Tag Archives: encryption

Posted on
by

Using the Paris attacks as an excuse, governments around the world are clamping down on free speech, and the tools that make that speech possible in the digital age.

Cameron, who clearly read somewhere that it doesn’t matter what you say, so long as you sound decisive, has declared war on cryptography.

I talk a bit about this in a rant I recorded earlier:

A secure internet secures us all, and despite having never so much as got a parking ticket, I feel deeply uncomfortable in the UK – which is officially the most spied on country in the “free” world. Where every car journey is tracked, where people are recorded (both audio and video) in virtually every public space, where every text message, email, phone conversation and website is recorded and analysed.

Where, if Cameron has his way, it will soon be a crime to use tools to resist this ever watchful eye.

Not knowing if you’re being watched, and not knowing what conclusion some faceless spook or bureaucrat will make from the activity of your day to day life is stressful and socially damaging. People will always say “if you’ve nothing to hide, you’ve nothing to fear”, but really it’s all about context.

Granted, there are crazies out there, but the gunmen in the Paris attack were known, and they communicated openly with each other. Why weren’t they picked up? Well, the French already stated, that it is simple not possible to investigate every possible lead – so throwing the net wider and making the haystack bigger, while sounding good in an election campaign, can only make it less likely that you’ll spot the next attack.

Destroying freedom in order to protect it is not winning, Mr Cameron. We lived for decades under the threat of Christian terrorists, and the threat of US/USSR nuclear annihilation, without shredding the constitution.

Putting the whole country under surveillance in a modern reboot of East Germany is not going to protect us. Destroying the UK’s IT sector is not going protect us either.

Christian Payne and Cory Doctorow say this much much better that I did.

Perhaps trying to get to the reasons why so many poor people are angry and turning to religious fanaticism and violence might be a better idea?

But of course you won’t. You need to appear Tough. You need to Lead. To support your backers.

The Cheltenham eye of Sauron is being turned inwards, not to protect UK citizens from terrorists, but to protect the interests of your super rich friends from the dispossessed and increasingly angry poor, as you strip away their freedoms, education, healthcare, houses and livelihoods.

My blood is boiling again, so I think it’s time to sign off and go drink some herbal tea.

I’ll leave you with a video by Russell Brand. No matter what your personal views are on this guy, his video on the Charlie Hebdo massacre hits the nail absolutely on the head.

Peace.

Posted on
by

Ok, so here’s an experimental, proof of concept plugin for Idno that provides OpenPGP encryption for form posts between web clients and the server (just in time for Reset the net 😉 ).

It makes use of OpenPGP.js, a pure javascript implementation of the OpenPGP spec. On form submission, the plugin will encrypt all form variables, client side in the browser, before transmitting them to the server.

What this for

Primarily, this is aimed at (partially) addressing a situation where you have an Idno site sitting behind a load balancer/reverse proxy like Squid, Nginx or Pound.

In this configuration it is common for the connection to be HTTPS only between the client and the load balancer node, at which point HTTPS is stripped and the connection to the back-end web server is conducted over HTTP. As we know from the NSA smiley, attacking this point where HTTPS is stripped at the load balancer was one of the ways the NSA and GCHQ was able to burgle customer data from Google’s cloud.

Using this plugin, the contents of the form will be encrypted with the back end server’s public key, meaning that the payload will remain encrypted as it transits through your data centre until it’s final destination, where, if you redesign your system as such, it could be stored in encrypted form and decoded only when necessary.

What this is NOT for

This is not intended to be a replacement for HTTPS.

Encrypting the form on the client does raise the bar slightly, making it much harder for a passive attacker to simply read your username and password as it travels over the wire. However, it does not protect against a more sophisticated attacker capable of launching a “Man in the middle“, or “Man on the side attack“.

Using HTTPS is important, because without it an attacker could insert their own public key into the mix, or modify the javascript sent.

Usage and limitations

The plugin currently piggybacks off of gnuPG to do the decryption on the server end, and so this requires you to perform a couple of configuration steps.

  • Make sure you’ve got gnuPG installed. If the binary isn’t at at /usr/bin/gpg, you can set opengpg_gnupg in your config.ini
  • Generate a keypair for your web server user
su www-data
gpg --gen-key
  • Make sure that the .gnupg directory is not accessible publicly, using a .htaccess or similar, since it’ll contain a secret key!
  • Get a copy of the public key gpg --export -a "User Name", and save it as openpgpPublicKey in your config.ini

Once you’ve done this, activate your plugin in your Idno settings, and you should be ready to rock and roll!

It was enjoyable playing with OpenPGP.js, and I can already think of some other cool uses for it (most obvious might be to enhance my OpenPGP elgg plugin).

Have fun!

» Visit the project on Github...

Posted on
by

GCHQoogle: so much for "Don't be evil" So, unless you’ve been living under a rock for the past few months, you will be aware of the disclosure, by one Edward Snowden, of a massive multinational criminal conspiracy to subvert the security of internet communications and place us all under surveillance.

Even if you believe the security services won’t misuse this, what GCHQ can figure out, other criminal organisations can as well, so like many others, I’ve decided this’d be a good time to tighten the security of some of the sites I am responsible for.

Enabling HTTP Strict Transport Security

So, lets start off by making sure that once you end up on the secure version of a site, you always get sent there. For most sites I had already had a redirect in place, but this wouldn’t help with a number of threats. Thankfully, modern browsers support a header, that when received, will cause the browser to rewrite all connections to that site to the secure endpoint before they are sent.

A quick and easy win, so in my apache conf I placed:

Header add Strict-Transport-Security "max-age=15768000; includeSubDomains"

Auditing my SSL configuration, enabling forward secrecy

The next step was to examine the actual SSL/TLS configuration used by the various servers.

During the initialisation of a secure connection, there is handshake that takes place which establishes the protocol used (SSL / TLS), the version, and what algorithms are available to be used. The choices presented have an effect on exactly how secure the connection will be, and obviously, older and insecure protocols and weaker algorithms present security risks.

I have been, I admit, somewhat remiss in the past, and have largely used Apache’s defaults, which was ok for the most part, but as SSL Lab’s handy audit tool revealed left a number of weak algorithms available as well as not taking advantage of some newer security techniques.

I quickly disabled the weaker algorithms and SSL protocols, and also took the opportunity to specify that the server prefers algorithms which support Forward Secrecy.

Forward secrecy is a property of newer algorithms (supported, sadly, only by newer browsers), that means that even if the key for a given session has been compromised, that key could not be used to decrypt any future sessions. This means that even if the attacker compromised one connection, they would not be able to compromise any past or future connections.

Here is a handy guide for implementing this on your own server.

The downside of these changes of course is that older browsers (IE6, I’m looking at you) are left out in the cold, but these browsers (IE6, I’m still looking at you) are using such old implementations with weak algorithms, they would likely be in trouble anyway.

Security is a moving target, so it’s important to keep up to date!

Update: If you’re running Debian (as I am), you will have some issues with ECDHE suites until stable updates to Apache 2.4. Until then I’ve tacked on AES support at the end, to support IE with something reasonable, but giving forward secrecy to more modern browsers.

Update 27/6/14: Debian recently backported a few 2.4 cipher suites into the 2.2 branch in debian stable. This means that Perfect Forward Secrecy is now supported for Internet Explorer!