Subject: [perpass] GHCQ Webcam Video Surveillance

From: Suhas Nandakumar <[email-masked]>
Date: Fri, 28 Feb 2014 06:17:11 -0800

http://www.theguardian.com/world/2014/feb/27/gchq-nsa-webcam-images-internet-yahoo

---

From: Robin Wilton <[email-masked]>
Date: Fri, 28 Feb 2014 14:32:52 +0000

And once again, the intelligence services manage to make "tinfoil hat" privacy advocates look entirely rational, rather than paranoid. 

In fact, I'm struggling to think, offhand, of any privacy nut dire warning that has not proved to be justified, or even slightly optimistic. 

Webcam stickers, anyone?

(incidentally, if you're using a Mac and you cover the webcam lens, you'll need to turn off the automatic screen-dimming function. System Preferences -> Displays )

R

Robin Wilton
Technical Outreach Director - Identity and Privacy
Internet Society

email: [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity

On 28 Feb 2014, at 14:17, Suhas Nandakumar wrote:

> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass

---

From: Suhas Nandakumar <[email-masked]>
Date: Fri, 28 Feb 2014 06:41:37 -0800

Doesn't hurt annonymizing ourselves :)

On Fri, Feb 28, 2014 at 6:32 AM, Robin Wilton <[email-masked]> wrote:

> And once again, the intelligence services manage to make "tinfoil hat"
> privacy advocates look entirely rational, rather than paranoid.
>
> In fact, I'm struggling to think, offhand, of any privacy nut dire warning
> that has not proved to be justified, or even slightly optimistic.
>
> Webcam stickers, anyone?
>
> (incidentally, if you're using a Mac and you cover the webcam lens, you'll
> need to turn off the automatic screen-dimming function. System Preferences
> -> Displays )
>
> R
>
> Robin Wilton

---

From: Wendy Seltzer <[email-masked]>
Date: Fri, 28 Feb 2014 09:56:19 -0500

> In fact, I'm struggling to think, offhand, of any privacy nut dire warning that has not proved to be justified, or even slightly optimistic. 

I've got a few with Tor onions on them :)

--Wendy

-- 
Wendy Seltzer -- [email-masked] +1.617.715.4883 (office)
Policy Counsel and Domain Lead, World Wide Web Consortium (W3C)
http://wendy.seltzer.org/        +1.617.863.0613 (mobile)

---

From: Jacob Appelbaum <[email-masked]>
Date: Fri, 28 Feb 2014 14:58:59 +0000

> that has not proved to be justified, or even slightly optimistic.

Don't worry, it will get worse. :-/

All the best,
Jacob

---

From: Mathieu Cunche <[email-masked]>
Date: Fri, 28 Feb 2014 16:30:00 +0100

Does anyone have an idea why Yahoo video chat and not another ?

Mathieu

---

From: Jacob Appelbaum <[email-masked]>
Date: Fri, 28 Feb 2014 15:34:22 +0000

> Does anyone have an idea why Yahoo video chat and not another ?

I don't believe it is reasonable to conclude that they're (read:
GCHQ/NSA) not doing other kinds of video chat. If I was a betting man,
I'd bet there are other stories in the works for other blatantly
insecure protocols (read: nearly all of them).

All the best,
Jacob

---

From: Mathieu Cunche <[email-masked]>
Date: Fri, 28 Feb 2014 16:37:01 +0100

> insecure protocols (read: nearly all of them).
I agree. I guess we'll have to wait for another Snowden document to 
know for sure ;).

Regards,
Mathieu

---

From: Kartoss <[email-masked]>
Date: Fri, 28 Feb 2014 15:48:26 +0100

Quoting from the Article:

"GCHQ did not make any specific attempts to prevent the collection or 
storage of explicit images, the documents suggest, *but did eventually 
compromise by excluding images in which software had not detected any 
faces* from search results -- *a bid to prevent many of the lewd shots 
being seen by analysts*."

So for Communication without (GCHQ-)Surveillance, all we have to do is 
put the Camera under our Desk and have no-pants meetings ?

