Lets not forget Equifax

In a nutshell:

1. Equifax was hacked big time, everybody knows that
2. Came out in September 2017
3. Found out in March?
1.  Slashdot: Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed
4. Execs sold lots of stock
1.  And even bigger and largely unappreciated, Options!
5. So if you're a responsible person with good credit, you're a target ripe for the picking
1. Equifax will do a credit with themselves for free ( and their PIN isn't even a time stamp )
2. Not sure about the others
3. Is something other than a credit freeze better?
4.  The Equifax Breach: Here's How to Protect Yourself | WIRED
5. There's something on TWIT, they discussed it on Security Now  #62
6. 
   

Update: Continuing this dumpster fire, according to Slashdot,  Equifax Has Been Sending Consumers To a Fake Phishing Site for Almost Two Weeks for theft protection.  They created "EquifaxSecurity2017.com", but were sending people to "securityequifax2017.com" in tweets between September 9 and 20 2017.  in Gizmodo:

Another Update: (9/22/2017)

The 3 executives that made $2mil were a story, but the options that were bought on August 21 for $160K were worth about $10M on Sept 7

https://www.cnbc.com/2017/09/20/house-finance-committee-seeks-information-on-equifax-options-activity.html

Yet another reason Verizon...

From Ars Technica...

Verizon technician sold calling, location data for thousands of dollars

Employee breached customer trust, profited from private phone data for years. 

An Alabama man who worked as a Verizon Wireless technician has agreed to plead guilty to a federal hacking charge in connection to his illegal use of the company's computers to acquire customer calling and location data. The man, Daniel Eugene Traeger, faces a maximum five years in prison next month. He admitted Thursday that he sold customer data—from 2009 to 2014—to a private investigator whom the authorities have not named.

Great!

So can Comodo be any sleazier? Trademarking "Let's Encrypt"?

Comodo has backed down from their, well, cynical and sleazy idea that they were bigger bullies than  a little non-profit, so applied for a trademark for "Let's Encrypt" in October 2015.

In doing that they admitted that they've never used the expression themselves (Techdirt) , and a quick Internet search shows that letsencrypt.org was registered on the web in 2014, and the organization had, as of June 15 2016, issued 5 Million certificates.

When asked about this by Let's Encrypt, there was silence until LE went public, and Comodo finally backed down, abandoning the filing, thankfully, but it begs the question:

Comodo is one of the biggest Certificate authorities, and "The largest issuer of SSL certificates with a 33% market share on 6% of all web domains" (Wikipedia) 

Are they a business that deserves the level of trust required by your security provider?

Oh by the way - Comodo's wikipedia page has a listing about Symantec:
https://en.wikipedia.org/wiki/Comodo_Group#Symantec

Symantec is the company that acquired Bluecoat 

So that's quite the triumvirate - Comodo makes the certs, Symantec now has the client and the SSL-unpacking proxy.

As a matter of fact our computers are definitely not our own

  

Remove location from facebook app Now

According to popular science, Facebook is explicitly tracking you
http://www.popsci.com/facebook-will-know-what-stores-you-go-into (Link)

Does it really matter?  According Slashdot, through truth-out.com and to Edward Snowdon, Smartphone Users Are Paying For Their Own Surveillance

Yeah, about Windows 10 Privacy, 7 is likely my last windows OS :-(

I haven't talked about it yet, but Microsoft considers Windows 10 a "service", meaning theirs, not yours, and they can monitor anything they want.

As a result, people are panicking and accusing them of all kinds of things like reading your emails which they apparently don't do, according to their blog or TechNet - either in consumer or  enterprise versions.

According to techdirt though, and Ars Technica they don't address other things, like Cortana (Microsoft Siri), remain on and collecting data, and aren't disabled when a user or admin disables telemetry.

As a result, I, and other people a lot more Microsoft-centric than me are moving toward Linux.

:-(

Thanks techdirt!

Yeah... Tile... It helps you find things... or others find you...

I want one, but it's scary. The new one even has batteries.

From the Verge article above:

Tile was an early Kickstarter success story and now it's hitting the big leagues. Starting today, there's a new version that will be available both online and in retail stores. The Tile is designed to help you find your keys — or purse, or basically whatever else you can attach it to. That remains unchanged — pair it to your iPhone or Android device and you can tap a button on your phone to make the little square dongle beep. Tile says that said beep is three times louder now and will work within 100 feet — both claims ring (ahem) true in my testing. Tile also has another clever feature — if you lose something, you can tell the Tile hive mind and every Tile user's phone will start looking for it. If it's detected, you'll get an alert on your phone — but the user who came near it won't know, protecting your privacy and your stuff.
Every phone can become a Tile now

Tile has also updated its app, now it lets the Tile system ring your phone if it's lost, effectively creating a backup find-my-phone system

And if there's any doubt about how it works, and how much it lives in the background...

