Slashdot Mirror
SSL Encryption Coming To The Pirate Bay
An anonymous reader writes "The Pirate Bay, in response to Sweden's new wiretapping law, will start offering SSL encryption to its user base this week. Although copyright issues really have little to do with national security, The Pirate Bay knows its population is uneasy with the recent legal change. The encryption will mostly benefit Swedish users living under the current law. Since The Pirate Bay and its servers are not hosted in Sweden, the additional security offered to outside users could be comparatively minimal."
Won't that slow things down quite a lot?
-1 not first post
While this particular instance doesn't concern me, it seems that, more and more, we're seeing reasons to start encrypting most data that we send across the Internet--certainly we would encrypt IMAP/POP3 sessions, Jabber and whatnot--why not HTTP as well?
Yes, there might be some performance drawbacks, but, on the whole, it seems to me like the less data we send in plaintext, the less we open ourselves up to identity theft, and being spied on by governments (not necessarily our own, mind you).
So I tend to think that this is just a manifestation of this broader trend towards encryption in all Internet transactions. I think the real question is whether we'll see people using SSL/TLS for things like checking the weather or sports scores.
Don't like the law? Open source the government.
Lets hope this is just the beginning.
*everything* should be encrypted by default, and no unencrypted connections should be offered.
I don't care that i'm doing nothing wrong, its no ones business.
ya, there is a performance hit, but thats just part of the deal to have your communications remain private.
---- Booth was a patriot ----
Since they are publicly announcing they are using SSL to circumvent a law as its primary goal, can they be held personally liable?
---- Booth was a patriot ----
" Although copyright issues really have little to do with national security... "
Try telling that to the US Gov't.
Government's idea of a balanced budget: take money from the right pocket to balance...oh who am I kidding?
The SSL encryption would presumably only be between you and the Pirate Bay web server\tracker. This would prevent the RIAA from seeing what you download from them (20kB .torrent files, tracker data while seeding\leeching), but the actual files you swap via the bittorrent protocol are not further secured by this.
There are encyption options for that too, but what the Pirate Bay folks are announcing here does not affect how you communicate with other peers (Which, presumably, is what the *AAs are busting you for)
Now duh. You spy on me, I counter with encryption. No, really? Who would have thought?
Now, let's assume for a moment that those laws are actually enacted to counter terrorism, as they allegedly are. Now, we see how companies and organisations act who are (allegedly) no target for those laws, and behold, they can very easily avoid being affected by the laws.
Question for 500: Are terrorists affected?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Because this lot can still connect to the tracker and read off the IP addresses of other people in the swarm.
Why would they implement it this week? The new law in Sweden doesn't apply until jan 2009...
Suddenly thinking of everyone else who want encryption to TPB around the world?
The question was not concerning what the *AA can or cannot do, but rather how the SSL encryption put in place by the Pirate Bay folks would constitute a "minimal" security increase for users not in sweden.
My post was intended to explain just how this added SSL encryption would help you, the scurvy sea dog, protect yourself against eavesdropping agents of different sorts, and more importantly how it would not.
If you read it again a few times before mouthing off, you'll see that I never said the *AA is looking at your HTTP data, but rather that they (hopefully) base their litigations and such on what you share with your peers in the swarm (the allegedly illegal stuff).
It would, however, not be a far cry to assume that the US government in one way or another (Say, NSA?) is looking at what you do, and as far as I understand, they get payed to look for pirates as well (Who buys your laws?) as "terrorists" and the like. SSL encryption of TPB web servers would mean that they can see whom you are talking to (The Pirate Bay) but not what you are talking about.
Sweden is probably one of the last countries in western world to introduce such a wiretapping law. Other countries are probably not as public about it though.
Think USA, UK, Australia and New Zealand which all members of the Echelon "community" of surveillance. France, Germany, Norway and others also have similar massive internet wiretapping in place.
Regardless where you live, you'll probably want SSL for whatever you do. How many actually uses PGP for their e-mails?
