WhatsApp has announced that all users will soon be able to store end-to-end encrypted backups of their chat history on Google Drive in Android or Apple iCloud in iOS.

The Facebook-owned company, which boasts two billion users who send over 100 billion messages a day, said that the move makes WhatsApp the first global messaging service at this scale to offer end-to-end encrypted messaging and backups.

WhatsApp's introduction of end-to-end encryption (E2EE) will provide users with the ability to secure their backed up message history stored in the cloud.

While WhatsApp messages have been encrypted since 2016, the app hasnt offered end-to-end encryption of backups, which rely on iCloud or Google Drive.

This lack of encryption on the backed-up messages created a security loophole exploitable by parties ranging from law enforcement agencies to unintended malicious third parties.

But with the latest update, users will be able to opt-in to end-to-end encryption for their backups before those backups hit their cloud storage service.

Users can expect the update in the coming weeks, according to the company.

For years, in order to safeguard the privacy of peoples messages, WhatsApp has provided end-to-end encryption by default so messages can be seen only by the sender and recipient, and no one in between.

Now, the platform is planning to give people the option to protect their WhatsApp backups using end-to-end encryption as well.

People can already back up their WhatsApp message history via cloud-based services like Google Drive and iCloud. WhatsApp does not have access to these backups, and they are secured by the individual cloud-based storage services. But, while WhatsApp doesn't have access to those backups, Apple and Google potentially do.

But now, if people choose to enable end-to-end encrypted (E2EE) backups once available, neither WhatsApp nor the backup service provider will be able to access their backup or their backup encryption key.

WhatsApp users will have to opt in to the new feature which will soon begin rolling out.

To enable E2EE backups, WhatsApp developed an entirely new system for encryption key storage that works with both iOS and Android.

With E2EE backups enabled, backups will be encrypted with a unique, randomly generated encryption key. People can choose to secure the key manually or with a user password.

When someone opts for a password, the key is stored in a Backup Key Vault that is built based on a component called a hardware security module (HSM) specialised, secure hardware that can be used to securely store encryption keys.

When the account owner needs access to their backup, they can access it with their encryption key, or they can use their personal password to retrieve their encryption key from the HSM-based Backup Key Vault and decrypt their backup.

The HSM-based Backup Key Vault will be responsible for enforcing password verification attempts and rendering the key permanently inaccessible after a limited number of unsuccessful attempts to access it. These security measures provide protection against brute-force attempts to retrieve the key. WhatsApp will know only that a key exists in the HSM. It will not know the key itself.

The move arrives as Facebook faces scrutiny over its privacy polices for the messaging service. Earlier this week, ProPublica published a report highlighting how contract workers sift through millions of private messages that have been flagged by users as potentially abusive.

The nonprofit investigative organisation subsequently made clear that WhatsApp doesnt break the end to end encryption.

Read more:
WhatsApp is finally allowing users to encrypt chat backups uploaded to iCloud and Google Drive - Buzz.ie

Company leaders are continually looking for ways to keep data safe without compromising its usability. Fully homomorphic encryption (FHE) could be a step in the right direction.

Fully homomorphic encryption allows the analyzing and running of processes on data without needing a decryption method. For example, if someone wanted to process information in the cloud but did not trust the provider, FHE would allow sending the encrypting data for processing without providing a decryption key.

Read more: Creating a Cloud Strategy: Tips for Success

FHE is like other encryption methods that require using a public key to encrypt the data. Only the party with the correct private key can see the information in its unencrypted state. However, FHE uses an algebraic system that allows working with data without requiring decryption first. In many cases, information is represented as integers, while multiplication and addition replace the Boolean functions used in other kinds of encryption.

FHE uses an algebraic system that allows working with data without requiring decryption first.

Researchers first proposed FHE in the 1970s, and people became interested back then. However, it has taken substantial time to turn these concepts into feasible real-world applications.

A researcher showed it was plausible with his 2009 published study. However, working with even a tiny amount of data proved too time-intensive. Even now, FHE can require hundreds of times more computing power than an equivalent plaintext data operation.

Data is at a higher risk of becoming compromised when its not encrypted. FHE keeps the information secure by not requiring decryption to occur for processing to happen.

In one recent example, Google released an FHE-based tool that allows developers to work with encrypted data without revealing any personally identifiable information (PII). Googles blog post on the subject gave the example of FHE allowing medical researchers to examine the data of people with a particular condition without providing any personal details about them.

Encryption takes private information and makes it unreadable by unauthorized third parties. However, something that makes people particularly excited about FHE is that it eliminates the tradeoff between data privacy and usability, making both present at a high level.

Read more: Data Collection Ethics: Bridging the Trust Gap

Many people familiar with FHE and its potential applications agree that it seems safer than other methods of data protection, which require decrypting data for processing. It could be particularly widely embraced in certain sectors. After all, cloud computing brings in $250 billion per year.

