To encrypt or not? That is the question
Even before someone hacked Sarah Palin's Yahoo Mail account I had been wondering whatever happened to encryption.
Encryption -- the science of rendering plain text unreadable by anyone but the intended reader -- made a splash in the mid-1990s. At the time the U.S. government was investigating human rights activist Phil Zimmermann for allegedly violating the Arms Export Control Act by distributing his PGP (Pretty Good Privacy) e-mail encryption software. The government eventually relaxed the restrictions and PGP was no longer programa non grata.
Nearly a decade has passed and it struck me recently that encryption still hasn't become a household word, although anyone who uses a Web browser has had his or her communications with sensitive Web sites encrypted without them even necessarily knowing it.
But outside of the SSL activity being done behind the scenes, people haven't been downloading encryption software to keep their online communications private. Hardly anyone I know uses encryption, even at work. Given the government's targeting of journalist sources and my own personal brush with an attempted hack, I decided to look into whether encryption would be a good idea and why it isn't more widely adopted.
First, a test drive
My first question was, is it still complex and difficult to use? My sense after trying out a free trial version of PGP Desktop Email ($149 after the one-month trial) is that it may be easier to use than it once was, but that it's still more complicated than necessary.
I downloaded the software and followed the prompts as it generated a public key for people to use to encrypt messages sent to me, and a private key for me to use to decrypt messages. I picked a password and published my public key to the Global Directory Server for people to find it when sending me encrypted e-mail. I sent an e-mail to Zimmermann as a test and he said it arrived encrypted, so I knew my PGP was working.
This screenshot shows the PGP Desktop Corporate Key Properties window with details of my key.
But then I noticed that reading and sending e-mails was slower than it used to be. It was taking a few seconds to try to authenticate every e-mail signed with a key and to search for keys to encrypt e-mails I was sending. Even after I changed the PGP settings so that it wouldn't automatically look up keys for each recipient, it was still taking time trying to authenticate signed e-mails.
While the software is more user-friendly now (requiring fewer hoops to jump through than the free, open source versions of PGP), there was a slight performance trade off and you still need to set policies and manage keys, which can be a hassle. For instance, because I turned off the automatic key look-up feature for encrypting I now have to manually get keys from people I want to send private e-mails to or look them up in a directory and spread my key to others. Keys for others are not always easy to find either. For me, it's not worth the effort at this time.
But the larger concern is self-perpetuating; because there are so few people I can send encrypted e-mail to I'm less likely to use it, which means that there are likely fewer people overall using encryption. All the software upgrades, automation and enhancements in the world can't change the fact that using encryption for e-mail requires that both parties have the same software installed for it to work.
"The biggest problem in the space has always been the lack of ability to send an encrypted message to someone who wasn't using encryption," says Nick Selby, director of the enterprise security practice at The 451 Group, who uses Gnu PGP.
Corporate workers have it easier than consumers; IT departments can handle the complexities of encryption software and manage the keys. E-mail encryption services from providers like Postini (now owned by Google), CertifiedMail and Voltage Security allow companies to outsource the function, easing the process further.
Despite that, a recent survey of more than 200 organizations conducted by CertifiedMail and Osterman Research found that frequent e-mail encryption users represent 18 percent of the total e-mail users and more than 50 percent of the total are infrequent users. Meanwhile, 21 percent of organizations have an enterprise-wide encryption strategy, according to a survey of 975 executives and administrators by The Ponemon Institute for PGP Corp.
For consumers, a no-hassle option is Hushmail, a free Web-based service that encrypts e-mail, scans for viruses and filters spam. The service encrypts mail sent to other Hush users or PGP-compatible e-mail users.
There is some level of encryption for users of the more popular Web-based e-mail services, but it's limited. Gmail encrypts the login and if a user enables always-https, the e-mail and cookies are encrypted as they travel between the server and the browser. Asked if the content on the servers is encrypted, a Google representative said that encryption and access control technologies are used but the company does not want to provide specifics on how it's used.
