encryption

Bilingual

What happens to your private messages under 'Chat Control'?
2 months ago
- EU law does not currently apply to end-to-end encrypted messages on platforms like WhatsApp and Signal.
- A temporary regulation allows voluntary scanning of unencrypted messages for child sexual abuse material (CSAM) until 2028.
- A permanent proposal, 'Chat Control 2.0', is under negotiation and may extend scanning to encrypted chats.
- Detection methods include hash matching (fast but with high false positives) and machine learning (error-prone, especially for text).
- Client-side scanning on encrypted services would inspect messages before encryption, raising privacy concerns.
- Human reviewers often misclassify content, leading to false reports, particularly involving teenage interactions.
- Alternatives include targeted court-authorized scanning and on-device warnings that never send data.
How Bitwarden Encrypts and Decrypts Secrets
2 months ago
- Bitwarden encrypts all secrets (passwords, usernames, URLs, notes, etc.) on the client before sending to the server.
- The master key is a 64-byte random sequence split into a 32-byte encryption key and a 32-byte MAC key.
- Encrypted secrets are stored in version 2 format: initialization vector (iv), ciphertext, and MAC signature, all base64 encoded.
- Decryption uses AES-256 in CBC mode with PKCS7 padding, and integrity is verified via HMAC-SHA256.
- To decrypt the master key, the client derives keys from the user's email and passphrase using PBKDF2 (600,000 iterations) and HKDF-Expand.
- The author provides complete Python code for both decryption and encryption of secrets.
- The author plans to build a custom client that syncs with a Vaultwarden database but keeps secret management local.
Branch Encryption
2 months ago
- Branch encryption prevents attackers from knowing or inferring program states before they are reached.
- It protects constant data (e.g., passwords) used in comparisons by replacing them with hashed values.
- Encrypted code blocks inside conditional statements can only be decrypted with the correct input key.
- The technique combines hashing for comparison and encryption for conditional code execution.
- An example with JavaScript shows how hashing and XOR encryption can hide a password and secret message.
- Branch encryption is useful for protecting comparison values and associated code or data.
End to End Encryption: Talk for the European Internet Forum at the European Parliament - Bert Hubert's writings
2 months ago
- Backdoored encryption has historically failed, exemplified by the weakened GSM encryption from the Cold War era still being vulnerable today.
- Forcing encryption backdoors creates risks and inequalities, as some entities may get exceptions while others do not.
- Total privacy without exceptions is not viable for a just society; a balance must be struck between law enforcement needs and privacy rights.
- Law enforcement has more data access now than ever before, contrary to claims of a crisis, as seen with cloud providers and metadata.
- Encryption is becoming the default in communications, which challenges traditional police methods but also represents progress.
- Proponents of backdoored encryption should be asked for specific, workable details rather than vague proposals.
- Any solution must respect Article 8 of the European Convention on Human Rights, balancing privacy with the rule of law.
CSAM Regulation Update: Dutch Intelligence agency weighs in - Bert Hubert's writings
2 months ago
- The European Commission and EU member states have considered forcing messaging platforms to scan private messages for child sexual abuse material (CSAM), which would break end-to-end encryption.
- The proposal includes fuzzily scanning for known CSAM now and adding AI scanning for text messages in three years, but this is seen as highly ineffective and risky.
- Dutch intelligence agency AIVD warns that scanning applications on all mobile phones create a complex system with large security risks to digital resilience.
- Inserting a scanning layer expands the threat surface, as image parsing is hard to secure; hackers could exploit the CSAM filter to access phones.
- Platforms like Facebook/Meta would bear the cost of installing and maintaining the scanning infrastructure without financial incentive, potentially leading to poor security.
- Drafts of the CSAM regulation include an opt-out for intelligence services, indicating acknowledged privacy risks.
Possible End to End to End Encryption: Come Help - Bert Hubert's writings
2 months ago
- The European Commission is seeking experts to advise on 'effective and lawful access to data for law enforcement', with applications open until September 1st.
