Martin Schaffer

I ❤️#schnorrsignatures. Much better than DSA (digital signature algorithm) which we were forced to use, until the Schnorr signature patent expired in 2018. Schnorr is the basis for blind signatures, a powerful mechanism for issuing an updated version of Chaumian ecash (invented in the 80s) Onward! https://lnkd.in/gu-GCJ3F

10

1 Kommentar

I wish I could comment more, but I have to pay to read the standard. A few months ago, it dawned on me that while we are advocating for open source , many of the digital public services are being implemented using pay-to-read standards. How did that happen? So combine political agendas with economic barriers and there you have it folks - something that works for government and corporate interests but with little regard for the one who ultimately has to use it - you. https://lnkd.in/gsT6AuYZ

34

14 Kommentare

“… national #dataprotection #supervisory #authorities in #Germany should be designated as #market #surveillance authorities under the #AIAct (following the entry into force of the AI Act in the coming months).” position paper from the #German #Datenschutzkonferenz #EUAIAct #AIRegulation #AI

5

1 Kommentar

#Kritische #Sicherheitslücken in #SolarWinds - #Updates verfügbar! "SolarWinds Access Rights Manager (#ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution." "SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability would allow access to the RabbitMQ management console." https://lnkd.in/e7CCZdJH

3

1 Kommentar

📚 Breaking reCAPTCHAv2 👥️ Andreas Plesner , #TobiasVontobel, Roger Wattenhofer 📆 September 2024, Preprints. 🌐 https://lnkd.in/dnvcBnTq #CAPTCHAs (Completely Automated Public Turing Tests to Tell Computers and Humans Apart) have been the frontline defense against automated bots on the Internet. Published on #ResearchGate as #preprints and early stage review, the study of ETH Zürich researchers is focused on the v2 of the Google websites protection system and the message is clear: 🟥 #reCAPTCHAv2 isn't safe anymore: #AI / #ML can fully bypass reCAPTCHAv2 image-based captcha challenges, rendering this captcha mechanism obsolete. It also highlights how the system relies more on metadata (such as browsing history) and cookies rather than the visual challenge itself. The study is valid only for ReCAPTCHAv2. As I was curious as well to known more about, I took the opportunity to browse for a while: the current reference page is here https://shorturl.at/kDJIz (see comments for more) and the first implementation of #CAPTCHA, has been released in #Y2000 by Luis von Ahn and his team at Carnegie Mellon University : ➡️ One of the most well-known early text-based systems was developed by Luis von Ahn and his team at Carnegie Mellon University (#Y2003): random letters and numbers shown in various fonts, often with added noise, lines, or distortions; ➡️ #Y2007, Luis von Ahn and his team published #reCAPTCHA; ➡️ #Y2009 #Google purchased reCAPTHA; ➡️ #Y2014, the image and audio based versions as #reCAPTCHAv2 by Google; ➡️ #Y2018 the behavior-based #reCAPTCHAv3 version. 💡I am sure you also are wondering what "re" stands for? As far as I have found, it is #Reuse or #Recycling and reflects a dual-purpose system. reCAPTCHA not only serves its original security purpose but also leverages human input to help with other tasks such as digitizing books and training machine learning models (credits to Luis von Ahn and his team). 💡 Luis von Ahn is currently the co-founder and CEO of Duolingo the e-learning platform. I believe it is great to remember the origins of technologies and innovations, as well as to credit those who originally developed them from scratch, often relying only on their intuition and genius. What do you think? 👌 ✅️ Moving forward, the #study, researchers used advanced #YOLOv8 models (training with 14,000 labeled images) to classify and segment images presented in captchas and Python 3.9 with Selenium WebDriver for Firefox to simulate realistic browsing scenarios. They also used a VPN to simulate unique user sessions to avoid detection and bezier curve-based mouse movements were integrated to emulate human-like behavior (#methodology). The model they developed solved all CAPTCHAs (100% score) in their tests, demonstrating a significant improvement over prior work, which had success rates of 68–71%: the message is to update from v2 as with #vulnerabilities. #CyberSec #ArtificialIntelligence #Security #AI #Security

