- nexa - server-nexa.polito.it

An Alexa Bug Could Have Exposed Your Voice History to Hackers
by Giacomo Tesio Aug. 16, 2020

Aug. 16, 2020

Findings published on Thursday by the security firm Check Point reveal that Alexa's web services had bugs that a hacker could have exploited to grab a target's entire voice history, meaning their recorded audio interactions with Alexa. Amazon has patched the flaws, but the vulnerability could have also yielded profile information, including home address, as well as all of the "skills," or apps, the user had added for Alexa. An attacker could have even deleted an existing skill and installed a malicious one to grab more data after the initial attack. "Virtual assistants are something that you just talk to and answer, and usually you don’t have in your mind some kind of malicious scenarios or concerns," says Oded Vanunu, Check Point's head of product vulnerability research. "But we found a chain of vulnerabilities in Alexa's infrastructure configuration that eventually allows a malicious attacker to gather information about users and even install new skills." For an attacker to exploit the vulnerabilities, she would need first to trick targets into clicking a malicious link, a common attack scenario. Underlying flaws in certain Amazon and Alexa subdomains, though, meant that an attacker could have crafted a genuine and normal-looking Amazon link to lure victims into exposed parts of Amazon’s infrastructure. By strategically directing users to track.amazon.com—a vulnerable page not related to Alexa, but used for tracking Amazon packages—the attacker could have injected code that allowed them to pivot to Alexa infrastructure, sending a special request along with the target's cookies from the package-tracking page to skillsstore.amazon.com/app/secure/your-skills-page. Continua su https://www.wired.com/story/amazon-alexa-bug-exposed-voice-history-hackers/ Cattivi hacker cattivi! Hanno questo brutto vizio di ignorare i tabù che proteggono queste microspie^W apparecchiature dagli accessi non autorizzati (autorizzate dal produttore, non dal acquirente, ovviamente). Forse inizieremo ad avere sistemi ragionevolmente sicuri quando i produttori dovranno per legge premiare gli hacker e risarcire gli acquirenti con la stessa cifra, come minimo un migliaio di euro, ogni volta che i primi riescono a dimostrare la credulità dei secondi, mostrando quanto male spendono i propri soldi. Giacomo

1 0

Rodrik, "Democratizing Innovation"
by J.C. DE MARTIN Aug. 16, 2020

Aug. 16, 2020

Democratizing Innovation Aug 11, 2020 Dani Rodrik <https://www.project-syndicate.org/columnist/dani-rodrik> Policymakers and the public at large understand the importance of innovation to economic growth and well being. What is less well appreciated is the degree to which the innovation agenda has been captured by narrow groups of investors and firms whose values and interests don’t necessarily reflect society’s needs. Continua qui: https://www.project-syndicate.org/commentary/policymakers-should-influence-…

1 0

Robots in the Workplace: a Threat to—or Opportunity for—Meaningful Work?
by don Luca Peyron Aug. 15, 2020

Aug. 15, 2020

The concept of meaningful work has recently received increased attention in philosophy and other disciplines. However, the impact of the increasing robotization of the workplace on meaningful work has received very little attention so far. Doing work that is meaningful leads to higher job satisfaction and increased worker well-being, and some argue for a right to access to meaningful work. In this paper, we therefore address the impact of robotization on meaningful work https://link.springer.com/content/pdf/10.1007%2Fs13347-019-00377-4.pdf _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

You Don’t Really Own Your Own Gadgets - James B. Meigs, Commentary Magazine
by J.C. DE MARTIN Aug. 15, 2020

Aug. 15, 2020

https://www.commentarymagazine.com/articles/james-meigs/you-dont-really-own… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Instagram kept deleted photos and messages on its servers for more than a year
by Giacomo Tesio Aug. 14, 2020

Aug. 14, 2020

The files were retained due to a now-fixed bug, says Instagram When you delete something from Instagram you expect it to be gone for good. But when security researcher Saugat Pokharel requested a copy of photos and direct messages from the photo-sharing app, he was sent data he’d deleted more than a year ago, showing that the information had never been entirely removed from Instagram’s servers. https://www.theverge.com/2020/8/14/21368602/instagram-kept-deleted-photos-m… Per fortuna ora il bug è stato corretto. Mancava una "WHERE deleted = FALSE" alla query che restituisce i dati da inviare all'utente. Ora i dati che l'utente ha chiesto di cancellare non gli verranno più inviati. A volte Facebook è sconcertante. In Google questi errori non avvengono: sanno che la copia dei dati non lascia traccia e quindi li cancellano davvero. Dopo. Comunque ora possiamo tutti tornare a dormire tranquilli... o no? Giacomo

1 0

Sources: Mozilla expected to extend its Google search deal
by Giacomo Tesio Aug. 14, 2020

