Tag Archives: CAcert

CAcert’s infrastructure ready for the future

On saturday, 13th of July 2019, in a joint operation, CAcert Infrastructure Team and CAcert Critical Team updated the operation system of CAcert’s infrastructure in the Netherlands sucessfully. The system is now running on the Debian Buster OS release that has been released by the Debian project last weekend.

Timing

The teams started this morning at around 9:30 CEST and finished the upgrades at 16:30 CEST, some of our applications turned back to service afterwards. The system is running smoothly now.

What is new?

The new OS release provides some features that are important for our infrastructure and will allow better operation of our applications in the future:

  • LXC has been upgraded from the somewhat primitive 0.8.0 pre-release to LXC 3.0.3 that has a proper API, better security and which will help application administrators
  • Firewalling/forwarding/NAT should now be faster then the old iptables setup. We still use ferm as a wrapper but the CAcert Infrastructure Team is already considering switching to native nftables rules that will provide a similar but faster rule set.
  • Further details about this major update can be read on our mailing list.

CAcert Infrastructure Team Lead JanDD is happy that we could finish this big upgrade and that we could implement all these changes for you. In a statement made on the early saturday evening, he thanked again to Wytze from CAcert Critical Team for his great support during the day.

The volunteers from these two teams worked for seven and a half hours today, Saturday, to keep our systems up to date. Join us in thanking them and donate now at your own discretion. Your donation will only be used to pay for the infrastructure (hosting, electricity in the data center). «I say thank you to Jan and Wytze and their team with a donation!»

If you find any issues that might be caused by the upgrade feel free to file bugs on https://bugs.cacert.org/ (at project Infrastructure > Infrastructue hosts).

If you want to join one of our teams, please join the development mailing list or write to the secretary.

Überholte Technologie ist keine Basis für Datensicherheit

Soll ein Land seine elektronische Identitätskarte (E-ID) selber editieren oder das Ganze an ein privates Konsortium auslagern? Darüber kann man in der Tat geteilter Meinung sein.

Hingegen darf es beim Datenschutz keine Abstriche geben. In der Schweiz wird darüber heftig diskutiert. Die Regierung ist offenbar der Meinung, eine bereits überholte Technologie genüge. CAcert unterstützt die Meinung der Experten, wie eine Zuschrift ihres Präsidenten in der angesehenen Neuen Zürcher Zeitung von 21. Juni 2019 eindeutig zeigt.

The Swiss government is obviously of the opinion that an outdated technology is sufficient for an E-ID. CAcert supports the opinion of the experts, as a letter from its president in the reputated newspaper Neue Zürcher Zeitung clearly shows.

Unterstützen Sie CAcert im täglichen Bemühen für mehr Sicherheit im Internet mit einem einmaligen oder einem regelmässigen Beitrag an die Betriebskosten. Bitte Spenden Sie jetzt, damit CAcert auch morgen und nächstes Jahr noch die Sicherheit im Internet erhöhen kann. Danke.

CAcert is supported by its community

The CAcert Free Certificate Authority is supported by its community. In the period of six weeks from the end of April to the beginning of June, 21 users from seven countries generously donated 725 $/€ to CAcert. This will cover the operating costs of the data center for almost three months.

We would like to thank all donators. If you want to support the work done by the volunteers of CAcert, please donate to continue to run this service. Thank you.

DEUTSCH

Die freie Certifikatsstelle CAcert wird durch ihre Gemeinschaft unterstützt. Im Zeitraum von sechs Wochen von Ende April bis Anfang Juni haben 21 Nutzer aus sieben Ländern CAcert sehr großzügig mit Spenden in der Höhe von 725 $/€ bedacht. Damit können die Betriebskosten des Rechenzentrums während knapp dreier Monate gedeckt werden. Hilf mit, die Kosten zu decken, spende jetzt!

NEDERLANDS

De CAcert Free Certificate Authority wordt ondersteund door haar gemeenschap. In de periode van zes weken van eind april tot begin juni hebben 21 gebruikers uit zeven landen 725 $/€ gedoneerd aan CAcert. Dit zal de exploitatiekosten van het datacenter voor bijna drie maanden dekken. Help de kosten dekken, doneer nu!

ITALIANO

La Autorità di Certificazione libera CAcert è supportata dalla sua comunità. Nel periodo di sei settimane tra la fine di aprile e l’inizio di giugno, 21 utenti di sette paesi hanno generosamente donato 725 $/€ a CAcert. Ciò coprirà i costi operativi del data center per quasi tre mesi. Aiuta a coprire i costi, donalo ora!

SVENSKA
CAcert-certifieringsorganet stöds av dess samhälle. Under sex veckorsperioden från slutet av april till början av juni donerade 21 användare från sju länder generöst $/€ 725 till CAcert. Därefter kan driftkostnaderna för datacentret täckas under nästan tre månader. Hjälp täcka kostnaderna, donera nu!

