A Skype Equivalent Without "Big Brother"?

Slimy Devil asks: "News.com has recently reported on the FBI seeking veto power over PC software. This makes me wonder: is there a safe, provably secure VOIP-like technology out there? The recent buyout of Skype probably means that the supposed encryption will be of little value, if you are of the opinion that the FBI or other law enforcement agencies shouldn't be able to tap in on demand. So, for my question to the Slashdot community: is there a viable alternative that is free of such concerns?"

Comments

There used to be...

[FrankBlues]

There used to be PGPhone, but development on it stalled.

if it ever gets working

[phUnBalanced]

voice over jabber. +ssl.

Re:if it ever gets working

[jrockway]

How about:

cat /dev/audio | lame | gpg --encrypt | nc my.friend 1337

Your friend can do:

nc -l -p 1337 | gpg --decrypt | mpg123

This works great... the power of UNIX at work. You don't even have to write any software yourself.

Re:if it ever gets working

[bloo9298]

Tsk. Useless use of "cat"!

Re:if it ever gets working

[NateTech]

Good lord, I've been doing Unix for a very long time and I just realized I'm completely and utterly annoyed with myself for not noticing that the "cat" in most things I use "cat" for is completely unnecessary.

I'm going to have to freak some people out at work with this. ;-)

Thanks for the link and the reminder.

Open Source

[Leroy_Brown242]

Isn't this exactly what the Open Source community is all about?

Someone contact sourceforge, someone else start coding, and someone send their SO to the store for Bawls, meth, and mountain dew!

In a week, we'll have the more spasticly coded, but free VoIP software EVAR!!

Re:Open Source

[TubeSteak]

Ummm... I get my meth from that guy in the hoodie who hangs around the gas station.

What store are you going to? And do they garauntee their product?

Re:Open Source

[alexandre]

hehe, i wish we had a p2p VoIP GPG Phone software... but alas, we dont :)

Paranoia

[$exyNerdie]

This is again a sign of government paranoia. Bad guys will use some obscure/less known software for communication while the government will spend taxpayers' money on useless monitoring of those taxpayers...

PGP Phone won't traverse NAT routers.

[Futurepower(R)]

The problem with PGP Phone is that it won't traverse NAT routers.

However, I understand that now there is other software for that. For example, Open VPN.

Any other suggestions?

Re:PGP Phone won't traverse NAT routers.

[Bob_Robertson]

OpenVPN requires one end of the tunnel to be directly addressable, so its use remains limited by that fact.

The Skype model, which seems substantially like the Gnutella network, might be one way of building such a system. Heck, why couldn't it be piggy-backed on the existing Gnutella network?

The voice client could connect to the Gnutella network with a hash of the users userID (or some such). Want to find Bob_Robertson? A request for the SHA1 hash of "Bob_Robertson" goes out, my system sees the request and responds, etc.

The only real problem is lag. I don't know how long it might be between someone trying to find me and my system finally receiving the request.

Oh well. The simple fact is that Security Is Inconvenient.

Bob-

Re:PGP Phone won't traverse NAT routers.

[LWATCDR]

Port forwarding could help with the NAT problem. You could use a jabber to send the IP and public keys and then do a connect over forwarded ports. Just an idea.

Destroying inovation in the US.

[RingDev]

Is it any wonder why technology companies are fleeing the US? Why would a company release a VOIP solution from the US when they could relocate their company to another country and export the software via the internet with out fears of government persecution from the US. Encryption, communications, stem cells, etc... The US is headed down a bad road where the only people with money are the Lawyers.

-Rick

Re:Destroying inovation in the US.

[TxRoadrunner]

Right On!! and the US Congress seems to be unwilling to do anything about the litigation problem which is seriously undermining the economy -- probably because they are mostly lawyers. Re innovation, I don't understand why a P2P operation doesn't set up offshore in a location untouchable by US Law. DRM is really getting out of hand!

Re:Destroying inovation in the US.

