Slashdot Mirror
Heml.is, New Encrypted Messaging Service From Brokep of the Pirate Bay
First time accepted submitter freddej writes "Heml.is ("secret" in Swedish), is a new peer encrypted messaging service from some of the guys behind TPB and Flattr. They describe it as this: 'Our focus is your privacy so we are building everything from software to company structure to protect that. The others are focused on maximizing profit.' So if you agree on the mantra that 'if you're not paying, you're the product' then you might want to check them out."
Caveats: they are begging for money and there is no mention whether this will be Free Software or some kind of proprietary service (in which case, how can you really trust it?). It looks more likely it will be a closed application/service: "We're building a message app where no one can listen in, not even us. We would rather close down the service before letting anyone in ... [what will codes unlock?] It will give you access to extended features of Heml.is like sending image messages and other stuff in the future. Pre-register username will let you register your username before the app is released."
The certificate is not trusted because no issuer chain was provided.
Sorry but I threw out all of my iOS/Android devices when Snowden blew that whistle.
Predicted this. First of many products that will try to offer security in lieu of ads after the Snowden leaks. I feel smart today. It's funding faster than a kickstarter... this gives me a page to refresh today instead of the dislikes on that Miley Cyrus video - good times that one.
Without going all "conspiracy theory" here, what if this is part of a secret arrangement with the secret police for each of the founders to get out of secret jail avoid the secret prosecution and additional secret jail time?
To paraphrase Admiral Ackbar, this could be an elaborate ruse. Realistically though? Its an excellent idea to cash in on the concept of the right to privacy.
- Nec Impar Pluribus, or so I'm told.
What good will this do if they've backdoored your device and are reading the keyboard input and taking screenshots?
There are no atheists when recovering from tape backup.
Many clients already support OTR: http://en.wikipedia.org/wiki/Off-the-Record_Messaging#Native
Many clients have plugins for OTR: http://www.cypherpunks.ca/otr/
Predicted this. First of many products that will try to offer security in lieu of ads after the Snowden leaks.
True. I am looking forward to more focus on security plugins and extensions to existing products. Been waiting years for mozilla Thunderbrid chat to get OTR up and running. Also, if any semi decent email encryption method that wants to be even moderately adopted really needs to be next to zero configuration for up-front use or it just wont catch on *at all* (like OTR is a good example, and Enigmail/GPG are defiantly not good examples). Let the ones that really care be able to dive into the configs, check fingerprints, confirm there is no MITM etc... I mean, it cant get any worse than what we have now - 99.999% plain text email traffic, now can it.
When you try to eradicate anything and fail you only succeed in make it stronger and more menacing.
It's true in medicine with antibiotics and bacteria, it's true in nature with mosquitoes and the various failed attempts to defeat their spread of malaria.
Skype was born from the technology to evade detection and network filtering (Kazaa).
First time I fire up Skype I couldn't believe the complexity of the networking it got into.
A close friend, who worked in networking with me, un-installed it immediately as it looked like a trojan at the network layer.
TPB people have learned some very hard lessons about evasion, law and staying alive online under extreme hostilities.
It'll be interesting to see what the next "Skype" will be and this could be either it, or one more step towards it.
On the other hand, such a certificate may be redundant in the case of a properly P2P process, as TFS suggests re their app. However, I can't see any reason why they need one for their homepage, which (from having looked at the content in Links) shouldn't need https at all.
This is borderline useless for the following reason, all the NSA needs is metadata. With metadata they can know a lot about you. They don't need the content of the message when they know who do you communicate with, what frequency, and whatnot. You already use the internet, they should be able easily to associate your IP with your identity. Unless you stop using cloud based services, this alone won't keep NSA in the dark about you.
If I would have a need for encrypted mobile communications I'd probably opt for the open source options from WhisperSystems, rather than a closed source option. Incidentally I asked on the heml.is blog if the source would be open and under what license terms the software would be released and 4 hours later my post is still awaiting an answer.
