattacks against contractors for the U.S. Transportation Command (TRANSCOM). The report alleges that the Chinese military successfully stole emails, documents, login credentials and more from contractors, but few of those incidents were ever reported to TRANSCOM. During a one-year period starting in June 2012, TRANSCOM contractors endured more than 50 intrusions, 20 of which were successful in planting malware. TRANSCOM learned of only two of the incidents. The FBI, however, was aware of 10 of the attacks.

Tinba Trojan Targets Major US Banks

samzenpus posted 4 days ago | from the protect-ya-neck dept.

Security 61

An anonymous reader writes Tinba, the tiny (20 KB) banking malware with man-in-the-browser and network traffic sniffing capabilities, is back. After initially being made to target users of a small number of banks, that list has been amplified and now includes 26 financial institutions mostly in the US and Canada, but some in Australia and Europe as well. Tinba has been modified over the years, in an attempt to bypass new security protections set up by banks, and its source code has been leaked on underground forums a few months ago. In this new campaign, the Trojan gets delivered to users via the Rig exploit kit, which uses Flash and Silverlight exploits. The victims get saddled with the malware when they unknowingly visit a website hosting the exploit kit."

Ask Slashdot: Remote Support For Disconnected, Computer-Illiterate Relatives

samzenpus posted 4 days ago | from the help-me-please dept.

IT 334

An anonymous reader writes I use email to communicate with my folks overseas. Their ISP only allows dial-up access to their email account (there is no option of changing ISP), that can receive messages no larger than 1MB nor hold more than 15MB (no hope of changing that either). They are computer-illiterate, click on everything they receive, and take delight on sending their information to any Nigerian prince that contacts them, "just in case this one is true". Needless to say, their PC is always full of viruses and spyware. In my next yearly visit, instead of just cleaning it up, I'd like to gift them with some "hardened" PC to use for email only that would hopefully last the year before someone has to fix it. So far, these are the things I have in mind:

  • Some kind of linux distro, or maybe even mac. Most viruses over there are windows only and propagate via Autorun.inf or by email attachments, not having Windows could prevent both.
  • Some desktop environment that hides anything unrelated to connecting to the net and accessing their account (dial-up software, email client, web browser, exchanging files between their hard disk/email attachments and USB drives). By "hide", I just want the rest to be out of the way, but not entirely removed, so that if necessary, I can guide them over the phone. For this, Ubuntu's Unity seems like a particularly bad solution, but a Gnome desktop with non-removable desktop shortcuts (is this possible?) for the file manager, browser, email client and dial-up program could work. An android system is unlikely to work (they have no wifi, and they were utterly confused with Android's UI).
  • This could be a life saver: some kind of extension to the email client that executes commands on specially formatted emails (e.g., signed with my private key), so that I can do some basic diagnostics or install extra software if I have to. This las point is important: they currently rely on acquaintances who may not be competent (they can't evaluate that) if something happens between my visits. They, most likely, wont know how to deal with anything non-windows, so all tech support would fall on me. (This is the reason I haven't moved them from windows yet.)
  • Another very useful extension would be something to automatically re-assemble attachments split into several emails, to overcome the 1MB message limit.

Does any of that exist? If I have to build that system myself (or parts of it), do you have other suggestions? For the inevitable and completely reasonable suggestion of getting someone competent for tech support: I've tried that too. The competent ones don't last beyond the third visit.

Use of Forced Labor "Systemic" In Malaysian IT Manufacturing

samzenpus posted 4 days ago | from the passing-on-the-savings-and-the-misery dept.

Businesses 183

itwbennett (1594911) writes "The use of forced labor is so prevalent in the Malaysian electronics manufacturing industry that there is hardly a major brand name that isn't touched by the illegal practice, according to a report funded by the U.S. Department of Labor and undertaken by Verité, a nonprofit organization focused on labor issues. The two-year study surveyed more than 500 migrant workers at around 200 companies in Malaysia's IT manufacturing sector and found one in three were working under conditions of forced labor."

eBay Redirect Attack Puts Buyers' Credentials At Risk

samzenpus posted 4 days ago | from the steal-it-now dept.

Security 37

mrspoonsi points out this BBC story about an eBay breach that was directing users to a spoof site. "eBay has been compromised so that people who clicked on some of its links were automatically diverted to a site designed to steal their credentials. The spoof site had been set up to look like the online marketplace's welcome page. The firm was alerted to the hack on Wednesday night but removed the listings only after a follow-up call from the BBC more than 12 hours later. One security expert said he was surprised by the length of time taken. 'EBay is a large company and it should have a 24/7 response team to deal with this — and this case is unambiguously bad,' said Dr Steven Murdoch from University College London's Information Security Research Group. The security researcher was able to analyze the listing involved before eBay removed it. He said that the technique used was known as a cross-site scripting (XSS) attack."

Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>