slides/slides02.tex
changeset 465 76f9457b8f51
parent 415 56bc53ba7c5b
child 466 ddf7315450c9
equal deleted inserted replaced
464:f76e1456b365 465:76f9457b8f51
   114 
   114 
   115 \end{frame}
   115 \end{frame}
   116 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  
   116 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  
   117 
   117 
   118 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   118 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   119 \begin{frame}[t]
   119 \begin{frame}[c]
   120 \frametitle{How to Salt?}
   120 \frametitle{Exam and Homework}
   121 
   121 
   122 \begin{center}\tt\small
   122 \begin{itemize}
   123 \begin{tabular}{lcl}
   123 \item reminder\ldots KEATS
   124 1salt & $\Rightarrow$ & 8189effef4d4f7411f4153b13ff72546dd682c69\\
   124 \end{itemize}
   125 2salt & $\Rightarrow$ & 1528375d5ceb7d71597053e6877cc570067a738f\\
   125 
   126 3salt & $\Rightarrow$ & d646e213d4f87e3971d9dd6d9f435840eb6a1c06\\
       
   127 4salt & $\Rightarrow$ & 5b9e85269e4461de0238a6bf463ed3f25778cbba\\
       
   128 \end{tabular}
       
   129 \end{center}
       
   130 
       
   131 \begin{itemize}
       
   132 \item in Unix systems: \texttt{hash(salt + password)}, or even
       
   133 \texttt{hash$^{\texttt{1500}}$(salt + password)}\smallskip\pause
       
   134 \item Bruce Schneier in cases messages are long: \\
       
   135 instead of \texttt{m $\mapsto$ hash(m)},\\ use \texttt{m $\mapsto$ hash(hash(m) + m)}
       
   136 \end{itemize}
       
   137 \end{frame}
   126 \end{frame}
   138 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  
   127 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  
   139 
       
   140 
       
   141 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   142 \begin{frame}[c]
       
   143 \frametitle{\Large\begin{tabular}{c}User-Tracking Without Cookies\end{tabular}}
       
   144 
       
   145 Can you track a user {\bf without}:
       
   146 
       
   147 \begin{itemize}
       
   148 \item Cookies
       
   149 \item JavaScript
       
   150 \item LocalStorage/SessionStorage/GlobalStorage
       
   151 \item Flash, Java or other plugins
       
   152 \item Your IP address or user agent string
       
   153 \item Any methods employed by Panopticlick\\
       
   154 \mbox{}\hfill $\rightarrow$ \textcolor{blue}{\url{https://panopticlick.eff.org/}}
       
   155 \end{itemize}
       
   156 
       
   157 Even when you disabled cookies entirely, have JavaScript turned off and use a VPN 
       
   158 service, and also \ldots
       
   159 
       
   160 \end{frame}
       
   161 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   162 
       
   163 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   164 \begin{frame}
       
   165 \frametitle{Verizon}
       
   166 \mbox{}\\[-23mm]\mbox{} 
       
   167 
       
   168 \begin{center}
       
   169 \includegraphics[scale=0.21]{../pics/verizon.png}
       
   170 \end{center}
       
   171 \vfill\footnotesize
       
   172 \url{http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works}
       
   173 \end{frame}
       
   174 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 
       
   175 
       
   176 
       
   177 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   178 \begin{frame}[c]
       
   179 \frametitle{Web-Protocol}
       
   180 
       
   181 \only<1->{
       
   182 \begin{textblock}{1}(2,2)
       
   183   \begin{tikzpicture}[scale=1.3]
       
   184   \draw[white] (0,0) node (X) {\includegraphics[scale=0.12]{../pics/firefox.jpg}};
       
   185   \end{tikzpicture}
       
   186 \end{textblock}}
       
   187 
       
   188 \only<1->{
       
   189 \begin{textblock}{1}(11,2)
       
   190   \begin{tikzpicture}[scale=1.3]
       
   191   \draw[white] (0,0) node (X) {\includegraphics[scale=0.15]{../pics/servers.png}};
       
   192   \end{tikzpicture}
       
   193 \end{textblock}}
       
   194 
       
   195 \only<1->{
       
   196 \begin{textblock}{1}(5,2.5)
       
   197   \begin{tikzpicture}[scale=1.3]
       
   198   \draw[white] (0,0) node (X) {};
       
   199   \draw[white] (3,0) node (Y) {};
       
   200   \draw[red, ->, line width = 2mm] (X) -- (Y);
       
   201   \node [inner sep=5pt,label=above:\textcolor{black}{\small GET static.jpg}] at ($ (X)!.5!(Y) $) {};
       
   202   \end{tikzpicture}
       
   203 \end{textblock}}
       
   204 
       
   205 \only<2->{
       
   206 \begin{textblock}{1}(5,6)
       
