SSL Encryption Coming To The Pirate Bay

An anonymous reader writes "The Pirate Bay, in response to Sweden's new wiretapping law, will start offering SSL encryption to its user base this week. Although copyright issues really have little to do with national security, The Pirate Bay knows its population is uneasy with the recent legal change. The encryption will mostly benefit Swedish users living under the current law. Since The Pirate Bay and its servers are not hosted in Sweden, the additional security offered to outside users could be comparatively minimal."

Comments

A broader lesson

[dfaulken]

While this particular instance doesn't concern me, it seems that, more and more, we're seeing reasons to start encrypting most data that we send across the Internet--certainly we would encrypt IMAP/POP3 sessions, Jabber and whatnot--why not HTTP as well?

Yes, there might be some performance drawbacks, but, on the whole, it seems to me like the less data we send in plaintext, the less we open ourselves up to identity theft, and being spied on by governments (not necessarily our own, mind you).

So I tend to think that this is just a manifestation of this broader trend towards encryption in all Internet transactions. I think the real question is whether we'll see people using SSL/TLS for things like checking the weather or sports scores.

Re:A broader lesson

[oodaloop]

It's about time. If you look at the postal system, people have been using security envelopes or at least sealed envelopes since pretty much the beginning. The only mail postal employees are allowed to read are postcards, since it's pretty hard to stop them. Unencrypted email is basically like a postcard, and it pains me to hear people complain that governments are reading them. Do they complain that postal employees are reading their postcards? If it's important or private, use a security envelope or encryption. Otherwise, don't complain when someone reads it.

Re:A broader lesson

[dfaulken]

If you look at the postal system, people have been using security envelopes or at least sealed envelopes since pretty much the beginning. This is exactly the problem, though--people are accustomed to using envelopes, whereas getting people to use e-mail encryption requires some serious additional effort, which most people aren't willing to put in.

Re:A broader lesson

[nine-times]

Yeah, it seems to me that it was an oversight that networking wasn't encrypted in the first place. When lots of these protocols were being developed, security didn't seem to be much of a consideration.

It's about time that these things got rectified, but I'm not sure what the best course is. For example, using SSL concerns me in that we've accepted the convention that certificates should be issued by certain set organizations that require exorbitant fees. I mean, hundreds or thousands of dollars per year for an SSL cert? Seems a bit much to me. Yeah, I know you can generate your own, which will cause you to get complaints from your websites' users when they see what looks to them like an error message.

I'm not a security expert, but I get the sense someone needs to go back to square one and figure out how to build a coherent, open, and secure model for networking that doesn't rely on giving such control to a small number of companies.

Re:A broader lesson

[Free the Cowards]

If TCP/IP had been encrypted from the beginning, we'd be worse off, not better.

Why? Because any crypto available from that time is trivially crackable today. So instead of an obviously insecure communications medium, you'd have an insecure communications medium that everyone thinks is secure because, hey, it's encrypted! It wouldn't change anything except make people more complacent.

Re:A broader lesson

[David Jao]

Yeah, it seems to me that it was an oversight that networking wasn't encrypted in the first place. When lots of these protocols were being developed, security didn't seem to be much of a consideration.

You may be too young to remember this, but until 1997, it was for all practical purposes illegal to transmit cryptography software over the internet because of ITAR regulations.

As a result, during the formative years of the internet when networking protocols were being designed, there was no practical way to include security as a requirement. A cynic would interpret this state of affairs as being exactly the goal that the US government had in mind when they made cryptography illegal.

Re:A broader lesson

[SirLurksAlot]

Yeah, it seems to me that it was an oversight that networking wasn't encrypted in the first place.

Correct me if I'm wrong here, but as I understand it security was outside of the scope of networking technology when it was first created. ARPANET was created in order to facilitate information sharing, and it started out quite small. Encryption at that point would've been counterproductive. Security wasn't much of a consideration because the network was connected and used by trusted nodes, namely research centers and universities.

Re:A broader lesson

[aliquis]

... if USA was the whole world.

Re:speed

[SirLurksAlot]

Possibly, but it's a trade-off. Do you want speed or do you want security? (Yes yes, I know, everyone wants their cake and wants to it too.)

About time

[nurb432]

Lets hope this is just the beginning.

*everything* should be encrypted by default, and no unencrypted connections should be offered.

I don't care that i'm doing nothing wrong, its no ones business.

ya, there is a performance hit, but thats just part of the deal to have your communications remain private.

Copyright issues != terrorism

[frdmfghtr]

" Although copyright issues really have little to do with national security... "

Try telling that to the US Gov't.

Re:speed

[Zero__Kelvin]

"Adding encryption is likely to introduce a couple more round trips"

If only I had thought to address the network connection issue somewhere. I think if I could do it all over again I would have done it in the first sentence of the first paragraph of my post.

"Adding encryption is likely to introduce a couple more round trips, which can be very noticeable, depending on the latency-sensitivity of an application and the way things are implemented."

... and in this case we know the application. It is downloading large files. The two round trips you describe represent negligible overhead in this case. Again, if only I had mentioned that. If I could do it all over again, I would choose the second sentence of the first paragraph of my post :-)

Re:speed

[Haeleth]

Better slow downloads than meeting your new Swedish boyfriend in jail.

