Protecting IM From Big Brother

holden writes "Ian Goldberg, leading security researcher, professor at the University of Waterloo, and co-creator of the Off-the-Record Messaging (OTR) protocol recently gave a talk on protecting your IM conversations. He discusses OTR and its importance in today's world of warrant-less wire tapping. OTR users benefit from being able to have truly private conversations over IM by using encryption to obtain authentication, deniability, and perfect forward secrecy, while working within their existing IM infrastructure. With the recent NSA wiretapping activities and increasing Big Brother presence, security and OTR are increasingly important. An avi of the talk is available by http as well as by bittorrent and a bunch of other formats."

Comments

Encryption

[nurb432]

Its time to implement encryption of ALL traffic from ALL applications. Perhaps even IPC encryption incase you have some sort of 'tap' installed on your computer.

Sure, it eats resources, but do you want others reading your information? I dont. Not even when its "we are out of milk, please pick some up on the way home", as its NONE OF THEIR BUSINESS.

Re:Encryption

[rainman_bc]

Check out SiMP-Lite

It's a fantastic product, I just wish it was multi-platform... Really nice for Windows though...

Re:Encryption

[Anonymous Coward]

Honey, is that you? We are out of milk, please pick some up on the way home.

Re:Encryption

[shikadi]

It's not just about encryption, it's about privacy too. Do you want instant messaging to be used as evidence against you in the future? The reason it is called OTR is because it really is off the record. Recording of conversations is not evidence that a conversation ever occurred, since it purposely lets anyone forge messages after the conversation is over. If the person you were talking to decides to record everything you say to them, it doesn't matter, since you can easily show that what you said could have been forged. In fact, tools are created specifically for this purpose.

Re:Encryption

[jmcnaught]

I regularly use OTR in Pidgin with MSN and Jabber (Gmail chat) and have never had a problem. Adium X on the Mac also includes OTR support out of the box.

I try to use OTR as much as possible, all of the time. I figure if I only protect the stuff that needs to be secret, it sticks out like a sore thumb. And the more encrypted traffic on the internet in general, the harder it is for them to break it all even if they do have magic quantum computers.

Trying to get more people to use PGP/GPG with me over email for the same reasons, but it's a little harder to understand and get started so I'm not making as much progress.

Re:Encryption

[QuantumG]

Blah, that's a load of shit. It's an academic answer to how to fix the problem of people logging your conversation with them.

When the log is presented in court the person who logged it will be asked "is this log an accurate representation of the conversation you had with the accused?" and they say "yes, it is" and the defense then has to show not that it is possible that the log was doctored but that person who has just sworn, under penalty of perjury, is lying. They typically do this by showing instances in the past where the person has submitted false evidence to a court, or they can try to show that the person has something to gain by changing the log and that they had the skills (if any special skills are required, which they wouldn't be). It would be a very tough sell and a jury is more likely to believe that the log is accurate because what kind of idiot would lie in court when the punishment is so severe.

Consider that email is so trivial to fake and yet emails are considered official correspondence in many many many court cases. It's not about the technology, it's about the people making the claims.

Re:Encryption

[thegrassyknowl]

The beauty of OTR messaging is that it claims to guarantee perfect forward secrecy. In other words, if you lose control of your private keys no previous conversation is compromised. This is a big plus, because even if they force you to turn over the keys they can't see the previous conversations.

It works (as I understand) by using your key pair to derive and exchange public session keys. The session keys then are used to do actual encryption and are changed frequently. The private key at each end is only ever stored in RAM and is discarded when the session ends or after a timeout.

It's neat because even listening in to the whole session and obtaining the public session keys isn't enough to compromise the session. Of course, having the public keys and obtaining the master private key may go a long way to helping with a mathematical attack of the algorithm.

Re:Encryption

[Kadin2048]

Encrypting by default still doesn't prove the *log* is legit and only prevents a 3rd party from secretly watching along the way, so i don't see me encrypting everything effecting that. Huh? OTR is specifically designed not to prove that the log is legit. It goes to a lot of work, actually, to ensure that there's a trivial way to fake messages after the fact, just not when a conversation is occurring.

That means that when you're having a chat with someone, you know that what they're saying to you is their actual words, but that the same cryptography that's giving you privacy can't (theoretically) be used to hang you later, by proving absolutely that you said certain things.

OTR's logs are designed to be easily forgeable. This is a major difference in its design from many corporate IM clients (e.g. Sametime), which offer encryption but also create authoritative logs that can be referred back to later.

