technology:encryption

  • Don’t Panic, You Can Boot Linux on Apple’s New Devices
    https://www.omgubuntu.co.uk/2018/11/apple-t2-chip-cant-boot-linux

    Does Apple stop Linux from booting on its newly refreshed Mac Mini PC or MacBookAir laptops? That’s the claim currently circling the web’s collective drain, with posts stating that the new T2 ‘secure enclave’ chip Apple has baked in to its new models (to help to beef up device security, encryption, manage touch ID, and ensure the microphone […] This post, Don’t Panic, You Can Boot Linux on Apple’s New Devices, was written by Joey Sneddon and first appeared on OMG! Ubuntu!.

  • The default #OpenSSH #key #encryption is worse than plaintext
    https://latacora.micro.blog/2018/08/03/the-default-openssh.html

    That’s a fair argument to say that standard password-encrypted keys are about as good as plaintext: the encryption is ineffective. But I made a stronger statement: it’s worse.

    How do you fix this? OpenSSH has a new key format that you should use. “New” means 2013. This format uses bcrypt_pbkdf, which is essentially bcrypt with fixed difficulty, operated in a PBKDF2 construction. Conveniently, you always get the new format when generating Ed25519 keys, because the old SSH key format doesn’t support newer key types. That’s a weird argument: you don’t really need your key format to define how Ed25519 serialization works since Ed25519 itself already defines how serialization works. But if that’s how we get good KDFs, that’s not the pedantic hill I want to die on. Hence, one answer is ssh-keygen -t ed25519. If, for compatibility reasons, you need to stick to RSA, you can use ssh-keygen -o. That will produce the new format, even for old key types. You can upgrade existing keys with ssh-keygen -p -o -f PRIVATEKEY . If your keys live on a Yubikey or a smart card, you don’t have this problem either.

  • #cryptoeconomics is THE revolution !
    https://hackernoon.com/cryptoeconomics-is-the-revolution-6fd7de8e7da0?source=rss----3a8144eabfe

    Most of the mechanisms used in a blockchain network existed before Satoshi’s whitepaper. Peer to peer network, Cryptographic Hashing, Asymmetric key encryption, Merkle Tree, for instance, have been well known for a long time. The true revolution brought about by the Bitcoin in 2009 is cryptoeconomics and it is paramount to understand it if you want to grasp the real value of the blockchain revolution.The purpose of cryptoeconomics is to build strong protocols that will be able to govern and securely develop peer-to-peer decentralized networks.Peer to peer networks exist for some time. “Torrents” for instance, that many people used to share folder online, are peer to peer networks. However, they lake efficiency because members are happy to download content, but have no interests in (...)

    #blockchain-technology #cryptography #consensus #cryptocurrency-news

  • Behind the Messy, Expensive Split Between Facebook and WhatsApp’s Founders

    https://www.wsj.com/articles/behind-the-messy-expensive-split-between-facebook-and-whatsapps-founders-152820

    After a long dispute over how to produce more revenue with ads and data, the messaging app’s creators are walking away leaving about $1.3 billion on the table​
    By Kirsten Grind and
    Deepa Seetharaman
    June 5, 2018 10:24 a.m. ET

    How ugly was the breakup between Facebook Inc. FB 0.49% and the two founders of WhatsApp, its biggest acquisition? The creators of the popular messaging service are walking away leaving about $1.3 billion on the table.

    The expensive exit caps a long-simmering dispute about how to wring more revenue out of WhatsApp, according to people familiar with the matter. Facebook has remained committed to its ad-based business model amid criticism, even as Facebook Chief Executive Mark Zuckerberg has had to defend the company before American and European lawmakers.

    The WhatsApp duo of Jan Koum and Brian Acton had persistent disagreements in recent years with Mr. Zuckerberg and Chief Operating Officer Sheryl Sandberg, who grew impatient for a greater return on the company’s 2014 blockbuster $22 billion purchase of the messaging app, according to the people.

    Many of the disputes with Facebook involved how to manage data privacy while also making money from WhatsApp’s large user base, including through the targeted ads that WhatsApp’s founders had long opposed. In the past couple of years especially, Mr. Zuckerberg and Ms. Sandberg pushed the WhatsApp founders to be more flexible on those issues and move faster on other plans to generate revenue, the people say.

    Once, after Mr. Koum said he “didn’t have enough people” to implement a project, Mr. Zuckerberg dismissed him with, “I have all the people you need,” according to one person familiar with the conversation.
    Facebook CEO Mark Zuckerberg testified about privacy issues and the use of user data before a Senate committee in April.

    Facebook CEO Mark Zuckerberg testified about privacy issues and the use of user data before a Senate committee in April. Photo: Alex Brandon/Press Pool

    WhatsApp was an incongruous fit within Facebook from the beginning. Messrs. Acton and Koum are true believers on privacy issues and have shown disdain for the potential commercial applications of the service.

    Facebook, on the other hand, has built a sprawling, lucrative advertising business that shows ads to users based on data gathered about their activities. Mr. Zuckerberg and Ms. Sandberg have touted how an advertising-supported product makes it free for consumers and helps bridge the digital divide.

