May 2020 - nexa - server-nexa.polito.it

"Senate Votes to Allow FBI to Look at Your Web Browsing History Without a Warrant"
by J.C. DE MARTIN May 14, 2020

May 14, 2020

Senate Votes to Allow FBI to Look at Your Web Browsing History Without a Warrant The government just got even more power to spy on your internet habits as millions remain quarantined at home. by Janus Rose <https://www.vice.com/en_us/contributor/janus-rose> May 13 2020, 9:32pm https://www.vice.com/en_us/article/jgxxvk/senate-votes-to-allow-fbi-to-look…

2 1

Re: [nexa] Naomi Klein: How big tech plans to profit from the pandemic | News | The Guardian
by Giuseppe Attardi May 13, 2020

May 13, 2020

Lo scorso novembre (mail allegata) avevo preconizzato uno scenario distopico in cui tutti saremmo diventati animali da batteria, che vivono confinati in casa, controllati da dispositivi che controllano la nostra salute, ci portano il cibo da mangiare, ci obbligano a fare ginnastica se ingrassiamo troppo, e di tanto in tanto ci ingaggiano per attività da mechanical turk o crowdsourcing per raccogliere dati di apprendimento, o per recommender system, da cui guadagnarci un tanto per sopravvivere. Pensavo di farci un video, per illustrare il pericolo, ma mi hanno detto che ci volevano troppi soldi per fare un buon lavoro. Comunque la realtà sta anticipando la mia peggiore fantasia. — Beppe > On 18 Nov 2019, at 22:49, Giuseppe Attardi <attardi(a)di.unipi.it> wrote: > > Dopo aver visto questo video: > > https://youtu.be/pbqJgHUwI4w > > ne ho visto un altro in cui una telecamera segue una persona per tutta la casa, guarda ciò che mangia, lo avvisa che dopo pranzo deve prendere una medicina, guarda cosa c’è in frigo e gli dice di buttare i cibi avariati. > > Questo mi ha fatto immaginare un futuro tecnologico un po’ distopico in cui le persone finiscono per essere assoggettate alle macchine quasi come polli in batteria. > > Ogni persona sta nella sua stanzetta e vive interagendo col resto del mondo tramite la rete e vari dispositivi. > Il nostro personaggio, che chiamerò Igor, con un braccialetto ai polsi che rileva lo stato di salute, seduta in poltrona davanti a uno schermo, dove gli appare un assistente a suggerirgli cosa guardare, poi lo invia a indossare un vestito e lo riprende mentre lo prova danzando, provando 2-3 diverse canzoni e infine lo pubblica in rete, dove viene visto dai suoi amici che commentano, poi viene chiamato da un robot marketer che gli chiede cosa pensa della proposta di mettere un deposito merci al posto del giardino del vicinato. > Nel frattempo i like al suo vestito arrivano pochi like e quindi il suo score di influencer diminuisce. > L’assistente segnala che costi il suo conto bancario si sta esaurendo e quindi lo invita ad andare a fare qualche lavoretto di Mechanical Turk, annotando dati. > Igor protesta perché vorrebbe vedere la partita, ma l’assistente lo rimprovera e gli blocca il televisore. > Siccome ci mette troppo tempo, lo pungola fare più in fretta altrimenti non ce la farà a guadagnare abbastanza. > All'ora di pranzo, Igor vorrebbe ordinare un piatto di lasagne, ma l’assistente gi dice che sta ingrassando e che deve accontentarsi di una pastina in brodo e del puré, che gli consegnato da un drone all’assistente che lo mette a riscaldare in microonde. > Dopo pranzo, l’assistente lo obbliga a prendere una medicina per il diabete. > Più tardi gli porta una tuta e scarpe da ginnastica e gliele fa indossare e poi lo mette a fare ginnastica, impersonando un personal trainer. > Mentre fa gli esercizi, controlla polso e pressione e manda i dati a un’azienda sanitaria privata. > > Si potrebbe fare un video di animazione su uno script del genere? > > On 13 May 2020, at 10:09, nexa-request(a)server-nexa.polito.it wrote: > > From: Alberto Cammozzo <ac+nexa(a)zeromx.net <mailto:ac+nexa@zeromx.net>> > To: Nexa <nexa(a)server-nexa.polito.it <mailto:nexa@server-nexa.polito.it>> > Subject: [nexa] Naomi Klein: How big tech plans to profit from the > pandemic | News | The Guardian > Message-ID: <699E1290-ADF1-41E9-8B96-836263FAE0C3(a)zeromx.net <mailto:699E1290-ADF1-41E9-8B96-836263FAE0C3@zeromx.net>> > Content-Type: text/plain; charset="utf-8" > > <https://www.theguardian.com/news/2020/may/13/naomi-klein-how-big-tech-plans… <https://www.theguardian.com/news/2020/may/13/naomi-klein-how-big-tech-plans…>> > > or a few fleeting moments during the New York governor Andrew Cuomo’s daily coronavirus briefing on Wednesday 6 May, the sombre grimace that has filled our screens for weeks was briefly replaced by something resembling a smile. > > “We are ready, we’re all-in,” the governor gushed. “We are New Yorkers, so we’re aggressive about it, we’re ambitious about it … We realise that change is not only imminent, but it can actually be a friend if done the right way.” > > The inspiration for these uncharacteristically good vibes was a video visit from the former Google CEO Eric Schmidt, who joined the governor’s briefing to announce that he will be heading up a panel to reimagine New York state’s post-Covid reality, with an emphasis on permanently integrating technology into every aspect of civic life. > > “The first priorities of what we’re trying to do,” Schmidt said, “are focused on telehealth, remote learning, and broadband … We need to look for solutions that can be presented now, and accelerated, and use technology to make things better.” Lest there be any doubt that the former Google chair’s goals were purely benevolent, his video background featured a framed pair of golden angel wings. > > Just one day earlier, Cuomo had announced a similar partnership with the Bill and Melinda Gates Foundation to develop “a smarter education system”. Calling Gates a “visionary”, Cuomo said the pandemic has created “a moment in history when we can actually incorporate and advance [Gates’s] ideas … all these buildings, all these physical classrooms – why, with all the technology you have?” he asked, apparently rhetorically. > > It has taken some time to gel, but something resembling a coherent pandemic shock doctrine is beginning to emerge. Call it the Screen New Deal. Far more hi-tech than anything we have seen during previous disasters, the future that is being rushed into being as the bodies still pile up treats our past weeks of physical isolation not as a painful necessity to save lives, but as a living laboratory for a permanent – and highly profitable – no-touch future. > > Anuja Sonalker, the CEO of Steer Tech, a Maryland-based company selling self-parking technology, recently summed up the new virus-personalised pitch. “There has been a distinct warming up to humanless, contactless technology,” she said. “Humans are biohazards, machines are not.” > > It’s a future in which our homes are never again exclusively personal spaces, but are also, via high-speed digital connectivity, our schools, our doctor’s offices, our gyms, and, if determined by the state, our jails. Of course, for many of us, those same homes were already turning into our never-off workplaces and our primary entertainment venues before the pandemic, and surveillance incarceration “in the community” was already booming. But in the future that is hastily being constructed, all of these trends are poised for a warp-speed acceleration. > > This is a future in which, for the privileged, almost everything is home delivered, either virtually via streaming and cloud technology, or physically via driverless vehicle or drone, then screen “shared” on a mediated platform. It’s a future that employs far fewer teachers, doctors and drivers. It accepts no cash or credit cards (under guise of virus control), and has skeletal mass transit and far less live art. It’s a future that claims to be run on “artificial intelligence”, but is actually held together by tens of millions of anonymous workers tucked away in warehouses, data centres, content-moderation mills, electronic sweatshops, lithium mines, industrial farms, meat-processing plants and prisons, where they are left unprotected from disease and hyper-exploitation. It’s a future in which our every move, our every word, our every relationship is trackable, traceable and data-mineable by unprecedented collaborations between government and tech giants. > [...]

