May 2020 - nexa - server-nexa.polito.it

Articolo Nature su Contact Tracing

by Roberto Dolci

https://www.nature.com/articles/d41586-020-01514-2 Ieri in call con Alex Vespignani e Maurizio Fava ho appreso che la paura non fa 90 ma fa un +12% di maggior compliance nell'uso della maschera ed in generale delle regole di prudenza per il contenimento del corona. Quest'articolo riprende il tema del grado di adozione dello strumento, ed il sentimento di sfiducia verso governo/autorita' Ciao roberto

May 20, 2020

Re: [nexa] Siri, l’assistente vocale Apple non solo risponde ma ascolta - Il Fatto Quotidiano

by Enrico Nardelli

C'è anche questo articolo del Guardian (ad accesso libero) che ha segnalato Fabio Chiusi su Twitter ---- A former Apple contractor who helped blow the whistle on the company’s programme to listen to users’ Siri recordings has decided to go public, in protest at the lack of action taken as a result of the disclosures. In a letter announcing his decision, sent to all European data protection regulators, Thomas le Bonniec said: “It is worrying that Apple (and undoubtedly not just Apple) keeps ignoring and violating fundamental rights and continues their massive collection of data. “I am extremely concerned that big tech companies are basically wiretapping entire populations despite European citizens being told the EU has one of the strongest data protection laws in the world. Passing a law is not good enough: it needs to be enforced upon privacy offenders.” Le Bonniec, 25, worked as a subcontractor for Apple in its Cork offices, transcribing user requests in English and French, until he quit in the summer of 2019 due to ethical concerns with the work. “They do operate on a moral and legal grey area,” he told the Guardian at the time, “and they have been doing this for years on a massive scale. They should be called out in every possible way.” ... https://www.theguardian.com/technology/2020/may/20/apple-whistleblower-goes… Il 20/05/2020 12:19, J.C. DE MARTIN ha scritto: > > https://www.ilfattoquotidiano.it/in-edicola/articoli/2020/05/20/siri-lassis… > > > (Sent from my wireless device; please excuse brevity and typos (if any)) > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa > -- EN ===================================================================== Prof. Enrico Nardelli Dipartimento di Matematica - Universita' di Roma "Tor Vergata" Via della Ricerca Scientifica snc - 00133 Roma tel: +39 06 7259.4204 fax: +39 06 7259.4699 mobile: +39 335 590.2331 e-mail: nardelli(a)mat.uniroma2.it home page: http://www.mat.uniroma2.it/~nardelli blog: http://www.ilfattoquotidiano.it/blog/enardelli/ http://link-and-think.blogspot.it/ ===================================================================== --

May 20, 2020

Siri, l’assistente vocale Apple non solo risponde ma ascolta - Il Fatto Quotidiano

by J.C. DE MARTIN

https://www.ilfattoquotidiano.it/in-edicola/articoli/2020/05/20/siri-lassis… (Sent from my wireless device; please excuse brevity and typos (if any))

May 20, 2020

Inferring distance from Bluetooth signal strength: a deep dive

by Giacomo Tesio

https://medium.com/personaldata-io/inferring-distance-from-bluetooth-signal… In sostanza, Google e Apple cercano di ridefinire il concetto di contact tracing per adattarlo ai cellulari. Ma NON faranno contact tracing, perché non funzionerebbe. Mica scemi! (loro) Giacomo Contact tracing apps intend to predict exposure to a COVID-19 infection, where exposure is computed as some function of time and distance to an infected person. The distance is inferred from Bluetooth signal strength, which is a step that has not been empirically tested properly. We review evidence coming from the developing teams of what might or might not work to deduce distance from Bluetooth signal strength, and eventually question whether this is truly the goal of all those who implement contact tracing apps. [...] # Apple & Google APIs It is very hard at the moment to know how Apple & Google intend to let apps infer distance from signal strength. In fact, every indication seems to be that they don’t intend to do that. They seem to want the apps to instead infer transmission risk from signal strength directly. Caveat: There seem to be changes, between v1.2 (cryptography, Bluetooth) and v1.3.1 (Android) of their protocol that relates to precisely this point. There is certainly divergence between Google and Apple, at least in the documentation available, since Google’s Android API v1.3.1 mentions AttenuationThresholds while iOS’ API doesn’t. For the moment, one thing we can productively evaluate is the core of the API already made available. It shows how the risk calculation will be derived. We include a few screenshots below of Android vs iOS. Android API for configuring the Exposure Risk calculation (taken from Android API v1.2, now superseded by v1.3 which doesn’t include the graphic anymore; v1.3 changes the way attenuationScores are computed) iOS ENExposureConfiguration (no version number available) Note that there are subtle but significant differences between the two: the range of the parameter values start at 0 or 1, and more crucially the final risk is calculated multiplicatively resp. additively. Definition of the parameters presented above, in the iOS API. We see that the attenuation is averaged to just one number, that is then passed to the app. Based on the fact that a simple average is returned instead of the actual sampled signal attenuation values, and all the difficulties outlined above, I infer that the Apple and Google APIs intend only to help apps deduce the infection risk from Bluetooth measurements, and not the distance itself (which could then be fed into epidemiological models). The Apple and Google APIs thus change the definition of the notion of contact for epidemiological purposes. Inferring infection risk from Bluetooth signal strength instead of distance is not a neutral act. Almost everyone is equal in understanding and assessing a recommendation of social distantiation of 2 meters, and able to discuss the politics of remediation for those who are not capable of following this rule. As a society, we also have much more common cognitive basis for discussing the politics tied to manual contact tracing and the consequences that follow from that process (for instance in carefully balancing false positives and negatives in manual contact tracing). With Bluetooth-based proximity tracing leveraging the Google and Apple API, we lose that common cognitive basis. Apple and Google get to define the rules, and will progressively get to introduce new data as input (if indeed, like everyone else, they conclude this is a necessity). It also will lead to a substantive shift in what constitutes a false positive and a false negative.