[RingDev]

DRM is not patent law. DRM is a nesecity to protect copy rights. I'm all for GOOD DRMs. In order to get what I would consider good DRMs, you need one of two things: 1) Unilateral agreement in all media production branchs, content providers, DVD/CD Player creators, PC Software, etc... or 2) A bohemoth monopoly that can market a single standard across all mediums with enough force to make it work.

DRMs are a device that will help drive digital content innovation. With out DRMs there are tons of pitfalls for content delivery, you either need to charge enough so that the few sales will cover the development costs($3000 graphcis application), or drop the price so low(iTunes) that piracy loses its appeal and depend on a volume of sales. But anyone in the middle ground is in a rough spot. Software/Content that is expencive enough to make pirating worth it, but not expensive enough to cover the manufacturing costs.

We just need innovation and cooperation to get an acceptable standard to the customer. Unfortunatly we are stuck with this craptastic Digital Rights Mis-management from companies like Sony.

This isn't the type of thing you can just slide in Ninja style and expect no one to notice, this is something that has to be an open standard with lots of consumer awareness. A progression over years of hardware integration and the slow but methodical replacement of current media. I would say 5 years on hardware alone, and probrably another 5 on top of that for media conversion and consumer acceptance. But after 10 years, you could have an industry standard DRM system that was just as accepted as CDs are now.

-Rick

Re:Destroying inovation in the US.

[TxRoadrunner]

Rick, I agree with your comments. Unfortunately the DRM agenda is currently steered by people and companies acting in their own interest rather than our Public Interest -- and I include in this group our elected representatives in the House and Senate who are elected poor but exit their tenure rich, really rich. I spent a lot of time in the Washington political arena (communications and media); it was pretty much understood that the Congress was for sale -- and that many special provision of law could be purchased and at surprisingly low cost. For example, the recent scandles re Jack Abramoff and Indian casinos. But even more importantly, media middlemen and trade associations acting in their own self-interest, rather than artists and end users, are driving the DRM framework. Worse there are many such as Sony who are all things: inventors, hardware manufacturers, media producers, media manufacturers, media distributers, TV and Radio owners, and ................ And with big "political persuasion" budgets. What is needed is a new and more responsible definition of "fair use" that reflects the digital revolution. What is happening now, re: fair use, is not unlike the perpetuation of their telephone monopoly by ATT for 80 years until the early 1970s. ATT used a combination of powerful political lobbying -- at every concerned Federal Agency and every State and concerned State Agency (literally thousands of lobbyist/employees) -- and technical mysticism characterized as "harmful foreign attachments". For example, a company called Hushaphone in the 1940s attemped to market a molded sponge rubber "cup" designed to fit over the telephone earpiece to minimize extraneous noise; ATT declared it to be a "harmful foreign attachment" and it was litigated at the FCC and in the courts for years. And the list could go on and on -- including the first telephone answering machine developed by Carterphone of Dallas who went bankrupt with litigation expense. I doubt that the outcome of the DRM policymaking will be in the Public Interest.

Re:Destroying inovation in the US.

[RingDev]

Best bet, get Google, Apple, and Sony together. Tell them the solution must be an open standard, source can be open/closed as the like, but it must be an open standard, it must work on all hardware (new car head units, home theaters, PCs, boom boxes), and must not get in the way of a definable list of acceptable customer activities (ie: loan to a friend). And watch what happens.

-Rick

Re:Destroying inovation in the US.

[jx100]

I disagree with your sentiment that widespread DRM would be a good thing. The rights afforded to IP are *not* natural rights. Widespread DRM would allow content makers essentially unlimited copyright. This, in the long term, would do *far* more harm than good, as content that has long since passed into the public consciousness and culture would still be directly controlled by whoever initially made it. This is a *bad thing*, and is directly against the objective of copyright.

Re:Destroying inovation in the US.

