Introduction to Encryption What it s all about

Transcription

1

2 Introduction to Encryption What it s all about At MOA Project, we believe privacy and the ability to communicate without government or corporate eavesdropping is a basic right of all people. Some groups, like activists, are active targets of surveillance and government spying in New Zealand and around the world. This is an unjust; abuse of power and we encourage all people to protect themselves from it. This is a basic guide to teach activists how to protect themselves and their communities. We hope you find it helpful - The MOA Project Encryption - Allows a message to be sent through a digital network in a way that its content cannot be read or understood by third parties or unauthorized people. To achieve this, a message must be encrypted by your computer. Then, travel through the internet encrypted. Until, it is recieved by your friend. Only then, should it be decrypted. Digital Communication How it works Digital communication (ie. , text messaging) are sent through a computer network, usually the internet, and can be intercepted in two locations. First, during transmission and second, when being stored on the company servers. The Internet Provider s Server The Internet Unsecure on Server A. Sending Message B. Recieving Message 1

3 Encryption by Device A Secure Laptop Storage - Communication - Anonymous Internet Use - Encrypted Drive with Truecrypt Encrypted and Trusted Networks On TOR Browser Smart Phone SMS (text message) - Voice Call - Telegram Messenger - (Secret Chat Only) Not Secure, Stored on Unencrypted Server Not Secure, phones can be tapped End-to-End Encryption + Auto Delete USB/Hard Drive Encrypted with Truecrypt - Secure Storage of File or Entire Disk How Security Breaches Happen 1) 2) 3) 4) 5) When stored on servers : Unencrypted data can be viewed/shared by the company under court order & accessed by the government. In some cases data can be stolen by hackers. Weak passwords : Can be easily opened with a Brute Force Attack and bypass encryption. Device if not protected : Gaining physical access to your computer. IE, Theft, lost device, seized by police during arrest, search or border crossing Hackers access computer : Through software with known vulnerabilities. Keep software up to date Intercepted on Wi-Fi : Unencrypted data sent on public Wi Fi, or data sent over non password protected Wi-Fi, can be taken. 2

4 3 Secure Communication What it s all about Any information that travels through the internet can be intercepted during trasmission. Since all digital communication also passes through and is stored on a server, anyone who can gain access to this server can get your information. The Internet Encrypted on Server The Internet A. Message is Encrypted B. Message is Decrypted Secure communication - occurs when a message is sent through a digital network in a way that its content cannot be read or understood. To achieve this, a message must be encrypted by your computer, travel through the internet encrypted, until it is recieved by your friend. Only then, should it be decrypted. Telegram Messenger Secure on your smart phone Telegram is a free and open source messenger app that allows you to communicate securely using its Secret Chat. Users can send/receive encrypted and self-destrucing messages, photo, video, documents and voice messages. This means your telephone company cannot read your messages, governments will have difficulty accessing and because Telegram servers are located internationally. Check out : https//telegram.org

5 Protecting Data Storage Truecrypt What are the primary uses of TrueCrypt? TrueCrypt is a free software used to encyrpt data storage devices (hard drive/ USB sticks) to protect your data. Encryption works by automatically mixing up the data into a form that cannot be understood by anyone who doesn t have the key to undo the mix up. Without the proper authentication key, even if the hard drive is removed and placed in another machine, the data remains inaccessible. TrueCrypt can encrypt the entire hard drive. Or, it can be used to create an encrypted folder on your computer. How can you encrypt your storage using TrueCrypt: 1) 2) 3) Create an encrypted file container: (Basic) Creates an encrypted folder on your computer. After created, you can drag and drop files into this folder. When the folder is closed they will be encrypted. You will need the encryption password to open the folder. Encrypt a non-system drive or partition (Advanced) Your non-system drive does not contain your computers operating system. IE. external hard drive, USB stick, computers with multiple hard drives or systems with a partitioned hard drive Encrypt the system hard drive, or entire system partition (Advanced) System means this is the primary memory drive for your computer. Most computers only have one drive, the system drive. Using this option, you will need to enter the encryption password when you first start the computer up. Without the password the computer will not function at all. If removed, the hard-drive will be completely encrypted. TrueCrypt has recently stopped being supported. Although TrueCrypt is secure now, as new versions of computer software are released it will become compromised. We are currently researching a replacement for TrueCrypt 4

6 Secure Research Anonymity on the network TOR (The Onion Router) provides anonymous and untraceable communication between you and the websites you visit. Websites cannot tell who you are, where you are, and your internet providor cannot see what you are viewing. You can anonymously research and view the internet, therefore this software will protect your privacy and defend yourself against network surveillance and website tracking. TOR Network Download TOR here : This part is NOT encrypted This part is encrypted Website s Server How TOR works: TOR directs Internet traffic through a free, worldwide, volunteer network consisting of more than five thousand relays and then encrypts the connection between each computer. Making it more difficult to trace Internet activity back to you. Including "visits to websites, online posts, instant messages, and other communication forms". TIP : Websites cannot see who you are or where you are but they can see what you send. If you send personal information over TOR you can be identified. IE, logging into or facebook 5

7 Passwords Best Practices for Encryption Passwords are used to protect most types of encryption. Weak passwords can be broken and are often the weakest link in an encrypted system. Advanced computers can conduct Brute Force Attacks on passwords and bypass encryption by cracking the password Tips for Passwords : f Do not share or reveal passwords Password length is more important than complexity Ideally, passwords should be 20+ characters long. Try using a sentance ie. thisisaverysecurepassword4589 Use different passwords for accounts that access restricted data, than for your less-sensitive accounts Change initial and temporary passwords as soon as possible. These tend to be less secure Secure (advanced) Messaging using providers is not secure as the data could be accessed on the server of the company that you use. The company can view or share your information, be forced to supply it to a government under court order or it can be stolen by hackers. By encrypting your s before they are sent, you add an extra layer of security to protect your conversation. This means that your s will be encrypted when stored on company servers, using a secure password the company does not have. Please see Advanced Encrypition on page 7 for more info 6

8 Advanced Options Fancy options We will endeavor to make information on more advanced encryption available on our website. Unfortunately it is outside the scope of this short guide. Encrypted encryption is based in a Public-Private keypair. You send your Public Key to your friends, they use this Public Key to encrypt sent to you. You must have their Public Key to send encrypted to them. What you need to encrypt your conversations ThunderBird : application that supports Public-Private key encryption GnuPG : Application to generate your public and private keypair. Enigmail : Extension for Thunderbird used to encrypt your More information on advanced encryption here: We are a group of activists from a variety of backgrounds who are working to build an organized and skilled activist network across Aotearoa/ New Zealand. We believe activism and protest is an integral part of any functioning democracy. The MOA Project works to assist activists and grassroots groups to become more effective and create real change. We support grassroots activists and groups through resource sharing, skill sharing and up skilling. More information available on