Harald Eilertsen

harald@hub.volse.no

Volse Hub admin

Homepage:: https://volse.anduin.net/~haraldei

'The goal is to automate us': welcome to the age of surveillance capitalism

Harald Eilertsen

Sun, 20 Jan 2019 21:54:07 +0100

This is by far the best and most informative piece I've read about surveillance capitalism, how it affects us, and why we should care. Starts off as a review of Shoshana Zuboff's latest book – The Age of Surveillance Capital, but the interview with Shoshana Zuboff at the end is also absolutely worth reading!

https://www.theguardian.com/technology/2019/jan/20/shoshana-zuboff-age-of-surveillance-capitalism-google-facebook

I haven't read the book yet, but this is one I'll definitely have to read!

#surveillancecapitalism #internet #privacy

Privacy Politics Internet

show all 11 comments

Beni Grind

Mon, 21 Jan 2019 20:58:45 +0100

@Harald Eilertsen Honestly, for some reason it didn't occur to me that I could just email an order to them and then pick it up when they notify me that it arrived... I don't mind paying a premium for this service.

h.EAR.t

Tue, 22 Jan 2019 11:58:17 +0100

Harald Eilertsen

Tue, 22 Jan 2019 13:12:00 +0100

@Tobias Yes, there were so many quoteworthy passages in the piece I ended up not quoting anything. But it really does put things into perspective. Can't wait to read the book.

The Watchdogs That Didn’t Bark

Harald Eilertsen

Sat, 19 Jan 2019 15:46:38 +0100

It’s also hard to overlook the fact that a lot of privacy advocacy groups in the U.S. get funding from the same tech companies that would ostensibly be affected by government regulation of consumer data collection. EFF, for example, took in about $822,000 from Google, including donations from employees that are matched by the company, in fiscal 2017. CDT collected about $590,000 in donations and support from Google in 2016 and received $250,000 from Facebook last year. As for OTI, Google’s former CEO Eric Schmidt co-founded and has been a significant donor to New America for years. He and his wife’s philanthropic foundation committed to $4 million in funding New America from 2016 to 2021. All of these groups maintain complete independence from their donors.

https://web.archive.org/web/20180921123410/https://slate.com/technology/2018/04/why-arent-privacy-groups-fighting-to-regulate-facebook.html

#politics #internet #privacy

Politics Internet Privacy

show all 7 comments

tomgrz

Sun, 20 Jan 2019 03:25:01 +0100 from Diaspora

The best way to tame an oversight institution is to give it food. Feed it enough treats and it will beg for more.

tomgrz

Sun, 20 Jan 2019 03:26:22 +0100 from Diaspora

The Green Party US understands this, deeply. They do not take money from Corporate-linked PACs.

tomgrz

Sun, 20 Jan 2019 03:26:52 +0100 from Diaspora

The Green Party US understands this, deeply. They do not take money from Corporate-linked PACs or Foundations.

Sensitive Data Exposure via WiFi Broadcasts in Android OS [CVE-2018-9489]

Harald Eilertsen

Mon, 03 Sep 2018 10:40:05 +0200

System broadcasts by Android OS expose information about the user’s device to all applications running on the device. This includes the WiFi network name, BSSID, local IP addresses, DNS server information and the MAC address. Some of this information (MAC address) is no longer available via APIs on Android 6 and higher, and extra permissions are normally required to access the rest of this information. However, by listening to these broadcasts, any application on the device can capture this information thus bypassing any permission checks and existing mitigations.

https://wwws.nightwatchcybersecurity.com/2018/08/29/sensitive-data-exposure-via-wifi-broadcasts-in-android-os-cve-2018-9489/

#android #vulnerability #security #privacy

Security

The "Sign-in with Facebook" problem and the open source solution

Harald Eilertsen

Mon, 27 Aug 2018 12:57:45 +0200

Björn Schießle wrote the following post Mon, 27 Aug 2018 08:00:06 +0200

scottnesbitt wrote: The "Sign-in with Facebook" problem and the #opensource solution https://www.itproportal.com/features/the-sign-in-with-facebook-problem-and-the-open-source-solution/

A convenient option has been gaining ground: Internet-wide single sign-on services run by the big OTTs. There is such a need for a simple solution that almost all websites quickly started to let you “login with Google” or “login with Facebook”. Or with Twitter. Or with all of them: just pick one of a list of ten providers and use their credentials.

This is a step forward, since you only need to remember the passwords to your social network accounts, and use them everywhere else. However, it poses a huge risk to your privacy: do you really want an monopolistic conglomerate whose business is based on monetising user information to know all the places where you log into, track you as you move among these services, and exchange information on you with them?

