Your car, tracked: the rapid rise of license plate read­ers [Ars Tech­nica]

A look at one of the less-known tech­nolo­gies that the gov­ern­ment uses to spy on people.

An Analy­sis of Apple’s Fil­e­Vault 2.

This is an analy­sis of Apple’s disk encryp­tion pro­gram, Fil­e­Vault 2, that first appeared in the Lion oper­at­ing sys­tem. Short sum­mary: they couldn’t break it. (Pre­sum­ably, the ver­sion in Moun­tain Lion isn’t any different.)

[Schneier on Secu­rity]

This is good news, but of course it’s impor­tant to keep in mind that Fil­e­Vault 2 secu­rity can be com­pro­mised by accept­ing the option (on by default, as I recall) to send a recov­ery key to Apple. The best secu­rity in the world is use­less if you give the keys to some­one who will give them up the first time some thug points a gun at him.

Apple holds the mas­ter decryp­tion key when it comes to iCloud secu­rity, pri­vacy [Ars Tech­nica]

The folks at Ars Tech­nica noticed the same thing I did about their ear­lier arti­cle and actu­ally investigated.

Ask Ars: how safe is my data stored in iCloud? [Ars Tech­nica]

An inter­est­ing arti­cle which ulti­mately con­cludes that it’s “safe enough.” How­ever, right there in the arti­cle is some­thing which con­tra­dicts its conclusion:

As far as your Safari book­marks or iPhone pho­tos, how­ever, that infor­ma­tion is only given out when required by law, such as when it’s required by court order. “We may also dis­close infor­ma­tion about you if we deter­mine that, for pur­poses of national secu­rity, law enforce­ment, or other issues of pub­lic impor­tance, dis­clo­sure is nec­es­sary or appro­pri­ate,” Apple wrote in its pri­vacy policy.

In other words, it’s not really safe at all. If it were, it would be impos­si­ble for Apple to ever dis­close any­thing, for any rea­son, because they wouldn’t be able to get to it to dis­close it.

Hack­ers ‘steal entire 2011 cen­sus’ [The Tele­graph]

Most of the arti­cle is a slightly con­fused report on whether or not LulzSec actu­ally claimed to have got­ten the UK cen­sus data­base. How­ever, I think the real story is this bit here:

“The 2011 Cen­sus places the high­est pri­or­ity on main­tain­ing the secu­rity of per­sonal data. At this stage we have no evi­dence to sug­gest that any such com­pro­mise has occurred.”

The US defence con­trac­tor Lock­heed Mar­tin, which col­lected the 2011 cen­sus data, was also prepar­ing a state­ment. The com­pul­sory national sur­vey was car­ried out in march and gath­ered data includ­ing full names, dates of birth and addresses for every­one in the UK.

So the oh-so-secure per­sonal data for every­one in the UK was gath­ered by a US defense con­trac­tor? Not just an appendage of the Evil Empire, but a tightly inte­grated part of the Impe­r­ial Mil­i­tary? In what uni­verse is that secure? There’s the evi­dence of your com­pro­mise right there!

Cheap GPUs are ren­der­ing strong pass­words use­less Think that your eight-character pass­word con­sist­ing of low­er­case char­ac­ters, upper­case char­ac­ters and a sprin­kling of num­bers is strong enough to pro­tect you from a brute force attack? [ZDNet]

Yes, that’s really how the author defines a “strong pass­word.” For­tu­nately I, not being a com­plete idiot, would only use such a sim­ple pass­word if I wanted other peo­ple to know it and be able to remem­ber it eas­ily. Here’s an exam­ple of what I con­sider a strong pass­word, in this case gen­er­ated by 1Password:

VbNwGIzrJWzccJMKJaQKCWXr4^mlWjglMQ*ZkcyMdyDOJrp9Kh

EFF Pub­lishes Study On Browser Fin­ger­print­ing. Rubin­stien writes “The Elec­tronic Fron­tier Foun­da­tion inves­ti­gated the degree to which mod­ern web browsers are sus­cep­ti­ble to ‘device fin­ger­print­ing’ via ver­sion and con­fig­u­ra­tion infor­ma­tion trans­mit­ted to web­sites. They imple­mented one pos­si­ble algo­rithm, and col­lected data from a large sam­ple of browsers vis­it­ing their Panop­ticlick test site, which we’ve dis­cussed in the past. Accord­ing to the PDF describ­ing the study, browsers that sup­ported Flash or Java on aver­age sup­plied at least 18.8 bits of iden­ti­fy­ing infor­ma­tion, and 94.2% of those browsers were uniquely iden­ti­fi­able in their sam­ple. My own browser was uniquely iden­ti­fi­able from both the list of plu­g­ins and avail­able fonts, among 1,557,962 browsers tested so far.” [Slash­dot]

I vis­ited the test site with my default browser with Tor and NoScipt on, and it had this to say:

Within our dataset of sev­eral mil­lion vis­i­tors, only one in 10,791 browsers have the same fin­ger­print as yours.

