One of the most important cultural change companies and organisations are beginning to face is the need of systematic inclusion of privacy and data protection in technical and organisational frameworks. A crucial aspect of these changes is the need of conducting Privacy Impact Assessments (PIA) and Data Protection Impact Assessments Read More
European Commission has revealed their proposal for updating of ePrivacy directive. I have previously analysed a version of ePrivacy document leaked in December. The new regulation still provides strong guarantees of integrity and confidentiality of communication (concerning also Instant messengers such as Facebook Messenger, WhatsApp, Google Hangout, etc.). That’s Read More
Understanding and perceiving privacy as a technological and strategic aspect is becoming a standard practice. The recently published NIST Internal Report “An Introduction to Privacy Engineering and Risk Management” is an interesting attempt to systematize the understanding of privacy engineering. Privacy in this view forms an important technical and strategic Read More
The new Russian Information Security Doctrine (Doktrina informatsionnoy bezopasnosti Rossiyskoy Federatsii) might appear to be a rather general document. Upon first sight, it seems that it doesn’t contain much interesting information. This view is misguided - it’s worth to look at the text of the doctrine in order Read More
Only a few days ago a major corporation has admitted to two massive breaches in a row: first in 2013, then second in 2014; both finally detected in 2016. The consequences were substantial: over a billion accounts breached. Company share prices did not respond significantly. However, the most interesting thing Read More
We've received an interesting opportunity to study further transitions of the privacy and data protection landscape in Europe. Just in time for the Holiday Season, a drafted proposal of European Parliament (and Council) concerning the respect for private life and personal data in electronic communications and repealing of Read More
I'm interested in battery status security/privacy potential for a while now. I have previously written about it here and recently my research led to web browser vendors removing battery readout functionality, citing privacy issues (Firefox, WebKit; Chrome has not decided yet). I'm also very happy Read More
On both sides of Atlantic the debate around strong cryptography frequently resurfaces. Proponents of weakening cryptography or introduction of backdoors (or "golden keys") cite national security. Technologists and activists oppose such proposals, citing freedoms and cybersecurity. Regulating cryptography is of course a bad idea. It's true Read More
It's 2016 and we are experiencing something unprecedented in the history of the Web. Apparently, Web browsers (Firefox, Safari?) are removing parts of their functionality citing privacy concerns. This is a fascinating development. Introduction I am analysing security and privacy of modern Web for more than 8 years Read More
Web Bluetooth - a web API under development, and will be one of the core components of Web of Things, the application layer of Internet of Things. It will enable sensors, beacons and user devices to communicate with each other. But at first: it will enable a web browser to Read More
Ambient Light Sensor is one of the more interesting data sources from privacy point of view. I recently highlighted a number of potential privacy issues in my analysis. I described how the ability to access and track the changes of lighting conditions in the user's environment might contribute Read More
The debate around surveillance around the world is a developing story. Multiple states are considering, working on or applying new investigative powers (e.g. United Kingdom’s Investigatory Powers Bill or France’s Patriot Act à la française) strengthening surveillance capabilities; this trend is visible around the world. Investigatory powers Read More
Introduction Smartphones are equipped with a sensor letting the device to detect the brightness levels in their environment (modern sensors are even capable to measure the intensity of green, red and blue lights). The simplest application of the sensor is to adjust the screen's brightness in accordance with Read More
Update (April 2019) It was brought to my attention that Brennan center has used some of the research described in the article to fill an amicus curiae (legal opinion to the appeal court) in a case touching election protection from disinformation operations and political advertisement transparency. The rest of the Read More
Introduction Mobile developers are familiar with proximity sensors. It provides information about the distance of an object from the device providing access to the sensor (i.e. smartphone, tablet, laptop, or another Web of Things device). This object is usually the user's head or hand. Proximity sensors provides Read More
Introduction Privacy risks and threats arise and surface even in seemingly innocuous mechanisms. We have seen it before, and we will see it again. Recently, I participated in a study assessing the risk of W3C Battery Status API. The mechanism allows a web site to read the battery level of Read More
Vibrating devices are a familiar thing. From the era of flip-phones, to vibrations induced by mobile apps. Or websites. [Edit 15/11/19: Firefox is limiting access to Vibration API] Vibration API The mechanism allowing websites to utilize device's vibration motor is called Vibration API. The mechanism allows Read More
It was never my intention to have a "blog". Then, as I have found myself increasingly interested in, and doing more and more things, I indentified a need to have a place for writing. It is not a good idea to put my thoughts on my site; I Read More