encryption

Auto Added by WPeMatico

Russia Begins Blocking Telegram Messenger

Russia Begins Blocking Telegram Messenger

Russia’s state telecommunications regulator said on Monday it had begun blocking access to Telegram messenger after the company refused to comply with an order to give Russian state security access to its users’ secret messages (encryption keys). From a report: The watchdog, Roskomnadzor, said in a statement on its website that it had sent telecoms operators a notification about blocking access to Telegram inside Russia. The service, set up by a Russian entrepreneur, has more than 200 million global users and is ranked as the world’s ninth most popular mobile messaging app.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, encryption
Former FBI Director James Comey Reveals How Apple and Google's Encryption Efforts Drove Him 'Crazy'

Former FBI Director James Comey Reveals How Apple and Google's Encryption Efforts Drove Him 'Crazy'

An anonymous reader shares a report: In his explosive new book, A Higher Loyalty, fired FBI director James Comey denounces President Trump as “untethered to the truth” and likens him to a “mob boss,” but he also touches on other topics during his decades-long career in law enforcement — including his strong objection to the tech industry’s encryption efforts. When Apple and Google announced in 2014 that they would be moving their mobile devices to default encryption, by emphasizing that making them immune to judicial orders was good for society, “it drove me crazy,” he writes. He goes on to lament the lack of “true listening” between tech and law enforcement, saying that “the leaders of the tech companies don’t see the darkness the FBI sees,” such as terrorism and organized crime. He writes, “I found it appalling that the tech types couldn’t see this. I would frequently joke with the FBI ‘Going Dark’ team assigned to seek solutions, ‘Of course the Silicon Valley types don’t see the darkness — they live where it’s sunny all the time and everybody is rich and smart.” But Comey understood it was an unbelievably difficult issue and that public safety had to be balanced with privacy concerns.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, encryption
Lawmakers Call FBI's 'Going Dark' Narrative 'Highly Questionable' After Motherboard Shows Cops Can Easily Hack iPhones

Lawmakers Call FBI's 'Going Dark' Narrative 'Highly Questionable' After Motherboard Shows Cops Can Easily Hack iPhones

Joseph Cox, reporting for Motherboard: This week, Motherboard showed that law enforcement agencies across the country, including a part of the State Department, have bought GrayKey, a relatively cheap technology that can unlock fully up-to-date iPhones. That revelation, cryptographers and technologists said, undermined the FBI’s renewed push for backdoors in consumer encryption products. Citing Motherboard’s work, on Friday US lawmakers sent a letter to FBI Director Christopher Wray, doubting the FBI’s narrative around ‘going dark’, where law enforcement officials say they are increasingly unable to obtain evidence related to crimes due to encryption. Politico was first to report the letter. “According to your testimony and public statements, the FBI encountered 7,800 devices last year that it could not access due to encryption,” the letter, signed by 5 Democrat and 5 Republican n House lawmakers, reads. “However, in light of the availability of unlocking tools developed by third-parties and the OIG report’s findings that the Bureau was uninterested in seeking available third-party options, these statistics appear highly questionable,” it adds, referring to a recent report from the Justice Department’s Office of the Inspector General. That report found the FBI barely explored its technical options for accessing the San Bernardino iPhone before trying to compel Apple to unlock the device. The lawmaker’s letter points to Motherboard’s report that the State Department spent around $15,000 on a GrayKey.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, encryption
Researchers Devise a Way To Generate Provably Random Numbers Using Quantum Mechanics

Researchers Devise a Way To Generate Provably Random Numbers Using Quantum Mechanics

No random number generator you’ve ever used is truly, provably random. Until now, that is. Researchers have used an experiment developed to test quantum mechanics to generate demonstrably random numbers, which could come in handy for encryption. From a report: The method uses photons to generate a string of random ones and zeros, and leans on the laws of physics to prove that these strings are truly random, rather than merely posing as random. The researchers say their work could improve digital security and cryptography. The challenge for existing random number generators is not only creating truly random numbers, but proving that those numbers are random. “It’s hard to guarantee that a given classical source is really unpredictable,” says Peter Bierhorst, a mathematician at the National Institute of Standards and Technology (NIST), where this research took place. “Our quantum source and protocol is like a fail-safe. We’re sure that no one can predict our numbers.” For example, random number algorithms often rely on a source of data which may ultimately prove predictable, such as atmospheric noise. And however complex the algorithm, it’s still applying consistent rules. Despite these potential imperfections, these methods are relied on in the day-to-day encryption of data. This team’s method, however, makes use of the properties of quantum mechanics, or what Einstein described as “spooky action at a distance.” Further reading: Wired, LiveScience, and CNET.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, encryption
Justice Department Revives Push To Mandate a Way To Unlock Phones

Justice Department Revives Push To Mandate a Way To Unlock Phones

“FBI and Justice Department officials have been quietly meeting with security researchers who have been working on approaches to provide such ‘extraordinary access’ to encrypted devices,” reports The New York Times (alternative source), citing people familiar with the matter. Justice Department officials believe that these “mechanisms allowing access to the data” exist without weakening the devices’ security against hacking. Slashdot reader schwit1 shares the report: Against that backdrop, law enforcement officials have revived talks inside the executive branch over whether to ask Congress to enact legislation mandating the access mechanisms. The Trump White House circulated a memo last month among security and economic agencies outlining ways to think about solving the problem, officials said. The FBI has been agitating for versions of such a mandate since 2010, complaining that the spreading use of encryption is eroding investigators’ ability to carry out wiretap orders and search warrants — a problem it calls “going dark.” The issue repeatedly flared without resolution under the Obama administration, peaking in 2016, when the government tried to force Apple to help it break into the iPhone of one of the attackers in the terrorist assault in San Bernardino, Calif. The debate receded when the Trump administration took office, but in recent months top officials like Rod J. Rosenstein, the deputy attorney general, and Christopher A. Wray, the FBI director, have begun talking publicly about the “going dark” problem. The National Security Council and the Justice Department declined to comment about the internal deliberations. The people familiar with the talks spoke on the condition of anonymity, cautioning that they were at a preliminary stage and that no request for legislation was imminent. But the renewed push is certain to be met with resistance.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, encryption
Telegram Loses Supreme Court Appeal In Russia, Must Hand Over Encryption Keys

