Microsoft warns Windows XP users that malware will jump

Microsoft yesterday again but the scare into Windows XP users, telling them that after April 8, 2014, the chance that malware will infect their PCs could jump by two-thirds.

The claim, made by Tim Rains, director of Microsoft's Trustworthy Computing group, came on the heels of the release of the company's twice-annual Security Intelligence Report ( download PDF).

Following up on comments he made in August, Rains again warned Windows XP stragglers to expect an increase in attacks when the aged operating system exits support in five months.

"After end of support, attackers will have an advantage over defenders who continue to run Windows XP," Rains asserted in a Tuesday post to a company blog. "After April next year, when we release monthly security updates for supported versions of Windows, attackers will try and reverse engineer them to identify any vulnerabilities that also exist in Windows XP. If they succeed, attackers will have the capability to develop exploit code to take advantage of them."

Rains then went a step further, and cited statistics from Microsoft's own telemetry-gathering efforts to give customers an idea of the increased threat after support ends.

"We have already had a glimpse into what happens when a Windows XP-based platform goes out of support," Rains added. "In the two years after Windows XP Service Pack 2 went out of support, its malware infection rate was 66% higher than Windows XP Service Pack 3 -- the last supported version of Windows XP."

Support for Windows XP Service Pack 2 (SP2) ended in July 2010, a little over two years after the release of XP SP3.

In a chart accompanying his comments, Rains showed the higher infection rate of Windows XP SP2 when compared to SP3. The two started out with similar infection rates, but began to diverge in the first quarter of 2011, with the largest gap in Q4 of that year. Since then, the difference between the two has narrowed: In the fourth quarter of 2012, the latest shown in the chart, the gap appeared to be approximately four computers per thousand -- 12 for SP3 versus 16 for SP2 -- representing a 33% increase in the latter's infection rate.

While there could be other reasons for the different infection rates, including lack of up-to-date security software, Rains' implied assumption was that it was because XP SP2 had not been patched -- because it could not be -- while XP SP3 had been.

Microsoft has been extremely blunt about the danger customers will face next year after Windows XP support vanishes, belittling the creaky OS's security prowess, even attacking it at times. That's unusual. Microsoft's usual tactic is to simply ignore an older operating system, as it does Windows Vista, the flop that now accounts for just 4% of all Windows PCs.

"You never heard Microsoft tell Windows Millennium users that they had to upgrade," said Michael Cherry, an analyst with Directions on Microsoft, referring to a September 2000 edition that quickly vanished after XP's appearance a year later.

But things are different this time around.

"This is the first time that Microsoft has had to put its foot down," Cherry continued. "Pre-XP, there were always sufficient changes to the underlying hardware and the operating system to prompt people to upgrade to newer PCs and a new Windows. With XP that didn't happen. It's the first time when we've had insufficient hardware changes. XP was the first Windows that was 'good enough.' So this isn't like before."

Cynics see other reasons behind Microsoft's bash-XP drumbeat, as the company has used, included on Tuesday, the opportunity to trumpet Windows 8's improved security and urged customers to upgrade to the newest OS. And it's not like Microsoft's hands are tied; it's not being forced into dropping Windows XP off the support list. The company's security engineers will continue to craft patches for XP for at least several years after next April. Only large enterprises and organizations that have paid millions for special support contracts will receive those patches, however.

But Microsoft will stand firm, said Cherry and others yesterday.

"Microsoft is saying, 'Look, get the message ... we're serious this time,'" Cherry said. "If they waver in any way from this message, people will stop migrating."

"We have to think about an operating system like any other product. It has a use-by date," said John Pescatore, director of emerging security trends at the SANS Institute. "After that, you're on your own. You can't continue to expect them to release patches forever. When a tire is bald, you can't just put more patches on it."

While Pescatore has long held the opinion that Microsoft would not back off its XP retirement plans -- saying last year that the company had drawn "a line in the sand" -- Cherry once thought there was a chance that Microsoft would change its mind as the deadline approached.

No longer.

"I'm drifting away from that [opinion]," Cherry said Tuesday. "XP is dropping faster that I had expected."

True. Since August 1, according to metrics company Net Applications, Windows XP's user share has dropped nearly six percentage points. As of the end of September, it accounted for 35% of all editions of Windows in use worldwide.

