Flawed sign-in services from Google and Facebook imperil user accounts
Account login services that implement applications from Google, Facebook, and other commercial providers are prone to flaws that allow adversaries unauthorized access to private user profiles on the third-party Websites that use them, a team of computer scientists has concluded.
Their 10-month study found that many SSO, or single sign-on, services supplied by IdPs or ID Providers including Google, Facebook, and PayPal weren't properly integrated into Websites that used the services. As a result, private data on RP, or relying party, sites belonging to Farmville, Freelancer, Nasdaq, Sears, JainRain, and other sites were all vulnerable to snoops.
Read the comments on this post
Read More ...
Weekend Ar(t)s: EP presents a new challenge for Sufjan Stevens
During the weekend, even Ars takes an occasional break from evaluating third-generation iPads or hypothesizing about Microsoft patents. Weekend Ar(t)s is a chance to share what we're watching/listening/reading or otherwise consuming this week.
We're not in Illinoise anymore folks.
Sufjan Stevens is the modern musician for intellectuals. He has the academic background, the intricate orchestral pop, the bevy of nerdy conceptual albums (covering topics from states to holidays, and even bridges). He once included "Decatur" and "Emancipator" within the same rhyme scheme for crying out loud.
Needless to say, news of a new Stevens EP leaked in February and caused much excitement. The project would be a collaborative effort, with Stevens forming a group called s/s/s. That meant initially pairing up with Son Lux, another heavily orchestral indie musician who once wrote an entire album in a single month, and composed for yMusic. No stretch there.
The surprise came from the inclusion of that final "s." It referred to Serengeti—a rapper who happens to share a label with Son Lux. Like many Ars staffers, he calls Chicago home and playfully weaves it into his music. Serengeti's original album referenced things from WCKG to Portillo's. Considering the emcee's affinity for concepts and hyper-referential vocals, perhaps only his musical style would truly be a stretch for Stevens.
Beak & Claw finally debuted this past week and early listens indicate it's a must for any Stevens completionist. Be warned up front: there's no outright orchestral or folk influence here. It's foreign territory for Stevens; a combo of electronica and hip-hop that should raise an eyebrow only on paper. Ultimately these four songs feature all the charming nuances of any of Stevens work, demonstrating that his musical intelligence can transcend genre.
Beak & Claw's first single, "Museum Day," is particularly indicative of this. Serengeti's verse mentions things like "dinosaur museums" and "double, triple dares," while taking a more relaxed tempo than most hip-hop (think Drake in terms of cadence). A very soothing electronic string hook is laid underneath to carry things musically. Stevens blends his own vocals (through vocoder naturally) with this to create a soundcape verging on ambient. During the chorus when he, accompanied by a familiar choir, vocally soars over a cymbal-heavy percussion beat, it's as genuinely beautiful as anything you'd find on Seven Swans.
The rest of this debut s/s/s effort reaches similar heights (possibly even higher ones, my favorite track is embedded above) and leaves a listener wanting more. It's not the first time Sufjan Stevens has been fused with hip-hop (thank Tor and his Illinoize remixes), but it's the first time he's concocted that marriage on his terms. Stevens has always been willing to challenge himself (ambitions of writing albums for all 50 states for instance), but the work of s/s/s shows he's capable of doing it through composition, not just concept. Here's hoping Beak & Claw isn't the last opportunity for that.
Read the comments on this post
Read More ...
Cracking the cloud: An Amazon Web Services primer
Maybe you're a Dropbox devotee. Or perhaps you really like streaming Sherlock on Netflix. For that, you can thank the cloud.
In fact, it's safe to say that Amazon Web Services (AWS) has become synonymous with cloud computing; it's the platform on which some of the Internet's most popular sites and services are built. But just as cloud computing is used as a simplistic catchall term for a variety of online services, the same can be said for AWS—there's a lot more going on behind the scenes than you might think.
If you've ever wanted to drop terms like EC2 and S3 into casual conversation (and really, who doesn't?) we're going to demystify the most important parts of AWS and show you how Amazon's cloud really works.
Read the comments on this post
Read More ...
Why black (or blue, or red) plants might be the key to finding life beyond Earth
Take another look at that picture, and think about what you see. What are we looking at, and what’s all that green stuff?
