Web Security


Inside Facebook’s Social Authentication System

VANCOUVER–Authentication is one of the thornier problems in security and it’s one that’s never been solved to any real degree, despite decades of research, technological advances and trial and error. For companies such as Facebook that have to deal with authentication on a massive scale, the problem is even more difficult. Facebook is trying a number of different “social” authentication methods right now, and while some are innovative, they all come with serious drawbacks and weaknesses.


As the privacy and tracking debate rages in the desktop arena, Mozilla has made a jump to the mobile world by announcing its new Boot to Gecko project, which will include an implementation of the Do Not Track technology on mobile devices. This is the first such implementation and it will give users the ability to tell mobile sites that they don’t want to be tracked persistently while using the Web from their phones.

A Federal Judge acceded to a request from the U.S. Attorney’s Office to extend the operation of Domain Name System servers that are the last lifeline to the Internet for hundreds of thousands of machines infected by the DNSChanger malware, following a bust of the group controlling the infected machines in November.

If the folks behind the photo sharing Web site Pinterest were looking for some validation that their fledgelings social media site had “arrived,” they got it this weekend, after scammers jumped on the site and used it to direct Pinterest users to survey scam Web sites.

Just two days before the annual Pwn2Own contest is set to begin at CanSecWest, Google has patched a huge set of serious vulnerabilities in its Chrome browser. In addition to the 14 high-risk flaws fixed in Chrome, the company also handed out rewards of $10,000 each to three researchers who regularly submit bugs to Google and have taken home quite a bit of cash in the past as part of the company’s reward program.