Speaker 1: Brought to you by the reinvented two thousand twelve camera.
Speaker 1: It's ready. Are you get in touch with technology? With
Speaker 1: tech stuff from how stuff Works dot Com, brought to
Speaker 1: you by Visas. Y'all have things we like to think about.
Speaker 1: Online fraud shouldn't be one of them, because with every purchase,
Speaker 1: Visa prevents to texts and resolves online fraud safe secure pieces.
Speaker 1: Other ladies and gentlemen, welcome to the podcast. My name
Speaker 1: is Chris Colette. I'm an editor here at How Stuff Works,
Speaker 1: and today I have with me in the studio right here,
Speaker 1: sitting here Jonathan Strickland, one of our writers in the
Speaker 1: flesh Ye, And today we are going to talk about
Speaker 1: some encryption things, things that you might want to keep
Speaker 1: an eye on because this could be an issue of
Speaker 1: great personal significance. Yes, uh. In fact, it was an
Speaker 1: issue of great personal significance for about forty million people recently.
Speaker 1: Um actually probably not that many. That was the That
Speaker 1: was the total number of people acted by a recent
Speaker 1: UH discovery. The federal government had a sting operation where
Speaker 1: they identified eleven international computer hackers who are accused of
Speaker 1: stealing the information of forty million people and some of
Speaker 1: that included pen numbers, which was a that's huge news. Yeah,
Speaker 1: because the thing about it is if somebody has your
Speaker 1: debit card number, they can't do an awful lot with
Speaker 1: it unless they have your pen, your personal identification number.
Speaker 1: So for hackers to get hold of the number and
Speaker 1: the pen, then they're in business because that allowed them
Speaker 1: to create or at least there the authorities are alleging
Speaker 1: that they were able to create fake debit cards with
Speaker 1: numbers and they were allowed to get use those to
Speaker 1: get money. Yeah, they could go to any a t
Speaker 1: M and use that and put in the pin number
Speaker 1: because the number and the pen matched. Uh. The they
Speaker 1: a t M had no way of knowing that this
Speaker 1: was uh, you know, someone impersonating an innocent victim and
Speaker 1: the guy could withdraw money. Now, whether or not this
Speaker 1: actually happened will that remains to be seen. We we haven't.
Speaker 1: We don't have all the information just yet. But um,
Speaker 1: this kind of leads into a discussion about what encryption.
Speaker 1: Encryption is, how it works, why it works, and why
Speaker 1: it's difficult, uh to to crack it. So kind of
Speaker 1: give you an overview of encryption. That's essentially you're talking
Speaker 1: about encoding information, so that only the person or organization
Speaker 1: that receives that information will be able to decode it
Speaker 1: and get at that information. Um. And this is done
Speaker 1: with a key, So the key decodes the encrypted message.
Speaker 1: And there are a couple of different ways you can
Speaker 1: do this right right, Um, Actually, encryption goes back centuries.
Speaker 1: You know, it's something we think about as being sort
Speaker 1: of a new thing. You mean, you hear about famous
Speaker 1: encrypt and like the the Enigma machine from Germany during
Speaker 1: World War Two is a famous way of encrypting messages
Speaker 1: used in wartime. And sure that's you know, the military
Speaker 1: has used codes and encryption, you know, for you know,
Speaker 1: as long as there have been militaries, you know, people
Speaker 1: sending encoded messages. But when we're talking about this, basically
Speaker 1: they're there are two sides to encryption. It's generally the
Speaker 1: way it's done in electronic transmissions. Uh, there is a
Speaker 1: there are two keys. There's a private key and a
Speaker 1: public key, and basically to to get at the encrypted information,
Speaker 1: you have to have both pieces of information right right
Speaker 1: the way. Now, there is one other way you can
Speaker 1: do this besides the public private key, there's there's the
Speaker 1: symmetric key. Encryption approach, but it's it's less secure. Uh,
Speaker 1: symmetric key encryption. What that means is that you have
Speaker 1: two keys that are exactly the same. They can both
Speaker 1: encode and decode information. It's kind of like having a
Speaker 1: decoder ring, you know, like you'd get out of a
Speaker 1: serial box. Kids still eat cereal, right, yeah? Okay, So
Speaker 1: so they basically each person has an identical codebook, right,
Speaker 1: and the person on one end is encoding it with
Speaker 1: the codebook. And you know, you passed through a message
Speaker 1: on your friend who uses the identical codebook and can
Speaker 1: decode the message exactly. The problem with that is if
Speaker 1: anyone else grabs hold of that codebook, they can also
Speaker 1: decode the message, so it's not terribly secure. That's where
Speaker 1: the public private key comes in. Now, in this situation,
Speaker 1: you would have a private key that belongs to you,
Speaker 1: it's on your computer, that's the only place it's ever
Speaker 1: going to be found. And then you have a separate
Speaker 1: key called a public key that you can give to
Speaker 1: whomever so that they can encode information, send it to you,
Speaker 1: and only your private key can decode that information. Um.
