DOCSLIB.ORG

Signal Telegram Surespot Threema Whatsapp Freie Software Ja Teils Ja Nein Nein

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Signal Telegram Surespot Threema Whatsapp Freie Software Ja Teils Ja Nein Nein „Ich möchte nicht in einer Welt leben, in der alles, was ich sage, alles, was ich tue, jedes Gespräch, jeder Ausdruck von Kreativität, Liebe oder Freundschaft aufgezeichnet wird. Das ist nichts, was ich bereit bin zu unterstützen. Das ist nichts, das ich bereit bin mit aufzubauen. Das ist nichts, unter dem ich zu leben bereit bin. Ich denke, jeder, der eine solche Welt ablehnt, hat die Verpflichtung, im Rahmen seiner Möglichkeiten zu handeln.“ - Edward Snowden Was ist eine CryptoParty? ● Workshop zur digitalen Selbstverteidigung • "Tupperware-Party zum Lernen von Kryptographie" (Cory Doctorow) ● Einsteigerfreundlich ● Öffentlich & unkommerziell ● Fokus auf Freier Software ● Von Anwendern für Anwender -> Gelerntes weitertragen 3 / 49 Agenda ● Inputvortrag zu: • Sichere Passwörter • Verschlüsselung von E-Mails (PGP) • Tracking beim Browsen vermeiden • Dateiverschlüsselung (VeraCrypt) • Smartphones ● Praxis 4 / 49 Sichere Passwörter Wie werden Passwörter geknackt? ● Brute Force • Alle möglichen Kombinationen ausprobieren ● Listen / Wörterbuch-Angriffe • Alle Wörter einer Liste ausprobieren ● Social Engineering • Phishing, Person austricksen um PW zu erfahren 5 / 49 Wie erschwert man das Knacken des Passworts? ● Brute Force => Länge (10+ Zeichen) => Verschiedene Zeichentypen (Groß- und Kleinbuchstaben, Zahlen, Sonderzeichen) 6 / 49 Wie erschwert man das Knacken des Passworts? ● Brute Force => Länge (10+ Zeichen) => Verschiedene Zeichentypen (Groß- und Kleinbuchstaben, Zahlen, Sonderzeichen) ● Listen / Wörterbuch-Angriffe => Kein einzelnes Wort als PW verwenden => Keine Wörter aus dem Umfeld (Namen, Geburtsdaten) 7 / 49 Wie erschwert man das Knacken des Passworts? ● Brute Force => Länge (10+ Zeichen) => Verschiedene Zeichentypen (Groß- und Kleinbuchstaben, Zahlen, Sonderzeichen) ● Listen / Wörterbuch-Angriffe => Kein einzelnes Wort als PW verwenden => Keine Wörter aus dem Umfeld (Namen, Geburtsdaten) ● Social Engineering => Niemandem das Passwort verraten! 8 / 49 Brute-Force-Angriffe und Passwortlänge Nutzung von Kleinbuchstaben (26 Zeichen) Quelle: http://www.1pw.de/brute-force.html (Rechengeschwindigkeit: 2096204400 Schlüssel pro Sekunde (Keys/sec)) 9 / 49 Brute-Force-Angriffe und Passwortlänge Nutzung von Groß-, Kleinbuchstaben und Zahlen (62 Zeichen) Quelle: http://www.1pw.de/brute-force.html (Rechengeschwindigkeit: 2096204400 Schlüssel pro Sekunde (Keys/sec)) 10 / 49 Wie erstelle ich ein sicheres Passwort? ● DBiR&dSd90M! • Merksatz: »Der Ball ist Rund & das Spiel dauert 90 Minuten!« ● HausLocherTasteMeloneBagger • Wortreihung ● 2UrN47oCfK6jAZ8xuKHiop4upPsI73 • Passwortgenerator 11 / 49 Passwortverwaltung Wichtig: Für jeden Dienst ein anderes Passwort verwenden! Software: KeePassX Vorteile Nachteile ● Freie Software ● Masterpasswort ● Viele Plattformen • Darf nicht vergessen oder geknackt werden! • Win, Linux, Mac, Android ● Komfort ● Passwortgenerator • Kein Sync zwischen ● Verschlüsselt gespeichert verschiedenen Geräten 12 / 49 13 / 49 E-Mail Anbieter Quelle: http://apps.opendatacity.de/prism/de 14 / 49 Alternativen zu "kostenlosen" E-Mail-Anbietern ● Posteo.de oder mailbox.org ● Gratis 24h-Einmal-E-Mail-Adresse: anonbox.net (CA-Cert) Vorteile Nachteile ● Standort in Deutschland ● Kostet 1,- € pro Monat ● Datensparsamkeit ● Keine Inhaltsanalyse ● Keine Werbung ● Anonyme Nutzung möglich ● Datenschutz hat Priorität 15 / 49 E-Mail Verwaltung ● Software: Mozilla Thunderbird • Freie Software • Mehrere Mail-Konten möglich • Verwaltung mit Filtern und Ordnern • HTML Abschalten möglich • Mails offline lesen und speichern • Plug-Ins: Kalender, Massenmails, Verschlüsselung 16 / 49 17 / 49 E-Mail Verschlüsselung (PGP) Vorteile Nachteile ● Inhalt Ende-zu-Ende ● Metadaten unverschlüsselt verschlüsselt ● Sender & Empfänger ● Sender & Empfänger sind müssen PGP nutzen eindeutig Benötigte Software: ● E-Mail Programm: Thunderbird ● Add-on: Enigmail 18 / 49 Unterschied Symmetrische / Asymmetrische Verschlüsselung ● Symmetrische Verschlüsselung (secret key) • Wie analoge Schlüssel • Ein Schlüssel zum ver- und entschlüsseln • Alle Teilnehmer brauchen den Schlüssel ● Asymmetrische Verschlüsselung (public key) • Schlüsselpaar 19 / 49 Wie funktioniert PGP (Pretty Good Privacy)? ● Asymmetrische Verschlüsselung ● Schlüsselpaar: privater und öffentlicher Schlüssel. ● Öffentlicher Schlüssel: • verschlüsselt die E-Mail • gibst du deinen Kommunikationspartnern ● Privater Schlüssel: • entschlüsselt die E-Mail • bleibt privat, gibst du niemals raus! 20 / 49 21 / 49 PGP Public Keys austauschen ● E-Mail Anhang • .asc Datei ● Key-Server • Bequem durchsuchbar • E-Mail-Adresse öffentlich einsehbar 22 / 49 23 / 49 Verbreitung von PGP Quelle: https://sks-keyservers.net/status/key_development.php 24 / 49 Tracking beim Browsen vermeiden Quelle: https://trackography.org/ 25 / 49 Analyse mit Firefox-Addon Lightbeam 26 / 49 Analyse mit Firefox-Addon Lightbeam 27 / 49 Wie kann ein Webserver mich identifizieren und verfolgen (Tracking)? ● Cookies: • kleine Textdateien, die die aufgerufene Webseite im Browser speichern und wieder abrufen kann. ● Passive Merkmale: • IP-Adresse, Sprache, Browser, Betriebssystem ● Aktive Merkmale (Javascript, Flash, Java, h264, ...) • Schriftarten, Browser-Add-ons, Bildschirmauflösung, uvm. => Eindeutiger Browser-Fingerabdruck • siehe https://panopticlick.eff.org/ 28 / 49 Wie kann ich mich vor Tracking schützen? ● Browser-Wahl • Firefox, Chromium (https://download-chromium.appspot.com) ● Browser-Einstellungen • Do-not-Track Option • Benutzerdefinierte Chronik: Cookies (für Drittanbieter) deaktivieren ● Suchmaschinen • Ixquick.com, Startpage.com, DuckDuckGo.com, MetaGer.de, etc. (im Gegensatz zu Google auch keine individuellen Ergebnisse) ● Browser-Add-ons! ... 29 / 49 Schutz durch Firefox-Add-ons ● Tracker und Werbung blocken: uBlock origin ● Aktive Inhalte blocken: NoScript • Skripte allgemein erlauben (laut Hersteller nicht empfohlen) ● Webseiten immer verschlüsseln: HTTPS Everywhere ● Flash-Cookies löschen: BetterPrivacy Etwas komplizierter und aufwendiger: ● Alle Skripte blocken: NoScript ● Anfragen an Drittanbieter blocken: RequestPolicy ● Referer blocken: RefControl (Vorsicht!) 30 / 49 TOR-Browser Was ist der TOR-Browser? ● Modifizierter Firefox ● Nutzt TOR zum anonymen Server 31 / 49 TOR (The Onion Router) Was ist TOR? ● Netzwerk zur Anonymisierung von Verbindungsdaten ● IP-Adresse wird verschleiert Vorteile Nachteile ● Freie Software ● Login bei personalisierten Seiten nicht sinnvoll ● Anonymes Surfen 32 / 49 33 / 49 Dateiverschlüsselung Software: VeraCrypt • Weiterentwicklung von TrueCrypt • Software zur Datenverschlüsselung Was kann ich mit VeraCrypt machen? • Verschlüsselte Container (Ordner) erstellen • Komplette Festplatte verschlüsseln • USB-Sticks und andere Wechseldatenträger verschlüsseln 34 / 49 VeraCrypt Vorteile Nachteile ● Plattformübergreifend ● Komfort • Win, Mac, Linux ● Passwort vergessen? ● Freie Software => Daten weg! ● Kompatibel mit alten TrueCrypt-Containern 35 / 49 Smartphones & Tablets ● Hardware ("Super-Wanze") • Mikrofon, Kamera, GPS, Bewegungssensor ● Betriebssystem • IOS (Apple) oder Windows (Microsoft) = Pest oder Cholera • Apps nur aus einer Quelle (zentraler App-Store) • Geschlossene Systeme, keine Gerätehoheit • Mehr Freiheit durch Jailbreak (Gefängnisausbruch) 36 / 49 Android ● Theoretisch gute Basis • Linux basiert, Freie Software ● ABER: Tiefe Integrierung proprietärer Google-Software • Suche, Browser, Gmail, Maps, Kalender- / Kontakte-Sync...etc. • Play Store & Google Play Dienste • Fernzugriff, Datenübermittlung (ca. 700 mal pro Tag) • Keine Root-Rechte 37 / 49 Erste Schritte ● Sichere Bildschirmsperre • von unsicher zu sicherer: Wischgeste, Muster, Biometrisch, PIN, Passwort ● Speicher verschlüsseln ● WLAN, GPS, Bluetooth, etc. ausschalten, wenn nicht genutzt ● Browser gegen Tracking schützen 38 / 49 Typische Wischgesten 39 / 49 Ansprüche an Messenger ● Für alle gängigen Betriebsysteme verfügbar ● Ende-zu-Ende-Verschlüsselung ● Sicheren Verschlüsselungsalgorithmus (AES) ● Open Source (Überprüfung durch unabhängige Experten) ● Upload von Daten (z.B. Adressbuch) nur mit ausdrücklicher Bestätigung des Nutzers ● Unabhängige Installation und Betrieb • z.B. ohne GooglePlayStore & PlayDienste 40 / 49 Messenger Vergleich Signal Telegram Surespot Threema WhatsApp Freie Software Ja Teils Ja Nein Nein Ende-zu-Ende Verschlüsselung Ja (Ja) Ja (Ja) (Ja) Unabhängiges Audit Ja Ja Nein (Ja) Nein Kein Auslesen des Adressbuchs Nein Nein Ja (Ja) (Ja) Nicknames Nein Nein Ja Ja Nein Nicht nur über App-Store erhältlich Nein Ja Nein Ja Ja Ohne PlayDienste Nein Ja Nein Ja Nein Verbreitung Mittel Weit Kaum Mittel Sehr Weit 41 / 49 Android 'entgoogeln' 1. Unnötiges entfernen • Google-Einstellungen (G+, Standort, Suche, Werbe-ID) 2. Alternativ-Dienste nutzen • Browser, Suche, Mail, Kalender- / Kontakte-Sync 3. Play-Store löschen • mindestens eingeschränkt nutzen 4. Freies Android-Betriebsystem installieren • z.B. Replicant, Cyanogen Mod, Paranoid Android 42 / 49 Empfehlenswerte Apps ● App-Store: F-Droid ● Mail: K-9 ● PGP: OpenKeychain ● Browser: Firefox ● Messenger: Signal (Eingeschränkt) 43 / 49 Weitere Projekte I ● Prism-break.org: ( https://prism-break.org/de/all/ ) Liste datenschutzfreundlicher Software und Anbieter, z.B.: • Startpage und DuckDuckGo statt Google-Suche • OpenStreetMap statt Google Maps • Dudle statt doodle • EtherCalc und EtherPad statt Google Docs • Diaspora* statt facebook oder Google+ • ... ● DigitalCourage: Digitale Selbstverteidigung ( https://digitalcourage.de/digitale-selbstverteidigung ) 44 / 49 Weitere Projekte II ● freifunk: freie, eigene Internet-Infrastruktur mit offenen WLANs (es gibt eine Gruppe in Bielefeld) ● Tails (The amnesic incognito live system): Anonyme Live- DVD Noch in Entwicklung: ● p≡p (Pretty Easy Privacy): Einfach zu bedienende E-Mail- und Chat-Verschlüsselung (PGP kompatibel) für Outlook, Thunderbird, WhatsApp, Facebook und Jabber, auf iOS-, Android-, Windows- und GNU/Linux-Geräten 45 / 49 Kontakt & Termine E-Mail: [email protected] Homepage: https://hsg.digitalcourage.de Linux Install Party: 24. November, 18 Uhr, U2-205 Hochschulgruppentreffen: Jeder 1. und 3. Montag im Monat (nächstes Treffen: 21.11.), 18 Uhr im SozCafé (X-C2-116) 46 / 49.
