June 2020 - nexa - server-nexa.polito.it

Eredità digitale
by Diego Giorio June 18, 2020

June 18, 2020

I legali in lista potranno dare una valutazione più puntuale; io l'ho trovato interessante. Saluti a tutti D. https://www.altalex.com/guide/eredita-digitale-cos-a-e-come-si-puo-trasmett…

2 1

segnalazione seminario "Identità culturale e digitalizzazione della propaganda di odio razziale" - 22 giugno
by Marina Caporale June 18, 2020

June 18, 2020

Cari Nexiani, mi permetto di segnalarvi un seminario che si terrà su Teams, con accesso aperto a tutti. Il seminario chiude un ciclo di sei incontri, tutti a carattere interdisciplinare anche se prevalentemente giuridico, sul tema dell'identità che abbiamo pensato con Corrado Caruso, responsabile scientifico, e Matilde Ratti. Sperando di incontrarvi in questa e altre prossime occasioni, Marina Identità culturale e digitalizzazione della propaganda di odio razziale Lunedì 22 giugno 2020, ore 15.00 Online, all’indirizzo https://www.urly.it/36v8s Introduce e modera Tommaso Giupponi (Università di Bologna) Discutono Alessandro Dal Lago (Università di Genova) Marcella Delle Donne (Università di Roma La Sapienza) Stefano Pasta (Università Cattolica del Sacro Cuore) Emanuela Fronza (Università di Bologna) Conclude il ciclo di seminari Andrea Morrone (Università di Bologna) Marina Caporale http://www.unibo.it/docenti/marina.caporale [cid:6122800d-27d1-42ea-a051-9585b855891d]

1 0

Now Is the Time to Dismantle Our Cities’ Invasive Surveillance Infrastructure
by J.C. DE MARTIN June 18, 2020

June 18, 2020

Now Is the Time to Dismantle Our Cities’ Invasive Surveillance Infrastructure Not all innovation deserves to exist — many surveillance and policing technologies should never have been created in the first place Jathan Sadowski Jun 17 · 5 min read https://onezero.medium.com/now-is-the-time-to-dismantle-our-cities-invasive… (Sent from my wireless device; please excuse brevity and typos (if any))

2 1

End-to-End Encryption Update - Zoom Blog
by Alberto Cammozzo June 18, 2020

June 18, 2020

La end-to-end encryption di Zoom ha fatto diversi passi avanti e indietro, incluso quello di renderla disponibile solo agli abbonati. L'ultimo è questo: disponibile per tutti, anche gli utenti non registrati, a condizione che non siano anonimi: devono fornire dati personali atti a reindentificarli, come il numero di telefono. La ragione fornita è "to reduce the mass creation of abusive accounts", ma immagino sia anche perché almeno i metadati siano attribuibili a soggetti identificabili (e il n. di telefono è il tipico "selector") Per alcuni non è esclusa la possibilità è che Zoom sia costretto a conservare le chiavi per poterle consegnare a richiesta, stile Hushmail (<https://www.wired.com/2007/11/encrypted-e-mai/>). Sempre che queste non siano già disponibili, come già sospettato ad inizio aprile <https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-a…>. In ogni caso, software proprietario... caveat emptor. Alberto Il post nel blog di Zoom è qui: <https://blog.zoom.us/wordpress/2020/06/17/end-to-end-encryption-update/> Since releasing the draft design of Zoom’s end-to-end encryption (E2EE) on May 22, we have engaged with civil liberties organizations, our CISO council, child safety advocates, encryption experts, government representatives, our own users, and others to gather their feedback on this feature. We have also explored new technologies to enable us to offer E2EE to all tiers of users. Today, Zoom released an updated E2EE design on GitHub. We are also pleased to share that we have identified a path forward that balances the legitimate right of all users to privacy and the safety of users on our platform. This will enable us to offer E2EE as an advanced add-on feature for all of our users around the globe – free and paid – while maintaining the ability to prevent and fight abuse on our platform. To make this possible, Free/Basic users seeking access to E2EE will participate in a one-time process that will prompt the user for additional pieces of information, such as verifying a phone number via a text message. Many leading companies perform similar steps on account creation to reduce the mass creation of abusive accounts. We are confident that by implementing risk-based authentication, in combination with our current mix of tools — including our Report a User function — we can continue to prevent and fight abuse. [...]

