Cloud Hosting

CLEVELAND, Ohio U.S. Attorney Justin Herdman is entering the fray on a national debate over law enforcements ability to access encrypted devices and messaging apps, trying to rebuff the sentiments of many tech companies that say such access could leave them vulnerable for exploitation by hackers.

Some experts consider his ideas problematic.

Herdman, in an op-ed published Wednesday on cleveland.com, mostly echoed statements made in recent years by Justice Department officials about the need for law enforcement and tech companies to work together so investigations dont stall. Calling on the need for public safety, he said agents inability to get into the devices hinders investigations into drug dealers, terrorists and sex traffickers.

The piece was directed not only at the public but at companies such as Facebook and Apple, which have spoken about the privacy needs of its customers and the rights they feel their users should enjoy to shield their messages.

Thus far, several tech companies have expressed an unwillingness to provide law enforcement a way to access either encrypted devices or messaging app systems such as WhatsApp and Signal. Other concerns raised involve defendants Fourth and Fifth Amendment rights.

Former American Civil Liberties Union attorney Alex Abdo, whose work at the organization involved issues surrounding tech and security, said many people in Silicon Valley argue that it is almost impossible to build a backdoor system for law enforcement that could not be accessed by hackers or, say, authoritarian governments in other countries that would seek information through their own legal systems on dissidents.

Still, Herdman said in an interview from Washington, D.C., that Im not convinced, nor is the department convinced, that theres not a technological solution to this. He also said that law enforcement accesses these devices for narrow purposes approved by a judge.

The U.S. attorney wrote in the op-ed that the companies are within their rights to offer privacy and cybersecurity to prospective customers as well they should, because these are important values.

But they shouldnt do so at the expense of public safety, Herdman continued. And these same industry professionals certainly know that warrant-proof encryption is protecting the criminals amongst us.

He took it a step farther in the interview, saying officials are committed to working with the companies but that forcing them to grant access could happen through the courts or new laws.

We cannot live in a world where pedophiles and drug traffickers and terrorists are able to communicate freely without law enforcement being able to lawfully intervene, he said.

The encryption issue was spotlighted in 2016, when the FBI sought Apples help to unlock an encrypted iPhone used by an extremist shooter who, along with another shooter, gunned down 14 people and injured 22 others in San Bernardino, California. Apple refused to help, citing privacy concerns.

The FBI sought outside help and was able to open the phone.

Herdmans op-ed was published two days after executives at Facebook wrote a letter snubbing overtures made by Attorney General William Barr to give law enforcement backdoor access to their systems. Facebook plans to enable end-to-end encryption on all of its messaging platforms, a system that locks messages so that not even the company can read them, according to The Associated Press.

Barr and other Justice Department officials have made statements directed toward tech companies to allow access. He said in a speech Tuesday that the encryption fight was one of our highest priorities and described an increasing number of horror stories about how people are dying, or being molested or whatever, but we cannot get in, the AP reported.

Herdman, in his op-ed, cited two examples from Ohio to support his argument that law enforcement needs more access.

He said agents were unable to get into the cellphone of a 25-year-old man arrested in a hotel outside Canton this summer on suspicion of trafficking a 16-year-old girl for sex. Agents have a search warrant but additional information that could build a case against the man is locked away because the phones manufacturer wont provide a way to get in the phone, the U.S. attorney said.

The result: Evil prevails and innocent children are still being victimized, Herdman wrote. First Assistant U.S. Attorney Bridget Brennan later declined to identify the man.

The other involved a wiretap that went cold when the target of an investigation, who was talking to a drug supplier in Mexico, switched to using an encrypted messaging app and the agents could not access the messages.

Brennan identified the target as Ismael Acosta, a Cleveland Heights man now serving a prison sentence of more than 15 years for trafficking drugs and money laundering following an investigation into a large operation by the Drug Enforcement Administration.

Herdman, who has been U.S. attorney since 2017, said in the interview that its very common for law enforcement to come across encryption. Such technology emerged near the end of his first stint at the U.S. Attorneys Office between 2006 and 2013, and he recalls discussions about it in meetings when he was in the offices national security unit.

Case Western Reserve University criminal law instructor Michael Benza said that having third parties, i.e. big tech companies, give access to apps or devices poses problems. If an agent gets a warrant to search a house, and they get someone else to kick in the door for them, thats unacceptable, he said.

Its not as simple as this is a bad guy, we know its a bad guy, so give us the access,'" Benza said.

Abdo, now the litigation director at the Knight First Amendment Institute at Columbia University, also said the government, even in the absence of encrypted information, has more information about people than ever before, because there are digital traces left every time someone uses a device or accesses the internet.

The existence of that information has caused some to say were living in a golden age of surveillance, he said.

To Herdman, such privacy concerns are vastly outweighed by the need for safety.

I dont think theres a really coherent argument on the tech side to not offering law enforcement access to devices and communications, he said.

Read more:

Child predators must not be able to hide behind warrant-proof encryption: Justin Herdman

Twenty charged in multi-state drug ring that brought heroin, fentanyl, cocaine to Cleveland

FBI works with outside party to unlock iPhone; hearing with Apple canceled

Continued here:
U.S. Attorney Justin Herdman of Ohio says agents need access encrypted devices, apps for the sake of public s - cleveland.com

AN international outcry has erupted after the UK Home Secretary, Priti Patel, joined her US counterparts in demanding that internet companies weaken encryption for users and design digital back doors in messaging services to allow security services easier access.

