Silent Circle Follows Lavabit By Closing Encrypted E-mail Service

Okian Warrior writes "Silent Circle shuttered its encrypted e-mail service on Thursday, in an apparent attempt to avoid government scrutiny that may threaten its customers' privacy. The company announced that it could 'see the writing on the wall' and decided it would be best to shut down its Silent Mail feature. 'We’ve been debating this for weeks, and had changes planned starting next Monday. We’d considered phasing the service out, continuing service for existing customers, and a variety of other things up until today. It is always better to be safe than sorry, and with your safety we decided that the worst decision is always no decision.' The company said it was inspired by the closure earlier Thursday of Lavabit, another encrypted e-mail service provider that alluded to a possible national security investigation." Does anyone have replacement recommendations for people who used these services?

Comments

Nicely done

[beefoot]

The US government is basically forcing technology firms to move else where.

Re:Nicely done

[flitty]

1. Force shutdown of US based communications companies for non-compliance with PRISM.
2. Suddenly, all commucation is "foreign".
3. All communications are now collectible without any oversight.

Re:Nicely done

[Anonymous Coward]

Move where? If you are going to take this it is better to be safe than sorry approach, and give up before the government does anything to actually force you somewhere else, what other country could you operate in? Any other country has some potential to do the same thing, to eventually produce laws or actions that interfere with such operations, so you can't set up such a service in any country if you want to play it safe. This seems like a cop-out, that they are just making things easier for the government by removing one more such service in the name of safety instead of trying to fight or fix things.

Re:Nicely done

[gmuslera]

If is encrypted is collected anyway. So, or you have it in a way easy to collect (and no guarantee that is not collected anyway, still a lot to be disclosed), or you have it in a hard way to collect (and there they will try to get it). Your best bet is still hard to break encryption, and if by law you can't have it inside US, you must have it outside. And if is important (i.e. concerned about the intellectual property of what you discuss), move yourself outside too, at least your communication with the server have less chances to be intercepted.

Re:Nicely done

[Bill, Shooter of Bul]

Brilliant!
I think the idea in this case was that lavabit and silent circle didn't have any way to decrypt your email. If this was true, then it wouldn't matter where it was as long as that remained true and email was between two users of the service ( obviously the NSA could read your sent and received email by just hacking the recipient/ sender of each email) .

Re:Nicely done

[buchner.johannes]

Are there any alternative services that do something similar as Lavabit? Perhaps not US-based?

Re:Nicely done

[Anonymous Coward]

For those of you who dont get the reference: Hes talking about this.

Re:Nicely done

[Anonymous Coward]

You think if Obama lost and Romney won there'd be any difference except for figurehead with false polite smile instead of one playing down to earth guy? How cute.

PS: Not an American, just find it silly how y'all go about this as if it was partisan issue and difference between R and D wasn't only what kind of lube they'll use when fucking you in the ass.

Re:Nicely done

[SteveFoerster]

The sad thing is that I now remember fondly when Obama was compared to Carter. Now it's more like he's channelling Nixon.

Re:Nicely done

[Seumas]

. . . Says Europe, which practically jizzed all over themselves upon the election of Obama.

No, only the most blinded Americans buy the Obama bullshit, just like only the most blinded bought the Bush bullshit.

But don't worry, after more than two centuries and dozens of shitty presidents, we are totally going to get an integrity-filled savior in 2016 who will save us from everything and not backtrack on or betray everything he ever said. We've just been desperately waiting for all those brilliant teenagers to finally come of age by the next voting cycle and they will save the world with their naive, inexperienced, easily swayed voting. Everything's gonna change in 2016 you guys!

Re:Nicely done

[Seumas]

Funny, the leaders he has been channeling remind me far more of certain European leaders from a time before I was alive.

Re:Nicely done

[bhlowe]

Nixon spied on a half dozen people and resigned in disgrace... Obama spies on everyone.

