Categories
Links

‘It feels like theft’: Ontario wineries frustrated by government obstacles

‘It feels like theft’: Ontario wineries frustrated by government obstacles:

The LCBO is a major cash cow for the much-indebted Ontario government. Last year, it returned $1.9 billion in dividends to provincial coffers – on top of the approximately $280 million in HST it makes off the sales. It’s not hard to see how it makes that much. When a consumer buys a bottle of alcohol, the LCBO takes:

  • 52 per cent of the cost of wine
  • 59 per cent of the cost of spirits
  • 39 per cent of the cost of beer

An LCBO spokeswoman says those markups fund Ontario’s social programs as well as the LCBO’s operating costs.

I’m not opposed to the LCBO’s existence but that is a lot of markup on a bottle of wine.

Categories
Writing

So Hey You Should Stop Using Texts for Two-Factor Authentication

One of the problems with contemporary computer systems is that they rely on login and password information, and both of these kinds of information are routinely either disclosed through data breaches or are configured by users such that it is relatively easy to guess the login and password combination. Two-factor authentication is designed to alleviate these problems by issuing a second code to a user, which they input in order to access the service. This ‘other factor’ is meant to prevent unauthorized third-parties from accessing protected systems (e.g. email, social media accounts).

However, many of these second-factor codes are delivered over text messages. The problem is that there are a litany of ways that texts can be either intercepted or diverted and, thus, reduce the efficacy of the two-factor system. Some companies have moved away, partially, from SMS-based second factors but others such as Twitter have not. The aim of the article is to suggest that it’s important for users to themselves migrate from text-based second factors to a more secure method.

This is entirely accurate…when individuals are being targeted. But when an attacker is unwilling to invest much time or effort — such as running password lists or otherwise just ‘testing’ accounts without seriously attacking them — then even text-based two-factor authentication can suffice. While I agree that ideally individuals will move to a second-factor that isn’t SMS-based there is a significant degree of friction in getting individuals to download new applications and ‘token-based’ modes of authentication can be challenging to deploy because they get lost/damaged/forgotten/etc. In effect: while the call from the author is good I have to ask whether this ‘solution’ is the one that we should be spending years shuffling users towards or if we should instead wait for a superior alternative.

Categories
Writing

The Fourth Amendment in the Information Age

Litt’s article focuses on finding new ways of conceptualizing privacy such that the current activities of intelligence agencies and law enforcement organizations are made legal, and thus shift the means by which their activities are legally and constitutionally evaluated. While his proposal to overturn much of the third-party doctrine coheres with the positions of many contemporary scholars his suggested replacement — that we should no longer focus on collecting data, but on use of collected data — would eviscerate basic privacy protections. In particular, I think that it’s important we not just ignore the ‘search’ aspect of fourth amendment law: we need to recalibrate what a search is within the context of today’s reality. And that doesn’t mean just letting the government collect with fewer baseline restrictions but instead modifying what a ‘search’ is itself.

The core aspects of the article that give a flavour of the entire argument are:

I suggest that—at least in the context of government acquisition of digital data—we should think about eliminating the separate inquiry into whether there was a “reasonable expectation of privacy” as a gatekeeper for Fourth Amendment analysis. In an era in which huge amounts of data are flowing across the Internet; in which people expose previously unimagined quantities and kinds of information through social media; in which private companies monetize information derived from search requests and GPS location; and in which our cars, dishwashers, and even light bulbs are connected to the Internet, trying to parse out the information in which we do and do not have a reasonable expectation of privacy strikes me as a difficult and sterile task of line-drawing. Rather, we should simply accept that any acquisition of digital information by the Government implicates Fourth Amendment interests.

After all, the concept of a “reasonable expectation of privacy” as a talisman of Fourth Amendment protection is not found in the text of the Fourth Amendment itself, which says merely that “[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated.” It was only in 1967, in Katz, that the Supreme Court defined a search as the invasion of a “reasonable expectation of privacy.” Katz revisited Olmstead v. United States after 40 years; the accelerating pace of modern technological change suggests to me that fifty years is not too soon to revisit Katz. My proposal is that the law should focus on determining what is unreasonable rather than on what is a search.

What I have suggested, however, is that—at least in the area of government collection of digital data—we eliminate the preliminary analysis of whether someone has a reasonable expectation of privacy in the data and proceed directly to the issue of whether the collection is reasonable; that the privacy side of that analysis should be focused on concrete rather than theoretical invasions of privacy; and that courts in evaluating reasonableness should look at the entirety of the government’s activity, including the “back end” use, retention restrictions, and the degree of transparency, not just the “front end” activity of collection.

Categories
Links

I Ran the C.I.A. Now I’m Endorsing Hillary Clinton.

I Ran the C.I.A. Now I’m Endorsing Hillary Clinton:

During a 33-year career at the Central Intelligence Agency, I served presidents of both parties — three Republicans and three Democrats. I was at President George W. Bush’s side when we were attacked on Sept. 11; as deputy director of the agency, I was with President Obama when we killed Osama bin Laden in 2011.

I am neither a registered Democrat nor a registered Republican. In my 40 years of voting, I have pulled the lever for candidates of both parties. As a government official, I have always been silent about my preference for president.

