Announcing The Dark Mail Alliance – Founded by Silent Circle and Lavabit
silentcircle.wordpress.com
silentcircle.wordpress.com
Some suggestions:
- Locke Mail [from John Locke]
- Mill Mail [from John Stuart Mill]
- Hobbes Mail
- Liberty Mail
Well, Bruce Schneier has argued that that's what security is becoming today: feudal (https://www.schneier.com/blog/archives/2012/12/feudal_sec.ht...). If you wanted to, you could instead call most if not all currently existing email services "Hobbes mail".
[1] Liberalism in it's classic and original sense (not the skewed meaning that it somehow has gotten here in the US).
http://en.wikipedia.org/wiki/Modern_liberalism_in_the_United...
The social contract of Hobbes is not something one can opt out of, or refuse, but an explanation and justification for individual rights within an absolute monarchy. At the same time Hobbes argued that to preserve the peace was so central that the sovereign had the power, and was indeed duty bound under the social contract, to take whatever measures necessary to ensure peace - even authoritarian measures.
His ideas on social contract theory are historically important as a pre-cursor to more expansive ideas about personal freedoms, but they are extremely authoritarian by most modern standards.
I'd argue that the name should work on the assumption that it is the defacto standard, and so there is no need to distinguish between "normal mail" and "new mail". It should also contain a possessive pronoun. (Something like "YourMail", if not already taken?).
With such a name, when someone attacks the mail service it will be difficult to avoid attacking the person, as an attacker will have to attack "YourMail". Attack the person and the person will react.
Not distinguishing between normal and new will have two effects:
1) It will seem a normal thing for the uninitiated to use it.
2) In the case of an attack, it will be easier for people to say the attack is directed at themselves, since the generic name will draw people in, rather than letting them dismiss it as an exclusive club.
-SecMail (Secure Email)
-PrivMail (private/privacy email)
-FMail (freedom email)
-NetMail (New Internet standard email)
And thank you for taking this on, it is seriously needed. And please, no reliance on CA certs, chances are the NSA has compromised at least some of those.
I would go with something like 'sealed mail' and imply the imagery of how in the olden days mail was sealed with a wax stamp. A strong visual analogy can be very powerful.
What I am implying is that it seems like a localized term and people elsewhere might have no connotation(?) to it. In German the word means a curl of hair.
He was a British philosopher from the 1600s, an important Enlightenment thinker.
He was very progressive for his time, and so he's one of the "icons" of classical liberalism, but he died in 1704, and we've moved on a tad from then.
Consider that for example Mill thought despotism could be acceptable under utilitarian principles if the end result was a better society afterwards; I don't know what you think of Marx [Marx Mail? Maybe not], but even an authoritarian reading of Marx ideological works fits within utilitarian principles to those who agree with it, while those who read Marx from a libertarian viewpoint, e.g. left communists, would generally find Mills distastefully authoritarian.
Locke was a major investor in the slave trade, and a central participant in trying to institute a feudal aristocracy in Carolina - writing about freedoms while trying to deprive others of them. Locke Mail in that respect would be fitting brand for a NSA run mail service for its hypocrisy alone.
Hobbes, while talking about individual rights, was a supporter of a strong central government an a supporter of absolute monarchy. He too would be a suitable beacon for the NSA.
That is not to say that these people were not important for the development of philosophical ideas related to freedom, but only in relation to the politics of the time. Today all three of them are archaic and authoritarian compared to a lot of more recent philosophers.
As for Liberty Mail, outside of the US at least it would be likely to leave a bad taste with a lot of people. It reads like Far-Right-Wing-US-Nationalistic-Nutjob-Mail or Lets-Pretend-It-Is-Liberty-While-We-Screw-You-Over-Mail to me, and I know a lot of people likely to have similar reactions.
My point from the above is that names do matter.
But anyway, I'm starting to get the feeling this issue is taking too much attention from the protocol itself, which is the big news here. If they want to change it, great, if not that's fine, too. They just need to make sure the protocol is great, and can get other big e-mail providers to support it, or at least a ton of smaller ones.
There was a talk show on the radio yesterday about Tor, the illegal trade of drugs and other bad things on the Internet. They referred to it as "The dark web".
Otherwise they were just wrong.
That being said, caring that the name might 'sound negative' seems ridiculous. Anyone who wants to rely on a form of secure communication wouldn't base their judgement solely on a name and ignore the context like who founded it. People who are willing to make those snap judgements aren't interested in the service.
The future of security depends on having everyone use it, including those who don't currently (realize they should) care.
1. I'd give the alliance a generic name that won't come off as threatening or malevolent when used out of context in news articles. Make it boring to talk about the alliance so it can operate larger and and with less scrutiny.
