April 2020 - nexa - server-nexa.polito.it

Francia e PEPP-PT
by Stefano Zacchiroli April 8, 2020

April 8, 2020

La Francia sembra orientarsi verso PEPP-PT per la sua implementazione di TTT (test/trace/treat): https://twitter.com/emile_marzolf/status/1247820268690640896 -- Stefano Zacchiroli . zack(a)upsilon.cc . upsilon.cc/zack . . o . . . o . o Computer Science Professor . CTO Software Heritage . . . . . o . . . o o Former Debian Project Leader & OSI Board Director . . . o o o . . . o . « the first rule of tautology club is the first rule of tautology club »

1 0

Tweetchat Open Glam Policies
by Fabio Nascimbeni April 8, 2020

April 8, 2020

Fabio Nascimbeni fabio.nascimbeni(a)gmail.com http://linkedin.com/in/fabionascimbeni/

1 0

The Far-Right Helped Create The World's Most Powerful Facial Recognition Technology
by J.C. DE MARTIN April 8, 2020

April 8, 2020

The Far-Right Helped Create The World's Most Powerful Facial Recognition Technology Clearview AI, which has alarmed privacy experts, hired several far-right employees, a HuffPost investigation found. By Luke O'Brien 04/07/2020 04:28 PM ET https://www.huffpost.com/entry/clearview-ai-facial-recognition-alt-right_n_… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

contact tracing
by a_ April 7, 2020

April 7, 2020

Salve, segnalo l'incontro di venerdì 10 aprile dalle 10:30 alle 12:30 (GoToWebinar) sulle iniziative di contact tracing. Partecipano: Carola Frediani - Guerre di Rete Maria Luisa Stasi - Article 19 Antonella Napolitano - Privacy International (in attesa di conferma) Fabio Pietrosanti - Hermes Center Federico Anghelé - The Good Lobby Italia Lucio Scudiero - Avvocato Tech & Privacy - Legance Avvocati Associati Vincenzo Tiani - Università IULM, membro della Task Force Dati del Governo italiano Marco Cappato - Eumans Facilita Simona Bonfante, giornalista https://www.alcuoredellapolitica.net/condivisi-covid-19-quali-dati-quali-di… Registrazione qui: https://attendee.gotowebinar.com/register/4017176089308552716 [image: image.png]

1 0

GitHub - DP-3T/documents: Decentralized Privacy-Preserving Proximity Tracing -- Documents
by Alberto Cammozzo April 7, 2020

April 7, 2020

Non so se questo approccio è passato in lista. Nel white paper è interessante la discussione tra un approccio centralizzato e uno decentrato. <https://github.com/DP-3T/documents> Decentralized Privacy-Preserving Proximity Tracing This repository contains a proposal for a secure and privacy-preserving decentralized privacy-preserving proximity tracing system. Its goal is to simplify and accelerate the process of identifying people who have been in contact with an infected person, thus providing a technological foundation to help slow the spread of the SARS-CoV-2 virus. The system aims to minimise privacy and security risks for individuals and communities and guarantee the highest level of data protection. By publishing this document we seek feedback from a broad audience on the high-level design, its security and privacy properties, and the functionality it offers; so that further protection mechanisms can be added if weaknesses are identified. The white paper document is accompanied by an overview of the data protection aspects of the design, and a three page simplified introduction to the protocol. If you have a similar project and you believe it would be beneficial to collaborate or exchange ideas drop an email here: dp3t(a)groupes.epfl.ch. The following people are behind this design: EPFL: Prof. Carmela Troncoso, Prof. Mathias Payer, Prof. Jean-Pierre Hubaux, Prof. Marcel Salathé, Prof. James Larus, Prof. Edouard Bugnion, Dr. Wouter Lueks, Theresa Stadler, Dr. Apostolos Pyrgelis, Dr. Daniele Antonioli, Ludovic Barman, Sylvain Chatel ETHZ: Prof. Kenneth Paterson, Prof. Srdjan Capkun, Prof. David Basin, Dennis Jackson KU Leuven: Prof. Bart Preneel, Prof. Nigel Smart, Dr. Dave Singelee, Dr. Aysajan Abidin TU Delft: Prof. Seda Gürses University College London: Dr. Michael Veale CISPA: Prof. Cas Cremers University of Oxford: Dr. Reuben Binns TU Berlin / Fraunhofer HHI: Prof. Thomas Wiegand Anche: <https://blog.symbolic.software/2020/04/05/dp-3t-verifpal/>