1 0

India's Contact Tracing App Is All But Mandatory. So This Programmer Hacked It So That He Always Appears Safe.
by Giacomo Tesio May 13, 2020

May 13, 2020

Sorpresa! :-D https://www.buzzfeednews.com/article/pranavdixit/india-aarogya-setu-hacked For days, Jay, a software engineer in Bangalore, watched with mounting alarm as people in India were forced to install the government’s coronavirus contact tracing app. Then, he rolled up his sleeves and ripped its guts out. “I didn’t like the fact that installing this app is slowly becoming mandatory in India,” said Jay, who requested a pseudonym to speak freely. “So I kept thinking of what I could personally do to avoid putting it on my phone.” Jay started work at 9 a.m. on a Saturday. He chopped away at the app’s code to bypass the registration page that required people to sign up with their cellphone numbers. More pruning let him bypass a page that requested personal information like name, age, gender, travel history, and COVID-19 symptoms. Then, he carved away the permissions that he viewed as invasive: those requiring access to the phone’s Bluetooth and GPS at all times By 1 p.m., the app had become a harmless shell, collecting no data but still flashing a green badge declaring that the user was at low risk of infection. “That was my goal,” said Jay. “I succeeded. You can show the green badge to anyone if they ask to check your phone and they won’t be able to tell.”

1 0

Secret NHS files reveal plans for coronavirus contact tracing app
by Enrico Nardelli May 13, 2020

May 13, 2020

https://www.wired.co.uk/article/nhs-covid-19-app-health-status-future The NHS Covid-19 contact tracing app could soon show people’s coronavirus health “status” and ask individuals to share precise location data, internal NHS documents seen by WIRED reveal. One document titled ‘Product Direction: Release One’ and marked as ‘OFFICIAL – SENSITIVE’, includes a series of slides showing the app’s future development roadmap. The documents also reveal that officials within the NHS and Department of Health and Social Care are worried that the app’s reliance on unverified diagnoses could be open to abuse and lead to “public panic” that puts extra pressure on the health service. The documents, which are hosted in Google Drive, were inadvertently left open for anyone with a link to view. Links to the documents were included in others published by the NHS covering the privacy protections in the contact tracing app. Other documents linked to in the document could not be accessed without approval. ... Parafrasando Eduardo, "le sorprese non finiscono mai" ... -- EN ===================================================================== Prof. Enrico Nardelli Dipartimento di Matematica - Universita' di Roma "Tor Vergata" Via della Ricerca Scientifica snc - 00133 Roma tel: +39 06 7259.4204 fax: +39 06 7259.4699 mobile: +39 335 590.2331 e-mail: nardelli(a)mat.uniroma2.it home page: http://www.mat.uniroma2.it/~nardelli blog: http://www.ilfattoquotidiano.it/blog/enardelli/ http://link-and-think.blogspot.it/ ===================================================================== --

1 0

The forever temporary contact tracing app
by Antonio Casilli May 13, 2020

May 13, 2020

"this technology, once deployed, will not be “rolled back.” We are repeatedly told that contact tracing apps and COVID-19-related surveillance are temporary measures for use until the pandemic passes. That’s likely to be a fantasy. Surveillance inertia is remarkably difficult to resist. Norms get set and practices and tools become entrenched. And who can say when this will wind down? We’re still dealing with the supposedly temporary surveillance authorized almost 20 years ago in the wake of after 9/11. Rollbacks are rare and highly unlikely because the tools we build today will create a path dependency that will shape our future data and surveillance practices." ("Coronavirus tracing apps are coming. Here’s how they could reshape surveillance as we know it" by Woodrow Hartzog (Center for Internet and Society at Stanford Law School) https://www.latimes.com/opinion/story/2020-05-12/coronavirus-tracing-app-ap…) -- Antonio A. Casilli Professor, Telecom Paris, Institut Polytechnique de Paris Member, Interdisciplinary Institute for Innovation (i3 UMR 9217 CNRS) Associate Member, LACI-IIAC (EHESS) Faculty Fellow, Nexa Center for Internet & Society *We respect your right to disconnect. This email send time is due to my own workflow efficiency. You are in no obligation to take action or reply to it outside your office hours.*

