Former National Security Officials Now See the Peril of Weakening Encryption

Former National Security Officials Now See the Peril of Weakening Encryption

Conor Friedersdorf, The Atlantic

August 31, 2015

FBI Director James Comey, Director of National Intelligence James Clapper, and NSA Director Mike Rogers continue to lament the ability of people to secure the privacy of their communications with end-to-end encryption that even governments cannot break. But the push for laws mandating “backdoor access,” or built-in security flaws for the state to exploit, has run into some unexpected opponents: former national security officials on the other side of the revolving door.
“My position is probably going to be a little surprising to people here,” Michael Chertoff, the former secretary of homeland security, told an audience last week at the Aspen Security Forum. “I think that it’s a mistake to require companies that are making hardware and software to build a duplicate key or a back door even if you hedge it with the notion that there’s going to be a court order.”
That’s long been the position of most technologists and many tech companies in the communications business. As founder of The Chertoff Group, where former national security officials draw on the knowledge and relationships they acquired as public servants to service the needs of corporations that pay them as consultants, Chertoff is “working with some companies in this area,” he disclosed.
Michael Hayden has served as director of national intelligence as well as head of the NSA and CIA. He is now a principal at the Chertoff Group. And according to The Daily Beast’s Noah Shachtman, who moderated a panel at the Aspen Security Forum, Hayden declared in an interview, “I think I come down on the side of industry. The downsides of a front or back door outweigh the very real public safety concerns.”
Michael Leiter has doubts about mandatory “backdoors” too. A former director of the United States National Counterterrorism Center, he presently works for Leidos, a defense and homeland security contractor. Appearing on the same panel as Chertoff, he declared that “we are clearly going to a world where end-to-end encryption with temporary keys that disappear immediately after any communication occurs, that is the future. There is no way around that; we are not going to stop that. And because of that, for the technology issues, I don't think there is a long term way to preserve the US government's ability to intercept or get access to those.”
“We have to accept that the degree to which we undermine our national security by having that back door or front door, depending upon how you define it, is very real,” he added. “We have seen that because of the cyberthreat.” Policymakers can try to design backdoor access to communications, he said, “but reality is going to overtake you and it's a funny thing that when technology and law conflict, law's not going to change that technology for long, it's going to overtake it. And you have to have a law which addresses reality, and not what you hope reality will be."
Journalist Marcy Wheeler, one of the first members of the press to take note of the panel, observed that Chertoff’s answer is notable because of who he is. Through much of his career, “Chertoff has been the close colleague of FBI Director Jim Comey, the guy pushing back doors now,” she wrote. “It’s possible he’s saying this now because as a contractor he’s being paid to voice the opinions of the tech industry; as he noted, he’s working with some companies on this issue. Nevertheless, it’s not just hippies and hackers making these arguments. It’s also someone who, for most of his career, pursued and prosecuted the same kinds of people that Jim Comey is today.”
Chertoff’s paymaster isn’t the only thing that has changed.
Being in private industry exposes him to people with different values, incentives, institutional imperatives, and responsibilities than he met when he traveled in national security circles. And the rest of Chertoff’s remarks, whatever motivated them, included cogent, hard-to-refute arguments against requiring “backdoors” and weakening encryption.
First of all, he said, “you’re basically making things less secure for ordinary people.”
Second, he said, “the really bad people are going to find apps and tools that are going to allow them to encrypt everything without a back door. These apps are multiplying all the time. The idea that you’re going to be able to stop this, particularly given the global environment, I think is a pipe dream. So what would wind up happening is people who are legitimate actors will be taking somewhat less secure communications and the bad guys will still not be able to be decrypted.”
Third, he explained, looking abroad, “what are we going to tell other countries? When other countries say great, we want to have a duplicate key too, with Beijing or in Moscow or someplace else? The companies are not going to have a principled basis to refuse to do that. So that’s going to be a strategic problem for us.”
He concluded by observing that “we do not historically organize our society to make it maximally easy for law enforcement, even with court orders, to get information”––and that past experience suggests “we’re not quite as dark, sometimes, as we fear. In the ‘90s –– when encryption first became a big deal –– there was a debate about a Clipper Chip that would be embedded in devices or whatever your communications equipment was to allow court ordered interception. Ultimately, Congress and the president did not agree to that. And talking to people in the community afterwards ... we collected more than ever. We found ways to deal with that issue. So it’s a little bit of a long-winded answer. But I think on this one, strategically, requiring people to build a vulnerability may be a strategic mistake.”
Again, none of these points is new. Opponents of “backdoors” have made them many times. It is nevertheless striking that even Chertoff, Hayden, and Leiter, alums of the national security state who are sympathetic to its needs, cannot be convinced that “backdoors” are a prudent solution to the problem of bad guys “going dark.”

