A Zombie From the 90s Makes the Case For Demanding Strong Encryption

Fight disinformation: Sign up for the free Mother Jones Daily newsletter and follow the news that matters.


Companies like Apple and Google have announced recently that they will start providing their customers with encryption that even Apple and Google don’t have the keys for. This means that even if law enforcement officers get a subpoena for data held by the companies, it won’t do any good. They couldn’t turn over decrypted data even if they wanted to.

This has led to calls from the FBI and elsewhere to provide “backdoors” of some kind for use by law enforcement. This would be a kind of master key available only under court order. But security experts argue that this makes encryption fundamentally useless. If you deliberately build in a weakness, you simply can never guarantee that it won’t be exploited by hackers. Encryption is either secure or it’s not, full stop.

Over at The Switch, Craig Timberg provides an interesting recent example of this. Back in the 90s, we were fighting this same fight, and one temporary result was the government’s mandate that only a weak form of encryption could be exported outside the U.S. This mandate didn’t last long, but it lasted long enough to get incorporated into quite a few products. Still, that was 20 years ago. What harm could it be doing today?

The weaker encryption got baked into widely used software that proliferated around the world and back into the United States, apparently unnoticed until this year.

Researchers discovered in recent weeks that they could force browsers to use the old export-grade encryption then crack it over the course of just a few hours. Once cracked, hackers could steal passwords and other personal information and potentially launch a broader attack on the Web sites themselves by taking over elements on a page, such as a Facebook “Like” button.

….The existence of the problem with export-grade encryption amazed the researchers, who have dubbed the flaw “FREAK” for Factoring attack on RSA-EXPORT Keys….Nadia Heninger, a University of Pennsylvania cryptographer, said, “This is basically a zombie from the ‘90s… I don’t think anybody really realized anybody was still supporting these export suites.”

For vulnerable sites, Heninger found that she could crack the export-grade encryption key in about seven hours, using computers on Amazon Web services….More than one third of encrypted Web sites — including those bearing the “lock” icon that signifies a connection secured by SSL technology — proved vulnerable to attack in recent tests conducted by University of Michigan researchers J. Alex Halderman and Zakir Durumeric. The list includes news organizations, retailers and financial services sites such as americanexpress.com. Of the 14 million Web sites worldwide that offer encryption, more than 5 million remained vulnerable as of Tuesday morning, Halderman said.

This is an object lesson in deliberately building vulnerabilities into encryption technology. Maybe you think you’ve done it perfectly. Maybe you think nobody but the proper authorities can ever exploit the vulnerability. But the chances are good that you’re wrong. In the case of FREAK, we were wrong for nearly 20 years before we figured out what was going on. There’s no telling how long we might be wrong if we deliberately do this again.

AN IMPORTANT UPDATE

We’re falling behind our online fundraising goals and we can’t sustain coming up short on donations month after month. Perhaps you’ve heard? It is impossibly hard in the news business right now, with layoffs intensifying and fancy new startups and funding going kaput.

The crisis facing journalism and democracy isn’t going away anytime soon. And neither is Mother Jones, our readers, or our unique way of doing in-depth reporting that exists to bring about change.

Which is exactly why, despite the challenges we face, we just took a big gulp and joined forces with the Center for Investigative Reporting, a team of ace journalists who create the amazing podcast and public radio show Reveal.

If you can part with even just a few bucks, please help us pick up the pace of donations. We simply can’t afford to keep falling behind on our fundraising targets month after month.

Editor-in-Chief Clara Jeffery said it well to our team recently, and that team 100 percent includes readers like you who make it all possible: “This is a year to prove that we can pull off this merger, grow our audiences and impact, attract more funding and keep growing. More broadly, it’s a year when the very future of both journalism and democracy is on the line. We have to go for every important story, every reader/listener/viewer, and leave it all on the field. I’m very proud of all the hard work that’s gotten us to this moment, and confident that we can meet it.”

Let’s do this. If you can right now, please support Mother Jones and investigative journalism with an urgently needed donation today.

payment methods

AN IMPORTANT UPDATE

We’re falling behind our online fundraising goals and we can’t sustain coming up short on donations month after month. Perhaps you’ve heard? It is impossibly hard in the news business right now, with layoffs intensifying and fancy new startups and funding going kaput.

The crisis facing journalism and democracy isn’t going away anytime soon. And neither is Mother Jones, our readers, or our unique way of doing in-depth reporting that exists to bring about change.

Which is exactly why, despite the challenges we face, we just took a big gulp and joined forces with the Center for Investigative Reporting, a team of ace journalists who create the amazing podcast and public radio show Reveal.

If you can part with even just a few bucks, please help us pick up the pace of donations. We simply can’t afford to keep falling behind on our fundraising targets month after month.

Editor-in-Chief Clara Jeffery said it well to our team recently, and that team 100 percent includes readers like you who make it all possible: “This is a year to prove that we can pull off this merger, grow our audiences and impact, attract more funding and keep growing. More broadly, it’s a year when the very future of both journalism and democracy is on the line. We have to go for every important story, every reader/listener/viewer, and leave it all on the field. I’m very proud of all the hard work that’s gotten us to this moment, and confident that we can meet it.”

Let’s do this. If you can right now, please support Mother Jones and investigative journalism with an urgently needed donation today.

payment methods

We Recommend

Latest

Sign up for our free newsletter

Subscribe to the Mother Jones Daily to have our top stories delivered directly to your inbox.

Get our award-winning magazine

Save big on a full year of investigations, ideas, and insights.

Subscribe

Support our journalism

Help Mother Jones' reporters dig deep with a tax-deductible donation.

Donate