July 2018 - cypherpunks-legacy

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

At 11:17 AM -0800 11/23/2000, Lynn.Wheeler(a)firstdata.com wrote: >Basically cetificates are an implementation of R/O partial replicated >distributed data that were intended to address availability of >information in a >predominately offline environment. > >In the SSL server certificates, distribution of CRLs tend to create a problem >for consumers because they aren't likely to want to see >99.99999999999999999999% >of the CRLs distributed and/or they aren't online at the time the CRLs are >distributed (and/or if done via email would create a horrible spam issue ... >every possible consumer in the world receiving email CRLs from every >possile SSL >server certificate issuing CA). Sounds like a job for Usenet. Arnold Reinhold For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)reservoir.com" with one line of text: "help".

1 0

<nettime> NYT > Krugman > The New Hungarian Secret Police
by nettime's_roving_reporter 06 Jul '18

06 Jul '18

<http://krugman.blogs.nytimes.com/2012/04/19/the-new-hungarian-secret-police/> April 19, 2012, 6:59 pm The New Hungarian Secret Police Another Hungary post from my Princeton colleague Kim Lane Scheppele, after the jump. The New Hungarian Secret Police Kim Lane Scheppele Tuesday 17 April 2012 Brad Pitt knows all about the TEK, Hungary's new counter-terrorism police. When Pitt was in Budapest last October shooting World War Z, an upcoming zombie-thriller, TEK agents [42]seized 100 machine guns, automatic pistols and sniper rifles that had been flown to Hungary for use as props in the movie. The weapons were disabled and came with no ammunition. But the Hungarian counter-terrorism police determined that they constituted a serious threat. The dead-pan seizure of movie props made TEK the laughing stock of the world. As David Itzkoff [43]joked in the pages of the New York Times, "If Hungary ever finds itself the target of an undead invasion, its police force should now be well supplied to defend the nation." Few have taken TEK seriously. But that is a big mistake. In fact, TEK seems to be turning into Prime Minister Viktor Orban's own secret police. In less than two years, TEK has amassed truly Orwellian powers, including virtually unlimited powers of secret surveillance and secret data collection. The speaker of the Parliament, Laszls Kvvir, now has his own armed guard too, since the Parliament yesterday passed a law that creates a separate armed police force accountable to the Parliament. It too has extraordinary powers not normally associated with a Parliamentary guard. The creation of this "Parlia-military" gives Hungary the dubious distinction of having the only Parliament in Europe with its own armed guard that has the power to search and "act in" private homes. About the Parlia-military, more later. First, to TEK. TEK was created in September 2010 by a governmental decree, shortly after the Fidesz government took office. TEK exists outside the normal command structure of both the police and the security agencies. The Prime Minister directly names (and can fire) its head and only the interior minister stands between him and the direct command of the force. It is well known that the head of this force is a very close confidante of the Prime Minister. TEK was set up as an anti-terror police unit within the interior ministry and given a budget of 10 billion forints (about $44 million) in a time of austerity. Since then, it has grown to nearly 900 employees in a country of 10.5 million people that is only as big as Indiana. Why was TEK necessary? When it was created, the government said that it needed TEK because Hungary would hold the rotating presidency of the European Union starting in January 2011. During the six months it held this office, Hungary could be expected to host many important meetings for which top anti-terrorism security would be necessary. But even though Hungary's stint in the EU chair is over, TEK has continued to grow. Eyebrows were raised when Janos Hajdu, Orban's personal bodyguard, was appointed directly by the prime minister to be the first head of this new agency. Since TEK's job also included guarding the prime minister, some believed that Orban had set up the office to get his trusted bodyguard onto the public payroll. Patronage turns out to be the least of the worries about TEK, however. TEK is now the sort of secret police that any authoritarian ruler would love to have. Its powers have been added slowly but surely through a series of amendments to the police laws, pushed through the Parliament at times when it was passing hundreds of new laws and when most people, myself included, did not notice. The new powers of TEK have received virtually no public discussion in Hungary. But now, its powers are huge. What can the TEK do? TEK can engage in secret surveillance without having to give reasons or having to get permission from anyone outside the cabinet. In an amendment to the police law passed in December 2010, TEK was made an official police agency and was given this jurisdiction to spy on anyone. TEK now has the legal power to secretly enter and search homes, engage in secret wiretapping, make audio and video recordings of people without their knowledge, secretly search mail and packages, and surreptitiously confiscate electronic data (for example, the content of computers and email). The searches never have to be disclosed to the person who is the target of the search - or to anyone else for that matter. In fact, as national security information, it may not be disclosed to anyone. There are no legal limits on how long this data can be kept. Ordinary police in Hungary are allowed to enter homes or wiretap phones only after getting a warrant from a judge. But TEK agents don't have to go to a judge for permission to spy on someone - they only need the