Tumgik
#underfunded coders
Text
FUNDRAISER!!
Hey guys!!!! @starisinsane and I (@ghostpepper-at-midnight) are starting a project. As soon as my friend and I get a total of 30 followers, will we start a fundraiser at our school. We will then donate the money to an issue YOU choose. See the poll on @starisinsane's blog and here. Choose and follow for updates!! The top two choices with the most votes get the money.
FOLLOW FOR UPDATES
THANKS GUYS!!
14 notes · View notes
starisinsane · 1 year
Text
FUNDRAISER!!!
Heyyy people!!! (if I ever get any followers y'all are celestial objects because i'm Star get it) Me and a friend, @ghostpepper-at-midnight are doing a fundraiser once we get 30 total followers. Plot twist is...You guys get to choose the fundraiser! See the poll here and on Ghostpepper's blog.
Choose one and follow for more info along the line!
(If the poll runs out and we don't have enough votes, we will restart it later.)
Please do reblog, likes are good, but reblogs spread it!
2 notes · View notes
Text
IRS Funding
[This is copied from a NYT article, which is behind a paywall, as are the links.]
Most of us know the I.R.S. from the unpleasant task of filing taxes. The agency processes more than 260 million tax returns and related documents each year, with an annual budget of nearly $14 billion and about 80,000 full-time staff members.
It does much of this work on antiquated systems. A recent Washington Post column depicted a bureaucracy that has not adapted to the computer age and instead has stacks of papers extending into a cafeteria. The agency still uses technology dating back more than a half-century, including devices running a programming language, COBOL, that few coders still know. It typically communicates with taxpayers through snail mail or fax.
Congress has cut the I.R.S.’s budget 20 percent since 2010. That makes it hard for the agency to help Americans file their taxes; it answered fewer than one in 10 calls for help during the 2021 filing season.
The funding shortage also makes it difficult for the agency to collect what the government is owed. The tax gap — the difference between taxes owed and taxes paid — is about 15 percent of all taxes.
The new funding will help address the shortcomings by letting the agency update its systems and hire more people. In total, the I.R.S. plans to recruit 87,000 employees. Many of those new hires will fill jobs left behind by retirees in the coming years, but its work force will expand overall to let it take on more duties in auditing, processing and customer service.
Republicans have cited the planned hires to amplify conspiracy theories about armed I.R.S. agents coming after law-abiding Americans. It’s true that some agents who conduct criminal investigations can be armed, like other law enforcement officials. But only 1 percent of new hires will be in such jobs, which focus on more serious financial crimes, according to the Treasury.
Republicans have also raised concerns that the I.R.S. will use the extra funds to go after conservative groups. The agency did target some right-wing organizations seeking tax-exempt status in the 2010s, but it also used similar tactics against progressive groups.
With the additional resources, the I.R.S. does plan to crack down on people and businesses who don’t pay the taxes they owe.
The question is who the agency will focus on. The Biden administration has said it will target rich tax cheats and ordered the agency not to increase audits on people who make less than $400,000 a year or on small businesses. The administration argues that underfunding led the I.R.S. to reduce audits on wealthy taxpayers in particular, so the new money should aim to close that gap.
The agency has good reason to focus on the rich: They account for the largest share of unpaid taxes.
7 notes · View notes
cerullos · 5 years
Text
so, like...i spent the past two days transcribing for a symposium focused on decolonizing AI, and on the second day when the moderator asked if anyone had criticisms or concerns...a lot of people did, because it was felt that the summit was structured in a way that only asked people to engage with the idea of “decolonization” in the broadest sense possible (i.e. how to make the tech world more “accessible” to everyone), rather than...y’know, the effects of excluding underserved communities from the tech industry, & marginalized groups that continue to deal with the effects of colonization today. 
and the symposium literally threw away the script, and pushed tables together and created groups to tackle issues they felt were actually important to breaking down barriers for would-be coders, which was very cool. and my group was trying to address the idea of “decolonization” in a more specific way, but the thing is that they still...didn’t. like, you had a gathering of maybe 100 PhDs across various disciplines, coming from local universities like columbia, NYU, etc. not to mention internationally recognized universities from all over the world, and yet you had people hailing things like raspberry pi and open source as the answer to democratizing the tech field. 
