Tag Archives: Safety

France says fight against messaging encryption needs worldwide initiative

13 August 2016

The report “France says fight against messaging encryption needs worldwide initiative“, published on Reuters technology news last Thursday, is truly worrying.

“Messaging encryption, widely used by Islamist extremists to plan attacks, needs to be fought at international level, French Interior Minister Bernard Cazeneuve said on Thursday, and he wants Germany to help him promote a global initiative.”

I can, of course, understand the motivation of the French Interior Minister. He must do his utmost to protect France from further terrorist attacks.

“French intelligence services are struggling to intercept messages from Islamist extremists who increasingly switch from mainstream social media to encrypted messaging services, with Islamic State being a big user of such apps, including Telegram.”

Although the French Interior Minister has not requested decryption options from service providers yet, the direction of a Franco-German initiative is from my point of view clear: Service providers shall make decryption options available to national police and intelligence and security services.

With this, some attacks can certainly be prevented, but on the other hand, it puts many innocent people, which care of civil rights in authoritarian regimes, at risk.

In “Exclusive: Hackers accessed Telegram messaging accounts in Iran – researchers“, published in Reuters CYBERSECURITY at 2 August 2016, Joseph Menn and Yeganeh Torbati reported, that Iranian hackers compromised accounts on Telegram.

The security researchers who researched the attack said that “… the Telegram victims included political activists involved in reformist movements and opposition organizations. They declined to name the targets, citing concerns for their safety.”

“We see instances in which people … are targeted prior to their arrest,” Anderson said. “We see a continuous alignment across these actions.”

That is precisely the problem when national security services demand decryption options from service providers: The information can be used to prevent terrorist attacks, as well as for violent actions against dissidents among the citizens. Hopefully the German Interior Minister will remember the recent German history (Stasi) and reject those demands once and for all.

By the way, end-to-end encryption is the just the comfortable way of secure communications. Terrorist can turn to less comfortable, but high secure encryption options like PGP. With this the French initiative makes no longer sense because the messages are encrypted before the transport to the service provider. Even end-to-end encryption is not required.

Even though it is apparent from the context, Benjamin Franklin’s quote about liberty and safety fits very well here:

Those who would give up essential liberty, to purchase a little temporary safety, deserve neither liberty nor safety.

Have a good weekend.

Advertisements

LIFARS: Hackers Disable ‘Smart’ Rifle and Change Its Target, Remotely

4 August 2015

When I read the LIFARS post ‘Hackers Disable ‘Smart’ Rifle and Change Its Target, Remotely’ I felt really appalled. Not so much because the rifle’s built-in Linux server was compromised, but rather because the software developers ignored really all requirements about security and safety. Just one example from the post:

Every rifle contains a built-in network password that’s default and cannot be changed.

I do not know what planet these developers are living on, but it’s definitely not the earth.

From my point of view the software must force the marksman to change the password before he fires the first shot. In addition, Two Factor Authentication is mandatory in safety relevant cases, on a transaction basis, and with the second factor always entered directly on the rifle. Preferably through a custom grip, like the Walter PPK which Q gave to 007 in Skyfall.

Imagine security and safety standards are such bad in the billions of devices making up the Internet of Things universe. With this Doomsday is no longer just a religious concept …

Sleep well!