Since Twitter first became popular enough to attract crooks and scammers, phishing has been a consistent problem.
Generally, Twitter phishing looks like this: First, you get a direct message linking you to some site for some reason. Next, you login into this third-party site using your Twitter credentials. Finally, everyone in your Twitter stream gets sent the same message you got spreading the scam into infinity.
These scams were enabled by the fact that Twitter users have grown comfortable logging into other sites and tools using their Twitter credentials. This is because, in an effort to make its service more useful, Twitter has had a very open policy for third-party developers.
Thankfully, most of these scams have not result into much direct harm for users. Sean in the F-Secure Labs suggested that the main purpose of phishing was to create trending topics/trending terms to improve SEO attacks.
Back in April, I suggested a draconian way of avoiding Twitter phishing: never click on any links. Thankfully, that became less necessary as Twitter’s increasingly effective filtering of shortened links has helped to minimize these attacks.
And here comes a real change for the better. As of August 16, 2010, you will not be able to use your login and password to login into Twitter using any site but Twitter.com. Any third-party site that you want to use has to connect to your Twitter account directly using the OAuth procedure.
This means Twitter can say to the world, don’t log into Twitter unless you’re on Twitter. And if users listen, Twitter phishing will be history. Just a little change, but a step in the right direction.
Image by Carrot Creative.
Black Friday and Cyber Monday are just about to kick off the holiday shopping season. Over the next month, we'll scoop up smartphones and tablets for loved ones, and also cases, covers and bags to shield them from scratches and bumps. But while we'll spend plenty to protect them from physical harm, most of us will leave an even more important area open to exposure. Check out our infographic to see what I mean: Device accessories are hot. But while a fancy leather cover may protect that tablet if you drop it, it won’t do a thing to safeguard your personal data if you’re surfing a poisoned hotspot. This holiday season, don't forget a VPN app, the most important accessory! Shopping mall image courtesy of Benson Kua, flickr.com
We wouldn't be F-Secure without the talented and passionate researchers in our Labs. And today we'd like you to meet one whose inquisitive nature has driven him to become an inventor - and a prolific one at that. In his 14-year career with F-Secure, Jarno Niemelä has racked up an impressive 20 patents to his name and has filed 100 patent applications in total. His achievements recently won the title of "Salaried Inventor of 2014" from a group of Finnish inventors' organizations. I sat down to chat with Jarno about where he gets his ideas, and his advice for others. What area do your inventions focus on? I mostly focus on methods to help detect malware on a system, or methods of preventing malware from entering the system in the first place. How do your ideas come about? Inventions mostly happen in the evening when I'm not at work, and not even trying to think about it. I'll be working on some problem at work, and usually a day or two later, when I'm doing something totally unrelated on my own time, it hits me. I understand the problem and come up with a solution. The gym is a really good place for inventions. What motivates you to keep on inventing new solutions? Inventions just happen, pretty much. Whenever I'm able to define a problem, I'm usually always able to come up with a solution. I am lucky to be researching in areas with problems that others have not yet solved. I'll be honest, I don't really like patents that much personally. The fact is though, that companies without patents would pretty much be at the mercy of the competitors. So in my view, patents are basically company self defense. Patents keep things in balance. Were you curious about things growing up? I've always kind of been inventive. You cannot learn to become an inventor, it's either something that's in your nature or it's not. And then you need to hone the talent and learn how to work within the patent framework. Another thing that is very important is good basic education and knowledge about the field. I owe a lot to Metropolia University of Applied Sciences where I studied for my engineering degree. Do you have any advice for people who have this inventive nature and are interested in filing patents? It all starts from defining and understanding the problem. Without a thorough understanding of the problem, you can't come up with a solution. Also, when it comes to patents, it's important to know what has previously been done in your area, and be clear in exactly how your invention is different from those. Otherwise your patent can be easily rejected by the patent examiner. And finally, patents are a long process so you need patience. It can take three to five years to get a patent approved. So this is not for hasty people. What is that rock you're holding? It's my trophy, a piece of Finnish bedrock! Inventors are the bedrock of new products. Do you have any certain goals for your inventions? Before I retire I would like to have at least 50 patents to my name. - Well, he's off to a great start. Congratulations, Jarno! Follow Jarno on Twitter
The EFF has put together a handy guide on choosing the right VPN -- virtual private network -- that explains in simple terms why you'd want to use this type of software. "It enables a computer to send and receive data across shared or public networks as if it is directly connected to the private network—benefiting from the functionality, security, and management policies of the private network," the guide explains. It goes on to clarify the three reasons people typically encrypt their data. Most people already using a VPN do so for the two reasons: They connect to a corporate network remotely or are attempting avoid Internet censorship in countries like China and Iran. But even if you're not using a VPN for business or digital freedom, there is a simple reason why you'd want to use a VPN. "You can also use a commercial VPN to encrypt your data as it travels over a public network, such as the Wi-Fi in an Internet café or a hotel," the EFF writes. I put together this flow chart that explains whether you're a candidate for this third reason to use a VPN: “A good number of open wi-fi providers take the time to tell you in their T&C that there are inherent risks with wireless communications and suggest using a VPN,” F-Secure Security Advisor Sean Sullivan said after we conducted a public Wi-Fi experiment. “So if you don’t take it from me, take it from them.” And even if you aren't on a public network, you may want a VPN to protect you from ubiquitous tracking elements like a perma-cookie. You can try our super simple Freedome VPN solution -- which also includes tracking protection and the ability to set up virtual locations -- free. [Image via Trevor Cummings | Flickr]