Infosec & Privacy

RGPD - Le guide pratique La CNIL1 est sympa. Le gendarme français des données personnelles inflige (parfois) des amendes (modestes au regard de ce qu’autorise le RGPD) à ceux qui bafouent le respect de la vie privée et la sécurité des données personnelles. Enfin, quand elle ne fait pas de siestes trop longues2 ou ne fait pas preuve d’un laxisme éhonté comme le rapportait La Quadrature du Net en 20213. Mais globalement la situation s’améliore: en 2023, la CNIL a instruit 16 000 plaintes, procédé à 340 contrôles et prononcé 168 mises en demeure et 42 sanctions pour un montant de 90 millions d’Euros. ...

Chez le tout nouveau France Travail (ex- Pôle Emploi, ex- ANPE) il y a ceux qui font leur boulot1 et puis il y a les autres, notamment ceux du service SSI2 qui devaient avoir aqua-poney le jour où la solidité du tout nouveau site web et de son backend a été éprouvée. Si elle l’a été, ce dont vous me permettrez de douter (voir plus bas). ...

[EDIT: 09.01.2023]: Threema has reacted to the publication in bold terms: The [research] paper is based on an old protocol that is no longer in use. The presented findings do not apply to Threema’s current communication protocol “Ibex” or have already been addressed. None of them ever had any considerable real-world impact. See how the story develops. Threema is a Swiss encrypted messaging application which has been widely advertised as a secure alternative to Signal, WhatsApp or Wire. Their website claims the app is used by more than 10 million users and 7,000 corporate customers. Prominent users of Threema include the Swiss Government, the Swiss Army and the current Chancellor of Germany, Olaf Scholz. ...

Abstract: Telling users to ‘avoid clicking bad links’ still isn’t working by David C. - Technical Director for Platforms Research and Principal Architect - NCSC (UK) Why organisations should avoid ‘blame and fear’, and instead use technical measures to manage the threat from phishing. Infosec tenets simply don’t work Advising users not to click on bad link: users frequently need to click on links from unfamiliar domains to do their job, and being able to spot a phish is not their job ...

[First published on September 05, 2016] I am ditching WhatsApp, following Facebook’s decision to begin harvesting data from its messaging service. Even though Motherboard claims “it may be possible to prevent WhatsApp to give your phone number to Facebook” (LOL) WhatsApp will still harvest your metadata. “Sharing metadata with Facebook still exposes users to significant risks,” says Claire Gartland, consumer protection counsel for the Electronic Privacy Information Center. “Facebook will have data indicating who WhatsApp users communicate with and how frequently, and connecting WhatsApp users with their social media accounts and broader online activity, associations, political affiliations, and more.” – Wired ...

Vu sur le site de l’ANSSI: Accompagnant la prise de conscience généralisée du besoin de sécuriser ses communications électroniques, de nombreuses applications de messagerie (quasi) instantanée ont fait leur apparition sur les ordiphones. Toutes annoncent un haut niveau de sécurité, laissant ainsi l’utilisateur dans le doute, vis-à-vis du niveau réel de sécurité à escompter. Donc, que privilégier entre Signal, Telegram ou XMPP? Je ne cite pas WhatsApp/Facecrook à dessein, hein. ...

Lowyat reported on Oct. 30, 2017 that a total of 46.2 Million Malaysian phone numbers were exposed, and the dataset included IC numbers, addresses, IMSI, IMEI and SIM numbers as well. Check yourself out Head over to SayaKenaHack.com, the dedicated website created by Keith Rozario and check if your details are part of the breach.

Knowing it and getting used to it: surveillance apathy turns out to be more worrisome than the proper lack of understanding online surveillanc. You may be sick of worrying about online privacy, but surveillance apathy is also a problem. We all seem worried about privacy. Though it’s not only privacy itself we should be concerned about: it’s also our attitudes towards privacy that are important. When we stop caring about our digital privacy, we witness surveillance apathy. And it’s something that may be particularly significant for marginalised communities, who feel they hold no power to navigate or negotiate fair use of digital technologies. ...

A brief history of GnuPG: vital to online security but free and underfunded Donate to GnuPG. Most people have never heard of the software that makes up the machinery of the internet. Outside developer circles, its authors receive little reward for their efforts, in terms of either money or public recognition. One example is the encryption software GNU Privacy Guard (also known as GnuPG and GPG), and its authors are regularly forced to fundraise to continue the project. ...

China has largely blocked the WhatsApp messaging app, the latest move by Beijing to step up surveillance ahead of a big Communist Party gathering next month. The disabling in mainland China of the Facebook-owned app is a setback for the social media giant, whose chief executive, Mark Zuckerberg, has been pushing to re-enter the Chinese market, and has been studying the Chinese language intensively. WhatsApp was the last of Facebook products to still be available in mainland China; the company’s main social media service has been blocked in China since 2009, and its Instagram image-sharing app is also unavailable. ...