{"id":113050,"date":"2014-04-16T19:47:58","date_gmt":"2014-04-16T19:47:58","guid":{"rendered":"http:\/\/rinf.com\/alt-news\/?p=113050"},"modified":"2014-04-16T19:47:58","modified_gmt":"2014-04-16T19:47:58","slug":"us-government-paying-undermine-internet-security-fix","status":"publish","type":"post","link":"http:\/\/rinf.com\/alt-news\/breaking-news\/us-government-paying-undermine-internet-security-fix\/","title":{"rendered":"The US Government: Paying to Undermine Internet Security, Not to Fix It"},"content":{"rendered":"

Julia Angwin<\/strong><\/p>\n

The\u00a0Heartbleed<\/a>\u00a0computer security bug is many things: a\u00a0catastrophic\u00a0<\/a>tech failure, an open invitation to\u00a0criminal hackers<\/a>\u00a0and yet another reason to upgrade our passwords on\u00a0dozens of websites<\/a>. But more than anything else, Heartbleed reveals our neglect of Internet security.<\/p>\n

The United States spends more than\u00a0$50 billion<\/a>\u00a0a year on spying and intelligence, while the folks who build important defense software \u2013 in this case a program called OpenSSL that ensures that your connection to a website is encrypted \u2013 are\u00a0four core programmers<\/a>, only one of whom calls it a full-time job.<\/p>\n

In a typical year, the foundation that supports OpenSSL receives just\u00a0$2,000 in donations<\/a>. The programmers have to rely on consulting gigs to pay for their work. “There should be at least a half dozen full time OpenSSL team members, not just one, able to concentrate on the care and feeding of OpenSSL without having to hustle commercial work,”\u00a0says<\/a>\u00a0Steve Marquess, who raises money for the project.<\/p>\n

Is it any wonder that this Heartbleed bug slipped through the cracks?<\/p>\n

Dan Kaminsky, a security researcher who\u00a0saved the Internet<\/a>\u00a0from a similarly fundamental flaw back in 2008,\u00a0says<\/a>\u00a0that Heartbleed shows that it’s time to get “serious about figuring out what software has become Critical Infrastructure to the global economy, and dedicating genuine resources to supporting that code.”<\/p>\n

The Obama Administration has said it is doing just that with its\u00a0national cybersecurity initiative<\/a>, which establishes guidelines for strengthening the defense of our technological infrastructure \u2013 but it does not provide funding for the implementation of those guidelines.<\/p>\n

Instead, the National Security Agency, which has responsibility to protect U.S. infrastructure, has worked to\u00a0weaken encryption standards<\/a>. And so private websites \u2013 such as Facebook and Google, which were affected by Heartbleed \u2013 often use open-source tools such as OpenSSL, where the code is publicly available and can be verified to be free of NSA backdoors.<\/p>\n

The federal government spent at least $65 billion between 2006 and 2012 to secure its own networks, according to a\u00a0February report<\/a>\u00a0from the Senate Homeland Security and Government Affairs Committee. And many critical parts of the private sector \u2013 such as nuclear reactors and banking \u2013 follow\u00a0sector-specific cybersecurity<\/a>regulations.<\/p>\n

But private industry has also failed to fund its critical tools. As cryptographer Matthew Green\u00a0says<\/a>, “Maybe in the midst of patching their servers, some of the big companies that use OpenSSL will think of tossing them some real no-strings-attached funding so they can keep doing their job.”<\/p>\n

In the meantime, the rest of us are left with the unfortunate job of changing all our passwords, which may have been stolen from websites that were using the broken encryption standard. It’s unclear whether the bug was exploited by criminals or intelligence agencies. (The NSA\u00a0says it didn’t know<\/a>\u00a0about it.)<\/p>\n

It’s worth noting, however, that the risk of your passwords being stolen is still lower than the risk of your passwords being hacked from a website that\u00a0failed<\/a>\u00a0to<\/a>\u00a0protect<\/a>them properly. Criminals have so many ways to obtain your information these days \u2013 by sending you a fake email from your bank or hacking into a retailer’s unguarded database \u2013 that it’s unclear how many would have gone through the trouble of exploiting this encryption flaw.<\/p>\n

The problem is that if your passwords were hacked by the Heartbleed bug, the hack would leave no trace. And so, unfortunately, it’s still a good idea to assume that your passwords might have been stolen.<\/p>\n

So, you need to change them. If you’re like me, you have way too many passwords. So I suggest starting with the most important ones \u2013 your email passwords. Anyone who gains control of your email can click “forgot password” on your other accounts and get a new password emailed to them. As a result, email passwords are the key to the rest of your accounts. After email, I’d suggest changing banking and social media account passwords.<\/p>\n

But before you change your passwords, you need to check if the website has patched their site. You can test whether a site has been patched by typing the URL\u00a0here<\/a>. (Look for the green highlighted ”\u00a0Now Safe<\/a>” result.)<\/p>\n

If the site has been patched, then change your password. If the site has not been patched, wait until it has been patched before you change your password.<\/p>\n

A reminder about how to make passwords: Forget all the password advice you’ve been given about using symbols and not writing down your passwords. There are only two things that matter: Don’t reuse passwords across websites and the longer the password, the better.<\/p>\n

I\u00a0suggest<\/a>\u00a0using password management software, such as\u00a01Password<\/a>\u00a0or\u00a0LastPass<\/a>, to generate the vast majority of your passwords. And for email, banking and your password to your password manager, I suggest a method of picking random words from the Dictionary called\u00a0Diceware<\/a>. If that seems too hard, just make your password super long \u2013 at least 30 or 40 characters long, if possible.<\/p>\n

ProPublica<\/a>\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Julia Angwin The\u00a0Heartbleed\u00a0computer security bug is many things: a\u00a0catastrophic\u00a0tech failure, an open invitation to\u00a0criminal hackers\u00a0and yet another reason to upgrade our passwords on\u00a0dozens of websites. But more than anything else, Heartbleed reveals our neglect of Internet security. The United States spends more than\u00a0$50 billion\u00a0a year on spying and intelligence, while the folks who build important […]<\/p>\n","protected":false},"author":1,"featured_media":113051,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[487],"tags":[],"class_list":{"0":"post-113050","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-breaking-news"},"_links":{"self":[{"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/posts\/113050","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/comments?post=113050"}],"version-history":[{"count":0,"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/posts\/113050\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/media\/113051"}],"wp:attachment":[{"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/media?parent=113050"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/categories?post=113050"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/rinf.com\/alt-news\/wp-json\/wp\/v2\/tags?post=113050"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}