Load more

Recommended publications
  • Copyrighted Material
    Stichwortverzeichnis A B Abstreitbarkeit 167 Bequemlichkeit 30 Adblocker 96 Bitcoin 110 – Adblock Plus 96 Blackberry 215 – Disconnect 96 Bookmarks siehe Favoriten – Ghostery 96 Browser 68, 75 – Privacy Badger 96 – Add-on 87, 90 – uBlock 97 – Apple Safari 77 Add-on – Cache 88 – Browser 87, 90 – Chromium 78 – E-Mail-Client 126 – Chronik 87 – Enigmail siehe Enigmail – Fingerprinting 85, 98 – GpgOL 137 – Google Chrome 77 – Mailvelope 130, 132 – HTML-Engine 80 – Thunderbird 139 – Hygiene 88 Adium 170 – Iceweasel 78 Advanced Programming Interface (API) 90, – Inkognito-Modus 86 182 – integrierte Suche 84 Android – Internet Explorer 77 – Android Privacy Guard (App) 156 – Konqueror 78 – K9 Mail (E-Mail-Client) 156 – Microsoft Edge 92 – OpenKeychain (App) 156 – Midori 78 – PGP 156 – Mosaic 68 – R2Mail2 (E-Mail-Client) 158 – Mozilla Firefox 68, 76 – S/MIME 156 – Netscape Navigator 68 Anonymität 206 COPYRIGHTED– Opera 77MATERIAL AOL Instant Messenger (AIM) 164 – Plug-in 87 Apple Mail – Prole (Identitäten) 87 – PGP 145 – Synchronisation von Einstellungen – S/MIME 155 86 Authentizierung 167, 169, 176, 179 – Web (Epiphany) 78 – Adium 172 Buffer Overow 82 – Multifaktor- 201 Bugs 82 – Pidgin 169 Bundesamt für Sicherheit in der Informations- Authentizität 29, 54, 56 technik (BSI) 215 233 Stichwortverzeichnis C – E-Mail-Adresse 119 Caesar-Chiffre 36 – Header 121 Certicate Authority siehe Zertizierungsstelle – Provider 129, 131, 139 Chain of Trust siehe Web of Trust – Server 122 Chaos Computer Club (CCC) 133 Eingangsverschüsselung 125 Chat 161 Electronic
    [Show full text]
  • Authentication and Key Management Automation In
    Authentication and Key Management Automation in Decentralized Secure Email and Messaging via Low-Entropy Secrets Itzel Vazquez Sandoval∗, Arash Atashpendar∗†, Gabriele Lenzini∗ ∗SnT, University of Luxembourg †itrust consulting, Luxembourg Email: {itzel.vazquezsandoval,gabriele.lenzini}@uni.lu, [email protected] Abstract—We revisit the problem of entity authentication in management, affecting email more acutely, is intertwined with decentralized end-to-end encrypted email and secure messaging authentication and the need for automating it has been known to propose a practical and self-sustaining cryptographic solution for a long time, e.g., see (Ruoti et al., 2018). based on password-authenticated key exchange (PAKE). This not only allows users to authenticate each other via shared low- Over the years, several methods have been established to entropy secrets, e.g., memorable words, without a public key tackle authentication, and indirectly key management: man- infrastructure or a trusted third party, but it also paves the ual validation, web of trust, public key infrastructure (PKI) way for automation and a series of cryptographic enhancements; and hierarchical validation, public key directories as well as improves security by minimizing the impact of human error and server-derived public keys such as identity-based encryption potentially improves usability. First, we study a few vulnera- bilities in voice-based out-of-band authentication, in particular (IBE). The set of viable candidates becomes much smaller a combinatorial attack against lazy users, which we analyze in once we consider a decentralized setting, i.e., without a PKI the context of a secure email solution. Next, we propose solving or a trusted third party (TTP).