The point of OTR Messaging is to allow you to have the equivalent of a face-to-face, "off the record" conversation, in the digital, computer-mediated world. Just like when you have an in-person conversation, there's nothing stopping the other person from walking back to their car and blabbing about the whole thing to anyone who'll listen, the encryption itself tries to not serve as authentication after the fact as to what was said.

Re:Encryption

[xiphoris]

Email isn't trivial to fake in such a way that it would stand up to any kind of scrutiny whatsoever. Already there are simple authentication protocols that are becoming widespread enough to secure the average user. If the receiving domain has any kind of proper configuration, it will be able to validate whether a mail was sent properly using one of SPF records, PTR, DomainKeys, or any reputation system.

Try to fake an email that looks like it authentically came from Amazon.com to a Yahoo account -- even from the perspective of a naive user, you can't do it.

To a user smart enough to examine mail headers, no forged email is good enough to stand up to any inspection. It is an incorrect rumor that email is easy to forge. Certainly if the issue came up in court, an expert witness would lay the question of whether it was forged to rest by examining the mail headers. Any decent MTA can do the same automatically.

Re:Encryption

[QuantumG]

The typical email trail presented in a court case is completely intra-domain.

Ya know, "the boss sent me an email saying we should fire all workers who had signed the latest union agreement".

Encrypted RAM and HDD Storage

[EmagGeek]

You can't have perfect secrecy unless your RAM contents are also encrypted. Wasn't there some case recently where the RAM contents of some server were subpoenaed in a court case? If your RAM is unencrypted, then your IM conversation is stored in plain text SOMEWHERE, even if it is encrypted on the network stack. Of course, having encrypted RAM would be a HUMONGOUS performance hit, but it could be done. Hmmm..

Off to the patent office I go..

Re:Encrypted RAM and HDD Storage

[Cracked Pottery]

Fine, let me get those chips out for you. Bring the back after you get the information off of them.

Re:Encrypted RAM and HDD Storage

[uofitorn]

Exactly. But you can take steps to limit the lifetime of sensitive data in memory.

See Shredding Your Garbage: Reducing Data Lifetime Through Secure Deallocation http://www.stanford.edu/~blp/papers/shredding.pdf

Re:Encrypted RAM and HDD Storage

[EmagGeek]

Well, the idea of encrypting RAM would be obvious to the person skilled in the state of the art, and therefore on its face not patentable. However, there are invariable many novel ways to solve obvious problems that would be patentable. Whether or not I could obtain a patent on the method and apparatus would depend upon the novelty of said method and apparatus.

Encryption is only part of the solution

[compumike]

This is a good step, and I wish that more people would use encrypted messaging systems. This includes IM, e-mail, and voice.

However, while encryption can protect against "big brother", you can never eliminate the risk from the other end of the line. What happens if the person you are talking to has a rootkit, or prints out the conversation, or otherwise compromises the data? There's no real way to protect your entire conversation.

--
Educational microcontroller kits for the digital generation -- great gift!

Re:Deniability may sound fine

[99BottlesOfBeerInMyF]

"I do not recall." If it's good enough for the administration to use and get away with, it's good enough for me.

Unless you're in the administration, that will get you tossed in jail. Normal citizens require plausible deniability. For hard drive encryption, this can be accomplished by saving dummy data accessible with a second password. For IM, perhaps we need something similar. If an IM client were to give a user the option of using a dummy password which would still initiate encrypted messages, but with a warning flag to the user on the other end, we might have parity.

Encryption technologies that provide plausible deniability are possible, but I doubt they will enter widespread use (or even encryption in general) until the big players champion them. Why one of the major IM providers has not jumped on this as a differentiating feature is beyond me. I guess I see why Google would not include it in GTalk, seeing as they want to use the data to target ads (ditto yahoo and MS), but why isn't it built into ichat yet?

Re:Ok

[sethawoolley]

d41d8cd98f00b204e9800998ecf8427e

The real problem is U.S. government corruption.

[Futurepower(R)]

Quote: "With the recent NSA wiretapping activities and increasing Big Brother presence, security and OTR are increasingly important."

The real problem is U.S. government corruption. See this example from Cooperative Research, a complete 911 Timeline of 3962 events: U.S. Government corruption TimeLines.

The government should serve the people, not spy on them.

1984

[dotancohen]

I find it fitting that someone named Goldberg is warning us about Big Brother.

Re:1984

[saibot834]

The person you are talking about was actually Emmanuel Goldstein

Pfft. Don't talk to me, I log all my IM sessions

[NotQuiteReal]

They are sitting in plain text on my HDD.

Anyone who is IM'ing with super-secret encoding and hoping that they are safe better not be IM'ing me, or someone like me who checks the "log" button...

