Tuesday, March 7, 2006

'Fascist' ID database worries Lords. 'Fascist' ID database worries Lords. Creeping compulsion The House of Lords called upon the ancient liberties enshrined in British common law last night when it ping-ponged the ID Cards bill back to the House of Commons. [The Register - Internet and Law: Digital Rights/Digital Wrongs] 11:59:45 PM  PermaLink   / trackback []

Council wins computer monitoring lawsuit | The Register Harlow Council has won a High Court action brought against it by a former councillor who claimed that its monitoring of a laptop used by him was unlawful. Lib-Dem Councillor Matthew Shepherd sued after being criticised for allegedly downloading pornographic images. Seeking damages of £35,000, the former councillor claimed breaches of the Human Rights Act, the Data Protection Act, and the Regulation of Investigatory Powers Act. But the judge ruled last month that the monitoring was legitimate, according to a report by Herts and Essex News Online. Mr Shepherd had argued that the offending images were downloaded as legitimate research into condom sizes, pursuant to his role as a health spokesman. But the court considered this implausible, according to the news report, and accepted that the council's monitoring was lawful to prevent breaches of its code of conduct which prohibits accessing pornography. 12:10:01 PM  PermaLink   / trackback []

EU privacy experts slam email tracking services | The Register Services that track whether an email has been opened will breach EU data protection laws unless the recipient has given unambiguous consent to the service, according to an opinion from the Article 29 EU Working Party on Data Protection. 12:07:44 PM  PermaLink   / trackback []

U of Wisconsin's Mac OS X Security Challenge. U of Wisconsin's Mac OS X Security Challenge. digitalsurgeon writes  "The University of Wisconsin [ed: Go Badgers] has launched a Mac OS X Security challenge, in response to a 'woefully misleading ZDnet article'. From the site: 'The challenge is as follows: simply alter the web page on this machine, test.doit.wisc.edu. The machine is a Mac mini (PowerPC) running Mac OS X 10.4.5 with Security Update 2006-001, has two local accounts, and has ssh and http open - a lot more than most Mac OS X machines will ever have open.' Are you up to the task? Can you prove ZDNet wrong, or can you show that Mac OS X can really be hacked in less then 30 minutes? More information about the challenge is at http://test.doit.wisc.edu/ The challenge ends Fri 10 March 2006 10:00 AM CST." ---  Update: 03/07 14:32 GMT by Z : Commentary on the contest and original claim is available at VNUNet [Slashdot] 11:47:57 AM  PermaLink   / trackback []

LAMP lights the way in open-source security - Security - News - ZDNet Asia The most popular open-source software is also the most free of bugs, according to the first results of a U.S. government-sponsored effort to help make such software as secure as possible. The so-called LAMP stack of open-source software has a lower bug density--the number of bugs per thousand lines of code--than a baseline of 32 open-source projects analyzed, Coverity, a maker of code analysis tools, announced Monday. The U.S. Department of Homeland Security awarded US$1.24 million in funding to Stanford University, Coverity and Symantec to hunt for security bugs in open-source software and to improve Coverity's commercial tool for source code analysis. The funding, announced in January, is for a three-year "Open Source Hardening Project." LAMP includes the Linux operating system, Apache Web server, MySQL database and a scripting language--PHP, Perl or Python. It has been pushing its way into mainstream corporate computing, a rival to Java and Microsoft's .Net. In the analysis, more than 17.5 million lines of code from 32 open-source projects were scanned. On average, 0.434 bugs per 1,000 lines of code were found, Coverity said. The LAMP stack, however, "showed significantly better software quality," with an average of 0.29 defects per 1,000 lines of code, the technology company said. There is one caveat: PHP, the popular programming language, is the only component in the LAMP stack that has a higher bug density than the baseline, Coverity said. Of the other open-source projects scanned, Coverity found that the Amanda back-up tool had the highest number of bugs per 1,000 lines of code, with a bug density of 1.237. The lowest was the XMMS audio player, with 0.051 defects per 1,000 lines of code. 11:44:45 AM  PermaLink   / trackback []

