Climbing in through General Petraeus's window

A guest blog for International Business Times by Brian Spector, CEO, CertiVox.

I have been watching the Petraeus affair closely over the past few weeks and, I have to say, it has all the ingredients of a first-class thriller. The chiselled military hero, the hi-tech espionage, the secret service infighting, the wanton peccadillo; it’s basically Skyfall served up in a sauce américaine. And, of course, it actually happened, which is a lot more than you can say about Skyfall.

But what is particularly striking for me is that, many thousands of years into the evolution of civilisation, the Petraeus affair shows quite clearly that we still haven’t learnt one fundamental lesson: if you can open a window to get in to your house for legitimate reasons, a burglar can do exactly the same thing for non-legitimate reasons.

Translation: if the thing that requires opening can be opened by anyone apart from you, it can, perforce, be opened by people who should not wield that power!

What’s this got to do with Petraeus?

This isn’t just to do with Petraeus; it is to do with the global senior business, defence, political, cultural, technical and scientific communities of which Petraeus and many others are a part. These figures prize confidentiality and privacy extremely highly – for professional reasons, certainly, but perhaps for other reasons too - so they ensure that they use various methods of “secure” communication.

But this really is nonsensical. Basically, almost all forms of secure email and file transfer still rely on a stored encryption key. This is ostensibly designed to keep data private, but instead it actually puts the ability to decrypt and read data squarely in the hands of a third party (namely, the vendor that has supplied the security or encryption software or service that stores the keys).

I’ve written about this more extensively elsewhere, but to summarise, government agencies can force the vendors to hand over the stored encryption keys so that they can decrypt the messages themselves. As simple as that, General – they can get in through your window and look at your stuff just like you can!

Storing up a storm…

Now there’s a line from spoof spy movies that I love, not only for its camp pomposity, but also because it reveals a really important underlying point: “I could tell you, but I’d have to kill you.” The point is this: anybody or anything that stores sensitive information is a risk.

I tell you my secret, you store it up in your head. Unless I then “neutralise” you, you can betray that information, whether willingly or no. You become both a liability to me and a target for somebody else. Security vendors , as we have hinted above, routinely store keys (in fact, their systems can’t work any other way.) So they’re not helping.

Now consider this. A system of encryption where nothing relating to the user’s identity is stored. Where the keys are created within a browser, without any use of an external security vendor (in the form of a Trusted Authority or keystore, or similar). Where the master secret is split across servers, so that it can never be reassembled. Where the encryption keys are created using a calculation that works in one direction but not in the other, so that it can’t be reverse-engineered to get at the original message or file.

And immediately, the landscape changes. In this scenario, only sender and recipient can ever open and read the messages and files that are sent. Nobody else. And that includes the security vendor themselves, hackers, whistleblowers, aggrieved ex-employees, your boss, and Uncle Tom Cobbley and all. Oh, and the FBI and their international buddies.

Redefining privacy

But is privacy really so precious that technology should be able to protect it at any cost? It’s a thorny question, but you have to see it against the backdrop of the way the online community now communicates. Opinions and conversations that were previously private have gone public. People talk about their ingrowing toenails on Facebook. They tweet when they have been let down by their train company or served bad food in a restaurant.

Truly private discourse has ever-dwindling currency in the online world. This, in turn, makes it a more precious item, requiring more radical measures to protect it. Alas, whether that discourse is ultimately for good or ill is not ours to influence. But we at least owe it to people and businesses to make sure they understand the difference between protecting their communications and inviting a third-party to step in through an open window and join the conversation when instructed.

A difference that a battle-hardened General really should have understood.

If it ain’t there, they can’t grab it!

Why encryption is not the answer to the username/password hacking fiasco

The past few days have been like a collective outpouring of cyberguilt here in Internetland, as website after website after website admitted that confidential user login information has been swiped from their supposedly secure systems. First Yahoo, then Nvidia, then clothing manufacturer Billabong - and all hot on the heels of the epic LinkedIn hack of just a few weeks ago, which left literally millions of user passwords compromised.

They are falling, it seems, like skittles – and Billabong’s inclusion shows quite clearly that this is not just geeky prankery aimed at tech firms. Every single website that offers a user login is a target. And yes, dear reader, that includes yours, and all the ones you use. Actually, let me clarify that last point: every single website is a target, but not every single website is a realistic target. Only the very large number of them that store users’ login details somewhere on their site. Gulp.

