Facebook's outmoded Web crypto opens door to NSA spying

Secret documents describing the National Security Agency's surveillance apparatus have highlighted vulnerabilities in outdated Web encryption used by Facebook and a handful of other U.S. companies.

Documents leaked by former NSA contractor Edward Snowden confirm that the NSA taps into fiber optic cables "upstream" from Internet companies and vacuums up e-mail and other data that "flows past" -- a security vulnerability that "https" Web encryption is intended to guard against.

But Facebook and a few other companies still rely on an encryption technique viewed as many years out of date, which cryptographers … Read more

Data, meet spies: The unfinished state of Web crypto

Revelations about the National Security Agency's surveillance abilities have highlighted shortcomings in many Internet companies' security practices that can expose users' confidential communications to government eavesdroppers.

Secret government files leaked by Edward Snowden outline a U.S. and U.K. surveillance apparatus that's able to vacuum up domestic and international data flows by the exabyte. One classified document describes "collection of communications on fiber cables and infrastructure as data flows past," and another refers to the NSA's network-based surveillance of Microsoft's Hotmail servers.

Most Internet companies, however, do not use an privacy-protective encryption technique … Read more

Review: Secure folders easily through encryption with Espionage

Espionage for Mac adds basic security to file folders in a streamlined application. The program comes with a free trial version with a 14-day use limit.

After an easy installation, Espionage for Mac opens a setup assistant that prompts the user to enter a master password. The application rates it for its level of security, and encourages the user to enter those that have additional characters. After passing this screen, the program asks the user to enter the password one additional time to start the application. This brings up a small window where the user can drag and drop folders … Read more

How to secure files from other users on external disks

If you use an external disk drive with OS X, you may notice that when it is mounted, it becomes available for all users on the system. Therefore, if you have files you have saved to a USB drive and you attach it to your system and you switch user accounts, those files will be viewable within the second account.

In addition, if you have network file sharing enabled, the files on this drive will be accessible to any user who logs in via the network.

This behavior may seem a bit concerning, especially for those who have set up … Read more

Insignificant bug keeps encrypted disks unlocked after ejecting in OS X

Apple's CoreStorage disk encryption technology has a small bug that will keep a disk unlocked, even after it has been ejected from the system.

In OS X Lion, Apple introduced a drive management technology called CoreStorage. When enabled, CoreStorage will create a "logical volume group" out of one or more physical drive partitions, and then create usable "logical volumes" from this group to serve as storage for your system. This setup allows the logical volume to span multiple physical partitions (as is seen with Apple's Fusion Drive), and support features like encryption for Apple'… Read more

Review: Cosmos System Care Free scans your computer for any problems

Cosmos System Care Free is touted as your all-in-one maintenance tool to keep your computer system healthy and clean. Indeed, when you first download the program, you are offered the chance for an immediate scan. However, while this program seems to be wide in scope, the free version only offers to scan your computer for problems; it doesn't fix them.

Cosmos System Care Free took more than 35 minutes to download, extract, and install on a dual processing system. The program scans for security problems including privacy issues, includes a file decryptor and encryptor, and backs up or restores … Read more

Judge: Child porn suspect doesn't need to decrypt files

Jeffrey Feldman has won a reprieve from a federal court order that had given him until Tuesday to decrypt his hard drives for the FBI -- or face contempt of court.

A federal judge in Wisconsin today granted an emergency motion filed by Feldman's attorney for additional time to establish that her client's Fifth Amendment right to self-incrimination would be violated.

U.S. District Judge Rudolph Randa lifted the threat of contempt of court and jail time, at least temporarily, and asked for additional briefs from Feldman's attorney and Justice Department prosecutors. A hearing is likely to … Read more

How to change an encrypted volume's password in OS X

With data security being an all-too-common concern, the options for encrypting data in OS X are welcome additions that are quite easy to implement. While you can store files in an encrypted disk image, you can also use FileVault to encrypt your boot drive. Furthermore, you can encrypt or decrypt any secondary volume by right-clicking it and choosing the option to do so, or by using the Terminal.

These features are convenient, but if you wish to change the password for an encrypted drive, you will find that this feature is not available along with the options for encrypting. You … Read more

How to encrypt one volume on a drive in OS X

Encrypting data is a convenient method for keeping your data secure, especially when using external hard drives and thumbdrives that may be stolen or lost. While it might be easiest to encrypt an entire drive, sometimes doing so may be a touch inconvenient, especially if the drive is used for more than one purpose.

For instance, if you keep sensitive files on your drive, you may wish to keep it encrypted; however, this prevents you from sharing the drive with others. Therefore, if you want to use the drive to transfer files to another system, you will have to authenticate … Read more

Free services make Gmail, Google Drive, Google search more private

It's no secret that any information you provide to a Google service is no secret.

When Google changed its terms of service last year, the company granted itself and any other company it chooses complete, unfettered access to anonymized (we hope) versions of all the messages you send and receive via Gmail, all the files you upload to Google Drive, and all the terms you enter in the Google search box.

As CNET's Rafe Needleman reported in April 2012, Google's rights go beyond simply perusing your personal information. Google's terms of service include the following:

When … Read more