Summary

Encryption is one of the crucial aspects of modern-day messaging apps, ensuring conversations always remain protected. While WhatsApp has offered end-to-end encryption on chats and video calls for a while now, and the chat app has also gradually worked on increasing the visibility of encryption indicators, like the one we've seen in WhatsApp beta releases dating back to 2021. The latest version of the app's beta contains one such indicator directly below the contact or group's name.

WABetaInfo's reporting reveals that the feature was first spotted in January with WhatsApp beta for Android version 2.24.3.17. However, this indicator is now seemingly making its wider appearance with the latest beta (version 2.24.6.11), according to the publication. The indicator simply reads "end-to-end encrypted" and is preceded by a tiny lock.

This banner won't be constant, though. WABetaInfo says it will only appear briefly and eventually make way for the last-seen indicator. Of course, users can always head over to the Encryption tab from the contact info page to manually verify the encryption. Does this change a whole lot for everyday users? That's debatable, but this will no doubt be useful for people who are new to WhatsApp and may be on the fence about its encryption standards.

It was roughly three years ago when people were leaving WhatsApp en masse and flocking to alternative messaging apps like Signal. However, the Meta-owned service has come a long way since then, ultimately giving up on its controversial privacy policy battle and moving on to become one of the more trusted messaging services around.

WhatsApp already offers plenty of text within the app to explain its encryption standards. In addition to chats and video/voice calls, status updates on the platform are also end-to-end encrypted, as specified in its mobile apps. The developer even has a detailed FAQ page providing all the information on its encryption standards.

This new encryption indicator could also appear in versions 2.24.6.7, 2.24.6.8, and 2.24.6.10 of WhatsApp beta for Android, per WABetaInfo, so it's been a part of the beta cycle for a while now. This also tells us that its appearance in the stable version shouldn't be far away.

See the rest here:
WhatsApp is testing a label to specify that your chats are encrypted - Android Police

WhatsApp is launching an in-app indicator informing users which chats are encrypted.

WhatsApps update 2.24.6.11, available now to some Beta testers of the platform, includes the new capability, which comprises an indicator that displays end-to-end encrypted alongside a small lock icon.

The label is positioned immediately under the contact or group name a user is communicating with, where the last-seen indicator usually is. However, the encrypted label will only appear for a few seconds before fading away to be replaced by the last-seen signifier.

The publication WABetaInfo reported:

After installing the latest WhatsApp beta for Android 2.24.6.11 update, which is available on the Google Play Store, we discovered that WhatsApp is rolling out a feature to identify end-to-end encrypted conversations!

This feature is intended to provide users with transparency about which chats are end-to-end encrypted. It offers peace of mind and confidence that their chats are securely encrypted with the Signal protocol. This visual confirmation ensures privacy by preventing unauthorised access to messages and calls.

WABetaInfo initially reported this feature was in development in January, but its arrival to Beta testing so soon is a pleasant surprise.

While presently available to select Beta testers who have access to WhatsApps Beta updates via Androids Google Play Store, this feature is scheduled to gradually expand to more users over the following weeks.

The update arrives less than a week after Meta posted a blog detailing how WhatsApps interoperability with third-party services will function while preserving its end-to-end encrypted messaging services.

Although accelerated by the European Union introducing its Digital Markets Act (DMA) for tougher regulation of designated messaging services, or digital gatekeepers, WhatsApp has been working on a solution enabling third-party interoperability for two years.

Third-party providers are required to sign an agreement to interoperate with Messenger and WhatsApp before implementation. Although the company favours using WhatsApps Signal protocol for encryption, it will consider other protocols that meet the same security standards.

The EUs new rules came into force last Thursday, March 7, meaning that Meta had to be ready to enable interoperability with other services within three months of receiving a request, as dictated by the DMA. However, Dick Brouwer, Engineering Director at WhatsApp, advised that turning on interoperability might take longer than three months before its ready for public use.

The DMAs requirements mandate support for one-on-one chats and file sharing, including images, videos, or voice messages, in the first year of the new regulation. These requirements will gradually extend to include group chats and calls over time.