and the irony of this group of transcribers (all of us college age or in that range, and paid hourly) sitting silently and recording everything that was said by literal jet-setting academics really was not lost on me, nor was the fact that no one even once mentioned the cost of higher education in this country...the fact that attending college is a pipe dream for so many kids because they were raised in an environment where that’s just not even within the realm of possibility. and even coming from a single-income household, you know...i had to turn down my acceptance to NYU because it was impossible for me to afford it even with the “help” of grants, financial aid and scholarship money. and i loved my college, but do i think i lost access to certain resources, networking opportunities, internship and job opportunities etc.? absolutely, and that pales in comparison to people who can’t go at all, either because it’s completely unaffordable, or because they did “poorly” in high school due to...i mean, literally any number of reasons: family trouble or an abusive household, learning disabilities, attending an underfunded school that lacks the resources possessed by schools in wealthier areas, or even just...knowing going in that you are not expected to go to college, that it’s either not a priority or not an option. 
how the hell is that child going to know what a raspberry pi is? yes, they can access open source, but how will they know what it is? and more importantly, why should they care? who sparks that curiosity? not their professors obviously, probably not the overworked, underpaid high school teacher. and this one woman kept trying to point that out, that even that kind of imagination (or more, knowing how and where to channel your imagination in terms of tech, in terms of pursuing a career and a field of interest more broadly) is a privilege because of the extreme inequity in this country, but the conversation would constantly derail anyway. 
idk where i’m going with this except that academia is an echo chamber, and i really do applaud all the marginalized people who tried to inject some specificity into that conversation because there were a lot of them! but it did ultimately all get lost in white noise, and i have to assume most people were just there to give a brief lecture, get some good press and go home.
12 notes · View notes
Text
Artificial Intelligence Philosophy – AI and Machine Learning
A student will gain an awareness, and discover to judge and also to produce arguments for and against major philosophical problems concerning AI, robotics as well as their relations to human cognition and behavior. A different type of effort at fixing AIs ethics issue is the proliferation of crowdsourced ethics projects, which have the commendable objective of a far more democratic method of science.
  To illustrate DJ Patils Code of Ethics for Data Science, which invites the information-science community to lead ideas but doesn't develop in the decades of labor already made by philosophers, historians and sociologists of science. Then there's MITs Moral Machine project, which asks the general public to election on questions for example whether a self-driving vehicle with brake failure must go beyond five destitute people instead of one female physician.
  Philosophers call these trolley problems and also have printed a large number of books and papers around the subject in the last half-century. Evaluating the views of professional AI philosophers with individuals of everyone could be eye-opening, as experimental philosophy has frequently proven, but merely ignoring professionals and going for an election rather is irresponsible. We live at a time in which the fundamental knowledge of what it really way to be human is altering. Social networking platforms still redefine our feeling of place and time.
  We grapple using these changes once we attempt to define ourselves and our social relationships within an era of constant connectivity. A couple of decades ago, if a person claimed to possess supporters you’d assume they were beginning a cult. Now it’s an expression that 12 year olds use once they discuss Instagram and Twitter. Customers aren't the only ones who're increasingly more demanding, employees too. They would like to choose their professional future as well as their development.
  That's the reason new talent management methodologies have started to emerge, as we will have below. Many counter-arguments happen to be made against unpredicted intelligence explosions, focused largely on technical limitations and logic. For instance, sci-fi author Ramez Naam stated within an essay for H+ magazine that a super intelligent mind would want some time and sources to invent humanity-destroying technologies it would need to have fun playing the human economy to acquire what it really needed (for instance, building faster chips requires not only new designs but complicated and costly nick fabrication foundries to construct them.)The determination that the system, just like an atom of polonium218, is or isn't a closed system, obviously, poses difficult epistemic problems, that are compounded within the situation of people, precisely since they're vastly more complicated causal systems.
