Censorship risks and electoral impact: Australia’s major parties need to drop WeChat – The Strategist

Scott Morrison demanded three things in his emotionally charged press conference about that tweet last week. One: an apology, two: that the Chinese government remove foreign ministry spokesman Zhao Lijians post, and three: that Twitter remove the post.

None of the demands were met. Instead, even as the prime ministers fulmination over Beijings deliberate provocation was still echoing around the world, the only post that was removed was his own statement on the issue that his team had posted to the Chinese social media platform WeChat.

In the now-censored post, Morrison delivered a message he should have led with in the first place. He said that Australia was a free, democratic country and was using an honest and transparent process to deal with the allegations of war crimes in Afghanistan.

Where there are alleged events that have taken place that require action, well we have set up the honest and transparent processes for that to take place. That is what a free, democratic, liberal country does, he wrote.

Morrisons comments were replaced with a notice from WeChat saying the post involved the use of words, pictures, videos that would incite, mislead and violate objective facts, fabricating social hot topics, distorting historical events and confusing the public.

But when the prime minister was asked if he was making representations to Twitter and WeChat about their content-moderation decisions, he told reporters it was a matter for the social media companies.

We have made our views clear on that and they can make an explanation of their action if they choose to make one, he said.

Deleting the social media post of Australias leader would seem to be a fairly drastic move that would warrant a stern and strident reaction and a demand for an explanation. So why was Morrisons response to this apparent act of censorship so limp?

One reason is clear. What WeChat did was totally within its rules, and the prime minister knows it.

Morrison has known for at least a year and a half that, because his account is registered to an unnamed man in Fujian province, any message he posts from it is subject to Chinas censorship rules.

The PM is not alone. When the ABC looked into the situation in April 2019, it found no less than a dozen accounts operated by Australian politicians that were registered to random people in the Peoples Republic of China.

The Australian politicians who have set up their WeChat accounts this way are actually in breach of the platforms terms and conditions. Under WeChats rules, the initial registration applicant shall not donate, borrow, rent, transfer or sell the Weixin [WeChat] account, nor permit any non-initial registration applicant to use the Weixin account. That means they could be shut down at a moments notice, even during a hotly contested election, for example.

Aside from the fact that this arrangement opens up politicians to censorship from Beijing, it also puts the PRC nationals in whose names the accounts are registered in serious danger.

If one of these politicians were inclined to post a message that crossed one of Beijings many political red linesas the prime minister did last weekthe account owner could be detained by Chinese authorities.

In fact, just a couple of days after the prime ministers WeChat account was censored, the Victorian Liberal Partys WeChat account was stripped of its name by the platform for breaking its rules.

That account is tied to a Shanghai-based company that is registered to Locky Ge, the founder and chief executive of fintech company RoyalPay, a Melbourne-based start-up which has partnered with Tencent (WeChats parent company) to roll out WeChat payment to Australian consumers.

So why are politicians and political parties so willing to put themselves in a position where they could be censored by Beijing and endanger the safety of Chinese citizens?

After all, they could mitigate some of these concerns if, instead of using whats referred to on WeChat as a subscription account (), which requires registration via a Chinese national third party, they used a service account (), which does not.

The reason they dont do this? Simple. A subscription account allows for one push-notification-enabled article a day. A service account only allows for four push-notification-enabled articles a month.

The Australian Labor Party, presumably by contacting Tencent directly, has attempted to strike a balance between these security and censorship concerns and its electoral need to communicate directly with Chinese-Australian voters. Labor has a subscription account that anomalously is not registered to anyone.

Clearly, WeChat does not provide a level playing field. Australias two major parties find themselves in a classic prisoners dilemma: if either of them makes too much of a fuss about Tencents lack of transparency, they could be penalised by the platform and give their domestic political opponents a distinct electoral advantage.

That advantage isnt trivial. There are several marginal seats at the federal level in Australia (and more at the state level) with large numbers of WeChat-using Chinese-Australian voters in them. Chisholm in Victoria and Banks, and Reid and Bennelong in New South Wales are prime examples. When the difference between being in government and being in opposition comes down to a handful of seats, the use of WeChat could potentially be decisive.

With the next federal election likely to be held in 2022, now would be a good time for the Liberal and Labor parties to mutually agree to stop using WeChat as a campaign channel and to start work on bipartisan legislation to properly regulate this influential platform.

View original post here:

Censorship risks and electoral impact: Australia's major parties need to drop WeChat - The Strategist

Technology Innovation Institute Appoints Global Cryptography Leaders as its Board of Advisors at Cryptography Research Centre – Business Wire

ABU DHABI, United Arab Emirates--(BUSINESS WIRE)--Technology Innovation Institute (TII), the applied research pillar of Advanced Technology Research Council (ATRC), today announced the formation of a board of advisors at Cryptography Research Centre (CRC). The new board of advisors comprises global experts in the field of cryptography.

The appointments follow a series of rapid announcements at Technology Innovation Institute since the first Advanced Technology Research Council board meeting in August 2020.

CRC is one of the initial seven dedicated centres at TII and it is also one of the few global centres bringing together theoretical and applied cryptographers in a research-oriented setting. The cryptographers collaborate on breakthrough research projects that lead to innovative outcomes in cryptography. Spanning fields from post quantum cryptography (PQC), lightweight cryptography, cryptanalysis, cryptographic protocols, hardware-based cryptography, confidential computing, amongst others, the distinguished board of advisors will guide efforts to develop breakthrough technologies for global impact, reinforcing the UAEs position as a global hub for innovation and R&D.