    When Facebook bought WhatsApp, it never publicly addressed how the divergent philosophies would coexist. But Mr. Zuckerberg told stock analysts that he and Mr. Koum agreed that advertising wasn’t the right way to make money from messaging apps. Mr. Zuckerberg also said he promised the co-founders the autonomy to build their own products. The sale to Facebook made the app founders both multibillionaires.

    Over time, each side grew frustrated with the other, according to people in both camps. Mr. Koum announced April 30 he would leave, and Mr. Acton resigned last September.
    Big Bet
    Facebook paid substantially more for WhatsApp than any other deal.

    Facebook’s five largest deals*

    WhatsApp (2014)

    $21.94 billion

    Oculus VR (2014)

    $2.30 billion

    Instagram (2012)

    $736 million

    Microsoft† (2012)

    $550 million

    Onavo (2013)

    $120 million

    *price at close of deal †approximately 615 AOL patents and patent applications

    Source: Dealogic

    The WhatsApp co-founders didn’t confront Mr. Zuckerberg at their departures about their disagreements over where to take the business, but had concluded they were fighting a losing battle and wanted to preserve their relationship with the Facebook executive, people familiar with the matter said. One person familiar with the relationships described the environment as “very passive-aggressive.”

    Small cultural disagreements between the two staffs also popped up, involving issues such as noise around the office and the size of WhatsApp’s desks and bathrooms, that took on greater significance as the split between the parent company and its acquisition persisted.

    The discord broke into public view in a March tweet by Mr. Acton. During the height of the Cambridge Analytica controversy, in which the research firm was accused of misusing Facebook user data to aid the Trump campaign, Mr. Acton posted that he planned to delete his Facebook account.

    Within Facebook, some executives were surprised to see Mr. Acton publicly bash the company since he didn’t seem to leave on bad terms, according to people familiar with the matter. When Mr. Acton later visited Facebook’s headquarters, David Marcus, an executive who ran Facebook’s other chat app, Messenger, confronted his former colleague. “That was low class,” Mr. Marcus said, according to people familiar with the matter. Mr. Acton shrugged it off. Mr. Marcus declined to comment.
    Staff at Facebook headquarters in Menlo Park, Calif. Small cultural disagreements between Facebook and WhatsApp staffs, involving issues such as noise, size of desks and bathrooms, created friction.

    Staff at Facebook headquarters in Menlo Park, Calif. Small cultural disagreements between Facebook and WhatsApp staffs, involving issues such as noise, size of desks and bathrooms, created friction. Photo: Kim Kulish/Corbis/Getty Images

    The posts also prompted an angry call from Ms. Sandberg to Mr. Koum, who assured her that Mr. Acton didn’t mean any harm, according to a person familiar with the call.

    When Mr. Acton departed Facebook, he forfeited about $900 million in potential stock awards, according to people familiar with the matter. Mr. Koum is expected to officially depart in mid-August, in which case he would leave behind more than two million unvested shares worth about $400 million at Facebook’s current stock price. Both men would have received all their remaining shares had they stayed until this November, when their contracts end.

    The amount the two executives are leaving in unvested shares hasn’t been reported, nor have the full extent of the details around their disagreements with Facebook over the years.

    “Jan has done an amazing job building WhatsApp. He has been a tireless advocate for privacy and encryption,” Mr. Zuckerberg said in May at the company’s developer conference about Mr. Koum’s departure. He added he was proud that Facebook helped WhatsApp launch end-to-end encryption a couple of years after the acquisition.

    In many ways, Facebook and WhatsApp couldn’t have been more different. Facebook from its beginning in 2004 leveraged access to user information to sell targeted advertising that would be displayed as people browsed their news feeds. That business model has been hugely successful, driving Facebook’s market value past half a trillion dollars, with advertising accounting for 97% of the firm’s revenue.
    A sign in WhatsApp’s offices at Facebook headquarters. Some Facebook employees mocked WhatsApp with chants of ‘Welcome to WhatsApp—Shut up!’

    A sign in WhatsApp’s offices at Facebook headquarters. Some Facebook employees mocked WhatsApp with chants of ‘Welcome to WhatsApp—Shut up!’

    It is also the antithesis of what WhatsApp professed to stand for. Mr. Koum, a San Jose State University dropout, grew up in Soviet-era Ukraine, where the government could track communication, and talked frequently about his commitment to privacy.

    Mr. Koum, 42, and Mr. Acton, 46, became friends while working as engineers at Yahoo Inc., one of the first big tech companies to embrace digital advertising. The experience was jarring for both men, who came to regard display ads as garish, ruining the user experience and allowing advertisers to collect all kinds of data on unsuspecting individuals.

    WhatsApp, which launched in 2009, was designed to be simple and secure. Messages were immediately deleted from its servers once sent. It charged some users 99 cents annually after one free year and carried no ads. In a 2012 blog post the co-founders wrote, “We wanted to make something that wasn’t just another ad clearinghouse” and called ads “insults to your intelligence.”

