On connait désormais le nom de l’auteur du #malware #Mirai. Il a été reconnu par sa combinaison assez inhabituelle de compétences dont il s’était vanté, sur un forum sous un pseudo, et sur LinkedIn sous son vrai nom...
▻https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author
▻https://techcrunch.com/2017/01/18/mirai-botnet-creator-unmasked-as-ddos-protection-developer-tempted-by-th
But for those of you who just want to skip to the end, here’s the executive summary. Anna-senpai appears to be one of perhaps a dozen aliases for one Paras Jha, founder of DDOS protection service ProTraf. ProTraf was in fierce competition over the lucrative Minecraft server market, and seems to have resorted to underhanded tactics in order to drive customers away from other hosts.
Several ProTraf employees — perhaps all of them, in fact — seem in various online conversations indirectly attributable to them to threaten, create, and execute DDOS attacks on competitors and for hire — $100 in bitcoin for every five minutes of attack time.
Jha looks to have been undone by the compulsive need of hackers operating in the shadows to claim credit for their work. Various personas linked to Jha and his colleagues take responsibility for numerous attacks, the creation of the Mirai code, and extorting service providers worldwide.
Slips here and there (identical coding skills between two online identities, for instance, or an attack utilising data only certain people could know) allowed the dots to be connected by Krebs, who understandably took the September takedown of his own site as something of a personal affront.
Mozilla lance #Persona (ex #BrowserID) pour l’identification universelle
►http://www.tassedecafe.org/943-mozilla-persona-identification-universelle.html
Mais la différence est aussi dans les options disponibles et une fonctionnalité intéressante est la limitation du temps de connexion. Sur la plupart des sites, vous avez la possibilité d’être connecté automatiquement via une petite case à cocher. Cette connexion automatique dure une semaine, un mois, un an, ça dépend, et bien souvent, ce n’est pas vous qui décidez. Justement, ici, la décision vous revient : une session qui ne dure qu’un moment ou une session disponible pendant un mois.
Et j’ajoute qu’avec Persona on peut choisir avec quelle adresse on se connecte.
début de discussion ici : ►http://seenthis.net/messages/89293
Mozilla essaye de répondre à la question :
How does Persona compare to #OpenID ?
►https://developer.mozilla.org/en-US/docs/Persona/FAQ
Persona is easier for users
Persona identifies users based on email addresses, which users already know, understand, and naturally associate with online identities. With OpenID, users are forced to learn a new username: an unintuitive URL.
Logging in with Persona is also easier: it just takes 2 clicks after a one-time setup process.
Persona is easier for developers
Persona has a simple API that only takes an afternoon to get started with.
Persona identities are email addresses, so websites don’t have to ask users for additional contact information during signup.
Because users know and understand their email address, developers don’t have to build complex pages with login buttons for all the popular OpenID providers.
Persona better protects user privacy
By design, OpenID allows Identity Providers to track their users around the web: whenever a user logs into a website, their browser gets redirected from that site to the user’s Identity Provider, and then back to the site that the user requested. These redirects fully expose to the Identity Provider where the user is going.
In contrast, the BrowserID protocol never leaks tracking information back to the Identity Provider. Rather, it behaves similarly to an ID card: users obtain signed credentials from their Identity Providers which can be presented to websites as a proof of identity. Websites can check the validity of these credentials without ever revealing a user’s identity to their identity provider.
Mozilla Persona : Enfin le bon système d’identification sur le Web ?
►http://www.framablog.org/index.php/post/2012/10/03/persona-mozilla-identification
alors taper bohwaz.openid.org c’est unintuitive mais bohwaz@persona.org c’est intuitif ? Moui... Bon sinon les avantages de Persona sont bien faibles comparé au fait que c’est un système centralisé... Donc sans intérêt !
Ça me parait d’autant plus intuitif (par rapport à une url) qu’un très grand nombre de gens ne tapent même plus d’adresse du tout mais recherchent systématiquement les sites dont ils connaissent pourtant l’url (genre « lemonde » dans google plutôt que lemonde.fr directement). Je n’ai aucun chiffre mais j’ai le sentiment que cette pratique est massive.
Le fait même que la présentation soit en vidéo (et pas en texte) indique que Persona est conçu pour les primates décérébrés.