Link

As of now, prospective Assurers can also take the Assurer test CATS in Czech. This is an important step towards vulgarizing of the Web of Trust and CAcert’s efforts to increase security on the Internet.

CAcert offers free certificates that can be used for digital signatures, phishing prophylaxis, login or encryption. In order for their own name to be included in the certificate, each user must first meet and identify themselves with at least two Assurers of the Web of Trust. CATS is an important part of Assurer training, explains Bernhard Fröhlich, responsible for training courses. Experience shows that acceptance and the success rate are higher if a course can be completed in one’s own language. Currently CATS can be completed in Czech, German and English.

www.cacert.org
wiki.cacert.org/AssurerChallenge/

Stability of e-mail verification strongly improved

The e-mail verification on the CAcert web server has recently led to repeated support requests. An analysis of the log files in our data center showed that the corresponding error occurred more frequently. So we have to conclude that many CAcert users have been negatively affected. In order to avoid further negative effects, an emergency
patch was deemed necessary by the Critical System Administrator Team.

The standardised review and testing of the emergency patch implemented yesterday is carried out by the regular teams in the aftermath, which can result in a formal blessing for this patch or a request for additional code or configuration changes. We would like to thank the Critical System Administrator Team for their quick and decisive action. All teams consist of volunteers. If you want to support the work done by the Critical System Administration Team and the review by the Software Team, please donate, to continue to run this service. Thank you.

Security is not everything, but without security everything is nothing

According to estimates, around six million people of the eight million inhabitants in Switzerland use the Whatsapp news service in their private lives. In Germany and Austria, the figures will probably be similarly high. This type of communication is so self-evident that more and more companies want to communicate with their employees and customers with Whatsapp: Picture messages of a place to be repaired, details of a booked flight or even direct advertising.

The well-known news service explicitly allows operational use and offers a business version for SMEs and an interface (API) for large companies. The list of advantages is long: uncomplicated, direct, shorter decision paths, cost-effective customer service, etc. – what more do you want? Since 2017, however, more and more companies have prohibited their employees from using Whatsapp, as the basic EU data protection regulation stipulates that personal data may neither be collected nor processed without the consent of the person concerned. No company wants to afford the imminent fines of several million euros.

The problem lies in the way the messsanger service operates. It regularly reads the address books of its users in order to compare them with its database. In this way he can display contacts that are new to the service. They have never given their consent. This is therefore a violation of the general data protection regulation, which also applies to companies that have only one contact in the EU. If it is either a service telephone or a private one on which business contacts are stored with the consent of the company, the company is liable. If the employees use their own device in the company, no synchronization with the data processing systems may take place. Thus, the employee processes personal data without the employer’s permission and is then liable for possible violations of the law.

If the intelligence service is to be used in compliance with data protection regulations, there must be two separate address books, one internal, with only those persons who have given their consent to the transfer of their personal data to Whatsapp. Another possibility is the use of a GDPR-compliant messenger in the company. The disadvantage of this solution, however, is that such messengers have not yet become widespread and can therefore hardly be used in contact with customers.

And the solution? It corresponds to squaring the circle and is about as simple as the browser integration of CAcert in the next 12 months. Nevertheless, it is worthwhile, especially in the year 2019, to deal with how one deals with personal data in one’s company. The first companies to find practicable and easily implementable solutions can gain a competitive advantage, because “Security is not everything, but without security everything is nothing”. (Schopenhauer)

The sending of encrypted and signed e-mails is in compliance with the general data protection regulation. With the Organisation Assurance Programme, CAcert offers companies a simple and practical solution. The systematic sending of digitally signed e-mails offers customers the opportunity to clearly distinguish messages from spam and phishing. The encryption of internal e-mails increases security and is technically easy to implement, as the IT department rolls out the corresponding certificates.

Source: NZZ, 31.12.2018

Donate the running costs of allmost one day (5€)     Donate as much as you want                     Donate the running costs of one week (50€)                                                                                    IBAN DE50 2019 0003 0008 5478 07 “CAcert”

New CAcert for New Year

English | Deutsch | Français | Português

Don’t miss new functions, new possibilities and the new forward strategy of CAcert in 2019. In 2018 we started again support, software team and arbitration. Now, board and active members of the community are hard workng on the next steps. Support our volunteers by contributing to the running costs of our data centre in the Netherlands. More security, less phishing thanks to digital signature with free X.509 certificate.

Donate the costs of allmost one day (5€)                 Donate as much as you want                     Donate the running costs of one week (50€)                                                                                    IBAN DE50 2019 0003 0008 5478 07 “CAcert”

Verpassen Sie nicht neue Funktionen, neue Möglichkeiten und die neue Vorwärtsstrategie von CAcert im Jahr 2019. Im Jahr 2018 haben wir Support, Software-Team und Arbitration wieder aufgebaut. Jetzt arbeiten Vorstand und aktive Mitglieder der Gemeinschaft hart an den nächsten Schritten. Unterstützen Sie unsere Freiwilligen, indem Sie sich an den laufenden Kosten unseres Rechenzentrums in den Niederlanden beteiligen. Mehr Sicherheit, weniger Phishing dank digitaler Signatur mit kostenlosem X.509-Zertifikat.