18

9 Kommentare

So, Could The Digital Euro, Be Used For State, Surveillance Purposes? Well, A Recent Survey, By Germany’s Deutsche Bundesbank. States, The German Public Believes It Could... 💭 💭 Germany’s Deutsche Bundesbank has revealed the results of its survey, showing 50% of the respondents could “generally imagine” using a Digital Euro. German's are “open to the idea of the Digital Euro,” according to the country’s, central bank. Which published the results of a survey conducted among 2,012 people in April 2024. As per results, around half of the respondents “could generally imagine using a Digital Euro as an additional payment option. People who were previously unaware of the Digital Euro, also indicated that they were open to this new means of payment in the survey. The survey revealed, only 41% of respondents had already heard, read or seen some information about the Digital Euro, whereas 59% did not know anything about it, at all. That said, another important bit of of information also come out, which stated that, there’re are still those who believe, that the Digital Euro was intended to spy on citizen’s payments. Accordingly and rightfully so too, the Deutsche Bundesbank president, Joachim Nagel. Noted that there's still a “great deal of information that still needs to be provided”, as 8% of respondents said they think that the Digital Euro “was intended to monitor payment flow. Joachim Nage, additionally stated that, the survey shows us that a great deal of information still needs to be provided and that we have to actually set the correct priorities. Such as privacy protection, in the preparatory work for the new European means of payment”. Executive board member responsible for cash and the Digital Euro project, Burkhard Balz, added. Many respondents “still had patchy knowledge about the Digital Euro,” as 16% of respondents still believe that the Digital Euro was a cryptocurrency. Burkhard Balz argued, “the prices of crypto-assets such as Bitcoin or Ethereum fluctuate strongly and do not fulfil the traditional functions of a ccurrency. Of which the stability of their value is not vouched for by a central bank”. In May, the bank revealed, nearly 90% of German households “appear open” to the idea of embracing a CBDC during the banking stress. At the time, the central bank found that many Germans were mainly open to CBDCs. Even without remuneration, almost half of the people said they would be okay with having digital euros. #couldtheDIGITALEUROorotherCBDCsbeusedforSTATEorotherSURVEILLANCEpurposes... 🤷🤷

4

3 Kommentare

🔒 "We Could Expose All of Italy!" – Protect Your Data Before It's Too Late... Recent events in Italy show how quickly data can fall into the wrong hands. With 52,000 attacks on the Italian Ministry of the Interior's database, the need for secure data protection has never been more urgent. Sensitive information, from tax and healthcare records to government communications, has been breached, underscoring the alarming scale of these threats. It’s no coincidence that millions of customers across 150+ countries rely on WeSendit to securely transfer and protect their data. 🇨🇭 As a Swiss company, WeSendit offers a secure, decentralized file transfer and storage platform, designed for organizations that require the highest data security standards. Find out how we protect what matters most: https://lnkd.in/dMPFm6JJ Source: https://lnkd.in/dVUGjkmJ

10

🔑The Next Web's feature of Terra Quantum AG today shows how we make it easy for developers and security professionals to protect sensitive data against current and future threats. Our new TQ42 Cryptography has a user-friendly unified API for post-quantum (PQ) and quantum-resistant algorithms, essential security features such as key generation and management functions, and a scalable architecture. 📚 This open-source library is the latest component of our quantum-as-a-service ecosystem, TQ42. It can help enterprises make data transmission, storage, and authentication more secure. ➡ Read the full article here: https://lnkd.in/gAkAZGRT ➡ Link to the repository: https://lnkd.in/gPjwPn-U #QuantumIsNow #cryptography #quantumtech #quantumcommunication #quantum

53

4 Kommentare

In these times where disinformation is king. Interesting graphs on how the content is produced. more information. https://lnkd.in/dQQ3ZZcT Imperva. thanks Fabienne Billat for this tip. #bot, #AI #security #ethics

