ProtonMail, Tutanota among authors of letter urging EU to reconsider encryption rules

Encrypted service providers are urging lawmakers to back away from a controversial plan that critics say would undercut effective data protection measures.

ProtonMail, Threema, Tresorit and Tutanota — all European companies that offer some form of encrypted services — issued a joint statement this week declaring that a resolution the European Council adopted on Dec. 14 is ill-advised. That measure calls for “security through encryption and security despite encryption,” which technologists have interpreted as a threat to end-to-end encryption. In recent months governments around the world, including the U.S., U.K., Australia, New Zealand, Canada, India and Japan, have been reigniting conversations about law enforcement officials’ interest in bypassing encryption, as they have sporadically done for years.

In a letter that will be sent to council members on Thursday, the authors write that the council’s stated goal of endorsing encryption, and the council’s argument that law enforcement authorities must rely on accessing electronic evidence “despite encryption,” contradict one another. The advancement of legislation that forces technology companies to guarantee police investigators a way to intercept user messages, for instance, repeatedly has been scrutinized by technology leaders who argue there is no way to stop such a tool from being abused.

https://www.cyberscoop.com/encryption-europe-tutanota-protonmail-threema-tresorit/

#tutanota #protonmail #threema #eu #encryption
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

Encryption: GPG needs to go

The GnuPG team disregards basic security practices and, on top of that, reacts stroppy when hinted. Thankfully, there is a replacement.

The GnuPG software project is a free and widely used program for encrypting and signing files, and is one of the central building blocks of secure communication over the Internet and in the development of a wide range of open source software. However, a recent bug in GnuPG shows once again that the project, which is actually focused on security, completely disregards common and especially basic security practices and should simply no longer be used.

GnuPG team reacts scandalously

However, the fact that the bug was only discovered after the software was released in a stable version by an external researcher is not the real scandal. Mistakes are human and happen. What is scandalous is the reaction of the GnuPG developers to the proposal to systematically test their software in the future using Asan and a CI system. Although this is now an extremely widespread practice in the industry, it apparently does not happen at GnuPG so far.

The corresponding request to implement a system for Continuous Integration Testing (CI) was stroppy moderated in the bug tracker by the main developer Werner Koch and the corresponding bug was marked as invalid. Specifically, the bug report points out that another bug could have been found through systematic testing with the help of Asan. Such trivial bugs should never appear in a stable version of a software written in C, especially not in such an extremely security-relevant one as GnuPG.

https://dev.gnupg.org/T5279#142665

https://twitter.com/tqbf/status/1355176541139972098

https://www.golem.de/news/verschluesselung-gpg-muss-endlich-weg-2102-153820.html

#gpg #encryption #thinkabout
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

UK Police Chief falsely claims that end to end encrypted messaging “puts lives at risk”

The Metropolitan Police in the United Kingdom (UK) really really don’t want Facebook to bring end to end encryption to Facebook Messenger and Instagram. In fact, a police chief went so far as to say that offering end to end encryption would “’unequivocally put lives at risk.” The words were uttered by Detective Chief Superintendent Kevin Southworth – who head’s the country’s online anti-terrorism efforts.

Law enforcement fears that end to end encryption will make it harder for Facebook’s internal compliance teams to root out terrorist and child exploitative materials on their platforms. Some non peer reviewed estimates even suggest that the efficacy of Facebook’s internal review programs will be reduced by as much as 70% if end to end encryption is implemented. Of course, the authorities would never try to enumerate how many lives would be put at risk if end to end encryption isn’t allowed to be implemented.

Despite what the government claims: End to end encryption isn’t a bad thing

The fact of the matter is that banning end to end encrypted messaging would put more lives at risk. Banning end to end encrypted messaging isn’t even a mathematical possibility. The United Kingdom has previously suggested a not-so-well-named GHOST protocol as a way of adding authorities to end to end encrypted chat groups. While Southworth was quick to clarify that they weren’t asking Facebook to build encryption backdoors – just taking the official stance that the public shouldn’t have end to end encryption tools.

https://www.privateinternetaccess.com/blog/uk-police-chief-falsely-claims-that-end-to-end-encrypted-messaging-puts-lives-at-risk/

#uk #police #encryption #messaging #thinkabout
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

Mass Extraction: The Widespread Power of U.S. Law Enforcement to Search Mobile Phones

Every day, law enforcement agencies across the country search thousands of cellphones, typically incident to arrest. To search phones, law enforcement agencies use mobile device forensic tools (MDFTs), a powerful technology that allows police to extract a full copy of data from a cellphone — all emails, texts, photos, location, app data, and more — which can then be programmatically searched. As one expert puts it, with the amount of sensitive information stored on smartphones today, the tools provide a “window into the soul.”

