technology:encryption

Emperor of the Internet — Shelly Palmer
▻http://www.shellypalmer.com/spb/2015/1/30/emperor-of-the-internet

“I am NoMan, Emperor of the Internet, Online Imperator and Lord of IPv6, Imperial ruler of the web, Grand King of the Ethernet, Keeper of the Royal Encryption Algorithms, Monarch of Virtual World. If I allow you to communicate with me, you will address me as, Your Majesty, the Heavenly Digital Sovereign.”

This had to be a hoax. The message continued...

“I am all powerful. No computer, no mobile phone, no device, nothing with an on/off switch is out of my reach...

When you are chosen, you will pay tribute to me in an amount equal to 2% of every online transaction, every online purchase, every online transfer of funds you make for the rest of your natural life. No transactions may be excluded. Ever.

In honor of your tribute, I grant you immunity from identity theft, cyber-attack, all cyber-weapons and protection against all other cyber-terrorists - for none are more powerful than I. If my conditions are met, I, as the beneficent Emperor that I am, will allow you to live a peaceful, tranquil, profitable digital life.

Should to choose to disobey me, I will give you three warnings. On the day of the third transgression, every aspect of your digital life will be destroyed. I will take 100 percent of your bank balance and leave you with no identity, no home, no transportation, no medical records, no financial records, no insurance, no data and no hope of ever recovering any of it. I will erase you from existence.

These are the rules. Do not test me. I am, NoMan. Pray that I favor you with my greatness.”

Pretty much everyone thought this was bit of technical magic performed by a disgruntled hacker with a sixth-grade sense of humor and delusions of grandeur. But after a few victims, it became clear that – not only was this not a hoax, it was the beginning of the end.

C’est comme ca qu’on vend son beurre quand on est conseiller de #sécurité. Pas mal.

The World’s Email Encryption Software Relies on One Guy, Who is Going Broke
▻http://www.propublica.org/article/the-worlds-email-encryption-software-relies-on-one-guy-who-is-going-brok

The man who built the free email encryption software used by whistleblower Edward Snowden, as well as hundreds of thousands of journalists, dissidents and security-minded people around the world, is running out of money to keep his project alive.

Werner Koch wrote the software, known as Gnu Privacy Guard, in 1997, and since then has been almost single-handedly keeping it alive with patches and updates from his home in Erkrath, Germany. Now 53, he is running out of money and patience with being underfunded.

#chiffrement

Safecracking the Brain - Issue 20: Creativity
▻http://nautil.us/issue/20/creativity/safecracking-the-brain-rp

http://static.nautil.us/1499_6490791e7abf6b29a381288cc23a8223.png

It’s hard to imagine an encryption machine more sophisticated than the human brain. This three-pound blob of tissue holds an estimated 86 billion neurons, cells that rapidly fire electrical pulses in split-second response to whatever stimuli our bodies encounter in the external environment. Each neuron, in turn, has thousands of spindly branches that reach out to nodes, called synapses, which transmit those electrical messages to other cells. Somehow the brain interprets this impossibly noisy code, allowing us to effectively respond to an ever-changing world. Given the complexity of the neural code, it’s not surprising that some neuroscientists are borrowing tricks from more experienced hackers: cryptographers, the puzzle-obsessed who draw on math, logic, and computer science to make (...)

“At the end of September 2014, a new threat for the #Linux operating system dubbed XOR.DDoS forming a botnet for distributed denial-of-service attacks was reported by the MalwareMustDie! group. The post mentioned the initial intrusion of SSH connection, static properties of related Linux executable and encryption methods used. Later, we realized that the installation process is customized to a victim’s Linux environment for the sake of running an additional #rootkit component. In this blog post, we will describe the installation steps, the rootkit itself, and the communication protocol for getting attack commands.”

▻https://blog.avast.com/2015/01/06/linux-ddos-trojan-hiding-itself-with-an-embedded-rootkit

#computer_security

“German researchers have discovered security flaws that could let hackers, spies and criminals listen to private phone calls and intercept text messages on a potentially massive scale – even when cellular networks are using the most advanced encryption now available.

