Tag: Internet Finds

Facebook Tracking People Who Have Opted Out of Tracking

Facebook specifically and individually tracks all people, even those who aren’t FB users. Using the opt-out mechanism you’re even worse off, since setting the opt-out cookie makes you uniquely identifiable (again).

During the opt-out process, Facebook sets a long-term identifying cookie and then uses this to track visits to pages that have a Facebook social widget. In other words: “for those individuals who are not being tracked by Facebook (e.g. non-users who have never visited a page on the facebook.com domain, or Facebook users who clear their cookies after logging out from Facebook), using the ‘opt out’ mechanism proposed for the EU actually enables tracking by Facebook” (emphasis in original).

When you opt-out …

[…] Facebook promises to stop collecting browsing information, or use it only specifically for the purpose of showing advertisements.”

So, of what use is it then?!?

JavaScript History as Seen From 2035

Gary Bernhardt presents a thought-provoking history of JavaScript as seen from 2035.

His arguments are that

  • With asm.js JavaScript VMs ran code with 50% of native speed (even in 2013)
  • Anything that can be compiled can be compiled into asm.js
  • Asm.js has basically become the universal runtime

So by further moving the JavaScript VM into the kernel we save ourselves the overhead of hardware process isolation as the VM does this any way.

All this lead to interesting consequences

  • Nobody uses binaries any more, everything is asm.js
  • The windowing systems of old have been ported to the DOM
  • Deployments are as simple as a push
  • JavaScript (as a language) is effectively dead
  • Overall developer happiness has increased

:’D

No, You Go First

Bruce Schneier talks about how security companies sat on knowledge and research data about military-grade Regin malware for at least six years. They only decided to share their knowledge because the Intercept was about to publish an article about it. Their arguments for why they withheld their knowledge until now range from “our customers asked us not to disclose what had been found in their networks” to “we didn’t want to interfere with NSA/GHCQ operations”. :/ It’s safe to say that they sit on a bunch more.

Privacy Consequences of the SPE Hack

Bruce Schneier in his comments on the recent Sony Hack cites a Gizmondo article that sums it up very well why privacy is important to everyone even for mundane everyday stuff we do on the internet:

These are people who did nothing wrong. They didn’t click on phishing links, or use dumb passwords (or even if they did, they didn’t cause this). They just showed up. They sent the same banal workplace emails you send every day, some personal, some not, some thoughtful, some dumb. Even if they didn’t have the expectation of full privacy, at most they may have assumed that an IT creeper might flip through their inbox, or that it was being crunched in an NSA server somewhere. For better or worse, we’ve become inured to small, anonymous violations. What happened to Sony Pictures employees, though, is public. And it is total.

And in Bruce’s words:

These people didn’t have anything to hide. They aren’t public figures. Their details aren’t going to be news anywhere in the world. But their privacy has been violated, and there are literally thousands of personal tragedies unfolding right now as these people deal with their friends and relatives who have searched and reads this stuff.

They Don’t Care About Your “Online” Privacy

Messenger apps show your friends’ online status. Anytime you open the app, they’ll notify the service that you’re “online” at the moment. Now everybody else can see it in their contact lists.

And with everybody I mean anybody! If you have a phone number you can check that person’s online status as often as you want from wherever you want (no need to be friends or anything).

So did a group of researchers at the Friedrich-Alexander-Universität Erlangen-Nürnberg. They used this “feature” to “find out how frequently and how long users spent with their popular messenger” on a random sample of 1000 people in different countries for over eight months.

Looking through the project’s website should make it clear how little the creators of those apps care …

Moreover, we were able to run our monitoring solution against the WhatsApp services from July 2013 to April 2014 without any interruption. Although we monitored personal information of thousands of users for several months — and thus strongly deviated from normal user behaviour — our monitoring efforts were not inhibited in any way.

… and that they don’t want you to be able to care.

Unfortunately, affected messenger services (like WhatsApp, Telegram, etc.) currently provide no option for disabling access to a user’s “online” status. Even WhatsApp’s newly introduced privacy controls fail to prevent online status tracking, as users still cannot opt-out of disclosing their availability to anonymous parties.