Slashdot Mirror
SSL Encryption Coming To The Pirate Bay
An anonymous reader writes "The Pirate Bay, in response to Sweden's new wiretapping law, will start offering SSL encryption to its user base this week. Although copyright issues really have little to do with national security, The Pirate Bay knows its population is uneasy with the recent legal change. The encryption will mostly benefit Swedish users living under the current law. Since The Pirate Bay and its servers are not hosted in Sweden, the additional security offered to outside users could be comparatively minimal."
Won't that slow things down quite a lot?
-1 not first post
While this particular instance doesn't concern me, it seems that, more and more, we're seeing reasons to start encrypting most data that we send across the Internet--certainly we would encrypt IMAP/POP3 sessions, Jabber and whatnot--why not HTTP as well?
Yes, there might be some performance drawbacks, but, on the whole, it seems to me like the less data we send in plaintext, the less we open ourselves up to identity theft, and being spied on by governments (not necessarily our own, mind you).
So I tend to think that this is just a manifestation of this broader trend towards encryption in all Internet transactions. I think the real question is whether we'll see people using SSL/TLS for things like checking the weather or sports scores.
Don't like the law? Open source the government.
Lets hope this is just the beginning.
*everything* should be encrypted by default, and no unencrypted connections should be offered.
I don't care that i'm doing nothing wrong, its no ones business.
ya, there is a performance hit, but thats just part of the deal to have your communications remain private.
---- Booth was a patriot ----
Since they are publicly announcing they are using SSL to circumvent a law as its primary goal, can they be held personally liable?
---- Booth was a patriot ----
Can someone please explain why SSL would offer minimal security? Won't this twart the RIAA and MPAA if the client is in the US? Why not?
" Although copyright issues really have little to do with national security... "
Try telling that to the US Gov't.
Government's idea of a balanced budget: take money from the right pocket to balance...oh who am I kidding?
Now duh. You spy on me, I counter with encryption. No, really? Who would have thought?
Now, let's assume for a moment that those laws are actually enacted to counter terrorism, as they allegedly are. Now, we see how companies and organisations act who are (allegedly) no target for those laws, and behold, they can very easily avoid being affected by the laws.
Question for 500: Are terrorists affected?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
well if sweden wants to intercept the connections it can still do man in the middle attacks on connections going out of sweden as they ought to control the gateways... instead of fighting aftermaths citizens should go out on the street and let their voices be heard, the only way to achieve freedom this is....
Why would they implement it this week? The new law in Sweden doesn't apply until jan 2009...
Suddenly thinking of everyone else who want encryption to TPB around the world?
The Cake is a LIE!
Vivin Suresh Paliath
http://vivin.net
I like
Sweden is probably one of the last countries in western world to introduce such a wiretapping law. Other countries are probably not as public about it though.
Think USA, UK, Australia and New Zealand which all members of the Echelon "community" of surveillance. France, Germany, Norway and others also have similar massive internet wiretapping in place.
Regardless where you live, you'll probably want SSL for whatever you do. How many actually uses PGP for their e-mails?
Version: GnuPG v1.4.7 (GNU/Linux)
hIwDupFG1SObtBMBBACAyUZAEDruQO9RlkZ5aGkGYRxv2oxqKdTgg0Glo1ZJk/nF
YS2HUhpzP7r3sVjTQ5h4RDRxUKOGllrFappta3kOfVU7KAS6HSrhmZ3IRU0VJvQP
LTusUO8cVjmon4YB44sMeUksLB/g7Ylm3LuF9abAd8yXH4lNn1OzgExAVtTbf8kf
IS4qtvlxiltgtqYqGw1N8JbFREuKrfyepkKshNxV3w==
=+MLj
-----END PGP MESSAGE-----
I've been thinking about this. Gmail provides a https interface, but i've seen people just type in gmail.com and be done with it (the session then uses http)
So my idea of a firefox plugin would be one that automatically tries for a 'https' version of any site (or lookup a list for it) and move to that if it exists.
http://dilemma.gulecha.org - My philospohical short film.
That's a good news.
I hate some jerk likes to sniff in LAN.
If you start encrypting all your traffic then will the govenments just have any data the cannot decrypt directed to /dev/null instead of letting pass through.
Undetectable Steganography? Yep, there's an app fo
As more and more wiretapping laws and eavesdropping systems come on line, the more and more the technology movers will make it impossible.
Every last thing is going to be encrypted, IM, web, email, etc. The more of this crap they pull, the more they will be unable to do. If they break the encryption, we'll make it better.
So, they get SSL on their site. That doesn't do anything to hide the fact that you were visiting The Pirate Bay, only what you did when there.
Depending on the circumstances, that visit might be enough probable cause for "further investigation", even if you just hit their front page.
There is also an excellent TECHNICAL reason to encrypt the tracker connections with SSL/TLS:
If the tracker uses TLS, Sandvine doesn't work; it uses a deep-packet-inspection on your tracker requests to pull the IPs so that it knows which of your connections are going to torrent peers, so that it can throttle encrypted TCP connections to that IP/port combo.