WhatsApps evolution into a comprehensive, enterprise-friendly communication and collaboration platform was a significant trend last year, and both the interoperability update and the encryption indicator further affirm this development.

Among the notable enterprise-friendly features launched last year, in December, WhatsApp introduced the ability for users to pin a message to the top of their chatsfor up to 30 days.

Also, in December, WhatsApp launched an enterprise-friendly voice chat upgrade, enabling users to host large groups of up to 128 audio-call participants. Different from a regular group call, this feature is intended to minimise disruptions. Unlike standard WhatsApp group calls that ring every member, this version adds an in-chat bubble on each participants screen, creating a more discreet invitation that users can select to join.

Last August, WhatsApp introduced a call scheduling feature within group chats, enabling WhatsApp group users to organise calls and automatically notify other participants, producing a more convenient and efficient form of communication.

This January, WhatsApp for Windows beta teased a capability to control input and output devices within the application. Reminiscent of similar capabilities in popular video conferencing platforms, such as Zoom and Google Meet, users can select their preferred speakers, microphone or camera for voice and video calls without having to leave the app.

Go here to see the original:
WhatsApp Adds Label Indicating Which Chats Are Encrypted - UC Today

SHIB, the force behind the Shiba Inu cryptocurrency, today introduced Fully Homomorphic Encryption (FHE) into its platform, ensuring unmatched data protection for its users.

This move places SHIB among the pioneers in the Web3 sector, offering comprehensive privacy through its new layer, $TREAT, and marking a significant stride in blockchain security via its partnership with encryption leader Zama. This collaboration aims for a secure and intuitive network, reflecting SHIBs dedication to its communitys safety.

Shytoshi Kusama emphasized the importance of privacy for the SHIB communitys confidence and security, viewing the Zama partnership and FHE adoption as key milestones: We know that in order to deliver against our vision for a nation-state, we need to empower our Shibizens to operate with the full confidence that their activity is both private and secure. This partnership with Zama and the implementation of FHE is a seminal milestone in our journey to fulfill that promise.

Zamas CEO, Rand, expressed excitement over bringing FHE to SHIBs vast user base, anticipating new applications and setting higher standards for blockchain privacy: Partnering with SHIB to bring FHE to millions of people in their community is incredibly exciting. Not only will this enable a wide range of new use cases on the Shiba Inu platform, it will also set a new benchmark for blockchain privacy and security.

Shiba Inus robust market presence and vibrant community underscore its ongoing innovation in the cryptocurrency realm. The integration of FHE is expected to fuel ecosystem growth, introduce new privacy functionalities, and highlight the capabilities of privacy-enhanced blockchain technology.

SHIBs popularity is evident in its significant following and its position as a leading DeFi cryptocurrency ecosystem. It encompasses various tokens and NFTs, and powers innovative technologies like SHIB: The Metaverse and Shibarium. For more information, visit https://shibatoken.com.

Zama, specializing in open-source cryptography, develops state-of-the-art FHE solutions for blockchain and AI, enabling a wide array of privacy-preserving applications, from confidential contracts to encrypted cloud services.

See the rest here:
Shiba Inu Enhances Privacy & Security with New Encryption - FinanceFeeds

Mrk Szab, PR and Security Writer,ESET explains that recently, the YouTube channel stacksmashing uploaded a video on breaking the built-in encryption in Windows, essentially bypassingWindows Disk Encryptionon most devices using Microsofts globally dominant operating system with a cheap $10 tool.

This all in just 43 seconds record time. And while encryption has often been the poster child for efficient and secure data protection, now it seems like encryption, too, has its holes, despite relying on advanced features such as Trusted Platform Modules (TPM), which are now alsorequired by the newest Windows OS.

But can this security hole be properly navigated? Thankfully, the solution is relatively easy and also does not cost as much as a full data breach would.

Exploring BitLocker sniffing The method bypassing encryption has been dubbed BitLocker sniffing, named after the built-in Windows encryption tool BitLocker. Essentially, data from the TPM is exposed on the bus, and if anything is using the TPM, one can then sniff out the data that gets exposed on the bus at some point during the de-encryption process. This can happen on older machines, specifically those whose TPM is not integrated into the CPU.

