August 2020 - nexa - server-nexa.polito.it

L’Europa ritrovi la sovranità tecnologica

by don Luca Peyron

Tema caldo, un intervento da chi ha un ruolo chiave per agire. Buona lettura dl https://www.ilsole24ore.com/art/l-europa-ritrovi-sovranita-tecnologica-ADdW… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

Aug. 26, 2020

Re: [nexa] Police Want Your Smart Speaker—Here's Why | WIRED

by Giacomo Tesio

On August 25, 2020 4:24:07 PM UTC, Giovanni Biscuolo <giovanni(a)biscuolo.net> wrote: >Detto in altre parole, il problema NON è la sorveglianza [2], ma la >sorveglianza DI MASSA, anche se solo *potenzialmente* possibile e non >praticata (comunque è praticata, almeno in altri contesti). Beh, anche la sorveglianza PREVENTIVA, senza alcuna garanzia giuridica è un problema. Il fatto che sia un male comune non dovrebbe tranquillizzare nessuno. Il fatto che sia operata da aziende, ancora meno. >Non Edmund Locard, il pioniere della scienza forense, ma un incrocio >fra Big Brother di 1984 e i precog di Minority Report. Bello questo parallelo con Minority Report. C'è però un vantaggio rispetto a quello scenario fantascientifico: queste aziende potrebbero creare prove false senza che nessuno sia in grado di smentirle. Senza Minority Report, appunto. Giacomo

Aug. 26, 2020

Using Google's location tracking can put innocents in jail.

by Giacomo Tesio

Geofencing requests - despite violating privacy rights - are being issued more frequently in the US every year. [...] The most recent example is Zachary McCoy, who was the prime suspect in a case of burglary due to a bike ride. Data from his fitness app showed that he had passed a burglarized home in his neighborhood three times during the timeframe of the burglary. As police had no clue who might have been the burglar, they sent a geofencing warrant to Google. [...] Being scared, his parents dipped into their savings to pay thousands of dollars to a lawyer to make sure their son would not go to prison for a crime that he never committed. The case against Zachary was eventually closed, but it shows that even when being innocent, you can still be in the wrong place at the wrong time - and in some cases you can even get jailed for being at the wrong place as another example from Arizona shows. # Being jailed because of Google data In 2018 an innocent man was jailed for six days in Avondale, Arizona, because his Google data showed that he had been at the scene of a shooting where one person was murdered. To make things worse his car had been spotted on surveillance cameras in the area as well. Later it turned out that the suspect's stepfather had used his car and had a device with him, on which the suspect's Google credentials where logged in. By now, the innocent suspect has filed a lawsuit against the authorities because while prosecutors never pursued charges against him, he lost his job, his car and his reputation due to the investigation, during which the police also released his full name in a press release. He was also unable to find a new job because a quick Google search showed that he had been investigated for murder so he did not pass background checks. # Tracking and geofencing The two cases show one thing very clearly: Al data that is accessible, is being used - whether you like it or not, even whether Google likes it or not. Google has to comply with warrants as any other company in the world. The problem is that today much more data about us exists than we can even imagine. The authorities are quickly learning how to get hold of this data, and despite the fact that general geofencing warrants are violating privacy rights, these are widely issued by judges in the US. # Fishing expeditions by the police Google said in a court filing last year that the requests from state and federal law enforcement authorities were increasing rapidly: by more than 1,500 percent from 2017 to 2018, and by 500 percent from 2018 to 2019. "This fishing expedition infringes on the privacy rights of so many possible people who had the misfortune of being in an area where a crime is alleged to be committed," said Jerome Greco, staff attorney at the Legal Aid Society to Forbes. "We should not allow for such broad access to the data of so many on the mere speculation that a suspect may have used a cellphone near the location of the crime." Police officers described the data they obtained from Google as "incredible". People would not realize to what extent they are being tracked - not by the government, but by private companies such as Google. Continua su https://tutanota.com/blog/posts/google-tracking-suspect/ Giacomo

