These are dark times for online privacy.

Online privacy is dead.

NEW YORK (CNNMoney) -- The U.S. government is spying on its own citizens' online activities. The FBI was able to suss out and shut down the anonymous black market Silk Road. Even the Internet-within-the-Internet called the Tor network -- the most secretive way to browse the Web -- is being monitored by the National Security Agency.

Silk Road serves as a prime example. It operated as a hidden service on Tor, an anonymizing tool that helps users and sites keep their identities secret. Everyone buying and selling drugs, weapons and other illicit items on the site thought they couldn't be tracked.Strong passwords and encrypted email services were never truly enough to protect users' online privacy. But recent revelations about government surveillance even throw into doubt the effectiveness of far-out measures of data encryption used by the most careful people surfing the Web.

But federal agents managed to track down a computer server Silk Road used, and the FBI monitored more than 1.2 million private communications on the site.

Related story: Facebook kills search privacy setting

If online privacy can't stand up to good, old-fashioned police work, it doesn't stand a chance against some of the more potent tools the government uses:

• The NSA figured out how to track down who's who on Tor by exploiting weaknesses in Web browsers, according to documents former NSA contractor Edward Snowden leaked to The Guardian -- a bug that was only recently fixed.
• PRISM, the government's hush-hush mass data collection program, lets even low-level NSA analysts access email, chats and Internet phone calls.
• The U.S. government issues frequent, secret demands for customer data from telecommunications companies.

It's no wonder, then, that many have declared the death of online privacy.

"Unfortunately, online anonymity is already dead," said Ladar Levison, founder of e-mail service LavaBit that closed its doors in the wake of the NSA's PRISM controversy. "It takes a lot more effort and skill than most have in order to keep your anonymity today."

Remaining unrecognizable and keeping conversations private online is immensely important. It's not just an issue for civil libertarians -- online privacy is crucial for crime victims, whistleblowers, dissidents and corporations trying to keep secret the latest high-tech research.

The result has been tantamount to a cryptographic arms race. On one side are independent programmers usually writing free software. On the other are a dozen U.S. intelligence agencies supported by a $52.6 billion black budget.

And while some claim unbreakable encryption is coming, large-scale availability is still years away.

"It's an open question how much protection Tor or any other existing anonymous communications tool provides against the NSA's large-scale Internet surveillance," said Roger Dingledine, Tor's lead developer.

Still, Aleecia McDonald, a privacy expert at Stanford University's Center for Internet & Society, said there's still a benefit to guarding yourself with a network like Tor. At least you make it harder to get spied on.

"The NSA has to attack Tor users one by one, not en masse as they do with non-Tor users," she said. 

The article above was originally published on the CNN website by Jose Pagliery  @Jose_Pagliery of CNN Money.

Uncertain future for BlackBerry's dwindling users.

CNN -- Since the dawn of the iPhone age in 2007, loyal BlackBerry users have watched their favorite device maker stumble into an ever-steepening decline.

Some of the collapse is due to the consumer changeover to Apple and Google Android products, but the company -- once known as Research In Motion -- hasn't helped itself with poor planning and delayed product introductions.

On Monday, the company that once blazed the trail in the smartphone market announced it's being taken private by its largest shareholder, Fairfax Financial, a Canadian insurance company.

The move comes on the heels of an announced $1 billion quarterly loss and layoffs of 4,500 employees. Its future as a maker of smartphones may be in doubt.

Now the dwindling numbers of loyal BlackBerry users must decide: Is this the last straw?

"You can tear my Blackberry's real keyboard out of my cold dead fingers," user Charles Wright of Toronto wrote on Twitter.It's no idle question. For all the attention paid to BlackBerry's fall and the rise of iPhone and Android, there's still a sizable BlackBerry market out there. Forbes magazine estimates that there are in excess of 50 million BlackBerry users, and they remain fiercely devoted to their phones, with their secure e-mail software and physical keyboards.

BlackBerry: Why breaking up is hard to do

Ronen Halevy, an IT security professional who runs the site BerryReview.com, still prefers his BlackBerry because it "focuses on communications first" -- even though he's familiar with both Android and iPhone platforms.