    [Show full text]
  • Secure Email - a Usability Study
    Secure Email - A Usability Study Adrian Reuter1, Karima Boudaoud2, Marco Winckler2 , Ahmed Abdelmaksoud2, Wadie Lemrazzeq2 1 Technische Universität München, Arcisstraße 21, 80333 München, Germany 2 Polytech Nice Sophia, 930 route des Colles, 06903 Sophia Antipolis, France Abstract. Several end-to-end encryption technologies for emails such as PGP and S/MIME exist since decades. However, end-to-end encryption is barely ap- plied. To understand why users hesitate to secure their email communication and which usability issues they face with PGP, S/MIME as well as with pEp (Pretty Easy Privacy), a fairly new technology, we conducted an online survey and user testing. We found that more than 60% of e-mail users are unaware of the existence of such encryption technologies and never tried to use one. We observed that above all, users are overwhelmed with the management of public keys and struggle with the setup of encryption technology in their mail soft- ware. Even though users struggle to put email encryption into practice, we ex- perienced roughly the same number of users being aware of the importance of email encryption. Particularly, we found that users are very concerned about identity theft, as 78% want to make sure that no other person is able to write email in their name. Keywords: mail encryption, user study, usability, PGP, S/MIME, pEp. 1 INTRODUCTION To prevent cyber-crime and to protect user privacy, almost all services running on the Internet critically depend on cyber security measures. Most dominantly, transport layer security (TLS) is used for securing a variety of communication protocols.
    [Show full text]
  • Security Analysis of Subject Access Request Procedures How To
    Security Analysis of Subject Access Request Procedures How to authenticate data subjects safely when they request for their data Coline Boniface, Imane Fouad, Nataliia Bielova, Cédric Lauradoux, Cristiana Santos To cite this version: Coline Boniface, Imane Fouad, Nataliia Bielova, Cédric Lauradoux, Cristiana Santos. Security Analy- sis of Subject Access Request Procedures How to authenticate data subjects safely when they request for their data. APF 2019 - Annual Privacy Forum, Jun 2019, Rome, Italy. pp.1-20. hal-02072302 HAL Id: hal-02072302 https://hal.inria.fr/hal-02072302 Submitted on 19 Mar 2019 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Security Analysis of Subject Access Request Procedures How to authenticate data subjects safely when they request for their data Coline Boniface2, Imane Fouad1, Nataliia Bielova1, C´edricLauradoux2, and Cristiana Santos3 1 Univ. Grenoble Alpes, Inria, France fcedric.lauradoux,[email protected] 2 Universit´eC^oted'Azur, Inria, France fnataliia.bielova,[email protected] 3 School of Law, University Toulouse 1 Capitole, SIRIUS Chair [email protected] Abstract. With the GDPR in force in the EU since May 2018, companies and administrations need to be vigilant about the personal data they process.