Cur­rently, we esti­mate that your browser has a fin­ger­print that con­veys 13.4 bits of iden­ti­fy­ing information.

How­ever, it reports the user agent incor­rectly, as Tor is set to lie about what browser I’m using. When I turned Tor off and reloaded the test page, I got this instead:

Within our dataset of sev­eral mil­lion vis­i­tors, only one in 21,435 browsers have the same fin­ger­print as yours.

Cur­rently, we esti­mate that your browser has a fin­ger­print that con­veys 14.39 bits of iden­ti­fy­ing information.

If I’m not mis­taken, this means that the test site thinks I’m in the first group of browsers when I’m actu­ally in the sec­ond group.

Flaws in Tor anonymity net­work spot­lighted. At the Chaos Com­puter Club Con­gress in Berlin, Ger­many on Mon­day, researchers from the Uni­ver­sity of Regens­burg deliv­ered a new warn­ing about the Tor anonymizer net­work, a sys­tem aimed at hid­ing details of a com­puter user’s online activ­ity from spy­ing eyes.

The attack doesn’t quite make a surfer’s activ­ity an open book, but offers the abil­ity for some­one on the same local network—a Wi-Fi net­work provider, or an ISP work­ing at law enforce­ment (or a régime’s) request, for example—to gain a poten­tially good idea of sites an anony­mous surfer is view­ing. [Ars Tech­nica]

There are things users can do to pro­tect them­selves. From the article:

Users them­selves can guard against this type of fingerprint-based eaves­drop­ping rel­a­tively eas­ily, Her­rmann noted. Down­load­ing or request­ing more than one site at a time through the net­work will muddy the pat­tern enough that cer­tainty will be very dif­fi­cult for the eaves­drop­per to establish.

And from one of the comments:

This attack should be sig­nif­i­cantly less effec­tive as well if the tar­get in ques­tion is a fully func­tional and qual­ity relay­ing node. In that case other peo­ple access­ing through the node would ran­dom­ize things sig­nif­i­cantly, and their access would be impos­si­ble to dif­fer­en­ti­ate from a local user with­out the kind of phys­i­cal access that makes the entire thing moot.

A few days ago I found the notice on the left in the photo above in my apart­ment build­ing. The notice states that some­one from the local gov­ern­ment will be con­duct­ing an ille­gal search of my apart­ment build­ing tomor­row. This isn’t the first time some­thing like this has hap­pened. About ten years ago, a sim­i­lar notice appeared and I took the day off from work to keep the “inspec­tor” from get­ting into my apart­ment with­out a search warrant–which, nat­u­rally, he didn’t have. After a bit of the expected veiled threats and attempts at intim­i­da­tion and trick­ery that inspec­tor gave up and left, and I’m hop­ing that the one tomor­row will go as well.

The two pages of Korean text next to the notice are a trans­la­tion of the Bill of Rights, with the Fourth Amend­ment high­lighted. I found this on the web­site of a civil rights orga­ni­za­tion called Jews for the Preser­va­tion of Firearms Own­er­ship, which has trans­la­tions of the Bill of Rights into many dif­fer­ent lan­guages. Most of my neigh­bors were born in Korea, and many speak no Eng­lish, so I fig­ured it was likely they wouldn’t be aware that they have the right to refuse war­rant­less searches of their homes. Hope­fully read­ing the trans­la­tion of the rel­e­vant US law will help at least some of them stand up for them­selves and their liberty.

Update: This time around the inspec­tor took “get a war­rant” quickly and with­out mak­ing a fuss.

Cryp­tog­ra­phy Suc­cess Story. From Brazil: the moral, of course, is to choose a strong key and to encrypt the entire drive, not just key files. [Schneier on Secu­rity]

The files were encrypted using True­crypt and an unnamed algo­rithm, report­edly based on the 256-bit AES stan­dard. In the UK, Dan­tas would be com­pelled to reveal his passphrase under threat of impris­on­ment, but no such law exists in Brazil.

The Brazil­ian National Insti­tute of Crim­i­nol­ogy (INC) tried for five months to obtain access to the encrypted data with­out suc­cess before turn­ing over the job to code-breakers at the FBI in early 2009. US com­puter spe­cial­ists also drew a blank even after 12 months of efforts to crack the code, Brazil’s Globo news­pa­per reports.

I use True­Crypt to pro­tect the Win­dows lap­top I use for work. Unfor­tu­nately, the Mac ver­sion doesn’t sup­port whole disk encryption.