  Furthermore, probabilistic systems need to be distinguished from (what exactly are known as) chaotic systems, that are deterministic systems with acute sensitivity to initial conditions, in which the smallest switch to individuals conditions can result in formerly unpredicted effects. A small improvement in thousands and thousands of lines of code controlling an area probe, for instance, composed of the appearance of just one wrong character, just one misplaced comma, caused Mariner 1, the very first US interplanetary spacecraft, to veer off target after which need to be destroyed. A minimum of some versions of artificial intelligence are attempts not just to model human intelligence, but to create computers and robots that exhibit it: which have ideas, use language, as well as have freedom.  Performs this seem sensible?  What can it show us about human thinking and awareness?  Join John and Ken because they identify the philosophical issues elevated by artificial intelligence. However the nerd-sighted geniuses in our day result in the same mistake. Should you ask a coder what ought to be done to make certain AI does no evil, you are prone to get 1 of 2 solutions, neither being reassuring. Answer No. 1: It is not my problem. I simply construct it, as exemplified lately with a Harvard computer researcher who stated, I’m just an engineer when requested the way a predictive policing tool he developed might be misused. Answer No. 2: Believe me. I’m smart enough to have it right. AI researchers really are a smart bunch, but there is a terrible history of staying away from ethical blunders.
  A few of the better-known goof-ups include Google images tagging black people as gorillas, chat bots that become Nazis and racist soap dispensers. The effects can be more serious when biased algorithms are responsible for deciding who ought to be approved for any financial loan, who to employ or admit to college or if to kill a suspect inside a police chase. I can tell how that's already happening. We have pretty efficient satnav systems, which generally take us right places.
  Those who have developed with this type of system have grown to be incredibly dependent on navigation by machine. In the event that begins to fail at any time, Id imagine some those who have lately passed their test as motorists would a very find it difficult to use road signs, or memorized routes, or perhaps a conventional map as a means of having in one spot to another.  Another recent article within the New You are able to Occasions claimed that academics happen to be asleep in the wheel, departing policy makers who're battling to learn how to regulate AI subject to industry lobbyists.
  The content trigger a Twitter storm of replies from philosophers, historians and sociologists of science, angry their decades of underfunded jobs are again being overlooked and erased. Such as the Who’s lower in Whoville, they cried in fear, we’re here! We're here! We're here! We're here!
  If policy makers and funding sources listen carefully to individuals’ voices, there are answers on offer. The content concludes that people urgently require an academic institute centered on algorithmic accountability. On Twitter, the articles author, Cathy ONeil, was adamant, there must be several more tenure lines dedicated to it. Individuals both seem like solid ideas. Objection II: A minimum of it might be figured that since current computers (objective evidence suggests) do lack feelings until Data 2.  Does arrive (when) we're titled, given computers' insufficient feelings, to deny the low-level and piecemeal high-level intelligent behavior of computers bespeak genuine subjectivity or intelligence. AI lent many concepts without delivering thanks, like ontology, theory of mind, agent based architecture, object oriented design, archetypes and many more. Algorithms tracking our each step and key stroke expose us to dangers more dangerous than impulsively buying anti-wrinkle cream. More and more polarized and radicalized political movements, leaked health data and also the manipulation of elections using harvested Facebook profiles are some of the documented connection between the mass deployments of AI. Something as apparently innocent as discussing your jogging routes online can reveal military secrets.
  These cases are simply the beginning. Even our beloved Canadian Tire cash is being repurposed like a surveillance tool for any machine-learning team. Singer didn't think about a. I. s, but his argument shows that the escalator of reason leads societies to greater benevolence no matter species origin. A. I. s will need to strike the escalator of reason must have, simply because they will have to bargain for goods inside a human-dominated economy and they'll face human potential to deal with inappropriate behavior.
  The philosopher John Smart argues, if morality and immunity are developmental processes, when they arise inevitably in most intelligent collectives as a kind of positive-sum game, they have to also grow in pressure and extent as each civilizations computational capacity grows.
2 notes · View notes
mirandamaisketch · 7 years
Photo
Tumblr media
Action 52 had interesting things regarding its development. To make the game with as little effort as possible, or either save time, they copied already done games and reskinned them and they copied melodies from already existing games. Also it was too ambitious and underfunded, having students as coders and not enough time to develop the game. Too many ideas crammed into one makes a crappy game. Also here is a drawing of Time warp tickers
193 notes · View notes
neptunecreek · 6 years
Text
How To Turn PGP Back On As Safely As Possible
Previously, EFF recommended to PGP users that, because of new attacks revealed by researchers from Münster University of Applied Sciences, Ruhr University Bochum, and NXP Semiconductors, they should disable the PGP plugins in their email clients for now. You can read more detailed rationale for this advice in our FAQ on the topic, but undoubtedly the most frequently asked question has been: how long is for now? When will it be safe to use PGP for email again?
