Are you REALLY Encrypted?

[IRstuff]

https://finance.yahoo.com/news/encryption-many-major-companies-rely-171500008.html

http://www.newsweek.com/what-krack-wpa2-wifi-hack-how-protect-yourself-685740?yptr=yahoo

Seems to in the realm of engineering failures, sadly, both in the same week. Both are in the category of inherent flaws in the very infrastructure of our on-line security.

While you're at it, if you work for a large company, it's likely that they're eavesdropping on what you might think is encrypted internet traffic:

https://security.stackexchange.com/...tion-to-intercept-and-decrypt-ssl-tls-traffic

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert!

https://www.youtube.com/watch?v=BKorP55Aqvg

faq731-376 forum1529 Entire Forum list

http://www.eng-tips.com/forumlist.cfm

 

[dgallup]

Krack - The attacker would have to be physically close to the target and the potential weaknesses would not compromise connections to secure websites

----------------------------------------

The Help for this program was created in Windows Help format, which depends on a feature that isn't included in this version of Windows.

 

[IRstuff]

"physically close to the target"

Only close enough to be within range of your wifi, and it's likely that ROI is low for trying this on most of us, but bored script kiddies have the time and patience to try it and potentially steal things of importance from you. Luckily, if your Windows is on auto-update, the last Patch Tuesday included the patch for Windows 10, although the patch description tries to fly under anyone's radar.

Nevertheless, your privacy and security isn't necessarily anywhere near what you might hope for.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert!

https://www.youtube.com/watch?v=BKorP55Aqvg

faq731-376 forum1529 Entire Forum list

http://www.eng-tips.com/forumlist.cfm

 

[dik]

IRS: In particular if Microsoft is scooping all your data, too... keystrokes, facial recognition, and the whole nine yards... Using Win7 pro and keeping track of all the add-ons I have a batch file with about 30 apps that MS uses for spying and delete them frequently...

Dik

 

[IRstuff]

MS is at least overt about it. My company spoofs the encryption certificate for https websites. Luckily, their public keys don't appear to be suffering from the RSA weak key problem.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert!

https://www.youtube.com/watch?v=BKorP55Aqvg

faq731-376 forum1529 Entire Forum list

http://www.eng-tips.com/forumlist.cfm

 

[itsmoked]

dik; I'm really interested in your.. list if you're willing to post it.

Keith Cress
kcress -

http://www.flaminsystems.com

 

[dik]

Yup... just change the name from *.txt to *.bat Check the knowledge base articles to see what each does... some don't tell you the entire story.

Dik

 

[JStephen]

Well, I'm reminded of that Seinfeld episode where Kramer and what's-his-name were reversing their front door peepholes so people could see in...in the hopes that somebody would WANT to see in! If anybody's intercepting my emails, they're probably encrypting it themselves so they don't have to read it. I'd have to pay money to get a stranger to read that stuff.

I'm just envisioning the North Koreans sitting over there thinking "Now, this guy seems interested in cotton gins...is that some secret code for something interesting or what?"

 

[VEBill]

Computerphile released a YouTube video on the subject of 'krack'. I happen to have watched it last night.

https://www.youtube.com/watch?v=mYtvjijATa4

My conclusion is that it isn't actually that big a deal for most situations.

...But still, worth watching for the patches.

 

[drawoh]

Hackers don't like it when boring people encrypt their email.

--
JHG

 

[dik]

drawoh... neither do the authorities...

Dik

 

[drawoh]

dik,

What was then the Toronto Linux Users Group held a lecture on some encryption software somebody was developing. Apparently, this had to be done in Canada and in the Netherlands. If it had been worked on in the USA, it would have been classified by ITAR as munitions. Perhaps a large, hard cover manual could be used as some sort of bludgeon.

--
JHG

 

[Sparweb]

Drawoh,
Great article! Thank you; that will save me hours every time I encrypt my mother's birthday e-card.


STF

 

[dik]

drawoh:

PGP had that problem decades back, and had an export restriction about it being treated as munitions by the US... it was at that point available world wide... like closing the proverbial barn door.

Dik

 

[Sparweb]

While you're at it, if you work for a large company, it's likely that they're eavesdropping on what you might think is encrypted internet traffic

I think there are some legitimate reasons for web/e-mail traffic to be monitored at work. If you visit *.ru sites on a regular basis, for instance, you don't have to be selling company secrets to be causing trouble. Just be logging to that address you are waving a flag saying "come get me"!

STF

 

[IRstuff]

Blocking domains is a whole separate thing altogether. I'm referring to what is essentially a man-in-the-middle attack on all your https connections, so my company, which does this, gets everything I might send to my bank over what I think is an encrypted connection. So, somewhere, there is a datafarm with my banking information in plaintext for someone or some program to review for any perceived wrongdoing.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert!

https://www.youtube.com/watch?v=BKorP55Aqvg

faq731-376 forum1529 Entire Forum list

http://www.eng-tips.com/forumlist.cfm

 

[dik]

I keep all my separate projects on an encrypted USB stick that I use on my laptop which is not connected to the company network...

Dik