Slashdot Mirror
'Let's Encrypt' Project Strives To Make Encryption Simple
jones_supa writes: As part of an effort to make encryption a standard component of every application, the Linux Foundation has launched the Let's Encrypt project (announcement) and stated its intention to provide access to a free certificate management service. Jim Zemlin, executive director for the Linux Foundation, says the goal for the project is nothing less than universal adoption of encryption to disrupt a multi-billion dollar hacker economy. While there may never be such a thing as perfect security, Zemlin says it's just too easy to steal data that is not encrypted. In its current form, encryption is difficult to implement and a lot of cost and overhead is associated with managing encryption keys. Zemlin claims the Let's Encrypt project will reduce the effort it takes to encrypt data in an application down to two simple commands. The project is being hosted by the Linux Foundation, but the actual project is being managed by the Internet Security Research Group. This work is sponsored by Akamai, Cisco, EFF, Mozilla, IdenTrust, and Automattic, which all are Linux Foundation patrons. Visit Let's Encrypt official website to get involved.
Having conversations that your government can't eavesdrop on is tantamount to terrorism.
You have been warned.
Making it simple will go a long way to avoiding PEBCAK problems. Simpler processes give less opportunity for human error.
Encrypt everything! Bummer about the decryption man pages...
Certs don't work, never have. Aggregating so much power and responsibility into the hands of CAs is just as foolish as key escrows run by governments and organized crime. Something will always go wrong there will always be too much incentive locked up in ensuring that it does. The more successful and useful a "simple" solution for everyone becomes the more incentive exists to coopt it.
The answer is not doubling down on these things and "encrypting" just because you can or just because its easy.
Most systems worth securing already require you to provide a password to login. If you want to improve the status quo and really make a difference then get browser vendors to natively support secure logins via TLS-SRP and relegate free certs to the margins for service discovery and account setup where there is no other practical means of establishing trust.
there's nothing prohibiting that now.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
That's already happening. DRM, for example, has always been partially for commercial reasons (preventing privacy), and largely for anti-competitive reasons (preventing interoperability and forcing people to repurchase the same content repeatedly).
Encryption is being used for almost every purpose except the good ones. We could use encryption to protect privacy and prevent identity theft, but I guess we can't do that because it might prevent the NSA from snooping on your dick pics.
ITbusinessweek is wrong: The linix foundation neither started or initiated this project, it only took over its hosting. The press release of the foundation clearly states this.
This is specifically about making it easy to offer an encrypted web site - so "Linux only" will mean it's available for the majority of websites in the world.
Unfortunately there seems to be a huge disconnect between what the Slashdot summary and linked article claims and what the actual Linux Foundation web page states is the goal (making encrypted websites easy to deploy). This is a much less ambitious project than the submitter thinks it is.
#DeleteChrome
The bracelet would work like the NFC chip in current phones
What's the benefit of making it a bracelet rather than a phone app? The phone already has the NFC chip you want.
Then, all email and every other communication can easily be encrypted, securely, and without adding complication.
How do you get the unique identifier from your bracelet to your PC? My PC doesn't have an NFC reader. If it did, again, I'd rather have it tie to my phone than a bracelet. You know what would be cool? A wireless charging pad with the NFC interface, so that you set your phone next to your computer on your desk, and all password requests from the PC are handled by the phone while it's physically there.
You need to use a deniable encryption system for this, then. Rubberhose comes immediately to mind, but it is no longer maintained.
Essentially, what it does is enable you to store several file systems in the same disk volume, which will have had its contents randomized in the formatting process. What blocks of the disk are used for each file system is not known until the key is provided. For that matter -- and this is the deniable part -- what file systems even exist is not knowable without having all of the keys.
So, they ask for a key, you give them one. They ask you for "the rest of the keys" you give them a few more, but there is no way to prove, one way or the other, that all of the keys have or have not been provided.
www.wavefront-av.com
They dont need to, the packages are signed, they are not trying to keep the contents of the packages secret, or hide thier contents during transfer, they are only trying to ensure that they are distributed unmodified. To perform a MITM attack on the packages pulled down from a repo, you would need the private signing keys To creat new packages.
Looking through most of the .repo files in /etc/yum.repos.d on my fedora install, all the dl links are already https.
I suspect that ubuntu is the same.
Its probaly full of holes, i dont think i have seen a decent, analysis of the package managers from a security standpoint, but they seem to have most of the basics.
I dont know if the private keys are distributed to the packagers, if they are then that could be an issue.
Why does it need to be secret?
All you need is an integrity check, and the packages are all signed with the key which is included in the initial distro image (which is itself signed, available over HTTPS and has publicly published checksums).
Encryption is not necessary here. To believe it is is to completely misunderstand the purpose of encryption.
I'm surprised that they are using a Windows desktop for everyday tasks such as document editing.
They're not, check the PDFinfo:
[CronoCloud ~]$ pdfinfo ISRG-CP-Feb-18-2015-DRAFT.pdf
Title: Microsoft Word - ISRG CP_ Draft 2_Clean_Draft_with_Revisions_2015-01-21.docx
Keywords:
Creator: Word
Producer: Mac OS X 10.10.2 Quartz PDFContext
They're using Word on OSX.
Phones can get hacked. And most people are already storing passwords on their phones. What use is two-factor authentication if a malicious app can steal both factors at the same time?
My first program:
Hell Segmentation fault
We'll see.
It's absolutely wrong that I am proposing a 'stealable' ID. No, it's not that at all. Like NFC (ApplePay and others) you don't send out your ID, your bracelet will engage in a two-way conversation that uses generates unique identifiers every time that prove that it's you without giving the system communicating with you the ability to impersonate you. It's not hard at all; we should have been doing this years ago. This is described in Bruce Schneier's Applied Cryptography twenty-fucking-years ago. Chapter 21(Identification Schemes) describes "zero-knowledge proof of identity". Curiously, researchers Feige, Fiat, and Shamir submitted a patent application in 1986 for this, but the Patent Office responded "the disclosure or publication of the subject matter ... would be detrimental to the national security..." The authors were ordered to notify all Americans to whom the research had been disclosed that unauthorized disclosure could lead to two years' imprisonment, a $10,000 fine, or both. Somewhat hilarious, as the work was all done at Weizmann Institute in Israel.
That said, I do think that groups like the NSA and FBI have been quite successful in keeping people (like Jeff4747) remarkably uneducated. Banks, credit card companies, and groups like Google that make gigabucks tracking people have held back from doing things right as well -- and they're paying for it today.
To say again. It is easy to build a system that would securely verify that you have authority to do something, without giving the ability for somebody else to impersonate you. It's somewhat more challenging than printing number in plastic on a credit card, but only a tiny bit more challenging.
This will happen. Once it does people will wonder why it took so long.
I love Mondays. On a Monday, anything is possible.
I've needed on a number of occasions to recover data from disks I can't boot from.
Then you have inadequate backups. That's a different issue from encryption.