August 2020 - nexa - server-nexa.polito.it

Re: [nexa] Schrems II e sovranità digitale

by Marco Ciurcina

In data venerdì 7 agosto 2020 14:41:57 CEST, Giovanni Biscuolo ha scritto: > Ho una domanda per favore: ho letto la "Copyright Notice" di questa > pagina https://joinup.ec.europa.eu/joinup/legal-notice e **mi pare** che > sia consentita "solo" la riproduzione (verbatim) con indicazione della > fonte, il che mi impedirebbe di poter pubblicare una traduzione e/o > riutilizzare parte del contenuto in altri documenti (che produrrei in > CC-BY o CC-BY-SA): interpreto bene? Si. m.c.

Aug. 7, 2020

Exposure Notification: Serious privacy and data harvesting concerns about technology underlying HSE app

by Giovanni Biscuolo

Buongiorno, Executive summary: HSE app è l'omologa di Immuni in Irlanda. Per funzionare le contact tracing apps devono usare applicazioni proprietarie (Google Play Service su Android, l'intero iOS su iPhone), che inviano diversi metadati negli USA [1], QUALCUNO dice illegalmente rispetto al GDPR grazie alla sentenza "Shrems II". Il problema NON è specifico delle app per il contact tracing, tuttavia senza quelle applicazioni proprietarie che raccolgono e inviano i metadati, le applicazioni di contact tracing non possono funzionare perché le API di "exposure notification" sono fornite dal componente proprietario; questo significa anche che le app di contact tracing che usano il servizio GAEN (Google/Apple exposure notification) non possono funzionare su versioni modificate (e libere) di AOSP (Android Open Source Project)... che comunque sono installate più o meno sullo 0,00001% dei telefoni :-) https://www.iccl.ie/news/serious-privacy-and-data-harvesting-concerns-about… --8<---------------cut here---------------start------------->8--- Serious privacy and data harvesting concerns about technology underlying HSE app 21 July 2020 Experts have today raised the alarm about serious privacy and data harvesting concerns related to Google Play Services. This software component must be running on the phones of all Android users who wish to use the Covid-19 contact-tracing app rolled out in Ireland. It is also turned on by default on almost all Android phones. Professor Douglas Leith and Dr Stephen Farrell, of Trinity College Dublin, have discovered that Google Play Services sends highly sensitive personal data to Google servers every 20 minutes and this potentially allows for IP address-based location tracking of the phone user. Even where users turn Google Play Services off, data is still collected, possibly in contravention of GDPR. While Android users can, in theory, opt to turn off Google Play Services, users of the Covid-19 contact-tracing app in Ireland cannot turn the surveillance off if they want the contact-tracing app to work. This means the collection and use of this data is unavoidable for people who wish to use the app. The data shared includes long-term, unchangeable identifiers of the phone users, including their phone’s IP address, WiFi MAC address, International Mobile Equipment Identity (IMEI) number, SIM serial number, phone number and Gmail address, as well as fine-grained data from other, potentially sensitive apps, such as banking, dating or health apps. This is data which, when considered together, has the potential to draw a very detailed map of our lives and activities. The two scientists made the discovery while examining the privacy of the Google/Apple Exposure Notification (GAEN) service, the technology which allows public health contact-tracing apps, including that of the HSE, operate across both Android phones and iPhones. Professor Leith commented: “This is extremely troubling from a privacy viewpoint, and of course it goes way beyond the HSE contact-tracing app. But given that governments and public health authorities are strongly encouraging their entire populations to use these apps, and hence are (wittingly or not) pressurising their entire populations to take part in this corporate surveillance, we think they should be telling Google to immediately fix this problem. This level of intrusiveness is simply incompatible with a recommendation for population-wide usage.” Elizabeth Farries, Director of the Information Rights programme at ICCL commented: “The HSE has been celebrated in Ireland and beyond for its transparent approach to developing the Covid-tracker app. However, Google Play Services represent a significant component of the app which is completely opaque – to users and the HSE themselves. Most people, even app developers, are unaware of this level of invasiveness. Without the independent research of these TCD scientists members of the public would not have known that Google is capturing via dragnet significant personal information of all Android app users – with or without the Covid Tracker app.” ICCL flagged concerns about transparency surrounding Google and Apple’s involvement in the HSE app in person with the previous Minister for Health. In our submission to the COVID-19 Oireachtas Committee, we also said the Government must “push for international companies such as Apple and Google to be completely transparent about how their Covid-tracking software works”. --8<---------------cut here---------------end--------------->8--- Saluti, Giovanni. [1] l'articolo parla solo dei metadati inviati da Google Play Services, c'è comunque ampia letteratura anche su sistemi analighi usati su iOS: https://www.gnu.org/proprietary/malware-apple.html otre che quelli di Google https://www.gnu.org/proprietary/malware-google.html -- Giovanni Biscuolo

