Security at the Mercy of Advertising


Yahoo’s latest move is yet another example of the tension between end-user security and the online advertising ecosystem.

Last year, Yahoo announced plans to enable encryption by default as a direct response to a story that Barton Gellman and I wrote about the NSA’s collection of millions of address books globally.  One of the slides we referenced in that story indicated that the NSA was collecting substantially more addresses from Yahoo than the other providers (444,743 from Yahoo vs. 105,068 from Hotmail or 33,697 from Gmail). These figures make sense given that, at the time, Yahoo was still not using default encryption for their front-end webmail users, let alone their back end email delivery (something I’ve written about previously).

Today, Yahoo announced they’ve made progress on their encryption plans with the help of former iSec Partner’s cofounder, and information security guru, Alex Stamos.  As Alex’s first post as Yahoo CISO indicates: [Read more…]

Apple’s #gotofail weekend


In case you spent your weekend watching closing ceremonies and not reading tech news, there was a lot of buzz around a security problem in Apple products. On Friday, Apple released an emergency update for iOS7 that fixed a severe vulnerability in their SSL/TLS implementation on the iPhone.

For those who are not technically inclined, SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are the encryption protocols underlying, among many things, the little lock icon you see in the upper right corner of your browser. This encryption protects you from eavesdroppers when logging into any secure site, like your bank account. It also protects you from actors like the NSA (and other governments) scooping up your emails in bulk when you’re … well … anywhere. After Apple released the emergency update for iPhone, security firm CrowdStrike examined the patch and reverse engineered the vulnerabilities it was addressing, only to find out that it repaired some pretty significant parts of the iPhone operating system. They also found that the same vulnerability exists in Apple’s OS X operating system meaning that the problem extends to Mac OS X laptops/desktops, not just iPhones. [Read more…]