Spenden Sie die Kosten für einen knappen 1 Tag (5€)      Spenden Sie einen freien Betrag          Spenden Sie die Betriebskosten des Rechenzentrums für 1 Woche (50€)                             IBAN DE50 2019 0003 0008 5478 07 “CAcert”

Ne manquez pas les nouvelles fonctions, les nouvelles possibilités et la nouvelle stratégie d’avenir de CAcert en 2019. En 2018, nous avons recommencé le support, l’équipe logicielle et l’arbitrage. Aujourd’hui, le comité et les membres actifs de la communauté travaillent d’arrache-pied aux prochaines étapes. Soutenez nos bénévoles en contribuant aux frais de fonctionnement de notre centre de données aux Pays-Bas. Plus de sécurité, moins de phishing grâce à la signature numérique avec certificat X.509 gratuit.

Offrez-nous les coûts opérationnels d’une petite journée (5€)                                               Donnez un montant à votre volonté   Offrez-nous les coûts opérationnels de 1 semaine  (50€) IBAN DE50 2019 0003 0008 5478 07 “CAcert”

Não perca novas funções, novas possibilidades e a nova estratégia de avanço do CAcert em 2019. Em 2018 iniciamos novamente o suporte, a equipe de software e a arbitragem. Agora, a diretoria e membros ativos da comunidade estão trabalhando arduamente nos próximos passos. Apoie os nossos voluntários contribuindo para os custos de funcionamento do nosso centro de dados na Holanda. Mais segurança, menos phishing graças à assinatura digital com certificado X.509 gratuito.

 

E-Mails signieren ist eine sichere Sache

Nach Angaben des deutschen Bundesamtes für Sicherheit in der Informationstechnik sind die von CAcert propagierten Methoden der digitalen Signatur und der E-Mail-Verschlüsselung eine sichere Sache – selbstverständlich bei korrekter Implementierung und Konfiguration.

Sicherheit von e-Mail Clients (Stand Sommer 2018)

Sicherheit von e-Mail Clients (Stand Sommer 2018)

Die nebenstehende Übersicht zeigt die Sicherheitsstufe der bekanntesten E-Mail-Clients. Aber was ist, wenn Ihr Korresponenzpartner eine Software mit einer roten Flagge verwendet? Kennen Sie denn die Software, die andere benutzen? Diese Fragen zeigen einmal mehr, wie wichtig das Vertrauen in der Kommunikation ist. Weitere Informationen über das Vertrauensnetz (Web of Trust) von CAcert.

Neben dem sorgfältigen Umgang mit dem geheim zu haltenden privaten Schlüssel kann auch die Sicherheit der verwendeten E-Mail-Programme und deren Konfiguration entscheidend.

  • Lassen Sie E-Mails im HTML-Format grundsätzlich nicht anzeigen oder generieren.
  • Insbesondere die Ausführung von aktiven Inhalten, d.h. die Anzeige von E-Mails im HTML-Format und das Nachladen von externen Inhalten, sollte ausgeschaltet werden.
  • Bietet ein E-Mail-Anbieter über die Einstellungen seiner Webmail-Anwendung die Möglichkeit dazu, sollten auch hier entsprechende Maßnahmen ergriffen werden.

Für sensible Informationen, die per E-Mail versendet werden müssen, kann das folgende Verfahren angewendet werden: Entschlüsseln Sie S/MIME- oder PGP-E-Mails in einer separaten Anwendung außerhalb Ihres E-Mail-Clients. Entschlüsseln Sie eingehende verschlüsselte E-Mails durch Kopieren und Einfügen des Chiffretextes in eine separate Anwendung, die die Entschlüsselung für Sie übernimmt. Auf diese Weise können die E-Mail-Clients keine Exfiltrationskanäle öffnen. Dies ist derzeit die sicherste Option mit dem Nachteil, dass der Prozess stärker involviert wird.

Auch Webmail ist sicher, wenn Sie Mailvelope oder PEP verwenden.

CAcert.org ist eine gemeinschaftsgeführte Zertifizierungsstelle, die kostenlos Zertifikate für die breite Öffentlichkeit ausstellt. Diese Zertifikate können verwendet werden, um E-Mails digital zu signieren und zu verschlüsseln, Benutzer zu authentifizieren und zu autorisieren, die sich mit Websites verbinden, und um die sichere Datenübertragung über das Internet zu gewährleisten. CAcert hat mehr als 360 000 Nutzer, wird von Freiwilligen betrieben und durch Spenden finanziert.

Spenden Sie die Kosten für 25 Zertifikate (5€)                 Spenden Sie einen freien Betrag          Spenden Sie die Betriebskosten des Rechenzentrums für 1 Woche (50€)                             IBAN DE50 2019 0003 0008 5478 07 “CAcert”