October 2019 - nexa - server-nexa.polito.it

La lunga mano dell'algoritmo

by don Luca Peyron

Facebook oscura le pagine pro curdi. Censurato anche il docufilm sul conflitto https://www.avvenire.it/attualita/pagine/facebook-chiude-le-pagine-pro-curd… Buona lettura e buona domenica dl _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

Oct. 19, 2019

Re: [nexa] interessante

by Andrea Trentini

On 19/10/2019 20:35, Mario Sabatino wrote: > C'è anche Delta Chat > > https://delta.chat/it/ > > Qualcuno la conosce? io l'ho usato per un po' per valutarlo, poi son passato a cose tipo tox/riot/etc. cmq la soluzione definitiva (al problema della messaggistica decentralizzata) non l'ho ancora -- |_|0|_| Andrea Trentini - http://atrent.it |_|_|0| Dipartimento di Informatica |0|0|0| Università degli Studi di Milano

Oct. 19, 2019

Re: [nexa] interessante

by Mario Sabatino

C'è anche Delta Chat https://delta.chat/it/ Qualcuno la conosce? Mario Sabatino Il 19 ottobre 2019 19:43:45 CEST, Stefano Quintarelli <stefano(a)quintarelli.it> ha scritto: >interessante. > >un client imap che fa da chat. >https://github.com/open-xchange/ox-coi >(c'e' per android in beta) > >chissà il carico sui server. > >in pratica usi il tuo server email per la chat > >Ciao, s. >-- >reserve your meeting with me at http://cal.quintarelli.it >_______________________________________________ >nexa mailing list >nexa(a)server-nexa.polito.it >https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa -- Mario Sabatino

Oct. 19, 2019

interessante

by Stefano Quintarelli

interessante. un client imap che fa da chat. https://github.com/open-xchange/ox-coi (c'e' per android in beta) chissà il carico sui server. in pratica usi il tuo server email per la chat Ciao, s. -- reserve your meeting with me at http://cal.quintarelli.it

Oct. 19, 2019

La chat dove regna l'orrore dei nostri adolescenti lasciati soli

by don Luca Peyron

Qui l' e- sorcista serve davvero, purtroppo! Buon lettura dl https://www.famigliacristiana.it/articolo/la-chat-dove-regna-l-orrore-dei-n… *L’online non ha funzioni educative. *Può diventare educativo, all’interno di un solido progetto pensato e sostenuto da adulti attenti. Ma se quegli adulti non ci sono, l’online diventa il paese dei balocchi, dove le scelte dei nostri figli sono funzionali a nutrire il loro cervello di eccitazione e sensazioni forti, intensissime. _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

Oct. 19, 2019

Vatican's wearable rosary gets fix for app flaw allowing easy hacks - CNET

by Alberto Cammozzo

Qui serve un e-Sorcista! <https://www.cnet.com/news/vaticans-wearable-rosary-gets-fix-for-app-flaw-al…> The road to internet-connected salvation is paved with cybersecurity issues. The Vatican discovered that Thursday, after a security researcher disclosed a severe vulnerability with the "Click to Pray" eRosary app. On Wednesday, the Vatican announced its $110 wearable rosary, an internet of things device that syncs with an app from the Pope's Worldwide Prayer Network. One advantage of IoT devices is that they open up a new way for people to interact with resources. With the eRosary, the Vatican said, people can get different prayers every day, as well as reminders on when to pray. The downside of IoT devices is that they're ripe for security issues. Lawmakers in the US have consistently called out poor security practices on connected gadgets, warning that they could lead to a flood of vulnerable devices. French security researcher Baptiste Robert found a significant flaw in the Vatican's app within 15 minutes. The vulnerability would have let a hacker take over a person's account, just by knowing the potential victim's registered email address. "This vulnerability is very severe as it allows an attacker to take over the victim's account and get his personal information," Robert said in a message. The Vatican didn't respond to a request for comment. Robert said he reached out to the Vatican on Wednesday and the security issue has since been fixed. The flaw worked because of how the app handled login credentials, Robert said. When you register for the "Click to Pray" app, you sign up with an email, and instead of setting a password, the app sends a PIN code to your inbox. You log in like this every time. Before the fix, the app was sending out requests to its server to email you the four-digit PIN. The issue was that PIN code itself was also sent on the network. Anyone analyzing the network traffic could have seen the response with the PIN sent. Robert demonstrated this vulnerability with an account we created on the app. Every time he gained access to the account, the app logged me out, telling me I was logged in on another device. It also sent an email with a new PIN code I didn't request. Once he had access, Robert was able to do anything I could on the account. He saw what I set as my gender, height, weight and birthday, as well as the cat photo I used for my avatar. He also deleted my account and was able to access a second account that I had made right after. The app logs other personal information as well, like how often someone prays, and it works as a fitness tracker. The rosary keeps track of how many steps a person takes throughout the day and distance traveled. The Android app also asks for access to location data and permissions to make calls.