Re:Nicely done

[Anonymous Coward]

Obamma is better than Bush:

no he's not

most of Obamma's policies have been well meaning

no they haven't

and he can give a speech without looking like a complete moron.

no...he can't

Re:Nicely done

[Charliemopps]

No I think the way lavabit stored the keys was faulty. They were stored on their own servers and unlocked by the users password when they logged in. So the NSA couldn't crack your email unless they watched you log in, then they would have your password. I suspect the NSA ordered them to allow the NSA to do this very thing and the owners realized that the only way to prevent them from gaining access was to shut down the service so no-one could log-in and give the NSA access to their accounts. Someone in the Lavabit thread suggested that they should have had a client side app that generated keys for you, then there would have been no-way for anyone to crack it unless your local machine was key-logged.

Re:Nicely done

[dryeo]

As far as I know Nixon didn't personally spy on anyone and there is no evidence that Obama is personally spying on anyone either. It's the government (and party in at least Nixon's case) doing the spying and they have been doing it as long as it has been technically possible. Civil war they tapped telegraph lines, prohibition the Supreme Court ruled that tapping phones didn't violate the 4th amendment as long as they didn't break into anyones house to tap their phone http://en.wikipedia.org/wiki/Olmstead_v._United_States. Under J Edgar Hoover the FBI spied on everyone they could and now with modern tech...
Obama is a massive disappointment but to act like he started the spying is wrong.

Re:Nicely done

[Anonymous Coward]

Of course he's better than Bush. Failure to end all of Bush's policies doesn't make him worse, or even as bad, as Bush.

"Failure to end" is a euphemism if I ever saw one. To fail, you first need to try. It's more like "embrace and extend". Yes, Bush is responsible for starting a lot of the crap that was escalated out of control under Obama's supervision. And Obama's election promises were quite explicit about reining them in instead.

What did the NSA have on him in order to turn him? Or did they brainwash him? Or what else is in it for him?

Re:Nicely done

[Wookact]

Yes, but what about the Republicans in Congress that approve of these methods. Everything is Obama's fault, sure whatever. Why don't you hold congress responsible. After all they control the purse strings.

Re:Nicely done

[SteveFoerster]

I agree. For things to have gotten this bad, there's an awful lot of blame to go around. For example, the judicial branch isn't any better here either.

Re:Nicely done

[ssam]

but they might 'interrogate' you until you give them a key that decrypts it.

safer to have something that will actually decrypt into something harmless. record a few hours of footage of a fish tank or something.

Re:Nicely done

[webmistressrachel]

Godwin's Law is still Godwin's Law even when the obvious name isn't mentioned. Discussion over. ;-)

Solutions anyone?

Re:Nicely done

[Archangel Michael]

... and gets a pass because he is a (D) and the press is (D) and not (R).

We have no fifth estate any longer. The MSM press is NOT an ally of the public interest. Not when they realized they could influence politics to their own benefit.

The real scandal in America is the Press. Obama is getting away with things the press would soundly criticize(rightly so) GWB on.

Re:Nicely done

[Anonymous Coward]

and difference between R and D wasn't only what kind of lube they'll use when fucking you in the ass.

Hey now, this is America we're talking about. The difference between R and D is what kind of lube they promise they'll use when elected while campaigning. After the election you find out that neither party actually has lube, but that it was just a campaign sound bite designed to appeal to voters.

Re:Nicely done

[colfer]

1. Gov't security letters now demand the ISP cannot shut down its service.
2. Targets start using GPG, using flower pots for key exchange.
3. Gov't takes over DNS.
4. Obama appoints sleeper North Korean communist agent as Chief Justice.
5. New FISA court judges throw out security letters.
6. NSA sends 300 number theorists into space on a near-light-speed ship, to return in 60 earth-days (40 local-frame years) with a crack to GPG.

Seriously, after another big terrorist attack all bets are off. But Congress may change how FISA court judges are appointed if another Democrat wins the White House.

Still at play - and was mentioned in one of the first hearings - is whether that handy web interface we saw a few weeks ago could be used to get line recordings from inside the Capitol or a high court. Separation of powers is still a big deal in Washington.

Re:Nicely done

[guises]

Guantanamo and indefinite detention was a failure to end. He tried and failed. The Bush tax cuts was a failure to end, he tried to eliminate the worst parts of them and failed. I don't know what he's done or what arguments he's made, as president, about the patriot act, but as a senator he did try (and fail) to limit surveillance.

