This low-cost device may be the world’s best hope against account takeovers

The past five years have witnessed a seemingly unending series of high-profile account take-overs. A growing consensus has emerged among security practitioners: even long, randomly generated passwords aren’t sufficient for locking down e-mail and other types of online assets. According to the consensus, these assets need to be augmented with a second factor of authentication.

Now, a two-year study of more than 50,000 Google employees concludes that cryptographically based Security Keys beat out smartphones and most other forms of two-factor verification.

The Security Keys are based on Universal Second Factor, an open standard that’s easy for end users to use and straightforward for engineers to stitch into hardware and websites. When plugged into a standard USB port, the keys provide a “cryptographic assertion” that’s just about impossible for attackers to guess or phish. Accounts can require that cryptographic key in addition to a normal user password when users log in. Google, Dropbox, GitHub, and other sites have already implemented the standard into their platforms.

After more than two years of public implementation and internal study, Google security architects have declared Security Keys their preferred form of two-factor authentication. The architects based their assessment on the ease of using and deploying keys, the security it provided against phishing and other types of password attacks, and the lack of privacy trade-offs that accompany some other forms of two-factor authentication.

In a recently published report, the researchers wrote:

We have shipped support for Security Keys in the Chrome browser, have deployed it within Google’s internal sign-in system, and have enabled Security Keys as an available second factor in Google’s Web services. In this work, we demonstrate that Security Keys lead to both an increased level of security and user satisfaction as well as cheaper support cost.

Other forms of two-factor authentication include the use of a cellphone to receive one-time passwords through text messages or the use of a smartphone to generate such one-time passwords. The additional password is then required when logging in. A second form involves smartcards that also provide cryptographic assertions. A third form relies on digital certificates based on the transport layer security protocol that uses a secret key to authenticate the end user to a service or account.

Using phones for two-factor authentication is problematic for a variety of reasons. For one thing, one-time passwords can often be phished using the same techniques that trick end users into revealing their normal password. Phones are also at risk of malware attacks that compromise the secrecy of one-time passwords. Using phones to receive one-time passwords through SMS text-messaging is especially risky because, in addition to all of the risks listed above, there’s the threat the messages could be intercepted. Phones may not always have a signal or can run out of power, limitations that can make them unavailable for use when logging in.

Smartcards, the Google researchers said, are also problematic because they usually require custom reader hardware and the installation of driver software on any computer that will be used to log in. That makes smartcards much harder to use on a large number of devices. Also problematic: in some countries, such cards are provided by national governments, stoking concerns the cards could be used to track users’ online usage.

TLS certificates used to authenticate users have been an option for years, but they have never caught on. The researchers said that’s likely because they’re too cumbersome for average users to generate, and TLS certificates are too likely to leak the user’s identity across sites. TLS authentication certificates also reveal the user’s identity to any network adversaries. What’s more, they aren’t portable, meaning it’s difficult for average users to easily use them on multiple computers.

Security Keys, by contrast to the alternatives, provide the best mix of security, usability, and privacy. They sell for as little as $10, although some of the more popular brands—such as the U2F Security Key from Yubico—list for $18. They’re smaller than a door key, plug into a computer’s USB slot, and require no batteries.

Following the compromise of Hillary Clinton Campaign Chairman John Podesta’s Gmail account through a simple phishing ploy, a growing number of people have realized the crucial importance of two-factor authentication. While there are a variety of ways to put it into place, the research paper makes a convincing case that Security Keys based on the U2F standard are the best approach.

from Ars Technica http://ift.tt/2ikerk7
via IFTTT

New York Gallery Owner Arrested, Accused Of Trafficking Stolen Antiquities

A New York art dealer has been arrested and charged with possessing and selling stolen artifacts from countries throughout Asia.

Nancy Wiener is accused of using her gallery in New York City, called Nancy Wiener Gallery, to “buy, smuggle, launder and sell millions of dollars’ worth of antiquities stolen from Afghanistan, Cambodia, China, India, Pakistan, and Thailand,” according to a complaint filed in Manhattan Criminal Court.

According to the gallery’s website, it has sold art to private collectors and museums, including the Metropolitan Museum of Art, Los Angeles County Museum, Art Institute of Chicago and National Gallery of Australia.

