Slashdot Mirror
Yahoo Debuts End-To-End Encryption Email Plugin, Password-Free Logins
An anonymous reader writes: Yahoo has released the source code for a plugin that will enable end-to-end encryption for their email service. They're soliciting feedback from the security community to make sure it's built properly. They plan to roll it out to users by the end of the year.
Yahoo also demonstrated a new authentication system that doesn't use permanent passwords. Instead, they allow you to associate your Yahoo account with your phone, and text you a code on demand any time you need to log in. It's basically just the second step of traditional two-step authentication by itself. But Yahoo says they think it's "the first step to eliminating passwords."
Yahoo also demonstrated a new authentication system that doesn't use permanent passwords. Instead, they allow you to associate your Yahoo account with your phone, and text you a code on demand any time you need to log in. It's basically just the second step of traditional two-step authentication by itself. But Yahoo says they think it's "the first step to eliminating passwords."
I hope that if the recipient gets an encrypted email, it shoves the plugin down their throat. Maybe that way people will start adopting encryption.
How secure is it? How hard is it difficult to clone SIM cards of people? Is there a chance the text can go to the wrong phone?
Maybe they should limit what can be accessed when not using the password. Read/Compose only. Maybe delete, but not empty the trash.
You know, I would love it if providers such as Yahoo! Mail were to offer an option to archive all e-mail, as a form of backup. You know, in a handy zip file consisting of either email file types or text file types.
I don't. I tried to sign up with Yahoo a few weeks ago and got cockblocked by this. They required a mobile number.
End to end encryption with sending the code over an unsecure SMS so that the NSA can decrypt it anyway.
Nice.
Yahoo needs to understand that the purpose of 2-factor authentication was not to replace passwords, but rather to ... provide a second factor of authentication.
Remember ideally:
1. Something you know
2. Something you have
3. Something you are
Each is no more secure than the other, but together they form a far stronger system than any individual component.
I wonder how many people access yahoo mail on their phone, in effect reducing the protection to 1-factor authentication again? I know people who have Paypal accounts accessed on the smart phone with passwords remembered - and use SMS to the same phone as authentication!
you can be compelled to give the encryption keys to the security services
In America, there would be a strong argument that this is in contravention of the Fifth Amendment of the consitution (as it would be self-incrimination). Not sure how that's played out though.
But yes, in the UK, there is a specific criminal offense of "Not disclosing your encryption key" which carries a 2 year sentence... and you can of course, be asked to disclose your key again once you've served it...
What if your phone is dead/stolen and you desperately need to get a message out? You're fucked.
NOTE: They just killed Yahoo! Profiles. In short, they are collecting data for themselves while making it harder and harder for Yahoo! users to search each other out.
*** Don't be dull.***
PGP doesn't protect metadata.
SQRL completely eliminates the need for passwords https://www.grc.com/sqrl/sqrl....
Finally there is a way for the NSA to easily link your Yahoo email address and your mobile phone number.
Just make sure to constantly use your GPS on your phone, you'll be safer that way.
Remember, if yahoo cannot sell your data, if the NSA cannot read your email the terrorists win.
You are not constantly sending my text messages every time I want to log in. It annoys me enough to deal with this the first time I authenticate a machine with Gmail but at least that is just one time.
I bet Hilary Clinton wishes this was an option for her "private" email account.
As SMS are far than secure, they just transmit the key access to your emails as readable by [nsa]body.
-- Laurent Pointal
I checked out the link, there was no mention of what kind of encryption they will be implementing.
Actually, one link directly says what kind of encryption:
https://github.com/yahoo/end-t...
Use OpenPGP encryption in Yahoo mail.
Yahoo End-To-End
A fork of Google's End-to-End for Yahoo mail.
and the other link shows it in action:
http://yahoo.tumblr.com/post/1...
If you watch the gif, you can see a PGP code block
I have one, but I don't *trust* Yahoo with it. The moment i won't be able to log in without my phone is when I give up on their services...
I apologize for the lack of a signature.
Is that right? I assumed that US law was like UK law - there is no law against using strong encryption but you can be compelled to give the encryption keys to the security services.
You always have the right to remain silent. You cannot be compelled to give testimony, although they might try to slap you with an obstruction of justice rap.
Admit nothing. Deny Everything. Make Counter-accusations.
Oh no, my phone is dead/stolen! Better email people and tell them not to phone me and I'll be reachable by email.
Just need to log into my email and ... ... shit...
While my Mobile Phone has a lock screen, text messages are briefly displayed in it even in lock mode. Which means anyone who has my phone can briefly see the plain-text 'code' that Yahoo will text that number, even if the mobile device itself is locked for normal use. So (setting aside the legitimate issue that I may not have cell coverage all the time), it would seem rather easy to bypass the security mechanism here, because Yahoo is essentially putting my reset code out to an unsecured endpoint in a publicly visible manner.
