Title: Theory / Unimportant / CS / Algo / Crypto / Click here to kill everyone

Name: Internet of things
Definition: the network of physical objects that contain embedded technology to communicate and sense or interact with their internal states or the external environment.
Page: 16,9
Chapter: Intro
Abbreviation: IoT

Name: Internet+
Definition: Internet + Things + us
Page: 24,4
Chapter: Intro

Question: Why is prosecution harder for internet crime than for physical one
Answer: Attribution is difficult
Page: 62,6
Chapter: I1
Section: THE COMPLEXITY OF COMPUTERIZED SYSTEMS MEANS ATTACK IS EASIER THAN DEFENSE
Answer2: International nature which render law application more complex

Question: Why is attack simpler than defense for internet security
Answer: Attacker as first move advantage
Page: 62,6
Chapter: I1
Section: THE COMPLEXITY OF COMPUTERIZED SYSTEMS MEANS ATTACK IS EASIER THAN DEFENSE
Answer2: Attacker doesn't have to respect law or moral
Answer3: Attacker is interested, we don't think of defense until a problem occurs

Question: Example of insecure interaction to two secure systems
Answer: In 2012, someone compromised reporter Mat Honan’s Amazon account, which allowed them to gain access to his Apple account, which gave them access to his Gmail account, which allowed them to take over his Twitter account.
Page: 64
Chapter: I1
Section: THE COMPLEXITY OF COMPUTERIZED SYSTEMS MEANS ATTACK IS EASIER THAN DEFENSE
Answer2: gmail allow to add dots (.) anywhere in your address. Every body else consider adress with and without dots as different.
If you have netflix account firstname.lastname@gmail, someone created firstnamelastname@gmail and ensured netflix sent message stating you need to revalidate your account/credit card number
Answer3: Gyroscope may be so sensible that it can eavesddrop conversation

Question: Why is internet attack different than physical attack
Answer: You have to protect yourself from everything. You don't have to protect your door from the best burglar, since they may have more interesting targets and don't come to your place
Page: 67,4
Chapter: I1
Section: COMPUTERS FAIL DIFFERENTLY
Answer2: Class break: everyone fails simultaneously. While every thief does not attack simultaneously
Answer3: You can attack computer without skills. You only need the software. Thus more people can do it.
Answer4: Internet attack is harder to prosecute
Answer5: Pickpocketing is as difficult as before. Creating fake cellphone tower or breaking a particular cryptography gets easier
Answer6: Tornadoes does not adapt to your counter-measure, while hackers do.

Name: Class break
Definition: security vulnerability that breaks not just one system, but an entire class of systems.
Page: 67,4
Chapter: I1
Section: COMPUTERS FAIL DIFFERENTLY
Context: Security
Example: All computer with the same unsecure OS may be attacked

Name: Responsible disclosure
Definition: Warning a software producer that a problem exists and that you'll make it public at a certain date whether or not they corrected it
Page: 80
Chapter: I2

Name: Bug bounty
Definition: Amount of money given by a developper to people find a bug in its software
Page: 80
Chapter: I2

Name: Project Zero
Definition: Google's project to find bug in most commonly used softwares
Page: 80
Chapter: I2

Name: Zero-day vulnerabilitie
Definition: A vulnerability which is discovered when an attack is made using it
Page: 80
Chapter: I2

Question: Why are patch complicated
Answer: They may break things
Page: 80
Chapter: I2
Answer2: On critical system such as plane, the whole plane must be certified again for each patch
Answer3: Each model of cars may have to be patched differently. It's virtually impossible for a company to keep track of each product during years

Question: Ways to authenticate someone
Answer: Something you know
Page: 105
Chapter: 3
Section: AUTHENTICATION IS GETTING HARDER, AND CREDENTIAL STEALING IS GETTING EASIER
Answer2: Something you are
Answer3: Something you have

Question: According to NSA's public speech, what's the principal way to break into a network
Answer: Abusing authentification process: having identifier of someone else
Page: 105
Chapter: 3
Section: AUTHENTICATION IS GETTING HARDER, AND CREDENTIAL STEALING IS GETTING EASIER

