Category Archives: Cryptography

New Certificate for

In the unlikely event you care, be aware that I have just installed a new digital certificate for


If your browser popped up a warning about the site’s cert changing, this is the reason. If it didn’t, well that just shows you how far we have to go in getting security to work well online.

The cert is issued by Let’s Encrypt, and replaces one I had to pay for.

Posted in Cryptography, | Leave a comment

My New Paper May Make Some of My Friends Angry

Building Privacy into the Infrastructure: Towards a New Identity Management Architecture comes to what I fear some of my friends in the privacy community will find to be an unacceptable conclusion.

I’ll be presenting it at the Privacy Law Scholars Conference in Washington next week. Hopefully, since many attendees are in fact friends, they won’t bring brickbats.

Posted in Cryptography, Econ & Money, Law: Internet Law, Law: Privacy, Surveillance, Talks & Conferences | Leave a comment

Clipper Chip on Ebay

clipper-s-l1600A guy is selling a T TSD 3600 Pair Clipper Chip Version New in Box Unused on E-Bay.

I have a birthday coming up, but the asking price is $250, which is just a bit too expensive. And I imagine the price will go up. Plus it sounds like they’d be hard to use, too.

Spotted via Scheier.

(Why do I care? The Metaphor is the Key: Cryptography, the Clipper Chip and the Constitution, 143 U. Penn. L. Rev. 709 (1995) and It Came From Planet Clipper, 1996 U. Chi. L. Forum 15.)

Posted in Cryptography | Leave a comment

Yahoo Does Apple v FBI

Yahoo! Politics has me on Apple and the slippery slope problem of government claiming powers to draf needed helpers under the All Writs Act.

Posted in Cryptography, Law: Constitutional Law, The Media | Leave a comment

Cory Nails It

A brief history of the surveillance debate:

2012: "Mass surveillance is fine — if it wasn’t, you’d see major corporations trying to court new business by building in crypto tools that kept out the surveillance agencies. The fact that they’re not doing this tells you that surveillance opponents are an out-of-touch, paranoid minority."

2016: "Mass surveillance is necessary — when companies use crypto tools as ‘marketing ploys,’ they’re getting in the way of something we all agree is proportionate and legitimate!"

Posted in Cryptography, Surveillance | Leave a comment

On the Apple v FBI Case

Talking HeadThe government’s attempt to get Apple to build a bespoke operating system so they can brute force access to an iPhone without it erasing its data has led the media to some of us who were in the first round of the crypto wars. Today was my turn. A few seconds on CBS in the Morning, ink in a nice explainer by Steve Lohr in the New York Times. I also spoke to the LA Times and the Wall St. Journal, but I haven’t seen what if anything they made of it.

I presume they found me because I wrote the first US legal article on law and encryption: The Metaphor is the Key: Cryptography, the Clipper Chip and the Constitution. There’s also a shorter sequel that some find easier to read, It Came From Planet Clipper.

The Apple case potentially raises at least these major legal issues:

  1. To what extent the government can use the All Writs Act to compel people unrelated to a case to provide unwilling technical support–here, Apple says, 12-40 man-weeks of expert engineering–to the government’s efforts to disable a security system in order to effectuate a search warrant or similar court order;
  2. Whether ordering a firm to write code (here, a bespoke phone OS), is a form of compelled speech violating the First Amendment
  3. Whether ordering a firm to digitally sign that code (or anything else) is an impermissible form of compelled speech
  4. Whether if a court can issue this order requiring assistance to disable a security system without violating the Constitutions, it follows that Congress could also legislate to forbid people from building strong security systems that the government cannot break into unassisted — and, most critically, whether that would mean the government could forbid the deployment of strong cryptographic tools without back doors. (This last issue was the main subject of the two articles I linked to above. It’s not a simple question.)

Although the Apple issue likely will be decided on non-constitutional grounds, the parties are making a record on the constitutional issues with an eye to a set of appeals that could go as far as the Supreme Court. The issues are important and interesting, so the media is right to treat this as a big deal.

Posted in Cryptography, Law: Constitutional Law, Law: Criminal Law, Law: Privacy, The Media | 1 Comment

Change Your LastPass Master Password

We want to notify our community that on Friday, our team discovered and blocked suspicious activity on our network. In our investigation, we have found no evidence that encrypted user vault data was taken, nor that LastPass user accounts were accessed. The investigation has shown, however, that LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised.

We are confident that our encryption measures are sufficient to protect the vast majority of users. LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side. This additional strengthening makes it difficult to attack the stolen hashes with any significant speed.

Nonetheless, we are taking additional measures to ensure that your data remains secure. We are requiring that all users who are logging in from a new device or IP address first verify their account by email, unless you have multifactor authentication enabled. As an added precaution, we will also be prompting users to update their master password.

An email is also being sent to all users regarding this security incident. We will also be prompting all users to change their master passwords. You do not need to update your master password until you see our prompt. However, if you have reused your master password on any other website, you should replace the passwords on those other websites.

Because encrypted user data was not taken, you do not need to change your passwords on sites stored in your LastPass vault. As always, we also recommend enabling multifactor authentication for added protection for your LastPass account.

Security and privacy are our top concerns here at LastPass. Over the years, we have been and continue to be dedicated to transparency and proactive measures to protect our users. In addition to the above steps, we’re working with the authorities and security forensic experts.

We apologize for the extra steps of verifying your account and updating your master password, but ultimately believe this will provide you better protection. Thank you for your understanding and support.

Joe Siegrist
& the LastPass Team


Frequently Asked Questions

Why haven’t I been notified by email? Emails are being sent to all users regarding the security incident. While this takes a bit longer than posting on the blog, we are working to notify users as fast as possible.

Do I need to change my master password right now? LastPass user accounts are locked down. You can only access your account from a trusted IP address or device – otherwise, verification is requested. We are confident that you are safe on your LastPass account regardless. If you’ve used a weak, dictionary-based master password (eg: robert1, mustang, 123456799, password1!), or if you used your master password as the password for other websites you need to update it.

via LastPass Security Notice | The LastPass Blog.

Posted in Cryptography, ID Cards and Identification | Leave a comment