Speaker 1: And this this is a this is a secure, more
Speaker 1: secure way of doing things than the symmetric key, because
Speaker 1: it's designed in such a way that you can't figure
Speaker 1: out what the private key is based solely on the
Speaker 1: public key. So you can stare at the public key
Speaker 1: all day long and you're not going to figure out
Speaker 1: what what the right process is to decode that information.
Speaker 1: And on the flip side, if you encode something with
Speaker 1: your private key and send it out, well, because because
Speaker 1: the public key is public, because other people can get
Speaker 1: hold of it, the information in that message won't be secure,
Speaker 1: but it is verifiable that it came from you, So
Speaker 1: it becomes kind of a digital signature, right You're you're saying, well,
Speaker 1: the public key can only decode informations that came from
Speaker 1: this particular private key, so we know the information came
Speaker 1: from him. The information itself isn't secure, but at least
Speaker 1: you know, like it's an authentication. It's it's like a
Speaker 1: digital signature. You know, you can it's absolutely verifiable that
Speaker 1: it came from this person. Um, you know what. There
Speaker 1: is one way around that though, if somewhere were able
Speaker 1: to get hold of your, say your laptop computer with
Speaker 1: your digital signature, you know, embedded in the computer, and
Speaker 1: you weren't encrypting your log in information. If it were
Speaker 1: just on then they could sign documents, which you know
Speaker 1: is another important part of encryption. It's not just for
Speaker 1: you know, your your pin number at your bank. You've
Speaker 1: got all kinds of other things that that could uh
Speaker 1: stand to be encrypted, especially if you have, uh, you know,
Speaker 1: very private information. If you have, say, uh, your bank
Speaker 1: account information on your computer. Um, my wife keeps a
Speaker 1: backup of our financial data on there. Well, if she
Speaker 1: were to not encrypt the log into her computer, someone
Speaker 1: could break into our house, open the computer up and
Speaker 1: see all that information because the log into the computer
Speaker 1: is wide open. Um. You know, they're they're all kinds
Speaker 1: of other things to Email is one of the most
Speaker 1: common places that you're going to see encryption. Um, you know,
Speaker 1: where you're actually aware of it being there. Um. There
Speaker 1: are ways to add that to your email program uh,
Speaker 1: programs like Pretty Good Privacy or there are There are
Speaker 1: actually some open source encryption standards, and even Google is
Speaker 1: talking about the possibility of adding a new open source
Speaker 1: encryption standard a p I, so that other people can
Speaker 1: incorporate that into their into their products. And I imagine
Speaker 1: and you know, they don't say that, but I'm just
Speaker 1: guessing that it's probably gonna end up in Gmail too,
Speaker 1: so that you can say encrypted messages back and forth.
Speaker 1: And you might be wondering how all this encoding happens. UM.
Speaker 1: It's generally uh accomplished through the use of a hashing
Speaker 1: algorithm to create a hash value. Now, an algorithm is
Speaker 1: a set of instructions that that machines follow to to
Speaker 1: complete a certain task. With a hash value hashing algorithm,
Speaker 1: what what happens is that it takes an agreed upon number.
Speaker 1: For example, this is just one of many different versions
Speaker 1: of hashing, but takes an agreed upon number that both
Speaker 1: the public and private key no, and it multiplies it
Speaker 1: by a different number, and without anyone knowing what that
Speaker 1: different number is. There's you know what what you end
Speaker 1: up with is the product of those two numbers. UM.
Speaker 1: If you don't know the identity of either of the
Speaker 1: two factors that went into making this product. UM, that's
Speaker 1: where the encryption comes in. You have to be able
Speaker 1: to say, hey, this number was arrived at by multiplying
Speaker 1: this number by this number. I'm the right person, let
Speaker 1: me see that information. UM. That kind of plays into
Speaker 1: r s A encryption, which is uh the idea that
Speaker 1: computers are really really bad at figuring out uh, the
Speaker 1: factors of a very very very very large number. We're
Speaker 1: talking about a hundred and twenty eight bit number, so
Speaker 1: uh uh this is this is a very large figure
Speaker 1: that that you have to take into account. So the
Speaker 1: what a computer has to do is it has to
Speaker 1: go through and try and figure each of those factors,
Speaker 1: finding the largest prime numbers that that factored together to
Speaker 1: to make this uh product um and computers take can
Speaker 1: take millions and millions of years to do this with
Speaker 1: a really really large number. Uh. In fact, the only
Speaker 1: real way of of cracking it right now, at least
Speaker 1: as far as people are theorizing, is to create a
Speaker 1: quantum computer. Yeah. Quantum computers operate on a much different level. Yeah,
Speaker 1: it's it's kind of a mysterious, magical level almost because
Speaker 1: you may know that the classic computers operate by looking
Speaker 1: at bits, so it's either a zero or it's a one,
Speaker 1: But with quantum computers it's a little bit more bizarre.
