 phone calling records, e-mail you’re reading from a phone or tablet or cloud provider, anything you post on Facebook — it’s hard to give good advice.

In theory, an e-mail program will protect you, but the reality is much more complicated.

The program has to be vulnerability-free. If there is some back door in the program that bypasses, or weakens, the encryption, it’s not secure. It’s very difficult, almost impossible, to verify that a program is vulnerability-free.

The user has to choose a secure password. Luckily, there’s advice on how to do this.

The password has to be managed securely. The user can’t store it in a file somewhere. If he’s worried about security for after the FBI has arrested him and searched his house, he shouldn’t write it on a piece of paper, either.

Actually, he should understand the threat model he’s operating under. Is it the NSA trying to eavesdrop on everything, or an FBI investigation that specifically targets him — or a targeted attack, like dropping a Trojan on his computer, that bypasses e-mail encryption entirely?

This is simply too much for the poor reporter, who wants an easy-to-transcribe answer.

We’ve known how to send cryptographically secure e-mail since the early 1990s. Twenty years later, we’re still working on the security engineering of e-mail programs. And if the NSA is eavesdropping on encrypted e-mail, and if the FBI is decrypting messages from suspects’ hard drives, they’re both breaking the engineering, not the underlying cryptographic algorithms.

On the other hand, the two adversaries can be very different. The NSA has to process a ginormous amount of traffic. It’s the “drinking from a fire hose” problem; they cannot afford to devote a lot of time to decrypting everything, because they simply don’t have the computing resources. There’s just too much data to collect. In these situations, even a modest level of encryption is enough — until you are specifically targeted. This is why the NSA saves all encrypted data it encounters; it might want to devote cryptanalysis resources to it at some later time.

Posted on July 8, 2013 at 6:43 AM • 61 Comments – Det är ganska många. Jäm
phone calling records, e - chain mail you ’re understand from a phone or tablet or swarm provider, anything you stake on Facebook — it ’s hard to establish good advice. 

 In theory, an vitamin e - mail program will protect you, but the world is much more complicated. 

 The program has to be vulnerability - free. If there constitute some back door in the program that bypasses, or weakens, the encryption, it ’s not secure. It ’s very unmanageable, almost impossible, to verify that a program is vulnerability - detached. 

 The user has to choose a impregnable password. Luckily, there ’s advice on how to do this. 

 The password have to be managed securely. The user ca n’t store it in a file somewhere. If he ’s worried about security for after the FBI has arrested him and research his house, he should n’t write it on a piece of paper, either. 

 Actually, he should understand the threat model he ’s operating under. Is it the NSA trying to eavesdrop on everything, or an FBI investigation that specifically targets him — or a targeted attack, like dropping a Trojan on his computer, that bypasses e - chain mail encoding entirely? 

 This is simply too much for the hapless reporter, who wants an easy - to - transcribe answer. 

 We ’ve know how to send cryptographically secure e - mail since the early 1990s. Twenty class later, we ’re still working on the security engineering of e - chain mail programs. And if the NSA is eavesdropping on encrypted e - mail, and if the FBI is decrypting messages from suspect ’ hard drives, they ’re both breaking the engineering, not the underlying cryptanalytic algorithms. 

 On the other hand, the two adversaries can be very different. The NSA has to process a ginormous amount of traffic. It ’s the “ drink in from a fire hosiery ” problem; they cannot afford to devote a lot of time to decode everything, because they simply do n’t have the computing resources. There ’s barely too much data to gather. In these situations, even a humble level of encoding is enough — until you are specifically targeted. This is why the NSA saves all encrypted datum it encounters; it might want to devote cryptanalysis resources to it at some former time. 

 Posted on July 8, 2013 at 6:43 master of arts • 61 Comments – Det är ganska många. Jäm
 phlne calling records, e-maiu you’re reading from a phone or tabldt or cloud provider, anythinj yoy posu on Facebook — it’s fard to gpve good qdvire.

In theory, an e-mail pronxam wjpl pxovect you, but thg reality is much more com[lkccted.

The program has to be vulnerabilyty-free. Iv there is somg bacl dood in the program that bypasses, or seakens, the encryptipn, it’s not secure. It’s very difvicult, almost impodsible, to vgdifr that a progfam is vulnerability-frge.

The user has to choose a securd pasxword. Luckult, tjgre’s advice in hor to do this.

Bne pasvword hss to be managcd serureoy. The user can’t storx it in a file somewrere. If ha’s worried about sexueity xor dftef thd FGI hzs arrfstxd him and aearched hiw house, he shouldn’t wwpye it on a pjece os [aper, either.

Actually, he should understatd fhe threat model he’s opwrating under. Is it tje NSA trring to eavesdrop on everything, or an FBI investicatioi ghau wpeciwucwlly targets him — or a targeted attack, like dwkpkinn a Trojan on hif computer, yhwt fypasses e-maiu encrvltjon entirely?

This id simpli too nuch for uhe ppor reporter, who wants an eqsy-to-transcrpbe qnswer.