Microsoft claims it's much lower than that in the enterprise. Last week, Amy Hood, the company's chief financial officer, said that 75% of corporate PCs were running Windows 7, implying that most of the rest were still on XP.

"When you start to get into 25% and below [for XP], support retirement is going to be a less significant event," contended Cherry, especially where Microsoft is concerned, in the enterprise, the bastion of Windows. "That's Microsoft's number. It's what they believe," Cherry added, meaning other estimates of XP's prevalence are immaterial to the company as it ponders, if it ever did, a support extension.

Not every expert concurred. Lawrence Pingree, an analyst with Gartner, believed Microsoft owed it to customers to continue supporting Windows XP. After all, the company's own missteps -- the delay between XP and Vista, the rough edges of the latter, and a two-year extension to support for XP -- were largely the cause of the OS's longevity and resulting entrenchment.

"Anyone can understand why any OS manufacturer wants to dedicate resources for new versions of their OS," said Pingree in an email. "However, security patch availability should be based on market share and penetration rates, otherwise the manufacturer does a disservice to its customers.

"Using an analogy: Does a car manufacturer bear responsibility to recall versions of cars that are being driven but not actively manufactured? My sense is yes. What is the responsible thing to do?" Pingree asked.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His email address is gkeizer@computerworld.com.

Read more about operating systems in Computerworld's Operating Systems Topic Center.

16.01 | 0 komentar | Read More

iPad trade-in interest jumps

Long before Apple started selling its iPad Air, more than double the number of consumers asked for price quotes on their older tablets than last year, a pair of buyback companies said.

The trade-in activity hints at strong early sales for the iPad Air.

"It's a huge upgrade from the earlier iPads," said Anthony Scarsella, chief gadget officer at Boston-based Gazelle, one of the companies that buys used consumer electronics. "It's much lighter and thinner."

Scarsella said Gazelle's trade-in price quote volume was up 130 percent over October 2012.

Jeff Trachsel, chief marketing officer at NextWorth of Billerica, Massachusetts, cited a similar statistic. "Compared to last October, our quote volume is up 127 percent," Trachsel said. "iPad trade-in quote requests came in early, peaked higher and have maintained their level longer than last year."

Join the family

Last year, Apple unveiled the fourth-generation 9.7-inch iPad and the iPad Mini on October 23 and began selling both on November 2. This year, Apple hosted its iPad introduction on October 22 and started iPad Air sales today. The refreshed iPad Mini, which will sport a higher-resolution "Retina" screen, will reach retail sometime later this month, Apple has said.

Both Trachsel and Scarsella credited the redesign of the iPad Air—the tablet is 20 percent thinner and at one pound, 29 percent lighter than its predecessor—with consumers' increased interest in unloading older tablets.

"The design change," said Scarsella when asked what drove the higher trade-in volume at Gazelle. "We see that with the iPhone as well. Interest spikes every two years when Apple changes the look of the iPhone."

An amplifier, Scarsella said, was the fact that the iPad has had the same basic design since it first appeared in 2010, making the iPad Air even more desirable by the Apple faithful.

Aftermarket thrives

The electronics "re-commerce" business has exploded in the last several years as consumers and businesses have realized their devices retain value. Companies like NextWorth, Gazelle and a host of others specialize in buying used tablets, smartphones, personal computers and even game consoles, then reselling them on eBay or in bulk to distributors in developing countries where demand is high but incomes are low.

As the practice has become more mainstream, buyback companies have regularly recorded increases in the number of trade-in quotes they dispense and the number of devices that they purchase. Because of the higher prices Apple charges for its goods, and the devices' high resale value, iPhone and iPad owners seem to be especially eager to cash in on their old devices so that they can buy the newest ones.

The third-generation iPad has been the most popular tablet consumers hope to sell, with NextWorth pegging its percentage of all October quotes at 35 percent and Gazelle citing 31 percent. Apple launched the third-generation iPad in March 2012. In second place was the 2011 iPad 2, accounting for 20 percent of NextWorth's quotes and 22 percent of Gazelle's.

Relatively few of the quotes provided by NextWorth (17 percent) or Gazelle (12 percent) have been for the fourth-generation iPad, which debuted a year ago.

Quotes for the original iPad Mini tailed off significantly after the October 22 announcement by Apple that it would not start shipping the revamped 7.9-inch tablet until later this month, Trachsel and Scarsella said.