4 8

What Was TON And Why It Is Over
by Giacomo Tesio May 13, 2020

May 13, 2020

https://telegra.ph/What-Was-TON-And-Why-It-Is-Over-05-12 Interessantissima lettura. Giudice o meno, TON era fuffa blockchain e come tale destinata, secondo la mia autorevolissima predizione (:-D), a fallire miseramente entro il 2020. Per cui Durov non la conta giusta e mi piacerebbe molto leggere la sentenza. Ma per quanto giungano da un bimbo imbronciato cui è stato tolto il giocattolo, le considerazioni geopolitiche sono assolutamente imperdibili. :-D Giacomo _____ For the last 2,5 years some of our best engineers have been working on a next-generation blockchain platform called TON and a cryptocurrency we were going to name Gram. TON was designed to share the principles of decentralization pioneered by Bitcoin and Ethereum, but to be vastly superior to them in speed and scalability. We were very proud with the result – the technology we created allowed for an open, free, decentralized exchange of value and ideas. When integrated with Telegram, TON had the potential to revolutionize how people store and transfer funds and information. Unfortunately, a US court stopped TON from happening. How? Imagine that several people put their money together to build a gold mine – and to later split the gold that comes out of it. Then a judge comes and tells the mine builders: "Many people invested in the gold mine because they were looking for profits. And they didn't want that gold for themselves, they wanted to sell it to other people. Because of this, you are not allowed to give them the gold." If this doesn't make sense to you, you are not alone – but this is exactly what happened with TON (the mine), its investors, and Grams (the gold). A judge used this reasoning to rule that people should not be allowed to buy or sell Grams like they can buy or sell Bitcoins. Perhaps even more paradoxically, the US court declared that Grams couldn't be distributed not only in the United States, but globally. Why? Because, it said, a US citizen might find some way of accessing the TON platform after it launched. So, to prevent this, Grams shouldn’t be allowed to be distributed anywhere in the world – even if every other country on the planet seemed to be perfectly fine with TON. This court decision implies that other countries don’t have the sovereignty to decide what is good and what is bad for their own citizens. If the US suddenly decided to ban coffee and demanded coffee shops in Italy be closed because some American might go there – we doubt anyone would agree. And yet, despite that, we have made the difficult decision not to proceed with TON. Sadly, the US judge is right about one thing: we, the people outside the US, can vote for our presidents and elect our parliaments, but we are still dependent on the United States when it comes to finance and technology (luckily not coffee). The US can use its control over the dollar and the global financial system to shut down any bank or bank account in the world. It can use its control over Apple and Google to remove apps from the App Store and Google Play. So yes, it is true that other countries do not have full sovereignty over what to allow on their territory. Unfortunately, we – the 96% of the world’s population living elsewhere – are dependent on decision makers elected by the 4% living in the US. This may change in the future. But today, we are in a vicious circle: you can’t bring more balance to an overly centralized world exactly because it’s so centralized. We did try though. We're leaving it to the the next generations of entrepreneurs and developers to pick up the banner and learn from our mistakes. I am writing this post to officially announce that Telegram’s active involvement with TON is over. You may see – or may have already seen – sites using my name or the Telegram brand or the "TON" abbreviation to promote their projects. Don’t trust them with your money or data. No present or past member of our team is involved with any of these projects. While networks based on the technology we built for TON may appear, we won’t have any affiliation with them and are unlikely to ever support them in any way. So be careful, and don’t let anyone mislead you. I want to conclude this post by wishing luck to all those striving for decentralization, balance and equality in the world. You are fighting the right battle. This battle may well be the most important battle of our generation. We hope that you succeed where we have failed.

2 2

Re: [nexa] Privacy e contact tracing: cosa può andare storto?
by Giuseppe Attardi May 13, 2020

