Here's how to best secure your data now that the NSA can crack almost any encryption

The latest Snowden-supplied bombshell shook the technology world to its core on Thursday: The NSA can crack many of the encryption technologies in place today, using a mixture of backdoors baked into software at the government’s behest, a $250 million per year budget to encourage commercial software vendors to make its security “exploitable,” and sheer computer-cracking technological prowess.

To some extent, it’s not surprising to hear that the U.S. spy agency is doing spy agency stuff but, given the recent surveillance revelations and the fact that other countries likely have similar capabilities, the news is certainly worrying. To make matters worse, it came just a day after Pew reported that 90 percent of Internet users have taken steps to avoid surveillance in some way.

All is not lost, however. While the stunning reports failed to name exactly which companies and encryption technologies have been compromised by the NSA, you can minimize the chances that your encrypted communications will be cracked by the government—or anyone else. Read on.

Now that we know that corporations—or at least individuals in corporations—have worked with the NSA to build backdoors into encryption technology, privacy buffs should give commercial encryption technology (such as Microsoft’s BitLocker) the hairy eye.

NSA headquarters.

You’re better off using tools that employ open-source or public-domain encryption methods, as they need to work with every vendor’s software and, in the case of open-source encryption, can be scrutinized for potential security flaws.

With that in mind, here are some tools worth checking out:

Truecrypt for encrypting sensitive files, folders, and entire drives on your PC.GPG, an open-source implementation of the OpenPGP protocol used to encrypt email communications. Be sure to read up on why standard-compliant email messages can never truly be secure, though.TAILS, a.k.a. The (Amnesic) Incognito Live System, a Linux distribution built with security and anonymity in mind. TAILS comes packed with numerous privacy and encryption tools baked in, including Tor, which allows you to browse the web (mostly) anonymously and access a Darknet of so-called “Hidden Services” that grant anonymity to both web servers and web browsers. Bruce Schneier—a longtime security guru who has actually read the documents detailing the NSA’s encryption-busting methods—recommends using Tor and Hidden Services to thwart NSA surveillance. TAILS is meant to be used as a live CD, which means you can boot it from a disc or USB drive, and your data is wiped when you power off your system.Off-the-record messaging, or OTR, a cryptographic protocol for encrypting and authenticating instant-messaging communications. The protocol uses AES and SHA-1 standards and comes baked into TAILS and is recommended by Schneier even in the wake of the NSA revelations. Here’s a list of IM software that supports OTR.

Proprietary encryption tools created overseas may—may—also be less likely to have installed NSA-friendly backdoors into their software. This morning, I received an email from Boxcryptor, the superb (and Germany-based) cloud-storage encryption tool, reassuring me that there is no way for the company to snoop on its customers, as it encrypts files using private RSA security keys stored only on users’ private PCs, then transmits the already-encrypted files using HTTPs.

Beyond encryption, most of the advice in PCWorld’s How to protect your PC from Prism surveillance still applies. Note, however, that the New York Times report on the NSA’s crypto-cracking abilities suggest that VPN technology and the ever-popular SSL web protocol have been two encryption methods particularly targeted by the government. (Schneier suggests using TLS and IPsec whenever possible on the web-communication front.)

Even so, using the tips in that article will make your browsing much more secure in general, not just the NSA or foreign governments.

Also check out PCWorld’s guide to encrypting (almost) everything, which is chock full of handy-dandy encryption tips, though many rely on proprietary—not open-source—technology. While closed-source solutions may not protect against The Man and his super-encryption-cracking eyes, they’ll help keep everyone else out of your business.

Brad Chacos spends the days jamming to Spotify, digging through desktop PCs and covering everything from BYOD tablets to DIY tesla coils.
More by Brad Chacos

View the original article here

Survey: Almost 90 percent of Internet users have taken steps to avoid surveillance

A majority of U.S. Internet users polled in a recent survey report taking steps to remove or mask their digital footprints online, according to a report from the Pew Research Center’s Internet Project and Carnegie Mellon University.

While 86 percent of the Internet users polled said they made some attempt hide what they do online, more than half of the Web users also said they have taken steps to avoid observation by organizations, specific people or the government, according to the survey.

The survey’s findings are based on telephone interviews among a sample of 1002 adults, age 18 or older in July, with 792 Internet users among the respondents.

People use a variety of measures to decrease their online visibility, the study showed. The most popular one is clearing cookie and browser history, which 64 percent of Internet users polled said they did. Forty-one percent said they deleted or edited something they had posted in the past and 41 percent said they disabled or turned off their browsers’ use of cookies, Pew said.

Other measures taken to cloak online activity were not using websites that asked to disclose a user’s real name (36 percent of users polled), using a temporary user name or email address (26 percent), posting comments without revealing who you are (25 percent). Twenty-one percent of the Internet users polled said they had asked others to remove something that was posted about them.

Some Internet users also use public computers to browse and give inaccurate information about themselves, while 14 percent said they at times encrypt email and 14 percent said they use services like virtual networks or proxy servers such as Tor anonymity software, which allow them to browse without being tied to a specific IP address, the survey found.

Beyond general measures taken to go online more or less anonymously, the majority of Internet users polled (55 percent) have tried to avoid observation by specific people or groups. “Hackers, criminals and advertisers are at the top of the list of groups people wish to avoid,” Pew said.

But a minority of Web users said they tried to hide their online activities from certain friends, people form their past, family members or partners as well as their employers, coworkers, supervisors, companies, people that might want payment for downloaded files and to a lesser extent the government (5 percent) and law enforcement (4 percent).

However, despite these precautions 21 percent of the online adults polled said they have had an email or social media account hijacked and 11 percent said they have had vital information like Social Security numbers, bank account data, or credit cards stolen.

Discovering that many Internet users have tried to conceal their identity or their communications from others was the biggest surprise to the research team, they said in a news release. Not only hackers, but almost everyone has taken some action to avoid surveillance and despite their knowing that anonymity is virtually impossible, most Internet users think they should be able to avoid surveillance online, they said.

Most U.S. citizens would like to be anonymous and untracked online, at least every once in a while, but many think it is not possible to be completely anonymous online, Pew said. “This reinforces the notion that privacy is not an all-or-nothing proposition for internet users. People choose different strategies for different activities, for different content, to mask themselves from different people, at different times in their lives,” the researchers wrote.

One of the most revealing contradictions in the results of the survey is that those who have taken steps to try to avoid observation by others and those who have taken more general steps to be anonymous are more likely than others to have personal information posted online, the researchers said.

Internet users surveyed said they have a photo of themselves online (66 percent), while about half of those polled said their birth date was available online. A minority said that their email address, home address, mobile number or political affiliation was available.

A majority of Web users polled, 66 percent, said they think current privacy laws are not good enough to provide reasonable protections for people’s privacy on their online activities.

“Interestingly, there are not noteworthy differences in answers to this question associated with political or partisan points of view. Tea Party supporters, conservative Republicans, self-described moderates, and liberal Democrats are not statistically significantly different in their answers,” the researchers wrote.

Loek Essers focuses on online privacy, intellectual property, open-source and online payment issues.
More by Loek Essers, IDG News Service

View the original article here