@cwbussard@ioc.exchange avatar

cwbussard

@cwbussard@ioc.exchange

Law & Technology

This profile is from a federated server and may be incomplete. Browse more on the original instance.

eff, to random
@eff@mastodon.social avatar

"I have a hard time believing that YouTube would be unable to keep business afloat without the revenue generated by behavioral-tracking advertisements,” EFF’s Daly Barnett told @theregister. “It’s a lazy and deliberately malicious move on their part."
https://www.theregister.com/2024/04/16/youtube_ad_blocking/

cwbussard,
@cwbussard@ioc.exchange avatar

@karlauerbach @eff @theregister
@pluralistic

It's not in the advertiser's interest either. If someone wants to block ads, but is stopped from doing so by Google's fuckery, there's a darned near 0% chance that they'll click the ad or buy the advertiser's product. It's more likely that they'll be annoyed and mentally associate that annoyance with the advertiser's brand. Showing ads to this cohort is a net negative for advertisers. The only party who benefits is Google, collecting money for showing ads that have no hope of leading to a sale, and annoying some users enough to drive them to pay them to make the ads stop.

campuscodi, to random
@campuscodi@mastodon.social avatar

The Irish Council of Civil Liberties says that an Israeli company named ISA Security is selling access to Patternz, a powerful surveillance tool.

The ICCL says Patternz taps into real-time bidding information from online ad platforms to provide customers the ability to track almost anyone around the world.

ISA claims Patternz has data points for five billion individuals, including information on their driving routes, children, co-workers, and approximate geo-locations.

https://www.iccl.ie/2023/new-iccl-reports-reveal-serious-security-threat-to-the-eu-and-us/

cwbussard,
@cwbussard@ioc.exchange avatar

@campuscodi

Sounds like a really good reason to block both ads and tracking.

cwbussard,
@cwbussard@ioc.exchange avatar

@Fuzzbuzz @nuncio @campuscodi

Short answer: Probably to a limited extent.

Medium answer: Depends on how the data purchased by Patternz was originally collected.

Long answer: Brace yourself for a multi-part reply.

Off the top of my head, I sort tracking methods into 8 subtypes:

  1. The OS spying on you. (E.g., Android collecting location data (even when you try to turn it off).)
  2. Spyware. (E.g., just about damn near every smartphone app requesting permissions it doesn't need, then using them to spy on you.)
  3. ISP snooping your DNS requests.
  4. ISP snooping the destinations on your outgoing packets.
  5. First party website tracking what you do while logged in.
  6. First party website stateful tracking (i.e., cookies/supercookies).
  7. First party website stateless tracking (i.e., fingerprinting).
  8. Third party website tracking, stateful and stateless.

continues...

cwbussard,
@cwbussard@ioc.exchange avatar

@Fuzzbuzz @nuncio @campuscodi

...continued

The only solution to #1 (OS spying) is to use an OS that doesn't spy on you. For PCs, you can use Linux. But smartphones are a problem. Both Google and Apple are engaged in "Rambler in the Attic"-level snooping, and your other options are limited: You can jailbreak your phone and install an ungoogled android rom, or buy an overpriced, underpowered linux phone and run android apps via an emulator. In both cases, you'll find a lot of apps -- esp. banking apps -- just won't work outside of an unrooted, fully-googled environment.

#2 Spyware is a solved problem on PC, but a huge problem on smartphones. To avoid spyware on PC, use Linux. In Windows world, Windows Defender does a decent job of dealing with spyware. Aside from things you consider spyware but it doesn't (e.g., anything made by Microsoft). But pretty much every smartphone app is built on a spyware-included SDK and the OS's lack adequate controls for permissions and autorun to reign this in.

continues...

cwbussard,
@cwbussard@ioc.exchange avatar

@Fuzzbuzz @nuncio @campuscodi

...continued

#3 is defeated by using another DNS server instead of your ISP's. Note that browsers that implement DNS-over-HTTPS (e.g., Firefox) are already using another DNS server. Note also that this doesn't solve the problem; it just moves it. You've still got a DNS server out there that knows every site you visit. Just maybe one that's more trustworthy than your ISP. You hope. (In the future, the "oblivious DOT" protocol should go a ways towards fixing this, but that's not widely implemented yet.) (Running your own DNS resolver on a rented VPS is also an option.)

#4 is defeated by using a VPN. Again note that you're moving the problem rather than solving it. Your ISP can no longer snoop on your traffic, but the VPN operator can. (You can reduce this problem by running your own wireguard VPN on a cheap VPS from Digital Ocean, Linode, etc. The VPS provider might peek inside the VPS, but that's unlikely without legal process.)