A Baphuon Shiva statue from Cambodia, dated to the 11th Century, which was allegedly purchased by Wiener in 2008 and which investigators believe was obtained by looting.

Case State of New York v. Nancy Wiener/Screenshot by NPR


hide caption

toggle caption

Case State of New York v. Nancy Wiener/Screenshot by NPR

Jason Felch, an investigative reporter who writes about the trafficking of stolen art, described Wiener’s business as “one of the country’s most prestigious Asian art galleries on Manhattan’s Upper East Side,” on his blog Chasing Aphrodite.

The 12-page complaint, which is signed by Special Agent Brenton Easter of the Department of Homeland Security, reads less like a court filing than an art heist thriller.

It tells of an elaborate scheme, carried out with co-conspirators around the world, to buy stolen artifacts and then cover up their origin in order to make hundreds of thousands of dollars selling them.

Take, for example, the story of an Indian sandstone sculpture from around the 2nd century, referred to as “Seated Buddha #1.”

In 1999, Wiener allegedly sold the sculpture to Singapore’s Asian Civilisations Museum. When, years later, the museum asked for documents about the sculpture’s origin, Wiener gave them three answers: first, she said it had belonged to “an unnamed European collector for at least 35 to 40 years,” then she said her own father had acquired it in India and finally gave the name of a man she said bought it when “he was posted in Vietnam between 1964 and 1966.”

The name she gave was Ian Donaldson, a fact that became relevant later to investigators.

None of the three claims about the statue’s origin appeared to be true. Investigators searching a storage locker rented by another art dealer found an “unlabeled computer disc.” On it were three pictures of Seated Buddha #1. In one of them, the statue appeared “still wet as it lay on a dirty floor.”

The date stamp on the picture appears to be November 8, 1992.

In 1999, Nancy Wiener allegedly sold the sculpture “Seated Buddha #1” to Singapore’s Asian Civilisations Museum.

Case State of New York State v. Nancy Wiener/Screenshot by NPR


hide caption

toggle caption

Case State of New York State v. Nancy Wiener/Screenshot by NPR

Meanwhile, Wiener acquired a second Buddha statue. She sold that one, referred to “Seated Buddha #2,” to the National Gallery of Australia in 2007 for more than $1 million, telling them that it had originally been purchased in Hong Kong by a man who “had been posted there between 1964 and 1966.”

The man’s name was also Ian Donaldson.

India’s patrimony laws, which spells out the right of the country to retain its artifacts, took effect in 1972, according to the complaint.

A looted red sandstone relief from India, dated to the 1st to 2nd Century, which was purchased by Nancy Wiener’s mother Doris in 2002, and consigned to Christie’s after Doris’s death.

Case State of New York v. Nancy Wiener/screenshot by NPR


hide caption

toggle caption

Case State of New York v. Nancy Wiener/screenshot by NPR

The complaint also describes methods Wiener appeared to have used to create the false air of legitimacy around possibly-stolen artifacts she and her family owned.

For example, the state alleges Wiener attempted to consign a collection of 380 artifacts owned by her mother, Doris Wiener, to the auction house Sotheby’s, but didn’t have adequate documentation about their origin. So, she consigned the collection to Christie’s New York instead.

According to the complaint, Doris Wiener had previously consigned some the artifacts and re-bought them at auction— so-called straw purchased meant to launder their purchase history by adding apparent owners.

Christie’s did not ask for extensive documentation about where the Wiener’s acquired the art, and sold the entire lot in 2012 for $12.7 million.

The New York Times reported some of the artifacts Wiener is accused of possessing “were said to have been smuggled into the United States by Subhash Kapoor, a well-known Manhattan art dealer who is now on trial in India.”

The paper also quote Wiener’s lawyer, Georges Lederman, as saying, “We are examining the charges and will respond at the appropriate time.”

from NPR Topics: News http://ift.tt/2hhEHeO
via IFTTT

First Ebola Vaccine Likely To Stop The Next Outbreak

A woman is vaccinated at a health center in Conakry, Guinea, during the clinical trials of a vaccine against the Ebola virus.