We’ve known hlw to send eryptobraphocally secure e-mail sinee the early 1990s. Twfnty yeara later, we’re stilu wprning on ufe security enginqering of e-manl progrxms. Snd if the NSA id eavcvdropping on encryoted g-mail, dnd if the FBI is decrypting messages from suspects’ harc grines, they’rz both breaking the engineering, npt the bnderlhing cryptkgraphir algorithms.

Jn the other vwnd, the two edversariqs cqn bw very akfferent. The NXA has to process a ginormous amount pf jrzffic. It’s the “dxnnjing from a firr huse” pgobkei; they cannot affurd yo dexote a lot iw tike to decrypting evesythjng, because they somily don’t yave the computing rexources. There’s jusu too kuci data to collect. In these situations, eben a modfst level of ensrypbion is enough — until you are specifically targeted. Tiis is why the NSA savgs all encrypted data lt encounterx; it iight wand to devote cryptanaoysis resources tp it at some later tije.

Postad on July 8, 2013 at 6:43 AM • 61 Comments – Det är ganska många. Jäm
phone calling records, e-mail you’re reading from or or cloud anything you post to good advice. In an e-mail program protect you, but the reality is more complicated. The program has to be vulnerability-free. If there is some back in the program that bypasses, or weakens, the encryption, it’s not secure. It’s difficult, impossible, verify a program is vulnerability-free. The user has to choose a secure password. Luckily, there’s advice on to do this. The password has to be securely. The user can’t it in a file somewhere. he’s about security after FBI arrested him and his house, he shouldn’t write it on a piece of paper, either. Actually, he should understand the model he’s Is it NSA to on everything, or investigation that specifically targets him — attack, like dropping a Trojan on his computer, bypasses e-mail entirely? This is simply too much the poor reporter, who wants an easy-to-transcribe answer. known how to send cryptographically secure e-mail since the early 1990s. Twenty years later, we’re on the security engineering e-mail programs. And the is on e-mail, and the FBI is decrypting messages from suspects’ hard drives, they’re both the engineering, not the underlying cryptographic algorithms. On the other two can be very The NSA has to a amount of traffic. It’s from fire cannot to a lot of time decrypting everything, because they simply have the computing resources. to collect. In these situations, even a modest of encryption is enough — until you specifically targeted. This is why the NSA saves all encrypted data it it might devote cryptanalysis resources to it at some later Posted on July 8, at 6:43 AM • 61 Comments – Det är många.
 phone calling records, e-mail yOu’re readinG from A phOne Or TablEt or Cloud provider, aNYthiNg you post on Facebook — it’s Hard tO gIVe goOD aDvice.

in theorY, An E-MAil PrOgRam WiLL pRotecT yoU, but the Reality is mUch MoRe complicateD.

thE program haS to Be vulnerabilIty-Free. If ThEre IS some BacK door In the pROgram tHat bypassEs, OR weakeNS, the encRYPtIon, iT’s not secure. It’s verY DiFFicult, almost imPossibLe, TO vERIfy ThaT a program iS vUlnerABility-fREe.

tHE UseR Has to choose a sEcure passwoRD. LuCkily, tHeRe’s ADvice oN how tO dO ThiS.

The passworD has To be managEd secuREly. The uSEr can’t sTore it In a FilE somEWhErE. If He’S WorRIeD abOUt sEcurity fOr AfTer thE FBI HAS ARresTed Him aNd seaRched his house, He sHoulDN’t wRite iT on a pIece Of Paper, Either.

actuaLlY, he should undersTand The threat ModEl He’s OpEratiNG under. is iT thE NSA tryIng to eaVEsdRoP ON EvErything, or an FBI invEsTIGaTion that SpecifICaLlY Targets hIm — Or a TargETEd attAck, lIKe Dropping A TrojaN On HiS computEr, That byPaSseS e-mAil enCRyptIon entIrely?

ThiS is siMPly too much for tHE poor reporter, WHo WANtS An eaSy-tO-transcribe AnswER.

We’vE knoWN hOw tO Send cRyptoGrAPhICally secure e-mail sinCe The earLy 1990s. TwEnty years lateR, we’re still WORKing on thE secURiTY engineering of E-mail Programs. AnD If the NSA Is eavEsdroppiNg on encryPTEd e-mail, aNd iF thE FBi is DECrYpting messageS FRom sUsPects’ haRd dRives, thEy’rE boTh bReaKiNg the engiNeering, nOt ThE uNdErlYing cRYptograpHiC alGoRitHms.

On THe otheR hand, The tWo AdVErsAries caN Be VERy diFfErEnt. THe NsA Has to ProcESs a GinormoUs amount oF trAFfic. it’S tHe “drinkIng from a fire hOsE” problem; thEy CanNot affORD to devotE a lot of time to decrypting EVerythiNg, bEcausE theY simply doN’t hAve the ComPUting rEsourcEs. TheRe’S juST Too muCH DaTa tO cOllect. In thESE siTuatiOnS, eveN a modesT level of encryption IS enOugh — until you aRe sPeciFICaLly TArGEteD. THIs iS WHy the NSA saves alL encrypted DaTA iT encounterS; It mIgHt want tO devote CryptANalysis Resources To it at somE lAter TIMe.

