Encryption may make terrorist activity more difficult to track, but the trade-offs in improved cybersecurity protection are worth it, according to the former head of Britains MI5 service.

In a recent interview with BBC Radio 4, Jonathan Evans said that recent attacks by militants in the U.K. are not a reason to increase risks by weakening encryption systems. As cybercriminals use more sophisticated techniques to penetrate government and private sector organizations, he argued, its important to remember the variety of threats facing the public and use whatever measures necessary to ward them off. Evans was chief of the British spy operations for six years and spent 33 years with the organization before he left in 2013.

As Business Insider reported, Evans has no illusions about the dangers technology can introduce. He said that the Dark Web, where online activity is more private, has allowed child abuse, leaks of sensitive government information and other criminal activity to take place more easily. Evans also predicted that cybersecurity attacks will continue to come from a variety of places including the Internet of Things (IoT), which he suggested needs greater protection.

To some extent, The Guardian suggested, Evans comments may be in reaction to British Home Secretary Amber Rudd. She has been criticizing encryption in messaging apps as a tool to hide militant activity.

But as Reuters pointed out, Evans is not the only one who is concerned about the impact of weakened encryption on cybersecurity threats. A senior official with the U.K.s intelligence agency GCHQ, for example, suggested that law enforcement officials could work more collaboratively with technology firms who maintain communication systems. That way, officials would be able to intercept communications by malicious actors, rather than reduce the strength of the underlying systems.

In any case, Evans believes that foiling militants will take at least 30 years which means that weakening encryption could be a short-term and premature move.

See the original post:
Ex-MI5 Leader Advocates for Strong Encryption to Stave Off Cybersecurity Attacks - Security Intelligence (blog)

Earlier this month, UK Home Secretary Amber Rudd idiotically insisted that "real people" don't need encrypted messaging apps; but as foolish a statement as that was, there was a kernel of truth to it.

Because real people don't just need encrypted messaging apps that offer end-to-end protection, they also need end-point security -- the kinds of thoughtful design and expedient updating and transparent code that enables them to defend their devices from attackers who gain access to their messages by compromising their phones and computers.

Computer scientist Megan Square writes in The Conversation that "Inventing new ways to protect our digital endpoints without reducing their usefulness is very challenging, but some new technologies just over the horizon might help."

Suppose a criminal organization or bad government, EvilRegime, wants to spy on you and everyone you communicate with. To protect yourself, you've installed an end-to-end encryption tool, such as Signal, for messaging. This makes eavesdropping even with a court's permission that much more difficult for EvilRegime.

But what if EvilRegime tricks you into installing spyware on your device? For example, they could swap out a legitimate upgrade of your favorite game, "ClashBirds," with a compromised version. Or, EvilRegime could use a malware "network investigative technique" as a backdoor into your machine. With control of your endpoint, EvilRegime can read your messages as you type them, even before they are encrypted.

To guard against either type of EvilRegime's trickery, we need to improve our endpoint security game in a few key ways, making sure that:

* EvilRegime isn't masquerading as the company that makes "ClashBirds" when we install our software.

* No one has tampered with our "ClashBirds" app before or after installation.

* The app doesn't have any backdoors or security holes that could be exploited by EvilRegime after we install it.

In addition, it would be ideal if users could control their apps' security themselves, rather than having to rely on app store security provided by yet another vulnerable corporation.

End-to-end encryption isn't enough security for 'real people' [Megan Squire/The Conversation]

(Image: johnnymip, CC-BY)

A group of researchers from Oxford and TU Berlin will present their paper, White-Stingray: Evaluating IMSI Catchers Detection Applications at the Usenix Workshop on Offensive Technologies, demonstrating countermeasures that Stingray vendors could use to beat Stingrays and other cell-site simulators (AKA IMSI catchers).

The $469 LockState RemoteLock 6i is a smart lock that is sold to Airbnb operators through a partnership with the company, allowing Airbnb hosts to generate and expire unique, per-tenant unlock codes.

Ziemowit Pierzycki bought a $1500 used lens from an Amazon seller who turned out to be a scammer with an ingenious trick: the crook researched a recently widowed person across town and sent them a parcel with a couple of baking mats addressed to the deceased or current resident.