Aug. 7, 2020

Re: [nexa] Schrems II e sovranità digitale

by Giovanni Biscuolo

Buongiorno Marco, Marco Ciurcina <ciurcina(a)studiolegale.it> writes: > Articolo interessante che spazia dalla sentenza Schrems II al software libero > https://joinup.ec.europa.eu/collection/joinup/news/privacy-shield-invalidat… Grazie! É talmente interessante che vorrei fosse tradotto anche in italiano per poi poterlo riusare come riferimento per il MARKETING del progetto che seguo :-)... oltre che come materiale divulgativo. Ho una domanda per favore: ho letto la "Copyright Notice" di questa pagina https://joinup.ec.europa.eu/joinup/legal-notice e **mi pare** che sia consentita "solo" la riproduzione (verbatim) con indicazione della fonte, il che mi impedirebbe di poter pubblicare una traduzione e/o riutilizzare parte del contenuto in altri documenti (che produrrei in CC-BY o CC-BY-SA): interpreto bene? Mi occuperò di questa cosa nel fine settimana (credo) in un mio spazio personale (repo git privato), nel frattempo spero di chiarire la questione sul copyright. [...] Saluti, Giovanni. -- Giovanni Biscuolo

Aug. 7, 2020

USA Clean Netwotk, l'idea dell'ammistrazione USA di una INternet separata dalla Cina e da apparati Cinesi?

