Crypto-Autonomist : encryption

Real privacy requires encryption

Autonomist0 — Fri, 08 Feb 2008 17:13:00 GMT

Are you using encryption software for all your data and communications yet? If not, are you aware that the government may inspect and/or seize any digital device (phones, media players, laptops) without a search warrant or cause when you travel internationally, and search any digital device during routine traffic stops?

The Association of Corporate Travel Executives, which represents 2,500 business executives in the United States and abroad, said it has tracked complaints from several members, including Udy, whose laptops have been seized and their contents copied before usually being returned days later, said Susan Gurley, executive director of ACTE.

I was assured that my laptop would be given back to me in 10 or 15 days," said Udy, who continues to fly into and out of the United States. She said the federal agent copied her log-on and password, and asked her to show him a recent document and how she gains access to Microsoft Word. She was asked to pull up her e-mail but could not because of lack of Internet access. With ACTE's help, she pressed for relief. More than a year later, Udy has received neither her laptop nor an explanation.

Think that virtual worlds like Second Life are a refuge? Think again:

U.S. intelligence officials are cautioning that popular Internet services that enable computer users to adopt cartoon-like personas in three-dimensional online spaces also are creating security vulnerabilities by opening novel ways for terrorists and criminals to move money, organize and conduct corporate espionage.
...
"Virtual environments provide many opportunities to exchange messages in the clear without drawing unnecessary attention," the IARPA paper said. "Additionally, there are many private channels that can be employed to exchange secret messages."
...
Officials from Linden Lab have initiated meetings with people in the intelligence community about virtual worlds. They try to stress that systems to monitor avatar activity and identify risky behavior are built into the technology, according to Ken Dreifach, Linden's deputy general counsel.

The government's message is clear: no thought or conversation in the digital realm is allowed to be private. Unless you believe that a private existance "lets the terrorists win," you'd better be using encryption software. (See the Links section to get started.)

TrueCrypt 5.0 is out!

Autonomist0 — Wed, 06 Feb 2008 07:46:00 GMT

TrueCrypt is an essential drive encryption application for Windows, Mac OS X, Linux users who want to encrypt real or virtual drive partitions. It's free, easy to use, and it even runs on Windows Vista 32/64 bit. The 5.0 release allows you to encrypt the boot drive partition in Windows, so if your server or laptop falls into the wrong hands, no data whatsoever can be gleamed from it.

An interesting feature of TrueCrypt is the “plausible deniability” option, which allows you to encrypt any number of hidden partitions in the empty space of an outer partition, so even if you are forced to reveal the outer partition, you can plausible deny the existence of inner partitions. Get it now!

How many of the 79 million personal records compromised in 2007 could have been avoided simply by installing this program?

Court ruling protects encryption keys as a Fifth Amendment right

Autonomist0 — Tue, 18 Dec 2007 01:09:00 GMT

Good news for Americans:

U.S. Magistrate Judge Jerome Niedermeier ruled that a man charged with transporting child pornography on his laptop across the Canadian border has a Fifth Amendment right not to turn over the passphrase to prosecutors. The Fifth Amendment protects the right to avoid self-incrimination.

If this becomes a precedent, it will be distinctly different from European countries such as the U.K, where a new law provides for up to two years of jail time simply for refusing to reveal a key.

As people's digital storage increasingly becomes an integrated part of their identity, the right to keep certain data private will become increasingly important. The right to keep encryption keys private will increasingly mean the freedom to keep certain thoughts private, whether they are stored in wetware or digital form.

More: Crypto and Self-Incrimination FAQ

Microsoft to include NSA backdoor algorithm in Windows Vista SP1

Autonomist0 — Tue, 18 Dec 2007 00:50:00 GMT

Various tech bloggers are reporting that Microsoft will include the NSA-recommended random algorithm suspected of containing a backdoor vulnerability in the upcoming Windows Vista service pack. According to Microsoft, the "Dual Elliptical Curve (Dual EC) PRNG from SP 800-90 is also available for customers who prefer to use it," so this algorithm is an option, not the default. Why would Microsoft intentionally include an inefficient and unsecure algorithm? Very likely, because it will eventually be required in governments contracts.

It is hard to blame Microsoft for not wanting to lose government contracts, or to alienate customers who depend on them. The real danger is the (inevitable?) attempts by the state to force this algorithm on everyone else, including requirements that make it mandatory for government contracts, and thus attempt to influence the default configuration by virtue of the state's dominant market share.