CNET "Apple's iMessage encryption trips up feds' surveillance"

http://news.cnet.com/8301-13578_3-57577887-38/apples-imessage-encryption-trips-up-feds-surveillance/

They cite a blog post from last August by Matthew Green http://blog.cryptographyengineering.com/2012/08/dear-apple-please-set-imessage-free.html

I follow Green's blog and can recommend it to anyone that is seriously interested in cryptography and/or data privacy.

Blackberry's BBM (Blackberry Messenger) http://en.wikipedia.org/wiki/BlackBerry_Messenger has long been secure as well, though I believe in recent years government pressure has forced some changes in that.

For more on BBM see http://computer.howstuffworks.com/e-mail-messaging/blackberry-messenger.htm

For general info on Blackberry security see http://www.berryreview.com/2010/08/06/faq-what-communication-is-encrypted-on-your-blackberry/

Note there are differences between BES (Enterprise Blackberry) and BIS (Consumer Blackberry), but (AFAIK) in general that doesn't matter for BBM.

According to  http://bgr.com/2013/02/27/blackberry-messenger-security-vulnerability-346634/ it seems that BBM on BIS lacks higher level security options just like email:

"“Although PIN-to-PIN messages are encrypted, they key used is a global cryptographic ‘key’ that is common to every BlackBerry device all over the world,” Public Safety Canada official stated in the memo. “Any BlackBerry device can potentially decrypt all PIN-to-PIN messages sent by any other BlackBerry device.”"

and

"It should be noted that Public Safety Canada has failed to take into account the fact that organizations have the ability to change the encryption key to a unique one, ensuring that only BlackBerry devices using the same BES network can communicate with each other. There are also several ways to encode BBM messages such as S/MIME, which adds another layer of security."

Introduction to Encryption: "Locking the bad guys out with asymmetric encryption"

http://arstechnica.com/security/2013/02/lock-robster-keeping-the-bad-guys-out-with-asymmetric-encryption/

If you already know a fair bit about encryption, you could skip to the comments http://arstechnica.com/security/2013/02/lock-robster-keeping-the-bad-guys-out-with-asymmetric-encryption/?comments=1

Peter Bright, the author of the article, knows more about the topic than he wrote, he was trying to keep it readable and understandable for people with no background knowledge.

I know I am going to refer people to this article frequently for some time to come, instead of trying to explain it myself.

Security & Hacking: Stanford's "Real-World Crypto" Workshop

[Updated with link to Day 3]

https://crypto.stanford.edu/RealWorldCrypto/index.php

Bristol Cryptography Blog's coverage:

• Day 1 http://bristolcrypto.blogspot.com/2013/01/real-world-crypto-workshop-day-1.html
• Day 2 http://bristolcrypto.blogspot.com/2013/01/real-world-crypto-workshop-day-2.html
• Day 3 http://bristolcrypto.blogspot.com/2013/01/real-world-crypto-workshop-day-3.html

Security & Hacking: Free online Cryptography Courses

Via Bruce Schneier's Blog http://www.schneier.com/blog/archives/2012/11/free_online_cry.html

https://www.coursera.org/course/crypto

https://www.coursera.org/course/crypto2

Positive comments about it on Bruce's blog.

Putting it on my list.

If your not familiar with Coursera, you can start here https://www.coursera.org/about

Wikipedia also has useful information about them, http://en.wikipedia.org/wiki/Coursera

Crypto News: Embedded Systems Week: Day 1

I started studying computer security seriously last December, because my credit card number got hacked or stolen some how and I wanted to know why & prevent it from happening again.

Learned a lot so far, though still a lot left to learn, still pretty much a Noob when it comes to Crypto, but I keep studying and learning.

The Bristol Cryptography Blog is an excellent source for Crypto news and information, they are covering the "Embedded Systems Week: It consists of three co-located conferences, CASES, EMSOFT and CODES+ISSS."

Day 1 coverage here http://bristolcrypto.blogspot.com/2012/10/embedded-systems-week-day-1-monday.html

Security & Hacking: Keccak is chosen to be SHA-3

Official NIST announcement http://csrc.nist.gov/groups/ST/hash/sha-3/winner_sha-3.html
detailed PDF announcement from NIST http://csrc.nist.gov/groups/ST/hash/sha-3/sha-3_selection_announcement.pdf

Bruce's comments and thoughts http://www.schneier.com/blog/archives/2012/10/keccak_is_sha-3.html Bruce made it to the final round with his entry.

Keccak website http://keccak.noekeon.org/

Interesting times, hat tip to NIST for picking a good replacement before we need one!

I wish more banks and other institutions would follow that lead, instead of general trend of not updating security and crypto until long after vulnerabilities have been exploited.

Nerd Gear: NSA builds Android phone for top secret calls & so can you?

I saw this article from SC Magazine,  about the US Government building secure phones with off the shelf Android components.

The NSA page about the secure phones with Secure VoIP is here http://www.nsa.gov/ia/programs/mobility_program/index.shtml

While this PDF spells out the requirements http://www.nsa.gov/ia/_files/Mobility_Capability_Pkg_%28Version_1.1U%29.pdf

Supposedly anyone could build something similar from these specifications, though I think it would take a bit of work, a certain minimum skill level, not to mention some specific knowledge and funds.

Also a key part to this working with Android phones is a clean vetted app store, not sure how many people would have one of those in their basement.

But I am sure some computer, Ham, & cryptography geeks will try their hands at this.