Experts believe FHE will emerge as a compelling option in tightly regulated industries.

People are continually interested in how to keep their data safe when stored in the cloud. Some experts also believe FHE will emerge as a compelling option in tightly regulated industries because it could become a better safeguard against breaches.

Past solutions to either completely anonymize data or restrict access through stringent data use agreements have limited the utility of abundant and valuable patient data, IBM notes on its site. FHE in clinical research can improve the acceptance of data-sharing protocols, increase sample sizes, and accelerate learning from real-world data.

Fully homomorphic encryption could forever change how companies use data. Thats crucial, especially considering how many businesses collect it in vast quantities at a time where many consumers feel increasingly concerned about keeping their details safe.

For example, FHE allows keeping information in an encrypted database to make it less vulnerable to hacking without restricting how owners can use it. That approach could limit an organizations risk of regulatory fines due to data breaches and hacks.

It also permits secure data monetization efforts by protecting customers information and allowing services to process peoples information without invading privacy. In such cases, individuals may be more forthcoming about sharing their information, knowing in advance that business representatives cannot see certain private aspects of it.

Using an FHE-based solution also enables sharing data with third-party collaborators in ways that reduce threats and help the company providing the information comply with respective regulations. Thus, this kind of encryption could support research efforts where people across multiple organizations need to work with sensitive content.

Read more: Data Analytics vs Data Science: Whats the Difference?

Fully homomorphic encryption is not widely available in commercial platforms yet. However, some companies offer products based on homomorphic encryption that could eventually work for the use cases discussed earlier.

For example, Intel has such a product that allows segmenting data into secure zones for processing.Similarly, Inpher offers a product with an FHE component. It primarily uses secure multiparty computation, but applies FHE to certain use cases.

IBM says FHE is now adequate for specific use cases.

Beyond those examples, IBM has a fully homomorphic encryption toolkit that it released for iOS in 2020. That progress primarily occurred after IBMs experts took it upon themselves to make FHE more commercially feasible, addressing the time and computing power that it previously took to use this type of encryption.

The companys representatives say FHE is now adequate for specific use cases and suggested the health care and finance industries as particularly well suited to it.

Since FHE is not widely available via commercial platforms yet, interested parties should not expect to start using it immediately. However, that could change as organizations become increasingly concerned about striking the right balance between data security and usability.

The ideal strategy for businesses to take now is to explore the options currently on the market. They can then determine if any of those options check the boxes for helping them explore fully homomorphic encryption, including what it might do in the future and what capabilities exist now.

Read next: AI vs Machine Learning: What Are Their Differences & Impacts?

Read this article:
What Is Fully Homomorphic Encryption (FHE)? - CIO Insight

The British government has expressed support for Apples now-delayed CSAM scanning plans, and says that it wants the ability to scan encrypted messages for CSAM, even where end-to-end encryption is used.

The country is offering to pay anyone who can find a way to keep children safe in environments such as online messaging platforms with end-to-end encryption

Home Secretary Priti Patel made the announcement, which included support for Apples plans.

Recently Apple have taken the first step, announcing that they are seeking new ways to prevent horrific abuse on their service. Apple state their child sexual abuse filtering technology has a false positive rate of 1 in a trillion, meaning the privacy of legitimate users is protected whilst those building huge collections of extreme child sexual abuse material are caught out. They need to see though that project.

But that is just one solution, by one company, and wont solve everything. Big Tech firms collectively need to take responsibility for public safety and greater investment is essential. Today I am launching a new Safety Tech Challenge Fund. We will award five organisations from around the world up to 85,000 each to develop innovative technology to keep children safe in environments such as online messaging platforms with end-to-end encryption.

She repeats the governments oft-expressed objection to end-to-end encrypted messaging, and attempts to imply that it is a new plan, rather than something that has been used for many years by services like iMessage, FaceTime, WhatsApp, Telegram, and Signal.

Your messages are already encrypted as they travel from your device to a technology companys systems. End-to-end encryption takes this further, so that neither the platform operator nor police can see the content even when its essential for safety reasons that they do so []

The introduction of end-to-end encryption must not open the door to even greater levels of child sexual abuse but that is the reality if plans such as those put forward by Facebook go ahead unchanged.

The reality here is that Facebook Messenger is the only major messaging platform that doesnt already offer E2E encryption as standard, and even that allows some users to enable it via the Secret Conversations feature. Facebooks plans to make this standard is simply catching up with the industry standard for private messaging.

The governments call for help is vaguely worded, and offers a maximum of 85k ($117K) to each successful applicant.

The Fund will award five organisations from around the world up to 85,000 each to develop innovative technology to keep children safe in environments such as online messaging platforms with end-to-end encryption []

Applications open today, with a deadline of 6 October. The Fund will run for five months from November 2021. Technologies will be evaluated by independent academic experts.

