Don't Even Think of Using Encryption Software to Escape NSA Scrutiny
dailykos.com
dailykos.com
We affect the 95%.
The solution could be a distributed CA system like http://convergence.io/
My understanding was that having a CA's private key just enables someone to issue new child keys for that CA. That vulnerability could be addressed with certificate pinning.
However, they absolutely can mount a MITM with the CA root.
EDIT: Further, if they can compel a master key then they can also compel a copy of all the private keys the CA generates.
The more taxes we will all have to pay. :)
"I used to wonder when the cyberpunk future was going to get here. Then I realized we're living in it"
So you essentially have to go off the usual grid to run your own email service... then you have to get all your contacts onboard with using it.
I have a client that uses zixmail - webmail that is https and just sends notifications to your plain-old-text email, then you login and read and reply to your email over https. Ironically, it is a gov't agency that makes us use it.. I wonder if they snoop on their own encrypted, vendor-provided secure email?
The only problem is that a lavabit email is generally viewed as an anonymous (burner) email, so half the services I want to register to just kick the email back as not being "legitimate" enough.
For human to human emails it's great.
Running a mail server is off-grid these days? Can't you just use pgp encryption and it doesn't matter where your email is stored.
The vast majority of people are not able to run a mail server. Of the ones that do some should not be doing it because they're not clueful enough to keep it secure and out of blocklists.
> Can't you just use pgp encryption and it doesn't matter where your email is stored.
Most people get freaked out by context menus and right-clicking. You're smart; you're surrounded by smart people; you're surrounded by people who know computers. I think you might be unaware of just how bad most people are with computers.
Nice plugin though, installed.
Not encrypting to stay secure is just plain fucking stupid. If you don't encrypt they can read your shit anyways. Plus "reasonably believed to contain secret meaning" in all likelihood means "whatever the fuck we want".
As someone else already noted: There's strength in numbers. Let's just encrypt everything and have those fuckers deal with humongous amounts of data, most of which will be completely useless. Shit, if you're inclined to do so let some piece of software run all day that just produces encrypted gibberish and sends it off to random recipients.
edit: yeah, I was talking out my ass, get over it. I still think it's imprudent to assume that encrypted files may never be compromised in the future.
Edit: It would probably just be easier at that point to ban encryption going forward.
You couldn't even increment every position of a 256-bit key using the energy our Sun could provide, let alone brute force 256-bit AES.
> Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it.
You probably don't need to use 3 cyphers. Just make sure you're storing your private key somewhere safe.
s/Moore's Law/technological advance and\/or advances in cryptanalysis/
Just so you know; the reasoning behind huge NSA camp they are building in Utah is not because huge camps are cool, but because someone at decisions level was presented with average number of data an average citizen of us soil digest per day, and that number was overwhelming.
So, if we all encrypt everything, 2 things gonna happen:
Either they will ask to quadruple their funding and build 10 more Utah-type camps "because we need more storage and CPU resources to catch those pesky terrorist", or
The problem will be so huge for the government that it will ban usage of PGP/encrypting. The light version of banning would be, for example: extra tax if you encrypt your data. I can see it easily reasoned: terrorist use PGP encryption so the government uses lots of resources (that equals to money) to crack those down so in order to keep their operation running they need extra money. Of course if you do not use PGP you don't have to pay that tax. If you do use PGP, you are required to pay it. Simple checkbox on your tax form. Now, if they every catch you with some encrypted files that they can reasonably say belongs to you (just like the can/cannot tell the child porn files belong to you [they can always upload them themselves]), you will be charge with a severe fine or imprisonment up to 25 years for aiding terrorist [by not supporting NSA Encryption Unit financially -- remember Bush motto? you not with us, you with terrorist].
So, long story short. Just pissing them off and encrypting everything will not fix the issue. It will just give them more reasons to ask for more funding. And they will get them.
So, they will keep it until they can figure out its content ? Fine, so why make it easy on them by giving them plain content from minute 0 ?
I don't see why would anyone able to encrypt his/her data not to.
The problem is not about them keeping encrypted data but about them labeling you as a potential bad guy once you have encrypted data.
"Deine papiere bitte" on the streets is not that far away. Actually what we have today is worse, self-censorship and suspension of rights.
Yup. It is practically here, license plate scanners, NSA metadata with location, constant surveillance. The only thing missing is automatic enforcement of the many petty crimes we commit each day (but you will be threatened with them if the gov't needs you to inform against someone, or simply wants you to plead guilty to some crime).
We already have this. Red light cameras.
Does a system like that exist? A constant stream of random bytes, some of it real information, most of it not. Only those intended to be the recipient know where to look.
I agree, this may not be true in practice.
[Presumably, NSA is not collecting all sources of random data?]
I wanted to like this proposal, but then I realized these encrypted spams have to be sent somewhere. Any ethical target would be too easy for "the bad guys" to filter. Oh well.
We do have a choice here, and our collective decisions will be what shape our future and our future government. Without a concerted effort we're doomed to slip ever closer to a dystopian future of zero privacy and ever present suspicion of everyone.
