Slashdot Mirror
Is Hushmail Still Safe?
Ringo Kamens writes to ask if the use of Hushmail can still be considered a secure method of communication:
"For a long time, Hushmail was considered a very secure email provider until an affidavit (PDF) from a DEA agent in 2007 showed that they had handed over 12 CDs of possibly decrypted data to law enforcement. Now, Cryptome has posted that the Hushmail encryption program is no longer the same program for which Hushmail releases their source. Is Hushmail even safe to use anymore?"
Several kind of encryption have been inspected for years by some of the brightest minds in the field. Are you claiming that they are somehow vulnerable as well? RSA, Diffie-Hellman key exchange, 3DES, AES...
If video games influenced behavior the Pac Man generation would be eating pills and running away from their problems.
No, they don't have that capability. Please read any beginners book on crypto.
it's in my head
Agreed, it is very clear from opening the jar files that the published one has undergone obfuscation.
What came out during the earlier revelations was the company handed over email that they decrypted on their servers, but couldn't do so for the applet based encryption. They said up front that the applet was far more secure.
IIRC, Hushmail started passing out 'bad' java applets so that they could grab encryption keys.
[Fuck Beta]
o0t!
Upgrade the EFF's DES cracker to modern processors or GPU cores (whichever would be better at cracking DES), and decryption times of a few minutes would be realistically achievable. Depending on how efficient their code was (eg: could it fit entirely into L2, with data?), there may be room for improvement there. Add in superior cooling and overclocking techniques, you can probably get another 10-20% speedup. So if you really wanted, you could probably crack DES in under a minute, using off-the-shelf components. Triple DES is many orders of magnitude harder, I know of no machines currently out there that could make a serious dent in it. You'd need to find a weakness caused by how the DES algorithms interacted to mount a serious challenge using today's technology.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
From my own admittedly anecdotal experience, I'd say Hushmail is just a way to make money. Not only do they constantly bombard you with pleas to upgrade to their paid service, but they are supposed to delete your account if you don't check it every 3 weeks. But my account was deleted under this claim when it had been only 1 week since I checked it. Yes, I'm sure. Not only that, but when I tried to create an account with the same name, whenever I pressed okay I got an error message that I couldn't use that name without upgrading. After that I'd started using GPG with Gmail. Both are free.
I guess I'm old-fashioned, or just learned better because I was raised in a poor rural area, but it's better to learn how to do something yourself if it's easy anyway than to pay someone too much to do it for you.
I dream of a better world... one in which chickens can cross roads without their motives being questioned.
Nice try, but generally trivial to break. For starters, there's the always popular method of steaming envelopes open.
Of course, that's pretty easy to prevent -- for example, people who cared have used wax seals for centuries.
That's still a long ways from secure though. For example, one trick (also known for a long time) uses a thin metal rod, split along its length. You insert the rod under the end of the envelope flap, where there's no seal. You catch the letter where it's folded, with one side of the fold on each side of the split, then twist the rod to roll the letter up, and remove it back out the end. When you're finished reading it, you reverse the process to re-insert the letter into the envelope.
It's no accident that, historically, most countries' code-breaking agencies have been attached to their postal services...
The universe is a figment of its own imagination.
*chuckle*
Yep, check some of my past posts. I actually do. I got to spend a dozen or so of my formative years in such a lovely "democracy" as it was. Very easy to spot this stuff growing here. Most Americans I talk to say "it'd never happen here, we'd vote them out of office long before that."
Hah... kinda how they voted Lincoln out of office for violating his oath (regardless his views on slavery or the independence of the southern states, he violated an oath he took that had his life as remedy for violation, execution was the price of treason to that oath)... or how they voted Wilson out for taking them into the war despite having gotten elected solely on his promise to "keep us out of the war" ?
My folks came here with me and built a business from scratch, amidst "go back where you came from" idiocies and "they came to take jobs away from Americans" stupidity. Hell we all built businesses as time went on and GAVE jobs to Americans. Many of whom were proven to not deserve them. Some of whom even cost us in the price of citations for their own negligence or laziness. Finding good people was very hard. Eventually we all retired... and I can tell you it wasn't soon enough, IMHO.
Some of the stupidest people I've ever met were here. Provide them with a good job and high pay, and they make fun of your origins or slack off when you're not around. None of them think... "hey, if this foreigner goes out of business, my 17 bucks an hour are out and I go back to the regular payscale of 15 tops! and no chance at a raise!"
So yes, I reserve the right to be quite pissed looking at Americans, as some of the most materially blessed people in history, and some of the stupidest fools to ever have lived. I view the immigrants the same way. All of them were given a nation like no other, codified protection for quite a few important rights. And what do they do? They bring that nanny state shit with them from abroad, and as if they couldn't get it, raise it on a pedestal as if it was not the same damn thing they had fled from just a few years before. Mine were different, but only because they built businesses and learned that government was nobody's friend. Not even the handout seekers. It won't be too long now... one good economical crash, and one loud cry for help from the stupid ones... and down the drain it all goes... clampdown and all. Man it'll be worth watching the stupid finally get theirs, just like I'm sure the Titanic was worth watching sink.
" What luck for rulers that men do not think" - Adolf Hitler
Really, seriously? You must be uber-leet to spout off 20-year-old propaganda about how the NSA can break anything ever -- the easiest way for them to break you crypto is to convince you it's not worthwhile to do in the first place.
Now, it's possible that there is some algorithmic flaw in AES or RSA that the NSA has discovered and no one else has noticed. But neither algorithm is something that some no-name math student slapped together and got published, nor was the NSA even vaguely involved in their development, which is where many of the concerns (and FUD) about DES originated.
And I actually have studied the GPG implementations of both AES and RSA, and verified by hand that their binaries produce the same output as my calculations. I've also studied the primes and nonce selection and padding algorithms and have likewise convinced myself that they are valid. There may be other bugs in the program, but I have satisfied myself that they are not broken in any way that produces known exploits.
Do you have any specific reason to doubt the algorithmic soundness of RSA or AES, to believe that GPG doesn't have valid implementations, or to believe that the NSA or anyone else has the ability to crack either algorithm in a reasonable amount of time without a flaw in the algorithm or implementation?