India Protects Online Banking And Social Media In Encryption Law

The Indian Government under pressure online banking, social media and online shopping a new encryption law excepted. Recently the Indian government published a draft version of the bill (pdf),where citizens and businesses to October 16 this year to respond.

The policy Indians required to store a decrypted version of encrypted data 90 days, and their visible for making intelligence services. There was a storm of criticism, because a large part of the internet presence of encryption use. For example, the popular chat app WhatsApp encrypts data, as well as banks for online banking. Therefore, there is now for this type of service made ​​an exception, reports the BBC.

The bill also proposes that service both within and outside India who use encryption must first sign an agreement with the Indian government before they are allowed to offer such services in India. In addition, the bill states that the Indian government will prescribe the allowable encryption algorithms and key lengths.

According Pranesh Prakash, director of the Center for Internet and Society in Bangalore, the proposal is a bad idea coming from people who do not understand encryption. He also finds it strange that the bill not "sensitive government" applies. "What the government should do is to establish minimum encryption standards for government use, but here the opposite happens," said Prakash across the India Times.

Enigmail Is Encrypted Email Easily Create

The makers of Enigmail, a popular extension for the Thunderbird email client allowing users to email encrypted, working on a solution that encrypts e-mail via Thunderbird should be as simple as possible. For the development is in pretty Easy privacy cooperated.

Pretty Easy privacy (p = p) is a project that last year $ 51,000 through IndieGoGo managed to pick up and aims to make anonymous and encrypted e-mail. Enigmail and pretty Easy privacy will be offering the p = p technology to Thunderbird users.Although EnigMail the most popular solution for encrypting e-mail, most people send their emails encrypted, so states Patrick Brunschwig, main developer of Enigmail.

Encrypted email as Brunschwig unavoidable to protect privacy. By working with p = p needs to change this. P = p provides the ability to encrypt messages automatically, without requiring users to deal with issues such as key management. It is intended to be processed, this technology also in EnigMail. The first version of Enigmail and p = p must appear in December this year.

Cisco Fixes Problems Again With Standard SSH Keys

Cisco offers weather updates for different products released due to the use of standard SSH-keys. Using the default SSH keys, an attacker remotely without valid credentials on a login system with root privileges. The only thing that is required is that the attacker can connect to the platform.

According to Cisco, the problem is that all installations of the Web Security Virtual Appliance (WSAV), Email Security Virtual Appliance (Esau) and Content Security Management Virtual Appliance (SMAV) share the same authorized SSH key for the remote support functionality. Also, an attacker via the SSH host key can also all appliances is the same, and all communications between virtual appliances decrypt and mimic.

Cisco has released updates to fix the problems. Last October there appeared an update of a similar problem in the Cisco Unified Communications Manager Domain. The networking giant has announced that to their knowledge the newly discovered problems are not yet attacked or were previously known on the Internet.

Tor-Mail Service Attack Suspects By Intelligence

On the Tor-based e-mail service SIGAINT has warned users that it has become a target of a suspected intelligence, which were deployed in a total of 70 malicious servers. The attacking party would also recent months several attacks carried out against the infrastructure of the service. According to the managers of SIGAINT the attacks had failed, however.

SIGAINT only through the Tor network and accessible on the Internet to protect journalists and activists against the large-scale surveillance. The website sigaint.org state the address of the Tor website where SIGAINT is found. According to the manager, the alleged intelligence tried to change this address, so that Man-in-the-middle attacks could carry on users could spy on them in real time.

Probably therefore some passwords stolen, but it would have been the attackers not to do. "We get less than one user in the three months complaining that their account has been hijacked," said the manager. SIGAINT would have a total of 42,000 users. Because the e-mail service of the Tor network uses it depends on the servers in the network.

The Tor network consists of several servers on which the traffic passes. The last server in the chain is the exit node or exit relay. Through this server, which is added by volunteers to the Tor network, the request of the Tor user is sent to the Internet.The attackers had put in this case 70 of such servers. Because of this large number of suspects administrator SIGAINT that he has been the target of an intelligence service.

He leaves the Tor-mailing list that can be used for the website sigaint.org an SSL certificate to ensure that the content, and also the address of the Tor website is adjusted. An intelligence service might work, according to him so through using the key from a certificate authority from the country. The malicious Tor servers proved to be not only against SIGAINT deployed, but also can be used for other dubious affairs. All 70 servers have been placed on a blacklist.