Link

European datacenter is no solution, recent developments show

NextCloud’s blog has an overview of where things seem to go with US companies storing data on European servers. (Hint: “Trump”).

Many Software-as-a-Service companies from abroad are currently setting up European data centers, often together with European partners. With this, they hope to ease the growing European concerns around privacy, data protection and complying with existing and upcoming regulations like the EU General Data Protection Regulation (GDPR). But recent developments in US courts show this to be a risky proposition: the problem of privacy is far from resolved by ‘just’ putting data in Europe. For companies betting on Privacy Shield, using services from US companies directly or through an intermediary storing data in Europe, all this is very bad news.

Source: European datacenter is no solution, recent developments show – Nextcloud

Link

Ethereum Hacks

My reservation with block chains and crypto currencies: they disempower the ordinary person (or user)… instead of the Bad Guy On The Corner taking your wallet, now anyone anywhere can steal all your money, and you might not even notice it at first.

The press is reporting a $32M theft of the cryptocurrency Ethereum. Like all such thefts, they’re not a result of a cryptographic failure in the currencies, but instead a software vulnerability in the software surrounding the currency — in this case, digital wallets.

[…]

This is my concern about digital cash. The cryptography can be bulletproof, but the computer security will always be an issue.

Source: Ethereum Hacks

Link

How easy is it to securely leak information to some of America’s top news organizations?

Good to spread the manual… leaking is pretty much a “standardised process” by now:

One quick download and a codename: If I can use SecureDrop, you can do it too.

Source: How easy is it to securely leak information to some of America’s top news organizations? This easy » Nieman Journalism Lab

They link to a video explaining the same thing:

Link

Class Breaks

Bruce Schneier on the different way most online risks works:

In a sense, class breaks are not a new concept in risk management. It’s the difference between home burglaries and fires, which happen occasionally to different houses in a neighborhood over the course of the year, and floods and earthquakes, which either happen to everyone in the neighborhood or no one. Insurance companies can handle both types of risk, but they are inherently different. The increasing computerization of everything is moving us from a burglary/fire risk model to a flood/earthquake model, which a given threat either affects everyone in town or doesn’t happen at all.

Source: Class Breaks

Link

Project Wycheproof: unit-testing cryptography

Using a unit-testing approach in cryptography. Somehow I had expected this to be common practice already, but it obviously includes quite a bit more knowledge, research and effort:

We’re excited to announce the release of Project Wycheproof, a set of security tests that check cryptographic software libraries for known weaknesses. We’ve developed over 80 test cases which have uncovered more than 40 security bugs (some tests or bugs are not open sourced today, as they are being fixed by vendors). For example, we found that we could recover the private key of widely-used DSA and ECDHC implementations.

Source: Google Online Security Blog: Project Wycheproof