approval of the justice minister to carry out such activities. As a result, requests for secret surveillance are never reviewed by an independent branch of government. The justice minister approves the requests made by a secret police unit operated by the interior minister. Since both are in the same cabinet of the same government, they are both on the same political team. TEK's powers were enlarged again in another set of amendments to the police law passed on 30 December 2011, the day that many other laws were passed in a huge end-of-year flurry. With those amendments, TEK now has had the legal authority to collect personal data about anyone by making requests to financial companies (like banks and brokerage firms), insurance companies, communications companies (like cell phone and internet service providers) - as well as state agencies. Data held by state agencies include not only criminal and tax records but also educational and medical records - and much more. Once asked, no private company or state agency may refuse to provide data to TEK. Before December 2011, TEK had the power to ask for data like this, but they could only do so in conjunction with a criminal investigation and with the permission of the public prosecutor. After December 2011, their data requests no longer had to be tied to criminal investigations or be approved by the prosecutor. In fact, they have virtually no limits on what data they can collect and require no permission from anyone. If an organization (like an internet service provider, a bank or state agency) is asked to turn over personally identifiable information, the organization may not tell anyone about the request. People whose data have been turned over to TEK are deliberately kept in the dark. These powers are shocking, not just because of their scope, but also because most Hungarians knowledgeable about constitutional law would probably have thought they were illegal. After the changes of 1989, the new Hungarian Constitutional Court was quick to dismantle the old system in which the state could compile in one place huge amounts of personal information about individuals. In its "PIN number" decision of 1991, the Constitutional Court ruled that the state had to get rid of the single "personal identifier number" (PIN) so that personally identifiable data could no longer be linked across state agencies. The Court found that "everyone has the right to decide about the disclosure and use of his/her personal data" and that approval by the person concerned is generally required before personal data can be collected. It was the essence of totalitarianism, the Court found, for personal information about someone to be collected and amassed into a personal profile without the person's knowledge. With that Constitutional Court decision still on the books and not formally overruled, the Fidesz government is reproducing the very system that the Court had banned by creating a single agency that can gather all private information about individuals in one place again. What, one might ask, is left of constitutional law in Hungary? One might also ask: Are there any limits to TEK's power? The law specifies that TEK operates both as a police and as a national security agency. When it is acting as a police unit, it has the jurisdiction to spy on any person or group who poses a threat of terrorism, along with anyone else associated with such persons. Hungary, like many countries after 9/11, has a broad definition of terrorism that includes, among other things, planning to commit a "crime against the public order" with the purpose of "coercing a state body . . . into action, non-action or toleration." Crimes against the public order include a long list of violent crimes, but also the vaguer "causing public danger." In addition, TEK also may arrest "dangerous individuals," a term not defined in the criminal law. It is difficult from the text of the law itself to see any clear limits on TEK's powers. And TEK is very active. On April 7, TEK agents were called in to [44]capture a young man in the small village of Kulcs who killed four members of his family with a machete. And then, in the early morning hours of Friday, April 13, TEK agents conducted a major drug bust in Budapest, arresting 23 people. According to news reports, fully 120 TEK agents were involved in the drug operation, [45]raising questions about whether the drug bust was thought to be part of the anti-terrorism mission of the agency or a rather broad extension of the concept of the "dangerous individual." Either way, the drug ring looked like garden-variety crime. If that is within TEK's jurisdiction, it is hard to imagine what is not. A You-Tube video of the April 13 drug bust, made available by TEK itself, shows what a middle-of-the-night raid by TEK officers looks like, complete with the use of heavy-duty tools to cut open an exterior door. IFRAME: [46]http://www.youtube.com/embed/Trl2YSiawXk Given that this is the video that TEK wanted you to see, one can only imagine the activities of TEK that are not recorded for posterity. (It would be interesting to know, for example, why the audio cuts out at certain points in the clip, as well as what happens between the time that TEK breaks open the door and the time the various suspects are seen lying handcuffed on the floor.) While its videos are crystal clear, TEK's legal status is blurry, as some parts of its activities are authorized under the police law and others parts are authorized under the national security law. Different rules and standards apply to police agencies and to national security agencies. Moreover, TEK seems to have some powers that exceed those of both police and national security agencies, particularly in its ability to avoid judicial warrants. No other agency in the Hungarian government has both police and national security powers, and it is unclear precisely