Continues...

cwbussard,
@cwbussard@ioc.exchange avatar

@Fuzzbuzz @nuncio @campuscodi

The only solution for #5 is "don't log in." For situations where, for example, you want to be logged in to g-mail but not logged in to google search, Firefox's container tabs feature can isolate them from each other. (There's also an extension to automate always opening certain website in certain containers.)

To defeat #6, delete the browser state. Firefox's option to delete everything on shutdown suffices. Cookie Autodelete is a more aggressive solution.

#7 is tricky. Blocking first-party javascript stops it dead, but it often breaks websites. As a practical matter, Firefox's "resist fingerprinting" option stops most of this kind of tracking. And the CanvasBlocker extension stops a little more. However, it is theoretically impossible to stop tracking by a sufficiently sophisticated script that uses statistics to detect faked inputs. You can only hope that the bother of writing something that can beat FF's RFP isn't worth the effort for most adversaries.

Continues...

cwbussard,
@cwbussard@ioc.exchange avatar

@Fuzzbuzz @nuncio @campuscodi

#8 is easy. Third part tracking stuff usually ends up on adblock lists really fast. So most adblock solutions will block third-party tracking.

Now, I bet you were wondering when I'd finally get to Blokada? Here we are. (Finally.)

The first thing I noticed about Blokada is that after 5 minutes on their website, I still can't find anything that clearly states how it works. This is not a good sign. This sort of opacity is usually a sign of hucksterism.

Anywho, as best I can tell, their basic product is a DNS server that blackholes ads and trackers. So, it's functionally equivalent to a piehole. It should stop #3 and #8. But at the cost of trusting Blokada with all your DNS traffic. (Note also that blocking #3 without also blocking #4 is of limited use.)

They've also got a VPN product. That blocks #4, at the cost of trusting Blokada with all your traffic.

GossiTheDog, to random
@GossiTheDog@cyberplace.social avatar

deleted_by_author

    •
    cwbussard,
    @cwbussard@ioc.exchange avatar

    @GossiTheDog

    So what's the "buyer's" endgame here? What were they aiming to accomplish?

    mattblaze, to photography
    @mattblaze@federate.social avatar

    Park Junction, Philadelphia, PA, 2010.

    The southern end of the former Reading Railroad.

    All the pixels at https://www.flickr.com/photos/mattblaze/4472088022

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @mattblaze

    OK, I usually ignore your photography posts, but this is fricking neat!

    georgetakei, to random

    There’s a term “stochastic terrorism” when someone triggers others to act so can claim he had nothing to do with it. The law isn’t good at stopping this. But Trump is now a criminal defendant, subject to limitations. Courts must now use their power to stop his online terrorism.

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @LouisIngenthron @peterdrake @georgetakei

    I'd argue that the additional "seriousness" element that originated in the Whitney dissent survived Brandenburg.

    (Also, you stated the second element a bit wrong -- it's likelihood that the lawlessness will occur under the given circumstances, not reasonable person -- but you already noted that elsewhere.)

    continues...

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @LouisIngenthron @peterdrake @georgetakei

    ...continued

    A big problem with the term "stochastic terrorism" is that it's vague. Depending on who's saying it, it may have some overlap with legally punishable "incitement," or it may have none. So, when someone calls for legal punishment for "stochastic terrorism," it's not really clear, to me at least, how much at odds with the First Amendment that position is. Are they focusing on one instance of "stochastic terrorism" that also qualifies as "incitement" and forgetting that the overlap is (much) less than total. Are they advocating for punishing an entire class of protected speech? Are they really just asking for enforcement against incitement and using the wrong word because "stochastic terrorism" is the new hip phrase all the cool kids are using?

    continues...

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @LouisIngenthron @peterdrake @georgetakei

    For the record, I think that a lot of Trump's "Will no one rid me of this turbulent priest?" statements DO qualify as incitement, and probably ought to be prosecuted. Is twice publishing Letitia James's home address a coded way of saying "somebody go kill her"? Yes, I think it is. Would killing her be lawless action? Yep. Serious lawless action? Yep.
    Immediate lawless action? Yes. "Now" seems to be implied along with "kill her." Is someone sufficiently likely to obey this exhortation, under the circumstances? Yes, I think so. I think, given that his exhortation to violence was obeyed on Jan 6, and his recent publication of Obama's home address actually prompted an idiot with a gun to show up, the exhorted lawlessness is a sufficiently likely outcome under these circumstances.

    Prosecuting statements made in coded language is always a hard job for a prosecutor, but shying away from such prosecutions encourages repetition.

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @LouisIngenthron @peterdrake

    Coded language is not magical armor against prosecution. We can and do prosecute people for the meaning of their statements even when the dictionary definitions of the words they used mean something else or when the statement leaves something unsaid but understood. See, e.g., just about every drug conspiracy case.