"They're very good devices to consume information, but the main point of the phone is that it's more like a computer," he says of the Apple and Google phones. BlackBerrys, he says, are better at "flow" from e-mail to calendar to other applications.

He hopes that the company returns to its roots.

"I think that Fairfax should double down on BlackBerry 10 and the combination of corporate and consumer market that appreciated the rock solid communication platform it offered," he wrote on BerryReview.com. "This means an end to the 'me too' additions of features to BlackBerry 10 and instead appealing to the market that made BlackBerry take off."

One commenter observed, however, that the company will be hard pressed to win new converts.

"Not good news for consumers, people hate the BB name and what it stands for. Self-inflicted suicide," kingbernie wrote. He suspected that becoming a corporate-focused software business might be the company's best way out of the wilderness -- even if it means leaving the consumer market behind.

From CrackBerry to 'depressing': The BlackBerry's 5-year fall

Chris Umiastowski, a tech analyst and regular contributor to the BlackBerry boards on CrackBerry.com, says BlackBerry fans should remain wary.

"Going private doesn't necessarily change the outcome for the company. All it is guaranteed to change is the ownership structure," he said via e-mail. "It's not a nail in the coffin, nor is it some massive opportunity to fix themselves. No matter who owns the shares they still have to compete with solid competitors. Going private just lets them operate outside of so much public scrutiny."

For those who want to put their BlackBerrys in a drawer next to their PalmPilots but want to keep a physical keyboard on their devices, your options are limited. The Motorola Photon Q and the Motorola Droid 4 are Android-compatible and have relatively large slide-out keyboards, but reviewers have taken issue with their camera capabilities.

In addition, BerryReview.com's Halevy observes, those keyboards -- which are landscape-oriented instead of the portrait-style versions on BlackBerrys -- seem like "afterthoughts."

"Even if you're in an e-mail and you want to hit the 'delete' button to delete an e-mail -- you think that's logical -- it doesn't work," he says.

The NEC Terrain, another Android phone with a physical keyboard, is marketed for its "rugged innovation" but, says Halevy, he doesn't think it's really aimed at the general consumer.

That leads to the host of smartphones with virtual keyboards, including the new iPhone 5S and 5C, the Android-compatibleSamsung Galaxy S4 and the Android HTC One, among many others. All have their pros and cons, whether it's your comfort with their operating systems or your desire for certain accessories.

But for those, like Umiastowski, who want to stick with BlackBerry, it will hard to get them to change.

His household includes a number of Apple items -- including his wife's iPhone -- but he prefers the BlackBerry. He's frustrated by the lack of apps for the device but still prefers the overall experience.

"BlackBerry has always been (and still is) the best experience for communicating. At first it was push email and physical keyboards. Now I'm on a Z10 and I find the multitasking + software keyboard + email experience is second to none," he wrote. "An iPhone would feel like a step backwards on those things which matter to me."

Besides, says Halevy, he likes how the BlackBerry creates community.

"The one thing you notice immediately when people change from BlackBerry to other devices is you never hear from them anymore," he says.

 The article above was originally published on the CNN website by Todd Leopold.

Microsoft is Ending Support for Windows XP in 2014: What You Need to Know

MICROSOFT GETS READY TO PULL THE LIFE SUPPORT ON WINDOWS XP...

YesCon Tech - Today marks the first day of the last year of Windows XP’s long and storied life.

On April 8, 2014, Microsoft will officially stop supporting Windows XP, meaning there will be no more security updates or other patches. When April 2014 rolls around Microsoft will have supported Windows XP for nearly 12 years.

Should you chose not to upgrade before next year, you will be, in Microsoft’s words “at your own risk” in dealing with security vulnerability and any potential malware designed to exploit them.

According to NetMarketShare, just over 38 percent of PCs connected to the web are still running Windows XP. Given that current XP users have already ignored three OS upgrades, it seems reasonable to assume a significant number of XP diehards still won’t upgrade even now that Microsoft is no longer issuing security updates — all of which adds up to a potentially huge number of vulnerable PCs connected to the web.