    Text MeWorld-wide monthly active users for popularmessaging apps, in billions.Source: the companiesNote: *Across four main markets; iMessage, Google Hangoutsand Signal don’t disclose number of users.

    WhatsAppFacebookMessengerWeChatTelegramLine*00.511.52

    The men are also close personal friends, bonding over ultimate Frisbee, despite political differences. Mr. Koum, unlike Mr. Acton, has publicly expressed support for Donald Trump.

    When Facebook bought WhatsApp in February 2014, the messaging service was growing rapidly and had already amassed 450 million monthly users, making it more popular than Twitter Inc., which had 240 million monthly users at the time and was valued at $30 billion. WhatsApp currently has 1.5 billion users.

    The deal still ranks as the largest-ever purchase of a company backed by venture capital, and it was almost 10 times costlier than Facebook’s next most expensive acquisition.

    Mr. Zuckerberg assured Messrs. Koum and Acton at the time that he wouldn’t place advertising in the messaging service, according to a person familiar with the matter. Messrs. Koum and Acton also negotiated an unusual clause in their contracts that said if Facebook insisted on making any “additional monetization initiatives” such as advertising in the app, it could give the executives “good reason” to leave and cause an acceleration of stock awards that hadn’t vested, according to a nonpublic portion of the companies’ merger agreement reviewed by The Wall Street Journal. The provision only kicks in if a co-founder is still employed by Facebook when the company launches advertising or another moneymaking strategy.

    Mr. Acton initiated the clause in his contract allowing for early vesting of his shares. But Facebook’s legal team threatened a fight, so Mr. Acton, already worth more than $3 billion, left it alone, according to people familiar with the matter.

    Some analysts in the tech community said a clash was inevitable. Nate Elliott, principal of Nineteen Insights, a research and advisory firm focused on digital marketing and social media, said the WhatsApp founders are “pretty naive” for believing that Facebook wouldn’t ultimately find some way to make money from the deal, such as with advertising. “Facebook is a business, not a charity,” he said.

    At the time of the sale, WhatsApp was profitable with fee revenue, although it is unclear by how much. Facebook doesn’t break out financial information for WhatsApp.
    David Marcus, vice president of messaging products for Facebook, spoke during the company’s F8 Developers Conference in San Jose on May 1.

    David Marcus, vice president of messaging products for Facebook, spoke during the company’s F8 Developers Conference in San Jose on May 1. Photo: David Paul Morris/Bloomberg News

    Facebook’s hands-off stance changed around 2016. WhatsApp topped one billion monthly users, and it had eliminated its 99 cent fee. Facebook told investors it would stop increasing the number of ads in Facebook’s news feed, resulting in slower advertising-revenue growth. This put pressure on Facebook’s other properties—including WhatsApp—to make money.

    That August, WhatsApp announced it would start sharing phone numbers and other user data with Facebook, straying from its earlier promise to be built “around the goal of knowing as little about you as possible.”

    With Mr. Zuckerberg and Ms. Sandberg pushing to integrate it into the larger company, WhatsApp moved its offices in January 2017 from Mountain View, Calif., to Facebook’s Menlo Park headquarters about 20 minutes away. Facebook tried to make it welcoming, decorating the Building 10 office in WhatsApp’s green color scheme.

    WhatsApp’s roughly 200 employees at the time remained mostly segregated from the rest of Facebook. Some of the employees were turned off by Facebook’s campus, a bustling collection of restaurants, ice cream shops and services built to mirror Disneyland.

    Some Facebook staffers considered the WhatsApp unit a mystery and sometimes poked fun at it. After WhatsApp employees hung up posters over the walls instructing hallway passersby to “please keep noise to a minimum,” some Facebook employees mocked them with chants of “Welcome to WhatsApp—Shut up!” according to people familiar with the matter.

    Some employees even took issue with WhatsApp’s desks, which were a holdover from the Mountain View location and larger than the standard desks in the Facebook offices. WhatsApp also negotiated for nicer bathrooms, with doors that reach the floor. WhatsApp conference rooms were off-limits to other Facebook employees.

    “These little ticky-tacky things add up in a company that prides itself on egalitarianism,” said one Facebook employee.

    Mr. Koum chafed at the constraints of working at a big company, sometimes quibbling with Mr. Zuckerberg and other executives over small details such as the chairs Facebook wanted WhatsApp to purchase, a person familiar with the matter said.

    In response to the pressure from above to make money, Messrs. Koum and Acton proposed several ideas to bring in more revenue. One, known as “re-engagement messaging,” would let advertisers contact only users who had already been their customers. Last year, WhatsApp said it would charge companies for some future features that connect them with customers over the app.

    None of the proposals were as lucrative as Facebook’s ad-based model. “Well, that doesn’t scale,” Ms. Sandberg told the WhatsApp executives of their proposals, according to a person familiar with the matter. Ms. Sandberg wanted the WhatsApp leadership to pursue advertising alongside other revenue models, another person familiar with her thinking said.