    Prosecuting statements made in coded language can be a hard lift for prosecutors. You've got to convince the jury of the coded meaning beyond a reasonable doubt. But there's a distinction between "things that are not crimes" and "crimes that are a headache to prove." This is the latter, not the former.

    ai6yr, to ai
    @ai6yr@m.ai6yr.org avatar

    Rapper blames AI-written closing arguments for conviction https://arstechnica.com/tech-policy/2023/10/fugees-rapper-blames-conviction-on-his-lawyers-ai-fueled-closing-argument/?utm_brand=arstechnica&utm_social-type=owned&utm_source=mastodon&utm_medium=social

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @ai6yr
    @arstechnica

    Does anyone have a link to the video or transcript of this closing argument?

    seldo, to random
    @seldo@alpaca.gold avatar

    There are ads in the start bar in Windows 11, in an operating system I paid for. Whose joke of enshittification is this?

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @seldo

    It's things like this that make me feel really smug about switching to Linux a few years back. I know Linux has a reputation for being difficult and "not for gaming," but I've found neither of those to be true.

    briankrebs, to random

    From the "I'd like to go back to bed now please" dept:

    An arrest on gun possession charges in Queens, New York, in November 2021 has led the Federal Bureau of Investigation to a pedophilic, Satanist extortion cult that has victimized dozens if not hundreds of minors, according to law enforcement documents, court records and sources with knowledge of the investigation.

    https://www.theguardian.com/us-news/2023/sep/28/new-york-satanic-cult-764-fbi

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @briankrebs

    Satanist pedophiles? Really? Sounds more like the cops found a 4chan knockoff and fantasized the rest.

    malwaretech, to random

    I had a go-to for demonstrating that LLMs don't think or understand. LLMs sort of treated inputs a bit like separate queries. So if you could find two questions on the same topic where a Google search might result in contradictory answers, the training data might be contradictory enough to get the LLM to mirror those contradictions. You could ask two specific questions and get conflicting answers, then ask a third higher-level question that would require reconciling both contradictory answers. The LLM would just pick which of the conflicting answers was statistically most likely based on its data, and completely ignore the other. No matter what you did you could never get it to reconcile the two answers. If you asked follow up questions, it would just go right back to giving contradictory answers.

    Over time they'd patch the LLM, I assume by adding some kind of system to address inconsistency, giving the further illusion of thought and understanding. Basically any test you could possibly develop can be addressed without making the LLM intelligent or conscious. It's a great example of the core tenant of Solipsism. You can only be sure that you are conscious. Any sufficiently advanced external system can be made to imitate anything you perceive to show consciousness or intelligence. Since consciousness is a purely internal experience, there can never be any reliable way to test for it (also works both ways, you can't truly disprove it).

    Too long, didn't read: are LLMs conscious or intelligent? We can never truly know, but common sense and wisdom says no on both counts.

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @malwaretech

    I thought this was a pretty good demonstration that there's no "comprehension" going on.

    https://benchmarks.llmonitor.com/sally

    malwaretech, to random

    Honestly, the idea that protecting hate speech increases freedom needs to die already.

    https://throwawayopinions.io/the-american-illusion-of-free-speech.html?1

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @malwaretech

    The case for protecting hate speech isn't a slipperly slope argument that not protecting hate speech now will lead to not protecting other speech later. Rather it's a direct argument about the corrupt use of government power -- if we let the government decide what constitutes "hate speech," then whatever upsets the people in power will be labeled "hate speech" and prosecuted. All the examples you cite about US gov't agents stomping all over freedom of speech in other areas show why they can't be trusted with the power to define "hate speech." Think about that prosecutor who overcharges to compel cooperation -- what would he do if there were an anti-hate-speech law on the books? He'd think of a way to twist something you said around into "hate" speech" so he could pile another bogus charge on top -- that's what!

    [continues]

    malwaretech, to random

    This is absolutely crazy stuff. Chinese hackers were able to get into a bunch of government email accounts by forging Microsoft access tokens, but how it happened is wild.

    Apparently an internal Microsoft system responsible for signing consumer access tokens crashed, then a bug in the crash dump generator caused the secret key to be written to the crash dump. Microsoft's secondary system for detecting sensitive data in crash dumps also failed, allowing the crash dump to be moved from an isolated network to the corporate one. The Chinese hackers compromised a Microsoft engineer's account and were able to get a hold of the crash dump. They were not only able to find the key and figure out that it's responsible for signing consumer access tokens, but were also able to exploit a software bug to use it to sign enterprise access tokens too, basically giving them the keys to the kingdom.

    So many security system had to fail for this to happen. Either the hackers were very lucky or extremely patient.

    https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @malwaretech

    Sooo.....

    1. Why is the machine holding the key crashing in the first place? Shouldn't that be a single-purpose machine that only ever executes one relatively simple, well-tested program for producing signatures?

