Thank you

Your message has been sent.

There was an error emailing this page.

Google is asking developers to take over its effort to make end-to-end email encryption more user-friendly, raising questions over whether itll ever become an official feature in the companys browser.

On Friday, the search giant said its email encryption tool, originally announced in 2014, was no longer a Google product. Instead, its become a full community-driven open source project, the company said in a blog post.

The tool is designed to work as an extension to Googles Chrome browser that uses the OpenPGP standard to encrypt emails, ensuring that only the recipient can read themand not the email provider or a government.

The main goal of Googles project was to make OpenPGP easier to use. It was announced amid growing scrutiny over U.S. surveillance efforts following disclosures from noted leaker Edward Snowden.

However, the search giant hasnt made the extension officially available on its Chrome Web Store. Instead, the projects source code has only been made available on GitHub, a software collaboration site, making the extension harder to install, especially for non-technical users.

The GitHub page also hasnt been frequently updated, so its unclear how serious the search giant has been about the effort, or if others will take up the project.

Google didnt immediately respond to a request for comment. But the GitHub page is offering the source code to whats called E2EMail, a Chrome extension that works with Gmail. At this stage, we recommend you use it only for testing and UI feedback, the page says.

A screenshot of the E2EMail extension.

Back in Dec. 2014, Google also said that its end-to-end encryption tool still wasnt as usable as it needs to be, pointing to the problem of managing the public keys used in PGP encryption. Often, the keys necessary to exchange secure messages are held on a public server or sent via email, but the authenticity of the user providing them is never verified.

Last month, Google announced a separate open-source project, called Key Transparency, that tries to solve this problem. It essentially works as a lookup service for public keys. However, as a safeguard, all the logs can be audited to track for any suspicious activity.

In Fridays blog post, Google said the Key Transparency project was crucial to the development of its end-to-end email encryption efforts.

Key discovery and distribution lie at the heart of the usability challenges that OpenPGP implementations have faced, it said.

Although Googles email encryption tool is no longer a company-led product, Google is still hoping to integrate it with its Key Transparency project, according to the blog post.

In the midst of Googles effort, others are also developing new email encryption protocols, too. Last month, the developer behind Lavabit, an email service Edward Snowden used, released its own open-source encrypted email standard for surveillance-proof messaging.

Michael Kan covers security for IDG News Service.

Read more from the original source:
Google shifts on email encryption tool, leaving its fate unclear - PCWorld

The technology industry has hit back at proposed plans by France and Germany to force EU member states to backdoor encryption for the police.

Last week, Thomas de Maizire and Bruno Le Roux, respectively the German and French ministers of the interior, sent a letter to the European Commission calling for measures to stem what they see as a tide of terrorism sweeping the land.

These proposed measures include allowing the greater sharing of people's personal information between nations' police forces to fight crime; more reliance on biometrics; and depressingly predictable these days demands for technology companies to come up with impossible encryption systems that are secure, strong, and yet easily crackable by law enforcement on demand. The German-French letter [PDF] calls for new legislation, to implement these changes, to be considered in October, after both countries have had their national elections.

This isn't the first time the pair have called for such measures, but this time they received support from the European Commission. "Encryption technology should not prevent law enforcement agencies or other competent authorities from intervening in the lawful exercise of their functions," an EC spokesman said in response to the letter, according to Politico.

The remarks brought a swift bite back from the Computer & Communications Industry Association, the non-profit think tank that lobbies for the technology industry. Christian Borggreen, its director of international policy in Brussels, slammed the idea as counterproductive late last week.

"Any backdoors to encrypted data would pose serious risks to the overall security and confidentiality of Europeans' communications, which seems inconsistent with existing legal protections for personal data," he said.

"Weakened security ultimately leaves online systems more vulnerable to all types of attacks, from terrorists to hackers. This should be a time to increase security not weaken it."

It looks as though the encryption wars have moved to Europe. For years now in the US, the FBI and others have been banging on about the need for crimefighters to have secret backdoors into encryption, or even a front door, as the director of the Feds likes to call it.