The TL;DR (although you really should read the rest of this article): coders and researchers across the PGP email ecosystem have been hard at work addressing the problems highlighted by the paper—and after their sterling efforts, we believe some parts are now safe for use, with sufficient precautions.
If you use PGP for email using Thunderbird 52.8 and Enigmail 2.0.6, you can update to the latest versions of Enigmail, turn on “View as Plain Text” (see below), re-enable Enigmail, and get back to using PGP in email.
For other popular clients: the answer is hazier. If you use GPGTools and Apple Mail, you should still wait. That system is still vulnerable, as this video from First Look’s Micah Lee shows.
%3Ciframe%20allow%3D%22autoplay%3B%20encrypted-media%22%20allowfullscreen%3D%22%22%20frameborder%3D%220%22%20height%3D%22365%22%20src%3D%22https%3A%2F%2Fwww.youtube.com%2Fembed%2FIMPKe-GJSh0%3Fautoplay%3D1%22%20width%3D%22650%22%3E%3C%2Fiframe%3E
Privacy info. This embed will serve content from youtube.com
  Other email clients have specific weaknesses reported in the EFAIL paper which may or may not have since been patched. Even if they were patched, depending on how the patch was implemented, they may or may not still be vulnerable to other exploits in the class of vulnerabilities described in the paper. So be careful out there: keep your software regularly updated, and choose conservative privacy settings for the client you use to decrypt and encrypt PGP mail. In particular, we continue to not recommend using PGP with email clients that display HTML mail. If possible, turn off that feature—and if you can’t, consider decrypting and encrypting messages using an external, dedicated application.
And remember, the safety of your messages also depends on the security of your correspondents, so encourage them to use clients that are safe from EFAIL too. You should even think about asking them to confirm which versions they’re using to ensure it’s safe to correspond.
The Fixes in Detail
The researchers’ publication contains a proof-of-concept exploit that affected users who protect their communications with PGP. The exploit allowed an attacker to use the victim’s own email client to decrypt previously acquired messages (or other protected information) and return the decrypted content to the attacker without alerting the victim. The attacker needed access to the previous (still encrypted) text. Unfortunately, an attacker that has access to your old encrypted emails is exactly the serious threat that the most targeted populations use PGP to protect against.
The attack, once understood, is simple to deploy. However, despite the fact that the vulnerability had been disclosed to the relevant developers months ago, many of the most popular ways of using PGP and email had no protection against the attack at the time of the paper’s publication. Because so many people in extremely vulnerable roles—such as journalists, human rights defenders, and dissidents—expect PGP to protect them against this kind of attack, we warned PGP users to hold off using it for secure communications and disable PGP plugins in their email clients until these problems were fixed.
That advice prompted a lot of discussion: some approving, some less so. We’re talking to everybody we can in the PGP community to hear about their experiences, and we hope to publish the deeper lessons we, and others, have learned from EFAIL and how it was handled.
But for now, we’ve been concentrating on testing whether the exploit has been successfully patched in the software setups most used by vulnerable groups.
Turning Off HTML vs Disabling Remote Content Loading
Many experts, after reading the research paper, were surprised we recommended disabling PGP in email, when it seemed like some less drastic options (such as turning off remote resource loading, and/or turning off their email client’s ability to read and decrypt HTML mail) would have sufficed to fend off the most obvious EFAIL attack.
But upon closer reading of the text of the paper, it becomes clear that the researchers describe exactly how to circumvent mail clients' attempts to block the remote loading of resources. Other researchers have created, and continue to create, exploits that can defeat this supposed protection. Further, with remote content turned off, a button is usually present to load remote content by choice. An alternative label for that innocuous-seeming button would be, “Leak all of my past encrypted emails to an attacker.” Having that button available to users is giving them an opportunity to shoot themselves in the foot.
Then there’s the other option for protection: turning off HTML in mail clients. At the time, the researchers were not confident that this protection was sufficient: they had already discovered a way of defeating S/MIME, a comparable email encryption standard, with HTML mail turned off. And while their simplest example used HTML to steal data, they also spelled out hypothetical attacks that might not need it.
Turning off HTML mail appears to be holding up as a defense. Unfortunately, not every client has this as an option: you can consistently turn off HTML in Thunderbird, but not in Apple Mail.
