Security vs Privacy: Encryption Technology After the Paris Attack
The Heartbleed Bug
Security vs Privacy: Encryption Technology After the Paris Attack
The Heartbleed Bug
In the wake of the Paris attack, a healthy discussion about security and privacy has been revisited and the discussion is centered on encryption technology. So what is “Encryption”? Encryption is the process of encoding a message so that only the sender and the intended recipient or recipients can read it.
Law enforcement and Intelligence officials claim, terrorist are taking advantage of the “end-to-end” encryption communication technology on iPhones and Android-based phones as well as apps like WhatsApp and iMessage to name a few. Now they are asking Silicon Valley to weaken its encryption or provide a backdoor so they can better monitor malicious activities.
The problem is, let’s say law enforcement were to provide a search warrant to Apple so they can access your email. Apple would reply stating, “Sorry, we can’t help you, we do not have access to the data, you will have to get the key from the person of interest. They are the only one that can access the information”.
They push for this level of privacy started in 2013 due to Edward Snowden revelations on how the National Security Agency (NSA) were spying and collection our information. Since then the newer operating systems on phones made by Apple and Google can’t be unlocked without the user passcode, not even by the companies themselves.
Law enforcement see this as a potential danger and are looking for legislation to change the current practices, but security and privacy professional state, even if Apple and Google could be convinced to cooperate, tech executives say there are dozens of other encrypted communication systems. Most encryption techniques are publicly known and terror organizations could build their own alternatives. Furthermore, many privacy advocates fear backdoors and encryption escrow keys can allow other countries and hackers with a vector to crack the code if it is not totally secure.
Before the Paris attack, it was nearly impossible for law enforcement and intelligence officials to talk about weaken decryption for surveillance matter due to Snowden revelations, but since then, there is a serious and open dialog about this matter.
ISIS ranking of encryption apps.
What is your opinion? Should we give up some of our privacy in hope for better security or should we keep our privacy and maybe compromise our security? Let me know.
The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).
The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.
What leaks in practice?
We have tested some of our own services from attacker’s perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.
How to stop the leak?
As long as the vulnerable version of OpenSSL is in use it can be abused. Fixed OpenSSL has been released and now it has to be deployed. Operating system vendors and distribution, appliance vendors, independent software vendors have to adopt the fix and notify their users. Service providers and users have to install the fix as it becomes available for the operating systems, networked appliances and software they use.
Source: HeartBleed