    Ms. Sandberg, 48, and Mr. Zuckerberg, 34, frequently brought up their purchase of the photo-streaming app Instagram as a way to persuade Messrs. Koum and Acton to allow advertising into WhatsApp. Facebook in 2012 purchased Instagram, and the app’s founders initially tried their own advertising platform rather than Facebook’s. When Instagram fell short of its revenue targets in its first few quarters, Facebook leadership pushed the founders to adopt its targeted advertising model, and the transition was relatively seamless, according to current and former employees. Today, analysts estimate that Instagram is a key driver of Facebook’s revenue, and its founders, Kevin Systrom and Mike Krieger, remain with the company. The men didn’t respond to requests for comment.

    “It worked for Instagram,” Ms. Sandberg told the WhatsApp executives on at least one occasion, according to one person familiar with the matter.
    Attendees used Oculus Go VR headsets during Facebook’s F8 Developers Conference.

    Attendees used Oculus Go VR headsets during Facebook’s F8 Developers Conference. Photo: Justin Sullivan/Getty Images

    Other high-profile acquisitions such as developer platform Parse, ad tech platform LiveRail and virtual-reality company Oculus VR have fallen short of expectations, people familiar with those deals say.

    The senior Facebook executives appeared to grow frustrated by the WhatsApp duo’s reasons to delay plans that would help monetize the service. Mr. Zuckerberg wanted WhatsApp executives to add more “special features” to the app, whereas Messrs. Koum and Acton liked its original simplicity.

    Mr. Zuckerberg and Ms. Sandberg also wanted Messrs. Koum and Acton to loosen their stance on encryption to allow more “business flexibility,” according to one person familiar with the matter. One idea was to create a special channel between companies and users on WhatsApp to deal with issues such as customer-service requests, people familiar with the matter said. That setup would let companies appoint employees or bots to field inquiries from users and potentially store those messages in a decrypted state later on.

    Last summer, Facebook executives discussed plans to start placing ads in WhatsApp’s “Status” feature, which allows users to post photo- and video-montages that last 24 hours. Similar features exist across Facebook’s services, including on Instagram, but WhatsApp’s version is now the most popular with 450 million users as of May.

    Mr. Acton—described by one former WhatsApp employee as the “moral compass” of the team—decided to leave as the discussions to place ads in Status picked up. Mr. Koum, who also sat on Facebook’s board, tried to persuade him to stay longer.

    Mr. Koum remained another eight months, before announcing in a Facebook post that he is “taking some time off to do things I enjoy outside of technology, such as collecting rare air-cooled Porsches, working on my cars and playing ultimate Frisbee.” Mr. Koum is worth about $9 billion, according to Forbes.

    The next day, Mr. Koum said goodbye to WhatsApp and Facebook employees at an all-hands meeting in Menlo Park. An employee asked him about WhatsApp’s plans for advertising.

    Mr. Koum responded by first alluding to his well-documented antipathy for ads, according to people familiar with his remarks. But Mr. Koum added that if ads were to happen, placing them in Status would be the least intrusive way of doing so, according to the people.

    Some people who heard the remarks interpreted them as Mr. Koum saying he had made peace with the idea of advertising in WhatsApp.

    In his absence, WhatsApp will be run by Chris Daniels, a longtime Facebook executive who is tasked with finding a business model that brings in revenue at a level to justify the app’s purchase price, without damaging the features that make it so popular.

    Among WhatsApp’s competitors is Signal, an encrypted messaging app run by a nonprofit called the Signal Foundation and dedicated to secure communication, with strict privacy controls and without advertising. Mr. Acton donated $50 million to fund the foundation and serves as its executive chairman.

    Corrections & Amplifications
    Facebook Messenger has 1.3 billion monthly users. An earlier version of a chart in this article incorrectly said it had 2.13 billion users. (June 5, 2018)

    Write to Kirsten Grind at kirsten.grind@wsj.com and Deepa Seetharaman at Deepa.Seetharaman@wsj.com

    #Facebook #Whatsapp

  • #cryptography + Malware = #ransomware
    https://hackernoon.com/cryptography-malware-ransomware-36a8ae9eb0b9?source=rss----3a8144eabfe3-

    Cybersecurity must deal with RansomwareWhen you combine cryptography with malware, you get a very dangerous mix of problems. This is a type of computer virus that goes by another name, “ransomware”. This type of virus is part of a field of study called “cryptovirology”. Through the use of techniques called phishing, a threat actor sends the ransomware file to an unknowing victim. If the file is opened it will execute the virus payload, which is malicious code. The ransomware runs the code that encrypts user data on the infected computer or host. The data are user files like documents, spreadsheets, photos, multimedia files and even confidential records. The ransomware targets your personal computer files and applies an encryption algorithm like RSA which makes the file unaccessible. The (...)