The Board of Advisors includes: Prof Joan Daemen, Professor of Symmetric Cryptography at Radboud University in The Netherlands, who co-designed the Rijndael cipher that was selected as the Advanced Encryption Standard (AES) and is also one of the co-designers of the Keccak (SHA-3) cryptographic algorithm; Prof Lejla Batina, Professor of Hardware Cryptography at Radboud University, whose expertise is in applied cryptography and embedded systems security; Dr Guido Bertoni, CEO of Security Pattern, Italy, whose research areas include cryptographic algorithms, hardware-based cryptography, applied cryptography and embedded systems security. He is also a co-designer of the Keccak (SHA-3) cryptographic algorithm. Prof. Carlos Aguilar, Professor of ISAE SUPAERO in Toulouse University, France, a post quantum cryptographer and expert in secure cryptographic implementations and computational theory; Prof. Damien Stehl, Professor in Computer Science at cole Normale Suprieure de Lyon, France, whose focus areas are post quantum cryptography, computational theory and complex algebra; and Prof. Tim Gneysu, Professor of Security Engineering at Ruhr-University Bochum, Germany, who is an expert in secure hardware implementations, cloud cryptographic schemes and secure engineering.

CRC currently employs and collaborates with scientists in multiple crucial fields of cryptography. The experts are engaged in the full spectrum of fundamental and applied cryptography and cryptanalysis research.

Speaking on the board appointments, Dr Najwa Aaraj, Chief Researcher at CRC, said: The success of any scientific and research-focused entity is led by its board of advisors as they support in setting the vision. By bringing together renowned experts, we are connecting global expertise in the field of cryptography.

Dr Aaraj added: Through the research undertaken at the Cryptography Research Centre, we are confident that Abu Dhabi and the UAE will pioneer breakthrough technologies that ensure even greater enhancements in high-priority cryptographic areas.

TII is a pioneering global research and development centre that focuses on applied research and new-age technology capabilities. The Institute has seven initial dedicated research centres in quantum, autonomous robotics, cryptography, advanced materials, digital security, directed energy and secure systems. By working with exceptional talent, universities, research institutions and industry partners from all over the world, the Institute connects an intellectual community and contributes to building an R&D ecosystem in Abu Dhabi and the UAE. The Institute reinforces Abu Dhabi and the UAEs status as a global hub for innovation and contributes to the broader development of the knowledge-based economy.

To know more about Cryptography Research Centre (CRC):

tii.ae/cryptographytii.ae/cryptography

*Source: AETOSWire

More:
Technology Innovation Institute Appoints Global Cryptography Leaders as its Board of Advisors at Cryptography Research Centre - Business Wire

How Password Hashing Algorithms Work and Why You Never Ever Write Your Own – Security Boulevard

Are you fascinated with cryptography? Youre not alone: a lot of engineers are. Occasionally, some of them decide to go as far as to write their own custom cryptographic hash functions and use them in real-world applications. While understandably enticing, doing so breaks the number 1 rule of the security community:??dont write your own crypto.?

How do hashing algorithms work and whats special about password hashing? What does it take for an algorithm to get ready for widespread production use? Is security through obscurity a good idea? Lets see.?

Before storing a users password in your applications database, youre supposed to apply a cryptographic hash function to it. (Youre not storing passwords in plain text, right? Good. Just asking.)?

Any cryptographic hash function converts an arbitrary-length input (a.k.a. message) into a fixed-length output (a.k.a. hash, message digest). A??secure cryptographic hash function??must be:?

Now, theres general cryptographic hashing, and then theres password hashing that is somewhat special.?

Standard cryptographic hash functions are designed to be fast, and when youre hashing passwords, it becomes a problem.??Password hashing must be slow.??You want to make it as hard as possible for the attacker to apply brute force attacks to passwords in your database should it ever leak. This is why you want to make passwords hashing computationally expensive. How expensive? Well, its a tradeoff between convenience for your legitimate users when they validate their passwords and making brute-force attacks hard for the attacker.?

To make hashing computationally expensive, a special kind of functions is commonly used:??key derivation functions??(KDFs). Under the hood, KDFs invoke hashing functions, but they add a random salt before hashing, and then apply numerous (usually thousands or tens of thousands) iterations of hashing. Ideally, they make brute force attacks both CPU-intensive and memory-intensive.?

A key derivation function produces a derived key from a base key and other parameters. In a password-based key derivation function, the base key is a password and the other parameters are a salt value and an iteration count?(RFC 2898: Password-Based Cryptography Specification Version 2.0).

In password hashing discussions, the terms hash function (such as MD5 or SHA-1) and key derivation function (such as PBKDF2 or Argon2) are often used interchangeably although theyre technically not the same.?

Both writing a custom hashing algorithm and creating your own implementation of a well-known algorithm are bad ideas. Why??

You probably dont have the skills. Lets face it: cryptography is hard, and messing up an algorithm or implementation is easy, even for professionals. Should you go for creating your own password hashing, some of the things youd need to take care of include:?

This is a lot on your plate even more so given that??you wont have access to qualified testers??from the cryptography community to help you find (inevitable) vulnerabilities.?