Aug. 14, 2020

Mozilla and Google are expected to extend their current search deal for another three years, multiple sources have told ZDNet. The new search deal will ensure Google remains the default search engine provider inside the Firefox browser until 2023 at an estimated price tag of around $400 million to $450 million per year. Mozilla officials are expected to announce the search deal's extension later this fall, in November, when the organization is scheduled to disclose its 2019 financial figures. Terms of the new deal were leaked to this reporter after Mozilla announced plans to lay off more than 250 employees on Wednesday in a move that had many users fearing for the browser maker's future, as Mozilla's current Google search deal was scheduled to expire at the end of the year. However, several sources have confirmed that the organization is sound financially, and the layoffs were part of a restructuring of its core business, with Mozilla moving away from its current role of internet standards steward and experimental approach to its product catalog to more commercially-viable offerings that generate revenues on their own. Work on open standards and protocols will take a backseat to commercialization efforts in the short-term, but Mozilla doesn't plan to phase out its work in the web development community completely and will most likely come back to its role of web custodian once its subscription-based services ensure long-term business survivability. Current plans include shoring up and expanding its recently-launched VPN service and, maybe, dipping its toes into acquiring new tech ventures that could be seamlessly integrated into its product catalog as self-standing revenue-generating streams. Reached out for comment, a Mozilla spokesperson said the organization had nothing to comment at this point; however, in a response post-publication, Mozilla confirmed our report and provided the following statement: "Mozilla's search partnership with Google is ongoing, with Google as the default search provider in the Firefox browser in many places around the world. We've recently extended the partnership, and the relationship isn't changing." https://www.zdnet.com/article/sources-mozilla-expected-to-extend-its-google… Giacomo

2 1

We need a full investigation into Siri's secret surveillance campaign | Apple | The Guardian
by J.C. DE MARTIN Aug. 14, 2020

Aug. 14, 2020

https://www.theguardian.com/commentisfree/2020/aug/14/apple-siri-secret-sur… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

The Fight for Digital Sovereignty: What It Is, and Why It Matters, Especially for the EU
by Roberto Resoli Aug. 14, 2020

Aug. 14, 2020

Da Luciano Floridi, filosofo dell'Etica a Oxford: «La sovranità digitale sembra essere qualcosa di molto importante, data la popolarità dell'argomento in questi giorni. Vero. Ma sembra anche un problema tecnico, che riguarda solo specialisti. Falso. La sovranità digitale, e la lotta per essa, toccano tutti, anche quelli che non hanno un cellulare o non hanno mai utilizzato un servizio online. Per capire perché, lasciatemi iniziare con quattro episodi. Tra poco ne aggiungerò un quinto. 18 giugno 2020: Il governo britannico, dopo non essere riuscito a sviluppare un sistema centralizzato con coronavirus app non basata sulle API fornite da Google-Apple, ha abbandonato l'applicazione e l'intero progetto (Burgess 2020) e ha accettato di iniziare a sviluppare una nuova app in futuro che sarebbe pienamente compatibile con la soluzione decentrata supportata dalle due Aziende americane. Questa inversione a U non è stata la prima: Italia (Longo 2020) e Germania (Busvine e Rinke 2020; Lomas 2020) aveva fatto lo stesso, solo molto prima. Notare che, nel contesto di un webinar online sulle applicazioni di ricerca di contatti COVID-19, organizzato da RENEW EUROPE (un gruppo politico liberale ed europeista dell'European Parliament), Gary Davis, Direttore globale di Privacy & Law Enforcement Requests presso Apple (e in precedenza vice commissario per la protezione dei dati personali in Irlanda), ha dichiarato che "Google/Apple può disattivare il sistema [cioè l'applicazione di ricerca contatti, il mio testo] su base regionale quando non è più necessario". 2 Questo è il potere come controllo, come spiegherò in seguito ...» https://link.springer.com/content/pdf/10.1007/s13347-020-00423-6.pdf

1 0

What CEOs talked about during the pandemic
by don Luca Peyron Aug. 14, 2020

Aug. 14, 2020

IoT Analytics’ latest publication analyses “keyword-based” visualization of the earnings transcripts of 3,000 US-listed companies (Q2 2020 vs. Q4 2019). It provides an indication of which technology topics CEOs prioritized during the pandemic. https://iot-analytics.com/what-ceos-talked-about-during-the-pandemic/ _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

I nomadi digitali e lo smart working senza barriere che mette in crisi l’Europa
by don Luca Peyron Aug. 14, 2020

Aug. 14, 2020

Le grandi multinazionali stanno creando nuovi piani organizzativi per permettere ai propri dipendenti di lavorare ovunque. Ma le implicazioni legali, fiscali e contributive non sono da sottovalutare. E fanno emergere i nervi scoperti della convivenza europea. Il caso dell’Estonia e i “remote worker” dalla Sicilia per le aziende della Silicon Valley. Buona lettura dl https://www.linkiesta.it/2020/07/lavoro-remoto-europa-regole-fisco-contribu… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

2 1