Encryption


'Encryption' Articles

Apple Criticizes Proposed Anti-Encryption Legislation in Australia

The Australian government is considering a bill that would require tech companies like Apple to provide "critical assistance" to government agencies who are investigating crimes. According to the Australian government, encryption is problematic because encrypted communications "are increasingly being used by terrorist groups and organized criminals to avoid detection and disruption." As noted by TechCrunch, Apple today penned a seven-page letter to the Australian parliament criticizing the proposed legislation. In the letter, Apple calls the bill "dangerously ambiguous" and explains the importance of encryption in "protecting national security and citizens' lives" from criminal attackers who are finding more serious and sophisticated ways to infiltrate iOS devices.In the face of these threats, this is no time to weaken encryption. There is profound risk of making criminals' jobs easier, not harder. Increasingly stronger -- not weaker -- encryption is the best way to protect against these threats.Apple says that it "challenges the idea" that weaker encryption is necessary to aid law enforcement investigations as it has processed more than 26,000 requests for data to help solve crimes in Australia over the course of the last five years. According to Apple, the language in the bill is broad and vague, with "ill-defined restrictions." As an example, Apple says the language in the bill would permit the government to order companies who make smart home speakers to "install persistent eavesdropping capabilities" or require device makers to create a tool to unlock

'Five Eyes' Governments Urge Tech Companies to Build Backdoors into Encrypted Services

Five nations including the U.S. and the U.K. have urged tech companies to comply with requests to build backdoors into their encrypted services, or potentially face legislation requiring them to do so by law. The statement is a result of a meeting last week between the "Five Eyes" intelligence sharing countries, which include the U.S., the U.K., Canada, Australia, and New Zealand. In a published memo, the governments claim that the use of such backdoors for accessing encrypted data would respect personal rights and privacy, and be limited only to criminal investigations by law enforcement. Privacy laws must prevent arbitrary or unlawful interference, but privacy is not absolute. It is an established principle that appropriate government authorities should be able to seek access to otherwise private information when a court or independent authority has authorized such access based on established legal standards. The same principles have long permitted government authorities to search homes, vehicles, and personal effects with valid legal authority.The memo goes on to note that each of the Five Eyes jurisdictions will consider how to implement the statement principles, including "with the voluntary cooperation of industry partners", while adhering to lawful requirements for proper authorization and oversight. The statement of principles underlines the fractious relationship between some governments and tech companies regarding encryption over the last few years, in which the popularity of digital messaging services has exploded. The U.K. government has long

Facebook Fights US Government Demand to Break Messenger Encryption in Criminal Case

Facebook is contesting a demand from the U.S. government that it break the encryption of its popular Messenger app so that law enforcement can listen in to a suspect's conversations as part of an ongoing investigation into the MS-13 gang. The U.S. Department of Justice's demand is in relation to a case proceeding in a federal court in California that is currently under seal, so public files are unavailable. However, Reuters' sources said the judge in the case heard arguments on Tuesday on a government motion to hold Facebook in contempt of court for refusing to carry out the surveillance request. Facebook says it can only comply with the government's request if it rewrites the code relied upon by all its users to remove encryption or else hacks the government's current target, according to Reuters. Legal experts differed over whether the government would likely be able to force Facebook to comply. However, if the government gets its way in the case, experts say the precedent could allow it to make similar arguments to force other tech companies to compromise their encrypted communications services. Messaging platforms like Signal, Telegram, Facebook's WhatsApp and Apple's iMessage all use end-to-end encryption that prevents communications between sender and recipient from being accessed by anyone else, including the service providers. Tech companies have pushed back against previous attempts by authorities to break encryption methods, such as the FBI's request that Apple help it hack into the iPhone owned by Syed Farook, one of the shooters in the December

Australia Prepares Laws Forcing Tech Companies to Help Police Access Encrypted Data of Criminals