May 20, 2020

Bluetooth BIAS attack threatens billions of devices

by Giacomo Tesio

https://securityaffairs.co/wordpress/103480/hacking/bias-attack-bluetooth.h… "The Bluetooth specification is affected by security flaws..." Non è la prima... non sarà l'ultima. ;-) Giacomo Boffins disclosed a security flaw in Bluetooth, dubbed BIAS, that could potentially be exploited by an attacker to spoof a remotely paired device. Researchers from École Polytechnique Fédérale de Lausanne (EPFL) discovered a vulnerability in Bluetooth, dubbed Bluetooth Impersonation AttackS or BIAS, that could potentially be exploited by an attacker to spoof a remotely paired device. The issue potentially impact over a billion of devices. “To establish an encrypted connection, two Bluetooth devices must pair with each other using a link key. It is possible for an unauthenticated, adjacent attacker to impersonate a previously paired/bonded device and successfully authenticate without knowing the link key. This could allow an attacker to gain full access to the paired device by performing a Bluetooth Impersonation Attack (BIAS).” reads the vulnerability note VU#647177. The Bluetooth specification is affected by security flaws that could allow attackers to carry out impersonation attacks while establishing a secure connection. For BIAS attack to be successful, the attacker has to use a device that would need to be within wireless range of a vulnerable Bluetooth device that has previously established a BR/EDR bonding with a remote device with a Bluetooth address known to the attacker. To establish an encrypted connection, two Bluetooth devices must pair with each other using a link key, aka long term key. The experts explained that the flaw results from how two previously paired devices handle the link key. The link key allows two paired devices to maintain the connection every time a data is transferred between the two devices. The experts discovered that it is possible for an unauthenticated attacker within the wireless range of a target Bluetooth device to spoof the address of a previously paired remote device to successfully complete the authentication procedure with some paired/bonded devices without knowing the link key. “The Bluetooth standard includes a legacy authentication procedure and a secure authentication procedure, allowing devices to authenticate to each other using a long term key. Those procedures are used during pairing and secure connection establishment to prevent impersonation attacks. In this paper, we show that the Bluetooth specification contains vulnerabilities enabling to perform impersonation attacks during secure connection establishment.” reads the research paper. “Such vulnerabilities include the lack of mandatory mutual authentication, overly permissive role switching, and an authentication procedure downgrade.” The researchers reported their findings to the Bluetooth Special Interest Group (SIG), in December 2019. “The researchers identified that it is possible for an attacking device spoofing the address of a previously bonded remote device to successfully complete the authentication procedure with some paired/bonded devices while not possessing the link key. This may permit an attacker to negotiate a reduced encryption key strength with a device that is still vulnerable to the Key Negotiation of Bluetooth attack disclosed in 2019.” reads the advisory published by the Bluetooth SIG. “If the encryption key length reduction is successful, an attacker may be able to brute force the encryption key and spoof the remote paired device. If the encryption key length reduction is unsuccessful, the attacker will not be able to establish an encrypted link but may still appear authenticated to the host.” Experts explained that combining the BIAS attack with other attacks, such as the KNOB (Key Negotiation of Bluetooth) attack, the attacker van brute-force the encryption key and use it to decrypt communications. “The BIAS and KNOB attacks can be chained to impersonate a Bluetooth device, complete authentication without possessing the link key, negotiate a session key with low entropy, establish a secure connection, and brute force the session key” states the paper. Experts tested the attack against as many as 30 Bluetooth devices and discovered that all of them were found to be vulnerable to BIAS attacks. The Bluetooth SIG has addressed the vulnerability announcing the introduction of changes into a future specification revision. The SIG recommends Bluetooth users to install the latest updates from the device and operating system manufacturers. “The BIAS attacks are the first uncovering issues related to Bluetooth’s secure connection establishment authentication procedures, adversarial role switches, and Secure Connections downgrades,” the paper concludes. “The BIAS attacks are stealthy, as Bluetooth secure connection establishment does not require user interaction.”