Pretty easy quiz, right? The paint-by-numbers surface of the Earth has become second nature as satellite photos have entered the globalized world’s vernacular: water is blue, and plants are green.
But does this always have to be the case? Is it possible that plants could be red, or purple, or blue? These questions are more than just sci-fi curiosities - they’re becoming increasingly relevant as exoplanet hunters peer at distant planets, now closer than ever before.
Read the comments on this post
Read More ...
HTML5 roundup: magazine-style Web layouts with CSS regions
The Web is a powerful publishing platform, but HTML still has some weaknesses as a medium for presenting written content. Browser vendors and other stakeholders are working to remedy those weaknesses by improving the Web's native support for print-quality typography and text layouts.
Adobe is making significant contributions to that effort. A new set of CSS features for advanced text layouts that Adobe developed and proposed for standardization last year are beginning to gain traction. The company's CSS Regions proposal defines a system for creating magazine-style text layouts in Web content.
Read the comments on this post
Read More ...
Sony preparing Chrome OS laptop, Google working on UI overhaul
Documents submitted to the FCC reveal that Sony is preparing to launch a VAIO laptop with Google's Chrome OS operating system. The new Chromebook has an 11.6-inch display, WiFi and Bluetooth connectivity, USB ports, an HDMI output, and SD card slot.
Laptop Reviews, which drew attention to the FCC documents this weekend, believes the system may be powered by an ARM-based processor. They note the documents list the CPU as a T25. That could refer to an NVIDIA Tegra 250 T25, an SoC with a dual-core 1.2GHz Arm Cortex A9. Previous Chromebooks have all used Intel's Atom CPU.
Read the comments on this post
Read More ...
Atlanta renovation achieves highest LEED score in Northern Hemipshere
A renovated building in Midtown Atlanta has been awarded 95 out of a possible 110 LEED points for its environmental design-the highest score for any new construction in the Northern Hemisphere.
Though classified as a "New Construction" in the Leadership in Energy and Environmental Design system, 1315 Peachtree Street, Atlanta is actually a 1980s construction that has undergone extensive renovation. But what does LEED certification entail? And is this the greenest building in the Northern Hemisphere?
Read the comments on this post
Read More ...
With Oracle vs. Google trial about to begin, judge orders settlement talks
High-level executives at Google and Oracle were ordered to hold one last round of settlement talks, with the trial over Google's alleged use of Java technology in Android set to begin April 16.
The suit began in August 2010 when Oracle sued Google for patent and copyright infringement over use of the Java programming language in development of Android. Settlement talks have been ordered multiple times, but so far no deal has been made. On Friday, Judge Paul Grewal of US District Court in Northern California ordered Android chief Andy Rubin and Oracle Chief Financial Officer Safra Catz to hold "a further settlement conference" no later than April 9.
Read the comments on this post
Read More ...
Montana kids win contest, choose first GRAIL photos of the moon
Fourth grade students from Emily Dickinson Elementary School in Bozeman, Montana won the contest to rename two NASA spacecrafts. Their prize? The right to choose which parts of the moon the NASA ships would photograph. The images they chose have now been made available by the space agency.
In a perfect storm of bureaucratic literalism and mythopoetic overstatement, the two crafts were formerly called "Gravity Recovery And Interior Laboratory (GRAIL) A and B." The students won the right to direct the craft's MoonKAM (Moon Knowledge Acquired by Middle school students, seriously?) to photograph their choice by slightly purging NASA of its endemic etymological turgidity. The kids' entry for the crafts' new names: Ebb and Flow.
GRAIL was NASA's first planetary mission devoted to education and is directed by the first American woman in space, Sally Ride. The MoonKAM will be used by 2,700 schools in 52 countries over the course of the mission. NASA hopes direct control over a spacecraft (or a sizable chunk of it anyway—the camera) will, in the minds of a generation of school children, turn the moon from an abstraction into something they feel invested in.
"What might seem like just a cool activity for these kids may very well have a profound impact on their futures," Ride said in NASA's announcement. "The students really are excited about MoonKAM, and that translates into an excitement about science and engineering."
Read the comments on this post
Read More ...