So, our first recommendation: whatever client you use, turn off HTML email. We have instructions for this in Thunderbird below.
Thunderbird+Enigmail Users Can Turn PGP Back On
Thunderbird and Enigmail’s developers have been working on ways to protect against the EFAIL vulnerabilities. As of version 2.0.6 (released Sunday May 27), Enigmail has released patches that defend against all known exploits described in the EFAIL paper, along with some new ones in the same class that other researchers were able to devise, which beat earlier Enigmail fixes. Each new fix made it a little harder for an attackerto get through Enigmail’s defenses. We feel confident that, if you update to this version of Enigmail (and keep updating!), Thunderbird users can turn their PGP back on.
But, while Enigmail now defends against most known attacks even with HTML on, the EFAIL vulnerability demonstrated just how dangerous HTML in email is for security. Thus, we recommend that Enigmail users also turn off HTML by going to View > Message Body As > Plain Text.
1. First click on the Thunderbird hamburger menu (the three horizontal lines).
2. Select “View” from the right side of the menu that appears.
3. Select “Message Body As” from the menu that appears, then select the “Plain Text” radio option.
Viewing all email in plaintext can be hard, and not just because many services send only HTML emails. Turning off HTML mail can pose some usability problems, such as some attachments failing to show up. Thunderbird users shouldn't have to make this trade-off between usability and security, so we hope that Thunderbird will take a closer look at supporting their plaintext community from now on. As the software is now, however, users will need to decide for themselves whether to take the risk of using HTML mail; the most vulnerable users should probably not take that risk, but the right choice for your community is a judgment call based on your situation.
Apple Mail+GPGTools Users Should Keep PGP Disabled For Now
Since Apple Mail doesn’t provide a supported plugin interface, the GPGTools developers have faced a difficult challenge in updating GPGTools to defend against EFAIL. Additionally, Apple Mail has no option for users to view all emails without HTML (also called plaintext-only). Apple Mail only provides an option to disable remote content loading, which does not defend against existing attacks.
Despite the challenges with Apple Mail, the GPGTools developers are working hard on fixes for all reported EFAIL-related attacks, and a release is expected very soon. That said, we do not recommend re-enabling GPGMail with Apple Mail yet.
Other Clients
The EFAIL researchers did a great job reviewing and finding problems with a wide set of desktop email clients. Using one of the lesser-known clients may or may not leave you vulnerable to the specific vulnerabilities outlined in the paper. And depending on the way the patches work, the patches may or may not protect against problems discovered by future research into the same class of problems.
Our advice for all PGP email users remains the same: if you depend on your email client to decipher PGP messages, make sure it doesn’t decode HTML mail, and check with its creators to see whether they’ve been working on protecting against EFAIL.
The Future of Pretty Good Privacy
Unlike situations where a fix only requires one piece of software to be mended and upgraded, some of the EFAIL problems come from interaction between all the different pieces of using PGP with email: email clients like Thunderbird, PGP plugins like Enigmail, and PGP implementations like GnuPG.
There are lots of moving parts to be fixed, and some of the fixes involve changes to the very core of how they function. It’s not surprising that it takes time to coordinate against attacks that exploit the complex interconnections between all of these parts.
EFF has fought, in the courts and in the corridors of power, for the right to write, export, and use decentralized and open source encryption tools, for as long as PGP has existed. We’re under no illusion about how hard this work is, or how underappreciated and underfunded it can be, or how vital its results are, especially for those targeted by the most powerful and determined of attackers. The transparent and public cooperation of all the parts of the PGP system make for some hard conversations sometimes, but that’s what keeps it honest and accountable—and that’s what keeps us all safe.
But if we’re to continue to use and recommend PGP for the cases where it is most appropriate—protecting the most vulnerable and targeted of Internet users—we need to carry on that conversation. We need to cooperate to radically improve the secure email experience, to learn from what we know about modern cryptography and usability, and to decide what true 21st-century secure email must look like.
It’s time to upgrade not just your PGP email client, but also the entire secure email ecosystem, so that it’s usable, universal, and stable.
from Deeplinks https://ift.tt/2H206AB
0 notes
neptunecreek · 6 years
Text
How To Turn PGP Back On As Safely As Possible
Previously, EFF recommended to PGP users that, because of new attacks revealed by researchers from Münster University of Applied Sciences, Ruhr University Bochum, and NXP Semiconductors, they should disable the PGP plugins in their email clients for now. You can read more detailed rationale for this advice in our FAQ on the topic, but undoubtedly the most frequently asked question has been: how long is for now? When will it be safe to use PGP for email again?