The flaws, to be reported at a hacker conference in Hamburg this month, are the latest evidence of widespread insecurity on SS7, the global network that allows the world’s cellular carriers to route calls, texts and other services to each other.”

▻http://www.washingtonpost.com/blogs/the-switch/wp/2014/12/18/german-researchers-discover-a-flaw-that-could-let-anyone-listen-to-y

SS7 is indeed awfully broken but, unlike what happens on the Internet (where everyone knows about the weaknesses of BGP and DNS and work on it), the telco companies were, until now, successful in hiding the problem under the rug.

#SS7 #network_security

▻https://www.iab.org/2014/11/14/iab-statement-on-internet-confidentiality

IAB Statement on Internet Confidentiality

The #IAB now believes it is important for protocol designers, developers, and operators to make encryption the norm for Internet traffic.

#encryption #privacy

Some comments on the EU's draft Privacy Icons
▻http://hroy.eu/posts/encryptionEuDataIcons

http://hroy.eu/./posts/encryptionEuDataIcons/iconEncrypt.png

The European Union is currently reviewing the regulatory framework of personal data protection. In the current draft, a standardised icon set would be mandatory in some circumstances.

I’m not convinced this is the best implementation, and there’s even one icon in the set that I’m really concerned about: “Encryption”. This proposal could undermine years of activism in favour of better encryption for users.

As I’ve been working on Terms of Service; Didn’t Read for a couple of years now, I have some experience and idea about how this sort of things might work and how it compares to existing projects, especially in the fields of “Privacy Icons” where several projects coexist and keep raising much attention (including, it seems, from European legislators).

First, some context for those who haven’t (...)

email encryption downgrade attack :
ISPs that remove #STARTTLS flag and as a result break email encryption

▻https://www.eff.org/deeplinks/2014/11/starttls-downgrade-attacks

This type of STARTTLS stripping attack has mostly gone unnoticed because it tends to be applied to residential networks, where it is uncommon to run an email server

[...]

There are several weak points in the STARTTLS protocol, however. The first weakness is that the flag indicating that a server supports STARTTLS is not itself encrypted, and is therefore subject to tampering, which can prevent that server from establishing an encrypted connection. That type of tampering is exactly what we see today. EFF is working on a set of improvements to STARTTLS, called STARTTLS Everywhere, that will make server-to-server encryption more robust by requiring encryption for servers that are already known to support it.

RFC 3270 : SMTP Service Extension for Secure SMTP over Transport Layer Security
▻http://www.bortzmeyer.org/3207.html

#security
#TLS
#SMTP
#email

Secure messaging scorecard
A rather elaborate overview of all those messaging apps out there, presented in a scorecard so you can quickly check which tools actually keep your messages safe (+), and in what way.

▻https://www.eff.org/secure-messaging-scorecard

Most of the tools that are easy for the general public to use don’t rely on security best practices—including end-to-end encryption and open source code. Messaging tools that are really secure often aren’t easy to use; everyday users may have trouble installing the technology, verifying its authenticity, setting up an account, or may accidentally use it in ways that expose their communications.

[...]

The Secure Messaging Scorecard examines dozens of messaging technologies and rates each of them on a range of security best practices. Our campaign is focused on communication technologies — including chat clients, text messaging apps, email applications, and video calling technologies. These are the tools everyday users need to communicate with friends, family members, and colleagues, and we need secure solutions for them.

(+) Updated: Please also check the comments below and do not take that scorecard simply at face value, as the security community has some relevant criticism on it.

Old version : ►https://www.eff.org/node/82654

#privacy

Why encryption (unbreakable by the police) on the smartphone is necessary:

▻http://www.sfgate.com/crime/article/CHP-officer-charged-in-theft-of-women-s-cell-5861964.php

#privacy #security

New defensive publication from ownCloud: file syncing encryption
▻http://hroy.eu/posts/owncloud-encryption-defpub

Last month, I have worked with Björn Schießle on ownCloud’s first defensive publication. This one covers ownCloud’s encryption system.

