August 2020 - nexa - server-nexa.polito.it

No to Blockchain Credentials of COVID-19 Test Results for Entry to Public Spaces
by Giacomo Tesio Aug. 8, 2020

Aug. 8, 2020

An ill-conceived California bill endorses a blockchain-based system that would turn COVID-19 test results into permanent records that could be used to grant access to public places. EFF and ACLU oppose California A.B. 2004. The newest version of this bill would create a pilot program for using “verifiable health credentials” to report COVID-19 and other medical test results. The bill defines such a credential as “a portable electronic patient record,” for which authenticity “can be independently verified cryptographically.” The bill’s fact sheet explains that these credentials “use blockchain technology” to create “a provable health record” for purpose of “travel, returning to employment, immunization status, and so on.” Three rounds of official bill analysis provide the same explanation. This bill is a blockchain solution in search of a problem, and COVID-19 is a problem that will not be so easily solved. Continua su https://www.eff.org/deeplinks/2020/08/no-blockchain-credentials-covid-19-te… Giacomo

3 3

Three people just got charged for Twitter’s huge hack, and a Florida teen is in jail
by Giacomo Tesio Aug. 8, 2020

Aug. 8, 2020

Early this morning, the FBI, IRS, US Secret Service, and Florida law enforcement placed a 17-year-old in Tampa, Florida, under arrest — accusing him of being the “mastermind” behind the biggest security and privacy breach in Twitter’s history... “This was not an ordinary 17-year old,” said the state attorney... “This could have had a massive, massive amount of money stolen from people, it could have destabilized financial markets within America and across the globe; because he had access to powerful politicians’ Twitter accounts, he could have undermined politics as well as international diplomacy,” [...] “This is not a game... these are serious crimes with serious consequences, and if you think you can rip people off online and get away with it, you’ll be in for a rude awakening, a rude awakening that comes in the form of a 6 AM knock on your door from federal agents,” he added later. Continua https://www.theverge.com/2020/7/31/21349920/twitter-hack-arrest-florida-tee… Per la serie: "GUARDA MAMMA: IL RE E' NUDO ! ! !" "Impiccate quel bambino." Giacomo

2 3

Italia digitale a macchia di leopardo, il gap tra territori frena lo sviluppo
by don Luca Peyron Aug. 8, 2020

Aug. 8, 2020

Rapporto della Corte dei Conti Buona lettura dl https://www.corrierecomunicazioni.it/pa-digitale/italia-digitale-a-macchia-… Qui il comunicato della Corte https://www.corteconti.it/HOME/StampaMedia/ComunicatiStampa/DettaglioComuni… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

Harvard to Track Affiliates’ Wi-Fi Signals as Part of Contact Tracing Pilot | News | The Harvard Crimson
by Alberto Cammozzo Aug. 8, 2020

Aug. 8, 2020

<https://www.thecrimson.com/article/2020/8/2/tracefi-wifi-contract-tracing-c…> Harvard began piloting Tracefi — a Wi-Fi-based contact tracing system — this past Friday in preparation for freshmen and a select group of upperclassmen students’ return to campus later this month. Tracefi uses the signals phones, laptops, and tablets constantly emit to Harvard’s Wi-Fi infrastructures to gather three pieces of information: a datetime stamp, the signal strength received by Harvard’s Wi-Fi infrastructure, and the MAC address of the mobile device. The system then stores the data for up to 28 days. Harvard will use the Tracefi data to aid contract tracing efforts run by Harvard University Health Services and Harvard University Information Technology by providing information to human contact tracers about the specific whereabouts of infected individuals. “We all want Harvard to return to lab research and on-campus activities safely, and we want our undergraduates to return to campus too,” Tracefi’s website reads. “One of the safety precautions Harvard wants in place to achieve this vision is the ability to notify a person who was in a building that she came into contact with someone who later tested positive for COVID-19. Timely notification can help her seek prompt testing for herself and protect her family and others from exposure.” The website explains that the data collected from the Wi-Fi information does not contain personally identifiable information, and that HUHS will only access relevant data if a patient tests positive for COVID-19. People can choose to opt-out of Tracefi by turning off Wi-Fi service on their device, the info page for the program notes. [...]