    #security #cybersecurity #hacker

  • Does #vpn Slow Down Internet?
    https://hackernoon.com/does-vpn-slow-down-internet-4ba14ae60e3?source=rss----3a8144eabfe3---4

    VPN is a technology that is used for #security; however, it degrades the speed of the internet to a certain level. But with some VPNs, you have to face high fluctuation of speed which occurs mostly with the inefficient VPN service or sometimes on the reputable VPN services too.It is worth noting that the legitimate VPN providers will generally give you an adequate speed with a slight reduction, mostly 5% to 6% of the regular internet speed. This reduction in speed is due to the encryption process of your internet data which a VPN implements to make everything safe and secure. Yet, there are various causes of speed reduction when there is a major drop down.There is not a pinpoint answer to the question that, does VPN slow down internet speed. But yes, there are probably factors which (...)

    #internet-speed #vpn-slow-down-internet #interne

  • French goverment will use Matrix Riot to replace Whatsapp (http://w...
    https://diasp.eu/p/7172792

    French goverment will use Matrix Riot to replace Whatsapp

    According to a recent report, the French government is currently developing an end-to-end encrypted alternative to WhatsApp and Telegram that its officials could use without worrying about foreign spying. Although the French government’s spokesperson said that the government’s app will be ...

    [ #privacy #surveillance #encryption #chat #messenger #matrix #riot ]

  • Attention PGP Users : New Vulnerabilities Require You To Take Action Now | Electronic Frontier Foundation
    https://www.eff.org/deeplinks/2018/05/attention-pgp-users-new-vulnerabilities-require-you-take-action-now

    A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME. EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages.

    The full details will be published in a paper on Tuesday at 07:00 AM UTC (3:00 AM Eastern, midnight Pacific). In order to reduce the short-term risk, we and the researchers have agreed to warn the wider PGP user community in advance of its full publication.

    Our advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email. Until the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels, such as Signal, and temporarily stop sending and especially reading PGP-encrypted email.

    #sécurité #boum

    • Par contre, si vous n’utilisez que des messages au format « texte » il semble qu’il n’y ait pas de trou de sécu. L’algorithme de PGP est toujour aussi sûr que possibe après meltdown :-)

      The EFAIL attacks exploit vulnerabilities in the OpenPGP and S/MIME standards to reveal the plaintext of encrypted emails. In a nutshell, EFAIL abuses active content of HTML emails, for example externally loaded images or styles, to exfiltrate plaintext through requested URLs. To create these exfiltration channels, the attacker first needs access to the encrypted emails, for example, by eavesdropping on network traffic, compromising email accounts, email servers, backup systems or client computers. The emails could even have been collected years ago.

      The attacker changes an encrypted email in a particular way and sends this changed encrypted email to the victim. The victim’s email client decrypts the email and loads any external content, thus exfiltrating the plaintext to the attacker.

      EFAIL
      https://efail.de

      EFAIL describes vulnerabilities in the end-to-end encryption technologies OpenPGP and S/MIME that leak the plaintext of encrypted emails.

    • OK, après la première lecture du site efail.de il semble qu’on puisse se protéger en suivant les indications suivantes :

      Mitigations

      Here are some strategies to prevent EFAIL attacks:

      Short term: No decryption in email client. The best way to prevent EFAIL attacks is to only decrypt S/MIME or PGP emails in a separate application outside of your email client. Start by removing your S/MIME and PGP private keys from your email client, then decrypt incoming encrypted emails by copy&pasting the ciphertext into a separate application that does the decryption for you. That way, the email clients cannot open exfiltration channels. This is currently the safest option with the downside that the process gets more involved.

      Short term: Disable HTML rendering. The EFAIL attacks abuse active content, mostly in the form of HTML images, styles, etc. Disabling the presentation of incoming HTML emails in your email client will close the most prominent way of attacking EFAIL. Note that there are other possible backchannels in email clients which are not related to HTML but these are more difficult to exploit.

      Medium term: Patching. Some vendors will publish patches that either fix the EFAIL vulnerabilities or make them much harder to exploit.

      Long term: Update OpenPGP and S/MIME standards. The EFAIL attacks exploit flaws and undefined behavior in the MIME, S/MIME, and OpenPGP standards. Therefore, the standards need to be updated, which will take some time.

  • Managing #encryption Keys With #aws KMS In Node.js
    https://hackernoon.com/managing-encryption-keys-with-aws-kms-in-node-js-c320c860019a?source=rss

    itsgoingdown.orgSecurity is very important when developing applications. How do you encrypt data and manage encryption keys in your application? Successful key management is critical to the #security of a cryptosystem. This is where KMS’s come into play. Let’s first see what a KMS really is.Key Management System (KMS)According to Wikipedia,A key management system (KMS), also known as a crytographic key management system (CKMS), is an integrated approach for generating, distributing and managing cryptographic keys for devices and applications. Compared to the term key management, a KMS is tailored to specific use-cases such as secure software update or machine-to-machine communication. In an holistic approach, it covers all aspects of security — from the secure generation of keys over the (...)

    #javascript #nodejs

  • There is no middle ground on encryption (https://rationalreview.com...
    https://diasp.eu/p/7112268

    There is no middle ground on encryption

    Source: Electronic Frontier Foundation by David Ruiz

    “Encryption is back in the headlines again, with government officials insisting that they still need to compromise our security via a backdoor for law enforcement. Opponents of encryption imagine that there is a ‘middle ground’ approach that allows for strong encryption but with ‘exceptional access’ for law enforcement. Government officials claim that technology companies are creating a world where people can commit crimes without fear of detection. Despite this renewed rhetoric, most experts continue to agree that exceptional access, no matter how you implement it, weakens security. The terminology might have changed, but the essential question has not: should technology companies be forced to (...)