May 20, 2020

Bando CS PNT

by Monica A. Senor

Cari tutti, mi permetto di promuovere in lista, anche quest’anno, l’interessante bando per l’attribuzione di un premio per tesi di laurea magistrale o di dottorato di ricerca su temi legati al rapporto tra protezione dei dati personali e innovazione tecnologica istituito dal Centro Studi Privacy e Nuove Tecnologie. Scadenza imminente: 31 maggio! Buona serata, Monica

May 19, 2020

Jennifer Cobbe, Elettra Bietti: Ripensare le piattaforme digitali per l'era post Covid-19

by Roberto Resoli

Non credo sia passato in lista; la necessità di elaborare nuove forme di partecipazione digitale: "Costruire un nuovo ecosistema di piattaforme. È ora più chiaro che mai che dobbiamo ricostruire i legami di comunità, solidarietà e società. Dobbiamo reinventare la nostra società e la nostra economia digitale, con nuove istituzioni, nuove strutture e nuovi spazi di comunicazione e di connessione. Il paradigma della piattaforma per i servizi online non è di per sé un problema, ma dobbiamo ripensare radicalmente il modo in cui le piattaforme sono organizzate e il loro funzionamento. Questo passo, naturalmente, è solo il primo di molti nel processo di riforma strutturale della gestione delle piattaforme. Un nuovo ecosistema di piattaforme non deve lasciare le infrastrutture sociali nelle mani delle aziende tecnologiche private. Deve includere spazi digitali di interazione e comunicazione dove il profitto non sia la logica dominante, dove le persone non siano soggette a sorveglianza e manipolazione, dove la comunità e la solidarietà possano svilupparsi libere dal controllo capitalistico, e dove le esigenze della società siano prioritarie rispetto agli interessi del capitale e degli azionisti. Come potrebbero essere queste piattaforme future? Per iniziare a rispondere a questo, dobbiamo considerare quattro elementi: proprietà, struttura, funzione e governance. ..." https://www.cigionline.org/articles/rethinking-digital-platforms-post-covid… Traduzione Italiana: https://www.linuxtrent.it/nextcloud/index.php/s/jRCJ7mixQZ7aaGM rob

May 19, 2020

Audizione Senato DDL direttiva CC IT

by deborah de angelis

Cari tutti, ho il piacere di informarvi che anche il Capitolo italiano di Creative Commons è stato audito lo scorso 14 maggio al Senato per esprimere il proprio parere sulla trasposizione della direttiva 2019/790/EU (c.d. Copyright. Per guardare l'intervento cliccate qui 👇 (minuto 3:42:58) http://webtv.senato.it/4621?video_evento=80701 Per leggere la relazione completa cliccate qui 👇: https://creativecommons.it/chapterIT/index.php/1124/ Un caro saluto Deborah DDA Studio Legale ------------------------------------------------ Avv. Deborah De Angelis 00195 Roma (RM), Via Giuseppe Ferrari, 2 Tel. +39 06 59871248 www.ddastudiolegale.it info(a)ddastudiolegale.it skype: deb.dda Il presente messaggio, corredato dei relativi allegati contiene informazioni da considerarsi strettamente riservate, ed è destinato esclusivamente al destinatario sopra indicato. Chiunque ricevesse questo messaggio per errore o comunque lo leggesse senza esserne legittimato è avvertito che trattenerlo, copiarlo, divulgarlo, distribuirlo a persone diverse dal destinatario è severamente proibito e, nel caso, è pregato di rinviarlo immediatamente al mittente distruggendo l'originale. This message, together with its annexes, contains information to be deemed strictly confidential and is destined only to the addressee(s) identified above. If anyone received this message by mistake or reads it without entitlement is forewarned that keeping, copying, disseminating or distributing this message to persons other than the addressee(s) is strictly forbidden and is asked to transmit it immediately to the sender and to erase the original message received.

