« First...102030...1,9761,9771,9781,9791,980...1,9902,0002,010...Last »

Private I: Encrypting email with public keys

Posted on by

In recent weeks, Ive written about protecting data stored locally on a hard drive, against both people with physical access and potential remote attacks. But your data is much more vulnerable in transit, as it passes between end points or via servers.

This problem is effectively solved for instant messages with iMessage, which uses strong end-to-end encryption designed in such a way thatApple saysnot even they can decrypt your messages. This is accomplished by creating local encryption keys through a process that cant be reverse-engineered on their side. Even though iMessages pass through intermediate points on the Internet, theres no opportunity for others to grab the plain text, images, and audio within. (The same is true with FaceTime audio and video.)

But its still a mess for email, whether Mail in iOS or OS X, or third-party email software. The problem arises from email protocols working too well. Yes, I know how that sounds, as Apples Mail app frustrates on both its platforms. But the diversity of what you can choose among native and Web apps has to do with no company or organization controlling how email works. iMessage is entirely Apples ecosystem, which is the case for most messaging systems, including Facebooks WhatsApp and the messaging component of Microsofts Skype. In contrast, there are thousands of native email programs across all platforms and all time, and hundreds remain in wide use.

The email protocols comprise POP3 (ancient and still in use) and IMAP for email retrieval and synchronization, while SMTP handles sending. Because they emerged from the dawn of Internet, they have evolved in fits and starts with weird vestigial pieces. Email continues to function because of compromises and a tacit agreement that nobody can break or refuse to support major componentspartly because no one controls a big enough piece to force change.

One of the biggest problems past and present in Apples Mail.app is, in fact, because Google has an odd setup for its IMAP service, and Apple dances around fully embracing it. Google cant break IMAP entirely, because then millions of users who pull in Gmail messages through Outlook or other software would be out in the cold, and potentially switch away. (Android has three separate email apps, in fact: two that work with Gmail in different ways, and third for regular email accounts.) Likewise, Apple cant invent a new, superior way to send email because every mail server in the world would need to be updated to receive it.

In the last few years, enough standardization and upgrading have taken place that one aspect is well secured: the connection between an email client and an email server. Email flows from a client to a server run by your ISP or company or email host, and from there typically directly to the recipients corresponding email server. By default, Apples mail clients and those of other companies try to set up a new account to use SSL/TLS, the same session-based encryption technology used for secure Web interactions.

But SSL/TLS protects just the link between an email client and an email server. The data is encrypted in transit for that session, and then decrypted at the server, before being packaged and sent on to the next server. Now, in practice, even thats becoming more secure. Most email serversall of those run by major companiesare in data centers. And after the Edward Snowden disclosure, Google and other companies have stepped up the security of links among their own data centers.

The weak points still remain when email is decrypted, whether its for microseconds on a server before being wrapped up to send to another server over an encrypted link, or for much longer, when a server communicates insecurelywhich is typicalwith another email server. At those weak points, a criminal or government agent could gain access.

iMessage suffers from none of these weaknesses because of its strong end-to-end encryption. So how can we achieve the same in email? Through the use of public-key (PK) cryptography, something thats been available for encrypting documents and email messages since 1991 in one form or another. A decade ago, I reviewed an updated and well-designed commercial version of PGP (originally standing for Pretty Good Privacy) in Macworld, and hoped it would usher in a new age of encrypted email. I guess Im a pretty optimistic fellow.

Still, hope springs eternal, and I think were ripe for another pass at PK becoming something that could be used readily and safely, rather than by those with command-line facility. Let me first explain public-key cryptography briefly. In the next column, Ill explain how to use it practicallyon a Mac at least.

See the original post:
Private I: Encrypting email with public keys

Hormone therapy treatment behind bars

Posted on by

SYRACUSE -- After seeing the reaction the Chelsea Manning story got on our Facebook page, we reached out to the Justice Department in Syracuse. We wanted to see how the Justice Department would deal with inmates if one was in a similar situation to Chelsea Manning.

The corrections department says at any given time there are 50 inmates who are going through hormone therapy treatment across the state.

Before being approved for treatment inmates must first be diagnosed with Gender Dysphoria by a doctor, just like they would with any other medical condition or disorder.