May 13, 2020

L’articolo è chiaro e ragionevole. La mia interpretazione è che i rischi di sicurezza del protocollo DP-3T, dipendano fondamentalmente da fattori esterni alla app stessa, imputabili ad atti malevoli e quindi illegittimi e punibili. Ad esempio, riguardo al DP-3T: Questo potenzialmente consente al server di associare questi codici alla stessa persona. In questo caso, l’utente diventa potenzialmente reidentificabile e tracciabile, ma solo retroattivamente e limitatamente al periodo di infezione. A parte il fatto che la persona infetta è completamente identificata, visto che sono i medici ad averlo diagnosticato, l’atto di “potenzialmente tacciabile" (non si spiega come, ma presumibilmente attraverso altri dati, anch’essi usati illegittimamente), sarebbe un atto illegittimo dell’autorità sanitaria, che utilizza dati al di fuori di quanto le è consentito. Altro rischio potenziale ipotizzato è che una persona malevola, vada a ricostruire con chi si trovava in un certo intervallo (a lui sconosciuto in quanto di durata casuale), con una singola persona che evidentemente conosca, da cui potrebbe ricostruire che fosse infetta. Ma questo succede anche senza app. Se il medico mi dice che sono stato contagiato, presumibilmente in un arco di 2-3 giorni e io ricordo che in quei giorni non ho avuto contatti non protetti con nessun altro se non con un singolo individuo, potrei concludere che tale individuo fosse infetto. Chiediamo alla app di dare maggiori garanzie d quante ne esistano nella normale realtà. Sappiamo che nessuna tecnologia è perfetta e può essere utilizzata per fare danni. Ma siccome gli usi illegali non possono essere impediti, va valutato il rischio, ossia il prodotto tra il danno e la probabilità che esso accada. Nella vita normale siamo abituati ad accettare rischi, se sono sotto un certo livello, e abbiamo modi di mitigarli, porvi rimedio o tollerare. Probabilmente il rischio del non usare la app, non solo individuale ma collettivo, è superiore rispetto al rischio di non usarla. Noi lasciamo girare persone in motocicletta, anche se sappiamo che possono fare danni a se stessi e ad altri, ma gli imponiamo di seguire il codice della strada e di indossare il casco (ma si può morire anche indossandolo). Se non rispettano le regole, multiamo solo loro, non aboliamo l’uso delle motociclette per tutti. — Beppe > On 8 May 2020, at 15:11, nexa-request(a)server-nexa.polito.it wrote: > > From: Roberto Resoli <roberto(a)resolutions.it> > To: nexa(a)server-nexa.polito.it > Subject: [nexa] Privacy e contact tracing: cosa può andare storto? > Ecco i rischi concreti > Message-ID: <F27DD146-99AF-46E5-8ABB-5D2742B2C0AC(a)resolutions.it> > Content-Type: text/plain; charset=utf-8 > > Un bellissimo articolo da Andrea Gadotti, divulgativo ma con un'analisi comparata dei vari protocolli e una presentazione degli scenari di rischio: > > https://www.agendadigitale.eu/sicurezza/privacy/privacy-e-contact-tracing-c… > > rob >

4 10

Naomi Klein: How big tech plans to profit from the pandemic | News | The Guardian
by Alberto Cammozzo May 13, 2020

May 13, 2020

<https://www.theguardian.com/news/2020/may/13/naomi-klein-how-big-tech-plans…> or a few fleeting moments during the New York governor Andrew Cuomo’s daily coronavirus briefing on Wednesday 6 May, the sombre grimace that has filled our screens for weeks was briefly replaced by something resembling a smile. “We are ready, we’re all-in,” the governor gushed. “We are New Yorkers, so we’re aggressive about it, we’re ambitious about it … We realise that change is not only imminent, but it can actually be a friend if done the right way.” The inspiration for these uncharacteristically good vibes was a video visit from the former Google CEO Eric Schmidt, who joined the governor’s briefing to announce that he will be heading up a panel to reimagine New York state’s post-Covid reality, with an emphasis on permanently integrating technology into every aspect of civic life. “The first priorities of what we’re trying to do,” Schmidt said, “are focused on telehealth, remote learning, and broadband … We need to look for solutions that can be presented now, and accelerated, and use technology to make things better.” Lest there be any doubt that the former Google chair’s goals were purely benevolent, his video background featured a framed pair of golden angel wings. Just one day earlier, Cuomo had announced a similar partnership with the Bill and Melinda Gates Foundation to develop “a smarter education system”. Calling Gates a “visionary”, Cuomo said the pandemic has created “a moment in history when we can actually incorporate and advance [Gates’s] ideas … all these buildings, all these physical classrooms – why, with all the technology you have?” he asked, apparently rhetorically. It has taken some time to gel, but something resembling a coherent pandemic shock doctrine is beginning to emerge. Call it the Screen New Deal. Far more hi-tech than anything we have seen during previous disasters, the future that is being rushed into being as the bodies still pile up treats our past weeks of physical isolation not as a painful necessity to save lives, but as a living laboratory for a permanent – and highly profitable – no-touch future. Anuja Sonalker, the CEO of Steer Tech, a Maryland-based company selling self-parking technology, recently summed up the new virus-personalised pitch. “There has been a distinct warming up to humanless, contactless technology,” she said. “Humans are biohazards, machines are not.” It’s a future in which our homes are never again exclusively personal spaces, but are also, via high-speed digital connectivity, our schools, our doctor’s offices, our gyms, and, if determined by the state, our jails. Of course, for many of us, those same homes were already turning into our never-off workplaces and our primary entertainment venues before the pandemic, and surveillance incarceration “in the community” was already booming. But in the future that is hastily being constructed, all of these trends are poised for a warp-speed acceleration. This is a future in which, for the privileged, almost everything is home delivered, either virtually via streaming and cloud technology, or physically via driverless vehicle or drone, then screen “shared” on a mediated platform. It’s a future that employs far fewer teachers, doctors and drivers. It accepts no cash or credit cards (under guise of virus control), and has skeletal mass transit and far less live art. It’s a future that claims to be run on “artificial intelligence”, but is actually held together by tens of millions of anonymous workers tucked away in warehouses, data centres, content-moderation mills, electronic sweatshops, lithium mines, industrial farms, meat-processing plants and prisons, where they are left unprotected from disease and hyper-exploitation. It’s a future in which our every move, our every word, our every relationship is trackable, traceable and data-mineable by unprecedented collaborations between government and tech giants. [...]

