2016 Saw A Massive Increase In Encrypted Web Traffic (eff.org) 91
EFF's "Deeplinks" blog has published nearly two dozen "2016 in Review" posts over the last nine days, one of which applauds 2016 as "a great year for adoption of HTTPS encryption for secure connections to websites." An anonymous reader writes:
In 2016 most pages viewed on the web were encrypted. And over 21 million web sites obtained security certificates -- often for the first time -- through Let's Encrypt. But "a sizeable part of the growth in HTTPS came from very large hosting providers that decided to make HTTPS a default for sites that they host, including OVH, Wordpress.com, Shopify, Tumblr, Squarespace, and many others," EFF writes. Other factors included the support of Transport Layer Security (TLS) 1.3 by Firefox, Chrome, and Opera.
Other "2016 in Review" posts from EFF include Protecting Net Neutrality and the Open Internet and DRM vs. Civil Liberties. Click through for a complete list of all EFF "2016 in Review" posts.
Chipping Away at National Security Letters: 2016 in Review Other "2016 in Review" posts from EFF include Protecting Net Neutrality and the Open Internet and DRM vs. Civil Liberties. Click through for a complete list of all EFF "2016 in Review" posts.
Everybody Wants To Rule The World (Wide Web): 2016 in Review
Fighting for Fair Use and Safer Harbors: 2016 in Review
Secure Messaging Takes Some Steps Forward, Some Steps Back: 2016 In Review
Most Young Gig Economy Companies Way Behind On Protecting User Data: 2016 In Review
Dark Skies for International Copyright: 2016 in Review
Congress Gives FOIA a Modest but Important Update For Its 50th Birthday: 2016 in Review
Our Fight to Rein In the CFAA: 2016 in Review
The Patent Troll Abides: 2016 in Review
DRM vs. Civil Liberties: 2016 in Review
The Fight to Rein in NSA Surveillance: 2016 in Review
The Year in Government Hacking: 2016 in Review
What Happened to Unlocking the Box? 2016 in Review
Top 5 Threats to Transparency: 2016 in Review
Technical Developments in Cryptography: 2016 in Review
This Year in U.S. Copyright Policy: 2016 in Review
Open Access Rewards Passionate Curiosity: 2016 in Review
Censorship on Social Media: 2016 in Review
Defending Student Data from Classrooms to the Cloud: 2016 in Review
Protecting Net Neutrality and the Open Internet: 2016 in Review
U.S. Trade Representative Gets Piracy Website Listing Notoriously Wrong
HTTPS Deployment Growing by Leaps and Bounds: 2016 in Review
Defending the Digital Future: 2016 in Review
Frist psot (Score:2)
A happy new year to you all
And on topic: I don't know much about cybersecurity but I would like to make sure the emails I send can not be read easily by people to whom my emails are not addressed. How can I go about that?
Re: (Score:2, Funny)
+ Enigmail + Full disk encryption + Tor + Tails + Burner laptop @ coffee shop + Groucho Glasses and trenchcoat + getaway car + fake passport.
Re: Frist psot (Score:1)
Fake boobs, high heels, fingerprint prosthetics
Re: (Score:1)
PGP.
Recipient deletes your encrypted block of shit, never fucking talks to you again.
Re: (Score:1)
Re: (Score:2)
GPG
Re: (Score:1)
Anyone who wants to recommend either GPG or PGP should have read and should give a good answer to both of the following articles.
why Johnny can't encrypt [usenix.org]
why I'm giving up on PGP [arstechnica.com]
And you should include hello to avoid the issues mentioned if you are making a recommendation.
Re: (Score:2)
First, it's "helo" not "hello" like in:
helo localhost
250 google.com Hello localhost [::1]
hello localhost
500 unrecognized command
Now, I sign all outgoing email, it never hurt anybody. Also, it advertises that I can exchange encrypted mail should to other party ever wish to do so.
Re: (Score:1)
If you just need them to not be decrypted in transit, you may be ok as long as you and they are both using something that shoves them around with TLS. Google does this, as do many others. If everyone is pushing the data encrypted, it won't be able to be read by someone who is recording that traffic.
https://www.google.com/transparencyreport/saferemail/
If you need only your recipients to be able to read the messages EVER, then you need them to do something too. Anything in a gmail inbox, for instance, is r
Re: (Score:2)
Try Signal. It's available for Android and iOS. It's messaging as opposed to email, but it's easier to use than the only real option for email (PGP).
Re: (Score:2)
There are many relatively secure messaging programs for Android and iOS but for work people use email and that is for some reason still as secure as when I started using the internet in 1992. That's why I asked for a safe way of sending email.
Re: (Score:3)
And on topic: I don't know much about cybersecurity but I would like to make sure the emails I send can not be read easily by people to whom my emails are not addressed. How can I go about that?
All you have is an address. To make an analogy to physical mail there's some security in sending letters instead of postcards but really most is in the postal system and the security of the recipient's mailbox which is out of your control. Not much you can do if I want it on my web mail, it's going to semi-permanently live on someone else's server in plaintext. If you want more security than that you need your communication partner to work with you, even if it's so low tech that you call them up and say the
Thank you Mr. Snowden!!! (Score:5, Insightful)
A true hero to anyone concerned about internet privacy.