"I have downloaded hundreds and hundreds of records, why would I care if somebody downloads ours?" Robin Pecknold
and 4 hours later my post is still awaiting an answer.
Those darn other-timezonians!
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
It all boils down to trusting a company once again.
Peter Sunde will run for European Parliament in 2014 election with Pirate Party of Finland. Quite impossible to think any intelligent person not voting for him.
Indeed his ideas on medical healthcare, social welfare, military spending and road infrastructure are renowned and undeniable.
Quite impossible to think any intelligens person would care for anything besides those particular issues.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
"You already use the internet, they should be able easily to associate your IP with your identity. "
only if you are a complete fool and use your home internet for most things.
they cant find me in the noise of a starbucks connection.
Do not look at laser with remaining good eye.
I agree 100 per cent. And I must add that all these so called crypto or secure apps that don't hide the fact of connections are absolutely unsafe. If the FSB (KGB, Russian equivalent of NSA) can compile my contact list they can just torture the content out of them. There is a specific Russian term - "rectothermal cryptoanalyzer" (meaning the hot soldering iron to suspect's anus).
BTW: Hemlis is suspicious because the usernames must be preregistered. The really secure app should have no any central server for the registration info. The admins of such server can be too easily tortured to disclose or stop everything.
they cant find me in the noise of a starbucks connection.
Wanna bet?
“He’s not deformed, he’s just drunk!”
. I mean, it cant get any worse than what we have now - 99.999% plain text email traffic, now can it.
Sure it can. If this is compromised or backdoored, it gives users a false sense of security. At least right now they know their email is wide open. If they chose to not care, then so be it.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
The fundamental problem of the next Skype is that any attempt to produce a really anonymous network will need lots of nodes in delivery chain and will correspondingly produce too long delays, but texting-only app suffers at least since users cannot verify their correspondents by known voice. And you should not trust a network where the intermediary nodes are not under direct control of participants since they all may belong to FSB (KGB, NSA, aso).
You mean the font order that your machine reports to places changes? I'd check with EFF's panopticlick before I say that you can't be found... most machines out there have a unique fingerprint.
Is this a joke?
If what you do in the various Starbucks venues is even slight statistically related, you can rest assured that there are automated methods to identify you.
If we followed the logic you presented then OTR would not exist, dismissed as giving users a false sense of security.
... which works for local communications even when the internet itself is down. Importantly, this is an application that already exists. Plus everything we're doing is open source and we'll never lock any features behind a paywall.
I've been working on Serval's software for a couple of years now building the core feature set; encrypted calling and messaging, distributed phone number lookups, file distribution, software updates and installs in the field...
But since we're initially targeting android phones, we're stuck with the range limitations of Wi-Fi. So we're trying to fund the design and manufacture of a pocket sized device with much longer range (totally shameless plug).
There's still a few missing features in our software that we'll need to finish before we call it version 1.0. But with a enough funding I could easily build a P2P directory to provide services across the internet. With no centrally controlled servers at all.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
Is this any better or more useful than the service Cryptocat (https://crypto.cat/)? Seems like a duplication of efforts to me.
I predict most of them will be broken, and not generate or exchange keys competently.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Any application intended to resist modern government surveillance is going to be extremely difficult to write, because it has to be resistant to bogus secret "court orders". The only way I know to do that is to have many independent developers engage in multi-party signatures of reproducible builds based on audited and reviewed open source code. If they're just going to run a company that develops it in a proprietary manner how will they achieve that?
I am more interested in Pond. It's being written by an actual cryptographer and he already has real, working code (though it's nowhere near releasable). It's up front about its security model and which threats can break it. It's built on top of Tor and even supports using the TPM chip so that when you press delete, the data is really really gone beyond the ability of any forensics tools to recover. It's even designed to resist traffic analysis. Anyone can run a server.
The main differences are that, obviously, Pond is not developed by a company, and it is focussed on asynchronous email style messaging rather than instant messaging. It's also got a very strong threat model that means it compromises on usability - for instance, there are no addresses in Pond, instead you are expected to hand out small files (perhaps on NFC tags?) to people who you want to be able to receive messages from (this is an anti-spam measure).
