Private messages from 81,000 hacked Facebook accounts for sale
bbc.co.uk
bbc.co.uk
1) Every extension has to declare up front what urls it needs to communicate to.
2) Every extension has to provide schema of any data it intends to send out of browser.
3) Browser locally logs all this comms.
4) Browser blocks anything which doesn't match strict key values & value values and doesn't leave browser in plain text.
Rather than say just... use Postman?
I'm not disagreeing with the use, just wondering how they use it compared to Postman itself. I'm a n00b web dev, I just want to know how others work and why.
- Dork with code/ routes in one window and/or dorking around with the front end code.
- Postman (the stand alone program) in another window to check what the return from the server really is or what the API is doing now.
So I've got it on it's on dedicated space (not all the time but often enough).
If I'm not mistaken, it started as a browser extension.
Postman started off as a Chrome Extension (ran in a chrome tab), and then became a Chrome App. The standalone apps for desktops came later. A lot of people use the chrome extension because it's convenient.
Source: I worked at Postman until about a year ago.
However, the standalone app doesn't have that feature (yet). So I will continue to use the Chrome Extension version until they have that feature available in the Standalone app.
The only version that works is the Chrome App Postman, which simply uses the Chrome network stack, which obviously works behind the proxy.
Boooo to Postman.
Eg. whatsapp, 1password
Mozilla could implement ad blocking extensions and give the user the option to use custom block list(so Mozilla is not accused of becoming a gate keeper).
The Chrome version is more usable.
The great firefox redesign at the beginning of the century was about slimming down Mozilla the navigator and let extensions extend the browser. Is that the pendulum going back and forth ?
For example, some form of add or at least popup blocking should be included, but that does not preclude useful addons from customizing the experience.
I completely agree that you should be able to disable/unintall Mozilla extensions and replace them if you want with different ones(maybe you know of a better reader mode or a better ad blocker extension)
In fact this extension may not even be installed , just be part of Mozilla code base so any update will be reviewed
I believe Firefox has this. The rest are great ideas. Would love to see a way to log these.
Since a browser like Opera can integrate a proprietary VPN without messing with OS network settings, doing the same on other browsers should be possible.
Have you used ever Kaspersky?
It is not that hard to leak out arbitrary info in strings or even numbers
This is a losing battle. Don't engage.
In any multilevel computer system there are a number of
relatively low-bandwidth covert channels whose existence is
deeply ingrained in the system design. Faced with the large
potential cost of reducing the bandwidths of such covert
channels, it is felt that those with maximum bandwidths of
less than one (1) bit per second are acceptable in most
application environments. [...] Therefore, a Trusted
Computing Base should provide, wherever possible, the
capability to audit the use of covert channel mechanisms
with bandwidths that may exceed a rate of one (1) bit in ten
(10) seconds.
All of this is to say: If I could limit covert channels from webpages or mobile phone apps to 10 bps I'd do it in a heartbeat. Perfect is the enemy of good enough.
Just because I supplied a schema does not mean I'm not exfiltrating sensitive data, in a way that would not be obvious from the logs.
What you're suggesting is not that much better. Do you expect your grandma to be able to review the permission list for the browser extension?
Browser extensions are the modern day ActiveX. Yes, lots of them are very useful. But you could say the same about ActiveX controls too.
Therein lies the problem. The entire industry has, ever since windows 3.1 (!), done their best to condition users with a single and highly destructive mindset:
"Press OK to make the annoying window go away."
The only way around this, and I'm not saying this lightly, would be to make the pushers and vendors CRIMINALLY AND PERSONALLY liable for the damage they cause to end users. Once we see the third or fourth offender nailed through their genitals, head down, on the town hall wall, the message will start to get through.
I have some foxes for rent, perhaps you could use them to guard your henhouse.
It's a mixed bag.
What happens when you change a feature on a proper extension? Submit a request to all the anti-virus vendors to whitelist it?
Safari’s content blocking framework provides an existence proof that it can be done. Extensions just give Safari a JSON file with regex expressions of content that should be blocked.
I'm similar to the parent comment but my sole extension is the EFF's Privacy Badger. Yes, I'm trusting the EFF with access to everything I view, but they are in turn, blocking tracking data from nearly everyone else.
I may soon drop Privacy Badger though, Firefox's built-in tracking protection has inched closer and closer to that tier.
Its the operating system equivalent of a kernel driver, getting access to everything.
They lack transparency, updates can be sketchy and I dont ever know based on what I should make trust decisions (number of downloads, is it an individual or company, permissions,.. )
I think there's a happy middle ground somewhere were I can set an expiration time on anything I post to such a platform (e.g. Facebook/Twitter) so that it goes private after that time - e.g. a year. It wouldn't even harm the bottom line, since all the money is in new content, and I'd still have a private archive of photos if I ever wanted to download them again.
All this is moot for me since I don't use services like this at all, but I think there's an opportunity for a company to get this right.
Despite privacy issues, I still think that things sticking around "forever" on the Internet is a good default. Link rot is already a huge problem when you're trying to reference something you read in the past, and that's without auto-expiry.
Visit: https://www.facebook.com/messages/
Mouse over a conversation, click the cog, "This will permanently delete all conversation history [Cancel] [Delete] [Archive]."
But won't deny Facebook could make this easier/automated.
That doesn't help the problem of old messages from before these existed. It's also not super helpful because the retention is no more than a day. Better I think would be like a year -- enough time that you're unlikely to want to refer back to it.
Mio is an abbreviation for "millions" as a unit indicator in some financial markets, such as the German, Swiss, and Dutch markets. https://en.wikipedia.org/wiki/Mio
> [...] the data had probably been obtained through malicious browser extensions.
It appears to actually be hacked browsers, or compromised browsers for that matter.
My parents, for example, would not understand the difference.
Nor should they be expected to, but the BBC should know the difference. Facebooks stock price could be hurt due to this reporting, even though it shouldn't. This could be seen as an attempt at manipulating the stock price of a public trade company. Of cause it's just incompetence, but still.
https://www.cnet.com/how-to/50-million-facebook-accounts-wer...
The important part is why it's 10 cents an account. Most of the accounts are worthless to them.
They are looking for the 1 in 10000 that is worth much more. Security, security, security...
Any reason we shouldn’t suspect a malicious mobile app?
https://www.nytimes.com/2018/09/28/technology/facebook-hack-...
It's not clear to me from reading the GDPR whether companies are responsible for the loss of personal data outside of breaches in their security. E.g. is a successful phishing campaign against customers a data breach? If not at fault, do they have an obligation to alert customers specifically about the attack?
‘personal data breach’ means a breach of security leading to the accidental
or unlawful destruction, loss, alteration, unauthorised disclosure of, or
access to, personal data transmitted, stored or otherwise processed;
I mean, that's demonstrably untrue.