  • WhatsApp founder plans to leave after broad clashes with parent Facebook
    https://www.washingtonpost.com/business/economy/whatsapp-founder-plans-to-leave-after-broad-clashes-with-parent-facebook/2018/04/30/49448dd2-4ca9-11e8-84a0-458a1aa9ac0a_story.html

    The billionaire chief executive of WhatsApp, Jan Koum, is planning to leave the company after clashing with its parent, Facebook, over the popular messaging service’s strategy and Facebook’s attempts to use its personal data and weaken its encryption, according to people familiar with internal discussions. Koum, who sold WhatsApp to Facebook for more than $19 billion in 2014, also plans to step down from Facebook’s board of directors, according to these people. The date of his departure isn’t (...)

    #Facebook #WhatsApp #cryptage #données

  • What does #privacy mean on a public blockchain?
    https://hackernoon.com/what-does-privacy-mean-on-a-public-blockchain-1243776df22f?source=rss---

    Strict new laws have come into effect for organisations dealing with personal data. What does that mean for businesses that store information on transparent, open and permanent ledgers?News of Cambridge Analytica’s misappropriation of data from some 87 million Facebook users has brought the issue of data protection squarely back into the spotlight. For years, consumers have effectively traded personal data for online services: data is considered the ‘oil’ of the internet, and the users of social networks, e-commerce platforms and almost every other free service have upheld this tacit bargain.In the last few weeks, we have seen where this leads — where, in fact, it was always and inevitably going to lead. It has become abundantly clear what the price of our personal data might be: freedom and (...)

    #encryption #data-protection #gdpr #blockchain-technology

  • Chinese Government Forces Residents To Install Surveillance App With Awful Security
    https://motherboard.vice.com/en_us/article/ne94dg/jingwang-app-no-encryption-china-force-install-urumqi-xinjiang

    Last year, authorities told residents of a Muslim-populated part of China to install JingWang, an app that scans for certain files. Now, researchers have found it transfers the collected data with no encryption. In Xinjiang, a part of western China that a Muslim minority population calls home, the government forces residents to install an Android app that scans devices for particular files. Now, cybersecurity researchers have found that the so-called JingWang app has horrendous security (...)

    #Jingwang/CleanWebGuard #Islam #surveillance #spyware #hacking

    ##Jingwang/CleanWebGuard

  • Fortknoxster: Decentralized, Secure Communication Platform That Does Not Collect Users Data On The…
    https://hackernoon.com/fortknoxster-decentralized-secure-communication-platform-that-does-not-c

    Fortknoxster: Decentralized, Secure Communication Platform That Does Not Collect Users Data On The BlockchainWhat is Fortknoxster?Fortknoxster is the first decentralized, secure communication and collaboration platform designed to allow participants to exchange information via calls, msgs, emails, group chats, video calls, attachments and p2p file sharing.The platform utilizes the #blockchain to create a peer-to-peer network within which data can be sent using highly secure end-to-end encryption, whilst it decentralizes p2p architecture enables a transparent, self sufficient ecosystem that can be maintained by its users, who are then rewarded for their efforts.What problems does Fortknoxster address?Fortknoxster is designed to offer highly secure encrypted communications services to all (...)

    #privacy #ico #investing #ethereum

  • #Nebula_Genomics will leverage #blockchain technology to eliminate middlemen and empower people to own their personal #genomic_data. This will effectively lower sequencing costs and enhance data privacy, resulting in growth of genomic data. Our open protocol will leverage the genomic data growth by enabling data buyers to efficiently aggregate standardized data from many individual people and genomic databanks.”

    Nice and interesting project but (see later).

    Official corporate Web site: https://www.nebulagenomics.io

    The detailed white paper: https://www.nebulagenomics.io/assets/documents/NEBULA_whitepaper_v4.52.pdf

    A summary, with an interview of the founders: http://www.sciencemag.org/news/2018/02/q-george-church-and-company-genomic-sequencing-blockchain-and-better-dru

    #DNS #DNS_sequencing #genomics

    After reading the white paper, some comments:

    Sentences such as “Nebula network addresses are cryptographic identifiers that are not associated with any personal information.” are worrying because they seem to indicate that the authors do not really understand the concept of “personal information”. “Personal information” is not only when you name is on it. There have been a lot of research on tracing blockchain addresses.

    The white paper sometimes make bold claims, then seriously reduces them. For instancen it talks about “#homomorphic_encryption”, something which is very cool for the mathematically inclined, but offers very poor performances. Later, the paper speaks only of “partially homomorphic encryption”.

    Most of the security seems to rely, not on homomorphic encryption, but on Intel’s #Software_Guard_ Extensions (#SGX). SGX is an interesting technology, but quite recent. (Also, it comes from the company that puts a backdoor on every processor, through the Management Engine.) Relying on Intel security one month after Meltdown and Spectre seems audacious.