Youll likely want to depend on secrecy and obscurity??by keeping your algorithm private. Doing so breaks the fundamental doctrine of cryptography known as the?Kerckhoffs?principle:??a cryptosystem should be secure even if everything about the?system, except the key, is public knowledge.??Security by obscurity can provide a short-term advantage but relying on it long-term is a bad practice:?

Youll put sensitive user data at risk. Leaking sensitive user data is one of the worst things that can happen to a business. This is something that instantly undermines trust, turns customers away, and is very expensive to remediate. Some companies and lots of developers are prone to the Not Invented Here fallacy, but password hashing is probably the worst thing you can choose to re-implement.?

Most importantly,??you wont know when your algorithm gets broken.?

Established algorithms and implementations benefit from??years of testing and polishing??by large communities of cryptography experts who help reveal and fix vulnerabilities without any malicious intent.?

Since your own algorithm and/or implementation wont be available to anyone with a good will, attackers will be the only category of people willing to crack it. Once they do that, they wont give you a headsup;?youll only know when sensitive data of your users is?compromised,?and your business is in serious trouble.?

Thats great! Go forward and practice. Read reference implementations of existing algorithms, play with your own implementations, reach out to the community for advice, and have a great time learning something new and exciting!?

Just dont use whatever youve written in your production applications.?

To learn more, read our vulnerability decoder on insecure crypto.?

Recent Articles By Author

*** This is a Security Bloggers Network syndicated blog from Application Security Research, News, and Education Blog authored by fheisler@veracode.com (fheisler). Read the original post at: https://www.veracode.com/blog/secure-development/how-password-hashing-algorithms-work-and-why-you-never-ever-write-your-own

Original post:
How Password Hashing Algorithms Work and Why You Never Ever Write Your Own - Security Boulevard

WISeKey launches IoT partnerships via the Trust Protocol Association to monetize its intellectual property (IP) portfolio, including both patent and…

WISeKey launches IoT partnerships via the Trust Protocol Association to monetize its intellectual property (IP) portfolio, including both patent and data assets

Geneva, Switzerland/New York, USA December 14, 2020 WISeKeyInternational Holding Ltd. (WISeKey NASDAQ: WKEY; SIX Swiss Exchange: WIHN), a leading cybersecurity IoT company, today announced the launch of IoT partnerships via the Trust Protocol Association to monetize its intellectual property (IP) portfolio, including both patent and data assets.

With a rich portfolio of more than 46 patent families, covering over 100 fundamental individual patents, and another 22 patents under review, WISeKey continues to expand its technology footprint in various domains including the design of secure chips powered with near field communication (NFC) technology, development of security firmware and backend software, secure management of data, improvement of security protocols between connected objects and advanced cryptography. The Company has filed strategic patents in U.S. which are essential to the digital transformation applications that are fueling the growth in the IoT market (see list patents https://www.wisekey.com/company/our-value-proposition/our-patents/).

For WISeKey, adding to its patent portfolio and intellectual property is key to ensuring that it remains a major player in the IoT industry for years to come, providing its customers with scientifically proven technology that differentiates and protects their products from counterfeiting, adds valuable supply-chain tracking features, and prevents the loss of sensitive enterprise and consumer data.

Digital transformation in the IoT market is opening up new applications that can improve the efficiencies of power grids, use NFC chips embedded on pharmaceutical labels to provide better quality healthcare, or secure autonomous vehicles but its also creating new security risks, each with its own set of challenges and consequences. Digital identities provided as part of the WISeKey Integrated Security Platforms act as the first line of defense in IoT security architectures by giving each object its own unique, immutable, identity that can be used for strong authentication of the device and encryption of sensitive data as it travels from the edge to the cloud.

The purpose of the Trust Protocol Association is to establish a new Trust Protocol for the internet combining traditional Cryptographic Trust Models with distributed blockchain ledgers creating a new Global Trust platform.

The mission of the Association is to create an ecosystem of governmental, technology and business partners, each representing a node with the possibility to have multiple nodes per country.Blockchain-based solutions aim to override the need for a central authority by distributing information previously held in a centralized repository across a network of participating nodes. While Blockchain is not owned by one individual or organization, anyone with an internet connection (and access, in the case of private Blockchains) can make use of it, help maintain and verify it. When a transaction is made on a Blockchain, it is added to a group of transactions, known as blocks. Each block of transactions is added to the database in a chronological, immutable chain. Each block is stamped with a unique cryptographic code, which ensures that records are not counterfeited or changed. The Blockchain approach lacks legal validity in most jurisdictions, which only recognize the digital signatures as equally valid that manuscript signatures when generated using traditional PKI technology.

The Trust Protocol Association is working with a number of members in USA, Asia MEA and Europe to deploy a fully compliant Trusted Health Passport using the WIShelter Version 2, a new application in the WISeID App ecosystem, designed to remediate risks during the global COVID-19 lockdown period. Using their digital identity secured by WISeKey, users will be able to geo-localize other certified users and stablish secure communications. If needed, the app allows users to prove to local authorities that they are respecting the stay at home recommendations. To ensure the data privacy, each users Personal Identifiable Information is kept encrypted and never disclosed without their consent. For more information visit: https://www.wisekey.com/press/wisekey-oiste-org-and-the-trust-protocol-association-to-help-health-organizations-deploy-a-covid-19-trusted-health-passport-on-the-blockchain/.