1 0

Riskin, "Just Use Your Thinking Pump!"
by J.C. DE MARTIN June 18, 2020

June 18, 2020

Non si parla di digitale, se non di sfuggita, ma segnalo comunque questa splendida recensione della storica Jessica Riskin perché tratta in pieno le radici epistemologiche del Centro Nexa e quindi anche di questa lista. Buona lettura, juan carlos *---------- **Just Use Your Thinking Pump!* Jessica Riskin July 2, 2020 /The Scientific Method: An Evolution of Thinking from Darwin to Dewey // //by Henry M. Cowles// //Harvard University Press, 372 pp., $35.00/ A few years ago, when my daughter was in middle school, she had to study for a quiz on “the five steps of the scientific method.” She had no problem memorizing five words in a given order, but she also had to be ready to explain them, and there she ran into trouble, until she was seized by a bright idea: here was a chance for her mother, who taught and wrote about the history of science, to make herself useful. “I guess it makes sense for it to be observation, hypothesis, prediction, experiment, confirmation,” she said to me, “but why couldn’t it be hypothesis, observation, prediction, experiment, confirmation? Or prediction, observation, confirmation, hypothesis, experiment? Or…” “Exactly,” I interrupted, before she could offer me all 120 permutations of the five words. Then, rather than solving her problem, I made it worse. (What are mothers for?) “They could really go in any order. Actually, I think they’re likelier to occur simultaneously. Also, they could include plenty of other parts, like comparison, formalization, analogy, interpretation, visualization…” She gave me her “parents are charming but of scant utility” look and turned back to her notes. If only I could have referred her to Henry M. Cowles’s The Scientific Method: An Evolution of Thinking from Darwin to Dewey. Cowles’s book doesn’t solve her problem either, but makes it into a much bigger and more interesting phenomenon. (What are books for?) [...] Continua qui: https://www.nybooks.com/articles/2020/07/02/just-use-your-thinking-pump/

2 1

Coronavirus: Alarm over 'invasive' Kuwait and Bahrain contact-tracing apps - BBC News
by Alberto Cammozzo June 17, 2020

June 17, 2020

<https://www.bbc.com/news/world-middle-east-53052395> Kuwait and Bahrain have rolled out some of the most invasive Covid-19 contact-tracing apps in the world, putting the privacy and security of their users at risk, Amnesty International says. The rights group found the apps were carrying out live or near-live tracking of users' locations by uploading GPS co-ordinates to a central server. It urged the Gulf states to stop using them in their current forms. Norway has halted the roll-out of its app because of similar concerns. The country's data protection authority said the app represented a disproportionate intrusion into users' privacy given the low rate of infection there. Researchers at Amnesty's Security Lab carried out a technical analysis of 11 apps in Algeria, Bahrain, France, Iceland, Israel, Kuwait, Lebanon, Norway, Qatar, Tunisia and the United Arab Emirates. Bahrain's "BeAware Bahrain" and Kuwait's "Shlonik" stood out, along with Norway's "Smittestopp", as being among the most alarming mass surveillance tools, according a report published on Tuesday. Most contact-tracing apps rely solely on Bluetooth signals, but Bahrain and Kuwait's capture location data through GPS and upload this to a central database, tracking the movements of users in real time. The researchers say Bahraini and Kuwaiti authorities would easily be able to link this sensitive personal information to an individual, as users are required to register with a national ID number. Other countries' contact tracing apps assure users' anonymity. Accessing such data could help authorities tackle Covid-19, but Claudio Guarnieri, head of Amnesty's Security Lab, said the apps were "running roughshod over people's privacy, with highly invasive surveillance tools which go far beyond what is justified". Image caption Authorities in Kuwait have reported 36,400 cases of Covid-19 and 298 deaths Mr Guarnieri added: "They are essentially broadcasting the locations of users to a government database in real time - this is unlikely to be necessary and proportionate in the context of a public health response. Technology can play a useful role in contact tracing to contain Covid-19, but privacy must not be another casualty as governments rush to roll out apps." Mohammed al-Maskati, a Bahraini activist who is the Middle East digital protection co-ordinator for the human rights group Front Line Defenders, said there was also a concern the information collected by the apps might be shared with third parties. Bahrain's app was linked to a television show called "Are You At Home?", which offered prizes to users who stayed at home during Ramadan.