Australia is gearing up to release new laws that will force Australian telecommunications companies and global tech companies to comply with law enforcement agencies, when such agencies ask for access to encrypted data on the smartphones of suspected criminals (via ABC News Australia). The laws are the latest in an ongoing global data battle that hit a fever pitch in the United States in early 2016 when the FBI asked Apple for a backdoor into the smartphone of one of the San Bernardino shooters. Specifics in regards to the Australian laws have not yet been shared, but they are said to affect companies like Apple, Facebook, and Google, which would face "significant fines" if they choose not to comply with encrypted data requests. Australian telecommunications companies affected under the law include Telstra and Optus. Cyber security minister of Australia Angus Taylor was asked if the laws would allow surveillance codes to be implanted into smartphones and "avoided directly answering," stating a lack of preparation to get into technical details. Notably, one detail Taylor did confirm is that the government would not ask companies to install a backdoor into their apps and equipment, nor would they be asked to "provide law enforcement agencies with an encryption key." Because of this, it's unclear exactly how the Australian government's demands would need to be met by companies. "There's been ideas around for decades that you should create some kind of key that law enforcement can get access to, to access any data at any time — that's not what we're proposing

Russia Demands Apple Remove Telegram From Russian App Store

The Russian government has asked Apple to help it block Telegram, the secure messaging app that's highly popular in the country, reports WCCFTech. A Russian court in April ordered carriers and internet providers in the country to block Telegram back in April, after Telegram refused to provide Russia with backdoor access to user messages. Telegram, for those unfamiliar with the app, offers end-to-end encryption for secure messaging purposes. With end-to-end encryption, no one, not even Telegram, can access the messages that are sent between users. Despite issuing the block order back in April, Russia has only been able to disrupt Telegram's operations in the country by 15 to 30 percent. Given the government's inability to block the app, Roskomnadzor, the division of the government that controls media and telecommunications, has demanded that Apple remove the Telegram app from the Russian App Store. The group first asked Apple to remove the app in April, but is appealing to Apple again. "In order to avoid possible action by Roskomnadzor for violations of the functioning of the above-mentioned Apple Inc. service, we ask you to inform us as soon as possible about your company's further actions to resolve the problematic issue," the regulator wrote. Roskomnadzor has given Apple one month to remove the Telegram app from the App Store. Roskomnadzor's director Alexander Zharov said he did not want to "forecast further actions" should Apple not comply with the request following the 30 day period. The Russian government said that it needed access to Telegram

Researchers Discover Vulnerabilities in PGP/GPG Email Encryption Plugins, Users Advised to Avoid for Now

A warning has been issued by European security researchers about critical vulnerabilities discovered in PGP/GPG and S/MIME email encryption software that could reveal the plaintext of encrypted emails, including encrypted messages sent in the past. The alert was put out late on Sunday night by professor of computer security Sebastian Schinzel. A joint research paper, due to be published tomorrow at 07:00 a.m. UTC (3:00 a.m. Eastern Time, 12:00 am Pacific) promises to offer a thorough explanation of the vulnerabilities, for which there are currently no reliable fixes. There are currently no reliable fixes for the vulnerability. If you use PGP/GPG or S/MIME for very sensitive communication, you should disable it in your email client for now. Also read @EFF’s blog post on this issue: https://t.co/zJh2YHhE5q #efail 2/4— Sebastian Schinzel (@seecurity) May 14, 2018 Details remain vague about the so-called "Efail" exploit, but it appears to involve an attack vector on the encryption implementation in the client software as it processes HTML, rather than a vulnerability in the encryption method itself. A blog post published late Sunday night by the Electronic Frontier Foundation said:"EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages."In the meantime, users of PGP/GPG and S/MIME are being advised to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted

Anti-Surveillance Coalition That Includes Apple Condemns Proposals for Device Backdoors

The Reform Government Surveillance coalition, which includes several major tech companies who have teamed up to lobby for surveillance law reform, this week released a statement condemning recent proposals for backdoor access into electronic devices and reaffirming a commitment to strong encryption. The coalition is made up of multiple tech companies who have taken a strong stance against weakening encryption, including Apple, Google, Microsoft, Dropbox, Snap, Evernote, LinkedIn, Oath (owned by Verizon) and Facebook.Reform Government Surveillance recently announced a new core principle on encryption that will guide our advocacy efforts, and we continue to believe that strong encryption helps protect the security and privacy of individuals and companies around the world. We have consistently raised concerns about proposals that would undermine encryption of devices and services by requiring so-called "exceptional access" for law enforcement. Recent reports have described new proposals to engineer vulnerabilities into devices and services - but they appear to suffer from the same technical and design concerns that security researchers have identified for years. Weakening the security and privacy that encryption helps provide is not the answer.As ZDNet points out, the statement comes following a WIRED article profiling Microsoft chief technical Ray Ozzie and his suggestion for a solution called "Clear" that would supposedly provide law enforcement with access to encrypted data with less security risk. Ozzie's proposal uses a public key and a private key (housed and