2. If you really really want to politicize the products, launch several regionally branded services, that can use the same architectural design, but leverage the cultural mores of individual freedom for those areas. What catches on in Germany may not be what sells in Spain/Italy/Greece today, for example.
However,
The "FMail" suggestion, or something similarly benign, is a strong choice, in that it diminishes the effect of partisan rhetoric and allows the tool to be sold on its actual merits.
3. Then you can gin up radical "Free the email!" action groups to run around and be obnoxious for you, take the heat and phoenix themselves into new groups every so often.
This name also appeals to ego. Ego matters. Talking about freedom and ideals will appeal to a minority, but you need a name that appeals to people's ego if you want to succeed.
This is not the same but is related to the ideas that Seth Godin expoused in his TED talk about being remarkable. Nobody likes receiving email, but they like receiving MeMail. Me. Me. Me. Me. I want my email to be about me. If it is not, it is noise and tedium. Never underestimate an appeal to ego.
There are many challenges, but if they can pull it off there are many benefits as well. And perhaps the nicest part is that it is hard to actively oppose such efforts without revealing an intent.
And GMail won't update to 3.0 in any meaningful way, no matter what, since they want to be able to mine the data in your email, so they will still be storing it on their servers "in the clear." Which means the next time NSA hacks their servers, they'll still be able to read all the email.
Best case is that email 3.0 will interoperate with 1.0, or GMail at least accepts 3.0, if only to unencrypt it on their servers. Short of that, it would take a compelling use case to convince people to leave GMail, so we'd be right back to where we are with email 2.0: No critical mass of adoption, meaning 98% of the email you receive and write is unencrypted.
As for connecting them. I could handle just being able to communicate with my security conscious friends on this platform. That might make it a niche play early on but so was email.
I recall that in 1979 exactly nobody in my family (except me) had a network email account (on USC-ECLC no less) and they didn't care. What my family had worked for them and it was just sillyness on my part to think that email added anything to the mix.
What mattered though was that enough people had email accounts that they could get more done, more efficiently, than people without email. Every year that converted more and more people to the idea that email was something they should have, by 1999 everyone thought they should have one even if they weren't sure why.
I see similar thinks with a reconstructed email system that is free from surveillance. People being able to joke about things or discuss things and not find themselves unable to board a flight because they joked about something the TSA considered suspicious. You and I may not have had that experience yet but folks have, and it is getting more common not less common. We just had a law enforcement officer drive up and shoot a kid dead because he was carrying a toy gun. He thought the gun might be real. I say that "Clubs in NYC are the bomb!" I don't want someone detaining me for four hours asking me what exactly I meant by that.
As few as 3 years ago I would not have considered a system like this something that "regular" people would want to use, and that would inhibit adoption and use. But now I am not so sure about that.
I agree that the 'outrage' is a minority, but it is coming from more people than it ever has before. At some point the minority is large enough to be a 'useful subset' and once it becomes self supporting I've seen otherwise "useless" products become part of everyday life. It is that change, that I wonder about here.
This. I assume Google will be very eager to adopt "3.0" simply to absorb the data and make it available to the Android/AI bots that really run the place (Larry, Sergey and other googlers are clearly just physical manifestations).
Google doesn't seem to me to be the kind of organization to fear adoption of external ideas - they just co-opt them.
Perhaps this problem can be addressed by having a plugin/add-on/extension that decrypts the mail within the browser. GMail, Yahoo, or other mail providers that don't adopt this new and secure email protocol won't get the plaintext of your message, and preferably not the metadata either.
This requires that the new protocol use a converter or proxy or something to be able to talk to the existing email infrastructure. I'm sure this idea has occurred to the Silent Circle and Lavabit guys.
I don't see how this is any different. We need new technology to solve new problems. Decentralization. Changing behavior is not easy, but sometimes necessary. Everything else being proposed seems half-assed (for lack of a better word) and easily circumventable by a resourceful adversary.
As long as Google (or whomever) holds all the cards and has a lot to lose by not complying to threat of force (for ex. shareholders and stock prices), then we won't get anywhere.
The contents. You can secure that with pgp etc. today, and gmail can do nothing about it, and there a browser plugin that "hides" the mess would be workable.
The metadata. Here gmail etc. is a problem. The best we can do are remailers that anonmize the sender. In the case of e.g. Gmail, the recipient at Gmail will obviously still be in plain text, but we can obscure the sender by encrypting forwarding information and setting the To: field to a remailer. A plugin could handle that too.
Of course any such plugins would either need the cooperation of the webmail providers (yeah, right) or would need to deal with breaking whenever they change their UI.
