Hélder Gomes

This article addresses the adoption and use of Hypertext Transfer Protocol Secure (HTTPS) in the entry pages of the official websites of all (308) Portuguese municipalities. This is relevant because such websites are typically used to provide transactional services to citizens, and citizens need to trust that websites are authentic and that confidentiality and integrity of the information exchanged is assured in the communication process. Automated and, whenever needed, manual analyses were used to investigate the entry pages. Specifically, we checked for the existence of an HTTPS site; the correctness of website certificates and their certification chain; coherence between contents of the HTTP and HTTPS versions of websites; redirection from the HTTP version of a website to its HTTPS version; the existence of resources fetched using HTTP in HTTPS versions of websites; and exploitation of HSTS. A Quality Indicator was then defined and a classification of the municipalities into quality groups was produced. Possible determinants for the results obtained by the municipalities were also investigated. The general conclusion is that there is still much to be done to assure that citizens can communicate securely with the websites of all Portuguese municipalities, since only 3.6% of the municipalities were considered good, while 46.1% do not guarantee the minimum conditions. We argue that these results are associated with the fact that most Portuguese municipalities do not have the critical technical and managerial mass to correctly implement and maintain their websites. To mitigate this limitation, we propose the dissemination of technical instructions on how to correctly configure and deploy municipal HTTPS websites and the creation of shared services between the smaller municipalities.

Information about the paper titled "EXPLORING THE USE OF PRODUCT PROTOTYPES TO FOSTER X BASED LEARNING IN HIGHER EDUCATION" at IATED Digital Library

Assuring security and privacy is one of the key issues affecting the Internet of Things (IoT), mostly due to its distributed nature. Therefore, for the IoT to thrive, this problem needs to be tackled and solved. This paper describes a security-oriented architecture for managing IoT deployments. Our main goal was to deal with a fine-grained control in the access to IoT data and devices, to prevent devices from being manipulated by attackers and to avoid information leaking from IoT devices to unauthorized recipients. The access control is split: the management of authentication and access control policies is centered on special components (Authentication, Authorization, and Accounting Controllers), which can be distributed or centralized, and the actual enforcement of access control decisions happens on the entities that stay in the path to the IoT devices (Gateways and Device Drivers). The authentication in the entire system uses asymmetric cryptography and pre-distributed unique identifiers derived from public keys; no Public Key Infrastructure (PKI) is used. A Kerberos-like ticket-based approach is used to establish secure sessions.

In a world where people must subject themselves to high scrutiny in every process they initiate, and in a world where the digital environment grows incessantly, we anticipate more online services asking for personal attributes and their need to trust in such attributes. For tackling such need, we describe a proposal for a secure, decentralized and shared repository of certified personal attributes. Individuals benefit because they have full control over the disclosure of their set of certified attributes (e.g. to assert their identities to service providers). The certifying entities benefit from a blockchain-based, resilient and decentralized infrastructure, avoiding the higher costs of an always-on, centralized infrastructure, while retaining the power to issue and revoke certified attributes. Finally service providers benefit from the correctness and freshness of the certified attributes that individuals disclosed to them.

Information about the paper titled "PROPOSAL OF GUIDELINES TO IMPLEMENT AND EVALUATE INTERNSHIPS IN HIGHER EDUCATION" at IATED Digital Library