The tax cuts and the patriot act are sore spots, since he could have just vetoed both of those. So again: I don't love everything he's done, but after you cut through the rhetoric the only real offenses that I've seen during his presidency have been by the justice department. I don't understand the persecution of Thomas Drake, even wearing my most cynical hat that doesn't make sense to me. "Obama bad" is not a sufficient explanation.

Re:Nicely done

[cayenne8]

Are any of the old NYM or mixmaster servers still running?

If you were to set up a mixmaster node on one of your home servers, you think you'll warrant a visit from the Feds on that one?

Re:Nicely done

[TheDarkener]

Real Americans aren't paying attention to R vs. D since many years ago. If you believe the consciousness of the majority of the American people align with what you see on your television from the U.S., you're just as ignorant.

Re:Nicely done

[lxs]

Or Ferdinand II...

Re:Nicely done

[Wookact]

Unfortunately I have to agree with you. All three branches and both sides of the aisle are at fault here.

Re:Nicely done

[ultranova]

6. NSA sends 300 number theorists into space on a near-light-speed ship, to return in 60 earth-days (40 local-frame years) with a crack to GPG.

Accelerating a thing makes time go slower for it, not faster. So you would need to accelerate the Earth, not the ship. And besides, if you can accelerate an object at least as massive as a human body into near-lightspeed, you already have a Death Star, so why do you need a software crack? Just get to your new starship and hold Earth hostage.

Re:Nicely done

[js_sebastian]

Godwin's Law is still Godwin's Law even when the obvious name isn't mentioned. Discussion over. ;-)

Indeed, Godwin's law by any other name still smells as sweet...

Re:Nicely done

[rahvin112]

There is nothing more right wing than claiming the press favors democrats. There are two sets of press, those like MSNBC that favor the democrat view and those like Murdoch properties like Fox News that go out of their way to advocate the republican party line. In the middle are those companies like CNN that are after rating and don't give a damn about content, including whether it's even factual. These middle organizations generally have individual reporters with extreme bias, like Nancy Grace who advocates for government authority regardless if that authority benefits republican or democrats.

Frankly there are almost NO news organizations that care about presenting all the issues and trying to remove reporter bias. They don't exist because (stupid) people want their "news" (or entertainment as Fox calls it) biased to their political view point. There are a couple vary rare organizations that still strive for that, but they have terrible ratings.

If you want it you need two things first, people to actually demand unbiased coverage (the biggest requirement) and to monopolize the coverage, and that means breaking up the big networks. The more competition in coverage and the less central control by large egomaniacal CEO's with agendas and you will see less bias, but that would require reinstating the ownership rules that the republicans works so hard to waive so Murdoch could build his empire.

Re:Nicely done

[TrentTheThief]

It's comments like yours that make me wish I could give you something besides a smile when I read it.

Slashdot needs a "thank you" or an "I appreciate your sentiment" button ;-)

Re:Nicely done

[anagama]

Godwin's law is correctly invoked in a context where comparing a person/action/entity/whatever to Hitler or Nazis is hyperbolic -- it's sort of an insult to those millions who died in the holocaust when someone calls their boss a Hitler because they have to go into work early.

But, when the comparison starts to fit, Godwin's law doesn't apply, precisely because the comparison fits.

So for example, the Nazis focused on a religious/ethnic group and killed millions of them by factory methods.

Americans focus on a particular religious/ethnic group, and kill millions by war, drone strike, and the most devastating weapon of all, economic and trade sanctions.

So the question is, is the way the US is systematically destroying a racial/ethnic group different enough from that the Nazis used, such that Godwin's law may be validly invoked. If not, that's sort of "holy fuck" territory, a place that is very hard to go to intellectually -- so if your knee jerk reply is that Godwin's does apply you should examine that closely because it is really hard to tell yourself, that you're an evil cretin and so much easier to go with the kneejerk.

Re:Nicely done

[anagama]

trade "racial/ethnic" for "religious/ethnic" in the last paragraph.

darn it!

Re:Nicely done

[HiThere]

He hasn't been worse.

"If I have appeared worse than prior presidents, it is because I have stood on the shoulders of giants."

Re:Nicely done

[HiThere]

If it's random, you don't really need to encrypt it. You might, however, need to compress it, and then alter it enough so that they can't be sure that you used, say, bzip2 to compress it.

