This post is built around my paper (presented to/at the International Workshop on Privacy Engineering) devoted to privacy assessment in web standards. After the previous one (Battery Status Not Included: Assessing Privacy in W3C Web Standards) this is the next insight in this domain. While I point out the Read More
Cyberattacks in times of conflict will look different than in peacetime. There are many reasons for that but naturally such points might not be at the center of interest now. Because we are fortunately in peacetime, and because imagining such a qualitative change is not simple. Still, there’s the Read More
The user’s Web browsing history is usually defined as a list of websites the user has visited, such as “google.com, facebook.com, reddit.com, bbc.co.uk, random-site.org, etcetc.org.uk”. On its own, it may seem innocuous. It turns out browsing history can be processed to Read More
Why do countries resort to cyber operations or cyberattacks (depending on the terminology)? It’s a long discussion that involves matters of performance, speed, aptness, ability, and risk. Some better-informed folks used to speak about it and we also covered it during the ICRC assessment of cyber operations. But only Read More
Countries continue to refine their approach to cybersecurity. Australia is not an exception, with the recent release of its new cybersecurity strategy. Previously I looked at several countries or organisations (i.e. USA, Ireland, Netherlands, France, ICRC, France, Luxembourg) along different dimensions of cybersecurity. Why is Australia worth a look? Read More
Quantum computers benefit from special effects like the quantum superposition and quantum interference to perform computation outside the reach to to classical computers, and attaining a speed advantage over classical computers for selected problems. What matters is quantum computers may allow an exponential computing speedup for certain problems. This speedup Read More
Privacy Shield provided for simple grounds for transferring data from the European Union to the USA. The news of invalidation of Privacy Shield as a result of the verdict of the European Court of Justice (ECJ) has now settled. It’s a matter of law, and the associated decision contains Read More
European Parliament recently called on a ban on micro-targeted ads. Such a decision made by a democratically elected body is somewhat unprecedented. Micro-targeting allows people (i.e. “advertisers”) to use platform profiling to reach the “right” audience. For example targeting content based on traits such as: Male/Female, age, the Read More
Imagine tens of millions of users potentially receiving a popup asking the user to grant permission to be tracked, in September 2020. The striking news emerged from this year’s Apple WWDC conference. Apple will limit the use of the IDFA “tracking identifier”. This identifier allowed advertisers to track the Read More
Magnetometer is a less known sensor. It equips web browsers with the ability to read the magnetic field strength using the built-in magnetometer device sensors and the W3C Magnetometer API. It might be useful in some specific use cases such as peripheral devices (like a gamepad, to control the user’ Read More
I was hesitant to speak about contact tracing apps because so many people speak on the subject and the ratio of repeating the same cliches over and over is also high. Little insightful things are left to be said in this rather simple problem. But recently it emerged that a Read More
I never thought it would come to this but this is a privacy analysis is of the “ctrl-f”. You know, the find-in-page functionality: when the user wants to find an occurrence of the word “cat”, control-f shortcut or the manual menu selection opens the find-in-page prompt. So exciting? Perhaps not. Read More
I wanted to steer clear from the topic of SARS-CoV-19. But it is now clear that thee global coronavirus epidemic/spread introduces an extraordinary situation, warranting special considerations for individual and organization, as well as collective cybersecurity. We are all in this is due to a confluence of many related Read More
Recently the US has conducted a process modeled over Eisenhower-era Red-Teaming designed to figure out how to tackle the Cold War era risks posed by Soviet Union. Just applied to cybersecurity. Sounds exciting if not fuzzy? The report is now released and it is an extremely interesting strategic assessment. It Read More
Over the past few years, waves of shocking privacy misuses, data breaches, and abuses have crashed on the world's biggest companies and billions of their users. At the same time, many countries have bolstered their data protection rules. Europe set the tone in 2016 with the General Data Read More
Privacy vulnerabilities in mechanisms designed to improve privacy are not something expected. On the contrary, they are the last place where you’d expect a privacy bug. Intelligent Tracking Prevention (ITP) is an impressive feature of Safari, the default browser used on iPhones, iPads, and Macs. It was the first Read More
Ireland just released its cybersecurity strategy. It is a very interesting document because, considering the size of the country, Ireland is a crucial backbone of the EU digital economy. Ireland knows this and it mentioned in the strategy very prominently: around 30% of “data” are based in Ireland. Big global Read More
Users increasingly encounter moments when a website asks for permission to gather some personal data or access to their device hardware: "Can we access your GPS position? Your microphone or camera? Your Bluetooth? Can we send you push notifications about breaking news or premium chocolate subscription offers?" Permissions, Read More
Software can officially and formally be munitions. Since December 2019 offensive software even more so. At least in the context of the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies, whose members are different countries around the world. The treaty regulates the selling of munitions Read More
Contrary to what you may read in the popular press, there are rules when it comes to cyberattacks. Today, probably all countries regulate cybercrime in domestic law. All countries agree also that international law rules apply to cyberspace, including cyberattacks and also cyberwarfare. I recently covered positions of two example Read More
The Netherlands recently released a document describing their views and position on the application of international law to cyberspace and cyberattacks. This is a very reasoned document and contains great insight. Just like a similar French document (with a big catch - see later; my analysis here), it is short Read More
Developments of the web introduce new ways of using technology. Sometimes the evolution brings positive changes that are not obvious initially. But some events highlight the significance. Like for example the periodic controversy about the removal of certain mobile apps from certain managed application stores (like Google Play, or Apple Read More
You may have heard of the cliché “there are no rules in cyberwar". It is false. There are rules. The trick is how those apply. Countries rarely speak clearly how they see or would see things. Most countries accept that international law applies to cyberspace, including to cyber operations Read More
Cyber conflicts involving state actors are quickly becoming a geopolitical reality. Perhaps the most cited example, the alleged Russian interference in the 2016 U.S. election, is a continued source of conflict in U.S.-Russia relations. The story took another turn last October when the U.S. Cyber Command Read More
Interesting proposals of web standards amending the way some aspects of web architecture work emerged from Apple and Google. This marks a pretty unprecedented competition over web architecture. The grand battleground is web standardization. As such it will happen in the open and involve the larger community. Web advertisements are Read More