Speaker 1: It can be both a zero and a one, or
Speaker 1: a zero or a one or anything in between, which
Speaker 1: is kind of hard to get your mind wrapped around,
Speaker 1: and quantum computers have uh the potential of being able
Speaker 1: to crack this really hard encryption. It's through the use
Speaker 1: of something called s wars algorithm UM, and it's a
Speaker 1: really really complicated, complicated process. It's it's really hard to
Speaker 1: explain in layman's terms, so we won't really get into
Speaker 1: it here because I'm not a mathematician and I'm sure
Speaker 1: i'd stumble along the way. But it's it's because quantum
Speaker 1: computers are not actually viable right now. We can't really
Speaker 1: make a stable quantum computer of any significant size. It's
Speaker 1: something to worry about, but it's further down the road, right,
Speaker 1: So it's very unlikely that you're going to have to
Speaker 1: worry if you come up with a reasonable uh level
Speaker 1: of encryption on your computer that it's you know, nothing's
Speaker 1: going to be able to hack it easily, right, you know.
Speaker 1: But the more complex you can make your passwords, the
Speaker 1: more involved you can you can get your encryption. If
Speaker 1: you could take it up to or even two six
Speaker 1: bit encryption, it's just going to take a computer longer
Speaker 1: to try to break the code and decrypt your messages
Speaker 1: or you know, get into your file else. So you
Speaker 1: know that that if you can take the steps necessary,
Speaker 1: you can make sure that your your private information is
Speaker 1: more private. Of course, that doesn't really help when you're
Speaker 1: talking about someone else's network, like you know, your local
Speaker 1: mall the wireless networks that they used to to get
Speaker 1: that information. Yeah, it kind of brings us back to
Speaker 1: the story we were talking about at the beginning. So
Speaker 1: how did these guys managed to crack this encryption? Well,
Speaker 1: we don't really know right now, but the one theory
Speaker 1: is that they actually managed to get hold of the
Speaker 1: key that unlocks this information. That they did not actually
Speaker 1: decrypt it through some sort of complex hacking system. They
Speaker 1: just managed to get hold of that special dacoder ring. Um.
Speaker 1: So if that's the case, then encryption is not nearly
Speaker 1: as badly off as as we would think Otherwise, If, however,
Speaker 1: they found a way to decrypt that themselves without the key,
Speaker 1: that's something to really really start to freak out about.
Speaker 1: I think we all have things to think about, like say,
Speaker 1: what's the best site to buy a new leather jacket,
Speaker 1: whether to buy the three or six megapixel cameras. But
Speaker 1: thankfully we don't need to think about online fraud because
Speaker 1: for every purchase you make. Visa keeps an eye out
Speaker 1: for fraud with real time fraud monitoring and by making
Speaker 1: sure you're not liable for any unauthorized purchases. How's that
Speaker 1: for peace of mind, safe secure Visa. Yeah, the authorities
Speaker 1: in the article I read in an MSNBC said that,
Speaker 1: you know, there really wasn't any reason to worry. It
Speaker 1: didn't appear like this is a widespread phenomenon, and then
Speaker 1: not sure that that it actually happened the way that
Speaker 1: they think that it may have happened. But if if
Speaker 1: these uh, these hackers were able to figure this out,
Speaker 1: you know, we may be moving on to a new
Speaker 1: standard in encryption in a very short time. Yeah. Nothing
Speaker 1: like nothing like impending doom to really get you get
Speaker 1: the gears running right right. Well, I guess that's about
Speaker 1: all we have right now for encryption. But if you'd
Speaker 1: like to learn more, you can read how encryption works
Speaker 1: at how stuff works dot com and we'll talk to
Speaker 1: you again soon. Let us know what you think. Send
Speaker 1: an email to podcast at how stuff works dot com.
Speaker 1: Brought to you by the reinvented two thousand twelve camera.
Speaker 1: It's ready, are you