The Pry.Me Bottle Opener holds tens of thousands of times its own weight, and you can pick one up now from the Boing Boing Store.This remarkable keychain is considerably smaller than any of your keys, but dont let that fool you: it can easily open any bottle, and could even tow a trailer full of []

Guaranteeing your privacy online goes way beyond checking the Do Not Track option in your browsers settings. To ensure that your internet activity is totally hidden from Internet Service Providers, advertisers, and other prying eyes, take a look at Windscribes VPN protection. It usually costs $7.50 per month, but you can get a 3-year subscription []

This project management bundle will help you get organized and learn how to lead a team to success. You can pay what you want for these five courses when you pick them up from the Boing Boing Store.To help you become an invaluable asset for your company, this bundle includes a curated collection of professional []

Read more from the original source:
Real people don't (just) need encryption / Boing Boing - Boing Boing

A decade ago, encryption was hot enterprise security news. As a measure of its effectiveness as a technology, it has been incorporated as a key feature in many security suites since. But that doesn't mean it has faded in importance. With so many incidents of ransomware, fraud and data breaches in the news, encrypting sensitive data remains a vital necessity. (For more on how encryption works and how to evaluate encryption products, see the eSecurity Planet article Full Disk Encryption Buyer's Guide.)

The encryption products covered here are those that have stood the test of time. In the early years of the millennium, there were scores of encryption tools available. But through consolidation, acquisition and attrition, these are the ones that have emerged in what can now be considered a mature market.

Research and product evaluation are necessities, as there remains great diversity among the various options. Some tools work well in certain environments and poorly in others. Incompatibility issues can arise. And the sheer volume of data in existence means that datasets have to be prioritized as part of enterprise encryption management it may not be feasible, in some cases, to encrypt everything.

"Many vendors' encryption products are using proprietary interfaces that are incompatible with other vendor key managers," said Gartner analyst Brian Lowans. "The wide variety of encryption products and vendors makes the selection process problematic."

Here, then, are ten of the top enterprise encryption vendors and their products, followed by a chart comparing encryption product features. Key features include endpoint encryption (hard drive and removable media, email encryption, file encryption, on premises and in the cloud cloud), centralized management, key management, authentication, and integration with other security tools.

IBM Guardium Data Encryption performs encryption and decryption operations with minimal performance impact. Features include centralized key and policy management, compliance-ready, and granular encryption of files and folders, as well as volumes of data, each protected under its own encryption key.

See our in-depth look at IBM Guardium Data Encryption.

The Check Point Full Disk Encryption Software Blade provides automatic security for all information on endpoint hard drives, including user data, operating system files and temporary and erased files. Multi-factor pre-boot authentication ensures user identity.

See our in-depth look at Check Point Full Disk Encryption Software Blade.

DESlock encryption by ESET has a web-based management console that allows multi-user administration across the network. Additional features include remote device wipe, simplified key sharing, and encryption policy setting and enforcement. Centralized management delivers the ability to control devices anywhere in the world.

See our in-depth look at Eset DESlock.

Dell Encryption Enterprise provides software-based, data-centric encryption that protects all data types on multiple endpoints and operating systems. It integrates with existing security platforms and tools, and enables IT to manage encryption policies for multiple endpoints from a single management console. In addition, the encryption tool allows IT to rapidly enforce encryption policies on system drives or external media without end-user intervention.

See our in-depth look at Dell Encryption Enterprise.

McAfee Complete Data Protection comprises data loss prevention, full-disk encryption, device control, and protection for cloud storage as part of an integrated suite. Centralized policy management is provided by the McAfee ePO management console to provide remote access.

See our in-depth look at McAfee Complete Data Protection.

HPE SecureData provides an end-to-end data-centric approach to enterprise data protection, securing data persistently at rest, in motion and in use. It protects data at the field level, preserves format and context, and provides granular policy controls. It offers security controls for Big Data applications too.

See our in-depth look at HPE SecureData.

GravityZone Full Disk Encryption leverages encryption capabilities provided by Windows (BitLocker) and Mac (FileVault) platforms. Encryption management is done from the same cloud or on-premises console used for endpoint protection.

