End to End Encryption in 10 minutes -

2. How does email work? • Your inbox is hosted on an email server • These servers are inter-connected • Email messages are stored and processed in clear text (or not?) • You are connecting to these using Wi-Fi, your ISP, and network cables

4. The internet is not a safe place • Lots of computers connected together • Using protocols designed in the 70s, by scientists and military • Expected to be used by max 1000 users • No security implemented by design • Imagine 100 people gatecrashing a house party with no locks on the doors!

5. You are receiving a postcard • Can your mailman read your postcards? • Can the van driver read your postcards? • Can your neighbours access your PO box? • Can they ask your landlord for a key, forge one? • Can they give it to a private detective? • Is the sender the person they claim to be?

6. Emails V Postcards • Email address = Personal Post Box • Email message = Postcard • Email servers = Post office • Wi-Fi / ISP = Mail Van Drivers

7. Threats Diagram

8. • Communication security over a network • Encrypting communications on a network (previously called SSL) • The van driver cannot access the content in the mail bag (but your mailman can) • Gmail & Facebook provide TLS (HTTPS) however … Transport Layer Security

9. Threats Diagram

10. End-to-End Encryption • Put your postcard in a safe and send the safe via email • Each safe has a special lock that only you and your recipient can trigger • You need to exchange keys in order to send messages to each other • Anyone without the key is unable to open it

11. Each user has a pair of keys. • Public Key : to be shared with recipients • Private Key : to be kept in a safe place. No one else has access to it

12. Threats Diagram

13.

14. Why is this important • Protecting against cyber threats • If an attacker gains access to your inbox, they cannot read your messages • Protecting personal privacy from increasing surveillance systems • Your recipient knows you are the genuine sender (your key is private)

15. E2EE in the news • Whatsapp rolling out E2E encryption for 1 billion users • Snowden was using PGP to communicate with Laura Poitras and The Guardian

16. Thank you for your time • Questions, comments? • Contact me – thomas@seropian.io – PGP Key : 0xfc944ab6 • Slides – http://seropian.io/assets/files/e2ee.pdf

17. Further reading • Security In A Box • EFF’s Security Self Defense • Digital First Aid Kit • CPJ’s Journalist Security Guide

Notas do Editor

Let me explain to you how E2EE is working, and why it does matter. I will take email communications as example but the concept is the same wether we talk about encryption on mobile phone apps (such as Whatsapp) and servers communications.
First a reminder on how emails are working. Your inbox is hosted on a server (could be Gmail, you corporate infrastructure of your own server) These servers are communicating with each other (using standards protocols – you might have heard of SMTP). Your emails are processed by all sort of algorithms and you are connecting to them using your local ISP, your corporate network or the local coffee shop.
Here is a visual illustration. You are sending a message to your receipient, connecting to Gmail using your wifi and local ISP. Your recipient connects to his mailbox from his end using the same way.
At this stage, it is also important to remind you that Internet is not a safe place. Internet as we know it relies on protocols which were designed in the 70s by a bunch of scientists and military who were expected maximum 1000 people to use it. They had no idea about adding security by default. 40 years later, 3 billions people are using the same protocols. Imagine a hundred people crashing a house party with no locks on the door. You may want to be careful  Let’s have a look more specifically at emails communications
Imagine you are receiving a postcard from a friend. What security threats can we think of? How can you make sure your mailman does not read your postcard? How can you make sure the truck driver does not open the mailbag? How can your make sure your neighbours/someone else, don’t pick the lock to get access to your private post box? How can you guarantee the sender is who they claim to be? These real life situation can be found very similar equivalent online.
Sending emails is like sending postcards.
Let’s go back to our illustration As you can see threats can come at any point of the email chain. A the server level and any node of the transport chain. Using no protection, anyone snooping on your Wi-Fi or at your ISP level can read your emails at anytime. Who can see it??? Network administrator on the local Wi-Fi System administrator / Government at ISP level System administrator / Hacker at the Email server level
Since the late 90s, additional protocols have been put in place to help safe guard the Internet. TLS for transport layer security (formerly known as SSL) ensure encryption between 2 points of the network, in our case the user and their email inbox. Basically truck drivers are not able to open mails while transporting big bags but your providers still can. For example Gmail and Facebook provide full HTTPS but can still read your messages. Here is another illustration, green arrows are popping out.
So here is another illustration. With TLS all the communications betweem user and email servers are secure. However anyone who gains access to the sender or the recipient inbox can read their emails.
E2EE brings an additional layer of encryption. E2EE is equivalent of putting your message in a locked safe and sending the safe by email. This safe can olny be open by keys that only you and your recipient own. Anyone else won’t be able to open it. For example only you and your recipient can read encrypted emails, Gmail cannot..
Any user who want to send encrypted messages has 2 keys. A public one and a private one. Alice wants to send an encrypted message to Bob. Alice asks Bob’s public key. Alice uses her private key and Bob’s public key to close the lock. Bob uses his private key to open it. Anyone else without Bob’s private key cannot read it.
Now it is all green everywhere.
And here is an example of an encrypted email.
If you are using whatsapp you may have noticed that they deployed E2EE for their application. Also, if you followed NSA snowden leaks news a couple of years ago, you may have heard that he was using the exact same type of encryption.
Thank you for your time. My practical exercise will consist of creating each of us a pair of key and send encrypted messages. Let me know if you have any question. B

End to End Encryption in 10 minutes -

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Destaque

Destaque (20)

Semelhante a End to End Encryption in 10 minutes -

Semelhante a End to End Encryption in 10 minutes - (20)

Último

Último (20)

End to End Encryption in 10 minutes -

Notas do Editor