EFF Wants Stronger Encryption Against Terrorists And Criminals

If the government were to ask people to remove the good locks on their doors and windows and replacing them worse so that government employees can penetrate more easily in case someone is a terrorist, no one would accept this because bad locks make everyone vulnerable.

Yet this is exactly what governments and law enforcement agencies in the case of encryption will, according to the American civil rights movement EFF. Regularly advocate agencies like the FBI to add backdoors in encryption, ensuring encrypted communication can still be tapped. This is similar to prevent people from getting access to good locks and locksmiths can produce good locks.

In this last example, most people would understand that this is not a wise idea, says Cindy Cohn of the EFF. However, when it comes to Internet and technology, such as the operation of encoding, which for many people is less clear. Parties such as the FBI and politicians would also have known better, says Cohn. "The answer to insecure networks and digital technologies must be correct in order to make them safer."

But that is not what is happening, so she continues. Policymakers are therefore urged to take this into account. "Ensuring that everyone's door is unlocked, is not the answer to crime or terrorism. That is the development and support of better security," Cohn decision.

Civil Rights Movement Praises AdBlocker In Firefox

The American civil rights movement EFF has very positively reacted to the latest version of Firefox, which typically has a built-AdBlocker features. Still, there is room for improvement, according to the organization. Yesterday released Firefox 42 includes Tracking Protection.

These Tracking Protection blocks trackers, analytics scripts, tracking pixels and also advertisements that follow users. For this, Firefox uses the blocking list of the Disconnect browser extension. This expansion also blocks all kinds webtrackers.According to Noah Swartz of the EFF Firefox does not take sides when it comes to online advertising, but has chosen to block ads that violate user privacy. Something the EFF agrees with.

The EFF is pleased that the browser now offers standard such an option. Earlier, namely Disconnect from the Android app store removed. Yet Swartz sees room for improvement. Tracking Protection is now enabled only when using the Private Browsing mode. If the option is enabled by default to the EFF for all users who have chosen within the browser for Do Not Track, whether via Private Browsing surfing or not. Swartz also hopes that other browser developers will follow the example of Mozilla.

Research: PGP Tools Still Unsuitable For The Masses

PGP tools for encrypting e-mail messages have been around for years, but are still unsuitable for the masses to use. Researchers at Brigham Young University concluded on the basis of own research (pdf).


For their research they let subjects Mailvelope try a browser extension for encrypting webmail. The reason was for Mailvelope chosen was that it is the only solution that is named by the American civil rights movement EFF and existing webmail services can handle. Also gets positive reactions in the Chrome Web Store. At the trial, 20 participants took part, divided into 10 pairs. The participants were instructed to Mailvelope encrypted via e-mail each other within one hour. Only one pair of pressed herein.

"This shows that the encryption of e-mail using PGP, as implemented in Mailvelope still unsuitable for the masses," according to the researchers. The most common mistake during the study was to encrypt a message using the public key of the sender. Something happened seven couples, including the couple finally did manage to send an encrypted message.Furthermore, three pairs generated a key pair "with information from their friends, and then tried to use public key to encrypt their message.

Improvement

Despite the criticism, the researchers also show improvement. They advocated for integrated tutorials to guide new users.Furthermore, a simple explanation of cryptography via public keys help users to manage their own keys well and could offer PGP-based tools to automatically for unknown recipients to generate an e-mail with the request to install the PGP software, a generate public key and share it with the sender.

Major Browsers Support SSL-Free Service Let's Encrypt

A new certificate authority (CA) which aims to encrypt all web traffic on the Internet and therefore will issue free SSL certificates is now supported by all major browsers, as announced the initiators of Let's Encrypt.

With an SSL certificate, websites can encrypt the traffic to and from visitors and identify themselves in front of visitors. Let's Encrypt is an initiative of the Internet Security Research Group (ISRG) and is supported by Mozilla, Akamai, Cisco, the American civil rights movement EFF and various other parties. According to the initiators, there are already parties that offer free certificates for websites, but the installation is still a tricky process, which is a fully encrypted web stands in the way.

Let's therefore Encrypt will automate the installation and issue of certificates. For this purpose has been developed a programming interface (API), as well as client software that makes use of this API. Administrators can use this client software on their own Web server to automatically install a certificate and configure their server so that henceforth use HTTPS.