how the agency is accountable - for which functions, under what standards and to whom. What follows is my best guess from reading the law. With respect to its powers authorized under the police law, it appears that TEK must act like the police and get judicial warrants to search houses, to wiretap and to capture electronic data when these activities are part of a criminal investigation. When TEK was arresting the machete-wielder and making the drug bust, it was probably acting under its police powers. But TEK only need judicial warrants when it is engaged in criminal investigations. It doesn't need judicial warrants when it is using its secret surveillance powers in security investigations. When it is acting as a national security agency, TEK only needs the permission of the justice minister to engage in secret and intrusive surveillance. Of course, given that the permissions and constraints are different depending on whether TEK is acting as a police agency or a national security agency, it would matter who decides whether a particular activity is conducted for police or national security purposes and what the criteria are for determining that it is one or the other. The law does not provide the answer to either question. Suppose someone believes that she has been spied upon illegally by TEK. What can she do to object? First, if TEK is engaged in secret surveillance or data collection, it is unlikely that people will know that they are a target, given the extraordinary secrecy of the whole operation. But even if one finds out that one is being watched, the remedies are not encouraging. A person aggrieved by TEK's actions may complain to the interior minister, and the interior minister must answer the complaint within 30 days. But given that the interior minister is the minister who controls TEK in the first place, this is not an independent review. If the complainant does not like the answer of the interior minister, s/he may appeal to the Parliament's national security committee, which must muster a one-third vote to hear the petition. At the moment, the 12-member national security committee consists of two-thirds governing party members and one-third members of all other parties combined. If the governing party does not want to investigate a complaint, garnering a one-third vote would mean uniting the whole opposition - or, to put it in more blunt terms, getting the Socialists to work with the neo-Nazis. That is unlikely to happen. Even if the national security committee agrees to hear a petition, however, it would take a two-thirds vote of the committee to require the interior minister to reveal the surveillance methods used against the complainant so that the committee can determine whether they were legal. There is no judicial review at any stage of this process. TEK operates in secret with extraordinary powers and no one reliably independent of the current governing party can review what it is doing when it uses its most potentially abusive powers. This shocking accumulation of power may explain the Hungarian government's abolition of a separate data protection ombudsman who would have the power to investigate such shocking accumulation of data. Instead, the data protection officer - a post required by European Union law - has been made a political appointee of the government itself. This is why the EU has [47]launched an infringement action against Hungary for failing to guarantee the independence of the office. Now we can see why the EU may be onto something. As if the powers of TEK are not enough, though, Parliament yesterday authorized another security service with the power to use police measures against citizens and residents of Hungary. The cardinal law on the Parliament itself contains a provision that gives the Parliament its own military, a Parlia-military. The Parlia-military is an armed police unit outside the chain of command of the regular military or police structures. Its commander in chief is the speaker of the house, Laszls Kvvir, who served as minister without portfolio for the Civilian Intelligence Services during the first Orban government from 1998-2002. The Parlia-military has the power to guard the Parliament and the speaker of the house, as might be expected. But if the Parlia-military is only supposed to guard the Parliament and the speaker, why does it need the powers that the cardinal law gives it? The law gives the Parlia-military power "to enter and to act in private homes." That's literally what the law says. It is unlikely that the Parliament will want to conduct a plenary session in someone's living room, so one must then wonder just what the Parliament will do if its armed military enters someone's home to "act." In addition to this power, the Parlia-military may also make public audio and video recordings of people. It can also search cars, luggage and clothing. It can use handcuffs and chemical substances (which I assume means tear gas and nothing more, but the wording make it sound like the Parlia-military may use chemical weapons!). The draft law seems to imply that the Parlia-military would have to operate under the constraints of the police law, which would mean that it would need judicial warrants to conduct these intrusive measures. But that is not completely clear. What is clear is that Hungary now suffers from a proliferation of police that are under direct political control. Until this point, I have thought that the Fidesz government was just attempting to lock down power for itself for the foreseeable future, which was bad enough. But now, with the discovery of these new security services, it seems increasingly likely that the Hungarian government is heading toward the creation of a police state. Actually, it may already be there. But shhhh! It's secret. B) 2012 The New York Times Company # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