About WISeKey

WISeKey (NASDAQ: WKEY; SIX Swiss Exchange: WIHN, NASDAQ: WKEY) is a leading global cybersecurity company currently deploying large scale digital identity ecosystems for people and objects using Blockchain, AI and IoT respecting the Human as the Fulcrum of the Internet. WISeKey microprocessors secure the pervasive computing shaping todays Internet of Everything. WISeKey IoT has an install base of over 1.5 billion microchips in virtually all IoT sectors (connected cars, smart cities, drones, agricultural sensors, anti-counterfeiting, smart lighting, servers, computers, mobile phones, crypto tokens etc.). WISeKey is uniquely positioned to be at the edge of IoT as our semiconductors produce a huge amount of Big Data that, when analyzed with Artificial Intelligence (AI), can help industrial applications to predict the failure of their equipment before it happens.Our technology is Trusted by the OISTE/WISeKeys Swiss based cryptographic Root of Trust (RoT) provides secure authentication and identification, in both physical and virtual environments, for the Internet of Things, Blockchain and Artificial Intelligence. The WISeKey RoT serves as a common trust anchor to ensure the integrity of online transactions among objects and between objects and people. For more information, visitwww.wisekey.com.

Press and investor contacts:

Disclaimer:

This communication expressly or implicitly contains certain forward-looking statements concerning WISeKey International Holding Ltd and its business. Such statements involve certain known and unknown risks, uncertainties and other factors, which could cause the actual results, financial condition, performance or achievements of WISeKey International Holding Ltd to be materially different from any future results, performance or achievements expressed or implied by such forward-looking statements. WISeKey International Holding Ltd is providing this communication as of this date and does not undertake to update any forward-looking statements contained herein as a result of new information, future events or otherwise.

This press release does not constitute an offer to sell, or a solicitation of an offer to buy, any securities, and it does not constitute an offering prospectus within the meaning of the Swiss Financial Services Act (FinSA), the FinSAs predecessor legislation or advertising within the meaning of the FinSA, or within the meaning of any other securities regulation. Investors must rely on their own evaluation of WISeKey and its securities, including the merits and risks involved. Nothing contained herein is, or shall be relied on as, a promise or representation as to the future performance of WISeKey.

The securities offered will not be, and have not been, registered under the United States of America Securities Act of 1933, as amended, and may not be offered or sold in the United States of America, absent registration or an applicable exemption from the registration requirements of said Act.

Read more:
WISeKey launches IoT partnerships via the Trust Protocol Association to monetize its intellectual property (IP) portfolio, including both patent and...

Appointments, honors and activities – Purdue News Service

A pair of Purdue engineering professors and a computer science professor have been chosen to the 2021 class of newly elevated fellows of the IEEE.

Yung-Hsiang Lu, professor of electrical and computer engineering, was named for his contributions to energy efficiency of computer systems. His research focus is mobile and cloud computing, energy-efficient computing, and image and video processing. Gesualdo Scutari, the Thomas and Jane Schmidt Rising Star Associate Professor in the School of Industrial Engineering and professor of electrical and computer engineering, was selected for his contributions to distributed optimization in signal processing and communications. Scutaris research interests include distributed and large-scale optimization, computational game theory, variational inequalities, machine learning, big data and applications in communications, networking, signal processing and sensor networks. Ninghui Li, the Samuel D. Conte Professor of Computer Science, was named for his contributions to data privacy and security. Lis research focus includes data privacy, access control, trust management, applied cryptography, and human factors in security and privacy.

IEEE Fellow is a distinction reserved for select IEEE members whose extraordinary accomplishments in any of the IEEE fields of interest are deemed fitting of this prestigious grade elevation, according to its website.

More here:
Appointments, honors and activities - Purdue News Service

What are the Odds That Trump Pardons Himself? – The New Yorker

Its Presidential pardon season! For obstructors of justice and launderers of foreign cash, the waning days of the Trump Administration might as well be the Super Bowl. Historically, this end-of-term bonanza has been the domain of a privileged guilty few, with the general public cut out of the action. But times change. Recently, a man named Pat Morrow surveyed the scene and thought, What if I gave you two-to-one odds on Giuliani?

Morrow runs the odds-making operation at Bovada, an online sports book. This year, with the N.C.A.A. Tournament cancelled and the Olympics postponed, Bovada has cleaned up on political wagering. It has allowed bets on everything from Bidens running mate (Kamala Harris led for weeks) to which word Trump would say first at a post-election press conference (fraud and steal lost to count, a heavy underdog). If you are a patriotic American concerned about the electoral process, thats kind of depressing, Morrow said, of the press-conference bet. But it got great engagement.

The latest action is on Bovadas pardon market. From the start, the former Trump campaign chair Paul Manafort has been the favorite to receive a pardon, at minus 400 (a winner must bet four hundred bucks on him in order to make a hundred). He is trailed by the campaign advisers George Papadopoulos (minus 325) and Rick Gates (minus 300). When setting lines for events like a Mets game, Bovada uses stats and probabilities. But for pardons, Morrow said, we really just went through a Whos Who of people who are in trouble, and who have some kind of connection to Trump. He added, Who would be in his best interest? Bannon makes sense, Gates makes sense, Manafort really, really, really makes sense. For those looking for a potential dark horse, Julian Assange is plus 250: a hundred-dollar wager would net two hundred and fifty. Ghislaine Maxwells at three to one, Morrow said. Thats probably not fair. I would recommend not betting that.