LAMP Lights the OSS Security Way. LAMP Lights the OSS Security Way. Kevin Young wrote to mention a ZDNet article which goes into some detail on new results from a Department of Homeland security initiative. It's called the 'Open Source Hardening Project', and (funded to the tune of $1.24 Million) the goals of the initiative are to use a commercial tool for source code analysis to buck up the security base of many OSS projects. LAMP (the conglomeration of Linux, Apache, MySQL, and PHP/Perl/Python) was a 'winner' in the eyes of the project. From the article: "In the analysis, more than 17.5 million lines of code from 32 open-source projects were scanned. On average, 0.434 bugs per 1,000 lines of code were found, Coverity said. The LAMP stack, however, 'showed significantly better software quality," with an average of 0.29 defects per 1,000 lines of code, the technology company said.'" [Slashdot] 11:40:51 AM  PermaLink   / trackback []

silicon.com - Schneier: 'Blame firms not staff for security breaches' Security guru Bruce Schneier has hit out at the trend of blaming staff for security breaches, suggesting it's companies which must always face the strongest criticism. Schneier was responding specifically to an exclusive story on silicon.com last week which reported a social experiment in the City of London which saw free CDs handed out to commuters to ascertain whether they would blindly access them on their work machines, despite knowing nothing of the source or the contents of the CDs. Although many fell for the sting, Schneier said the blame does not lie with the staff and he hit out at suggestions that such behaviour from employees shows disregard for security. "Employees care about security; they just don't understand it," he wrote on his blog, in response to the silicon.com story. He added: "Computer and network security is complicated and confusing, and unless you're technologically inclined, you're just not going to have an intuitive feel for what's appropriate and what's a security risk. "Technology changes quickly, and any security intuition an employee has is likely to be out of date within a short time." However, Rob Chapman, founder of The Training Camp which ran the experiment, said Schneier's response is "muddled" and unrealistic. Chapman said he believes there are few excuses now for staff not showing common sense towards basic security threats. Chapman said: "[Schneier] talks about how complicated security is and how it is constantly changing but I'm really not sure how complicated or how new a CD is as a means of installing software." Chapman added that the CDs used in the experiment contained a clear warning about accessing them on a work computer which was obviously ignored. However Schneier, CTO of Counterpane, said companies need to work harder to ensure they mitigate human error - even taking it out of the equation as much as possible. 11:10:20 AM  PermaLink   / trackback []

SiteAdvisor - Press Releases (Software rates and flags websites) SiteAdvisor's test results reveal that the Web can be extremely dangerous if consumers don't have a way to know which sites are safe or not. The company's comprehensive testing of the Web over the last 11 months resulted in: "Red" warning ratings for sites representing more than 5% of Web traffic "Yellow" cautionary ratings for sites representing more than 2% of Web traffic Many popular Web categories have a much higher percentage of red and yellow sites. For example, SiteAdvisor's software reveals that on the first page of Google search results for "screensavers," 10 of the 18 sites shown have "red" ratings. "Every month, worldwide Web users make more than 1 billion visits to 'red' sites, resulting in countless spyware infections, spam-filled inboxes and hijacked browsers," noted Tom Pinckney, co-founder and VP Engineering. "We shed light on which sites are red so users can make better decisions about where they go and what they do online." SiteAdvisor's safety ratings are grounded in a massive proprietary database containing test results from millions of automated Web site visits, download installations, and e-mail registrations. New sites are tested daily and previously tested sites are re-tested often. SiteAdvisor's automated test coverage includes: Web sites representing more than 95% of Web traffic More than 475,000 downloads analyzed for adware, spyware, and viruses More than 1.3 million registration forms using unique e-mail addresses so all subsequent e-mail from each source can be tracked SiteAdvisor's automated tests are supplemented by feedback from volunteer reviewers, comments from Web site owners and input from SiteAdvisor analysts. SiteAdvisor does not accept payment from sites to be rated or to have ratings changed, thus ensuring that ratings are objective and uniformly applied. The result is a rich, multifaceted, uncensored and constantly improving Web site advisory system which consumers can trust. As Internet users search and browse, SiteAdvisor helps them find "green" sites and avoid "red" ones. When users search with popular search engines such as Google, Yahoo! or MSN, SiteAdvisor's software displays safety ratings next to search results. As users browse the Internet, a small SiteAdvisor button on their browser toolbar changes color based on SiteAdvisor's safety results. SiteAdvisor documents every test it conducts, so users can look up any site's detailed safety report on SiteAdvisor's free Web site. 10:58:52 AM  PermaLink   / trackback []

