Tag Info

Hot answers tagged

59

Foreword: This problem isn't necessarily about governments. At the most general level, it's about online services giving their data about you (willingly or accidentally) to any third party. For the purposes of readability, I'll use the term "government" here, but understand that it could instead be replaced with any institution that a service provider has a ...


44

Despite the media hype, the key thing here is not that the FBI/NSA/US Government was intercepting all phone calls, but that it was collecting all phone 'metadata' records which includes: Originating Phone Number Terminating Phone NUmber IMSI Number IMEI Number Trunk Identifier (which relates to the location) Telephone Calling Card numbers Time of the call ...


37

My opinion (and I am a cryptographer -- I have a shiny diploma which says so) is that: We cannot speculate on unknown algorithms, because they are, well, unknown. NSA is like all secret services in the World, they really love secrecy and will practice it for the sake of it. So the fact that their algorithms are not published is in no way indicative of some ...


31

To add to the answer from @RoryAlsop I'd agree that you probably don't, as an average person, have a lot to worry about in terms of the PRISM/phone tapping by the NSA being used for it's intended purprose (anti-terrorism operations by the US gov.) as people's concept of security/privacy most of the time isn't too great. There are other good reasons to be ...


26

The Internet at large is designed to resist nuclear blasts. At least, it was a design goal of its immediate predecessor, ARPANET. There is no secret: to survive loss of components, you must have redundancy. In the context of nuclear blasts, this means that there must exist several paths for data between any two machines, and the paths should be as ...


18

As someone who tracks people and their habits for a living, I will share a few observations about the average user. Implications of the phone information collection initiative on the internet: There will be a little more activity online worrying about privacy. The twitterverse will "explode" momentarily, but people will be aware of this as something going ...


17

Thanks for the insightful question. The more I think about it the more it feels like someone has pulled the rag below my feet (living without cryptographic protection). Analyzing the resulting threats (strictly from the business point of view - the requirements of dissidents etc. are a different story), I see them being: Corrupt government officials who ...


17

In theory you should still be able to achieve confidentiality protection in some circumstances, because crypto isn't the only way to provide confidentiality, you can also provide it via access control. Realistically however it is difficult to think of any real world system where you can usefully achieve this without at least something like SSL in the ...


17

What properties should an online voting system ideally have? Secure Each voter can vote only once The voting authority can't add or remove votes without getting caught Privacy/Anonymity Other people(including the state) can't find out what you voted for. You should not be able to prove to somebody else how you voted, to prevent bought votes, or votes ...


14

An interesting data point here is the DES s-box constants. Wikipedia NSA Wikipedia DES NSA recommended changes in the S-box constants to make DES resistant to differential analysis, which was unknown in the academic and commercial cryptography world at the time. In that case, they were able to make that improvement in a way that was opaque to the users of ...


14

@D3C4FF's answer hits the nail squarely on the head, however there is a further viewpoint regarding the average internet user: The average internet user has no concept of privacy, other than "the government looking at my data is bad, mmmkay" The average user shares far more information about themselves, deliberately, with the rest of the world than the ...


13

I think there's not enough information to answer. Without seeing the exact text of the law, we can't say whether it will be possible to communicate securely; it depends. That said, I will make two small points. I think if legislators really want to prevent secure communication, they'll do that. Sometimes technical folks think that legislators are dumb ...


13

It is not known how to build an Internet voting system that will be verifiably secure and auditable. Ron Rivest, Turing award winner and the R in RSA, has famously compared Internet voting to drunk driving: something you just can't do safely. (By Internet voting, I mean voting over the Internet from client computers not controlled by election authorities, ...


13

Even without cryptography, you could use steganography to make information hard or in some cases near impossible to find. It seems difficult to imagine a situation under which government could effectively ban that, since one could claim that a secret message was hidden anywhere and it is very difficult for an accused individual to demonstrate otherwise ...


13

Can this site be trusted? No. Well, not if you consider GoDaddy subverted or subvertable. As even the published serial number or website could be an FBI plant ;-). But if you want your emails, you'll need to connect to the site. What is the reason for allowing password changes only for five days in this context? We are assuming that the ...