Getting in on the pardon game requires a working knowledge of constitutional law. I wasnt sure if we wanted to put Trump himself as an option, because theres still some legal discussion as to whether thats possible, Morrow said. Trump made the cut as a plus-160 dog. Initially, his three eldest children did not. We thought he did not have the power to do it, Morrow said. But, when the Times reported that Trump was, in fact, discussing the matter with advisers, the lines went up. Theyre currently plus 130. Jared Kushner is plus 150.

Rudy Giuliani posed another quandary. Can a President premptively pardon someone who hasnt been charged with a crime? Giuliani began as a bargain, plus 240. That one was probably a mistake on our side, Morrow said. I personally didnt price this one. I would suggest that perhaps the trader behind it was thinking that, as it currently stands, Rudy doesnt have any indictments pending. Bettors hammered the line all the way down to plus 140. Giuliani is now the most popular wager on the board. Trump is second.

The election itself accounted for a quarter of Bovadas 2020 revenue. (It was bigger than Mayweather-McGregor! Morrow said.) About two-thirds of the money was on Trump, though most savvy bettors, or sharps, bet Biden. The Biden bettors were paid only after the votes were certified. Morrow is now concerned about the tiny chance that the certifications will be overturned; hed have to pay out the Trump wagers, too. But, in the grand scheme of things, whats a quarter of a years revenue versus, you know, the republic being torn apart? Morrow asked. Thats actually kind of given me a weird bit of peace.

How are the sharps approaching pardons? Gadoon Kyrollos, a prominent professional gambler who goes by Spanky, recommended betting against the news. That strategy returned a big profit for him on Election Night. The market went crazy after Trump, then the underdog, won Florida. I was trading until 4 a.m., Spanky said. Trump was a three-to-one favorite. When I wake up, Trump becomes a three-to-one dog. And then, by 7 p.m., that became a ten- or fifteen-to-one underdog. You never see movement like that. Thats once in a lifetime. Almost like last weekends Jets game. Although that might have been on purpose.

Despite the windfall, Spanky and his partners are sitting out the pardon market. If were not getting down fifty, a hundred thousand a game, were really not into it, he said. Plus, its personal. Eight years ago, Spanky was pinched in a gambling bust. He maintains that he was simply a bettor (legal), but that the large sums he was moving convinced the police that he must be a bookie (illegal). He pleaded guilty to avoid a trial. Officially, hes a felon. Earlier this year, he petitioned both Trump and Andrew Cuomo, on Twitter, for a pardon. Im a hundred to one, Spanky said.

Read more:
What are the Odds That Trump Pardons Himself? - The New Yorker

Vivienne Westwood’s Son and His Ex-Publicist Are Having a Dramatic Dudefight Over Email – Jezebel

Image: Niklas HALLEN (Getty Images)

Did everyone know that in July, London designer Vivienne Westwood locked herself in a birdcage to protest the extradition trial of WikiLeaks founder Julian Assange? Well, its been approximately 100 years since June, so I totally forgot.

In the shadow of this perplexing political stand, however, a lesser, more confounding drama has escalated to an all-out cage match between Westwoods son and his publicist. Joe Corr, a similar fashion activist and Westwoods heir, was been embroiled in a heated email exchange with his former publicist, Richard Hillgrove, with whom he has worked since 2014. WWD reports that Hillgrove quit his job in September, after the two collaborated on Westwoods bizarre political stunt. Hillgrove reportedly gave Corr a month notice before he left his employment, but in emails seen by the outlet, Corr rejected his notice, and began sending Hillgrove e-mails so venomous they could turn a man to stone. Let me be the judge of that; heres one, per WWD:

Your behavior has been disgusting, I have supported you so much in the past to the point where I would have taken a bullet for you. You havent even had the decency to explain or discuss your decision to cut your relationship with me after everything we have been through.

Elsewhere in the email, WWD reports that Corr than used words to describe Hillgroves wife that cannot be reprinted here. Hillgrove also told the outlet that Corr used sexist language and religious hate speech in the same email.

In a comment to WWD about the whole affair, Corr did himself absolutely no favors.

Richard is an idiot, and his desire to let everyone know that he is one by sending out press releases on this non-story just proves that he is one. We worked very successfully together as a team, but when he is left to his own devices he is a car crash. Goodbye Richard!

G/O Media may get a commission

OK, but is Vivienne Westwood still in that birdcage? Ive lost the plot on what exactly everyone is fighting about. But to Corr, specifically: Please log off!

The rest is here:
Vivienne Westwood's Son and His Ex-Publicist Are Having a Dramatic Dudefight Over Email - Jezebel

What’s at stake in the Computer Fraud and Abuse Act (CFAA) – Help Net Security

Two weeks ago, the Supreme Court heard oral arguments in Van Buren vs. United States, the landmark case over the Computer Fraud and Abuse Act (CFAA). Nathan Van Buren, the petitioner in the case, is a former police officer in Georgia who used his lawful access to a police license plate database to look someone up in exchange for money. Van Buren was indicted and convicted of violating the CFAA for using his legal access to the database in a way it was not intended.