Russia Bans Access to Telegram Encrypted Messenger Service [Updated]

A Russian law court has ordered that access to the Telegram encrypted messaging service should be blocked, according to Russian news agencies on Friday (via Reuters). The development follows last week's news that Russia's media regulator had filed legal proceedings to block the app in the country because the company refused to enable state security services to access users' messages. The Telegram platform allows people to communicate with each other using end-to-end encryption, meaning no-one – not even Telegram – has access to messages sent between users. The app has over 200 million users globally. They include Kremlin staff, who use Telegram to coordinate conference calls with Vladimir Putin's spokesman. Many government officials also use the messenger app to communicate with media, according to Reuters. When Reuters asked a person in the Russian government on how they would operate without access to Telegram, the person, who asked not be identified due to the sensitivity of the issue, replied by sending a screenshot of his mobile phone with an open VPN app.Telegram becomes the second global network after LinkedIn to be blocked in Russia. In 2016, a court found LinkedIn guilty of violating a law that requires companies holding Russian citizens' data to store it on servers within Russia. Update 04/17: The Russian government has formally requested that Apple remove Telegram from its regional App Store in the country, reports Reuters. Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics,

Russia Moves to Ban Telegram Encrypted Messaging Platform

Russia appears to be following through on its threat last year to block access to the Telegram encrypted messaging platform. The BBC reports today that the Roskomnadzor media regulator has begun legal proceedings to block the app in the country, after Dubai-based Telegram refused to comply with requests that it hand over the encryption keys. Telegram was given a deadline of 4 April to hand over the keys, but the company has refused, explaining that the way the service is built means it has no access to them. Russia's main security agency, the FSB, wants the keys so it can read messages and prevent future terror attacks in the country. In its court filing, Roskomnadzor said the legal action was related to the FSB request and Telegram's non-compliance with its legal requirements as a "distributor of information".Telegram's lawyer, Pavel Chikov, called the Russian attempt to block the app "groundless" and said the FSB's demand to access users' chat logs was "unconstitutional, baseless, which cannot be fulfilled technically and legally". Telegram had a legal challenge to the demand dismissed in a Moscow court in March, but the platform creator Pavel Durov has said Telegram, which is widely used in Russia, will not "give up" the private data of its users. Threats to block Telegram unless it gives up private data of its users won't bear fruit. Telegram will stand for freedom and privacy.— Pavel Durov (@durov) 20 March 2018 Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion,

FBI Forensic Examiner Stephen Flatley Calls Apple 'Jerks' and 'Evil Geniuses' for Encrypting iPhones

Senior FBI forensic examiner Stephen R. Flatley spoke at the International Conference on Cyber Security yesterday, and during the talk he discussed Apple and the FBI's differing opinions on the topic of smartphone encryption. According to Motherboard, Flatley described the company as "jerks" and "evil geniuses" for creating iOS device encryption that is so powerful as to prevent Apple itself from entering users' iPhones. Flatley said that recent updates to Apple device encryption have made password guesses slower, by increasing hash iterations from 10 thousand to 10 million, "making his and his colleagues' investigative work harder." This extended brute force crack time from a few days to two months, leading to Flatley stating that Apple is "pretty good at evil genius stuff." No detailed context was given regarding his "jerks" comment. Image of Stephen Flatley taken by Lorenzo Franceschi-Bicchierai via Motherboard That means, he explained, that “password attempts speed went from 45 passwords a second to one every 18 seconds,” referring to the difficulty of cracking a password using a “brute force” method in which every possible permutation is tried. There are tools that can input thousands of passwords in a very short period of time—if the attempts per minute are limited, it becomes much harder and slower to crack. "Your crack time just went from two days to two months," Flatley said. “At what point is it just trying to one up things and at what point is it to thwart law enforcement?" he added. "Apple is pretty good at evil genius stuff." Flatley's comments come