If they can't get the data in transit, they'll go for the sources and destinations. Legally mandated keyloggers, anyone? An 'adversary' as markedly omnipresent as the NSA has had no problems [1][2][3] with intruding upon infrastructure, and I doubt your pesky little Win8 tablet or your pretty little Linux box would be able to withstand even a fraction of what the NSA could set up as a push-button intrusion system.
A click of a button, and you're compromised.
If you mess with the bull, you'll get the horns.
[1] http://rt.com/news/snowden-nsa-china-hack-120/ [2] http://venturebeat.com/2013/06/12/nsa-global-surveillance/ [3] http://www.wired.com/threatlevel/2013/06/snowden-says-nsa-ha...
My public key is here: http://sho.ch/alexgraul.publickey and on the gpg keyserver, where's yours?
but maybe this is a different thing conceptually i think i would call that a stamp or a seal ..sort of like a wax imprint of a key
Seriously, the are few situations where someone's actually going to want to post their private key to the internet - at least if they understand what it is - so what are we imaging that they're doing with it that they need to know about it in the first place?
You're probably going to want them to have a backup, but you can have them make a backup without having them understand the difference - you just have your program back up a folder structure that the private key is hidden somewhere in and only make the public one obvious. Make them aware that if they don't backup they won't be able to access their emails - should the worst happen - but don't tell them why. Someone with a push-button understanding of computer... they just don't really need to know why.
... -sigh-
I almost wonder whether it wouldn't be easier to market public-private key crypto as a packaged solution. Buy an encrypted email address kind of thing. Send people a physical token they mentally associate with that email address and tell them not to lose it.
GPG has a sucky API and crazy CLI. It's a stack of eggs that everyone is scared to improve.
People don't even try to understand the bare basics of PKI or even security because they are fundamental lazy and not required too. No one expects them to understand the math, just the few processes required for basic usage. If you can understand the arcane rules of baseball, or how to drive a stick, or solder, or field strip a pistol or basic cooking, you can learn how to "use" encryption.
Consider https. That is very easy to use, because the user doesn't have to do anything to use it. The user doesn't need to know anything about encryption.
Doesn't this mean that many users will just click through any errors, thus making https less secure than it could be?
Consider the evolution of warnings. Padlocks were shown in different states and colours, then pop-up dialogue boxes appeared, and now Chrome has an entire red screen with a suitably stern warning.
You're right that https is the easiest form of PKI for users to understand. And they still get it wrong. And that's for encryption that could make a difference to their lives - people could steal their money or their products or whatnot.
Allow me to be the first. (Check your email.)
In all seriousness, I agree that it's a social problem. I think we (in the tech industry) can do a better job of making the tools easier to use. If we really want to make something like PGP take off, we'll have to provide easy tools that integrate with people's email clients and provide dead simple tutorials of how to get started.
I am talking about something like a Chrome/Firefox extension, which creates a GPG key pair for you, uploads the public to some central server and encrypts stuff like the text in your hotmail, gmail, yahoo mail, etc, after you press "send" and before the text is sent to google.
Then, at the other side, the a user with the same extension opens the new message and as soon as it appears, the extension detects that it is an encrypted message, reads the id of the sender and decrypts the message.
There are lots of details which makes this difficult to implement... but that would be the only way to make the vast majority of people use public key encryption.
The only problem was that the system was compromised in order to comply with US requests.
http://en.wikipedia.org/wiki/Hushmail#Compromises_to_email_p...
Good concept, but anything you rely on someone else doing can always be compromised.
Someday I'll even meet someone real in person and be able to get it signed!
Btw. It's time to upgrade the DSA signing key to longer RSA key. Soon GnuPG should have ECC support allowing much shorter keys.
I don't have one. I, a software developer, have no idea how to get one. And if that's the case, what hope does anyone else have?
Does it dawn on anyone else that our government has and will continue to have turned on its own people. Let that sink in for a couple seconds. The the majority of the legislature instituted it and the executive has been executing it with impunity.
It is already bad enough just based on principle as to what is being done to the rest of the world, but our own government has turned on its own people. Just like Europe didn't quite understand what it was getting into, let's say late ~1910 and again in ~1930, because what was to come was so beyond their experience and comprehension; we are making the same mistake and not quite comprehending the ramifications and consequences that will wash over us.
No one wants to acknowledge it, but the enemy is within. Tyranny is spreading the way it does and will not be apparent until it is too late.
And strength in numbers is not the only reason to do this. The more people expect that their Internet communications are private by default, the more outrageous it will seem to the general public that encrypted data is an exception to whatever rules there are against storing and targeting data from U.S. citizens. "Encrypt everything by default" is a good policy for changing social attitudes, not just a technological measure to defeat an unconstitutional practice.
Anyway, I have found that if some article claims that you should or should not do something to protect yourself against NSA, it is almost always written by an amateur. The real experts know that we currently don't know which capabilities NSA has and what exactly they do, so it is almost impossible to assess if something will help or not help or hurt.
