Page Cage released

Ever got a funny feeling when your password manager popped up offering to save a login that you thought was really, really confidential? Well, you should get it, because this is a sign that the app is able to see everything you’re doing. The developer of this app could get hacked (or the developer of any add-on or extension you’re using, for that matter), and then all your precious logins would be sent to some hacker’s computer without your noticing anything amiss. That is, until you look at your bank account and find that all your life’s savings have been sent to an account in Cayman Islands.

Page Cage is here to help you with that. It won’t work always, but it will work with a number of sites. Read More

Cryptanalyzing FibonaRNG

Sorry about the title. This post is motivated by Steven’s comments to the “What is Randomness?” post, where he describes a way that the current paper-and-pencil cipher champion, FibonaRNG, could be broken. Rather than responding with more comments, I thought a whole new post on the issue would make more sense, since it’s going to be rather long. For those who prefer the short version: yes, what Steven says would work, but not very well, although it looks like it should. Read on if you prefer the long version.
Read More

Low-tech high-security passwords

You’ve seen this advice many times: use a different password for each website you log into, including lowercase, capitals, numbers, and special symbols. Change it often. If you don’t, a hacker that breaks into one of those websites might be able to get into your bank account and your Facebook page, emptying the first of money and filling the second with child porn. But I’d bet you don’t do it because it’s just too hard to come up with a good password for each website, and then remember it. In this post, I’ll be telling you a paper-and-pencil trick derived from one whose author is none other than Turing award winner Manuel Blum, but far less taxing on your brain. Read More

Tabula Prava

In Latin, “Tabula Prava” means “crooked table.” This is a play on “Tabula Recta” (straight table), which is a grid full of letters used in a number of classic ciphers, including the Vigenère cipher. Tabula Prava is the straightforward combination of a high-entropy key derivation algorithm, which I published earlier on this blog, and the FibonaRNG cipher, also published here. The result is a very secure cipher that is still quite fast and easy to use with pencil and paper. Read More

Et Tu, WhatsApp

The “unthinkable” has happened: it is alleged that WhatsApp has a backdoor in its end-to-end encryption, and nobody has actually been getting any security all along. All of this while using  the acclaimed “open source” Signal protocol. This article will not break any news, but hopefully will make you think and be safer as a result.

Hint: it has all to do with the quotes in the first two sentences. Read More

High-security low-tech ciphers compared

mallet_tooth3-1Not a totally unlikely scenario: you need to send some extremely sensitive information to someone, using email or whatnot, and you suspect that your phone, your computer, and all electronic devices around you have been bugged. The only thing you have is paper, pencil, maybe some stone as in the picture, and your brains. Some people would prefer that everything is done in your head, but I will presume that you can burn the paper where you did your work afterwards, leaving no traces (hard to do with stone, though). There are a few admittedly low-tech symmetric ciphers that claim to work well in this situation, producing ciphertext that even the NSA would have trouble cracking. I go first over desirable features, then look at the different ciphers and what they have to offer, and conclude with some scores and comparison between them. Nothing prevented their having been invented centuries ago and, had they been available back then the history of the world might have turned out quite different. Read More