See our in-depth look at Bitdefender GravityZone.

Sophos encryption products include mobile recovery of BitLocker or FileVault recovery keys, and granting of access to encrypted files based on the security state of the endpoint. Further, they provide full disk encryption, central management for Windows BitLocker and macOS FileVault, service-to-service key recovery, role-based access, and application-based encryption.

See our in-depth look at Sophos SafeGuard.

Symantec's integrated encryption product line includes endpoint, email and file encryption. Endpoint encryption encompasses full disk encryption, cloud data encryption, policy enforcement integration, and encryption of messages from Apple iOS and Android.

See our in-depth look at Symantec Encryption.

Trend Micro Endpoint Encryption provides full disk encryption, folder and file encryption, and removable media encryption. A single management console allows clients to manage encryption along with other Trend Micro security products.

See our in-depth look at Trend Micro Endpoint Encryption.

Below is a chart comparing key features of top enterprise encryption products.

Go here to see the original:
Top 10 Enterprise Encryption Products - eSecurity Planet

(The Conversation is an independent and nonprofit source of news, analysis and commentary from academic experts.)

Megan Squire, Elon University

(THE CONVERSATION) Government officials continue to seek technology companies help fighting terrorism and crime. But the most commonly proposed solution would severely limit regular peoples ability to communicate securely online. And it ignores the fact that governments have other ways to keep an electronic eye on targets of investigations.

In June, government intelligence officials from the Five Eyes Alliance nations held a meeting in Ottawa, Canada, to talk about how to convince tech companies to thwart the encryption of terrorist messaging. In July, Australian Prime Minister Malcolm Turnbull called on technology companies to voluntarily ban all systems that totally encrypt messages in transit from sender to recipient, an approach known as end-to-end encryption. British Home Secretary Amber Rudd made global headlines with her July 31 newspaper opinion piece arguing that real people dont need end-to-end encryption.

These claims completely ignore the one billion real people who already use secure messaging apps like Signal and WhatsApp. And it leaves no room for people who may decide they want that security in the future. Yet some technology companies look like they might be considering removing end-to-end encryption and others installed backdoors for government access years ago. Its been two decades since the Clipper chip was in the news, but now a revival of the government-business-consumer crypto-wars of the 1990s threatens.

One thing is very clear to computer scientists like me: We real people should work on improving security where we are most vulnerable on our own devices.

For the moment at least, we do have good, easy-to-use solutions for secure communication between computers, including end-to-end encryption of our messages. End-to-end encryption means that a message is encrypted by the sender, and decrypted by the recipient, and no third party is able to decrypt the message.

End-to-end is important, but security experts have warned for years that the most vulnerable place for your data is not during transit from place to place, but rather when its stored or displayed at one end or the other on a screen, on a disk, in memory or on some device in the cloud.

As the WikiLeaks release of CIA hacking tools highlighted, if someone can gain control of a device, they can read the messages without needing to decrypt them. And compromising endpoints both smartphones and personal computers is getting easier all the time.

Why are we most vulnerable at the endpoint? Because we dont like to be inconvenienced, and because adding more protection makes our devices harder to use, the same way putting multiple locks on a door makes it harder to get in, for both the homeowner and the burglar. Inventing new ways to protect our digital endpoints without reducing their usefulness is very challenging, but some new technologies just over the horizon might help.

Suppose a criminal organization or bad government, EvilRegime, wants to spy on you and everyone you communicate with. To protect yourself, youve installed an end-to-end encryption tool, such as Signal, for messaging. This makes eavesdropping even with a courts permission that much more difficult for EvilRegime.

But what if EvilRegime tricks you into installing spyware on your device? For example, they could swap out a legitimate upgrade of your favorite game, ClashBirds, with a compromised version. Or, EvilRegime could use a malware network investigative technique as a backdoor into your machine. With control of your endpoint, EvilRegime can read your messages as you type them, even before they are encrypted.

To guard against either type of EvilRegimes trickery, we need to improve our endpoint security game in a few key ways, making sure that:

- EvilRegime isnt masquerading as the company that makes ClashBirds when we install our software.