If it is determined that hormones are needed they will be prescribed and paid for by the Department of Corrections, which in turn is funded by you, the tax payer.

Esteban Gonzales, of the Onondaga County Justice Center, has the responsibility to make sure these inmates are physically safe, even inmates like former Fort Drum Soldier Chelsea Manning, who is in the process of becoming a woman.

Gonzalessays, We are responsible for their care, custody and control. That includes safety and medical treatments.

The Department of Corrections doesn't have a specific price for how much this treatment can cost. It's really the concept that even one penny of tax payers money is going toward this.

Gonzales says, Some people already commit crimes to get a warm place to stay and a few meals. So could the Chelsea Manning story encourage others to try to get locked up just to go through this therapy and have you pay for it? He says Does that happen? Yes. Can I give you specific statistics for here? No, but we would be nave to think it doesnt occur.

See the original post here:
Hormone therapy treatment behind bars

NSA Trojan Firmware Widespread, U.S. International Tech Reputation May Suffer. Tech Privacy has Been a Myth.

Posted on by

MARKET UPDATETodays AM fix was 1,221.75 USD, 1,072.56 EUR and 793.86 GBP per ounce. Yesterdays AM fix was USD 1,233.50, EUR 1,81.12 and GBP 801.91 per ounce.

The U.S. market was closed yesterday for a national holiday.

New NSA spying scandal emerges, highlighting the scale of cyber wars

- Agency can access hard-drives made by major U.S. producers

- Computers in over 30 countries, including NATO allies, were hacked

- Iran and Russia were main targets

- Revelations may impact technology sector in the U.S. as institutions around the world seek alternatives

Kaspersky Lab, the Moscow-based cyber security firm whose report into international hacking was previewed by the New York Times Yesterday, has exposed that the NSA has had the capacity to snoop on most U.S.-made computers since 2001.

The report claims that the NSA attained access to firmware code from all the major Western computer manufacturers which runs every time a computer is switched on and figured out how to lodge malicious software in the code.

The terminology may be foreign to you but imagine if you will what your world would be like if the digital records of your wealth and property titles simply vanished or became corrupted. Imagine the screen just going dark. It sounds alarmist but that is exactly the sum total of the high stakes games now being played out by the worlds superpowers you and I are the pawns.

Visit link:
NSA Trojan Firmware Widespread, U.S. International Tech Reputation May Suffer. Tech Privacy has Been a Myth.

NSA ‘Equation’ Fallout: Experts Say Damage To US Tech Firms Could Top $180B

Posted on by

Revelations that the National Security Agency implanted spyware into hard drives sold by top American tech manufacturers stand to further damage the international sales of those vendors and further degrade the U.S. government's diplomatic relations with countries, many already stinging from previous NSA spying programs, abroad.

This is yet another instance that has led to building this viewpoint that the U.S. government and U.S. companies cannot be trusted, and whether that is correct or not, its harder and harder to combat that idea, said Jake Laperruque, the Center for Democracy & Technologys fellow on Privacy, Surveillance and Security. Thats going to cause problems for U.S. businesses.

The spyware, which has been dubbed Equation, was discovered by Kaspersky Lab, a Russian security software maker that over the past few years has built a reputation for uncovering American cyberespionage operations. Kaspersky Lab revealed the operation late Monday evening.

It is strongly believed that the NSA isbehind Equation and has been building spyware directly into the firmware of hard drives sold by companies like Western Digital, Seagate Technology, Micron Technology and many others since 2001. That spyware was then used to monitor the computer activities of top foreign targets in countries like Iran, Russia, Pakistan, Afghanistan, China and others, according to Reuters.

Short of something major like Congressional action, its going to be hard to break that narrative that we cant be trusted, said Laperruque. The trust has been withered away so significantly.

Since the revelation of PRISM in 2013, countless cyberespionage operations have been tied to the NSA, damaging the U.S. governments relationships around the globe. Equation is the latest example of that and the "icing on Snowden's cake," saidIgor Baikalov, chief scientist at Securonix, asecurity analytics and intelligence firm.

"While Kaspersky stopped short of attributing 'Equation Group' activities to any specific entity, the list of clues discovered and especially the list of targets leaves little doubt that eventually it will be tied to NSA," Baikalov said. "The question is: does the U.S. government care anymore?"

