Jaap-Henk Hoepman - on security, privacy and... » Seeds

A Space For New Art

Jaap-Henk — Sat, 08 Oct 2011 18:18:12 +0000

Visiting the Bienale in Venice made me feel very happy (I love Venice) and very sad (seeing only ‘old’ art from the big names). Walking around in the Punta della Dogana museum, re-architected by Tadao Ando in such an obviously unobvious (over designed) way that the whole building got on my nerves in fact, it felt like walking around in a temple, or rather a prison, meant to keep the people out, meant to take away the art from the people.

And then it occurred to me that, given the mainstream stuff that was shown in there (Koons, Richter, etc), this was not such a bad idea really. What about setting up a foundation, aimed at collecting all major artworks in the world. It would announce the opening of a new museum, meant to make Guggenheim, MOMA and all that look like pilferers (it would be located in Dubai, of course). Grand opening: April 1, 2014. RSVP. Everybody shows up. And then: a black box (or maybe golden..). No doors. No windows. All art inside. Safe. Forever.

The museum would be called “A Space For New Art”. Because that is what it would provide: space for new art. Because it would take all the old art from the face of the earth, creating a void that can be filled with new ideas by new artists. At last.

Global GSM eavesdropping network.

Jaap-Henk — Mon, 03 Jan 2011 17:56:03 +0000

GSM has been broken up to the point that a phone call or an SMS can be intercepted using an ordinary phone and a PC. The impact of this attack is still somewhat limited, because to eavesdrop, you need to be close to the target mobile phone. However, with a bit of ‘crowdsourcing’ we can overcome this ‘limitation’.

Suppose we are able to reprogram the baseband (this is still a big if, as far as I know…) of a few common types of phones, that also have a mobile internet connection. Reprogram the baseband in such a way that such phones can intercept an SMS or GSM call, provided they know the right session key. Also add fucntionality to collect data needed to crack a session key.

Next develop a small P2P app, install it on all these phones, and use this P2P network (that communicates using the mobile internet connection of the phone) to find a phone close to the target phone corresponding to a given mobile phone number. Use the app to first collect some data in order to crack the session key off-line, and when it receives back the corresponding session key to start eavesdropping.

You could do this in the open, or you could hide the functionality in a popular app. Whatever way you do it, you would have built yourself a global GSM intercept facility. Now wherever you are, you can enter the phone number of a target mobile phone, and the communications will be delivered to you in real time.

Push-to-talk button for RFID

Jaap-Henk — Tue, 08 Jun 2010 09:28:36 +0000

Basic RFID tags, like EPC Global tags, store a unique number that is broadcast whenever they come within reading range of an arbitrary reader. This poses some privacy threats because if you carry a tag with you all the time, the same serial number will show up at all the readers you pass. Today at the RFIDSec 2010 workshop I learnt that secret handshakes (See Czeskis et. al.) are an active area of research in RFID security. The aim is to provide some context to an RFID tag that will allow the tag to decide whether to talk or not.

In the case of secret handshakes, the aim is to allow the RFID tag to detect whether it is moved in a particular way. The tag will only respond to a reader, when it detects this movement. For example, the swipe movement you make when presenting you public transport pass to the gate can be detected, and the card will only respond if it just performed that swipe movement.

The problem with this approach is twofold. First, the tag need to have some accelerometer and some processing capabilities (that standard EPC tags do not have). Second, the detection algorithms are not very precise, so walking and swiping are hard to distinguish. This means your card can still be read when you are walking around, for example.

A much simpler approach to implement this kind of explicit consent would be to put a push-to-talk button on your transport card, that controls a switch between the actual tag and the antenna. Only when the button is pressed, the switch is closed, and the antenna and the tag are connected. Only when these two are connected, the tag receives power and is able to communicate. When disconnected, any communication is physically impossible. One thing to take care of is to make sure that the button is not accidentally pressed when it is in your pocket or your wallet. Perhaps, another approach would be to put a sensor on the card that can detect the presence of a finger (no fingerprint scanning required, btw.)

There are many more options to add context to RFID tag reading protocols. Another simple example is to construct RFID tags that only respond whenever another tag is present. That second tag then works as an unlock tag to the second. I think using context to improve the security and privacy of RFID tags is an important area of research. It could provide is with new tools and methods that allow users to exert more control over how their RFID tags are used.