    It is not clear if the “Nebula blockchain” is a private one or a public one, like Blockstack. Private blockchains remove most of the security of a blockchain.

    “we want to support research conducted by non-profit institutions, such as universities.” In countries where researchers in public institutions are allowed to create for-profit companies with the results of research funded by “non-profit” research, the concept of “non-profit” is quite blurred.

  • WhatsApp Security Flaws Could Allow Snoops to Slide Into Group Chats
    https://www.wired.com/story/whatsapp-security-flaws-encryption-group-chats

    When WhatsApp added end-to-end encryption to every conversation for its billion users two years ago, the mobile messaging giant significantly raised the bar for the privacy of digital communications worldwide. But one of the tricky elements of encryption—and even trickier in a group chat setting—has always been ensuring that a secure conversation reaches only the intended audience, rather than some impostor or infiltrator. And according to new research from one team of German cryptographers, (...)

    #WhatsApp #Signal #Threema #cryptage #hacking

  • Edward Snowden’s New App Uses Your Smartphone to Physically Guard Your Laptop
    https://theintercept.com/2017/12/22/snowdens-new-app-uses-your-smartphone-to-physically-guard-your-laptop

    Like many other journalists, activists, and software developers I know, I carry my laptop everywhere while I’m traveling. It contains sensitive information; messaging app conversations, email, password databases, encryption keys, unreleased work, web browsers logged into various accounts, and so on. My disk is encrypted, but all it takes to bypass this protection is for an attacker — a malicious hotel housekeeper, or “evil maid,” for example — to spend a few minutes physically tampering with it without my knowledge. If I come back and continue to use my compromised computer, the attacker could gain access to everything.

    Edward Snowden and his friends have a solution. The NSA whistleblower and a team of collaborators have been working on a new open source Android app called Haven that you install on a spare smartphone, turning the device into a sort of sentry to watch over your laptop. Haven uses the smartphone’s many sensors — microphone, motion detector, light detector, and cameras — to monitor the room for changes, and it logs everything it notices. The first public beta version of Haven has officially been released; it’s available in the Play Store and on F-Droid, an open source app store for Android.

    #haven #surveillance
    https://github.com/guardianproject/haven

  • PrivateBin
    https://privatebin.info

    PrivateBin is a minimalist, open source online pastebin where the server has zero knowledge of pasted data.

    Data is encrypted/decrypted in the browser using 256bit AES in Galois Counter mode.

    This is a fork of ZeroBin, originally developed by Sébastien Sauvage. It was refactored to allow easier and cleaner extensions and has now much more features than the original. It is however still fully compatible to the original ZeroBin 0.19 data storage scheme. Therefore such installations can be upgraded to this fork without losing any data.
    What PrivateBin provides

    As a server administrator you don’t have to worry if your users post content that is considered illegal in your country. You have no knowledge of any of the pastes content. If requested or enforced, you can delete any paste from your system.

    Pastebin-like system to store text documents, code samples, etc.

    Encryption of data sent to server.

    Possibility to set a password which is required to read the paste. It further protects a paste and prevents people stumbling upon your paste’s link from being able to read it without the password.

    #internet #sécurité #surveillance

  • Internet, we have a problem: Wi-Fi WPA2 security probably broken through key re-installation attack

    Two Belgian researchers, Mathy Vanhoef of KU Leuven and Frank Piessens of imec-DistriNet, are confident they really have done serious damage to WPA2.

    Their paper “Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2” will be formally presented on November 1st at the ACM Conference on Computer and Communications Security.

    https://www.modmy.com/wi-fi-wpa2-security-has-been-krack-ed

    The vulnerability, called KRACK (Key Reinstallation AttaCK), is found within the 4-way handshake process which takes place when a device attempts to connect to a wireless network. This process involves generating unique single-use numbers to secure the connection between the device and the wireless access point. As it turns out, under certain reproducible conditions, such a number (called a nonce) can be reused, which may significantly weaken the encryption for traffic between Wi-Fi access points and devices connecting to them.

    https://www.theregister.co.uk/2017/10/16/wpa2_inscure_krackattack

    The CVE (Common Vulnerabilities and Exposures) numbers for Krack Attack have been reserved. They are CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13084, CVE-2017-13086, CVE-2017-13087, and CVE-2017-13088

    https://www.i4u.com/2017/10/124939/wi-fi-wpa2-security-broken

    The researchers published last year a paper titled “Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys.” The core problem for that security problem of Wi-Fi was the 802.11 random number generator allowing predicting its output including the group key. The paper shows how a downgrade-style attack against the 4-way handshake works. The researchers also propose the solution to fix the vulnerability with the random number generator based on randomness extracted from the wireless channel.

    https://www.alexhudson.com/2017/10/15/wpa2-broken-krack-now

    Lots of us have old routers at home, which have no chance of a firmware upgrade, and lots of WiFi equipment that may well not get a protocol upgrade if one is required. Right now, it sounds like all this stuff is going to be worthless from the perspective of encryption.