Weird Science smells its way out of awkward social situations
You smell uncomfortable and accident prone: What do we rely on our sense of smell for? A new study attempts to find out by surveying a population of 32 individuals who were born without the ability to detect odors (in jargonese, that's "isolated congenital anosmia"). The answers: those without a functional nose tended to be involved in more household accidents, while experiencing "enhanced social insecurity." For the former, many have adopted coping strategies like asking others to determine whether a container of milk has gone bad.
I'm not sure prison is the right place to be testing gender theories: This is a case where an interesting and potentially useful finding is probably being a bit overinterpreted. Some researchers tracked the incidence of sexual violence in state prisons and found that it was lower in states that allowed their inmates conjugal visits. However, they've attempted to broaden that into some sort of grand conclusion about whether rape is a matter of gender-driven power struggles, which is probably stretching the relevance of the results past their breaking point.
Verdi after organ transplants, Enya for day-to-day life: This one had Weirdness written all over it, starting with the title: "Auditory stimulation of opera music induced prolongation of murine cardiac allograft survival and maintained generation of regulatory CD4+CD25+ cells." Yes, some researchers have honestly subjected mice to a heart transplant, and then subjected them to either plain noise, opera, classical music, or Enya. The ones that got Verdi or Mozart handled their transplant better.
There are two things worth pointing out about this study. The first is that various forms of stress are known to alter immune function, and these mice appear to have gotten the music 24 hours a day for a week. So it's not out of the question that there would be some difference in immune response. The second thing is that, should you have a pretentious friend point to this as evidence of the superiority of opera, point out that a reduced immune response isn't considered a great thing if you haven't just had an organ transplant.
This sounds a bit more involved than the average runner's high: Apparently, it might be time to reinterpret some of the grunting you hear at the gym, as there is a population of women out there who sometimes experience what's being termed an "exercise induced orgasm." Generally, this came during a heavy abdominal workout (a pattern that's apparently earned them the term "coregasm"), although some have also had it while bicycling or hiking. The authors note that the women who get them say they don't generally involve any mental sexual imagery, raising questions about whether there's any necessary connection between the orgasm and sexual activity.
Read the comments on this post
Read More ...
Ars readers call for hackerspaces in the Ars OpenForum
Ars Technica's beginnings are rooted in a community that has always tinkered, built, and modded computer hardware. As it has evolved, the do-it-yourself philosophy has also triggered other communities that make their own stuff. Most recently, the "make movement" has made a name for itself in the world of open source hardware and hacking. The movement covers a broad range of interests, edging into some hardcore do-it-yourself projects. Some groups meet in hackerspaces, but the movement at large seems mostly based on the spirit of building things yourself or with other people.
Read the comments on this post
Read More ...
Rent-a-fraudster website operator gets nearly 3 years in prison
A Belarusian who operated a rent-an-accomplice business for bank thieves has been sentenced to 33 months in prison in New York.
Dmitry Naskovets pleaded guilty to operating CallService.biz, a Russian-language site for identity criminals who trafficked in stolen bank-account data and other information.
Naskovets was arrested in 2010 in the Czech Republic at the request of US authorities and subsequently extradited to the US. A co-conspirator named Sergey Semashko was arrested the same day in Belarus and has been charged there.
According to authorities, the two launched their site in Lithuania in June 2007 and filled a much-needed niche in the criminal world—providing English- and German-speaking "stand-ins" to help crooks thwart bank security screening measures.
In order to conduct certain transactions—such as initiating wire transfers, unblocking accounts or changing the contact information on an account—some financial institutions require the legitimate account holder to authorize the transaction by phone.
Thieves could provide the stolen account information and biographical information of the account holder to CallService.biz, along with instructions about what needed to be authorized. The biographical information sometimes included the account holder’s name, address, Social Security number, e-mail address and answers to security questions the financial institution might ask, such as the age of the victim’s father when the victim was born, the nickname of the victim’s oldest sibling, or the city where the victim was married.
More than 2,000 identity thieves used the service to commit more than 5,000 acts of fraud, according to authorities.
"Through his website, Dimitry Naskovets served as the middleman for a network of identity thieves who used his many employees to impersonate thousands of victims in exchange for a stake in the profits from the fraudulent transactions they helped facilitate," Manhattan US Attorney Preet Bharara said in a statement. "This case is another example of how cybercrime knows no geographic boundaries and of how we will work with our partners in the United States and around the world to catch and punish cyber criminals."