On Android, one sort of annoying thing about the system is that you can't quit the app if you want it to work. That does mean you can kill it and save battery, but it seems like the sort of thing that ought to live in the notification tray.

 Welcome to the unwelcome part of the future...

Oracle Java installs Malware Toolbar without "Ask"ing

Updates after Java 7 Update 71 don't appear to allow opting-out of Ask toolbar. 

It does let you choose whether to use Ask as the default search engine, and another thing, but the Ask toolbar looks like it's automatic

I'll just delete java then

 Do they really need the money?  Will Java stop being free?

It's really time to get completely off the Java platform.

Chris Christie shows abuse of ez-pass and metadata in a single speech

And what type of human being he is, effectively making it impossible for him to be president.

(I honestly don't know if I'd pick him or Obama, but Obama can't run again)

Techdirt, as usual has a great article

So here's the lead up, from Bill Baroni -

"Respectfully, Senator, you only started paying tolls recently," [Port Authority Deputy Chief Bill] Baroni said, according to a transcript of the exchange. "In fact, I have a copy of your free E-ZPass," he continued, holding up a physical copy of the toll pass Lautenberg had received as a benefit from his tenure as a Port Authority commissioner. "You took 284 trips for free in the last 2 years you had a pass."

Chris Christie abusing E-ZPass and quotes him, saying about a rival:

At a press conference, he alleged that the senator didn't "pay for parking at Port Authority facilities" and said Lautenberg went "through the tunnel to New York three or four times a week in 2005 and 2006."

I find it interesting, too, by the way, in 2005 and 2006, that he went over the Hudson River 284 times. Where was he going?... I think he needs to answer that. 'Cause he's supposed to be the senator from New Jersey. So what's he doing going over the bridge or through the tunnel to New York three or four times a week for 2005 and 2006?... Did he ever spend any time in New Jersey?

Did you think:

1.  E-ZPass data was confidential?  Nope
2. That the government reading E-ZPass  data needed a warrant?  Nope
3. That Metadata was harmless?  Nope
4. That Government thinks Metadata can't be abused? Nope
5. That Chris Christie is above anything slimy or scummy? Data is still out

Oh they do have a link to the pdf of NJ committee meeting that includes testimony about bridgegate and some details about traffic readers in the Fort Lee area, and I think how many E-ZPass details they get. 

Viewing or using Sony stolen documents? Wrong Wrong Wrong

And I'm not gonna do it.  Period.

And there's always a BUT.

Remember:

1. The rootkit on the audio CD?
2. The promise to run Linux on the PS3?
3. All the Harrassment for Geohot?

the list goes on

Sony is not a friend of their community.  Is this karma?

The idiots that are threatening the families are going to get caught, and they're going to do time. BTW. duh?

Awesome! Uber crying that media is mean to them, suggests "Digging up dirt on journalists"

Update #7 - 20-June because AUATT (below) - The FTC is investigating them?

Update #6 - 14-June-2017 - As a matter of fact, this blog is "All Uber all the time".  After Emil Michael's and Travis Kalanick's LOA departures, board member David Bonderman in a discussion with Adriana Huffington - 'who was speaking about the need for more female representation on Uber’s board. When “there’s one woman on the board, it’s much more likely that there will be a second woman on the board,” Huffington said, to which Bonderman shot back “what it shows is that it’s much more likely to be more talking.” - Bonderman was out in about the time it takes to say "Do we need to call security?"

Update #5 - 12-June-2017 - Eric Holder report released soon, likely not good.   Travis Kalanick on LOA after a family tragedy (we're truly sorry and our thoughts and prayers for the family), oh, and Emil Michael out
 
Update #4: The Verge:  Can Uber be saved from itself?