12

I don't believe in security by obscurity in general, but in case of crypto it's actually worse, because it violates Kerckhoffs Principle So is it better? Maybe. Is it different? Sure. Is it necessary to hide the algos? If your crypto was good to begin with, you would not need to hide the algorithms, just the keys. On the other hand, you have the 'many ...


11

There isn't really enough information out there to know exactly what is being collected, but if most of it is meta data in nature or user records from services, then a VPN isn't really relevant. For the first situation (phone/Internet connection meta-data), the contents are not being requested, but only what connections are made. While the contents of your ...


10

It's Always Been an Issue, You Just Didn't Care I'm not sure you need to worry that much more about it than you should have before. Keep in mind that what they are collecting are your operator's Call Data Records (or at leat a subset of that). You were already trusting a third-party with all that, and that was already a third-party I personally wouldn't ...


9

tl;dr: Internet voting is certainly a bad idea now for important elections. Many of us consider secure Internet voting one of the great unsolved problems in IT Security. That's because of the very challenging requirement for both anonymity and transparency. It also combines the enormous challenges of securing both clients and servers, and requires dealing ...


9

Preventing government-led Internet blackouts is highly unlikely, since governments have very close ties to the telecom industry for a reason. By the time Effects-Based Operations on that scale are in play, the likely outcome of a conflict is already decided. Voice communication would be of much more value, and that's a completely different question in my ...


8

I think the German high court nailed down the problem very well: Verifiability The German constitutional court ruled about any kind of voting devices: The usage of voting devices [...], is in compliance with the constitutional requirements only, if the essential steps of the voting and counting can be verified reliably and without expert knowledge. ...


8

In my experience in high level agreements of any type it's very difficult to insert specific requirements relating to security due to the challenge of matching controls that different organisations have in place (i.e. trying to get the other party to state compliance against your specific standards) That's why most times, you'll see language around things ...


8

What is the reason for allowing password changes only for five days in this context? It might speculate on the government being slower to get a court order. But given enough priority, they can be very fast. I know little about USA law, in German the police has additional permissions in case of "imminent danger". Another reason might be to put pressure ...


7

For the sake of argument even if the endpoints are secure, what is stopping the govt from intercepting the email within transit? PGP/GPG will solve the problem of intercepting the email within the transit. However, then security will depend on the security of the private key stored on the email server itself or in your personal computer.In case of PRISM (as ...


7

Nope it will be as secure as you can configure it and like you say the end point might not be secure. If you want to have security you should encrypt your emails with pgp/gpg.


7

As the software developer, you need to ensure that not only the chosed encryption standard is FIPS compliant, but also the cryptographic module used. AES for example is FIPS 140-2 approved as a method, but the actual implementation of the Rijndael algorithm on Windows Server 2008 [not R2] is not approved (and is therefore not FIPS compliant ... you'd have to ...


7

There's a broad spectrum of methods that could be used to monitor your communication. External Monitoring ("Lawful Intercept") Your attacker could be monitoring your communication upstream. This could be because they're working with your ISP, or they're sniffing your home network (wired or wireless). You said that your attacker knows things you typed... ...


7

Unfortunately, HTTPS is about as good as it gets in a situation like this. Encryption will help you prevent someone from viewing your messages in transit, and HTTPS is the correct tool for that in this case. However, the real security hole here isn't transmission of data, it's who you're sending it to. Whenever you visit BBC News or Stack Overflow, they ...


7

While I dont know how most critical infrastructure is defended against EMP threats I do know of many instances of critical infrastructure offer no protection to these kinds of threats. This does however not mean that there does not exist protection. Take for example Kelvedon Hatch nuclear bunker. Some of its features, and which should be considered in any ...


7

Between cleartext and cryptographic encryption there's a vast area of obfuscation. From natural stuff (a foreign language/alphabet), through technical (little-endian, UTF-16, EBSDIC), through oddities/obscurity (large binary files with internal, unpublished structures), to non-cryptographic-grade encryption (ROT13). They can all be defeated with enough ...



Only top voted, non community-wiki answers of a minimum length are eligible