Key Takeaways

With mobile phones and the internet becoming what some would call a daily necessity, it's not uncommon for websites and business services to receive billions of visits on a weekly basis - and thats not all.

Sales days like Black Friday in North America or Double Eleven (aka Singles Day) in Asia are excellent examples of traditional retail enterprises adapting to the digital world. These enterprises must now contend with new needs and challenges, to successfully achieve their business goals.

They all have to answer the same question: we need to drive our digital sales on this Black Friday, but when we succeed and this incredible traffic reaches the database cluster, will our databases be able to handle it?

Different business cases have multiple options when it comes to database solutions. Such options range from NoSQL products (e.g., MongoDB, Cassandra, Amazon DynamoDB, etc.), to NewSQL products (like Amazon Aurora or CockroachDB, which are popular these days).

Besides these great solutions, some industries will also consider transparent sharding on top of existing database clusters.

According to the database trend ranking DB-Engines, although many new database offerings are hitting the market, the traditional relational database still retains a considerable share of the pie.

Considering the new challenges databases are facing, is there an efficient and cost-effective way to leverage these types of databases and enhance them through some new practical ideas? Database transparent sharding is one of the best answers to this question.

Database popularity ranking on DB-Engines

One of the best techniques for this is to split the data into separate rows and columns. This splitting of large database tables into multiple small tables are known as shards. The original table is divided into either vertical shards or horizontal shards. Terminologies used to label these tables can be subjective to VS1 for vertical shards and HS1 for flat shards. The number represents the first table or the first schema. Then 2 and 3, and so on. These subsets of data are referred to as the table's original schema.

So what is the difference between sharding and partitioning? Both sharding and partitioning include breaking large data sets into smaller ones. But a key difference is that sharding implies that the breakdown of data is spread across multiple computers, either as horizontal or vertical partitioning. On the other hand, partitioning is when the database is broken down into different subsets but held within a single database, sometimes referred to as the database instance.

Since for sharding data is divided into numerous pieces stored across different machines, this approach offers the following advantages:

However, sharding architecture is not perfect and has some drawbacks:

Sharding: One to multiple shards

Like for most things in technology, let alone in life, there is no silver bullet. You should perform a thorough analysis to have a complete picture of your needs and scenarios, and only then move on to choose the best possible solution.

Generally, the advantages of sharding architecture prevail, and many excellent products that play an essential role in the database industry are based on this architecture. Citus or Vitess have their respective definitions, but they're based on database-sharding architecture in nature.

Citus manages a coordinator (proxy) cluster to distribute the PostgreSQL cluster, while Vitess shards MySQL alike. Both of them concentrate on providing a low-cost and efficient distributed solution of traditional but prevailing relational databases. Actually, sharding architecture is fundamental for most NoSQL and NewSQL products as well, but that would be another topic focusing on sharding with NoSQL and NewSQL. This article focuses on sharding with relational databases since there are some innovations brought to the classic sharding technique.

The occurrence of sharding is the result of the distributed needs of databases. These days an increasing number of new issues involve databases, such as privacy protection, SQL audit, tenant, distributed authentication, etc.

These represent real-world new demands for databases. How to deal with these issues is an inevitable question for all database products, no matter the type of database. Could these issues be addressed with a database sharding solution? It looks like sharding needs to evolve to meet these challenges, which is our topic i.e., what's the next evolution for database sharding architecture.

My answer is Database Plus, the guiding concept for creating a distributed database system for more than sharding, positioned above DBMS.

It was conceived with the aim to build a standardized layer and ecosystem above existing and fragmented databases, as well as provide a unified and standardized database usage specification. This provides for upper-level applications, and the challenges faced by businesses due to underlying databases fragmentation get minimized as much as possible. The result is an environment where the applications only need to speak with a standardized service, instead of different ones for each database.

This idea was initiated by the PMC (Project Management Committee) of Apache ShardingSphere, and it took about a year to release 5.0.0 GA and implement this concept in its architecture.

In the 3.x and 4.x release stages, we defined Apache ShardingSphere as a distributed database middleware (sharding architecture) to only solve the sharding issue. However, new challenges for databases and the community pushed this project to evolve and include more features such as data encryption, shadow database, distributed authentication, distributed governance, etc. All of these changes go beyond the traditional sharding range, as sharding is just one part of Database Plus.

The evolution of ShardingSphere's Database plus architecture

Apache ShardingSphere's example supports my thesis that a simple and classic sharding architecture can do more than sharding. The kernel mechanism directs all traffic through a proxy or driver, and then if it could parse SQLs and know the location of every database, the following jobs will be easy to perform:

So what do these jobs mean to the end users? Based on these kernel jobs, the products of Apache ShardingSphere are qualified to ease users database pain points.

Originally sharding, data encryption, shadow database, distributed authentication, distributed governance, etc. were all based on the necessary steps above. The architecture proposed by the Database Plus concept of Apache ShardingSphere brings these enhancing features with flexibility in mind.

All functions are just plugins that can be added or removed at any given time in this distributed system. Some people may just want to shard a database, while others may prefer to do data encryption. Users needs never stop evolving and are diverse, and for this reason Database Plus can be fully customizable and continuously receive new plugins (features) allowing it to meet users demands one by one specifically and flexibly.

ShardingSpheres architecture includes the following four layers as shown in Figure 1 below.

ShardingSphere's Four Layer Architecture

Foundation Layer:Provides a variety of access terminals such as driver or proxy to flexibly meet the needs of users in different scenarios.