See original article on The Atlantic

It’s actually not that difficult to protect your digital identity like an expert

No Experience Required

It’s actually not that difficult to protect your digital identity like an expert.

By Josephine Wolff

Update your software, and your conceptions about what it takes to protect yourself online.

Photo by wavebreakmedia/Shutterstock

You, too, can protect your computers and online accounts like an expert! But you probably don’t, according to a study from researchers at Google presented at the Symposium on Usable Privacy and Security last week. The researchers conducted online surveys of 231 security “experts” (defined as people with at least five years of experience working in the field) and 294 non-experts, recruited through Amazon Mechanical Turk, to find out how the two groups’ security practices differed. The results showed several discrepancies in how the expert and non-expert groups protected themselves online. More strikingly, the study also suggested that protecting yourself like an expert actually requires very little expertise at all.

In an attempt to winnow down the massive amount of computer security advice out there, the survey asked respondents the open-ended question “What are the 3 most important things you do to protect your security online?” The top five responses in the expert group were: installing software updates (35 percent), using unique passwords (25 percent), using two-factor authentication (20 percent), using strong passwords (19 percent), and using a password manager (12 percent). For non-experts, the top five responses were: using anti-virus software (42 percent), using strong passwords (31 percent), changing passwords frequently (21 percent), visiting only known websites (21 percent), and not sharing personal information (17 percent). (Strong passwords are those that are difficult to guess because of their length or complexity; unique passwords are those that are used for only one account and not repeated across multiple sites.)

Advertisement

Let’s set aside the question of how it’s possible that one-fifth of the non-expert computer-using population is visiting only known websites. One of the most interesting things about these findings is the implication that expert-level protection requires very little technical know-how. The practices that experts are most likely to endorse—and implement themselves—do not require an intimate knowledge of computer networking, or traffic monitoring, or malicious code. You don’t need any training in computer science or security to figure out how to install software updates or choose unique passwords. Even the slightly more sophisticated practices—two-factor authentication (i.e., using a one-time code texted to your cellphone or other credential in addition to a password to login to an account) and password managers—are fairly straightforward and easily available even to users with relatively little tech savvy.

To protect yourself online like an expert, in other words, you don’t need to understand the Internet’s architecture or inner workings—you just need to branch out from anti-virus software. The survey suggests non-expert users are wary about programs like password managers or new software updates. But they lean heavily on anti-virus software, which 85 percent of non-experts said they used on their personal computers, compared with only 63 percent of expert respondents. Only 7 percent of experts said they considered anti-virus to be one of the top three things they do to stay safe online, compared with 42 percent of non-experts.

But when it came to installing software updates and using password managers, non-experts were much more hesitant than experts. For instance, 73 percent of experts said they used a password manager program to store their credentials for at least some of their accounts, compared with 24 percent of non-experts. And some of the non-experts said in the survey that they did not think password managers were safe and might result in their passwords being leaked. “I wouldn’t use a password manager even if it helps because I don’t trust it,” one wrote. Those fears aren’t entirely unfounded—password manager LastPass announced it had been hacked earlier this summer—but dedicated password managers are still probably more trustworthy and reliable than the alternatives (or so many of the surveyed experts seemed to feel).

Other non-experts expressed concern about downloading software updates, with one writing, “I don’t know if updating software is always safe. What if you download malicious software?” Another noted that “there are often bugs in these updates initially, that must be worked out by the software vendor.” This suspicion of new updates may be part of the reason that 25 percent of experts said they installed updates “immediately,” compared with 9 percent of non-expert respondents.