The thieves obtained the information through phishing attacks and malware placed on victims’ computers to log their keystrokes.
CallService.biz would then assign someone who matched the legitimate account holder’s gender and was proficient in the needed language. That person would pose as the account holder and call the financial institution to authorize the fraudulent transaction.
Read the comments on this post
Read More ...
Tweet seats deserve to be booed out of the theater
Marketers, when they hit, can identify the seed of a product, service or organization and plant it in fertile soil where it will grow like mad. They can tease out the implications of the object they're charged with publicizing or find the motif that others are most likely to riff on. But when they fail, they can fail in the most mortifying fashion. All around the country, the marketing staff at live performance spaces big and small are embracing the "youthquake" in the grooviest way I've seen in years. They are offering up "tweet seats" to the kids.
It is an operatically stupid idea.
Read the comments on this post
Read More ...
AOL may sell off some of its 800 patents for cash
AOL, a company that’s been struggling with shrinking sales over the last several years, may be looking for new sources of income. According to Bloomberg “three people with knowledge of the matter” said the company is hiring investment firm Evercore to find buyers or licensees for some of its more than 800 patents. The three sources also said Evercore would “explore other strategic options” for the company, without going into more detail.
Since 2009, when AOL separated from media content giant Time Warner, the web company has seen a 29 percent drop in revenue, according to Bloomberg. Part of this could be due to the ever-diminishing returns of AOL’s once ubiquitous dial-up service (subscription revenue from AOL's dial-up dropped 18 percent from 2010 to 2011). Earlier this month, AOL cut more than 40 employees from AIM, their Instant Messenger department.
The three anonymous sources also said that several private-equity firms have recently approached AOL about privatizing the company and buying out its shareholders, but that AOL has not yet made a deal with any other company. AOL’s CEO Tim Armstrong has said publicly that he would be open to going private, and was in talks with Yahoo as early as September, although no deal was initiated then, either.
Investment Bank MDB Captial Group said licensing some of its patents could earn AOL as much as $1 billion in licensing fees. A quick search of AOL’s patents reveals such prime intellectual property as “e-mail integrated instant messaging” which is included in most e-mail clients these days, a patent for “host based-intelligent results related to a character stream” much like Google search’s auto-complete, and a “system for automated translation of speech” similar to a system developed by Microsoft and shown off earlier this year. Large companies like Google and Microsoft might be potential buyers for such patents in order to prevent infringements on alternative ways of developing products similar to theirs, or simply to avoid patent lawsuits down the road.
Evercore has been hired by companies like McGraw Hill, mortgage insurer PMI, and the airline Northwest Air, to find buyers for portions of the companies or to assist with restructuring.
Read the comments on this post
Read More ...
Shutting down your gadgets at takeoff and landing: not such a bad idea
Bowing to pressure from travelers, the FAA has decided to "revisit" the de facto ban on the use of gadgets during take-off and landing. Depending on the outcome of this re-examination of the rules, the future may well allow us to remain glued to our screens for an extra fifteen minutes at each end of a flight. But is this really a future we should be welcoming?
While nothing will change in the immediate future, this "revisit" opens the door to end-to-end gadgetry: if the rules change we will be glued to our screens from the moment we first take our undersized and uncomfortable seats right until the time the pod bay doors are opened and we escape our flying sardine cans.
I think this is a step backwards, and that the pressure that the FAA is under is a sad reflection on modern life.
Read the comments on this post
Read More ...
Week in Gaming: Bioware tries to calm fans, EA shuts them out of online servers
What at first seemed like a relatively benign story about Internet protests over the ending of Mass Effect 3 became an enduring story this week, with Bioware publicly addressing the complaints very respectfully amid growing furor. Also this week, EA announced server shutdowns for over a dozen of its online games, including some that were released relatively recently.
We're starting to gear up for PAX East in Boston these days. Anyone got any recommendations for either the show or the surrounding cityscape?
Read the comments on this post
Read More ...
Week in Apple: it's dividend time!
Pixel-pumping prowess: Ars reviews the third-generation iPad: Extra memory, faster chips, a huge new battery—the third-generation iPad needs them all to drive its high-resolution screen.
