Showing posts with label Encryption. Show all posts

Thursday, April 10, 2014

Heartbleed Bug Online security breach is described as 'catastrophic'

Internet users told to change ALL passwords in security alert over 'catastrophic' Heartbleed bug

Online security breach is described as 'catastrophic'
Alert is result of internet bug Heartbleed being uncovered
Heartbleed is able to bypass websites' security measures to access passwords and personal information

Published: 17:33 EST, 9 April 2014 | Updated: 17:57 EST, 9 April 2014

Internet users have been warned to change all their computer and phone passwords following what could be a ‘catastrophic’ security breach.

Major technology firms have urged the public to immediately update their online security.

The alert is the result of the discovery of an internet bug called ‘Heartbleed’, which is able to bypass computer security settings.

LastPass Heartbleed Checker warns if a website may be at risk. It also reveals websites that aren't affected

HOW TO BEAT THE BUG

If a password is in any dictionary in any language then it will take just three minutes to crack, warned computer expert Tony McDowell.

The worst passwords are the likes of ‘password’, ‘123456’, ‘qwerty’, or your child’s name. Using the same password for every site can leave you even more vulnerable to hackers, he added.
His advice is to use a phrase rather than a word. For example, use ‘nameisabella’ rather than just ‘Isabella’ – and use a mixture of letters and numbers.

A password of ‘name!saBe1la’ would take a year to crack, said Mr McDowell, managing director of Encription Ltd.

‘Most hackers give up after 24 hours unless it is something they really want to gain access to,’ he added.

WHICH MAJOR SITES ARE AT RISK?

Potentially vulnerable sites:

Facebook, Twitter, Tumblr, Instagram, Google, Gmail, Lloyds TSB, Nationwide, Santander

Safe sites:

Bing, Yahoo, Flickr, LastPass, DuckDuck Go, Natwest, GitHub

The tool is a guide to affected services; it is not a definitive list.

Sites listed as vulnerable may use unreported servers, meaning their status can't be officially verified.

As a result, personal information such as passwords and credit card details has been accessible.

Read More Here

.....

Heartbleed test

......

Tuesday, November 19, 2013

CEO Marissa Mayer moves to calm privacy fears after reports US spy agency gained access to Google and Yahoo data centres

Yahoo to add encryption to all services in wake of NSA spying revelations

Dominic Rushe in New York
theguardian.com, Monday 18 November 2013 13.53 EST

Yahoo will add encryption to all its products by spring 2014, chief Marissa Mayer has announced, in a bid to tackle users’ privacy fears in the wake of reports that the National Security Agency had accessed the tech firm's data centres.
In a blogpost on Monday, Mayer said: “We’ve worked hard over the years to earn our users’ trust and we fight hard to preserve it. As you know, there have been a number of reports over the last six months about the US government secretly accessing user data without the knowledge of tech companies, including Yahoo.
“I want to reiterate what we have said in the past: Yahoo has never given access to our data centers to the NSA or to any other government agency. Ever. There is nothing more important to us than protecting our users’ privacy.”
Mayer’s move comes after the Washington Post reported last month that the NSA had broken into the main communications links that connect Yahoo and Google data centres around the world.
According to documents obtained from former NSA contractor Edward Snowden and interviews with officials, the NSA, in partnership with its British counterpart GCHQ, has been copying large amounts of data as it flows across fibre-optic cables that carry information between the companies’ worldwide data centres.
After the story broke, Yahoo said government attempts to circumvent its online security systems offered “substantial potential for abuse”. Eric Schmidt, Google’s executive chairman, called the news “really outrageous”.

Read More Here

Friday, November 8, 2013

'I used to think US best country for privacy & freedom' - Lavabit founder

Published on Nov 8, 2013

His business suffered in the wake of the NSA leaks scandal because the service he provided was used by the person now most wanted in the US - Edward Snowden. SophieCo is talking to Ladar Levison, founder and owner of encrypted email service Lavabit.com, who says all he cares for is the privacy and the trust of his clients.
FULL SCRIPT: http://on.rt.com/a0w0ru
RT LIVE http://rt.com/on-air

Tuesday, August 13, 2013

‘Encryption is a human right’: Wikipedia aims to lock out NSA

Published time: August 03, 2013 11:10
Edited time: August 04, 2013 15:25

Screenshot from www.wikipedia.org

Wikipedia is taking steps to make its site ‘unsnoopable’ to the NSA following revelations that its site users were being spied on. The measures will include the use of secure encryption for its logged-in users to minimize eavesdropping.
The non-profit US-based organization that manages Wikipedia, Wikimedia, has released a statement, announcing the introduction of HTTPS security protocol on its website to protect its visitors.
“[Wikipedia] believes strongly in protecting the privacy of its readers and editors. Recent leaks of the NSA’s XKeyscore program have prompted our community members to push for the use of HTTPS by default for the Wikimedia projects,” said the statement published on the organization’s website.
HTTPS protocol shields against eavesdropping and tampering with internet communications, using bilateral encryption between the server and the internet user.
Using the protocol would minimize the risks of the snooping on users’ internet activity.
A report by UK publication The Guardian revealed that the NSA was monitoring the users who accessed one of the world’s most popular websites. In response to the revelation the organization’s co-founder, Jimmy Wales announced that Wikipedia would be introducing security measures to protect site visitors, starting from August 21.
However, he noted that bugs were delaying the upgrade from regular HTTP protocol to HTTPS.
"Our current architecture cannot handle HTTPS by default, but we've been incrementally making changes to make it possible. Since we appear to be specifically targeted by XKeyscore, we'll be speeding up these efforts," Wikimedia said on its website.

Read More Here