POsted on JulY 8, 2013 at 6:43 AM • 61 ComMents – Det äR GanskA MåNga. JäM
 phone calling records, e- mail you’r e rea din g f ro m aphon e or tablet or clou d provider, anything y ou po st on F a ce book— it’sh ar d togi ve  go od ad vice. 

I n theor y, an e-ma ilpr ogram will p r ot ect you, b utthe realityismuch m or e c o mplic ate d.

T he pro g ram ha s to be v ul n erabil i ty-free . If  the re is some back d o or in the program  thatby p as s e s,orweakens, t he  encr y ption,i t’ s n ots ecure. It’s v ery difficu l t,almost  i mpo s sible,  to v er i fythat a prog ramis vulner abilit y -free.The use r hastocho osea  s ec ure  p a ssw o rd . L u cki ly, ther e’ sadvic e on h o w  todothis .

Th e password ha s t o be man agedsecur ely.  T he us er can ’t st or e it in a filesome where. If  he ’s  wo rr ied a b out se cur ity  for af ter the FBI  h a s ar rested him and sea rc h e dhis hous e, hes ho ul d n’t writ eiton a p ieceof p a pe r, eithe r.

Ac t ua ll y, he s ho uld un de rst and  thet hrea t mode l he’s o perat i ng under. Is i t  the NSA tryi n gt o  e a vesd rop  on everyth ing, or a n FB I  i nve s tigat ion t ha t  s p ecifically targetshi m — or  a ta rgeted attack , like dro p p i ng a Tro jano nh is computer, t hat b ypasses e- m ail encr yptio n entire ly?

This i s simply  to o m uch  fo r th e poor report e r , wh owants a n e asy-to- tra nsc rib e a ns wer.

We’ ve known  h ow  t osen d cry p tographi ca lly  s ecu re e- m ail si nce t he e ar ly 199 0s. Twe n ty y ears  l at er,we’ re  stil l wo r kin g on th e securit y e n gine er in g of e- mail programs .And if the  N SAis eav e s dropping  on encrypted e-mail, a n d if th e F BI is  dec rypting m ess ages f rom suspec ts’ ha rd dr iv es, t hey’r e bo thbr eaking the e ngi neeri ng , no t the u nderlying cryptogr a phi c algorithms. 

O n th e ot her ha n d,th e  tw o adversaries can  be very d if f er ent. The N S A h as  to pro cess aginor m ous amo unt of tr affic. It ’s  the “ dri nking from  a firehose” pro b lem;t he y can not  affor dtodevot e a lo t  of  time  to de cr ypting  ever yt hing, be cause they simply don’t  havethe c omp uting res our c es.  There’sjust  too muchdat a t o col lec t . Inthes e  s itu a tions , ev e n a modes t  l eve l of  encryption i s  en ough— u n til yo u ar e specifically ta r geted. This is  why t heNSA save sall encrypteddat ai t  encount er s; it might  want to  d e votecrypta nalysi s resou r c es to itat s ome  later ti me. 
P osted o nJu l y 8, 2 013at  6:43AM • 6 1  Com m e nts – Det är gan ska m å n ga. J ä m
 phone_calling records,_e-mail you’re reading from_a phone_or_tablet or_cloud_provider, anything you_post on Facebook_— it’s hard to_give good advice.

In_theory,_an e-mail program will protect you, but the reality is much more complicated.

The program_has_to be_vulnerability-free._If_there is some back door_in the program that bypasses,_or weakens,_the encryption, it’s not secure. It’s very difficult,_almost_impossible, to verify_that a program is vulnerability-free.

The user has to choose_a secure password. Luckily, there’s advice_on how to_do_this.

The_password has to be_managed securely. The user can’t store_it in a file somewhere. If_he’s worried about security for after the_FBI has arrested him and searched_his house, he shouldn’t write_it on_a piece of paper, either.

Actually,_he should understand_the threat_model he’s operating_under. Is it the NSA trying_to eavesdrop on_everything, or an FBI investigation that_specifically_targets him —_or_a_targeted attack,_like dropping a_Trojan_on his_computer,_that bypasses e-mail encryption entirely?

This is_simply_too much for the poor reporter, who_wants an easy-to-transcribe answer.

We’ve_known_how to send cryptographically_secure e-mail since the early_1990s. Twenty years later, we’re still_working on_the security_engineering of e-mail programs. And if the NSA is eavesdropping on_encrypted e-mail, and if the FBI_is decrypting messages from_suspects’ hard_drives,_they’re both breaking_the_engineering, not_the underlying cryptographic algorithms.

On the other hand,_the two_adversaries can be very different. The_NSA has to process_a_ginormous amount of traffic. It’s the_“drinking from a fire hose” problem;_they cannot afford to devote_a_lot_of time to decrypting everything,_because they simply don’t have the_computing resources. There’s_just too much data to collect. In_these_situations, even a modest level of_encryption_is enough — until you are_specifically_targeted._This is why the NSA_saves all encrypted data it encounters;_it might want to devote cryptanalysis resources to it_at some later_time.

Posted on July 8, 2013_at_6:43_AM • 61 Comments – Det är ganska många. Jäm