Oct. 19, 2019

Google chief: I'd disclose smart speakers before guests enter my home - BBC News

by Alberto Cammozzo

<https://www.bbc.com/news/technology-50048144> It's an admission that appears to have caught Google's devices chief by surprise. After being challenged as to whether homeowners should tell guests smart devices - such as a Google Nest speaker or Amazon Echo display - are in use before they enter the building, he concludes that the answer is indeed yes. "Gosh, I haven't thought about this before in quite this way," Rick Osterloh begins. "It's quite important for all these technologies to think about all users... we have to consider all stakeholders that might be in proximity." And then he commits. "Does the owner of a home need to disclose to a guest? I would and do when someone enters into my home, and it's probably something that the products themselves should try to indicate." To be fair to Google, it hasn't completely ignored matters of 21st Century privacy etiquette until now. As Mr Osterloh points out, its Nest cameras shine an LED light when they are in record mode, which cannot be overridden. But the idea of having to run around a home unplugging or at least restricting the capabilities of all its voice- and camera-equipped kit if a visitor objects is quite the ask. [...]

Oct. 19, 2019

How Abusers Are Exploiting Smart Home Devices - VICE

by Alberto Cammozzo

<https://www.vice.com/en_uk/article/d3akpk/smart-home-technology-stalking-ha…> Ross and Catherine Cairns had been married for 16 years. He was an electronics expert, she an accountant, and by their early 30s they were living with their two young daughters in Hale, in Greater Manchester. The village is one of the wealthiest areas in the UK, home to upmarket restaurants and Premier League football players. The Cairns household was fitted out with an ELAN smart home system. The house’s security alarm, lighting and heating were all controlled centrally by a tablet mounted on the kitchen wall. With the touch of one button, the tablet let you turn off the lights and ensure the doors were locked. Using a smartphone app, you could remotely activate security cameras or change the music playing through the entertainment system. Ross was the administrator; Catherine mainly used it to turn lights on and off. “Monitoring your home has never been so easy!” declares the ELAN website. Perfect for parents to keep a distant eye on their kids while working late, but when used maliciously, also for jealous partners to spy on their spouses. Internet-connected devices – wearable trackers, smart TVs, voice-activated assistants, app-controlled locks and lights and thermostats – promise a utopia of convenience, a world in which we don’t need to get out of bed to turn off a ceiling light or fumble for house keys in the bottom of a bag. But as these devices – the internet of things, as it’s known – become ever more pervasive, so too does their use by domestic abusers as tools for surveillance and harassment. “Perpetrators of domestic abuse like to keep tabs on their partners. They like to know what you’ve been up to and where you’ve been,” says Sara Kirkpatrick, Research and Services Development Manager at Respect. “Being tracked is so much easier than it ever was.” As of January 2019, domestic violence charity Refuge has documented more than 2,500 people seeking their support services who have reported experiences of technology-facilitated abuse. Ross and