RE: [HacDC:Byzantium] I'd like to help out
by Dave Duchesneau 06 Jul '18

06 Jul '18

> "Rooting the phone will allow for adhoc mesh network capability and is > required for full functionality of the software. By choosing not to > root the phone, the software will still be able to provide free calls > to phones that are connected to the same Access Point." AFAIK, although Serval currently requires a rooted phone for the phone itself to be part of the mesh, the standard Serval download for Android allows phone-to-phone communications through an AP with a non-rooted phone. This is more of a fallback plan, since a key aspect of the Serval project is to have the phones be mesh nodes. However, as one may surmise, even such AP-based communications would not be possible if the AP is configured to disallow client-to-client communications (i.e., client isolation mode). On the other hand, if the AP is really just an SSID offered by the nodes on a bridged mesh network, then AP-based Serval communications may reach anywhere that the underlying mesh network reaches. Because such a network is in bridged mode, it operates at layer 2 (based on MAC addresses), and thus is effectively a big software switch, so collectively, all the nodes act as one big AP (in some configurations, clients can roam between mesh nodes without losing sessions, IP addresses, etc.). For those who may not be aware, two examples of such bridged mesh networks are the open-source SECN offering from Village-Telco.org (which is also collaborating with the Serval project to make their meshes interoperate), and also Open-Mesh.com (providing the bridge-mode option is selected). Both meshes are based on batman-adv, so you could expect similar behavior from any mesh based on batman-adv (in bridge mode), and possibly other bridged meshes. Bridged meshes are relatively straightforward, but are not without issues, especially with respect to scalability. One avenue to address scalability issues is to adopt hybrid models where layer 2 is used for localized mesh clusters (up to 20-200 nodes, let's say), and layer 3 is used to route between localized mesh clusters. Note that with a hybrid approach, layer 3 may also serve as an interoperability layer to connect meshes with differing protocols, so that Byzantium-style OLSR meshes may be routed to VillageTelco-style batman-adv meshes. Layer 3 routing consumes more resources than layer 2, so such an approach may not be feasible on every mesh node. Of course, multiple protocols may coexist on run-of-the-mill mesh nodes, too, if there's enough local capacity (memory, CPU, radio bandwidth, etc.). In general, it would be good to make all the meshes work together, at least at arm's length (i.e., this can be done a non-trusted basis, assuming end-to-end encryption). To maximize communications survivability, our own approach incorporates a smattering of optional multi-radio nodes (multiple bands, channels, protocols) in every mesh. These nodes have extra capacity for routing, proxying, protocol translation, serving, store-and-forward, caching, etc. Preachin' to the Choir, Dave Duchesneau ddd(a)crisis-force.org CRISIS-FORCE Emergency Network -----Original Message----- From: Ben Mendis [mailto:dragonwisard@gmail.com] Sent: Tuesday, June 19, 2012 5:20 AM To: byzantium(a)hacdc.org Subject: Re: [HacDC:Byzantium] I'd like to help out -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It may be accurate. I may have misunderstood something. I haven't gotten an opportunity to test out Serval myself yet. On Tue, 19 Jun 2012, John wrote: > On 6/12/2012 11:40 AM, Ben Mendis wrote: >> It seems that Serval (http://www.servalproject.org/) has >> managed to get BATMAN-Adv to run as an Android app without requiring >> root, so maybe it's possible for Babel and OLSR too. > > Does that mean this document is out-of-date? > > http://developer.servalproject.org/files/Serval_Manual_Prototype_v0.05.pdf > > Scroll down to 2.3, > "Rooting the phone will allow for adhoc mesh network capability and is > required for > full functionality of the software. By choosing not to root the phone, the > software > will still be able to provide free calls to phones that are connected to the > same > Access Point." > > John > > -- > You received this message because you are subscribed to the Google Groups > "Project Byzantium (Emergency Mesh Networking)" group. > To post to this group, send email to Byzantium(a)hacdc.org. > To unsubscribe from this group, send email to > Byzantium+unsubscribe(a)hacdc.org. > For more options, visit this group at > http://groups.google.com/a/hacdc.org/group/Byzantium/?hl=en. > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQEcBAEBAgAGBQJP4G57AAoJEMco5sYyM+0wq58H/RmhKlbWA7prhiD2CaJS0h4s SVH9Wj/HfFh2D3Rs25gyOYnZ/o05/KRMS38MSNCDrUxg9uqqUavZ+85I2yfw6XKJ p905Ejo0E1SXpiWpxtTeZ3J8ZKQP5vTFa0NTSs07U0dCE1h59vTkEdjA8cQk6oEc z0yytSLlXNa9okLof1AK6U0m0Jjdkps/NcjScQFOsuJ0gT4SYluzecrV2E5UL/tI HFqtdsxvtil8m9xnmVfg7z3GvqhpCbPxVMVsCEvWXCSDiVL6euw/a4Usz3/8IBps 8TCiYnkQvZvtXMJ83zG7uVogdMOHt0BRGhM+s0RFlNNUvPFG6P832yD8b2mD1qU= =2Vlj -----END PGP SIGNATURE----- -- You received this message because you are subscribed to the Google Groups "Project Byzantium (Emergency Mesh Networking)" group. To post to this group, send email to Byzantium(a)hacdc.org. To unsubscribe from this group, send email to Byzantium+unsubscribe(a)hacdc.org. For more options, visit this group at http://groups.google.com/a/hacdc.org/group/Byzantium/?hl=en. -- You received this message because you are subscribed to the Google Groups "Project Byzantium (Emergency Mesh Networking)" group. To post to this group, send email to Byzantium(a)hacdc.org. To unsubscribe from this group, send email to Byzantium+unsubscribe(a)hacdc.org. For more options, visit this group at http://groups.google.com/a/hacdc.org/group/Byzantium/?hl=en. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[liberationtech] Finishing what Aaron Swartz started with PACER
by Aaron Greenspan 06 Jul '18

