The Free Software Foundation's "EncryptFest" today covers both encryption and privacy. The free two-hour event runs from 13:00-15:00 Eastern Daylight Time (17:00-19:00 UTC), and includes: — A discussion on "bulk surveillance, and how encryption protects personal privacy" — A short video from renowned cryptographer Bruce Schneier. — A discussion with Henry Fisher, the founder of Techlore and a digital rights activist — A hands-on workshop on how you can encrypt your email using the FSF's Email Self-Defense guide "as a concrete step to enhance your data privacy" You may join us virtually, or if you are in Boston, Massachusetts, United States (the FSF's home base), you can join us in-person at the Boston Public Library's Copley Square branch. You may also join us in-person at MakeHaven in New Haven, Connecticut, US, and meet our deputy director Sean O'Brien. Whether attending our event online or in-person, please register. It will help us plan ahead and enable us to contact you about other important details before the workshop, like what to expect and what to bring... Bulk surveillance violates our fundamental rights and makes free speech dangerous. Email encryption is an excellent tool you can use to shield yourself from bulk surveillance. Encrypting your email is also a concrete step towards protecting your data from others whose intentions may not be honorable.

Read more of this story at Slashdot.

eMudhra, the certificate authority that issued eight intermediate TLS credentials so weak that anyone could mint certificates for any website or mail server—one had a private encryption key of just 4—said it’s getting out of the business.

V. Srinivasan, chairman of India-based eMudhra Limited, cited increasing costs and complexities of compliance requirements—paired with the business generating just 1 percent of its revenue. He also said that the emergence of organizations providing TLS certificates free of charge further reduced returns on investment when compared to other products and services the company offers.

Don't let the door hit you on the butt

“However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,” the company continued in a Thursday post. “In view of this, after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders.”

Read full article

Comments

© Getty Images

Let's Encrypt "will shorten the default validity period of its TLS certificates from 90 days to 64 days, starting February 10, 2027," reports the blog Linuxiac: All certificates issued or renewed from that date will have a 64-day lifespan unless users explicitly select one of the shorter options already available: 45 or six days. Existing certificates will remain valid until their expiration dates. Let's Encrypt expects the final 90-day certificate to expire on May 11, 2027. The organization also confirmed no valid certificates will be revoked during the transition. To help administrators prepare, Let's Encrypt will introduce 64-day certificates in its staging environment on October 14, 2026, allowing users to test their renewal setups before the change reaches production. The move is part of a broader effort to improve web security by reducing how long compromised or incorrectly issued certificates remain usable... Looking further ahead, the organization plans to reduce the default certificate lifetime again, this time to 45 days in 2028. That makes the upcoming 64-day limit an intermediate step rather than the final destination. "Administrators using cron jobs or scripts with hardcoded renewal intervals should review their configurations," the article suggests. "Another upcoming change concerns domain validation. Let's Encrypt will reduce the period during which a previously completed domain authorization can be reused from 30 days to 10 days. In 2028, that period will shrink further to just seven hours."

Read more of this story at Slashdot.

The blog It's FOSS reports: You already know that Canonical has been selectively replacing Ubuntu's C-based system components with Rust-written equivalents that don't compromise in terms of functionality, most of the time. Now it looks like the distro's OpenPGP implementation is next, with Sequoia PGP coming preinstalled in Ubuntu 26.10. Canonical wants it to eventually replace GnuPG [the dominant Linux implementation of PGP, written in C] as the default toolchain, though that switch has not happened yet... [The Ubuntu 26.10 release notes say Sequoia PGP's default status will be a future goal...] [Sequoia PGP] was started in 2017 by three former GnuPG developers who chose to build a new OpenPGP implementation in Rust rather than keep evolving GnuPG's existing codebase. Sequoia PGP is designed as a library that other software can use directly, rather than a standalone command-line tool. sq sits on top of that for encryption, decryption, signing, and key management, and sqv handles signature verification, filling in for gpg and gpgv in GnuPG. Sequoia also implements RFC 9580, the 2024 revision of the OpenPGP standard, whereas GnuPG has continued from the RFC 4880 branch, pursuing its own newer extensions and the LibrePGP specification rather than adopting RFC 9580 as its primary standard. From the It's FOSS Weekly newsletter, which also notes that the founder of the It's FOSS blog has also created a Linux-themed game called TUXDLE — a variation on Wordle where all the answers are Linux terms.

Read more of this story at Slashdot.