Sorry, sometimes I like to refer back to them, and that is the way they are kept. I am too lazy to do anything about it.

I always assume I am just part of the noise in the s/n ratio that "they" are listening to.

What's the opposite of tin-foil hat?

Re:Pfft. Don't talk to me, I log all my IM session

[the_brobdingnagian]

I log all my IM messages too. But you can not prove those messages are written by some specific person. They are plaintext and everyone can edit them. The "problem" with most encryption protocols is signing. If I write a message to you and I sign it, you can prove I wrote it. OTR provides encryption and authentication that can't be used to prove to anyone else you wrote it. I suggest you watch the video for more information.

how to boil a frog

[CranberryKing]

Isn't EVERYONE very upset that we need these types of applications these days? Why does it seem reasonable that EVERYONE needs to hide their communications from their own governments? Shouldn't we be more upset that things have gotten so out of hand?

Re:how to boil a frog

[b1scuit]

Dude, move, you're blocking the TV.

HR 1955

[CranberryKing]

If this bill passes, you won't be able to use OTR without being carted off. Call your senator and tell them to vote NO.

Re:HR 1955

[iminplaya]

`The Congress finds the following: ...

The Internet has aided in facilitating violent radicalization, ideologically based violence, and the homegrown terrorism process in the United States by providing access to broad and constant streams of terrorist-related propaganda to United States citizens.

Uuuh huh.

Software freedom gets you software you can trust.

[jbn-o]

Except that it's completely untrustworthy because it's non-free software. If a major feature of the software is that you can trust it to keep your secrets or protect your privacy, you should be able to trust that it's only going to do what you want it to do. Non-free software inherently doesn't work this way, so none of it is useful for encryption. This program disallows modification, so if you discover that it doesn't do what you want you have no permission to make it do what you want. Forget about helping your community by distributing improved versions of the program: distribution is only allowed gratis and if one distributes the software they distributed to you in its original (software) packaging.

The license for the program is so over-the-top in its restriction it's laughable. It claims to prohibit talking about the software (section 3.a.iv). Users are prohibited from any translation or localization of the software as well (section 3.a.i), so if the interface isn't in your language you're out of luck.

The solution is simple: use only free software, relish your software freedom, help your community by distributing free software, and encrypt your communications to your heart's content. This way only your limitations keep you from fully understanding what your computer is doing with your data and you can draw on the talents of other trustworthy people to help you whenever you need their assistance.

Hmm

[ILongForDarkness]

Nice how a Canadian researcher is looking into solutions to a mostly US problem, at least it is always US media talking about wiretaps. Perhaps if ~21% of the US budget wasn't blown on the military and God knows how much more on espionage, everyone wouldn't have to be as paranoid. My solution: if big brother gets the brillant idea to tap innocent people for no reason, big brother should invest in a gun and blow his brains out.

Nearly all ssh clients have built-in SSH proxy

[blumpy]

Putty and openssh clients can act as a SOCKS proxy server.

Simply ssh to your machine at home... direct Pidgin / GAIM / MSN (or any SOCKS capable app) to use your new local proxy server and your traffic is hidden from corporate big brother.

Once traffic leaves your machine to the internet, it's goes out unencrypted as usual... only useful to not let the boss know you've got to pick up milk on the way home.

Also, careful this doesn't hide DNS traffic.

Re:https://mail.google.com/mail/

[Jason Pollock]

Jabber is only encrypted on the wire, not end to end. Google can read and archive the conversation. However, using this, or other plugins, it's encrypted from your machine to the destination, man-in-the-middle attacks are prevented.

For a reason why, google "hushmail subpoena"

Re:Here's My Big Question

[SagSaw]

I want the government watching you just in case you're one of the bad guys. I'll gladly give up a bit of my own privacy to make sure they don't have any.

Here's the thing: "Bad guys" are rare. As a result, the majority of people the government would end up watching are "good guys". Let's say that 1 in 100 users being watched is a "bad guy", and the government gets the "good guy/bad buy" decision right 99% of the time. That implies that about 1 "good guy" is incorrectly labeled a "bad guy" for every "bad guy" correctly labeled a "bad guy". I'd rather minimize the information the government might use to incorrectly label me a "bad guy", even if it means increasing the very slight risk that one of the "bad guys" will hurt me or someone I care about.

Or, in Franklin's words: "Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety."

Why does it use a separate keyring?

[Grendel Drago]

I have four sets of keys on my machine--keys for SSH, for PGP, for WASTE and for OTR. Why does every app using encryption insist on using its own wrappers for public keys? What's wrong with the infrastructure already present in the OpenPGP standards?