Despite all that it's a very interesting piece of research.
Yup I'll bet a bunch. It is not hard if you have a clue as to what you are doing to hide in a public net connection.
Professional hackers do it every single day. And yes it takes more knowledge about networking and computers than 80% of the population has to do it, bit it certainly can be done.
Do not look at laser with remaining good eye.
Unless you go to the trouble of changing your wifi mac address and many other uniquely identifying signatures of your computer and the software it runs, you can very easily be found and tracked inside your starbucks. Considering you probably have a smartphone in your pocket with an always on wifi radio, too, you can probably be very easily tracked all around town all the way back to your house for someone with the resources and determination to do so.
Yup I'll bet a bunch. It is not hard if you have a clue as to what you are doing to hide in a public net connection.
Professional hackers do it every single day. And yes it takes more knowledge about networking and computers than 80% of the population has to do it, bit it certainly can be done.
Please give a link to a tutorial! I'm pretty sure I know more about networking and computers than 80% of the population, probably 90% or even 98% (and still I don't consider myself a system or network admin), but I don't know how to do this.
Tormail is free and already well established.
oh, quite the opposite
NSA is merely the excuse/cover for people securing the things that have always needed securing. Don't look at things from the PoV of the NSA or the kinds of people they're supposedly supposed to (?) be peeking at. Look at it from your own PoV.
When a burglar sees you send a mundane message to your friend, it matters to you whether or not he is able to tell the difference between
or
These are the kind of messages which are important to 99.999% of people, the kind of info that we're constantly leaking to fuck-knows-who, which needs to be transmitted securely.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
I worked in Cisco System R&D on IOS for 12 years (1994-2006).
I have patents on network monitoring specific to NetFlow (or Flexible NetFlow) which came from being on the team that redesigned Cisco's netflow on IOS.
That's how I spotted what Skype was doing, and so did my colleague.
We had Cisco routers at home, running our own dev code, watching our own home network traffic.
He thought the skype traffic looked like something a Trojan would do, but since neither of us worked in Anti-virus software or hacking, what would we know? :)
I, being less paranoid, stuck with Skype as I figure it was just being clever in avoiding network filtering.
After all why would the telco's, who provide our networks, let some hackers from Sweden steal all their long distance voice calls...?
Only thing I can think of is to run one of those utilities that sniffs the WiFi channel for MAC IDs and randomly switches to one that's been seen but isn't currently on the network. Of course, you'd also have to be clearing all your tracking markers continuously, and not log in to any cloud-based services (including webmail, social network, etc.).
Hopping from the WiFi to an anonymous VPN service /could/ add an extra layer of misdirection, *if* you trust the service. Over this, you run TOR.
So the end result is:
Trackable web apps purged regularly
Using Ghostery and/or Albine and NoScript and AdBlockPlus
Over TOR
Over Anonymous VPN
Via shared but traceable Starbucks IP
Via Spoofed MAC ID pool
Did I miss a step? There's of course the entire DNS issue (ISP and Google DNS are tracked), so you really want a DNS somewhere under a jurisdiction that you don't mind tracking you (don't assume they're not tracking you). I suppose you could limit yourself to the i2p network to mitigate this issue.
I'm totally anonymous and posting from Starbucks!
BRB, buying another drink with my credit card/debit card/cash from the cashpoint nearby/totally anonymous cash that doesn't matter because if they really want me, they have security camera footage.
This android app (currently under development for iOS) is open source (github.com/surespot) and gaining momentum. "Exceptional encryption for everyone."
https://www.surespot.me/
Disclaimer: I know the developer.
"I either want less corruption, or more chance
to participate in it." -- Ashleigh Brilliant
It's a proprietary service, so you don't know if they're doing what they say they are. Forget it. Absolutely rediculous - it's the same problem we have now in that few people really know what's going on. Let the project drown.
No, they don't generally know that their email is wide open. I guarantee you, if a large batch of random intercepted emails was suddenly published, regular people would be shocked.