No longer. On Nov. 8, I will vote for Hillary Clinton. Between now and then, I will do everything I can to ensure that she is elected as our 45th president.

The securocrats are increasingly throwing their hats in the Clinton camp. And I suspect that Trump will use this to fire up his own base by discounting those same securocrats as democratic patsies, despite many democrats having railed against the heads of the CIA, NSA, and other agencies over the years following 9/11.

Categories
Aside Links

With Remote Hacking, the Government’s Particularity Problem Isn’t Going Away

Crocker’s article is a defining summary of the legal problems associated with the U.S. Government’s attempts to use malware to conduct lawful surveillance of persons suspected of breaking the law. He explores how even after the law is shifted to authorize magistrates to issue warrants pertaining to persons outside of their jurisdictions, broader precedent concerning wiretaps may prevent the FBI or other actors from using currently-drafted warrants to deploy malware en masse. Specifically, the current framework adopted might violate basic constitutional guarantees that have been defined in caselaw over the past century, to the effect of rendering mass issuance of malware an unlawful means of surveillance.

Categories
Links

Dear activists, please stop telling everyone Telegram is secure

Dear activists, please stop telling everyone Telegram is secure:

Telegram was not wrong in promoting its security features back in 2013 – end-to-end encryption in mobile chat apps was rare back then. Since then, however, other chat apps have caught up and in many cases surpassed its security features. This isn’t to say Telegram doesn’t have its merits – neither Whatsapp nor Signal have support for channels (public groups) or bots, and Telegram does have a handy, Snapchat-like, self-destruct feature for conversations. But to recommend Telegram, without reservation, to protesters and activists is simply irresponsible. Dear activists: please stop telling people Telegram is more secure – either stick with WhatsApp or direct people to Telegram’s “Secret Chat” feature.

A good, and quick, piece written to explain the deficiencies of Telegram as opposed to its competing – and more secure and equally usable – chat applications.

Categories
Links

Researchers Are Chipping and Surveilling NYC’s Rats

Researchers Are Chipping and Surveilling NYC’s Rats:

Parson’s and his team use traps baited with pheromones—not food—to capture the rats. They know where to place the traps because rats frequently navigate the dark tunnels where they live not with their eyes, but with their fur. Rubbing themselves against walls creates a trail that’s visible with an ultraviolet dark light. According to the study the trail glows blue–white if it’s fresh, yellow–white if old. The trap has a sensor attached to it that alerts the researcher by cell phone when a rat has been caught.

Once a rat has been caught, a mobile lab is deployed. Inside researchers wearing thick gloves render the rat unconscious by dipping the rat trap in a plastic induction container filled with isoflurane, a kind of ether. An unconscious rat is an easy rat to draw specimens from. Before it wakes up, the rat blood is drawn and an RFID chip is implanted.

An interesting bit of news in addition to previous writing on rats.

Categories
Links Writing

Rape Culture Is Surveillance Culture

Scaachi Koul has written a piece that draws on her own experiences of men attempting to prey on her because she is a woman and while she engages in socially normal behaviour. Men who sought to prey on her were explicit in attempting to determine how they could take advantage, drug, or otherwise use her body without attempting to secure her genuine consent.

Koul’s writing makes clear the very normal, human, experiences of being targeted by men and how the intent of those attackers and potential attacker is normalized in contemporary society. The result is that Koul — and other women just like her — must treat social scenarios as a possible environments for attack or abuse. Her lived reality thus turns even seemingly benign situations into ones filled with risk. Koul’s ability to write as clearly and powerfully as she does should make clear to anyone who absolves sexual abuse on grounds of drinking that alcohol is not the problem: men who have internalized their own privilege and power and treat women as objects around them to be used are the problem.

Categories
Aside Links

How a file-sharing lawsuit against Rogers threatens your Internet privacy: Geist | Toronto Star

In the next stage of the copyright wars in Canada, Voltage is moving forward with its efforts to use a reverse class-action lawsuit to reveal the identities of thousands of people the company alleges have infringed on Voltage’s copyright. If the company is successful it will open up a new way for companies to access information about subscribers while simultaneously indicating the relative weakness of the privacy protections baked into Canada’s recent copyright legislation.

Categories
Links

Cybercrime Overtakes Traditional Crime in UK

Cybercrime Overtakes Traditional Crime in UK:

The NCA’s Cyber Crime Assessment 2016, released July 7, 2016, highlights the need for stronger law enforcement and business partnership to fight cybercrime. According to the NCA, cybercrime emerged as the largest proportion of total crime in the U.K., with “cyber enabled fraud” making up 36 percent of all crime reported, and “computer misuse” accounting for 17 percent.

“The ONS estimated that there were 2.46 million cyber incidents and 2.11 million victims of cyber crime in the U.K. in 2015,” the report’s authors wrote. “These figures highlight the clear shortfall in established reporting, with only 16,349 cyber dependent and approximately 700,000 cyber-enabled incidents reported to Action Fraud over the same period.”

While there is a persistent issue associated with counting ‘cyber’ events, that UK organizations are highlighting this kind of fraud and espionage so prominently does indicate a real problem is being faced by organizations.