What does browser incognito mode accomplish? What about TOR?

Do you really need to “worry about” using ingonito mode on your browser (when your spouse uses it)?  

Here’s a good answer from Quora.

Yes, if you look up information on how to commit a crime, on porn, on terrorism, on fetishes – one of the respondents says, “I’m a writer, what can I say?”

Maybe that’s a relevant answer in this area where independent content creation is coming under attack from radicals on both sides.

It’s possible that in the future law enforcement will scan cloud backups even more than it can today.

The other objection is that it will lead to the serving of ads on your “family computer” that you don’t want your spouse or the kids to see.

  

Thorin Klowowski gives a discussion of what the use of a TOR browser (“the Onion browser”) accomplishes for the average user.  It does provide “anonymity” but not real “security”.  And it is possible for very determined law enforcement (or the NSA) to crack it, so overuse of it could call attention to illegal motivations and weaken a claim of credibility should improper online behavior come to notice in other means (especially in civil cases).  Electronic Frontier Foundation has encouraged ordinary bloggers and vloggers to learn to use it, however, even in democratic, western countries. 

Verizon hotspot and microarchitectural incontinence

On an Amtrak train, my laptop connected to somebody else’s hotspot before connecting to mine.  It even offered an automatic connection, which it should not do if I’ve never supplied a correct pw.  A flaw in Verizon software?  In Windows 10 security? 

Train was at a station, might have been someone’s house near the tracks. Maybe they didn’t set a pw?

No, I do not hack.

Some “microarchitetural incontinence”, as Daniel Gruss would say.

HP makes a short "horror" film about printer security

Hewlitt-Packard sent out a tweet this morning about printer security, with the main link here. 

It’s pretty understandable if you use your printer as a 3-in-1 and send old-fashioned faxes. 
   

But this seems to be more about enterprise printers on small business networks.

Here is their little short film, “The Fixer: The Wolf’s Next Meal”.

Business film does keep some independent filmmakers employed.  I remember that in the 1990s a friend wrote an article called "printer therapy" in a tech magazine. 

Quora has large data breach, but it is unlikely to harm many users

Quora, a site that poses questions which users can answer, has reported a hack of over 100 million users from authorized access that occurred Friday Nov. 30.

Motherboard Vice reports in a story here by Joseph Cox. 

CEO Adam D’Angelo, 34, has written an official statement here. 

The passwords stolen were encrypted, which should make it harder to misuse, especially with a huge number of them.  Site speakers who had used the same pw’s for other accounts should change these.

But the stolen email addresses may make phishing spam more frequent (and I’m wondering if somehow that accounts for the Apple spam I got last week).

When I went back into it this morning, it invited me to sign on with Facebook (which is probably also not the best security now, given what happened this year).

Most users are not likely to have placed other PII or non-public material on this site.

The site keeps track of subject matter preferences.  I see a lot of questions about USCF chess ratings. 

  

CERT has just reported several industrial espionage trojans which I’ll have to get back to later.

I install a legitimate iPhone app, and get a suspicious email

On Thursday, I installed the Smart News app on my iPhone.  It is true that I had to look around for the right Apple password, as I had not used it for a while.

I later got this bizarre email (shown) from a spammer saying my account was “signed on with another device”.  That may be OK, but not the sender address of “account.mail.verify.complite”.  What’s going on?

In the past I’ve gotten bogus Apple emails claiming credit card transactions in Indonesia and Belarus for materials I never bought.  And no credit card transactions ever appeared.

Foreign espionage hackers user publicly available tools; Russians could retaliate for de-plaforming of their fake news sites; phishing for election recounts

US Cert in Pittsburgh has a collaborative report between US DHS and the British Commonwealth (UK, Canada, Australia, New Zealand), an Alert AA18-284A. about “publicly available hacking tools” seen in worldwide cyber incidents.

Most of the tools presented here seem determined to provide hidden readers for corporate espionage.

But concern persists that China, North Korea, and Russia can continue to do destructive attacks on relatively innocuous American interests, “to prove we can”.

There were some sporadic backbone router outages early Monday Nov 12 which might have been malicious.  Since US social media companies and perhaps hosts have no-platformed what they believe to be Russian fake accounts and “fake news” bots, the Russians might attack legitimate smaller interests in the US (or, more likely, the infrastructure supporting them) just to prove they can, as retaliation.

 One other thing – there seems to be some phishing spam going around claiming to raise money for Florida recounts.

Could spammers send out no-platforming phishing notices? Also -- soft "NSA" intelligence tips when your email or social media shows unusual content repeatedly

Just a quick security tip.

If you get unusual volumes of emails, texts, robocalls, twitter mentions, Facebook postings in your timeline (or page if you allow multiple admins – a dubious idea now) or even US mail letters – about causes to which you have no connection and have no interest in supporting – just be careful, and watch your back.

It can mean someone views you as a threat to them.  Perhaps you’re lowballing them in business, or they think you are.

This goes a little beyond depending on spam filters or being careful about emails purporting to be from parties you know but looking odd. 

This is a matter that intelligence services and CIA and NSA people know well.

  

It’s even conceivable that spammers will send out sham “no-platforming” takedown emails (from social media platforms, domain registrars or hosts, claiming some sort of connection to a terms of service violation).  The first place to verify is the sender address with a mouseover, but sometimes those are masqueraded successfully.