Allstaractivist’s note:
As you read the below editorial, think back to what I said in my previous post; “Thank God For Puppy Linux! – (and Barry Kauler too)” about random number generators (RNG) and their importance in cryptography. Remember also that I said to stay away from Google and MSN search engines too. It goes without saying of course to avoid Microsoft’s Internet Explorer browser, ditto for Google’s Chrome (I don’t care if it is partially open source now) and Firefox.
Truecrypt uses you as it’s RNG, is totally open source and the programmers who wrote it have never been identified. They gave the program to the world for free and, for two very good reasons. First, had they identified themselves they would have been attacked or coerced by the NSA to adulterate their program and compromise their principles (or worse). Second, the patent laws are such that only big corporations or fascist collaborators are able to avail themselves of their protections. (the patent laws). It takes huge sums of money to legally defend your patent, corporations are the only ones able to do it, most times. Best to open source and derive your income from consulting.
The reason that I stick with an old version of Opera and stay away from Firefox is because in the early stages of Opera’s development, security and innovation were still an ethic of it’s developers. They hadn’t sold out yet. Funny, I do remember that for a time in the beginning, Opera was being touted as the browser of choice for communists, I started seeing communist based themes offered as skins. Don’t know where that was comming from, Opera was the anti-establishment tool of the time.
Firefox has sullied itself by using talent that works with the NSA, as the editorial below details. Even though it is open source and not proprietary like Opera, it is so popular that it attracts large numbers of hackers. Opera on the other hand, is used by less than %0.05 of all users of desktop browser applications. With such a small user base, Opera is not worth the time for a hacker to try to attack. No payoff. This same principle is the reason that I stay away from other popular browsers too, don’t care if they are open source.
As for using an email program that is totally secure, the government will not allow that. There used to be only two, for pay security focused email service providers however, our government pressured them so bad that it was impossible for them to stay in that business. One of them was Silent Circle. If you are going to do email, don’t say or send anything sensitive. Better yet, have every one of your contacts use software that allows for strong encryption. I don’t know what those programs are (I don’t do email) but I know they are out there.
***************************************************************
excerpted from: Ars Technica
by Dan Goodin – Mar 31 2014, 8:49am -0700
Security provider RSA endowed its BSAFE cryptography toolkit with a second NSA-influenced random number generator (RNG) that’s so weak it makes it easier for eavesdroppers to decrypt protected communications, Reuters reported Monday.
Citing soon-to-be-published research from several universities, Reuters said the Extended Random extension for secure websites allows attackers to work tens of thousands of times faster when breaking cryptography that uses the Dual EC_DRBG algorithm to generate the random numbers that populate a specific cryptographic key. Dual EC_DRBG is a pseudo-random number generator that was developed by cryptographers from the National Security Agency and was the default RNG in BSAFE even after researchers demonstrated weaknesses so severe that many suspected they were introduced intentionally so the US spy agency could exploit them to crack encrypted communications of people it wanted to monitor. In December, Reuters reported that the NSA paid RSA $10 million to give Dual EC_DRBG its favored position in BSAFE.
Extended Random was a second RNG that would presumably make cryptographic keys more robust by adding a second source of randomness. In theory, the additional RNG should increase the entropy used when constructing a new key. In reality, the algorithm made protected communications even easier for attackers to decrypt by reducing the time it takes to predict the random numbers generated by Dual EC_DRBG, which is short for Dual Elliptic Curve, Reuters reported Monday.
“If using Dual Elliptic Curve is like playing with matches, then adding Extended Random is like dousing yourself with gasoline,” Matt Green, a professor specializing in cryptography at Johns Hopkins University and one of the authors of the upcoming academic report, told Reuters. Monday’s report continued:
The NSA played a significant role in the origins of Extended Random. The authors of the 2008 paper on the protocol were Margaret Salter, technical director of the NSA’s defensive Information Assurance Directorate, and an outside expert named Eric Rescorla.
Rescorla, who has advocated greater encryption of all Web traffic, works for Mozilla, maker of the Firefox Web browser. He and Mozilla declined to comment. Salter did not respond to requests for comment.
Though few companies appear to have embraced Extended Random, RSA did. The company built in support for the protocol in BSafe toolkit versions for the Java programming language about five years ago, when a preeminent Internet standards group—the Internet Engineering Task Force—was considering whether to adopt Extended Random as an industry standard. The IETF decided in the end not to adopt the protocol.
The researchers said it took them about an hour to crack a free version of BSAFE for Java using about $40,000 worth of computer gear, Reuters reported. Cracking was 65,000 times faster when BSAFE used Extended Random, an improvement that reduced attacks to seconds.
Dan is the Security Editor at Ars Technica, which he joined in 2012 after working for The Register, the Associated Press, Bloomberg News, and other publications.
Dan Goodin / Dan is the Security Editor at Ars Technica, which he joined in 2012 after working for The Register, the Associated Press, Bloomberg News, and other publications.
All Star Activist 