« First...102030...2,3642,3652,3662,3672,368...2,3802,3902,400...Last »

NSA spying is here to stay

Posted on by

The 3 billion phone calls made in the US each day are snatched up by NSA, which stores each call's metadata for five years.

On Monday, April 14, the Washington Post and the Guardian newspapers received the Pulitzer for Journalism Public Service for their reports on NSA spying. In light of their hard work, let's recap events of the last year.

Embarrassed and irritated by Edward Snowden's leaks, Obama charged last year at a press conference that Snowden was presenting a false picture of NSA by releasing parts of its work piecemeal: "Rather than have a trunk come out here and a leg come out there," he said, "let's just put the whole elephant out there so people know exactly what they're looking at. ... America is not interested in spying on ordinary people," he assured us. The government, he went on, is not "listening in on people's phone calls or inappropriately reading people's emails."

Six days later, a Washington Post headline declared: "NSA broke privacy rules thousands of times per year." In an internal audit in May 2012 of its DC-area spy centers, the agency itself found 2,776 "incidences" of NSA overstepping its legal authority. As the American Civil Liberties Union noted, surveillance laws themselves "are extraordinarily permissive," so it's doubly troubling that the agency is surging way past what it is already allowed to do. The ACLU adds that these reported incidents are not simply cases of one person's rights being violated but thousands of Americans being snared, totally without cause, in the NSA's indiscriminate, computer-driven dragnet.

The agency's surveillance net stretches so wide that it is inherently abusive, even though its legal authority to spy on Americans is quite limited. US Rep. James Sensenbrenner, the sponsor of the PATRIOT Act (which NSA cites as its super-vac authority), said that Congress intended that it should apply only to cases directly tied to national security investigations. No lawmaker, he said, meant that government snoops should be able to conduct a wholesale grab of Americans' phone, email and other personal records and then store them in huge databases to be searched at will.

Yet look at what NSA has become:

The three billion phone calls made in the US each day are snatched up by the agency, which stores each call's metadata (phone numbers of the parties, date and time, length of call, etc.) for five years.

Each day telecom giants turn over metadata on every call they have processed.

Every out-of-country call and email from (or to) a US citizen is grabbed by NSA computers, and agents are authorized to listen to or read any of them.

The agency searches for and seizes nearly everything we do on the Internet. Without bothering with the constitutional nicety of obtaining a warrant, its XKeyscore program scoops up some 40 billion Internet records every month and adds them to its digital storehouse, including our emails, Google searches, websites visited, Microsoft Word documents sent, etc. NSA's annual budget includes a quarter-billion dollars for "corporate-partner access" i.e., payments to obtain this mass of material from corporate computers.

Continue reading here:
NSA spying is here to stay

Lavaboom builds encrypted webmail service to resist snooping

Posted on by

A new webmail service called Lavaboom promises to provide easy-to-use email encryption without ever learning its users private encryption keys or message contents.

Lavaboom, based in Germany and founded by Felix Mller-Irion, is named after Lavabit, the now defunct encrypted email provider believed to have been used by former NSA contractor Edward Snowden. Lavabit decided to shut down its operations in August in response to a U.S. government request for its SSL private key that would have allowed the government to decrypt all user emails.

Lavaboom designed its system for end-to-end encryption, meaning that only users will be in possession of the secret keys needed to decrypt the messages they receive from others. The service will only act as a carrier for already encrypted emails.

Lavaboom calls this feature zero-knowledge privacy and implemented it in a way that allows emails to be encrypted and decrypted locally using JavaScript code inside users browsers instead of its own servers.

The goal of this implementation is to protect against upstream interception of email traffic as it travels over the Internet and to prevent Lavaboom to produce plaintext emails or encryption keys if the government requests them. While this would protect against some passive data collection efforts by intelligence agencies like the NSA, it probably wont protect against other attack techniques and exploits that such agencies have at their disposal to obtain data from computers and browsers after it was decrypted.

Security researchers have yet to weigh in on the strength of Lavabooms implementation. The service said on its website that it considers making parts of the code open source and that it has a small budget for security audits if any researchers are interested.

Those interested in trying out the service can request to be included in its beta testing period, scheduled to start in about two weeks.

Free Lavaboom accounts will come with 250MB of storage space and will use two-way authentication based on the public-private keypair and a password. A premium subscription will cost 8 (around US$11) per month and will provide users with 1GB of storage space and a three-factor authentication option.

In addition to your key-pair and password we can either send you a randomly generated code or you can use the OTP-feature of a YubiKey. Or even both. We strongly recommend using YubiKey, Lavaboom said on its website.

The service uses the popular OpenPGP email encryption standard thats based on public-key cryptography. Each user will have a public and a private key that will form a keypair. The public key will be advertised publicly and will be used by other users to encrypt messages sent to the key owner and the key owner will then use his private key to decrypt those messages.

Read the rest here:
Lavaboom builds encrypted webmail service to resist snooping

Snowden’s Email Provider Loses Appeal Over Encryption Keys

Posted on by

Lavabit founder Ladar Levison. Image: Gage Skidmore/Flickr

A federal appeals court has upheld a contempt citation against the founder of the defunct secure e-mail company Lavabit, finding that the weighty internet privacy issues he raised on appeal should have been brought up earlier in the legal process.

The decision disposes of a closely watched privacy case on a technicality, without ruling one way or the other on the substantial issue: whether an internet company can be compelled to turn over the master encryption keys for its entire system to facilitate court-approved surveillance on a single user.

The case began in June, when Texas-based Lavabit was served with a pen register order requiring it to give the government a live feed of the email activity on a particular account. The feed would include metadata like the from and to lines on every message, and the IP addresses used to access the mailbox.

