US Secretary of State exclusively uses private Email, pleads ignorance

Coming to the attention of the public when one of her closest advisors gets hacked by a Romanian hacker "Guccifer",  Hillary Clinton did not use public email during her whole term as secretary of state

http://www.thesmokinggun.com/documents/investigation/hillary-clinton-private-e-mail-account-897531

While the contents of only some of the emails have been made public, the list of subjects that is published shows some that clearly might contain classified information.

I guess Hillary doesn't really get the "protect information from enemies of the state" thing.  Hillary, when using private internet services, there's really no way to know who's reading the information.

I'm really surprised this didn't come out earlier.  Is there something (special) about the providers that she and her circle of friends are using?

Funny how they forced an ambassador who did the same thing to resign
http://thefederalist.com/2015/03/05/hillarys-state-dept-forced-the-resignation-of-an-ambassador-for-using-private-e-mail/


In other news, thanks to Popehat, Gen David Petraeus won't be getting jail time for leaking more-secret-than TS information to his biographer/mistress/girlfriend

Uber is worth a gazillion dollars, and is putting the Taxi industry out of business - how can they be such idiots? Again!

By Dan Goodin

Ars Techica

March 2, 2015

Uber is trying to force GitHub to disclose the IP address of every person that accessed a webpage connected to a database intrusion that exposed sensitive personal data for 50,000 drivers. The court action revealed that a security key unlocking the database was stored on a publicly accessible place, the online equivalent of stashing a house key under a doormat.[ but more visible - pe]

Uber officials have yet to say precisely what information was contained in the two now-unavailable GitHub gists. But in a lawsuit filed Friday against the unknown John Doe intruders, Uber lawyers said the URLs contained a security key that allowed unauthorized access to the names and driver's license numbers of about 50,000 Uber drivers. The ride-sharing service disclosed the breach on Friday, more than two months after it was discovered.

more...

 http://arstechnica.com/security/2015/03/in-major-goof-uber-stored-sensitive-database-key-on-public-github-page/

Intuit is accused of deliberately allowing fraudulent returns for increased market share

Brian Krebs writes that Intuit is accused, apparently with proof  like audio, video, or email, that Intuit made the conscious decision to reduce fraud detection when criminals went to their competitors and caused them to lose market share.

http://krebsonsecurity.com/2015/02/turbotaxs-anti-fraud-efforts-under-scrutiny/

Question:  If a criminal files a fraudulent return from a web site , and pays with a percentage of the refund, then the refund can't be recovered, will the web site operator have to return the fee?  What's the penalty?  What if they're found to be doing it deliberately?  Losing their ability to file?

People:  Friends don't let friends overpay their taxes.

Think Superfish isn't a big deal?

Well, first off, remember that it compromises the whole IE/Firefox infrastructure
(and possibly code signing =8-0 ) of the whole machine  [perry]

Second, there are lots of Non-Lenovo (14) (+?) apps that use it and it's getting easier to break

Now it's breakable and exploitable over by a Raspberry PI (with instructions)

Oh there is a true virus that exploits it and Komodia, the company behind the MITM-by-local-internal-proxy is under DDOS attack.  Did we mention that the password is Komodia?  And that many commercial companies use products from Komodia?

And, while Lenovo has apologized, (they still have a business), and has updated auto and manual removal instructions

Of course Superfish says it's not so bad
 
Understandable, but no.

And a movie that shows how to remove Superfish.A from Chrome - from Jul 2014

Graham Cluley gives instructions for Flash Click-to-play

Nice!

http://grahamcluley.com/2015/02/adobe-flash-zero-day-vulnerability-exploited-hackers-infect-ie-firefox-users/

Oracle Java installs Malware Toolbar without "Ask"ing

Updates after Java 7 Update 71 don't appear to allow opting-out of Ask toolbar. 

It does let you choose whether to use Ask as the default search engine, and another thing, but the Ask toolbar looks like it's automatic

I'll just delete java then

 Do they really need the money?  Will Java stop being free?

It's really time to get completely off the Java platform.

Chris Christie shows abuse of ez-pass and metadata in a single speech

And what type of human being he is, effectively making it impossible for him to be president.

(I honestly don't know if I'd pick him or Obama, but Obama can't run again)

Techdirt, as usual has a great article

So here's the lead up, from Bill Baroni -

"Respectfully, Senator, you only started paying tolls recently," [Port Authority Deputy Chief Bill] Baroni said, according to a transcript of the exchange. "In fact, I have a copy of your free E-ZPass," he continued, holding up a physical copy of the toll pass Lautenberg had received as a benefit from his tenure as a Port Authority commissioner. "You took 284 trips for free in the last 2 years you had a pass."

Chris Christie abusing E-ZPass and quotes him, saying about a rival:

At a press conference, he alleged that the senator didn't "pay for parking at Port Authority facilities" and said Lautenberg went "through the tunnel to New York three or four times a week in 2005 and 2006."

I find it interesting, too, by the way, in 2005 and 2006, that he went over the Hudson River 284 times. Where was he going?... I think he needs to answer that. 'Cause he's supposed to be the senator from New Jersey. So what's he doing going over the bridge or through the tunnel to New York three or four times a week for 2005 and 2006?... Did he ever spend any time in New Jersey?

Did you think:

1.  E-ZPass data was confidential?  Nope
2. That the government reading E-ZPass  data needed a warrant?  Nope
3. That Metadata was harmless?  Nope
4. That Government thinks Metadata can't be abused? Nope
5. That Chris Christie is above anything slimy or scummy? Data is still out

Oh they do have a link to the pdf of NJ committee meeting that includes testimony about bridgegate and some details about traffic readers in the Fort Lee area, and I think how many E-ZPass details they get.