'ProtonMail Bridge' Brings Encryption to Outlook, Thunderbird, and Apple Mail

Swiss-based encrypted email provider ProtonMail today announced Bridge, an app for premium account holders that aims to bring easy-to-use email encryption to desktop email clients like Outlook, Thunderbird, and Apple Mail. One of our goals has always been to bring easy-to-use encrypted email to desktop. The problem is formidable. Desktop systems encompass multiple operating systems with dozens of popular email clients with their own adherents, and virtually none of them natively speak PGP, the email encryption standard upon which ProtonMail is built. Around two years ago, we created a small task force to tackle this challenge. Today, we are finally ready to present ProtonMail Bridge.Basically, the downloadable Bridge app enables ProtonMail users to access their encrypted email accounts using their favorite email client, without compromising on the security provided by the end-to-end encrypted service, and without needing to modify their email application. At the same time, local copies of the emails are stored on the user's computer, allowing them to use the search features of their email client as normal. To achieve this, the Bridge app functions like a local IMAP/SMTP email server capable of communicating with the remote ProtonMail server to encrypt and decrypt incoming/outgoing messages locally. In this way, it translates end-to-end encrypted email data into a language that any email client can understand, thus "bridging" the gap between ProtonMail's end-to-end encryption and a user's standard email client. The Bridge app aims to fit right into email clients

Signal Encrypted Messenger 2.19 Update Finally Available Following App Store Hiccup

Encrypted messaging app Signal pushed out its v2.19 update late on Friday after a post-release 48-hour delay, owing to an App Store issue that Apple has now resolved. The update includes a number of new features and improvements, including full UI display support for iPhone X. After the update is applied, users will no longer see the "Load Earlier Messages" link within chat threads, because additional messages now appear automatically upon scrolling to the top of a conversation. In other improvements, a new simplified interface has been introduced to the Signal mobile app that aims to make sending photos, files, and GIFs easier and quicker. For example, attachment previews are now displayed directly in the message bar instead of on a separate confirmation screen. Adopting a design concept popularized by Facebook Messenger known as "Jumbomoji", emoji characters are now also visibly larger in Signal chat bubbles that don't contain any other text. Elsewhere, messages that fail to send have been made easier to spot and re-send, while a new "Tap for More" option should make navigating extremely long messages a more pleasant experience. The list of supported languages has also been expanded to include Burmese, Hebrew, and Persian, while users with an external keyboard linked to their device can now make use of new key combination shortcuts for sending messages (Shift + Enter, and Command + Enter). Apart from the above changes, Open Whisper Systems has revamped the layout code to improve performance and flexibility, so everything should feel smoother and more

Keybase Launches Teams, a Free End-to-End Encrypted Alternative to Slack

Encryption messaging company Keybase launched a Slack-like open source team communications tool on Monday for macOS and iOS platforms. Called Keybase Teams, the fully encrypted platform supports groups as large as 500 people, with free access to a team's message history. Keybase is a new and free security app for mobile phones and computers. For the geeks among us: it's open source and powered by public-key cryptography. Keybase is for anyone. Imagine a Slack for the whole world, except end-to-end encrypted across all your devices. Or a Team Dropbox where the server can't leak your files or be hacked.Like Slack, once users have created a team in Keybase they can begin generating chats and channels. It's also possible to share encrypted files with team members.  Unlike Slack accounts however, users don't have to switch at the top level of the app. Teams can be casual and small, allowing them to blend into the user's inbox, while teams with multiple chat channels are grouped under "Big teams". Keybase Teams is a free download for Mac from the Keybase website, while the Keybase chat app is available for iPhone and iPad on the App Store. [Direct Link

'Real People' Don't Need Encrypted Messaging Services, Claims U.K. Home Secretary