1 0

Re: [nexa] Privacy e contact tracing: cosa può andare storto?
by Giuseppe Attardi May 12, 2020

May 12, 2020

L’attacco è ingegnoso, anche se complicato da effettuare, perché richiede l’installazione di malware su due o più dispositivi che si trovino contemporaneamente insieme col terzo da attaccare. Ma se pensiamo di passare attraverso un malware, allora perché limitarsi a individuare l’associazione con il rolling identifier? "Da questo punto in poi, iat sarà associato ad A sino a quando A non lo cambierà.” Un malware può raccogliere ben di più e inviare tutto a un server: posizione geografica, codici bancari, tutto quello che riesce a trovare sullo smartphone. Sarei stato più colpito se l’attacco consentisse di raccogliere informazioni sul terzo dispositivo C, quello non infetto da malware. -- > On 12 May 2020, at 11:08, nexa-request(a)server-nexa.polito.it wrote: > > From: Stefano Quintarelli <stefano(a)quintarelli.it <mailto:stefano@quintarelli.it>> > Cc: nexa(a)server-nexa.polito.it <mailto:nexa@server-nexa.polito.it> > Subject: Re: [nexa] Privacy e contact tracing: cosa può andare > storto? > Message-ID: <469c6920-09db-1a0a-d192-6d00957261f1(a)quintarelli.it <mailto:469c6920-09db-1a0a-d192-6d00957261f1@quintarelli.it>> > Content-Type: text/plain; charset=windows-1252; format=flowed > > cio, > > senza replicare a tutto, risalendo fino a Lo spirito delle leggi e > all'ODHIR, mi concentro sul punto tecnico (*) > > On 09/05/2020 21:13, Giuseppe Attardi wrote: >> I rischi dell’uso dell’attuale app sono stati abbondantemente sviscerati, e per quelli sono state date delle risposte, che personalmente considero soddisfacenti. > > credo che questo nn sia stato preso nella dovuta considerazione > https://www.cybersecurity360.it/nuove-minacce/app-di-contact-tracing-e-vuln… <https://www.cybersecurity360.it/nuove-minacce/app-di-contact-tracing-e-vuln…> > > credo anche che la mitigazione tecnica sia complicata, in ragione della > scelta di base apparentemente effettuata, e che la mitigazione normativa > sarebbe semplice; vediamo se sara' implementata > > > ciao, s. > > > (*) che poi e' anche il senso della mia mail prcendete in cui facevo un > parallelo con la telefonia mobile e, rispetto alla polarizzazione si/no, > invitavo a riflettere sul "come", peraltro con scarso successo essendomi > stato risposto che una procedura che prevede che uno dichiari > direttamente ai propri peer di essere positivo era commendevole, ma non > cosi' un meccaismo di comunicazione anonima > > > -- > reserve your meeting with me at https://cal.quintarelli.it <https://cal.quintarelli.it/> >

2 1

Facebook and the Folly of Self-Regulation | WIRED
by J.C. DE MARTIN May 12, 2020

May 12, 2020

https://www.wired.com/story/facebook-and-the-folly-of-self-regulation/ (Sent from my wireless device; please excuse brevity and typos (if any))

2 1