Better, just xor together a few bzip files. 7 should be plenty., but make sure they're fairly long, and truncate the length of the result to the length of the shortest. It's not random. There's clearly pattern present. But there's no way to recover the information.

Re:Nicely done

[HiThere]

You haven't been watching long. The Republicans enact the abusive legislation. The Democrats howl about it. Then, when the Democrats are in power, they start using the new powers abusively. (Sometimes the Republicans howl about this, but they're more likely to complain when the government does something that helps people who aren't wealthy.)

Re:Nicely done

[HiThere]

Probably the only real alternative is to find a country that is "aggressively neutral" towards your desired market. And don't take any customers that reside in that country. This will make you of minimal interest to that country.

Of course, you also need a good security model. No government can be trusted. Remember that governments are usually just gangsters that have been in power so long that people have forgotten about their origins. (Yes, there are exceptions. But damn few. And they don't keep their morality.)

Re:Nicely done

[oreiasecaman]

+1 SadButTrue

Re:Nicely done

[DaEmEoNd]

Nixon spied on a half dozen people and resigned in disgrace... Obama spies on everyone.

It wasn't really Nixon, it was J. Edgar Hoover and Senator McCarthy that really spied on the people of America. And that is what the real worry should be for the American public. This argument about "if you done nothing wrong you should have nothing to hide..."is an empty argument in my opinion. What will future governments do with this information. Could you imagine what it would be like if either of these people were alive today and all the access to information they would have. What it would mean for the people of the US. It would be a damn nightmare is what it would be... disclaimer I'm Canadian and our government is becoming no better than the Americans, heck it's seems our two governments are sharing the same bed when it comes to spying on its citizens.

Re:Nicely done

[kirkb]

When did they start using lube?

Re:Nicely done

[radarskiy]

Name 3 policies where Obama is to the left of Nixon.

Re:Nicely done

[Archangel Michael]

Serious question. How come NO Press person has hammered the "phoney scandals" line? I mean not one.

When you can answer that, without saying "they are phoney scandals" ... then we'll talk.

Re:Nicely done

[citizenr]

Nixon spied on a half dozen people and resigned in disgrace... Obama spies on everyone.

When its millions its just statistics, he learned from uncle Stalin.

Re:Nicely done

[DuckDodgers]

The PRISM surveillance program started in 2007, when Bush was president. The Patriot Act was passed when Bush was president.

So the way I see it, we have two bad choices. We can pick a guy that believes in warrantless wiretapping, indefinite detention without trial, torture, assassination of American citizens without any kind of legislative or judicial check, and making software and media piracy a felony. That would be any Democrat presidential candidate. Or we could pick any Republican presidential candidate and get all those plus plans to dismantle social services, tear down the separation between Church and State, and systematically gang rape the poor and homosexuals.

When Satan's running the country but he's running against Cthulhu, sorry but I'm going to pick Satan every time. I don't see anything plausibly better.

Re:Nicely done

[Fjandr]

I don't think the non-American voted for either Obama or Romney. Then again, who knows...

Re:Nicely done

[Fjandr]

It's like murder. If you only kill a few (dozen, maybe), you're a murderer. If you kill thousands+, you're a hero.

Re:Nicely done

[DuckDodgers]

Be practical. Bush and Obama and presumably Romney are effectively indistinguishable from one another on foreign policy, torture, indefinite detention, intelligence policy, and the executive branch overstepping its constitutional authority.

But the Republicans want to dismantle the separation between Church and State, specifically by banning gay marriage and related things (visitation rights to gays for their partners in hospital, extending job benefits to a gay partner, allowing gays to adopt children), by banning abortion, and by teaching abstinence-based sex education in school.

The Republicans also want to cut taxes on the wealthy and cover the corresponding deficit in federal income by cutting social services and cutting education spending. Likewise they favor legislation to dismantle unions, remove anti-discrimination laws, and block any moves towards universal health care.

Those differences may not matter to you, but they do matter to me. I voted for Obama, and I don't regret it. I regret that the Democrats and Republicans have a stranglehold on politics in the country, but given that fact I don't regret supporting the Democrats.