- No one has tampered with our ClashBirds app before or after installation.

- The app doesnt have any backdoors or security holes that could be exploited by EvilRegime after we install it.

In addition, it would be ideal if users could control their apps security themselves, rather than having to rely on app store security provided by yet another vulnerable corporation.

Computer security experts are excited about the idea that blockchain technology might be able to help us secure our own endpoints. Blockchain, the technology that underpins Bitcoin and other cryptocurrencies, creates a verifiable, unchangeable public record of information.

What this means for endpoint security is that computer scientists might be able to create blockchain-based tools to help us verify the origin of our apps. We could also use blockchains to confirm our data havent been tampered with, and to ensure our privacy. And as long as the source code for these programs is also free for us to inspect as Signal is today the security community will be able to verify that there are no secret backdoors.

As with any new technology, there is an enormous amount of hype and misinformation around blockchain and what it can do. It will take time to sift through all these ideas and develop secure tools that are easy to use. In the meantime, we all need to continue to use end-to-end encryption apps whenever possible. We should also stay vigilant about password hygiene and about what apps we install on our machines. Finally, we must demand that real people always have access to the best security mechanisms available, so we can decide for ourselves how and when to resist surveillance.

This article was originally published on The Conversation. Read the original article here: http://theconversation.com/end-to-end-encryption-isnt-enough-security-for-real-people-82054.

Go here to see the original:
End-to-end encryption isn't enough security for 'real people' - Albany Times Union

A former head of MI5 has argued against undermining end-to-end encryption in messaging apps like WhatsApp, claiming it will damage broader cybersecurity efforts.

Jonathan Evans, who left the secret service in 2013 and is now a crossbencher in the House of Lords, made the comments in an interview with BBC Radio 4s Today program on Friday.

Despite recognizing that end-to-end encryption has helped terrorists hide their communications from the security services, he distanced himself from outspoken critics of the technology, such as home secretary Amber Rudd.

Im not personally one of those who thinks we should weaken encryption because I think there is a parallel issue, which is cybersecurity more broadly, Evans argued.

While understandably there is a very acute concern about counter-terrorism, it is not the only threat that we face. The way in which cyber-space is being used by criminals and by governments is a potential threat to the UKs interests more widely.

He argued that undermining encryption would actually make countless consumers and businesses less secure, and the countrys economy as a whole worse off.

Its very important that we should be seen and be a country in which people can operate securely. Thats important for our commercial interests as well as our security interests, so encryption in that context is very positive, said Evans.

As our vehicles, air transport, our critical infrastructure is resting critically on the internet, we need to be really confident that we have secured that because our economic and daily lives are going to be dependent on the security we can put in to protect us from cyber-attack.

Evans also had something to say about allegations of Russian interference in elections, claiming that he would be surprised if thered been no attempts to sway UK votes in the past.

The former MI5 boss is not the first expert to have argued against the government forcing providers to undermine encryption so that the security services can access suspected terrorists comms.

Former GCHQ boss Robert Hannigan claimed in July that so-called backdoors in such services are a threat to everybody and that its not a good idea to weaken security for everybody in order to tackle a minority.

Read the original here:
Ex-MI5 Boss Evans: Don't Undermine Encryption - Infosecurity Magazine

SEATTLE, Aug. 15, 2017/PRNewswire/ --WatchGuard Technologies, a leader in advanced network security solutions, today announced hardware upgrades to its Firebox M Series to handle the rapid proliferation of encrypted web traffic and offer more flexibility with added copper and fiber ports. With the new M470, M570 and M670 appliances, users can add additional network modules to increase the number of copper or fiber ports available to support the growing use of 10G fiber in midsize enterprise data centers. The new Firebox M Series appliances also enable users to inspect encrypted traffic with industry-leading performance with all security services enabled. According to Miercom, an independent testing lab, the updated Firebox M370 performs full HTTPS inspection 94 percent faster than competing solutions.

Network defenses that don't adequately process and inspect encrypted traffic leave employees, customers and partners vulnerable to cyber attacks. According to a 2016 Ponemon study, 41 percent of attacks in 2016 used encryption to either disguise their entry into the network or hide their connection to a Command and Control server. NSS Labs, Inc. forecasts that as adoption rates continue to climb, 75 percent of web traffic will be encrypted by 2019. A firewall that lacks the processing power necessary to inspect high volumes of encrypted traffic will either need to turn off some security services or compromise throughput in order to manage the burden.