- The initiative aims to balance law enforcement needs with privacy, though critics note it leans toward surveillance and lacks leadership from justice and fundamental rights bodies.
- Experts with technical profiles in cybersecurity, telecommunications, big data, or fundamental rights are encouraged to apply, despite the role being unpaid (travel reimbursed).
- The author urges technologists and civil society members to join to counterbalance law enforcement perspectives, emphasizing the mathematical limits of encryption.
- The expert group will operate for one year; the author declines to apply due to their public activism but offers to advise informally.
Kan een Amerikaans bedrijf met encryptie de Amerikaanse overheid buiten de deur houden? - Bert Hubert's writings
2 months ago
- US companies can be compelled by various means to hand over data to the US government, even without judicial review.
- Encryption alone is insufficient because servers must temporarily access unencrypted data for processing, at which point US law applies.
- Solutions like Microsoft Double Key Encryption (DKE) are only recommended for highly sensitive data (around 5%) and severely limit functionality.
- System administrators ultimately have full control over servers, making it impossible to both prevent access and perform necessary management tasks.
- Practical separation of sensitive data is often too late, as data sensitivity is realized only after the fact.
- Theoretical solutions like Confidential Computing and Homomorphic Encryption are not yet viable in real-world applications.
- Claims that using own key management can keep US government out of US-controlled servers are almost always false; renting from a non-US provider is simpler and more effective.
Using PGP Keys
2 months ago
- GPG is a program for encrypting digital files using the PGP standard mandated by IETF.
- Encryption ensures only authorized people can read data; it is used in HTTPS and dates back to the Roman empire.
- Cryptography has two main functions: encrypting data to restrict access and signing data to verify integrity.
- GPG installation varies by OS: Debian/Ubuntu via apt, Windows via GPG4Win, macOS via GPGtools or brew.
- GPG uses asymmetric encryption, allowing anyone to send secure messages but only the key owner to decrypt them.
- To use GPG, you need to generate a key pair (private and public) protected by a passphrase, publish your public key, and start signing things.
- You can sign Git commits, emails (with Thunderbird, Kmail, etc.), or join Keybase for identity verification.
- Key generation requires random bytes and appears to run twice because it creates both private and public keys.
My USB Drive Has a Hidden Encrypted Vault
2 months ago
- Phantomdrive is an open-source USB drive that appears as an 8 GB drive but hides a second encrypted partition activated by editing a plaintext file with 'password:YOURPASSWORD'.
- It uses the CH569 chip, an SD card for storage, and AES-256 encryption, with firmware and hardware designs fully open source.
- The key derivation function (KDF) uses 100,000 rounds of SHA-256 with a device-specific salt from the serial number, taking about 3 seconds to unlock.
- Two AES modes are available: AES-CTR (faster, ~9 MB/s write, 20 MB/s read) and AES-XTS (more secure, ~6 MB/s write, 10 MB/s read).
- The firmware snoops writes to detect the password string and prevents it from being written to disk, avoiding accidental exposure.
- The device is designed to help bypass authorities who may force decryption, but does not protect against being compelled to reveal the password.
Show HN: Ekko – post-quantum E2EE layer for Instagram, WhatsApp, Telegram Web
2 months ago
- Claim a universal handle to link socials and share public keys; private keys stay device-local.
- Post-quantum encryption (X25519, ML-KEM-768, XChaCha20-Poly1305) secures messages across existing apps.
- Two usage modes: handle-based (auto key discovery) or anonymous (manual invite trading).
- Ekko operates as a layer on top of messengers like Instagram, WhatsApp, Telegram; no new app required.
- Private key never leaves the device; only public keys are published via Ekko.
- Start using in browser, with keyboard integration planned next.
- Open source code ensures basic functionality remains free forever.
Show HN: Hidetext.sh – encrypted pastebin where the server never sees the key
3 months ago
- Share text privately without accounts or tracking
- End-to-end encrypted for secure sharing
- Features text formatting options like bold, italic, and color
- Includes 'Burn after read' functionality for self-destructing content
Exit Chat Control
3 months ago
- EU Prüm II regulation allows facial image exchange across police forces, raising mass surveillance concerns.
- eIDAS 2.0 mandates European digital identity wallets by 2026 and forces browsers to trust state certificates.
