April 2019 - wlug - list.wlug.org.nz

You Can Now Use Your Android Phone as a 2FA Security Key for Google Accounts
by Peter Reutemann 10 Apr '19

10 Apr '19

'Google said today it will now enable Android users to use their smartphones as a Fast Identity Online (FIDO) security key (for two-step authentication) for their Google accounts, thereby addressing one of the biggest challenges that has slowed the adoption of this security measure: convenience. A report adds: You can thus use your Android phone to protect your personal Google account, and your G Suite, Cloud Identity, and Google Cloud Platform work accounts. (Android tablets aren't supported -- Google specifically limited the functionality since users are more likely to have phones with them.) This means Android phones can move from two-step verification (2SV) to two-factor authentication (2FA). 2SV is a method of confirming a user's identity using something they know (password) and a second thing they know (a code sent via text message). 2FA is a method of confirming a user's identity by using a combination of two different factors: something they know (password), something they have (security key), or something they are (fingerprint). The feature is coming only to Android devices versions 7 and up.' -- source: https://tech.slashdot.org/story/19/04/10/1621253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Chrome Wants To Block Some HTTP File Downloads
by Peter Reutemann 10 Apr '19

10 Apr '19

'Google wants to block some file downloads carried out via HTTP on websites that use HTTPS. The plan is to block EXE, DMG, CRX, ZIP, GZIP, BZIP, TAR, RAR, and 7Z file downloads when the download is initiated via HTTP but the website URL shows HTTPS. Google said it's currently not thinking of blocking all downloads started from HTTP sites, since the browser already warns users about a site's poor security via the "Not Secure" indicator in the URL bar. The idea is to block insecure downloads on sites that appear to be secure (loaded via HTTPS) but where the downloads take place via plain ol' HTTP.' -- source: https://tech.slashdot.org/story/19/04/10/1758206 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mysterious safety-tampering malware infects a second critical infrastructure site
by Peter Reutemann 10 Apr '19

10 Apr '19

'Sixteen months ago, researchers reported an unsettling escalation in hacks targeting power plants, gas refineries, and other types of critical infrastructure. Attackers who may have been working on behalf of a nation caused an operational outage at a critical-infrastructure site after deliberately targeting a system that prevented health- and life-threatening accidents. Game-changing attack on critical infrastructure site causes outage There had been compromises of critical infrastructure sites before. What was unprecedented in this attack—and of considerable concern to some researchers and critical infrastructure operators—was the use of an advanced piece of malware that targeted the unidentified site’s safety processes. Such safety instrumented systems (SIS) are a combination of hardware and software that many critical infrastructure sites use to prevent unsafe conditions from arising. When gas fuel pressures or reactor temperatures rise to potentially unsafe thresholds, for instance, a SIS will automatically close valves or initiate cooling processes to prevent health- or life-threatening accidents. Russia was likely behind dangerous critical infrastructure attack, report says By focusing on the site’s SIS, the malware carried the threat of physical destruction that depending on the site and the type of accident had the potential to be serious if not catastrophic. The malware was alternately named Triton and Trisis, because it targeted the Triconex product line made by Schneider Electric. It’s development was ultimately linked to a Russian government-backed research institute.' -- source: https://arstechnica.com/information-technology/2019/04/mysterious-safety-ta… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Windows XP Dies Final Death As Embedded POSReady 2009 Reaches End of Life
by Peter Reutemann 10 Apr '19

10 Apr '19

'Extended support for Windows Embedded POSReady 2009 -- the last supported version of Windows based on Windows XP -- ended on April 9, 2019, marking the final end of the Windows NT 5.1 product line after 17 years, 7 months, and 16 days. Counting this edition, Windows XP is the longest-lived version of Windows ever -- a record which is unlikely to be beaten. Despite the nominal end of support for Windows XP five years ago, the existence of POSReady 2009 allowed users to receive security updates on Windows XP Home and Professional SP3 through the use of a registry hack. Microsoft dissuaded users from doing this, stating that they "do not fully protect Windows XP customers," though no attempt was apparently made to prevent users from using this hack. With POSReady reaching the end of support, the flow of these security updates will likewise come to an end.' -- source: https://tech.slashdot.org/story/19/04/10/0017208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Most Public Windows Error-Message Screen Ever?
by Lawrence D'Oliveiro 09 Apr '19

09 Apr '19

There has long been a history of Windows error messages popping up in the most embarrassing public places, like on status displays in train stations, shopping malls and the like. Could this example be some kind of record for being the most public? Being wrapped right round the top of one of the tallest buildings in London, after all. <https://www.theregister.co.uk/2019/04/08/bt_tower_broadcasts_error_message_…>