Starting around this time next year expect black hat hackers to have a botnet fire sale.

With so many suddenly vulnerable PCs on the web, it’s really only a matter of time before unpatched vulnerabilities are identified and exploited, which could mean a serious uptick in the amount of botnet spam or worse — imagine even a small percentage of those 38 percent of PCs being harnessed for distributed denial of service attacks.

For individual users upgrading Windows XP shouldn’t be too difficult, barring a dependency on software that’s never been updated. If Windows 7 or 8 aren’t to your liking there’s always Linux (I suggest starting with Mint Linux if you’re new to Linux).

Upgrading enterprise and government installations is somewhat more difficult. Microsoft puts the matter quite bluntly on the Windows blog: “If your organization has not started the migration to a modern desktop, you are late.”

The Windows blog post contains quite a few links designed to help anyone looking to upgrade, but at the enterprise/government level it may well be too late anyway. “Based on historical customer deployment data,” says Microsoft, “the average enterprise deployment can take 18 to 32 months from business case through full deployment.”

Windows XP isn’t the only Microsoft product that will be getting the heave-ho this time next year. Internet Explorer 6 on XP, Office 2003, Exchange Server 2003 and Exchange Server 2010 Service Pack 2 (newer service packs of Exchange Server 2010 are still supported) will all be cast adrift. It’s also worth noting that this affects virtual machines as well, so if you’ve got a Windows XP virtual machine for testing websites, well, be careful out there.

If You Still Need XP

You shouldn’t keep using XP. It will become more and more unsecure over time as more security vulnerabilities are found and not patched. Finding new hardware that supports XP will be difficult if your current hardware breaks down or needs to be upgraded. New software may stop supporting XP and you may be stuck with older, outdated, and also unsecure versions of software. Current versions of Mozilla Firefox no longer support Windows 98 – Firefox users on Windows 98 are using an unsecure version of Firefox.

If you have old software that only works on XP, you should consider upgrading to a modern version of Windows and running Windows XP in a virtual machine. Professional, Enterprise, and Ultimate editions of Windows 7 include a “Windows XP Mode” feature for easily running a Windows XP virtual machine. This will help increase your security by allowing you to use a modern, supported, secure operating system on your computer while confining the unsecure, unsupported XP to a virtual machine.

You should already be using antivirus software on your Windows XP systems, but this will become even more important when Windows XP starts to become the security equivalent of swiss cheese. Some security companies may jump in with solutions to secure increasingly vulnerable legacy XP systems, but you’re much better off upgrading.

If your organization has a Windows XP deployment, you should already be working on migrating to a new version of Windows. If you’re a home user, you should be looking at upgrading, too. Most longtime Windows XP users generally agree that Windows 7 is a worthy upgrade (Windows 8 is more controversial), and Microsoft will be supporting Windows 7 until 2020.

Let’s be honest: You won’t find an operating system vendor that supports their desktop operating system for as long as Microsoft supported XP. But, if you’re really upset, you can always switch to Linux instead. Just leave XP behind!

The article above was originally published on, Microsoft is Ending Support for Windows XP in 2014: What You Need to Know  by How-To Geek and Scott Gilbertson of webmonkey.com

Image Credits: How-To Geek, Microsoft and webmonkey

Microsoft mandates Windows 8.1 upgrade

Applies existing support policy to Windows 8: Customers must upgrade within 24 months to continue receiving patches and fixes.

Computerworld - Microsoft today said that Windows 8.1, slated for release this fall, will use the same lifecycle support timeline as 2012's Windows 8, meaning that it will be supported until early 2023.

Windows 8 users will also be required to upgrade to 8.1, and presumably in the future to newer versions of the OS, to continue to receive security patches and other bug fixes, just as they have been obligated to keep up with past editions of Windows.

"The lifecycle of Windows 8.1 will remain under the same lifecycle policy as Windows 8 with support ending 1/10/2023," said Erwin Visser, who heads Windows marketing to businesses, in a Tuesday blog.