[RingDev]

I disagree with your disagreement ;) And I raise you one technical issue! Copyrights can be extended, so the owner could literally argue to unlimited copyright. The question then is how do you handle public domain, more specificly content that changes from copyrighted material to public domain. I see two clear posibilities; Option #1 is to set up the DRM to phone home to a CR/PD list and verify the rights of the consumer. This has a few major flaws, it requires internet access (not available in cars/home sterios) it also posses the risk of tracking by the list provider (ack!). Option #2 is to require the USPTO(or a new Digital Media Copy Rights Office) to maintain an online library of all public domain digital material (obviously, since current media is unDRM'd, they wouldn't have to maintain it). The obvious flaw here is the lack of current historical material and hosting costs. Historical material is easy enough to convert, but the hosting costs is something the poloticians can hammer out.

You see, this entire conversation could be copyrighted and published (technicalities a side). Even with a DRM it could be distributed, and the idea's, faults, and possibilities would get passed on. But if someone patents the idea, they could sue anyone who attempts to market a similar solution, thus stifling innovation and making a hand full of lawyers very rich. DRMs Good, Patents Good when correctly applied, Lawyers Bad.

-Rick

Re:The FBI is stupid

[gatzke]

Phone encryption devices have been illegal in the US for ages, I believe. My mexican buddy claims they used to use them down south of the border, little boxes you would strap on a phone that was coupled to a mate on the other end.

All the Fed have to do is outlaw encrypted internet traffic. How hard could that be?

If they really want you, they will get you. Few people are Tempest-proof, so they can just park a van out front and screen read whatever you do.

You have no privacy outside your home or on the internet. Always assume someone is reading your email.

Shtoom!

[gothzilla]

This site follows Skype's work with encryption.

http://www.pgpvoip.com/

Zimmerman's work with encrypting VOIP is with this client:
http://divmod.org/projects/shtoom

Forget about Skype ever being secure. It already has an encryption layer but since they've made "arrangements" with law enforcement, it cannot be assumed to give you total privacy.

If you want truly secure VOIP, follow Shtoom's progress. It's as close as it gets right now.

Calling all Americans

[Anonymous Coward]

This Big Brother shit has to stop.

Will you spineless, willfully ignorant morons take your excellent constitution and stuff it collectively up your politician's and bureaucrat's asses. You all have no right to celebrate Thanksgiving in the current political climate - when everything you purportedly hold sacred is being murdered from within. "We the People" have become "we the impotent".

You may say - "sort out your own country before criticising", You see the thing is - we have adopted major sections of US law all so we can have a "Fucked Trade Agreement". The difference is we have no recourse to affect the situation.

Re:Calling all Americans

[Stardate]

yes, it is time to break out the guns, like in cryptonomicon...

Re:Calling all Americans

[Bob_Robertson]

As if Americans have any recourse? With a 98%+ re-election rate at the Federal level, Near that at state and local levels, a very well coordinated media blackout of viable candidates that offer alternatives (such as limited government of specifically enumerated powers, imagine that! Shocking!) and most people being focused on making enough money to both live and pay their taxes, rather than on silly pointless things like "voting", and what do you get?

Bob-

Re:Calling all Americans

[oliverthered]

There's one way to help fix things, limit the number of election terms an elected official can stay in office for. That way you get new blood and people can actually vote for who they want not just a party.
Proportional represention also helps, even if the Nazi party get one seat that way because the lefties and the greens get seats too and it all balences out, just with a bit more variety then a two party system.

Re:Calling all Americans

[NateTech]

Actually another even more effective solution would be a "NONE OF THE ABOVE" ability during an election to say, "Nope... send in the next two clowns until we find someone worth voting for."

Re:Calling all Americans

[oliverthered]

You can already do that in the UK, it's called spoiling the ballot and it doesn't do anyting pratical.

Re:The FBI is stupid

[Drooling Iguana]

All the Fed have to do is outlaw encrypted internet traffic. How hard could that be?

Easy, if they don't mind stopping all internet commerce and severely impacting the bottom lines of countless companies (many of which are big enough to have considerable influence on the government.)

Speak Freely API

[mwilliamson]

There's a open source project called Speak Freely that implements strong cryptograhpy and can interface with gnupg for key exchange and authentication. The actual windows product hasn't been updated in a long time, but the linux API may be useful.

