Subject: Are security questions terrible for account security?
Source: Proton blog
https://proton.me/blog/security-questions-flaws-solutions
[infomercial … ] What was your first pet’s name? In what city were you born? We’ve all had to answer these questions to reset a long-forgotten password, but consider how that works. Much of this information is easy to find for others (or easily forgotten by you), making it a poor defense for your most valuable online accounts, personal data, and sensitive information.
Security questions are meant to help reset passwords, reopen locked accounts, and ultimately protect your digital spaces from attacks or breaches, but such safeguarding is widely considered flawed and unreliable (new window).
…
Answers to questions like “What is your mother’s maiden name?” are supposed to be information only you know or a select few — in theory, the more obscure the answer, the better the security.
However, experts have begun to question the effectiveness(new window) of this security layer due to the vulnerabilities that come with requiring people to remember information that can be forgotten, changed, or discovered by potential attackers digging around on the Internet.
Why security questions are a terrible idea…There are several reasons why leaning on security questions to protect you is a bad idea. It comes down to a pair of unfortunate realities: Potential attackers are more clever than you might think, and there’s more personal information online than you realize.
Source: Becker’s Health IT
https://www.beckershospitalreview.com/cybersecurity/change-healthcare-is-credit-negative-after-attack-moodys.html [maybe this is why I had trouble with filling an Rx?]
UnitedHealth Group’s Change Healthcare has fallen victim to a cyberattack, marking a credit-negative event for the company, according to Moody’s. “The cyberattack against UnitedHealth Group, one of the largest U.S. commercial prescription processors, is credit negative for the company, as financial and reputational impacts may ensue,” Dean Ungar, vice president and senior credit officer for Moody’s Investors Service, told Becker’s in an emailed statement. “Reportedly, the impact is limited to its subsidiary Change Healthcare, which is relatively small compared to the consolidated company.”
Change Healthcare reported a “cybersecurity incident” on Feb. 21 that disrupted connectivity and healthcare operations nationwide.
The AHA has warned hospitals and health systems to disconnect from Change Healthcare systems. Danville, Pa.-based Geisinger is one of the organizations that has already done so.
Latest articles on Cybersecurity:
Authorities take down 14K email accounts linked to healthcare hackers
FBI warned of Chinese malware ‘low blows’ before Change cyberattack
Health systems disconnect from Change Healthcare amid attack
Source: WIRED – Security News This Week – five stories
https://www.wired.com/story/isoon-china-hack-for-hire-leak/
Hundreds of documents linked to a Chinese hacking-for-hire firm were dumped online this week. The files belong to i-Soon, a Shanghai-based company, and give a rare glimpse into the secretive world of the industry that supports China’s state-backed hacking. The leak includes details of Chinese hacking operations, lists of victims and potential targets, and the day-to-day complaints of i-Soon staff.
“These leaked documents support TeamT5’s long-standing analysis: China’s private cybersecurity sector is pivotal in supporting China’s APT attacks globally,” Che Chang, a cyber threat analyst at the Taiwan-based cybersecurity firm TeamT5, tells WIRED. Chang says the company has been tracking i-Soon since 2020 and found that it has a close relationship with Chengdu 404, a company linked to China’s state-backed hackers.
…
Topics
- security roundup
- China
- hackers
- cybersecurity
- privacy
- national security
- Crime
Subject: A Vending Machine Error Revealed Secret Face Recognition Tech
Source: WIRED
https://www.wired.com/story/facial-recognition-vending-machine-error-investigation/
Canada-based University of Waterloo is racing to remove M&M-branded smart vending machines from campus after outraged students discovered the machines were covertly collecting face recognition data without their consent. The scandal started when a student using the alias SquidKid47 posted an image on Reddit showing a campus vending machine error message, “Invenda.Vending.FacialRecognitionApp.exe,” displayed after the machine failed to launch a face recognition application that nobody expected to be part of the process of using a vending machine. “Hey, so why do the stupid M&M machines have facial recognition?” SquidKid47 pondered. The Reddit post sparked an investigation from a fourth-year student named River Stanley, who was writing for a university publication called MathNEWS.
…
…
Source: BleepingComputer
https://www.bleepingcomputer.com/news/security/paypal-files-patent-for-new-method-to-detect-stolen-cookies/
PayPal has filed a patent application for a novel method that can identify when “super-cookie” is stolen, which could improve the cookie-based authentication mechanism and limit account takeover attacks.The risk that PayPal wants to address is that of hackers stealing cookies containing authentication tokens to log into victim accounts without the need for valid credentials and bypassing two-factor authentication (2FA).
“The theft of cookies is a sophisticated form of cyberattack, where an attacker steals or copies cookies from a victim’s computer onto the attacker’s web browser,” PayPal says in the patent application.
“With stolen cookies often containing hashed passwords, the attacker can use a web browser on the attacker’s computer to impersonate the user (or authenticated device thereof) and gain access to secure information associated with the user’s account without having to manually login or provide authentication credentials,” it is further explained.
…
Source: tech.co
https://tech.co/news/impact-technology-workplace-report-2024
The impact of technology on the workplace over the last year has been nothing if not substantial. From the integration of generative AI platforms like ChatGPT to the increase in data breaches across the industry, keeping up with shifting trends is a full-time job at this point in history.Fortunately, you’ve got Tech.co to help you out. In our inaugural annual report on this subject, we’ve embarked on an in-depth journey to quantify and explain a wide range of workplace trends, noting the influence of technology as a primary driver.
We surveyed over 1000 US business leaders to ensure an accurate depiction of the workplace heading in to 2024, and help you to strategize for the year ahead.
Below, we’ll introduce our 2024 workplace report and give you a preview of its key findings. Make sure to download the full report if you want the learn more about how the workplace is changing in the face of evolving technology.
Impact of Tech on the Workplace Report 2024: Key Findings
Our Impact of Tech on the Workplace report found a wide range of statistics that point to how the world is adapting to new technology. Here are some of the key findings we identified, which are further outlined below:
- Using more collaboration tools and AI results in higher productivity
- 59% of people who use AI have greater job satisfaction
- ChatGPT is the most popular AI tool used amongst businesses
- Digital natives and businesses that use AI are more open to the idea of a 4-day working week
- The majority of companies found it challenging to hire new staff – but remote working organizations find it easier
- Remote working organizations report higher levels of productivity
- Phishing attacks were the most common cause of a data breach
PDF is 43 pages – https://images.tech.co/wp-content/uploads/techco-impact-of-tech-workplace-report-2024.pdf