Distributed computing cracks Enigma code | CNET News.com More than 60 years after the end of World War II, a distributed computing project has managed to crack a previously uncracked message that was encrypted using the Enigma machine. The M4 Project began in early January, as an attempt to break three original Enigma messages that were intercepted in 1942 and are thought never to have been broken by the Allied forces. These messages were encrypted using a four-rotor Enigma. That version was considered by Germany to be completely unbreakable, as it could be set up in any one of a vast number of ways (2 times 10 to the 145th power), each of which would encrypt a plain text message differently. Cryptologists at Bletchley Park in the U.K. managed to break Enigma through their development of early computers, led by Alan Turing, and also by using intelligence to cut down the number of possible set-ups. According to the organizers of M4, their open-source message-breaking application managed to crack one of the three messages early last week. 10:52:11 AM  PermaLink   / trackback []

Open source plan secures key data. Open source plan secures key data. A group of academics and major vendors last week kicked off an open source project designed to give applications easier access to identity systems and users more control over their personal information. The Higgins Project will provide a set of adapters that plug into identity systems, such as directories, human resource systems or Web sites using native protocols or APIs. [Identity mangement news] 10:48:35 AM  PermaLink   / trackback []

Researcher Hacks Microsoft Fingerprint Reader. Researcher Hacks Microsoft Fingerprint Reader. Hackers could steal your fingerprint information. [PCWorld.com - Latest News Stories] 10:47:09 AM  PermaLink   / trackback []

EFF - Consumer Alert: AdviceBox.com Isn't Anonymous Email. Consumer Alert: AdviceBox.com Isn't Anonymous Email. EFF is warning the public about a so-called anonymous email service located at Advicebox.com. Advicebox.com's tagline is "Anonymous email made easy" but this service does not provide real anonymity -- it's a trap for the unwary and should not be used by battered spouses, whistleblowers and others who need real protection. We were alerted to AdviceBox.com trap when we were approached by an anonymous critic who believed the tagline, paid the fee and used the service to send an "anonymous" extremely critical email about a former employer. The employer ran to court, and AdviceBox.com handed the critic's name over to the former employer, giving our critic less than a three days notice -- not nearly enough time to find an attorney and make a motion to protect his identity. He has lost his current job as a result. So has AdviceBox.com violated its promise? Certainly if you look at the way this service is marketed. The Website is filled with stuff like this: "Send your anonymous email here!" and this "What is anonymous email? The ability to send email without revealing your identity to the recipient." But as Tom Waits once noted, what the large print giveth, the small print taketh away. AdviceBox.com doesn't really provide anonymous email -- email where the recipient cannot find out your identity. [EFF: Deep Links] 10:45:51 AM  PermaLink   / trackback []

Lords fights back on compulsory IDs. Lords fights back on compulsory IDs. Tells Blair to back manifesto pledge Tories in the House of Lords are hoping to throw out the Labour government's proposals for compulsory ID cards this afternoon - in part by pointing to Labour's manifesto commitments. [The Register - Internet and Law: Digital Rights/Digital Wrongs] 10:42:28 AM  PermaLink   / trackback []