    [Show full text]
  • Massenüberwachung Mittels Computerlinguistik Und Sprachtechnologie Im Lichte Der Snowden-Enthüllungen
    Masterarbeit zur Erlangung des akademischen Grades Master of Arts UZH der Philosophischen Fakultät der Universität Zürich im Rahmen des fakultätsübergreifenden Master-Studiengangs Computerlinguistik und Sprachtechnologie Massenüberwachung mittels Computerlinguistik und Sprachtechnologie im Lichte der Snowden-Enthüllungen Recherchen zum Stand der Technik und kritisch-illustratives Datenprojekt zur automatischen Generierung von Selektoren für verdachtsunabhängige Massenüberwachung von Datenströmen mit manueller Evaluation resultierender Treffer Verfasser: Hernâni Marques Madeira {[email protected],hernani@ccc-ch}.ch 7FE5 71F9 3B0C AE18 8424 C7C2 7B83 6E41 F7AB 9CE5 [email protected] (OTR-verschlüsselt) Referent: Prof. Dr. Martin Volk Betreuer: Dr. Noah Bubenhofer Institut für Computerlinguistik Abgabedatum: 30.11.2015 PUBLIC//V1.14//20160902 V1.14: EDITION NDG-ABSTIMMUNG1 1Formal sind diese Bilder und der Aufruf natürlich nicht Teil der offiziellen Abgabe. 2 An Schweizer Stimmberechtigte: Am 25. September NEIN zum NDG! https://www.stopndb.ch/ 3 Abstract The master thesis gives an overview of the state-of-the-art in mass surveillance methods and practices following the Snowden relevations and scientific papers with a focus on NLP methods. For the practical part of this work, genesis and the nature of search terms (content or soft selectors) used in finding text material by the needle-in-a-haystock methodology are researched, implemented, evaluated and critically dicscussed. Quantitatively and technically, as expected, it is found that false
    [Show full text]
  • Technological Sovereignty: Missing the Point?
    2015 7th International Conference on Cyber Conflict: Permission to make digital or hard copies of this publication for internal use within Architectures in Cyberspace NATO and for personal or educational use when for non-profit or non-commercial purposes is granted providing that copies bear this notice and a full citation on the M.Maybaum, A.-M.Osula, L.Lindström (Eds.) first page. Any other reproduction or transmission requires prior written permission 2015 © NATO CCD COE Publications, Tallinn by NATO CCD COE. Technological Sovereignty: Missing the Point? Tim Maurer Isabel Skierka Open Technology Institute Global Public Policy Institute New America Berlin, Germany Washington, DC, USA [email protected] [email protected] Mirko Hohmann Robert Morgus Global Public Policy Institute Open Technology Institute Berlin, Germany New America [email protected] Washington, DC, USA [email protected] Abstract: Following reports of foreign government surveillance starting in June 2013, senior officials and public figures in Europe have promoted proposals to achieve “technological sovereignty”. This paper provides a comprehensive mapping and impact assessment of these proposals, ranging from technical ones, such as new undersea cables, encryption, and localized data storage, to non-technical ones, such as domestic industry support, international codes of conduct, and data protection laws. The analysis focused on the technical proposals reveals that most will not effectively protect against foreign surveillance. Ultimately, the security of data depends primarily not on where it is stored and sent but how it is stored and transmitted. In addition, some proposals could negatively affect the open and free Internet or lead to inefficient allocation of resources.
    [Show full text]
  • Parldigi 2014-11-24 Pretty Easy Privacy
    Parldigi 2014-11-24 pretty Easy privacy The World is threatened… …our privacy and security is gone! Google, Facebook, WhatsApp,… are all reading, selling and using our data for their benefit. Snowden has proven that governments record all internet traffic, have built back-doors and access into software, hardware and cloud solutions. Citizens lost their privacy. Democracy is undermined. SMBs and Enterprises face Industrial Espionage. p≡p – pretty Easy privacy Protection is compromised The common protection technology TLS (based on X.509) is compromised if: • one single Certification Authority (CA) is taken (hacked, undermined, infiltrated) … • … like the NSA in the most probable case… • … then all communication – using software which is trusting this CA – is compromised. p≡p – pretty Easy privacy Metadata alone reveals a lot E-mail, even encrypted, leaves header metadata (to: - from: position and subject:) in clear text available for spooks to see. Metadata alone allows to draw interesting conclusions, like Leon’s relationships illustrated by 12 months of metadata. Organisations like the NSA can do a lot more with our metadata. p≡p – pretty Easy privacy Metadata alone reveals a lot p≡p – pretty Easy privacy p≡p is contributing to change. The Network is 0wned by the Five Eyes already. Probably it’s a lost case for now. We urgently need Free Hardware to trust in! Open Source Hardware projects are working on it. We need secure Free Software. Support Free Software now! And we need peer-to-peer communication in between: p≡p. Landscape of Messaging Solutions Voltage Datamotion Echoworx Symantec Peanut Totemo TrendMicro Zixcorp SMS LuxSci Privato Enigmail Email Agari Mailpile Textsecure Virtru Darkmail Neocertified p≡p Edgeware Cryptzone Encryptomatic BBM Mysecureemail Walnut Heml.is Threema myEnigma Kaitenmail iPGmail K9mail Messaging Sophos IronPort Barracuda Proofpoint Wickr Telegram Seecrypt Surespot Silentcircle Tigertext Chatsecure HoccerXO Kontalk iMessage p≡p.