My "amateur gut feeling" tells me that if you really want to send something secretly, you should at minimum setup a separate hardware+software with no connection point to your real identity. But this is not advice against NSA, just an opinion.
But indeed, let's keep using encryption. It is, after all, the US government that has a long history(1) of trying to keep encryption out of our non-American hands.
(1) http://en.wikipedia.org/wiki/Export_of_cryptography_in_the_U...
Furthermore, it would be weird if this didn't happen. And if your country, whichever one it is, isn't doing this, and some horrible thing happens which might have been avoided by this kind of spying, then your co-citizens will be rightly outraged and demand to know what the hell your government thinks it is doing.
But, equally, your government might [ought?] to consider what it can do to protect its citizens from foreign spying.
Most wicked in all of this is not that the spying takes place, but that it does so within the most diaphanous of legal frameworks. I understand that my government might want to spy on me if it thinks I'm involved in something illegal, but I damn well want a clear, unambiguous, legal framework that says who gets to authorise that spying, for how long, and on what grounds. Oh, and the person who does that authorisation had better be a judge, or an elected official that I can un-elect.
All this we're-so-clever-because-we-found-a-way-to-subvert-the-law-by-cleve-interpretation nonsense needs to be stopped in a career ending way for those doing it. Oh, and the politicians who gave it a wink and a nod need to be named so we can decide what to do with them at the next election.
In summary, countries spy on foreigners. Always have. Always will. But that doesn't excuse them spying on their own. That kind of behaviour has a bad reputation, for a bunch of historically valid reasons.
I'd like to live in a world where we all were able to assert our rights, as stated most elegantly under the Declaration of Human Rights (1).
Article 7: All are equal before the law and are entitled without any discrimination to equal protection of the law. All are entitled to equal protection against any discrimination in violation of this Declaration and against any incitement to such discrimination.
Article 12: No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.
Article 14: (1) Everyone has the right to seek and to enjoy in other countries asylum from persecution.
Article 19: Everyone has the right to freedom of opinion and expression; this right includes freedom to hold opinions without interference and to seek, receive and impart information and ideas through any media and regardless of frontiers.
The USA's own Elanor Roosevelt was the Chair of the CHR, which drafted the Declaration, and the US is a signatory. (2)
(1) http://www.un.org/en/documents/udhr/ (2) https://en.wikipedia.org/wiki/Universal_Declaration_of_Human...
Now we seem to have this attitude of "Justice for all (multinational) corporations!". Voting the wrong way is terrorism, as far as some of these interests are concerned :-(
I would prefer if we managed to stop this nation vs nation view on things. But, since this is probably impossible, the way forward is to encrypt everything and stop using foreing cloud services.
Here you are going wrong because this implies every other country should do the same and therefore harm you. This is nothing but war just without shooting people. Every right you claim for you, you have to grant to everybody. You want to perform industry espionage, then don't call it an act of war if they are spying at you. This is one of the deepest roots of all the mess in this world - not being willing to treat everybody equally.
I actually have a nice Gedankenexperiment. Just imagine for one moment Iran would contact the US government and tell them they fear that the USA may be hostile to them and they are concerned about their atomic weapons. Therefore they would like the USA to denuclearise and grant them access to all their nuclear facilities to oversee what they are doing. Can you imagine the laughs?
So international isolation in the upcoming turmoil times of re-balancing of the global politics may not be the best time to be.
US seems like post-Birsmarck's Germany right now - too powerful, arrogant and incompetent for its own good.
Oh I don't know... morals? A simple sense of common decency? I know, it brings a chuckle to talk about such qualities when talking about a government, but let's just pretend for the sake of conversation that the government is for the people and by the people and not a self-propagating hostile life-form.
The first duty of government is surely to protect the interests of the country to which it belongs
Do you not see that the foreigner-spying aspect of this this leak does immeasurable damage to US interests, especially US-based companies? Such simple-minded views are used to defend our drone program. To put it crudely, we can't go around the world fucking everyone else in every which way and continue to pretend to be the good guys. The concept of this country being a good citizen of the world hasn't even occurred to most Americans.
your co-citizens will be rightly outraged
You beg the question. They may be outraged, but I don't think they'll be rightly outraged. People tend to have very myopic perspectives in the face of disaster. I don't think that's the bar by which we should set our policy.
That's exactly why we have an intelligence arms race developing.
Country A spies on citizens of Country B. Learns all sorts of useful information that could be used for doing some nasty things like black mailing political leaders, manipulating the economy, supporting anti-government groups, etc.
Country B says hey wait a minute. Country A knows more about our our domestic situation than we do because they spy on our citizens and we don't. That could give them a huge strategic advantage. We gotta start spying on our own citizens to stay one step ahead of Country A!
It's the evolution of warfare into the 21st century.
Because being openly hostile to foreigners is not very productive in a world where international commerce is important. What happens to all of those "cloud" companies when nobody trusts their bytes to leave their country's borders?