Yahoo encrypts the login and sends the password encrypted over the network using SSL. Microsoft provides support for S/MIME encryption for Windows Live Hotmail users when using Microsoft Outlook or Windows Live Mail as clients. Windows Live Messenger includes an option to encrypt contact list data. Representatives from Google, Yahoo and Microsoft declined to discuss why they don't give people the option of storing e-mail in encrypted form on their servers.
If you are going to be concerned about keeping e-mail private, why not instant messages too?
I tried Off-The-Record messaging with Pidgin that allows for messaging on multiple IM platforms simultaneously. It was easy to install and use, but here again it only works if both parties are using the software. The popular multi-platform IM software Trillian has a built-in encryption feature called SecureIM. (For information on how specific popular IM programs handle security see the CNET News IM survey from June.)
Maybe it's just too hard to use
The consumer programs still require some user supervision of keys, which is an impediment to their widespread adoption. Consumers don't want to have to think about the logistics of communicating, they just want it to happen seamlessly.
Basically, e-mail encryption has failed to become mainstream (only five percent of all e-mail is encrypted, according to PGP) because technologists under-estimated how difficult it would be for people to manage their own key rings, said Benjamin Jun, vice president of technology at Cryptography Research.
"If we thought about where encryption was 10 years ago and where it is now, in many ways we have failed," Jun said. "You use more cryptography to start your car in the morning than there is in your e-mail, in many cases."
Meanwhile, the very government forces that were fighting use and export of strong encryption a decade ago may now be among the strongest beneficiaries of it.
Phil Zimmermann created the PGP e-mail encryption program in the early 1990s to be used as a tool by human rights groups. The software is available in free, open source versions and commercial versions sold by PGP Corp. Zimmermann serves as a consultant and advisor to the company and has started a new venture for encrypting voice over IP, called the Zfone Project.
(Credit: Phil Zimmermann & Associates)"I don't think the government is doing much to discourage general Web encryption now," said PGP creator Zimmermann. "U.S. computer networks are getting hit hard by organized crime and foreign governments like China, so from a national security perspective there are arguments to be made" that favor of encryption. (The FBI, however, continues to seek access to consumer information for law enforcement.)
As data leaks and stolen laptops and missing back up tapes become commonplace, state governments are beginning to realize they may have to force companies to protect sensitive consumer data. A new Massachusetts law will require that personal consumer data stored on laptops and flash drives--and where feasible data transmitted over the Internet and wireless connections--be encrypted. Nevada recently passed a law that requires that personal data be encrypted before transmission over electronic networks.
"Overall, the legislative environment actually tends to favor encryption more now than in the '90s," with regulations like HIPAA and breach disclosure laws that have exemptions if the data is encrypted, Zimmermann said.
Full disk encryption
A hot area for encryption right now is full disk encryption, in which every piece of data on a hard drive is encrypted. With all the laptops that get lost and stolen, there's really no reason not to encrypt the hard drive.
Zimmermann learned this the hard way, having had several laptops stolen from him in train stations in Europe, including one instance that involved a thief distracting him by tossing yogurt on the back of his shirt. "Everyone who travels with a laptop absolutely needs whole disk encryption," he said in recounting the incident. (Zimmermann's latest venture is the Zfone Project, software for encrypting voice over IP calls.)
Bruce Schneier, chief security technology officer at BT, said he uses PGP Whole Disk Encryption and doesn't really worry about encrypting his communications. "It's data at rest that is at risk, not data in transit," he said.
And renowned social engineer Kevin Mitnick, who spent five years in jail for breaking into computer networks, takes extraordinary precautions using encryption when he travels outside of the U.S. because customs officials can search and seize computer equipment with no cause whatsoever. He was detained for four hours recently at a U.S. airport and had his laptops inspected. Because of that risk, he encrypts his hard drive before returning to the U.S. and encrypts all his confidential data, transmits it to servers in the U.S. and wipes the data from his laptop.
Mitnick says he uses free open source disk encryption software called TrueCrypt. Microsoft's Windows Vista and Windows Server 2008 include BitLocker Drive Encryption. And Fujitsu and other hardware companies offer full disk encryption hard drives.
