The Coming End of the Password?

From Wired:

Want an easier way to log into your Gmail account? How about a quick tap on your computer with the ring on your finger?

This may be closer than you think. Google’s security team outlines this sort of ring-finger authentication in a new research paper, set to be published late this month in the engineering journal IEEE Security & Privacy Magazine. In it, Google Vice President of Security Eric Grosse and Engineer Mayank Upadhyay outline all sorts of ways they think people could wind up logging into websites in the future — and it’s about time. . . .

Thus, they’re experimenting with new ways to replace the password, including a tiny Yubico cryptographic card that — when slid into a USB (Universal Serial Bus) reader — can automatically log a web surfer into Google. They’ve had to modify Google’s web browser to work with these cards, but there’s no software download and once the browser support is there, they’re easy to use. You log into the website, plug in the USB stick and then register it with a single mouse click.

They see a future where you authenticate one device — your smartphone or something like a Yubico key — and then use that almost like a car key, to fire up your web mail and online accounts. 

In the future, they’d like things to get even easier, perhaps connecting to the computer via wireless technology.

Overcriminalization and the Criminal Congress

How many crimes do you commit every day?  It is probably way more than you imagine.  From Overcriminalized:

“Overcriminalization” describes the trend in America – and particularly in Congress – to use the criminal law to “solve” every problem, punish every mistake (instead of making proper use of civil penalties), and coerce Americans into conforming their behavior to satisfy social engineering objectives. Criminal law is supposed to be used to redress only that conduct which society thinks deserving of the greatest punishment and moral sanction.

But as a result of rampant overcriminalization, trivial conduct is now often punished as a crime.  Many criminal laws make it possible for the government to convict a person even if he acted without criminal intent (i.e., mens rea). Sentences have skyrocketed, particularly at the federal level.

Sound far fetched?  Consider the case of the Computer Fraud and Abuse Act.  From Tech News Daily:

The CFAA is a 1986 law, section 1030 of the federal criminal code, which makes any unauthorized access into a protected network or computer a federal crime and permits harsh penalties for those convicted.

But 1986 was a long time ago. Today, any Web server can be defined as a protected computer, and almost anything can be defined as unauthorized access.  Use your roommate's Netflix account to watch movies on your iPad? You're violating the CFAA.  Trim the URLs of articles on the New York Times website so you can read them for free? You're breaking federal law.  Check your Facebook page at work, even if your employer forbids it? Better call your lawyer. . . . 

To Robert Graham, chief executive officer of Errata Security in Atlanta, the CFAA is "hopelessly out of date, and can be used to prosecute anybody for almost anything."

"The issue is 'authorization,'" Graham said. "Back in 1986, everyone had to be explicitly authorized to use a computer with an assigned username and password.

"But today, with the Web, we access computers with reckless abandon without knowing whether we are authorized or not," he added. "When you click on a URL, you are technically in violation of the law as it was designed."

Of course, these laws only apply to the people and are rarely if ever used to prosecute ruling elites.  The US Congress, for instance, is a hot bed of cyber criminality.  From the Guardian:

Employees of the US Congress were found to be downloading a host of television shows and movies illegally on congressional computers, according to a report by anti-piracy service ScanEye.

The report shared by US News and World Reports showed that since early October, congressional employees have downloaded movies and television shows including The Walking Dead, The Dark Knight Rises and 30 Rock.

The report demonstrates that even though Congress has found itself at the forefront of measures to stop piracy, including the much-maligned Stop Online Piracy Act (Sopa), its staff do not always follow the legislators' lead. . . .

The blog TorrentFreak has found that IP addresses associated with the biggest players in the anti-piracy legislative campaign are used for illegal downloading. People at Hollywood studios, major record labels and the US department of homeland security have downloaded music, film and television on their employers' networks.

As TorrentFreak noted in a 2011 blogpost, Congress was illegally downloading television shows and self-help books around the same time some members were drafting Sopa.

It is time to put these criminals in prison and throw away the key.

You Are Being Monetized

From Forbes:

With Tuesday’s announcement of Graph Search, Facebook has confirmed what we’ve known all along: we users aren’t there to enjoy content as much as we are the content. That means we’re the products it intends to monetize. . . .

We are the product on Facebook, and the platform’s very premise depends on our willingness to share our lives openly (there’s lots of theology on why we should reveal everything about ourselves online, though it’s usually written by people who do no such thing). Graph Search will eventually provide more pages for advertising, perhaps ever-better keyed to whatever it is we’re searching for. Maybe brands will be given a way to crap out the results with sponsored links, so it could get even worse than all those recommendations you get now from friends who made the mistake of clicking on something. I’d bet on ads running down the sides of every page, too. . . .

