thewayne | Entries tagged with encryption

This is both funny and sad because (A) it happened to the International Association of Cryptologic Research, an organization that's been around for 50-some years, and (2) because it demonstrates how brittle encryption can be.

The organization was its annual leadership election, and was using high-strength and verifiable encryption. Everyone who submitted their vote could verify, through their own encryption key, that their vote was correct and not tampered with. Three members of the election committee each held one-third of the key required to completely decrypt the master file to tabulate the vote, so all three had to simultaneously submit their part of the key to process the votes.

One of the members lost their part of the key, irrecoverably, through simple human error - not a hack. Thus, the file remains forever locked.

The IACR is re-running the election which will close on December 20 using a different encryption methodology requiring two of the three key portions. And the person who lost their part of the key has resigned from the election committee, I don't know if they're still part of the organization.

https://arstechnica.com/security/2025/11/cryptography-group-cancels-election-results-after-official-loses-secret-key/

https://www.schneier.com/blog/archives/2025/11/iacr-nullifies-election-because-of-lost-decryption-key.html

This was a government order. And it was a secret. Apple was not allowed to reveal the order. The purpose of the order was allegedly to make it easier for the government to find CSAM, explicit child pornography. It was, in fact, admitting that they were not being very good at their investigations and wanted Apple to make it easier for them.

So Apple broadcast not only that they received the order, they actually broadcast the text of it.

And now they've announced that they are turning off ADP, Advanced Data Protection, a form of advanced encryption of iCloud information in the UK to comply with the order. If you turn on ADP, the only person who can access your data is YOU, which also means that you can lose it. That's the risk of encryption.

Apple basically engaged in naming and shaming the government, good for them! The Home Office said "We do not comment on operational matters, including for example confirming or denying the existence of any such notices." As of this time, Apple users in the UK can no longer turn on ADP, it is expected that with a future update it will be turned off for users who previously activated it.

Without ADP, the information is still encrypted, but it is done in such a way that if the government serves Apple with a warrant, Apple can get at the information. Need I remind people about an incident that I posted about a month or so ago about a back door that the U.S. government required telecommunications providers to install for surveillance purposes that the Chinese have cracked? Several telcom providers have been compromised, and it's an extreme fight to keep them out - it's an on-going problem.

I can't wait for a British tabloid to get ahold of some MP or Lord's data and splash it all over their paper.

https://www.bbc.com/news/articles/cgj54eq4vejo

https://apple.slashdot.org/story/25/02/21/1529255/apple-removes-cloud-encryption-feature-from-uk-after-backdoor-order

A forthcoming version of Windows 11 known as 24H2 will enable Bitlocker device encryption (FDE) by default. This can be turned off if you want to get into Control Panel and deactivate it. The article notes that Tom's Hardware found that FDE can slow down disc access by 45% on solid-state drives. Additionally, Microsoft requires that the encryption key is uploaded to your Microsoft cloud account, meaning they have the means for decrypting your drive.

MS holding the key to your drive is a theoretical vulnerability. I have not read of them cooperating with authorities in the decryption of drives, much like Apple has not, though in Apple's case, they don't hold keys and cannot.

Personally, I don't think disk encryption is a good idea for the average home user. You should maintain good backups and keep them disconnected from your PC, preferably in a fire-proof lockbox or off-site. Have two sets (or more) and rotate between them so you have fall-back points if one of the backup sets fail.

We have a concept in IT that backups don't exist until you test them or need them, until that time they just exist in a void. When you pull them out and try to restore from them, that's when you find out whether or not they're any good. Backup disks and tapes fail, which is why if you value your data you want multiple copies to reduce the chance of one copy failing.

https://www.theverge.com/2024/8/14/24220138/microsoft-bitlocker-device-encryption-windows-11-default

https://tech.slashdot.org/story/24/08/14/1559240/microsoft-is-enabling-bitlocker-device-encryption-by-default-on-windows-11

This is starting out with a warning: this article is really, REALLY deep computer security stuff, DO NOT dig into it if you don't have a minimal understanding of network encryption, SSH, RSA, etcetera! YOU WILL BE LOST!