Re:Nicely done

[Fjandr]

There's a lot of blame to go around. Anyone blaming just one segment of government, or just one person, is not paying attention or is trying to manipulate people.

Re:Nicely done

[Fjandr]

Why would their editors allow them to jeopardize their meal ticket?

Re:Nicely done

[Fjandr]

He has failed to end surveillance policies over which the Executive branch has complete control.

Re:Nicely done

[guises]

Well fuck. I've already written two lengthy responses to this and lost both thanks to the god damn back button sitting next to the arrow keys on my laptop. I am not buying another Thinkpad.

Short version: the patriot act does not grant surveillance powers to the president, it grants them to the director of the FBI. The FBI is required to act under the guidelines of the attorney general, and that's as close as it gets to control by the executive branch. This again means that the justice department is the problem here which, as I said, has committed the only real offenses that I've seen during his presidency. There are two ways to look at this: one is that the justice department is just a bunch of presidential lackeys, capable of no independent action, and the president is to blame for everything that they do. This is the Bush approach - they "serve at the pleasure of the president" and he can do whatever he wants with them. The other way to look at it is that this is not how the justice department is supposed to work. They are supposed to act independently, otherwise the president or other lawmakers could use the legal system as a cudgel to get whatever they wanted from whoever they wanted. Putting the power to prosecute (or not prosecute) under the power of a lawmaker is an invitation for corruption.

Of course, if you take this second approach then the attorney general and the director of the FBI are the ones to blame for the surveillance - people appointed by the president. So he doesn't get off scott free, though I'll point out that he also didn't appoint them unilaterally. They were approved by congress.

Re:Nicely done

[Fjandr]

The director of the FBI reports to the President. An EO by Obama is all that is required.

Sucks about the hardware issue.

Re:Nicely done

[Benders]

Blame whom? For what? I don't get it. Everyone talks about the methods created. The events of 9-11-1 pretty much forced the US population to agree to the implementation of the Patriot Act. And the Act itself is viable. The issue with the current Administration isn't that they continued to run a program that everyone agreed was intrusive. This Administration has used the information that is now gathered in real-time, (vs looking at it as archived data to be used when needed), and used that information for the advancement of their agenda politically. They have lied at every turn for the last 5 years. Which one of this Administration's demonstrations of over-reach, ineptitude, or just total lack of knowledge of what is going on in their branch of the administration has been resolved to anyone's satisfaction? Fast and Furious? Benghazi? Using the IRS as a political weapon? The unwarranted investigation into the Associated Press? The Justice Department wrongfully and secretively surveilling James Rosen including his Parents private communications? The justice Department fighting perfectly legal State Laws, that are perfectly legal in the state but does not agree with Federal policies in Washington? Has anyone received any information that even suggests that anyone at all has been held accountable for anything regarding any of these issues? How is it possible our Government can run this far amuck but suffer no consequences? F & F was responsible for the death of a US Border Guard. The Benghazi horror story saw 4 US citizens killed, (if not more we don't know about) including a US Ambassador. There are 5 deaths irrefutably laid at the doorstep of this Administration. Whether the deaths were caused by mistakes, ineptitude, or unforeseen circumstances has never been answered truthfully. Their is no sense of Honor, Integrity, Truth, or Morality in this Administration whatsoever. And those traits are becoming demonstrated less and less by our elected Congressional personnel.

NSA or Chinese great firewall

[beefoot]

In USA, if you google search specific terms will result a visit from the authority (hint pressure cooker and back pack). In China, if you want to find something the government does not want you to know, you just can't find it. I don't know which one I like best.

Re:NSA or Chinese great firewall

[therealkevinkretz]

It turned out that the visit from Homeland Security after the "pressure cooker" and "backpack" searches weren't a result of Google monitoring but of a report from the guy's employer after finding the search on his work computer.

Re:NSA or Chinese great firewall

[sacrilicious]

Yes, that's what the official story may be... but who knows? Just two or three days ago was the whole exposing of how the government admitted that they have been coming up with "alternate explanations" of how they get various pieces of intelligence so that the official explanations don't point to prism/etc. So truly, how can we possibly know?

Re:NSA or Chinese great firewall

[interkin3tic]

In capitalist America, employer IS government!