2 1

An algorithm was taken to court – and it lost (which is great news for the welfare state) - The Correspondent
by Alberto Cammozzo June 17, 2020

June 17, 2020

<https://thecorrespondent.com/276/an-algorithm-was-taken-to-court-and-it-los…> An algorithm was taken to court in the Netherlands last week. The System Risk Indication (SyRI) has been legal since 2014 and is intended to detect any social security fraud – benefits, taxes, you name it. SyRI combines all kinds of data sources and dumps them into an algorithm. Then suspects roll out who are scrutinised because they’re supposedly more likely to commit fraud. The police and the public prosecutor can also access SyRI’s analyses. In response, a coalition consisting of a large labour union, organisations, and even writers took the state to court. And last Wednesday, this diverse group was vindicated. The judge ruled that SyRI is against the law and violates the European Convention on Human Rights, which stipulates that every citizen has the right to protection of their private life. The ruling has damaged SyRI’s credibility, but it’s also important in the fight against a much bigger development: the digitisation of the welfare state. Because a system like SyRI is not unique. The digital welfare state is advancing all around the world. A digital dystopia "[T]here is a grave risk of stumbling zombie-like into a digital welfare dystopia." These words aren’t from a sensational column or an alarmist conspiracy blog; they’re from a United Nations (UN) report from October 2019. (Not exactly a place where you’d expect to find zombies.) Philip Alston, the UN Special Rapporteur on extreme poverty and human rights who wrote the report, is deeply concerned. His report mentions Universal Credit, the UK social security payment that was designed to simplify the British benefits system. The system, which was the first major government service in the UK to be "digital by default", means people have to apply for their benefits online, prove online that they have applied for jobs, and provide required documents online. But even in a wealthy country like the UK in 2019, some 12 million adults, 22% of the population, do not have the "essential digital skills" needed for day-to-day life. Another 19% can’t perform a "fundamental" task like opening an app. And about four million adults are offline because of fears that the internet is an insecure environment – mostly those who are poorer and older. It’s become much more difficult for them to access the welfare state. Alston also mentions Australia, where the government implemented far-reaching automation to calculate who had received too many benefits or other allowances. The government used to flag 20,000 wrongful payments per year, but when the "Robodebt" programme was launched, this rose to as many as 20,000 per week. People quickly received hefty fines. And the onus was not on the government to prove wrongdoing – instead, it was people themselves who had to prove that the accusation was wrongful. A judge ruled that the method behind the calculation was wrong. Terry Carney from the University of Sydney said that could mean as many as 300,000 alleged debts should be repaid with interest, amounting to as much as A$660m. Alston’s report gives more examples, from India to Canada, to South Africa and Sweden. Again and again, he shows that the digitisation of the welfare state leaves poor people out in the cold. Not only that – it’s violating their human rights. [...]

1 0

EDPS Opinion on Data -European Strategy
by Oreste Pollicino June 17, 2020

June 17, 2020

https://edps.europa.eu/sites/edp/files/publication/20-06-16_opinion_data_st… [La tua firma può scrivere un futuro. Aiuta gli studenti meritevoli a costruire il proprio. Dai il tuo 5x1000 alla Bocconi C.F. 80024610158] Please note that the above message is addressed only to individuals filing Italian income tax returns. 5x1000 is a percentage of Italian personal income tax that taxpayers can allocate to Universities, scientific research and non profit organizations.

1 0

Zoom Not Offering End-to-End Encryption to Free Users to Help Law Enforcement | SecurityWeek.Com
by Alberto Cammozzo June 17, 2020

June 17, 2020

<https://www.securityweek.com/zoom-not-offering-end-end-encryption-free-user…> Zoom’s chief executive revealed on Tuesday that free users will not be offered end-to-end encryption as the company wants to assist the FBI and local law enforcement in their investigations. Zoom’s popularity has increased significantly since the start of the COVID-19 pandemic due to many people being forced to work and study from home. This popularity has also attracted the attention of privacy and security experts, who have identified some serious issues in the video conferencing service, as well as the attention of bad actors who have started abusing the platform. Zoom has promised to take action and it has already started implementing measures that would help it address security and privacy concerns. One of these measures is related to end-to-end encryption. Zoom does encrypt communications between clients and its servers, but it currently does not offer true end-to-end encryption, which would prevent even the company itself from gaining access to the content of customers’ communications.Zoom end-to-end encryption Last month, the company published a detailed draft of the cryptographic design it plans on using for its upcoming end-to-end encryption feature, which it said would be offered to paying customers and schools. During a conference call following the release of financial results for the first quarter of fiscal year 2021, Zoom CEO Eric Yuan told investors that they do not want to offer this kind of protection to free users, which are more likely to abuse the platform, as the company wants to work with the FBI and local law enforcement if people use Zoom for “bad purposes.” In a long thread on Twitter, Alex Stamos, who was hired by Zoom as an outside advisor on cybersecurity, shared some details on the company’s plans for end-to-end encryption, which he says “are complicated by the product requirements for an enterprise conferencing product and some legitimate safety issues.” Stamos, who in the past worked as CSO at Yahoo and Facebook, said Zoom does not proactively monitor meeting content and it does not plan on doing so in the future. He says the vast majority of abuse comes from people who use Zoom for free and the company plans on taking measures that would “create friction and reduce harm.” Stamos pointed out that if end-to-end encryption is enabled, Zoom’s Trust and Safety team will not be able to enter a meeting they believe to be abusive — this is now possible without end-to-end encryption — and there will be no backdoor to facilitate such access. Stamos also noted that some meeting features are also incompatible with end-to-end encryption. This is why end-to-end encryption will be opt-in “for the foreseeable future.” “So we have to design the system to securely allow hosts to opt-into an E2E meeting and to carefully communicate the current security guarantees to hosts and attendees,” Stamos said. Zoom’s revenue for the first quarter was $328 million and the company expects to generate up to $1.8 billion this fiscal year, with an estimated profit of up to $380 million.