by gabriele elia

interessante vedere gli sviluppi ... https://www.verdict.co.uk/clean-network-china-wall/ Clean Network is a messy roadmap for a digital wall with China Show Hide image [Clean network china] 0Shares <http://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.verdict.co.uk%2Fclea…>Email ticle<mailto:?Subject=Clean%20Network%20is%20a%20messy%20roadmap%20for%20a%20digital%20wall%20with%20China&Body=https%3A%2F%2Fwww.verdict.co.uk%2Fclean-network-china-wall%2F>LinkedIn<http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.verdic…>0<https://twitter.com/intent/tweet?text=Clean+Network+is+a+messy+roadmap+for+…>0<http://pinterest.com/pin/create/link/?url=https://www.verdict.co.uk/clean-n…> Robert Scammell<https://www.verdict.co.uk/author/robertscammell/> Rob is deputy editor at Verdict. You can reach him at robert.scammell(a)verdict.co.uk [Robert Scammell] * Huawei was never going to be enough for Donald Trump. What started as the White House’s 5G Clean Path, an initiative to “secure” critical telecommunications from “malign actors”, has now been expanded to target Chinese mobile apps, Chinese cloud servers and Huawei’s access to US apps. Announced on Wednesday by Secretary of State Mike Pompeo, the Clean Network Program<https://www.state.gov/announcing-the-expansion-of-the-clean-network-to-safe…> has raised concerns that the US will create a so-called “splinternet”, in which the global internet becomes fragmented by location. China already has its own parallel internet, dubbed the “Great Firewall”, where US websites such as Google and Facebook are banned. But will Clean Network lead to something similar in the US, and mark a reversal of America’s long-standing position as a free internet champion? Clean Network is full of uncertainty At the moment, there are too many unknowns at play. First, Pompeo’s announcement is not legally binding and it has not received Congressional funding or approval. It is merely a roadmap – if a messy one with potentially far-reaching consequences. Second, the comparison might be premature given China’s Great Firewall also encompasses state media and information censorship which – for now, at least – is not part of the Clean Network plan. “China telecoms have significant operations in the US and have engaged in massive data sucking operations because of their US-based operations,” said Christopher Balding, associate professor at the Fulbright University Vietnam, via Twitter<https://twitter.com/BaldingsWorld/status/1291198393360855040>. “Blocking their ability to divert all internet traffic in the US through China is not a Great Firewall.” And third, implementing the proposals outlined in Clean Network is likely to be fraught with logistical challenges. “The specifics don’t add up terribly well. They don’t speak to a good understanding of how networks function, or a very clear idea of how this is expected to be implemented,” Maria Farrell, an independent researcher in international tech policy, told The Verge<https://www.theverge.com/2020/8/6/21356948/us-clean-network-purge-chinese-t…>. “That does make it seem like more of a rhetorical exercise.” For example, the ‘Clean Carrier’ aspect aims to prevent Chinese carriers from providing “international telecommunications services to and from the United States”. The State of Technology This Week GET THE VERDICT WEEKLY EMAIL This could create data roaming problems, says Amy Karam, fellow at the Canadian Global Affairs Institute, and author of The China Factor. “If a US citizen is in Kenya and they have a Huawei network, are they not allowed to call home?” she told Verdict. “It’s more a geopolitical statement in my opinion.” Trump’s persistence Geopolitics has been the consistent theme running through Trump’s approach to Chinese technology companies. Washington cited espionage concerns against Huawei as key driver for its allies – including the UK<https://www.verdict.co.uk/huawei-banned-uk-5g/> – to ban the company, but is yet to provide definitive proof of foul play. But what the Trump administration lacks in substance it is making up for in its persistence. On Thursday, Trump signed an executive order banning transactions with ByteDance, the Chinese parent company of popular video-sharing app TikTok, and Chinese tech giant Tencent, parent company of super app WeChat. Both orders will take effect in 45 days, but once again the details behind these moves are scarce and experts say they are likely to face legal challenges. To counter US sanctions, TikTok has sought to distance itself from its Chinese operations. Microsoft is in talks to buy the US arm<https://www.verdict.co.uk/tiktok-microsoft-purchase-surprise/> of the hugely popular app, which could lead to a splintering of brands. WeChat, which is ubiquitous in China but has a smaller presence in the US, was a more surprising inclusion. But it indicates the extent to which the White House is prepared to go to in limiting Chinese technology firms’ presence in the US. The ‘Clean Cloud’ aspect of Clean Network prevents US citizens’ and businesses’ sensitive data being “stored and processed” on cloud-based systems accessible by China. In the borderless world of data transfers, this could see customers of Chinese cloud providers Alibaba, Baidu and Tencent brought into the fray. For example, US car manufacturer Ford and American language-learning app Duolingo are listed as Alibaba cloud customers. It also creates headaches for non-US firms, such as Finnish telecommunications firm Nokia, which has a US presence and customers but counts Tencent and Baidu among its cloud providers. Levelling the playing field However, there could be positives from Clean Network, says Karam. China has long played to a different set of rules to the rest of the world, from its early copying of intellectual property to weaker data protections rules that give it an advantage when training data-hungry artificial intelligence algorithms. “It’s good that the USA is working with allies on addressing the security concerns around networks,” says Karam. “The first step of taking a defence approach, levelling the playing field and getting to the point of heightened security and competitiveness in tech will allow for the current dynamics with China to be recalibrated and hopefully the threats will eventually be mitigated.” Perhaps the biggest unknown in the Clean Network Program is the fate of the man spearheading it. On 3 November, Americans head to the polls. While there is strong bipartisan support for limiting the reach of Chinese tech firms, presumed Democratic nominee Joe Biden is likely to take a more moderate stance than Trump. Should Trump win, however, he will have a mandate and ample time to try and implement his Clean Network proposals. Where Trump failed to build a physical wall between the US and Mexico, he may yet succeed in building a digital wall with China.

Aug. 7, 2020

TJCI - THE CASE FOR BANNING LAW ENFORCEMENT FROM USING FACIAL RECOGNITION TECHNOLOGY

by Diego.Latella

You might be interested in reading: The Justice Collaborative Institute THE CASE FOR BANNING LAW ENFORCEMENT FROM USING FACIAL RECOGNITION TECHNOLOGY https://tjcinstitute.com/research/the-case-for-banning-law-enforcement-from… "The Justice Collaborative Institute is home to a collection of the nation's top scholars and thinkers bound together by a common mission to produce rigorous, practical research that contributes to an America with more dignity and freedom for all of us, starting with those who are the most vulnerable. We translate our research into pragmatic resources for public officials, reporters, advocates, and other scholars, including polling memos, policy briefs, model laws and policies, and amicus briefs." https://tjcinstitute.com/about/ D. Latella -- Dott. Diego Latella - Senior Researcher CNR-ISTI, Via Moruzzi 1, 56124 Pisa, Italy (http:www.isti.cnr.it [1]) FM&&T Lab. (http://fmt.isti.cnr.it) http://www.isti.cnr.it/People/D.Latella - ph: +390506212982, mob: +39 348 8283101, fax: +390506212040 =================== I don't quite know whether it is especially computer science or its subdiscipline Artificial Intelligence that has such an enormous affection for euphemism. We speak so spectacularly and so readily of computer systems that understand, that see, decide, make judgments, and so on, without ourselves recognizing our own superficiality and immeasurable naivete with respect to these concepts. And, in the process of so speaking, we anesthetise our ability to evaluate the quality of our work and, what is more important, to identify and become conscious of its end use. […] One can't escape this state without asking, again and again: "What do I actually do? What is the final application and use of the products of my work?" and ultimately, "am I content or ashamed to have contributed to this use?" -- Prof. Joseph Weizenbaum ["Not without us", ACM SIGCAS 16(2-3) 2--7 - Aug. 1986] Links: ------ [1] http://www.isti.cnr.it