   207   \begin{tikzpicture}[scale=1.3]
       
   208   \draw[white] (0,0) node (X) {};
       
   209   \draw[white] (3,0) node (Y) {};
       
   210   \draw[red, <-, line width = 2mm] (X) -- (Y);
       
   211   \node [inner sep=5pt,label=below:\textcolor{black}{\small ETag: 7b33de1}] at ($ (X)!.5!(Y) $) {};
       
   212    \node [inner sep=5pt,label=above:{\includegraphics[scale=0.15]{../pics/tvtestscreen.jpg}}] at ($ (X)!.5!(Y) $) {};
       
   213   \end{tikzpicture}
       
   214 \end{textblock}}
       
   215 
       
   216 \only<3->{
       
   217 \begin{textblock}{1}(4.2,11)
       
   218   \begin{tikzpicture}[scale=1.3]
       
   219   \draw[white] (0,0) node (X) {};
       
   220   \draw[white] (3,0) node (Y) {};
       
   221   \draw[red, ->, line width = 2mm] (X) -- (Y);
       
   222   \node [inner sep=5pt,label=above:\textcolor{black}{\small GET static.jpg ETag: 7b33de1}] at ($ (X)!.5!(Y) $) {};
       
   223   \end{tikzpicture}
       
   224 \end{textblock}}
       
   225 
       
   226 \only<4->{
       
   227 \begin{textblock}{1}(4.2,13.9)
       
   228   \begin{tikzpicture}[scale=1.3]
       
   229   \draw[white] (0,0) node (X) {};
       
   230   \draw[white] (3,0) node (Y) {};
       
   231   \draw[red, <-, line width = 2mm] (X) -- (Y);
       
   232   \node [inner sep=5pt,label=below:\textcolor{black}{\small HTTP/1.1 304 (Not Modified)}] at ($ (X)!.5!(Y) $) {};
       
   233   \end{tikzpicture}
       
   234 \end{textblock}}
       
   235 
       
   236 \end{frame}
       
   237 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   238 
   128 
   239 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   129 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   240 \begin{frame}[c]
   130 \begin{frame}[c]
   241 \frametitle{Today's Lecture}
   131 \frametitle{Today's Lecture}
   242 \begin{center}
   132 \begin{center}
   251 
   141 
   252 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   142 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   253 \begin{frame}[c]
   143 \begin{frame}[c]
   254 \frametitle{E-Voting}
   144 \frametitle{E-Voting}
   255 
   145 
   256 \begin{bubble}[9cm]
   146 \begin{bubble}[10cm]
   257 ``Any electronic voting system should provide at least the same
   147 ``Any electronic voting system should provide at least the same
   258 security, privacy and transparency as the system it replaces.''
   148   security, privacy and transparency as the system it replaces.''\medskip\\
       
