Well, we’ve had a working beta for several weeks now… but just working isn’t enough, so we have been adding features for the last few weeks. MailCloak now supports 11 email providers: Gmail, Hotmail, Live, MSN, Yahoo!, tom.com Sina, Sohu, 163, and more. We have updated our configuration page, got draft and attachment and message encryption working and stable, and whole lot more. We are now in the last phases of internal beta testing and, if all goes well, we will open our beta to the public some time next week.

Here at Global Web Security we have been working round the clock to bring our users a new, brighter, better, more functional and more interesting website. Our homepage has undergone a complete rewrite and redesign.

We’ve added a forum and tons of information about our MailCloak software (which provides strong encryption for webmail), as well as brief introductions for products that are in development: PassDancer our biometric authentication software, DriveCloak and DocCloak. In-depth documentation is coming soon!

Also MailCloak is now “open” for beta testing. Sign up here!

About MailCloak: MailCloak is Strong encryption software for Webmail. MailCloak utilizes GnuPG to encrypt email on Gmail, Yahoo! Mail, Hotmail and re em

Here at Gwebs, the makers of the world’s easiest encryption software, we’ve been hard at work on a new, completely re-written and altogether better version of WebmailSafety. So much about this product has changed that we’re even changing the name!

Gwebs WebmailSafety, which offers email encryption for Webmail and desktop clients, is now called MailCloak, and with version 3.0 on the way webmail users are in for some great surprises.

Like what?

The world’s easiest encryption software just got even easier!

Here are the basic features:

• Free!
• Automatic protection for emails and attachments.
• Supports Internet Explorer、Firefox and Outlook.
• Supports Gmail, Hotmail, Live mail, AOL Mail, Yahoo mail, 126 mail, QQ mail and 163 mail.
• Auto-update keeps you secure with the latest features and bug-fixes installed as soon as they are available.
• Simplified backup.
• Automatic Key Management.
• No Adware, Spyware, or Malware.
• Easy invitations.
• Automatic draft encryption.
• Enable/Disable with a single click.
• Supports English, Simplified Chinese, Traditional Chinese and French.

Firefox (versions 2.0 and 3.0 supported!), IE and Outlook versions for Windows will be released all at the same time, with OS X and Linux versions coming soon there-after.

The most significant change is that we have completely changed our encryption algorithm.

We have now adopted the Gnu Privacy Guard (a.k.a. GPG, a.k.a. GnuPG) for public key encryption, so now our users can email anyone who uses PGP or GPG. Users can also store their keys on PGP and GPG key servers, and they can use other GPG compatible programs with their GPG keys – like GnuPG Shell, for key management.

Also: MailCloak 3.0 features a new, completely rewritten GUI (user interface) which no longer relies on flash. FF and IE Configuration and key generation are now handled completely within the browser. Outlook has its own configuration utility.

Note: You can click on the green Gwebs icon (above) to disable MailCloak encryption.

Some more features:

• GnuPG public key encryption, the default algorithm is El Gamal 2048
• Timed Logins: leave your GPG logged in for as long as you like, or get asked for your passphrase every time it’s needed.
• Symmetrical encryption: Don’t have someone’s public key? Now you can encrypt files with a password.
• Digital Signatures: Use your private key to encrypt your digital signature. Anyone who has your public key can decrypt it.

The WebmailSafety Tour!

WebmailSafety is Gwebs new encryption product for Gmail, Hotmail, Yahoo! Mail and AOL Mail and with WebmailSafety’s new 2.0 release out yesterday, it’s high time for a walkthrough!

But first, be sure to download WebmailSafety 2.0 at www.gwebs.com!

1. The First Time You Run Gwebs WebmailSafety
2. Logging into Webmail With A Secure Browser
3. Receiving Normal Email
4. Receiving Encrypted Email
5. Sending Normal Email
6. Sending Encrypted Email
7. The Invitation Process

1. The First Time You Run Gwebs WebmailSafety.
   1. Follow the wizard to create a WebmailSafety account and bind one or more email addresses to it.
   2. When you create an account, WebmailSafety automatically generates a key pair
      (a public key and a private key,)
      and binds it to your new account.
2. Logging into Webmail With A Secure Browser.
   1. Run WebmailSafety and click on a bound email address.

   

   2. WebmailSafety launches a safe version of Microsoft Internet Explorer (The plug-in is only installed when you
      launch MSIE from within WebmailSafety) and directs it to the correct domain.

   

   3. Manually login.
3. Receiving Normal Email: It Just Works!
4. Receiving Encrypted Email: It Just Works!
5. Sending Normal Email.
   1. Go to the Gwebs icon in the Windows Task Bar and select “Disable Temporarily” so that it becomes checked.*
   2. Send email as usual.