Re: (Score:1)
Re:Thank you Mr. Snowden!!! (Score:5, Informative)
Snowden's revelations were years ago, and probably had very little impact on this. The reason HTTPS went way up in 2016 is that Apple said that they were going to mandate use of HTTPS in all iOS apps, which forced all the ad networks to switch to HTTPS.
Unfortunately, their subsequent decertification of StartSSL (the only CA whose free certificates don't require continuous auto-renewal) is likely to make a large number of smaller sites go back from HTTPS to HTTP, erasing much of the benefit.
Re: (Score:1)
* the translated movie titles here normally are funny, by having so few relation to original title
Re: (Score:2)
StartSSL (the only CA whose free certificates don't require continuous auto-renewal)
StartSSL certificates had to be renewed every 366 days.
Re: (Score:1)
You are very wrong (this kind of change takes time...)
Re:Encrypted is in the eye of the beholder (Score:5, Insightful)
The goal is to stop mass surveillance. If GCHQ or the NSA really want that data, they will hack the site anyway.
By using HTTPS everywhere it just makes their job harder, so they can't spy on everyone by default.
Re:Encrypted is in the eye of the beholder (Score:4, Insightful)
HTTPS doesn't hide what computers contacts other computers. I doubt NSA cares that much about the actual content of the communication. By just checking the metadata they can see if someone is communicating with someone on their naughty-list and add them to it. It doesn't matter if you just asked what time it was. If you are talking with a terrorist you are considered to be a terrorist.
The metadata NSA is after is not your computer contacting to facebook.com, it's Alice sending a Facebook message to Bob. They very much want to unwrap HTTPS to get to their level of metadata. And I'm pretty sure they slurped up the content too, because we're the NSA and the rules don't apply to us.
Re: (Score:1)
Re: (Score:1)
Not 100% accurate, but a very good point to consider
tapping glass and Room 641a (Score:2, Insightful)
The goal is to stop mass surveillance. If GCHQ or the NSA really want that data, they will hack the site anyway.
By using HTTPS everywhere it just makes their job harder, so they can't spy on everyone by default.
Specifically it stops them from 'tapping glass' in places like Room 641a:
* https://en.wikipedia.org/wiki/Room_641A
There are valid reasons for surveillance and wire tapping on individuals; there are few-to-no valid reasons for mass surveillance. HTTPS everywhere stops the latter.
Re: (Score:3)
Specifically it stops them from 'tapping glass' in places like Room 641a:
* https://en.wikipedia.org/wiki/... [wikipedia.org]
There are valid reasons for surveillance and wire tapping on individuals; there are few-to-no valid reasons for mass surveillance. HTTPS everywhere stops the latter.
HTTPS doesn't prevent leakage of timing and size of content. Server name is sent in the clear and TLS identifier used for session resumption is not obscured allowing activities within a site to be linked to specific browser instances.
With some analysis they can still deduce exactly what many people are doing despite encryption.
Re: (Score:2)
The goal is to stop mass surveillance. If GCHQ or the NSA really want that data, they will hack the site anyway.
By using HTTPS everywhere it just makes their job harder, so they can't spy on everyone by default.
Wrong. The NSA only needs to hack the CAs. Once they do that once, it takes no further effort on their part to engage in the kind of mass surveillance they did before people started using encryption for their web surfing. You're only fooling yourself if you think that using https is going to make the job any more difficult for the NSA.
Re: (Score:2)
You mean a public CA. If you run your private CA it's a different matter.
However it won't stop the gun to your head or banging your knuckles with a hammer attacks.
Re: (Score:2)
If you run your private CA it's a different matter.
If you run a private CA, forget about owners of bring-your-own devices being able to figure out how to trust its root certificate.
Slashdot what is your excuse?? (Score:1)
Why doesn't /. have an .onion site?
You can set this up in like 5 mins., and you can generate an 8 char. vanity domain using Garlic in probably an hour or two.
What is the excuse?
Yes but (Score:4, Interesting)
It would have been all great if governments couldn't exert power over certificate authorities. The reality however is different.
We need a universally adopted system which doesn't allow to circumvent the process of issuing certificates or at least protect against rogue certificates - then we may sing praises.
Re:Yes but (Score:4, Interesting)
Governments can do that, but not nearly so easily. If they use bulk interception that way, the site operator may well notice eventually - it's trivial to check for. Just contact a few random site users and ask them what cert hash they are seeing. It also destroys trust in the CA, which means people switch to another on that cannot be so easily compromised by that specific government.
SSL and a CA system doesn't make it impossible to monitor individuals, just makes it impossible to monitor entire populations without a substantial risk of detection.