Speech Recognition Coming to Web Apps

From Tech Crunch:

Google just launched the latest beta version of its Chrome browser (version 25) for the desktop and Android and this one is chock-full of new tools for developers. The most important update – and the one that Google chose to highlight – is the inclusion of the Web Speech API in Chrome. This, says Google, will allow developers to integrate speech recognition into their web apps so that “in the near future you’ll be able to talk apps into doing all sorts of things.”

Illegal Surveillance on the Basis of Secret Laws Should be Repugnant to a Free People

President John F. Kennedy famously stated, "The very word 'secrecy' is repugnant in a free and open society; and we are as a people inherently and historically opposed to secret societies, to secret oaths, and to secret proceedings."  Unfortunately, today, this is no longer the case among our elected representatives in the legislative and executive branches of government, who wield secrecy like a weapon in their ongoing war against the constitutional rights and liberties of the people.  From the EFF:

As 2012 came to a close, Congress reauthorized the FISA Amendments Act (FAA) for another 5 years. Yes, the same FAA under which the government cohttp://www.google.com/nducted unconstitutional surveillance; the same FAA for which the government refuses to estimate the number of Americans who have been spied on; and yes, the same FAA that has been interpreted in substantial ways within secret court opinions. . . . 

Senators have repeatedly complained that provisions of FISA have been secretly interpreted in ways that differ markedly from the language of the statute. These interpretations, according to the Senators, are contained in opinions issued by the FISC.

But perplexingly, both the executive branch and other members of the Senate have taken the position that, despite the secrecy of the FISC opinions, those opinions do not constitute “the law” or “secret law.” . . .  

But this much is clear: when a court issues an opinion containing a significant interpretation of a public statute, that court’s opinion is the law. When the court’s opinion is withheld from the public, that opinion is a “secret,” even if the statute the opinion interprets is already publicly available. Because a court’s opinion constitutes the “law,” refusing to disclose those opinions to the public results in “secret law.”

The basis for the government’s secrecy claim is irrelevant: the law is still “secret” whether the opinion is classified, protected by the attorney-client privilege, or kept secret for any other of the host of legal privileges available to the government.

The only relevant issue is whether the law is publicly disclosed. And EFF joins with Senators Merkley, Wyden, Udall, Paul, and the other 33 Senators that voted to support this simple principle: when the government interprets federal surveillance law in a way that fundamentally affects citizens rights, that interpretation must be disclosed.

Governments "Threatened by Freedom and Openness of Expression" on Internet

From an interview with Vint Cerf in the Financial Post:

VC: The Internet is threatened by governments that want to control content and use of the network. All of us have gotten accustomed to freedom of expression and freedom of access to content on the net, but we have also gotten accustomed to something called permissionless innovation, which is a phrase I use to explain why it’s so important to keep the network relatively open and freely accessible. It’s so that anyone who wants to try a new application out can just do so.

We all have to appreciate that there are harms that occur on the net, no one who tells you otherwise should be believed, there’s viruses, worms, trojan horses and other kinds of technical attacks on the net turning your machine into a member of a botnet that generates spam or generates denial of service attacks or directly goes after content on your machine, there’s key loggers that go looking for passwords and account numbers. Those are bad.

The problem is that sometimes the proposed cure is worse than the disease, and in some cases it is to shut down the Internet or block websites or to interfere with our ability to make use of the system, and these harms and their remedies are used as an excuse to prevent political speech, to prevent people from sharing information from knowing what is going on, it’s to obscure transparent visibility of what the government is doing. Governments that are authoritarian are feeling threatened by the freedom and openness of expression and discovery of information on the Internet so they will use any excuse they can find to shut that network down. That’s what you’re seeing right now.

Petition: DDoS Should Be Recognized as Valid Form of Protest

From Slashdot:

Anonymous has filed a petition with the U.S. Government asking the Obama administration to make Distributed Denial of Service (DDoS) attacks a legal form of protest. Anonymous has argued that because of advancements in internet technology, there is a need for new ways of protest. The hacking collective doesn't consider DDoS as a form of attack and equates it to hitting the 'refresh' button on a webpage. Comparing these attacks to the 'occupy' protests, Anonymous notes that instead of people occupying an area, it is their computers occupying a website for a particular period of time.