1 0

Come mai Hideo Kojima, creatore di videogiochi, è nella giuria del Festival del Cinema di Venezia
by don Luca Peyron Aug. 7, 2020

Aug. 7, 2020

La trasformazione digitale ed i cambi di scenario culturali. Buona lettura dl https://artslife.com/2020/07/29/come-mai-hideo-kojima-creatore-di-videogioc… ______________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

Re: [nexa] Three people just got charged for Twitter’s huge hack, and a Florida teen is in jail
by Giovanni Biscuolo Aug. 7, 2020

Aug. 7, 2020

Ciao, Giacomo Tesio <giacomo(a)tesio.it> writes: [...] > Non condivido invece questa nota: > > Il August 7, 2020 9:12:24 AM UTC, Giovanni Biscuolo > <giovanni(a)biscuolo.net> ha scritto: >> >> [2] almeno quanto è offensivo chiamarlo hack e chiamare gli >> infiltrati hackers > > Io non lo trovo offensivo. Al di là delle competenze tecniche > impiegate, ciò che distingue l'hack da una truffa cibernetica è il > movente dell'hacker, ovvero acquisire e diffondere conoscenza. Esatto: questa è l'essenza della cultura hacker. > Ora, in questo caso, si è trattato di un hack o no? [...] > ma in questo caso no: le credenziali in questione erano accessibili a > chiunque sapesse come accedervi. Sì concordo: le tecniche di social engineering sono un hack, non un atto criminale (non c'è violenza o coercizione). [...] > E mentre che c'erano, come ciliegina sulla torta, si saranno chiesti: > quanto capiscono di informatica le vittime di Bitcoin? E hanno > risposto anche a questa domanda. Ho capito: tu dici che il pishing sul phishing lo hanno fatto appositamente per caricare di ulteriore significato l'hack; se fosse così sarebbe geniale, un doppio hack carpiato :-D [...] > Dunque dall'esterno il comportamento di questi hacker è stato > estremamente etico: hanno arricchito rapidamente le conoscenze > dell'umanità. E l'hanno fatto da veri hacker, scatenando tutta una > serie di altre domande che meritano risposte urgenti ed > importanti. Peccato che pochissimi le colgano. Se davvero la loro raccolta di Bitcoin fosse stata effettuata in modo così smaccatamente tracciabile per farsi poi beccare allora ti darei pienamente ragione... ma non ho elementi sufficienti per giudicare > Da hacker, io li riconosco come miei pari. E trovo offensivo che li > si sminuisca o criminalizzi Concordo, non era comunque mia intenzione: anche se avessero commesso frode sui Bitcoin andrebbero assolti per manifesta superiorità :-O > Dovremmo premiarli, non punirli. Hanno mostrato che il re è nudo E > che il popolo è credulone. Sai che mi hai *quasi* convinto :-D [...] Ciao, Gio' -- Giovanni Biscuolo

1 0

USA Clean Netwotk, l'idea dell'ammistrazione USA di una INternet separata dalla Cina e da apparati Cinesi?
by gabriele elia Aug. 7, 2020