Re: (Score:3)
You must be smoking some strong weed if you believe that the average Joe even grasps the concept of CA. Most of them don't even understand what connection encryption is. All they understand is that if there's a green lock sign next to the domain name then they are secure. Then we've already seen how a lock sign can
Re: (Score:3)
You must be smoking some strong weed if you believe that the average Joe even grasps the concept of CA. Most of them don't even understand what connection encryption is.
You don't need random users, just traffic appearing like it so they don't MITM everyone but your test connection. Try it from home or your private cell phone. Ask a friend or family member to check. Use a public WiFi spot or go to a library. Use a proxy or VPN. Ask some privacy watchdog organization for volunteers. If any of them get the wrong certificate it's happening. You're not trying to find targeted attacks, you just want to know if they have a giant dragnet doing it to everyone. Did you see the Snowd
Re: (Score:2)
Re: (Score:3, Insightful)
> It also destroys trust in the CA, which means people switch to another on that cannot be so easily compromised by that specific government.
$DEITY, I wish. CAs have inappropriately issued _wide_ certs (for names such as "mail" or "news") to people, issued certs to entities that clearly didn't control those domains, left their private keys on a publicly accessible portion of their website (!), issued certs that could be used to issue _more_ certs for _any_ domain(!!), and on and on and on. AFAIK, only _o
Re: (Score:2)
AFAIK, only _one_ CA has ever been removed from web browsers' trusted issuer lists, and that's DigiNotar.
Certificates issued by StartCom and WoSign on or after 2016-10-21 are distrusted [mozilla.org] because of backdating to circumvent SHA-1 phase-out.
Re: (Score:2, Insightful)
That was a close one, wasn't it? We could almost have had DNSSEC based key management, but instead "we" managed to perpetuate the borken certificate authority system, now with less verification.
Re:Yes but (Score:4, Informative)
We've had a viable system [wikipedia.org] on the table for years now, but certain big players have backed away from it in favor of a doubling down on the CA model.
Re: (Score:1)
Re: (Score:3, Interesting)
Lets encrypt (Score:2)
Re: (Score:1)
* hurry: get the tinfoil hat!
Re: (Score:3)
Correct me if I am wrong, but isn't every public server handling TLS connections basically non-secure as a middle man, between a website and someone's web browser?
Surely not to be confused with end-to-end encryption?
There are at least two answers.
Answer 1 - It is E2E and secure against active man in the middle attack:
Browser maintains a list of entities it trusts. Secure websites advertise a certificate blessed by one of those entities. Since an active middleman does not possess secure websites private key it does not have the means to trick browsers into thinking attacking site / proxy was blessed by a trusted entity.
Answer 2 - Answer 1 is in real terms just an illusion:
It is also necessary to consider practically h
Re: (Score:2)
But you can't be sure that there isn't a "man in the middle" attack on this. As long as governments are involved they have the power to get approved certificates to place in proxies.
Re: (Score:2)
And how i can be sure YOU are not a fake news disguised as a user?
Google is the reason (Score:5, Interesting)
As much as I hate and disdain the spying empire Google; private companies only thought about adopting https because of Google's hint of ranking sites based on utilising https encryption.
Anything Google does is for its own selfish purpose, not for the good of humanity - so the reason for the push towards https is so that Google (almost alone) has analytics and information about site visitors and the amount of money e-commerce and such sites are making. Without encryption, countless other firms (such as alexa) was capturing user analytics through approaching different providers, and often directly from ISP's.
Remember, Google's trackers are almost ubiquitous [softpedia.com] (unlike facebook), so they want to own alone the vast amounts of info on users and organisations - and then use this info to either catalogue people and/or sell this to evil companies/organisations, such as insurance firms and governments.
Information is power, user information is even more power, especially if you alone hold that data.
Re: (Score:2)
That's no doubt part of it, but I think the bigger cause was Apple threatening to stop allowing new submissions of apps unless they moved to HTTPS (with only narrow exceptions for web views), which meant that every ad network was forced to switch to HTTPS if they wanted to keep their lucrative iOS clients. As a side effect, most ads shown on normal websites are now served via HTTPS, too.
Re: (Score:2)
I went to set up a iPod Touch for a friend the other day. Can't believe that in addition to asking for a lot of personal identifying information (date of birth, address, email, three security questions quite similar to those used in banking, etc...) the Apple ID account creation process *forces* you to enter a credit card to sign up. What possible justification has Apple made to substantiate this requirement? All I want to do is install a few programs to make the little thing more useful for my friend. Even
Re: (Score:3)
Ha ha, very funny. As it happens, and not that you care, but I gave up helping people to "be popular" over a decade ago. Best thing I ever did. Helping people is a gift, not an obligation, and when you give freely you become free yourself. Try it sometime, it will make you a much better person.
Re: (Score:2)
Unless "being popular" is how you find a potential coworker. They used to call it "professional networking" before LinkedIn coopted that phrase.
Re: (Score:2)
Registering an Apple ID on a device requires a payment method in order to reduce friction toward the user's first App Store, iTunes Store, or IAP purchase. This makes the platform more attractive to developers so that they don't have to rely on ads so much.
Re: (Score:1)
Also router-based content blockers... (Score:1)