That’s not my name! Practical problems in real name policies.

by @edent | # # | 8 comments | Read ~1,287 times.
A human holds up some paper with a mysterious script printed on it.

Once in a while, big companies suggest that the answer to abuse is to ban anonymity and institute a Real Names policy. This time, it is Google’s turn. They think that critical software should only be authored by people with “real names”. I don’t want to go into whether this is a good idea or…

Continue reading →

That’s not how 2FA works

by @edent | # # # # | 21 comments | Read ~30,508 times.
List of tweeters advocating for 2FA.

Another day, another high-profile website cloned to phish credentials. Is this a phishing attempt? Goes to "https://t.co/7b0EaPdGZR" and asks for username and pw (if so, it nearly got me!) /cc @github pic.twitter.com/jgt4oNvjF2 — Tess Rinearson (@_tessr) January 16, 2021 In the replies, you’ll see lots of techbros saying “this is why you should switch on…

Continue reading →

Falsehoods programmers believe about… Biometrics

by @edent | # # # # | 9 comments | Read ~6,144 times.
A fingerprint being scanned.

(For the new reader, there is a famous essay called Falsehoods Programmers Believe About Names. It has since spawned a long list of Falsehoods Programmers Believe About….) Everyone has fingerprints! The BBC has a grim tale of a family with a genetic mutation which means they have no fingerprints. It details the issues they have…

Continue reading →

I know how many microphones and cameras you have

by @edent | # # # # # | 8 comments | Read ~306 times.
Web browser asking for permission to access microphones. On the page, the number of microphones is displayed.

A curious little data leak, but one I struggle to care about. Perhaps useful for a bit of fingerprinting? Websites can access your system’s camera and microphone. That’s how modern video conferencing works in the browser. In an effort to retain user privacy, the browser asks the user for permission to use the camera and…

Continue reading →

Book Review: Privacy is Power – Carissa Véliz

by @edent | # # # # | 1 comment | Read ~232 times.
Book Cover.

Without your permission, or even your awareness, tech companies are harvesting your location, your likes, your habits, your relationships, your fears, your medical issues, and sharing it amongst themselves, as well as with governments and a multitude of data vultures. They’re not just selling your data. They’re selling the power to influence you and decide…

Continue reading →

Review: eufyCam 2C Wireless Home Security Camera System

by @edent | # # # # | 2 comments | Read ~162 times.
Flyer explaining how Eufy is different.

I hate the Internet of Things. It’s a load of overpriced junk, which abuses your privacy and demands a monthly fee in return. That’s why I was pleasantly surprised to see this fall out of the eufyCam 2C box. There’s no monthly fee. The recordings stay in your home. The batteries last for ages. I…

Continue reading →

I have 4% 2FA coverage

by @edent | # # # | 2 comments | Read ~213 times.
A long list of 2FA tokens.

Last year, when doing some digital spring-cleaning, I realised that I had 800 different passwords. I tried going through them, removing long-dead websites, closing old accounts, and deleting anything incriminating. I now have 891 accounts. Arse. I also went through my 31 different 2FA accounts. Getting rid of old employers’ email tokens, failed crypto wallet…

Continue reading →

More Phishers On Twitter

by @edent | # # # # # | 4 comments | Read ~1,085 times.
A Twitter exchange. Virgin ask Dom for his address - which he gives. Then they ask for his full credit card details. He refuses.

My mate Dom was moaning to his ISP on Twitter. They sent him a private message so they could look into his account. Blimey! Thankfully, that was a pretty brazen and inept attempt at phishing. Anyone asking for all your card details like that should set the alarm bells ringing. Of course, phishers often target…

Continue reading →

“file:///C:/users”

by @edent | # # | Read ~555 times.
List of Tweets where people have pasted a link to their local machine.

Once in a while, I’ll see someone Tweet a “link” to file:///C:/users/… – that’s the Microsoft Windows way of representing a location on a filesystem. Usually this means that the user has tried to either drag ‘n’ drop something, or copied a link from their file explorer. There are some (mild) infosec risks you should…

Continue reading →

GDPR and common sense

by @edent | # # # # | 3 comments | Read ~127 times.
Some giant question marks standing in a field.

Every so often, I get a glimpse into the thought processes of someone who has a very different view of the world to me. I don’t deal with people’s personal information often. So I was surprised to receive an email with a multi-megabyte spreadsheet called “Pay and Bonuses 2020”. The email contained this doozy of…

Continue reading →