The challenge is that ownCloud is a free software server for file syncing and file sharing, and you can connect it to different storage backends. However, you don’t necessarily want these storage providers to access data unencrypted.

Thus, being able to use encryption to protect user data is paramount, but not trivial. Users of local encryption tools such as GnuPG will know that.

Fortunately, ownCloud has offered an encryption system for more than a year.

The source of their defensive publication is available on Linux Defenders’ repositories. In order to make it, I started working from Björn’s blog post. It turns out that Björn already had documents describing (...)

Nine Epic Failures of Regulating Cryptography | Electronic Frontier Foundation
▻https://www.eff.org/deeplinks/2014/09/nine-epic-failures-regulating-cryptography

Recently Apple has announced that it is providing basic encryption on mobile devices that they cannot bypass, even in response to a request from law enforcement. Google has promised to take similar steps in the near future. Predictably, law enforcement has responded with howls of alarm. ...

PGP Encryption is Fundamentally Broken, Time for #PGP to Die, says Cryptography Expert Matthew Green
▻http://thehackernews.com/2014/08/cryptography-expert-pgp-encryption-is_19.html

According to Green, the solution of the problem is to stop plugging encryption software into today’s plaintext email systems, and instead build networks that are designed from the base level to protect messages from eavesdroppers. He suggested TextSecure and #DarkMail as potentially interesting projects that are looking forward to this direction.

#sécurité_informatique Cf. ▻http://seenthis.net/messages/281017

The Future of Birth Control ? Remote-Control Contraceptives | Alternet
▻http://www.alternet.org/sex-amp-relationships/future-birth-control-remote-control-contraceptives

The company is now working on securing the device’s data flow, so you can rest easy knowing your birth control prescription comes with encryption. In a report released last year, the FDA warned that wireless medical devices are susceptible to hacking:

“Many medical devices contain configurable embedded computer systems that can be vulnerable to cybersecurity breaches. In addition, as medical devices are increasingly interconnected, via the Internet, hospital networks, other medical device, and smartphones, there is an increased risk of cybersecurity breaches, which could affect how a medical device operates.”

Evidemment, côté sécurité on est tranquille, c’est la Fondation Bill and Melinda Gates qui finance...

Un chat chiffré

cameoNet
▻https://www.cameonet.de/w/en

Encrypted Easy and Secure to Use!

End-to-end encryption for all users!
OpenSource - 100% Transparent!
OpenSource - 100% Transparent!

No backdoors - open software.
On all Devices - At the Same Time!
On all Devices - At the Same Time!

Desktop/Tablet/Smartphone with one account.

▻https://github.com/memoConnect

6月8日のツイート
▻http://twilog.org/ChikuwaQ/date-140608

Top story: Google announces end-to-end encryption for Gmail (a big deal!) - Boi… boingboing.net/2014/06/04/goo…, see more tweetedtimes.com/ChikuwaQ posted at 02:20:39

Obfuscate #Tor traffic with pluggable transports - here is how they look on the wire:
▻https://trac.torproject.org/projects/tor/wiki/doc/AChildsGardenOfPluggableTransports #encryption #P2P

I love the #Bananaphone !

Laverna - store your notes anonymously and encrypted
►https://laverna.cc

evernote open source(Permalink)

#Encryption #Opensource #Synchro #notes

#Obama Lets #N.S.A. Exploit Some #Internet Flaws, Officials Say
▻http://www.nytimes.com/2014/04/13/us/politics/obama-lets-nsa-exploit-some-internet-flaws-officials-say.html

WASHINGTON — Stepping into a heated debate within the nation’s intelligence agencies, President Obama has decided that when the National Security Agency discovers major flaws in Internet security, it should — in most circumstances — reveal them to assure that they will be fixed, rather than keep mum so that the flaws can be used in espionage or cyberattacks, senior administration officials said Saturday.

But Mr. Obama carved a broad exception for “a clear national security or law enforcement need,” the officials said, a loophole that is likely to allow the N.S.A. to continue to exploit security flaws both to crack encryption on the Internet and to design cyberweapons.

