LISNews: Librarian News

This week's episode looks around the LISHost galaxy while looking at some ambiguous information in a speculative manner.

Related links:

• LISWire: Worch Memorial Public Library Joins COOL and Goes Live on Evergreen
• Pwnie Express: Pwn Plug Elite
• Wired: The Little White Box That Can Hack Your Network
• The Verge: Wikileaks claims Aaron Swartz was an ally and possible source, breaking anonymity
• CNET: WikiLeaks says Aaron Swartz may have been a 'source'
• The Guardian: Libraries crisis set to get 'much worse' this year
• Galileo 0.012 released!

Download here (MP3) (Ogg Vorbis), or subscribe to the podcast (MP3) to have episodes delivered to your media player. We suggest subscribing by way of a service like gpodder.net. A way to send gifts of replacement hardware to Erie Looking Productions is available here via Amazon, as always.

This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 United States License. To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/3.0/us/.

The "I Know..." series of blog posts shows relatively simple tricks [malicious] websites can use to coax a browser into revealing information that it probably should not. Firewalls, anti-virus software, anti-phishing scam black lists, and even patching your browser was not going to help.

Fortunately, if you are using one of today’s latest and greatest browsers (Chrome, Firefox, Internet Explorer, Safari, etc.), these tricks, these attack techniques, mostly don’t work anymore. The unfortunate part is that they were by no means the only way to accomplish these feats.

I Know…

• … Series Introduction
• …A LOT About Your Web Browser and Computer
• …The Country, Town, and City You Are Connecting From (IP Geolocation)
• …What Websites You Are Logged-In To (Login-Detection via CSRF)
• … I Know Your Name, and Probably a Whole Lot More (Deanonymization via Likejacking, Followjacking, etc.)
• … Who You Work For
• … Your [Corporate] Email Address, and more…
• … Summary and Guidance

Hacker Group Breaches Library of Congress Site, Publishes Passwords
A group of hackers claims to have breached the official website of the Library of Congress, America’s national library.

The group claiming responsibility, BlitzSec, decried the wildly unpopular US Congress and said it used a SQL injection attack to access the Library of Congress Website's back end database and expose user names, passwords and email addresses. The group has posted data taken from the Library on the file sharing Web site Pastebin.

A Research Agenda Acknowledging the Persistence of Passwords
Despite countless attempts and near-universal desire to replace them, passwords are more widely used and firmly entrenched than ever. Our exploration of this leads us to argue that no silver bullet will meet all requirements, and not only will passwords be with us for some time, but in many instances they are the solution which best fits the scenario of use. Among broad authentication research directions to follow, we first suggest better means to concretely identify actual requirements (surprisingly overlooked to date) and weight their relative importance in target scenarios; this will support approaches aiming to identify best-fit mechanisms in light of requirements. Second, for scenarios where indeed passwords appear to be the best-fit solution, we suggest designing better means to support passwords themselves. We highlight the need for more systematic research, and how the premature conclusion that passwords are dead has lead to the neglect of important research questions.