So if the NSA want to spy on a US citizen they simply enable the UK to spy on that USA citizen and share data afterwards. All very legal and NSA is clear to spy on any US citizen.
I want to see what the reaction is when we find out that some foreign country is spying on all communications of American citizens and retaining all their data. For sure it is happening. Someone else mentioned GCHQ UK possibly has the same kind of program running with agreements with NSA. Let's just wait for that one to be exposed. Or maybe China. Or Russia. Or N Korea.
As a non-US citizen (UK) the NSA supposedly has all my communications stored. I have no say in that and it seems that people are treating that as a non-issue. 'Ahh foreigners won't mind.' But we do
I'm curious, do you think it would be unethical for British Intelligence to spy on someone in, say, Pakistan?
This sudden outrage is odd, honestly what did people think the NSA did with their tens of billions of dollars per year budget?
My comment is more about how so many people seem to be blindsided that this is what the NSA does. It should have been assumed, even expected.
My key is available at https://keyserver.pgp.com/vkd/DownloadKey.event?keyid=0x9C3D... or you can search for my key with the id '9C3DEA4F4A1E556D'!
Technology is not the solution to this problem, it is society and it can be solved by rule of law, accountability, revolution and such old forgotten concepts.
Technology is not the solution to this problem, it is A solution, among others.
to compile OpenSSl you need a compiler and an entire toolchain, an operatingsystem, microcode and hardware. In any layer it is possible for an organization such as NSA to do its dirty deeds.
They dont fabricate their own chips/hardware for fun. Well, maybe for fun too, but not only for fun.
I tend to assume that Microsoft Windows has backdoors, given their track record and their corporate culture of bending to the will of the government. This means that anything you run off of Windows is already compromised. Open-source operating systems are one way to remove this unknown. The largest ones have the eyeballs of thousands of people scrutinizing them at all times.
I can't speak to hardware backdooring because I know nothing about it. Would this be able to affect end-to-end encryption like GPG? I'm assuming it would have to have extremely complicated analysis to understand the "bigger picture" of the instructions being run on the CPU...and logging every instruction is beyond the capabilities of built-in hardware for most computers, I would think. Are there any good articles on this?
On the other end, the American public needs to wake the fuck up and realize that just because one of us isn't a terrorist doesn't mean this doesn't affect each of us, individually. The government works for us, and we wrote the constitution, not the government. It is ultimately our job to enforce the constitution.
I'm starting to wonder if Americans even deserve free speech if all it's used for is to take pictures of your lunch and post it on instagram, or free press if it only covers a useless string of mundane sludge while dancing around the issues that are defining us as a people.
1. The NSA is allowed to store and analyze encrypted data longer than unencrypted
2. US citizens' encrypted data will be treated the same as non-citizens'
It still seems you have a much better expectation of privacy by encrypting your data and trusting to mathematical proofs that it would take thousands of years to break it; rather than leaving it in the clear, and trusting to five year storage limits and the supposed privileges of American citizenship.
(It's fairly likely that the US has covertly tapped undersea cables elsewhere in the world as well.)
This is recently reported, but has been known for many many years. (Longer than the lifetimes of some HN readers.)
It is the publicly stated mission of GCHQ.
But, in general, NSA / GCHQ have many mathematicians working on crypto. Some of them are breaking existing products. Some of them are breaking newer algorithms. Some of them are working on creating newer algorithms.
One example of an important cryptosystem that was invented independently in secret before it was invented is public is public-key crypto. (https://en.wikipedia.org/wiki/Clifford_Cocks)
Employment opportunities for mathematicians are slim, and GCHQ is known for tolerance of the sometimes odd behaviour of people with Asperger's.
There was a section in there about the development of DES. At some point the researchers at IBM showed their work in progress on DES to the NSA, and the NSA made a few suggestions on improvements, one of them was a different set of S-Boxes (basically a bunch of constants used as part of the cipher.) IBM analyzed the new S-Boxes and could find no weaknesses so they used the ones the NSA recommended.
Over a decade later, differential cryptanalysis was discovered and it turned out that the tweaks the NSA had suggested made DES particularly resistant to differential cryptanalysis.
After doing some googling, it seems like the gap has closed since that book was written. They are still ahead, but not as much as they were in the 80's and 90's. Or maybe that's just what they want us to think ;)
I suggest that we all create a handful of large files from /dev/random, make torrents out of them, and seed them until their servers bleed out.
Your idea of seeding some /dev/random or attaching some /dev/random to emails sounds like a great idea, and also funny, to me. We should definitely do that!
Then spread the word and give them something to spy on.
I say we go for it.
Alternatively, we could set up a mesh of dropbox/cloud accounts. People would connect in pairs and generate their own huge files of garbage. Then they would copy it into each of their dropbox directories and it would propagate n times. If everyone does this every day (write a script to generate random data), there will be a continuous stream of randomly encrypted files across the network. When your cloud drive fills up, delete older files.
The idea being, you think they can't break your encryption, but they can just break your fingers one by one until you tell them the password.