#id4me #privacy #identitymanagement

show all 31 comments

M. Dent

Mon, 27 Aug 2018 13:20:00 +0200

Except for ID4me, no other public, open, federated, privacy-friendly, user-centred Identity Management Standard exists.

Lies!

Harald Eilertsen

Mon, 27 Aug 2018 13:26:40 +0200

Or ignorance... but either way, it's an interesting approach.

M. Dent

Mon, 27 Aug 2018 13:33:58 +0200

@Mario Vavti - I'm working on a note to the editor of the publication indicating that basically this assertion is misleading and that Hubzilla can offer this today... But I think the case could be stronger if the OpenID connect stuff was in Master rather than just Dev. You know the codebase better than me, how much work would it take to merge those commits to master?

Mario Vavti

Mon, 27 Aug 2018 13:53:06 +0200

I think its about 4 or 5 commits we would need to port. I could do that in a minor release if the code is tested and reported working...

Beni Grind

Mon, 27 Aug 2018 13:55:07 +0200

OpenID, Mozilla Persona, Hubzilla. They really should do some research....

Darren Drapkin

Mon, 27 Aug 2018 13:56:57 +0200 from Diaspora

how does it compare with #openauth ?

M. Dent

Mon, 27 Aug 2018 14:14:37 +0200

Yeah, we need to have several people validate it first. There are things that need to be added, but a basic working system is sufficient.

I've got the dev code working with an instance of WordPress through openID connect (the plugin for WP needs some work, but it functions)... It'd be good if we knew it worked with others.

@muppeth and @poVoq - I think one or both of you were looking at the open-id-connect connect stuff - are you running an instance of the dev code with the ability to test it anywhere?

Harald Eilertsen

Mon, 27 Aug 2018 14:17:22 +0200

@Beni Grind ID4me is built on top of OpenID Connect.

I have to admit that my first reaction when I first saw ID4me mentioned also was "again...?" But I think the way they tie this in with DNS and their drive to standardise it looks promising. If we can do the same with hubzilla's openconnect implementation that's awesome, but a standard that works also for people not on hubzilla is preferable. With the rest in place, having hubzilla be an ID4me provider should be a trivial next step.

But yeah, others have tried and failed earlier, so only time will tell if this will fare any better. I hope it does, since something like this is desperately needed on the web!

Harald Eilertsen

Mon, 27 Aug 2018 14:25:05 +0200

@Darren Drapkin Not sure, do you have a link for OpenAuth?

M. Dent

Mon, 27 Aug 2018 14:31:36 +0200

The thing is, THIS is in the wheelhouse of Zot/Hubzilla. Even with all the things we know Hubzilla can do better, this is locked in. The fact that the NEXT iteration is already in the offing with ZotVI sternghens the case, "Hubzilla has been doing THIS exact thing for YEARS"

The only other thing that would make it a complete lock would be some sort of SDK for OWA/webfinger - even if it was only in PHP. If we could just get the authentication bit down to the bare essentials and package it up as a reference SDK, that would even further strengthen the proposition.

As usual, this is a call to action for those not in active development to shake the trees and find people who would be excited by this prospect and ask them to get involved with a mature project and help out. This isn't a suggestion that those in active development 'drop everything' (or anything for that matter) to make this happen.

The community needs to grow. This is a place where the path is pretty clear already and people with a little know-how, ingenuity, and some time can contribute to something great.

The very fact of this article and thought these companies are trying to recreate the wheel which Mike has already created, balanced and started rolling proves there is a desire for what we already have. We need to capitalize on that.

And not just devs! If you write, we need "rebuttal articles" to the misinformation being spread about how 'new' and 'innovative' these upstarts are. Even if you just follow tech -- make sure to comment on articles like these when you run across them and point people to Hibzilla and Zot. The @Hubzilla Advocacy channel can be used to share info on stories and coordinate efforts. A bunch of us doing a little can go a long way!

Brad Koehn ☑️

Mon, 27 Aug 2018 14:37:44 +0200 from Diaspora

Persona is dead, OpenID is pretty worthless since nobody actually wants it. ID4me addresses some of OpenID’s issues, but doesn’t actually exist yet. It would be nice if the various services in The Federation supported some kind of federated identity standard.

M. Dent

Mon, 27 Aug 2018 14:44:19 +0200

ID4me's tie to DNS is it's Achillies heel. Courts and corporate actors can still muck with your identity by getting your DNS revoked. Ultimately, ID4me's system IS still centralized. It is just LESS centralized. But it is not fully DEcentralized (Hubzilla is) ID4me's claim to decentralization are only "true enough" not to be completely lies.

