Revealed: The six 'secure messaging' apps that actually are secure

Summary: The most popular secure messaging apps fall well short of ensuring users are protected from government surveillance.
 
Which six messaging apps actually live up to the claim that they're verifiably 'safe and secure'? Hint: none that have millions of users, though Apple's messaging products do perform well.
 
In a bid to improve messaging product security, the Electronic Frontier Foundation (EFF) has published a scorecard of 39 apps, which decodes the seven basic requirements they must meet in order to live up to the claim of being 'secure'.
 
The EFF's scorecard draws attention to the fact that messaging apps like Google Hangouts, Facebook Chat, SnapChat, WhatsApp, Apple's email products, Yahoo's web and mobile chat, and Secret "lack the end-to-end encryption that is necessary to protect against disclosure by the service provider".
 
As the EFF notes, end-to-end encryption has become more important in light of the surveillance techniques used by government agencies, including either forcing providers to hand over keys to decrypt protected messages, or by hacking the providers themselves.
 
"The revelations from Edward Snowden confirm that governments are spying on our digital lives, devouring all communications that aren't protected by encryption," said EFF technology projects director Peter Eckersley.
 

Just a handful of apps meet all seven of the EFF's criteria: ChatSecure, CryptoCat, Signal/Redphone, Silent Phone, Silent Text, and TextSecure.
 
The criteria assessed the apps as to whether content is encrypted in transit; whether the provider can read encrypted messages; and whether they've implemented 'perfect forward secrecy', which ensures that past communications that were encrypted remain secure even if the keys are stolen in the future.
 
The last three criteria assess whether claims to being secure can be verified, such as whether the source code has been published to facilitate an independent check for bugs and backdoors; whether documentation of the cryptography used has been published; and whether there has been an independent security audit.
 
While Apple's mail products didn't fare well, iMessage and FaceTime were the best mass-market options, according to the EFF. Meanwhile, some popular apps such as Tencent's QQ, Mxit, and the desktop version of Yahoo Messenger had no encryption at all.
 
The main aim of the scorecard is to drag app makers towards better security for end users, according to the EFF. "We hope the Secure Messaging Scorecard will start a race-to-the-top, spurring innovation in stronger and more usable cryptography," said EFF staff attorney Nate Cardozo.
 
~ Liam Tung

Read More

Android privacy flaw leaks location details over Wi-Fi -- even when Wi-Fi is off

 

Google Android smartphones and tablets have a major privacy flaw that broadcasts private location data over Wi-Fi even when the connectivity is switched off and it will take some time for Google to fix the error.
 
Research by the Electronic Frontier Foundation [EFF] found that devices produced in the past three years transmit location history to anyone within Wi-Fi range whilst the screen is off and the device isn’t connected to a Wi-Fi network.
 
The leaked data comes in the form of the names of wireless networks that the phone or tablet has previously connected to including homes, workplaces, travel destinations and anywhere else that wireless Internet via Wi-Fi has been accessed, and includes up to 15 stored network names.
 
"This data is arguably more dangerous than that leaked in previous location data scandals because it clearly denotes in human language places that you've spent enough time to use the Wi-Fi," EFF’s Peter Eckersley and Jeremy Gillula explained in a blog post. "Normally eavesdroppers would need to spend some effort extracting this sort of information from the latitude/longitude history typically discussed in location privacy analysis. But even when networks seem less identifiable, there are ways to look them up".
 
Google is aware of the issue and an employee has already submitted a patch to wpa_supplicant that fixes the issue and explained that it is working out whether it needs to make changes to Android to make it more secure.
 
"We take the security of our users' location data very seriously and we're always happy to be made aware of potential issues ahead of time. Since changes to this behavior would potentially affect user connectivity to hidden access points, we are still investigating what changes are appropriate for a future release,” read a statement from the company.
 
In the meantime, which could take a while, the EFF has advised Android device owners to turn off the "Keep Wi-Fi on during sleep" mode even though it leads to an increase in both data usage and power consumption.
 
Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.
 
~ Jamie Hinks

Read More

Unlocking your mobile phone will become a crime starting Saturday

If you’ve been on the fence about whether or not to unlock your smartphone, you might want to hurry up and make a decision one way or another. That’s because starting January 26 (this Saturday), the process will become illegal in the US thanks to the Digital Millennium Copyright Act.

The law officially went into effect in October 2012 but the Librarian of Congress provided a 90 day grace period for anyone with an unlocked device to do the deed.

It goes without saying that the restriction hasn’t earned the approval of everyone – most notably, the
Electronic Frontier Foundation (EFF).The advocacy group has questioned whether or not the Digital Millennium Copyright Act has the right to determine who can and cannot unlock a phone.

Those with certain handsets like Verizon’s iPhone 5 aren’t affected as it comes unlocked out of the box. AT&T, meanwhile, will unlock a phone once it is out of contract. Alternately, users can simply purchase an unlocked phone without a carrier subsidy although expect to pay a pretty penny for the opportunity. Unlocked iPhones start at $649 but you can get something cheaper like the Nexus 4 from Google for around $300.

At the end of the day, this really isn’t expected to have a significant impact on most users. At most, it
will likely become a thorn in the side of some wireless carriers like T-Mobile that have promoted bringing unlocked handsets to their network in order to save on monthly billing.

~ Shawn Knight

Read More