透過手機螢幕上的餘熱猜測 PIN 碼

利用手機螢幕上的餘熱分析可能的 PIN 碼:「Heat traces left by fingers can reveal your smartphone PIN」,在輸入完 PIN 碼的 30 秒內的準確度都還是很高 (80%):

The report further revealed that if the thermal image is collected within 15 seconds of a PIN being entered, the technique is accurate almost 90% of the time. At 30 seconds, this accuracy decreased slightly to 80%. At 45 seconds or more, the accuracy dropped to 35% and below.

維基百科的 User Agent 公開資料

Nuzzel 上看到的東西...

維基百科不掛 Google Analytics 之類的第三方服務,而是透過 Piwik 蒐集後自己分析:「Dashboards and Data Downloads for Wikimedia Projects」。

主要有兩個資料可以看,一個是「Browser Statistics」,另外一個是「Readers: Pageviews and Unique Devices」。

不過翻了一下,Piwik 好像還是沒有寫到 NoSQL 之類的方案,出自「How do I use another database like Postgresql, SQLite, Oracle? Will you support Nosql databases like Hadoop, Mongodb?」:

Piwik only works on Mysql, where all the development and testing is done. Supporting multiple databases is a long term objective for Piwik, but not our current focus.

不知道維基百科是怎麼 scale 的...

用 Pushover 當簡訊...

很久之前被 ccn 介紹 Pushover,可以很簡單的透過 API 送推播,這樣就可以用來代替簡訊發給自己。

第一次申請有七天的試用期可以用,試用期滿後每個 device 的費用是一次性的 USD$4.99,在 iOS 裝置上可以透過 IAP (Apple) 購買,Android 裝置則是透過 IAB 購買。

官網上可以看到 API 設計很簡單,user token + application token 用 POST 帶進去就可以發出去了。

就算不透過 API 寫,也可以透過 IFTTT 串接起來,像是我設定中文維基百科上的條目「Kalafina」,有修改就通知我:

AWS Device Farm 可以遠端操作

AWS 又推出新的功能,這次 AWS Device Farm 讓使用者可以遠端互動跟機器操作:「AWS Device Farm Update – Remote Access to Devices for Interactive Testing」。

在「Test Devices List」這邊可以找到很多舊版本的機器可以互動操作 (尤其是 iOS 系列的機器),就可以拿來測各種舊版本的 bug report 了...

對 ECDSA 實體非破壞性的 Side Channel 攻擊

用很簡單的設備透過 Side Channel 攻擊取得 ECDSA private key:「ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels」。這次 Side Channel 只需要簡單的線圈,透著一塊玻璃也 okay:

文章裡面提到是 Tracker Pre,查了一下二手價是 USD$80:

這邊抓出了 ADD 產生出的訊號:

然後就可以利用這些訊號重建出 private key:

After observing the elliptic-curve DOUBLE and ADD operations during a few thousand signatures, the secret signing key can be completely reconstructed.

下面中獎的 library 有點多,可以看到主要是以 constant-time implementation 或是 side-channel mitigation technique 來解這個問題。

Apple 打算把 iCloud 加密用的 Key 放到用戶端

在經過最近 FBIApple 的戰鬥中 (FBI–Apple encryption dispute),Apple 正規劃把 iCloud 加密所使用的 key 放到用戶端裝置上,而非放在伺服器端:「Apple to Hand iCloud Encryption Key Management to Account Holders」:

In effect, Apple is following the lead of secure cloud services such as SpiderOak which has been offering what it calls “Zero Knowledge” cloud storage. By that, SpiderOak retains no information about whatever is stored in its cloud service, nor the means of gaining access to it.

也就是加解密都放在 client 端處理,server 端只是 storage。

這類型最大的問題是 server 端沒辦法運用資料,但 iCloud 的確可以放掉這些功能 (搜尋之類的),純粹當 storage 使用,藉以讓使用者自己裝置保護。

而蘋果在使用者的裝置上把類似於 HSM 的系統做的頗強大... 不知道 Android 有沒有機會也跟進。(雖然我自己是用 Apple 家的東西...)

Amazon Fire 會把加密系統弄回來

FBIApple 的戰爭開打後,愈來愈多安全與隱私問題被重新拿出來檢驗,而 Amazon 也決定將 2015 年拔掉的加密功能搬回 Fire OS 裡:「Amazon Reverses Course, Encryption Returning for Fire Devices」:

Amazon.com Inc. will restore encryption as a security option on its tablets and other devices that use the Fire operating system, following a customer backlash driven by increased sensitivity about data protection as Apple Inc. grapples with the FBI over access to a terrorist’s iPhone.

預定是今年春天加回來:

Amazon reversed course late Friday night, saying in an e-mail that it would restore encryption as an option on Fire devices with a software update “this spring,“ without being more specific.

愈來愈多公司與產品都認定加密是「基本功能」,無論你有沒有接觸到敏感資料。

蘋果裝置的報廢過程:香港

Bloomberg 的「Where Your iPhone Goes to Die (and Be Reborn)」這篇稍微描述了 Apple 裝置回收後的報廢過程。

報導是寫香港的報廢工廠,但受限於與蘋果的合約就不能具名說是誰:

While global brands including HP, Huawei, Amazon and Microsoft also have detailed protocols for recycling their products, Apple’s are the most rigid and exacting, according to people involved in the processes, who declined to be identified because they’re not authorized to speak about clients.

不過 Bloomberg 的人有跟蘋果官方取得一些訪問資料:

"I think people expect it of us, I think our customers hold us to a high standard," Lisa Jackson, Apple’s head of environmental affairs, said by phone from the company’s Cupertino headquarters. "It’s difficult, because these are incredibly complex pieces of product."

另外也有提到取得時的成本:

After a quick test, the recycler will either buy the phone or offer to scrap it for free. In the U.S., payouts for working phones range from $100 for the smallest-capacity iPhone 4, to $350 for the largest iPhone 6 Plus. More stringent testing then shows whether the handset can be resold or must be scrapped.

以及 Bloomberg 做的一些圖表,可以看到各種處理的原則以及回收的大概流程:

AWS Device Farm 支援手機上的 Web Application 測試

AWS Device Farm 支援在 iOSAndroid 上測試 Web Application 了:「AWS Device Farm Update – Test Web Apps on Mobile Devices」。

支援愈來愈多東西了...