Telegram Loses Supreme Court Appeal In Russia, Must Hand Over Encryption Keys

Telegram has lost a bid before Russia’s Supreme Court to block security services from getting access to users’ data, giving President Vladimir Putin a victory in his effort to keep tabs on electronic communications. Bloomberg reports: Supreme Court Judge Alla Nazarova on Tuesday rejected Telegram’s appeal against the Federal Security Service, the successor to the KGB spy agency which last year asked the company to share its encryption keys. Telegram declined to comply and was hit with a fine of $14,000. Communications regulator Roskomnadzor said Telegram now has 15 days to provide the encryption keys. Telegram, which is in the middle of an initial coin offering of as much as $2.55 billion, plans to appeal the ruling in a process that may last into the summer, according to the company’s lawyer, Ramil Akhmetgaliev. Any decision to block the service would require a separate court ruling, the lawyer said.

Putin signed laws in 2016 on fighting terrorism, which included a requirement for messaging services to provide the authorities with means to decrypt user correspondence. Telegram challenged an auxiliary order by the Federal Security Service, claiming that the procedure doesn’t involve a court order and breaches constitutional rights for privacy, according to documents. The security agency, known as the FSB, argued in court that obtaining the encryption keys doesn’t violate users’ privacy because the keys by themselves aren’t considered information of restricted access. Collecting data on particular suspects using the encryption would still require a court order, the agency said.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, encryption
23,000 HTTPS Certs Axed After CEO Emails Private Keys

23,000 HTTPS Certs Axed After CEO Emails Private Keys

An anonymous reader quotes Ars Technica:
A major dust-up on an Internet discussion forum is touching off troubling questions about the security of some browser-trusted HTTPS certificates when it revealed the CEO of a certificate reseller emailed a partner the sensitive private keys for 23,000 TLS certificates. The email was sent on Tuesday by the CEO of Trustico, a UK-based reseller of TLS certificates issued by the browser-trusted certificate authorities Comodo and, until recently, Symantec…

In communications earlier this month, Trustico notified DigiCert that 50,000 Symantec-issued certificates Trustico had resold should be mass revoked because of security concerns. When Jeremy Rowley, an executive vice president at DigiCert, asked for proof the certificates were compromised, the Trustico CEO emailed the private keys of 23,000 certificates, according to an account posted to a Mozilla security policy forum. The report produced a collective gasp among many security practitioners who said it demonstrated a shockingly cavalier treatment of the digital certificates that form one of the most basic foundations of website security… In a statement, Trustico officials said the keys were recovered from “cold storage,” a term that typically refers to offline storage systems. “Trustico allows customers to generate a Certificate Signing Request and Private Key during the ordering process,” the statement read. “These Private Keys are stored in cold storage, for the purpose of revocation.”
“There’s no indication the email was encrypted,” reports Ars Technica, and the next day DigiCert sent emails to Trustico’s 23,000+ customers warning that their certificates were being revoked, according to Bleeping Computer.

In a related development, Thursday Trustico’s web site went offline, “shortly after a website security expert disclosed a critical vulnerability on Twitter that appeared to make it possible for outsiders to run malicious code on Trustico servers.”

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, encryption
Two Years After FBI vs Apple, Encryption Debate Remains

Two Years After FBI vs Apple, Encryption Debate Remains

It’s been two years since the FBI and Apple got into a giant fight over encryption following the San Bernardino shooting, when the government had the shooter’s iPhone, but not the password needed to unlock it, so it asked Apple to create a way inside. What’s most surprising is how little has changed since then. From a report: The encryption debate remains unsettled, with tech companies largely opposed and some law enforcement agencies still making the case to have a backdoor. The case for strong encryption: Those partial to the tech companies’ arguments will note that cyberattacks and hacking incidents have become even more common, with encryption serving as a valuable way to protect individuals’ personal information. The case for backdoors: Criminals are doing bad stuff and when devices are strongly encrypted they can do it in what amounts to the perfect dark alley, completely hidden from public view.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, encryption
Camera Makers Resist Encryption, Despite Warnings From Photographers

Camera Makers Resist Encryption, Despite Warnings From Photographers

An anonymous reader shares an article from the security editor of ZDNet:
A year after photojournalists and filmmakers sent a critical letter to camera makers for failing to add a basic security feature to protect their work from searches and hacking, little progress has been made. The letter, sent in late 2016, called on camera makers to build encryption into their cameras after photojournalists said they face “a variety of threats…” Even when they’re out in the field, collecting footage and documenting evidence, reporters have long argued that without encryption, police, the military, and border agents in countries where they work can examine and search their devices. “The consequences can be dire,” the letter added.

Although iPhones and Android phones, computers, and instant messengers all come with encryption, camera makers have fallen behind. Not only does encryption protect reported work from prying eyes, it also protects sources — many of whom put their lives at risk to expose corruption or wrongdoing… The lack of encryption means high-end camera makers are forcing their customers to choose between putting their sources at risk, or relying on encrypted, but less-capable devices, like iPhones.
We asked the same camera manufacturers if they plan to add encryption to their cameras — and if not, why. The short answer: don’t expect much any time soon.

Read more of this story at Slashdot.

Go to Source

Posted by amiller in Blog, encryption