Microsoft's current support life-cycle for Windows 8 pegs the end of "Mainstream" support on Jan. 9, 2018, and "Extended" support's end on Jan. 10, 2023. Under mainstream support, Microsoft patches security vulnerabilities and provides non-security bug fixes. Extended support is limited to security-only updates.

For the first time, the company also confirmed that it will manage Windows 8 support the same way it has previous editions of the operating system.

"Windows 8 customers will have two years to move to Windows 8.1 after the General Availability of the Windows 8.1 update to continue to remain supported under Windows 8 life-cycle," Visser said.

"That's key," said Rob Helm, an analyst with Directions on Microsoft, ranking the importance of the clarification to enterprises.

With previous editions, Microsoft cut off support for the initial build of Windows, known as RTM for "release to manufacturing," two years after the release of the first service pack. If it shipped a second service pack, it stopped supporting the first 24 months after the follow-up's debut. Service packs have historically been free, just as Windows 8.1 will be.

But Microsoft has done away with service packs for Windows 8, instead adopting a faster-paced development and release schedule that will ship a new version about once a year.

Helm had expected that Microsoft would make Windows 8.1 mandatory, just as the firm demanded customers upgrade from Windows 7 RTM to SP1.

"Windows 8 has a relatively small base at the moment [and] Windows 8.1 is free, so it's not insanely onerous to require users [to upgrade]," said Helm.

If Microsoft had changed its life-cycle policy for Windows 8.1, it would have been forced to maintain an increasing number of versions. "This makes sense because under its faster-release schedule, if it didn't pull up the carpet, there would be too many different versions to support," Helm said.

Visser also announced the availability of a preview of Windows 8.1 Enterprise -- the version designed for Microsoft's volume license customers -- in the same blog today.

"In general, Windows 8.1 is a much better target for migration than Windows 8," said Helm, echoing other analysts who have said the same. "We've been recommending Windows 8.1 as the alternative to Windows 7 to clients getting off Windows XP."

Helm cited Windows 8.1's new enterprise-oriented features for that recommendation, including "workplace join," which will allow trusted devices to access secured data on a company's network, and mobile management additions such as limiting access to a single "Modern," née "Metro," app.

"The renewed focus on mobile management will make it much easier for enterprises to handle BYOD," Helm added, referring to the "bring your own device" trend where businesses support workers' choice of hardware. 

Also a big plus in Helm's book was Microsoft's renouncing its stubborn insistence that it knew what customers wanted. "Just the overall fact that Microsoft took the time to understand what enterprises needed, and delivered on those features, which we really could have liked to see in the initial release," has been encouraging, said Helm.

The enforced upgrade to Windows 8.1 is the strongest signal yet that Microsoft will offer future versions in the Windows 8 line -- Windows 8.2, for instance, or even 8.3 -- free of charge, just as it has service packs in the past. Deviating from free without also eliminating the upgrade requirement for continued support would likely trigger a revolt by customers, or at least a hue-and-cry that Microsoft would find hard to silence.

When Microsoft first announced it would speed up Windows releases, many experts assumed that the company would dispense free Windows 8 upgrades for several years running before launching an entirely new edition, perhaps titled Windows 9, that would come with a price tag.

Microsoft has not yet set a ship date for Windows 8.1, or as Visser put it, the version's General Availability. When it does, the 24-month clock will start ticking: An October launch of Windows 8.1, for example, means customers will have until October 2015 to finish their upgrades.

Windows 8.1 Enterprise Preview can be downloaded from Microsoft's website. The sneak peak will expire Jan. 14, 2014.

This article, Microsoft mandates Windows 8.1 upgrade, was originally published at Computerworld.com.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at  @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is gkeizer@computerworld.com.

See more by Gregg Keizer on Computerworld.com.

Leap Motion Controller review: A touchscreen interface without the touching..

It's 'Minority Report' meets Microsoft Kinetic as virtual interactivity comes to the PC. Cool, yes, but does it have any practical value?