Storage Layer:All the functions are supported in these databases with the possibility to include more.

Function Layer:Provides a variety of functional plug-ins that meet users' needs, allowing a high degree of flexibility in plug-in choice and combination.

Solution Layer:End users are provided with industry-oriented (e.g. financial, e-commerce and entertainment industries) and specific scenario-oriented standard product solutions (e.g. distributed database solution, encrypted database solution or database gateway).

ShardingSphere JDBC and ShardingSphere Proxy have been polished and tested for five years and are now available in production. Many community users provided relevant production cases, and production feasibility has been verified.

With the shared core functions among different ShardingSphere clients, users can also choose hybrid deployment to achieve balance between query performance and management convenience (shown in Figure 2 below).

ShardingSphere JDBC and Proxy Hybrid Development

The Apache ShardingSphere community proposed a SQL dialect, i.e., DistSQL (distributed SQL), to operate and manage all functions of ShardingSphere.

SQL is the standard and conventional interaction method with databases. However there are many new features in this distributed database system which required us to think of a SQL dialect to configure and use these new functions.

DistSQL allows users to use SQL-like commands to create, modify or delete a distributed database and table, or to encrypt or decrypt data. All of the above mentioned functions could be performed with distributed SQL. Some DistSQL snippets are presented below.

DistSQL in Action

Distributed database system governance capability is necessary to alleviate the suffering of distributed cluster management. In the ShardingSphere ecosystem where computing and storage are separated, features are greatly enhanced in the new version including:

Additionally, the distributed lock new feature is scheduled to be released soon.

ShardingSpheres Distributed Governance

Although many advantages have been listed above, there are some constraints or limitations that are worth mentioning. You should give careful consideration to the following items before adopting ShardingSphere::

This section will introduce two practical examples to demonstrate how create a distributed database and create an encrypted table with DistSQL - the SQL dialect connecting all the elements of the ShardingSphere ecosystem.

This part will guide you through an example of how to leverage DistSQL to create a distributed database. Users and applications visit Proxy to achieve a logic table (distributed table) which has been sharded among different servers. There is no need to take care of these shards, instead make your applications operate and manage this logical table.

Prerequisites:

Process:

Login Proxy CLI by executing SQLcommand:

mysql -h127.0.0.1 -uroot -P3307 -proot

Register two MySQL databases using DistSQL

ADD RESOURCE ds_0( HOST=127.0.0.1, PORT=3306, DB=demo_ds_0, USER=root, PASSWORD=root );

ADD RESOURCE ds_1 ( HOST=127.0.0.1, PORT=3306, DB=demo_ds_1, USER=root, PASSWORD=root );

Create sharding rule by distSQL

CREATE SHARDING TABLE RULE t_order( RESOURCES(ds_0,ds_1), SHARDING_COLUMN=order_id, TYPE(NAME=hash_mod,PROPERTIES("sharding-count"=4)), GENERATED_KEY(COLUMN=order_id,TYPE(NAME=snowflake,PROPERTIES("worker-id"=123))) );

Create sharding table by the previous sharding rule

CREATE TABLE `t_order` ( `order_id` int NOT NULL, `user_id` int NOT NULL, `status` varchar(45) DEFAULT NULL, PRIMARY KEY (`order_id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

Show resources, sharding databases and sharding tables

sql SHOW SCHEMA RESOURCES;

SHOW DATABASES;

SHOW TABLES;

Show sharding tables

SHOW TABLES;

Below are the tables in MySQL:

And below are the tables in ShardingSphere Proxy:

Drop sharding table

DROP TABLE t_order;

This example shows you how to create an encrypted table with DistSQL. The data encryption feature is ShardingSphere Proxy, which helps encrypt and decrypt data. Applications do not need any coding refactoring, and just send the plaintext to Proxy, where plaintext is encrypted and resends the ciphertext to the databases. Additionally, users can configure which column in which table should be encrypted by which encryption algorithm.

Prerequisites:

Process:

Login Proxy CLI by executing the following command:

Add Resources by distSQL.

ADD RESOURCE ds_0 ( HOST=127.0.0.1, PORT=3306, DB=ds_0, USER=root, PASSWORD=root );

Create encrypt rule

CREATE ENCRYPT RULE t_encrypt ( COLUMNS( (NAME=user_id,PLAIN=user_plain,CIPHER=user_cipher,TYPE(NAME=AES,PROPERTIES('aes-key-value'='123456abc')))));

SHOW ENCRYPT TABLE RULE t_encrypt;

Create encrypt table

CREATE TABLE `t_encrypt` ( `order_id` int NOT NULL, `user_plain` varchar(45) DEFAULT NULL, `user_cipher` varchar(45) DEFAULT NULL, PRIMARY KEY (`order_id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

Below is the result in MySQL:

Read the original here:
The Next Evolution of the Database Sharding Architecture - InfoQ.com

By default, WhatsApp chats are end-to-end encrypted, but the backups arent encrypted for iPhone users. To be on the safe side, you can enable end-to-end encryption for those WhatsApp backups. Heres how.

Start by opening WhatsApp on your iPhone. Next, tap the Settings (gear-shaped) icon in the bottom-right corner.

In WhatsApp Settings, select Chats.

In Chats, tap Chat Backup.

Under Chat Backup options, tap End-to-End Encrypted Backup.

The next screen will show that the Encrypted backup is off. Select Turn On.

On the next screen, tap Create Password.