The exploit on BitLocker relies on the fact that it is not using a password or any other secondary authentication method alongside the TPM. In the case presented in the video, the PC boots automatically with only the TPM providing access to the Disk Encryption Key (also known as Volume Master Key VMK). While switching on the machine, the BitLocker automatically uses the TPM to decrypt the VMK and boots to Windows login almost immediately. So, the VMK is available in the plain on the bus as the system is booting up.

Simply put, the communication between the TPM and the computers processor is exposed during startup, meaning that the encryption key can be read by someone snooping on the signal between the TPM and the CPU, which can be done with a cheap tool and somefirmware.

This might remind someone familiar with cybersecurity of how in some cases man-in-the-middle attacks can eavesdrop on a persons internet connection/Bluetooth/RFID signal while trying to connect to somewhere or something. This occurs because the data stream can become exposed while traveling to a receiver, unless theres some form of additional security involved, like using a VPN while connected to public Wi-Fi, ensuring a protected hidden connection. Basically, adding another security layer on top is required to mask the data transfer.

Is encryption not enough? This new piece of research is very interesting, especially since using a TPM security module or chip is now a requirement of the Windows 11 OS, which is why many older processors that might not have satisfied the requirement werebarred fromhaving the eligibility to install the OS.

The issue is not whether encryption is enough of an incentive for someone to want the newest OS features, but the fact that, so far, its always been a signal of added security. However, with BitLocker sniffing, it seems like encryption might be just another redundant security functionor is it?

Truthfully, encryption is a necessary no, a compulsory security measure for any user that has to ensure their data remains safe and securely stored, limiting potential access opportunities even after a device gets stolen. Whats more, as an added security layer, it makes activities that much harder for crooks, as it delays their potential breach time, giving more time to security responders.

Every company security strategy has to include encryption, as this is also required for regulatory compliance and cyber insurance, where the trend seescompulsory standards raised every year.

To answer the headline then: No, encryption is not enough, as multiple security layers are needed for any strategy to work against malicious threats, but it is a necessary component; businesses must include it for better protection. However, encryption does not need to be as it is, a singular security layer, and there are ways to protect it even against BitLocker sniffing.

Its all about the layers Was it Shrek who described how ogres are layered like onions? Well, like ogres, successful cybersecurity apps and measures are layered too. At ESET, thePROTECT Platformis one example of that, since in and of itself, it contains multiple layers of technologies that protect against threats, be they zero-days that have never seen the light of day or known malware trying its best to avoid detection with newer evasion techniques.

As such, ESET can also guarantee better encryption thanks to a simple thing a password. It might seem like a simple layer, but it is very powerful, as thanks to its inclusion withinESET Full Disk Encryption (EFDE)andESET Endpoint Encryption (EEE), it protects against techniques such as BitLocker sniffing, as that technique relies on unprotected communication betweena discrete TPM chip and a CPU. Thus, any secondary authentication that happens before the process starts prevents the encryption key from being out in the open.

In normal operation with EFDE and EEE, the user is required to enter their password upon booting up their computer. Essentially, the password is used in conjunction with other data and the TPM encryption to decrypt the VMK. So, without the users password, the correct VMK cannot be obtained. Yes, at some point the data decrypted by the TPM will be available in the plain; however, this cannot take place without knowing the users password first.

Powerful encryption, secure systems In the end, cybersecurity will always need to keep evolving, just as threats do. However, sometimes simple security measures can demonstrate quite an impact.

Passwords have always been the first line of defense against external compromise (as gaining access to a single account can cause a chain reaction), and this will probably continue into the future.

However, a reminder needs to be said never pick weak passwords, never reuse a single password across your accounts or encryption, and in general, be mindful of cybersecurity. And for businesses in general, consider what level of security you require as just a single product, or a single additional measure like a strong password for your encryption, can make a difference.