DearAOL.com Coalition Grows From 50 Organizations to 500 In One Week. DearAOL.com Coalition Grows From 50 Organizations to 500 In One Week. 30,000 Email Users Sign Open Letter San Francisco - Despite AOL's attempt to divide its critics, the DearAOL.com Coalition announced Monday it has grown tenfold from 50 organizations to more than 500 as it fights AOL's controversial plan to create a two-tiered Internet that leaves the little guy behind. Last week, AOL's proposed "email tax" came under fire from a coalition of political groups on the left and right, businesses and non-profits, charities, and Internet advocacy organizations. More than 400 publications around the world published articles about AOL's plan to allow large mass-emailers to pay to bypass AOL's spam filters and get guaranteed delivery directly into the inboxes of AOL customers[~]leaving the little guy behind with increasingly unreliable second-tier Internet service. In just several days, the DearAOL.com Coalition grew to include everything from babysitting co-ops to pony clubs, from farmers markets to biker dailies, from Hawaiian skateboard makers to church groups[~]demonstrating that small, large, ordinary and extraordinary groups depend on free email delivery. All coalition members are located at www.dearaol.com. Clearly worried by the coalition's growing momentum, AOL on Friday tried to repackage its already existing "Enhanced Whitelist" as if it were a new program for nonprofits. It also tried to divide the coalition with an offer to give special email privileges to some "qualified" nonprofits while leaving other non-profits, charities, small businesses, and even neighbors with community mailing lists behind. Neither of these addresses the core of the problem: AOL's increased financial incentive to downgrade ordinary email delivery. "I don't take bribes," said Gilles Frydman, Executive Director of the Association of Cancer Online Resources, a free nonprofit online service for cancer patients. "The solution is not AOL offering a few of us service for free in exchange for our silence[~]the solution is preserving equal access to the free and open Internet for everyone." If anything, the net result of AOL's Friday announcement was that they conceded the central point of the DearAOL.com Coalition. "By offering to move a few of the little guys from the losers circle to the winners circle, AOL conceded the broader point of our coalition[~]that AOL's would create a two-tiered Internet that leaves many behind with inferior service," said Adam Green, a spokesperson for MoveOn.org Civic Action. This weekend, the San Jose Mercury News exposed this reality in an editorial entitled, "Paid e-mail will lead to separate, unequal systems; free systems will become neglected." It identified AOL's threat to the "free and open" Internet this way: "the temptation would be to neglect the free e-mail system, whose reliability would decline. Eventually, everyone would migrate to the fee-based system. There would be no way around the AOL tollbooth." "Perversely, AOL's pay-to-send system would actually reward AOL financially for degrading free email for regular customers as they attempt to push people into paid-mail," said Danny O'Brien, Activism Coordinator for the Electronic Frontier Foundation. "AOL should be working to ensure its spam filters don't block legitimate mail, not charging protection money to bypass those filters and offering band-aids to allow some select nonprofits to bypass them as well." "AOL's pay-to-send scheme threatens the free and open Internet as we know it," said Timothy Karr, campaign director of Free Press, a national, nonpartisan media reform organization. "The Internet needs to be a level playing field. The flow of online information, innovation and ideas is not a luxury to be sold off to the highest bidder." The DearAOL.com Coalition: http://www.dearaol.com San Jose Mercury News editorial: http://www.mercurynews.com/mld/mercurynews/news/opinion/14023726.htm Contact: Danny O'Brien Activism Coordinator Electronic Frontier Foundation danny@eff.org [EFF: Breaking News] 10:40:38 AM  PermaLink   / trackback []

Symantec Adjusts Browser Bug Count Symantec Adjusts Browser Bug Count. Latest Internet Security Threat Report looks at the flaws found in IE and Firefox. [PCWorld.com - Latest News Stories] 10:32:49 AM  PermaLink   / trackback []

Hey Neighbor, Stop Piggybacking on My Wireless. Hey Neighbor, Stop Piggybacking on My Wireless. Tapping into someone else's wireless Internet connection is no longer just for computer geeks. Ordinarily upstanding people are tapping in too. By MICHEL MARRIOTT. [NYT > Home Page] 12:35:26 AM  PermaLink   / trackback []

Lords fights back on compulsory IDs | The Register Tories in the House of Lords are hoping to throw out the Labour government's proposals for compulsory ID cards this afternoon - in part by pointing to Labour's manifesto commitments. Originally, the proposed ID card was to be voluntary, but new plans mean that anyone applying for a new passport from 2008 will also get an ID card. Lord Strathclyde, Tory leader in the Lords, said: "That fundamentally changes what the government said they were trying to do, which was to have a voluntary ID pass system. We want to go back to an entirely voluntary scheme. The reason why this is so important is that, if we don't get it right, some 85 per cent of people of this country will be affected within the next five to six years." 12:33:02 AM  PermaLink   / trackback []

