Slashdot Mirror
Secure Communication Comes To Android
An anonymous reader writes "Forbes is reporting that Moxie Marlinspike and Stuart Anderson's startup, Whisper Systems, has released a public beta of two Android applications that provide encrypted call and SMS capabilities for your Android phone. In the wake of recent GSM attacks, it'll be interesting to see if smartphones end up providing a platform that fundamentally changes the security we can expect from mobile communication."
Just like encrypted email! Everyone uses that...
While interesting, these apps aren't that useful because the other caller would have to be using the same software for it to work which limits it to just a few people using Android with these apps.
Taxation is legalized theft, no more, no less.
However, the site claims "we will be making the source available for download and inspection shortly."
Now everybody's mom can call them to dinner without fear of being overheard by certain Three Letter Agencies.
Faster! Faster! Faster would be better!
What I would like to see is a PGP/gpg utility for Android. The closest I can get to this is cross-compiling a statically linked gpg binary for ARM and running that in a terminal.
We'll know it's at least OK if the FBI and CIA start lobbying congress to outlaw it.
We'll know it's pretty good if the NSA starts lobbying congress to outlaw it.
The government is absolutely convinced that law enforcement will come to a screeching halt if people can communicate casually without being subject to eavesdropping. This despite the courts' general distaste for such evidence (people rarely speak candidly in phone conversations regarding criminal enterprises and therefore establishing context and the meaning of codewords becomes a prosecutorial hurdle), and the paucity of successful prosecutions built primarily on the strength of intercepts.
So we've had cryptography treated as a munition. And clipper. And CALEA.
Of course, if the keys are on a server somewhere they can always just subpoena them.
it just reminds me that I really need to start speaking in Klingon more frequently.
the beta...be advised its "US Only" at this time apparently.
Good people go to bed earlier.
It's a VOIP app that encrypts the audio. Except the fact that the protocol itself is documented this is not materially different from skype which is also encrypted and has governments apparently scrambling to crack.
A truly revolutionary app would encrypt the phone's mobile call audio.
Skype provides encrypted calls and SMS for how many years now? Oh, this is from Forbes...
... these apps aren't that useful because the other caller would have to be using the same software for it to work ...
From TFA:
Looks to me like the product uses defacto-standard encrypted communication tools and integrates them with the phonebook to make their use automatic when calling a contact with whom you can have an encrypted conversation.
So it looks to me like your encrypted communications wouldn't be limited to people using the same android app. You could talk to anybody using the same underlying "standard" scheme.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
There doesn't seem to be too many details on their site yet. I am wondering if both parties establish a connection with the Whisper Systems server and make the connection that way? Is this end to end encryption? Is the key exchange end to end or with their server? I didn't think that a mobile phone could receive in incoming data connection without a special account.
If a tariff makes coal triple in cost, wind and nuclear start looking pretty okay.
And if you think that rationing and massive price increases will not put a damper on NIMBY, you're nuts.
As for the rest of your 'analysis', Watts Bar seems to count as major:
http://en.wikipedia.org/wiki/Watts_Bar_Nuclear_Generating_Station
I suppose the fact that they started it 35 years ago takes away from the fact that they brought it online 15 years ago. Never mind that attitudes have shifted enough that they are going to complete the other half in a few years.
Also, people currently spend more money driving to the damn grocery store than it costs to ship stuff thousands of miles, I wouldn't worry about getting stuff from the next state over (so, each pound of food consumes way more energy in your car than it consumes in the semi/cargo ship. For example, b-a--n-a--n-a-s are practically free at my grocer.).
And then there is the whole thing where petroleum prices over ~$120 are obviously unsustainable (We have real life experience of this, from a couple years ago. Also, much of the $10 a gallon that you are fear-mongering about would be going to the gub'mint, to subsidize other transportation options and such).
The worst thing you are doing is assuming that investors in power companies (which are generally regulated in a way that the return on investment is okay, but not great) would want to put massive amounts of capital into having a bunch of extra power generation sitting offline, rather than trying to maximize the return on the capital that they have already invested.
Nerd rage is the funniest rage.
1) Encryption = hidden writing 2) Whisper = Popular UK chocolate bar, now withdrawn 3) Whisper Systems (anag) Sweetish Mrs Spy
IBM doesn't play chess with the Universe.
I'm okay with $10 per gallon gasoline under two conditions:
As long as that money actually goes towards developing technology to bring the cost of renewable energy down, then great. But that's not what will happen. It will be used to penalize people who use energy and to give huge grants to megacorps that then use our hard-earned dollars to develop technology that only benefits themselves. And that's not cool.
Check out my sci-fi/humor trilogy at PatriotsBooks.
Also, your timescales are off, South Carolina Electric & Gas doesn't even have a license yet and they figure they can have a 1.1 GW reactor online by 2016:
http://en.wikipedia.org/wiki/Virgil_C._Summer_Nuclear_Generating_Station
(Though they have completed much of the engineering, which probably speeds things up, I'm not sure how the licensing process interacts with the engineering).
Nerd rage is the funniest rage.
It won't be secure unless the hardware, software and distribution are controlled, tracked and audited. Prove there isn't a hidden API in the RF modem that will dump RAM and the keys on command.
About time? It's pretty hard to be more wasteful than the US (X axis), which per capita claims around 3 times more resources compared to the most lean places with similar standard of living.
One that hath name thou can not otter
Since it's going out as a VOIP call, why not route it via TOR? Yes, it would likely slow down the talking a bit (great, I could finally take notes while still keeping up with the conversation), but it would make it that much more difficult to track down the caller and/or recipient. Might also work for the SMS if it's using an Internet-based route instead of the actual cell system SMS.
I hope this comment is well received... I could have moderated instead!
Persecutors will be violated!
There are several encryption programs for Nokia's Symbian phones that work over GSM, but they don't look terribly compatible even amongst one another, which has presumably stymied adoption.
These two Android apps are compatible with Zfone, which is SIP not GSM. So they should work with the commercial Zfone clients for Windows Mobile and Symbian, which covers the vast majority of smartphones outside the U.S.
I've found no Zfone port for the iPhone or BlackBerry but they're bit players outside the U.S. Maemo support has sadly not yet happened, but presumably once the MeeGo platform stabilizes.
The Christian religion has been and still is the principal enemy of moral progress in the world. -- Bertrand Russell
Encrypted voice is US only, so that's no good for the rest of the world. Also, searching for TextSecure on Market doesn't yield any results on my Android 1.5 device (although the FAQ claims it works on all versions of Android), though 2.2 is fine. Sending encrypted texts to myself didn't work either, it says "Bad encrypted message..." but that might just be me doing something wrong.
Plus we can look at the impact done by availability of Zfone/ZRTP (this new encrypted VoIP standard from Phil Zimmermann) for Symbian smartphones (half of all smartphones)
That is also the case with this application.
The secure voice communication *is* done with ZRTP.
The secure texting is done with Off-the-record (already widely used in Adium, Pidgin and the likes).
Oh, nobody was aware of its availability? Exactly...
The more these (standard) technologies are deployed, the more they will get used.
As an example, Adium is a rather popular multi-system chat software for Mac OS (based on the same libpurple of pidgin fame) has Off-the-record (the same system as used by this software for SMS), and thus Off-the-record is starting to get some usage.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
In fact, the texting part uses Off-the-record, which is available on lots of software, including libpurple-based like Pidgin (as a plugin) and Adium (out of the box).
So if you configured an account able to receive SMS (like a SIMPLE or Skype account) on these software, it already works.
And as the webOS chat module is libpurple-based it might not by that much difficult to bolt OtR on Palm Pre (some hobyist have successfully ported other libpurple plugins onto the Pre).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I'm interested in seeing how the key exchange is handled. After all, you can have a great encryption algorithm but if your implementation sucks, it won't do you any good.
For texting the implementation is Off-the-Record, which is already used in several other softwares (the libpurple-based Pidgin and Adium, for instance). The details of this are here.
Granted, the hurdle there would be things like losing the phone, getting new hardware, etc, but it's still interesting to think about.
Read OtR's website and their arguments about "Deniability" and "Perfect forward secrecy". Some of the problems are addressed in the way OtR works (as opposed to older encryption system such as pidgin-encryption).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I've been using it on my android devices since I first got a G1. Hell I even used it before then on a bog standard landline phone...
*dial number*
*ring ring*
"Hello?"
"Hi it's Chris, the Satsuma is flying without wings beyond the crust of the BIG APPLE pie."
"Got ya"
Sorted.
Nobody mentioned rob gongrijps cryptophone yet. It uses regular cellphone calls. Instead of voip. You both need to have that phone tough.