Slashdot Mirror
Yahoo Debuts End-To-End Encryption Email Plugin, Password-Free Logins
An anonymous reader writes: Yahoo has released the source code for a plugin that will enable end-to-end encryption for their email service. They're soliciting feedback from the security community to make sure it's built properly. They plan to roll it out to users by the end of the year.
Yahoo also demonstrated a new authentication system that doesn't use permanent passwords. Instead, they allow you to associate your Yahoo account with your phone, and text you a code on demand any time you need to log in. It's basically just the second step of traditional two-step authentication by itself. But Yahoo says they think it's "the first step to eliminating passwords."
Yahoo also demonstrated a new authentication system that doesn't use permanent passwords. Instead, they allow you to associate your Yahoo account with your phone, and text you a code on demand any time you need to log in. It's basically just the second step of traditional two-step authentication by itself. But Yahoo says they think it's "the first step to eliminating passwords."
I hope that if the recipient gets an encrypted email, it shoves the plugin down their throat. Maybe that way people will start adopting encryption.
I don't. I tried to sign up with Yahoo a few weeks ago and got cockblocked by this. They required a mobile number.
End to end encryption with sending the code over an unsecure SMS so that the NSA can decrypt it anyway.
Nice.
Yahoo needs to understand that the purpose of 2-factor authentication was not to replace passwords, but rather to ... provide a second factor of authentication.
Remember ideally:
1. Something you know
2. Something you have
3. Something you are
Each is no more secure than the other, but together they form a far stronger system than any individual component.
What if your phone is dead/stolen and you desperately need to get a message out? You're fucked.
NOTE: They just killed Yahoo! Profiles. In short, they are collecting data for themselves while making it harder and harder for Yahoo! users to search each other out.
*** Don't be dull.***
SQRL completely eliminates the need for passwords https://www.grc.com/sqrl/sqrl....
With phones becoming primary form of email access for many, two-factor that relies on phone defeats the purpose.
As SMS are far than secure, they just transmit the key access to your emails as readable by [nsa]body.
-- Laurent Pointal
Sure there is. All you have to do is use stegnography to encode your message into a photo, then use that photo in what looks like a spam email message, then pretend your computer is taken over by a botnet and send the spam to a few thousand email addresses (including the one you actually want to send to). Absolutely no useful metadata there.
Support Right To Repair Legislation.
I checked out the link, there was no mention of what kind of encryption they will be implementing.
Actually, one link directly says what kind of encryption:
https://github.com/yahoo/end-t...
Use OpenPGP encryption in Yahoo mail.
Yahoo End-To-End
A fork of Google's End-to-End for Yahoo mail.
and the other link shows it in action:
http://yahoo.tumblr.com/post/1...
If you watch the gif, you can see a PGP code block
I have one, but I don't *trust* Yahoo with it. The moment i won't be able to log in without my phone is when I give up on their services...
I apologize for the lack of a signature.
Oh no, my phone is dead/stolen! Better email people and tell them not to phone me and I'll be reachable by email.
Just need to log into my email and ... ... shit...
Also, don't lose your phone where evil people might find it.
Forgive me if I've got the following arithmetic wrong, but if they remove one factor from two-factor authentication, doesn't that make it one-factor authentication?
I don't see eliminating passwords as an important goal. Instead, the goal should be to increase security. To that end, I've recently begun to use two-factor authentication on all my important accounts. However, I'm finding that each service implements it differently, so it's a bit annoying to have to remember how to deal with each one. Also, I use one service that requires a hardware token which they mail to you, and that makes it more difficult to get the whole thing set up, compared to the more common case where you just give them your phone number and then two-factor authentication begins to work nearly instantly. So, it would be nice if we had some industry standards on all that.
Since some services make two-factor authentication somewhat difficult to set up, I get the impression that they find that the increased support costs for it to not be worth it, at least from the service's point of view. Of course, from the customer point of view, if it prevents a security breach to an important account, it's well worth the extra trouble.
Of course, from the customer point of view, if it prevents a security breach to an important account, it's well worth the extra trouble.
That's the problem. You can't prove it prevented a security breach so most users just see it as a PITA extra step and definitely NOT worth the extra trouble. My experience has been the harder it is to access something the less people use it. It's so hard to do some simple tasks on my current corporate network that at least half the office brings in their own laptops to get their work done. They just expense a WiFi hotspot and use it in the office.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
You just hit the nail on the head. As of now, if someone steals my phone in an unlocked state, they will be able to get the second factor... but they won't be able to log into the account due to the password. What having just one factor does is make a phone theft all the more crippling where a bad guy can do a lot of damage.
2FA is 2FA because it covers at least two of these properties: Something you know, somewhere you are located, something you are, and something you have. For example, a secure biometric system uses the fingerprint/retina scan as a username, then a PIN for access, or a remote access system uses a password and a OTP so that if the password gets sniffed, the OTP is still an obstacle.
On the other hand, perfect is the enemy of the good. In general, someone is going to be less likely to have their phone stolen than to have their password sniffed or cracked, so moving to a SMS message can be argued to be a security improvement.
I don't even have a computer or internet access and they wouldn't let me sign up.
I see the point you're trying to make with your sarcasm, but there's a difference: Public libraries offer Internet access. They do not offer SMS access.
Then perhaps the right way to think about it is that the cost/benefit analysis differs depending on the sender. If the sender is Yahoo! or another authentication service, show only the sender. If the sender is anyone else, show the sender and a few words.
Can't you just make a throw-away VOIP (Skype, etc) number for this purpose, then get rid of it?
You can make it. You can try to use it. But when you do, Yahoo! will probably reject it as "unsupported carrier" the same way it does land lines.