   149   
       
   150   \small\hfill ---Australian Voting Commission
   259 \end{bubble}
   151 \end{bubble}
   260 
   152 
   261 \end{frame}
   153 \end{frame}
   262 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  
   154 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  
   263 
   155 
   419 \frametitle{E-Voting}
   311 \frametitle{E-Voting}
   420 
   312 
   421 \mbox{}\\[-12mm]
   313 \mbox{}\\[-12mm]
   422 \begin{itemize}
   314 \begin{itemize}
   423 \item US used mechanical machines since the 30s, later punch cards,
   315 \item US used mechanical machines since the 30s, later punch cards,
   424   now DREs and optical scan voting machines
   316   until recently DREs and optical scan voting machines
   425 
   317 
   426 \item Estonia used in 2007 the Internet for national elections
   318 \item Estonia used in 2007, 2011 and 2015 the Internet for national elections
   427   \textcolor{gray}{(there were earlier pilot studies in other
   319   \textcolor{gray}{(there were earlier pilot studies in other
   428     countries)}
   320     countries)}
   429 
   321 
   430 \item India uses e-voting devices since at least
   322 \item India uses e-voting devices since at least
   431   2003\\ \textcolor{gray}{(``keep-it-simple'' machines produced by a
   323   2003\\ \textcolor{gray}{(``keep-it-simple'' machines produced by a
   442 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   334 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   443 \begin{frame}[t]
   335 \begin{frame}[t]
   444 \frametitle{E-Voting in Estonia}
   336 \frametitle{E-Voting in Estonia}
   445 
   337 
   446 \begin{itemize}
   338 \begin{itemize}
   447 \item worlds first general election that used internet voting (2007)
   339 \item worlds first general election that used internet voting (2007, 2011, 2015)
   448 \item builds on the Estonian ID card (a smartcard like CC)
   340 \item builds on the Estonian ID card (a smartcard like CC)
   449 \item Internet voting can be used before the election (votes can be changed an
   341 \item Internet voting can be used before the election (votes can be changed an
   450 unlimited amount of times, last vote is tabulated, you can even change your
   342 unlimited amount of times, last vote is tabulated, you can even change your
   451 vote on the polling day in person)
   343 vote on the polling day in person)
   452 \item in the 2011 parliamentary election 24\% voted via Internet\bigskip\pause
   344 \item in the 2011 parliamentary election 24\% voted via Internet\bigskip\pause
   675 
   567 
   676 Alex Halderman:
   568 Alex Halderman:
   677 
   569 
   678 \begin{itemize}
   570 \begin{itemize}
   679 \item acquired a machine from an anonymous source\medskip
   571 \item acquired a machine from an anonymous source\medskip
   680 \item they try to keep secret the source code running the machine\medskip\pause
   572 \item they try to keep secret the source code running on the machine\medskip\pause
   681 
   573 
   682 \item first reversed-engineered the machine (extremely tedious)
   574 \item first reversed-engineered the machine (extremely tedious)
   683 \item could completely reboot the machine and even install a virus that infects other Diebold machines
   575 \item could completely reboot the machine and even install a virus that infects other Diebold machines
   684 \item obtained also the source code for other machines
   576 \item obtained also the source code for other machines
   685 \end{itemize}
   577 \end{itemize}
   751 
   643 
   752 \begin{itemize}
   644 \begin{itemize}
   753 \item keep a paper trail and design your system to keep this secure\medskip
   645 \item keep a paper trail and design your system to keep this secure\medskip
   754 \item make the software open source (avoid security-by-obscurity)\medskip
   646 \item make the software open source (avoid security-by-obscurity)\medskip
   755 \item have a simple design in order to minimise the attack surface
   647 \item have a simple design in order to minimise the attack surface
   756 \end{itemize}\pause
   648 \end{itemize}\pause\bigskip
   757 
   649 
   758 But overall, in times of NSA/state sponsored cyber-crime, e-voting is
   650 But overall, in times of NSA/state sponsored cyber-crime, e-voting is
   759 too hard with current technology.
   651 too hard with current technology.
   760 
   652 
   761 \end{frame}
   653 \end{frame}
   874 first lecture
   766 first lecture
   875 \end{column}
   767 \end{column}
   876 \begin{column}<2>{.4\textwidth}
   768 \begin{column}<2>{.4\textwidth}
   877 \centering
   769 \centering
   878 \includegraphics[scale=0.32]{../pics/trainwreck.jpg}\\
   770 \includegraphics[scale=0.32]{../pics/trainwreck.jpg}\\
   879 next week
   771 next
   880 \end{column}
   772 \end{column}
   881 \end{columns}
   773 \end{columns}
   882 \end{center}
   774 \end{center}
   883 
   775 
   884 \end{frame}
   776 \end{frame}
   885 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
   777 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   778 
       
   779 
       
   780 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   781 \begin{frame}[t]
       
   782 \frametitle{How to Salt?}
       
   783 
       
   784 \begin{center}\tt\small
       
   785 \begin{tabular}{lcl}
       
   786 1salt & $\Rightarrow$ & 8189effef4d4f7411f4153b13ff72546dd682c69\\
       
   787 2salt & $\Rightarrow$ & 1528375d5ceb7d71597053e6877cc570067a738f\\
       
   788 3salt & $\Rightarrow$ & d646e213d4f87e3971d9dd6d9f435840eb6a1c06\\
       
   789 4salt & $\Rightarrow$ & 5b9e85269e4461de0238a6bf463ed3f25778cbba\\
       
   790 \end{tabular}
       
   791 \end{center}
       
   792 
       
   793 \begin{itemize}
       
   794 \item in Unix systems: \texttt{hash(salt + password)}, or even
       
   795 \texttt{hash$^{\texttt{1500}}$(salt + password)}\smallskip\pause
       
   796 \item Bruce Schneier in cases messages are long: \\
       
   797 instead of \texttt{m $\mapsto$ hash(m)},\\ use \texttt{m $\mapsto$ hash(hash(m) + m)}
       
   798 \end{itemize}
       
   799 \end{frame}
       
   800 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  
       
   801 
       
   802 
       
   803 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   804 \begin{frame}[c]
       
   805 \frametitle{\Large\begin{tabular}{c}User-Tracking Without Cookies\end{tabular}}
       
   806 
       
   807 Can you track a user {\bf without}:
       
   808 
       
   809 \begin{itemize}
       
   810 \item Cookies
       
   811 \item JavaScript
       
   812 \item LocalStorage/SessionStorage/GlobalStorage
       
   813 \item Flash, Java or other plugins
       
   814 \item Your IP address or user agent string
       
   815 \item Any methods employed by Panopticlick\\
       
   816 \mbox{}\hfill $\rightarrow$ \textcolor{blue}{\url{https://panopticlick.eff.org/}}
       