Aug. 7, 2020

Mondo digitale. Giovani e anziani sono più soli. Il paradosso del «tutti collegati»

by don Luca Peyron

Opinioni interessanti... buona lettura dl https://www.avvenire.it/opinioni/pagine/giovani-e-anziani-sono-pi-soli-il-p… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

Aug. 7, 2020

Re: [nexa] Three people just got charged for Twitter’s huge hack, and a Florida teen is in jail

by Giovanni Biscuolo

Buongionro, potenza di Wikipedia, è già una voce bella completa: https://en.wikipedia.org/wiki/2020_Twitter_bitcoin_scam C'è praticamente tutto lo scibile noto su questa vicenda, che racconta in buona sostanza l'anatomia di una *banale* [1] infiltrazione (chiamarlo attacco informatico credo sia fuorviante [2]) per mezzo di social engineering. Il social enginnering è stato egregio, ma la frode è stata maldestramente eseguita, non sono certo dei professionisti del crimine. Non è ancora del tutto chiaro se nell'infiltrazione sia coinvolto un collaboratore di Twitter corrotto, ma allo stato attuale delle informazioni è ALTAMENTE IMPROBABILE visto che non ci sono collaboratori indagati (AFAIK), quindi si tratta di un *banale* phishing. Un buco di sicurezza da anni '90, che manco colossi come Twitter - con migliaia di operatori tra interni e contractors - sono ancora in grado di gestire... sono basito, ma se ci penso bene non dovrei esserlo visto che la formazione sulla sicurezza informatica è solo un bel proposito in *quasi* tutte le organizzazioni: è noiosa e genera solo costi, no? Mi domando se infiltrazioni meno eclatanti di questa - in generale, non con Twitter - siano e saranno passate sotto imbarazzato silenzio :-O Tra le curiosità emerse grazie a questo caso, c'è quella che l'account Twitter dell'attuale presidente USA avrebbe misure di sicurezza aggiuntive e segrete [3] ...tutto ciò evidenzia ancora una volta, se ce ne fosse bisogno, come con le identità digitali (solitamente username/password e codice di secondo livello) siamo messi MALE, ma proprio male male male. Per non parlare della concentrazione in un solo database centralizzato di informazioni e notizie importanti o potenzialmente dirompenti E facilmente manipolabili con una banale interfaccia da un operatore (non dal titolare dell'account): è normale?!? Io dico di no, sono un sistemista, so quello che dico :O In un caso del genere, chi è da condannare?!? Qualsiasi altro fornitore di servizi che subisse una tale compromissione di sicurezza (infiltrazione con accesso amministrativo ai dati) verrebbe letteralmente crocifisso in ordine da: clienti, garante privacy, media. I colossi IT sono un'eccezione, "too big to be blamed"? Giacomo Tesio <giacomo(a)tesio.it> writes: [...] > Continua https://www.theverge.com/2020/7/31/21349920/twitter-hack-arrest-florida-tee… --8<---------------cut here---------------start------------->8--- [...] From the affidavit: To wit: Clark without authorization gain [sic] access to Twitter Inc.’s Customer Service Portal. Clark used social engineering to convince a Twitter employee that he was a co-worker in the IT department and had the employee provide credentials to access the customer service portal. [...] --8<---------------cut here---------------end--------------->8--- Le altre **key features** di questo buco di sicurezza sono: https://www.msn.com/en-in/news/other/twitter-was-hacked-using-employee-cred… --8<---------------cut here---------------start------------->8--- "The attackers successfully manipulated a small number of employees and used their credentials to access Twitter's internal systems, including getting through our two-factor protections," the company said in a blog post on the matter. --8<---------------cut here---------------end--------------->8--- https://www.bleepingcomputer.com/news/security/hackers-stole-twitter-employ… --8<---------------cut here---------------start------------->8--- Twitter says that it has "significantly" limited employees' access to its internal systems and support tools during the ongoing investigation and that it expects response times to some user reports and support needs to be slower until normal operations will be resumed. According to a Reuters report, over 1,000 Twitter contractors and employees had access to the company's internal tools before the attack. --8<---------------cut here---------------end--------------->8--- https://www.bloomberg.com/news/articles/2020-07-27/twitter-s-security-woes-… --8<---------------cut here---------------start------------->8--- Twitter Inc. has struggled for years to police the growing number of employees and contractors who have the ability to reset users’ accounts and override their security settings, a problem that Chief Executive Officer Jack Dorsey and the board were warned about multiple times since 2015, according to former employees with knowledge of the company’s security operations. Twitter’s oversight over the 1,500 workers who reset accounts, review user breaches and respond to potential content violations for the service’s 186 million daily users have been a source of recurring concern, the employees said. [...] The controls were so porous that at one point in 2017 and 2018 some contractors made a kind of game out of creating bogus help-desk inquiries that allowed them to peek into celebrity accounts, including Beyonce’s, to track the stars’ personal data including their approximate locations gleaned from their devices’ IP addresses, two of the former employees said. --8<---------------cut here---------------end--------------->8--- Saluti, Giovanni. [1] https://en.wikipedia.org/wiki/Phishing#Spear_phishing [2] almeno quanto è offensivo chiamarlo hack e chiamare gli infiltrati hackers [3] https://web.archive.org/web/20200716223043/https://www.nytimes.com/2020/07/… P.S.: il vero problema è che le persone non dovrebbero aver bisogno di sili centralizzati sotto il controllo di terzi per pubblicare le loro informazioni o per informarsi; in particolare: possibile che LE ISTITUZIONI non abbiano a disposizione un canale ufficiale dove "le elites" possano cinguettare le proprie elucubrazioni?!? Le prossime elezioni USA saranno determinate dai Tweets? La prossima guerra mondiale verrà dichiarata con un Tweet? -- Giovanni Biscuolo