Type a new password with at least 6 characters and one letter. Then, tap Next in the top-right corner. Retype the same password on the following screen, and tap Next in the top-right corner again.

Tap the Create button at the bottom to confirm that you want to create a new End-to-End Encrypted Backup. WhatsApp will prepare your backup with encryption and store it in iCloud.

Thats it! When you want to restore your WhatsApp messages backup, youll have to enter the same password that youve set for your encrypted backups. Good luck!

RELATED: How To Back Up and Restore Your WhatsApp Messages with Google Drive

See the original post:
How to Encrypt WhatsApp Chat Backups on iPhone - How-To Geek

The Hill may be compensated and/or receive an affiliate commission if you buy through our links.

People have been spending the majority of their waking lives online more than ever. Due to the pandemic and how it forced us to transfer our work and social lives online, the average adult in the U.S. allocates an astounding 16:06 hours a day on digital media. That's a huge increase from the already questionable 12:24 hours spent online pre-pandemic.

With tech as your lifeline and most of your personal information being dumped within the crevices of the online web, the responsible thing to do is to protect your data whenever you connect to the internet. A VPN is one of the easiest ways to do that, and thankfully, you don't have to spend much to gain access to reliable services. This Cyber Week, a lifetime subscription to RealVPN is available for an extra 20% off with the code CYBER20.

Compatible with Mac, Windows, iOS, and Android, RealVPN works to deliver total online freedom. It encrypts all of your data and all Internet activities from any app on your device, making them unreadable once they make their way around the internet. Whether you're connected to a private network or a public WiFi, you can rest assured that your pertinent information remains safe and secure, including from your ISPs. You won't have to worry much about advertisers, either, as they will be unable to pinpoint your physical location.

With multiple VPN servers spread across the globe, RealVPN offers the best connection speed at all times. Most importantly, it uses high-grade encryption AES-256 for your personal data, so you can enjoy secure access whether you're online shopping or banking. You're also rendered anonymous online, allowing you to hide from anyone who might want to interfere in your conversations.

A subscription to RealVPN lets you protect up to 5 devices connected simultaneously via a single account. With the one-button feature, you can enable protection with just a quick click. A lifetime subscription normally retails for $249, but you can grab it on sale for $15.99 with code CYBER20.

Prices subject to change.

See the original post here:
Save an extra 20% discount on a lifetime subscription to this VPN service | TheHill - The Hill

Nearly a third of hospitals and health systems are planning to implement biometrics (29%), digital forensics (28%) or penetration testing (28%) within the next 24 months, according to new HIMSS research. (HIMSS is the parent company of Healthcare IT News.)

However, 43% say funding is keeping their organizations from executing on security challenges they have, the research shows. This is not good as healthcare remains a primary target of cyber criminals.

So Healthcare IT News has interviewed a cybersecurity expert to get his views on where healthcare cybersecurity will be headed in 2022. Manoj Srivastava is general manager of security, ID Agent and Graphus at Kaseya, a vendor of IT management software.

Q. What do you see on the horizon in 2022 when it comes to technological advances in healthcare cybersecurity?

A. There are at least three technological advances that will apply to healthcare cybersecurity and across other industries as well. They are password-less authentication, secure access service edge (SASE) and zero trust.

Will passwords finally become a thing of the past? Possibly. The use of password-less authentication is growing, as it can help healthcare organizations reduce security risks associated with passwords.

Eliminating passwords can reduce the risk for a data breach since compromised credentials account for a large percentage of breaches. There are various ways to verify identity other than passwords, including biometrics, such as fingerprints and one-time passwords, which require users to input a code that is either emailed or sent via SMS or used with an authenticator app.

An SASE combines SD-WAN and security into cloud computing, and is quickly becoming a VPN replacement for remote work and distributed offices. Security consists of digital identity, which may be connected to a person, device, cloud service, software or even an IoT system. SASE makes it more secure without the complexity and latency of the traditional WAN/VPN approach.

Finally, zero trust is a shift of network defenses toward a more comprehensive IT security model. It is about not trusting any user or any device even if it is already connected to the corporate network.

Anytime a new resource is requested by connected users and devices, re-authentication is required. Zero trust is a security model or a security architecture. Products supporting various security controls in a network are now supporting zero trust.

Q. What's going on in the tech side in the cybersecurity space? What new technologies/techniques are emerging?

A. There are two emerging technologies, homomorphic encryption and blockchain, whose impact on the security of the healthcare industry is particularly interesting.

Homomorphic encryption (FHE) enables people to collaborate simultaneously without revealing confidential data. By using an encryption scheme, users can run tasks on encrypted data producing the same encrypted results as if they were using plaintext.

Typical methods of handling sensitive data with collaborators may be at risk. When files are sent, they may be encrypted, but once in use, they are decrypted providing bad actors with opportunities to access the data.

FHE eliminates this by allowing people with access to manipulate the data, keeping it encrypted and reducing the time it is decrypted. Another feature of this technology is that it can restrict decryption access so people can view only the parts they've been granted access to.

Keeping medical records safely stored and protected has long been a priority, and challenge, for healthcare organizations. Blockchain tech may make it a little easier to achieve while minimizing fraud and the costs associated with it.

Through blockchain technology, patients can access their medical information through a collective network. This technology allows for greater security and privacy. Additionally, the information would be housed on a single, trusted platform where physicians and other medical personnel could access the same data. Updates would be available immediately to everyone at once potentially revolutionizing patient care.

Q. What does the next year look like when it comes to ransomware, and the volume of malicious attacks? And what should healthcare provider organizations be doing to prepare?