This report documents the widespread adoption of MDFTs by law enforcement in the United States. Based on 110 public records requests to state and local law enforcement agencies across the country, our research documents more than 2,000 agencies that have purchased these tools, in all 50 states and the District of Columbia. We found that state and local law enforcement agencies have performed hundreds of thousands of cellphone extractions since 2015, often without a warrant. To our knowledge, this is the first time that such records have been widely disclosed.

Every American is at risk of having their phone forensically searched by law enforcement.

https://www.upturn.org/reports/2020/mass-extraction/

💡 Read as well:
https://www.eff.org/deeplinks/2021/03/fbi-should-stop-attacking-encryption-and-tell-congress-about-all-encrypted-phones

#usa #fbi #lawenforcement #massextraction #MDFT #mobilephones #cellphones #encryption #decryption #study #thinkabout
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

What’s in your browser (backup)?

It’s not every day that I wake up thinking about how people back up their web browsers. Mostly this is because I don’t feel the need to back up any aspect of my browsing. Some people lovingly maintain huge libraries of bookmarks and use fancy online services to organize them. I pay for one of those because I aspire to be that kind of person, but I’ve never been organized enough to use it.

In fact, the only thing I want from my browser is for my history to please go away, preferably as quickly as possible. My browser is a part of my brain, and backing my thoughts up to a cloud provider is the most invasive thing I can imagine. Plus, I’m constantly imagining how I’ll explain specific searches to the FBI.

All of these thoughts are apropos a Twitter thread I saw last night from a Chrome developer, which purports to explain why “browser sync” features (across several platforms) don’t provide end-to-end encryption by default.

https://blog.cryptographyengineering.com/2021/03/25/whats-in-your-browser-backup/

#chrome #browser #backup #sync #encryption #thinkabout
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

Nasdaq and Intel are teaming up on a new type of encryption that could prove key in speeding up adoption of AI and cloud tech on Wall Street

As banks, lenders, and other financial institutions increasingly turn towards artificial intelligence as a way to quickly analyze vast quantities of data, they're also attracting attention from US regulators.

Rulemakers' focus on AI is, in part, a result of concerns surrounding the safety and anonymity of customer data when used by this cutting-edge tech.

But a new tech collaboration between Nasdaq and Intel announced Tuesday might offer a solution. The partnership will see the trading venue adopt what's called homomorphic encryption, or HE, alongside Intel's latest-generation processors.

HE allows customers to perform AI and machine-learning computations on private data without ever having to decrypt the data itself, an especially critical tool in financial services where the safety of user data is increasingly important.

It's a technology that Intel also recently announced it's exploring with DARPA (The Defense Advanced Research Projects Agency, an arm of the Department of Defense) and will in Nasdaq's case provide the opportunity for next-generation computing to be tested in a business setting.

The ability to analyze large amounts of encrypted data using HE could lead to more efficient tools focused on anti-money laundering and fraud prevention efforts, areas that typically include sensitive data. Apart from finance, industries like healthcare, which tends to have restrictions around individuals' data, also stands to benefit from the use of HE.

HE could also help further increase the adoption of the public cloud, a growing trend on Wall Street. Concerns around data security in the public cloud would be alleviated by being able to keep the data encrypted.

https://telegra.ph/Nasdaq-and-Intel-are-teaming-up-on-a-new-type-of-encryption-that-could-prove-key-in-speeding-up-adoption-of-AI-and-cloud-tech-on-04-07

via www.businessinsider.com

#nasdaq #intel #encryption #ai
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

Interview with Hanna from Tutanota

Interview with Hanna from Tutanota about the importance of encryption in email, some of Tutanota's offerings and more.

https://www.youtube.com/watch?v=vLvxf6IxhPQ

#tutanota #encryption #email #interview #video
📡 @nogoolag 📡 @blackbox_archiv

Octopus - an alternate OpenPGP backend for Thunderbird built on top of Sequoia

We are thrilled to release the first version of the Octopus, an alternate OpenPGP backend for Thunderbird built on top of Sequoia.