Aug. 7, 2020

interessante vedere gli sviluppi ... https://www.verdict.co.uk/clean-network-china-wall/ Clean Network is a messy roadmap for a digital wall with China Show Hide image [Clean network china] 0Shares <http://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.verdict.co.uk%2Fclea…>Email ticle<mailto:?Subject=Clean%20Network%20is%20a%20messy%20roadmap%20for%20a%20digital%20wall%20with%20China&Body=https%3A%2F%2Fwww.verdict.co.uk%2Fclean-network-china-wall%2F>LinkedIn<http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.verdic…>0<https://twitter.com/intent/tweet?text=Clean+Network+is+a+messy+roadmap+for+…>0<http://pinterest.com/pin/create/link/?url=https://www.verdict.co.uk/clean-n…> Robert Scammell<https://www.verdict.co.uk/author/robertscammell/> Rob is deputy editor at Verdict. You can reach him at robert.scammell(a)verdict.co.uk [Robert Scammell] * Huawei was never going to be enough for Donald Trump. What started as the White House’s 5G Clean Path, an initiative to “secure” critical telecommunications from “malign actors”, has now been expanded to target Chinese mobile apps, Chinese cloud servers and Huawei’s access to US apps. Announced on Wednesday by Secretary of State Mike Pompeo, the Clean Network Program<https://www.state.gov/announcing-the-expansion-of-the-clean-network-to-safe…> has raised concerns that the US will create a so-called “splinternet”, in which the global internet becomes fragmented by location. China already has its own parallel internet, dubbed the “Great Firewall”, where US websites such as Google and Facebook are banned. But will Clean Network lead to something similar in the US, and mark a reversal of America’s long-standing position as a free internet champion? Clean Network is full of uncertainty At the moment, there are too many unknowns at play. First, Pompeo’s announcement is not legally binding and it has not received Congressional funding or approval. It is merely a roadmap – if a messy one with potentially far-reaching consequences. Second, the comparison might be premature given China’s Great Firewall also encompasses state media and information censorship which – for now, at least – is not part of the Clean Network plan. “China telecoms have significant operations in the US and have engaged in massive data sucking operations because of their US-based operations,” said Christopher Balding, associate professor at the Fulbright University Vietnam, via Twitter<https://twitter.com/BaldingsWorld/status/1291198393360855040>. “Blocking their ability to divert all internet traffic in the US through China is not a Great Firewall.” And third, implementing the proposals outlined in Clean Network is likely to be fraught with logistical challenges. “The specifics don’t add up terribly well. They don’t speak to a good understanding of how networks function, or a very clear idea of how this is expected to be implemented,” Maria Farrell, an independent researcher in international tech policy, told The Verge<https://www.theverge.com/2020/8/6/21356948/us-clean-network-purge-chinese-t…>. “That does make it seem like more of a rhetorical exercise.” For example, the ‘Clean Carrier’ aspect aims to prevent Chinese carriers from providing “international telecommunications services to and from the United States”. The State of Technology This Week GET THE VERDICT WEEKLY EMAIL This could create data roaming problems, says Amy Karam, fellow at the Canadian Global Affairs Institute, and author of The China Factor. “If a US citizen is in Kenya and they have a Huawei network, are they not allowed to call home?” she told Verdict. “It’s more a geopolitical statement in my opinion.” Trump’s persistence Geopolitics has been the consistent theme running through Trump’s approach to Chinese technology companies. Washington cited espionage concerns against Huawei as key driver for its allies – including the UK<https://www.verdict.co.uk/huawei-banned-uk-5g/> – to ban the company, but is yet to provide definitive proof of foul play. But what the Trump administration lacks in substance it is making up for in its persistence. On Thursday, Trump signed an executive order banning transactions with ByteDance, the Chinese parent company of popular video-sharing app TikTok, and Chinese tech giant Tencent, parent company of super app WeChat. Both orders will take effect in 45 days, but once again the details behind these moves are scarce and experts say they are likely to face legal challenges. To counter US sanctions, TikTok has sought to distance itself from its Chinese operations. Microsoft is in talks to buy the US arm<https://www.verdict.co.uk/tiktok-microsoft-purchase-surprise/> of the hugely popular app, which could lead to a splintering of brands. WeChat, which is ubiquitous in China but has a smaller presence in the US, was a more surprising inclusion. But it indicates the extent to which the White House is prepared to go to in limiting Chinese technology firms’ presence in the US. The ‘Clean Cloud’ aspect of Clean Network prevents US citizens’ and businesses’ sensitive data being “stored and processed” on cloud-based systems accessible by China. In the borderless world of data transfers, this could see customers of Chinese cloud providers Alibaba, Baidu and Tencent brought into the fray. For example, US car manufacturer Ford and American language-learning app Duolingo are listed as Alibaba cloud customers. It also creates headaches for non-US firms, such as Finnish telecommunications firm Nokia, which has a US presence and customers but counts Tencent and Baidu among its cloud providers. Levelling the playing field However, there could be positives from Clean Network, says Karam. China has long played to a different set of rules to the rest of the world, from its early copying of intellectual property to weaker data protections rules that give it an advantage when training data-hungry artificial intelligence algorithms. “It’s good that the USA is working with allies on addressing the security concerns around networks,” says Karam. “The first step of taking a defence approach, levelling the playing field and getting to the point of heightened security and competitiveness in tech will allow for the current dynamics with China to be recalibrated and hopefully the threats will eventually be mitigated.” Perhaps the biggest unknown in the Clean Network Program is the fate of the man spearheading it. On 3 November, Americans head to the polls. While there is strong bipartisan support for limiting the reach of Chinese tech firms, presumed Democratic nominee Joe Biden is likely to take a more moderate stance than Trump. Should Trump win, however, he will have a mandate and ample time to try and implement his Clean Network proposals. Where Trump failed to build a physical wall between the US and Mexico, he may yet succeed in building a digital wall with China.