While rules may force companies to adopt encryption to protect consumer data, there is no outside force pushing individuals to use it. Until people feel more vulnerable they aren't likely to be compelled to install more software, according to Cryptography Research's Jun. "Most alarm systems are installed after a home has been burglarized, not before," he said.
But just because people don't realize they need it doesn't mean it shouldn't be more readily available to them, said Marc Rotenberg, executive director of the Electronic Privacy Information Center.
"Right now, it's not practical. I think that's unfortunate and it should be more widely available," he said. "My hope is that in an IPv6 (Internet Protocol version 6) world encryption will be routine."
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
Now once you get into PGP and all that you're starting to enter the realm of the web mail vs the client mail application debate again. I personally prefer web mail and I prefer to keep important/confidential data safe by not sending it through email at all and using other methods.
As for Palin. Well, she probably picked a weak password. It's a common mistake that your common person makes. Problem is Palin is running for VP. She can't be just a common person with common mistakes anymore. If she can't keep her own email safe by picking a good strong password how would she keep the whole country safe from the dangers it faces if something happens to McCain? Hopefully she'll be smart enough to listen to any advisers she can get her hands on in that case.
Um, Einstein, her password wasnt guessed. The 'hacker' used Yahoo's password reset system to get at her account. Anyone who hasnt been living under a rock the past few weeks knows this, which makes me wonder if you're really informed to be casting a vote.
-R
Days/Weeks? Maybe.
I don't care how big your rainbow table is - a decent encryption scheme that the NSA has no backdoor to is going to take awhile to brute-force into if Mitnick uses a sufficiently strong password.
Baring human error in key management, the key lengths involved make brute forcing highly impractical. At very least everyone will be dead by the time a 128 bit key is found. TrueCrypt uses 256 bit AES by default, meaning it's exponentially more difficult. Even if they could try 100 trillion keys per second it would take them well over a billion years to try less than quarter of the possible keys in 128bits. By then the sun will have gone red giant an incinerated the Earth .
128 bits = 340282366920938463463374607431768211456 possibilities.
256bits = 115792089237316195423570985008687907853269984665640564039457584007913129639936 possibilities
I used the GNU Multiple Precision Arithmetic Library to calculate these numbers.
So he's not carrying any data that he wants to keep secret across customs, he's sent it encrypted over the 'net, and is coming in with "clean" hardware.
One of the biggest if not the biggest failures in computing is PKI, public key infrastructure, whether from fear that keys would be centralized and available to law enforcement to the lack of education for developers on public-key technologies. I thought for sure when the RSA patent expired there would be a mass adoption of PKI but alas it hasn't happen.
Not enough time is spent on making it usable to my 60 year old parents. If they can easily use the encryption features, it will be adopted more.
Let's say that works for you, that you perform incremental backups and you're good with that. Using DropBox and Password Safe, you can get exactly what it is you are looking to do: it will log you out of your Password Safe session if you suspend, go to screen saver, lock the console, etc. It will also timeout.
Furthermore, you can mimic the same thing with TrueCrypt, as it can be configured to relock on screensaver activation, suspend mode, timeouts, etc. Check them out.
-R
Secondly we need to push all of our providers to offer us Strong authentication using the Trusted Platform Module that is now on 250 million PCs and provides a common standards based hardware device to manage keys on the PC. The TPM would eliminate the need to login with passwords from your personal PC and would dramatically reduce the potential for theft of access to data
Steven Sprague
Wave Systems Corp
Whether ?tis nobler in the mind to suffer
The slings and arrows of user nonacceptance,
Or to take arms against a sea of exploits,
And by opposing end them? To encrypt: to authenticate;
No more; and by authenticate to say we end
The heart-ache and the thousand natural shocks
That disclosure is heir to, ?tis a consummation
Devoutly to be wish?d. To encrypt, to authenticate;
To audit: perchance to dream of security: ay, there?s the rub;
For in that effort of implementation what dreams may come
When we have shuffled off this mortal user apathy,
Must give us pause: there?s the respect
That makes calamity of so long life;
For who would bear the whips and scorns of user communities,
The oppressor?s ID10T error, the proud man?s denial that caps-locks was on;
The pangs of despised credentials, the law?s delay,
The insolence of the CSIO?s office and the spurns of the auditors
That patient merit of the unworthy takes,
When he himself might his quietus make
With a bare server? who would fardels bear,
To grunt and sweat under a weary implementation plan,
But that the dread of something after death,
The undiscover?d lost data from whose bourn
No system administrator returns, puzzles the will
And makes us rather bear those ills we have
Than fly to vendors that we know not of?