06 Jul '18

Hi there, In case anyone is interested, I've built a tool to crowdsource the downloading of PACER materials. You can find details here: http://www.aarongreenspan.com/writing/essay.html?id=85 http://www.plainsite.org/asymptote/index.html Please help spread the word! Aaron Aaron Greenspan CodeX Fellow | Stanford Center for Legal Informatics | http://codex.stanford.edu Founder | PlainSite | http://www.plainsite.org -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Thoughts on Google Maps Street Level Photos and Privacy
by Lauren Weinstein 06 Jul '18

06 Jul '18

Thoughts on Google Maps Street Level Photos and Privacy http://lauren.vortex.com/archive/000244.html Greetings. The New York Times noted today ( http://tinyurl.com/28zbde ) that Google Maps is now displaying street level photos for some locations in some areas -- the list of which is sure to be expanding rapidly. I've been asked what I thought about the privacy implications of this -- some people seem to be pretty upset. I started noticing this feature on various Google Map searches around here in L.A. some time ago. It's certainly handy for getting a feel for what an unfamiliar place looks like before heading on over. Given the static nature of the images, which currently are unlikely to be updated very frequently, I do not see a big privacy risk at the moment. Real estate companies are constantly snapping photos of houses in many areas for their databases -- though obviously these are not public in the way Google Maps now is. In my neck of L.A., I've seen film camera trucks bristling with lenses plowing up and down the streets shooting movie backgrounds. In general, such photography from a public point (street, sidewalk, etc.) is legal -- though there are exceptions that can come into play for purposeful harassment and in other special cases. However, it is possible to imagine possible situations where this feature of Google Maps could cause problems, and even potential risks for Google, depending on how Google chooses to manage the service. So long as the images being used by Google Maps are from authenticated sources and are relatively infrequently updated, the privacy risks stay low for most locales. This isn't to say that various government agencies won't go berserk over particular images in any case -- given the ease with which you can get hassled by police these days for taking a photo of the local freeway overpass -- but by and large that won't happen for shots of most locations, to be sure. However if Google decided to allow users to submit their own more frequently updated photos of locations, either for the official Google Maps database or through public "mashups" that link such photos to the mapping database, the situation becomes more problematic. Not only could much more frequently updated photos cross the line into real privacy violations, but the risk of photoshopped photos being submitted or used that show faked imagery would seem a real possibility. You can use your own imagination about the range of ways in which such fakes could be manipulated to attract attention, harass, or mislead. Now, I have absolutely no indication that Google has any intention of permitting such "self-submitted" location photos scenarios. In fact, Google does have a link with which you can report "inappropriate" photos for possible removal, though if photos were faked, figuring out what was really inappropriate in different situations could get rather complex. In any case, all I'm saying here is that so long as Google Maps is using authentic photos on a infrequent update interval, the privacy risks remain relatively low in the vast majority of cases. A bigger risk to the service might loom in the future though. I can't count the number of times I've gotten queries from people that amount to: "My neighbor has a camera pointed at my house -- who can I report him to? I feel like my children are at risk," etc. In almost all of these cases, my response is that so long as someone is taking photos from public spaces or their own property, and isn't making a special effort to see things they couldn't otherwise normally see, such photography or video is usually permitted. That answer seems to infuriate many people. This seems to suggest -- given the post-9/11 mentality -- that it is not impossible to imagine laws that could be written specifically to restrict the use of such street level photos, ostensibly on personal security and privacy grounds. If Google Maps were painted as a major privacy problem -- which again is an opinion I don't subscribe to, but that some others already do -- this could act as a catalyst toward the enactment of such legislation. This would be very unfortunate in the absence of genuine, major privacy concerns of a sort that do not currently exist in the Google Maps context, and that might not ever exist there if Google and its competitors use due care. I only bring up this sort of possibility as did the "Ghost of Christmas Yet to Come" -- not as something that Will Be, but as something that Might Be -- a cautionary thought experiment, as it were. So, bottom line -- for now the Google Maps street level photos provide a useful service and should not raise significant privacy concerns, except for a tiny percentage of photos that can be easily expunged. Whether this benign situation will remain the case depends upon Google's decisions regarding the service moving forward. Allen Funt would probably be amused, anyway. --Lauren-- Lauren Weinstein lauren(a)vortex.com or lauren(a)pfir.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, IOIC - International Open Internet Coalition - http://www.ioic.net Founder, CIFIP - California Initiative For Internet Privacy - http://www.cifip.org Founder, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Thoughts on Google Maps Street Level Photos and Privacy
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Thoughts on Google Maps Street Level Photos and Privacy
by Lauren Weinstein 06 Jul '18