Microsoft: Vista won't get a backdoor | CNET News.com Windows Vista won't have a backdoor that could be used by police forces to get into encrypted files, Microsoft has stressed. In February, a BBC News story suggested that the British government was in discussions with Microsoft over backdoor access to the operating system. A backdoor is a method of bypassing normal authentication to gain access to a computer without to the PC user knowing. But Microsoft has now quelled the suggestion that law enforcement might get such access. "Microsoft has not and will not put 'backdoors' into Windows," a company representative said in a statement sent via e-mail. The discussion centers on BitLocker Drive Encryption, a planned security feature for Vista, the update to the Windows operating system. BitLocker encrypts data to protect it if the computer is lost or stolen. This feature could make it harder for law enforcement agencies to get access to data on seized computers. "The suggestion is that we are working with governments to create a back door so that they can always access BitLocker-encrypted data," Niels Ferguson, a developer and cryptographer at Microsoft, wrote Thursday on a corporate blog. "Over my dead body," he wrote in his post titled "Back-door nonsense." 12:22:45 AM  PermaLink   / trackback []

No Backdoor in Vista. No Backdoor in Vista. mytrip wrote to mention a C|Net article stating that Vista will not have a security backdoor after all. From the article: "'The suggestion is that we are working with governments to create a back door so that they can always access BitLocker-encrypted data,' Niels Ferguson, a developer and cryptographer at Microsoft, wrote Thursday on a corporate blog. 'Over my dead body,' he wrote in his post titled Back-door nonsense."[Slashdot] 12:17:17 AM  PermaLink   / trackback []

Are Spam Blockers Too Strict? Are Spam Blockers Too Strict? Complaints about over-blocking e-mail messages are fueling debate over AOL's plan to charge for guaranteed delivery of e-mails. But spam is often in the eye of the beholder. News analysis by Joanna Glasner. [Wired News: Top Stories] 12:13:35 AM  PermaLink   / trackback []

NewsForge | Open source election systems desirable, unavailable Electronic voting expert Avi Rubin, a computer science professor at Johns Hopkins University and director of the federally funded, $7.5 million ACCURATE organization (A Center for Correct, Usable, Reliable, Auditable, and Transparent Elections), says he is not familiar with any open source voting system efforts that are ready for the polls. "To my knowledge, all of the vendors use proprietary systems," he says. The only open source e-voting effort that Rubin noted was the Open Voting Consortium (OVC). "I don't agree with everything they are doing, but they are all about transparency and open source," Rubin said. OVC President and CEO Alan Dechert says it would take a large investment of time and money to provide an alternative to traditional e-voting systems vendors, but he says an effort known as Open Voting Solutions (OVS) is looking to do just that. 12:10:43 AM  PermaLink   / trackback []

OSS Election Systems Desired, but Not Ready. OSS Election Systems Desired, but Not Ready. An anonymous reader writes "Even though many American voters are ready for open source systems at the polls, Newsforge (a Slashdot sister site) has an interesting story about why open source may not be ready for the polls. From the article: 'The only open source e-voting effort that Rubin [an e-voting expert] noted was the Open Voting Consortium (OVC). "I don't agree with everything they are doing, but they are all about transparency and open source," Rubin said. OVC President and CEO Alan Dechert says it would take a large investment of time and money to provide an alternative to traditional e-voting systems vendors, but he says an effort known as Open Voting Solutions (OVS) is looking to do just that.'" [Slashdot] 12:06:31 AM  PermaLink   / trackback []

STLtoday - Nixon sues company selling phone records online JEFFERSON CITY, Mo. (AP) -- Attorney General Jay Nixon has filed suit against a Florida-based company that sold phone records online, claiming it obtained the records illegally. Datatraceusa.com is the third such Web site Nixon has sued since January. Two of the Web sites, locatecell.com and completeskiptrace.com, already have been ordered to stop doing business in Missouri and with the state's residents. Several such Web sites stopped doing business last month following negative publicity and government pressure. 12:02:17 AM  PermaLink   / trackback []