If it can't read the IP/port combos in advance, the throttling as currently implemented will not work.
There's no reason to not host websites on https: now. Servers are fast enough, crypto is cheap enough, it's perfectly doable and it's probably high time encryption became easier and more ubiquitous...
You have hit the nail on the head that envelopes are not secure, yet they do succeed in making it much harder for the government to scan all of the mail sent in envelopes for keywords.
This actually means that it's relatively easy to gain security for your email which is analogous to that of putting mail in an envelope, and in a one-sided fashion (the recipient does not need to do anything special). Merely send the important data in an encrypted attachment, with the key "encoded" in the plaintext of the email (obscure the key in a way similar to how Slashdot sometimes obscures email addresses, but not in an automatic fashion).
Example:
This is of course totally insecure against a person trying to read your email, but would defend your mail from automatic scanning. Exactly what a postal envelope does!Whereas most of seasonal users have moved to private torrent sites, it is better late than never for those casual downloaders who still havent heard of private sites!
can anyone explain to me how a web site adding SSL support to their web site is news? This is 2008, SSL has been around at least since the early 1990's... Not sure how this is breaking news...
NEWSFLASH: ASDJAJSDA.COM HAS ADDED SSL SUPPORT!!!!
Sounds a little retarded if you ask me...
So, when will slashdot be offering SSL encryption? Most of us don't post anything that anyone would want to snoop on, but better safe than sorry.
You could already use Tor to surf on the torrent search engine and for the traffic between your bt client and the tracker. Tor is quite slow, but traffic doesn't need high speed.
But as it is p2p, the client know the ip address of others to exchange data...
You are denying the RIAA, the MPAA, and Metallica the right to see if you have infringing content, (I.E. lyrics, movie plots, bad reviews). This is in violation of the CANSPY Act of 2009, allowing anyone to see anything they want, if they pay Congress. Please proceed to the nearest prison.
You will be baked, and there will be cake.
The man-in-the-middle attacks are prevented in SSL through certificates that are guaranteed by the signature authorities (which are blindly trusted by the applications).
Now there's no telling if the cooperating international intelligence agencies can persuade a few reputable signature authorities to underwrite forged certificates that make it possible to eavesdrop on all traffic between you and the server. They'll need to commandeer a router as well, maybe at your ISP or at some predictable international network boundary.
I have a question about this part of the article: "The Pirate Bay and its servers are not hosted in Sweden, the additional security offered to outside users could be comparatively minimal." As not being a techy savvy person, why would the "additional security" be less secure to "outside users", with "outside users" I suppose the article refers to users outside of Sweden? Thanks for your answer.
That's bullshit. They could have made the actual crypto pluggable. Simply have a header that tells what kind of crypto it is, approve a new crypto standard every now and then and filter out packets that are crypted using algorithms that have been cracked at the clients, servers and routers.
Good, so now we can go Tor -> SSL -> TPB
Torproject.org
And so full of new insights that I've never heard before!
I encrypt not for the fear of doing what I do, but for the fear of getting CAUGHT doing what I do. More power to the people - encrypt and be FREE !! Down with tyranny !! Down with USA !! Down with your wife !! (and she's loving every monsterous inch of it) !!
If the average windows user uses PGP, it does provide a decent level of privacy, however it's not absolutely private because the pseudo random number generators are predictable, and this includes Linux.
The problem will be finding random numbers, and using PGP properly, and most probably wont do either of these things.
But it's still better than nothing.
And it's these sorts of people who reduce security, privacy, and liberty for the rest of us.
Wouldn't the internet be a better place of these individuals never came online?
If TCP/IP had been encrypted from the beginning, we'd be worse off, not better.
Why? Because any crypto available from that time is trivially crackable today. So instead of an obviously insecure communications medium, you'd have an insecure communications medium that everyone thinks is secure because, hey, it's encrypted! It wouldn't change anything except make people more complacent.
If TCP/IP had been encrypted from the beginning, we'd be worse off, not better.
Why? Because any crypto available from that time is trivially crackable today. So instead of an obviously insecure communications medium, you'd have an insecure communications medium that everyone thinks is secure because, hey, it's encrypted! It wouldn't change anything except make people more complacent.
Crypto today is still crackable because the majority of people who use crypto aren't using it properly. Most of the crypto is purely software crypto which is easier to crack by default simply because the key is stored on the harddrive, secondly pseudo random number generators aren't random and these can be cracked to determine what the keys will be for all systems.PGP and GNUPG is a good idea, but it will never be implemented on a mass scale and the only people who will know how to use it properly will probably be it's inventors, and hackers and other bright folks, but not the sorts of people who need it most.
I propose we build better live CDs, and Linux needs a better pseudo random number generator.
And if you really want to be safe you have to generate your own random numbers.
If you do encryption properly it's completely unbreakable. The banks do it properly. Governments do it properly. Really smart hackers do it properly.
The majority of people just don't do it properly.
The only reason a brute force attack can work is if the numbers used to generate the key are not completely random, if the numbers are created by a true random number generator, it's impossible to crack the encryption through brute force methods.