2 1

Exposure Notification: Serious privacy and data harvesting concerns about technology underlying HSE app
by Giovanni Biscuolo Aug. 7, 2020

Aug. 7, 2020

Buongiorno, Executive summary: HSE app è l'omologa di Immuni in Irlanda. Per funzionare le contact tracing apps devono usare applicazioni proprietarie (Google Play Service su Android, l'intero iOS su iPhone), che inviano diversi metadati negli USA [1], QUALCUNO dice illegalmente rispetto al GDPR grazie alla sentenza "Shrems II". Il problema NON è specifico delle app per il contact tracing, tuttavia senza quelle applicazioni proprietarie che raccolgono e inviano i metadati, le applicazioni di contact tracing non possono funzionare perché le API di "exposure notification" sono fornite dal componente proprietario; questo significa anche che le app di contact tracing che usano il servizio GAEN (Google/Apple exposure notification) non possono funzionare su versioni modificate (e libere) di AOSP (Android Open Source Project)... che comunque sono installate più o meno sullo 0,00001% dei telefoni :-) https://www.iccl.ie/news/serious-privacy-and-data-harvesting-concerns-about… --8<---------------cut here---------------start------------->8--- Serious privacy and data harvesting concerns about technology underlying HSE app 21 July 2020 Experts have today raised the alarm about serious privacy and data harvesting concerns related to Google Play Services. This software component must be running on the phones of all Android users who wish to use the Covid-19 contact-tracing app rolled out in Ireland. It is also turned on by default on almost all Android phones. Professor Douglas Leith and Dr Stephen Farrell, of Trinity College Dublin, have discovered that Google Play Services sends highly sensitive personal data to Google servers every 20 minutes and this potentially allows for IP address-based location tracking of the phone user. Even where users turn Google Play Services off, data is still collected, possibly in contravention of GDPR. While Android users can, in theory, opt to turn off Google Play Services, users of the Covid-19 contact-tracing app in Ireland cannot turn the surveillance off if they want the contact-tracing app to work. This means the collection and use of this data is unavoidable for people who wish to use the app. The data shared includes long-term, unchangeable identifiers of the phone users, including their phone’s IP address, WiFi MAC address, International Mobile Equipment Identity (IMEI) number, SIM serial number, phone number and Gmail address, as well as fine-grained data from other, potentially sensitive apps, such as banking, dating or health apps. This is data which, when considered together, has the potential to draw a very detailed map of our lives and activities. The two scientists made the discovery while examining the privacy of the Google/Apple Exposure Notification (GAEN) service, the technology which allows public health contact-tracing apps, including that of the HSE, operate across both Android phones and iPhones. Professor Leith commented: “This is extremely troubling from a privacy viewpoint, and of course it goes way beyond the HSE contact-tracing app. But given that governments and public health authorities are strongly encouraging their entire populations to use these apps, and hence are (wittingly or not) pressurising their entire populations to take part in this corporate surveillance, we think they should be telling Google to immediately fix this problem. This level of intrusiveness is simply incompatible with a recommendation for population-wide usage.” Elizabeth Farries, Director of the Information Rights programme at ICCL commented: “The HSE has been celebrated in Ireland and beyond for its transparent approach to developing the Covid-tracker app. However, Google Play Services represent a significant component of the app which is completely opaque – to users and the HSE themselves. Most people, even app developers, are unaware of this level of invasiveness. Without the independent research of these TCD scientists members of the public would not have known that Google is capturing via dragnet significant personal information of all Android app users – with or without the Covid Tracker app.” ICCL flagged concerns about transparency surrounding Google and Apple’s involvement in the HSE app in person with the previous Minister for Health. In our submission to the COVID-19 Oireachtas Committee, we also said the Government must “push for international companies such as Apple and Google to be completely transparent about how their Covid-tracking software works”. --8<---------------cut here---------------end--------------->8--- Saluti, Giovanni. [1] l'articolo parla solo dei metadati inviati da Google Play Services, c'è comunque ampia letteratura anche su sistemi analighi usati su iOS: https://www.gnu.org/proprietary/malware-apple.html otre che quelli di Google https://www.gnu.org/proprietary/malware-google.html -- Giovanni Biscuolo

