It’s Always Sunny in Reykjavik or How I NSA-Proofed My Email (2013)
27months.com
27months.com
Silk Road Iceland http://www.wired.com/2014/09/the-fbi-finally-says-how-it-leg...
ISIS domain name take down http://english.alarabiya.net/en/media/digital/2014/10/18/In-...
Iceland ISP's block TPB http://grapevine.is/news/2015/09/16/icelandic-isps-will-bloc...
Iceland BGP route attack http://www.internetsociety.org/deploy360/blog/2014/02/bgp-hi...
Rememeber that ashley madison hack? our prime minister had credentials on it! http://icelandmag.visir.is/article/icelandic-minister-financ...
Iceland seeks to ban porn http://www.theguardian.com/world/2013/feb/25/iceland-seeks-i...
I won't even get into our limited internet connectivity and resulting high IP transit rates. I'm not saying don't host here in Iceland, but do some research first.
1) Iceland is not a safe harbor from the NSA. Iceland is fully within the U.S. orbit. Iceland, actually does not maintain a standing army and its defense is the responsibility of the U.S. In addition, banking is a significant portion of Iceland's economy, and thus vulnerable to the U.S. cutting of access to SWIFT. Basically, if the U.S. really wants something from Iceland, it will be able to get it.
2) By making the front page of HN, the author is sure to have been noticed by somebody at the NSA. Because, the NSA has pretty broad authorizations for intercepting and decrypting foreign messages (that is actually why they exist), there is a very good chance that they are probably reading the author's email right now. If the email server had been in the U.S., there would have been at least some political/legal considerations about reading the email. By being in Iceland, there are none, and I am sure the author's email presented a very easy challenge (and probably is the butt of an inside joke about how this naive person thought their setup was NSA-proof)
A lot of crypto nerds have this fantasy of "NSA-proofing" themselves or their information.
That's near impossible. If the NSA cares enough about someone specifically to use, say, tools from the TAO catalog, they will be able to find out what they want to know. (See http://www.spiegel.de/international/world/a-941262.html ). The FBI also has powerful targeted surveillance tools.
Targeted surveillance is often legitimate, anyway. Authorities have suspicion that someone is, say, planning an attack or running a cartel, or someone is a suspect in murder case. It's good that powerful tool exist to find the truth.
I think the right goal is to stop mass surveillance. Mass surveillance the continuous monitoring of whole populations at a time. Mass surveillance is illegitimate and a threat to liberal democracy.
That leads to a totally different approach. Moving your own personal email server to Iceland does nothing at all to prevent mass surveillance (and honestly doesn't protect you from targeted surveillance either, as others have pointed out).
To roll back mass surveillance, both in the US and around the world, we need tools that are clean and simple and easy to use, even for people who have never heard of a "key" or a "cipher" and don't care what those are. We need to make things like end-to-end encryption, forward secrecy, and metadata security available by default.
Signal and WhatsApp are the biggest success stories so far. Moxie is the boss.
End of the day, all of this stuff is nonsense. The only thing standing between your stuff and unauthorized access is your contract and the actions of the third party running the datacenter. The only way you can exert any meaningful control over your data is to host it yourself... as in have computers and storage that hold your stuff running in your home.
Even then, making a statement like "I NSA-Proofed my email" is either self-delusional or clueless.
The FBI had little trouble getting access to Robert Ulbricht's servers, with the help of the Reykjavik Metropolitan Police.
Notably in that case, the Icelandic police did not even seek a court order, as they didn't need to since the server was owned by a US citizen. They just got a letter from the US police and decided to perform a raid. So you're absolutely right.
I'd question the technical compentency of anyone who would claim to have "NSA-proofed" anything without expounding further on the threat model.
If your adversary is the NSA, you need to determine how interested they are in you. If you're on the shortlist, I doubt any national borders or legal frameworks will protect you - TAO doesn't respect them.
If it's law enforcement like in the Ulbricht case, some countries may have stricter requirements for a local search warrant to be issued. But I doubt you can make such a sweeping generalisation about "europe".
And the trial judge didn't allow Ulbricht's challenge to suppress that evidence[1] on fourth amendment grounds as Ulbricht didn't claim or demonstrate ownership of the server[2]
Which is a shame, as it would have been an interesting case and could have changed a lot of that trial.