06 Jul '18

Thoughts on Google Maps Street Level Photos and Privacy http://lauren.vortex.com/archive/000244.html Greetings. The New York Times noted today ( http://tinyurl.com/28zbde ) that Google Maps is now displaying street level photos for some locations in some areas -- the list of which is sure to be expanding rapidly. I've been asked what I thought about the privacy implications of this -- some people seem to be pretty upset. I started noticing this feature on various Google Map searches around here in L.A. some time ago. It's certainly handy for getting a feel for what an unfamiliar place looks like before heading on over. Given the static nature of the images, which currently are unlikely to be updated very frequently, I do not see a big privacy risk at the moment. Real estate companies are constantly snapping photos of houses in many areas for their databases -- though obviously these are not public in the way Google Maps now is. In my neck of L.A., I've seen film camera trucks bristling with lenses plowing up and down the streets shooting movie backgrounds. In general, such photography from a public point (street, sidewalk, etc.) is legal -- though there are exceptions that can come into play for purposeful harassment and in other special cases. However, it is possible to imagine possible situations where this feature of Google Maps could cause problems, and even potential risks for Google, depending on how Google chooses to manage the service. So long as the images being used by Google Maps are from authenticated sources and are relatively infrequently updated, the privacy risks stay low for most locales. This isn't to say that various government agencies won't go berserk over particular images in any case -- given the ease with which you can get hassled by police these days for taking a photo of the local freeway overpass -- but by and large that won't happen for shots of most locations, to be sure. However if Google decided to allow users to submit their own more frequently updated photos of locations, either for the official Google Maps database or through public "mashups" that link such photos to the mapping database, the situation becomes more problematic. Not only could much more frequently updated photos cross the line into real privacy violations, but the risk of photoshopped photos being submitted or used that show faked imagery would seem a real possibility. You can use your own imagination about the range of ways in which such fakes could be manipulated to attract attention, harass, or mislead. Now, I have absolutely no indication that Google has any intention of permitting such "self-submitted" location photos scenarios. In fact, Google does have a link with which you can report "inappropriate" photos for possible removal, though if photos were faked, figuring out what was really inappropriate in different situations could get rather complex. In any case, all I'm saying here is that so long as Google Maps is using authentic photos on a infrequent update interval, the privacy risks remain relatively low in the vast majority of cases. A bigger risk to the service might loom in the future though. I can't count the number of times I've gotten queries from people that amount to: "My neighbor has a camera pointed at my house -- who can I report him to? I feel like my children are at risk," etc. In almost all of these cases, my response is that so long as someone is taking photos from public spaces or their own property, and isn't making a special effort to see things they couldn't otherwise normally see, such photography or video is usually permitted. That answer seems to infuriate many people. This seems to suggest -- given the post-9/11 mentality -- that it is not impossible to imagine laws that could be written specifically to restrict the use of such street level photos, ostensibly on personal security and privacy grounds. If Google Maps were painted as a major privacy problem -- which again is an opinion I don't subscribe to, but that some others already do -- this could act as a catalyst toward the enactment of such legislation. This would be very unfortunate in the absence of genuine, major privacy concerns of a sort that do not currently exist in the Google Maps context, and that might not ever exist there if Google and its competitors use due care. I only bring up this sort of possibility as did the "Ghost of Christmas Yet to Come" -- not as something that Will Be, but as something that Might Be -- a cautionary thought experiment, as it were. So, bottom line -- for now the Google Maps street level photos provide a useful service and should not raise significant privacy concerns, except for a tiny percentage of photos that can be easily expunged. Whether this benign situation will remain the case depends upon Google's decisions regarding the service moving forward. Allen Funt would probably be amused, anyway. --Lauren-- Lauren Weinstein lauren(a)vortex.com or lauren(a)pfir.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, IOIC - International Open Internet Coalition - http://www.ioic.net Founder, CIFIP - California Initiative For Internet Privacy - http://www.cifip.org Founder, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Thoughts on Google Maps Street Level Photos and Privacy
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [tor-talk] Child pornography, anonymity and free speech
by torop20＠hushmail.com 06 Jul '18