1 0

TJCI - THE CASE FOR BANNING LAW ENFORCEMENT FROM USING FACIAL RECOGNITION TECHNOLOGY
by Diego.Latella Aug. 7, 2020

Aug. 7, 2020

You might be interested in reading: The Justice Collaborative Institute THE CASE FOR BANNING LAW ENFORCEMENT FROM USING FACIAL RECOGNITION TECHNOLOGY https://tjcinstitute.com/research/the-case-for-banning-law-enforcement-from… "The Justice Collaborative Institute is home to a collection of the nation's top scholars and thinkers bound together by a common mission to produce rigorous, practical research that contributes to an America with more dignity and freedom for all of us, starting with those who are the most vulnerable. We translate our research into pragmatic resources for public officials, reporters, advocates, and other scholars, including polling memos, policy briefs, model laws and policies, and amicus briefs." https://tjcinstitute.com/about/ D. Latella -- Dott. Diego Latella - Senior Researcher CNR-ISTI, Via Moruzzi 1, 56124 Pisa, Italy (http:www.isti.cnr.it [1]) FM&&T Lab. (http://fmt.isti.cnr.it) http://www.isti.cnr.it/People/D.Latella - ph: +390506212982, mob: +39 348 8283101, fax: +390506212040 =================== I don't quite know whether it is especially computer science or its subdiscipline Artificial Intelligence that has such an enormous affection for euphemism. We speak so spectacularly and so readily of computer systems that understand, that see, decide, make judgments, and so on, without ourselves recognizing our own superficiality and immeasurable naivete with respect to these concepts. And, in the process of so speaking, we anesthetise our ability to evaluate the quality of our work and, what is more important, to identify and become conscious of its end use. […] One can't escape this state without asking, again and again: "What do I actually do? What is the final application and use of the products of my work?" and ultimately, "am I content or ashamed to have contributed to this use?" -- Prof. Joseph Weizenbaum ["Not without us", ACM SIGCAS 16(2-3) 2--7 - Aug. 1986] Links: ------ [1] http://www.isti.cnr.it

1 0

Mondo digitale. Giovani e anziani sono più soli. Il paradosso del «tutti collegati»
by don Luca Peyron Aug. 7, 2020

Aug. 7, 2020

Opinioni interessanti... buona lettura dl https://www.avvenire.it/opinioni/pagine/giovani-e-anziani-sono-pi-soli-il-p… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0