A. The industries most impacted by ransomware are the public sector, professional services and healthcare. In addition to the perception these industries can pay ransom, they tend to store large amounts of data and safety measures are not as good as they should be.

Bottom line no industry is immune from ransomware attacks, but these are the most vulnerable. Also, companies with 1,000 employees or fewer account for nearly 70% of ransomware attacks. With emerging variants always on the rise and attack vectors getting more sophisticated, it's safe to say ransomware attacks will continue to plague healthcare providers and society as a whole.

There are three interesting factors at play the U.S. government is determined to go after cyber criminals behind ransomware; there is increased international cooperation; and new regulations might get approved to track bitcoins and other digital currencies.

All together, these should bring down the number of high-profile attacks targeting critical infrastructure, including healthcare. But cybercriminals are not going to go away that easily. They might just change their tactics. Instead of targeting larger organizations and demanding seven-figure ransoms, they might just target a larger number of smaller organizations and demand only five- and four-figure ransoms to stay below the radar of law enforcement agencies.

To prepare, organizations should perform regular data backups and integrity checks of those backups, and provide security awareness training to employees to avoid phishing and other social engineering tactics.

Additionally, there should be a patch management system and discipline in place. Finally, limiting privileges to access files and directories also is essential to mitigate lateral movement of attackers if they were to breach non-privileged user accounts.

Q. What other cybersecurity developments do you think will be important for healthcare in 2022?

A. As the Internet of Things continues to expand its reach in the real world, including the medical field, IoT security will also need to be prioritized by healthcare providers. Thousands of devices that comprise the Internet of Things must be protected that includes items you may find in hospitals and healthcare centers, such as infusion pumps and remote patient monitoring devices, among others.

As tech expands, other intelligent medical equipment also will need to be safeguarded, as well as things we may use every day, from smart elevators to smart HVAC systems.

Twitter:@SiwickiHealthITEmail the writer:bsiwicki@himss.orgHealthcare IT News is a HIMSS Media publication.

See more here:
Cybersecurity in 2022: password-less authentication, zero trust, blockchain and more - Healthcare IT News

Earlier this year, WhatsApp updated its policy and forced users to accept the changes if they wanted to continue using the app. This move caused heavy backlash for various privacy and security reasons and prompted users to reconsider using the app for personal communication.

WhatsApp privacy policy is terrible for user privacy, says Ashley Simmons, founder of avoidthehack!, a website that promotes online privacy and security awareness. It requires data sharing with Facebook, doesnt offer encryption for chat backups, and mines the metadata of your messages.

For instance, a WhatsApp blog post published in 2016 reads, And by connecting your phone number with Facebooks systems, Facebook can offer better friend suggestions and show you more relevant ads if you have an account with them.

After concerns like this garnered public attention, WhatsApp came forward with various clarifications, but by then, a lot of users had already started looking for alternatives like Telegram and Signal.

Today, WhatsAppstill has more than 2 billion active users, but discussions about dumping the app for another, potentially more secure messaging service are still going online.

Should users really consider leaving the app? Do suitable alternatives exist? We asked technology, social media, and privacy experts.

Simmons believes the time to dump WhatsApp was back in 2014 when Facebook acquired it. Facebook (Meta) may not be consistently reading the contents of your messages but they know other sensitive bits of information (metadata) such as who you are, who you talk to, which devices you and your devices communicate with, the time you sent the message, and from where you sent the message, Simmons says. In short, your privacy is silently being invaded.

On the other hand, experts like Jackie Leavitt, chief editor of Cloudwards, an online publication on cloud-based technology, believe dumping the app may be difficult as its free and nearly everyone around the world uses it. For instance, apps like Telegram and Signal still have a smaller user base. [These apps] dont have the spread WhatsApp does, so they cant functionally replace WhatsApps communication power just yet.

Viber, Telegram, Wire, Discord, and Skype are other options users are considering.

While people are open to alternatives, not everyone has made the switch to other messaging apps. So even if there are serious security concerns in using WhatsApp, ultimately, users may be forced to choose the app anyway, simply because most of their family members and friends are available there.

Finally, despite its popularity, the app doesnt cover everyone. Users who have limited access to the internet and smartphone cant be reached through apps like WhatsApp, says Derek Ting, co-founder and CEO of TextNow, a service that offers free calling and texting on any device without the need for another person to have the same app installed.

With all these factors working together, people have realized its not a good idea to put all their eggs in one basket, Ting says. And now people know alternatives exist.

Signal is currently the best alternative we recommend in terms of reach, security, and privacy-enabled features, Harold Li, vice president of ExpressVPN, points out. It is a messaging app created by Open Whisper Systems, now part of the Signal Foundation that created the end-to-end encryption protocol that is also used by WhatsApp, Microsoft, and Google. Signal is also open-sourced, allowing its security to be vetted by cybersecurity experts.

Simmons recommends taking a look at Threema and Element that require less (or hardly) personal identifiable information to sign up/use, offer strong encryption protocols, and collect minimal usage data (such as metadata described above).

Viber, Telegram, Wire, Discord, and Skype are other options users are considering, though not all necessarily place a premium on privacy the way Signal does.

However, despite the wide choice of alternative messaging apps, dumping WhatsApp may not be the best option for everyone. WhatsApp is not going away, as it has the backing of the largest social media company in the world, with a massive user base in countries where WhatsApp is one of the most common forms of communication, Ting says.