The fundamental question presented to the Supreme Court is whether someone who has authorized access to a computer violates federal law if he or she accesses the same information in an unauthorized way. While the question may seem trivial, this is a welcome and long overdue court case that could have a major impact on security researchers, consumers, and corporations alike.

Intended as the United States first anti-hacking law, the CFAA was enacted almost thirty-five years ago, long before lawyers and technologists had any sense of how the Internet would proliferate and evolve. In fact, the Act is outdated enough that it specifically excludes typewriters and portable hand-held calculators as a type of computer.

Since its inception, it has been robustly applied for basic terms and services breaches, like the infamous case of Aaron Swartz downloading articles from the digital library JSTOR, to indicting nation-state hackers and extraditing Julian Assange.

The core of the problem lies in the vague, perhaps even draconian, description of unauthorized computer use. While the law has been amended several times, including to clarify the definition of a protected computer, the ambiguity of unauthorized access puts the average consumer at risk of breaking federal law. According to the Ninth Circuit, you could potentially be committing a felony by sharing subscription passwords.

The stakes are particularly high for security researchers who identify vulnerabilities for companies without safe harbor or bug bounty programs. White-hat hackers, who act in good faith to report vulnerabilities to a company before it is breached, face the same legal risks as cybercriminals who actively exploit and profit from those vulnerabilities. Say, for example, that a security researcher has identified a significant vulnerability in the pacemaker that a healthcare company produces. If the healthcare company hasnt published a safe harbor agreement, that security researcher could face up to ten years in prison for reporting a vulnerability that could potentially save someones life.

On the less drastic side, security researchers who work with companies to protect their systems face legal risk in their day-to-day activities. During a penetration test, for example, a client will list assets that are in scope for testing, as well as state what tests are prohibited (e.g., any action that causes a denial of service and crashes a server). A penetration tester could face legal liability and prison time for inadvertently testing the wrong asset that is out of scopeor accidentally executing a test that breaches authorized use. Arguably, engineers could face the same legal liability if they access the wrong database or push the wrong code.

On one hand, the broad and ambiguous language of the CFAA provides robust legal protection for companies and facilitates federal resources, like the FBI, if a significant breach occurs. Some companies have argued that narrowing the scope of the CFAA would not be damaging to security programs if companies are already contracting security services, including crowdsourced programs like bug bounty. One company received pushback from the information security community when it accused MIT security researchers of acting in bad faith by identifying vulnerabilities in its mobile app. Some companies have argued that the difficulty of attribution, meaning the ability to accurately identify a threat actor, makes it difficult to distinguish good actors from cybercriminals.

Yet the CFAA is a reactive measure that would be enforced following an incident. Companies should ideally be focused on preventative measures to protect against a breach before it occurs. It is arguably to the detriment of companies like Voatz, which serves the public through its voting app, that the CFAA is so broad, since security researchers may choose not to investigate or report vulnerabilities due to the possibility that they could be reported to the FBI. While attribution can be incredibly difficult, good faith security researchers will always identify themselves when they report a vulnerability. Unlike malicious actors, who will exploit vulnerabilities for their own gain, security researchers act to increase the security posture of a company and protect citizens from harm.

All companies should use security services, like penetration testing, bug bounty programs, and safe harbor, to quickly identify and triage vulnerabilities. However, security researchers all have different methods for testing and may not be able to cover all of the assets that a company owns. For example, an ethical hacker may be focused on exploiting a SQL injection in a database, he or she may miss exposed credentials on the Internet that allow access into a protected server. With the rapid pace of DevSecOps, engineers could be pushing changes a dozen timesor morein a single day.

Revolutionary changes in the structure and pace of the Internet and the software that fuels it means that ad-hoc or occasional security testing is not enough to protect against vulnerabilities. We need the full force of security researchers, and all companies should encourage and protect their work.

Should the Supreme Court affirm van Burens conviction, the legal landscape will remain largely the same. Security researchers and consumers alike will face liability despite acting in good faith, and the federal government will continue to exercise broad power over trivial and ambiguous breaches of authorized computer use.

Yet the Supreme Court now has the opportunity to limit the scope of the CFAA and restrict what the federal government can prosecute. Doing so will enhance the security of the Internet, protect security researchers, and limit the legal liability of daily Internet users who clicked through terms of services without reading them.

A lot has changed since the CFAA was first enacted in 1984. While the Supreme Courts decision could drastically change the information security landscape, it is still not enough. As weve seen with the Internet of Things bill that was recently passed through the House, the United States needs modern legislation to secure the rapidly changing technology of the twenty-first century.

In short, security researchers who act in good faith are exposing themselves to huge legal risk because of the broad interpretation of CFAA. This is to the detriment of anyone who values the protection of their information. We are in dire need of reform in the United States, but in the meantime, there is hope that the Supreme Court will narrow the scope of the CFAA to protect consumers and security researchers alike.