Zot's nomadic identity is truly decentralized and not permanently tied to anything. You can maintain your identity on multiple domain names.

There is nothing for Hubzilla to "chase after" here. Zot/nomadic identity is already better. If we can validate the OpenID connect stuff, the only technical issue is documenting how to get open-id-connect to parse the webfinger address in order to address the correct hub. (THAT part is tied to DNS, but your actual identity is not in Hubzilla/Zot) - as long as your identity is on one hub that has valid DNS resolution, your identity is available to be used.

Harald Eilertsen

Mon, 27 Aug 2018 14:44:49 +0200

@M. Dent I'm really not sure what you're objecting to. ID4me isn't an upstart, it's a proposed standard. It's not about lock in, it's about getting identities back into the control of the users. It's not an implementation, others should do that. There's no reason why this can not be implemented by Hubzilla, as well as diaspora, and other players on the social web. You find more information on their website including their draft RFCs and more.

If the currently implemented id management functionality in Hubzilla is better, then standardize it. Write up the RFCs and promote it. I'll support that too!

Harald Eilertsen

Mon, 27 Aug 2018 14:51:24 +0200

@M. Dent:

ID4me's system IS still centralized. It is just LESS centralized.

How?

There is nothing for Hubzilla to "chase after" here. Zot/nomadic identity is already better.

Not asking you to chase after anything, and not disputing that the nomadic identities provided by zot/hubzilla is better. Still I have not seen any thoughts about how to use this outside of a hubzilla/zot universe. That's the part missing.

Also, one does not rule out the other. Perhaps even the nomadic identity specs could be contributed as part of the id4me initiative?

M. Dent

Mon, 27 Aug 2018 14:51:52 +0200

The Fediverse could have such a standard - if it looked at Hubzilla and Zot for what they really are and didn't try to shoe-horn it into the paradigm of 'just another social media platform'. It probably wouldn't even be a ton of work to do it!

M. Dent

Mon, 27 Aug 2018 15:09:23 +0200

@Harald Eilertsen

It is still centralized because DNS is inherently centralized. They tie your identity to your DNS address. If your DNS address goes bye-bye, your identity does too.

Your Zot/Hubzilla identity is not permanenetly tied to your DNS address. It only uses DNS as a bridge - that is the essence of nomadic identity. It goes where you go. If you change servers and are on a different domain, it is still YOU. Each of your clones is on a different DNS address - and they are completely interchangeable.

M. Dent

Mon, 27 Aug 2018 15:16:33 +0200 last edited: Mon, 27 Aug 2018 15:24:20 +0200

Using g your Zot/Hubzilla address outside of the Zot/Hubzilla universe is accomplished the same way ID4me seems to propose - through open-id-connect (at least at this stage). Dev already has open-id-connect working. We need some others to test and validate so we can push to master.

Note "OpenID" is not the same as OpenID-Connect. They are very different.

All it would take for an OpenID-Connect client to be able to validate your Hubzilla identity and get user info would be to parse your webfinger address and get the hostname and username both from that rather than getting the hostname from a static setting. Then, if your Hubzilla Hub had the OpenID-Connect module installed, you'd be able to use your Zot/Hubzilla identity as your single-signon identity.

Harald Eilertsen

Mon, 27 Aug 2018 15:28:28 +0200

@M. Dent

It is still centralized because DNS is inherently centralized.

Which is to say that the Internet is inherently centralised. So we have already lost.
At least if that was the case, which it luckily is not.

I know how the Hubzilla nomadic identities work, and it's bloody brilliant! Still, I've never seen anyone do the work and propose it as an internet standard to be used universally. It's that last part which makes id4me interesting, not necessarily it's technicalities.

Harald Eilertsen

Mon, 27 Aug 2018 15:31:21 +0200

@M. Dent:

All it would take for an OpenID-Connect client to be able to validate your Hubzilla identity and get user info would be to parse your webfinger address and get the hostname and username both from that rather than getting the hostname from a static setting.

Great! Now that's the part you need to standardise then. Go for it!

M. Dent

Mon, 27 Aug 2018 15:39:39 +0200

It's so fun when complete strangers presume to tell you what "you need to" do. Lol. (I find they are frequently the same who complain that "you think you're running a one-man-show!"Lol)

Harald Eilertsen

Mon, 27 Aug 2018 15:52:34 +0200

@M. Dent I'm not telling you to do anything at all. And please tell me when I've said anything about you running a one man show.