Since whistleblower Edward Snowden came out two years ago with revelations of widespread cyberespionage by the NSA, American businesses have been negatively impacted as countries around the globe lose their trust U.S.-made tech. Qualcomm, IBM, Microsoft and Hewlett-Packard have been among companies whove reporteddiminished sales in Chinaas a result. In Brazil, Boeing missed out on a$4.5 billion jet contractdue to the NSAs activities. The total damage to American tech businesses could amount to as much as $180 billion, according to an estimate byForrester Research's James Staten.

This will most certainly have a long-term impact on the brands of the companies involved -- Seagate, Toshiba, and Western Digital -- at the very least tainting their products as suspicious, said Jim Gregory, chairman ofTenet, a brand innovation and marketing firm. Their corporate brand will be impacted and the damage will last from three to five years depending on how actively they manage the crisis.

As for companies that are concerned with what Equation could mean for their own computer systems, there really isnt much that can be done other than having an expert go through their computer system code and manually ensure there is no spyware installed. "One cannot simply install any antivirus product off the shelf and expect to be fully protected, even if you have Kaspersky," said Brett Fernicola, chief information security officer for STEALTHbits Technologies, a provider of data security solutions.

See the original post here:
NSA ‘Equation’ Fallout: Experts Say Damage To US Tech Firms Could Top $180B

Encryption Can Create Stormy Weather in the Cloud

Posted on by

By John P. Mello Jr. 02/17/15 5:00 AM PT

Encryption has received a lot of attention lately as a solution to the growing data breach problem, but one of the hang-ups dogging the technology has been its ability to play nice in the cloud.

That's especially true if an organization wants to control the keys by which its data is scrambled and use services offered by a cloud provider beyond simple storage.

For example, if a cloud provider can't decrypt a client's data, it could break the provider's antivirus, data loss prevention, file preview and text indexing functions, as well as pose performance challenges.

"If the cloud provider can't decrypt your data, the cloud just becomes a dumb bucket," Adrian Sanabria, a senior analyst with the enterprise security practice at The 451 Group, told TechNewsWorld.

That's why cloud service providers in the past have had access to users' data encryption keys. As long as a user trusted their provider, that approach was acceptable, but that's no longer the case for many organizations.

Compliance with regulations requires some businesses to control the keys by which they encrypt their data. Other organizations just don't want to lose control of their information.

However, if an organization wants to use a cloud provider's services, it can allow a provider to access its keys. "Encryption still takes place in the cloud, but it's done with keys managed by the customer," Todd Partridge, director of product marketing at Intralinks, told TechNewsWorld.

From a security perspective, though, that solution is imperfect. A rogue employee of the cloud provider could abuse those key privileges to peek at, or leak a customer's data. The solution also opens the door for lawyers or government authorities to snatch the data.

Those authorities usually obtain data from a provider through a civil or criminal subpoena. As long as there isn't a gag order attached to the subpoena -- a rare occurrence except in national security cases -- a customer with control of its encryption keys has a chance to protect their data.

Read more:
Encryption Can Create Stormy Weather in the Cloud

Obama hedges position on encryption. It’s good. It’s bad.

Posted on by

President Barack Obama is making his position on encryption known: he is a supporter and "believer in strong encryption" but also "sympathetic" to law enforcement's needs to prevent terror attacks.

"I think the only concern is... our law enforcement is expected to stop every plot. Every attack. Any bomb on a plane. The first time that attack takes place, where it turns out we had a lead and couldn't follow up on it, the public's going to demand answers. This is a public conversation that we should be having," Obama said in a Friday interview with Re/Code. "I lean probably further in the direction of strong encryption than some do inside law enforcement. But I am sympathetic to law enforcement, because I know the kind of pressure they're under to keep us safe. And it's not as black and white as it's sometimes portrayed. Now, in fairness, I think those in favor of air tight encryption also want to be protected from terrorists."

Encryption became a hot-button topic in the wake of the summer 2013 leaks by National Security Agency whistleblower Edward Snowden. His documents, including some seemingly showing that Skype has a backdoor, highlighted a broad online global surveillance society and set off a cottage industry of encryption companies.

