The man who built the free email encryption software used by whistleblower Edward Snowden, as well as hundreds of thousands of journalists, dissidents and security-minded people around the world, is running out of money to keep his project alive.

This post was originally published on ProPublica.

Werner Koch wrote the software, known as Gnu Privacy Guard, in 1997, and since then has been almost single-handedly keeping it alive with patches and updates from his home in Erkrath, Germany. Now 53, he is running out of money and patience with being underfunded.

"I'm too idealistic," he told me in an interview at a hacker convention in Germany in December. "In early 2013 I was really about to give it all up and take a straight job." But then the Snowden news broke, and "I realized this was not the time to cancel."

Like many people who build security software, Koch believes that offering the underlying software code for free is the best way to demonstrate that there are no hidden backdoors in it giving access to spy agencies or others. However, this means that many important computer security tools are built and maintained by volunteers.

Now, more than a year after Snowden's revelations, Koch is still struggling to raise enough money to pay himself and to fulfill his dream of hiring a full-time programmer. He says he's made about $25,000 per year since 2001 a fraction of what he could earn in private industry. In December, he launched a fundraising campaign that has garnered about $43,000 to date far short of his goal of $137,000 which would allow him to pay himself a decent salary and hire a full-time developer.

The fact that so much of the Internet's security software is underfunded is becoming increasingly problematic. Last year, in the wake of the Heartbleed bug, I wrote that while the U.S. spends more than $50 billion per year on spying and intelligence, pennies go to Internet security. The bug revealed that an encryption program used by everybody from Amazon to Twitter was maintained by just four programmers, only one of whom called it his full-time job. A group of tech companies stepped in to fund it.

Koch's code powers most of the popular email encryption programs GPGTools, Enigmail, and GPG4Win. "If there is one nightmare that we fear, then it's the fact that Werner Koch is no longer available," said Enigmail developer Nicolai Josuttis. "It's a shame that he is alone and that he has such a bad financial situation."

The programs are also underfunded. Enigmail is maintained by two developers in their spare time. Both have other full-time jobs. Enigmail's lead developer, Patrick Brunschwig, told me that Enigmail receives about $1,000 a year in donations just enough to keep the website online.

Continued here:
The World’s Email Encryption Relies on a Guy Who Is Going Broke

Thousands of people will have their personal files held hostage this year, by software that uses virtually unbreakable encryption.

Every so often someone invents a new way of making money on the Internet that earns wild profits, attracts countless imitators, and reshapes what it means to be online. Unfortunately, such a shift took place last year in the world of online crime, with the establishment of sophisticated malicious software known as ransomware as a popular and reliable business model for criminals.

After infecting a computer, perhaps via an e-mail attachment or a malicious website, ransomware automatically encrypts files, which may include precious photos, videos, and business documents, and issues an electronic ransom note. Getting those files back means paying a fee to the criminals who control the malwareand hoping they will keep their side of the bargain by decrypting them.

The money that can be made with ransomware has encouraged technical innovations. The latest ransomware requests payment via the hard-to-trace cryptocurrency Bitcoin and uses the anonymizing Tor network. Millions of home and business computers were infected by ransomware in 2014. Computer crime experts say the problem will only get worse, and some believe mobile devices will be the next target.

Ransomware has been around for more than a decade. Older examples tended to be ineffective or relatively easy to defeat. But a new, more potent wave of ransomware emerged in late 2013 beginning with a version dubbed Cryptolocker. That malware infected Windows computers and in about 30 minutes would encrypt nearly all the data stored on them, as well as any external or network drives, locking up photos, music, and videos. Then it would display a message with a 72-hour countdown timer telling the victim to pay a fee (usually around $300) to retrieve the data. Step-by-step instructions explained how to send the money by buying bitcoins or using a prepaid debit card.

Cryptolocker was professional in its design, and it used an essentially unbreakable encryption system developed by Microsoft. At its peak, around October 2013, Cryptolocker was infecting 150,000 computers a month. And over the course of nine months, it is thought to have generated about $3 million in ransom payments.

The criminals behind Cryptolocker were taken down in June last year, after collaboration among the FBI, U.K. and E.U. law enforcement agencies, security companies, and academic researchers. Investigators broke into the network used to control the malware and uncovered a stash of encryption keys that were then used to create a free service to rescue data belonging to victims of the scam.

Because of the breakout, if temporary, success of Cryptolocker, the problem of ransomware seems sure to get bigger.