The NSA can't hire enough heavies to break fingers of every person sending and receiving encrypted data (assuming they could even find the people sending and receiving it without first decrypting).
It seems to chill speech either way. This is why the wholesale spying must stop.
They can attack an encrypted communication and probably decrypt it, but they just want you to be afraid of encrypting with fear of being targeted so that they have it easier to process your information.
But that´s a fallacy and a puny tactic to make the general public afraid of being under scrutiny because of the very reason of using encryption.
They might be able to decypher encrypted communications if they are the minority, but even with their big supercomputers and billions of dollars, I doubt they would be able to process people´s communication if encryption was the majority of communications.
And these articles work towards the NSA´s goals and agenda misleading the public in thinking that it´s better not to use any encryption at all. If the public was educated on this subject and everyone used encryption, I guess they would have a really hard time processing all this information...
This 'tactic' was classified until leaked, so I don't think its purpose is to scare the public. My guess is that they just want tons of ciphertext samples to use in future cryptanalysis work.
That it would have been brilliant, is how I know that General Surveillance and his minions didn't do it.
Surely this is massively dependent on the kind of encryption being used?
Why this assumption? The NSA has NO super-human abilities.
And one of their jobs is to protect gov secrets. Which is why they participated in the AES standard. If you really believe they can decrypt AES, then you believe they chose an algo that is insecure, than would allow China, Russia and others with similar abilities to read any of our nation's secrets.
Not to mention, that there are currently no known attacks that would allow them to decrypt AES in any reasonable amount of time, even if they had every single computer in the world.
If you really believe the NSA can decrypt anything, then you're out in conspiracy-theory land, with magical yet-to-be-invented computers, and humans with super-math abilities.
No, but they do have a larger hardware budget than you. And a larger budget for crypto research.
If you haven't broken the algorithm, a "larger hardware budget" really isn't helpful at all. Key sizes are big enough that the laws of physics prevent you from brute-forcing them. From Bruce Schneier: "If we built a Dyson sphere around the sun and captured all its energy for 32 years, without any loss, we could power a computer to count up to 2^192. Of course, it wouldn't have the energy left over to perform any useful calculations with this counter." http://www.schneier.com/blog/archives/2009/09/the_doghouse_c...
If they've made a huge breakthrough on quantum computers, they could break the popular public-key algorithms, but could only halve the effective key size of symmetric algorithms.
A lot of it still boils down to password guessing. The limitation is in the user's choice of password, not the laws of physics.
Given the techniques listed here http://arstechnica.com/security/2013/05/how-crackers-make-mi... (e.g. generating password guesses with Markov chains) suprisingly long and un-obvious passwords are found without brute-forcing the whole space. In other words, you have to pay attention to a whole lot of lateral things to actually be secure. The mathematical properties of the key-space don't matter if your OS has been backdoored and a keystroke logger installed.
A keylogger bypasses the whole thing but so far nobody's accusing the NSA of hacking lots of domestic computers, and that would definitely do away with the excuse that "we didn't know he was in the U.S."
I know several people who have put all of their (strong) website passwords in a 1password/keepass/truecrypt file covered by a password that they can remember and type; and then put that on dropbox. Over the wire. I am assuming that this is compromised now.
> nobody's accusing the NSA of hacking lots of domestic computers
Except for here http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-t... and http://blogs.computerworlduk.com/open-enterprise/2013/06/how...
> "we didn't know he was in the U.S."
I am sitting in front of a domestic computer that is not in the US. The line about "but only for non-americans" is no reassurance whatsoever to the world.
I was familiar with both those stories, and neither is about the NSA hacking into domestic computers (by which I mean, computers in the USA, which is "domestic" for the NSA). Voluntary cooperation by firms is not the same as the NSA surreptitiously installing keyloggers.
And yet you were arguing a few comments up that the keyspace that 1password etc use was too large to ever crack. But you have to remember some master password. Your crypto is only as strong as the weakest part.
> domestic computers (by which I mean, computers in the USA)
I'm sorry, I thought that you meant "computers in people's houses". In the USA or not, I could not care less.
> Voluntary cooperation by firms is not the same as the NSA surreptitiously installing keyloggers
The keyloggers is a logical endpoint of what they would do with the 0-day exploits mentioned in the two articles. Not directly related to the "cooperation by firms"
As a foreigner with an enormous distaste for the US government and a comfortable relationship with cryptography I say; good luck with that fascists, bring it on.
"cryptography" is not enough - but good cryptography with good passwords, and due care at the points where the decryption happens may be.
No. If you do it right, nobody on earth can decrypt it. From Bruce Schneier:
>> In fact, we cannot even imagine a world where 256-bit brute force searches are possible. It requires some fundamental breakthroughs in physics and our understanding of the universe. For public-key cryptography, 2048-bit keys have same sort of property; longer is meaningless.
and
>> These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.
http://www.schneier.com/blog/archives/2009/09/the_doghouse_c...