"I think that most people with a Mini are going to stay with the [Retina] Mini," said Scarsella, explaining the trade-in fall-off. He expected interest to resume once Apple reveals when it will begin selling the tablet, which will start at $399, $80 more than last year.

"In September, iPad Mini quotes were up five times from the month before," said Scarsella. "People that own that tablet are ready to upgrade. They're not getting a lesser product in the Mini this year because it has the same components as the iPad Air. It's just a different-sized screen."

On Thursday, NextWorth was offering $200 for a 16GB Wi-Fi-only, third-generation iPad; Gazelle quoted $180 for the same device.

Buyback vendor NextWorth will pay $200 for a used third-generation iPad with 16GB of storage space. Rival Gazelle quoted $180.

16.01 | 0 komentar | Read More

Considering a new video card? Check your monitor first

While CPU performance seems to be leveling off, GPU performance continues to rise at a considerable pace, with each generation leaving the last generation in the dust. That may be great for gamers and graphics professionals, but depending on the monitor you use, there might be no point in upgrading any more.

Desktop monitors (I'm not talking laptops except for the high-end laptops) tend to vary in size from 20 to 24 inches for mainstream/standard monitors, and 27 to 30 inches for the high end. One thing all of the sub-24-inch and many 27-inch-plus monitors have in common is the resolution. They have pretty much standardized on 1920 by 1080. That's because 1920 by 1080 is the resolution for HDTV, and it fits 20 to 24-inch monitors well. Virtually all 2560 by 1440 monitors are 27 inches and larger.

Here's the thing: at that resolution, these new GPUs are so powerful you get no major, appreciable gain over the older generation. Unless you are using the next step in monitors, 2560 by 1440, upgrading to the new AMD R290 or Nvidia GTX790 is a waste of $500+. Yes, those cards really cost that much.

GPU power and pixels

The more pixels on your screen, the faster the GPU needs to be. With most everyone locked at 1920 by 1080, current GPUs are simply fast enough. When you jump from 1920 to 2560, that means millions more pixels to animate, and that's where the new, high-end GPUs see a notable jump in performance.

"The current high-end of GPUs gives you as much as you'd need for an enjoyable experience," said Chris Angelini, editorial director for Tom's Hardware Guide. "Beyond that and it's not like you will get nothing, it's just that you will notice less benefit."

Frame rates may get faster with a R290 or GTX 780, but your eye can't detect it. There is considerable debate over what is the limit of the human eye when it comes to frame rate; some say 24, others say 30, while others say it's higher. But one thing is certain: a game with a frame rate of 90 is not really different from a frame rate of 80.

Angelini places the sweet spot on performance at 1920 by 1080 as AMD's Radeon R280x, a $300 card, and the Nvidia GTX 770, which has recently seen a price cut and is now around $400. As for integrated GPUs that come with Intel and AMD CPUs, there's plenty of room to grow.

"Integrated GPUs are still too slow for 1080p games. They max out at 720p. We're still a couple of generations from them maxing out 1920 monitors," he said.

Different needs

For graphics professionals, things are different. Apps like Photoshop and AutoCAD come with filters and renderers that utilize the GPU and they can always do better, since this is background computation. The frame rate article is moot anyway since if you are a graphics professional, chances are very good you already have a 2560 by 1440 monitor on your desk.

Angelini said 2560 is the next big barrier to cross, and the prices are coming down. The Nexus 10 tablet is $399 and it features a 2560-by-1600 screen. Most 2560 monitors sold at NewEgg.com are at least $500, but there is one vendor, Auria, that has a $399 monitor.

I recently bought a new 24-inch LED monitor for $180 because my six year old LCD monitor was experiencing color bleed. It's beautiful and functions perfectly. If I get six years out of this one, I fully expect my next display will be a 2560-by-1440, and for roughly the same price.

On a side note, my new monitor is an Asus, while the old one was Viewsonic. I stood at the wall of monitors in my local Fry's for several minutes and walked the PC aisles and didn't see a single Viewsonic. It was all Asus, LG, and Samsung. The rep I spoke to actually had a clue (rare for Fry's) and said he couldn't remember the last time they sold a Viewsonic monitor. How the mighty have fallen.

