Note the even huge breaches don’t make much of a ripple on the
evening news.
https://www.databreaches.net/ask-fm-user-database-with-350m-user-records-has-shown-up-for-sale/
Ask.FM user
database with 350m user records has shown up for sale
“I think it’s probably one of the biggest
breaches in a long time, can’t think of any bigger ones,”
Pompompurin, the owner of Breached.to, wrote when asked about a new
for-sale listing that appeared on his forum.
A seller called “Data,” who Pompompurin says
he will “vouch all day and night for” listed user data from
Ask.FM (ASKfm), the social networking site.
“I’m selling the users database of Ask.fm and
ask.com,” Data wrote. “For connoisseurs, you can also get 607
repositories plus their Gitlab, Jira, Confluence databases.”
There are about 350 million records in the
database, with about 45 million of them using Single Sign-On login.
The fields in the user database include: “user_id,
username, mail, hash, salt, fbid, twitterid, vkid, fbuid, iguid”
and the hashes are reportedly crackable.
Data, who joined the forum in March, also provided
a list of repositories, and sample git and sample user data.
DataBreaches reached out to Data to ask some
questions about when the data were acquired and how. DataBreaches
also reached out to Ask.FM last night to ask them some questions.
Ask.FM didn’t reply to either of two inquiries
over a 24 hour period, but Data did respond to this site’s
questions, with two prefacatory remarks. The first was to berate
yours truly for having a protonmail account. The second was a
request to please add “Marine Le Pen is a racist fraudster.”
Having dealt with those remarks, let’s turn to
the clarification Data provided on the Ask.FM incident.
In response to the first query about initial
access, Data replied that there was a vulnerability in Safety Center:
the server contained a WordPress site on their ASKFM-NET network.
As to when the hack occurred, Data replied that
the server was first accessed in 2019 and the database was obtained
on 2020-03-14. Data provided this site with users on the Safety
Center and wrote insultingly about a certain ‘lazy’ administrator
who allegedly used the same password everywhere.
[Note: Data provided specific and technical
details that DataBreaches is not reproducing in this post out of
concern that they might encourage or enable others to re-attack
Ask.FM. According to Data, Ask.FM is still vulnerable due to a poor
response to the 2020 incident.
“Specific parts were taken in 2021, although
they assumed the aggressors were kicked off,” Data wrote. “The
buyer will get specific details on how piss easy it is to compromise
the morons.”]
How easy is “piss easy,” you wonder? “Just
need to open 10 source files and spot either a vulnerability or peek
at the heavy password re-use,” Data told DataBreaches.
Ask.FM Knew But Kept Quiet?
When asked whether Ask.FM knew about the breach in
2020, Data was unequivocal in stating that they knew. Ask.FM noticed
the March 2020 breach circa June 2020, Data claims, but “was
apparently too busy laying off employees to give Answers to the
attempt to contact them.”
Data’s claim that Ask.FM knew was based, in
part, on Ask.FM burning some specific access the hackers had played
around with, like several production AWS credentials provided to
DataBreaches.
DataBreaches could find no media coverage or other
indication that Ask.FM ever disclosed the March 2020 breach or
notified users of it. If anyone ever received a notification about
it, please contact DataBreaches. If Ask.FM replies to inquiries,
this post will be updated.
Because Data invited contacts by private message,
it’s not clear how many purchase offers they have received at this
point, but they tell DataBreaches that they are now looking more at a
single (exclusive) sale.
Updated 9/21/2022: Because there has still been no
reply by AskFM, DataBreaches sent an inquiry to the Irish DPC asking
whether AskFM ever reported the March 2020 incident to them under the
GDPR. This post will be updated when a reply to that inquiry is
received.
Will lawyers be asked to arrange abortions and
will that communication be as vulnerable?
https://www.theregister.com/2022/09/20/encryption_abortion_data/
Meta,
Twitter, Apple, Google urged to up encryption game in post-Roe
America
… Now
that America has entered its post-Roe era, in which more than a dozen
states have banned abortion, digital rights advocacy group Fight for
the Future has called
on tech
companies to implement strong on-by-default end-to-end encryption
(E2EE) across their messaging services to secure users'
communications, and prevent conversations from being shared with
police and others.
Crucially,
campaigners want to ensure that people's chats discussing procedures
outlawed at the state level can't be obtained by the cops and used to
build a criminal case against them.
"When
our messages are protected from interlopers, we can communicate
freely, without the fear of being watched," said Caitlin Seeley
George, Fight for the Future's campaigns and managing director, in a
statement.
We had an effect? You’re welcome?
https://fpf.org/blog/the-colorado-effect-status-check-on-colorados-privacy-rulemaking/
THE
“COLORADO EFFECT?” STATUS CHECK ON COLORADO’S PRIVACY
RULEMAKING
Colorado
is set to formally enter a rulemaking process which may establish de
facto interpretations
for privacy protections across the United States. With the passage
of the Colorado
Privacy Act (CPA)
in 2021, Colorado, along with Virginia, Utah, and Connecticut, became
part of an emerging group of states adopting privacy laws that share
a similar framework and many core definitions with a legislative
model developed
(though never enacted) in Washington State. However, while the
general model of legislation seen in the CPA is similar to recently
enacted state privacy laws, the
CPA stands alone in providing authority to the state Attorney General
to issue regulations.
