Please try the URL privacy information feature enabled by clicking the flashlight icon above. This will reveal two icons after each link the body of the digest. The shield takes you to a breakdown of Terms of Service for the site - however only a small number of sites are covered at the moment. The flashlight take you to an analysis of the various trackers etc. that the linked site delivers. Please let the website maintainer know if you find this useful or not. As a RISKS reader, you will probably not be surprised by what is revealed…
Eli Dourado, *The New York Times*, 8 Oct 2013
Can we ever trust the Internet again?
http://www.nytimes.com/2013/10/09/opinion/lets-build-a-more-secure-internet.html
In the wake of the disclosures about the National Security Agency's
surveillance programs, considerable attention has been focused on the
agency's collaboration with companies like Microsoft, Apple and Google,
which according to leaked documents appear to have programmed "back door"
encryption weaknesses into popular consumer products and services like
Hotmail, iPhones and Android phones.
But while such vulnerabilities are worrisome, equally important - and
because of their technical nature, far less widely understood - are the
weaknesses that the N.S.A. seems to have built into the very infrastructure
of the Internet. The agency's "upstream collection" capabilities, programs
with names like Fairview and Blarney, monitor Internet traffic as it passes
through the guts of the system: the cables and routers and switches.
The concern is that even if consumer software companies like Microsoft and
telecommunications companies like AT&T and Verizon stop cooperating with the
N.S.A., your online security will remain compromised as long as the agency
can still take advantage of weaknesses in the Internet itself.
Fortunately, there is something we can do: encourage the development of an
"open hardware" movement - an extension of the open-source movement that has
led to software products like the Mozilla browser and the Linux operating
system.
The open-source movement champions an approach to product development in
which there is universal access to a blueprint, as well as universal ability
to modify and redistribute the blueprint. Wikipedia is perhaps the
best-known example of a product inspired by the movement. Open-source
advocates typically emphasize two kinds of freedom that their products
afford: they are available free of charge, and they can be used and
manipulated free of restrictions.
But there is a third kind of freedom inherent in open-source systems: the
freedom to audit. With open-source software, independent security experts
can scrutinize the code for vulnerabilities - whether accidentally or
intentionally introduced. The more auditing by the programming masses, the
better the security. As the open-source software advocate Eric S. Raymond
has put it, "given enough eyeballs, all bugs are shallow."
Perhaps the greatest open-source success story is the Internet itself - at
least its "soft" parts. The Internet's communications protocols and the
software that implements them are collaboratively engineered by loose
networks of programmers working outside the control of any single person,
company or government. The Internet Engineering Task Force, which develops
core Internet protocols, does not even have formal membership and seeks
contributions from developers all over the world.
But the problem is that the physical layer of the Internet's infrastructure
- the hardware that transmits, directs and relays traffic online, as well as
its closely knit software (or "firmware") - is not open-source. It is made
by commercial computing companies like Cisco, Hewlett-Packard and Juniper
Networks according to proprietary designs, and then sold to governments,
universities, private companies and anyone else who wants to set up a
network.
There is reason to be skeptical about the security of these networking
products. The hardware firms that make them often compete for contracts
with the United States military and presumably face considerable pressure to
maintain good relations with the government. It stands to reason that such
pressure might lead companies to collaborate with the government on
surveillance-related requests.
Because these hardware designs are closed to public scrutiny, it is
relatively easy for surveillance at the Internet's infrastructural level to
go undetected. To make the Internet less susceptible to mass surveillance,
we need to recreate the physical layer of its infrastructure on the basis of
open-source principles.
At the moment, the open hardware movement is limited mostly to hobbyists -
engineers who use the Internet to collaboratively build "open" devices like
the RepRap 3D printer. But the Internet community, through a concerted
effort like the one that currently sustains the Internet's software
architecture, could also develop open-source, Internet-grade
hardware. Governments like Brazil's that have forsworn further involvement
with American Internet companies could adopt such nonproprietary equipment
designs and have them manufactured locally, free from any
N.S.A. interference.
The result would be Internet infrastructure, both hardware and software,
that was 100 percent open and auditable.
But never, of course, 100 percent secure. The N.S.A. could still try to
exploit the Internet's open hardware. And of course, open hardware would do
little to prevent the government from reading e-mail if it still had the
cooperation of companies like Microsoft or Google. Open hardware is not a
panacea.
Still, open hardware would at a minimum make the N.S.A.'s Internet
surveillance efforts more difficult and less effective. And it would
increase the difficulty of surveillance not just for the N.S.A. but also for
foreign governments that might otherwise piggyback on N.S.A.-introduced
security vulnerabilities.
A 100 percent open-infrastructure Internet - a trustworthy Internet - would
be an important step in the empowerment of individuals against their
governments the world over.
Eli Dourado is a research fellow with the technology policy program at the
Mercatus Center at George Mason University.