Catherine separated in 2016. They remained friendly and the children spent time with both parents. Ross moved in with his mother in the neighbouring town of Altrincham, a five-minute drive from Hale. On August 12, 2017, Ross visited the family home to fix a fish tank. While he was there, she handed him her mobile, as she also wanted him to check the security system. “When he was on it, he read messages I had sent to a man I had been on a date with,” Catherine would later testify in Manchester Magistrates’ Court. Ross became agitated. He left the house, then came back inside, crying. “He ran upstairs and got the wedding rings and said that I wouldn’t need them.” Catherine told her parents about the incident. Standing in the kitchen with her mother, she said that she no longer loved Ross. “The next thing I knew, he was downstairs telling the kids he was moving back in,” testified Catherine. “He repeated the conversation that I had with my mum. He said, ‘Oh, you don’t love me anymore.’” Ross later admitted to accessing the ELAN system remotely through an app on his iPhone to eavesdrop on conversations. He also hacked into her Bumble accounts, posting an intimate picture and sending explicit messages. Catherine switched off the control tablet’s camera function and asked an IT engineer to change the system password. But even after this, the system logged more remote connections on October 14 and 15. “It looks like he was using the system as normal, but hadn't informed her exactly how it works,” says Bill Hensley, a spokesperson for ELAN. The password was likely changed for only the security system, he says, but not for the overriding administrator account. “It doesn't look like there was a breach.” “Prosecuting cases involving the use of technology in order to commit offences present real difficulties,” says Neil White, who was the prosecutor in the Cairns case. “With offences like harassment, this can be especially difficult, as there can be issues like shared IP addresses, or of one party having the technological knowledge, and being able to abuse it, when the other doesn't.” In May 2018, Ross was convicted of stalking and harassment. In court, he claimed that he had accessed ELAN remotely only to switch lights on or off, or adjust television volume. The stalking conviction was later quashed on appeal, but the harassment offence was upheld and he was banned from contacting Catherine for three years. The Cairns court case marked one of the first convictions involving IoT technology, says Leonie Tanczer, a gender and IoT researcher at University College London. The rise of smart devices, she believes, creates a new arsenal of tools that can be used against people already at risk of domestic abuse. Tanczer leads a research project on the topic in collaboration with the London Violence Against Women and Girls Consortium, comprising 29 organisations. Discussions with support groups have identified examples such as spying via smart TVs and security cameras at entrances, tracking location via GPS-enabled smartwatches, and physical gaslighting – remotely changing the temperature in a room by meddling with the heating system. Refuge, which is part of the consortium, has found a rise in women whose kids’ video game consoles have been hacked by perpetrators to trace information including a child’s location. [...]

Oct. 19, 2019

Re: [nexa] Perdonate il link :-) spero di non disturbarvi (altrimenti perdonatemi perfavore)