RSA is a pretty much a deprecated encryption technique. While it was good in its day, it's somewhat broken and has been superseded by better methodologies, both because technology moves ever onward and because it's broken. Apparently it's mainly in use in old systems where companies haven't bothered to replace it: 'If it ain't broke, leave it alone', and just haven't budgeted the funds and time to get it done.

People who try to break computer security have found an interesting way to break RSA even worse. They monitor and sit and wait. The first thing that happens when establishing an SSH connection (and other secure types of connections) is a handshake - the computers send a few packets back and forth, exchange keys (encryption certificates), and get to know each other (proverbially). This handshake process is supposed to be encrypted and secured and not easily spied upon. Except sometimes it isn't.

Computers make mistakes. Sometimes the process that encrypts the handshake fails, it can be a memory bit failure, and this can reveal part of one of the private keys that provides the encryption to the handshake. These keys are generated by multiplying very large prime numbers. If you recover one of the keys, you can then recover the other key by dividing by great whomping big prime numbers. Once you break that, you have access to the certificates that created the secure connection and you can now sit in the middle and impersonate all traffic of either host.

This is what people in computer security call BAD.

OpenSSH applied fixes to try to prevent it, but some major vendors, including Cisco, roll their own code and had some pretty bad vulnerabilities to this problem. They might have fixed it, but when you're running closed-source software (where you've written your own code), rather than relying on an open software where there are tons of eyes looking for problems and testing, it's often weaker than the open source version such as OpenSSH.

Interesting times.

No real solid information as to whether or not this has been exploited in the wild as it's really hard to detect interception attacks like this.

https://arstechnica.com/security/2023/11/hackers-can-steal-ssh-cryptographic-keys-in-new-cutting-edge-attack/

The purpose is to generate encryption keys with a high level of entropy. Specifically, it's a kit of 25 dice that get locked in to a 5x5 grid. For each die, the die is individually numbered, each face is individually numbered, and the rotation is individually numbered! Because of this, the entropy possible is 2^196, or 124,127,134,662,179,891,202,329,100,571,859,806,502,566,406,865,813,504,000,000! That's a bloody huge number!

Here's what it looks like after you shake the dice in the provided bag, roll them into the provided plastic cage and lock them down:

After you roll the dice and lock it down, you use a smartphone app to capture the dice and an app generates the key, which you can use within your phone or copy into a USB key. The best thing is that the software that generates the key is open source, so if the company disappears, as long as you still have your dice or a picture of it, you can still regenerate your key! And the case design is such that if you drop it (or a toddler accident), it won't accidentally pop open and spill the dice all over the place.

Bruce Schneier, noted encryption expert, is a consultant on the project.

I ordered two of them, I think they're pretty cool. And at $25 for the basic kit, they're not too expensive. Honestly, I don't know if I'll ever use it, but the potential utility is quite good. And since they've already built 900 kits and sent them to the fulfillment center, there's zero chance that the project will not succeed.

https://www.crowdsupply.com/dicekeys/dicekeys

Crossposts: https://thewayne.livejournal.com/1200570.html

The good news is that a non-technical jury found that Google's use of Java to create Android was not infringing. Oracle has been suing Google over this for years and the jury came back after three days of deliberation and said Google was OK with what they did. Considering that Sun, who was bought out by Oracle, also thought it was OK even though Sun didn't like it, probably was a key factor.

Revealed in the testimony was that Oracle tried to develop their own phone using Java and couldn't.

I'm not a huge fan of Google. Yes, their products are pretty good, and I use their search engine, maps, and Gmail regularly. It's their original 'Don't be evil' mantra that bugs me because they monetize everything. Now, a business has to make money to survive in business, but why couldn't they be more upfront about it?

The basic standard is that if you're not paying for a service, then YOU (and your information) is the product being sold.

