Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[guest]

The Register is reporting that an animal rights activist has been "requested" to hand her encryption keys over to the police/CPS. It doesn't appear to be a formal Section 49 request but I'm sure one of those will be forthcoming.

Full story :

http://www.theregister.co.uk/2007/11/14/ripa_encryption_key_notice/

Now I'm no great fan of animal rights activists but given all of RIPA is now activated this is a wakeup call to everyone - if your current encryption solution doesn't have some form of plausible deniability built in (hidden containers/multiple layers of encryption etc) then it is now totally useless in the UK. Don't anyone bother coming out with the old chestnut of "If you've got nothing to hide...." either as if you don't have something to hide then why are you using encryption? Make damn sure you delete old containers securely too as if it is recovered years later and you can't remember the key then plod can send you to prison for 2 years if they choose - 5 years if they think you're a terrorist.

Not a good week for encryption solutions using Windows random number generator to seed the key either :

http://www.theregister.co.uk/2007/11/13/windows_random_number_gen_flawed/

Hard to see how this can be anything other than a deliberate weakening of encryption by MS - speculate on the reasons yourselves.

Time to review your encryption solutions and make sure you're happy with them peeps

[roseway]

It makes me go cold to think about it. I keep all sorts of private information encrypted for completely innocent purposes - bank account details, registration details for various services, and so on. If the police were to gain access to this information I doubt very much that it would remain secret very long, and where would that leave me?

[guest]

Phonebook Eric

http://www.freenet.org.nz/phonebook/manual.html

Edit - although I note the manual still refers to SHA1 hashing which is known to be vulnerable to a non-brute force attack. Not very vulnerable right enough, but most people have moved on to SHA256 at least.

[roseway]

Gosh, thanks rizla, that looks just like what I need.

[kitz]

Reading the article on the MS encryption I couldnt help but laugh at this

/guaranteed to return a random number

public int random() {

// decided by fair dice roll

return 6;

}