06 Jul '18

Julian wrote: "* It's possible to wank without porn. We can reach places in our imagination that no amount of b realityb can take us. In my experience an orgasm that starts in the mind is *much* more fulfilling than one involving porn. It's also possible to reach orgasm without wanking (i.e. by having sex). " But the anti-child pornography laws proceed on the assumption that even non-commercial possession of computer generated images must be banned because inducing the stimulation or wanking is a legitimate societal interest to be regulated. It's classic thought crime control. Sure everyone can wank and have their thoughts, but only until the state manages a way to control what people think. If someone wrote a decentralized truly realistic fantasy Virtual Reality simulation in which everyone could get their desire without killing, maiming or molestating another, do you think the government would allow such a program to exist? I bet not. "Getting into bed with the porn producers risks alienating the feminist movement who would otherwise be naturally aligned with Tor's goals." You must be kidding. Google for Catharine Mackinnon and Andrea Dworkin and the Indianapolis pornography ordinance. The feminist movement has changed since the 1960s. These two leading feminists have called for the prohibition on hate speech and pornography. And only thanks to the ACLU did they not succeed in Indianapolis. The question is not whether someone likes pornography, but whether he/she believes the state should control it. If you believe that the state should regulate which material I view in my own home you can't in the long run be a friend of Tor's goals. Enforcement of the neo-feminist movement's censorship goals is no more friendly to Tor's goals than those of the Christian conservative movement. Aside from the failed war on drugs, there are three policy goals which often beget more censorship: Protect the children, national security and enforce copyright. I don't want censor happy feminists on my side. They are as toxic to free speech, privacy and anonymity as the RIAA. Fortunately, both the protection of hate speech and virtual child pornography is a settled constitutional question in the US, so the worst which can happen is that other nations f-ck up their own laws. _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Tor 0.2.2.14-alpha is out
by Roger Dingledine 06 Jul '18