Oracle is, of course, going to appeal the verdict. Had Google lost, it is rumored that they could ask for as much as $9 BILLION dollars, insert your best Dr. Evil voice as needed.

http://arstechnica.com/tech-policy/2016/05/google-wins-trial-against-oracle-as-jury-finds-android-is-fair-use/

The bad news concerns Apple. Amongst the many lawsuits against it at any given time was one from VirnetX that claimed that Apple was infringing against its patents with its Facetime and iMessage apps. Yesterday they lost the case. VirnetX is a patent troll: they buy lots of patents, wait for a product that is vaguely similar to be successful the go crying to the East Texas courts. VirnetX claims that Apple has done irreparable harm to its brand, even though they've never produced a product and no one has heard of them outside of the patent troll game.

So Apple may have to cough up a heck of a lot of money, or possibly turn off iMessages and Facetime, which would suck in a major way and probably FINALLY! get the attention of Congress and the need for patent reform.

Me, personally, I don't use Facetime but I can appreciate the product. I use iMessages regularly, and I love the fact that my texts, which are all so sexy and top secret, are very strongly encrypted and my cell carrier can't see them since they're shunted through Apple's servers. So I would hate to see them go.

Apple is, naturally, going to appeal the decision.

http://arstechnica.com/tech-policy/2016/05/patent-troll-that-beat-apple-now-wants-judge-to-block-facetime-imessages/

However....

Apple just hired the co-founder of Silent Circle, Blackphone, and PGP Corp. Jon Callas is an expert when it comes to encrypted communications, so presumably he's going to beef-up Apple crypto and possibly revamp iMessages and Facetime so they're even more secure and perhaps no longer infringe on VirnetX's patents.

http://www.reuters.com/article/us-apple-encryption-callas-idUSKCN0YF2J1

PGP stands for Pretty Good Privacy, a VERY strong crypto system that gives excellent end-to-end encryption for email users. It has been released to security researchers to poke at it to find flaws, it's not yet available to the general public but will be in the form of browser add-ins.

On the plus side: industry-standard and publicly-examined crypto. This should do an excellent job of preventing anyone from reading your email except for the intended recipient. On the down side: it can be slightly clunky to use, though the Gmail integration should make key exchanges more smooth.

In brief, this is how PGP works. The software generates a gobsmackingly-huge prime number and creates two crypto keys, a public one and a private one. You don't need to be concerned about the content of the key because it's just a huge hexadecimal mess. Let's say that you and I want to exchange email, and we've both implemented PGP. Let's call my private key A1 and my public key A2, your private key is Z1 and your public key is Z2. We give our public keys to anyone with whom we want to exchange email, but we jealously guard our private keys. When I want to send you an email, the message is encrypted on my end using A1+Z2, you decrypt it using Z1+A2. At a basic level, that's all there is to it. The software handles combining the keys and encrypting or decrypting the message, it also handles key exchanges. The thing that you have to watch out for is if you ever lose your private key, you have to notify everyone that your key was compromised, your friends delete your public key from their systems, and then you generate a new pair of keys and redistribute your public key.

Which brings up a third negative: you can't use email on a public computer without importing your key in to that system, with potential security risks if that computer has already been compromised. A lot of people store their keys on USB drives which they try to never let out of their personal control. Another negative is that if you're sending big attachments in email, it can take some time for big files to have the crypto applied/removed.

Google is doing a definitely good thing here, opening up the code to the public for review by experts, and at some cost to them: they cannot read the encrypted messages, so they can't do keyword searches and targeted advertising.

http://www.wired.com/2014/06/end-to-end/

A little bit about open source software. The open source development model says that anyone who has the coding skills can contribute to big, complicated, programming projects. Anyone. As lone as your code is good, runs, and does what it's supposed to do, you are in. This is the model that gave us linux, which is the underpinning of a vast majority of servers on the internet and World Wide Web.

The issue, of course, is that it's conceivable that someone with nefarious intent could insert dodgy code that passes superficial inspection and that someone then has in-place a vulnerability, exploit, back door, whatever.