Apple to announce plans for $100 billion cash pile on Monday: Apple made a surprise announcement saying it would make public its plans for its nearly $100 billion cash hoard.
Read the comments on this post
Read More ...
Week in science: first planet's apparence and the third planet's energy
Last weekend saw the return of Weird Science, which barely snuck on to our list of the top stories. It faced fierce competition from a number of stories on energy—the cost of coal, efficient LEDs, the displacement of fossil fuels, and a new method of making solar panels. Our most detailed look yet at the planet Mercury also proved to be very popular.
Read the comments on this post
Read More ...
Week in tech: flying Pi drones, Facebook passwords, and virtual desktops
Pirate Bay plans to build aerial server drones with $35 Linux computer: The Pirate Bay has announced plans to build a fleet of flying server drones using the Raspberry Pi ARM board. The airborne computers will reportedly be more difficult for law enforcement agencies to terminate.
Facebook says it may sue employers who demand job applicants' passwords: After an alarming increase in reports of employers demanding Facebook usernames and passwords, Facebook said it is willing to take legal action.
Read the comments on this post
Read More ...
AT&T declares it could have saved T-Mobile from job losses
AT&T has issued an I-told-you-so press release addressing the T-Mobile layoffs announced Friday, asserting that they wouldn't have happened if the FCC had just let AT&T buy T-Mobile. Jim Cicconi, AT&T's senior executive vice president of external and legislative affairs, said in the statement that T-Mobile's recent misfortune demonstrates the need for more "regulatory humility," and that "the truth of who was right is sadly obvious." AT&T is referring, of course, to itself.
While AT&T was trying to acquire T-Mobile, the company asserted that the merger would create many jobs, a claim that the FCC and the US Department of Justice refused to believe. In fact, the FCC stated in its own report that the merger would create a "net loss of direct jobs."
T-Mobile stated Friday that it plans to close seven call centers and cut 1,900 jobs. In AT&T's press release, Cicconi said that the company planned specifically to protect "these very same small call centers and jobs if our merger was approved," and that the job loss has proven the FCC made the wrong choice.
Of course, the FCC's and DoJ's real concern was that the reduction in competition that the merger would have created. Four billion dollars later, AT&T is apparently still smarting at their decision.
Editor's Update: Friday evening, a spokesperson for the FCC sent an e-mail
to All Things D flatly denying claims made by AT&T's petulant
press release, saying "The bottom line is that AT&T’s
proposal to acquire a major competitor was unprecedented in scope and
the company’s own confidential documents showed that the merger
would have resulted in significant job losses." The spokesperson did not elaborate on the details of those confidential documents.
Read the comments on this post
Read More ...
Voice paging systems recorder seeks millions in damages from Megaupload
Valcom, a company that makes automatic voice paging systems that function over analog and IP lines is suing Megaupload.com for copyright damages, saying that a “significant number” of its more than 6,000 audio and video titles were distributed illegally through the file-sharing site. Valcom's clients include school, government, and transportation systems, which use the company's recordings in the event of emergencies or as background easy-listenin' music in brick-and-mortar waiting areas.
Megaupload was a popular cyberlocker seized by the Feds in January for criminal copyright infringement, money laundering, and racketeering.
The recording company stated in a press release that it had filed a suit against Megaupload, which had an associated shell company responsible for causing "an estimated half-billion dollars in copyright losses" altogether, noting that cases of willful copyright infringement can result in damages ranging from $750 to $150,000 per copyright infringed. Valcom's legal counsel will seek a slice of some of the millions of dollars seized by government authorities for each of the copyrights that Valcom can prove were infringed upon.
The Next Web suggests that Valcom could sue for as much as $900 million in damages if all 6,000 titles were infringed upon and if the company could make the case that each copyright merited a $150,000 remittance, but the actual number Valcom seeks will most likely be much lower than that, as Valcom only claims a portion of its copyright library was used illegally. Ars contacted Valcom but did not receive an immediate response.
Valcom's claim may be only the first in a flurry of suits against Megaupload seeking recompense for alleged lost profits, and only the start for Valcom's new "aggressive initiative to acquire back-due royalties and compensation... for the benefit of the Company and to increase value for our shareholders," according to a statement made by Vince Vellardita, President and CEO of Valcom.
