Tag Archive for: aims

What is FIDO? How this initiative aims to make passwords obsolete

/in


FIDO definition: What is the FIDO Alliance and what does FIDO stand for?

The FIDO (fast identity online) Alliance is an industry association that aims to reduce reliance on passwords for security, complementing or replacing them with strong authentication based on public-key cryptography. To achieve that goal, the FIDO Alliance has developed a series of technical specifications that websites and other service providers can use to move away from password-based security. In particular, the FIDO specs allow service providers to take advantage of biometric and other hardware-based security measures, either from specialized hardware security gadgets or the biometric features built into most new smartphones and some PCs.

The FIDO Alliance came together in 2013 as security pros working at PayPal, Lenovo, and other companies began to get fed up with various password-based security holes. The group has been plugging away at its goal for a while — “FIDO Alliance Says, Forget Passwords!”, CSO declared not long after the group started up — but with biometric readers becoming more and more prevalent and a new set of specs that are easy to integrate into standard webpages via JavaScript APIs, our passwordless future may finally be in sight. FIDO Alliance members include some of the biggest names in tech and media, so this initiative has muscle behind it. 

FIDO specifications

Before we get into the individual FIDO specifications, we need discuss the principle that they’re all based on: public key cryptography. In this form of cryptography, each communicating party uses two keys — very large numbers — to encrypt messages via an encryption algorithm. Each party shares a public key that’s used to encode a message, which can only be decoded by a private key, which is kept secret. The two keys are related by some mathematical operation that would be difficult or impossible to reverse — for instance, the private key might be two very long prime numbers and the public key would be the number you get by multiplying those two primes together. (For more on how this works, check out CSO’s explainer on cryptography.)

Public key cryptography is already the basis for most…

Source…

New coalition aims to combat growing wave of ransomware attacks

/in


A new coalition of cybersecurity and tech groups is looking to create a roadmap for countering the surge of ransomware attacks that plagued city governments, schools and hospitals in 2020.

“You see ransomware as not just an increasing security threat, it is to the level of now where it’s putting hospitals, children, the elderly, financial institutions, everyone at risk,” Philip Reiner, executive chairman of the Institute for Security and Technology’s Ransomware Task Force, told The Hill.

“As a result, we were seized with the idea that creating a collaborative cross-sectoral grouping that is looking at it from a comprehensive, top-down policy approach could potentially have more effect,” Reiner added.

The California-based nonprofit aims to produce recommendations that will help governments and the private sector tackle the scourge of ransomware attacks.

Hackers have increasingly used these types of attacks — which involve accessing and encrypting the victim’s network and demanding payment to allow access again — to hit major targets, with city governments in Atlanta, Baltimore and New Orleans severely impaired by ransomware attacks over the past two years.

More recently, hospitals have become a target during the COVID-19 pandemic, with cyber criminals seeing vulnerable hospitals as easy targets more likely to pay a quick ransom as health care systems struggle to keep up with coronavirus cases. In some instances, the cyberattacks have been blamed for deaths due to delayed care.

“Ransomware has evolved from an economic annoyance to a national security and public health and safety threat,” said Michael Daniel, who served as special assistant to former President Obama and cybersecurity coordinator on the National Security Council. “It is affecting almost every sector of the economy and every size of organization, both public and private.”

Daniel now serves as president and CEO of the Cyber Threat Alliance, one of the groups that has signed on as a member of the newly formed coalition.

The coalition’s task force is made up of heavy hitters in the cybersecurity and tech sector, including Microsoft, FireEye and McAfee, along with cyber-focused groups like the CyberPeace…

Source…

IPO Plans: Petco Aims for $816M and Poshmark Seeks $257M

/in


Petco Health & Wellness and Poshmark filed financial details of their planned initial public offerings with the Securities and Exchange Commission on Wednesday.

Source…

It’s Impossible To Opt Out Of Android’s Ad Tracking; Max Schrems Aims To Change That

/in

Most of the world has been under some form of lockdown for weeks, but that clearly hasn’t stopped the indefatigable Austrian privacy expert Max Schrems from working on his next legal action under the EU’s GDPR. Last year, he lodged a complaint with the French Data Protection Authority (CNIL) over what he called the “fake consent” that people must give to “cookie banners” in order to access sites. Now he has set his sights on Google’s Android Advertising ID, which is present on every Android phone. It builds on research carried out by the Norwegian Consumer Council, published in the report “Out of control”.

Today noyb.eu filed a formal GDPR complaint against Google for tracking users through an “Android Advertising ID” without a valid legal basis. The data collected with this unique tracking ID is passed on to countless third parties in the advertising ecosystem. The user has no real control over it: Google does not allow to delete an ID, just to create a new one.

The Android Advertising ID (AAID) is central to Google’s advertising system. It allows advertisers to track users as they move around the Internet, and to build profiles of their interests. Google claims that this “gives users better controls”, which is true if people want to receive highly-targeted advertising. But if they wish to opt out of this constant tracking, there is a problem. Although Google allows you to change your AAID, it is not possible to do without it completely: the best you can manage is to get a new one. And as the detailed legal complaint to the Austrian Data Protection Authority (pdf) from Schrems points out, there are multiple ways to link old AAIDs with new ones:

Studies and official investigations have proved that the AAID is stored, shared and, where needed, linked with old values via countless other identifiers such as IP addresses, IMEI codes and GPS coordinates, social media handles, email addresses or phone number, de facto allowing a persistent tracking of Android users.

Schrems’ organization None of Your Business (noyb.eu) claims that’s unacceptable under the GDPR:

EU Law requires user choice. Under GDPR, the strict European privacy law, users must consent to being tracked. Google does not collect valid “opt-in” consent before generating the tracking ID, but seems to generate these IDs without user consent.

Google’s position is weakened by the fact that Apple gives users of its smartphones the ability to opt out of targeted ads; for those using iOS 10 or later, the advertising identifier is replaced with an untrackable string of zeros:

If you choose to enable Limit Ad Tracking, Apple’s advertising platform will opt your Apple ID out of receiving ads targeted to your interests, regardless of what device you are using. Apps or advertisers that do not use Apple’s advertising platform but do use Apple’s Advertising Identifier are required to check the Limit Ad Tracking setting and are not permitted by Apple’s guidelines to serve you targeted ads if you have Limit Ad Tracking enabled. When Limit Ad Tracking is enabled on iOS 10 or later, the Advertising Identifier is replaced with a non-unique value of all zeros to prevent the serving of targeted ads. It is automatically reset to a new random identifier if you disable Limit Ad Tracking.

The formal legal complaint was filed on behalf of an Austrian citizen, requesting that the AAID should be deleted permanently. If the action succeeds, that would allow anyone in the EU — and probably elsewhere — to do the same. In addition, the complaint points out that under the GDPR, the maximum possible fine, based on 4% of Google’s worldwide revenue, would be about €5.94 billion. There’s no chance such an unprecedented sum would be imposed, but the fact that every Android user in the EU is forced to use Google’s AAID could lead to a fairly hefty fine if Schrems succeeds with his latest legal defense of privacy.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Techdirt.