TrueCrypt is a disk encryption product that encrypts your entire drive, AKA whole disk encryption. Your computer won't boot unless you enter a password on powerup. You can remove the hard drive from the computer, and the whole thing is still encrypted. You can also create hidden 'shadow' volumes that are hidden from normal view: basically you can have multiple encrypted virtual hard drives on your system and they appear invisible, so if you're forced to give up your crypto key, such as by the UK gov't officials or someone using rubber hose decryption (they beat you with a rubber hose until you give up your crypto key), they theoretically won't find the hidden encrypted volume.

This is a great feature for foreign reporters or human rights workers.

The issue is that TrueCrypt is an open source software project, and in the post-Snowden world, it's possible that it was compromised a long time ago by the NSA or its proxies. So an audit was launched: examine every line of code for correctness, lack of vulnerability, and strength of its encryption. The first phase has been completed: the code appears correct and free of vulnerabilities. Now they're examining the strength of the encryption and the pseudo-random number generator (PRNG).

PRNGs are programs/algorithms that provide random numbers to encryption systems, and surprisingly, it's not easy to generate random numbers. One of my favorite PRNGs was a project run, IIRC, by UC Berkeley where they had two lava lamps going and a web cam pointed at them and doing integrations to provide pseudo-random numbers. I have no idea if the project is still running. The problem is, if the PRNG in a piece of crypto software is not sufficiently random or can be predicted, then the strength of the encryption is pretty much zero. It might be strong against common criminals, but it'll fall to supercomputers.

So now they're examining the encryption and the PRNG, which will tell us if the software is really good. As it stands, Bruce Schneier thinks its good enough to continue using.

(As a side note, most of the modern operating systems have built-in disk encryption. The problem is that they have weaknesses. Apple's encryption, for example, has a recovery key built-in for the boot partition, so if your entire drive is one partition, you're not as secure as you thought. I don't know much about how strong Microsoft's full disk encryption is or what known weaknesses there are, I don't keep up on their products as much as I probably should. The advantage of using a third-party crypto package like TrueCrypt is that you won't have a vulnerability like this, assuming it passes the audit, which I'm pretty confident on. The disadvantage is that if you lose your primary encryption key, there's nothing the OS vendor can do, all your contents are gone.)

https://opencryptoaudit.org/reports/iSec_Final_Open_Crypto_Audit_Project_TrueCrypt_Security_Assessment.pdf

https://www.schneier.com/blog/archives/2014/04/auditing_truecr.html

This is pretty funny, actually. Lavabit is a secure email provider: the only people with your crypto keys is you with your public and private keys and the recipient with their public and private keys. The way that this encryption works is that everyone gives their public key to anyone who wants it, but keeps their private key a closely-guarded secret. If I want to send you an email, I get your public key and encrypt the message with YOUR PUBLIC key and MY PRIVATE key. When you receive the email, you decrypt it with MY PUBLIC key and YOUR PRIVATE key. This is an automatic process controlled by the software, and it's almost impossible to crack. And don't ask me how it works, it has to do with generating huge prime numbers, but this is how it works in a nutshell. In fact, it is considered utterly secure and unbreakable: basically with sufficiently large keys, which are easy to generate, it would take computer power running until pretty much our sun goes nova to crack it. I never know your private key, the private key is never transmitted across the internet, so unless you machine is compromised with malware, you're pretty darn secure.

That's how Lavabit worked. Apparently the FBI was on to Snowden before he fled the country and they served Lavabit with a subpoena for all of their crypto keys so they could read this email. Lavabit had no choice but to comply, so they did. They provided the FBI with five SSL keys, each of which are 2,560 characters.

They printed them. In four-point type. Eleven pages of extremely small gibberish. And if you get one character wrong, the key is invalid and can't be used to decrypt messages.

The court was not amused and two months later demanded that he hand over the crypto keys in digital form. That was the day that Lavabit announced that it was shutting down, because once the keys were surrendered, the communications of their customers would no longer be secure.