Read more here:
What's at stake in the Computer Fraud and Abuse Act (CFAA) - Help Net Security

27 Things You Can Do to Let There Be Peace on Earth – PRESSENZA International News Agency

1. Reports on the climate collapse have stopped in some cases the nonsense talk about needing the United States to lead, and even gone beyond urging it to get out of last place, and begun demanding that it do its fair share to undo its share of the damage. Thats the same thing we need on militarism, when U.S. weapons are on both sides of most wars, almost all foreign bases are U.S. bases, and most people in the U.S. cant begin to name its current wars, drone murders, or nations with U.S. troops in them. We saw this past year that moving even 10% out of militarism, even explicitly to address a health crisis killing huge numbers of people in the United States, was too great a blasphemy. The biggest chance of reducing militarism, winding back the nuclear doomsday clock, and funding a serious Green New Deal is to make demilitarization part of a Green New Deal. That means telling your misrepresentative and senators that, and telling every environmental organization that. Here are some resources to help:https://worldbeyondwar.org/environment

2. At the time of the failure to move 10% out of militarism, Congress Members Lee and Pocan announced the formation of a so-called Defense budget reduction caucus. Heres a petition encouraging them to follow through on that. Sign and share it:https://moneyforhumanneeds.org/letter-to-u-s-representatives-lee-and-pocan

3. The biggest enemy of the Pentagon is not some foreign nation spending 8% what it does on militarism. The biggest enemy is free college, or the inclusion of college in public education. Demanding that the United States join other wealthy nations in making education accessible to its residents is a tremendous good in itself. Many organizations will be promoting this in the coming months. It starts with ending student debt. One group working on this is: https://rootsaction.org

4. During the four years of Trump, Congress for the first time used the War Powers Resolution to end a war the war on Yemen but Trump vetoed the bill. Congress also for the first time adopted the practice of forbidding a president to end a war or a post-war occupation specifically the war on Afghanistan, the Korean War, and World War II. Senator Rand Paul raised hell about this a couple of days ago, and the war supporters said little, while liberals denounced him for recklessly suggesting that Trump could be permitted to end the war on Afghanistan in under two decades. We need to put everything we can into getting a repeat vote of the ending of the war on Yemen, and into undoing and ending the practice of allowing presidents to start dozens of wars but forbidding them to end them. Many groups will be working on at least part of this, including: https://rootsaction.org https://worldbeyondwar.org

5. Building on ending the war on Yemen, we should insist that Congress end additional wars, starting with the war on Afghanistan. And we should insist on an end to weapons sales, military training, military funding, and military basing in Saudi Arabia and United Arab Emirates. We should, in fact, extend that to support the reintroduction of Congresswoman Omars Stop Arming Human Rights Abusers Act, and eventually end the trading of weapons that cannot actually be used without abusing human rights.Contact your Congress Members at https://actionnetwork.org/letters/pass-the-stop-arming-human-rights-abusers-act

6. We should organize a major coalition to support the reintroduction of all of Rep. Omars peace bills, including the Global Peacebuilding Act, the Global Migration Agreement Act, the Congressional Oversight of Sanctions Act, the Youthbuild International Act, the Resolution on the UN Convention on the Rights of the Child, and the Resolution on the International Criminal Court. See: https://omar.house.gov/media/press-releases/rep-omar-introduces-pathway-peace-bold-foreign-policy-vision-united-states

7. Sign and share the petition asking President-Elect Biden to end Trumps sanctions against the International Criminal Court:https://actionnetwork.org/petitions/ask-biden-to-end-trumps-coercive-measures-against-the-international-criminal-court/

8. Peace activists stopped a particularly egregious contender for Secretary of so-called Defense in Michle Flournoy. Review what worked and get ready for the next one here: https://rootsaction.org/news-a-views/2378-2020-12-08-13-01-24

9. Make sure everyone you know is on board with what is coming at us in a Biden regime that had no foreign policy on the campaign website and no foreign policy task force, but made a top-priority for the transition to nominate numerous warmongers from the boards of weapons companies, with an inauguration being funded by weapons companies. We should see if we cant shame the shameless over the inauguration funding of yet another presidency brough to you by the war profiteers.https://www.businessinsider.com/boeing-biden-inauguration-donors-corporations-2020-12

10. Make sure everyone you know understands what happened in the Trump regime now ending, that Trump started no big new wars other than a cold war with Russia, but escalated existing wars, moved them more to the air, increased civilian casualties, increased drone murders, built more bases and weapons, tore up key disarmament treaties, openly threatened to use nuclear weapons, and dramatically increased military spending. Trump both bragged about selling weapons to brutal dictatorships and denounced anyone bowing before the military industrial complex. No other presidents will do either of those things. But they will follow in the footsteps of his actions, which followed those of his predecessor unless we change things. That means undoing much Trump damage (including policies on Iran, Cuba, Russia, etc.), even while insisting on following through on a few things Trump suggested (such as withdrawing a few troops from Afghanistan and Germany).Email your Congress Member about Afghanistan here:https://act.rootsaction.org/p/dia/action4/common/public/?action_KEY=14013

11. There is a brief opening to undo the Trump damage and the damage of decades of U.S. conduct on Iran, before the Iranian elections in June 2021. Learn more, sign the petition to Biden, and inform others here:https://actionnetwork.org/petitions/end-sanctions-on-iran/

12. Biden has committed to restoring at least somewhat better relations on Cuba. Lets hold him to that and insist on an end to the whole blockade. Lets even build on that to demand an end to deadly and illegal sanctions against other nations. Use these fact sheets on the sanctions now imposed on various countries:https://worldbeyondwar.org/flyers/#fact

13. Another novelty in the Trump years is corporate media outlets calling a president a liar and fact-checking him. Sometimes their own facts are wrong too. Sometimes they still fail to call the president on lies. But if this new policy were upheld consistently, war would be over. Take a look and spread around my book, War Is A Lie. Also check out the debunking of war myths and the case for war abolition on the homepage of World BEYOND War.https://warisalie.orghttps://worldbeyondwar.org

14. Another novelty is military officials proudly bragging about having tricked a president into thinking he was withdrawing more troops from a war (Syria) than he was. This is just as dangerous a power-balance development as Congress forbidding presidents from ending wars. We need to be prepared to spot this maneuver the minute it next happens.