Dozens of concerned groups, including Amnesty International, Index on Censorship, Reporters Without Borders and Open Rights Group (ORG), have raised their concerns in an open letter to the UK, US and Australian governments.

READ MORE:Time Person of the Year prize for activist Greta Thunberg

The UK government suggested that stronger capabilities to monitor private messages would aid the fight against terrorism and child abuse.

However, the ORG said that alternative approaches must be used as the proposed measures would weaken security for every internet user.

It said this attack on encryption formed a pattern of attacks on digital privacy and security by the UK government, after documents leaked last week showed that it wanted to give the US access to NHS records and other personal information, in a free flow of data between the two countries.

The letter, co-ordinated by the US-based Open Technology Institute, came after a joint letter from the authorities to Facebook described encrypted communications tools as lawless spaces, and urged the company to remove or delay the deployment of end-to-end encryption protections on their messaging platforms.

In their letter, concerned bodies warned: Fulfilling this request would endanger the security and privacy of billions of internet users around the world.

Proponents of exceptional access have argued that it is possible to build backdoors into encrypted consumer products that somehow let good actors gain surreptitious access to encrypted communications, while simultaneously stopping bad actors from intercepting those same communications. This technology does not exist. To the contrary, technology companies could not give governments backdoor access to encrypted communications without also weakening the security of critical infrastructure, and the devices and services upon which the national security and intelligence communities themselves rely.

ORG policy director, Javier Ruiz Diaz, said: The Home Secretary wants to be able to access our private messages in WhatsApp and similar apps, demanding that companies remove the technical protections that keep out fraudsters and other criminals. This is wrong and will make the internet less safe.

Surveillance measures should be targeted and not built into the apps used by millions of people to talk to their friends and family.

Originally posted here:
Priti Patel bids to create end-to-end encryption apps' back door - The National

Version 79 of Chrome is out, and it promises to do a better job of protecting you against phishing sites and credential stuffing attacks.

Since 2017, Chrome has protected users against phishing by checking the sites you enter your Google credentials into against a list of known phishing sites. It keeps these as part of its Safe Browsing initiative. Google synchronises its list of bad sites with the browser every 30 minutes, but because sites change so quickly, that means users might fall victim to new sites that had come online just minutes earlier.

Chrome 79, released on Tuesday 10 December, now performs that phishing protection in real-time, even for users with the synchronisation feature turned off. The company says this will protect users in 30% more cases. The protection has also been extended to include all the passwords stored in the Chrome password manager rather than just Google accounts. You can turn it on by enabling the Make searches and browsing better option in Chrome.

The browser also now includes some other protections. It will now show you more clearly which profile the browser is currently using, which is handy for those sharing a browser and using different profiles. Theres also a feature that Google has been testing out for months: a built-in check for hacked passwords during site logins.

The feature began as a Chrome extension called Password Checkup that warned users their login credentials had been breached. Released in February 2019, it found that 1.5% of all web logins were using breached credentials, according to a Google survey released in August this year. That fuelled Googles next move, in which it folded the feature directly into Chromes password manager. The service still didnt check your credentials against hacked logins whenever you logged into a website. Instead, it would run the passwords youd stored in the password manager service periodically to see if it found a match.

The version of Password Checkup integrated into Chrome 79 goes a step further. Now, it runs the check whenever you log into a site. Google is at pains to avoid any suggestion of creepiness or spying as part of this move, so its been pretty clever about how it performs the check. It wants to be clear that it doesnt get to see your login credentials.

When you log into a website, Chrome will now send a hashed copy of your login credentials to Google. A hash creates a unique and reproducible string of text using whichever data you give to it, which identifies the data without revealing it. This data is encrypted in the browser using an encryption key to which only you have access.

Google already used its own key to encrypt the list of hacked login credentials that it sniffed from various sources online. It does the same thing with the credentials that Chrome sends it, encrypting them a second time.

This double encryption is part of a technique called private set intersection with blinding. It tries to match the login credentials you entered against Googles database of hacked usernames and passwords.

For your privacy, Google doesnt do this matching itself. Instead, it sends a small part of its encrypted hacked credentials database back to Chrome, along with your double-encrypted login credentials (which youll remember have now been encrypted twice). Chrome removes the encryption it applied to your login credentials using your own key, leaving only Googles encryption in place. It then tries to match those hashed encrypted credentials against the small subset of the database that it received from Google. If it finds one, then your credentials have been hacked.

Google knows which small subset of the database to send back because your browser also creates a hash of the username you tried to enter into the website. It sends part of that hash to Google along with the other data. Google uses that snippet of your hashed username to select the part of its database including the same snippet in the index.

Its an ingenious system, and as long as you feel you can trust the encryption (and Google), then it looks like a good way to automate hacked password detection. It will alert you that your credentials have been pwned at the point in time when youre most likely to do something about it when youre trying to log into the site.

As with all password breaches, you should change your password if Chrome does discover a match, and turn on multi-factor authentication if the hacked site makes it available, to prevent a possible attack. You should also avoid reusing passwords across multiple sites so that attackers wont be able to unlock your other accounts with a hacked password. You can make that easier by using a password manager with a built-in password generator.

Read more from the original source:
Chrome 79 includes anti-phishing and hacked password protection - Naked Security