KEY FEATURES:

SUPPORTING QUOTES:

ADDITIONAL RESOURCES:

About WatchGuard Technologies, Inc.WatchGuard Technologies, Inc. is a global leader in network security, providing best-in-class Unified Threat Management, Next Generation Firewall, secure Wi-Fi, and network intelligence products and services to more than 80,000 customers worldwide. The company's mission is to make enterprise-grade security accessible to companies of all types and sizes through simplicity, making WatchGuard an ideal solution for Distributed Enterprises and SMBs. WatchGuard is headquartered in Seattle, Washington, with offices throughout North America, Europe, Asia Pacific, and Latin America. To learn more, visitWatchGuard.com.

For additional information, promotions and updates, follow WatchGuard on Twitter,@WatchGuardonFacebook, or on theLinkedIn Companypage. Also, visit our InfoSec blog, Secplicity, for real-time information about the latest threats and how to cope with them at http://www.secplicity.org.

NSS Labs, Inc. does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings. NSS Labs expressly disclaims any warranties with respect to any research cited herein, including those of merchantability and fitness for a particular purpose.

Media Contacts:

Chris WarfieldWatchGuard Technologies206.876.8380 rel="nofollow">chris.warfield@watchguard.com

Anthony CogswellVoxus PR253.444.5980 rel="nofollow">acogswell@voxuspr.com

View original content with multimedia:http://www.prnewswire.com/news-releases/watchguards-new-fireboxes-chew-through-encrypted-traffic-94-percent-faster-than-competitors-300504295.html

SOURCE WatchGuard Technologies, Inc.

See original here:
WatchGuard's New Fireboxes Chew Through Encrypted Traffic 94 Percent Faster Than Competitors - Markets Insider

(The Conversation is an independent and nonprofit source of news, analysis and commentary from academic experts.)

Megan Squire, Elon University

(THE CONVERSATION) Government officials continue to seek technology companies help fighting terrorism and crime. But the most commonly proposed solution would severely limit regular peoples ability to communicate securely online. And it ignores the fact that governments have other ways to keep an electronic eye on targets of investigations.

In June, government intelligence officials from the Five Eyes Alliance nations held a meeting in Ottawa, Canada, to talk about how to convince tech companies to thwart the encryption of terrorist messaging. In July, Australian Prime Minister Malcolm Turnbull called on technology companies to voluntarily ban all systems that totally encrypt messages in transit from sender to recipient, an approach known as end-to-end encryption. British Home Secretary Amber Rudd made global headlines with her July 31 newspaper opinion piece arguing that real people dont need end-to-end encryption.

These claims completely ignore the one billion real people who already use secure messaging apps like Signal and WhatsApp. And it leaves no room for people who may decide they want that security in the future. Yet some technology companies look like they might be considering removing end-to-end encryption and others installed backdoors for government access years ago. Its been two decades since the Clipper chip was in the news, but now a revival of the government-business-consumer crypto-wars of the 1990s threatens.

One thing is very clear to computer scientists like me: We real people should work on improving security where we are most vulnerable on our own devices.

For the moment at least, we do have good, easy-to-use solutions for secure communication between computers, including end-to-end encryption of our messages. End-to-end encryption means that a message is encrypted by the sender, and decrypted by the recipient, and no third party is able to decrypt the message.

End-to-end is important, but security experts have warned for years that the most vulnerable place for your data is not during transit from place to place, but rather when its stored or displayed at one end or the other on a screen, on a disk, in memory or on some device in the cloud.

As the WikiLeaks release of CIA hacking tools highlighted, if someone can gain control of a device, they can read the messages without needing to decrypt them. And compromising endpoints both smartphones and personal computers is getting easier all the time.

Why are we most vulnerable at the endpoint? Because we dont like to be inconvenienced, and because adding more protection makes our devices harder to use, the same way putting multiple locks on a door makes it harder to get in, for both the homeowner and the burglar. Inventing new ways to protect our digital endpoints without reducing their usefulness is very challenging, but some new technologies just over the horizon might help.

