Category Archives: Privacy

Adobe Security Team 直接把 Private Key 貼到網誌上面...

Security Team 出這種包...:「In spectacular fail, Adobe security team posts private PGP key on blog」。 Oh shit Adobe pic.twitter.com/7rDL3LWVVz — Juho Nurminen (@jupenur) September 22, 2017 Adobe 這次的事情要怎麼說呢,hmmm...

Posted in Blog, Computer, Murmuring, Network, Privacy, Security | Tagged , , , , , , , , | Leave a comment

Imgur 上 HTTPS

Imgur 宣佈 HTTPS 化:「HTTPS on Imgur」。 Today, we deployed HTTPS by default on Imgur. All traffic is now redirected to https:// and, as of now, HTTPS is the default on all Imgur URLs. 總算是上線了... 先前是靠 HTTPS Everywhere 做。

Posted in Computer, Murmuring, Network, Privacy, Security, Service, WWW | Tagged , , , , , , , | Leave a comment

Google 放棄對海外伺服器搜索票的抵抗了...

先前美國政府透過搜索票,要求各雲端廠商提供海外伺服器的資料而引起話題 (像是先前 Microsoft 往上打官司抵抗:「Does US have right to data on overseas servers? We’re about to find out」),而現在看起來 Google 打算放棄掙扎了:「Google stops challenging most US warrants for data on overseas servers」。 Google has quietly stopped challenging most search warrants from US judges … Continue reading

Posted in AWS, Cloud, Computer, GCP, Murmuring, Network, Privacy, Security | Tagged , , , , , , , , , , | Leave a comment

Homebrew 蒐集到的安裝資訊

在「Homebrew Analytics Install On Request Events — Homebrew」這邊,Homebrew 利用了傳回來的資訊算出 2016/07/14 到 2017/07/14 的安裝套件次數,列出前一千名。(我是把他關掉,因為隱私問題不想要傳出去... 參考「Homebrew 會將安裝資訊送到 Google Analytics 上」這篇。) 比較有趣的是第一名的 node 超級多,比第二名加第三名的 git + wget 還多... 拿來翻一翻還 ok,順便看一下大家用什麼...

Posted in Computer, MacOS, Murmuring, Network, OS, Privacy, Programming, Service, Software | Tagged , , , , , , , , , , , | Leave a comment

VPN 的評價

文章的作者試了很多家 VPN 服務,然後文章的標題有點長,有種輕小說的感覺...:「I tested the most recommended VPN providers using my credit card to find the best ones — and which ones you should avoid.」。 不過這種文章有很多東西很主觀,大家心裡有個底就是了... 作者比較滿意的是 TunnelBear 與 OVPN 這兩家,也許等手上 PIA 到期的時候再試看看要怎麼選好了,畢竟 PIA 還是目前最便宜的方案。

Posted in Computer, Murmuring, Network, Privacy, Security, Service, VPN | Tagged , , , , , , , , , , , , , | Leave a comment

超過三億筆的密碼 (Hash 過的)

Troy Hunt 放出三億筆 SHA1 hash 過的密碼讓大家研究:「Introducing 306 Million Freely Downloadable Pwned Passwords」。 他引用了 NIST 新的草案中對密碼的建議,阻擋已知外洩的密碼: 檔案可以在「I been pwned? Pwned Passwords」這邊下載。

Posted in Computer, Murmuring, Network, Privacy, Security, Service, Social | Tagged , , , , , , , , , , | Leave a comment

Telegram 使用 CDN 加速下載

Telegram 說明他們將會使用 CDN 加速:「More Speed and Security!」。 資料在 CDN 的節點上是加密的,金鑰需要透過 Telegram 的 key server 提供: While these caching nodes are only used to temporarily store public media (imagine Telegram versions of superpopular YouTube hits), all data that goes through them … Continue reading

Posted in CDN, Computer, Murmuring, Network, Privacy, Security, Service, Software, WWW | Tagged , , , , , , , , , , , , , | 1 Comment

對 Open Data 的攻擊手段

前陣子看到的「Membership Inference Attacks against Machine Learning Models」,裡面試著做到的攻擊手法: [G]iven a data record and black-box access to a model, determine if the record was in the model's training dataset. 也就是拿到一組 Open Data 的存取權限,然後發展一套方法判斷某筆資料是否在裡面。而驗證攻擊的手法當然就是直接攻擊看效果: We empirically evaluate our inference techniques on classification models … Continue reading

Posted in Computer, Murmuring, Privacy, Programming, Search Engine, Security | Tagged , , , , , , , , , , | 1 Comment

BoringSSL 的 FIPS 140-2 驗證

看到由 Google 主導的 BoringSSL 有計劃將其中一塊申請 FIPS 140-2 的驗證計畫 (BoringCrypto 的部份):「FIPS 140-2」。 其中 FIPS 140-2 最有名的後門應該是 Dual_EC_DRBG (定義於 NIST SP 800-90A,被 FIPS 140-2 引用),所以特地講清楚他們選擇哪個演算法: FIPS 140-2 requires that one of its PRNGs be used (which they call DRBGs). In BoringCrypto, we … Continue reading

Posted in Computer, Library, Murmuring, Privacy, Security, Software | Tagged , , , , , , , , , | Leave a comment

用照片打鑰匙的服務

在 Bruce Schneier 的 blog 上看到 KeyMe 這個服務:「Now It's Easier than Ever to Steal Someone's Keys」。 你把鑰匙的照片拍下來,透過 app 上傳付款後,他就把鑰匙寄給你 XDDD 查了一下資料,在五年前 (2012) 的時候就有人做遠距離攻擊的研究了:「60 公尺外,拍照攝影就可以重製鑰匙...」,所以有好的方面,也有邪惡的方面...

Posted in Computer, Murmuring, Privacy, Security | Tagged , , , , | 1 Comment