Also, from Bitcoin Talk:
>> But what about very well funded entities such as the US National Security Agency (NSA)? Could they build a machine to crack a 256 bit key? Assume they could build a theoretical nanocomputer that executes 10^13 instructions per second (approximate rate of atomic vibrations) in a space of a cube with a side that is 5.43nm across (This is the approximate size of a silicon lattice10 atoms wide, or a crystal containing 1000 silicon atoms). Assume that it could calculate an attempt in 10 cycles. Such a computer the size of the earth would take more than 10^13 years (roughly 58 times the estimated age of the earth) to attack a 256 bit algorithm via brute force.
(1,2) (3,4) (10,7) (11,1) (12, 2)Many steganography systems use images or video or sound, but are 'proof of concept' - toys for learning - rather than serious tools. This, unfortunately, includes many of the steganography systems described as serious tools.
One of the problems of hiding text in text is persuading people not to re-use the cover text.
... but then it's encrypted. I'm not willing to take chances with the argument that if I send everything in the clear and take steps to act non-suspiciously then they won't intrude on my privacy. What I send in the clear I assume will be looked at; as for what is encrypted, they are welcome to store it and look at it as much as they like. (Yes, maybe they can break OpenPGP-grade encryption, but if this is the case then we're screwed anyway.)
If they cannot establish if a US Person is party to the conversation, they should assume one is and remove the potential of violating this constitutionally guaranteed right. This could be due to a failure of the service provider (Google, Verizon) to collect this information (they don't), or the fact that the communications are anonymous or encrypted, etc. Proving a negative can be tough, but that burden is the government's to bear.
Of course there is also a moral component… I'm pretty shocked that as patriotic as we are about the sacred rights of the constitution, we somehow feel that it is morally ok to not afford these protections when dealing with foreigners. The Declaration of Independence says:
We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness.
With the rights to be enshrined more specifically later in the Constitution. How can anyone passionately agree with these words and not believe that the just treatment afforded to US citizens should somehow not be afforded to non-citizens, or citizens who choose to use a particular software program?
The Supreme Court said that people have a reasonable expectation of privacy while using the phone, and that therefore the 4th Amendment applied. Part of the reason people had that expectation was that Congress had introduced much stronger regulation of telephone circuits in 1934 so it wasn't like just anybody was allowed to tap into utility lines.
However the only protection is the expectation of privacy, which Congress can take away by saying "you should not expect communications to be private in these situations". And that's exactly what they did in 1968 in response to those Supreme Court decisions.
One important provision of that law were that the President was allowed to take "such measures as he deems necessary:"
to protect the nation against actual or potential attack or other hostile acts of a foreign power, to obtain foreign intelligence information deemed essential to the security of the United States or to protect national security information against foreign intelligence activities.
EMails have less expectation of privacy, though Congress did try with ECPA (which was passed when POP was the way to obtain email, not IMAP). But even ECPA gives broad exceptions for FISA surveillance.
I wonder how well we would take it if we discovered that in addition to the NSA, Gmail was also sending all communications directly to Joe Blow in Podunk, Indiana, for his personal edification and entertainment? After all, it's not like we had any expectation of privacy for our email. What laws would this violate?
If he's not a Google employee it would probably violate ECPA, but ECPA explicitly allows foreign intelligence surveillance to occur (even over the Internet), so that wouldn't help against government surveillance being done in accordance with FISA.
My point, which admittedly I'm still not making clearly, is that it's weird to consider phone calls to be some sort of judicial fluke that was far outside accepted 4th Amendment jurisprudence. Americans didn't want the government listening in on their phone calls. Since we clearly couldn't elect a government that would abstain from that noxious practice, it was a good thing the third branch stepped in for a time to stop it. Maybe sometime in the future we'll be that fortunate again.
If one is uncomfortable with the Joe Blow example, consider how much worse it is for the government to be reading all of Gmail than it would be for Joe Blow to be doing that.
* All searches & seizures will be reasonable and
* All warrants will be particular and based on probable cause.
Read an introduction to criminal law to verify that these are independent protections. The latter was intended as an antidote to the British "General Warrant", a transferable warrant that gave officials the right to toss any house in the empire.
Warrantless searches of various kinds have been been a constant throughout the history of the US. Electronic surveillance of US citizens began in the mid-1800s, when the US tapped telegraph lines prior to (and during) the civil war.
edit: That was odd downvotes. Anyone care to explain?
AES-256 takes 2^256 guesses to break by brute force and by using Grover's quantum algorithm that's only improved to 2^128. It is something, but I can bet that AES-256 will at some point become insufficient due to Moore's law, not due to quantum computing - a theory that has originated in the 1980-1981 and that has yet to yield actual machines that we can use. And of course, Moore's law also works in our favour, since with more power and specialized chips, we'll be able to use bigger keys that aren't likely to be breakable by Moore's law or Quantum computing in the next century or even millennium.
As long as we cannot reduce NP problems to P, then virtually unbreakable cryptography is possible. Also, cryptography as a (mathematical) field is pretty new.