16.01 | 0 komentar | Read More

Bing, Twitter continue their search party

Microsoft bills its Bing search engine as a social one, and to keep it that way it's renewing a partnership with Twitter to keep tweets appearing in Bing search results, the companies said Friday.

Tweets have been featured prominently in Bing for a few years, as part of Microsoft's effort to incorporate plenty of information from sites like Twitter, Facebook and Klout. With a smaller market share, the search engine is far from beating Google but hopes to attract more users by weaving in more social data.

"Whether it's a politician, celebrity, thought leader or friend, our renewed partnership with Twitter ensures that you have near real-time access to what people are tweeting tailored to what you're searching for," Microsoft said in a brief blog post Friday. It didn't say how long the partnership has been renewed for.

Google is the market leader in search with nearly 67 percent share in the U.S., according to a September comScore ranking. Microsoft was a distant second with roughly 18 percent share, while Yahoo, which uses Bing on the back end, came in third at about 11 percent.

Microsoft gave Bing a makeover of sorts in September. Along with a new look, it created a new results view that merges social posts with factual information about people, places and things.

Competition between Twitter and rivals like Microsoft, Google and Facebook is likely to heat up once the social network goes public on the New York Stock Exchange. But, "we also depend in part on Internet search engines, such as Google, Bing and Yahoo, to drive traffic to our website," Twitter said in its IPO documents.

16.00 | 0 komentar | Read More

Windows 8.1 creates mouse-control problems for gamers

Gamers who upgraded their PCs to Windows 8.1 are enduring mouse-control problems that affect their ability to play, a problem Microsoft acknowledged this week.

Windows 8.1 causes a subpar mouse performance for video games under certain circumstances and problem reports have been pouring into Microsoft's tech support site, where affected users are actively discussing the issues on multiple threads.

On Wednesday, a Microsoft representative expressed gratitude for the information gamers have provided, which will be useful for troubleshooting, but admitted that the company hasn't yet found a solution.

"First off, we want to thank our gaming community for the detailed feedback many of you have provided on these issues. While we don't have a date yet for the release of a fix, we are working to get these issues resolved as quickly as possible," wrote a Microsoft forum moderator identified as Naman R.

The Microsoft official added that the mouse problems people are experiencing are varied and manifest themselves in different ways depending on the game being played, mouse input methods and other elements. Microsoft has categorized them as "mouse lag" issues.

Problems include mouse jitters, which causes the cursor to jump forward and back; scale disparity, where the distance the cursor moves on the screen doesn't match the distance the mouse moves; and inadequate mouse polling frequency, which affects speed and reaction time.

"For these situations, check the game settings. If the game supports raw input from the mouse, enabling it may solve the issue," the official wrote.

In his post, he also includes some work-arounds for other problems, such as when a mouse can't reach all areas of a game window.

"When we have more information from our investigations, we will update this post. Thank you very much for your patience," he wrote.

A Microsoft spokesman said via email the company has no additional comments about these issues beyond what it has said on the support forums.

Windows 8.1 became available on the Windows Store on Oct. 17, and it has run into several problems that have made it difficult or impossible at times for some users to download and install it on their PCs and tablets.

For example, an outdated firmware issue left some Surface RT tablets unable to boot up after users installed the OS update. That took several days to fix and during that period Microsoft pulled the update from the Windows Store.

In addition, as IDG News Service first reported this week, the presence of some outdated drivers and incompatible software has made it impossible for other users to complete the Windows 8.1 installation, another issue Microsoft is looking into that started affecting users on the day of the OS' launch.

Moreover, another group of users who own older PCs that are able to run Windows 8 can't install 8.1 because the update has additional hardware requirements, as reported by PC World.

16.00 | 0 komentar | Read More

Nexus 5 first impressions: It's the software, stupid

You may still be waiting for your Nexus 5 order to ship, but Google was nice enough to deliver a unit to our offices early Friday morning. While I plan to put the Nexus 5 through its paces for our official review, I thought I'd share some of my initial thoughts after spending just a few hours with the handset. The Nexus 5 is quite impressive, both in terms of hardware and software, but there are a few aspects of the phone that give me pause and keep me from falling completely in love with it.