I think what they did was absolutely brilliant. I'm also sure that the FBI will amend their information demands to state "...in DIGITAL form." The article has a sample page of what they keys look like that were given to the FBI.

http://www.npr.org/blogs/thetwo-way/2013/10/03/228878659/how-snowdens-email-provider-tried-to-foil-the-fbi-using-tiny-font?sc=17&f=1001

They're applying strong crypto and logging to the voice stack, not much detail as to whether the data on the phone is encrypted which I think would be fairly trivial. They're also discussion about Germany encrypting other smart phone OS's. It'd be cool if the software were released to the public, but that'd totally screw law enforcement and CALEA.

http://www.h-online.com/security/news/item/NSA-German-government-using-Android-for-secure-phones-1466294.html

The Feds were able to decrypt her laptop, it's not known if her co-defendant ex-husband might have given them the password or if one that she previously gave them finally worked. Regardless, the timing is a little suspect.

http://www.wired.com/threatlevel/2012/02/decryption-flap-mooted/

Her attorney said that it wasn't clear to him if she installed the software herself. She has not yet declared this in court, so the prosecution hasn't announced any plans to deal with this yet.

I wouldn't think it would be hard to compel her to provide a list of possible passwords then run permutations of those against the encrypted image. But you run in to the easy bypass of providing them with a list of reasonable yet wrong passwords that stand zero chance of decrypting the drive.

I'm also curious if the prosecution and investigating law enforcement agency followed procedure and are doing their forensic examination from a cloned image of the drive and not messing with the drive itself, otherwise they open an argument for the defense that their messing with the computer has corrupted the drive and it cannot be decrypted. They probably did, but cases have been lost before where investigating authorities haven't followed correct procedure.

http://www.wired.com/threatlevel/2012/02/forgotten-password/

http://yro.slashdot.org/story/12/02/07/0327233/defendant-ordered-to-decrypt-laptop-claims-she-had-forgotten-password

Said defendant is accused of bank fraud and used PGP to encrypt her entire laptop hard drive. Apparently the prosecutors don't have much of a case without the contents of said hard drive. And now the judge has given her until 2/21 to produce an unlocked hard drive. And, as a marvelous kicker, "The judge added that the government is precluded “from using Ms. Fricosu’s act of production of the unencrypted hard drive against her in any prosecution.”"

She unsuccessfully argued that this was a case of compelled self-incrimination.

http://www.wired.com/threatlevel/2012/01/judge-orders-laptop-decryption/

http://yro.slashdot.org/story/12/01/24/024233/us-judge-rules-defendant-can-be-forced-to-decrypt-hard-drive

DNS, the Domain Name System, is a database lookup that translates a domain name entered into a browser or other program into an IP address. You type www.google.com, DNS does a lookup and finds that Google's IP address is 74.125.227.83. Simplifies things all around.

Usually your default DNS provider is configured by your ISP which looks upstream to heftier DNS servers for their information. You can configure your computer to use any DNS server that you like, but you could be potentially violating terms of service of your ISP or the other server.

The problem is that the DNS lookup process happens in plain text, meaning that you are potentially vulnerable to man-in-the-middle snooping and possible alteration. There have been a lot of effort over the last couple of years to make DNS more secure, including encryption. And now an encrypted DNS system is available!

The DNS service provider OpenDNS is providing encrypted lookups to its DNS servers for Mac clients. A Windows version is promised, and since the source code is available on GitHub, I'm sure a *nix version will be available soon.

http://www.h-online.com/security/news/item/DNSCrypt-a-tool-to-encrypt-all-DNS-traffic-1392283.html

"AT&T is adopting technology that gives a person with an Android device two user profiles, enabling company email and other data to reside in an encrypted partition separate from a user's apps, games and unfettered web browsing. AT&T is calling the feature Toggle, and plans to release it later this year. Toggle is a regular app that, once installed, creates its own encrypted desktop under the control of company IT bosses. Toggle is a rebranding of an app developed by startup Enterproid, which continues to develop its own version. AT&T think this move will encourage smartphone adoption in the enterprise. Interestingly, Apple's current version of iOS and app guidelines exclude multiple profiles on one device."