Uhm – classical computer science originated sometime in the early 19th century (possibly earlier) in the form of analytical engines and the first actually usable machines[0] were created just a bit before World War II. General relativity originated before WWI and was first used well after WW II. Quantum mechanics was invented at the beginning of the last century and the first usable LASERs were built in the 1960s.
Really, 30 years is not that long in the context of ‘hard’ science. Even in the ‘fast-moving’[1] field of software engineering, people still use SMTP (1982), TCP/IP (1975) and FTP (1971).
[0] ‘Usable’ in the same sense that QC are not usable yet because people can perfectly factor 15 without Shor’s algorithm.
[1] Because it’s young and hence easy to discover new stuff.
I'm not saying that it won't happen eventually. I'm only saying that Moore's law is a more imminent threat to current encryption methods and that quantum computing still doesn't solve NP and as long as NP is not P, unbreakable encryption is a reality that quantum computing won't change.
But, unfortunately, looking at the absolute pushback from congress and the white house over this whole thing, it's pretty clear the citizens have absolutely 0 say in the matter. After all, we're just ignorant sheep. They're the ones will all the knowledge and we should just trust them. We're not going to be able to change the NSA's policies or magically make everyone follow the constitution and the law to the T overnight. This is a compromise on our end.
The NSA may have a large amount of resources for storing and running attacks on my emails, but they don't have limitless resources. For every hour they spend bruteforcing my keys to recover a sappy "Just thinking of you <3" to my wife, the less time they're spending bruteforcing someone else's emails.
So how about simply ignoring all that. Think of vampires; they can't get in without your permission, and sunlight kills them real fucking quick, so quick you will doubt they ever existed. Sure they can be dangerous, but their main tools are lies, and foolishness of their victims.
As Assange pointed out, censorship betrays fear. These people have nothing but a huge house of cards. Even if they ruled forever, they have nothing inside; they are a clenched fist around nothing, around a bluff, around fear. So they already lost anything humans can loose, they already went the way of the dinosaur, at "best" they can take us all with them.
They have my pity, and those who are still able to get out I wish the best, but the rest should simply learn to know their place already.
Regards, a deluded narcissist, writing from the fortress of his mind, unimpressed by noob stuff such as death.
IMO, best bet is to keep it all encrypted. It sounds like an attempt to scare people into leaving their stuff open.
This is just a scare tactic to get people to not use encryption, but it's also dimwitted because they could get a lot more mileage by saying "we can break all forms of encryption" and the American public would probably believe it (even with Snowden/a vocal minority calling out the NSA on the lie). The media would most likely propagate the lie because they don't seem to care about the rights/freedom of the people in the US more than creating a scare frenzy.
In summation, the NSA are liars and will keep your data regardless, so encrypt everything, don't put anything sensitive on Google, Skype, Dropbox (you'd have to be really stupid to do this anyway), and call your senator.
And we all know that the FISA court is infallible, the great Wizard ("pay no attention to the man behind the curtain"), deserving of all our trust, right?
Thank you; thank you; thank you, oh wonderful, all knowing, all seeing, all wise, all powerful, wonderful FISA court watching over us and taking such good care of us!!
FISA court, I don't know who you are, where you are, what you do, or how to contact you or review your work, but I know that you are now watching over all of us.
What a new day! For 200+ years we've had the restrictive Constitution from those skeptical founding fathers and suffered under such paranoia as
"The price of liberty is eternal vigilance"
when all we needed was the wonderful Father FISA court! Why didn't the founding fathers think of this???? I can believe that Hitler, Stalin, Mao, and even Pol Pot thought of this -- why not our founding fathers?
At a secure, undisclosed location in the private chambers of the FISA court:
"Darn, why can't we keep those ink pads for our rubber stamps in stock?
Oh, well, the rest of the day is shot. Back to watching those SnapChat intercepts from Sweden!".
How can you be sure "they" are not running the exit node?
The problem here is that the destination can identify you. You, after all, are the one paying for that VM instance at that IP address within AWS. Who else would be connecting via SSH?
However, reading about what the NSA might or might not be be doing, plus the fact that GCHQ is tapping the transatlantic cables and knowing that the US and western European intelligence agencies tend to cooperate, I'm not so sure anymore. I think at this point we can assume that other countries have similar capabilities as well. Knowing that the infrastructure for this kind of attacks is in place, I think the cost is a lot lower than I would have expected a few months ago.
How many machines would Tor need to make traffic analysis tricky?
https://metrics.torproject.org/networksize.png?start=2013-03... https://metrics.torproject.org/direct-users.png?start=2013-0...
Edit: also this (pdf): http://secan-lab.uni.lu/images/stories/christian_franck/FRAN...
If you do trust the oversite, it makes sense that they keep encrypted data around since they have no easy way of knowing if its from a US person or not. Once they decrypt it and find out it is a US person, thats where you should focus. It should be as if they collected US Person data originally and should count it as collected when they actually got it, not decrypted it.