Version: GnuPG v1.4.7 (GNU/Linux)
hIwDupFG1SObtBMBBACAyUZAEDruQO9RlkZ5aGkGYRxv2oxqKdTgg0Glo1ZJk/nF
YS2HUhpzP7r3sVjTQ5h4RDRxUKOGllrFappta3kOfVU7KAS6HSrhmZ3IRU0VJvQP
LTusUO8cVjmon4YB44sMeUksLB/g7Ylm3LuF9abAd8yXH4lNn1OzgExAVtTbf8kf
IS4qtvlxiltgtqYqGw1N8JbFREuKrfyepkKshNxV3w==
=+MLj
-----END PGP MESSAGE-----
I've been thinking about this. Gmail provides a https interface, but i've seen people just type in gmail.com and be done with it (the session then uses http)
So my idea of a firefox plugin would be one that automatically tries for a 'https' version of any site (or lookup a list for it) and move to that if it exists.
http://dilemma.gulecha.org - My philospohical short film.
If you start encrypting all your traffic then will the govenments just have any data the cannot decrypt directed to /dev/null instead of letting pass through.
Undetectable Steganography? Yep, there's an app fo
As more and more wiretapping laws and eavesdropping systems come on line, the more and more the technology movers will make it impossible.
Every last thing is going to be encrypted, IM, web, email, etc. The more of this crap they pull, the more they will be unable to do. If they break the encryption, we'll make it better.
So, they get SSL on their site. That doesn't do anything to hide the fact that you were visiting The Pirate Bay, only what you did when there.
Depending on the circumstances, that visit might be enough probable cause for "further investigation", even if you just hit their front page.
You have hit the nail on the head that envelopes are not secure, yet they do succeed in making it much harder for the government to scan all of the mail sent in envelopes for keywords.
This actually means that it's relatively easy to gain security for your email which is analogous to that of putting mail in an envelope, and in a one-sided fashion (the recipient does not need to do anything special). Merely send the important data in an encrypted attachment, with the key "encoded" in the plaintext of the email (obscure the key in a way similar to how Slashdot sometimes obscures email addresses, but not in an automatic fashion).
Example:
This is of course totally insecure against a person trying to read your email, but would defend your mail from automatic scanning. Exactly what a postal envelope does!Whereas most of seasonal users have moved to private torrent sites, it is better late than never for those casual downloaders who still havent heard of private sites!
So, when will slashdot be offering SSL encryption? Most of us don't post anything that anyone would want to snoop on, but better safe than sorry.
You are denying the RIAA, the MPAA, and Metallica the right to see if you have infringing content, (I.E. lyrics, movie plots, bad reviews). This is in violation of the CANSPY Act of 2009, allowing anyone to see anything they want, if they pay Congress. Please proceed to the nearest prison.
You will be baked, and there will be cake.
I have a question about this part of the article: "The Pirate Bay and its servers are not hosted in Sweden, the additional security offered to outside users could be comparatively minimal." As not being a techy savvy person, why would the "additional security" be less secure to "outside users", with "outside users" I suppose the article refers to users outside of Sweden? Thanks for your answer.
That's bullshit. They could have made the actual crypto pluggable. Simply have a header that tells what kind of crypto it is, approve a new crypto standard every now and then and filter out packets that are crypted using algorithms that have been cracked at the clients, servers and routers.
I encrypt not for the fear of doing what I do, but for the fear of getting CAUGHT doing what I do. More power to the people - encrypt and be FREE !! Down with tyranny !! Down with USA !! Down with your wife !! (and she's loving every monsterous inch of it) !!
If the average windows user uses PGP, it does provide a decent level of privacy, however it's not absolutely private because the pseudo random number generators are predictable, and this includes Linux.
The problem will be finding random numbers, and using PGP properly, and most probably wont do either of these things.
But it's still better than nothing.
And it's these sorts of people who reduce security, privacy, and liberty for the rest of us.
Wouldn't the internet be a better place of these individuals never came online?
If TCP/IP had been encrypted from the beginning, we'd be worse off, not better.
Why? Because any crypto available from that time is trivially crackable today. So instead of an obviously insecure communications medium, you'd have an insecure communications medium that everyone thinks is secure because, hey, it's encrypted! It wouldn't change anything except make people more complacent.
If TCP/IP had been encrypted from the beginning, we'd be worse off, not better.
Why? Because any crypto available from that time is trivially crackable today. So instead of an obviously insecure communications medium, you'd have an insecure communications medium that everyone thinks is secure because, hey, it's encrypted! It wouldn't change anything except make people more complacent.
