Whatsapp: Facebook's ability to decrypt messages is a "limitation," not a "defect"

Facebook spokespeople and cryptographers say that Facebook's decision to implement Open Whisper Systems' end-to-end cryptographic messaging protocol in such a way as to allow Facebook to decrypt them later without the user's knowledge reflects a "limitation" -- a compromise that allows users to continue conversations as they move from device to device -- and not a "defect." Read the rest

A critical flaw (possibly a deliberate backdoor) allows for decryption of Whatsapp messages -- UPDATED

Update: Be sure to read the followup discussion, which explains Facebook's point of view, that this is a deliberate compromise, and not a defect, that makes the app more usable for a wide variety of users, while putting them to little additional risk (namely, that Facebook might change its mind; or be forced to spy on its users; or suffer a security breach or internal rogue employee).

When Facebook implemented Open Whisper Systems' end-to-end encrypted messaging protocol for Whatsapp, they introduced a critical flaw that exposes more than a billion users to stealthy decryption of their private messages: in Facebook's implementation, the company can force Whatsapp installations to silently generate new cryptographic keys (without any way for the user to know about this unless a deep settings checkbox had been ticked), which gives the company the ability to decrypt user messages, including messages that have already been sent in the past.. Read the rest

Trump's NSA will be able to share its firehose of surveillance data with 16 government agencies (Thanks, Obama)

The new data-sharing rules enacted by the Obama administration will allow the NSA to lawfully share the unredacted, full take of its surveillance databases with sixteen other US government agencies -- meaning that, for example, Trump's door-to-door deportation squads could use that data to figure out who's doors to break down, and his Muslim surveillance database could bootstrap itself with NSA data. Read the rest

Germany, France and the UK are moving the EU to continuous, unaccountable, warrantless mass surveillance

Recent surveillance laws in Germany, France and the UK require online service providers to store (undoubtedly leaky and infinitely toxic) databases of everything you do online, and allow government agencies to raid these databases without accountability or meaningful oversight). Read the rest

Apple Store employees fired after accusations of snooping on customers' devices for sexual selfies and sharing them

Last October, an Apple Store in Brisbane, Australia terminated some of its employees after they were accused of searching customers' devices for sexually explicit selfies and sharing them with colleagues, rating them on a scale of 1-10. Read the rest

Free audiobook of Car Wars, my self-driving car/crypto back-door apocalypse story

Last month, Melbourne's Deakin University published Car Wars, a short story I wrote to inspire thinking and discussion about the engineering ethics questions in self-driving car design, moving beyond the trite and largely irrelevant trolley problem. Read the rest

Trump's policies on net neutrality, free speech, press freedom, surveillance, encryption and cybersecurity

Three posts from the Electronic Frontier Foundation dispassionately recount the on-the-record policies of Trump and his advisors on issues that matter to a free, fair and open internet: net neutrality; surveillance, encryption and cybersecurity; free speech and freedom of the press. Read the rest

After ACLU investigation, Twitter blocks US surveillance "fusion centers" from monitoring tool

The ACLU of Northern California recently published a leaked email showing that Dataminr -- a Twitter-monitoring company partially owned by Twitter itself -- was selling access to US domestic surveillance "fusion centers" where local, state and federal agencies pool resources to spy on their targets. Read the rest

Bruce Schneier's four-year plan for the Trump years

1. Fight the fights (against more government and commercial surveillance; backdoors, government hacking); 2. Prepare for those fights (push companies to delete those logs; remind everyone that security and privacy can peacefully co-exist); 3. Lay the groundword for a better future (figure out non-surveillance internet business models, privacy-respecting law enforcement, and limits on corporate surveillance); 4. Continue to solve the actual problems (cybercrime, cyber-espionage, cyberwar, the Internet of Things, algorithmic decision making, foreign interference in our elections). Read the rest

Car Wars: a dystopian science fiction story about the nightmare of self-driving cars

Melbourne's Deakin University commissioned me to write a science fiction story about the design and regulation of self-driving cars, inspired by my essay about the misapplication of the "Trolley Problem" to autonomous vehicles. Read the rest

UK's new surveillance law creates a national browser history with a search engine to match

The Snoopers Charter, an extreme surveillance bill that passed last week, and it's the most extensive domestic spying regime that any "democratic" country has passed, and is a potential blueprint for Orwellian surveillance elsewhere in the years to come. Read the rest

Iphones secretly send your call history to Apple's cloud, even after you tell them not to

Apple has acknowledged that its Icloud service is a weak link in its security model, because by design Apple can gain access to encrypted data stored in its customers' accounts, which means that the company can be hacked, coerced or tricked into revealing otherwise secure customer data to law enforcement, spies and criminals. Read the rest

Snowden to journalists: your best defense is legal limits on spying, not crypto

Edward Snowden videoconferenced with a journalism roundtable at Editors Lab participants at Süddeutsche Zeitung (home of the Panama Papers) about the effect of state surveillance on a free press. Read the rest

EFF asks court to let American sue Ethiopia for hacking his computer and rounding up his friends

Since 2014, the Electronic Frontier Foundation has been representing "Mr Kidane," an Ethiopian-born US citizen whose computer the Ethiopian government hacked while he was living in DC, in order to extract the identities of his contacts in Ethiopia and target them for violent human-rights-abusing reprisals over their democratic opposition to the country's ruling dictatorship. Read the rest

UAE surveillance contractor is recruiting an army of foreign hackers to break into its citizens' devices

The world's most sophisticated security experts have been bombarded with recruiting offers from UAE-based company Darkmatter, which bills itself as a major state security contractor -- but people who've taken the bait say they were then told that they were being hired to weaponize huge arsenals of zero-day vulnerabilities so that the UAE can subject its own population to fine-grained, continuous surveillance. Read the rest

Tax-funded NZ company sold mass surveillance tech to torturers and GCHQ

A whistleblower has provided The Intercept with leaked documents about Endace, an obscure New Zealand company based in Auckland, revealing that the company -- which received millions in government funding -- developed the mass surveillance equipment used by the UK spy agency to engage in illegal mass surveillance on fiber-optic lines that traverse the UK, and that Endace's customer list also includes a who's-who of telcoms companies, spy agencies, and the Moroccan secret police, who make a practice of spying on people, then kidnapping and torturing them. Read the rest

After being outed for massive hack and installing an NSA "rootkit," Yahoo cancels earnings call

What do you do if your ailing internet giant has been outed for losing, and then keeping silent about, 500 million user accounts, then letting American spy agencies install a rootkit on its mail service, possibly scuttling its impending, hail-mary acquisition by a risk-averse, old economy phone company? Just cancel your investor call and with it, any chance of awkward, on-the-record questions. (via /.) Read the rest

More posts