The Octopus is a drop-in replacement for RNP, the OpenPGP library shipped with Thunderbird 78. In addition to providing all of the RNP functionality that Thunderbird uses, the Octopus also includes a number of enhancements. These fall into several categories. The Octopus restores some functionality that was present in Enigmail, but removed or has not yet been reimplemented in Thunderbird’s OpenPGP integration. In particular, the Octopus uses GnuPG’s keystore, interacts with gpg-agent, integrates GnuPG’s web of trust information, and updates certificates in the background.

The Octopus includes a number of security fixes and improvements. For instance, it fixes Thunderbird’s insecure message composition, and automatically encrypts in-memory secret key material at rest. The Octopus adds a few performance improvements, such as, parsing the keyring in the background and using multiple threads. And, the Octopus has better support for parsing less usual, but not necessarily esoteric, certificates and keys.

https://sequoia-pgp.org/blog/2021/04/08/202103-a-new-backend-for-thunderbird/

#thunderbird #octopus #sequoia #OpenPGP #GnuPG #encryption #backend
📡 @nogoolag 📡 @blackbox_archiv

Strategic autonomy in danger: European Tech companies warn of lowering data protection levels in the EU.

The EU is highly respected internationally for its data protection laws such as the GDPR. Now an EC initiative could be a threat to Europe's strategic autonomy.

Today we are sending an open letter to the European Commission together with #Boxcryptor, #Cryptomator, mail.de, #Mailfence, #Praxonomy, and #Tresorit to draw attention to the dangers of undermining encryption and people's privacy. Mass surveillance will not stop terrorism or child sexual abuse.

Joint open letter for right to privacy

In the course of the initiative "Fighting child sexual abuse: detection, removal, and reporting of illegal content", the European Union plans to abolish the digital privacy of correspondence. In order to automatically detect illegal content, all private chat messages are to be screened in the future. This should also apply to content that has so far been protected with strong end-to-end encryption. If this initiative is implemented according to the current plan it would enormously damage our European ideals and the indisputable foundations of our democracy, namely freedom of expression and the protection of privacy (see EDRi letter). The initiative would also severely harm Europe’s strategic autonomy and thus EU-based companies.

Europe as a global technology leader is respected internationally for its high level of data protection, notably due to the exemplary effect of the GDPR. In an internationally very competitive market, European companies are in first position when it comes to data protection. The EU initiative could now endanger this unique selling point of European IT companies.

https://tutanota.com/blog/posts/european-autonomy-in-danger/

#tutanota #surveillance #gdpr #eu #encryption #privacy #thinkabout
📡 @nogoolag 📡 @blackbox_archiv

Facebook Pushes Ahead with Plans for Full End-to-End Encryption of its Messaging Tools

Despite ongoing concerns about the proposal among various authorities, Facebook is pushing ahead with its plan to implement full end-to-end encryption by default within all of its messaging tools.

Within an overview of a recent virtual workshop Facebook held with experts in privacy, safety, human rights and consumer protection, the company noted that:

"We’re working hard to bring default end-to-end encryption to all of our messaging services. This will protect people’s private messages and mean only the sender and recipient, not even us, can access their messages. While we expect to make more progress on default end-to-end encryption for Messenger and Instagram Direct this year, it’s a long-term project and we won’t be fully end-to-end encrypted until sometime in 2022 at the earliest."


The news of Facebook's continued work on this front will please privacy advocates - but as noted, various authorities have raised significant concerns with the plan, with respect to how such a process could be used to hide criminal activity, with no way for authorities to track such exchanges.

https://telegra.ph/Facebook-Pushes-Ahead-with-Plans-for-Full-End-to-End-Encryption-of-its-Messaging-Tools-05-01

via www.socialmediatoday.com

#facebook #DeleteFacebook #encryption #messaging
📡 @nogoolag 📡 @blackbox_archiv