Apple was somehow taken by surprise by widespread objections to its own plans, and now says that it will take additional time to make privacy improvements.

Stock photo:Andrej Liakov/Unsplash

FTC: We use income earning auto affiliate links. More.

Check out 9to5Mac on YouTube for more Apple news:

See the original post here:
UK government backs Apple, and wants to scan encrypted messages for CSAM - 9to5Mac

06 September 2021 | Alan Burkitt-Gray

Traditional PKI methods of encrypting data are about to fall to the onslaught of quantum computing. Arqit, a start-up led by David Williams thinks it has a quantum-based solution, he tells Alan Burkitt-Gray

A start-up company that is expected to be valued at US$1.4 billion by the end of August is launching its quantum-based telecoms encryption service in the middle of July. Arqit, founded by satellite entrepreneur David Williams, is launching QuantumCloud, a platform-as-a-service (PaaS) for telecoms, including consumer, industrial and defence internet of things (IoT), he tells me.

Early customers, including BT and other telcos that he doesnt want to name, have already signed contracts and used the cyber security software, but Arqit is likely to be thrust into greater prominence imminently, when a Nasdaq-listed special purpose acquisition company (Spac) buys it in a deal that will value it at $1.4 billion.

Williams and a small number of co-founders will own 45%, he tells me a stake that will be worth $630 million to him and his colleagues.

A former banker, Williams, who is now chairman of Arqit, was founder and CEO of Avanti, a UK-based company that runs a fleet of geostationary satellites called Hylas with government, military and commercial customers. He left Avanti in August 2017 and a month later set up Arqit.

Being the founder of two satellite companies is a pretty remarkable record after seven years working for three banks following a degree in economics and politics. (He also notes that he was the yard-of-ale champion at the University of Leeds.)

However, his first start-up, Avanti Communications, has not fared well over the past year, long after Williamss departure. In February 2021 its existing junior lenders injected $30 million of new capital, and its so-called super senior facility, which was due for repayment in February, was extended, but only to the end of January 2022.

Existential threat

But Arqit has moved into a completely different market, addressing something the company calls an existential threat to the hyperconnected world. Why? The legacy encryption that we all use, designed in the 1980s, has done a great job but is now failing us, says Arqit on its website. It was never intended for use in our hyper-connected world. The breaches caused are seen around us daily.

At the same time, there is a bigger problem. Quantum computing now poses an existential threat to cyber security for everyone. As a result, the world must begin a global upgrade cycle to replace all encryption technologies, an upgrade unlike anything we have seen before, says the company.

Dont bother patching and mending, says Arqit. Dont take risks with incremental improvements to public key encryption which is no longer fit for purpose.

Encryption using public key infrastructure (PKI) emerged from the communications intelligence community around 1971 in work by James Ellis at the UKs Government Communications Headquarters (GCHQ) and was then developed further in 1976 through work in the US and Israel by Whit Diffie and Martin Hellman and separately by Ronald Rivest, Adi Shamir and Leonard Adleman (known, from their initials, as RSA).

So, the idea is virtually half a century old. But in that time, certainly in the past decade, it has done us well. If the URL of a website starts https://, you know its encrypted to those 1970s standards. It means we are reasonably confident we can type our credit card details into a hotel, theatre, travel or shopping site. Messaging apps such as Signal and WhatsApp use encryption based on these PKI principles.

No one trusts PKI

However, no one trusts PKI any more, says Williams. The safest way of delivering keys to a battlefield is now to put them on a dongle and fly them in by helicopter.

At the heart of the problem is the fact that quantum computers are coming, and quantum computers are fast. Diffie and Hellman, and the RSA trio, calculated that if it took weeks or months to decrypt a message, PKI was secure. Breaking the code would be computationally infeasible, to use the term the crypto community likes.

By perhaps as soon as next year, quantum computers will be able to work so fast that they will have decrypted the text in a usable period of time. The challenge will no longer be computationally infeasible. Someone intercepting a transaction could find your credit card details within an hour or so, and use them. So, thats why there is pressure to upgrade to a new system of key exchange, a replacement for PKI.

However, the security people have something more to worry about. Many suspect that for years governments and other organisations have been squirrelling away in their vaults traffic that is encrypted to current standards, knowing that, any time soon, they will be able to crack it.

Think of all those politicians, on all sides of the global political divides, who have been conspiring via WhatsApp. Think of all those whistleblowers who have leaked information to law enforcement authorities or journalists via Signal. Think of all those criminal organisations that have been using Telegram for their plans.