Uttang Dawda, a malware researcher with security company Fireeye, who worked on the Cryptolocker rescue tool, says computer criminals have identified ransomware as a valuable new business model. If well designed, it provides easier profits than stealing credit card details or banking information and then selling that data on the black market. The crooks get anonymity, faster profit, and dont have to spend time and money finding middlemen, Dawda says.

The most successful ransomware circulating today copies Cryptolockers basic design but adds technical and interface-design improvements.

Read this article:
Holding Data Hostage: The Perfect Internet Crime?

With the global importance of data privacy at an all-time high, and in recognition of Data Privacy Day, Brocade announced the industrys first native port-based encryption functionality for modular routers. This offering delivers encryption embedded in-line with the I/O ports, enabling customers to avoid the significant performance loss, operational complexity, and prohibitive cost associated with services blades or external appliances used for encryption. The new capability better enables comprehensive privacy for all data across campus, data center, and wide area networks belonging to enterprises, service providers, and the public sector.

To protect data-in-flight between data centers, branch offices, and campus buildings, Brocade added the industrys highest level of encryption, IPsec Suite B algorithms with support for AES 256-bit keys, to the family of BrocadeMLXe routers via a purpose-built line module and operating system enhancements. The updates eliminate the need for expensive specialized switch/router encryption services blades or third-party security appliances, while also eradicating performance-inhibiting latency and complex operations that are inherent with these types of add-on devices.

Its common knowledge among IT teams that adding security devices severely impacts application performance and employee productivity, forcing difficult decisions that can put the business, as well as employees and customers, at risk.

In a recent survey of IT professionals across North America, respondents stated they experienced a 75 percent decline in network performance when security appliance capabilities are enabled such as firewall, anti-virus, deep packet inspection, and encryption, said Zeus Kerravala, founder, ZK Research. Additionally, 44 percent cited trade-offs being required between network performance and security, with nearly 40 percent of respondents stating they either decline to enable, or completely turn off, functions in their security devices to avoid impacting networking performance.

The new security functionality added to the Brocade MLXe routers includes both 256-bit IPsec encryption and 128-bit MACsec encryption, the gold-standard protocols used by organizations to help ensure end-to-end data protection. Both of these security protocols can be enabled at wire speed for up to 44 Gbps (IPsec) or 200 Gbps (MACsec) throughput per module, meeting the highest levels of network performance requirements.

With data breaches making headlines around the world, securing confidential information is top of mind for every organization. As customers tackle the data privacy challenge, they need security everywhere in their infrastructure, but especially for data-in-flight over the WAN. Historically, performance and cost have been key barriers to broad adoption of network encryption technology, said Jason Nolet, senior vice president Switching, Routing, and Analytics Products, at Brocade. By utilizing innovative, I/O-based encryption in Brocade MLXe routers, organizations can now deploy up to 44 Gbps of wire-speed IPsec encryption per trunk and over 1 Tbps per router, achieving five times the performance at a third of the costand without the operational complexityof comparable solutions.

Adding encryption and decryption natively to the I/O modules of the router enables the network to ensure the privacy of all data that moves across it, without compromise, for the first time. By bringing wire-speed encryption into the router, customers can enable pervasive data privacy across their New IP initiatives while offloading their appliances, improving performance, and increasing their overall IT security profile.

The new IPsec and MACsec functionality for the Brocade MLXe routers is interoperable with third-party IPsec Suite B-capable platforms, and it complements MACsec functionality available in the Brocade ICX family of switches. IPsec interoperability with the Brocade Vyatta vRouter is targeted for a future release, enabling customers to deploy native network encryption for privacy of all their data across hybrid cloud deployments.

Read the original here:
Brocade Enables Pervasive Data Privacy across Public and Private Cloud Deployments for the New IP

Crypto pioneer Phil Zimmermann has labelled UK Prime Minister David Camerons anti-encryption plans as "absurd".

Zimmermann, creator of the PGP email privacy package, countered Cameron's argument that encryption is creating a means for terrorists and child abusers to communicate in private, arguing instead that intelligence agencies such as GCHQ and the NSA have "never had it so good".

Strong encryption technology is one of the few success stories in online security, according to the co-founder of secure communications firm Silent Circle.

Cameron is pushing the idea of banning crypto products that UK spies are unable to access, an idea he first floated in a recent speech before lobbying US President Barack Obama on the issue.

Unsurprisingly, Zimmermann is unimpressed with an anti-encryption policy the Conservative Party plans to write into its manifesto for the forthcoming UK general election.

"Its absurd," Zimmermann told The Guardian. "We fought the crypto wars in the 1990s, and that matter has been settled. End-to-end encryption is everywhere now: in browsers, online banking. If you have strong encryption between your web browser and your bank, you cant have a man in the middle from the government wiretapping that."