Watch for:  Ryan Graves (employee #1) to take the fall for the latest things, both the Misogyny from Susan Fowlers blog (sub watch - are they investigating her personally? ) and Greyball (Verge again) 

Update #3a:
Uber allegedly has a pretty horrible culture of sexual harassment, per engineer-author Susan Fowler who isn't afraid to blow the whistle under her own name, and there's a really good blog post at Global Nerdy that deconstructs and validates the claims

Kara Swisher from Recode/Decode had a podcast about Uber that posted the day after Susan’s blog post went viral named “Self-driving cars are an ‘existential crisis’ for Uber, ‘Upstarts’ author Brad Stone says”

Here’s Kara’s blog post about the leather jacket

http://www.recode.net/2017/2/22/14700114/is-uber-lost

Update #2:  CNN-  Uber limits employee access to God mode

Update #1:  Washington Post blog has insight on their privacy and least privilege policy

 AKA - Let's DOX our customers, that'll show them

So correct me if I'm wrong, Buzzfeed article, linked from Drudge:

According to Buzzfeed article uber-executive-suggests-digging-up-dirt-on-journalists :

1. Uber thinks journalists are being mean, especially pando writer Sarah Lacey writing about them after a Buzzfeed article accusing them of sexism (awesome example of just that BTW)
2. VP of Black Bag Jobs, er "business", Emil Michael, suggests opposition research including aforementioned digging up dirt
3. Immediate spin control, an Uber spokes droid states (from the article) "the company does not do “oppo research” of any sort on journalists, and has never considered doing it. She also said Uber does not consider Lacy’s personal life fair game, or believe that she is responsible for women being sexually assaulted."
4.  Even though (from the article again) "the general manager of Uber NYC accessed the profile of a BuzzFeed News reporter, Johana Bhuiyan, to make points in the course of a discussion of Uber policies."
5.  SO a new economy taxi company is on record of using it's data against journalists and anybody still uses them?!
6. Update:  Amy Keyishian at Re/code had the first link to Seth Meyers clip with the "That Boober Guy" nickname for Travis Kalanick, some great advice on the difference in truth in public and private speech, and equating the Emil Michael quotes with Valdemort speaking to Hogwarths.  
   

Good Techdirt analysis of Applepay and CurrentC situation

States that retailers want to cut out Mastercard and Visa, and want ultimate tracking of their customers that they had when they used their old tracking cards

https://www.techdirt.com/articles/20141027/07065628950/payment-wars-how-merchants-carriers-are-trying-to-block-payment-systems-they-cant-track.shtml

Grab the popcorn, IMHO, this will be an utter and dismal failure, because the members of PCI won't correctly use their previous lessons learned to make a system that protects customers, instead they will greedily grab all the data they can on their customers, attempt to protect their shopkeeper members, but fail because they're cheaping out on the infrastructure, creating something even worse than PCI.

Seriously, Rite Aid and CVS are creating a payment system that will be more secure than Google, Apple and Mastercard/VISA?  OMG what are they thinking other than sheer greed.  I won't boycott, though, expecially CVS, I truly want to support a company that went out on a limb and stopped selling tobacco.

Don't use CurrentC, it will be even riskier than debit cards - the QR codes will be found to be awful security, and there will be people burned by the automatic debit behavior of the system. Even if they use something clever like Steve Gibson's SQRL , they won't be able to implemment something secure enough to handle the amounts of cash it needs to.

Please just use credit cards or cash at these merchants

Google: That whole "don't be evil" thing is so last century!

According to Edweek.org, The latest thing in Google slide to become the great evil empire is the "Google Apps for Education".  

Apparently Google has these free applications that schools can sign up for, and then require their students to use.  Then Google scans the content learning all kinds of things about the students.

Why do I think that's a problem? Well, let's see what happens in a class action lawsuit in San Jose, which Judge Lucy H Koh denied Googles motion to dismiss the case and is not deciding whether to certify it as a class. (Google Inc. Gmail Litigation, 13-md-02430.)

 Also, there's FERPA, the "Family Educational Rights and Privacy Act", which is meant to protect students privacy, and gives the following example:

EXAMPLE 4: A district contracts under the school official exception with a provider for basic productivity applications to help educate students: email, calendaring, web-search, and document-collaboration software. The district sets up the user accounts, using basic enrollment information (name, grade, etc.) from student records. Under FERPA, the provider may not use data about individual student preferences gleaned from scanning student content to target ads to individual students for clothing or toys, because using the data for these purposes was not authorized by the district and does not constitute a legitimate educational interest as specified in the district’s annual notification of FERPA rights.

Yes, right, which is exactly what Google does with Gmail, and they state they make no secret of.  Except they're not contracting with adult users of the services, they're contracting with schools that require minor students to use the applications.

How about Microsoft Office 365?

The privacy policy for Microsoft’s Office 365, the company’s competitor product for Google Apps for Education, states “We do not mine your data for advertising purposes. It is our policy to not use your data for purposes other than providing you productivity services.” 

Score 1 for Microsoft