Recently the speak freely API was used as the basis of the IRLP amateur radio linking project. IRLP needs strong authentication (but not crypto) and speakfreely + gnupg provides it.

Asterisk.

[NoMoreNicksLeft]

Dunno if it does decent crypto on its own or not, but even if not... wrap the connection in a openvpn or ipsec tunnel, and be done with it. Of course, the "phone over broadband" commercial service is out of the question at that point.

What I want to know, is if we all hook up our asterisk servers together, and allow them to place local unmetered calls, could we get decent coverage of the US (or even the world) ?

Could we even allow people without computers/internet to call us locally, and route their calls around for them, for free? Would be a neat way to stick it to the phone companies.

(Even better yet, a cell phone plan that allows unlimited calls within the same service...)

Re:Asterisk.

[DrSkwid]

my ISP uses Asterisk and I can use http://www.gizmoproject.com/ to call them.

Bah, until I looked again then I thought Gizmo was OSS

None of these will work

[WindBourne]

First, you have to ask your self what capability does the NSA have for monitoring outside of the USA? After you answer that, then realize that the GWB (via his un-patriot act) gave that capability to the FBI.

From there, you next need to ask if you were the FBI, what type of data are you going to be looking for? After you answer that, then you have to realize that current stuff will not work.

Instead, a better way is to create a p2p connection using an audio stream with an embedded (regular|encrypted) phone message. This would hide the signal in the noise of all the streaming audio running around. At this time, that does not exist.

Re:None of these will work

[3waygeek]

Well, since the NSA is about 200 years ahead of the rest of the world in theoretical maths, I'd say their capabilites are significantly greater than those of the Open Source/Free Software community, unless we have some little gray men of our own to help us out.

Re:What's wrong with Big Brother

[bugg]

Yeah, because " law enforcement" never does anything to people who aren't breaking the law.

What's wrong? Everything.

[WindBourne]

the patriot act gave the DOJ to ability to monitor anything when they invoke a terrorism charge. We are not talking just Al Qaeda. they could declare that somebody is a risk to do a columbine, a mall attack, etc. and then have that as a reason for a warrent. Keep in mind, that if DOJ invokes the term terrorism with the warrent, very little evidence is required. If anything is discovered, that can be used against the victom. For all purpose, we now have the same system as the old USSR.

Everybody has every reason to fear big brother, as this will allow for anything to be used against you.

Re:The FBI is stupid

[Detritus]

Phone encryption devices have been illegal in the US for ages, I believe.

Bullshit. They are not illegal. You may not be able to use them on certain radio services, due to FCC regulations, but there is no law that prevents their use over the wireline telephone network, private data networks, or the Internet.

What the NSA has done is to discourage the use of encryption, while staying within the law. This can be by friendly persuasion or vague threats of "problems" with other government agencies. That is why American cellular carriers do not provide strong crypto on their systems.

The sad truth is that the market for commercial secure telephone hardware is very small. Most people just don't care. To make a business out of it, you have to sell to the federal government and their contractors who handle classified information. AT&T and others have tried to sell secure telephones to the general public, with disappointing results.

Re:What's wrong with Big Brother

[Anonymous Coward]

Yer kidding right? "Mostly Law Abiding", what's that? By the same logic we don't need the bill of rights, so lets get rid of them. Lets see. As long as I belong to a religion that other people don't find offensive, then who needs that right written down anywhere. As long as I don't say nasty things like "No Blood for Oil" on a bumper sticker on my car as I attend an "audience" with the President, then heck, why should I worry, no one will try to silence me. Habeus Corpus -- who needs that? If I'm in jail awating my arrainment I must be guilty, right? Governments never get big and powerful and abuse that power, do they? I've never heard of such a thing. By golly, it would be terrible if librarians were required to report what books I was reading! It could never happen in the good old "Ewe Ess of Ehhh"!

So, is Adobe hiring Americans over in Dublin? This is getting scary.