The FBI and intel agencies such as MI5 have been vocal in complaining that strong encryption technologies are paving the path toward a dark web where they will no longer be able to intercept terrorists' communications.

Zimmermann said ubiquitous CCTV cameras and other technologies mean that spy agencies are enjoying a "golden age of surveillance" comparable with the world as depicted by TV show Person of Interest.

"They can see everything: theyve got face recognition algorithms looking through cameras on the streets, optical recognition cameras at bridges, tunnels and traffic lights," Zimmermann said. "They can track movements, transactions, whos having lunch with whom, whos sleeping with whom. They can see everything!"

"To complain that end-to-end encryption is crippling them, well, it's like having a couple of missing pixels in a large display. They have the rest of the display! Theyve never had it so good. They didnt have this stuff 20 years ago," he added.

Read the original post:
Zimmermann slams Cameron’s ‘absurd’ plans for crypto ban

IBM Cloud Data Encryption Services Overview
Check out IBM #39;s most advanced software-defined data protection for enterprises servers, on-premises or in the cloud. Security, availability, resiliency, reco...

By: Cloud Data Encryption Services

See the original post here:
IBM Cloud Data Encryption Services Overview - Video

Tinkering with this is a slippery slope towards authoritarianism a far cry from what you might expect to see in the UK

Earlier this month in the aftermath of the Paris attacks, David Cameron pledged to deny terrorists any safe space to communicate online. However, to make this possible, what he is essentially pledging is a ban on end-to-end encryption.

Encryption is the backbone of online security. It allows the safe transfer of sensitive information such as passwords and credit card details, in addition to safeguarding most of the data we use online. Without encryption there would be no e-commerce, no online banking, and certainly no cryptocurrencies, such as Bitcoin.

Outlawing the use of encryption would be like imposing a ban on envelopes and forcing all correspondence sent via the Royal Mail to be in the form of postcards.

>See also:Who's the idiot now, prime minister? David Cameron's encryption ban is just as ignorant as Steve Emersons Fox News gaffe

Whilst Cameron may simply have been looking to reassure the British public that the government will be taking further measures to safeguard the nation from unwanted attacks, unfortunately, the current option being proposed is an ill-advised one. Not to mention, it contradicts the UKs own vision of establishing itself as the safest place for e-commerce in the world, as well as the upcoming changes to the EU data protection act.

Even if there was enough of a consensus for a ban on encryption to go ahead, it isnt a technology that can easily be made to go away. Whether we like it or not the encryption genie is out of the bottle and its not something we can put back.

What Cameron has proposed would mean having backdoors or intentional secret flaws built into apps so that suspicious content can be accessed by the government if it needs to. Crucially however, there is no way to guarantee that only the good guys will use it you cant deliberately introduce a flaw into a piece of software and prevent it from being used maliciously.

Similarly, the idea of having these rules applicable to software for one country alone wouldnt work from an international standpoint. Would Britons be required to avoid software from creators that fall outside of the UKs jurisdiction? Would visitors to the UK be expected to replace the software on their laptops, and have all messages to and from the UK be scrutinised by the government for contamination by encryption?

Governments might grudgingly accept that encryption is here to stay and instead focus on ways that enable them to crack the code they could try to limit the size of encryption keys, force the use of approved algorithms or require people to register a copy of their keys with the authorities but none of these approaches are practical, and even if they were would just serve to make the life of an attacker easier.

Go here to read the rest:
David Cameron’s approach to cyber security is teetering dangerously close to authoritarianism

SAN MATEO, CA (PRWEB) February 02, 2015

Cloud security company Sookasa, Inc. has added a breakthrough capability to its portfolio of data encryption services, now allowing customers to securely receive documents from anyone, including non-users of Sookasa.

Sookasa provides seamless Dropbox encryption and facilitates HIPAA- and FERPA-compliant use of the cloud, enabling users to securely store, sync, and share confidential files. The companys new secure receipt capability joins the previously released secure sending feature to form Sookasas new File Delivery platformthe seminal one-way sharing suite designed to eliminate the need for high-risk email or clunky faxes to exchange information. Sookasa's encryption solution now addresses every step of the sharing process to ensure compliance.

Receiving information from clients has long posed a security challenge to businesses in regulated industries, said Asaf Cidon, CEO and co-founder of Sookasa. No matter how many precautions businesses take to secure and send data responsibly, their own customers can undermine these efforts by relying on easy modes of transferespecially emailwithout regard for security of their own data. We deliver file encryption on non-users termsthey dont need to have Sookasa or Dropbox to take advantage of both services.