    #WPA2

  • [Forum] | Trump : A Resister’s Guide | Harper’s Magazine - Part 11
    https://harpers.org/archive/2017/02/trump-a-resisters-guide/11

    y Kate Crawford

    Dear Technologists:

    For the past decade, you’ve told us that your products will change the world, and indeed they have. We carry tiny networked computers with us everywhere, we control “smart” home appliances at a remove, we communicate with our friends and family over online platforms, and now we are all part of the vast Muslim registry known as Facebook. Almost 80 percent of American internet users belong to the social network, and many of them happily offer up their religious affiliation. The faith of those who don’t, too, can be easily deduced with a little data-science magic; in 2013, a Cambridge University study accurately detected Muslims 82 percent of the time, using only their Facebook likes. The industry has only become better at individual targeting since then.

    You’ve created simple, elegant tools that allow us to disseminate news in real time. Twitter, for example, is very good at this. It’s also a prodigious disinformation machine. Trolls, fake news, and hate speech thrived on the platform during the presidential campaign, and they show few signs of disappearing now. Twitter has likewise made it easier to efficiently map the networks of activists and political dissenters. For every proud hashtag — #BlackLivesMatter, #ShoutYourAbortion, the anti-deportation campaign #Not1More — there are data sets that reveal the identities of the “influencers” and “joiners” and offer a means of tracking, harassing, and silencing them.

    You may intend to resist, but some requests will leave little room for refusal. Last year, the U.S. government forced Yahoo to scan all its customers’ incoming emails, allegedly to find a set of characters that were related to terrorist activity. Tracking emails is just the beginning, of course, and the FBI knows it. The most important encryption case to date hinged on the FBI’s demand that Apple create a bespoke operating system that would allow the government to intentionally undermine user security whenever it impeded an investigation. Apple won the fight, but that was when Obama was in office. Trump’s regime may pressure the technology sector to create back doors in all its products, widen surveillance, and weaken the security of every networked phone, vehicle, and thermostat.

    There is precedent for technology companies assisting authoritarian regimes. In 1880, after watching a train conductor punch tickets, Herman Hollerith, a young employee of the U.S. Census Bureau, was inspired to design a punch-card system to catalogue human traits. The Hollerith Machine was used in the 1890 census to tabulate markers such as race, literacy level, gender, and country of origin. During the 1930s, the Third Reich used the same system, under the direction of a German subsidiary of International Business Machines, to identify Jews and other ethnic groups. Thomas J. Watson, IBM’s first president, received a medal from Hitler for his services. As Edwin Black recounts in IBM and the Holocaust, there was both profit and glory to be had in providing the computational services for rounding up the state’s undesirables. Within the decade, IBM served as the information subcontractor for the U.S. government’s Japanese-internment camps.

    You, the software engineers and leaders of technology companies, face an enormous responsibility. You know better than anyone how best to protect the millions who have entrusted you with their data, and your knowledge gives you real power as civic actors. If you want to transform the world for the better, here is your moment. Inquire about how a platform will be used. Encrypt as much as you can. Oppose the type of data analysis that predicts people’s orientation, religion, and political preferences if they did not willingly offer that information. Reduce the quantity of personal information that is kept. And when the unreasonable demands come, the demands that would put activists, lawyers, journalists, and entire communities at risk, resist wherever you can. History also keeps a file.

    #Silicon_valley #Fichage #Médias_sociaux #Chiffrement #Ethique

  • HOW TO USE SIGNAL WITHOUT GIVING OUT YOUR PHONE NUMBER
    https://theintercept.com/2017/09/28/signal-tutorial-second-phone-number

    JUST A FEW years ago, sending encrypted messages was a challenge. Just to get started, you had to spend hours following along with jargon-filled tutorials, or be lucky enough to find a nerd friend to teach you. The few that survived this process quickly hit a second barrier: They could only encrypt with others who had already jumped through the same hoops. So even after someone finally set up encrypted email, they couldn’t use it with most of the people they wanted to send encrypted emails to.

    The situation is much better today. A number of popular apps have come along that make encryption as easy as texting. Among the most secure is Signal, open-source software for iOS and Android that has caught on among activists, journalists, and others who do sensitive work. And probably the most popular is WhatsApp, a Facebook-owned platform with encryption setup derived from Signal. For me, the spread of encrypted chat apps means that, with very few exceptions, all of my text messages — with friends, family, or for work — are end-to-end encrypted, and no one even has to understand what a “public key” is.

    But there is a major issue with both Signal and WhatsApp: Your account is tied to your phone number.

  • GNOME Foundation Gives its Backing to Purism’s Linux Phone
    http://www.omgubuntu.co.uk/2017/09/gnome-foundation-gives-backing-purisms-linux-phone

    The GNOME Foundation has today given its backing to Purism’s ambition of building a free, open-source smartphone with user privacy and encryption as a central feature. This post, GNOME Foundation Gives its Backing to Purism’s Linux Phone, was written by Joey Sneddon and first appeared on OMG! Ubuntu!.