They tried it with books, they'll try it with code

[Nice2Cats]

It shouldn't surprise anybody that the FBI and the other usual suspects are out there trying to control software: They tried it -- and out side the U.S. they did it for decades, nay, centuries -- with books. America has been spared most of that because of the genius of the Consitution, but unfortunately, software wasn't on the agenda back then any more than privacy. And the Bill of Rights just ain't getting any longer.

As somebody else has posted, this will just send people packing to Europe and India. The administration's attack on sex sites has already just done that: All those companies are simply moving out. Like it or not, that is a billion-dollar industry that is taking its tax money and jobs elsewhere. Giving the FBI that kind of power will just make people leave faster -- and bring us one more step closer to being a police state.

Encryption shall set you free

[xtal]

http://www.philzimmermann.com/EN/background/index. html

Everyone should take a moment and read the story of the PGP creator. Strong crypto is the only thing that will keep people from reading your packets, and the only thing that will guarantee you have the ABILITY - forget having the right - to have privacy in your communications.

This wasn't always the case.

People listening isn't a problem. You should ASSUME they are listening. Run crypto point to point if you want to be private.

Dream On

[barryvoeten]

Here in The Netherlands (a "free" country) we have seen Intelligence Agencies getting into organisations which were political opponents of the government. Being part of the leaders of political parties. Did any of those parties do anything wrong other then just being on the wrong side?

Unless secret services are being controlled, they operate on their boundaries or just outside. But the problem is : who can control a secret organisation?

From the Dept. of "For What It's Worth"

[drgould]

Here's a page with a list of Open Source VOIP applications, both clients and servers.

PgpFone

[AdiBean]

This is exactly what PgpFone was supposed to provide. AFAIK, PgpFone was written by Phil Zimmerman, and the project was hosted at MIT. As you can see, not much happening here. However, the rights apparently went to NAI, but I don't think they currently offer the product.

I was able to find this link to pgpi.org where it looks like you can find old source and binaries for PgpFone. I don't know what the copyright status of these are.

In the face of the Patriot Act,etc, it would be great if someone started up, and modernized this project again.

Re:The FBI is stupid

[biglig2]

If you'll RTFA, you'll see that the FBI are not the source of this, but those sons of fun, the FFC. Now, maybe the DHSS leant on the FCC to claim this, but that's not confirmed.

Re:What's wrong with Big Brother

[Bob_Robertson]

The Federalists were against a Bill of Rights. Since the Constitution explicitly granted the Fed.Gov no power to establish a state religion, or prohibit arms, as a couple of examples, they argued that any "bill of rights" could not include everything, and might therefore in the future become confused, that those few rights enumerated were being "granted" to the people by that Bill, rather than pre-existing the new Constitution and being prohibited by the states (who came first) from any power of infringement by this new Fed.Gov.

That is exactly what happened. Now, anything not explicitly mentioned in the Bill of Rights is fair game for the Fed.Gov to regulate and prohibit. Even the items specifically mentioned are substantially regulated and even prohibited, laughing in the face of such explicit language as "Shall Not Be Infringed".

Bob-

O.T.

[Philip K Dickhead]

Great sig!

Re:Asterisk is a PBX not a revolution.

[NoMoreNicksLeft]

You must be a VoIP newb.

Guilty as charged.

Of course you could do this. But as everyone else has found out the infrastructure costs you money. Your high-speed internet connection incurs a monthly charge as does the local PSTN connection. Then there are the costs of your server equipment and the electricity to run it and I haven't even mentioned your labor costs to maintain it all.

You mean the broadband that I'm already paying for... not a big gamer, not a big music downloader. Except for the occassional linux iso, I don't use it so much. And of course, you mean the POTS line I already pay for, too. Oh, and the electricity I spend on a server that runs 24/7 hosting a few weird projects of mine already... and the labor to keep it running.

Seems like it wouldn't cost me any more than it already does. Like I care if my line is busy, no one calls me anyway (besides, I'd still have priority to kick them off the line if I needed to use it in a hurry).

