Slashdot Mirror

So what are you exactly against? People using your code and improving it without giving anything back? Because that is what Google is doing. Why are you exactly against distributing modified code without source, but not against locking in that code in their own datacenters and never giving anything back? Because the end result is the same - they use the code without contributing back. In fact it's even worser, because it also locks users to their services.

I have a good example of this. I've been using Cryptoheaven as my email provider for several years. They open source their client, but not their server side code. This means you cannot actually use the code without also using them, and I've been locked to paying them because I was stupid enough to use their domains for emails while registering to all kinds of services.

In light of email leaks and similar stories in the media, I wish there was more coverage how to prevent such leaks in the first place. I recommend services that offer encrypted email services like Hushmail and CryptoHeaven. Hushmail http://www.hushmail.com/ for its browser accessible web interface and CryptoHeaven http://www.cryptoheaven.com/secure-email-hosting.htm because of the transparent encryption for email and files which anyone can use with ease.

If the guy used a good grammar and spell checker when sending out the anonymous email, all this analysis would be quite useless. I'm a long time client of CryptoHeaven http://www.cryptoheaven.com/ and I feel very confident that my emails remain fully anonymous... -henry

CryptoHeaven does exactly that... it stores your data backup offsite, all encrypted with your private keys. So no one can break in or request to surrender your files.

This Im not sure about the conficating part but i would assume that they would hve to crack it first

"Then you take one of these and put it over the border in Mexico at your friends house acroos the other side of the border. Who can press charges? Any answers anyone?"

Howabout we just put all of our hard drives in Mexico? Or Canada. Or the British West Indies.

While they don't support PGP, I have used Cryptoheaven casually for over a year and have been fairly impressed. They have a Java client for Windows, Mac, and Linux that runs on your own computer, meaning that the Cryptoheaven servers don't ever see your private key (although they offer to store your key as a convenience option if you choose). It started out as a closed system, meaning only Cryptoheaven members could contact other members, but now they have some kind of internet email gateway for plaintext messages. Anyway, they offer secure email, chat, and storage, with free and 'premium' options. The only questionable aspect is their use of the Rijndael algorithm:

"All services fully encrypted using the latest technology including an AES symmetric cipher Rijndael with 256 bit encryption keys, SHA-256 message digest function, and asymmetric encryption with keys of 2048-4096 bits in length."

With PGP being mostly used as an email plugin, and with the NAI problems I would look into alternative ways of sending encrypted email. There are a few other software which in addition to email, also handle instant messaging and file sharing in a secure mode. I would strongly recommend you try CryptoHeaven as it is relatively easy to use and provides great crypto. Its great for mail, chat and file transfers.

Could virtual keyboards like the one offered by CryptoHeaven and E-gold defend against password sniffing trojans?

Just switch to CryptoHeaven and don't worry about Trojans or other viruses. Those guys make the source code available so you can check for trojan bugs.

Get your free account at
http://www.cryptoheaven.com

Check out http://www.cryptoheaven.com they already have a file sharing system using it.

The U.S. government has standardized an AES (Advanced Encryption Standard) algorithm after four years of testing. The original encryption formula is developed by two Belgian scientists, Joan Daemen and Vincent Rijmen. Will the new standard pass the test of time? By comparison to the old standard, where government used triple DES with an effective symmetric strength of 112 bits, we are far ahead now. The 256 bit key space allows for over 1 followed by 77 zeros combinations. Several companies are already offering AES crypto toolkits and new products are emerging. For example a toolkit from Cryptix includes the new AES for some time now. Also, CryptoHeaven is already offering a data exchange platform with AES 256 bit security. Watch for more exciting new products as they are doomed to come to the computer near you!

Privacy comes at a price. You are talking about a way of creating PRIVATE communities that require authentication to join, and not OPEN community that kazaa provides. Neverless, http://www.cryptoheaven.com is a good choice.

This is an alternative, and rather much more private solution than KaZaa. However with a slightly different purpose. The difference is that it allows for creation of PRIVATE communities to exchange data, not OPEN communities. Good choice neverless.
link

Perhaps this is worth further investigation...

The user interface is written in Java, and requires a 1.3 or higher runtime installed. The Windows installer has an optional 1.3 runtime included. By virtue of the Java client-side implementation, your private key is never sent, or seen by the server unless you choose to upload it in encrypted form. If you do decide to upload your private key, thereafter you rely only on SSL, presumably, to protect the password for your encrypted private key stored remotely.

It's been awhile since I looked at Java's crypto. The 1.2 stuff was pretty lame, especially the keystore. But this implementation does at least seem to use RSA keys for Java, which means that the container may be better too.

I dunno if I'd ever advise anyone to allow their keys to be stored on the server, no matter how many reassurances they get. However, for someone who simply wishes to share private mail with someone else, it might be nice.

Things that remain unclear to me are:
1. Can encrypted mail be sent to someone who does not have an account, using a ordinary PGP public key, for example?
2. What protocol does the service use? Is it standard SMTP? (possibly with verification)
3. Where does the encryption/signing of the delivered email actually occur? Presumably always on the client. 4. The Service Agreement seems pretty, uh, tight. If you displease them in any way, all your rights, including access to your existing mail, is cutoff.

Anyone actually using this service?