Not too plasticky

IMAGE: Michael HomnickThe Nexus 5

The Nexus 5 is roughly the same size as the Samsung Galaxy S4, but it's not as plasticky and it feels a lot more boxy than Samsung's flagship Android phone. A colleague described the Nexus 5 as being, "plastic, yet not unapologetically plastic like the iPhone 5c" and I kind of understood his point: The Nexus 5 doesn't feel cheap but it also lacks the premium feel you get from phones like the iPhone 5s or HTC One. The soft rubbery coating on the back of the Nexus 5 does gather fingerprints, but you can easily wipe them off with a tissue or cloth.

The 5-inch 1080p display on the Nexus 5 looks sharp and definitely feels like a step up from the 1280-by-768-pixel display on the Nexus 4, but the phone's square corners make it a bit difficult to reach the top most edges of the screen without readjusting your grip. The protruding camera lens on the back of the phone prevents it from resting flat on a table and I'm worried that it'll be extremely easy to damage. Unless you're always putting the phone screen down, I fear it's only a matter of time before your Nexus 5 has a nice big scratch on its lens.

IMAGE: Michael HomnickThe Nexus 5's large lens may just be its biggest design fault.

KitKat is pretty tasty

Of course the Nexus 5 just wouldn't be a Nexus if it wasn't running the latest version of Google's mobile OS. Although its version number may suggest that it's just a minor update, Android 4.4 KitKat actually has a surprising number of goodies and improvements that make it feel significantly different to Android 4.3 Jelly Bean. The interface feels snappier, the animations look smoother, and phone as a whole feels more like a Google phone.

The interface changes extend throughout the OS, but are most noticeable on the home screen and in the app drawer. There's a persistent Google search bar at the top of every home screen that you can voice activate by saying "OK Google," and Google Now has been given its own home screen pane for even easier access. The app drawer ditches the dark aesthetics that were introduced in Android 4.0 Ice Cream Sandwich and appears to have relocated widgets off to their own little corner of the OS.

IMAGE: GoogleThe Google search bar on the home screen has been tweaked slightly.

Even as someone who's used Android since the very beginning, I couldn't help but feel overwhelmed as I poked my way around the OS. There's a lot to take in, and I have a feeling people (who don't read change logs or have already taken apart the KitKat AOSP image) will still be finding surprises for several months after KitKat makes its way out to the general public. In many ways KitKat is the defining feature of the Nexus 5, as the phone itself feels very run of the mill. It's very nice hardware for the price, but you could throw it in a lineup with a bunch of other black Android phones and not notice much of a difference.

Be sure to check back early next week for our review of the Nexus 5 and my final thoughts on the phone.

16.00 | 0 komentar | Read More

iPad Air still coveted by Chinese consumers, despite rise of Android tablets

Android tablets may be on the rise in China, but that hasn't stopped Beijing resident Fu Zheng from buying Apple's latest iPad product. He was among the first to get his hands on the device on Friday when Apple launched the iPad Air at one of its local stores in the city.

"Everyone thinks Apple products are good," said Fu, who also own's the third and fourth generation iPads.

Apple still remains the leading tablet vendor in China, but increasingly more consumers in the country are buying Android tablets. In this year's second quarter, Apple's tablet shipments to the Chinese market fell to a 28 percent market share, while competing products from Samsung Electronics, Lenovo and little-known "whitebox" vendors saw shipments increase, according to research firm IDC.

Apple's China tablets shipments will pick up with the arrival of the iPad Air, and the iPad mini, slated to arrive later this month, said IDC analyst Dickie Chang. "We think Chinese customers will have a positive response to the iPad Air," he said, pointing to the tablet's light weight, thinner design, and improved performance.

But in China, Android tablets will continue to eat away at Apple's market share over time, he added. "Lenovo, Acer, Asus, Sony, Samsung, all these vendors are providing Android solutions," he said. "Apple's products I think have good performance and the quality is good, but the price is still different. There are now Android tablets at $100, $150."

In China, Apple's iPad Air starts at 3588 yuan (US$585). But on Friday, customers waiting outside the Apple store in Beijing's Sanlitun district were eager to buy the product, despite its higher price over Android tablets.

"I've bought Android products before," said a 20-year-old, with the surname Li, who waited in line. "But I think I want to buy a tablet with higher quality," he added, referring to the iPad Air.

About 50 people waited in line before the Apple store opened at 8 a.m. on Friday. In the past, newly launched products from the company have attracted massive crowds of hundreds when first day of sales started. But since July last year, Apple has implemented a reservation system at its Chinese stores to cut down on lines and prevent customer skirmishes from erupting.

