@LetITFly 的频道，主题包括但不限于 Android、Windows、Web、消费电子相关，吹水为主。愿各位始终享有足够的信息渠道，在心情好有意愿的时候能够做想做的事情。本频道的原创信息均采用 CC BY-NC-SA 4.0 知识共享协议 发布；本频道所有 Forward 消息均按原消息的许可合理转载。友情链接：@TaborSpace@MATIFW (archived)@encmasutahttps://news.letitfly.mehttps://news.letitfly.me/posts/10438https://news.letitfly.me/posts/10438Mon, 29 Apr 2024 08:22:00 GMT<div class="tgme_widget_message_forwarded_from accent_color">Forwarded from <a class="tgme_widget_message_forwarded_from_name" href="https://t.me/outvivid/4508" target="_blank" rel="noopener"><span>层叠 - The Cascading</span></a></div>Citizen Lab 分析称多款中文输入法的云输入功能存在漏洞，可用于获取用户输入内容。<br /><br />研究者建议用户更新输入法、停用云端功能及停用 iOS 中输入法的「允许完整访问权」选项。<br /><br />报告称：<br />- QQ 拼音也被发现和之前发现的搜狗输入法一样 [1] 的自制加密算法的漏洞。百度输入法自制的被称为「Baidu CTR」的 AES 加密模式亦存在漏洞。<br />- 三星键盘被发现使用 HTTP 明文协议发送用户输入数据及与云输入服务进行交互。<br />- 在 Citizen Lab 告知漏洞详情后，除 QQ 拼音 Windows 版和荣耀设备上默认启用的百度输入法，其它软件均在更新版本中对漏洞进行修正。<br /> - 百度修复了报告中的几个最严重的漏洞，但并未修复其余报告的漏洞。不过目前研究者已经无法获取百度云输入用户的输入内容。<br /> - 腾讯修复了数个定制/非定制版搜狗输入法及 QQ 拼音 Android 版中的漏洞。QQ 拼音 Windows 版的漏洞则由于产品停运而并未进行修正。<br /><br /><a href="https://citizenlab.ca/2024/04/%e6%95%b2%e6%95%b2%e6%89%93%e6%89%93%e4%b8%80%e7%b3%bb%e5%88%97%e4%ba%91%e7%ab%af%e8%be%93%e5%85%a5%e6%b3%95%e6%bc%8f%e6%b4%9e%e4%bd%bf%e7%bd%91%e7%bb%9c%e6%94%bb%e5%87%bb%e8%80%85%e5%be%97-zh-cn/" target="_blank" rel="noopener" title="citizenlab.ca/~">citizenlab.ca/~</a><br /><br />1. <a href="https://t.me/outvivid/4284" target="_blank" rel="noopener" title="/4284">/4284</a><br /><br /><a href="/search/result?q=%23China" title="#China">#China</a> <a href="/search/result?q=%23IME" title="#IME">#IME</a> <a href="/search/result?q=%23Privacy" title="#Privacy">#Privacy</a><a class="tgme_widget_message_link_preview" href="https://citizenlab.ca/2024/04/%e6%95%b2%e6%95%b2%e6%89%93%e6%89%93%e4%b8%80%e7%b3%bb%e5%88%97%e4%ba%91%e7%ab%af%e8%be%93%e5%85%a5%e6%b3%95%e6%bc%8f%e6%b4%9e%e4%bd%bf%e7%bd%91%e7%bb%9c%e6%94%bb%e5%87%bb%e8%80%85%e5%be%97-zh-cn" target="_blank" rel="noopener" title="重要：我们建议所有用户立即更新所使用的输入法软件以及操作系统。并建议高风险用户停止使用任何输入法提供的云端建议功能，改为完全离线的输入法，以避免数据外泄。"> <div class="link_preview_site_name accent_color">The Citizen Lab</div> <img class="link_preview_image" alt="敲敲打打" src="/static/https://cdn4.telesco.pe/file/G-6koebXRPk_dzyBdFbldb5IklpoeMKrervlQvumlLrNk3uuEoiKiSq6oB1NIH7zVMehc091AuBGfuc7s-_iC_dS0vgjTco2uagMJH4pvH0vTii4nkqkPqr9Yof-lg4dka3C0VMaSF10C8gEDPMKmuxhYdnlOlJmrWAlwK-22IgcmAn4gq35cilxpKJNzqJPeRGcwaEItStzabcswRceU7JkTNlJt5J_8oUZZhxUKWelgSSmNxSYoqns6A0dZwijDPsQf3qPgvUhxGJpWG4VD9q6XhWAW8i4pZZiIsflU4YbeH6FLLx0LYUoDyOggd9RhhK3knAVetHbOrCGjPkEYA.jpg" width="1200" height="630" loading="eager" /> <div class="link_preview_title">敲敲打打</div> <div class="link_preview_description">重要：我们建议所有用户立即更新所使用的输入法软件以及操作系统。并建议高风险用户停止使用任何输入法提供的云端建议功能，改为完全离线的输入法，以避免数据外泄。