XOT: On Privacy, Security, and... https://blog.xot.nl/ On privacy, security and (occasionally) other stuff Thu, 04 Apr 2024 09:25:07 +0000 en daily 1 Raisin, stop abetting identity theft. https://blog.xot.nl/2024/04/04/raisin-stop-abetting-identity-theft/index.html https://blog.xot.nl/2024/04/04/raisin-stop-abetting-identity-theft/index.html Thu, 04 Apr 2024 00:00:00 +0000 Today I got a strange request from Raisin, a large European financial service provider. They wanted me to upload a new copy of my passport, because the old one I used to register my account is about to expire. This puzzles me. And the way they asked is downright dangerous.

]]>
Wie de Holocaust herdenkt, moet ook bij Gaza stilstaan https://blog.xot.nl/2024/03/09/wie-de-holocaust-herdenkt-moet-ook-bij-gaza-stilstaan/index.html https://blog.xot.nl/2024/03/09/wie-de-holocaust-herdenkt-moet-ook-bij-gaza-stilstaan/index.html Sat, 09 Mar 2024 00:00:00 +0000 Dit zou een open deur moeten zijn. Deze uitleg, deze blog, deze verantwoording zo je wil, zou niet nodig moeten zijn. Maar is het helaas wel in het huidige politieke klimaat.

Voor de duidelijkheid: wat er in Gaza gebeurt is verschrikkelijk, maar komt niet in de buurt van wat er tijdens de Holocaust gebeurde. Dit is dus geen vergelijking. Ik ben ook niet echt geïnteresseerd in de vraag of Israël zich in Gaza aan genocide schuldig maakt. Welk label je er op plakt maakt weinig uit. Feit is wel dat in Gaza de mensenrechten worden geschonden, en tienduizenden onschuldige burgers, vrouwen en kinderen, door Israël worden vermoord. En als beesten opgejaagd en gevoerd worden. Omdat Palestijnen niet meer als mensen gezien worden, maar als ‘collateral damage’, als objecten die in de weg staan, of gewoon als gerechtvaardigd doelwit.

Uit diezelfde ontmenselijking (van Joden) ontstond de Holocaust. De kern van het herdenken van de Holocaust is: dit nooit meer. Maar dat moet verder gaan dan de Holocaust enkel te zien als aberratie, als singuliere manifestatie van het Kwaad. Dan zouden we er maar weinig van leren. We moeten ook leren van de oorzaken, het zaad waaruit de Holocaust groeide, zoals de ontmenselijking van ‘de ander’. Alleen dan kunnen we er echt van leren, en uit de grond van ons hart zeggen: dit nooit meer. En daarom moeten we ook stilstaan bij, en ons uitspreken over, wat er nu in Gaza gebeurt. Niet omdat het hetzelfde is. Maar wel omdat het uit hetzelfde gedachtegoed ontstaat.

]]>
Publieke laadpaal op privéstroom https://blog.xot.nl/2024/03/04/publieke-laadpaal-op-priv-stroom/index.html https://blog.xot.nl/2024/03/04/publieke-laadpaal-op-priv-stroom/index.html Mon, 04 Mar 2024 00:00:00 +0000 Veel mensen hebben geen eigen oprit of garage waar ze een eigen laadpaal neer kunnen zetten om hun elektrische auto mee op te laden. Maar misschien hebben ze wel zonnepanelen, of genoeg dakruimte ervoor. Of hebben ze interesse in een dynamisch energiecontract. Dat is een gemiste kans. Helemaal omdat alle laadpalen, of ze nu publiek of privé zijn, uiteindelijk op het zelfde elektriciteitsnetwerk zijn aangesloten. Zouden we publieke laadpalen niet zo kunnen programmeren dat ze ook voor het laden met privéstroom gebruikt kunnen worden?

]]>
Will the digital euro really be equivalent to cash? https://blog.xot.nl/2024/02/28/will-the-digital-euro-really-be-equivalent-to-cash/index.html https://blog.xot.nl/2024/02/28/will-the-digital-euro-really-be-equivalent-to-cash/index.html Wed, 28 Feb 2024 00:00:00 +0000 The European Central Bank (ECB) is developing a digital euro. Such a digital euro should be “an electronic equivalent to cash”. But will it? It doesn’t look like it, really. Which makes it all the more important to push for better designs for the offline digital euro, and to fight for the continued acceptance of traditional cash.