Both the FBI and the Justice Department are demanding that companieslike Apple and Google that are beginning to outfit mobile phone devices with encryption by defaultshould build backdoors to allow law enforcement access. Without a backdoor, the encryptionlikely prevents authorities from physically accessing contents directly from the phones' hardware, even with a warrant.

The chief executive isn't faulting companies for building encrypted tools. "I think they are properly responding to a market demand." But the president, his second remarks on the topic in a month, said "we can't pretend" that there's not a tradeoff between civil liberties and safety.

One of the interesting things about being in this job, is that it does give you a bird's-eye view. You are smack dab in the middle of these tensions that exist. But, there are times where folks who see this through a civil liberties or privacy lens reject that there's any tradeoffs involved. And, in fact, there are. And you've got to own the fact that it may be that we want to value privacy and civil liberties far more than we do the safety issues. But we can't pretend that there are no tradeoffs whatsoever.

US-based companies are not required to provide the government with backdoors into their wares. The law surrounding this issue is the Communications Assistance for Law Enforcement Act of 1994, commonly referred to as CALEA. It requires that telcos make their phone networks amenable to wiretaps, but it doesnt apply to phone hardware or most other communication services.

With British Prime Minister David Cameron at his side, the president last monthsaid:

If we find evidence of a terrorist plot and despite having a phone number, despite having a social media address or e-mail address, we cant penetrate that, thats a problem, Obama said.

Silicon Valley companies, he said, will help solve the problem because "theyre patriots."

Follow this link:
Obama hedges position on encryption. It’s good. It’s bad.

Web standard promising faster page loads wins approval

Posted on by

HTTP 2.0 is the standard's first new version in 16 years. In practice, the new standard will bring more privacy-protection encryption to the Web, too.

Newly approved web standard promises faster page loads.

A new version of the HTTP standard that promises to deliver Web pages to browsers faster has been formally approved, the Internet protocol's first revision in 16 years.

The specifications for HTTP 2.0 have been formally approved, according to a blog post by Mark Nottingham, who as chairman of the IETF HTTPBIS Working Group serves as the standard effort's leader. The specifications will go through a last formality -- the Request for Comment documenting and editorial processes -- then be published, Nottingham wrote.

HTTP, short for Hypertext Transfer Protocol, is one of the seminal standards of the Web. It governs how a browser communicates with a Web server to load a Web page. HTTP 2.0, the protocol's first major revision since HTTP 1.1 in 1999, is designed to load Web pages faster, allowing consumers to read more pages, buy more things and perform more and faster Internet searches.

The new standard is based on SPDY, a protocol Google introduced in 2009. The technology spread to Google's own Chrome browser, Mozilla's Firefox, Microsoft's Internet Explorer, many websites such as Facebook that they reach, and the some of the software that delivers Web pages to browsers.

The core feature of SPDY and HTTP 2.0 is "multiplexing," which lets many data-transfer requests share a single underlying network connection between a Web browser and the Web server across the Internet. In terms of computing resources, those requests are costly to set up, and Web pages have been demanding more and more over the years as the Web has grown more complex.

In practice, HTTP 2.0 also brings another big change: encryption. Google has long pushed for encryption on the Web to protect privacy and cut down on hacking vulnerabilities, and SPDY requires encryption technology called TLS (Transport Layer Security), formerly called SSL for Secure Sockets. That encryption push grew a lot stronger after the former National Security Agency contractor Edward Snowden revealed extensive government surveillance, and SPDY's creators along with some IETF saw the performance benefits of HTTP 2.0 as a good way to coax more of the Web toward encryption.

There's also a practical reason for encryption in HTTP 2.0: it makes it easier to adopt a new version of HTTP. That's because it sets up a direct connection between the Web server origin and the Web browser destination, and that direct connection sidesteps problems from intermediate network equipment that might not yet support HTTP.

However, some IETF members -- notably some of those that make or operate that intermediate equipment -- didn't like the encryption requirement. Thus, the IETF didn't require it as part of the HTTP 2.0 standard. However, in practice, encryption is very likely, because Firefox and Chrome won't support HTTP 2.0 without encryption.

See original here:
Web standard promising faster page loads wins approval


« First...102030...1,9761,9771,9781,9791,980...1,9902,0002,010...Last »