    [Show full text]
  • Ich Möchte Nicht in Einer Welt Leben, in Der Alles, Was
    „Ich möchte nicht in einer Welt leben, in der alles, was ich sage, alles, was ich tue, jedes Gespräch, jeder Ausdruck von Kreativität, Liebe oder Freundschaft aufgezeichnet wird. Das ist nichts, was ich bereit bin zu unterstützen. Das ist nichts, das ich bereit bin mit aufzubauen. Das ist nichts, unter dem ich zu leben bereit bin. Ich denke, jeder, der eine solche Welt ablehnt, hat die Verpflichtung, im Rahmen seiner Möglichkeiten zu handeln.“ - Edward Snowden Was ist eine CryptoParty? ● Workshop zur digitalen Selbstverteidigung • "Tupperware-Party zum Lernen von Kryptographie" (Cory Doctorow) ● Einsteigerfreundlich ● Öffentlich & unkommerziell ● Fokus auf Freier Software ● Von Anwendern für Anwender -> Gelerntes weitertragen 3 / 39 Agenda ● Inputvortrag zu: • Sichere Passwörter • Verschlüsselung von E-Mails (PGP) • Tracking beim Browsen vermeiden • Dateiverschlüsselung (VeraCrypt) • Verschlüsselung von Chats (Pidgin-OTR) ● Praxis 4 / 39 Sichere Passwörter Wie werden Passwörter geknackt? ● Brute Force • Alle möglichen Kombinationen ausprobieren ● Listen / Wörterbuch-Angriffe • Alle Wörter einer Liste ausprobieren ● Social Engineering • Phishing, Person austricksen um PW zu erfahren 5 / 39 Wie erschwert man das Knacken des Passworts? ● Brute Force => Länge (10+ Zeichen) => Verschiedene Zeichentypen (Groß- und Kleinbuchstaben, Zahlen, Sonderzeichen) 6 / 39 Wie erschwert man das Knacken des Passworts? ● Brute Force => Länge (10+ Zeichen) => Verschiedene Zeichentypen (Groß- und Kleinbuchstaben, Zahlen, Sonderzeichen) ● Listen / Wörterbuch-Angriffe
    [Show full text]
  • Evaluating Ambiguity of Privacy Indicators in a Secure Email App
    Evaluating ambiguity of privacy indicators in a secure email app Borce Stojkovski and Gabriele Lenzini1 Interdisciplinary Centre for Security, Reliability and Trust (SnT) University of Luxembourg [email protected] Abstract Informing laymen of security situations is a notoriously hard problem. Users are usually not cognoscenti of all the various secure and insecure situations that may arise, and this can be further worsened by certain visual indicators that instead of helping users, fail to convey clear and unambiguous messages. Even in well established and studied applications, like email clients providing end-to-end encryption, the problem seems far from being solved. Motivated to verify this claim, we studied the communication qualities of four privacy icons (in the form of coloured shapes) in conveying specific security messages, relevant for a particular secure emailing system called p≡p. We questioned 42 users in three different sessions, where we showed them 10 privacy ratings, along with their explanations, and asked them to match the rating and explanation with the four privacy icons. We compared the participants' associations to those made by the p≡p developers. The results, still preliminary, are not encouraging. Except for the two most extreme cases, Secure and trusted and Under attack, users almost entirely missed to get the in- dicators' intended messages. In particular, they did not grasp certain concepts such as Unsecure email and Secure email, which in turn were fundamental for the engineers. Our work has certain limitations and further investigation is required, but already at this stage our research calls for a closer collaboration between app engineers and icon designers.