Because pen register orders provide only metadata, they can be obtained without probable cause that the target has committed a crime. But in this case the court filings suggest strongly that the target was indicted NSA leaker Edward Snowden, Lavabits most famous user.

Levison resisted the order on the grounds that he couldnt comply without reprogramming the elaborate encryption system hed built to protect his users privacy. He eventually relented and offered to gather up the email metadata and transmit it to the government after 60 days. Later he offered to engineer a faster solution. But by then, weeks had passed, and the FBI was determined to get what it wanted directly and in real time.

So in July the government served Levison with a search warrant striking at the Achilles heel of his system: the private SSL key that would allow the FBI to decrypt traffic to and from the site, and collect Snowdens metadata directly. The government promised it wouldnt use the key to spy on Lavabits other 400,000 users, which the key would technically enable them to do.

Levison turned over the keys as a nearly illegible computer printout in 4-point type. In early August, Hilton who once served on the top-secret FISA court ordered Levison to provide the keys instead in the industry-standard electronic format, and began fining him $5,000 a day for noncompliance.

After two days, Levison complied, but then immediately shuttered Lavabit altogether.

Levison appealed the contempt order to the 4th Circuit, and civil rights groups, including the ACLU and the EFF, filed briefs in support of his position.

Read the original here:
Snowden’s Email Provider Loses Appeal Over Encryption Keys

Coverity finds open source software quality better than proprietary code

Posted on by

Summary: Coverity, a company specializing in software quality and security testing solutions, finds that open source programs tend to have fewer errors than proprietary programs.

The irony isn't lost on me: Coverity, a a company specializing in software quality and security testing solution, has found that open source software has fewer defects in its code than proprietary programs in the aftermath of open-source OpenSSL Heartbleed programming fiasco. Nevertheless, the numbers don't lie and the 2013 Coverity Scan Open Source Report (PDF Link) found that open source had fewer errors per thousand lines of code (KLoC) than proprietary software.

The Coverity Scan service, which the study was based on, was started with the US Department of Homeland Security in 2006. The project was designed to give hard answers to questions about open source software quality and security.

For this latest Coverity Scan Report, the company analyzed code from more than 750 open source C/C++ projects as well as an anonymous sample of enterprise projects. In addition, the report highlights analysis results from several popular, open source Java projects that have joined the Scan service since March 2013. Specifically, the company scanned the code of C/C++ programs, such as NetBSD, FreeBSD, LibreOffice, and Linux, and Java projects such as Apache Hadoop, HBase, and Cassandra.

The 2013 report's key findings included:

Zack Samocha, senior director of products for Coverity, said in a statement, "Our objective with the Coverity Scan service is to help the open source community create high-quality software. Based on the results of this report as well as the increasing popularity of the service open source software projects that leverage development testing continue to increase the quality of their software, such that they have raised the bar for the entire industry."

Coverity also announced that it has opened up access to the Coverity Scan service, allowing anyone interested in open source software to view the progress of participating projects. Individuals can now become Project Observers, which enables them to track the state of relevant open source projects in the Scan service and view high-level data including the count of outstanding defects, fixed defects, and defect density.

"Weve seen an exponential increase in the number of people who have asked to join the Coverity Scan service, simply to monitor the defects being found and fixed. In many cases, these people work for large enterprise organizations that utilize open source software within their commercial projects," concluded Samocha. "By opening up the Scan service to these individuals, we are now enabling a new level of visibility into the code quality of the open-source projects, which they are including in their software supply chain."

Related Stories:

Go here to read the rest:
Coverity finds open source software quality better than proprietary code

Plant Breeders Release First ‘Open Source Seeds’

Posted on by

hide captionBackers of the new Open Source Seed Initiative will pass out 29 new varieties of fourteen different crops, including broccoli, carrots and kale on Thursday.

Backers of the new Open Source Seed Initiative will pass out 29 new varieties of fourteen different crops, including broccoli, carrots and kale on Thursday.

A group of scientists and food activists is launching a campaign Thursday to change the rules that govern seeds. They're releasing 29 new varieties of crops under a new "open source pledge" that's intended to safeguard the ability of farmers, gardeners, and plant breeders to share those seeds freely.

It's inspired by the example of open source software, which is freely available for anyone to use, but cannot legally be converted into anyone's proprietary product.

At an event on the campus of the University of Wisconsin-Madison, backers of the new Open Source Seed Initiative will pass out 29 new varieties of fourteen different crops, including carrots, kale, broccoli and quinoa. Anyone receiving the seeds must pledge not to restrict their use by means of patents, licenses or any other kind of intellectual property. In fact, any future plant that's derived from these open source seeds also has to remain freely available as well.

Irwin Goldman, a vegetable breeder at the University of Wisconsin-Madison, helped organize the campaign. It's an attempt to restore the practice of open sharing that was the rule among plant breeders when he entered the profession more than 20 years ago.

"If other breeders asked for our materials, we would send them a packet of seed, and they would do the same for us," he says. "That was a wonderful way to work, and that way of working is no longer with us."

These days, seeds are intellectual property. Some are patented as inventions. You need permission from the patent holder to use them, and you're not supposed to harvest seeds for replanting the next year.

Even university breeders operate under these rules. When Goldwin creates a new variety of onions, carrots or table beets, a technology-transfer arm of the university licenses it to seed companies.

This brings in money that helps pay for Goldman's work, but he still doesn't like the consequences of restricting access to plant genes what he calls germplasm. "If we don't share germplasm and freely exchange it, then we will limit our ability to improve the crop," he says.

View post:
Plant Breeders Release First 'Open Source Seeds'


« First...102030...2,3642,3652,3662,3672,368...2,3802,3902,400...Last »