Even better, how about paying for your movies, games, and music? That way you can download them as fast as you like, and the government won't try to put you in jail even if they spy on you doing it!

I realise this is Slashdot, where "not getting busted for copyright infringement" is apparently categorised as a "right", so I'm probably about to be modded into oblivion -- but hey, that's life, isn't it?

Re:speed

[Maxo-Texas]

I agree with your general point and agree that recent material that is still in print should be either paid for or ignored.

That being said, I torrent.

I use it for
1) Movies that I can't buy if I want to.
2) Comics that I grew up with and can't buy if I want to.
3) Anime that isn't for sale in the U.S. (This has lead to be buying anime when it does become available- like Stand Alone Complex)

And I do draw the line 28 years (the original terms before our governments sold out to disney and other companies and sold away the public domain to them). And I could get fined or go to jail for that activity. I keep that in mind, so I use peer guardian and other techniques to keep a low profile. But mainly, I stay away from new hot shit. Mostly, new hot movies you can buy for $5-$7.50 within 18 months of them coming out. Why risk prison/ fines to see a movie 18 months early? And more importantly, creators do deserve *some* compensation for creating.

Re:speed

[WeblionX]

Wait, so I can now buy HD movies online and download them as fast as my connection allows legally? I thought I had to drop a wad of cash on a new disc drive then had to either go out and buy or wait for it to ship to get the movie, then I had no option to put it on my computer (legally). This is all news to me.

Re:speed

[Anonymous Coward]

Oh, I'll pay, when they offer me what I want to buy, not what they want me to buy.

I certainly don't want to pay for drm, which I can't play in Linux without having to circumvent their stupid restrictions.

And all other x countries that does wiretapping?

[Anonymous Coward]

Sweden is probably one of the last countries in western world to introduce such a wiretapping law. Other countries are probably not as public about it though.

Think USA, UK, Australia and New Zealand which all members of the Echelon "community" of surveillance. France, Germany, Norway and others also have similar massive internet wiretapping in place.

Regardless where you live, you'll probably want SSL for whatever you do. How many actually uses PGP for their e-mails?

A firefox plugin?

[anilg]

I've been thinking about this. Gmail provides a https interface, but i've seen people just type in gmail.com and be done with it (the session then uses http)

So my idea of a firefox plugin would be one that automatically tries for a 'https' version of any site (or lookup a list for it) and move to that if it exists.

The gvmts legislating themselves out of options

[mlwmohawk]

As more and more wiretapping laws and eavesdropping systems come on line, the more and more the technology movers will make it impossible.

Every last thing is going to be encrypted, IM, web, email, etc. The more of this crap they pull, the more they will be unable to do. If they break the encryption, we'll make it better.

Re:The gvmts legislating themselves out of options

[Anonymous Coward]

Do you really believe the government won't make encryption itself illegal? Sooner or later what you say WILL happen - everything will be encrypted.

That's when the government will step in under the guise of protecting our children and defending us from terrorists. It's only a matter of time.

Re:speed

[Anonymous Coward]

...creators do deserve *some* compensation for creating.

Which is EXACTLY the point. They're product isn't *worth* anything if it isn't scarce. With digital medium nothing is scarce making it worth whatever the public is willing to pay - simple economics. What pisses me off is that media companies are allowed to force artificial scarcity. I have no sympathy and don't believe hiding their greedy little faces behind corrupt bureaucrats should be tolerated by the general public.

Better late than never....

[ArIck]

Whereas most of seasonal users have moved to private torrent sites, it is better late than never for those casual downloaders who still havent heard of private sites!

Re:speed

[mollymoo]

Don't lump the rest of us Anglos-Saxons in with the Americans. UK prisons may not the most pleasant in the West (though they are currently overcrowded), but they're a damn sight more civilised than those in the USA.

Re:speed

[Anonymous Coward]

Meanwhile, back in reality, not all of us are willing to pay exhorbitant prices to have untrusted (with reason) software installed on our systems to "buy" said shows, without any of the rights that one usually gets when "buying" something.

I would cheerfully pay a small, reasonable fee for the service of downloading a known quantity (bitrate, quality, etc). But I can't buy that now, and the problem is not the market, my friend, and I am part of the market.

And go fuck yourself for a fascist, too.

Bullshit: you could allow for upgrading crypto

[Anonymous Coward]

That's bullshit. They could have made the actual crypto pluggable. Simply have a header that tells what kind of crypto it is, approve a new crypto standard every now and then and filter out packets that are crypted using algorithms that have been cracked at the clients, servers and routers.

Re:speed

[Mista2]

Now you can have your cake, but only if you eat on approved plates using paid for proprietary knives and forks. and you may not get the same cake as someone else in another country, and it may not even be the cake you want. However you can download a good facsimile of the cake and eat it wherever you want for free.

Re:speed

[rohan972]

1) Movies that I can't buy if I want to.
Name one.

The Last Starfighter, as far as I can tell not available in region 4. If I have to commit a crime (breaking the encryption) to access it, then they aren't making it available to me to buy.

I don't think freeloading off other people's work is the answer, but I can see why people see that as better than complying with the idiocy of the movie and music industries.