If you must be a part of your regular WhatsApp groups with little to no possibility of convincing your frequent contacts to use another messaging service, you have no choice but to agree with WhatsApps policy and continue using the app.

Thats why, ultimately, whether people should really dump WhatsApp comes down to personal choice and individual circumstances. If your entire household depends on it for school and work, it may be more feasible to continue with the app. However, if you have the opportunity to make a switch, it may be a good idea to find a more secure service that offers similar features but with more privacy options and transparent data sharing policies.

See more here:
Nows the time to dump WhatsApp, privacy advocates say - Digital Trends

( Boston, MA,05/30/14) Andy Yen, cofounder of ProtonMail. (see Jordan Graham story) (Staff photo ... [+] by Stuart Cahill) (Photo by Stuart Cahill/MediaNews Group/Boston Herald via Getty Images)

Proton CEO Andy Yen once worked at CERN before deciding to kickstart his encryption-focused company ProtonMail out of beta through a crowdfunding campaign. Since then, ProtonMail has expanded into a variety of privacy-preserving technologies, from rolling out a drive product and calendar product with enough intuitive access features that it could be a very real competitor to Googles GOOG suite of products to allowing for organizational control of different emails and releasing its own VPN product.

The company has been renamed to Proton, to adjust for its broader focus on privacy-enhancing tools outside of email. What follows are excerpts from my interview with Andy on his thoughts about encryption, bitcoin and the enduring importance of privacy. The questions and responses have been excerpted from a larger interview, and written out in a way that is more reader-friendly and focused, though the substance is there: the content of the answers matches almost exactly those in the full interview save a few formatting edits and changing the order of one question.

Proton is structured in an interesting way from ProtonMail to ProtonVPN what do you see as the full privacy stack of tools which can maximize encryption and minimize surveillance? How do you see Proton interacting with other privacy tools such as bitcoin and Signal?

As a business, were shifting from a single privacy product, ProtonMail to Proton as a privacy platform, privacy ecosystem as a privacy infrastructure for the future. Obviously when you think about privacy online, email is an important part because it is an identity many people say that it is the only identity that matters today, but it is still limited and that is why we introduced ProtonVPN to allow facility and access to ProtonMail services, thats why were doing a calendar and drive. Well be expanding on that ecosystem of course.

The way to really consider this is, in fact, all services that Google offers today are built and designed in a way to maximize the data they can collect in order to sell better advertising. You could take all of those products and services and rebuild them in a way that is centred around making privacy the default and being as private and as secure as possible. In fact, theres nothing that Google offers that couldnt be rebuilt in a better way, and that whole ecosystem could in fact be recreated in a privacy-first way.

And what you do see is different companies, different startups starting to pick up different pieces of that. Obviously, we have the email, VPN, file storage and calendar piece that were working on. DuckDuckGo is doing that on search. Signal and Telegram are adjusting this when it comes to chat. I think its a very healthy and vibrant fact that we have an ecosystem today where theres many companies in the space, and it becomes increasingly possible to replace more and more pieces of your online life with private versions of [products].

Blockchain is another element there. Weve been long-time supporters of bitcoin from the very beginning. [...] Its a means of independence. For the space to survive, for privacy to thrive, you need to be able to be independent. You need to be not under the control of lets say, big tech or even the banking system. This level of independence really needs to be there to be in order for you to really do what is best for users at all times. This is why we also support cryptocurrencies and we support it as a payment method.

I personally would like to see more adoption of cryptocurrencies, because I think thats something that leads us to a world where things are less centralized. Centralization is a very very big risk because it means a single company can essentially cut you off and kill you. Resilient systems must be decentralized. We are building a platform or an ecosystem, but we are working as much as possible to be part of a broader ecosystem because we know we cant do it alone.

(Paypal once restricted ProtonMails account, with one representative questioning if the service was even legal).

Youve spoken and written often about the negative effects of big tech monopolies. What are your thoughts on the acquisitions in the space something Ive been seeing in the space for example with Zoom acquiring Keybase.

There are acquisitions within the privacy space the Zoom/Keybase acquisition was a very specific one it was to try to repair the security and privacy reputation [of Zoom] that took quite a big hit last year. From the perspective of Proton, our business model doesnt allow us to be acquired by Google and become part of big tech. It simply isnt possible, it would undermine our value proposition and I think if you are building businesses in privacy that is something to keep in mind.

Very so often, a lot of people start companies solely for the purpose of selling them, and the usual buyers in the past were big tech. That avenue isnt possible for privacy companies and I think that is a good thing, because if it were possible, then big tech would just own everything and you would have a competition issue.

What about the pricing (for example app store fees) and talent effects of big tech monopolies?

The things that Apple and Google are doing on the app store clearly are anti-competitive in many ways. You cannot have a fair competition if you are mandated by your competitor to pay them 30% of your revenue. There is no market, historical or future, where fair competition can exist under those circumstances. This should be very obvious [...], its very obvious to us. It took quite a long time for lawmakers to realize that this is an issue and theyre starting to realize its a problem now and thats why were seeing action on both sides of the Atlantic to pursue that.

[...]

Its also very bad for privacy, because if you look at the advertising business model, they dont charge for their product. The way that they work is that you get the product for free and theyll monetize you off of your data and using your most intimate and sensitive information to basically sell you ads.

A service like Facebook, honestly, would never have the payback fee but assume there was a more responsible version of Facebook that was going to subsist off of subscriptions instead of massive data abuse. That service would because of app store policies be put at a competitive disadvantage. Theyd have to pay fees that the bad business models dont have to pay. What the app store fees are essentially doing is strongly favouring ads-based business models which are bad for privacy and through that way, consumers around the world are harmed as a result of this.