by Diego Giorio

Mah, in linea generale sono d'accordo, ma non credo (spero) che un singolo episodio possa/debba variare la profilazione generale (senza aprire una discussione sull'opportunità della profilazione in generale). Ad esempio l'altro giorno ho letto su La Settimana Enigmistica che durante un'olimpiade degli anni 20 per un disguido è stato suonato O sole mio al posto della Marcia reale, allora inno nazionale. Mi è venuta la curiosità di sentirla, ma questo non significa che io sia monarchico. Analogamente, c'è chi ha senso dell'umorismo e spirito critico, per cui uno sporadico "mi piace" su un politico, attore, giornalista non significa essere della stessa corrente o che si approvi in toto quanto dice, magari posso essere del campo opposto ma trovarmi d'accordo su un punto specifico, così come posso criticare una posizione o condividere una vignetta ironica pur approvando in senso generale il pensiero. E' quindi interesse di tutti, profilatori in primis, scartare i dati fuori schema. Nello specifico, il link - peraltro ben segnalato, dunque chi ha cliccato sapeva perfettamente cosa avrebbe visto - parlava di un personaggio pubblico che si è dato alla programmazione, non credo che guardarlo possa implicare l'essere cattolici, come, in generale, guardare un video di un politico non comporta essere di quello schieramento. Anzi, molte volte si monitora il "nemico", proprio per confutarlo. Oppure molti occidentali, cattolici o agnostici, vedono video del Dalai Lama o di altri filosofi/religiosi orientali per senza convertirsi. La profilazione, quella fatta bene, è molto complessa e, pur con le condivisibili attenzioni suggerite, non è facile sfuggire, perchè gli indizi più probanti sono i canali a cui si è iscritti, i siti preferiti, le mailing list (questa compresa), le reazioni e condivisioni sui social e così via, tutte cose alle quali non è facile rinunciare, anche per non perdersi notizie di proprio interesse. Senza contare altri dati meno prevedibili, come l'uso della batteria, la velocità di digitazione o chissà quale altro indizio, come leggiamo sovente ecome già passato in lista. Buona domenica a tutti. D. ________________________________ From: nexa <nexa-bounces(a)server-nexa.polito.it> on behalf of Giacomo Tesio <giacomo(a)tesio.it> Sent: Saturday, October 19, 2019 9:36 AM To: nexa(a)server-nexa.polito.it <nexa(a)server-nexa.polito.it>; Agata Lo Tauro <agatalotauro(a)gmail.com> Subject: Re: [nexa] Perdonate il link :-) spero di non disturbarvi (altrimenti perdonatemi perfavore) Il October 19, 2019 7:59:40 AM UTC, Agata Lo Tauro <agatalotauro(a)gmail.com> ha scritto: >Grazie gentilissimi, >ma non ci vedo niente di "Disturbing"... >Continueremo a fare vedere il Papa su youtube???!!!! :-) Il credo religioso o le opinioni politiche di una persona sono informazioni personali molto delicate. L'atto di comunicarle ad altri deve essere una scelta consapevole adeguatamente ponderata. Questa consapevolezza è impossibile per un ragazzo (o per un adulto) che non padroneggi l'informatica in questione. Se vuoi far vedere un video del Papa su YouTube puoi scaricarlo con programmi come youtube-dl attraverso tor e metterlo su un CD o su una chiavetta da far girare fra gli studenti interessati o proiettarlo a scuola. Ma indirizzare persone su YouTube per vedere il Papa significa permettere la loro profilazione da parte di Google (che possiede YouTube) attraverso la strumentalizzazione del Papa stesso, trasformato in prodotto di consumo ed in sponsor di YouTube allo stesso tempo. Ahimè l'egemonia culturale della Silicon Valley è talmente potente che nessuno osa veramente sfidarla: credono che sia imbattibile e si possa solo "assecondarla". Persino io mi sono ritrovato, qualche mese fa, in un'assemblea di un partito insospettabile distribuita via Facebook: nessuno dei tecnici presenti era consapevole che il problema non era la privacy dei presenti (cui comunque nessuno aveva chiesto un'autorizzazione allo streaming via Facebook) ma di tutte le persone che, guardando l'assemblea del partito, avrebbero informato Facebook dei loro interessi politici (cosa dannosa per queste persone e per il partito stesso). L'unico uso responsabile che possiamo fare delle piattaforme di sorveglianza è entrare per tirare fuori la gente che vi è intrappolata, senza caricare contenuti significativi ma solo rimandi ad altri siti non sorvegliati. Giacomo _______________________________________________ nexa mailing list nexa(a)server-nexa.polito.it https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa

Oct. 19, 2019

Re: [nexa] Google keeps adding Pixel features it claimed it didn’t need - The Verge

by Stefano Quintarelli

e' che prima mentivano, mentre adesso sono sinceri... On 19/10/2019 08:40, J.C. DE MARTIN wrote: > > Google keeps adding Pixel features it claimed it didn’t need > > Just like everyone else > > * By Jon Porter <https://www.theverge.com/authors/jon-porter> > * on October 17, 2019 7:30 am > > > > https://www.theverge.com/2019/10/17/20916996/google-pixel-4-second-telephot… > > > (Sent from my wireless device; please excuse brevity and typos (if any)) > > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa > -- reserve your meeting with me at http://cal.quintarelli.it

Oct. 19, 2019