Computerworld - Anyone who's ever stood in front of a Kinetic-equipped Xbox knows the fun of virtual control, of using your hands to manipulate what you see on the screen without touching anything but air.

The Leap Motion Controller endows your PC with that same air-powered interactivity, allowing you to bypass mouse and keyboard in favor of hand-waving control of apps, games and even various PC operations.

The Leap Motion Controller sits between keyboard and monitor.

It's a cool concept, and Leap Motion pulls off the execution reasonably well -- for the surprisingly low price of $80. But it definitely raises a few questions, starting with: What would you actually use this thing for? And does it have any practical business value?

Plug and playtime

Not much larger than an average flash drive, the Leap Motion Controller has a glossy black top with a silver band wrapped around the sides. It's attractive and surprisingly compact, which is good considering it's designed to sit below your monitor (or, if you're using a laptop, in front of the keyboard). A USB 2.0 cable provides both power and connectivity. Leap Motion supplies both short (two feet) and long (five feet) cables to accommodate various computing configurations.

I tested the Leap Motion Controller with a Lenovo IdeaPad U310 Touch laptop and Samsung Series 9 ultrabook. Although the controller itself didn't get in the way, I disliked the look of the USB cable snaking around the side. This thing really begs for a rechargeable battery and wireless connection, which would emulate the somewhat disingenuous promo video where you see only the sensor, not the cable.

But installation couldn't have been much simpler. After loading the Windows client (it's also available for OS X) and plugging in the controller, I raised my hands and instantly saw their movement reflected in the introductory visualizer app. As a regular Kinect user, however, for me the effect was less "Wow!" and more, "Okay, it works."

Even so, when I tried the calibration process, during which you point the top of the controller at a reflective surface (a glossy screen is recommended) and move it around, I found it nearly impossible to achieve the required "pass" score of 80. Eventually I managed it with the IdeaPad, which has a glossy display, but I never hit 80 on the matte-finished display of the Series 9. The sensor still worked as expected, but I couldn't shake the feeling it wasn't operating optimally.

Space oddity

The controller generates a kind of virtual-space bubble in front of your PC, one large enough to accommodate your two hands (though many apps require only one). Imagine a 10-point multitouch interface, like you'd find on a touchscreen, but in three-dimensional space. The sensors track not only the positions of your hands and fingers, but also their movements. Thus you're able to "interact" with onscreen objects without actually touching anything.

Let me just pause right here to note that any business user hoping for a Leap Motion-powered productivity edge will be disappointed. You cannot design industrial components a la Tony Stark in Iron Man, nor can you sift through virtual files like Tom Cruise in Minority Report. We are a long, long way from that.

Apps for air

The Leap Motion Controller runs on apps, and there's already a decent collection of them in the Airspace Store -- about 75 as of this writing. These run the gamut from games to drawing tools to music makers, with a smattering of productivity apps for good measure. Some are free, while others cost a couple of bucks. A few will seem familiar to anyone with a tablet or smartphone, including Cut the Rope and Google Earth.

I started with Cyber Science - Motion, which displays a photorealistic model of a human skull and lets you rotate it, zoom in and out and remove individual pieces -- all through a combination of hand and finger motions. It's really cool, and one could see where a student -- one studying anatomy, anyway -- might find this a helpful educational tool.

At a Glance

Leap Motion Controller

Leap Motion
Price: $79.99
Pros: Compact, inexpensive, easy to set up
Cons: Little productivity value, it's challenging to use some apps effectively

Google Earth, on the other hand, proved an exercise in frustration. Unless you maneuver your hand with slow, exacting precision, the globe spins hopelessly out of control. That's because it responds to every single hand movement: toward the screen, away from the screen, up, down, tilted left, tilted right and so on. Without considerable practice, it's impossible to get where you want to go -- or even just take a simple flight across the mountains.

Then there's Touchless, which effectively turns your hand into a mouse. You can click, drag, zoom, scroll and more, all via a couple of fingers mirroring what you'd do on a touchpad or touchscreen. It works, though air taps and drags can be difficult to pull off, and the lack of any tactical feedback makes for agonizingly slow navigation.