2 1

Google apologizes after its Vision AI produced racist results
by Giacomo Tesio April 7, 2020

April 7, 2020

A Google service that automatically labels images produced starkly different results depending on skin tone on a given image. The company fixed the issue, but the problem is likely much broader. In the fight against the novel coronavirus, many countries ordered that citizens have their temperature checked at train stations or airports. The device needed in such situations, a hand-held thermometer, has risen from a specialist item to a common sight. A branch of Artificial Intelligence known as “computer vision” focuses on automated image labeling. Most computer vision systems were trained on data sets that contained very few images of hand-held thermometers. As a result, they cannot label the device correctly. In an experiment that became viral on Twitter, AlgorithmWatch showed that Google Vision Cloud, a computer vision service, labeled an image of a dark-skinned individual holding a thermometer “gun” while a similar image with a light-skinned individual was labeled “electronic device”. A subsequent experiment showed that the image of a dark-skinned hand holding a thermometer was labelled “gun” and that the same image with a salmon-colored overlay on the hand was enough for the computer to label it “monocular”. Continua su https://algorithmwatch.org/en/story/google-vision-racism/ Giacomo

1 0

Sito INPS: niente "hacker", solo una scusa per proteggere gli appalti da 360 milioni di euro. La verità? Hanno usato la CDN Microsoft Azure Edge senza sapere come si usa - italy
by Giovanni Biscuolo April 7, 2020

April 7, 2020

Buongiorno nexiani, un amico mi segnala questo thread di reddit: https://www.reddit.com/r/italy/comments/fuyvwd/sito_inps_niente_hacker_solo… --8<---------------cut here---------------start------------->8--- La mattina del 1 aprile, per qualche ora (e non "5 minuti" come ha dichiarato l'INPS), è stata impostata la CDN Microsoft Azure Edge (rivenditore di Akamai in questo caso) davanti al server del sito dell'INPS. www.inps.it era diventato un CNAME a inps-cdn-a.azureedge.net. Poi hanno ripristinato l'IP diretto senza CDN, "risolvendo l'attacco hacker" e il "data breach" (autoinflitti?!?!) Chi continuava a visualizzare dati altrui in seguito avrebbe dovuto semplicemente cancellare la cache del browser, oppure utilizzare la modalità incognito. Addirittura la CDN sta funzionando ancora oggi: (quindi Microsoft sta continuando a ricevere soldi pubblici per questo) https://inps-cdn-a.azureedge.net/nuovoportaleinps/home.htm https://inps-cdn-a.azureedge.net/nuovoportaleinps/default.aspx Archiviati per futura memoria: https://archive.is/inps-cdn-a.azureedge.net Ecco svelato il mistero, una volta per tutte. Niente "hacker", e nessun database fallito in modi improbabili e assurdi, come sosterrebbero alcuni sedicenti "esperti" (non esiste che si possano "confondere" le richieste al database...) --8<---------------cut here---------------end--------------->8--- Non ho avuto modo di approfondire la veridicità di queste informazioni, potrebbero anche essere falsità costruite ad arte *ma* potrebbero anche contenere informazioni verificabili da terzi. Se fosse vero che tutto è dipeso da questo, dire che si tratta di una cosa grave è un eufemismo... qualsiasi sia la causa. Dalle scarne informazioni che ho non è possibile escludere che possa essersi trattato di un attacco a livello DNS... che però da solo non può consentire l'aggiramento della verifica del certificato X.509 (HTTPS) del sito [1]... non voglio neanche pensarci :-O Io so solo che oggi il record DNS inps-cdn-a.azureedge.net non esiste più (AFAIK) e non ho la possibilità di verificare se il giorno del disastro davvero l'indirizzo dell'INPS www.inps.it (inps.it non esiste :-S ) puntasse a quel record. Spero che i sistemisti dell'INPS siano onesti e pubblichino a breve un rapporto post-mortem completo che risponda anche a questi dubbi, i fornitori seri fanno così. Nel thread però ci sono diverse altre informazioni più facilmente verificabili, tipo la sostanziale privatizzazione (si chiama ancora outsourcing?) del sistema informativo INPS, che illustrano il contesto. Questo è *uno* dei motivi per i quali io, semplice cittadino a conoscenza di questioni di tecnologie digitali, sono un filino preoccupato di come vengono gestiti i nostri dati sensibili dalla PA, in particolare quelli sanitari. Saluti, Giovanni [1] qualcuno avrebbe dovuto "impersonare il certificato valido" dell'INPS, è possibile da parte di un attaccante con molte risorse -- Giovanni Biscuolo Xelera IT Infrastructures

3 3

Zoom videos exposed online, highlighting privacy risks - The Washington Post
by Alberto Cammozzo April 7, 2020

April 7, 2020

<https://www.washingtonpost.com/technology/2020/04/03/thousands-zoom-video-c…> Thousands of personal Zoom videos have been left viewable on the open Web, highlighting the privacy risks to millions of Americans as they shift many of their personal interactions to video calls in an age of social distancing. Videos viewed by The Washington Post included one-on-one therapy sessions; a training orientation for workers doing telehealth calls that included people’s names and phone numbers; small-business meetings that included private company financial statements; and elementary school classes, in which children’s faces, voices and personal details were exposed. Many of the videos include personally identifiable information and deeply intimate conversations, recorded in people’s homes. Other videos include nudity, such as one in which an aesthetician teaches students how to give a Brazilian wax. Many of the videos appear to have been recorded through Zoom’s software and saved onto separate online storage space without a password. It does not affect videos that remain with Zoom’s own system. But because Zoom names every video recording in an identical way, a simple online search can reveal a long stream of videos elsewhere that anyone can download and watch. The Washington Post is not revealing the naming convention that Zoom uses, and Zoom was alerted to the issue before this story was published. How to protect your Zoom calls Zoom videos are not recorded by default, but call hosts can choose to record them and save to Zoom servers or their own computers without participants’ consent, though participants do receive a notification when a host starts to record. Sign up for our Coronavirus Updates newsletter to track the outbreak. All stories linked in the newsletter are free to access. The discovery that the videos are available on the open Web adds to a string of Zoom privacy concerns that have come to public attention as the service has become the preferred alternative for American work, school and social life. AD The company reached more than 200 million daily users last month, up from 10 million in December, as people turned on their cameras for Zoom weddings, funerals and happy hours at a time when face-to-face gatherings are discouraged or banned. Zoom said in a statement that it “provides a safe and secure way for hosts to store recordings” and provides guides for how users can enhance their call security. “Should hosts later choose to upload their meeting recordings anywhere else, we urge them to use extreme caution and be transparent with meeting participants, giving careful consideration to whether the meeting contains sensitive information and to participants’ reasonable expectations,” the statement said. Five people identified in the videos The Post viewed said they had no idea how the footage made its way online. AD “That definitely shouldn’t be happening,” said Jack Crann, the owner of the Connecticut dog-training company Peace of Mind Canine, after a Post reporter alerted him to a video that included private financial details. “That was a meeting for us, and shouldn’t be put out for the public.” Patrick Jackson, the technology chief of the privacy-software company Disconnect and a former researcher for the National Security Agency, who alerted The Post to the exposed data, said Zoom could do a better job at cautioning people to protect their videos. Zoom could also help by implementing design tweaks, such as naming videos in an unpredictable way to make them harder to find. Jackson found the videos by using a free online search engine that scans through open cloud storage space online. One search for recordings, using Zoom’s default naming convention, revealed more than 15,000 results. AD “This was stuff I didn’t feel good watching, and I doubt all of the people here know these videos are public,” he said. Many of the videos can be found on unprotected chunks of Amazon storage space, known as buckets, which are widely used across the Web. Amazon buckets are locked down by default, but many users make the storage space publicly accessible either inadvertently or to share files with other people. (Amazon CEO Jeff Bezos owns The Post.) Thousands of other Zoom clips, all of them named in the same way, have been uploaded onto the video sites YouTube and Vimeo. In one clip posted Wednesday, a class of second-grade students can be seen learning about money while logged in from home. Everybody seems to be using Zoom. But its security flaws could leave users at risk. The problem is not exclusive to Zoom video or Amazon storage. But in designing their service, Zoom’s engineers bypassed some common security features of other video-chat programs, such as requiring people to use a unique file name before saving their own clips. That style of operating simplicity has powered Zoom to become the most popular video-chat application in the United States, but it has also frustrated some security researchers who believe such shortcuts can leave users more vulnerable to hacks or abuse. AD The service has also attracted the scrutiny of members of Congress, who have questioned its privacy and security measures at a time when Americans are signing on en masse. A group of 19 House Democrats sent Zoom a letter on Friday seeking details on Zoom’s data-collection and recording rules, writing, “Our new dependency on such solutions raises important questions about the privacy practices of the companies many of us are interacting with for the first time.” Zoom chief executive Eric Yuan acknowledged in a blog post Wednesday night that the service is being used far more extensively than he had contemplated when he founded the company in 2011. “We did not design the product with the foresight that, in a matter of weeks, every person in the world would suddenly be working, studying, and socializing from home,” he wrote. The system’s new user base, he said, was using Zoom in a number of “unexpected ways, presenting us with challenges we did not anticipate when the platform was conceived.” Yuan also apologized for Zoom falling short of users’ “privacy and security expectations” and said the company would be freezing new features for 90 days and redirecting its engineers to tackling security flaws. AD The Technology 202: Zoom chief Eric Yuan says he was not prepared for flood of security and privacy complaints As millions more people try Zoom, researchers have pointed to software and privacy concerns they worry could leave people’s computers at risk. Teams have highlighted security flaws that could allow strangers to steal log-in information, view messages and take control of users’ cameras and microphones. The service has also been abused by “zoombombing” trolls, who have invaded unlocked Zoom meetings to share pornography and spew racist slurs. Zoom officials said this week they were working overtime to patch security flaws and identify abusers to “ensure this doesn’t happen again.” The publicly exposed videos could be a surprise for people who expected their sensitive discussions would be kept private. But they could also put people at real personal risk. Ruth Schwartz, the director of Conscious Girlfriend, a relationship-support group for lesbian and queer women, said she was alarmed to learn that videos of her group sessions could be viewed online, including one in which women talked about how they recovered from toxic relationships. AD Schwartz said she went back to protect the Zoom videos and said she was worried about groups like hers, in which some women have not publicly shared their sexual orientation. “It’s a really important wake-up call,” she said. “Social connection is one of the biggest predictors of mental and physical health. … It’s so important for all of us who do this kind of sensitive work to take the precautions to protect our communities.” Geoffrey A. Fowler contributed to this report. What you need to know: How to make your own fabric mask | What to do if you get laid off or furloughed | Stay-at-home orders by state | Calculate how much money you might receive from the stimulus bill | Follow all of our coronavirus coverage and sign up for our daily newsletter (all stories in the newsletter are free). Follow the latest on the outbreak with our newsletter every weekday. All stories in the newsletter are free to access. By signing up you agree to our Terms of Use and Privacy Policy Coronavirus Updates Follow the latest on the outbreak with our newsletter every weekday. All stories in the newsletter are free to access.

