Bits: Wall Street Journal Leak Site Works on Fixes

May 7, 12:29 a.m. | Updated Updating Qualys’s rating of SafeHouse’s encryption.

The Wall Street Journal on Thursday introduced SafeHouse, a Web site that takes a page from WikiLeaks by inviting whistleblowers to submit tips and documents. But within hours, security researchers were challenging the notion that the site was safe for leakers. And on Friday, The Journal said it was rushing through technical changes to address the problems.

According to the researchers, the way SafeHouse uses Web encryption technology known as HTTPS opens the site up for attacks, and is not rigorous enough for a site that handles highly sensitive communications. They also said they were troubled that SafeHouse used Adobe Flash for uploading documents, a technology that can help strip leakers of anonymity.

The problems were the subject of a barrage of messages on Twitter on Thursday afternoon by Jacob Appelbaum, a developer for the Tor Project, which provides tools for anonymous online communication used by dissidents, whistleblowers, journalists and others. Mr. Appelbaum was formerly associated with Wikileaks. “Pro-tip: if you’re going to create a document leaking website – have a clue!” he wrote.

The Journal said in an e-mailed statement that it was taking the issues raised “very seriously” and that it would end its use of Flash within 48 hours. “In addition, our system has been updated to limit the types of less secure connections it will accept,” it said.

SafeHouse’s terms of service encourage whistleblowers to improve their security by using tools like Tor that provide anonymity. However, both Mr. Appelbaum and Peter Eckersley, a senior staff technologist at the Electronic Frontier Foundation, a digital rights group, said Adobe Flash defeated? those tools.

Mr. Eckersley said the problem was with a Flash feature called Flash Socket Class, which would allow SafeHouse to discover a user’s real IP address, regardless of any anonymizing technologies that might be in use. As such, The Journal could identify people who upload documents, or be forced by the government to do so. News organizations like The Journal are accustomed to protecting sources, including from the government, but having the information could open it up to legal difficulties.

The E.F.F. said that it raised its concerns about Flash Socket Class in March 2010 with Adobe’s chief privacy officer, MeMe Rasmussen, and that the company said the issue would be hard to fix but that it would work on it. An Adobe spokeswoman was not immediately able to provide comment.

The way HTTPS is used by SafeHouse would not be problematic for an average Web site, said Ivan Ristic, director of engineering at Qualys and founder of a research effort called SSL Labs. However, it did not cover all the bases necessary to ensure that a user couldn’t be fooled into engaging in unencrypted communication.

Dan Kaminsky, chief scientist at the security firm DKH, said even major banks did not use the advanced technologies in question. Those technologies are “nice to have,” but can cause other problems, he said, and their absence does not make a site unsafe.

Mr. Ristic said it was also troubling that SafeHouse was using algorithms known as cipher suites that are not strong enough to ensure that recorded communications cannot be deciphered later if the key to them is somehow obtained.

On Friday afternoon, Qualys was giving SafeHouse a grade of B on its use of encryption, in large measure due to poor cipher strength. But by Friday evening, its use of cipher technology was getting higher marks, and Qualys raised its grade to an A.

“Hopefully we’ll see this WSJ site moving toward a truly secure deployment,” Mr. Eckersley of the E.F.F. said. “That kind of i-dotting and t-crossing is necessary to be safe against some of the attacks we’ve seen used against HTTPS Web sites in recent years.”

View the original article here

A Community College in Florida Works to Attract the Poor and the Presidential

Yet a community college in Miami with no trace of ivy and a policy of accepting just about everyone, even the hard luck cases, has managed to lure a trifecta of commanders in chief to its urban campus.

At Miami Dade College on Friday evening, President Obama delivered the commencement address, joining a roster that includes Presidents George W. Bush and Bill Clinton. Over the years, Jimmy Carter, the elder President Bush and Gerald R. Ford have stopped in for round-table chats as have an assortment of first ladies, foreign presidents and cabinet members.

So how is it that an open-admission college that embraces academically risky students carries such cachet?

“We call it a dream factory,” said Eduardo J. Padrón, the college’s president since 1995. “We give people who ordinarily wouldn’t have the opportunity a second chance.”

The college’s demographics make for political catnip. Presidents and other members of the nation’s elite want to align themselves with an institution that has had an amazing run of success stories among its Hispanic and black students. “If we want to win the future,” said Hannah M. August, a White House spokeswoman, “we need to outeducate our global competitors, and schools like Miami Dade are helping us lead the way.”

With an enrollment of 170,000, Miami Dade is the country’s largest college (not including online universities). Ninety percent of its students are minorities, and it graduates more black and Hispanic students than any other college. This is no small accomplishment in light of the country’s stubbornly low college attendance and graduation rates among minorities.

Take a Google tour of Miami notables and an impressive list crops up of graduates and former students of Miami Dade College (or Dade County Junior College, as it was known when it opened in 1960): members of Congress (Representatives Ileana Ros-Lehtinen and John L. Mica, both Florida Republicans and House committee leaders), mayors, actors (Andy Garcia and Sylvester Stallone), music magnates (Emilio Estefan), baseball players, a former president of Panama and an assortment of successful architects, lawyers, bank presidents, hospital directors and business owners.

“I think if it weren’t for Miami Dade, I would be doing something very different right now, working in a gas station or something,” said Cesar L. Alvarez, the executive chairman of the law firm Greenberg Traurig and a 1967 graduate who said the college inspired him to achieve. “I didn’t have money to go anywhere else, and I seriously doubt anyone else would have taken me.”

The college’s home state, an electoral prize, is irresistible for any politician. But many attribute its allure for presidents and students to Dr. Padrón, who boasts of Miami Dade’s community college soul. He has elevated its status and nurtured his political relationships. Mr. Obama selected him to head the President’s Advisory Commission on Educational Excellence for Hispanic Americans. He has held similar posts under past presidents.

Like many in Miami, Dr. Padrón is an alumnus. “He was his own case study,” Mr. Alvarez said.

Dr. Padrón attended the college in the 1960s, fresh from Cuba, with only a smattering of English and no chance of attending any other college. He excelled, eventually working his way to a doctorate in economics at the University of Florida. He rebuffed a lucrative job with DuPont, choosing instead to pay a social debt to his community. He started working at the college and has stayed for 40 years.

Rather than encourage professors to polish their credentials by publishing papers, Dr. Padrón urges them to be passionate about teaching and committed to helping struggling students, many of whom barely graduated high school or struggle to afford college. Some take 10 years to graduate because they are working their way through school. Others charge through in two years and transfer to top-tier universities.

Miami Dade also focuses on training students for real-world jobs; it graduates more nurses, for example, than any other college.

“Our students, a majority, come to us unprepared,” said Dr. Padrón, who said Miami public schools, with some exceptions, often fail to properly educate the city’s children. “It takes effort and money to get them to a level they can compete. If we say, ‘You are not prepared. We won’t admit you,’ thousands and thousands would not be able to come to college. The cycle of poverty would continue. That’s why this is so crucial.”

That was true of Mr. Estefan, a Miami institution who was just another broke Cuban refugee with no option but Miami Dade. He squeezed in courses at night between his day job as an office boy at the Bacardi Corporation and an evening job as an accordion player at an Italian restaurant. Mr. Estefan, now a world-renowned music producer, credits the college for giving him a foundation for what it takes to run a business.

When he aspired to jump into the music business, people told him he was too poor, too foreign, too old. “Then at Miami Dade, one professor said to me, ‘In this country, you can do anything.’?”