#failles #surveillance

2014-04-12
▻http://hroy.eu/notes/openssl-11

Wall Street Journal: The encryption flaw that punctured the heart of the Internet this week underscores a weakness in Internet security: A good chunk of it is managed by four European coders and a former military consultant in Maryland.

To answer some of the astonishing comments I made yesterday, the lack of contributors to the project is baffling. So: the whole Internet relied on 10 volunteers and 1 employee and nobody helped them?

I guess this sort of comes back to one of the essential question in Free Software: how do you get the users to fund it? For some kind of software, this can be difficult; but in the case of OpenSSL I would have thought this to be an easy thing, since so many banks and web companies intensively rely on it.

But apparently, they didn’t care at all if this (...)

Jeremy Scahill and The War on Journalism
▻http://www.filmsforaction.org/watch/jeremy-scahill-and-the-war-on-journalism

In this video Luke Rudkowski talks with Jeremy Scahill about the NSA’s ability to penetrate all of our communications. The two discuss encryption techniques to ward off government surveillance and...

Crypto, security, comp-sci specialists speak out on NSA | Sputnik7
▻http://www.sputnik7.com/2014/01/25/crypto-security-comp-sci-specialists-speak-out-on-nsa

More than 50 big names in the fields of computer science, security, and cryptography [in the U.S.A.] have published an open letter calling for an end to the NSA’s controversial spying practices, including reported efforts to undermine encryption and network-security standards.

Parmis les idées clef : Z’avez bien évalué toutes les conséquences de combatre les méchants avec leur « éthique » ?

#vie_privée #NSA #surveillance #encryption #ecommerce

Encryption Works: How to Protect Your Privacy in the Age of NSA Surveillance | Freedom of the Press Foundation
▻https://pressfreedomfoundation.org/encryption-works

The NSA is the biggest, best funded spy agency the world has ever seen. They spend billions upon billions of dollars each year doing everything they can to vacuum up the digital communications of most humans on this planet that have access to the Internet and and the phone network. And as the recent reports in the Guardian and Washington Post show, even domestic American communications are not safe from their net.

Defending yourself against the NSA, or any other government intelligence agency, is not simple, and it’s not something that can be solved just by downloading an app. But thanks to the dedicated work of civilian cryptographers and the free and open source software community, it’s still possible to have privacy on the Internet, and the software to do it is freely available to everyone. This is especially important for journalists communicating with sources online.

#PGP #GPG #OTR #chiffrement

First the US cancels all science funding to Fermilab’s Tevatron and subsequently loses the Quest for the Holy Boson to the LHC, and now all of a sudden they have money to reignite advanced quantum research?

NSA seeks to build quantum computer that could crack most types of encryption - Steven Rich, Barton Gellman - Washington Post

According to documents provided by former NSA contractor Edward Snowden, the effort to build “a cryptologically useful quantum computer” — a machine exponentially faster than classical computers — is part of a $79.7 million research program titled “Penetrating Hard Targets.”

▻http://www.washingtonpost.com/world/national-security/nsa-seeks-to-build-quantum-computer-that-could-crack-most-types-of-encryption/2014/01/02/8fff297e-7195-11e3-8def-a33011492df2_story.html

#Penetrating_Hard_Targets
#surveillance
#Snowden
#LHC
#NSA
#quantum_computing

“TrackMeNot is a lightweight browser extension that helps protect web searchers from surveillance and data-profiling by search engines. It does so not by means of concealment or encryption (i.e. covering one’s tracks), but instead, paradoxically, by the opposite strategy: noise and obfuscation. [...] background process that periodically issues randomized search-queries to popular search engines, e.g., AOL, Yahoo!, Google, and Bing. It hides users’ actual search trails in a cloud of ’ghost’ queries, significantly increasing the difficulty of aggregating such data into accurate or identifying user profiles.”

▻http://www.cs.nyu.edu/trackmenot

Note that many network protocols have provisions to add random noise to defeat some types of privacy attacks but they are not always activated.

#privacy #google #PRISM #search_engines