My friend Hubert has started compiling statistics of Alexa's top 1 million websites. Specifically, he's looking at their SSL/TLS settings and attempting to show trends in the world that is port 443. He recently released his May numbers showing a slow but mostly improving security environment. I'm hoping he'll …
read moreOther articles
STARTTLS for SMTP
Okay, I don't really mean to advocate this as a privacy solution because it is and it isn't. If you truly want privacy of your email you mustuse end-to-end encryption like PGP/GnuPG or S/MIME. That said, I think it's good to encrypt things, even ciphertext, over the …
read moreTrusting Trusted CAs
Like it or not, the basis of trust for much of the Internet is based on Certificate Authorities (CA). Companies like Verisign, GoDaddy, and GeoTrust are in the trust business. They will sell you cryptographic proof of your Internet assets (namely your domain name) that others can use to verify …
read moreSFGate: If You Send To Gmail, You Have 'No Legitimate Expectation Of Privacy'
SFGate: If You Send To Gmail, You Have 'No Legitimate Expectation Of Privacy'
Not that this is really news but if you hand your message to a third-party for delivery you have no expectation of privacy. Agree with it or not that's the way it is inside the United States …
read moreThe Police State: History repeats itself.
If you've done any reading of 20th century European history then this story will seem familiar. Back then there were places where you had to be careful about what you said to whom. It could really be anything you said to any number of people including close friends, family members …
read moreTor and HTTPS
An excellent description of how Tor and HTTPS can help protect your online privacy and secure your web communications.
read moreLawmakers of both parties voice doubts about NSA surveillance programs
Lawmakers of both parties voice doubts about NSA surveillance programs
I'm happy to read the Washington Post story discussing the House committee's hearing on the NSA's domestic spying programs. It's encouraging that both parties aren't happy with the programs and that "...there are not enough votes in the House now …
read morePrivacy articles to read
Why Privacy Matters Even if You Have 'Nothing to Hide' by The Chronicle Review
Using Metadata to Find Paul Revere by Kieran Healy
We Should All Have Something To Hide by Moxie Marlinspike
read moreSecure GnuPG configuration
Someone recently asked what my GPG.conf file looks like since he hadn't updated his in... years. Okay, let's take a look and I'll try to explain what each setting is and why I feel it is important. I'm not guaranteeing this as being complete and I welcome input from …
read moreInadvertant data leakage from GnuPG
I was recently introduced to a privacy issue when refreshing your OpenPGP keys using GnuPG. When refreshing your public key ring using a public key server GnuPG will generally use the OpenPGP HTTP Key Protocol (HKP) to synchronize keys. The problem is that when you do refresh your keys using …
read moreThe Guardian: I'd pay more for tech products with greater privacy from surveillance
The Guardian: I'd pay more for tech products with greater privacy from surveillance
I thought this was a fantastic article. It skims over the fact that if you aren't paying for a service then you are probably the product being sold. Google, Facebook, and many other companies make billions of …
read morePrivacy Upgrade: Encrypted Internet browsing
Many websites have both the traditional, unencrypted HTTP and the SSL or TLS-encrypted HTTPS addresses available to access their content. Wikipedia is one good example of this functionality. You can easily view Wikipedia using traditional HTTP protocol but if you wanted or needed a little more privacy the HTTPS …
read moreProposed encryption "backdoor" for the US Government and how it will fail.
If you haven't heard, the President is drafting legislation that may require hardware and software developers to install backdoors in their encryption solutions and give the keys to these backdoors to the US Government. In my opinion, this is an increadibly bad idea.
- This has already been tried and failed …
HTTPS-Everywhere
The other day I found myself reading about a new Firefox plugin that will automatically select HTTPS for various websites (and you can make your own rules, too). The plugin, created by the EFF, is named HTTPS Everywhere.
Basically it knows that there are several popular websites out there that …
read morePrivacy risk in your email client?
read moreThat was a switch in my email client Thunderbird 3 that I did not have checked because I wasn't sure what it was doing and I certainly didn't want my Inbox to be cleared every time I exited the software. So I decided to do a search for it to …