That, in fact, is where the apparent “serial vulnerability” we have seen this last week stems from. You see, there are two really silly things that a lot of websites are still doing. (This is silly on the scale of lighting a cigarette when you have a gas leak, by the way – not silly as in wearing brown in Town.) Most websites store a list of logins – usernames and passwords – in a thumping great file. This file is stored on the website itself. Engineers and project managers would call this a “single point of failure” – in other words, if the hackers can get to this file, they can get to everything on the site that’s of any value and then use it on other sites too. Mortals like us simply call this “really daft.” All the interesting and sensitive stuff, all in one place – how very obliging!

Secondly (and this really did make the toes of my boots curl up), it seems that this data was stored unencrypted. Yes, you read that right. In the clear. Transparent. So, all the interesting and sensitive stuff in one place, in a way which is also really easy to read - thank’ee, sir! As compound stupidity goes, it’s a beauty.

So what’s the remedy? Encrypt the username/password file so that, even if the hackers can get to it, they can’t do anything with it?  Ah, the British, pragmatic to the last! But, you see, this isn’t a practical question, it’s a philosophical one. Hackers go where they think they can get the big prize. As long as it’s the big prize, it justifies the effort. Ergo, no big prize, no effort – and the hackers are out of your hair. As the title of this piece says, if it ain’t there, they can’t grab it; and, moreover, they would see no existential point in trying.

So what am I suggesting here – that you run your website without logins? Everything out in the open? Universal trust? No, go hug a tree. I’m suggesting that you run your website without storing the login data in a file on your site. Files are big and unwieldy and (as we’ve seen) vulnerable. Files are ugly and incompetent. Files probably even smell bad, too.

Ever seen the film Rob Roy? (Bear with me on this…) At one point, the devilishly pompous character played by John Hurt, unwilling to do his own dirty work, utters the line to a fellow conniving duke “My factor will call on Your Grace’s factor.” Two parties, known to each other, in totally controlled communication. In fact, you could almost call this “two-factor” authentication. (Groan). But, bad punnery aside, this really is the nuts and bolts of keeping website login information secure. The only place that “secret” user information should be stored is in the user’s head or some other part of their body (think biometrics, for example.)

Instead, the website should simply serve as an entry point to a service that makes a calculation between one authentication factor (something the user knows – like a PIN, for example) and something the user has (like an ATM or smart card, or biometric value, or mathematical token), and confirms a match or a mismatch. Going one step further, multi-factor authentication brings additional elements like one-time passwords and mobile devices into the mix. (But I couldn’t think of a film that summed that up very well!)

Amazingly, given the high profile of the companies that were hacked, authentication of this type is now a requirement across a range of industries. Should it be a requirement for (supposedly) specialist internet/software companies, clothing and retail companies, and social networking firms too? Based on recent experience, you bet your hard drive it should! Hackers don’t care how their victims make their money – they just want in on it. Make no mistake, the hackers are on a file hunt and those ole websites just keep on giving.

So I’m winding my Friday down now, hoping and praying that this nonsense is over and that the denizens of Internetland – website owners and website users both – can sleep soundly in their cyberbeds from now on. Maybe we can even catch a little sun at the weekend. And you know what – the same rules apply to your choice of sun cream as they do to your choice of website security. Multi-factor only!

Thank you Beta Testers; Online Privacy Continues to Get Lots of Media Attention

Frank Böning and I are in the United States this week meeting with potential key partners and we’ve been able to incorporate real-world opinions and thoughts from our hundreds of PrivateSky beta testers into our meetings. If you are one of these beta testers, thank you! Your time and feedback are so appreciated!

In response to a short survey we recently issued, 93 percent of our beta users think PrivateSky is easy to use. We are so incredibly pleased with that! The No. 1 problem plaguing encryption to date has been difficult, hard-to-use products, so we’ve clearly made a breakthrough in ease of use! More than 85 percent feel they are working in a more secure environment. Nearly everyone wants to know when the finished product will be available!

We’re incorporating your feedback to make the final version of PrivateSky better than the beta. We’ve taken a close look at many requests for more functionality, especially in the business setting, and we’re working diligently to fulfill those requests in the full release version, which we plan to launch soon. We will keep you posted on our progress and final launch date – if you are a beta tester you will be informed automatically.