And not all compromising is equal. If it takes even a modest effort for NSA to read my mail, that's better than nothing. That ultimately limits how much they can do.
xkcd is not in the sudoers file. This incident will be reported.
You can extract metadata from the content of your message too. They can't automatically understand it yet, but they can probably guess whether you're talking about something political, whether you're angry, certainly what languages you speak...
It can also enhance their understanding of your social connections. If there are certain words that show up in mails to recipient A which never shows up in any other mail (say, like the words "your body"), that's valuable to them, that can tell you something about what kind of relationship you have to A. Now if those words suddenly start turning up in messages to someone else... whoops, automatically collected blackm.. I mean opposition research material!
xkcd is not in the sudoers file. This incident will be reported.
You have an account with five digits, and you're still using it after all these years? Yeah, I think they can find you.
xkcd is not in the sudoers file. This incident will be reported.
The problem is, they don't even need very much determination to do so today. It could all be automated, and run on your entire demographic (just in case) rather than targeted at you.
xkcd is not in the sudoers file. This incident will be reported.
Before you care about those issues one way or another, you've got to care about your freedom and ability to actually make a difference on either of those issues.
If you have no power, if the spy agencies are in charge and could manipulate the majority's public opinion on those issues any way they wanted, what would it matter what you thought about them?
Democracy first, then politics.
xkcd is not in the sudoers file. This incident will be reported.
I think protecting the freedom of speech, democracy, human rights and civil liberties is the new 'environmental' issue that matters the most. And it appears the pirate party is the most active in resisting human-right supressing stasi-like activities... and quite frankly I don't care that much for Sunde's or pirate party's other ideas or priorities.
;)
In the 80's green party movement/party was a great political invention, which eventually helped in ending the acid rains, CFC-freons, overuse of farm pesticides and other nasty things. The industry would not have stopped poisoning the environment without a clear political guidance. For me the pirate party is like the 80's green party movement... this time it's just protecting humans instead/besides the nature. Ok, not everybody needs to have these political priorities
Exactly how much of Finland's medical health care, social welfare, military spending and road infrastructure will be determined by the European Parliament? Yes that is right, exactly nothing.
And even if it where, Finland has 14 seats so that would leave 13 to deal with those issues.
"There's of course the entire DNS issue"
It is not hard to run your own DNS locally, plus you can always use a connection elsewhere to do a DNS lookup from outside the USA via IP address.
Add one more step, high gain directional antenna. I can be 500 meters away from the starbucks and use the wifi there, or pick another open or public wireless source. Easy to fit in a backpack and works even if it's inside the backpack, so nothing is visible and you dont attract attention.
Lastly, Everyone assumes that you have to use a web browser.
Do not look at laser with remaining good eye.
Very true. IT was one of the vectors how mitnick got lazy and got caught. Manning simply was dumb and was bragging about it to someone, Rule #1 of what you never do. Rule #2 is never brag to a known government mole, again another mistake he made.
Do not look at laser with remaining good eye.
"You already use the internet, they should be able easily to associate your IP with your identity. "
only if you are a complete fool and use your home internet for most things.
they cant find me in the noise of a starbucks connection.
Unfortunately for you, the combination of browser plugins you use is basically unique (see https://panopticlick.eff.org/) and more than sufficient to track you.
Check out https://panopticlick.eff.org/ and all the things that JavaScript can potentially reveal to the sites that you trust to execute JS. My favorite is that the list of fonts you have installed can uniquely identify you.
You also missed the obvious settings regarding cookies, your browser cache, referrer tags, and user agents. I assume that was just oversight.
Yes, I know NoScript will block all JavaScript if you're ruthless, but that means never letting your desire for convenience, functionality, or access to a site allow you to bypass NoScript, ever. And make sure you're blocking Flash and Java as well.
John
What's wrong with email+gpg and xmpp+gpg? Did it get broken? Why the need for a new protocol?
Obligatory XKCD: http://xkcd.com/927/