    [Show full text]
  • Technological Sovereignty: Missing the Point?
    Technological Sovereignty: Missing the Point? An Analysis of European Proposals after June 5, 2013 by TIM MAURER, ROBERT MORGUS, ISABEL SKIERKA, MIRKO HOHMANN Following reports of foreign government surveillance starting in June 2013, senior officials and public figures in Europe have promoted proposals to achieve “technological sovereignty”. This paper provides a comprehensive mapping and impact assessment of these proposals, ranging from technical ones, such as new undersea cables, encryption, and localized data storage, to non-technical ones, such as domestic industry support, international codes of conduct, and data protection laws. This analysis shows that most technical proposals will not effectively protect against foreign surveillance. In addition, some proposals could negatively affect the open and free Internet or lead to inefficient allocation of resources. Finally, proposals tend to focus on the transatlantic dimension, neglecting the broader challenge of foreign surveillance and promising ideas like the expansion of encryption tools. Ultimately, the security of data depends primarily not on where it is stored and sent but how it is stored and transmitted. This paper is part of a joint project by New America's Open Technology Institute and the Global Public Policy Institute (GPPi) called "Transatlantic Dialogues on Security and Freedom in the Digital Age". For more: www.digitaldebates.org November 2014 Acknowledgements OPEN NEW TECHNOLOGY AMERICA INSTITUTE The authors would like to thank the members of the Steering Committee for the project Transatlantic Dialogues on Security and Freedom in the Digital Age (go to www.digitaldebates.org for more) as well as the participants of our workshop hosted in Washington, DC, on September 18, 2014, for their valuable input and feedback (see Annex 4).
    [Show full text]
  • Network Working Group V. Birk Internet-Draft H
    Network Working Group V. Birk Internet-Draft H. Marques Intended status: Standards Track Shelburn Expires: July 13, 2018 pEp Foundation S. Koechli pEp Security January 09, 2018 pretty Easy privacy (pEp): Privacy by Default draft-birk-pep-01 Abstract Building on already available security formats and message transports (like PGP/MIME for email), and with the intention to stay interoperable to systems widespreadly deployed, pretty Easy privacy (pEp) describes protocols to automatize operations (key management, key discovery, private key handling including peer-to-peer synchronization of private keys and other user data across devices) that have been seen to be barriers to deployment of end-to-end secure interpersonal messaging. pEp also introduces "Trustwords" (instead of fingerprints) to verify communication peers and proposes a trust rating system to denote secure types of communications and signal the privacy level available on a per-user and per-message level. In this document, the general design choices and principles of pEp are outlined. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on July 13, 2018.
    [Show full text]
  • A Worldwide Survey of Encryption Products
    A Worldwide Survey of Encryption Products February 11, 2016 Version 1.0 Bruce Schneier Berkman Center for Internet & Society Harvard University [email protected] Kathleen Seidel Independent Researcher [email protected] Saranya Vijayakumar Harvard College [email protected] Introduction Data security is a worldwide problem, and there is a wide world of encryption solutions available to help solve this problem. Most of these products are developed and sold by for-profit entities, although some are created as free open-source projects. They are available, either for sale or free download, all over the world. In 1999, a group of researchers from George Washington University attempted to survey the worldwide market for encryption products [HB+99]. The impetus for their survey was the ongoing debate about US encryption export controls. By collecting information about 805 hardware and software encryption products from 35 countries outside the US, the researchers showed that restricting the export of encryption products did nothing to reduce their availability around the world, while at the same time putting US companies at a competitive disadvantage in the information security market. Seventeen years later, we have tried to replicate this survey. • • • • • • • • • A Worldwide Survey of Encryption Products • Feb 2016, v 1.0 1 Findings We collected information on as many encryption products as we could find anywhere in the world. This is a summary of our findings: • We have identified865 hardware or software products incorporating encryption from 55 different coun- tries. This includes 546 encryption products from outside the US, representing two-thirds of the total. Table 1 summarizes the number of products from each country.
    [Show full text]