1 0

Tracking quarantine, tracing cases, sharing info: Can these govt-issued apps help fight Covid-19? | | Citizen Matters
by Alberto Cammozzo April 7, 2020

April 7, 2020

<https://citizenmatters.in/tracking-quarantine-tracing-cases-sharing-info-ca…> In response to the Covid-19 pandemic, the governments of Kerala, Karnataka, Punjab and Tamil Nadu, the Ministry of Electronics and Information Technology (MeitY) and the National Informatics Centre (NIC) have released various mobile apps. Most of them are meant for one or more of these purposes: Ensure compliance with quarantine rules Provide information about symptoms and healthcare, and updates about the outbreak Tracing of confirmed and at-risk cases Tracing contact history with confirmed and at-risk cases A slew of mobile apps and other Internet-based interventions have been released by governments and private entities around the world. Google’s Android application store (Google Play) took down several Coronavirus infection tracker apps over the past month for violating its policy against “apps that lack reasonable sensitivity towards or capitalise on a natural disaster, atrocity, conflict, death, or other tragic event”. The Apple App Store also shuttered several such apps while citing a similar policy. Both app stores have allowed only infection tracker apps approved by governments or healthcare organisations/ companies. Key issues: Technical glitches, usability and privacy A preliminary review of the apps that I conducted based on publicly available information such as the app store listing and government orders raises two major concerns: Technical and usability issues that prevent quarantined users and the rest of the public from meaningfully using the apps Privacy of apps users as well as those identified as at-risk and/ or quarantined. (It is unclear from studying publicly available information regarding these apps if complementary and alternative means are being used to trace home-quarantined persons who do not own a smartphone or an Internet connection/ mobile Internet plan.) The current milieu encourages people to distrust and/ or discipline each other: while public services are being stretched thin while simultaneously trying to control the spread of an epidemic and manage a lockdown of the entire country, some individuals are flouting rules for quarantine and safety. While desperate times understandably call for desperate measures, many of these mobile phone-based interventions raise concerns about the privacy of users and that of persons directly affected by the novel coronavirus, overboard surveillance, and eventually, “function creep”. In the absence of a law for the protection of personal data and informational privacy, what happens of personally identifiable information (PII) collected and/ or published by these apps? Who would have access to information gathered for the purpose? For how long will it be stored and where? When will it be deleted, if at all? What safeguards exist to prevent abuse and leaks of this information? Would the use of PII be limited for the purpose of tracing, preventing and mitigating coronavirus cases? Leaks and abuse of photos and PII such as home addresses have already happened in some parts of the country. In case the app has been developed by a third-party, for example, a contractor with the government, what would be the rules applicable on the contractor for ownership and handling of PII, preventing its abuse, unauthorised access, and data breaches? Persons who violate quarantine rules face punitive actions under the Epidemic Diseases Act, 1897, a law far older than the Internet. The government orders that I could find have mandated the use of these apps. However, there is no publicly available information about what happens in case of technical failure of an app or if a person gets erroneously reported by the app as breaking the rules (in technical terms, a “false positive” report). On the other hand, technical issues with the apps and their allied systems, or trivial situations such as poor Internet connectivity could mean that persons who indeed break the rules do not get flagged (a “false negative” report). Here is the list of the apps reviewed: Aarogya Setu (National Informatics Centre) Quarantine Watch (Government of Karnataka) Corona Watch (Government of Karnataka) Corona Kavach (Ministry of Electronics and Information Technology – MeitY) COVID-19 Quarantine Monitor Tamil Nadu (Tamil Nadu Police Department) GCC- Corona Monitoring (Greater Chennai Corporation) Cobuddy – Covid-19 Tool (FaceTagR, Tamil Nadu) COVA Punjab (Government of Punjab) Mahakavach (Maharashtra State Innovation Society) COVID 19 Feedback (Ministry of Electronics and Information Technology-MeitY) GoK-Direct Kerala (Government of Kerala) KSP Clear Pass Checker (Vivish Technologies, Karnataka) Covid Care Kerala (Kannur District administration, Government of Kerala) Other apps mentioned in the news and unlisted apps [...]

1 0

Digital divide: Rural broadband in the time of coronavirus
by J.C. DE MARTIN April 7, 2020

April 7, 2020

https://journalistsresource.org/studies/society/internet/rural-broadband-co… (Sent from my wireless device; please excuse brevity and typos (if any))

2 1