</div> </a>https://news.letitfly.me/posts/10067https://news.letitfly.me/posts/10067Fri, 03 Nov 2023 05:08:32 GMT<div class="tgme_widget_message_forwarded_from accent_color">Forwarded from <a class="tgme_widget_message_forwarded_from_name" href="https://t.me/outvivid/4361" target="_blank" rel="noopener"><span>层叠 - The Cascading</span></a></div>要求浏览器无条件信任欧盟指定 CA 及公钥的 eIDAS 草案被三方会谈通过，将被送审。<br /><br />此草案的第 45 条如是说。欧盟成员国可以指定合格信任服务提供商 (QTSPs)，而浏览器除非取得政府同意，否则不被允许移除对这些 QTSP 的信任，甚至不被允许进行任何额外核查（例如目前广泛存在的证书透明度要求等）。<br /><br />这一条款将给政府的监听行为大开方便之门。同时，也会使欧盟一国信任事故的影响放大到全体欧盟公民。公开信还提到，草案的制定大多在闭门会议上，公众难以了解立法进展。<br /><br />EFF、Mozilla、Linux Foundation 等组织/企业撰写公开信反对草案的这一部分。<br /><br />- <a href="https://last-chance-for-eidas.org/" target="_blank" rel="noopener" title="https://last-chance-for-eidas.org/">https://last-chance-for-eidas.org/</a><br />- <a href="https://eidas-open-letter.org/" target="_blank" rel="noopener" title="https://eidas-open-letter.org/">https://eidas-open-letter.org/</a><br /><br />thread: <a href="https://t.me/outvivid/3392" target="_blank" rel="noopener" title="/3392">/3392</a><br /><br /><a href="/search/result?q=%23EU" title="#EU">#EU</a> <a href="/search/result?q=%23eIDAS" title="#eIDAS">#eIDAS</a> <a href="/search/result?q=%23PKI" title="#PKI">#PKI</a> <a href="/search/result?q=%23Privacy" title="#Privacy">#Privacy</a><a class="tgme_widget_message_link_preview" href="https://last-chance-for-eidas.org/" target="_blank" rel="noopener" title="13 days before the first eIDAS vote, still no public text"> <div class="link_preview_site_name accent_color">last-chance-for-eidas.org</div> <div class="link_preview_title">Last Chance for eIDAS</div> <div class="link_preview_description">13 days before the first eIDAS vote, still no public text</div> </a>https://news.letitfly.me/posts/9796https://news.letitfly.me/posts/9796Fri, 25 Mar 2022 13:23:29 GMT<div class="tgme_widget_message_forwarded_from accent_color">Forwarded from <a class="tgme_widget_message_forwarded_from_name" href="https://t.me/outvivid/3499" target="_blank" rel="noopener"><span>层叠 - The Cascading</span></a></div>美国加州议员 Dr. Richard Pan 推出学生考生隐私保护法 (Student Test Taker <mark class="highlight">Privacy</mark> Protection Act, STTPP)，希望引导和规范数字监考服务的数据收集行为。EFF 亦为此议案发起者之一。<br /><br /><a href="https://www.eff.org/deeplinks/2022/03/stop-invasive-remote-proctoring-pass-californias-student-test-taker-privacy" target="_blank" rel="noopener" title="https://www.eff.org/deeplinks/2022/03/stop-invasive-remote-proctoring-pass-californias-student-test-taker-privacy">https://www.eff.org/deeplinks/2022/03/stop-invasive-remote-proctoring-pass-californias-student-test-taker-privacy</a><br /><br /><a href="/search/result?q=%23US" title="#US">#US</a> <a href="/search/result?q=%23CA" title="#CA">#CA</a> <a