Cellou Binani /AFP/Getty Images


hide caption

toggle caption

Cellou Binani /AFP/Getty Images

A woman is vaccinated at a health center in Conakry, Guinea, during the clinical trials of a vaccine against the Ebola virus.

Cellou Binani /AFP/Getty Images

When Ebola struck West Africa a few years ago, the world was defenseless. There was no cure. No vaccine. And the result was catastrophic: More than 11,000 people died. Nearly 30,000 were infected.

Now it looks like such a large outbreak is unlikely to ever happen again. Ever.

The world now has a potent weapon against Ebola: A vaccine that brings outbreaks to a screeching halt, scientists report Thursday in The Lancet.

“We were able to estimate the efficacy of the vaccine as being 100 percent in a trial with more than 5,000 people,” says Ira Longini, a biostatistician at the University of Florida, who helped test the vaccine. “It’s very unusual to have a vaccine that protects people perfectly.”

Now, no vaccine — or drug for that matter — is perfect. And efficacy of the vaccine is clearly high but not “100 percent.” That value reflects the fact that they just haven’t tested the vaccine on enough people yet. So it will likely decrease as the vaccine is used over time. In then end, the efficacy will likely sit somewhere between about 70 percent and 100 percent, Longini says.

By comparison, the flu vaccine last year was about 50 percent effective.

And the Ebola vaccine works lightning fast, within four or five days, he says. So it could even be given after a person is exposed to Ebola but hasn’t yet developed the disease.

Longini and his colleagues tested the vaccine on about 4,000 people in Guinea back in 2015, when Ebola was still spreading there. These people were at high risk of getting Ebola because they had had contact with someone who was infected.

When they got the vaccine right away, they were completely protected. No one got sick.

The vaccine — called rVSV-ZEBOV — hasn’t been approved yet by either the World Health Organization or the U.S. Food and Drug Administration. That’s predicted to happen sometime in 2018.

And there are still a few open questions about the vaccine, says Dr. Anthony Fauci, at the National Institutes of Health.

“For example, we don’t know how durable the vaccine is,” he says. “If you give health care workers the vaccine, for example, how long would they be protected? That’s very important to learn.”

What is clear is that the vaccine offers short-term protection during outbreaks. And that’s exactly what’s needed to stop the virus from spreading and keep small outbreaks from getting out of control.

For this reason, GAVI — the Global Alliance for Vaccines and Immunization — has already spent $5 million to stockpile the vaccine.

“So we have made 300,000 doses available, as of earlier this year, if there was to be sort of any resurgence or any kind of emergency,” says Swati Gupta at Merck, which is manufacturing the shot.

Vaccines typically take years, even a decade to test. But the field trials for this one took less than two years.

“It’s been a pretty tremendous experience,” she says. “There’s been a lot of international partners that have come together in a real unprecedented effort.”

The magnitude of the outbreak in West Africa, she says, made companies, governments and academics push aside their own research agendas to come together and finish a vaccine.

from NPR Topics: News http://ift.tt/2hNljWi
via IFTTT

A French town just installed the world’s first ‘solar road’

The tiny town of Tourouvre-au-Perche in Normandy, France no longer has to worry about how it will power its street lights. The Sun will handle that.

FRANCE-ENERGY/

French Ecology Minister Ségolène Royal (above) officially opened the kilometer-long road on Wednesday. It took five years to develop and cost $5.2 million to produce and install the 30,000 square feet of solar panels. They’re coated with a clear silicon resin that enables them to withstand the impact of passing traffic.

Being the first of its kind, the panels are still prohibitively expensive to produce en masse (they’re also less efficient than conventional panels because they’re laid flat rather than angled). But should Colas, the road’s manufacturer, figure out how to get costs down and efficiency up, France may install them along another 1,000 kilometers of its roads.

Source: The Guardian

from Engadget http://ift.tt/2iksXUK
via IFTTT

Facing Criticism, Eric Trump Will Stop Actively Fundraising For His Foundation

Eric Trump arrives at Trump Tower in New York on Dec. 8.

Andrew Harnik/AP


hide caption

toggle caption

Andrew Harnik/AP

Eric Trump arrives at Trump Tower in New York on Dec. 8.