[It is delightful that the author's name conjures up the image of El
Dorado (by slightly disemvowling it), with visions of a golden view of the
Internet of the future:
El Dorado in Webster's: Spanish, literally, the gilded one
1 : a city or country of fabulous riches held by 16th century
explorers to exist in So. America
2 : a place of fabulous wealth or opportunity
The open-source aspect of Eli's article is very refreshing. However, in
light of the reality that today there is no adequate security in the
servers, switches, and even local hosts attached to the Intenet, and that
NSA could have had secret backdoors implanted in everything, we have a
very long way to go before the Internet and all of its attached systems
might be considered adequately trustworthy. PGN]
Carnegie Mellon University researchers claim they have created a smartphone messaging app with security that not even the National Security Agency can break. The app is called SafeSlinger, and is free on the iTunes store, and Google play store for Android phones. Researchers say the app uses a passphrase that only the user, and the other party can know. They claim messages cannot be read by a cellular carrier, Internet-provider, employer, or anyone else. The setup takes a few minutes, with the user answering security questions generated by the app that help it generate encryption and authorization credentials. The app then works just like a regular messaging app. In a press release from CMU's CyLab, programmer Michael W. Farb said, “the most important feature is that SafeSlinger provides secure messaging and file transfer without trusting the phone company or any device other than my own smartphone.'' http://pittsburgh.cbslocal.com/2013/10/08/cmu-researchers-claim-to-have-created-messaging-app-even-nsa-cant-crack/ [Of course, it is not just that the app might be nonbreakable. Note carefully that the last sentence above implies that you have to trust your own smartphone—even if it is fundamentally untrustworthy. In addition, don't forget that the underlying smartphone hardware and software may not be impervious to insider misuse, outsider attacks, and so on, irrespective of what the app does. Also, `unbreakable' might ignore denial-of-service attacks, electromagnetic interference and emanations, and much more. However, the old adage that NOTHING is unbreakable (unless it is actually NOTHING!) makes this sound suspiciously like hype, especially when claimed with respect to defending against the aggregated abilities of the NSA and all sorts of other people with significant experience in breaking supposedly secure systems. Just a thought from the RISKS perspective. PGN]
James Niccolai, *ComputerWorld*, 8 Oct 2013 Giant new Utah facility has been dogged by electrical problems, a report says IDG News Service - A massive data center being built by the National Security Agency in Utah has been plagued by "chronic electrical surges" that have destroyed equipment and delayed its opening for a year, according to a report Monday. The facility has suffered 10 "meltdowns" in the past 13 months that destroyed hundreds of thousands of dollars' worth of machinery, The Wall Street Journal reported Monday, citing project documents and unnamed officials. The data center is expected to be the NSA's main facility for storing, decrypting and analyzing the vast amounts of data it collects through its surveillance programs. Those programs have been under scrutiny since the disclosures about Prism and other data collection efforts earlier this year. The data center has cost a reported $1.4 billion excluding the computing equipment inside, and covers more than a million square feet. Data centers can consume huge amounts of power, partly for the compute gear but also for cooling equipment that keeps the computers from overheating. The NSA facility, located 30 miles south of Salt Lake City in a town called Bluffdale, continuously uses 65 megawatts of electricity—enough to power a small city—at a cost of more than $1 million a month, the Journal reported. The electrical problems, known as arc fault failures, create "fiery explosions, melt metal and cause circuits to fail," one official told the newspaper. "Documents and interviews paint a picture of a project that cut corners to speed building," the Journal said. Backup generators have failed several times and the cooling system has yet to be tested, according to the newspaper. An NSA spokeswoman told the Journal that "the failures that occurred during testing have been mitigated." But the Journal said there is disagreement about the cause of the problems and whether proposed fixes will work. The NSA planned to turn on some of the computers at the facility this week, the Journal reported. James Niccolai covers data centers and general technology news for IDG News Service. Follow James on Twitter at @jniccolai. James's e-mail address is james_niccolai@idg.com http://www.computerworld.com/s/article/9243045/NSA_data_center_meltdowns_force_year_long_delay?source=CTWNLE_nlt_serversdata_2013-10-09
Nikolaj Nielsen, EU Observer http://euobserver.com/justice/121695?goback=%2Egde_2083215_member_5793386738592272384#%21 "STRASBOURG - Hundreds of US-based companies handling EU citizens' data have lied about belonging to a data protection arrangement known as the Safe Harbour Framework. Christopher Connolly, a director at Galexia, an Australian-based consulting company on Internet law and privacy, told the European Parliament's civil liberties committee on Monday (7 October) that “many claims of Safe Harbour membership are false.'' Well, duh. Colour me surprised, knowing that Safe Harbo(u)r certification relies on .. (wait for it) .. SELF assessment. No conflict of interest there, clearly...
> the W3C's pragmatists say, no worse than the current environment where > Silverlight and Flash serve the purpose of preventing unauthorized > behavior. Despite being a Linux & Unix advocate, I run Windows 7 on my netbook mostly because it's a standard platform upon which way too many desired, required or useful programs exist. Despite that, I can't count the number of times Flash or Silverlight have crashed. "preventing unauthorized behavior" seems to mean preventing running reliably. As an engineer and programmer, I'm ashamed that we're relying on such an unreliable infrastructure for the future of all communications, commerce and education. Here's a simple way to kill the addition: add a mandatory performance, stability & reliability clause, as tested on a reasonable platform of existing systems (so it's not used as an excuse for planned obsolescence of hardware and/or software). That also gives me insight as to why M$ was advocating using Windows 8 embedded on everything. It's not just for total vertical marketing (M$ products from the server to the middleware to the mobile device) but for Silverlight to display "protected content" and further lock users into the proprietary service provider. Since I'm not a M$ zombie, I didn't catch that nuance during the presentation. But then again, M$ events aren't for anyone with a clue about competing products or technologies.
Please report problems with the web pages to the maintainer