The U.K. home secretary Amber Rudd has argued that "real people" do not want secure end-to-end encryption on messaging platforms and are more concerned with usability and features than unbreakable security (via Yahoo News). Rudd made her case in a newspaper article, published ahead of a meeting today with technology companies in San Francisco, where she will warn tech giants that their services are being misused by terrorists. Writing in The Daily Telegraph, Rudd said: "Who uses WhatsApp because it is end-to-end encrypted, rather than because it is an incredibly user-friendly and cheap way of staying in touch with friends and family? "So this is not about asking the companies to break encryption or create so-called 'back doors'. "Companies are constantly making trade-offs between security and 'usability', and it is here where our experts believe opportunities may lie. "Real people often prefer ease of use and a multitude of features to perfect, unbreakable security."Rudd's comments were immediately criticized by privacy campaigners, with civil liberties organization Big Brother Watch calling her viewpoint "at best naïve, at worst dangerous". "Suggesting that people don't really want security from their online services is frankly insulting," said Renate Samson, chief executive of BBW. "What of those in society who are in dangerous or vulnerable situations, let alone those of us who simply want to protect our communications from breach, hack or cybercrime." "Once again the government are attempting to undermine the security of all in response to the

Changes to iCloud Put Apple on Collision Course With Governments Seeking Access to Encrypted Messages

Apple has sent its top privacy executives to Australia twice in the past month to lobby government officials over proposed new laws that would require companies to provide access to encrypted messages. According to the Sydney Morning Herald, Apple privacy advocates met with attorney general George Brandis and senior staff in Prime Minister Malcolm Turnbull's office on Tuesday to discuss their concerns about the legal changes, which could compel tech companies to provide decryption keys to allow access to secure communications such as that provided by WhatsApp and iMessage. Apple has consistently argued against laws that would require tech companies to build so-called "back doors" into their software, claiming that such a move would weaken security for everyone and simply make terrorists and criminals turn to open-source encryption methods for their digital communications. While Apple's position is clear, the Turnbull government has yet to clarify exactly what it expects tech companies to give up as part of the proposals. A source familiar with the discussions said that the government explicitly said it did not want a back door into people's phones, nor to weaken encryption. However, given that encrypted services like WhatsApp and iMessage do not possess private keys that would enable them to decrypt messages, a back door would seem the only alternative. "If the government laid a subpoena to get iMessages, we can't provide it," CEO Tim Cook said in 2014. "It's encrypted and we don't have a key." As it happens, Cook's comment only applies to iMessages that

Encrypted Chat App Telegram to Remove Terrorist Content Following Ban Threat in Indonesia

Telegram is to form a team of moderators to remove terrorist-related content from the encrypted messaging platform in Indonesia, after the country's government threatened to ban the app. Indonesia's Ministry of Communications and Information Technology has already blocked access to the web version of the chat platform, citing concerns that it was being used to spread "radical and terrorist propaganda" in the country, according to Reuters. "This has to be done because there are many channels on this service that are full of radical and terrorist propaganda, hatred, ways to make bombs, how to carry out attacks, disturbing images, which are all in conflict with Indonesian law," the communications ministry said in a statement on its website.Telegram co-founder Pavel Durov said on Sunday that the service had blocked channels reported by the government and that it would take further action to remove the illegal content. "We are forming a dedicated team of moderators with knowledge of Indonesian culture and language to be able to process reports of terrorist-related content more quickly and accurately," Durov said in a Telegram post quoted by Associated Press.Telegram has been criticized by governments before for its use by terrorist groups to spread propaganda and recruit members. Last month Telegram agreed to provide basic information about the company to Russia after authorities threatened to block access to the service. Despite pressure from governments, Telegram's founders have refused to bow to demands for backdoors into the platform for authorities to access

Australia Proposes Law That Would Compel Tech Companies to Decrypt Messages

Australia on Friday proposed new laws that would require companies like Apple to provide law enforcement authorities with access to encrypted communications (via Reuters). Australia's proposed legislation will compel companies to help security agencies intercept and read messages sent by suspects. It appears to take cues from the U.K.'s Investigatory Powers Bill, which includes provisions that require technology companies to bypass encryption where technically feasible. "We need to ensure the internet is not used as a dark place for bad people to hide their criminal activities from the law," Australian Prim Minister Malcolm Turnbull told reporters in Sydney. "The reality is, however, that these encrypted messaging applications and voice applications are being used obviously by all of us, but they're also being used by people who seek to do us harm."The proposal will be introduced when parliament resumes in August and could be adopted within months, according to lawmakers. Other nations have said they will introduce similar laws. Apple, along with Facebook, Google, and other major tech companies, have historically opposed such law changes, which they say threaten online security protocols. For example, Apple claimed the U.K.'s recent bill would "weaken security" for millions of law-abiding customers. "The creation of backdoors and intercept capabilities would weaken the protections built into Apple products and endanger all our customers," Apple stated in December 2015. "A key left under the doormat would not just be there for the good guys. The bad guys