[...]On talent, its an interesting question big tech because of their size sucks up a lot of the talent in the tech sector. But I believe what weve been seeing in the last year or last two years has been the rise of employee activism in that employees care of course about making a paycheck [...] but theres also more and more people [...] who also care about what theyre doing in their life. [...] If you care about those things, and there are bigger and bigger proportion of people these days, especially young people, then you ask yourself the question: do I want to spend my life working at the worlds biggest ad company, and abuse data to optimize ad returns? Or do I actually want to build the Internet of the future that defends democracy, defends human rights and ensures freedom for all?

-

It has been an interesting year for Proton, which has seen it launch new products, and continue building as part of a privacy ecosystem a place where parts of the Internet, including cryptocurrencies, Bitcoin and the broader encryption ecosystem are gradually building towards.

View original post here:
An Interview With Proton CEO Andy Yen On Big Tech, Bitcoin And The Enduring Importance Of Privacy - Forbes

Microsoft has released end-to-end encryption for one-on-one Teams calls, adding a feature already offered by competitors Zoom and Webex.

Microsoft this week made E2EE generally available to Teams users on Windows and Mac computers, allowing workers to secure calls so only the participants have access to the content. Usually, Teams secures data through Transport Layer Security encryption, in which data can be decrypted in Microsoft's cloud before being re-encrypted and sent to the intended recipient.

Because E2EE removes Microsoft's ability to access meeting data, customers' employees can't use cloud-based services when using the feature. The company said workers would be unable to record, capture or transcribe meetings while E2EE is on. Transferring calls, merging calls, adding a meeting participant and moving calls onto another device will not work either.

The feature is more limited than the E2EE offered by Microsoft competitors. While Teams E2EE calls are limited to two workers, Zoom and Webex allow encrypted meetings with multiple participants.

E2EE will make Teams more attractive to customers in highly regulated fields, like government, military, healthcare and finance.

"[E2EE] comes up where it's mandated that you must have [meetings] encrypted end to end," said Tom Arbuthnot, an IT architect at systems integrator Modality Systems. He added that most organizations are unlikely to use the E2EE for typical staff meetings, however. "It's really a pretty niche requirement."

Administrators need to enable E2EE before workers can use it. Once IT configures its encryption policy, employees must activate the security feature in their Teams settings. According to Microsoft, IT retains the ability to disable E2EE at any time.

E2EE for video conferencing became a hot topic after the pandemic made Teams and Zoom household names. In 2020, individual users filed a class-action suit against Zoom, claiming the company did not provide E2EE as advertised. Zoom settled the lawsuit and a Federal Trade Commission complaint about its E2EE marketing. It later added the feature to its service in October 2020.

In other Teams news, Microsoft has improved search in the service to help users find the information they want more effectively. The redesigned search lets people choose whether they're looking for a chat message, file or person within the company. Workers can specify by date and the people involved and exclude messages from apps and bots.

It can be challenging to find information in Teams, Arbuthnot said. In chat, a flood of messages can quickly bury a needed attachment.

"[Teams search] wasn't the best, to be honest," he said. "There's so much data, so finding the exact thing you need was challenging."

Microsoft also plans to improve its Teams Rooms conference-room product next year to bridge the gap between in-office and remote meeting attendees. A new layout will place remote workers at eye level and let those in the room see the meeting chat and which participants have raised their hands to speak. Microsoft plans to release the layout, called front row, in January.

Zoom and Cisco's Webex have introduced features to level the playing field for hybrid work. Zoom's Smart Gallery and Webex's People Focus place conference-room participants in individual video frames to allow remote workers to read body language and nonverbal cues readily.

Providing an equal experience for at-home and in-office workers will be the most prominent video conferencing problem of 2022, said Bob O'Donnell, founder of Technalysis Research. He added that he expects it will take some time before vendors fix it.

"The experience of having some people remote and some in the room is pretty bad right now," he said. "It's incredibly hard to do well."

Many workers will just bring their laptops into conference rooms and individually join meetings until room-based systems provide parity, O'Donnell said.

Mike Gleason is a reporter covering unified communications and collaboration tools. He previously covered communities in the MetroWest region of Massachusetts for theMilford Daily News,Walpole Times,Sharon AdvocateandMedfield Press. He has also worked for newspapers in central Massachusetts and southwestern Vermont and served as a local editor for Patch. He can be found on Twitter at @MGleason_TT.

See the rest here:
Microsoft adds end-to-end encryption to Teams - TechTarget

What user data can U.S. federal law enforcement obtain from providers of encrypted messaging services? A recently disclosed January 2021 document from the Federal Bureau of Investigation (FBI) supplies a concise summary with respect to nine different secure messaging apps. It shows that with legal process, the FBI can get various types of metadata, and in some cases even stored message content. Exactly whats available, though, varies widely by app. The one-page document should give useful guidance to privacy-conscious people including journalists, whistleblowers, and activists while also helping to dispel misconceptions about the FBIs surveillance capabilities (or lack thereof) in the encrypted messaging context. Kudos to government-transparency nonprofit Property of the People (POTP), run by FOIA guru Ryan Shapiro and indefatigable lawyer Jeffrey Light, for obtaining this record under the Freedom of Information Act.