8

1 Kommentar

📢 Exciting news for open source software advocates! The German government has officially published the Onlinezugangsgesetz 2.0 (OZGÄndG), featuring a groundbreaking new Article 16a, which mandates federal public offices to prefer open source software for newly procured software over proprietary options. This represents a significant step towards greater transparency, security, and efficiency in government operations. 🔍 Despite the soft language of "should" in Article 16a, within the context of public offices, it practically sets a default process, making it stronger than previous preferences in federal architecture guidelines. However, the impact of such mandates remains to be seen in practice. The Swiss EMBAG law, for example, already requires public bodies to disclose the source code of software they develop unless restricted by third-party rights or security concerns, yet challenges in enforcement persist. ⚖️ Similar situations are observed in other countries like France and Italy, where open source-friendly laws exist but are not consistently enforced. This underscores a broader issue: legal mandates alone do not guarantee adherence. Strategic litigation might be one approach to ensure compliance, but it's crucial to also understand vital role o establishing Open Source Program Offices (OSPOs) within public sector organizations. 🏢 OSPOs could play a transformative role by providing the necessary infrastructure and support for public offices to adopt, develop, and contribute to open source software effectively. This approach aligns with a collaborative strategy, offering assistance rather than presenting additional problems. 📈 France’s experience offers valuable insights. Despite the Digital Republic law’s mandate, progress was slow until the Bothorel parliamentary report in 2021 and the subsequent establishment of the Mission Logiciels Libres (MLL). However, the MLL’s limited resources highlight the need for stronger institutional support and coordination across relevant ministries. 🔑 The key takeaway is that while getting open source mandates into law is a critical first step, it cannot be the last (as French junior minister Axelle Lemaire said in 2016: "The after-sales service is as important as the law itself"). There must be ongoing efforts to build the necessary institutional infrastructure and ensure these laws have the intended impact. The success of such initiatives depends on political will, administrative approval, budget allocation, and strategic understanding at all levels of government. 🚀 We need to continue to advocate for stronger support structures like OSPOs, promote strategic litigation where necessary, and push for comprehensive implementation studies to ensure open source mandates lead to meaningful change. #OpenSource #OSS #PublicSector #DigitalTransformation #OSPO #Governance #TechPolicy

18

2 Kommentare

🚨Understanding the Impact of the KRITIS Umbrella Act on Perimeter Protection The KRITIS Umbrella Act is THE hot topic in today’s perimeter protection landscapes. Whereas the challenges through this new legislation are highlighted by many, it also drives technological innovation forward Dr. Kai Nuernberger and Prof. Dr. Elmar Padilla from Fraunhofer FKIE highlight how this Act provides essential guidelines and fosters the use of advanced technologies to enhance security. The EU NIS 2 Directive for Cyber Security, for example, will lead to expanded obligations for companies, promoting the adoption of innovative solutions. 🔍 Key Insights: The focus on electronic security is growing, with new technologies rapidly improving solutions for critical infrastructures, industrial facilities, and more. Integrated security solutions combining perimeter protection, IT security, and operational data are crucial for timely detection of security anomalies. From drone detection to advanced IT protection systems and real-time data processing, a multi-layered approach is essential for comprehensive security strategies. Fraunhofer FKIE's research plays a pivotal role in setting the foundations for protecting and monitoring critical systems. The KRITIS Umbrella Act demands close cooperation across disciplines, which is exemplified by initiatives like the Fraunhofer Center for Digital Energy. For a deeper dive into these developments and to stay ahead in the field of security, visit our website to read our detailed article on the KRITIS Umbrella Act and learn more about the latest trends and technologies showcased at Perimeter Protection 2025! 📅 Book your stand now and join the conversation at Perimeter Protection 2025! #PerimeterProtection #PerimeterProtection2025

24

1 Kommentar

What is the Canton Network? Two papers in one download: 🔹 Canton Network: A Network of Networks for Smart Contract Applications Current smart contract networks suffer two constraints that significantly limit meaningful adoption by traditional financial institutions and other enterprises. First, they require every application to inherit the governance properties and the fully transparent privacy model of the underlying network. Second, applications compete for transaction throughput. In this whitepaper, the authors present the Canton Network, a smart contract network of networks that overcomes these limitations and enables each application provider to define their application’s privacy, scaling, permissions, and governance while being part of a broader decentralized public permissioned network. 🔹 Canton Coin: A Canton-Network-native payment application Accessibility and connectivity across subnets of the Canton Network will be supported by an infrastructure called the “Global Synchronizer”, decentrally run by a group of “Super Validators”. As part of the launch of the Global Synchronizer, the Super Validators will also launch a payment application called Canton Coin to facilitate the transfer of value, provide incentives, and serve as payment for infrastructure costs. Just as the Canton Network overcomes several of the key limitations holding back other networks from widespread enterprise adoption, Canton Coin is specifically designed to be compatible with an ecosystem used by regulated financial enterprises. This paper presents Canton Coin, its mechanics, and its role in incentivizing all stakeholders of the Canton Network to build a thriving ecosystem. 