Settings | Sound and notifications | When device is locked | Don't show notifications at all. Problem solved, at least on Android :-)
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
In the US, when the judge orders it and you don't comply, it's contempt of court. He'll have you thrown in jail until such time as you agree to unlock your phone.
There's a case going through Canadian courts where someone refused. We'll let you know what happens, if anything, because apparently this was the first time that a Canadian has refused to let Canada Border Services (CBS) look at their phone and CBS decided to make an issue of it.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
If you want anonymity and/or privacy, just don't go with the big companies. Period. I use openmailbox through TOR and using email addresses with false names, this does a better job at anonymity. As for privacy, I f**king keep my personal info to myself.
I don't think the suggestion was relating to what the US government can compel from users of Yahoo's service, but rather that they could compel Yahoo to provide the government access to that user's emails while simultaneously compelling Yahoo to deceive the user about having done so. The notion is that Yahoo could show the world source code and intend to use it, but when it came time to actually put it into use, the government could come and force Yahoo to use different code, written by the government, while also forcing Yahoo to lie to the world, claiming that it's using the code it had originally intended to use. Five years ago this might sound like a bizarre conspiracy theory, but now it seems much less like a question of whether the government would try than a question of how successful the government might be at forcing all the Yahoo employees who would have to know about the lie to keep it secret.
... privacy.
No phone number, no yahoo or google account for you. Because ... the NSA wants to know you.
Please...serious answers only...I don't care if you hate/love Apple or Android.
But, what is the likelyhood of the following:
1) Malware running on your non-jailbroken iPhone?
2) Malicious scripts running in the browser talking to other apps on the device?
3) Potential for your SMS traffic to be intercepted on a non-jailbroken iPhone?
4) Ability of an app to access SMS traffic on an iPhone?
Now, apply the same questions as they apply to latest incarnation Android?
My understanding is that sandboxed nature of iOS would/should prevent malicious apps from being run (assuming, you don't download one from the store or have allowed someone to physically compromise your device). iOS does not allow one access to received SMS traffic (unlike, Android). This means a user would have to manually enter the received token. To gain access to pushed traffic, something like APNS (on iOS) or GNS (Android) might be a better solution. Dumb phones can use SMS.
I would not suggest accessing your email from the same device as your token receiver, but can iOS' sandbox architecture provide enough of a firewall?
Are there exploits in the wild for iOS and/or Android making this a serious threat?
"But Yahoo says they think it's "the first step to eliminating passwords.""
And another in a long line of steps that remove any anonymity from the user.
"If any question why we died, Tell them because our fathers lied."
but that assumes you don't want ANY text messages displayed. I have need to see most text messages when in lock mode, and there's no way to screen this specific type of notification out. One approach would be for the initial message from yahoo to not contain the actual code, but rather requires a response before sending the actual code in a second text message. And yes, text messaging rates would apply :)
The last time I wrote code, it was Morse
From their intro video it appears that you generate your key on their website and even have a backup code that lets you retrieve it. How is this end to end? If they can retrieve the key for you and hold your private key for you, they can be compelled to release it (or knowing Yahoo's track record, accidentally leak it or get hacked).
The NSA can read your txts too. If they get a copy of the email not hard to get a copy of the txt to decode, right?
There is also a middle ground between people who live on their phones and people who live without one. It's called prepaid mobile phone service, and it often carries a fee of 20 cents per sent text message and 20 cents per received text message. Having to pay 20 cents every time you log in to Yahoo! is not fun.
I don't even have a computer or internet access and they wouldn't let me sign up.
I see the point you're trying to make with your sarcasm, but there's a difference: Public libraries offer Internet access. They do not offer SMS access.
Then perhaps the right way to think about it is that the cost/benefit analysis differs depending on the sender. If the sender is Yahoo! or another authentication service, show only the sender. If the sender is anyone else, show the sender and a few words.
This is a solved problem, although by a commercial solution. Symantec's Encryption Desktop....
I stopped reading after that. If you think Symantec is a solution to any problem that exists, then we'll just have to agree to disagree.
Can't you just make a throw-away VOIP (Skype, etc) number for this purpose, then get rid of it?
You can make it. You can try to use it. But when you do, Yahoo! will probably reject it as "unsupported carrier" the same way it does land lines.
You can also do it on an app-by app basis.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Try accessing this URL while logged in to Yahoo.
https://developer.yahoo.com/yql/console/?q=select * from social.profile where guid = me
Are you able to harvest a phone number using YQL?
I was. Disturbingly, even after "deleting" the phone number from my Yahoo profile, the query result still includes a phone number.
On a related note, I wish Yahoo would at least properly implement OpenID Connect before delving into more exotic login scenarios.
With the yahoo encryption module, you will require a yahoo decryption module. Ergo, reading encrypted yahoo mail from gmail will or should not work.
I am certain that this non-universality concept will be equivalent to floating a lead ballon.
Leslie Satenstein Montreal Quebec Canada