Here's a clue, you can't "stick it to the phone companies" unless you own all of the wires between the communicating nodes.

The cell phone revolution has put a dent in it, as have other services. But in the US, long distance revenue is still a major cash earner. With local unmetered access, a free service that let's anyone make long distance calls in the US would hurt them.

ignorant slashbots again

[ednopantz]

>>the patriot act gave the DOJ to ability to monitor anything when they invoke a terrorism charge.

Except it didn't. Most of the PA just codified existing practice as Slate's four part analysis piece explains.

What parts were more radical (215) have been struck down as unconstitutional as can be seen on the EFF's (join EFF now!! the sky is falling!!) Patriot Act webpage.
One might want to notice that the PA renewal substantially weakened govt power while demanding new accountability.

Don't let the facts stop a good bout of paranoia. It is more fun to pretend that life is a black and white cyberpunk airport thriller novel than to recognize shades of gray. It makes us feel more important.

Attention slashbots: your next move is the slippery slope. In which you argue that searches approved by judges aren't bad but searches not approved are and therefore we need to freak out about about warranted searches because they might lead to unwarranted searches.

Tunneling requirements?

[Futurepower(R)]

Bob,

I don't think there is a problem with finding the other person, without using a network. Just have the other person send an email to you, and use their IP address, which is in the email header. That's what we did with free software called Dial something or something Dial, several years ago. It used software that displayed ads.

The OpenVPN home page says that OpenVPN can:

• tunnel networks whose public endpoints are dynamic such as DHCP or dial-in clients,
• tunnel networks through connection-oriented stateful firewalls without having to use explicit firewall rules,
• tunnel networks over NAT,...

I don't see any limitation about needing one end of the tunnel to be directly addressable, but that makes sense. Otherwise how would they see each other?

UltraVNC has a module called a repeater which I understand also traverses NATs.

Re:Tunneling requirements?

[Bob_Robertson]

I don't see any limitation about needing one end of the tunnel to be directly addressable, but that makes sense. Otherwise how would they see each other?

Yep. Port-forwarding does work, but then there still is a directly addressable machine accessable from the outside. As opposed to simple NAT. Someone has to open the connection, so they have to be able to reach the other system.

The reason the Gnutella system works is that stable reachable systems automatically become core nodes that NATed machines can open a connection to. Unlike Napster, it's not single/multiple controlled servers which broker the connections, which kept records later used by lawyers to prosecute traders. If it can be done with streams of data for one use, why not for another?

Bob-

CryptoPhone

[llzackll]

http://www.cryptophone.de/index.html

Not exactly VoIP, but it works over landline or GSM network, and it's actual phone to phone encryption, not just phone to tower. They have several devices/software available, and full source code.

Gizmo

[abrotman]

this may meet your needs

http://www.gizmoproject.com/

Speak Freely Links

[Futurepower(R)]

Speak Freely?

Speakfreely Speex Codec.

Old Home Page?

Current Home Page

"The actual windows product hasn't been updated in a long time..." I don't understand that. The Sourceforge page says "(2004-02-04 16:00)".

Does anyone have experience with Speak Freely?

Many of the issues mentioned don't exist now.

[Futurepower(R)]

Speak Freely End of Life Announcement posted by its original creator.

However, many of the issues mentioned don't exist now. It is possible to buy router/firewalls for as little as $3 after rebate now (did that yesterday) that can be programmed to deliver specific ports to specific computers behind a NAT.

Clearly, more developers are needed.

Front end

[snoopyjd]

Wouldn't it be easier to create a front end that would encrypt the voice stream and pass it off to any voip system. Both parties would need to be running the software, but could use any service provider.

You must be a terrorist

[nurb432]

If you dont approve of being monitored by our government you must be evil.

Therefore, if any encrypted traffic is detected from you that doesnt have the proper backdoor, you will be assumed guilty and sent directly to jail.

Note: This is sarcasm. However, i can see us heading in that direction since they cant stop every little encryption project out there. Just make its very use illegal, and they wont have to worry about finding out content.