Aug. 26, 2020

Re: [nexa] Police Want Your Smart Speaker—Here's Why | WIRED

by Giovanni Biscuolo

Buongionro, "J.C. DE MARTIN" <demartin(a)polito.it> writes: > https://www.wired.com/story/star-witness-your-smart-speaker/ --8<---------------cut here---------------start------------->8--- Earlier this month, Amazon said it had received more than 3,000 requests from police for user data in the first half of this year, and complied almost 2,000 times. That was a 72 percent increase in requests from the same period in 2016, when Amazon first disclosed the data, and a 24 percent jump in the past year alone. Amazon doesn’t provide granular data on what police are seeking, but Douglas Orr, head of the criminal justice department at the University of North Georgia, says police now look for smart home data as routinely as data from smartphones. Data on a smartphone often points officers towards other devices, which they then probe as the investigation continues. By amending a search warrant, police can “keep going to keep collecting data,” Orr says. “That usually leads to an Echo or at least some other device.” As Orr explains, officers are getting more savvy about smart home devices, creating templates that simplify requesting data. Police departments often share these templates, he says, tailoring requests for the specifics of the case they’re investigating. Google’s Nest unit reported increasing police demands for data from its smart speakers through 2018. Google then stopped reporting Nest data separately, including such requests in its broader corporate transparency report, which shows increased requests for Google user data. --8<---------------cut here---------------end--------------->8--- Colgo l'occasione per dire cose che agli "addetti ai lavori" suonano ovvie ma ci tengo a sottolineare che la *peculiarità* di questo modus operandi NON consiste nella raccolta, a seguito di un crimine, delle eventuali registrazioni ambientali disponibili da parte degli investigatori. La *peculiarità* consiste nel fatto che le registrazioni ambiantali sono richieste al venditore del dispositivo (che le raccoglie e conserva) INVECE di essere SEQUESTRATE sul luogo del delittto. Tutti saremmo felici di poterci difendere da un'accusa falsa [1] se avessimo a disposizione una registrazione ambientale a riprova, ma il fatto che TUTTO sia registrato e conservato dal produttore (e fornitore del servizio) ha un SENSIBILE impatto sulla nostra vita quotidiana, di diversi ordini di grandezza peggiore della mancanza di una registrazione ambientale nell'eventualità fossimo ingiustamente accusati. [...] Detto in altre parole, il problema NON è la sorveglianza [2], ma la sorveglianza DI MASSA, anche se solo *potenzialmente* possibile e non praticata (comunque è praticata, almeno in altri contesti). Non Edmund Locard, il pioniere della scienza forense, ma un incrocio fra Big Brother di 1984 e i precog di Minority Report. Saluti, Giovanni. [1] o dimostrare l'adulterio del partner in una causa di divorzio… sembra una puntata di Black Mirror :-O [2] quella raccontata nell'articolo non è nemmeno tecnicamente sorveglianza ma investigazione successiva al crimine -- Giovanni Biscuolo

Aug. 25, 2020

Re: [nexa] Blockchain, the amazing solution for almost nothing - The Correspondent

by Alberto Cammozzo

Vendere cose inutili è il cuore del consumismo e la missione del marketing: "stregone" è il markettaro più del tecnico. Un distributed ledger è un tipo di database, e come tale immagino possa servire in certi casi, o forse meno: abbiamo libri pieni di algoritmi che non si usano o si usano solo in casi particolari. Chi usa ancora database reticolari? Quanto al lavoro di manutenzione, condivido in pieno. La mitologia dell'"homo faber siliconensis" ci nasconde che il nostro fragile mondo digitale sta in piedi soprattutto per via di una maggioranza di colleghi che sono decisamente più simili ad un "animal laborans", per dirla con la Arendt. <https://xkcd.com/2347/> Ciao, Alberto On 25/08/2020 16:32, Giovanni Biscuolo wrote: > Alberto Cammozzo via nexa <nexa(a)server-nexa.polito.it> writes: > >> Blockchain, the amazing solution for almost nothing >> Economics correspondent at De Correspondent >> Jesse Frederik >> >> <https://thecorrespondent.com/655/blockchain-the-amazing-solution-for-almost…> > Grazie! Ooooh come m'è piaciuto questo articolo! > > Non è "solo" di blockchain che si parla; in particolare mi incornicio > questo: > > --8<---------------cut here---------------start------------->8--- > > [...] He spends half his time yelling at his screen in frustration, > while he programmes strips of duct tape to repair creaky PHP script from > years and years ago. > > [...] Councillors and managers think that problems – however large and > fundamental they are – evaporate instantaneously thanks to technology > they’ve heard about in a fancy PowerPoint presentation. How will it > work? Who cares! Don’t try to understand it, just reap the benefits! > > [...] This is the market for magic, and that market is big. Whether it’s > about blockchain, big data, cloud computing, AI or other buzzwords. > > [...] The smartest thing about blockchain, Matt Levine wrote, is that > the rest of the world was forced to “pay attention to those back-office > technology upgrades, and to think that they might be revolutionary”. > > --8<---------------cut here---------------end--------------->8--- > > Per far funzionare i sistemi digitali ci vuole certo competenza ma anche > tanta pazienza, tanto lavoro, una discreta passione e un briciolo di > spirito di sacrificio… per quello che un mio amico chiama «il lavoro > sporco di chi pulisce le fognature digitali» :-) > > Un pensiero di solidarietà a tutti coloro che - nel retro degli uffici - > spendono buona parte del loro tempo lavorativo a "sbattere la testa" per > scovare e sistemare l'ennesimo bug del software o capire perché quel > sottosistema IT ha misteriosamente smesso di colpo di funzionare. > > Scienziati e tecnici, non stregoni :-D > > > Happy hacking! Giovanni > > [...] > > > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa

Aug. 25, 2020

Re: [nexa] Blockchain, the amazing solution for almost nothing - The Correspondent

by Giovanni Biscuolo

Alberto Cammozzo via nexa <nexa(a)server-nexa.polito.it> writes: > Blockchain, the amazing solution for almost nothing > Economics correspondent at De Correspondent > Jesse Frederik > > <https://thecorrespondent.com/655/blockchain-the-amazing-solution-for-almost…> Grazie! Ooooh come m'è piaciuto questo articolo! Non è "solo" di blockchain che si parla; in particolare mi incornicio questo: --8<---------------cut here---------------start------------->8--- [...] He spends half his time yelling at his screen in frustration, while he programmes strips of duct tape to repair creaky PHP script from years and years ago. [...] Councillors and managers think that problems – however large and fundamental they are – evaporate instantaneously thanks to technology they’ve heard about in a fancy PowerPoint presentation. How will it work? Who cares! Don’t try to understand it, just reap the benefits! [...] This is the market for magic, and that market is big. Whether it’s about blockchain, big data, cloud computing, AI or other buzzwords. [...] The smartest thing about blockchain, Matt Levine wrote, is that the rest of the world was forced to “pay attention to those back-office technology upgrades, and to think that they might be revolutionary”. --8<---------------cut here---------------end--------------->8--- Per far funzionare i sistemi digitali ci vuole certo competenza ma anche tanta pazienza, tanto lavoro, una discreta passione e un briciolo di spirito di sacrificio… per quello che un mio amico chiama «il lavoro sporco di chi pulisce le fognature digitali» :-) Un pensiero di solidarietà a tutti coloro che - nel retro degli uffici - spendono buona parte del loro tempo lavorativo a "sbattere la testa" per scovare e sistemare l'ennesimo bug del software o capire perché quel sottosistema IT ha misteriosamente smesso di colpo di funzionare. Scienziati e tecnici, non stregoni :-D Happy hacking! Giovanni [...] -- Giovanni Biscuolo

