Feeds

Hushmail warns users over law enforcement backdoor

Still secure, up to a point

Protecting users from Firesheep and other Sidejacking attacks with SSL

Hushmail has updated its terms of service to clarify that encrypted emails sent through the service can still be turned over to law enforcement officials, providing they obtain a court order in Canada.

September court documents (pdf) from a US federal prosecution of alleged steroid dealers reveals that Hush Communications turned over 12 CDs involving emails on three targeted Hushmail accounts, in compliance of court orders made through the mutual assistance treaty between the US and Canada. Hushmail is widely used by privacy advocates and the security-conscious to send confidential emails.

Hush Communications, the firm behind Hushmail, previously claimed "not even a Hushmail employee with access to our servers can read your encrypted email".

However an updated explanation states that it is obliged to do everything in its power to comply with court orders against specified, targeted accounts. Unlocking targeted accounts involves sending a rogue Java applet to targeted users that captures a user's passphrase and sends it back to Hush Communications. This information, when passed onto law enforcement officials, allows access to stored emails and subsequent correspondence sent through the service.

The possibility that law enforcement officials can tap targeted accounts exists whether or not Hushmail users use the supposedly more secure Java applet option or a simpler web server encryption set-up. The updated terms of service explain:

Hushmail is a web-based service, the software that performs the encryption either resides on or is delivered by our servers. That means that there is no guarantee that we will not be compelled, under a court order issued by the Supreme Court of British Columbia, Canada, to treat a user named in a court order differently, and compromise that user's privacy.

International criminals and terrorists ought to look elsewhere for their encrypted email needs, Hush Communications explains.

"If you expect to engage in activity that might result in a court order issued by the Supreme Court of British Columbia, Canada, Hushmail is not the right choice for you," it said, adding that stand-alone desktop encryption packages such as PGP Desktop provide higher levels of security than web-based services.

PGP creator Phil Zimmermann has long fought to keep the software free of backdoors. Even after the September 11 attacks his convictions about privacy and civil liberties were strong enough to withstand pressure to tamper with the software, despite evidence it was been used by terrorists as well as its intended audience of human rights activists.

However, Zimmermann has defended Hushmail compliance with court orders, arguing that users who pick web-based products for their ease of use can't expect absolute security. Zimmermann, who sits on Hushmail's advisory board and helped found the service, told Wired: "Just because encryption is involved, that doesn't give you a talisman against a prosecutor. They can compel a service provider to cooperate."

Zimmermann explained that Hushmail has little option but to comply with Canadian court orders, adding that the service remained far more secure than other webmail services. ®

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.