To avoid warnings in the browser must Let's Encrypt or by the browser as a valid certificate authority are recognized.Something which is now achieved through the intermediate certificates of Let's Encrypt by IdenTrust be signed. All browsers accept IdenTrust and thereby also the certificates of Let's Encrypt. "This is a major milestone because it means that visitors to websites that use Let's Encrypt certificates without special modifications have a secure browsing experience," said Josh Aas of ISRG.

EFF Advises Against Eavesdropping HTTPS And VPN By NSA

This week, researchers presented information showing that the NSA may be able to store some encrypted connections, such as HTTPS, SSH and VPN, eavesdrop. Users can, however, take steps to prevent this, according to the American civil rights movement EFF.

The problem is that is used when an encrypted connection for instituting an algorithm for exchanging the key. In many cases, used for this purpose is the Diffie-Hellman algorithm. It forms the basis for modern cryptography and is used for VPNs, HTTPS, email, and other protocols. Because of the way the algorithm is implemented users run the risk of being bugged by the secret services, researchers said Alex Halderman and Nadia Heninger.

The problem is that a client, for example, a browser, and a server which use Diffie-Hellman must first agree on a prime number with a certain shape. Many applications thereby appear to use standardized 'hardcoded' primes. A secret service that any one particular prime number is able to "crack", then can eavesdrop all connections that use this particular prime number. It is in this case 1024-bit prime numbers.

NSA

"Based on the evidence we have, we can not prove that the NSA does. Our proposed way to crack Diffie-Hellman is better suited to the technical details of the large-scale decryption capabilities of the NSA than any other explanation," said the researchers. The documents from whistleblower Edward Snowden that the NSA have an infrastructure to monitor VPN connections. The system is designed to collect specific data that is required specifically to attack Diffie-Hellman.

"As the use of Diffie-Hellman in this feeble way is widespread in both standards and implementations, it may take years before the problems are resolved," as the researchers warn. They argue that all major governments can carry out similar attacks, if they do not do that.
Actions

Internet users who want to protect themselves against a possible attack may take various measures. Diffie-Hellman can be in the browser are so turned off, so that with it the setting up of an encrypted connection no use is made. Users of VPN have set their software to Diffie-Hellman is used only with 2048-bit prime., As the EFF in this article explains

NSA Should Stop Large-Scale Data Storage Phone

The US National Security Agency, the mass collection of phone records of US citizens now stop the Senate no agreement has been reached on an extension of Section 215 of the Patriot Act. Through this legislation, the NSA was authorized to store massive conversation data and store. In total expired three commissions of the Patriot Act, says civil rights movement EFF .

It is the section that used to store the state of your phone data and business data, the " lone wolf "provision and" roving wiretap "provision. Preliminary section 215 will be reversed to the state of the Patriot Act, which does not allow financial or communication data storage and requires the government consults specific facts to show that works a target for a foreign government.

During a heated debate showed Sen. Rand Paul know that he is afraid that the new legislation would introduce the US government, the Freedom Act, the NSA still gives wide powers. The new standards would require that telecommunications companies to store the data, which can then be retrieved after a court order by the NSA. According to Paul, his general orders the reason that the American Revolution was fought.

Senator Bob Corker said that the government has the effectiveness of a major program to national security limits as well as the ability to fight terrorists. Other senators are calling for swift action to take and implement the Freedom Act. Despite the expiration of Section 215 of the EFF states that the US government had sufficient authority has to store and process data.

FBI Gets Security Expert From Plane After Tweet

The FBI on Wednesday met a security of an aircraft and its computer equipment confiscated because of a tweet. He was not yesterday after his release along with the airline. Chris Roberts posted a message online in which he expressed his doubts about the safety of the aircraft network, but the American investigative thought he plane of United Airlines wanted to hack, so notify CNN and Forbes.

After his arrest his iPad, MacBook Pro, three hard disks and various USB stick were confiscated. His phone was allowed to keep Roberts. All devices were encrypted, however. "It will be interesting to see if the encryption keeps" the security expert showed through Twitter know. Against both Forbes and CNN Roberts from his frustration that vulnerabilities in aircraft are not resolved, even though they are known for years. He was questioned after his arrest four hours.