It’s not too late to sign up for beta testing! We’re especially looking for more feedback about our secured file transfer feature. With PrivateSky, you can send large files to anyone securely. As always with PrivateSky, no one can see what you send. That’s part of what sets us apart from other services claiming to be secure (yes, they really can see your data and no, we really can’t!).

Almost all (97%) of our beta testers agree that online privacy is a huge deal. Maybe it’s a highly publicized story that came out a few weeks ago about Google Co-Founder Sergi Brin saying that he is “scared” about the state of Internet freedom today, with various efforts to control access and communication on the web. If they had PrivateSky, they could send what they wanted, when they wanted, without anyone seeing their data. It’s just that secure.

There’s also this story from WIRED magazine – The NSA is Building the Country’s Biggest Spy Center (Watch What You Say). Pay special attention about half-way in, where it says, “There is still one technology preventing untrammeled government access to private digital data: strong encryption.”  PrivateSky uses strong AES-256 bit encryption to safeguard your data so that only the intended recipients can access it.

Thank you to again to our beta testers, our teams, our families and our friends. We couldn’t be on this journey without your support and every day that we hear your stories, or read theirs; we’re more convinced than ever that what we’re doing is truly special.

Brian & Frank

PC Mag recommend PrivateSky: Six Tips for Protecting Your Email Privacy

Sending an email message is certainly more private than posting on a social networking site, but email has its own dangers.

PC Mag recently published an article educating users with six tips to help secure their online communications without risking their privacy.

"By now we all know not to post sensitive information on social networking sites. Even with privacy settings enabled, that angry political rant or embarrassing beach photo can easily become the next viral Internet sensation. By comparison, email seems like a much safer communications medium, but you can still get into trouble if you lose control of your account. In addition, email messages bounce unprotected from server to server, so private information might be compromised."

The Six tips from PC Mag are:

1. Use a Strong Password.

2. Beware Public PCs.

3. Protect Your Address.

4. Lock It Up.

5. Don't Be Fooled.

6. Use Encryption like PrivateSky

Read the full article from PCMag on the Six Tips for Protecting Your Email Privacy

We would like to thank PC Mag for recommending PrivateSky for encrypted messaging to their readers, and don't forget you can sign up for your FREE Privatesky account to protect your email privacy now!

PrivateSky Really Can NOT See Your Data

It's been a busy week at CertiVox! First and foremost, we're excited that we've been chosen as a finalist for Red Herring's 2012 Top 100 Europe award, a prestigious honor that calls out the year's most promising private technology ventures in Europe. This is great validation of the work we're doing. We'll be heading to Amsterdam later this month.

We've also received solid feedback and interest in our Beta testing! Thank you! There seems to be many questions about our technology and some people hesitant to accept that we can actually deliver on our privacy policies. We welcome the questions and will take every opportunity we can to clarify. Human history proves that technological advancements can bring out fear and negativity. When the Lumiere Brothers showed their films for the first time in 1895 at the Grand Café in Paris, audience members ran out of the room in a panic to avoid being hit by the image of a train pulling into a station.

People knew they were only watching an image, but they had no basis by which to judge this unfamiliar experience and overreacted. And so it is with our technology. People want to doubt and turn away from our technology, just as they did that train. But we are simply delivering on something that hasn't been delivered on yet; it's new from an implementation standpoint, but is actually based upon cryptographic capabilities that have suffered over a decade of cryptanalysis. Nevertheless, it will take some folks more time than others to accept what we do.

There was a good, healthy exchange from some of these skeptics on Security Stackexchange. I responded to the posts in hopes of educating readers how PrivateSky works. Though it's pretty techy, it lays the foundation and provides links to research and other data for anyone interested. I welcome your feedback!

All of us at CertiVox sincerely believe that just because we use the Internet to communicate doesn't give the government, the NSA, Dropbox, or any media companies the right to use our information in any way, especially not for data mining! PrivateSky simply and safely protects your data (yes, even from us)!

As more governments start to come under fire for proposing surveillance legislation to see your email communications and web site visits, more people will see the value of PrivateSky and our technology. A lot of people (and businesses) already get it, but more will follow as mainstream media picks up on what is truly happening out there in the wild west of web 2.0.

Happy reading and, as always, we continue…onwards!

Brian