href="/search/result?q=%23STTPPA" title="#STTPPA">#STTPPA</a> <a href="/search/result?q=%23Privacy" title="#Privacy">#Privacy</a> <a href="/search/result?q=%23Proctoring" title="#Proctoring">#Proctoring</a><a class="tgme_widget_message_link_preview" href="https://eff.org/deeplinks/2022/03/stop-invasive-remote-proctoring-pass-californias-student-test-taker-privacy" target="_blank" rel="noopener" title="Remote proctoring companies like Proctorio, ProctorU, and ExamSoft collect all manner of private data on students and test takers, from biometric information to citizenship status to video and audio"> <div class="link_preview_site_name accent_color">Electronic Frontier Foundation</div> <img class="link_preview_image" alt="Stop Invasive Remote Proctoring: Pass California’s Student Test Taker Privacy Protection Act" src="/static/https://cdn4.telesco.pe/file/k0aEqT0oS4amyRZFJejTAryHzCeXneUfAYMEpiZNEy85Qvc43nAoXZIwLKK_pIKzkzp4xsorL9VuXDrGxVg9L1FEjS-6RXLiQ5qhKRVmhOI4Nt3zMwuC3rca3_z2iKWT9BptXj2iBnj9h48P0DGSaC1K1OvxUbh8Lht587sE012XsZ08goB-xkFeR5dthE7Jmr907fi8lvWRMfRzWnZ0fnWQY1ZCDB0phlF5WbxjSg6wBBrR8IaiEwYYxpAqALfeKNG1ejrcvv3qxKoTM9Mywl9VOVfg9R3Djyji-kystRXL8SExVgvg5VW0AHp7qmBPbSD2RLxY8wKU4-O-nulNtQ.jpg" width="1200" height="630" loading="eager" /> <div class="link_preview_title">Stop Invasive Remote Proctoring: Pass California’s Student Test Taker <mark class="highlight">Privacy</mark> Protection Act</div> <div class="link_preview_description">Remote proctoring companies like Proctorio, ProctorU, and ExamSoft collect all manner of private data on students and test takers, from biometric information to citizenship status to video and audio</div> </a>https://news.letitfly.me/posts/4763https://news.letitfly.me/posts/4763Thu, 31 May 2018 00:57:47 GMT<div class="tgme_widget_message_forwarded_from accent_color">Forwarded from <span class="tgme_widget_message_forwarded_from_name"><span>interesting ¯\\_(ツ)_/¯</span></span></div><div class="image-list-container image-list-odd"> <button type="button" class="image-preview-button image-preview-wrap" popovertarget="modal-4763-0" popovertargetaction="show" aria-label="Open image preview: 敲敲敲 打扰一下 告诉你 我们更新了我们的隐私政策与服务条款 #GDPR #spam #update #privacy #policy #tos #pic"> <img src="/static/https://cdn5.telesco.pe/file/ZD1qsOa2c40US3gGRkXRktC2EitxBBRQa_WdLc3WT7WZOGbxWlPr-5kEVl4ZD8b3EY84whTi5FWhxjGRodKULL4ca0qwAyU2BPNVGWH9jCzBiwbzh4CpQAgFTZSBMRJrYi8G1ijbyCbdcmrPoVvpaCaYQbZixObmqgq5-O1inGHTKvBWP-6E1WWNt55iXgRMcgr0h97ibrSY6Ts6Vy-uN7GvqUHHGmfEllEQn50np2UUnRQdL6ss4xPkMqUVjvtXB92wN1FJmTf3qlgXuwKITU_ee-4GtzUzSiroT7dVs8goxt2c4C8GbLi3FdNXQZA3HoWuiFEeUD9Km9lXZNE65w.jpg" alt="敲敲敲 打扰一下 告诉你 我们更新了我们的隐私政策与服务条款 #GDPR #spam #update #privacy #policy #tos #pic" width="800" height="600" loading="eager" /> </button> <div