Estágio realizado na Portugalmail e orientado pelo Eng.º Nuno Lopes / Tese de mestrado integrado. Engenharia Informática e Computação. Faculdade de Engenharia. Universidade do Porto. 2009

Tese de mestrado integrado. Engenharia Informática e Computação. Faculdade de Engenharia. Universidade do Porto. 2009

Estágio realizado na Portugalmail e orientado pelo Eng.º Nuno Lopes / Tese de mestrado integrado. Engenharia Informática e Computação. Faculdade de Engenharia. Universidade do Porto. 2009

Webmail applications are very popular these days. Besides typical usage, thanks to ciphered communication, they can be used for malicious activity like confidential data loss. This thesis discusses webmail events detection based on common webmail signatures in captured network traffic. Also there will be discussed SSL/TLS interception and decryption for further data analysis. The modules in this thesis are designed and implemented for Netfox.Framework forensics analysis tool. The Netfox project is developed at FIT BUT under security research project SEC6NET.

Ett nystartat företag ville skapa en hemsida som såg ut och fungerade som Outlook.  Denna sida skulle senare kunna kopplas till Exchange eller något liknande e-postserverprogram. Under arbetets gång så installerades en labbserver med Exchange. När servern var färdig så skulle det gå att koppla upp företaget Teleriks webmaillösning för att sedan kolla om den klarar av Exchange. Målet var att en sida liknande Outlook, till utseende samt funktion, skulle skapas. Denna sida skulle sedan kopplas ihop med en fungerande Exchange server. En fungerande Exchange server samt hemsida kopplades ihop men det uppstod problem då betrott certifikat saknades/fungerade inte.

None of the three largest webmail service providers (serving over 1 billion users) support end-to-end message encryption. Encrypted email has never seen mass adoption because it is prohibitive for non-experts to use. Private WebMail (Pwm) is our extension to popular webmail systems that lets users easily encrypt sensitive messages without having to first contact the recipient and share information. It is designed to spread quickly in a grassroots fashion so that a user receiving their first encrypted message can quickly and easily start using the system. This thesis describes the design and implementation of Pwm, then measures its usability through analysis and a user study.

Users share private information on the web through a variety of applications, such as email, instant messaging, social media, and document sharing. Unfortunately, recent revelations have shown that not only is users' data at risk from hackers and malicious insiders, but also from government surveillance. This state of affairs motivates the need for users to be able to encrypt their online data.In this dissertation, we explore how to help users encrypt their online data, with a special focus on securing email. First, we explore the design principles that are necessary to create usable, secure email. As part of this exploration, we conduct eight usability studies of eleven different secure email tools including a total of 347 participants. Second, we develop a novel, paired-participant methodology that allows us to test whether a given secure email system can be adopted in a grassroots fashion. Third, we apply our discovered design principles to PGP-based secure email, and demonstrate that these principles are sufficient to create the first PGP-based system that is usable by novices. We have also begun applying the lessons learned from our secure email research more generally to content-based encryption on the web. As part of this effort, we develop MessageGuard, a platform for accelerating research into usable, content-based encryption. Using MessageGuard, we build and evaluate Private Facebook Chat (PFC), a secure instant messaging system that integrates with Facebook Chat. Results from our usability analysis of PFC provided initial evidence that our design principles are also important components to usable, content-based encryption on the Web.

Mitteilungen des URZ 3/2002

Mitteilungen des URZ 3/2002