User-visible cryptography in email and web scenarios

Purpose– This paper aims to classify different types of “user-visible cryptography” and evaluate the value of user-visible cryptographic mechanisms in typical email and web scenarios for non-expert IT users.Design/methodology/approach– The authors review the existing literature, and then identify user stories typical to their users of interest. They analyse the risks, mitigations of risks and the limits of those mitigations in the user stories.Findings– The scenarios identified suggest that background, opportunistic encryption has value, but more explicit, user-visible cryptographic mechanisms do not provide any further mitigation. Other mechanisms beyond technological mitigations provide the required mitigation for the users.Research limitations/implications– Further work should be carried out on the trust issues with trusted third parties, as they are intrinsic to global, automated cryptographic mechanisms. The authors suggest that deployed systems should rely on automation rather than explicit user involvement; further work on how best to involve users effectively remains valuable.Practical implications– Deployed systems should rely on automation rather than explicit user dialogues. This follows from recognised aspects of user behaviour, such as ignoring dialogues and unconsciously making a holistic assessment of risk that is mostly mitigated by social factors.Social implications– The user populations concerned rely significantly on the existing legal and social infrastructure to mitigate some risks, such as those associated with e-commerce. Guarantees from third parties and the existence of fallback procedures improve user confidence.Originality/value– This work uses user stories as a basis for a holistic review of the issues surrounding the use of cryptography. The authors concentrate on a relatively large population (non-expert IT users) carrying out typical tasks (web and email).</jats:sec

VoIP security - attacks and solutions

Voice over IP (VoIP) technology is being extensively and rapidly deployed. Flexibility and cost efficiency are the key factors luring enterprises to transition to VoIP. Some security problems may surface with the widespread deployment of VoIP. This article presents an overview of VoIP systems and its security issues. First, we briefly describe basic VoIP architecture and its fundamental differences compared to PSTN. Next, basic VoIP protocols used for signaling and media transport, as well as defense mechanisms are described. Finally, current and potential VoIP attacks along with the approaches that have been adopted to counter the attacks are discussed

Inter-social-networking: Accounting for multiple identities

We argue that the current approaches to online social networking give rise to numerous challenges regarding the management of the multiple facets of people’s digital identities within and around social networking sites (SNS). We propose an architecture for enabling people to better manage their SNS identities that is informed by the way the core Internet protocols developed to support interoperation of proprietary network protocols, and based on the idea of Separation of Concerns [1]. This does not require modification of existing services but is predicated on providing a connecting layer over them, both as a mechanism to address problems of privacy and identity, and to create opportunities to open up online social networking to a much richer set of possible interactions and applications.This work is supported by Horizon Digital Economy Research, RCUK grant EP/G065802/1; and by CREATe, the Centre for Copyright and New Business Models, RCUK grant AH/K000179/1. Packages and source are available under open source licenses at github.com/CREATe-centre/.This is the author accepted manuscript. The final version is available from Springer via http://dx.doi.org/10.1007/978-3-319-20367-6_2

The Value of User-Visible Internet Cryptography

Cryptographic mechanisms are used in a wide range of applications, including email clients, web browsers, document and asset management systems, where typical users are not cryptography experts. A number of empirical studies have demonstrated that explicit, user-visible cryptographic mechanisms are not widely used by non-expert users, and as a result arguments have been made that cryptographic mechanisms need to be better hidden or embedded in end-user processes and tools. Other mechanisms, such as HTTPS, have cryptography built-in and only become visible to the user when a dialogue appears due to a (potential) problem. This paper surveys deployed and potential technologies in use, examines the social and legal context of broad classes of users, and from there, assesses the value and issues for those users

Security Mechanisms for the Internet

Security must be built into Internet Protocols for those protocols to offer their services securely. Many security problems can be traced to improper implementations. However, even a proper implementation will have security problems if the fundamental protocol is itself exploitable. Exactly how security should be implemented in a protocol will vary, because of the structure of the protocol itself. However, there are many protocols for which standard Internet security mechanisms, already developed, may be applicable. The precise one that is appropriate in any given situation can vary. We review a number of different choices, explaining the properties of each

Comparison of different ways to avoid internet traffic interception

Projecte fet en col.laboració amb la Norwegian University of Science and Technology. Department of Telematic EngineeringEnglish: The main objective of this thesis is to analyze and compare different ways to avoid the Internet traffic eavesdropping (carried out both by governments or malicious particulars). The analysis consists on a description of the different protocols and technologies involved in each option as well as the difficulties to implement them and the technical knowledge of the users in order to take profit of them