06 Jul '18

Tor 0.2.2.14-alpha greatly improves client-side handling of circuit build timeouts, which are used to estimate speed and improve performance. We also move to a much better GeoIP database, port Tor to Windows CE, introduce new compile flags that improve code security, add an eighth v3 directory authority, and address a lot of more minor issues. https://www.torproject.org/download.html.en Packages will be appearing over the next few days or weeks. (We've decided to start announcing alpha versions when they're released, rather than waiting for all the packages first.) Changes in version 0.2.2.14-alpha - 2010-07-12 o Major bugfixes: - Tor directory authorities no longer crash when started with a cached-microdesc-consensus file in their data directory. Bugfix on 0.2.2.6-alpha; fixes bug 1532. - Treat an unset $HOME like an empty $HOME rather than triggering an assert. Bugfix on 0.0.8pre1; fixes bug 1522. - Ignore negative and large circuit build timeout values that can happen during a suspend or hibernate. These values caused various asserts to fire. Bugfix on 0.2.2.2-alpha; fixes bug 1245. - Alter calculation of Pareto distribution parameter 'Xm' for Circuit Build Timeout learning to use the weighted average of the top N=3 modes (because we have three entry guards). Considering multiple modes should improve the timeout calculation in some cases, and prevent extremely high timeout values. Bugfix on 0.2.2.2-alpha; fixes bug 1335. - Alter calculation of Pareto distribution parameter 'Alpha' to use a right censored distribution model. This approach improves over the synthetic timeout generation approach that was producing insanely high timeout values. Now we calculate build timeouts using truncated times. Bugfix on 0.2.2.2-alpha; fixes bugs 1245 and 1335. - Do not close circuits that are under construction when they reach the circuit build timeout. Instead, leave them building (but do not use them) for up until the time corresponding to the 95th percentile on the Pareto CDF or 60 seconds, whichever is greater. This is done to provide better data for the new Pareto model. This percentile can be controlled by the consensus. o Major features: - Move to the June 2010 Maxmind GeoLite country db (rather than the June 2009 ip-to-country GeoIP db) for our statistics that count how many users relays are seeing from each country. Now we have more accurate data for many African countries. - Port Tor to build and run correctly on Windows CE systems, using the wcecompat library. Contributed by Valerio Lupi. - New "--enable-gcc-hardening" ./configure flag (off by default) to turn on gcc compile time hardening options. It ensures that signed ints have defined behavior (-fwrapv), enables -D_FORTIFY_SOURCE=2 (requiring -O2), adds stack smashing protection with canaries (-fstack-protector-all), turns on ASLR protection if supported by the kernel (-fPIE, -pie), and adds additional security related warnings. Verified to work on Mac OS X and Debian Lenny. - New "--enable-linker-hardening" ./configure flag (off by default) to turn on ELF specific hardening features (relro, now). This does not work with Mac OS X or any other non-ELF binary format. o New directory authorities: - Set up maatuska (run by Linus Nordberg) as the eighth v3 directory authority. o Minor features: - New config option "WarnUnsafeSocks 0" disables the warning that occurs whenever Tor receives only an IP address instead of a hostname. Setups that do DNS locally over Tor are fine, and we shouldn't spam the logs in that case. - Convert the HACKING file to asciidoc, and add a few new sections to it, explaining how we use Git, how we make changelogs, and what should go in a patch. - Add a TIMEOUT_RATE keyword to the BUILDTIMEOUT_SET control port event, to give information on the current rate of circuit timeouts over our stored history. - Add ability to disable circuit build time learning via consensus parameter and via a LearnCircuitBuildTimeout config option. Also automatically disable circuit build time calculation if we are either a AuthoritativeDirectory, or if we fail to write our state file. Fixes bug 1296. - More gracefully handle corrupt state files, removing asserts in favor of saving a backup and resetting state. - Rename the "log.h" header to "torlog.h" so as to conflict with fewer system headers. o Minor bugfixes: - Build correctly on OSX with zlib 1.2.4 and higher with all warnings enabled. - When a2x fails, mention that the user could disable manpages instead of trying to fix their asciidoc installation. - Where available, use Libevent 2.0's periodic timers so that our once-per-second cleanup code gets called even more closely to once per second than it would otherwise. Fixes bug 943. - If you run a bridge that listens on multiple IP addresses, and some user configures a bridge address that uses a different IP address than your bridge writes in its router descriptor, and the user doesn't specify an identity key, their Tor would discard the descriptor because "it isn't one of our configured bridges", and fail to bootstrap. Now believe the descriptor and bootstrap anyway. Bugfix on 0.2.0.3-alpha. - If OpenSSL fails to make a duplicate of a private or public key, log an error message and try to exit cleanly. May help with debugging if bug 1209 ever remanifests. - Save a couple bytes in memory allocation every time we escape certain characters in a string. Patch from Florian Zumbiehl. - Make it explicit that we don't cannibalize one-hop circuits. This happens in the wild, but doesn't turn out to be a problem because we fortunately don't use those circuits. Many thanks to outofwords for the initial analysis and to swissknife who confirmed that two-hop circuits are actually created. - Make directory mirrors report non-zero dirreq-v[23]-shares again. Fixes bug 1564; bugfix on 0.2.2.9-alpha. - Eliminate a case where a circuit build time warning was displayed after network connectivity resumed. Bugfix on 0.2.2.2-alpha. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0