The TL;DR (although you really should read the rest of this article): coders and researchers across the PGP email ecosystem have been hard at work addressing the problems highlighted by the paper—and after their sterling efforts, we believe some parts are now safe for use, with sufficient precautions.
If you use PGP for email using Thunderbird 52.8 and Enigmail 2.0.6, you can update to the latest versions of Enigmail, turn on “View as Plain Text” (see below), re-enable Enigmail, and get back to using PGP in email.
For other popular clients: the answer is hazier. If you use GPGTools and Apple Mail, you should still wait. That system is still vulnerable, as this video from First Look’s Micah Lee shows.
%3Ciframe%20allow%3D%22autoplay%3B%20encrypted-media%22%20allowfullscreen%3D%22%22%20frameborder%3D%220%22%20height%3D%22365%22%20src%3D%22https%3A%2F%2Fwww.youtube.com%2Fembed%2FIMPKe-GJSh0%3Fautoplay%3D1%22%20width%3D%22650%22%3E%3C%2Fiframe%3E
Privacy info. This embed will serve content from youtube.com
  Other email clients have specific weaknesses reported in the EFAIL paper which may or may not have since been patched. Even if they were patched, depending on how the patch was implemented, they may or may not still be vulnerable to other exploits in the class of vulnerabilities described in the paper. So be careful out there: keep your software regularly updated, and choose conservative privacy settings for the client you use to decrypt and encrypt PGP mail. In particular, we continue to not recommend using PGP with email clients that display HTML mail. If possible, turn off that feature—and if you can’t, consider decrypting and encrypting messages using an external, dedicated application.
And remember, the safety of your messages also depends on the security of your correspondents, so encourage them to use clients that are safe from EFAIL too. You should even think about asking them to confirm which versions they’re using to ensure it’s safe to correspond.
The Fixes in Detail
The researchers’ publication contains a proof-of-concept exploit that affected users who protect their communications with PGP. The exploit allowed an attacker to use the victim’s own email client to decrypt previously acquired messages (or other protected information) and return the decrypted content to the attacker without alerting the victim. The attacker needed access to the previous (still encrypted) text. Unfortunately, an attacker that has access to your old encrypted emails is exactly the serious threat that the most targeted populations use PGP to protect against.
The attack, once understood, is simple to deploy. However, despite the fact that the vulnerability had been disclosed to the relevant developers months ago, many of the most popular ways of using PGP and email had no protection against the attack at the time of the paper’s publication. Because so many people in extremely vulnerable roles—such as journalists, human rights defenders, and dissidents—expect PGP to protect them against this kind of attack, we warned PGP users to hold off using it for secure communications and disable PGP plugins in their email clients until these problems were fixed.
That advice prompted a lot of discussion: some approving, some less so. We’re talking to everybody we can in the PGP community to hear about their experiences, and we hope to publish the deeper lessons we, and others, have learned from EFAIL and how it was handled.
But for now, we’ve been concentrating on testing whether the exploit has been successfully patched in the software setups most used by vulnerable groups.
Turning Off HTML vs Disabling Remote Content Loading
Many experts, after reading the research paper, were surprised we recommended disabling PGP in email, when it seemed like some less drastic options (such as turning off remote resource loading, and/or turning off their email client’s ability to read and decrypt HTML mail) would have sufficed to fend off the most obvious EFAIL attack.
But upon closer reading of the text of the paper, it becomes clear that the researchers describe exactly how to circumvent mail clients' attempts to block the remote loading of resources. Other researchers have created, and continue to create, exploits that can defeat this supposed protection. Further, with remote content turned off, a button is usually present to load remote content by choice. An alternative label for that innocuous-seeming button would be, “Leak all of my past encrypted emails to an attacker.” Having that button available to users is giving them an opportunity to shoot themselves in the foot.
Then there’s the other option for protection: turning off HTML in mail clients. At the time, the researchers were not confident that this protection was sufficient: they had already discovered a way of defeating S/MIME, a comparable email encryption standard, with HTML mail turned off. And while their simplest example used HTML to steal data, they also spelled out hypothetical attacks that might not need it.