People who work in computer security (and security more generally) tend to have a reputation for being paranoid about every possible risk, so it’s striking that the non-expert population actually seems to exhibit greater paranoia around some issues—being more suspicious about the trustworthiness of a password manager, or the reliability or a new update, or the threats presented by an unknown website.

It’s possible, of course, that the expert population is less fearful of new programs and updates and websites because they have greater faith in their own ability to identify threats. For instance, though the researchers found that the advice experts offered to less tech-savvy users mostly mirrored their own practices, there were some exceptions. For instance, many experts considered it to be good security advice to not click on links or open emails from unknown people. Yet 38 percent of expert respondents said they often clicked on links from unknown senders, compared with only 12 percent of non-experts. (One expert admitted: “I do all the time … but I tell my mother not to.”)

Paranoid or not, the computer security experts seem, in some ways, to live in less fear of the dangers of the Internet than the non-expert population. In some cases this may just be an indication of how experts and non-experts fear different threats—perhaps the group of non-experts is more concerned about their old passwords being guessed or stolen and therefore change their passwords regularly, while the experts are worrying about having their passwords phished, and therefore are more likely to activate two-factor authentication.

Of course, non-expert opinions about security are probably shaped to a large extent by expert ones—someone probably told them that anti-virus software and regularly changing passwords and staying away from unknown websites are important safety measures. If anything, the most popular non-expert safety measures seem to reflect the messages that the security community has most effectively communicated (whether intentionally or otherwise) to the rest of the world. That may be partly a function of how long those messages have been around—after all, we’ve been hearing about anti-virus for much longer than we have two-factor authentication—as well as the inundation of security advice in recent years, as a growing number of breaches have made headlines, which has made it harder to know which measures to adopt.

Actually, it’s still hard to know which measures to adopt. The Google study largely sidesteps the question of which of these myriad suggestions actually lead to the best outcomes, or correlate with fewer malware infections or account compromises.

That doesn’t mean the expert suggestions from the survey aren’t good advice. Indeed, non-experts might do well to shift some of their practices to emulate those recommendations (especially if you’re one of the users out there studiously avoiding all unknown websites—as my favorite survey respondent said of this recommendation, “Why not hide under the bed too?”) It does mean, though, that protecting yourself online like an expert is, at least for now, more about doing things that the experts do—and less about doing things that are proven to work.

This article is part of Future Tense, a collaboration among Arizona State University, New America, and Slate. Future Tense explores the ways emerging technologies affect society, policy, and culture. To read more, visit the Future Tense blog and the Future Tense home page. You can also follow us on Twitter.

Facebook Messenger now lets users send money to friends

by Lisa Vaas on July 2, 2015           

Filed Under: Android, Facebook, Featured, iOS, Mobile

As of Tuesday, Facebook has switched on person-to-person (P2P) payments for users in the US to instantly message money to friends.
David Marcus, former president of PayPal and currently Facebook's Vice President of Messaging Products, said on his Facebook page that it's easy and safe:

We're happy to announce that Messenger person-to-person payments are now available to everyone in the U.S.! Add your Debit Card and pay anyone on Messenger in a few taps. Money goes straight from your checking account to the recipient's checking account. Easy and safe. As always, give it a try and let us know how we can make even better for you!

Here's how it works:

1. Start a message with a friend
2. Tap the $ icon and enter the amount you want to send
3. Tap Pay in the top right and add your debit card to send money

To receive money:

1. Open the conversation from your friend
2. Tap Add Card in the message and add your debit card to accept money for the first time