class="modal" id="modal-4763-0" popover="auto" aria-label="Image preview"> <button type="button" class="modal__backdrop" popovertarget="modal-4763-0" popovertargetaction="hide" aria-label="Close image preview"></button> <button type="button" class="modal__close" popovertarget="modal-4763-0" popovertargetaction="hide" aria-label="Close image preview">×</button> <div class="modal__surface"> </div> </div> </div>敲敲敲 打扰一下 告诉你 我们更新了我们的隐私政策与服务条款 <a href="/search/result?q=%23GDPR" title="#GDPR">#GDPR</a> <a href="/search/result?q=%23spam" title="#spam">#spam</a> <a href="/search/result?q=%23update" title="#update">#update</a> <a href="/search/result?q=%23privacy" title="#privacy">#privacy</a> <a href="/search/result?q=%23policy" title="#policy">#policy</a> <a href="/search/result?q=%23tos" title="#tos">#tos</a> <a href="/search/result?q=%23pic" title="#pic">#pic</a>https://news.letitfly.me/posts/4762https://news.letitfly.me/posts/4762Thu, 31 May 2018 00:57:47 GMT<div class="tgme_widget_message_forwarded_from accent_color">Forwarded from <span class="tgme_widget_message_forwarded_from_name"><span>interesting ¯\\_(ツ)_/¯</span></span></div><div class="image-list-container image-list-odd"> <button type="button" class="image-preview-button image-preview-wrap" popovertarget="modal-4762-0" popovertargetaction="show" aria-label="Open image preview: 我们更新了我们的隐私政策与服务条款 #GDPR #spam #update #privacy #policy #tos #pic"> <img src="/static/https://cdn5.telesco.pe/file/XxeGi7nIk9_GQCiCiDRwh55neEx5AYoUZrrgH_TGyJMsFRAyKPbtUkAmMIbHnubWgiWKoFQzXJYcMVFx_aJqHQPHEkFL-jZfRd7S1X0rd2pcE1GWoQvcKVQPJOlRIMuNIPTQIn3-nuvQjBNd9IK-9vMRFWSRANmfmCYm3dtfkngNtqhw54ZwuOseK0GSUswm6ynLQfwiQRkxdM3Sv3ffRvNwLzJTgp69-otECk9bM-UdfQ0IKdfUtx3K5aKp-WP0NOEOE5eAsjPGwl7ilTxUeE56M6H6wVcsb5dSsCd6T62c0XHi1klOuL3S2oggfEhfPAsdLVElBkmaceHx8lpWpw.jpg" alt="我们更新了我们的隐私政策与服务条款 #GDPR #spam #update #privacy #policy #tos #pic" width="712" height="800" loading="eager" /> </button> <div class="modal" id="modal-4762-0" popover="auto" aria-label="Image preview"> <button type="button" class="modal__backdrop" popovertarget="modal-4762-0" popovertargetaction="hide" aria-label="Close image preview"></button> <button type="button" class="modal__close" popovertarget="modal-4762-0" popovertargetaction="hide" aria-label="Close image preview">×</button> <div class="modal__surface"> </div> </div> </div>我们更新了我们的隐私政策与服务条款 <a href="/search/result?q=%23GDPR" title="#GDPR">#GDPR</a> <a href="/search/result?q=%23spam" title="#spam">#spam</a> <a href="/search/result?q=%23update" title="#update">#update</a> <a href="/search/result?q=%23privacy" title="#privacy">#privacy</a> <a href="/search/result?q=%23policy" title="#policy">#policy</a> <a href="/search/result?q=%23tos" title="#tos">#tos</a> <a href="/search/result?q=%23pic" title="#pic">#pic</a>