May 19, 2020

Re: [nexa] Algorithms associating appearance and criminality have a dark past

by Giovanni Biscuolo

don Luca Peyron <dluca.universitari(a)gmail.com> writes: > Lombroso ieri ed oggi, > > Buona lettura e buona domenica > > https://aeon.co/ideas/algorithms-associating-appearance-and-criminality-hav… Grazie don Luca! Credo che questo sia uno dei migliori articoli sul tema che ho letto negli ultimi due anni. Illustra in modo preciso, chiaro e incontrovertibile come dare forma algoritmica a una teoria pseudoscientifica NON serva a far diventare scientifica tale teoria ma solo a rendere RIDICOLO l'algoritmo, anche se purtroppo in molti lo prendono sul serio. Mio personalissimo executive-summary (verbatim): --8<---------------cut here---------------start------------->8--- The problem with reinventing physiognomy is not merely that it has been tried without success before. Researchers who persist in looking for cold fusion after the scientific consensus has moved on also face criticism for chasing unicorns – but disapproval of cold fusion falls far short of opprobrium. At worst, they are seen as wasting their time. The difference is that the potential harms of cold fusion research are much more limited. In contrast, some commentators argue that facial recognition should be regulated as tightly as plutonium, because it has so few nonharmful uses. When the dead-end project you want to resurrect was invented for the purpose of propping up colonial and class structures – and when the only thing it’s capable of measuring is the racism inherent in those structures – it’s hard to justify trying it one more time, just for curiosity’s sake. --8<---------------cut here---------------end--------------->8--- L'algoritmo è nudo :-) [...] Cordiali slauti, Giovanni -- Giovanni Biscuolo

May 19, 2020

L'app magica di Yoshua Bengio

by Antonio Casilli

Notizia dal Québec: Yoshua Bengio ha finalmente presentato la sua applicazione di contact tracing che è doppiamente magica, perché è anonima e in più c'è anche l'IA. "COVI utilizza l'intelligenza artificiale per dare ai cittadini la possibilità di proteggersi, limitare la diffusione del virus e facilitare l'allentamento sicuro e informato delle misure di distanziatione sociale da parte delle autorità sanitarie". https://www.indexsante.ca/nouvelles/845/yoshua-bengio-et-ses-collaborateurs… Il grosso dell'annuncio concerne la pubblicazione di un grosso documento LaTeX, ottimisticamente definito "libro bianco" che spiega come funziona l'applicazione. https://mila.quebec/wp-content/uploads/2020/05/COVI-whitepaper-V1-1.pdf La cosa interessante è che, a differenza della quasi totalità dei documenti di questo tipo, questo non è stato fatto da criptografi, quindi non parla solo ed esclusivamente di anonimizzazione e privacy, come se i dati smettessero di esistere una volta raccolti. Qui c'è un minimo di approfondimento sui modelli epidemiologici usati per valutare lo score di rischio delle persone tracciate. Ed è proprio qui che ho incontrato un po' di difficoltà e se qualcuno della lista potesse aiutarmi a capire meglio la parte di ABM/ML, gliene sarei grato. "We have trained a machine learning predictor in a supervised way using data generated from the simulator, using a simple contact tracing heuristic to generate the messages. To obtain preliminary results measuring the impact of using machine learning to predict contagiousness and obtain risk level messages, we have then used that predictor inside the simulator to influence the behavior of the agents according to four levels of recommendations associated with different thresholds of risk levels. This has allowed us to simulate (with different random seeds than those used for generating training data), how the ML predictor would impact the reproduction number Rt of the disease and the growth of infections in a small pilot population of 1000 (it is indexed by time t because it can evolve over time, depending on the recommendations received by citizens from public health authorities and their app). The simulation was performed with the assumption that 60% of the population was using the app and users at the strongest level of recommendation (quarantine level) got tested. " In parole povere, un gruppo di scienziati ha progettato una simulazione multi-agenti piena di bias e di assunzioni legate alla loro percezione non-specialistica della realtà sociale, ha fatto annotare i dati così ottenuti da micro-lavoratori le cui condizioni di lavoro sono sconosciute, ha utilizzato il predittore così ottenuto all'interno della stessa simulazione di prima, assumendo un livello di adozione (60%) mai osservato in un contesto empirico. Perché dovremmo fidarci dell'app magica di Yoshua Bengio? Cheers, ---a -- Antonio A. Casilli Professor, Telecom Paris, Institut Polytechnique de Paris Member, Interdisciplinary Institute for Innovation (i3 UMR 9217 CNRS) Associate Member, LACI-IIAC (EHESS) Faculty Fellow, Nexa Center for Internet & Society *We respect your right to disconnect. This email send time is due to my own workflow efficiency. You are in no obligation to take action or reply to it outside your office hours.*

May 19, 2020