Go here to read the rest:
How to keep encryption secure from BitLocker sniffing - My Startup World

Table of Contents

Show more Show less

Nothing turns potential customers away from a website faster than a label that reads not secure. Or worse, a screen with a large pop-up that warns, This website might not be secure. Protecting your website with a secure sockets layer (SSL) certificate is the easiest way to prevent this. SSL certificates ensure that the information coming to and from your website is secure.

Featured Partners

1

Namcheap SSL Certificate

Starting Price

Around $5.99/Year (INR 499) onwards

Encryption Level

256-bit or 128-bit encryption

Features

Activate in 4 easy steps and Top-Tier Support

On Namecheap's secure website

An SSL (secure sockets layer) certificate verifies the identity of a website and secures a connection between a web page and a web browser. If you run an e-commerce site and are asking people to input information such as their credit card number, or collect other sensitive information, an SSL certificate ensures that information transmitted to and from your website is encrypted.

Youll know that a website has an SSL certificate installed when HTTPS (Hypertext Transfer Protocol Secure) appears in front of a URL (i.e., https://www.forbes.com/advisor/). Many browsers help you determine if a website has an SSL certificate by displaying a small image of a lock by the URL.

On the other hand, if a website does not encrypt its data youll see a warning sign and the words not secure.

Related: Best Web Hosting Services

The short answer is yes. If you own a website, you should have an SSL certificate. If you are asking users to enter a login username and password, or are collecting private information such as credit card numbers, health data or financial accounts, you need an SSL certificate to ensure the transmission of this data is secure.

Many website owners choose to have an SSL certificate even if they are not collecting sensitive information (such as credit card numbers) because Googles algorithm rewards websites that have them. An SSL certificate also communicates to viewers that their sensitive information (such as credit cards and passwords) is protected on your website. These days, most websites have an SSL certificate.

Its relatively easy to get an SSL certificate and many of the best website builders and web hosting providers even offer them for free. Hosting providers such as GoDaddy and Bluehost offer the ability to buy an SSL directly on their website.

If your site doesnt already have one, you can also use a third-party certificate authority. To research some of the most reliable options with the best prices, read our list of the best SSL certificate services.

There are three different types of SSL certificates: domain validated (DV), organization validation (OV) and extended validation (EV). The one best suited for you will depend on your website and how much security you need.

DV SSL is best for personal project websites and is the least expensive option. It requires that the website owner verify that the domain is registered to the domain owner, which is done through the WHOIS database.

OV SSL is best for business or nonprofit websites, and requires a higher level of verification, so is therefore considered more secure. The SSL certificate issuer verifies the address and location of the owner.

EV SSL is best for e-commerce businesses and businesses exchanging financial data as it offers the most amount of protection. In addition, these certificates offer the highest monetary warranties to any website viewers affected by an SSL failure

If you click on the small image of a lock that appears next to any website with an SSL certificate, youll be able to view some key information about its SSL certificate. Youll see the name of the certificate holder, who it was issued by and the expiration date.

An SSL certificate also contains some details about the issuer of the certificate, a copy of the issuers public key and a digital signature of the certificate issuer.

Featured Partners

1

Namcheap SSL Certificate

Starting Price

Around $5.99/Year (INR 499) onwards

Encryption Level

256-bit or 128-bit encryption

Features

Activate in 4 easy steps and Top-Tier Support

On Namecheap's secure website

An SSL certificate is a digital certificate that encrypts online communication. When a visitor tries to access your website through their web browser, the SSL certificate signals to the browser that your website is secure.

Some website hosting providers offer free SSL certificates. While any SSL certificate is better than none, free SSL certificates typically offer the lowest security level (DV). Additionally, paid SSL certificates often offer a warranty to protect your site visitors against any potential SSL-related security threats, while free versions generally do not.

The price you pay for an SSL certificate will depend on the level of security you need (DV, OV or EV) and whether you need to certify one domain or many. In our list of the best SSL certificate services, prices range from INR 550 per year for DV SSL (for a five-year plan) to INR 18,000 per year (for a six-year plan) for OV SSL. If youre looking to pay per year, you can expect to pay between INR 4,000 and INR 20,000 per year for a DV SSL.

Read more:
What Is An SSL Certificate? Everything You Need To Know - Forbes