*The WebmailSafety Tray Icon should appear inside a circle with a line through it. (like this: )

6. Sending Encrypted Email.
   1. If WebmailSafety is disabled, go to the Gwebs icon in the Windows Task Bar and select “Disable Temporarily” so that it becomes unchecked.*
   2. If attaching files be sure to enter your recipient before selecting the files, so that WebmailSafety
      knows who’s key to use when encrypting the attachments.
   3. Send email as usual.**

*The WebmailSafety Tray Icon should appear normal. (like this: )

7. The Invitation Process: If you don’t have a person’s public key.
   1. WebmailSafety will notify you that you don’t have their public key.
   2. Enter a Passphrase.

   

   3. WebmailSafety uses AES-256 Symmetrical Encryption to encrypt your email with this passphrase.
   4. WebmailSafety automatically attaches your public key and a WebmailSafety download link to this email so the recipient can easily install WebmailSafety, read, and reply to this email.
   5. Call, SMS, IM, or use some other method to tell your contact this passphrase.
   6. When the recipient replies to this email, their public key will be attached to their reply
   7. Now that you have their public key, simply send them email from the safe browser and it will be encrypted.

Well, that’s it for the walk through! Hope you enjoyed it, and don’t forget to check out www.gwebs.com for more info and new downloads!

WebmailSafety 2.0 Released!

WebmailSafety v1.0 was the world’s first public key encryption product designed for webmail from the ground up. Version 2.0 adds a host of new features designed to make webmail encryption even easier.  Download WebmailSafety 2.0 here!

New Features:

• RSA 2048 bit public key encryption for Webmail.
• Supports Gmail.com, Hotmail.com, Live.com and Yahoo.com.
• New Multi-User Interface with Avitars.
• Auto-Update.
• Tray Icon Now Provides Total Control.
• Improved Key Management.
• Improved Invitation Process.
• Improved English Language Support.
• New French Language Support.
• New Hot-Key and Desktop Integration.
• Multiple Recipient Support.
• And Many More!

And now for some screen shots!

Here is the Login screen:

Encryption From Gmail:

The Windows Tray:

File Encryption:

Auto-Update:

Now what are you waiting for? Download WebmailSafety 2.0 at www.gwebs.com!

I just read an review of a new 64 gb flash drive from Samsung on ComputerWorld.com and it got me thinking about the best way to distribute resources on a laptop. Here are some excerpts from the article, and my comments:

The no-moving-parts characteristic is, in part, what protects your data longer, since accidentally bumping your laptop won’t scramble your stored files. Samsung says the drive can withstand an operating shock of 1,500Gs at .5 miliseconds (versus 300Gs at 2 miliseconds for a traditional hard drive). The drive is heartier in one other important way: Mean time between failure is rated at over 2 million hours, versus under 500,000 hours for the company’s other drives.

….

Other specifications are equally “small”: power consumption is just 1 watt when the system is active, 0.1 watt when idle, and .06 watt in standby mode. (Equivalent power consumption figures with hard drives are 2.1, 1.5, and .2 watts, respectively.)

Flash drives will be the next big thing in laptop computing. The simple fact that they are three times more durable then platter drives is enough to make me want to lay out for one (data integrity is much more important to any business user then his/her screen, which can be replaced with minimal effort). Add to that the fact that they reduce energy consumption (thus increasing battery life), and it becomes a no-brainer for a non-media dependent person to use a flash HD.

On the other hand, many of us use massive amounts of storage for digital imaging, music, and video. These users require platter HDDs because you cant buy a 250 gb flash drive yet. (but with Moore’s law, we will have 256 gb flash drives in no time…)

Now there are two solutions to this problem (best practices) - if you are using your laptop as a digital video/photography production system, you can buy a dual hd system. Put your system on one partition (which you ghost after setting up your ideal system config) and your important word docs and the like on another (encrypted) partition on the flash drive , and then put your media files on your 250 gig platter drive (all of which you have backed up of course.)

The other (not so good) option is to carry around a minimal dataset on your laptop that is to say keep your images and video in highly compressed format for the laptop, and have them in RAW your whatever you use for uncompressed storage on some NAT drive or server (but don’t forget the sys partition and ghost… it will come in handy in the future).

Facebook, if you didn’t know already, asks you for your email address and password when you create an account, or even if you don’t. It’s a highly visible link on their homepage. The stated reason is so that you can send invite letters to your contact list. And you can’t blame the peeps for trying, right? We all gots our hustle. It’s just that Facebook’s particular hustle leaves a lot of room for doubt. It could be Facebook doing exactly what they claim to do and nothing else, or it could be that the largest data mining company in the world is applying to email what Nigerian scammers have been doing with bank accounts for years.

But it’s also a royal pain in the tuches to have to invite every one of your friends to your social networking site manually, and with the importance of social networking sites to many businesses, people in fields that require a little publicity, and people who really like attention, this is a useful feature.

Which is why this article from blogger Dragon’s Flag caught our eye. It’s not just a plug for our product (although an independent testimonial to how awesome we are it certainly is), it’s also a fantastic little piece of know-how that makes you kick yourself for not thinking of it. And so here it is, translated for your edification:

On National Day (October 1st), 2007, I created a Facebook profile, and as part of the registration process, Facebook asked for my email account and password. To test if Facebook poses a threat to social networks by doing this, I gave them my password. I can hand out my password to pretty much anyone who asks for it, but can you?