Using a mobile phone number as an authentic identifier

Jaap-Henk — Tue, 27 Apr 2010 21:33:10 +0000

This idea came up when I saw a guy in the train today, carrying a cardboard box with a number written on it.

I stared at the box, and it took a short while before I realised the number was a phone number. I wondered why that was, and then it occurred to me that maybe the guy carrying the box was the recipient of the box. Maybe the phone number on the box was used to call him up to say his parcel was waiting for him…

And then I realised that the number could also have been used to authenticate him when he showed up to collect his parcel. Suppose a caretaker is responsible to hand over parcels to the rightful recipient. All the caretaker knows is the mobile phone of the recipient. The caretaker also has a phone, whose number is secret. If a recipient shows up to claim a parcel, the caretaker simply asks him to show his mobile phone. Next, the caretaker dials the phone number written on the parcel. If the call is displayed on the mobile phone held in the hands of the recipient (with the number of the caretaker clearly shown in the display), this proofs the rightful person showed up to collect the parcel.

Of course this is very similar to the use SMS to send one-time passwords or transaction codes to people signing in to websites, or doing electronic banking. But this protocol doesn’t cost you anything (if the caller does not pick up his phone). Moreover, this protocol allows you to ask someone else to collect the parcel… Simply forward all your incoming calls to his mobile…

1d (One Id)

Jaap-Henk — Tue, 15 Dec 2009 18:48:53 +0000

It actually surprised me that it took so long for a service like Google Voice to come along. No more arbitrary distinction between email, voicemail, sms and conversations: all use the same contact address (a ‘universal’ phone number). Sender and receiver decide independently how to send/receive the message.

I wanted this many years ago… (when ENUM came along and that didn’t do the trick..). But today I realised you could even extend this idea to ordinary mail and travel directions as well. You could drop a paper letter in a mail box addressed to my universal contact point (say my email address) and it would get delivered to my current address (and maybe even scanned to my email address as well… Driving directions: maybe I’m not in town, maybe I moved and I didn’t send you my new address,… TomTom can find me anyway.

You could also use this to enhance your privacy. Just create many pseudonyms, and use a fresh one each time you buy a book at Amazon.com. With this system, they no longer need to know your real address…

Improved iPhone calendar

Jaap-Henk — Thu, 17 Jul 2008 20:29:38 +0000

The current iPhone calendar application doesn’t give a good overview of appointments, holidays, all day events, and so on in month view. That is really a pity because the resolution of the device is really large enough to give much more visual feedback.

The idea is the following:

All day events and special days are colour coded; the colour is selectable to tell different types of days apart.

Appointments are shown in a radial grid that runs either from 6am to 6pm (day view) or 6pm to 6 am the next day (night view). Day view and night view are selected using the sun/moon buttons on the month bar. The radial grid thus represents a traditional clock, split at the bottom at 6 o’clock.

The example shows only appointments that last an hour and start at the full hour. Of course, the grid can be made more fine grained. To avoid very tiny segments, appointment lengths and start times should probably rounded off at quarters of an hour.

Other issues

Also, integration of holiday calendars, and birthdays as entered in the contact list should be implemented. They could be shown as all day events.

Events from multiple calendars could also be shown in distinguishing colours, although the resulting calendar could be quite painful to the eyes .

Rubiks Office

Jaap-Henk — Wed, 25 Jun 2008 21:35:34 +0000

Office buildings are soo boring to work in. Always the same room to work in. Same floor, same view, same… “Flexplek” you say? So you really want me to clean my desk every day!!??

What about

Rubik’s Office, or the Matrix Cubicles or… The office consists of square rooms, that can move relative to each other, along the same hall, or move up or down to different floors. A bit like the cubes in Rubik’s cube.

A bonus for someone for designs that have more fancy office room shapes!

0906-SORRY

Jaap-Henk — Wed, 10 Jan 2007 15:58:56 +0000

Say it with flowers…? No, an excuse-me-service. Saying sorry is hard. But Japanese are good at it. So hire one, to say sorry for you! (And, for people sick of hearing excuses, there’s 0906-THANKYOU, also Japanese, to receive the apologies for you…).

Thanx to Cees, MaOo and the other SoS-ers (sausages? ) for this one!…

… and Soulwax of course: ‘This is the excuse that we’re making, is it good enough for what you pay? You pay!’ (NY Excuse )