ORGCon 2013 June 8 London

Hi all,

Hopefully you know about ORGCon 2013

http://orgcon.openrightsgroup.org/

- but in case you don't it has a lot to offer you all. Hope to see some of you there!

Jim

A sample:

http://orgcon.openrightsgroup.org/2013/programme

Snoopers' Charter: What's the situation now?
 -Jim Killock, ORG Executive Director
- Peter Sommer
- Others TBC

Digital Arms Trade
-Hauke Gierow, Reporters without Borders
-Eric King, Privacy International

Regulating Code
- Ian Brown and Chris Marsden on their book and its conclusions

How to wiretap the Cloud (without anybody noticing)
-Caspar Bowden, independant privacy expert
Speaking on the threat of the US FISAA (Foreign Intelligence Surveillance Ammendments Act)

Fwd: BBC News - 'Fresh proposals' planned over cyber-monitoring

On 13 May 2013 18:45, Florian Weimer <fw@...> wrote:

> If you look at typical IPv6 textbooks, they give you a long list of
> advantages:
>
> * larger address space
> * simplified address structure
> * universal reachability of all end devices
> * protocol header optimized for efficient forwarding
> * more flexibility due to scoped addresses
> * improved security through IPsec
> * smaller routing tables due to aggregation
> * stateless auto-configuration
> * automatic renumbering between different provider aggregates
> * no broadcasts
> * improved multicast
> * built-in mobility
> * better for QoS with flow labels
>
> A lot of that turned out to be totally undesirable...

And those that were desirable were really only problems for people who
write software for routers. Not for end users. Or even people who run
computers for end users. Or even people who configure networkds for
people who run computers for end users.  And they have pretty much
been solved in the last twenty years by those people who write
software for routers.

And "simplified address structure" is only true if you are writing
software for routers.  To everybody else IPv4 looks simpler because

Apologies for the previous top post.

BBC Moneybox - contactless hiccups

        "Some Marks and Spencer customers have told the BBC of cases
        where the chain's contactless payment terminals have taken money
        from cards other than the ones intended for payment.

        "Card are supposed to be within about 4cm of the front of the
        contactless terminal to work.

        "But some customers say payments have been taken from cards
        while in purses and wallets at much greater distances.

http://www.bbc.co.uk/news/business-22545804
--

-- 
Roland Perry

BBC News - 'Fresh proposals' planned over cyber-monitoring

practical homomorphic encryption (allegedly)

Have received a link to the following article:

IBM takes a big new step in cryptography: practical homomorphic encryption

http://nakedsecurity.sophos.com/2013/05/05/ibm-takes-big-new-step-in-cryptography/

by Paul Ducklin on May 5, 2013

IBM just released an open source software package called HELib.

The HE stands for homomorphic encryption.

Although it doesn't sound terribly sexy or impressive, HELib is actually 
an interesting and important milestone in cryptography.

HE is also a surprisingly relevant topic right now, with our 
ever-increasing attraction to cloud computing.

<more in the article>

Peter

FAQ on UK law

Best practice for federated authentication and authorisation?

I'm currently looking for some sort of definition of best practice for
implementing federated authentication and authorisation systems, but
struggling to find much.

What I'm looking at is an application that uses Gmail/Facebook/Twitter
etc. for authentication via a bespoke intermediate ("cloud-based")
registration service and then does access control by verifying claims
with another bespoke cloud-based system.

Can anyone point me to any documents that discuss best practice for
implementation of such a system?  I'm thinking that handling all
transactions over HTTPS really isn't sufficient for this and that they
should all be at least time-stamped, digitally signed and use both
client and server certificates for HTTPS, but if I'm being overly
paranoid, or not paranoid enough, it would be useful to know :)

Thanks,
James

Phone hacking: the telco angle

I recently revisited parts of the phone hacking coverage (mainly
related to the activities of NotW), and it seems that this was never
framed as a security failure at the mobile phone operators who ran the
network and provisioned the attacked services.

Is there any explanation for this?

3D Secure / Verified By Visa

Does anyone know more about how it currently works than Wikipedia and Murdoch and Anderson 2010 [1] and
high-level descriptions for application writers [2]?

Originally, it took you to an iFrame which prompted you for a password you had previously agreed with the
issuer.  Later, for me at least (Lloyds TSB) it instead put up the Verified by Visa or its Mastercard
equivalent logo, said it was authenticating, and then immediately succeeded.  I assumed, without
checking, that it had dropped a random cookie which the issuer regarded as sufficient proof the card
hadn't been stolen.   Not ideal, but better than nothing, and avoids having to type the password.

This morning, I used my credit card for a transaction in my wife's name, because my wife's card had been
declined [3].   It was a non-trivial amount of money to a website I have never used before, but which Sue uses
regularly for small transactions.  This transaction was probably two orders of magnitude greater than
any previous one.   Our credit cards are separate accounts.   I was using her web browser while logged in to her
account.   My card went straight through, without asking for a 3DS password.  

To which I say, huh?  What state is there in a random user account on an OSX machine which allows it to assert
that it's me?  What are 3DS checking?

ian

[1] http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf

[2] http://www.web-merchant.co.uk/3dsecure.asp

[3]  Itself an interesting point.  We suspect that as we use my card for making large online purchases, I've
built up a history of doing "that sort of thing", while Sue hasn't.  Alternatively, if you do a lot of
transactions of size x with a merchant, a transaction of size 100x might scream "insider fraud with stored
credentials", while a first-time transaction of the same size doesn't raise the same concern.  

‘Secretbook’ Lets You Encode Hidden Messages in Your Facebook Pics