I can see this as a good move that will help the phone be increasingly adopted in business, but what they need to do is extend this encryption to the entire phone! People are realizing that we're now functionally carrying our entire life in our pocket or purse: photos, contacts, personal and private information, etc., and that can be a real problem if lost. I've carried a PDA for close to 20 years now, and I've been cognizant of this and kept the important stuff in encrypted files. A lot of information was still vulnerable, but at least the most important stuff was affected.

But now in California, Michigan, and other states, you can get your phone sucked dry by the cops during a routine traffic stop. So this really needs to be extended throughout the phone.

One thing that I find interesting is in relation to my current employer. Currently Blackberry's are the standard data phone. I was speaking to one of my fellow IT drones and he said that policies were being put in place so that people with iPhones and Microsoft phones can have them connected to the enterprise. Conspicuously absent from the list? Android phones. The problem viewed from a security perspective is that the operating system is forked for just about every manufacturer and almost every phone. They have different screen dimensions, different keyboards, different feature sets, and this requires customizations and extensions to the operating system. And in doing so, increases the chance for exploits. This is a case where monolithic control over the code base can be an advantage.

Overall, I agree with the Free/Open Source concept of many eyes makes problems visible and easy to fix, but this works in both directions, for good guys and bad guys. And the bad guys are very highly motivated, there's a lot more money for them to find and sell an exploit than there is for the good guys. And this is a problem for the overall Android code base: Maker X finds a significant bug that can lead to an exploit in their code, so they fix it. They may or may not notify other Makers because that bug may or may not exist in their code base. And they can report the bug to Google's Android team, but THEY CANNOT directly patch the fix back in to the base code tree! Most F/OSS projects you can either directly patch the code or submit a patch for review to the code maintainers, unless Google has changed this policy since I first heard of it, its a lot harder to get these patches submitted to them.

http://apple.slashdot.org/story/11/10/14/0350258/android-phones-get-dual-accounts

So theoretically, if you get pulled over for a traffic stop, the officer can suck your phone dry using the same sort of device they use in cell phone stores to transfer data between phones. Your best defense is to silence it and put it in the glove compartment and refuse all requests to search your car without a search warrant.

Since this is an appellate court, hopefully it'll get appealed to the SCOTUS.

http://yro.slashdot.org/story/11/10/06/1234232/calif-appeals-court-approves-cell-phone-searches

The case is interesting. The woman in question is being charged with various securities fraud crimes with having illegally obtained deeds of houses about to go into foreclosure, but the prosecutors are having problems because she seems to have used very strong encryption on her laptop. They're now saying that they don't want her password, they just want her to unlock her laptop so they can inspect the files therein.

I can't imagine this being anything except self-incrimination.

In England it is a crime to not provide an encryption password if the gov't asks for it. I wonder how long before we have such a law here. TrueCrypt has a feature called plausible deniability in which you have a password for your real info, and another password that unlocks the volume in such a way that your secure data is still secure, I imagine we'll be seeing it getting adopted a lot more.

http://news.cnet.com/8301-31921_3-20078312-281/doj-we-can-force-you-to-decrypt-that-laptop/

http://it.slashdot.org/story/11/07/11/1531259/DOJ-We-Can-Force-You-To-Decrypt-That-Laptop

This is pretty cool! It's not a common attack vector, but it's one that has been exploited and wouldn't be difficult. They're using AES-128, which is not easily broken. The cool thing about it is that it's going to sell for $40! The bad thing is that it isn't ergonomic, otherwise I'd be seriously interested.

http://www.h-online.com/security/news/item/Microsoft-wireless-keyboard-with-128-bit-AES-encryption-1254793.html