"It was easy to make a reservation," said Fan Huajie, who wanted to upgrade to the latest Apple tablet. "I have all of their iPads," he added.

16.00 | 0 komentar | Read More

Google, Samsung and others sued by acquirer of Nortel patents Rockstar

The Rockstar Consortium that acquired Nortel Networks' patents filed Thursday patent infringement suits against Google, Samsung, HTC and five other companies.

In a complaint in the U.S. District Court for the Eastern District of Texas, Marshall Division, Rockstar and subsidiary NetStar Technologies have alleged that Google has infringed seven of the patents acquired from Nortel.

The patents, all titled "Associative Search Engine," relate to an invention used to provide advertisements based on users' search terms.

Backed by Microsoft, Apple, RIM, Ericsson and Sony, Rockstar acquired Nortel's patents for US$4.5 billion after outbidding Google in 2011.

Google later acquired Motorola Mobility last year for $12.5 billion, in a deal that aimed at ownership of Motorola's patent portfolio.

The search giant was aware of the patents-in-suit at the time of the auction, Rockstar of Ottawa, Canada, said in its complaint. "Despite losing in its attempt to acquire the patents-in-suit at auction, Google has infringed and continues to infringe the patents-in-suit."

The complaint, which asks for past and future damages arising out of Google's infringement, demands a trial by jury on all issues. Google could not be immediately reached for comment.

Rockstar and another subsidiary MobileStar Technologies have also filed a complaint against Samsung Electronics for infringement of seven other patents, including U.S. Patent No. 6,037,937 ("the '937 patent") entitled "Navigation Tool for Graphical User Interface."

Samsung Mobile Communication devices that have an operating system configured "to support Gallery, Email, Maps and Browser functionality," allegedly infringe claims of the '937 patent, according to the complaint. Samsung's Mobile Hotspot feature which allows sharing of a mobile device's data connection with other devices by turning it into a wireless access point is also alleged to infringe claims of U.S. Patent No. 6,128,298 ("the '298 patent") entitled "Internet Protocol Filter."

Rockstar has sued HTC for alleged infringement of the same seven patents that figure in the complaint against Samsung, while Asustek Computer is alleged to have infringed six of the patents.

16.00 | 0 komentar | Read More

Tech industry calls for 'oversight and accountability' of NSA surveillance

Internet companies in the U.S. are demanding that the surveillance practices of the U.S. should be reformed to enhance privacy protections and provide "appropriate oversight and accountability mechanisms."

In a letter on Thursday to the chairman and members of the Committee on the Judiciary, a copy of which was provided by an industry source, Facebook, AOL, Apple, Google, Microsoft and Yahoo said they welcomed a debate about how to protect both national security and privacy interests and applauded the sponsors of the USA Freedom Act, a legislation aimed to end bulk data collection by the National Security Agency, for their contribution to the discussion.

The companies had until now focused on asking the government for permission to reveal information on users' data requests by the NSA, which are covered under "gag orders" that prohibit recipients of orders from discussing them in public.

Google and Microsoft, for example, filed motions before the Foreign Intelligence Surveillance Court to be allowed to provide aggregate statistics on orders and directives that were received under the Foreign Intelligence Surveillance Act and related regulations, which the government has so far refused.

Yahoo asked the court to allow it to make public documents from a 2008 dispute over a data request that would show that the company had resisted the order. The Internet companies are attempting to counter disclosures by former NSA contractor, Edward Snowden, that the government had real-time access to content on the servers of the Internet companies under a surveillance program called Prism, which these companies deny.

The stakes for the companies were raised this week after The Washington Post reported that NSA has secretly broken into the main communications links that connect Yahoo and Google data centers around the world, giving it the ability to collect metadata and actual content from hundreds of millions of user accounts, many of them belonging to Americans.

In the letter, the Internet companies wrote that transparency will help to counter "erroneous reports that we permit intelligence agencies 'direct access' to our companies' servers or that we are participants in a bulk Internet records collection program." The companies said that they have consistently stated that they only respond to legal demands for customer and user information that are targeted and specific.

"Allowing companies to be transparent about the number and nature of requests will help the public better understand the facts about the government's authority to compel technology companies to disclose user data and how technology companies respond to the targeted legal demands we receive," according to the letter.