For the first time, content can be automatically encrypted and delivered securely by non-users, with no download or setup required by the sender. Each Sookasa user has a unique secure receipt URL that they can share with others.

For example, if a patient needs to send sensitive health information to her doctor, she simply clicks the link provided by her physician and uploads the document. Its seamlessly encrypted by Sookasa, and the file is transferred directly to a secure subfolder in the Sookasa users account.

Don Murray, a criminal defense attorney and founding partner of New York firm Shalley & Murray, uses Sookasa to receive critical case documents from clients. Im thrilled to have Sookasas secure uploads capability, Murray said. Its become a competitive advantage with clients, allowing me to distinguish myself from other lawyers who dont care as much about security and still rely on email.

Jayson Hanelius, director of behavioral health agency Positive Services for Kids, said Sookasa's new feature has made sharing files and collaborating in a HIPAA-compliant environment easier. Its changed how we do thingswe used to rely completely on faxingand has made communicating much simpler, Hanelius noted. Electronic communication is vital to us, because were not actually meeting in a central location. With Sookasa, I have real-time insight into the work of my 28 clinicians who are out in the field seeing patients and sending me files.

The File Delivery suite, like the rest of Sookasas solutions, is geared toward putting the onus on technology to ensure effortless compliance.

This is a key tool for users who need to give their own customers confidence that their personal information is being protected, but without the inconvenience of making them find a way to secure the information on their end, Cidon said.

The rest is here:
Sookasa Launches a Cloud Encryption Capability that Lets Users Securely Receive Files from Anyone

Olympia, WA and Stamford, CT (PRWEB) February 02, 2015

Townsend Security, a leading authority in data privacy solutions, in conjunction with NetLib, a leader in data protection security software, today announced a partnership enabling a best practices approach to data protection. With Key Connection for Encryptionizer, Townsend Security customers are now able to deploy a no additional cost plugin application that enables Alliance Key Manager, the companys flagship encryption key manager to support NetLibs Encryptionizer for Microsoft SQL Server, a user and developer friendly tool that offers an easy and flexible environment enabling transparent whole database (TDE), column and file encryption, as well as a flexible API set.

The combined product supports Microsoft SQL Server Versions 2000 through 2014, Express through Enterprise editions.

Combined with Alliance Key Manager, NetLibs Encryptionizer secures distributed databases, files, and folders all the way down to the workstation or laptop supporting the physical, virtual and cloud environments.

Our customers have asked us for a FIPS 140-2 compliant solution that is easy-to-use and deploy, flexible architecture for encrypting whole databases, as well as files. We are proud to now support encryption key management for NetLibs Encryptionizer, said Patrick Townsend, Founder and CEO of Townsend Security.

FIPS 140-2 compliance is critical to businesses that fall in highly regulated industries (financial services, retail, healthcare, etc.) and need to meet compliance requirements. NetLibs Encryptionizer, paired with our Alliance Key Manager, offers enterprises a complete encryption solution that has been independently tested and is compliant with FIPS 140-2, continued Townsend.

Encryption key management is an increasingly important part of protecting your data, stated Neil Weicher, Founder and CTO, NetLib. NetLibs partnership with Townsend Security underscores the importance of just this by expanding our key management options to the Enterprise. We are pleased to be their trusted business partner in fighting the number one business issue today: data protection.

Key Connection for Encryptionizer, Alliance Key Manager, and Encryptionizer are all available for a no cost 30-day trial.

---

About Alliance Key Manager & Key Connection for Encryptionizer With Alliance Key Manager and Key Connection for Encryptionizer, organizations can meet compliance requirements in less time and at a lower cost by managing their NetLib Encryptionizer keys with a FIPS 140-2 compliant encryption key management solution. Additionally, the solutions supports encryption and decryption services so that the encryption key is always kept separate from the data it protects. Alliance Key Manager is available as a Hardware Security Module (HSM), VMware virtual machine, Cloud HSM, or in the Cloud (AWS and Microsoft Azure).

Read the rest here:
Alliance Key Manager Now Includes Support for NetLib’s Encryptionizer

How to use Hallaj Encryption file Plus

By: hallaj hack

More here:
How to use Hallaj Encryption file Plus - Video

Enigma V Encryption machine with $150 solution challenge
The most powerful of our Enigma Series of Encoders. 5 double sided gears can provide 7.2 billion different possible keys. Each gear has 37 teeth containing t...

By: dj51florida

Read more here:
Enigma V Encryption machine with $150 solution challenge - Video