- High-Level Group proposes 'lawful access by design' for police access to data, criticized as mass surveillance.
- Romanian election annulled due to TikTok campaign; DSA proceedings opened against platform.
- Vietnam requires identity verification for online posting, linking speech to verified identity.
- UK demands iCloud backdoor; Apple removes encryption for UK users rather than comply.
- France rejects 'ghost participant' mechanism in encrypted messengers after cross-party opposition.
- EU's ProtectEU strategy includes roadmap for accessing encrypted communications and boosting Europol.
- ICE purchases Palantir's 'ImmigrationOS' for targeted surveillance of immigration populations.
- Switzerland's surveillance ordinance proposal stalls after opposition from companies like Proton.
- US requires student visa applicants to make social media public for ideological screening.
- EU schedules state decryption capabilities by 2030, including AI analysis of seized data.
- EU pilots age-verification apps, integrating into digital identity wallets by late 2026.
- France enforces age verification for adult sites, blocking access for non-compliance.
- China introduces centralized 'cyberspace ID' with face recognition, eroding online anonymity.
- EMFA bans spyware against journalists but includes exceptions for national security.
- Russia mandates pre-installed state-controlled messenger MAX on smartphones, with tracking capabilities.
- Russia penalizes searching for 'extremist' content online, including via VPNs.
- Over 500 scientists sign open letter against client-side scanning, citing technical infeasibility.
- UK plans mandatory digital ID for right-to-work checks, sparking public opposition.
- EU pulls mandatory scanning proposal after backlash, but it returns as 'voluntary'.
- EU Entry/Exit System collects biometrics for non-EU travelers, centralizing border control.
- UN Cybercrime Convention adopted, enabling cross-border surveillance with broad definitions.
- ECB advances digital euro development while legal safeguards remain undecided.
- Australia bans under-16s from social platforms, requiring age estimation and deactivating millions of accounts.
- France extends algorithmic CCTV 'experiment' to 2030, expanding surveillance scope.
- Former Polish minister granted asylum in Hungary amid Pegasus spyware scandal.
- Russia blocks WhatsApp after platform refuses data-sharing demands.
- Greek court convicts spyware vendors in Predator case, but buyers remain untraceable.
- France proposes expanding 'black boxes' to include full URL tracking for metadata analysis.
- German and French intelligence switch from Palantir to ChapsVision for AI-driven police analysis.
- US FISA Section 702 lapses but surveillance continues under existing certifications.
- EU Parliament advances digital euro with conditional payment features, despite non-programmability claims.
- Europol budget proposal increases to €3 billion with expanded mandate on encryption and AI.
- Pegasus spyware found on MEP in committee overseeing spyware, highlighting oversight failures.
- Decentralized social networks like Mastodon, Nostr, and Matrix offer alternatives to corporate platforms, emphasizing user control and privacy.
Australian Police seize control of network of encrypted phones
3 months ago
- Police seized control of an encrypted phone network used by alleged gangsters for drug deals, kidnappings, and murders.
- The VIP Network sold custom-encrypted devices for $2000 each, generating around $2 million annually, targeting Sydney's underworld.
- Three brothers were arrested and charged with crimes related to the encrypted devices, which were linked to violent gang feuds.
- Over 3000 devices have been identified, and police warned users via a broadcast message on the network.
- The crackdown has disrupted organized crime, with gang members arrested, killed, or forced to flee, including senior leaders hiding abroad.

encryption

What happens to your private messages under 'Chat Control'?

How Bitwarden Encrypts and Decrypts Secrets

Branch Encryption

End to End Encryption: Talk for the European Internet Forum at the European Parliament - Bert Hubert's writings

CSAM Regulation Update: Dutch Intelligence agency weighs in - Bert Hubert's writings

Possible End to End to End Encryption: Come Help - Bert Hubert's writings

Kan een Amerikaans bedrijf met encryptie de Amerikaanse overheid buiten de deur houden? - Bert Hubert's writings

Using PGP Keys

My USB Drive Has a Hidden Encrypted Vault

Show HN: Ekko – post-quantum E2EE layer for Instagram, WhatsApp, Telegram Web

Show HN: Hidetext.sh – encrypted pastebin where the server never sees the key

Exit Chat Control

Australian Police seize control of network of encrypted phones