Gmail Email Traffic Connections Now Encrypted To Protect Its Users

It was announced today by Google that is protecting its Gmail users by providing enhanced encryption.

Gmail will “always use an encrypted HTTPS connection” 

When a user connects to read its email, and subsequently transmits a new communication, it will now be always encrypted.

 This security layer also ensures that even when traffic at a point of delivery and processing stages as it travels between Google servers and data communication highways will have better security from any possible third party attempts to read confidential data.

As a positive consequence is that general users even whilst at different locations checking their emails, will be better protected regardless of their type of connected network such as a public location. 

Thus leaving users without the need to worry about security settings or third party illegal attempts to intercept communications using technology such as public wifi.

Feel free to add your comments to this post, thank you.

Facebook Improves Security Moving Users to HTTPS, Slower Speed

Facebook is now improving security following an infrastructure upgrade and moving all its users to HTTPS, the transition period will start this week and it was announced that will “slow down connections only slightly.” Nevertheless, users will still be able to opt-out of HTTPS for maximum speed. Following this development to include all users as a standard setting, the context is where HTTPS (Hypertext Transfer Protocol Secure) was already available to all users, nevertheless most users did not change or selected their account settings to use this secure connection.

Following a Facebook Developer Blog post, the security manager Frederic Wolens stated:

“It is far from a simple task to build out this capability for the more than a billion people that use the site and retain the stability & speed we expect, but we are making progress daily towards this end. This may slow down connections only slightly, but we have deployed significant performance enhancements to our load balancing infrastructure to mitigate most of the impact of moving to HTTPS, and will be continuing this work as we deploy this feature.”

New Security Palm Recognition for Smartphones Developed

In a context where smartphones current security features are based around password protection on the screen, SIM lock pin, cloud backups, remote location and data wipe security. It then follows that switching on security is not the best, as a result a new mobile technology implementation from the Japanese Softbank Mobile Corp in partnership with Universal Robot Co Ltd allows for palm recognition security on smartphones.

This idea is not new, however in the past many attempts have been unsuccessful as the technology and human palm characteristics combination features, were never quite small enough to be used in mobile phones.

This new implementation and solution is based on utilising software pattern recognition in combination with built-in smartphone cameras thus streamlining the amount of the required data analysis or pre-processing.

The way users will be able to use the security recognition logging in feature, is by simply showing their palm over the camera, in the case where a user is using the mobile phone in the dark or under low light conditions, then it is anticipated that the flash camera will automatically turn on in order to scan the palm. This new technology will be available soon towards the end of the year starting in Japan. Source 

New Security Challenges from HTML5

As  HTML5 is gaining in popularity, subsequently new web applications are being created on a daily basis, however in terms of security new challenges are also being created particularly for enterprise security professionals.

The predictions for 2012,  from the HTML5 technology as it introduces new capabilities for rich web application, nevertheless new possible attack gates may be created in combination.

From the HTML4 this technology has powered most of the web for many years, as it consists of a low capability programming language, as a result developers have added and complemented it by embedding programming interpretive objects such as JavaScript, Flash, among others. In terms of security these objects are capable of compromising users as they can inject and manipulate vulnerabilities which in turn made the whole system very insecure.

With HTML5 the requirement to have these embedding objects are almost non existent, as this language and standards has already all functionality and capabilities built in, thus no need to use any of the interpretive objects.

With this new rich capabilities these include a full database that enables users to store gigabytes of information.  As an example, developers and users can execute and process full frame animation, 3D virtual reality or store applications inside the browser.

As a consequence from this technology, in terms of security by allowing to  store data within the browser, the browser itself can become a target and a tool for cyber criminals.

Furthermore, new sandboxing in HTML5 also makes "clickjacking" (tricking web users into revealing confidential information or taking control of their computer while clicking on a seemingly innocuous link) more of a risk, as web pages are no longer able to identify where commands are coming from. HTML5 from its new capabilities around cookies manipulations, which could make the removal of cookies after a certain period redundant.

If developers don't code their sites properly the security implications are that bad code may be run under a huge database of the URLs that users have been to and track all of users field input all from the browser.

Despite these new security challenges problems, there are also security benefits. These include: A reduction of the need for unverified add-ons, furthermore with HTML5 there is the capability for client-side input validation, as well as libraries that can help deal with SQL injection challenges.

All Computers May be Blocked to Connect to the Internet, Initially.

An idea to block malicious computers was presented by a senior researcher from Microsoft.  It follows that risky computers may be blocked from connecting to the internet due to threat that these present to the entire web infrastructure.

This idea is mainly intended to address the security issue that botnets - networks of infected computers present, subsequently acting like a drome under the control of internet organized criminal associations.  It follows that once these machines are spotted, they can be put in temporary quarantine in order to evaluate and prevent the spread of malicious software deployments.

"Just as when an individual who is not vaccinated puts others' health at risk, computers that are not protected or have been compromised with a bot put others at risk and pose a greater threat to society," Senior Researcher at Microsoft.

The way these computers operate is by being recruited into a wider network as soon as they lose control of their instructions by becoming infected with malicious code.  Networks can consist of a few hundred to a few thousand Windows machines.  Furthermore, some can contain millions of PCs.  These networks once dominated by criminals have the capability of instructing others for various means including pumping out spam or mounting "denial of service" attacks against websites, as an example.

This idea of blocking computers to the internet was  presented at the International Security Solutions Europe (ISSE) Conference in Berlin, Germany, where it details that in order for a computer to first connect to the internet it must pass a "health test" to prove that it poses no threat to the whole internet infrastructure.

"Although the conditions to be checked may change over time, current experience suggests that such health checks should ensure that software patches are applied, a firewall is installed and configured correctly, an antivirus program with current signatures is running, and the machine is not currently infected with known malware," As written in the accompanying paper.

Microsoft said that to make its plan work itwould need four steps, including defining a health computer, creating a trusted system for health certificates and finding a way for ISPs to process and act on them.