Sparrowvsrevolution writes
"In the wake of news that the iPhone app Path uploads users' entire contact lists without permission, Forbes dug up a study from a group of researchers at the University of California at Santa Barbara and the International Security Systems Lab that aimed to analyze how and where iPhone apps transmit users' private data. Not only did the researchers find that one in five of the free apps in Apple's app store upload private data back to the apps' creators that could potentially identify users and allow profiles to be built of their activities; they also discovered that programs in Cydia, the most popular platform for unauthorized apps that run only on 'jailbroken' iPhones, tend to leak private data far less frequently than Apple's approved apps. The researchers ran their analysis on 1,407 free apps (PDF) on the two platforms. Of those tested apps, 21 percent of official App Store apps uploaded the user's Unique Device Identifier, for instance, compared with only four percent of unauthorized apps."
An anonymous reader writes
"In what can only be described as a case of the pot calling the kettle black, Zynga has launched and settled a lawsuit against Brazilian game developer Vostu after accusing Vostu of copying their games. The settlement resulted in the loss of jobs for many Vostu employees. How Zynga managed to carry out such actions while keeping a straight face after dealing with similar allegations remains to be seen."
An anonymous reader writes
"A team of researchers led by McGill neuroscientist Terence Coderre, who is also affiliated with the Research Institute of the McGill University Health Centre, has found the key to understanding how memories of pain are stored in the brain. More importantly, the researchers are also able to suggest how these memories can be erased, making it possible to ease chronic pain."
An anonymous reader writes
"If you grab all the public keys you can find on the net, then you might expect to uncover a few duds — but would you believe that 2 out of every 1000 RSA keys is bad? This is one of the interesting findings in the paper 'Ron was wrong, Whit is right' by Lenstra, Hughes, Augier, Bos, Kleinjung and Wachter. Quoting from the paper's abstract: 'We performed a sanity check of public keys collected on the web. Our main goal was to test the validity of the assumption that different random choices are made each time keys are generated. We found that the vast majority of public keys work as intended. A more disconcerting finding is that two out of every one thousand RSA moduli that we collected offer no security. Our conclusion is that the validity of the assumption is questionable and that generating keys in the real world for "multiple-secrets" cryptosystems such as RSA is significantly riskier than for "single-secret" ones such as ElGamal or (EC)DSA which are based on Diffie-Hellman.'" For a layman's interpretation of the research, the NY Times has
an article about the paper.
Update: 02/15 01:34 GMT by
S : Security researcher
Dan Kaminsky has commented on the paper, saying that while the survey work itself is good, it doesn't necessarily support the paper's thesis. He writes, "On the most basic level, risk in cryptography is utterly dominated, not by cipher selection, but by key management. The study found 12,720 public keys. It also found approximately 2.94 million expired certificates. And while the study didn’t discuss the number of certificates that had no reason to be trusted in the first place (being self signed), it did find 5.4M PGP keys. It does not matter the strength of your public key if nobody knows to demand it."
itwbennett writes
"Sony on Tuesday demonstrated new 'smart sockets' that 'perform authentication whenever a device is plugged in,' said Taro Tadano, a general manager in Sony's technology development division. The company also demoed a home power grid that tracks electricity use by time and appliance." This has led to speculation that the technology will be used in some places to
charge consumers for the use of electricity.
An anonymous reader sends this quote from CBC News:
"Hackers based in China enjoyed widespread access to Nortel's computer network for nearly a decade, according to ... Brian Shields, a former Nortel employee who launched an internal investigation of the attacks, the Wall Street Journal reports [from behind a paywall]. ... Over the years, the hackers downloaded business plans, research and development reports, employee emails and other documents. According to the internal report, Nortel 'did nothing from a security standpoint' about the attacks."