Thus conscience and user feedback does make cowards of us all;
And thus the native hue of resolution Is sicklied o?er with the pale cast of thought,
And enterprises of great pith and moment
With this regard their currents turn awry,
And lose the name of action. - Soft you now!
The fair McAfee! DLP, in thy orisons.
Be all my lost data sins remember?d.
Simon Hunt, CTO, McAfee Data Protection.
http://siblog.mcafee.com/?cat=41
Elinor
95% of world users probably have no idea what encryption or PGP means.
with the use of USB products and fast Data Transfer rates, anyone, in seconds can copy data from their home PC.
and if you ask whom to blame? well, i think that would be both Apple and Microsoft, if both OS's had easy-to-use, easy-to-see and understand encryption options while user viewing his folders, maybe it would have been different.
Users don't want to wait.
Don't even get me started on flash drives. The zero security versions are so cheap and are everywhere... the industry is just now telling consumers "oh wait! maybe you want to keep that stuff private... we can do that, but it costs more and it's not as fast as the thing we already sold you!"
This is definitely a case of trying to put the genie back in the bottle and trying to sell that idea to a user base that believes in the illusion of privacy because the industry selling the widgets didn't tell them any different.
Before designing our latest product we conducted extensive focus group research with small businesses all over the country. What we found is that it was important for our products not only to work with Outlook but any email client or service including GMail, Yahoo! etc. Also important was the ability for senders to have the choice whether or not thier encrypted email recipients should need to download software. Thus with our product email recipients do not have to download any software to view encrypted messages. Also important was the ability to add digital rights management controls that help prevent forwarding, printing, Prt+Scn, etc. Although DRM controls are much easier to circumvent, such as by taking a picture of the secure email with your cell phone. When selling email encryption to small businessessuch as law firms, we have found that DRM provides an important value-add.
Being that very few people actually ssem to care about their on-line privacy, we hope that recent legislation such as Nevada's new encryption law NRS 597.970 will help increase adoption and awareness of encryption. What's encouraging is that the encryption industry has really started focusing on making encryption products more useable.
Website: http://www.essentialsecurity.com
If your account is protected by a password. You are dead. Your lock can be easily picked by guessing, brute force, keystroke logging, etc...
Not much else matters until we have something better than a password.
If your account is protected by a password. You are dead. Your lock can be easily picked by guessing, brute force, keystroke logging, etc...
Not much else matters until we have something better than a password.
I've been using a product called eCipher to encrypt my emails and I love it. And Grandma doesn't need to do anything to read my emails, other than to click on a link.
Here, you try it:
<a href="http://www.eciper.com">www.ecipher.com</a>
I have had almost no problems with Thawte. A problem was with the browser Opera.
WebLOQ has solved this problem completely with an email based communications ecosystem that delivers dual layer encryption for keyboard-to-keyboard security and privacy, with complete regulatory compliance reporting in a privacy space that is free of malware. WebLOQ runs on any OS, behind any email client, on any platform, including smartphones, and over any Internet connection. The user never even knows about keys and passwords and all private email is sent and recieved just as though it were regular email. You may download WebLOQ's free trial at www.webloq.com
George Sidman
Chairman, WebLOQ
What Voltage does is gives you true ad hoc messaging. The emails can be encrypted using something you already know, the recipients email address. On top of that, the Voltage solution has a key management solution that can generate keys on the fly.
Give it a look. http://vsn.voltage.com
It's definitely worth a look! www.steganos.com
- by uohaa January 4, 2009 7:47 AM PST
- Sarah Palin's email account, would Sarah Palins be able to use it?
- Like this Reply to this comment
-
Showing 1 of 2 pages (35 Comments)