Category: Privacy & Security
-
How to Assess an E-voting System
Part 1 of a 5-part series If I can shop and bank online, why can’t I vote online? David Jefferson explained in 2011 why internet voting is so difficult to make secure, I summarized again in 2021 why internet voting is still inherently insecure, and many other experts have explained it too. Still, several…
-
Most top websites are not following best practices in their password policies
By Kevin Lee, Sten Sjöberg, and Arvind Narayanan Compromised passwords have consistently been the number one cause of data breaches by far, yet passwords remain the most common means of authentication on the web. To help, the information security research community has established best practices for helping users create stronger passwords. These include: Block weak…
-
Dcentral vs. Consensus: Are institutions “frens” or enemies of crypto?
As a part of an ethnographic study on blockchain organizations, I recently attended two major conferences – Dcentral Con and Consensus – held back-to-back in Austin, Texas during a blistering heatwave. My collaborator, Johannes Lenhard, and I had conducted a handful of interviews with angel investors, founders, and venture capitalists, but we’d yet to conduct…
-
Phone number recycling creates serious security and privacy risks to millions of people
By Kevin Lee and Arvind Narayanan 35 million phone numbers are disconnected every year in the U.S., according to the Federal Communications Commission. Most of these numbers are not disconnected forever; after a while, carriers reassign them to new subscribers. Through the years, these new subscribers have sometimes reported receiving calls and messages meant for…
-
New Research on Privacy and Security Risks of Remote Learning Software
This post and the paper is jointly authored by Shaanan Cohney, Ross Teixeira, Anne Kohlbrenner, Arvind Narayanan, Mihir Kshirsagar, Yan Shvartzshnaider, and Madelyn Sanfilippo. It emerged from a case study at CITP’s tech policy clinic. As universities rely on remote educational technology to facilitate the rapid shift to online learning, they expose themselves to new…
-
NJ agrees No Internet voting in July, vague about November
A formal settlement agreement has been submitted to the NJ Superior Court regarding online ballot access in the 2020 elections. On May 4, 2020, New Jersey’s Division of Elections was caught trying to adopt vote-by-Internet on the stealth, even though the law forbids it. That is, not only is Internet voting inherently insecurable, there’s a…
-
Vulnerability reporting is dysfunctional
By Kevin Lee, Ben Kaiser, Jonathan Mayer, and Arvind Narayanan In January, we released a study showing the ease of SIM swaps at five U.S. prepaid carriers. These attacks—in which an adversary tricks telecoms into moving the victim’s phone number to a new SIM card under the attacker’s control—divert calls and SMS text messages away…
-
The CheapBit of Fitness Trackers Apps
Yan Shvartzshnaider (@ynotez) and Madelyn Sanfilippo (@MrsMRS_PhD) Fitness trackers are “[devices] that you can wear that records your daily physical activity, as well as other information about your health, such as your heart rate” [Oxford Dictionary]. The increasing popularity of wearable devices offered by Apple, Google, Nike inadvertently led cheaper versions to flood the market,…
-
Improving Protections for Children’s Privacy Online
CITP’s Tech Policy Clinic submitted a Comment to the Federal Trade Commission in connection with its review of the COPPA Rule to protect children’s privacy online. Our Comment explains why it is important to update the COPPA Rule to keep it current with new privacy risks, especially as children spend increasing amounts of time online…
-
Every move you make, I’ll be watching you: Privacy implications of the Apple U1 chip and ultra-wideband
By Colleen Josephson and Yan Shvartzshnaider The concerning trend of tracking of user’s location through their mobile phones has very serious privacy implications. For many of us, phones have become an integral part of our daily routine. We don’t leave our homes without and take them everywhere we go. It has become alarmingly easy for services…