[1] and everything that followed per fruit of poisonous tree - which was most of the case
[2] http://www.wired.com/2014/10/silk-road-judge-technicality/
From what source and how were they validated, both from a secure checksum perspective and code audit? Was a full application pen-test done on each package after installation and configuration? Additionally, what controls are running server-side to audit memory execution and modifications on disk? Is Tripwire being used as an example? How about Wireshark? Is it being used to monitor all traffic from the host NICs with alerts sent out if it spots any non-encrypted traffic or traffic to IP addresses not explicitly white-listed? How about ongoing monitoring for zero-days for each of the packages used?
Nothing I read in the article leads me to believe there is any NSA proofing here whatsoever. Making something secure isn't about finding a "secure" data center and hosting a solution yourself. In fact, self hosted solutions can be some of the toughest to secure because you must have a broad and deep knowledge of security as it relates to the entire environment and then keep up with package changes in a way which results in auditing each and every future change. Honestly, no one has time for that and even if secure at x point in time, it won't be at y point, say when a Hartbleed level vuln is announced for a package used while the author is on vacation and can't reach his servers to appropriately mitigate.
I use Gmail + GPG (almost nobody uses GPG) in Thunderbird. When I truly need confidentiality over internet communication, I use Signal.
SMTP is just plain broken in a sense of security.
Aside from the many maintenance problems of hosting e-mail yourself, the biggest problem here is the distance: Iceland is far away from the user in the USA. Latency doesn't matter so much for e-mail, but connectivity does, and if there's a problem with a transatlantic link (which does happen on occasion) there goes your most important communications medium.
Finally, the biggest fallacy with e-mail is that it is ever secure. It's never secure. The mail on your client devices is unencrypted, and if you ever reply, forward, or send an e-mail to anyone it's very likely for the whole thread go over an unencrypted relay and be stored temporarily, not to mention the logs, and the unencrypted storage on the destination, etc.
Your physical mail isn't secure in the postal service, and neither is your virtual mail in the e-mail service.
Email is hard to secure and identified personal accounts are difficult to keep private.
The "better" answer is to do what those on Wall St figured out after various scandals and Sarbanes-Oxley - if you want something to remain private keep it off email.
[1] Sorry.
Email is trivial to secure. Just need to be able to exchange OOB one RSA key.
But being able to securely communicate with "isis_recruiter34@jihadistan.jihad" don't give you much when LEO knows that you are communicating with each other.
Nowadays you need security, anonymity and usability - which are often with contradicting requirements.
[1] https://www.nicta.com.au/pub-download/full/8943/
[2] https://www.google.com/transparencyreport/userdatarequests/?...
One such end-to-end email encryption solution can be found at www.jumble.io
The "better" answer of not putting sensitive information into email is true for all industries, however, more companies are installing end-to-end email encryption solutions to comply with SOX and mitigate risk in the event of a breach.
- No mention of reputation, the hardest part of self-hosting email
- Advises using StartSSL, so he hasn't purged his trust store of root CAs under the NSA's control (given StuxNet and the relationship between the US and Israel, Israel isn't a country that's free from NSA influence)
I wish people would stop using the term "end-to-end encryption" to simply mean using encrypted channels. It really does confuse people who have heard that end-to-end is great, but don't actually understand/appreciate the differences between the two.
So, let's just compare the author's email to that list. A strong TCB at OS/firmware/trusted-component level like with EROS, INTEGRITY-178B, or GenodeOS? Nope. Components or apps made in a manner to reduce complexity, be type/memory safe, use static analysis, analyzed for covert channels, and so on? Probably not given names I saw. Do the underlying projects use a subversion-resistant development process and SCM security that assumes a number of them are malicious w/ independent auditing? Virtually nobody does that despite Myers (1980) showing subversion the most powerful attack. Has the crypto and its implementation been tested by experts in that? Don't know. Has the overall system and configuration been pentested by TAO-grade hackers? No.
So, it's far from NSA-proof as the underlying properties necessary for NSA-proof operation don't exist here. They exist only in a handful of defense-oriented products with some traits existing in other security-focused projects (esp in academia). This, at best, will slow down nation state attackers who are probably uninterested in his system anyway. A good configuration and 0-day mitigation tech might make this build survive typical blackhats and snoops. A real, threat profile along with more reasonable goal.
