Gwebs Cryptographer

Almost every week I can read news about smaller or bigger scandals about passwords or private data exposures. What’s wrong with today’s users ? Lack of common sense or are people just getting more and more stupid ? So many times I have faced these situations that someone is asking my email address and password, just for checking my address book. Or then the Microsoft Messenger trick “See who have blocked you from their MSN”. Or the one with credit card number “So many credit card numbers are exposed, check if your one is on the list”.

Come on, how easy can average user really be ?
I really think that people are getting more and more reliable on internet and all the services, but they really cannot see that there are also thiefs and other “bad people” around. So many of us are thinking that of course it’s safe, because it’s somehow related to service what user is using. But at the same time on the streets when someone is humbly asking to borrow their phone they get scared that the person will steal it or use it for illegal activities. Why this question never comes into their minds when acting in internet ?

At this time, a bit more than a week ago, Google’s Gmail and Yahoo’s Mail were also targeted by a large-scale phishing attack, perhaps the same one that harvested at least 10,000 passwords from Microsoft’s Windows Live Hotmail, according to a report by the BBC.

The BBC also said it has seen a list of some 20,000 hijacked e-mail accounts; the list included accounts from Gmail, Yahoo Mail, AOL, Comcast and EarthLink. The latter two are major U.S. Internet service providers.

I assume that when people are reading these news, they are first over sensitive, maybe one week, after that paying attention what they do online and where they use their passwords, max. one month. And after this, they start acting like before. Maybe that one month they haven’t seen any progress of safety or increased privacy, so “it’s okay to continue the old style, no-one is interested about MY emails and passwords“. But this way of thinking is just that what might lead to scandals. Everyone’s email account is interesting, not necessarily the emails or the content itself, but all Your addresses, contacts, your passwords and login info for everywhere else, because still on these days normally the login infos are posted to one’s email, when starting to use new services.

And also one other thing, which I think is very important here, is that so many users used to use same passwords for different places. I know by myself, that it will be very difficult to remember all the passwords if they are just randomly made. For example 20 passwords for tools at work, 5 for your own emails, 20 for other services online (social networks, online banking, bookstores, games, etc.) And I’m not encouraging people to write them down, but just inventing some patterns to remember them or then using some other tools for securing all those passwords. I know that there are so many nice software available, which are taking care of your passwords, but for me, I don’t know can I trust them or not.

Here are links for more information about this scandal:
http://www.infoworld.com/d/security-central/gmail-and-yahoo-mail-passwords-exposed-737
http://www.techradar.com/news/internet/exposed-the-great-password-scandal-596064
http://www.computerworld.com/s/article/9139000/Gmail_Yahoo_Mail_join_Hotmail_passwords_exposed

Here is nice collection of hints and tips for boosting online security:
http://www.techradar.com/news/internet/10-easy-ways-to-boost-your-online-security-591191

Security, email, google, personal, privacy AOL, BBC, email, gmail, Hotmail, Internet Security, microsoft, MSN Live!, privacy, Yahoo! Mail

One of the reasons we (yes, it’s a we now) at the Cryptographer are in this business is because we get to laugh at the messes we ourselves will never get into. Take, for example, Guo Li, a Hangzhou lawyer whose email was inadvertently “hung out to dry” online by Baidu (China’s search giant) and WanWang (one of China’s largest hosting providers). He sued for 1,000,000RMB (around $120,000), and the results speak for themselves.

I have translated the following article specifically for this blog.

Private Emails “Hung Out to Dry” for a Month, Victim Sues Baidu for
Violation of Privacy.
8-12-2007 3:35 A.M., Beijing Morning Post
After his private emails hosted in a Baidu (百度) account were posted online for more than a month, Hangzhou lawyer Guo Li (郭力) decided to sue Baidu Inc. and email services provider WanWang (万网) for 1,000,000 yuan in damages, claiming his communication privacy rights were violated. A judgment will be issued tomorrow at the Haidian District Court on this so-called “national precedent-setting email privacy case.” Guo Li stated at the conclusion of the trial, “It’s entirely possible to look into other people’s inboxes online, I’ve searched the information myself. This won’t be the last trial of this type.”

Read more…

Security, email, encryption, government, law, personal, privacy Baidu, email, email server, Internet Security, law, lawyer, privacy, search engine, Wanwang, 万网, 晒, 海淀区, 百度, 郭力, 金道律师事务所

Yesterday’s news of Hushmail.com passing information to the US Government is alarming to most people who consider privacy important. We use encryption to protect our privacy against industrial spies, nosy intruders, and hackers; but most importantly, we use encryption to protect ourselves against governments, which are becoming more and more nosey.

Read more…

PGP, Security, email, government, personal, privacy Internet Security, privacy