15. Another odd twist in these past 4 years is the development of great liberal affection for a new cold war with Russia, for building up NATO, for keeping troops in Germany and Korea and Afghanistan, and for supporting the CIA and the so-called intelligence so-called community. When Trump talked this week of stripping the CIA of support from the military, good liberals were outraged. The world is now seen as unsafe if it lacks sufficient hostility toward Russia and blind support for militarism and lawless secret agencies. I really cannot gauge how long this will last or how hard it will be to undo the damage, but we have to try. We have to confront true believers with all of Trumps anti-Russian behavior, with the U.S. governments longstanding support for most of the worlds oppressive governments, with the abuses and counterproductive activities of the spies and killers on whom is bestowed the euphemistic label intelligence.

16. When nuclear weapons become illegal in over 50 countries on January 22, 2021, we need to celebrate globally, hold events, put up billboards, petition the nuclear nations, etc. A whole toolkit of resources is online here:https://worldbeyondwar.org/122-2

17. We need to get organized, build community, build power, win local victories, and connect local allies and individuals with a global movement. One way to do that is to form a World BEYOND War chapter. Try it here:https://worldbeyondwar.org/findchapter

18. We need to take advantage of the fact that real-world events no longer compete with online events, and create larger, more global, more effective and persuasive webinars and actionars. World BEYOND War can help with this. Here are numerous upcoming webinars already planned, and videos of many that have already happened:https://worldbeyondwar.org/eventshttps://worldbeyondwar.org/webinars

19. Campaigns we can work on locally with likely success and global support, with educational and organization benefits, include divestment, base closures, and demilitarization of police. With even the Chairman of the Joint Chiefs of Staff talking about closing foreign bases, we darn well should be. See:https://worldbeyondwar.org/divesthttps://worldbeyondwar.org/baseshttps://worldbeyondwar.org/policing

20. Take advantage of the existence of tons of great books. Read them. Get them into libraries. Give them to elected officials. Organize reading clubs. Invite authors to speak. Check out these lists of books, films, powerpoints, and other resources for events, and this list of available speakers:https://worldbeyondwar.org/resourceshttps://davidswanson.org/bookshttps://worldbeyondwar.org/speakers

21. Take advantage of online courses, for yourself, and to recommend to others:https://worldbeyondwar.org/education/#onlinecourses

22. Make use of this collection of resources to celebrate and educate about the Christmas Truces:https://worldbeyondwar.org/christmastruce

23. Nip in the bud this insane idea that extending draft registration to women is feminist progress. Overcome the twisted idea that a draft is good for peace. And join the coalition working to abolish the so-called selective so-called service:https://worldbeyondwar.org/repeal

24. Help halt the extradition of Julian Assange and the criminalization of journalism, despite all your completely justified complaints with Assange:https://actionnetwork.org/petitions/fight-for-peace-and-free-press

25. Email Congress to stop impeding peace-making in Korea:https://actionnetwork.org/letters/peace-in-korea-email-your-representative-and-senators

26. Those of you Im talking to on December 12 from Ohio, elect Nina Turner!

27. Wear your damn mask!

Continue reading here:
27 Things You Can Do to Let There Be Peace on Earth - PRESSENZA International News Agency

Appeals for the Release of Julian Assange: Manu Chao, Snowden, Oliver Stone – PRESSENZA International News Agency

12.12.2020 - Pressenza Athens

This post is also available in: French, Greek

A snapshot from the video of Manu Chao on Twitter #FreeAssange is flooding social media while calls for the release of Julian Assange and against his extradition to the USA multiply. Ordinary people who are calling for the protection of free journalism and of Julian Assange raise their voices every day together with journalists, artists, lawyers, politicians and academics.

Manu Chao posted his appeal on his Twitter account by singing:

In a desperate plea, Edward Snowden, the NSA public interest whistleblower, who himself is being persecuted by the USA but who has been granted asylum in Russia and lives there, called upon President Trump to release Assange. He writes on Twitter: Mr. President, if you grant only one act of clemency during your time in office, please free Julian Assange. You alone can save his life.

In his turn, Oliver Stone, the award-winning American film director, in a photograph of himself holding the slogan I am Julian Assange calls for a halt to the censorship of journalists. The next court hearing in London for the case of Assanges extradition to the USA is scheduled to take place on December 11, while the decision is expected to be announced in one months time, on 4 January 2021.

Related articles:

Pressenzas Campaign 14Assange: Varoufakis on the Offensive for the Defense of Assange (video)

Juan Branco: The Greek people to apply pressure for the granting of asylum to Julian Assange.

Julian Assange is being held in severe conditions according to a report by the UN Rapporteur

A call to protest for Julian Assange the court hearing for his extradition starts on 24/2.

Translation by Jeannette A. Arduino, from the voluntary Pressenza translation team. We are looking for volunteers!

Originally posted here:
Appeals for the Release of Julian Assange: Manu Chao, Snowden, Oliver Stone - PRESSENZA International News Agency