Aug. 7, 2020

Morte di Bernard Stiegler

by Antonio Casilli

https://www.liberation.fr/direct/element/le-philosophe-bernard-stiegler-est…

Aug. 7, 2020

Re: [nexa] No to Blockchain Credentials of COVID-19 Test Results for Entry to Public Spaces

by Stefano Quintarelli

non conosco i dettagli per andare in certi luoghi occorre la vaccinazione contro la febbre gialla attestata da un libretto di vaccinazione. (cartaceo) perche' non digitalizzarlo, se digitalizzato bene ? questo mi sembra un buon use case di SSI https://www.covidcreds.com/ ciao, s. On 06/08/2020 23:58, Giacomo Tesio wrote: > An ill-conceived California bill endorses a blockchain-based system that would turn COVID-19 test results into permanent records that could be used to grant access to public places. > EFF and ACLU oppose California A.B. 2004. The newest version of this bill would create a pilot program for using “verifiable health credentials” to report COVID-19 and other medical test results. The bill defines such a credential as “a portable electronic patient record,” for which authenticity “can be independently verified cryptographically.” The bill’s fact sheet explains that these credentials “use blockchain technology” to create “a provable health record” for purpose of “travel, returning to employment, immunization status, and so on.” Three rounds of official bill analysis provide the same explanation. > > This bill is a blockchain solution in search of a problem, and COVID-19 is a problem that will not be so easily solved. > > > Continua su https://www.eff.org/deeplinks/2020/08/no-blockchain-credentials-covid-19-te… > > > > Giacomo > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa > -- reserve your meeting with me at https://cal.quintarelli.it

Aug. 7, 2020

No to Blockchain Credentials of COVID-19 Test Results for Entry to Public Spaces

by Giacomo Tesio

An ill-conceived California bill endorses a blockchain-based system that would turn COVID-19 test results into permanent records that could be used to grant access to public places. EFF and ACLU oppose California A.B. 2004. The newest version of this bill would create a pilot program for using “verifiable health credentials” to report COVID-19 and other medical test results. The bill defines such a credential as “a portable electronic patient record,” for which authenticity “can be independently verified cryptographically.” The bill’s fact sheet explains that these credentials “use blockchain technology” to create “a provable health record” for purpose of “travel, returning to employment, immunization status, and so on.” Three rounds of official bill analysis provide the same explanation. This bill is a blockchain solution in search of a problem, and COVID-19 is a problem that will not be so easily solved. Continua su https://www.eff.org/deeplinks/2020/08/no-blockchain-credentials-covid-19-te… Giacomo

Aug. 6, 2020