Suppose a criminal organization or bad government, EvilRegime, wants to spy on you and everyone you communicate with. To protect yourself, youve installed an end-to-end encryption tool, such as Signal, for messaging. This makes eavesdropping even with a courts permission that much more difficult for EvilRegime.

But what if EvilRegime tricks you into installing spyware on your device? For example, they could swap out a legitimate upgrade of your favorite game, ClashBirds, with a compromised version. Or, EvilRegime could use a malware network investigative technique as a backdoor into your machine. With control of your endpoint, EvilRegime can read your messages as you type them, even before they are encrypted.

To guard against either type of EvilRegimes trickery, we need to improve our endpoint security game in a few key ways, making sure that:

- EvilRegime isnt masquerading as the company that makes ClashBirds when we install our software.

- No one has tampered with our ClashBirds app before or after installation.

- The app doesnt have any backdoors or security holes that could be exploited by EvilRegime after we install it.

In addition, it would be ideal if users could control their apps security themselves, rather than having to rely on app store security provided by yet another vulnerable corporation.

Computer security experts are excited about the idea that blockchain technology might be able to help us secure our own endpoints. Blockchain, the technology that underpins Bitcoin and other cryptocurrencies, creates a verifiable, unchangeable public record of information.

What this means for endpoint security is that computer scientists might be able to create blockchain-based tools to help us verify the origin of our apps. We could also use blockchains to confirm our data havent been tampered with, and to ensure our privacy. And as long as the source code for these programs is also free for us to inspect as Signal is today the security community will be able to verify that there are no secret backdoors.

As with any new technology, there is an enormous amount of hype and misinformation around blockchain and what it can do. It will take time to sift through all these ideas and develop secure tools that are easy to use. In the meantime, we all need to continue to use end-to-end encryption apps whenever possible. We should also stay vigilant about password hygiene and about what apps we install on our machines. Finally, we must demand that real people always have access to the best security mechanisms available, so we can decide for ourselves how and when to resist surveillance.

This article was originally published on The Conversation. Read the original article here: http://theconversation.com/end-to-end-encryption-isnt-enough-security-for-real-people-82054.

Continued here:
End-to-end encryption isn't enough security for 'real people' - San Francisco Chronicle

IBM India claims the IBM Z (z14) is so secured that it is hacker-proof.

The days of Anonymous hacker could be numbered as IBM India releases an encryption technology which claims to be hacker-proof. Is this really the solution to stop all the hacking and stealing of online data?

Recently, the news of leaked Game of Thrones unaired episodes made the headlines. A group hackers have demanded ransom in form of Bitcoins from HBO in exchange for not leaking more episodes, per Business Insider. Included in the sensitive information the hackers got allegedly hold of are emails of executives, scripts and unaired episodes. The group revealed they get as much as $15 million a year for blackmailing.

However, a team of tech specialists in India is planning to put a stop to this blackmailing scheme. According to The Hindu, the IBM Z (z14) can encrypt customer data from banks, customers, and healthcare industry. It can process 12 billion encrypted transactions per day.

IBM Indias accomplishment will save a lot of companies money in the future. (Source)

One of the reasons why hacking has been successful in the past is because data have not been encrypted. Since 2013, only four percent of the estimated nine billion hacked data were encrypted. IBM executive Gururaj S. Rao naturally takes pride in their accomplishment. Other than IBM, no other vendor has been able to do it, he added.

SEE ALSO Atari announces the release of a new console called the Ataribox

Once the z14 mainframe detected intrusion or an attack, it will launch a defensive stance and shut itself down automatically, as reported by India Times. While this feat is a big step in the right direction, it did not surprise the tech community.

In an interview published by The Hindu Business Line, IBM India Private Limited Chairman Vanitha Narayanan claims, In India, we have created a pool of innovations that can be applied both globally and in the domestic market.

The rogue community of online hackers is becoming more brazen as their tech know-how becomes at-par or even ahead of the technologies of some big companies. The only way to stop them is to get ahead. And as always, prevention is better than cure. It is better for data to be encrypted than to be stolen.