Am 28.02.2014 15:32, schrieb Robin Wilton:
> In fact, I'm struggling to think, offhand, of any privacy nut dire 
> warning that has not proved to be justified, or even slightly optimistic.
>
> Webcam stickers, anyone?
>
>
>> [email-masked] <mailto:[email-masked]>

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Fri, 28 Feb 2014 14:54:50 +0000

> (incidentally, if you're using a Mac and you cover the webcam lens, you'll need to turn off the automatic screen-dimming function. System Preferences -> Displays )

Not really -- the light sensor on many Macbooks, at least, is to the left of the camera lens.  This just came up on Twitter; here's my set-up at https://twitter.com/SteveBellovin/status/439412122410184704.  (I don't want to clog the list with a large picture attachment.)  Yes, it works, and if you find me here I'll show you what happens if I move the slide to the left a bit more.

		--Steve Bellovin, https://www.cs.columbia.edu/~smb

---

From: Robin Wilton <[email-masked]>
Date: Fri, 28 Feb 2014 16:52:16 +0000

Apologies - I should have been more specific... my Macbook Air doesn't have a separate light sensor... it's in the same orifice as the camera lens.

R

Robin Wilton

email: [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity

---

From: Robin Wilton <[email-masked]>
Date: Fri, 28 Feb 2014 17:17:36 +0000

With apologies for one further mail on this topic... Steve is right, and I stand corrected.

As far as I can determine, the light sensor on a MacBook Air (well, mine, at least) is about 1-4mm to the left of the webcam aperture in the screen surround. 

This means that you can block the webcam without interfering with the automatic screen brightness function - but you need to position your webcam-blocker as carefully as in Steve's picture, and from the right of the lens aperture.

Serves me right for (a) making assumptions and (b) using my left thumb to occlude the lens. If I had used my right thumb, I wouldn't have made the same assumption (!)

Thanks Steve!

Robin

---

From: Warren Kumari <[email-masked]>
Date: Fri, 28 Feb 2014 17:26:04 +0000

On Fri, Feb 28, 2014 at 2:48 PM, Kartoss <[email-masked]> wrote:
> storage of explicit images, the documents suggest, but did eventually
> compromise by excluding images in which software had not detected any faces
> from search results - a bid to prevent many of the lewd shots being seen by
> analysts."
>
> So for Communication without (GCHQ-)Surveillance, all we have to do is put
> the Camera under our Desk and have no-pants meetings ?

My favorite quote from all this:
"Unfortunately ... it would appear that a surprising number of people
use webcam conversations to show intimate parts of their body to the
other person," one document states, according to the Guardian.

I love the understatedness...

W
W

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Fri, 28 Feb 2014 17:25:33 +0000

I made the same assumption until others corrected me.

On Feb 28, 2014, at 5:17 PM, Robin Wilton <[email-masked]> wrote:

> Strint-attendees mailing list
> [email-masked]
> http://lists.i1b.org/listinfo.cgi/strint-attendees-i1b.org

---

From: Peter Lawler <[email-masked]>
Date: Sat, 01 Mar 2014 09:20:38 +1100

> insecure protocols (read: nearly all of them).
I'd suggest it is because Yahoo's protocol was widely reverse engineered 
on a number of platforms with 3rd party clients. Folks would use these 
other clients so as to not have the ads pushed at them by Yahoo and 
could do other whack stuff. Such other stuff would be to do to online 
contacts what GCHQ were doing (ie, monitoring all Y!M comms). So I'm 
actually rather surprised anyone's surprised that Gov't bodies were 
doing what the 13y/o kids were up to...

I'd also suggest that it may have had something to do with the hellhole 
that was the Yahoo Rooms. If you never experienced that, (a) 
congratulations (b) imagine the worst parts of of IRC mixed with 4chan 
and make it several times worse and you're approaching the level of 
shudder (see above about monitoring comms and mix it with taking over comms)

Add to that, for many many years (no idea about now) it seemed Y! did 
not care one iota about the exploits the 3rd party hackers had found in 
their servers and protocols.

Cheers,

Pete.
(Apols for caffiene fulled rambling)

---

From: Mark Atwood <[email-masked]>
Date: Fri, 28 Feb 2014 14:59:00 -0800

The N-way video chat system running at meet.jit.si uses DTLS and SRTP.
 And it's all open source using open standards, so you can run your
own bridge as well, if you don't want to use theirs.

For keeping the peeping tom spooks out, I don't trust Skype or Google
Hangouts or Apple Facetime at all now, and on the corporate VTC case,
I am deeply suspicious of Microsoft Lync and all the hardware VTC
(Cisco, Polycom, etc).