Because
no other similar state law has provided for this type of
interpretative authority, regulations issued by the Colorado Attorney
General could have far-reaching implications for how both businesses
and regulators in other jurisdictions come to interpret key state
privacy rights and protections. Colorado’s pre-rulemaking process
recently concluded, revealing a range of possible directions that
formal rulemaking could take. Below, we assess key priorities and
areas of significant divergence that have been brought into focus
both through public comments from stakeholders and questions posed by
the Attorney General.
Agreed, but I’m not sure that’s the solution.
https://www.scientificamerican.com/article/artificial-intelligence-needs-both-pragmatists-and-blue-sky-visionaries/#
Artificial
Intelligence Needs Both Pragmatists and Blue-Sky Visionaries
Artificial intelligence thinkers seem to emerge
from two communities. One is what I call blue-sky visionaries who
speculate about the future possibilities of the technology, invoking
utopian fantasies to generate excitement. Blue-sky ideas are
compelling but are often clouded over by unrealistic visions and the
ethical challenges of what can and should be built.
In contrast, what I call muddy-boots pragmatists
are problem- and solution-focused. They want to reduce the harms
that widely used AI-infused systems can create. They focus on fixing
biased and flawed systems, such as in facial recognition systems that
often mistakenly identify people as criminals or violate privacy.
The pragmatists want to reduce deadly medical mistakes that AI can
make, and steer self-driving cars to be safe-driving cars. Their
goal is also to improve AI-based decisions about mortgage loans,
college admissions, job hiring and parole granting.
Do you need to read cursive or are you willing to
trust an AI App on your phone to read it for you? “For sure and
several years ago our fathers bought this continent, a new station,
conceited and liberally dominated by the preposition that owl men are
created evil.”
https://www.bespacific.com/gen-z-never-learned-to-read-cursive/
Gen Z Never
Learned to Read Cursive – How will they interpret the past?
The
Atlantic:
“In
2010, cursive
was omitted from the new national Common Core standards for K–12
education. The students in my class, and their peers, were then
somewhere in elementary school. Handwriting instruction had already
been declining as laptops and tablets and lessons in “keyboarding”
assumed an ever more prominent place in the classroom. Most of my
students remembered getting no more than a year or so of somewhat
desultory cursive training, which was often pushed aside by a growing
emphasis on “teaching to the test.” Now in college, they
represent the vanguard of a cursiveless world. Although I was
unaware of it at the time, the 2010 Common Core policy on cursive had
generated an uproar. Jeremiads about the impending decline of
civilization appeared in The
Atlantic, The
New Yorker,
The
New York Times,
and elsewhere. Defenders of script argued variously that knowledge
of cursive was “a
basic right,”
a key connection between hand and brain, an essential form of
self-discipline, and a fundamental expression of identity. Its
disappearance would represent a craven submission to “the
tyranny of ‘relevance.’ ”
In
the future, cursive will have to be taught to scholars the way
Elizabethan secretary hand or paleography is today.
Within a decade, cursive’s embattled advocates had succeeded in
passing
measures requiring some sort of cursive instruction in
more than 20 states. At the same time, the struggle
for cursive became
part of a growing, politicized nostalgia for a lost past. In 2016,
Louisiana’s state senators reminded their constituents that the
Declaration of Independence had been written in cursive and cried out
“America!” as they unanimously voted to restore handwriting
instruction across the state…”
Perspective.
https://www.schneier.com/blog/archives/2022/09/automatic-cheating-detection-in-human-racing.html
Automatic
Cheating Detection in Human Racing
This
is a fascinating
glimpse of
the future of automatic cheating detection in sports:
Maybe
you heard about the truly insane false-start controversy in track and
field? Devon Allen—a wide receiver for the Philadelphia Eagles—was
disqualified from the 110-meter hurdles at the World Athletics
Championships a few weeks ago for a false start.
Here’s
the problem: You can’t see the false start. Nobody can see the
false start. By sight, Allen most definitely does not leave before
the gun.
But
here’s the thing: World Athletics has determined that it is not
possible for someone to push off the block within a tenth of a second
of the gun without false starting. They have science that shows it
is beyond human capabilities to react that fast. Of course there are
those (I’m among them) who would tell you that’s nonsense, that’s
pseudoscience, there’s no way that they can limit human
capabilities like that. There is science that shows it is humanly
impossible to hit a fastball. There was once science that showed
human beings could not run a four-minute mile.
Besides,
do you know what Devon Allen’s reaction time was? It was 0.99
seconds. One thousandth of a second too fast, according to World
Athletics’ science. They’re THAT sure that .01 seconds—and
EXACTLY .01 seconds—is the limit of human possibilities that they
will disqualify an athlete who has trained his whole life for this
moment because he reacted one thousandth of a second faster than they
think possible?
We
in the computer world are used to this sort of thing. “The
computer is always right,” even when it’s obviously wrong. But
now computers are leaving the world of keyboards and screens, and
this sort of thing will become more pervasive. In sports, computer
systems are used to detect when a ball is out of bounds in tennis and
other games and when a pitch is a strike in baseball. I’m sure
there’s more—are computers detecting first downs in football?—but
I’m not enough of a sports person to know them.