Australia to Push for Greater Powers on Encrypted Messaging at 'Five Eyes' Meeting

Australia is set to push for greater international powers to thwart the use of encrypted messaging services by terrorists and criminals, according to reports on Sunday (via Reuters). The topic will be addressed this week at a meeting of officials from the "Five Eyes" intelligence sharing network, which includes the U.S., the U.K, Canada, Australia, and New Zealand. Australia claimed the increasing use of strong encryption on smartphones and other devices was hindering law enforcement's capacity to gather and act on intelligence, and said it wants tech companies to do much more to give intelligence and law enforcement agencies access to encrypted communications. Security experts and privacy groups regularly argue that any such methods would simply weaken overall security for everyone. "I will raise the need to address ongoing challenges posed by terrorists and criminals using encryption," Australian Attorney General Senator Brandis said in a joint statement. "These discussions will focus on the need to cooperate with service providers to ensure reasonable assistance is provided to law enforcement and security agencies."The announcement followed the U.K. government's recent statement of intent to pressure technology companies to do more to put an end to the "safe spaces" that the internet offers extremists. The country has also called for measures to "regulate cyberspace", following terror attacks in the country. In related news, a leaked draft technical paper prepared by the U.K. government states that technology companies would be required to remove

Russia Threatens to Ban Encrypted Messaging App Telegram

Russia has threatened to block access to the Telegram messaging platform unless the company that runs the app provides more information about itself (via Sky News). The head of communications regulator Roskomnadzor, Alexander Zharov, said repeated efforts to obtain the information had been ignored by the company and warned that "time is running out" for the app. "There is one demand and it is simple: to fill in a form with information on the company that controls Telegram," Zharov said in an open letter. "And to officially send it to Roskomnadzor to include this data in the registry of organizers of dissemination of information. In case of refusal… Telegram shall be blocked in Russia until we receive the needed information."Telegram's non-response appears to be down to the repercussions of handing over the requested details: Doing so would effectively add it to the state regulators' registry, which would require it to retain users' chat histories and encryption keys and share them with authorities if asked, according to Russian news agency TASS. The demand isn't the first time the Russian founders of Telegram – Kremlin, Nikolai and Pavel Durov – have failed to comply with state requests. In 2014, the Durovs refused to turn over data on Ukranian users of Vkontakte, a social network they also set up together. Telegram claims to split its encryption keys into separate data centers around the world to ensure "no single government or block of like-minded countries can intrude on people's privacy and freedom of expression". According to the group's policy, it can

Swiss Encrypted Email Provider Launches ProtonVPN With Free Subscription Tier

Encrypted email provider ProtonMail today launched its own VPN service called ProtonVPN, which includes a free user tier in its pricing plan. The Swiss-based company said it had been testing its VPN service for four months with the help of over 10,000 members of the ProtonMail community, and the group was ready to make ProtonVPN available to everyone starting Tuesday. The Proton group said they were motivated to create ProtonVPN to combat increased threats to online freedom, such as the recent repeal of Obama-era rules designed to protect consumer internet browsing history, calls by British Prime Minister Theresa May for increased online surveillance, and the attempts by the U.S. FCC to dismantle net neutrality. "In the past year, we have seen more and more challenges against Internet freedom," said ProtonMail Co-Founder Dr. Andy Yen, "now more than ever, we need robust tools for defending privacy, security, and freedom online. "The best way to ensure that encryption and privacy rights are not encroached upon is to get the tools into the hands of the public as soon as possible and widely distributing them," said Yen. "This is why, as with ProtonMail, we're committed to making a free version of ProtonVPN available to the world."The group says it has worked to make the best possible VPN service by addressing many of the common pitfalls with existing VPNs. Features therefore include a Secure Core architecture that routes traffic through multiple encrypted tunnels in multiple countries to better defend against network based attacks, a no logs policy backed by