Yahoo Rolls Out End-To-End Encryption For Email

from the good-move! dept

Back in 2012 (pre-Snowden!), we wrote about why Google should encrypt everyone's emails using end-to-end encryption (inspired by a post by Julian Sanchez saying the same thing). Since then, securing private communications has become increasingly important. That's why we were happy to see Google announce that it was, in fact, working on a project to enable end-to-end encryption on Gmail, though it was still in the early stages. In December of last year, Google moved that project to Github, showing that it was advancing nicely. As we noted at the time, one interesting sidenote on this was that Yahoo's Chief Security Officer, Alex Stamos, was contributing to the project as well.

Thus it's not surprising, but still great to see, that Stamos has now announced the availability of an end-to-end encryption extension for Yahoo Mail (also posted to Yahoo's Github repository). It appears to function similarly to existing third-party extensions (like Mailvelope), but it's still good to see the big webmail providers like Yahoo and Google taking this issue more seriously. It's still not ready for prime time, and it's unlikely that either provider is going to make this a default option any time soon, but offering more, better (and more user friendly) options to give everyone at least the option of doing end-to-end encryption is a very good sign.

It also raises a separate issue that I think is important: many have argued that companies like Yahoo and especially Google would never actually push for end-to-end encryption of emails, because it takes away the ability of those companies to do contextual advertising within those emails. But that's an exceptionally short-sighted view. If Google, Yahoo and others don't do enough to protect their users' privacy, those users will go elsewhere, and then it won't matter whether or not the emails are encrypted, because they won't see them anyway. Focusing on the user first is always going to be the right solution, and that includes encrypting emails, even if it means slightly less ad revenue in the short term. Hopefully, Google, Yahoo and others remember this simple fact.

Filed Under: email, encryption, end to end, end to end encryption
Companies: yahoo

End-To-End Encryption Isn't Just About Privacy, But Security

from the legacy-of-ed-snowden? dept

Nicholas Weaver has a fantastic article over at Wired detailing how GCHQ and NSA's "quantum injection" effort works to install malware on the computers of targets via packet injection. As he notes, this effort "turned the internet backbone into a weapon." That's dangerous on multiple levels. He explains that, while experts have been suggesting this for years, cleartext traffic isn't just a privacy issue, it's now a security issue:

If the NSA can hack Petrobras, the Russians can justify attacking Exxon/Mobil. If GCHQ can hack Belgicom to enable covert wiretaps, France can do the same to AT&T. If the Canadians target the Brazilian Ministry of Mines and Energy, the Chinese can target the U.S. Department of the Interior. We now live in a world where, if we are lucky, our attackers may be every country our traffic passes through except our own.

Which means the rest of us — and especially any company or individual whose operations are economically or politically significant — are now targets. All cleartext traffic is not just information being sent from sender to receiver, but is a possible attack vector.

The only way to protect against this is to encrypt everything:

The only self defense from all of the above is universal encryption. Universal encryption is difficult and expensive, but unfortunately necessary.

Encryption doesn’t just keep our traffic safe from eavesdroppers, it protects us from attack. DNSSEC validation protects DNS from tampering, while SSL armors both email and web traffic.

Thankfully, he's not the only one thinking about this. As we pointed out a few weeks ago, IETF is moving forward, full-steam ahead, on looking at ways to make the internet secure by default.

That seems like a very useful consequence of all of this. While we've mostly been focused on what's happening at the political and policy levels around here, the technology can make a lot of that meaningless. The simple fact is that an awful lot of security online has involved kludges pasted on later, after problems or concerns appeared. Rethinking and rebuilding a more secure (it'll never be perfectly secure but it can be a lot more secure) internet from the ground up isn't just good for protecting privacy and keeping away from snooping spies, but it's just a good plan, in general, for security.

Filed Under: cybersecurity, encryption, end to end, nsa, online attacks, online security, packet injection, security, surveillance

Akamai Does Not Violate Network Neutrality

from the end-to-end-vs-end-to-middle dept

Many supporters of AT&T's plans to double dip in internet charges by ending neutrality claim that the internet has never been neutral, and point to systems like Akamai as an example of this. However, as we've explained in the past, this is simply untrue. It's purposely stretching the definition of network neutrality to make a point that isn't supported by the facts. Services like Akamai help make the internet faster for everyone. It doesn't discriminate. It holds to the "end-to-end" principle that a connection you buy to the internet entitles you to reach any content across that entire network. That's not what AT&T is looking to do. It's claiming that you really only have access to the cloud in the middle, and someone needs to pay for the second half of that connection from the middle out to the server you're accessing.

Tim Lee (who, like me, does not support net neutrality legislation) has ripped apart a paper that claims that Akamai is an example of why the internet is not neutral. Lee notes that the author of the paper doesn't even seem to understand how Akamai works, and provides a nice (more technology focused) explanation for why content caching systems have little to do with the network neutrality discussion: "A network is neutral if it faithfully transmits information from one end of the network to the other and doesn't discriminate among packets based on their contents. Neutrality is, in other words, about the behavior of the routers that move packets around the network. It has nothing to do with the behavior of servers at the edges of the network because they don't route anyone's packets."

Filed Under: cdn, end to end, net neutrality
Companies: akamai