As Facebook said when it first announced the service in March, using the service requires adding a Visa or MasterCard debit card issued by a US bank to your Messenger account when you first send or receive money.
Facebook has reportedly said that it's opted to avoid making the new service compatible with credit cards, so as to reduce fraud and avoid the exorbitant fees that might turn off users from using the service.
P2P payment service Venmo, for example, charges a 3% fee per payment for credit cards and non-major debit cards, to cover processing costs.
After you've added a debit card to your Messenger account, you can also create a PIN for additional security the next time you send money.
Touch ID can also be enabled on iOS devices.
Facebook says that "as always," you can also add another layer of authentication to your account at any time with login approvals.
That's a setting which prompts you for a special security code each time you try to access your Facebook account from a new computer or mobile phone.
Funds may take one to three business days to become available after they're sent, depending on the bank involved, just as it does with other deposits.
Messenger P2P payments are available on Android, iOS, and desktop operating systems.
Facebook promises that it's lovingly swaddled our payments and card details in secure systems with encrypted connections between users and itself with "layers of software and hardware protection that meet the highest industry standards."
The company says that its payment systems are kept in a secure environment, separate from other parts of the Facebook network, and monitored by a team of anti-fraud specialists keeping an eye out for suspicious purchase activity.
"Trust us!" Facebook says, pointing out that it's been processing transactions for game players and advertisers since 2007 and at this point is processing over 1 million transactions daily.
Convinced? Tell us why or why not in the comments section below!

Image of Facebook payments courtesy of Shutterstock.

Nieuws van AG Partnerblog

Directie moet grotere rol spelen in IT-beveiliging

1 juni 2015 14:32 AG Partnerblog NIEUWS

De negatieve effecten van een IT-beveiligingslek, dringen langzaam door in de boardroom. Waren in het verleden raden van bestuur en senior executives nog enigszins zelfgenoegzaam over de risico’s van datalekken en cyberaanvallen, tegenwoordig is er een groeiende bezorgdheid over reputatieschade, groepsvorderingen en kostbare downtime. Security heeft eindelijk de aandacht van de boardroom. En terecht.
Uit onderzoek van Ponemon Institute in opdracht van HP (oktober 2014) blijkt dat senior executives steeds meer betrokken zijn bij de voorkoming van en het nemen van de juiste acties na een digitale inbraak. Het beperken van de financiële impact van mogelijke incidenten en het beschermen van de bedrijfsreputatie en merknaam zijn belangrijke drijfveren. 79 Procent van de ondervraagden geeft aan dat de bemoeienis van een executive bij een beveiligingslek noodzakelijk is voor effectieve actie.
Forse financiële schade
De financiële consequenties van een digitale inbraak kunnen fors zijn. Uit de ‘Cost of Cyber Crime Study 2014’ blijkt dat de gemiddelde jaarlijkse schade voor de 59 onderzochte Amerikaanse bedrijven uitkomt op 12,7 miljoen dollar, variërend van 1,6 miljoen tot 61 miljoen per bedrijf. De 38 Britse bedrijven die meewerkten aan het onderzoek gaven aan gemiddeld 3,56 miljoen pond per jaar kwijt te zijn aan de gevolgen van datalekken, variërend van ruim 544.000 Britse pond tot 14 miljoen pond per bedrijf.  
Risico’s security onduidelijk
De belangrijkste belemmeringen voor effectieve actie na een beveiligingslek zijn de slechte communicatie, het gebrek aan leiderschap en het gebrek aan toezicht vanuit de board. Vooral de communicatie is een groot punt van zorg onder de respondenten. Nog niet de helft gaf aan dat ze worden geïnformeerd over het te volgen actieplan na een datalek. Uit ander onderzoek blijkt dat beveiligingsexperts bij een organisatie het lastig vinden om met senior executives te praten over security, zeker als het gaat om het uitleggen van de risico’s en gevolgen. Bijna twee derde (65 procent) van de ondervraagden gaf aan dat als ze gevraagd wordt om een rapport van een beveiligingsincident met grote gevolgen voor de organisatie, ze rapporten wijzigen, filteren of afzwakken. De kans is dan ook groot dat de meeste CEO’s, raden van bestuur en andere managers in het duister tasten over de daadwerkelijke gereedheid van de organisatie om te reageren op beveiligingslekken en digitale inbraken.
Wat te doen?
De uitkomsten van het onderzoek van Ponemon Institute zijn, samen met een aantal aanbevelingen, gebundeld in het whitepaper ‘Het belang van de betrokkenheid van het senior management'.

inShare8