30

💡Case study in corporate BS ❓When does a corporation decide *not* to release their products into one of the largest markets in the world? 🤔We can safely assume, that the real reason behind Meta’s decision *not* to release their multimodal models in the EU is *the exact opposite* to what they are claiming. 🇪🇺EU regulatory environment in regards to AI is one of the most transparent ones, especially now, after the long-awaited and publicly discussed AI act was published and will be applied starting August 2nd. ⚠️And Meta (as everybody else) needs to comply with AI Act’s copyright and privacy provisions, but most likely can’t. 🧵Remember last year how we got Threads 6 months later than everybody else? It was for the similar reason(s) - at least a basic protection of *our privacy* was one of them. 🤷‍♂️That’s why a corporation decides *not* to release their products into one of the largest markets in the world. 🤝Let’s *not* fall into the corporate BS PR trap here, shall we?

17

EthiFinance’s new report on cyber risk management in European companies is out! Our report provides an overview of how European companies manage the increasing threat of cyber risks. Main take-aways from our report: 1. On average, cybersecurity management across European companies has steadily and strongly increased over the past three years. 2. Austrian companies receive the highest average cybersecurity score, followed closely by the Dutch, Irish and French firms. Countries with the lowest average scores are Norway and Sweden. 3. European companies are increasingly including cyber risks into their operational risk management. This is the case above all for large firms and to a lesser extent for smaller companies. 4. The ISO 27000 certification is widely used in most European countries, except for France, where only one third of companies were certified in 2023. Real Estate companies show a particularly low certification rate as opposed to organisations from other sectors. 5. While cybersecurity training for employees is key for protection organisations from IT system intrusion, is not a topic that many companies report on and the proportion of companies with fully trained staff is only half of those providing the information. Read the Full Report on our website - Link in 1st comment. Thank you Clara Jiménez-Becerril García, Stievan Vincent, Camille Ferron and Julia Haake for your contribution! #EthiFinance #ESGRatings #Cybersecurity #Cyberattacks #Corporatesustainability #Controversies

42

1 Kommentar

#Apple announced a delay in releasing #iOS18’s flagship #AI features in the European Union, citing concerns over the Digital Markets Act (#DMA) regulations. Affected features include Apple Intelligence, iPhone Mirroring on the Mac, and SharePlay Screen Sharing. Apple says the DMA’s interoperability requirements could compromise user privacy and data security. However, everyone’s favorite fruit company did not provide specific details. The DMA, enacted in 2022, was designed to foster fair competition by curbing anti-competitive practices by major tech companies. It prevents them from suppressing smaller competitors, favoring their own services, and locking customers’ data into their platforms. It also requires transparency regarding data usage. Apple has previously blamed regulations for limiting features available to EU users. Earlier this year, it cited the DMA when it initially planned to remove the ability to add home screen web apps in Europe, a decision it later reversed following user requests. Similarly, Google removed third-party apps and watch faces from European devices, attributing the move to new regulatory requirements. This delay comes as Apple faces increasing scrutiny from EU regulators. In March, the European Commission opened a formal investigation into Apple’s compliance with the DMA, with potential charges expected in the coming weeks. Earlier this year, Apple was fined €1.8 billion ($1.95 billion) for preventing app developers from informing iOS users about cheaper subscription options outside of the Apple ecosystem. I’m wondering how this ends. Are EU regulators blissfully paving a road to a bifurcated world of AI-haves and AI-have-nots, or are they justified in limiting the power of Big Tech? If I was forced to guess, I’d argue that the EU’s stringent regulations will overly restrict its citizens’ ability to adapt in an emerging world of co-intelligence. You know… the road to hell, etc. -s