    2. Why move the dump to a less secure network for debugging?

    3. Why delete logs?

    Nightyear, to random

    Really enjoyed @sawaba 's talk on Myths and Lies in Infosec (https://youtu.be/Bvps1JdYYlE) though I found myself wishing for the Directors Cut. I suppose it's good to leave the audience wanting more. Hope to some day buy Adrian a beverage and trade stories about Ponemon Institute and various other absurdities in this fledgling industry.

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @Nightyear @sawaba

    Wait a minute, who is that one company? Did I miss the part where he said who it was?

    briankrebs, to random

    Small scoop here: In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech industry has led some security experts to conclude that crooks likely have succeeded at cracking open some of the stolen LastPass vaults.

    https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-cracking-keys-stolen-in-lastpass-breach/

    From the story:

    "...the researchers learned the attackers frequently grouped together victims by sending their cryptocurrencies to the same destination crypto wallet.

    By identifying points of overlap in these destination addresses, the researchers were then able to track down and interview new victims. For example, the researchers said their methodology identified a recent multi-million dollar crypto heist victim as an employee at Chainalysis, a blockchain analysis firm that works closely with law enforcement agencies to help track down cybercriminals and money launderers.

    Chainalysis confirmed that the employee had suffered a high-dollar cryptocurrency heist late last month, but otherwise declined to comment for this story."

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @briankrebs

    I suppose the two big lessons here are:

    (1) The people in charge at LastPass are just buffoons. They've had so many second chances, and they just keep screwing up. They're simply not capable of making a secure password manager and no one should use their product again ever.

    (2) Cloud storage for a password manager is just a fundamentally bad idea. Something is inevitably going to go wrong. And this is what happens when it does.

    I'm skeptical about low iterations on the KDF being the culprit here. Sure, having low KDF iterations like this really bad -- like "comically negligent" kinda bad. But I'd assume that these sophisticated victims ought to have strong enough LastPass master passwords to survive brute force regardless of the KDF iterations. I'm thinking there's something cryptoanalytic at play here -- a padding oracle or a dumb AES mode or dumb IV reuse or something. I'm flagging @matthew_d_green who actually knows about this stuff and might have a better idea.

    Popehat, to random

    https://youtu.be/aiVkyD1yzJg

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @Popehat

    I'm beginning to think that we live in some kind of Douglas-Adams-ian universe in which the very structure of reality itself has been organized with the goal of irritating Ken.

    pluralistic, to random
    @pluralistic@mamot.fr avatar

    Today's threads (a thread)

    Inside: Paying consumer debts is basically optional in the United States; and more!

    Archived at: https://pluralistic.net/2023/08/12/do-not-pay/

    1/

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @pluralistic

    Back when I practiced law in NYC, I did consumer bankruptcy, along with some debt collection defense and FDCPA stuff too. So this is a subject near and dear to my heart. I've got some thoughts. Oh yes I do.

    First and foremost, Mr. McKenzie seems not to understand something of really critical importance: The harassment calls and the eventual lawsuit are largely operating on independent tracks. Stopping the calls may give great psychic relief, but it doesn't stop the sue-sue train that's coming down the tracks. If you don't do something about that then one day you're going to wake up to a frozen bank account.

    For this reason, I'm concerned about the impression readers may take away from a "paying consumer debts is basically optional in the United States" tone. Often that's not the case, and believing that dealing with the calls fully deals with the problem can set someone up for a terrible surprise.

    (continues...)

    cwbussard, to random
    @cwbussard@ioc.exchange avatar

    @pluralistic

    "Truly, any big number multiplied by an imaginary number can be turned into an even bigger number."

    But "imaginary number" is a term with a defined meaning: some real number multiplied by the square root of -1. So a big number multiplied by an imaginary number yields another imaginary number. It's still rhetorically apt though, since imaginary numbers defy common sense definitions of "positive" and "negative," much like Uber's balance sheet.

    georgetakei, to random

    Wait. She paid them HOW much in bonuses? Incredible. https://bit.ly/3qj0cAz

    cwbussard,
    @cwbussard@ioc.exchange avatar

    @georgetakei

    I don't care for her music, but it's hard not to like her for this.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • megavids
  • thenastyranch
  • magazineikmin
  • everett
  • InstantRegret
  • rosin
  • Youngstown
  • slotface
  • love
  • khanakhh
  • kavyap
  • tacticalgear
  • GTA5RPClips
  • DreamBathrooms
  • provamag3
  • modclub
  • mdbf
  • normalnudes
  • Durango
  • ethstaker
  • osvaldo12
  • cubers
  • ngwrru68w68
  • tester
  • anitta
  • cisconetworking
  • Leos
  • JUstTest
  • All magazines
    •