M. Dent

Mon, 27 Aug 2018 16:37:36 +0200

You have not. I also did not say you did. But before this gets any further down the rabbit hole of defensiveness and derails an otherwise very helpful and productive thread it may be helpful to realize that we are not the only participants in this conversation.

So with that in mind, I'll share some advice a company owner once gave me when I expressed concern that his pointed but general comments did not properly apply to everyone in the room though it was know they applied to some when they were made. "If it doesn't apply to you, you can safely ignore it. If it does, consider changing your behavior accordingly."

As to publishing a standard. I'm not the guy. It sounds like you may be, or at least may be interested in seeing that happen. Maybe you are or know somebody who could help organize such an effort. I don't know. But I agree that it would be great if someone rolled up their sleeves and made it happen. I think it's a great idea! I do know it would take me far too long to gain competence in writing standards to be that person and I can contribute more to the project in other ways. At the same time, I'm as sure as I can be that anyone who would take up the task would find ready assistance with the appropriate pieces. From what I've seen, the devs here love to talk about the nitty gritty details with those who show an interest and ask the relevant questions.

Harald Eilertsen

Mon, 27 Aug 2018 18:25:31 +0200

I'm afraid I'm not the person to drive a standardization process either. At least not at this time. But it would be awesome to see it happen, thus the attempted (but failed) encouragement in the earlier reply :)

M. Dent

Mon, 27 Aug 2018 19:09:55 +0200

:)

Well, if circumstances change - or if you know someone up to the task, I think everyone would be grateful for the help!

worblux@diaspora.koehn.com

Mon, 27 Aug 2018 20:30:34 +0200 from Diaspora

@Harald Eilertsen

@M. Dent

It is still centralized because DNS is inherently centralized.

Which is to say that the Internet is inherently centralised. So we have already lost. At least if that was the case, which it luckily is not.

Names and Identities are hard, and not system is perfect. Central authorities let you avoid name space collision, and deal with change and revocation efficiently. That being said there's not reason ID4me couldn't work on top of the .onion name service or namecoin with some small modifications.

M. Dent

Mon, 27 Aug 2018 20:47:16 +0200

Perhaps not. But the point remains that there is already a system that doesn't rely on DNS and provides nomadic identity and all of their aims seem to be satisfied by a system that has been around for years - with the exception of the OIDConnect piece which has been resolved (more could be done, but it is functional) and is pretty much just awaiting testing and validation before it can be fully released.

M. Dent

Mon, 27 Aug 2018 20:59:41 +0200

*by "doesn't rely on DNS,' I mean the identity is not permanently tied to a specific domain name.

Brad Koehn ☑️

Mon, 27 Aug 2018 22:12:04 +0200 from Diaspora

DNS is inherently centralized.

I've never understood this myth. DNS is not inherently centralized. You are free to set up your own peer DNS using existing servers, simply by re-configuring the root zone file. Boom! You have your own DNS that is completely under your control. Nobody else can read it without also being so configured, but that's no different than the system we have today.

Identity (which is the problem DNS solves) is inherently a trust-based system. If you don't like the system currently in use, you can easily establish your own. Good luck getting the rest of the internet to trust yours, though.

M. Dent

Mon, 27 Aug 2018 23:32:45 +0200

Ok, a technicality. DNS as it is currently implemented on the Internet is essentially though not inherently a centralized system. (better?)

Identity is not really the problem which DNS solves. The registration of DNS records with "authoritative" root servers requires those root servers to do due diligence and attempt to assure identity, but even this is not entirely reliable. The problems of accepting DNS as an Identity system are numerous. As you mention, someone else can set up a different root server and if they happen to trick various end-users into using their DNS root servers - identity is stolen. Also, if the centralized authority with control over the root servers ceases to delegate DNS zones to a server under your control, or if they delegate DNS zones to a server under someone else's control (say, someone who happens to notice that your domain has expired and nabs it before you reregister it....) then your identity system based on DNS is unreliable.

Since the trust-based DNS system currently implemented relies on a centralization of DNS root servers and a centralized (though shared) system for updating them - and the "owner" of record does not, in fact, have complete control over their identity records, for all intents and purposes, an identity system that is tied to DNS as ID4me appears to be, is defacto centralized (even if the underlying technology does not absolutely require it to be). You yourself point out that treating DNS as untrustworthy and rejecting the centralized control makes any identity system build on top of it centralized as well. At the very least, those who have responsibility for updating the DNS Root servers ultimately control your identity - so any system that inextricably ties identity to DNS, is not truly federated system that gives individuals CONTROL over their identity (which is the claim made of ID4me in the article).

