Google Photos: the Faustian bargain of privacy

Unlimited backups of all your photos. For free. Now that’s hard bait to refuse, especially considering how photo-happy we’ve all become since our smartphones have replaced our pocket cameras. But this offer is just the tip of the iceberg in Google’s new app. After all, if you’re going to be uploading thousands upon thousands of photos, you’d expect sorting them would be a pain.

Google’s answer to that seems to be: Don’t. Instead, trust us to deliver the right photos when you use our in-app search bar.

 

Searching Photos

Google’s new Photos app leverages the search giant’s recent investments in machine learning to “read” your photos and figure out what they’re about without any need for you tag, label or date them.

Looking for photos of that holiday in London? Type “London”, and even without geo-location data enabled, Google’s algorithms will “read” the photos for any landscape it can recognize as coming from Old Foggy.

Type in “dog”, and it will do the same, pulling any photos of dogs it can find in your collection. If you’ve ever tagged a photo of your pet with its name, it will learn that too, and show you photos of “Rex” alone if you ever search for it.

None of this is happening with your input: Google’s engines have just learned to look at your photos, and understand what they’re looking at.

Facial recognition

Another feature you can choose to activate or deactivate, is the system’s ability to sort through faces. When you hit the search bar, you’ll be presented with a series of faces it has pulled out. Tap on one, and most if not all of the photos you have of that person will be presented. If your photo collections go back far enough, the system will sometimes be able to recognize the person as far back as childhood.

While not 100% accurate, it’s damn impressive, very useful, and whole lot of creepy.

Dealing with the Privacy Devil

The story of Faust is a quite apt description: in exchange for incredible powers, Dr. Faust sold his soul to the devil. You can bet that Google is not offering this much free backup storage and amazing machine analysis out of the goodness of its heart.

Just as Gmail made a breakthrough in the email market by offering enormous amounts of free storage in exchange for data-mining your communications to sell against ads, you can put down some good money on Photos going the same way.

While Google has affirmed that they will never sell your photos to third parties or publish them without your consent, that’s most likely not how they intend to use your collections. Instead, they will use them to get to know you better.

However the system manages it, it is somehow labeling your photos so that when you search for a term, it can deliver results against it. It will also be doing it for terms you may never search for.

Happen to be wearing Adidas shoes in a photo? In the future, you can expect Google Photos to make note of that, and the next time you are near a shoe store, don’t be surprised to receive discounted offers from Adidas.

Again, it’s unlikely that Adidas will ever see your photos. It will instead ask Google to target all the relevant users on its behalf.

In many ways, this is nothing new: it’s exactly the way any of Google’s other services work, whether that be Gmail, Google Now, or even the main Google search engine. Indeed it is how nearly all major web companies operate.

But it is taking that data-mining to a new, uncomfortably close-to-home level.

Ebay Magento Bug Bounty #12 – Cross Site Request Forgery Web Vulnerability

Posted by Vulnerability Lab on Jun 19

Document Title:
===============
Ebay Magento Bug Bounty #12 – Cross Site Request Forgery Web Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1460

Video: http://www.vulnerability-lab.com/get_content.php?id=1526

View Video: https://www.youtube.com/watch?v=x7uaABfxxU0

EIBBP-31602

Release Date:
=============
2015-06-17

Vulnerability Laboratory ID (VL-ID):…

Ebay Magento Bug Bounty #10 – Persistent Filename Vulnerability

Posted by Vulnerability Lab on Jun 19

Document Title:
===============
Ebay Magento Bug Bounty #10 – Persistent Filename Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1457

eBay Inc. Bug Bounty Program ID: EIBBP-31603

Video: https://www.youtube.com/watch?v=WffsHd8pibE

Release Date:
=============
2015-06-16

Vulnerability Laboratory ID (VL-ID):
====================================
1457

Common Vulnerability Scoring…

Ebay Magento Bug Bounty #17 – Client Side Cross Site Scripting Web Vulnerability

Posted by Vulnerability Lab on Jun 19

Document Title:
===============
Ebay Magento Bug Bounty #17 – Client Side Cross Site Scripting Web Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1473

EIBBP-31541

Release Date:
=============
2015-06-15

Vulnerability Laboratory ID (VL-ID):
====================================
1473

Common Vulnerability Scoring System:
====================================
3

Product & Service…

ZTE ZXV10 W300 v3.1.0c_DR0 – UI Session Delete Vulnerability

Posted by Vulnerability Lab on Jun 19

Document Title:
===============
ZTE ZXV10 W300 v3.1.0c_DR0 – UI Session Delete Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1522

Release Date:
=============
2015-06-16

Vulnerability Laboratory ID (VL-ID):
====================================
1522

Common Vulnerability Scoring System:
====================================
6

Product & Service Introduction:…

ManageEngine SupportCenter Plus 7.90 – Multiple Vulnerabilities

Posted by Vulnerability Lab on Jun 19

Document Title:
===============
ManageEngine SupportCenter Plus 7.90 – Multiple Vulnerabilities

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1501

Release Date:
=============
2015-06-19

Vulnerability Laboratory ID (VL-ID):
====================================
1501

Common Vulnerability Scoring System:
====================================
6.9

Product & Service Introduction:…

EFF Privacy Report 2015: Which Companies Have Your Back?

On Wednesday the EFF published their yearly report called “Who Has Your Back? 2015: Protecting Your Data From Government Requests”. It answers important questions like which companies follow industry-accepted best practices, tell their users about government data demands, disclose policies on data retention or government content removal request, and oppose backdoors.

For the EFF report 24 companies are evaluated and being awarded (or not awarded, depending on the outcome) stars in the five categories mentioned above. Nine companies managed to get stars in all of them: Adobe, Apple, CREDO, Dropbox, Sonic, Wickr, Wikimedia, WordPress.com, and Yahoo.

Facebook and Twitter received four out of five stars, with Facebook “not providing transparency into ways it cooperates with the U.S. government to block content and remove accounts” and Twitter „not providing notice after an emergency has ended or a gag has been lifted”.

The worst rating with only one star went to WhatsApp who at least opposes backdoors but seems lacking in all other privacy regards. The EFF recommends WhatsApp to “publicly require a warrant before turning over user content, publish a law enforcement guide and transparency report, have a stronger policy of informing users of government requests, and disclose its data retention policies.”

Take a look at the full report to find out more.

 

The post EFF Privacy Report 2015: Which Companies Have Your Back? appeared first on Avira Blog.

eBay Magento Persistent Script Insertion

A persistent input validation web vulnerability has been discovered in the official Magento xCommerce web-application. The vulnerability allows remote attackers to inject own script code to the application-side of the affected service module. The vulnerability is located in the filename value of the image upload module. The attacker needs to create a New Message with upload to change the filename to a malicious payload. The attack vector of the issue is located on the application-side and the request method to inject the script code is POST.