Dated Jan. 7, 2021, the document states that it reflects FBI capabilities as of November 2020. The apps included in the chart are iMessage, LINE, Signal, Telegram, Threema, Viber, WeChat, WhatsApp (owned by Meta, fka Facebook), and Wickr (which was acquired by AWS in June). Most of these appsiMessage, Signal, Threema, Viber, WhatsApp, and Wickrend-to-end encrypt messages by default. As for the rest, Telegram uses default end-to-end encryption (E2EE) in some contexts, but not others. E2EE is on by default in newer versions of LINE, but it may not be turned on in older clients. And WeChat, owned by Chinese giant Tencent, does not support end-to-end encryption at all (just client-to-server encryption). This variance may explain why the document refers to the apps as secure instead of E2EE.

What User Data Can the FBI Get?

The chart illuminates the variation in how much data different services collect and retain about users and their communicationsand consequently, what data theyll provide to law enforcement given a valid warrant, subpoena, or court order. (Think, for example, about a warrant asking for all records in a providers possession pertaining to a user: the more information it retains about its users, the more it can be required to provide to law enforcement.) This ranges from the minimal information available from Signal and Telegram, to the basic subscriber information and other metadata that several services disclose to the FBI, and even limited stored message content from three of the nine apps: LINE (which, as said, still supports non-E2EE chats), iMessage, and WhatsApp.

That last part may come as a surprise to some iMessage and WhatsApp users, given that were talking about E2EE messaging. True, E2EE renders users messages inaccessible to law enforcement in transit, but its a different story for cloud storage. If an iMessage user has iCloud backups turned on, a copy of the encryption key is backed up along with the messages (for recovery purposes) and will be disclosed as part of Apples warrant return, enabling the messages to be read. WhatsApp messages can be backed up to iCloud or Google Drive, so a search warrant to one of those cloud services may yield WhatsApp data including message content (although a search warrant to WhatsApp wont return message content). (WhatsApp recently started rolling out the option to E2EE message backups in the cloud, rendering the FBI chart slightly out-of-date.)

While its possible to piece together some of the information in the chart by scouring app makers public documentation and courts criminal dockets, the FBI conveniently pulled it into one at-a-glance page. It might be old news to you, if you happen to be familiar with both the law governing electronic communications privacy and the technical nuances of your encrypted messaging app(s) of choice. That may describe a lot of Just Security readers and government surveillance beat reporters, but it probably doesnt reflect the average users mental model of how an E2EE messaging service works.

The chart also reveals details that app makers dont talk about forthrightly, if at all, in their public-facing guidelines about law enforcement requests. With a warrant, WhatsApp will disclose which WhatsApp users have the target user in their address books, something not mentioned on WhatsApps law enforcement information page. And Apple will give 25 days worth of iMessage lookups to and from the target number irrespective of whether a conversation took place, which is described in Apples law enforcement guidelines but takes a little digging to understand since neither the FBI nor Apple explains what that means in plain English. In each case, the company is disclosing a list of its other users that happen to have the target users contact info, whether or not the target communicated with them. (If other messaging services make a practice of disclosing similar information, its not reflected in the chart.) These details underscore the broad sweep of U.S. electronic surveillance law, which lets investigators demand any record or other information pertaining to a [target] subscriber in response to a 2703(d) order or search warrant. While Apple and Meta have both fought for user privacy against overreaching government demands, the law nevertheless renders a lot of user data fair game.

Popular Misperceptions of Messaging Privacy

In short, its no easy task for the average person to accurately understand precisely what information from their messaging apps could wind up in the hands of federal investigators. Not only do different apps have different properties, but app makers dont have much of an incentive to be straightforward about such details. As the FBI chart demonstrates, the market of free, secure messaging apps is a gratifyingly crowded and competitive field. Providers want to give current and would-be users the impression that their app is tops when it comes to user security and privacy, whether the user is concerned about malicious hackers, governments, or the provider itself. Providers have learned to be wary of overstating their services security properties, but theyre betting that marketing copy will get more attention than technical whitepapers or transparency reports.

In this regard, app makers incentives are aligned with those of the FBI. Given the FBIs years-long campaign against encryption, it makes a strange bedfellow to the encrypted service providers it has condemned by name in public speeches. But service providers and the FBI both benefit from a popular misconception that underestimates the user data available to investigators from certain E2EE services. That misapprehension simultaneously maintains the providers image in the eyes of privacy-conscious users while upholding the FBIs narrative that its going dark in criminal investigations due to encryption.

Although this misunderstanding may help law enforcement investigators, it can have significant consequences for their targets. Not just garden-variety criminals, but also journalists and their sources, whistleblowers, and activists have a lot riding on their choice of communications service. As noted in Rolling Stones article about the FBI chart, WhatsApp metadata was key to the arrest and conviction of Natalie Edwards, a former U.S. Treasury Department official who leaked internal documents to a reporter with whom she exchanged hundreds of messages over WhatsApp. Edwards (and presumably also the reporter, who owed Edwards an ethical duty of source protection) believed that WhatsApp was safe for journalist/source communication. That misunderstanding cost Edwards her freedom.

The Reality Behind the Myth

Thanks to FOIA and its zealous disciples at POTP, the public can now see the internal FBI document that neatly summarizes the reality behind the myth. It shows that despite its going dark claims, the FBI can obtain a remarkable amount of user data from messaging apps that collectively have several billion global users. (The ability to test the governments public claims against its internal statements is one of the reasons why public access to government records, POTPs raison dtre, is so crucial.) It shows the role that cloud storage and metadata play in mitigating end-to-end encryptions impact on real-time communications surveillance. And it shows which popular E2EE messaging services truly do know next to nothing about their users.

