Hacker News Reader

Comment by cabalamat | Hacker News Reader

If the NSA is saying that all encrypted communication is automatically suspicious, then everyone should use encryption for all data they send over the internet.

Starting today, I am writing email encryption software that, when you send an email to someone else with the software installed, will automatically encrypt it on the way out, and automatically decrypt any encrypted messages on the way in. (A "zero user interface" once installed).

The intention is that this will allow people to encrypt their messages with zero effort on their part.

Initially it will encrypt email and will run on unixlike machines (Linux and Mac). Later it will run on all major platforms (Windows, iOS, Android) and have functionality for VoIP and social networking (the intention is to replace Skype and Facebook with secure alternatives).

View on HN

This should be open source software as there needs to be security reviews and what not.

Also, checkout OWS: https://whispersystems.org/

> This should be open source software as there needs to be security reviews and what not.

It will be open source.

No, that's not what the NSA is saying. The regulations only apply to material inadvertently collected while targeting a specific foreign target (who, presumably, might be routing their traffic through the U.S. to evade surveillance). If the information is encrypted, the NSA doesn't know if it's real domestic communications, or foreign communications, until it can be decrypted, so it's kept until it can be decrypted. Otherwise, a foreign target would easily be able to evade intercept simply by making their traffic appear to be domestic.

And all of their arguments start from the wrong side. It should not be "We stop listening as soon as we know that it is a US citizen." Instead, it should be "We only start listening once we know that it is not a US citizen."

And that is ignoring the whole aspect of it that they shouldn't be doing blanket surveillance to begin with, and should only be doing targeted surveillance, whether or not it is against a US citizen.

If you really want this to work you should target the webmail use case for the big three webmail providers. Nobody wants to use a standalone client on a PC, if that's what you are suggesting. Next up is a mobile client for Android and iOS that works identically to the existing mail client on those platform so there is no learning curve.

In other words, this will be a long slog where most of the work is product-oriented and feature Xerox'ing, and not whiz-bang cool encryption oriented. Good luck :)

Im unsure of what you are describing. Are you stating that hotmail should be able to display your decrypted emails? That would imply that they themselves would be able to read it and therefore remove any benefit. Any website you would build would have the same problem unless you resort to js crypto in which the js can be changed on you in a second (when the government forces your company to do so) and send the private key to the nsa. How exactly are you envisioning a solution?

There is no need for that decryption to occur server-side.

Where will the keys be stored?

How will they be distributed and replaced?

Who will generate them?

How will they get on my phone?

What happens when my phone is stolen?

How will they get to the people who want to communicate with me?

Ie, this is a hard design problem.

Hacking out a local client usable by unix nerds punts on these problems, more or less. Solve these problems in a way that fits into the workflow of present day average e-mail users (ie, my mom) and you will have something.

Nobody wants to use a standalone client on a PC, if that's what you are suggesting.

I do. Am I the only one who finds web-based email clients insufferably slow?

And next week, after someone demos an easy-to-use encrypted system, the same naysayers will be all about how it helps drug dealers and other baddies.

> Nobody wants to use a standalone client on a PC

What if your standalone client is a website running on your local box with an interface similar to gmail?

> In other words, this will be a long slog where most of the work is product-oriented and feature Xerox'ing, and not whiz-bang cool encryption oriented.

Yes, you're right. The crypto itself isn't that complicated.

Users can't and won't securely store key material, even their own.

Servers that store key material are subject to wiretaps.

We're not lacking secure alternatives because this isn't a technical problem.

> Users can't and won't securely store key material, even their own.

I believe it is an interface problem. I am surprised Mozilla isn't re-activating Thunderbird with an easier to use encryption procedure and an educational campaign to raise awareness in users instead of making petitions around Firefox.

Reply on news.ycombinator.com