There may be British readers who are feeling rather smug about this latest European proposal, and think that Brexit UK will be immune from such silliness. Not so Blighty already has legislation that paves the way for mandatory backdoored encryption, it just hasn't worked out how to force the issue yet.

As has been pointed out many times, it isn't mathematically or technologically possible to build a backdoor into encryption that is completely exclusive to a select set of people, and can't be found and exploited by others. The only way under today's technology would be to have a key escrow system, and that would fall down if someone with access to the keys were to be bribed or coerced into handing them over.

Continued here:
Germany, France lobby hard for terror-busting encryption backdoors Europe seems to agree - The Register

Security researchers have achieved the first real-world collision attack against the SHA-1 hash function, producing two different PDF files with the same SHA-1 signature. This shows that the algorithm's use for security-sensitive functions should be discontinued as soon as possible.

SHA-1 (Secure Hash Algorithm 1) dates back to 1995 and has been known to be vulnerable to theoretical attacks since 2005. The U.S. National Institute of Standards and Technology has banned the use of SHA-1 by U.S. federal agencies since 2010, and digital certificate authorities have not been allowed to issue SHA-1-signed certificates since Jan. 1, 2016, although some exemptions have been made.

However, despite these efforts to phase out the use of SHA-1 in some areas, the algorithm is still fairly widely used to validate credit card transactions, electronic documents, email PGP/GPG signatures, open-source software repositories, backups and software updates.

A hash function such as SHA-1 is used to calculate an alphanumeric string that serves as the cryptographic representation of a file or a piece of data. This is called a digest and can serve as a digital signature. It is supposed to be unique and non-reversible.

If a weakness is found in a hash function that allows for two files to have the same digest, the function is considered cryptographically broken, because digital fingerprints generated with it can be forged and cannot be trusted. Attackers could, for example, create a rogue software update that would be accepted and executed by an update mechanism that validates updates by checking digital signatures.

In 2012, cryptographers estimated that a practical attack against SHA-1 would cost $700,000 using commercial cloud computing services by 2015 and $173,000 by 2018. However, in 2015, a group of researchers from Centrum Wiskunde and Informatica (CWI) in the Netherlands, Nanyang Technological University (NTU) in Singapore and Inria in France devised a new way to break SHA-1 that they believed would significantly lower the cost of attacks.

Since then, the CWI researchers have worked with Google, using the company's massive computing infrastructure, to put their attack into practice and achieve a practical collision. It took nine quintillion SHA-1 computations, but they succeeded.

According to Google, it was one of the largest computations ever completed: the equivalent processing power of 6,500 years of single-CPU computations and 110 years of single-GPU computations. It was performed on the same infrastructure that powers Alphabet's AlphaGo artificial intelligence program and services like Google Photo and Google Cloud.

Does this mean that achieving SHA-1 collisions is now within the grasp of most attackers? No, but it's certainly within the capabilities of nation-states. In less than three months, the researchers plan to release the code that made their attack possible so other researchers can learn from it.

"Moving forward, its more urgent than ever for security practitioners to migrate to safer cryptographic hashes such as SHA-256 and SHA-3," Google said in a blog post Thursday. "In order to prevent this attack from active use, weve added protections for Gmail and GSuite users that detects our PDF collision technique. Furthermore, we are providing a free detection system to the public."

Starting with version 56, released this month, Google Chrome will mark all SHA-1-signed HTTPS certificates as unsafe. Other major browser vendors plan to do the same.

"Hopefully these new efforts of Google of making a real-world attack possible will lead to vendors and infrastructure managers quickly removing SHA-1 from their products and configurations as, despite it being a deprecated algorithm, some vendors still sell products that do not support more modern hashing algorithms or charge an extra cost to do so," saidDavid Chismon, senior security consultant at MWR InfoSecurity. "Whether this happens before malicious actors are able to exploit the issue for their benefit remains to be seen."

More information about the attack, which has been dubbed SHAttered, is available on a dedicated website and ina research paper.

Excerpt from:
Stop using SHA1 encryption: It's now completely unsafe, Google proves - PCWorld