If users think the encrypted apps they use dont keep much information about them, the FBI chart shows that belief to be largely false. With some exceptions, many major E2EE messaging services hand over all kinds of data to federal law enforcement, and cloud backups can even enable the disclosure of stored messages sent on two of the biggest E2EE messaging apps. Even if little or none of whats in the document is truly news, its still helpful to see it laid out so succinctly in a single page. If you are concerned about messaging privacy, use this chart (together with privacy and security guides specific to your situation, such as for journalism or protests) to help you decide which app is best for youand share it with the people you chat with, too. That way, you can make a more informed decision about which app(s) to keep (and which to leave behind) as we enter the new year.

Apple, Digital Surveillance, Encryption, FBI, FOIA, Law enforcement, Privacy, Stored Communications Act, Technology, WeChat, WhatsApp

See the original post:
We Now Know What Information the FBI Can Obtain from Encrypted Messaging Apps - Just Security

Britain's Online Safety Bill is being enthusiastically endorsed in a "manifesto" issued today by MPs who were tasked with scrutinising its controversial contents.

Parliament's Joint Committee on the Online Safety Bill published the report declaring the bill would let government ministers "call time on the Wild West online."

The committee, made up of MPs and peers from various political parties, was asked to carry out a serious analysis of the controversial legislation. Surprising some onlookers, its Conservative chairman, Damian Collins MP, used the committee's 193-page report to talk about what he described as a "wider manifesto" for Big Tech regulation.

Ministers have two months before they have to formally respond to the report. As drafted, the bill doesn't go far enough (in the committee's view) and ought to impose more bans and regulations on activities that take place over an internet connection for example, "cyberflashing" (using Apple Airdrop and similar mobile device technologies to send obscene content to unwitting recipients), promotion of self-harm, posting adverts for online fraud, and so on.

"The Committee has set out recommendations to bring more offences clearly within the scope of the Online Safety Bill, give Ofcom the power in law to set minimum safety standards for the services they will regulate, and to take enforcement action against companies if they don't comply," said Collins in a canned statement.

Among other things, the committee called for:

It also said:

British legislators have been grappling with largely US-owned social media and web platforms failing to pay enough attention to increasingly loud demands for content censorship and for end-to-end encryption to be banned.

The bill's stated aim is protecting children from unsuitable content on the World Wide Web, though every political campaigning group imaginable (including a pro-free speech group) has weighed in during the general public debate about the bill.

The British Computer Society, the chartered institute for IT, praised the bill's focus on public risk assessments by platforms and nascent internet regulator Ofcom alike, but expressed reservations about exactly what legal duties it will impose.

"The Bill leaves a lot of definitions abstract, and much of the concrete expectations for what platforms will be asked to do will be set out in secondary legislation and Codes of Practice," said the BCS, "meaning it's currently very difficult to assess what exactly platforms will be asked to do to reduce harms and protect rights, and whether it will be sufficient."

Warnings about the risks to free expression online of over-regulation have largely been ignored by the committee, whose members included politicians from the Conservative, Labour, SNP, and Lib Dem parties.

The bill's second reading in Parliament is expected this week as the government moves to make it legally binding.

See the rest here:
MPs charged with analysing Online Safety Bill say end-to-end encryption should be called out as 'specific risk factor' - The Register

Previous chairman of the U.S. Securities and Exchange Commission, or SEC, Jay Clayton, was delegated by ex-President Donald Trump to serve in 2017. In his tenure as head of the SEC, Clayton often defended Bitcoin (BTC) as a store of significant worth. This previous Wednesday, during a interview with CNBCs Squawk Box show, Jay shared his musings on digital currency and how it ought to be directed going ahead. The previous SEC seat said that he is a huge believer in crypto technology and that its productivity benefits in the financial system and tokenization are enormous.

When asked whether the present chairperson is creating too many restrictions for the crypto industry, Jay said that cryptocurrencies have numerous purposes and are connected to a variety of industries, and the SEC should be in charge of regulating only those sectors that are linked to it.

Claytons remarks come as the current SEC chair, Gary Gensler, recently confirmed that the watchdog has no plans to ban crypto, but that U.S. congress could. Gensler warned, however, that crypto in its current form is comparable to the wild west without proper regulation.

Crypto is a wide variety of products, with a wide variety of functions, and the rules of our financial system are clear and long-standing. If you are raising capital for a project, you have to register your capital raising with SEC. If you are trading securities it has to be on a registered venue, But there are many crypto sectors like stablecoins that are not securities and outside of SEC purview.

Clayton did not allow the approval of a Bitcoin ETF during his term, which occurred now in 2021 under Gary Gensler. The agency has since come under fire for rejecting spot ETF applications and approving Bitcoin futures ETFs. Grayscale submitted a letter to SECs secretary, Vanessa Countryman, in which it stated that there is no basis for the position that investing in derivatives for an asset is acceptable for investors but not investing in the asset itself. The SEC was accused of treating the two Bitcoin ETF proposals unequally under the Administrative Protections Act, or APA.

According to Clayton, cryptocurrencies should be implemented but with appropriate regulation. He said that the government should be reactive to people who are violating our well-defined laws but proactive in encouraging the adoption of this technology throughout our financial system.

News Summary:

See the article here:
'I'm a big believer in encryption technology,' says the former chairman of the US SEC. - BollyInside