But lets be honest, how many of us actually have or know how to make a true random number generator? And even if we could make one, it probably wouldn't be all that useful if the encryption algorithm you use is weak.
For the most part the algorithm you choose isn't important, the most important part is the entropy, but a weak algorithm just makes it that much easier.
The algorithm to generate the keys must be good.
And the random number generator must be true.
That and you have to know how to use the encryption after it's set up. Either way, lack of knowledge in how to use it will make it a lot less useful in practice.
Although the algorith is known to my enemies, my secret is safe as long as they don't have the key with which it is encrypted. They can get a computer to try all possible combinations though (called brute force attack).
My defence against this is to increase the key length so much that all th computers in the wolrd working together would take longer than the age of the universe to test all possible keys.
If 'the enemy' can brute-force an encryption key that is (say) 1024 bits long, I can increase the key length by any number of bits. Each aditional bit will double the length of time needed to test every single possible combination. Adding 10 bits would multiply the time by one thousand, twenty bits would make the time needed one million times longer. Another thousand bits and 'the enemy' can forget about it: the universe is not going to exist long enough for them to crack my encrypted message with brute force atacks, no matter how many computers they use.
Please note that the above only applies to cracking my encrypted message with brute force. I f 'the enemy' is willing to do it they might get a better resutl grabbing me and putting a gun to my head. Or they might try some other method at cracking the encryption.
If they crack your number generator then they can figure out which keys will be created by your GNUPG, they'll have a complete list of all the possible keys GNUPG can create, and they'll just go down the list trying each one until it matches your key, and thats how they'll crack your encryption.This is what happened with SSL, this is what happened with the pseudo random number generator in windows.
The input (including random numbers) becomes the output and if you simply input a very recognizable pattern to generate all your keys, all your keys will maintain that very recognizable pattern, and so will your cipher text.
When they cant afford to make big expensive movies they will have to make cheaper movies that use cheaper elements to entertain, old fashioned things like 'engaging plot' and 'interesting characters'. the internet will be responsible for a cinema renaissance.
And like a previous poster said, movies are suddenly only worth what people are willing to pay for them.
nobody give s a fuck what you do with your property,. its when you think you have a right to carry out mass redistribution of it to undermine the person who created it than anyone with a brain cell realises you are just being an ass.
Stop trying to justify your own desire to keep your wallet shut.
give it up, i read that as if in pure english.
I know full well that tobacco is bad for you, so I smoke weed with crack
1. Strong cert (RSA, 2048 bits), make sure it's also self-signed, and a subsidiary cert that is not issued by a US or SE exposed MNC. Each should sign the other. Put both in well known places, and have well known places to look for the revocation.
2. Throw away the Apache mod_ssl default SSLCipherSuite which is worse than useless. Use:
SSLCipherSuite "HIGH:MEDIUM"
and consider forcing EDH/ADH, which the line above enables but does not require from the client.
Ephemeral Diffie-Hellman has the main advantage that if ever the cert is forced open, the sessions protected ephemerally cannot be forced. Without ephemeral session key negotiation, a baddie can just record all the crypto text, and once the key is forced (rubber-hose, insider job...) the baddie can trivially get all the plaintext from the recorded sessions.
EDH/ADH is a bit CPU intensive, but the tradeoff is that AES-128 (and even AES-256) is generally faster than any of the weaker (DES based) modes.
Out-of-the-box use of SSL sadly just wastes actual power doing more computations that provide little extra security for a determined, well-funded attacker.
They should call what they are doing TLS, to avoid any confusion about support for weaknesses in SSLv3 or even any support at all for the (long obselete, and no longer secure) SSLv2.
3. Finally, they should also have someone on their sysadmin team get current with the IETF TLS wg mailing list which discussed some of these issues recently, and which is full of talented people who are able to offer useful advice on being secure against real attackers.
There are weaknesses in the Linux random number generator, some of the ideas you talk about would be smart to implement in Ubuntu but so far Ubuntu seems to be giving up on secuity in exchange for ease of use.
Honestly, this should be the main focus of desktop security in linux, the strength and efficiency of the random number generator. I think using the soundcard combined with the webcam would be good enough to stop the majority of criminal organizations from cracking your key.
Linux needs to also better intergrate biometric and smartcard security mechanisms into the OS so that it's literally a plug and play affair.
I want GNUPG to automatically recognize my smartcard or biometric interface. Even voice recognition providers better security than passwords, why don't we use that?
Passwords need to be phased out of linux altogerher and replaced with mouse gestures, voice recognition, face recognition, fingerprint scanning, and vein scanning.
When you use passwords you make it easy for crackers, and when those new GPUs from Nvidia come out it's going to let them crack a strong password in a matter of hours.
Because most people store their keyring under password protection, really to steal someones private key you just have to crack an 8 character password most of the time, and usually it's not a very strong password.
What this means is PGP gives the average user a few hours of privacy, to a few days, to a few weeks, depending on the limited strength of their password.
A smartcard combined with biometrics would solve all of this. Ubuntu should support this, but if not, maybe Redhat or Suse should.