1 0

Google Faces Privacy Lawsuit Over Tracking Users in Incognito Mode | Threatpost
by Alberto Cammozzo June 17, 2020

June 17, 2020

<https://threatpost.com/google-faces-privacy-lawsuit-over-tracking-users-in-…> A $5 billion class-action lawsuit filed in a California federal court alleges that Google’s Chrome incognito mode collects browser data without people’s knowledge or consent. Google faces a $5 billion class-action lawsuit over claims that it has been collecting people’s browsing information without their knowledge even when using the incognito browsing mode that’s meant to keep their online activities private. The lawsuit, filed in the federal court in San Jose, California, alleges that Google compiles user data through Google Analytics, Google Ad Manager and other applications and website plug-ins, including smartphone apps, regardless of whether users click on Google-supported ads, according to a report in Reuters. Google uses this data to learn about private browsing habits of Chrome users, ranging from seemingly innocuous data that can be used for ad-targeting—such as information about hobbies, interests and favorite foods—to the “most intimate and potentially embarrassing things” that people may search for online, according to the complaint. Google “cannot continue to engage in the covert and unauthorized data collection from virtually every American with a computer or phone,” the complaint said, according to the report. The technology problem at the root of the report is a feature called incognito mode in the Chrome browser, which ironically is one that is supposed to protect people when surfing the internet. Chrome users can turn on incognito mode to protect their browsing history, sessions and cookies from websites that want to use this information for marketing or ad-targeting purposes. Google Chrome incognito modeHowever, the feature has long had a problem in that even when using their mode, people’s activity has still been detectable by websites “for years” due to a FileSystem API implementation, Google Chrome developer Paul Irish tweeted last year. Though Google said it implemented the FileSystem API in a different way in Chrome 76, released last year, the problem persists even in the latest version of Chrome 83, which was released last month, according to a report filed Thursday in ZDNet. It is still possible to detect incognito mode in Chrome–as well as other Chromium-based browsers, such as Edge, Opera, Vivaldi, and Brave, which share the core of Chrome’s codebase, according to the report, which said Google still has not set a timeframe to fix the issue. Developers even have taken the Chrome codebase scripts to expand the ability of websites to block incognito mode users from browsing, expanding it to other browsers that don’t use the same code base, including Firefox and Safari, the report said. Ironically, the problem that’s put Google in legal hot water is nearly the same as the one the company accused browser rival Apple of having earlier this year in its Safari browser. In January, Google researchers said they identified a number of security flaws in Safari’s private-browsing feature—called Intelligent Tracking Protection–that allow people’s browsing behavior to be tracked by third parties. Apple responded by saying it had already fixed the flaws in an update to Webkit technology in Safari. Search-engine rival Duck Duck Go used news of the class-action suit as an opportunity to laud its own technology, which it offers as an alternative to Google search as a way to allow people to search and use the web privately. Incognito mode isn't private. It never was. DuckDuckGo is private. Will always be. https://t.co/bz5VmjurQW — DuckDuckGo (@DuckDuckGo) June 3, 2020 “Incognito mode isn’t private. It never was.” the company said on Twitter. “DuckDuckGo is private. Will always be.” Longtime Google critic, author, psychologist and researcher for the American Institute for Behavioral Research and Technology Dr. Robert Epstein also took to Twitter to reiterate his longstanding public opinion over Google’s privacy violations. “#Google #Surveillance & Advertising just got sued for $5 BILLION for lying about its bogus ‘incognito’ mode on its Chrome browser,” he tweeted. “As I’ve always said, you’re STILL being tracked when you’re in that mode.” The current case against the technology giant is Brown et al v Google LLC et al, U.S. District Court, Northern District of California, No. 20-03664. The New York-based law firm Boies Schiller & Flexner is representing the plaintiffs in the class-action suit, Chasom Brown, Maria Nguyen and William Byatt.

1 0