Beware of Fake Security Advice

First published: 16^th June 2017

Allan Dyer

I was recently asked to share a privacy guide for journalists, unfortunately, on inspecting the guide, I found very serious flaws, and evidence of deliberately misleading advice. Therefore, I am sharing my anti-recommendation of "Online Privacy Guide for Journalists 2017", which is at https://www.vpnmentor.com/blog/online-privacy-journalists/ . Here is why:

The article starts with a brief description of the confidentiality problems faced by investigative journalists. Then, under the heading, "Communicating with your source and safeguarding the sensitive data", the advice begins. The advice starts with a warning about backdoors and a recommendation to encrypt everything; there is a link to a Bruce Schneier article, so it looks reasonable. Then there's the sentence, "But if you want bullet-proof security, you will need more than the AES encryption method.", but no explanation of what "more" is. This woolly sentence seems to throw doubt on the security of AES, but 256 bit AES is required by the NSA for Top Secret information and it is generally regarded as, currently, the best available algorithm. Perhaps the sentence is supposed to imply that encryption is just one part of your operational security, and the other aspects must not be neglected, but it does not make that clear. Let's say this is poor writing and continue.

My attention was grabbed by point 8, "Protecting Data on your computer" that discusses password and passphrase strength. The discussion uses screenshots from "Gibson Research Corporation’s password strength calculator" to compare the strength of "F53r2GZlYT97uWB0DDQGZn3j2e" and "i wandered lonely as a cloud" and concludes, 'The phrase: “I wandered lonely as a cloud”, he points out, is so much easier to remember and is also more secure, taking the same software 1.24 hundred trillion centuries to exhaust all possibilities. Well, passphrase it will be.' My bovine excrement alarm deafened me.

Passphrases are good, a definite improvement on a password, but the title of a famous poem is not a good passphrase. Compared to a good passphrase, it is like using 'password' instead of a good password. We advise not choosing a word that can be found in a dictionary as a password, and using a famous quote as a passphrase is just as bad. "I wandered lonely as a cloud" is item 36 on this list of 48 Of The Most Beautiful Lines Of Poetry.

Secondly, the discussion implies that the entropy of "i wandered lonely as a cloud" is equivalent to the entropy of "F53r2GZlYT97uWB0DDQGZn3j2e". By restricting the passphrase to dictionary words in a meaningful order, the number of possibilities has been vastly reduced. The well-known XKCD cartoon on passphrase strength attributes 11 bits of entropy to each common random word. Assuming a vocabulary of about 2000 common words, that is reasonable because 2¹¹ = 2048. Using the same estimate of entropy, 6 random common words would give 66 bits of entropy, but point 8 claims the 6 non-random words of “I wandered lonely as a cloud” represent a search space of 62²⁶ possibilities, which is about 154 bits of entropy. The strength of XKCD's "correct horse battery staple" example depends on randomly choosing the words without any consideration of meaning, and retrospectively constructing a meaning as a memory aid. For the removal of any doubt, "correct horse battery staple" became a terrible choice for a passphrase the moment XKCD published that cartoon, concentrate on the method.

Having had my attention grabbed, I looked closer at point 8 and found something far more disturbing: this was not just bad advice, it was maliciously constructed bad advice. The evidence is:

1. It misrepresents GRC's | Password Haystacks: How Well Hidden is Your Needle? as "Gibson Research Corporation’s password strength calculator". In fact, the page specifically warns, "IMPORTANT!!! What this calculator is NOT . . . It is NOT a “Password Strength Meter.”" I am not sure that I agree with the idea of "Password Padding" that Gibson presents on his page, it seems highly dependant on the attacker not using a search strategy that considers password padding, but the "Online Privacy Guide for Journalists 2017" (OPG) is misleading about Gibson's message.

2. It falsifies the results from GRC's Password Haystacks page. Compare this screenshot of the Online Privacy Guide (OPG) with my screenshot of GRC's Password Haystacks page. Note:

   1. The OPG screenshot shows "i wandered lonely as a cloud" contains 12 Uppercase, 6 Lowercase, 8 Digits and No Symbols. My count is No Uppercase, 23 Lowercase, No Digits and 5 Symbols.
   2. There is a difference in the character count: 26 characters versus 28 characters
   3. The font for the phrase is different, the OPG has a serif font and my screenshot shows the GRC page uses a sans serif font. Look closely at the tail of the y and the tops of the w, for example.

   In short, the OPG faked the screenshot for the "strength" of "i wandered lonely as a cloud" by taking the screenshot for the "strength" of "F53r2GZlYT97uWB0DDQGZn3j2e" and pasting in the phrase "i wandered lonely as a cloud".

I think that is enough to establish the bad intention of the author of this "Online Privacy Guide for Journalists 2017". I strongly recommend looking for more reliable sources of security advice, and, most importantly, understand their arguments and use your own critical thinking.

Updated: 20^th June 2017

vpnMentor has responded to the criticism in this article:

A letter to Allan and his readers.

Hi there, my name is Ariel and I’m one of the founders of vpnMentor. I wanted to address a post that Allan wrote, and explain to you guys what happened.

Basically, in his posts, Allan has three doubts:

1. The OPG screenshot shows "i wandered lonely as a cloud" contains 12 Uppercase, 6 Lowercase, 8 Digits and No Symbols. My count is No Uppercase, 23 Lowercase, No Digits and 5 Symbols.
2. There is a difference in the character count: 26 characters versus 28 characters
3. The font for the phrase is different, the OPG has a serif font and my screenshot shows the GRC page uses a sans serif font. Look closely at the tail of the y and the tops of the w, for example.

It actually easy to explain. Mike, who wrote the privacy guide, received assistance from many people in writing it. One of them was in charge of the graphics and he was asked to send a screenshot, he just didn’t use the same password the text uses, but rather the one he was instructed to replicate during the early writing process. This is why the screenshot doesn’t match the password we used in the text. We didn’t think this is of such importance. But, every so often, one comes across someone serious as Allan who checks the text, and verifies for his users that what he shares, doesn’t just look nice, but is also serious and accurate.

Below is the screenshot from Mike’s email to the graphic designer:

Anyhow, we want to first thanks Allan for being cautious. Just imagine if the Democratic Party in the U.S. was as cautious as him when they got a Russian email asking them to click here and restore password…

I hope that we helped explain the issue, and urge you to protect your privacy online, which is under threat more and more each day.

Best,
Ariel Hochstadt

I would like to thank Ariel Hochstadt and the team at vpnMentor for their openness and willingness to respond to criticism. Allan.