Crypto today is still crackable because the majority of people who use crypto aren't using it properly. Most of the crypto is purely software crypto which is easier to crack by default simply because the key is stored on the harddrive, secondly pseudo random number generators aren't random and these can be cracked to determine what the keys will be for all systems.PGP and GNUPG is a good idea, but it will never be implemented on a mass scale and the only people who will know how to use it properly will probably be it's inventors, and hackers and other bright folks, but not the sorts of people who need it most.
I propose we build better live CDs, and Linux needs a better pseudo random number generator.
And if you really want to be safe you have to generate your own random numbers.
If you do encryption properly it's completely unbreakable. The banks do it properly. Governments do it properly. Really smart hackers do it properly.
The majority of people just don't do it properly.
The only reason a brute force attack can work is if the numbers used to generate the key are not completely random, if the numbers are created by a true random number generator, it's impossible to crack the encryption through brute force methods.
But lets be honest, how many of us actually have or know how to make a true random number generator? And even if we could make one, it probably wouldn't be all that useful if the encryption algorithm you use is weak.
For the most part the algorithm you choose isn't important, the most important part is the entropy, but a weak algorithm just makes it that much easier.
The algorithm to generate the keys must be good.
And the random number generator must be true.
That and you have to know how to use the encryption after it's set up. Either way, lack of knowledge in how to use it will make it a lot less useful in practice.
Although the algorith is known to my enemies, my secret is safe as long as they don't have the key with which it is encrypted. They can get a computer to try all possible combinations though (called brute force attack).
My defence against this is to increase the key length so much that all th computers in the wolrd working together would take longer than the age of the universe to test all possible keys.
If 'the enemy' can brute-force an encryption key that is (say) 1024 bits long, I can increase the key length by any number of bits. Each aditional bit will double the length of time needed to test every single possible combination. Adding 10 bits would multiply the time by one thousand, twenty bits would make the time needed one million times longer. Another thousand bits and 'the enemy' can forget about it: the universe is not going to exist long enough for them to crack my encrypted message with brute force atacks, no matter how many computers they use.
Please note that the above only applies to cracking my encrypted message with brute force. I f 'the enemy' is willing to do it they might get a better resutl grabbing me and putting a gun to my head. Or they might try some other method at cracking the encryption.
If they crack your number generator then they can figure out which keys will be created by your GNUPG, they'll have a complete list of all the possible keys GNUPG can create, and they'll just go down the list trying each one until it matches your key, and thats how they'll crack your encryption.This is what happened with SSL, this is what happened with the pseudo random number generator in windows.
The input (including random numbers) becomes the output and if you simply input a very recognizable pattern to generate all your keys, all your keys will maintain that very recognizable pattern, and so will your cipher text.
When they cant afford to make big expensive movies they will have to make cheaper movies that use cheaper elements to entertain, old fashioned things like 'engaging plot' and 'interesting characters'. the internet will be responsible for a cinema renaissance.
And like a previous poster said, movies are suddenly only worth what people are willing to pay for them.
give it up, i read that as if in pure english.
I know full well that tobacco is bad for you, so I smoke weed with crack
There are weaknesses in the Linux random number generator, some of the ideas you talk about would be smart to implement in Ubuntu but so far Ubuntu seems to be giving up on secuity in exchange for ease of use.
Honestly, this should be the main focus of desktop security in linux, the strength and efficiency of the random number generator. I think using the soundcard combined with the webcam would be good enough to stop the majority of criminal organizations from cracking your key.
Linux needs to also better intergrate biometric and smartcard security mechanisms into the OS so that it's literally a plug and play affair.
I want GNUPG to automatically recognize my smartcard or biometric interface. Even voice recognition providers better security than passwords, why don't we use that?
Passwords need to be phased out of linux altogerher and replaced with mouse gestures, voice recognition, face recognition, fingerprint scanning, and vein scanning.
When you use passwords you make it easy for crackers, and when those new GPUs from Nvidia come out it's going to let them crack a strong password in a matter of hours.
Because most people store their keyring under password protection, really to steal someones private key you just have to crack an 8 character password most of the time, and usually it's not a very strong password.
What this means is PGP gives the average user a few hours of privacy, to a few days, to a few weeks, depending on the limited strength of their password.
A smartcard combined with biometrics would solve all of this. Ubuntu should support this, but if not, maybe Redhat or Suse should.