Name: differential authentication
Definition: Using different authentification method depending on the context
Page: 107
Chapter: 3
Section: AUTHENTICATION IS GETTING HARDER, AND CREDENTIAL STEALING IS GETTING EASIER
Example: Whether you are reading your bank account or doing a transfer
Example2: Whether you are logging from a new computer

Name: Continuous authentication
Definition: Detecting when the current user is not the one who logged in anymore but someone who use their session
Page: 109
Chapter: 3
Section: AUTHENTICATION IS GETTING HARDER, AND CREDENTIAL STEALING IS GETTING EASIER

Name: Attribution
Definition: The identification of someone who does not want to be identified
Page: 121
Chapter: 3
Section: ATTRIBUTION IS GETTING BOTH HARDER AND EASIER, DEPENDING

Name: Authentication
Definition: Ensuring that someone is an individual they state they are
Page: 121
Chapter: 3
Section: ATTRIBUTION IS GETTING BOTH HARDER AND EASIER, DEPENDING

Question: Absence of attribution of an attack means
Answer: absolutly nothing
Page: 121
Chapter: 3
Section: ATTRIBUTION IS GETTING BOTH HARDER AND EASIER, DEPENDING

Question: Why would a government not attribute a crime when they know who comitted it.
Answer: If you attribute but don't retaliate, you appear weak
Page: 121
Chapter: 3
Section: ATTRIBUTION IS GETTING BOTH HARDER AND EASIER, DEPENDING
Answer2: If you attribute and retaliate, you first have to prove the attribution, it would need to state how they attributed it. Which would require to explain how they attribute, which is a precious secret.

Question: What can be done by someone having acces to data
Answer: steal a copy
Answer2: delete
Answer3: modify

Question: How to attack machine learning algorithm
Answer: Feed it false training data
Answer2: Feed data specially processed for it, which seems innocuous to human

Question: Let a program give advice about things to do. Why can't we just protect ourself by asking a human to check the validate or reject the output
Answer: The human may trust the machine more than it should
Answer2: Rejecting a correct output is an action, so the human may get sued. They'll avoid to do this.

Name: Autonomous weapon
Definition: A weapon that selects a target and fires without intervention from a human operator

Name: Supply chain attack
Definition: Attacks that target the production, distribution, and maintenance of computers, software, networking equipment, and so on—everything that makes up the Internet+, which means everything.
Chapter: 5
Section: OUR SUPPLY CHAINS ARE INCREASINGLY VULNERABLE

Question: Proposal make internet+ more secure
Answer: State explicitly which kind of attack are considered, and which kind of attack may succeed
Answer2: Warn when it stops to be supported in advanced
Answer3: Allow patch
Answer4: Enable default secure (i.e. no default password, 2. F.A.)
Answer5: Test before shipping
support security research
Answer6: Use standard protocol and implementation. Encrypt data
Answer7: Avoid known vulnabi
Answer8: Preserve offline functionnality

Question: Proposal make data more secure
Answer: Store and transfer data securly
Answer2: Collect minimum data
Answer3: be transparant in data storage
Answer4: Anonymize data when possible
Answer5: Use data as little as possible
Answer6: Allow user to inspect and correct data
Answer7: delete when no more required

Name: Personnaly identifiable information
Definition: Data allowing to identify an individual
Abbreviation: PII

Question: If you can't explain the decision of an algorithm, what you require instead
Answer: Studying algorithm output as we study human's biais
Answer2: Use public algorithm so that the user affected by data analysis may test that the correct answer was given to them

Question: Why is it harder to protect USA internet for the NSA than protecting its phone lines
Answer: Because protecting software used in USA means adding security to software use in the entire world, thus protecting ennemies too

Name: Nobody but us
Definition: A vulnerability that noone can use but «us»
Abbreviation: NOBUS

Question: What's the problem if the US choose to disclose it's vulerability it knows
Answer: It won't be followed by other countries, and thus will be the only one without weapon