-
David, you're cryptic enough as it is, you don't have to worry about encryption.
:)
-
Encryption works.
The NSA and GCHQ likely have corporate spies who access the private keys, and thus can decrypt things signed with those keys.
You're still safe with many forms of encryption (OpenVPN, perfect forward secrecy, etc).
You may not know how to configure such stuff, but just accept that the people who make OpenVPN, and even Google's Gmail encryption do know this stuff.
By using encryption routinely, when the strong stuff exists you'll be using it.
If you abandon encryption, you'll have nothing.
In many ways, whilst weak encryption is weak and is broken, the strong stuff is really good, not broken (mathematically) and even with a private key an attacker would only have the start of a piece of communication.
Hold your nerve, encrypt all the things.
-
Open source is not a universal panacea though - for example in Android of certain parts of the OS being closed source- the parts provided by Qualcomm to interface with their chips etc.
No use 90% of the stack being open to inspection but the remaining 10% potentially being written in consultation with the NSA.
Mikko Hyponnen tweeted the other day that his iPhone cheerfully told him that it's root certificate was from the US Govt- a government with which he had nothing to do, but making it clear that nothing done on the device should be considered in anyway private.
Ironically they're more open about the lack of privacy than the open source OS, in a way.
It's all a bit shit, really.
https://mobile.twitter.com/mikko/status/327170802673917952/photo/1
-
My understanding of it was that "They" had gotten backdoors into paid for encryption tech, ie. closed source. That sort of thing shouldn't be able to happen with open source software, as there are too many people that do understand it watching it...
That's certainly some of it, we know they did that with Microsoft and Oracle. But with the ones that didn't play game, they just used espionage to steel the keys.
The big takeaway should simply be: They haven't broken the theory or practical nature of encryption. Instead they've gone for the weakest link which are the humans and processes of the companies that provide encryption.
The NSA and GCHQ have kinda done this:
But encryption actually does work, providing you aren't using one of the compromised providers (a closed device is most likely compromised, but you can still encrypt your communications with OpenVPN, and your files with Truecrypt).
-
The other way it works is that the police ask for your encryption keys and throw you in jail under the Regulation of Investigatory Powers Act 2000, Part III if you refuse to hand them over. At least with this approach you know when they are reading your emails and trawling through your search history and cached images and no one hits you with a spanner, even if you do take a couple of tumbles down the stairs on your way back from the interview room.
-
Snowden himself said "encryption works".
http://techcrunch.com/2013/06/17/encrypting-your-email-works-says-nsa-whistleblower-edward-snowden/
-
The other way it works is that the police ask for your encryption keys and throw you in jail under the Regulation of Investigatory Powers Act 2000, Part III if you refuse to hand them over. At least with this approach you know when they are reading your emails and trawling through your search history and cached images and no one hits you with a spanner, even if you do take a couple of tumbles down the stairs on your way back from the interview room.
I had a meeting with a client (fairly significant global consumer electronics company) who had an issue with a hacker who had been targetting them his entire "career", the issue was that he used a virtual machine to store everything that was configured to delete itself if he didn't login every 6 hours.
Hence, when the police kicked his door down and hauled him into custody all he had to do was to keep schtum for that period, then happily hand over his keys, as it were.
This had annoyed the client quite a lot.
-
New announcement from Cameron - Extremist websites to be blocked now.
I picked it up from http://revk.http://www.me.uk/2013/11/brave-move.html but can't find it in Hansard at the moment. The wedge slips a little further in...
-
- Extremist websites to be blocked now.
Extreme bike love on this site (hyperlink to lfgss.sm)
Such extremists should be banned (and tagged) - Extremist websites to be blocked now.
-
I've said it many times before, and I'll keep saying it. Sexual health is not "adult content". Lumping important (and for many young people, the only) sexual health advice they will have access to in with porn is a mistake. I've always supported voluntary blocks installed by parents on a home by home basis, but phone and internet providers need to understand that doing this for everyone as a default is not their job. More to the point, politicians need to understand that making internet providers do so is not the Government's job.
There is also a concern for LGBT teens, some of whom will not have the support of their families and may have little access to safe, reliable information about sex and sexuality. What about them?
Maybe internet providers mistakenly believe that good, thorough sex and relationships education is available in schools, but as the Telegraph Wonder Women Better Sex Education campaign has demonstrated this year, it isn't. Sex ed as it currently exists is not fit for purpose. The teaching guidelines haven't been updated in over a decade and make no mention of the internet.
-
O2 parental controls block samaritans website by default: https://pbs.twimg.com/media/BcBt1q7IMAALjFJ.png:large
Excellent work by an ISP, lots more of this to come!
-
And we have it:
http://urlchecker.o2.co.uk/urlcheck.aspxCheck http://www.lfgss.com/
And we are blocked by parental controls.
-
Feel free to retweet this: https://twitter.com/buro9/status/414684549218455552 and this: https://twitter.com/buro9/status/414684959308132352
As my MP is mentioned on it and she might freak out about it and actually start to question it.
I had emailed her about it, her written response was laughable and basically said "Think of the children", and "This is for your own good", and did not at all address the very real risk that the policy that the Conservatives have pushed private companies to enforce is poorly expressed and has no way for small businesses or website owners to resolve the issues, and in many cases we cannot even get visibility over who is blocking us or why.
Please also tweet your MP, let them know what is happening and that it's not acceptable.
skydancer
bothwell
n3il
Oliver Schick
MrDrem
Dammit
Ramsaye
hippy-
Post a reply
About
UK "default on" ISP censoring will include "web forums" by default
Posted by
@Velocio
We can't encrypt anything?