Go here to read the rest:
Will IBM India's impenetrable encryption tech stop Anonymous hacker? - Born2Invest

Do you know that despite the end-to-end encryption provided by popular messaging platforms like Facebook Messenger, WhatsApp, and Viber, your sensitive information is vulnerable to hacking?

A research report has highlighted the importance of what is called an 'authentication ceremony' to help mitigate the risk.

Researchers from Brigham Young University (BYU) at Utah in the US found that most users of popular messaging apps like Facebook Messenger, WhatsApp, and Viber are leaving themselves exposed to fraud or hacking because they are unaware of important security options like an 'authentication ceremony'.

The 'authentication ceremony' is a security practice to ensure the members involved in a communication are authentic. It is done by identifying the message recipient before sending out any sensitive or confidential information.

But because most users are unaware of the 'ceremony' and its importance, "it is possible that a malicious third party or man-in-the-middle attacker can eavesdrop on their conversations", said Elham Vaziripour, Computer Science student at BYU who led the study.

The researchers conducted a two-phase experiment in which they prompted participants to share a credit card number with another participant. Participants were warned about potential threats and encouraged to make sure their messages were confidential.

Only 14 percent of users in the first phase managed to successfully authenticate their recipient. Others opted for ad-hoc security measures like asking their partners for details about a shared experience.

In the second phase, after researchers emphasised the importance of 'authentication ceremonies', 79 percent of users were able to successfully authenticate the other party. However, the participants averaged 11 minutes to authenticate their partners.

"Once we told people about the authentication ceremonies, most people could do it. But it was not simple, people were frustrated and it took them too long," noted Daniel Zappala, Professor, Computer Science, BYU.

Most people don't invest the time and effort to understand and use these security measures because they don't experience significant security problems. But there's always a risk in online communications.

The researchers are now working to develop a mechanism that makes the 'authentication ceremony' quick and automatic.

"If we can perform the authentication ceremony behind the scenes for users automatically or effortlessly, we can address these problems without necessitating user education," said Vaziripour.

More here:
Despite end to end encryption, apps like WhatsApp, Messenger are still vulnerable to hacking: Study - Firstpost

While Apple may have given in to demands from the Chinese government to remove VPN apps from its app store there, it does generally take a strong stand on encryption. It uses end-to-end encryption for both iMessage and FaceTime, and resisted pressure from the FBI to create aweakened version of iOS, describing it as too dangerous.

Weve written a number of pieces explaining why we support Apples stance, both before and after the San Bernardino case.

The British government wants to ban end-to-end encryption altogether, arguing that it hampers the work of the security services. Support for Apples position and opposition to that of the British Home Secretary has now come from an unlikely source

In a BBC Radio 4 interview cited by Gizmodo,the former head of the Security Service (more commonly known as MI5)has said that while strong encryption does make their job harder, it is the lesser evil.Jonathan Evans said:

Im not personally one of those who believes we should weaken encryption, because I think there is a parallel issue which is cybersecurity more broadly. Whilst, understandably, there is a very acute concern about counter-terrorism, its not the only national security threat that we face. And I think the way cyberspace is being used by criminals, and by governments, is a potential threat to the UKs interests more widely and its very important that we should be seen and be a country where people can operate securely. And thats very important for our commercial interests, as well as our national security interests, so encryption is very positive.

MI5 is responsible fordomestic counter-intelligence and security. Evans wasDirector-General of MI5 until 2013.

Evans also spoke about the risk of unsecured Internet of Things devices.

As our vehicles, air transport, our critical infrastructure is resting critically on the internet, we need to be really confident that we have secured that because our economic and daily lives are going to be dependent on the security we can put in to protect us from cyber-attack.

Apple HomeKit certification requires extremely strong encryption for devices to be approved.

VPN apps encrypt traffic between a user and the server, ensuring that not even your ISP can see which sites you are visiting or what you are doing there. It is, however, important to choose one that doesnt keep logs to ensure that it is not doing its own snooping.

Check out 9to5Mac on YouTube for more Apple news:

See the article here:
Former UK security service head says weakening encryption would be too dangerous - 9to5Mac