Really funny if you are into crypto. From xkcd of course.
Unique Homepage Views:
Sitemeter Tracker & Counter
Today is Data Privacy Day. Start your celebration with Unqualified Offerings:
Snowden’s revelations must be especially hard on the psychiatric profession. If one patient dismisses the idea that the government is spying on him, and the other is convinced that the government is working with major electronics manufacturers to put listening devices in his personal belongings, which one do you diagnose as being unable to distinguish reality from fantasy?
At a University committee meeting recently, I suggested the University should provide us all with encryption so we can protect our data on our computers, and in transit, as it was at risk of interception. The ranking University official at the meeting smiled dismissively and said something along the lines of ‘Well, if you are worrying about that…”. I said, “but it’s national policy – the President announced it.” He stopped smiling.
New infographic from EFF:
And the press release:
Dropbox, Google, SpiderOak and Sonic.net Score Five out of Five in Crypto Best Practices
San Francisco – The Electronic Frontier Foundation (EFF) today published a new infographic to illustrate how 18 service providers are encrypting communication. The chart supplements EFF’s popular “Who Has Your Back” series, which evaluates how companies respond to government requests for user information.
Over the last three weeks, EFF surveyed the companies on whether they are now employing or have concrete plans to employ a set of five best practices: Encryption of data center links, Hypertext Transfer Protocol Secure (HTTPS) support, HTTP Strict Transport Security (HSTS) support, forward secrecy and STARTTLS for email encryption.
Four of the companies surveyed-—Dropbox, Google, SpiderOak and Sonic.net—-are implementing all of the measures. In addition, six companies-—the aforementioned four, plus Twitter and Yahoo–are taking, or have committed to taking, the critical step of encrypting the connections for their data centers to protect against backdoor access like the NSA’s MUSCULAR program.
“In light of the National Security Agency’s unlawful surveillance programs, as well as other threats to network security, it is now more important than ever to deploy strong encryption throughout networks,” EFF Senior Staff Attorney Kurt Opsahl said. Like all EFF content, the infographic is available for publication at no cost under the Creative Commons-Attribution License.
For a detailed explanation of the survey, the encryption practices and the chart: https://www.eff.org/deeplinks/2013/11/encrypt-web-report-whos-doing-what.
I guess I started somewhere between the crypto nut and the nihilist. These days some conspiracist sneaks in. The NSA really is building a huge data warehouse in Utah, you know….
People who care about crypto should read CDT’s new post, What the heck is going on with NIST’s cryptographic standard, SHA-3?
You rarely see a MITM attack in real life, but the Miami Heat (that’s 2-time champion basketball for the foreign readers) big man Chris Andersen, known as ‘Birdman’ for his Mohawk and many tattoos, appears to have been the victim of one:
Andersen’s lawyer and agent, Mark Bryant, said his client was duped by a woman in Canada who sought a relationship and gifts and who threatened a female acquaintance of Andersen’s in California while impersonating the tattoo-covered fan favorite known as “Birdman.”
Bryant said neither Andersen nor his acquaintance realized they weren’t communicating with each other online or via cellphone texts but rather were communicating with the woman in Canada, who impersonated one to the other.
The article at Huffington isn’t clear about all the messy details; more oddly it calls the scam a “Catfishing Hoax” but that doesn’t seem appropriate because (as I understand it) in a Catfishing scenario the other person doesn’t exist. Here, it sounds like both parties existed but an intermediary was able to insert herself into their communications. The Man in the Middle (MITM) attack is one of the things that security professionals worry about a great deal when assessing purportedly secure communications mechanisms.
Please feel free to correct me in comments if I misunderstood something.
Update: Much clearer article at ESPN.com, Heat’s Chris Andersen cleared:
“We were always confident that Chris was innocent but we just couldn’t figure out what had happened,” Andersen’s lawyer, Mark Bryant, told ESPN.com. “It turned out that it was a Manti Te’o situation. It was Manti Te’o on steroids.”
Te’o, the former Notre Dame football star, was caught up in a scheme last year when several individuals created a fake person and started a relationship with Te’o over the Internet, something known as “catfishing.”
In Andersen’s case, a woman in the middle used social media to dupe two people without their knowledge, according to police.
The woman, identified by the Denver Post as Shelly Lynn Chartier of Easterville, Manitoba, posed as Andersen in electronic conversations with a woman in California. Then she posed as the California woman in electronic conversations with Andersen.
Along the way, police told Andersen, she made threats pretending to be Andersen and attempted extortion pretending to be the woman from California. Chartier was arrested by Canadian authorities in January.
“When they searched Chris’ house they were basically looking for an I.P. address,” Bryant said. “But it wasn’t there. They kept investigating but it took time because it ended up involving two countries.”
More than a year after sheriffs from Douglas Country, Colo., searched Andersen’s home, they asked for a meeting with him. ….
… Using charts and slowly explaining their case, the authorities informed Andersen what had happened to him.
“It was right out of CSI with all the charts,” Bryant said. “When we walked in there both pretty hostile, it had been 15 months since this happened and we were cooperating but we hadn’t heard anything. Chris had a pretty good scowl.”
As the police started showing him what took place, Andersen unfolded his arms and then moved closer to the table. He and Bryant just looked at each other, stunned by what they were being told had taken place.
Basically, you can tamper with a logic gate to be either stuck-on or stuck-off by changing the doping of one transistor. This sort of sabotage is undetectable by functional testing or optical inspection. And it can be done at mask generation — very late in the design process — since it does not require adding circuits, changing the circuit layout, or anything else. All this makes it really hard to detect.
The paper talks about several uses for this type of sabotage, but the most interesting — and devastating — is to modify a chip’s random number generator.
Which means that the crypto is sabotaged.
Neither Bruce nor I is willing to say the NSA isn’t doing this.