My email address is dragonflag@gmail.com, and there are over 3000 emails inside. (Facebook supports most of the major services, including gmail, hotmail, live, yahoo, aol, etc.) Before uploading my password, I changed it to 123456.

I’m a longtime user of the notable Gwebs WebmailSafety software. I have more than 50 people in my address list there, and all the email we’ve sent back and forth is stored on Google’s servers is encrypted using a RSA+AES mixed cipher. I’m definitely not worried about Facebook searching or selling my email, because they can’t understand a word of it.

So after I gave my password to Facebook, those 50-odd received their invitation letters, and after 30 minutes I changed it back. Everything was alright, and now Facebook and don’t owe each other anything, nor do we have to be concerned about one another.

I also used the same method to register at the domestic (mainland Chinese) social networking site XING.com, without any apparent danger to my privacy or data. My advice when dealing with commercial web service companies like this is not to trust them lightly. Their promises to you don’t mean a thing, and it’s never a bad idea to have some basic self-protection in place.

So take my advice, especially if you’re one of those people who haven’t invited their email contacts because you’re afraid of your email being searched or revealed.

Italicized text added by translator.

Encrypting his email, we approve of, and using our product to do it, we approve of even more. But another important step he’s taken is:

Before uploading my password, I changed it to 123456…and after 30 minutes I changed it back

This is very important, because people are often predictable when they create passwords, and even if you use “rules” to create less breakable passwords and change them regularly, if someone gets a sample or two of your work, they can figure out your formula, and you’re right back where you started. Change your password to a no-brainer before giving it to someone, and change it back as soon as possible.

The best advice here, though, is not to let a company that makes its living by selling highly specialized user data to advertisers rummage through your inbox. Using Gwebs WebmailSafety; which is free, remember; or any of the other programs on the market means that your email is safe from advertisers as well as hackers.

Cnet.com is running a news article on our fifth amendment rights entitled “Judge: Man Can’t be Forced to Divuldge Passphrase.” I thought this was noteworthy because, as I argued just last week, being forced to reveal passkeys is tantamount to self-incrimination.

One of the reasons we (yes, it’s a we now) at the Cryptographer are in this business is because we get to laugh at the messes we ourselves will never get into. Take, for example, Guo Li, a Hangzhou lawyer whose email was inadvertently “hung out to dry” online by Baidu (China’s search giant) and WanWang (one of China’s largest hosting providers). He sued for 1,000,000RMB (around $120,000), and the results speak for themselves.

I have translated the following article specifically for this blog.

Private Emails “Hung Out to Dry” for a Month, Victim Sues Baidu for
Violation of Privacy.
8-12-2007 3:35 A.M., Beijing Morning Post
After his private emails hosted in a Baidu (百度) account were posted online for more than a month, Hangzhou lawyer Guo Li (郭力) decided to sue Baidu Inc. and email services provider WanWang (万网) for 1,000,000 yuan in damages, claiming his communication privacy rights were violated. A judgment will be issued tomorrow at the Haidian District Court on this so-called “national precedent-setting email privacy case.” Guo Li stated at the conclusion of the trial, “It’s entirely possible to look into other people’s inboxes online, I’ve searched the information myself. This won’t be the last trial of this type.”

Read the rest of this entry »

Two news stories caught my attention this weekend. The first, “Wider Spying Fuels Aid Plan For Telecom Industry,” [NyTimes.com] is a great article describing the state of the NSA wiretapping investigation.  Most of my readers will have heard of the secret room at AT&T’s San Franscisco offices, which was built to mirror ALL of the data going into and out of AT&T. But the reporter for this excellent article turns up a ton of new information.

The N.S.A.’s reliance on telecommunications companies is broader and deeper than ever before, according to government and industry officials, yet that alliance is strained by legal worries and the fear of public exposure.

To detect narcotics trafficking, for example, the government has been collecting the phone records of thousands of Americans and others inside the United States who call people in Latin America…. The program dates to the 1990s, according to several government officials, but it appears to have expanded in recent years.

Terror, the government’s (not very good) excuse for renegigng on the 4th amendments promises of personal security, has nothing to do with drug trafficking.

In addition the article points to some further previously unknown facets of the government’s spying. A dedicated fiber optic cable mirroring all of Verizon’s traffic appears to have been uncovered during lawsuit depositions.

[what the accusing Verizon employee saw] “was decisive evidence that within two weeks of taking office, the Bush administration was planning a comprehensive effort of spying on Americans’ phone usage.”

The same lawsuit accuses Verizon of setting up a dedicated fiber optic line from New Jersey to Quantico, Va., home to a large military base, allowing government officials to gain access to all communications flowing through the carrier’s operations center. In an interview, a former consultant who worked on internal security said he had tried numerous times to install safeguards on the line to prevent hacking on the system, as he was doing for other lines at the operations center, but his ideas were rejected by a senior security official.

It doesnt say why his safeguards were rejected, but if the government is viewing all our telecommunications, that is bad enough - if they are negligently making that information available hackers, that is an even grater cause of concerns.