United Airlines

Roberts has his computer still not recovered, but has by now released. Yesterday he tried to fly to the RSA Conference in San Francisco, where he will give a presentation. After the expert had received his boarding pass and wanted to board the plane he was stopped by security personnel of the airline.

Eventually he could at the last minute along with another airline, but the American civil rights movement EFF criticizes the actions of United Airlines. "As a member of the research community, it is his job to find vulnerabilities so they can be resolved," said Andrew Crocker of the EFF. Crocker notes that the EFF is worried about this kind of reflexes on legitimate security research, which ultimately can have a paralyzing effect on researchers, eventually causing problems go unnoticed.

Experts Divided On Risk Of Trackers On Porn Sites

In February warned a software engineer for the risk of trackers and other ways in which it can be followed online porn surfing habits of viewers, but experts are divided over how big the risk is real. Software engineer Brett Thomas suggested two months ago that the viewing habits on porn sites the next "big privacy scandal" can be. Many ways to websites and advertisers identify Internet users today and that is no different on porn sites.

This data could, for example end up using a hacked advertising company, tracker or porn site on the Internet. It does not matter if people such as "private browsing" to use to protect their browsing habits, so let experts opposite Vice Magazine know. Even if this option is enabled the user's IP address is on the website visited, and the trackers that are active thereon passed.

88% of the 500 most visited porn sites are active trackers. "If you look at porn on the Internet in 2015, even in incognito mode, you must assume that at some point your viewing habits public and will be linked to your name," said Thomas. In addition to the IP address has almost every computer to identify a unique fingerprint browser so that users are. "It is certainly cause for concern," said Justin Brookman, privacy expert of? Center for Democracy & Technology.

Alarmism

According to Cooper Quintin of the American civil rights movement EFF is possible that the viewing habits of one's membership in a porn site is known, but he calls the remark of Thomas later someone can easily put it online porn viewing habits of viewers on the Internet scaremongering. Vice Magazine porn sites also asked for a response, but received only sent a statement of PornHub. The site is on the 75th place of most visited websites on the Internet, just for Gmail.com , which stands on a 78th place.

The statement PornHub calls the assertion of Thomas not only utterly wrong but also dangerously misleading. According to the porn store the viewing habits of daily users would cost 3,600 terabytes. The searches of these data would be almost impossible and very time consuming. "The server logs PornHub contain only for a limited time the IP address and user agent, never a browser fingerprint," said a spokesman.

Tor Is Looking For Students Who Want To Develop Privacy Tools

After years of having participated in a Google initiative where students were paid to the development of open source software, have the Tor Project, known from the Tor anonymizing network, and the American civil rights movement EFF now decided to launch an initiative in which students from all over the world are paid for the further development of the Tor privacy tools.

From 2007 to the Tor Project participated last year in the Google Summer of Code . Google paid for several months, students who wanted to contribute to open source software projects. So the students could gain practical experience, while the open source projects could benefit from the extra programming power. The size of the Google initiative has been adjusted, allowing Gate and the EFF not participate this year.

It was then decided to start his own initiative, called Tor Summer of Privacy . Students from all over the world, also from the Netherlands can apply for one of the available spots. For every student is a grant of $ 5,000 available. The idea is that students, under the supervision of a mentor, existing Tor privacy tools or develop their own ideas to improve the software.Registration is possible until April 17th. On 25 May, the Summer of Privacy start to finish then on 1 September.

Microsoft And Google To Stop Mass Surveillance NSA

Big tech companies such as Microsoft, Google and Yahoo and American civil rights organizations like the EFF and ACLU have the US Congress a letter ( PDF controlled) which they call to stop the mass surveillance of telephone calls. It involves conversation data collected under section 215 of the Patriot Act. Section 215 allows to store the metadata calls the NSA. On 1 June this year expires this section and thus the authority for the NSA.

Opponents this is a good time to implement reforms. Congress has, however, consistently refused reforms of section 215, with threats to national security are given as a reason. In the letter sent now Congress is called to ensure that any proposal that section 215 adjusts at least put an end to mass surveillance, establishes rules for transparency and no demands on data storage or technology.

"We understand that the government plays an important role in protecting our communities, but we must do so in a manner consistent with our values ​​that. Almost two years after the government surveillance became known, the US government still has work to do to distrust in technology that it has caused to recover, " says Microsoft's Fred Humphries.