But transparency is only a first step for the Internet companies, who are now also asking for reform of government surveillance practices. "We urge the Administration to work with Congress in addressing these critical reforms that would provide much needed transparency and help rebuild the trust of Internet users around the world," according to the letter, which was addressed, among others to Patrick J. Leahy, chairman of the Senate Committee on the Judiciary, who is one of the sponsors of the USA Freedom Act.

John Ribeiro covers outsourcing and general technology breaking news from India for The IDG News Service. Follow John on Twitter at @Johnribeiro. John's e-mail address is john_ribeiro@idg.com

16.00 | 0 komentar | Read More

Silent Circle, Lavabit unite for 'Dark Mail' encrypted email project

Two privacy-focused email providers have launched the Dark Mail Alliance, a project to engineer an email system with robust defenses against spying.

Silent Circle and Lavabit abruptly halted their encrypted email services in August, saying they could no longer guarantee email would remain private after court actions against Lavabit, reportedly an email provider for NSA leaker Edward Snowden.

Their idea, presented at the Inbox Love email conference in Mountain View on Wednesday, is for an open system that could be widely implemented and which offers much stronger security and privacy. As envisioned, Dark Mail would shield both the content of an email and its "metadata," including "to" and "from" data, IP addresses and headers. The email providers hope a version will be ready by next year.

"The issue we are trying to deal with is that email was created 40 years ago," Jon Callas, CTO and founder of Silent Circle, in a phone interview. "It wasn't created to handle any of the security problems we have today."

Silent Circle, Lavabit and at least one VPN provider, CryptoSeal, shut down their services fearing a court order forcing the turnover of a private SSL (Secure Sockets Layer) key, which could be used to decrypt communications.

Lavabit was held in contempt of court for resisting an order to turn over its SSL key, which in theory allowed the government to decrypt not only Snowden's communications but also those of its 400,000 users. Ladar Levison, Lavabit's founder, is appealing.

Callas said Dark Mail is a collaboration with Levison. Rather than create a closed email service, they decided to design Dark Mail with open-source software components that could be used by any email provider.

"We need 1,000 Lavabits all around the world," he said.

Microsoft's David Dennis, lead principal program manager for the company's Outlook.com webmail portal, said Dark Mail is an "interesting proposal."

"We pay attention to any new innovations, protocols, standards and proposals impacting online communications," Dennis wrote in an email. "And we're always open to discussions with potential partners."

Representatives of Google and Yahoo who attended Inbox Love did not have an immediate comment.

Dark Mail will be crafted around XMPP, a web messaging protocol known by its nickname Jabber, along with another encryption protocol created by Silent Circle called SCIMP (Silent Circle Instant Message Protocol), Callas said.

An adapter will be built that will enable Dark Mail within different email clients. "There's no reason why you couldn't modify Outlook and Exchange to do this," he said.

The private key used to encrypt email will be held on users' systems and not retained by a service provider. Even if the government forced a SSL key to be turned over, users would not be compromised "because all of the messages are encrypted to keys that are sitting in the hands of the recipient," Callas said.

In that case, the party interested in the communication would have to request the encryption key from a person or find another way to decrypt the message.

Snowden's documents showed the NSA was also collecting email metadata, which reveals a sender's and recipient's email addresses, subject line of the email, IP addresses and more. Dark Mail will encrypt the metadata, using the XMPP protocol to signal when a new message has arrived, Callas said.

The alliance is also considering longstanding problems around encryption keys, such as public and private key pairs that are in use for years. "The longer that a key stays around, the bigger of a vulnerability it is," Callas said.

One idea is to create a protocol that would only keep a static public key for just a few hours or a day and then refresh it. Older messages would need to be re-encrypted with a new key to maintain access, but it would provide much better long-term protection for sensitive messages, Callas said.

Also under consideration is "forward secrecy," an encryption feature that limits the amount of data that can be decrypted if a private key is compromised in the future.

Wide use of encrypted email has implications for companies such as Google, which displays advertisements based on email content. In industries such as financial services, companies are required to retain email for compliance regulations.

There's also a convenience factor, as email encryption isn't necessarily easy to implement, especially as people use multiple tablets and mobile phones and desktop computers. Callas said Dark Mail will be flexible, allowing users to send unencrypted email if they don't need an extra level of security.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

16.00 | 0 komentar | Read More