Won't stop the NSA, though. You can put money on that. Assume it's true every time you hear it, too. You can't stop nation-state attackers until you know how (see framework) then apply that to every level and user/machine interfaces. Even then, it might work and might just be an obstacle. So, include monitoring & logging on top of it.
> "Sovereign is a set of Ansible playbooks that you can use to build and maintain your own personal cloud based entirely on open source software, so you’re in control."
It makes use of all the techniques described in the article for e-mail, including dovecot/postfix, DKIM, encfs.
I decided to give it a try a few weeks ago. I went and bought a $10/month linode instance and a domain name. By the end of the day I could send and receive e-mail. letsencrypt was a big help here, because it allowed me to get TLS for free.
I always assumed that hosting your own e-mail was virtually impossible but my friend has been hosting his personal e-mail and the e-mail for his company for around two years now, with linode and sovereign. He says that the server requires maintenance about once every six months.
This doesn't really protect you from the three-letter orgs, as other commenters here have mentioned. But it does put you in control of your own data, and prevents analytics of your own inbox by corporations like google.
Using PGP (with a locally stored private key) is one of the best option I'm aware of to secure emails and continue to use email cloud clients like gmail or yahoo.
The only caveat is that you loose search which is one of the requirements in the article.
> Google has most of my email because it has all of yours
Mailpile (I'm a backer) might be interesting, but is still unstable and the future isn't certain for happy reasons (i.e. 'paternity leave'). Stumbled upon Whiteout from the references in the mailpile blog, only to learn that the company behind that effort is dead. No clue if or how this project will continue.
I regularly see (new) mail clients mocked as 'unnecessary', but I'm still waiting for a decent one. Mail as a medium works incredibly well for me, but it feels unpolished to use whereever I am.
I switched to pine in ... 1993 ? I've never used anything else (except for brief stints of corporate email account and consulting, many years ago).
You'll note that in the "screenshots from famous developers"[1] that Brian Kernighan (Unix legend, the K in K&R and AWK) is using alpine in his 2015 screenshot...
[1] https://anders.unix.se/2015/12/10/screenshots-from-developer...
But I guess I don't see how you could turn that into a 'mobile' client. For the time I used pine I was ssh-ing into a box of mine for most of the day, while I was in front of a computer. I didn't care much about mail notifications on the go.
Now I do. If there's some (reliable! I don't care about the initial one-off effort) way to make that work with emails on the go, I'd be glad to learn about that.
Solution to this is to remember what the purpose of email actually is. It's supposed to be asynchronous communication, with the expectation that it may be checked, at most, 1-3 times daily. If you need communication immediately and in any location, instant messaging covers that use case much better.
For me mail is for async, coherent exchanges. IM is not a replacement: It is usually a conversation, usually short and short-lived and synchronous.
Async doesn't have to imply that I don't get a notification about your mail. It just means that I probably won't answer right away - or at least on my time.
Anyway: Mail plus ~instant~ notification is a thing for me and I don't want to give that up.
- local mail delivery does not traverse any network
So if you are user A on a mailserver and your wife/friend/uncle is user B, when you send mail to them that mail is simply a local copy operation (provided they don't POP or IMAP it to a local mailtool).
That's pretty interesting, I think.
It may interest you to know that no piece of rsync.net company email has ever traversed a network - everyone logs in via SSH and uses (al)pine and all internal mail is just local copy ...
As for spooky23, while most your email recipients might be NSA accessible, maybe not _all_ of them are. If you manage to keep your email account confidential, then peeping toms only have a partial view of your social graph (the part that is in your compromised correspondent inbox).
https://www.greenqloud.com/greenqlouds-public-cloud-services...
Thor is no more
For anyone else trying to 'fix' unbroken things: Hold off for a minute, read the link here first.
1: http://postfix.1071664.n5.nabble.com/Disabling-Anonymous-Dif...
On a physical machine, you have to plug in a dumping device into a DMA-capable port, cool down the RAM and move it to another machine as fast as possible, or reset the machine and boot it from another medium (hoping the BIOS didn't override anything useful). In many jurisdictions you also have better protections in regards to required warrants and such for your own hardware.