1 0

meeting next Monday
by Peter Reutemann 09 Apr '19

09 Apr '19

Hi everyone Due to Easter falling on our usual WLUG meeting slot on the 22nd and the university no longer allowing rooms to be used on public holidays, this month's meeting will happen next Monday, a week earlier. At this stage, I'm still looking for a speaker. A talk on Wayland was suggested, but I never received a confirmation/blurb, unfortunately. https://www.meetup.com/WaikatoLinuxUsersGroup/events/257884273/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Opera Adds Crypto Wallet To Its Desktop Browser, Launches Anti-Chrome Campaign in Europe
by Peter Reutemann 09 Apr '19

09 Apr '19

'Opera has updated its eponymous web browser for the desktop with a crypto-makeover and a number of additional features. From a report: The Norway-headquartered browser maker has also launched a marketing campaign to cash in on the EU regulatory order that requires Google to give Android users in Europe more options to choose their preferred browser. Dubbed 'Reborn 3,' the latest version of Opera for Windows, macOS, and Linux includes a native cryptocurrency wallet, which follows Opera's Android app getting this feature in December. The wallet keys and transactions are synced between the desktop and mobile browsers with the latter also serving as a way for the user to authenticate their identity, the company said. [...] Additionally, Opera is speeding up the free VPN feature, after adding this feature to its Android app last month.' -- source: https://tech.slashdot.org/story/19/04/09/1356246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla is Launching Curated Recommended Extensions Program This Summer
by Peter Reutemann 09 Apr '19

09 Apr '19

'However much you love your chosen web browser, you have probably enhanced its capabilities through the use of add-ons. Finding decent, reliable add-ons can be tricky, and this is why Mozilla is launching the Recommended Extensions program. This editor-curated program will surface the very best vetted extensions for Firefox, and it is due to roll out in stages later this summer. Mozilla says that any extensions it recommends through the program will be highlighted across its portfolio of websites and products, including addons.mozilla.org (AMO) and on Firefox's Get Add-Ons page. The company is already identifying extensions it likes the look of, and will soon be reaching out to developers. Changes should be seen on AMO around June.' -- source: https://tech.slashdot.org/story/19/04/09/1444248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Several Major Browsers to Prevent Disabling of Click-Tracking 'Hyperlink Auditing'
by Peter Reutemann 08 Apr '19

08 Apr '19

'A HTML standard called hyperlink auditing that allows sites to track link clicks is enabled by default on Safari, Chrome, Opera, and Microsoft Edge, but will soon have no way to disable it. As it is considered a privacy risk, browsers previously allowed you to disable this feature. Now they are going in the opposite direction. Hyperlink auditing is an HTML standard that allows the creation of special links that ping back to a specified URL when they are clicked on. These pings are done in the form of a POST request to the specified web page that can then examine the request headers to see what page the link was clicked on. The article concludes that "Firefox and Brave win the award" for people who want this click-tracking capability disabled -- since "only Brave and Firefox currently disable it by default, and do not appear to have any plans on enabling it in the future."' -- source: https://news.slashdot.org/story/19/04/07/2338244 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Why Aren't People Abandoning Windows For Linux?
by Peter Reutemann 08 Apr '19

08 Apr '19

'This weekend SlashGear published "Reasons to Abandon Windows For Linux," making their case to "Windows users who are curious about the state of Linux for mainstream computing." It tries to enumerate specific reasons why Linux might be the better choice, arguing among other things that: * Updates on Linux are fast and "rarely call for a restart" -- and are also more complete. "Updates are typically downloaded through a 'Software Updater' application that not only checks for operating system patches, but also includes updates for the programs that you've installed from the repository." * Windows "tries to serve a variety of markets...cramming in a scattered array of features" -- and along those lines, that Microsoft "has gradually implemented monetization schemes and methods for extracting user data." And yet you're still paying for that operating system, while Linux is less bloated and "free forever." * "Because less people use Linux, the platform is less targeted by malware and tends to be more secure than Windows" The article also touches on a few other points (including battery life), and predicts that problems with Windows are "bound to get worse over time and will only present more of a case for making the switch to Linux." Long-time Slashdot reader shanen shared the article, along with some new thoughts on why people really stay with Windows: I think the main "excuse" is the perception of reliability, which is really laughable if you've actually read the EULA. Microsoft certainly doesn't have to help anyone at all. I would argue that Windows support is neither a bug nor a feature, but just a marketing ploy. Their original submission suggests that maybe Linux needs to buttress the perception of its reliability with a better financial model -- possibly through a new kind of crowd funding which could also be extended to all open source software, or even to journalism).' -- source: https://linux.slashdot.org/story/19/04/07/2111218 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1