12

We have published a discussion paper: "A face of one’s own: The role of an online personae in a digital age and the right to control one’s own online personae in the presence of digital hacking" by Eric Clemons, Andrej Savin, Maximilian Schreieck, Stina Teilmann, Jan Trzaskowski & Ravi Waran. https://lnkd.in/dwCxq_Ng Abstract In the post-Covid world, our online personae have become increasingly essential mechanisms for presenting ourselves to the world. Simultaneously, new techniques for hacking online personae have become more widely available, easier to use, and more convincing. This combination, of greater reliance on online personae and easier malicious hacking, has created serious societal problems. Techniques for training users to detect false content have proved ineffective. Unfortunately, legal remedies for dealing with hacked personae have also been inadequate. Consequently, the only remaining alternative is to limit the posting of false content. In this discussion paper, we provide an overview of online personae hacking. As potential remedies, we propose to redesign search engine and social media algorithms allowing platforms to detect and restrict harmful false content and a new fundamental right for the EU Charter that would provide legal justification for platforms to protect online reputations. For those platforms that might choose not to protect online reputations, this new right would require that they do so. #InformationSystems #OnlinePersonae #OnlineIdentity #IdentityHacking #Disinformation #SocialWelfareComputing

7

1 Kommentar

"Open by default: It’s the law". Open source and open data // A new Swiss law will require the federal administration to publish all of its software as open source software. Public authorities will also be required to release their data as open government data. The new law is creating more openness, boosting innovation, and prompting a cultural shift in the federal administration. Plus, more digital public goods means more digital sustainability. https://lnkd.in/dmuGytfk "Switzerland mandates software source code disclosure for public sector: A legal milestone". Switzerland has enacted the "Federal Law on the Use of Electronic Means for the Fulfillment of Governmental Tasks" (EMBAG), establishing a mandatory requirement for open source software within public sector bodies. https://lnkd.in/d2JBGyUF

25

1 Kommentar

The 2024 Cryptographic Products Market Analysis by ENISA explores the evolving world of cryptography, a key element in protecting digital communications and transactions in today’s increasingly connected world. As more of our activities move online, from banking to healthcare to government services, the need for robust security mechanisms is greater than ever. This report examines the landscape of cryptographic products and services, highlighting the role cryptography plays in securing information and transactions. It helps governments, companies, and individuals protect sensitive data through encryption, digital signatures, and secure communications. The analysis is focused on Europe, where regulations like the Cybersecurity Act guide how cryptographic tools should be developed, certified, and used. ENISA, the European Union Agency for Cybersecurity, aimed to assess the demand and supply sides of the cryptographic market. They gathered information through surveys of key players in the ecosystem—businesses using cryptography, companies supplying these tools, regulators, and researchers. The goal was to understand the market’s size, the types of cryptographic products available, and how these products are being used to reduce cyber risks. One of the report’s key insights is that cryptography is not just about protecting data in transit (such as secure online transactions) but also data at rest (like encrypted files stored on a hard drive). Another major point is that cryptographic services, such as key management and digital signature verification, are critical to ensuring that cryptographic systems are trustworthy and effective. In terms of future trends, the report highlights the growing importance of “cryptography-as-a-service,” where companies outsource their encryption needs to third parties, much like cloud computing. It also emphasizes the need for EU-wide open-source cryptographic libraries and the rising interest in advanced cryptographic techniques like fully homomorphic encryption (which allows computations on encrypted data without revealing the data itself). Regulatory compliance, especially with EU standards, is a major driver for companies providing cryptographic tools. This is becoming increasingly important as more industries are required to adopt stricter security measures to protect personal data and critical infrastructure.

7

🔮 the KRITIS Umbrella Act: Curse or blessing? The KRITIS Umbrella Act sets a crucial framework for enhancing the security of critical infrastructures. But what are the challenges, and how can they be overcome? In a recent discussion, Dr. Kai Nuernberger and Prof. Dr. Elmar Padilla from Fraunhofer FKIE shared their insights on the limitations of current legislation and the future of security in Germany. 🔍 Key Takeaways: Economic incentives are essential for promoting security requirements. In order to meet standards, compliance checks, like penetration testing and IT infrastructure hardening are inevitable. The evolving threat landscape requires continuous vigilance: Detailed process documentation and modeling enable well-founded risk assessments and rapid countermeasures. Resilience and redundancy are crucial across technical, organizational, and personnel facets. With the rise of AI the integration in security systems must maintain transparency and control, focusing on human-machine interfaces. To ensure a balance between security measures and privacy, a social discourse on security costs should consider financial aspects and data handling. Thank you Dr. Kai Nürnberger and Prof. Dr. Elmar Padilla for the insightful interview! Read the full article on our website. And if you want to learn more about Perimeter Protection join us at Perimeter Protection 2025! #PerimeterProtection #PerimeterProtection2025

10