A just-announced app, DexType, will create a virtual keyboard for two-fingered air typing. It's a neat concept, and potentially a boon for someone who's physically impaired (although I expect it will be slow compared with a traditional keyboard).

Bottom line

And that's really the key issue here: In what ways is the Leap Motion Controller better than a mouse or touchscreen or keyboard? For the moment, it's not. It's more toy than tool, more science fiction than practical addition.

I do find it impressive that Leap Motion managed to pack so much functionality into such a compact package, especially given the unit's impulse-buy price. But unless you're an app developer, physically challenged computer user or gadget lover, this is one Leap not worth taking -- at least, not quite yet.

Company video demonstrating the Leap Motion Controller.

This article, Leap Motion Controller review: A touchscreen interface without the touching, was originally published at Computerworld.com.

Rick Broida has written about technology for nearly 25 years. He pens the popular Cheapskate blog and writes for Computerworld, PC World, Popular Science and Wired.

SIM cards vulnerable to hacking, says researcher

Millions of phones could be at risk due to the use of a 1970s-era encryption standard.

IDG News Service - Millions of mobile phones may be vulnerable to spying due to the use of outdated, 1970s-era cryptography, according to new research due to be presented at the Black Hat security conference.

Karsten Nohl, an expert cryptographer with Security Research Labs, has found a way to trick mobile phones into granting access to the device's location, SMS functions and allow changes to a person's voicemail number.

Nohl's research looked at a mobile phones' SIM (Subscriber Identification Module), the small card inserted into a device that ties it to a phone number and authenticates software updates and commands sent over-the-air from an operator.

More than 7 billion SIM cards are in use worldwide. To ensure privacy and security, SIM cards use encryption when communicating with an operator, but the encryption standards use vary widely.

A mobile communication trade group, the GSM Association, said in a statement that only a "minority" of SIM cards that use older encryption standards would appear to be vulnerable.

"There is no evidence to suggest that today's more secure SIMs, which are used to support a range of advanced services, will be affected," GSMA said.

Nohl's research found that many SIMs use a weak encryption standard dating from the 1970s called DES (Data Encryption Standard), according to a preview posted on his company's blog.

DES has long been considered a weak form of encryption, and many mobile operators have upgraded now to more secure forms. It is relatively easy to discover the private key used to sign content encrypted with DES.

In its experiment, Security Research Labs sent a binary code over SMS to a device using a SIM with DES. Since the binary code wasn't properly cryptographically signed, it would not run on the device.

But while rejecting the code, the phone's SIM makes a crucial mistake: it sends back over SMS an error code that carries its own encrypted 56-bit private key, according to the company. Because DES is considered a very weak form of encryption, it's possible to decrypt the private key using known cracking techniques.

Security Research Labs did it in about two minutes on a regular computer with the help of a rainbow table, a mathematical chart that helps convert an encrypted private key or password hash into its original form faster.

With the private DES key in hand, it is then possible to "sign" malicious software updates with the key, and send those updates to the device. The device believes the software comes from a legitimate source and then grants access to sensitive data.

GSMA said that it has not seen the full details of Nohl's research but that use of the DES algorithm has been "discontinued in over the air (OTA) standards for several years."

Security Research Labs outlined an attack scenario against SIM cards that run some form of Java virtual machine, a software framework for Java applications.

Using the SIM's private key, an attacker could force the SIM to download Java applets, which are essentially very small programs that perform some function. Those applets would be "allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions."

"These capabilities alone provide plenty of potential for abuse," the company wrote.

Possible remedies to the problem including ensuring SIM cards use state-of-the-art cryptography and also using Java virtual machines that restrict applets' access to certain information.

GSMA said it has already provided guidance to network operators and SIM vendors that might be affected by Nohl's findings.

Nohl's presentation, "Rooting SIM cards," will take place at the Black Hat security conference in Las Vegas on July 31.

Report by Jeremy Kirk, Computer World. Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk