Slashdot Mirror
Zimmermann's Silent Circle Now Live
e065c8515d206cb0e190 writes "Several websites have announced the launch of Silent Circle, PGP's founder Phil Zimmermann's new suite of tools for the paranoid. After a first day glitch with a late approval of their iOS app, the website seems to now accept subscriptions. Have any slashdotters subscribed? What does SilentCircle provide that previous applications didn't have?"
The "Silent Circle" uses their own "Silent Network", allowing centralized user tracking. Also, the code isn't open source, so you have no idea if the crypto key generation is any good or if there are backdoors.
shhh...
That's what we call it when a bunch of guys gather round in a circle and... you know what I mean. We never talk about it. Hence "silent" :)
"What does SilentCircle provide that previous applications didn't have?"
The 20$/*PER MONTH* price tag. You can also use csipsimple, it does secure messaging (using sips) and voice using the zrtp protocol. For 0$/*PER MONTH*.
(Captcha: investor. How fitting...)
From TFA:
The company's encryption tools offer potentially powerful capabilities for those who need to secure sensitive data. However, broader MDM and MAM capabilities currently aren't included, which means that Silent Circle could be a component in an enterprise's security policy but not a complete solution.
What do MDM and MAM stand for?
How many times will subscription approaches to crypto have to fail before people understand that it does not work? It failed with Hushmail, and it will almost certainly fail here.
Palm trees and 8
I was almost sure you were talking about the Trayvon Martin murder.
The "Silent Circle" uses their own "Silent Network", allowing centralized user tracking. Also, the code isn't open source, so you have no idea if the crypto key generation is any good or if there are backdoors.
I couldn't sign up going through my 3 proxies - the website timed out.
What?!? And let them know my IP?!?!
This could be a honey pot for the FBI or CIA or Illuminati!
Seriously though, WTF is it with the SEAL shit. Do they cover advanced cryptography after mastering small unit tactics and CQB? I have nothing but the greatest respect for Phil Zimmerman but this just smacks of crude marketing.
Using the name Zimmerman immediately after a post about Treyvon Martin was a poor choice. Perhaps "PGP Creator's Silent Cirlce is now live" would have been a better choice. I certainly didn't associate the name with PGP, I associated it with the previous article, and I'm sure others did as well.
They have the first working implementation of CONTROL's Cone of Silence.
Seriously. Make programs (like email, IM, etc.) work with a good but open encryption protocol, like gpg for example. And surely (since Skype has shown what is possible with compression) voice applications can make good use of encryption too.
But a subscription-based, proprietary solution with central servers? No thanks.
why would you mention on CIA-/. that you have subscribed to that service??
There was an unknown error in the submission.
How many times has it been tried?
I worked with Phil for awhile at StorageTek--6 months or a year I think. He's a very smart guy. He was also one of the most evangelistic people I have ever met. I do NOT mean this in a religious sense, any way shape or form. At the time (this was the 1980's) he spoke a lot (incessantly?) about the danger of nuclear war and all these bombs we've got. I expect that this same incredible focus and sense of purpose has now been applied to security, which could be a really good thing. I also expect that he has mellowed a bit, but that's just a guess.
Steve
When I saw the title, I thought it was a Google+ story. There are a lot of silent circles over there, after all.
#DeleteChrome
citation needed. should probably read "among the most stringent".
I hope I didn't brain my damage.
well, hes gotta eat too....
---- Booth was a patriot ----
I wrote to Silent Circle over a week ago when news of the impending launch first started making circles.
SC's COO was kind to respond in an attempt to allay my fears. Sadly though his answer was more "non" than one.
A week ago replied back with a follow-up question, and have yet to receive a response.
While my political activism is pretty much limited to change.org petitions, SC is directly marketing their services TO activists. As the Occupy movement has shown, political activism, and the free-speech that goes along with it, are becoming in jeopardy. My concern, and I feel it's a valid one, is that CALEA will give subscribers a false sense of security. After all when Microsoft purchased Skype, one of the first things they did (they had no choice) was to install CALEA intercepts.
Hopefully somebody at Silent Circle will be able to answer this. Until then, I wouldn't recommend it. Check out The Guardian Project and Jitsi instead.
(Note - I'm only posting this because as Silent Circle's COO, Vic Hyder is authorized to speak on behalf of the Company.)
-----BEGIN EMAIL-----
Mr. Hyder,
Thank you very much for the reply and information you've provided below, /does Silent /CALEA/jurisdiction or not/?
but I'm afraid I'm still unclear on one particular point:
Circle fall under
Kind regards,
George Ellenburg
On 10/11/12 7:43 PM, Vic Hyder wrote:
> *George*,
> Thanks for the note. Quick response - Silent Circle provides peer to
> peer encryption from subscriber to subscriber. The Secure Calling Plan
> offers members a little flexibility to use their Silent Phone number
> to send and receive calls outside the Circle (encrypted to our servers
> but decrypted from servers to non-subscriber). We'll let our members
> determine what their threat model is and how they need to protect
> their transmissions.
>
> Circle up.
> *______________*
>
> Vic Hyder
> Chief Operations Officer
>
> Silent Circle
> Private Encrypted Communications
> Silicon Valley | Washington DC
>
> w: SilentCircle.com
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you received this e-mail in error, please notify the
> sender immediately and destroy and/or delete all copies. Circle up.
>
>
>
> On Oct 11, 2012, at 6:01 AM, George Ellenburg > wrote:
>
>> Hello-
>>
>> I read with interest news reports yesterday that Silent Circle was
>> getting ready to launch. As an activist and privacy advocate, I was
>> troubled though to read that Silent Circle was planning on offering a
>> Secure Calling Plan amongst other communication services.
>>
>> I understand the obvious revenue stream such an offering will generate,
>> but I'm intrigued as to how you plan to not comply with CALEA, or
>> curious as to how CALEA wouldn't do an end-run around your service
>> altogether? CALEA, as you probably know, is the Communications
>> Assistance for Law Enforcement Act, which requires mandatory technical
>> intercept points for Law Enforcement and Intelligence purposes.
>>
>> Being a United States Company, offering Communication services, located
>> in the United States, your Company is certainly subjected to mandatory
>> CALEA implementations.
>>
>> Thanks for your time. I earnestly look forward to your response.
>>
>> -George Ellenburg
>>
>
-----END EMAIL-----
But it's the wrong damn Zimmerman.
Of late I've been thinking that it might be prudent to establish an on-line persona that can't be traced back to me. Between corporate tracking (Google?) and government's love of surveillance, and a sense that we could be heading for some economically or politically charged time, I can see situations where anonymity could be essential.
It seems to me that if you can start with an untraceable e-mail address and consistent use of Tor, you should be on the way to building up an on-line profile that's recognizable, useful, and fairly disconnected from real life.
I'm not naive enough to think that anything I could do would be 100% safe or secure, but surely you can keep most of the prying eyes away from you.
Three Squirrels
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Presumably this is a US-only thang?
and they are not the same Zommerman. who would have thought.
I'm personally surprised that no one has bothered to build encryption in to the TCP/IP stack yet, an sTCP/IP if you will. Using a public/private key encryption model, each time the stack initiates a new connection to any IP, it would first ask the other side if it supports secure encryption, if it doesn't, the other side would probably return an error. Once it is determined the other side supports encryption, both sides generate one-time key pairs and transmits the public key to the other side. Once the connection closes, the private key is destroyed and must be renegotiated. Of course, this doesn't prevent against man in the middle attacks, because there is no central repository to prove who's keys belong to who, but something like this could be done.
I guess what I am trying to say is, SSL should be implemented in the stack, instead of the application level, then we wouldnt really need to worry about our ISP's or the big bad government sniffing out our traffic.
"suite of tools for the paranoid" where you let a 3rd party handle your security...
"If any question why we died, Tell them because our fathers lied."
That explains why there are so many Zimmerman supporters in the shooting stories... They think it is THAT Zimmerman. I remember Mr. Filesystem which lost files better than he lost evidence... many biased defenders on that one too...
Democracy Now! - uncensored, anti-establishment news
Correction. Reiser lost files better than he lost incriminating evidence.
Democracy Now! - uncensored, anti-establishment news
First rule of Silent Circle, don't talk about Silent Circle. Second rule - Don't talk about Silent Circle!!
I was working on public key cryptography in the late 70s while doing my undergrad degree in maths and electronics and got to know some of the people in that field. I have talked with PZ face to face about his experiences with PGP and government. I believe him.
I clicked on the Silent Circle URL, and was immediately offered a cookie. (Which I declined—thanks Firefox.)
I refuse to believe corporations are people until Texas executes one. -- desert rain on http://www.dailykos.com/user/
Sorry, but I have been trying to get a QUALIFIED view of their security and I have been unable to come up with anything that I can actually consider a confirmation that this is not a honey trap.
HOSTING abroad is of nil and nada value if any part of the business or the people involved is based in the US, and as far as I can see that is indeed the case. Not that I begrudge the US government the power to catch bad guys, the problem is that their definition of bad includes "foreigners who may have interesting stuff we would rather sell as American products" and "foreigners who compete with US companies". Actually, just say "foreigners", that's easier.
I'm not going to touch this one. Maybe it'll work for US citizens, but sticking a label "Phil Zimmermann" over any product to call it secure is not going to fly.
I prefer setups that follow Kerckhoff's principle.
"There has been considerable chatter about Silent Circle's launch and about what our products, service and unique architecture is all about. We wanted to get out in front to keep everyone here informed as best we can....
We just posted our Law & Compliance information on our site (https://silentcircle.com/web/law-compliance/) to clear up a lot of the questions about whether CALEA laws apply to us, what data we do hold and how we will handle the "heat" to come.
We are putting our products out open source. CALEA does not apply to us -we are a VOIP and software company -the law makes it clear that communications service providers can deliver products to their customers that use encryption to protect their communications without having the ability to decrypt those communications.That is us, thats what we do. If Canada -US-UK-EU Governments try to regulate and change this -we will move to where we can provide it to the world. We do not have the ability to track individual user logs nor calls. We hold aggregate server IP logs for 7 days — we are working hard to get it down to 24 hours.The data we do have is:
*Authentication information — your user name and hashed password. We hash passwords with a twelve-character random salt and 20,000 iterations of HMAC-SHA256 via PBKDF2.
*Your contact email address.
*Your Silent Phone number that we issue you...
That's it. No more no less..We use ZRTP and PGP encryption. Phil created both. Jon created PGP universal and Apple's Whole Disk encryption.These protocols have been open, peer reviewed and tested for 10-20 years. We are in the process of open sourcing our code Phil, Jon Callas and Vincent Moscaritolo ( Top crypto engineer at PGP, Apple and Symantec) created our new Instant Messaging encryption called SCimp....it's being released worldwide for audit and review in a few days...we too believe in open source. We will put our products out open source. We are paranoid. We are on the firing line. There are lots of organizations who do not want us doing what we are doing. We want to push back. We worry about CALEA being highjacked again. We do Peer to peer, device to device encryption. We dont like survellience. we believe every worldwide citizen has the right to private comms. We dont like Huawei or the Chinese Government putting holes in the silicon. They dont like Silent Circle. So its a fair fight.
Our silent network is how we can do clear, very low latency Mobile video and voice on 3G, 4G, edge, and wifi- completely encrypted. Without our custom built network- customers would have poor comms- as is the case with modern day VOIP. We wanted better. We did better. Its not perfect, but we are trying hard to make it the best out there. We don't have the keys to your voice, video, text and data- you do. True security is up to the user. We only secure your comms.
We are not perfect. We are swimming as fast as we can to launch Android, our Secure PSTN calling plan, Windows 8 version and some new products in 2013... We will make mistakes. We don't stop traffic analysis. We don't secure the device. We don't peddle "military grade encryption" or snake oil VPN systems and we are not for everyone...we deserve scrutiny, skepticism, and questioning. We want to do this right. Phil has been fighting for this chance for 23 years. We understand that secure comms and crypto is a contact sport. We have our big-boy pants on and know we cannot please everyone -we dont want to.
I have included my email address so anyone on slashdot can let me know what you think, give us some ideas on what we can do better- or just fire criticism missiles my way.
Michael Janke, CEO , Silent Circle