]]>
Do fair design patterns exist? https://blog.xot.nl/2024/02/07/do-fair-design-patterns-exist/index.html https://blog.xot.nl/2024/02/07/do-fair-design-patterns-exist/index.html Wed, 07 Feb 2024 00:00:00 +0000 Last week I participated in a Lorentz workshop on Fair patterns for online interfaces, organised by Hanna Schraffenberger, Raphael Gellert, Colin Gray, Arianna Rossi and Cristiana Santos. The workshop was super interesting, and I would like to thank the organisers for the great work they did in preparing such a stellar event. (BTW: the Lorentz Center offers a great location and a great deal of support to organise your own workshop at no cost. They are always happy to receive workshop proposals!).

At the workshop dinner, Arianna asked me what I learned, and I provocatively quipped: “fair design patterns do not exist”. Of course the truth is much more nuanced, which I will try to unpack a bit in this blog post, to perhaps start a more in depth discussion and study.

]]>
Analysing the proposal to regulate the digital euro https://blog.xot.nl/2023/12/04/analysing-the-proposal-to-regulate-the-digital-euro/index.html https://blog.xot.nl/2023/12/04/analysing-the-proposal-to-regulate-the-digital-euro/index.html Mon, 04 Dec 2023 00:00:00 +0000 Earlier this year the European Commission published a proposal for a regulation on the establishment of the digital euro. At the same time it also published another proposal for a regulation on the legal tender of euro banknotes and coins. See for more information this digital euro package.

A few months later, both the European Central Bank (ECB) and the EDPB/EDPS published their opinions on this proposal. I was asked to offer my views on these proposals to the Civil Liberties, Justice and Home Affairs (LIBE) committee of the European Parliament. This is what I submitted.

]]>
Some observations on the final text of the European Digital Identity framework (eIDAS). https://blog.xot.nl/2023/11/20/some-observations-on-the-final-text-of-the-european-digital-identity-framework-eidas/index.html https://blog.xot.nl/2023/11/20/some-observations-on-the-final-text-of-the-european-digital-identity-framework-eidas/index.html Mon, 20 Nov 2023 00:00:00 +0000 The final text of the update to the eIDAS regulation (establishing a framework for a European Digital Identity) has been agreed upon. In a last minute effort to improve the text, we wrote an open letter criticising the proposal on weakening the security of the web, and providing too few safeguards protecting users of the proposed European Identity Wallet. Were we successful?

]]>
Clearghost: Using the laws of nature to limit digital surveillance by law enforcement. https://blog.xot.nl/2023/10/24/clearghost-using-the-laws-of-nature-to-limit-digital-surveillance-by-law-enforcement/index.html https://blog.xot.nl/2023/10/24/clearghost-using-the-laws-of-nature-to-limit-digital-surveillance-by-law-enforcement/index.html Tue, 24 Oct 2023 00:00:00 +0000 Digitisation owes its disruptive power to the near zero marginal cost of digital products and services. Although the initial investment to create a product or service may be huge, creating a new digital copy, adding new users, or processing more work, costs next to nothing. As a result, these products and services can scale up very quickly without control, creating all kinds of societal problems. In this blog post I will focus on the particular problem of digital surveillance by law enforcement, and will study a speculative approach based on laws of nature to inherently limit their reach.

]]>
Tainting the CSAM client-side scanning database. https://blog.xot.nl/2023/10/11/tainting-the-csam-client-side-scanning-database/index.html https://blog.xot.nl/2023/10/11/tainting-the-csam-client-side-scanning-database/index.html Wed, 11 Oct 2023 00:00:00 +0000 The proposal of the European Commission for a regulation on preventing and combatting the sexual abuse and sexual exploitation of children is currently discussed in Dutch parliament. I recently wrote about some concerns and the risk of a DDoS attack. It turns out it is also possible to taint the database of images of known child sexual abuse material (CSAM), allowing an adversary to trick the client-side scanning system to also trigger an alarm for other, non CSAM, material. Client side scanning could thus be vulnerable to undetectable function creep.

]]>
DDoS-ing client-side scanning https://blog.xot.nl/2023/10/04/ddos-ing-client-side-scanning/index.html https://blog.xot.nl/2023/10/04/ddos-ing-client-side-scanning/index.html Wed, 04 Oct 2023 00:00:00 +0000 The European Commission is proposing a regulation on preventing and combatting the sexual abuse and sexual exploitation of children. I recently wrote (in Dutch) about some concerns I have about the proposal, especially the requirement it creates for large messaging platforms to implement client side scanning for child sexual abuse material (CSAM). Today I learned I forgot something: it appears to be possible to DDoS the system!

]]>