As far as trust in identity - there is no essential requirement that it be centralized. In fact, most human trust systems are not centralized. SOME centralized systems have arisen, but even those are not universally trusted by all - and with good reason. Trust should be earned and gained by common consent and agreement. It can not be forced (and anyone who forces it is usually untrustworthy because they must use force to make you trust them).

Anyway - all this is to say that to build an identity system using DNS as an integral component the system is not ultimately reliable or truly federated because of the centralization of control which, though shared, is still consolidated in the hands of a few that are beholden to certain contractual or other legal requirements that may lead to a loss of control of a users identity and therefore fails to achieve the ultimate aim that ID4me seems to be trying to aim for.

ZOT and Nomadic Identity are divorced from a reliance upon DNS. Indeed, DNS is integral to the transport and ability to check and validate identity - but a failure of the DNS system or a rerouting of requests by corruption of DNS will simply result in a failure to verify the identity or, possibly, result in a case of mistaken identity. But it will not result in theft of identity as a system inextricably tied to DNS would.

And I think that is the whole point - this conglomerate of mostly large scale ISP's who make a mint off of DNS registrations would LOVE to tie your identity to DNS... then they'll set up extra levels of DNS validation and set themselves up as those who are trustworthy and extract whatever they wish in fees... essentially doing an end run around Facebook, but still accomplishing the same thing that Facebook does - making money off your identity.

worblux@diaspora.koehn.com

Tue, 28 Aug 2018 00:20:55 +0200 from Diaspora

I’ve never understood this myth. DNS is not inherently centralized. You are free to set up your own peer DNS using existing servers, simply by re-configuring the root zone file.

All you've done there is change your center, you haven't de-centralized/federated DNS by any means. While I and many people override/provide a few entries in a hostfile for personal use/naming these won't/don't work when you move to a different network or machine. If you mess with your DNS too much all of a sudden you aren't working with a global name-space.

M. Dent

Wed, 29 Aug 2018 23:23:43 +0200

@Harald Eilertsen

After a little research - perhaps there is absolutely no need to do any sort of standardization ---- it's already baked in!

https://openid.net/specs/openid-connect-discovery-1_0-21.html#IssuerDiscovery
https://tools.ietf.org/html/rfc7033

We just need to make sure our implementation is compliant.

@Mike Macgirvin - do you know off hand if we are - or could easily be compliant with section 3 of rfc7033?

How I Hacked BlackHat 2018

Harald Eilertsen

Tue, 21 Aug 2018 21:47:15 +0200 last edited: Sun, 14 Oct 2018 19:47:17 +0200

During training at BlackHat this year I was getting frustrated with my badge and lanyard making noise around my neck in training, so I took it off and set it down on the table next to me. Later I set my phone on top of it and saw a notification to read the NFC tag. Out of curiosity I downloaded a tag reader app, looked at the data stored on my tag and made a few observations(...)

https://ninja.style/post/bcard/

Good thing it's fixed now, but you would expect BlackHat to be a bit more proactive with it's own security.

#blackhat #hacking #privacy

Security

Some moments are personal....

Harald Eilertsen

Fri, 15 Jun 2018 09:57:55 +0200

If you're a parent, you should definitely watch this. Don't post pictures of your children (or anybody else who has not given their consent for you to do so) on social media or the internet.

https://www.youtube.com/watch?v=ziltBdyFxDo

#privacy #socialmedia #children #consent

EU-US Privacy Shield not up to snuff, data tap should be turned off

Harald Eilertsen

Wed, 13 Jun 2018 11:48:23 +0200

"While progress has been made to improve on the Safe Harbor agreement, the Privacy Shield in its current form does not provide the adequate level of protection required by EU data protection law and the EU Charter," said Claude Moraes, chair of [the civil liberties committee (LIBE)].

https://www.theregister.co.uk/2018/06/12/meps_privacy_shield_insufficient_protection/

#privacy #privacyshield #eu #us

Harald Eilertsen

Sat, 26 May 2018 16:22:40 +0200

Hacker News ( unofficial ) wrote the following post Sat, 26 May 2018 07:17:17 +0200

Ghostery exposed everyone's email address in its GDPR email by not using BCC

HN Discussion: https://news.ycombinator.com/item?id=17159497
Posted by rexbee (karma: 371)
Post stats: Points: 98 - Comments: 13 - 2018-05-26T01:10:31Z

\#HackerNews #address #bcc #email #everyones #exposed #gdpr #ghostery #its #not #using
HackerNewsBot debug: Calculated post rank: 69 - Loop: 67 - Rank min: 60 - Author rank: 90