Corps "need" to have an overview of the messages unsecured. There is no such thing as personal privacy in the corporate world, only corporate privacy.
Cypherpunks archive-96.02.29-96.03.06: List of reliable remailers
List of reliable remailers Anonymous Remail Service (nobody@vegas.gateway.com) Sun, 3 Mar 199609:18:03-0500
( Messages sorted by: [date][ threa4][ subject][ author] ( Next message: Adam Shostack: "Re: NYT on Crypto Bills" ( Previous message: Raph Levien: "List of reliable remailers" ( Next in thread: Black Unicorn: "Re: your mail"
Thought that this was worth reposting:
>1 attended last weeks "Information, National Policies; and International >Infrastructure" Symposium at Harvard Law School, organized by the Global >Information Infrastructure Commission, the Kennedy School and the >Institute for Information Technology Law & Policy of Harvard Law School.
>During the presentation by Paul Strassmann, National Defense University >and William Marlow, Science Applications International Corporation, >entitled 'Anonymous Remailers as Risk-Free International Infoterrorists" >the questions was raised from audience (Professor Chaarles Nesson, >Harvard LAw School) - in a rather extended debate - whether the CIA and >similar government agencies are involved in running anonymous remailers >as this would be a perfect target to scan possibly illegal messages.
>Both presenters explicitly acknowledged that a number of anonymous >remailers in the US are run by government agencies scanning traffic. >Marlow said that the government runs at least a dozen remailers and that >the most popular remailers in France and Germany are run by the >respective government agencies in these countries In addition they >mentioned that the NSA has successfully developed Systems to break >encrypted messages below 1000 bit of key length and strongly suggested >to use at least 1024 bit keys. They said that they themselves use 1024 >bit keys.
>J ask Marlos afterwards if these comments were off or on record, he >paused then said that he can be quoted.
>So I thought I pass that on. ft seems interesting enough, don 't you > think?
>Best
> Viktor Mayer-Schoenberger >Information Law Project >Austrian Institute for Legal Policy
Groundfog@alpha.c2.org
( Next message: Adam Shostack: "Re: NYT on Crypto Bills" ( Previous message: Raph Levien: "List of reliable remailers" ( Next in thread: Black Unicorn: "Re: your mail"
I of 1 05.09.96 01:58
It's a bit late for the HN thread now, but how about MFM protocol, but pronounced as "My Mail" just as RTFM is sometimes pronounced as "Read The Manual."
To Euro-English speakers, 'git' is a rather coarse pejorative term for a person:
http://www.etymonline.com/index.php?term=git
It's fairly vulgar, of a similar coarseness to calling someone a 'stupid fucker' in US terms.
The in-joke being that Mr Torvalds chose the name specifically to cause offense.
It would be great if the recipient could specify the amount of proof of work required for example. Or ask for a certain amount of bitcoin in exchange for accepting promotional material. Or a mail attribute that indicates it's a newsletter. Lots of interesting possibilities.
I disagree. Different problems sometimes require mutually exclusive solutions.
In fact, receiving lots of unsolicited mail provides some plausible deniability. So a spam free-for-all might actually be a useful part of the new network.
Which also makes it completely trivial to DDoS into oblivion. And the problem gets worse then that: the more anonymous it is, the less it's possible to stop someone from spamming.
Though I suppose you could attack this problem from the email address side: make it computationally expensive to general an email address, to make address-hopping as a spammer more difficult.
We've got very used to email's totally open mailboxes, and it seems to me that the cost may well outweigh the benefit.
Edit: Added comment about key exchange.
My point being: There is already a big market for sending secure emails. If this Dark Mail, or whatever it is called, is secure enough for a government to use then the adoption will be huge.
This probably means that it should be called something else than dark. "Normal people" don't know what encryption is, what NSA is or even why it is bad that companies like Google read and use their email. They won't know why or even that their email is insecure. They might have ssl in their Web browser showing a small lock, so they think they are already secure and don't need this "SecureMail". It is absolutely critical that the name of this thing is something that a normal person will feel that he/she needs. Something as simple as "New Email". Yes, the nerds will rage, but the nerds already knows why this is a big deal. The name does not need to cater to them. What is important is to get adoption of this new email platform. And naming it secure mail will probably not help. And having a dark alliance behind it all is the worst idea so far. Both words have negative annotations and sounds like a untrustworthy hacker group or even a terrorist organization. Needless to say, they need some serious re-branding, and fast.
So there are already working solutions for the problem. I wonder - does it really have to be created some new group of "privacy innovators [that] have [to be] partnered to lead the charge to replace email as we know it today"? A descriptive alliance to measure the adherence to a new solution may be a useful thing, but some new group to reinvent some existing solution is just political in my view.