As to the argument that the NSA could count anything as encrypted. Yep, they could. See point one.
Not to mention a push for users to continually adopt stronger encryption.
I see of course that there is this movement towards webmail, and this makes things more complicated. Wouldn't it be possible to write an online version of an encryption-friendly mail client? I mean, a web service which polls your mails via POP/IMAP from any server, and where the encryption is done client side in javascript. If that doesn't exist, maybe we should write one.
The question is, how much do you want an unchecked organization with no oversight to know about you? Do you trust the NSA to know everything about you and never do anything wrong with it, 10, 15 or 20 years from now?
http://www.guardian.co.uk/world/2013/jun/17/edward-snowden-n...
My name is XXX, I am a US citizen. My address is YYY. By the rights guaranteed by the US Constitution and supported by federal courts, the contents of this email are encrypted, private, and require a valid warrant to be intercepted, stored, or accessed by the US government.
As for distinguishing random data from PGP that is very easy: PGP messages (even binary ones) have some headers that determine who the recipient is, what encryption is used, etc. See here for the format of PGP messages: https://tools.ietf.org/html/rfc4880
What you could do is to generate a public/private PGP keypair, then destroy the private key, and encrypt your /dev/urandom data using that public key.
The idea is to add by default an encrypted message to all e-mails that contain nothing useful, to make it indistinguishable from e-mails that do contain useful encrypted stuff. Is that possible? Does it make any sense?
People might say that "there are no posted attacks for privnote", but that just means the bad guys haven't told you they can crack your encryption. Since bad guys will never tell you that they can crack your encryption you must not assume lack of evidence of cracks is the same as lack of cracks.
(http://pablohoffman.com/how-privnote-really-works)
There's some stuff that is vaguely worrying about privnote.
Really, learn GPG / PGP. Help other people learn it. Fix the UI. Fix the documentation. Sign everything. Encrypt everything.
Yeah, yeah, three felonies a day. I know. But there are a third of a billion people in the US. Given a billion felonies a day (more or less), it's easy to find comfort in statistics and probability. Honestly, I've got bigger and more likely problems to worry about than getting sucked into some Kafkaesque nightmare (though, like an attack by shark or bear, it's not impossible).
No, what really concerns me is the emergence of a belief that the government is an impervious citadel, fortified against any democratic control or correction. When stuff like the spying scandal, or the crime spree on Wall Street, goes unchecked (let alone unpunished) it saps political will in general, and that leads to a social environment that really is intolerable. A tiny portion of the population resorting to encryption doesn't do anything to change that. The truly appropriate response is a political one, and one that goes well beyond the mass surveillance issue in particular. Specifically, we (the people) need to recover control of our own Congress.
The mushrooming scandal with spying fits a broader pattern of regulatory capture, adding to the constellation of toxic effects that result. But at the heart of all this corruption, there's a relatively vulnerable target. That's because the mechanics of capturing legislators rest of four key pieces: private campaign finance, closed primaries, gerrymandered districts, and the revolving door between public and private offices.
Before the apathy goes to deep, we need people to coalesce around a set of conditions for winning office. Specifically, no legislator gets past the voters if they haven't committed themselves to changes that make them exclusively beholden to the voters (i.e. open primaries, non-partisan redistricting, public election finance, and a lifetime hell-ban on going to work for the industries you once "regulated"). If someone promises to do all this, but balks once elected, throw them out systematically. Keep doing this until there is a critical mass of legislators who can push through reform that makes legislators dependent on the people alone. Not their financial backers, not their future employers, not their political parties, and not the voters they hand-pick.
Lots of folks aren't worried about the NSA at all. There's a fairly disturbing number who actually think mass surveillance a good and necessary thing. But regardless of where you are on the political spectrum, there's a good chance that something about crony capitalism bothers the daylights out of you. Different people will have different reasons for insisting on the basic "you-work-for-us-alone" condition for winning office. That's fine. As long as people will hold legislators to it, the restoration of government of, by, and for the people can happen.
But aside from this - from the sustained and forcible assertion of exclusive control over legislators - I don't see how the spying problem, or really any major problem, will resolve itself satisfactorily.
here's the rationale: if we don't have total awareness and snooping power over this guy private stuff, he must be doing secret stuff and we can't know if it's bad, therefore we have reason to believe he must be a TERRORIST(are you still using this one or have you admitted to yourself that the objective is just `total information awareness`?)
also, cannot stop LOVING that non-americans basically have no fucking rights whatsoever.
On top of it, instead of our media telling us "WAKE THE FUCK UP AND LOOK AT WHAT YOUR GOVERNMENT IS DOING!!" they are saying "Gee, where will Snowden go next lol?!?! Ohh he's in Moscow now, neat!!!!"
I think the endorphin rush people get from receiving a Facebook message on their portable distraction device outweighs the negative feelings of the government spying on every aspect of our lives. People don't know what's happening two feet away from them, much less in their government or the world (besides what big media tells them).
We're sliding fast down a slippery slope while chuckling and playing Farmville on the way down.