EFF: Install New Computer Ever Again

If you buy a new computer that must first install all over again, because the software that comes standard is not to be trusted. That secures the American civil rights movement EFF. Following are programs like Superfish and PrivDog who intercepted the SSL traffic of users to inject ads and thus users exposed themselves to all kinds of risks.

This week it was announced that next Superfish, standard on some Lenovo notebooks shipped, other programs intercepting SSL traffic. One of these programs was PrivDog . A vulnerability in certain versions of PrivDog caused the software each certificate which replaced the Internet came and intercepted by a self-signed certificate. Even though it was about certificates that were not valid in the first place.

The Decentralized SSL Observatory of the EFF, which gathers information from the HTTPS Everywhere plugin for Firefox, has collected more than 17,000 different certificates PrivDog users. "Each of these licenses may be an attack. Unfortunately there is no way to know this for sure" says Joseph Bonneau of the Electronic Frontier Foundation (EFF).

"So what have we learned from this Lenovo / Superfish / Komodia / PrivDog debacle? For users, we have learned that the software is pre-installed on your computer can not be trusted, which means that reinstalling a clean operating system standard now procedure must be if someone has bought a new computer, " said Bonneau. The main lesson, he says, for software companies, which must stop intercepting SSL traffic of their users.

US Senator Concerned About Voice Recognition Smart TVs

US Senator Al Franken is concerned about voice recognition and call screening of smart TVs, which he both Samsung and LG has sent a letter to the manufacturers will be asked to further explain the operation of this feature and the use of data collected.

This week it was announced that Samsung televisions recorded words send it to a third party. In addition, consumers were warned that if they discuss confidential information, this data can be transmitted. "This relatively new technology has major implications for the privacy of people and I am concerned about the extent to which Samsung collects voice data SmartTV users and shares," said the senator's letter ( pdf ). He also worries that Samsung does not give customers the necessary information so that they understand how their voice data can be used by third parties.

A letter ( pdf ) with similar questions was sent to manufacturer LG. Senator wants to know how consumers can avoid voice and data viewing behavior are recorded and transmitted by the manufacturers. Samsung now has the operation of the voice recognition on their own blog clarified. So that the data is sent to Nuance Communications. Franks wants to know, however, whether there are other third parties that receive the data.

The American civil rights movement EFF warns of the privacy implications of smart TVs, which are present in the living room or bedroom and include cameras and microphones and have access to the viewing habits of users. This can provide very personal information. "If the software security researchers can not investigate on these devices and developers can not develop alternatives or adjustments, users are bound by the terms of the manufacturer and to trust that they are implemented as promised," the EFF.

The civil rights movement holds also that these smart TVs are often connected to the Internet and can be updated remotely.Therefore, the user's privacy is not just about delivering to the manufacturer, but to anyone who can access the television and can customize the software to gather additional information.

EFF Also Not Happy With YouTube Without Flash Player

In late January announced that Google's now standard HTML5 for video playback, so users do not have Adobe Flash Player need more, but according to the American civil rights movement EFF this is not a victory or improvement for Internet users.

The Electronic Frontier Foundation (EFF) is also not in favor of Adobe Flash Player, which it describes as a closed technology where regular vulnerabilities are found in exposing millions of users to attack. Switching to HTML5 seems at first sight, therefore an improvement, but it is anything but that, late science fiction writer, journalist and blogger Cory Doctorow know.

The problem is that to play Youtube videos without Flash Player Encrypted Media Extension (EME) is used. According Doctorow a controversial technology that Apple, Microsoft and Google, after consultation with Netflix agreed upon. In the spring of 2013 decided the World Wide Web Consortium (W3C) is behind to rally the extension. Last May, Mozilla joined here. According to the browser developer would be no support for Netflix users lose other browser vendors. To the annoyance of Doctorow, who likens it to "destroy the village to save it."

In the case of YouTube is it now means that users without Adobe Flash Player to view videos. "As long as your browser supports the W3C version of Adobe's proprietary software," says Doctorow. Firefox Users can view all the Youtube videos without Flash, but will in some cases require standardized by W3C Encrypted Media Extension. But who uses proprietary software from Adobe, including Mozilla announced last year. According Doctorow is therefore ultimately nothing changed.