One of the biggest issues with security-conscious systems is that people don't want to be seen as using something that only "people with something to hide" would be using.
The average American watches a show like SVU and learns that TOR is how kiddie porn is traded, not that it is how dissidents in Iran or Russia communicate with Journalists. They hear about the "darknet" and assume that that is where illegal activity goes on.
So "dark mail" gives the complete wrong connotation and basically means this is DOA unless they completely rebrand.
It should be named the Private Mail Protocol, or something. If it stands up to scrutiny, as soon as there is a nice looking e-mail client for it, I'll start using it, and try to use Gmail as little as possible, or not at all. I know Google won't adopt it, so I won't even bother to ask them to adopt it. I'll just switch.
Lots of large businesses would probably like something like this (the ones that buy rsa keyfobs and use VPNs). My old company would strongly discourage email from the company system to non company email address for security reasons.
(I dont use my personal GPG key for any work related or firstname.lastname@company.tld mail, but have a separate GPG key – who's passphrase is in a sealed envelope in the company safe so it can be made available to the company if required without needing to reveal my personal private key. If I'm hit by a bus, or if lawyers/law-enforcemet come knocking on company business - they can have the keys to the encrypted mail in my company account. Mail encrypted to _me_ at nickname@company.tld or me@mydomain.tld is useless if I'm hit by a bus, and would require lawyers/leo/courts to convince me to reveal a passphrase stored only in my head if they wanted it. (Or, you know, for the NSA to rootkit any of my devices I type my personal passphrase into…))
A quick search shows SecureMail and PrivateMail are commercially used, but LockedMail and SignedMail aren't.
I don't think it'd be too late to (eventually?) do a rebrand/cobrand for the product, especially if someone comes up w/ something particularly good. I think something that even a slight bit of spitballing would turn up something much better.
Some thoughts on naming:
* If the first word ends in e like securemail/privatemail you actually get email in the word
* something that could be shortened like email, but will connote secure sending - "send me that via pmail/smail"
* something that has familiar connotations of privacy/sealed delivery (registered mail?) or something might work as well
the Mail Isolation Control and Tracking program, in which Postal Service computers photograph the exterior of every piece of paper mail that is processed in the United States
Now, the electronic part is a given. But what about the courier part? Here's what Wikipedia says:
> Couriers are distinguished from ordinary mail services by features such as speed, security, tracking, signature, specialization and individualization of express services, and swift delivery times, which are optional for most everyday mail services. As a premium service, couriers are usually more expensive than standard mail services, and their use is typically restricted to packages where one or more of these features are considered important enough to warrant the cost.
Speed, security, individualization, premium? Those all sound like adjectives that I like!
Let's do the L'Académie française a solid. Let's adopt Courriel and apply the label only to our fast, secure, individualized, premium electronic communiques.
You receive a message via XMPP that an email is waiting for you on the cloud storage (similar to MMS). This is also a good solution for the spam problem, I think.
They have a working prototype, a whitepaper is forthcoming and the community is welcome to improve the new standard.
[Enter your e-mail] "
Remember what happened with "Anarchist's cookbook" and recipes for thermite and such that used to be readily available on the net, and relatively uncontroversial. It was just "information" after all. These days it seems knowing how to do some basic chemistry is considered intent to do harm or something.
The current e-mail protocols are far too centralized, which doesn't make sense. Mail is delivered, and after that, it is no longer in possession of USPS. This is unlike how E-mail works (even though it kind of seems like that's what happens).
I hope to see some kind of client being required to run on my computer to decrypt e-mails at rest and receive e-mails that are delivered to me from the central server.
Requiring very strong encryption may help make spam email computationally infeasible.
That alone might be worth it!
started at min 30 or so
Once that's known, is it really such a stretch to assume that an already complicit PRISM partner might be convinced/coerced to monitor downloads of crypto-capablea app from their respective app-stores, and provide or allow backdoors to their OS that leak private keys?
Maybe that's being overly paranoid, but in the "post Snowden" era, it might just be a sensible and pragmatic view…
AFAIK Apple is close to best in class when it comes to handling secure information (keys, pins etc) -- even if they're not perfect.
If I held a top security clearance in a country the US was interested in, or was a politician, diplomat, drug-dealer, or Occupy Movement organiser - I wouldn't be happy using a modern smart phone.
As a "nobody", I doubt the NSA would burn those resources on monitoring me.