Aug. 25, 2020

US Border Patrol Says They Can Create Central Repository Of Traveler Emails, Keep Them For 75 Years

by Giovanni Biscuolo

Buongiorno, l'ennesimo capitolo della querelle in merito alla "Border Search Exeption" sulla perquisizione e copia integrale del contenuto dei dispositivi elettronici (fino a 100 miglia dal confine, all'interno ovviamente). [1] ...meno male che c'è "il cloud"! :-D «US Border Patrol Says They Can Create Central Repository Of Traveler Emails, Keep Them For 75 Years» https://viewfromthewing.com/us-border-patrol-says-they-can-create-central-r… --8<---------------cut here---------------start------------->8--- The U.S. government has taken the opportunity during the global pandemic, when people aren’t traveling out of the country much, to roll out a new platform for storing information they believe they are entitled to take from people crossing the border. A new filing reveals how the U.S. Border Patrol will store data from traveler devices centrally, keeping it backed up and searchable for up to 75 years. On July 30 the Department of Homeland Security published a privacy impact assessment detailing the electronic data that they may choose to collect from people crossing the border – and what happens to that data. * Border Patrol claims the right to search laptops, thumb drives, cell phones, and other devices capable of storing electronic information” and when they call it a ‘border search the can do this not just when you’re “crossing the U.S. border” in either direction (i.e. when you’re leaving, not just when you’re entering the country) but even “at the extended border” which generally means within 100 miles of the border, which encompasses where two-thirds of the U.S. population lives. * They needed an updated privacy impact assessment because of a new “enterprise-wide solution to manage and analyze certain types of information and metadata USBP collects from electronic devices” – and they they actually keep on file. Border Patrol will “acquire a mirror copy of the data on the device” they take from a traveler and store it locally. Before uploading it to their network they check to make sure there’s no porn on it (so they search your devices to find porn first). Then once they’ve determined it’s “clean” they transfer the data first to an encrypted thumb drive and then to the Border Patrol-side system called PLX. Examples of what they plan to keep from travelers’ devices include e-mails; videos and pictures; texts and chat messages; financial accounts and transactions; location history; web browser bookmarks; tasks list; calendar; call logs; contracts. Information is stored for 75 years although if it’s not related to any crime it may be deleted after 20 years. The government emphasizes they’ve been collecting this information, what’s changed is simply that they’ll be storing it in a central system where everything “will now by accessible to a larger number of USBP agents with no nexus” to suspected illegal activity. They promise, though, to restrict access and train staff not to do anything they aren’t supposed to. And they don’t see risk to privacy because they’ve published a notice (that I’m now writing about) telling you how your privacy may be violated. Electronic device searches have been on the rise. Between October 2008 and June 2010 6500 devices were searched. In 2016 there were 10,000 device searches, and 30,200 in 2017. It’s not clear though that these searches are all actually legal. In November 2019 a federal judge in Boston ruled that forensic searches of cell phones require at least reasonable suspicion “that the devices contain contraband.” --8<---------------cut here---------------end--------------->8--- Saluti, Giovanni. [1] https://en.wikipedia.org/wiki/Border_search_exception#Searching_of_electron… -- Giovanni Biscuolo

Aug. 25, 2020

Re: [nexa] Uber and the lawlessness of 'sharing economy' corporates | Uber | The Guardian

by J.C. DE MARTIN

Scusate, ho dimenticato di premettere che ho postato l’articolo benché fosse di 5 anni fa perché gli autori l’hanno rilanciato nelle scorse ore sull’onda dei recenti sviluppi (soprattutto californiani). In effetti ci avevano visto lungo, per di più in un periodo in cui quasi tutti osannavano Uber. scusate ancora! jc (Sent from my wireless device; please excuse brevity and typos (if any)) > On 25 Aug 2020, at 07:55, J.C. DE MARTIN <demartin(a)polito.it> wrote: > > > > Uber and the lawlessness of ‘sharing economy’ corporates > Companies including Airbnb and Google compare themselves to civil rights heroes, while using their popularity among consumers to nullify federal law > Frank Pasquale and Siva Vaidhyanathan > Tue 28 Jul 2015 07.00 BST > > https://www.theguardian.com/technology/2015/jul/28/uber-lawlessness-sharing… > > > (Sent from my wireless device; please excuse brevity and typos (if any)) > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa

Aug. 25, 2020

How I helped fix Canadaʼs COVID Alert app

by Alberto Cammozzo

<https://seancoates.com/blogs/how-i-helped-fix-canadas-covid-alert-app> On July 31st, Canada's COVID Alert app was made available for general use, though it does not have support for actually reporting a diagnosis in most provinces, yet. In Quebec, we can run the tracing part of the app, and if diagnosis codes become available here, the app can retroactively report contact. It uses the tracing mechanism that Google and Apple created together, and in my opinion—at least for now—Canadians should be running this thing to help us all deal with COVID-19. I won't run it forever, but for now, it seems to me that the benefits outweigh the "government can track me" fear (it's not actually tracking you; it doesn't even know who you are), and it's enabled on my phone. But, before I decided to take this position and offer up my own movement data, I wanted to be sure the app is doing what it says it's doing—at least to the extent of my abilities to be duly diligent. (Note: it's not purely movement data that's shared—at least without more context—but it's actual physical interactions with other people whose phones are available within the radio range of Bluetooth LE.) Before installing the app on my real daily-carry phone, I decided to put it on an old phone I still have, and to do some analysis on the most basic level of communication: who is it contacting? In 2015, I gave a talk at ConFoo entitled "Inspect HTTP(S) with Your Own Man-in-the-Middle Non-Attacks", and this is exactly what I wanted to do here. The tooling has improved in the past 5 years, and firing up mitmproxy, even without ever having used it on this relatively new laptop, was a one-liner, thanks to Nix: nix-shell -p mitmproxy --run mitmproxy This gave me a terminal-based UI and proxy server that I pointed my old phone at (via the Wifi Network settings, under HTTP proxy, pointed to my laptop's local IP address). I needed to have mitmproxy create a Certificate Authority that it could use to generate and sign "trusted" certificates, and then have my phone trust that authority, by visiting http://mitm.it/ in mobile Safari, and doing the certificate acceptance dance (this is even more complicated on the latest versions of iOS). Worth noting also, is that certain endpoints such as the Apple App Store appear to use Certificate Pinning, so you'll want to do things like install the COVID Alert app from the App Store before turning on the proxy. Once I was all set up to intercept my own traffic, I visited some https:// URLs and saw the request flows in mitmproxy. I fired up the COVID Alert app again, and noticed something strange… something disturbing: shows that the app is accessing clients.google.com In addition to the expected traffic to canada.ca (I noticed it's using .alpha.canada.ca, but I suspect that's due to the often-reported unbearably-long bureaucratic hassle in getting a .canada.ca TLS certificate, but that's another story), my phone, when running COVID Alert, was contacting Google. HEAD https://clients4.google.com/generate_204 A little web searching helped me discover that this is a commonly-used endpoint that helps developers determine if the device is behind a "captive portal" (an interaction that requires log-in or payment, or at least acceptance of terms before granting wider access to the Web). I decided that this was probably unintended by the developers of COVID Alert, but it still bothered me that an app, designed for tracking interactions between people['s devices], that the government wants us to run is telling Google that I'm running it, and disclosing my IP address in doing so: shows that the User Agent header identifies the app as (Note that the app clearly identifies itself in the User-Agent header.) A bit more quick research turned up a statement by Canada's Privacy Commissioner: An Internet Protocol (IP) address can be considered personal information if it can be associated with an identifiable individual. For example, in one complaint finding, we determined that some of the IP addresses that an internet service provider (ISP) was collecting were personal information because the ISP had the ability to link the IP addresses to its customers through their subscriber IDs. It's not too difficult to imagine that Google probably has enough data on Canadians for this to be a real problem. I discovered that this app is maintained by the Canadian Digital Service, and that the source code is on GitHub, but that the code itself didn't directly contain any references to clients3.google.com. [...]

Aug. 25, 2020

Uber and the lawlessness of 'sharing economy' corporates | Uber | The Guardian

by J.C. DE MARTIN

Uber and the lawlessness of ‘sharing economy’ corporates Companies including Airbnb and Google compare themselves to civil rights heroes, while using their popularity among consumers to nullify federal law Frank Pasquale and Siva Vaidhyanathan Tue 28 Jul 2015 07.00 BST https://www.theguardian.com/technology/2015/jul/28/uber-lawlessness-sharing… (Sent from my wireless device; please excuse brevity and typos (if any))

Aug. 25, 2020