   817 \end{itemize}
       
   818 
       
   819 Even when you disabled cookies entirely, have JavaScript turned off and use a VPN 
       
   820 service, and also \ldots
       
   821 
       
   822 \end{frame}
       
   823 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
       
   824 
       
   825 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   826 \begin{frame}
       
   827 \frametitle{Verizon}
       
   828 \mbox{}\\[-23mm]\mbox{} 
       
   829 
       
   830 \begin{center}
       
   831 \includegraphics[scale=0.21]{../pics/verizon.png}
       
   832 \end{center}
       
   833 \vfill\footnotesize
       
   834 \url{http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works}
       
   835 \end{frame}
       
   836 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 
       
   837 
       
   838 
       
   839 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   840 \begin{frame}[c]
       
   841 \frametitle{Web-Protocol}
       
   842 
       
   843 \only<1->{
       
   844 \begin{textblock}{1}(2,2)
       
   845   \begin{tikzpicture}[scale=1.3]
       
   846   \draw[white] (0,0) node (X) {\includegraphics[scale=0.12]{../pics/firefox.jpg}};
       
   847   \end{tikzpicture}
       
   848 \end{textblock}}
       
   849 
       
   850 \only<1->{
       
   851 \begin{textblock}{1}(11,2)
       
   852   \begin{tikzpicture}[scale=1.3]
       
   853   \draw[white] (0,0) node (X) {\includegraphics[scale=0.15]{../pics/servers.png}};
       
   854   \end{tikzpicture}
       
   855 \end{textblock}}
       
   856 
       
   857 \only<1->{
       
   858 \begin{textblock}{1}(5,2.5)
       
   859   \begin{tikzpicture}[scale=1.3]
       
   860   \draw[white] (0,0) node (X) {};
       
   861   \draw[white] (3,0) node (Y) {};
       
   862   \draw[red, ->, line width = 2mm] (X) -- (Y);
       
   863   \node [inner sep=5pt,label=above:\textcolor{black}{\small GET static.jpg}] at ($ (X)!.5!(Y) $) {};
       
   864   \end{tikzpicture}
       
   865 \end{textblock}}
       
   866 
       
   867 \only<2->{
       
   868 \begin{textblock}{1}(5,6)
       
   869   \begin{tikzpicture}[scale=1.3]
       
   870   \draw[white] (0,0) node (X) {};
       
   871   \draw[white] (3,0) node (Y) {};
       
   872   \draw[red, <-, line width = 2mm] (X) -- (Y);
       
   873   \node [inner sep=5pt,label=below:\textcolor{black}{\small ETag: 7b33de1}] at ($ (X)!.5!(Y) $) {};
       
   874    \node [inner sep=5pt,label=above:{\includegraphics[scale=0.15]{../pics/tvtestscreen.jpg}}] at ($ (X)!.5!(Y) $) {};
       
   875   \end{tikzpicture}
       
   876 \end{textblock}}
       
   877 
       
   878 \only<3->{
       
   879 \begin{textblock}{1}(4.2,11)
       
   880   \begin{tikzpicture}[scale=1.3]
       
   881   \draw[white] (0,0) node (X) {};
       
   882   \draw[white] (3,0) node (Y) {};
       
   883   \draw[red, ->, line width = 2mm] (X) -- (Y);
       
   884   \node [inner sep=5pt,label=above:\textcolor{black}{\small GET static.jpg ETag: 7b33de1}] at ($ (X)!.5!(Y) $) {};
       
   885   \end{tikzpicture}
       
   886 \end{textblock}}
       
   887 
       
   888 \only<4->{
       
   889 \begin{textblock}{1}(4.2,13.9)
       
   890   \begin{tikzpicture}[scale=1.3]
       
   891   \draw[white] (0,0) node (X) {};
       
   892   \draw[white] (3,0) node (Y) {};
       
   893   \draw[red, <-, line width = 2mm] (X) -- (Y);
       
   894   \node [inner sep=5pt,label=below:\textcolor{black}{\small HTTP/1.1 304 (Not Modified)}] at ($ (X)!.5!(Y) $) {};
       
   895   \end{tikzpicture}
       
   896 \end{textblock}}
       
   897 
       
   898 \end{frame}
       
   899 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%
       
   900 
   886 
   901 
   887 \end{document}
   902 \end{document}
   888 
   903 
   889 %%% Local Variables:  
   904 %%% Local Variables:  
   890 %%% mode: latex
   905 %%% mode: latex