It's an interesting proposition, and it's not using current router tech. Basically, each person who connects to a router would be separately encrypted, presumably through a shared key. The problem is that once someone can connect to a router it isn't too difficult to listen in to other people's traffic. If each connection is separately encrypted, you pretty much eliminate that possibility.

https://www.eff.org/deeplinks/2011/04/open-wireless-movement (their site kinda sucks, on my browser I have to scroll down quite a bit to get to the text)

http://mobile.slashdot.org/story/11/04/28/150241/EFF-Advocates-Leaving-Wireless-Routers-Open

At the same time, you have the issue that people are getting raided by ATF/DHS/MOUSE at 3am, getting guns pointed at their head, having people with guns shout at them that they're child molesters, and they didn't do anything: people used their open connection to download porn, and in one case, send death threats to the vice president. I'm not entirely clear on how full encryption will prevent this. But for the time being, I'm keeping my router encrypted, no broadcast SSID, and MAC filtering. It's not totally hack-proof, but it's as close as I can easily get. I'd like to have an open router, but if I do, it's going to have all connections logged.

A 19 year old refused to give up a 50 character password and is sentenced to 16 weeks in jail. He's being investigated for child exploitation. In England, you can't make the excuse "I don't remember it" without going to jail. It's not yet against the law in the US, but who knows how long that will last.

http://www.bbc.co.uk/news/uk-england-11479831

http://it.slashdot.org/story/10/10/05/2038219/British-Teen-Jailed-Over-Encryption-Password

And an XKCD cartoon showing the true value of disk encryption: http://xkcd.com/538/

Profile

The Wayne

Spare Brains Games

December 2025

S	M	T	W	T	F	S
	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30	31

Syndicate

Page Summary

Cryptography organization has to nullify election because someone lost the decrypt key!
The UK government secretly ordered Apple to weaken its iCloud encryption
Microsoft will be enabling full disk encryption on clean Win 11 installs soonish
Major flaw found in RSA SSH where crypto keys can be recovered!
An interesting computer security project: Dice Keys
Some good news on the software patent lawsuit front, also some bad news, then some interesting news
Google opening crypto add-in for Gmail that gives users PGP
The audit of TrueCrypt has completed Phase I
Snowden and his email provider, Lavabit
The NSA encrypting Android phones
Mortgage fraud defendent's laptop unlocked
Defendant ordered to decrypt laptop has forgotten the password
U.S. judge orders defendant to decrypt laptop
DNS Encryption
Android phones becoming schizophrenic?
California appeals court approves cell phone sucking
Dept of Justice says they can force you to unlock encrypted disk drives
Microsoft announces wireless keyboard -- that's encrypted!
The EFF is advocating leaving your wireless routers open
Man jailed in England for not revealing computer password

Style Credit

Style: Neutral Good for Practicality by timeasmymeasure

Expand Cut Tags

No cut tags

Page generated Dec. 11th, 2025 09:54 am

Always strive to learn something useful. --Sophocles

You are coming to a sad realization. Cancel or allow?

Entries tagged with encryption

Cryptography organization has to nullify election because someone lost the decrypt key!

The UK government secretly ordered Apple to weaken its iCloud encryption

Microsoft will be enabling full disk encryption on clean Win 11 installs soonish

Major flaw found in RSA SSH where crypto keys can be recovered!

An interesting computer security project: Dice Keys

Some good news on the software patent lawsuit front, also some bad news, then some interesting news

Google opening crypto add-in for Gmail that gives users PGP

The audit of TrueCrypt has completed Phase I

Snowden and his email provider, Lavabit

The NSA encrypting Android phones

Mortgage fraud defendent's laptop unlocked

Defendant ordered to decrypt laptop has forgotten the password

U.S. judge orders defendant to decrypt laptop

DNS Encryption

Android phones becoming schizophrenic?

California appeals court approves cell phone sucking

Dept of Justice says they can force you to unlock encrypted disk drives

Microsoft announces wireless keyboard -- that's encrypted!

The EFF is advocating leaving your wireless routers open

Man jailed in England for not revealing computer password