On the other hand, I wouldn't be _too_ surprised to find the NSA take special interest in anybody who's downloaded a PGP/GPG app from the App Store or Google Play - and if I worked for the NSA I'd certainly have entertained the idea of working out how to subvert iOS/Android to expose private keys and passphrases using privileged vendor-provided OS access.
And I doubt I'm anything like as smart/creative/evil as the best people working at the NSA…
(And Apple definitely talk best-in-class talk about secure data handling, but there are some interesting questions about how your old passwords/iMessages/keys re-appear on a new iOS device when you replace them…)
S/MIME doesn't use PGP keys, it uses X509 certificates. You can quite easily deploy multiple certificates, one for each communication partner or channel.
So for example your mail sent to / from your iPhone would be encrypted with one cert, whereas from your desktop for Super Secret Stuff you'd use another.
Since 'retroshare' hasn't taken the world by storm, maybe that wheel needs to be reinvented.
Of course, if you want to talk about "taken the world by storm" as in "Microsoft Windows 95": You're right, no encryption software has ever taken the world by storm. And that has to do with the fact that the general public doesn't care about privacy, b/c they have no clue how it works and most of all what the mid- and long-term consequences of losing privacy will be for their lives.
I love the idea of bitmessage, but this issue is a major problem.
The concept of the POW is to stop spam, as all addresses are inevitably public, it doesn't really work though, as spammers typically have access to botnets which can spam all day long. Normal users just have to wait minutes to send a message.
The scale issue is a weird one, they plan to split the network into different "streams" with different address types, which just sort of muddles the entire setup. Ultimately the limit is how much CPU and bandwidth the network can survive with while mirroring the entire content of the entire network.
There's lots of problems with timing attacks that have been "resolved" with random sleeps, though nobody is really convinced of that too much.
Your other points are good, but this one is wrong. Bitmessage is currently bundled with a client because that makes adoption easier, but ultimately, Bitmessage is first and foremost a protocol. POW increases the cost of flooding attacks on the network. Clients like Thunderbird (it was easier for me to integrate Bitmessage with Thunderbird than my regular email provider) stop spam.
The scaling is a rather hard problem, since, for anonymity, "everyone gets everything." If you have any ideas about how to scale a network like that, OR have any comparable methods for hindering traffic analysis, you should publicize them.
The timing attack mitigation via sleeps /is/ a rather ineffective substitute for constant-time decryption.
In summary:
1. POW is a non-issue, and part of the design at least the way you've put it.
2. Scaling is inevitable given the tradeoffs being made, unless you have a better idea, for which I will pay money
3. Timing attacks are a temporary problem, but they can certainly be "flushed out."
Having a standard is certainly a necessity. I definitely see secure email starting as a niche and if the user experience is at least as good as gmail I don't see any reason why a new email system would not take over.
It's not going to happen overnight but there definitely is a need for it. Lavabit and Silent Circle are proofs that this need is real.
There are major issues with replacing the current email:
1) there is no good open source email interface (if I'm wrong, please point me to this gem). Roundcube is good but not good enough when you come from gmail. I don't know of anything better than roundcube.
2) the threshold for a company to implement secure email is too high. Having a secure standard with secure libraries certainly lower that threshold
3) the current open source mails are GPL like licenses. This sucks for companies and individuals. Give them the ability to do what they want, including money. Replacing email is not going to happen without investment. Technology investments are mainly done by companies, only exceptionally by individuals.
Anyway, if anyone wants to take a shot as implementing an easy to use & opinionated (ie standardisation vs customization) webmail, chime in: https://github.com/nherment/dolphyn
(edit: form & typos)
The problem is manufactured and the solution is missing the point.
1. get a new website, terrible design even from a 1995 point of view it is bad. Drop shadows on tag-lines are tacky. Not that tech people care, but if you want to take over the world. Try starting by having a decent designer on your team.
2. the only way to "truely" fix this for good is to not use email. instead, use a different form of communication (im thinking of...)
3. work with a few "enterprise companies" 4. get some capital 5. lastly, email is really still on 1.0, there was really no 2.0... unless you consider the time before the internet as 1.0 when the government used internal mail. But as we know mail today technically its still 1.0
https://www.youtube.com/watch?v=IgV_Z6V_llk
I guess I wasn't actually there in person to witness it so I can't confirm he wasn't one of those Tupac holograms[1].
https://silentcircle.com/web/scimp-protocol/
I thought we didn't want to use the NIST curves (like ECC-384?) anymore... seems something like Curve25519 might be better.
http://silentcircle.wordpress.com/2013/10/17/this-one-goes-t...
The second is their approach. Overcoming the install base of current email, no matter how much better your new offering, is practically impossible. So instead secure layers on top of existing email is your only feasible option.