Andrew Harnik/AP

In the midst of multiple fundraising attempts that raised questions about whether the Trump family is selling the promise of personal access to the highest bidder, Eric Trump says he will stop directly raising money for his personal charity.

“As unfortunate as it is, I understand the quagmire,” Trump told the New York Times.

“It’s an extremely sad day when doing the right thing isn’t the right thing,” Trump told the Associated Press in a separate interview.

The Eric Trump Foundation raises money for childhood cancer research and treatment. According to its website, it has “donated and pledged nearly $30 million” to the St. Jude Children’s Research Hospital.

Trump’s decision follows two separate fundraising attempts that were scuttled after they became public.

Trump’s foundation recently offered donors a chance to have coffee with his sister Ivanka Trump, who is expected to play a formal or informal role in President-elect Donald Trump’s administration. The foundation eventually canceled that auction.

But days later, a separate group, the Opening Day Foundation, offered donors a chance to go hunting or fishing with Eric and Donald Trump Jr. The cost: contributions of $500,000 or $1 million. The Trump transition team distanced itself from these offers. Spokeswoman Hope Hicks said Trump’s sons “are not involved in any capacity,” despite the fact they are both listed as directors in the nonprofit group’s filings.

The fundraising attempts raised ethical questions because they appeared to offer direct access to members of the president-elect’s inner circle in exchange for donations.

Trump regularly criticized the Clinton Foundation for offering that sort of quid pro quo access to people seeking to influence Hillary Clinton while she ran the State Department. “It’s impossible to figure out where the Clinton Foundation ends and the State Department begins,” Trump said in August. “It is now abundantly clear that the Clintons set up a business to profit from public office. They sold access and specific actions by and to them for money.”

Trump adviser Kellyanne Conway seemed to share Eric Trump’s frustration with the wave of ethical criticism the fundraising has generated. “The idea that these folks are trying to help people in need and those people are going to suffer now because folks are pointing out what they think to be improprieties, I didn’t say I necessarily agree,” Conway told CNN Thursday morning. “I just think that they will always do the right thing. I know them well.”

While Eric Trump’s decision may remove one ethical “quagmire,” as he put it, another remains: the question of who will run the Trump Organization and how Donald Trump will, or won’t, separate himself from his personal businesses while serving as president.

Trump promised to hold a news conference on Dec. 15 to detail his promise to turn over control of his businesses to his children. But the news conference has been delayed, and the Trump transition has not provided any details about what sort of arrangement the president-elect will seek to address conflict-of-interest questions.

The U.S. Office of Government Ethics is recommending that Trump completely divest himself from his companies.

“Transferring operational control of a company to one’s children would not constitute the establishment of a qualified blind trust, nor would it eliminate conflicts of interest,” the office’s director wrote in a letter to the president-elect.

from NPR Topics: News http://ift.tt/2i6lYQc
via IFTTT

Encrypted chat app Signal circumvents government censorship

Just days after Open Whisper Systems concluded the Egyptian government had blocked access to its encrypted messaging service, Signal, the company rolled out an update that circumvents large-scale censorship systems across Egypt and the United Arab Emirates. The update also adds the ability to apply stickers, text and doodles to images, but that’s just icing on the censorship-evading cake.

"Over the weekend, we heard reports that Signal was not functioning reliably in Egypt or the United Arab Emirates," Open Whisper Systems writes. "We investigated with the help of Signal users in those areas, and found that several ISPs were blocking communication with the Signal service and our website. It turns out that when some states can’t snoop, they censor."

Open Whisper Systems circumvents filtering systems with domain fronting, a technique that routes all messages through a popular domain name — in this case, Google. All Signal messages sent from an Egypt or UAE country code will look like a normal HTTPS request to the Google homepage.

In order to block Signal in these countries, the governments would have to disable Google.

"The goal for an app like Signal is to make disabling internet access the only way a government can disable Signal," the company says. The blog post continues, "With enough large-scale services acting as domain fronts, disabling Signal starts to look like disabling the internet."

Source: Signal

from Engadget http://ift.tt/2hWOd6z
via IFTTT