Read the comments on this post
Read More ...
Scammers attempt to trick fans with promise of new Mass Effect 3 endings
Where there is passion on the internet, there is someone who seeks to exploit it. Thus, in the wake of the massive fan-driven controversy surrounding the ending of Mass Effect 3, a new scam has been unearthed that seeks to trick users into clicking on affiliate advertising offers in exchange for a download of a supposed "new ending."
The spam email, as uncovered by GFI, directs users to download a ZIP file containing a password-protected downloader for the supposed new ending. A text file inside the ZIP instructs downloaders to go to a web site where they're asked to take part in one of a number of shady offers to get access to the supposed password.
"Last Mass Effect 3 Ending, was really bad, but here, you have NEW, EXCITING ENDING," reads the download page. "You only need, to downlad [sic], and run it, downloader will automacitally [sic] start, download, new ending files, you will like it!"
You'd think obvious misspellings like "automacitally" and the generally poor grammar would raise the warning bells for users even remotely familiar with internet security, but nevertheless the download link has attracted at least a few hundred gullible players since its first appearance, according to publicly displayed statistics.
Recently, Bioware told fans they would be working to address the rampant criticism of the Mass Effect trilogy's vague ending with new downloadable content that will help answer lingering questions. However, the official DLC will not be available until April, and will likely only be available on Xbox Live, the PlayStation Network, and Origin (EA's download service.) Even then, it's unclear whether the new content will significantly change the game's existing ending or merely add new context an explanation to the existing narrative.
Read the comments on this post
Read More ...
"Teach the controversy" science education bills advance in Tennessee, Oklahoma
Earlier this week, legislators in Tennessee approved a bill that singles out public school science education for special attention. Now, the Oklahoma House has passed a very similar bill that attacks an identical range of subjects that the legislation deems controversial: biological evolution, the chemical origins of life, global warming, and human cloning.
Both bills contain identical language, saying they "shall not be construed to promote any religious or nonreligious doctrine." There's also identical language about how they're intended to "help students develop critical thinking skills they need in order to become intelligent, productive, and scientifically informed citizens." However, the subjects they target are not areas where there are significant scientific controversies; either the bills' sponsors are poorly informed (and thus shouldn't be injecting themselves into science education), or they have non-educational goals in mind.
In any case, the legislators want to do what they can to enable science teachers to teach the controversy. To that end, they're basically attempting to block any educational authority—school board, principal, the state board of education—from punishing a teacher for covering the "scientific strengths and scientific weaknesses of existing scientific theories." The Oklahoma bill goes a bit further, adding protections for students who choose voice their disagreements with the science in any medium.
Given the staggering amount of scientific-sounding misinformation available on topics like evolution and climate change, these bills are a recipe for chaos in the science classrooms. It's a chaos that state legislators are inviting local school districts to sort out at great expense via lawsuits.
Read the comments on this post
Read More ...
Review: Kid Icarus: Uprising loses control of an otherwise enjoyable mythological romp
A control scheme for a game is like the foundation for a house. If it's constructed well, it serves its purpose largely in the background, providing unseen support for the part that people see. But if there's a problem with either a game's control scheme or a house's foundation, it can easily sink the rest of the enterprise, no matter how well it's constructed.
Such is the case with Kid Icarus: Uprising, an imaginative, lighthearted, fun-filled game that ultimately falls on the weakness of some incredibly ill-conceived controls.
Read the comments on this post
Read More ...
Facebook asserts trademark on word "book" in new user agreement
Facebook is trying to expand its trademark rights over the word "book" by adding the claim to a newly revised version of its "Statement of Rights and Responsibilities," the agreement all users implicitly consent to by using or accessing Facebook.
You may recall that Facebook has launched multiple lawsuits against websites incorporating the word "book" into their names. Facebook, as far as we can tell, doesn't have a registered trademark on "book." But trademark rights can be asserted based on use of a term, even if the trademark isn't registered, and adding the claim to Facebook's user agreement could boost the company's standing in future lawsuits filed against sites that use the word.
Read the comments on this post
Read More ...
Available Tags:Google , Facebook , Amazon , HTML5 , Chrome OS , Sony , Chrome , Oracle , Ars , Ars , AOL , EA ,
No comments:
Post a Comment