Lemon juice and milk

Thats why PKI, the current crypto infrastructure, is facing what Arqit calls an existential threat. Pretty soon, it will be as outmoded as writing Xf buubdl bu ebxo upnpsspx* in lemon juice or milk and sending it via carrier pigeon. Dont bother with minor fixes, says Arqit. Its wrong to patch and mend, or to take risks.

The future lies in symmetric keys, with a new way of distributing them. Symmetric keys are provably secure against any attack, including quantum computing, says the company.

The problem is that, until now, there has been no safe way to distribute them. Arqit says that it offers a method to create those keys at scale, securely, at any kind of endpoint device. We have invented a method of creating unbreakable encryption keys locally, both at the edge and in the cloud, says Williams.

Arqit has a solution. Its called Arq19, pretty much for the same reason Covid-19 has that suffix: 2019 was our Eureka moment, he smiles.

These are systems he calls global and trustless, a confusing term. It seems to mean you cant trust it, but what Williams and Arqit mean is that you dont have to trust it, as keys will never be stored in any system, so they cannot be stolen, but they can be put on devices within less than half a second to enable a high level of security.

We create hardware storage modules in a number of places he says London, New York, Sydney, for example. But those arent the keys. They are clues, a process involving shared secrets to create brand-new symmetrical encryption keys. No, I dont understand either; but how many people in 1936 understood Turings famous paper, On Computable Numbers, which started the computer revolution? (Turing went on to work during World War Two at GCHQs predecessor at Bletchley Park, in what is now the English city of Milton Keynes.)

Arqit can deliver its keys in unlimited group sizes, says Williams. The traditional PKI approach is for two-way communications Alice and Bob, in the crypto communitys terminology.

But what Williams is looking for is a system that will work with Alice, Bob, Catherine, Dave, Eve and a whole telephone directory.

For example, says Williams, they can deliver keys to international telecoms networks, and we can change the key every second if we want. He says that will result in ultra-secure software defined networks (SDNs).

We can deliver quantum keys in a manner thats global and trustless, says Williams. The company will use a small fleet of satellites, weighing 300kg each, that is being built by QinetiQ, a company formed 20 years ago by the privatisation of part of the UK governments Defence Evaluation and Research Agency.

BT has an exclusive deal to distribute Arqits QuantumCloud services in the UK, and the Japanese firm Sumitomo has a deal as the first big international customer, says Williams.

It is working with telcos to encrypt traffic on Japanese fibre cables, he adds.

These are contracts with distributors that have been signed, but the companys first contract with a corporate user went live in June, he says, although he will not name the partner, except that it is a big global corporation. It is an enterprise customer and is not BT.

The eventual market will include the internet of things (IoT) and connected cars, enterprise and connectivity, he said. Cost will be low, says Williams. Users will pay a tiny fraction of a dollar for each key created.

Heir to Turing

Williams has gathered around him a range of technical, crypto and management talent. CTO and co-founder with Williams is David Bestwick, who was also a co-founder and CTO of Avanti. Theres a chief cryptographer who was at GCHQ: think of David Shiu as the inheritor of the tradition founded by Turing 80 years ago.

There are other ex-GCHQ people, too, and a retired air vice-marshal and a former lieutenant general in the US Air Force. And more, including experts in telecoms, IT and a chief software engineer who was at McAfee. And a former head of operations at 10 Downing Street.

These people are well connected. Well see what they achieve.

Though, will we be able to find out, or will it all be encrypted?

*Xf buubdl bu ebxo upnpsspx means just We attack at dawn tomorrow, using the so-called Caesar cipher, as reputedly used by the Roman dictator

See the article here:
Future in the cloud for encryption - Capacity Media

WhatsApp claims to offer end-to-end encryption. What this means is that messages are encrypted so that during transit, even if they were to be intercepted, it will not be readable. Instead, it only gets decrypted once it arrives on the intended device. Or at least thats what they claim.

According to a somewhat damning report from ProPublica, it seems that WhatsApps claims of end-to-end encryption might not be 100% true. The report alleges that WhatsApp employs over 1,000 contractors from Dublin, Singapore, and Texas who use special Facebook software to examine user content.

These contractors then make judgments on the content that appears on their screen that includes all kinds of content ranging from fraud, spam, potential terrorist planning, and CSAM. WhatsApp has since sort of denied the allegations made in the report. The companys director of communications Carl Woog told the publication that the contractors are only used to remove the worst abusers who use their platform to spread spam, threats, and more.

Facebook has also since issued a statement claiming that WhatsApp has been built in a way that limits the data they collect, which might be true, but it also means that some data can be collected.

WhatsApp has faced several privacy related controversies in the past, with the latest one seeing many users migrate to other messenger platforms like Signal and Telegram.

Filed in General. Read more about Facebook, Privacy, Security and Whatsapp. Source: cultofmac

Link:
WhatsApps Claims Of End-To-End Encryption Might Be Entirely True - Ubergizmo