Turning off HTML mail appears to be holding up as a defense. Unfortunately, not every client has this as an option: you can consistently turn off HTML in Thunderbird, but not in Apple Mail.
So, our first recommendation: whatever client you use, turn off HTML email. We have instructions for this in Thunderbird below.
Thunderbird+Enigmail Users Can Turn PGP Back On
Thunderbird and Enigmail’s developers have been working on ways to protect against the EFAIL vulnerabilities. As of version 2.0.6 (released Sunday May 27), Enigmail has released patches that defend against all known exploits described in the EFAIL paper, along with some new ones in the same class that other researchers were able to devise, which beat earlier Enigmail fixes. Each new fix made it a little harder for an attackerto get through Enigmail’s defenses. We feel confident that, if you update to this version of Enigmail (and keep updating!), Thunderbird users can turn their PGP back on.
But, while Enigmail now defends against most known attacks even with HTML on, the EFAIL vulnerability demonstrated just how dangerous HTML in email is for security. Thus, we recommend that Enigmail users also turn off HTML by going to View > Message Body As > Plain Text.
1. First click on the Thunderbird hamburger menu (the three horizontal lines).
2. Select “View” from the right side of the menu that appears.
3. Select “Message Body As” from the menu that appears, then select the “Plain Text” radio option.
Viewing all email in plaintext can be hard, and not just because many services send only HTML emails. Turning off HTML mail can pose some usability problems, such as some attachments failing to show up. Thunderbird users shouldn't have to make this trade-off between usability and security, so we hope that Thunderbird will take a closer look at supporting their plaintext community from now on. As the software is now, however, users will need to decide for themselves whether to take the risk of using HTML mail; the most vulnerable users should probably not take that risk, but the right choice for your community is a judgment call based on your situation.
Apple Mail+GPGTools Users Should Keep PGP Disabled For Now
Since Apple Mail doesn’t provide a supported plugin interface, the GPGTools developers have faced a difficult challenge in updating GPGTools to defend against EFAIL. Additionally, Apple Mail has no option for users to view all emails without HTML (also called plaintext-only). Apple Mail only provides an option to disable remote content loading, which does not defend against existing attacks.
Despite the challenges with Apple Mail, the GPGTools developers are working hard on fixes for all reported EFAIL-related attacks, and a release is expected very soon. That said, we do not recommend re-enabling GPGMail with Apple Mail yet.
Other Clients
The EFAIL researchers did a great job reviewing and finding problems with a wide set of desktop email clients. Using one of the lesser-known clients may or may not leave you vulnerable to the specific vulnerabilities outlined in the paper. And depending on the way the patches work, the patches may or may not protect against problems discovered by future research into the same class of problems.
Our advice for all PGP email users remains the same: if you depend on your email client to decipher PGP messages, make sure it doesn’t decode HTML mail, and check with its creators to see whether they’ve been working on protecting against EFAIL.
The Future of Pretty Good Privacy
Unlike situations where a fix only requires one piece of software to be mended and upgraded, some of the EFAIL problems come from interaction between all the different pieces of using PGP with email: email clients like Thunderbird, PGP plugins like Enigmail, and PGP implementations like GnuPG.
There are lots of moving parts to be fixed, and some of the fixes involve changes to the very core of how they function. It’s not surprising that it takes time to coordinate against attacks that exploit the complex interconnections between all of these parts.
EFF has fought, in the courts and in the corridors of power, for the right to write, export, and use decentralized and open source encryption tools, for as long as PGP has existed. We’re under no illusion about how hard this work is, or how underappreciated and underfunded it can be, or how vital its results are, especially for those targeted by the most powerful and determined of attackers. The transparent and public cooperation of all the parts of the PGP system make for some hard conversations sometimes, but that’s what keeps it honest and accountable—and that’s what keeps us all safe.
But if we’re to continue to use and recommend PGP for the cases where it is most appropriate—protecting the most vulnerable and targeted of Internet users—we need to carry on that conversation. We need to cooperate to radically improve the secure email experience, to learn from what we know about modern cryptography and usability, and to decide what true 21st-century secure email must look like.
It’s time to upgrade not just your PGP email client, but also the entire secure email ecosystem, so that it’s usable, universal, and stable.
from Deeplinks https://ift.tt/2H206AB
0 notes