Re:NSA or Chinese great firewall

[Dunbal]

No that was the bullshit damage control. You know how I know? Don't you remember the guy in England who said he was going to "have a blast" (or something to that effect) in Los Angeles, and was turned around at the US border? They are reading everything. They just don't want you to think that they are.

Re:NSA or Chinese great firewall

[theguyfromsaturn]

Well, why don't you test the official story? It's easy, go to your computer and google search "pressure cooker" and a few minutes later "back pack". Make sure to let us know if the MIB go visit you. Here on /., we like to know.

Re:NSA or Chinese great firewall

[Dunbal]

Except you're the one taking the government's word for it and spreading disinformation. You go try convincing local cops to get off their asses and go talk to someone over a google search and see how likely that is.

Re:NSA or Chinese great firewall

[JustOK]

If they did show up, how would the poster be able to convey that info to us?

Re:NSA or Chinese great firewall

[stewsters]

Dead man's switch posting. I'm pretty sure you can set that up with an Arduino, a network shield, and a button.

Re:NSA or Chinese great firewall

[gmuslera]

You get NSA inspection in US, China, Switzerland, Peru, New Zeland and the rest of the world. In some countries, if they don't like what you are looking for, they send to your entire neighbourhood a drone (and then claim "we hit terrorist suspects", with nothing left alive to discuss that), thing that could expand to other countries, and maybe US too. Chinese firewall only targets chinese citizens and is more about preventing than punishing. Yes, both are bad, but the NSA is several orders worse.

Re:NSA or Chinese great firewall

[Threni]

They would enter text into a text box and then click submit.

Re:NSA or Chinese great firewall

[Binestar]

How about if they don't show up he posts, if they do he doesn't.

Re:NSA or Chinese great firewall

[thoth]

Surely the Streisand effect would have already happened - some percentage of people (especially Slashdot readers) would have read that and immediately searched for "pressure cooker backpacks" - and we'd hear about hundreds/thousands of people suddenly gone missing or being detained for questioning.

I mean come on, there's legit concern, there's paranoia, and there's all out tin-foil-nutjob behavior with layered conspiracies hiding deeper multi-level conspiracies. The story about the employer reporting his employee for searching at work sounds 100% legit. Employer is probably engaging the CYA, something corporations have no problem throwing puppies under the bus to do.

Re:NSA or Chinese great firewall

[KingMotley]

The NSA would just hack his account, and keep posting ridiculous stupid stuff so we couldn't tell the difference.

Re:NSA or Chinese great firewall

[the_B0fh]

his wife was on his office computer...?

Re:NSA or Chinese great firewall

[therealkevinkretz]

I don't think I'm stupid or naive - I wasn't surprised at all at any of Snowden's revelations. I was skeptical right away at the report of a Long Island couple getting a visit from the feds (or locals directed there by the feds) because of a Google search on two terms associated with a terror event months prior - not because I don't think Google is being watched, but because a policy with such a low threshold for a response would keep every law enforcement officer on 24/7 duty for...ever.

I googled about ricin after a Breaking Bad episode. I'm sure that most people have at one time or another earched for terms associated with news events, or crime, or terror.

That the person-of-interest's employer turns out to have reported it makes much more sense.

Re:NSA or Chinese great firewall

[bill_mcgonigle]

It turned out that the visit from Homeland Security after the "pressure cooker" and "backpack" searches weren't a result of Google monitoring but of a report from the guy's employer after finding the search on his work computer.

The buried lead in that story was that there were hundreds of similar visits from men in black every day in the US. Either US employers really suck, or this is just another flat-out lie from the so-called security apparatus.

Re:NSA or Chinese great firewall

[CreatureComfort]

If he never posts again, can we assume they got him?

Re:NSA or Chinese great firewall

[HiThere]

Actually, we can " pick up the next month and say "OK, tin-foil-hat guys, you're being paranoid. Where's your proof this week?".". People do it all the time. That's a part of what authority depends on.

Re:NSA or Chinese great firewall

[hawkingradiation]

Maybe, but there were two searches, you only mentioned one computer, the other one was his wife's. Seems to me the story implied that he was searching at home. Also, how does somebody suddenly "find a search on his work computer" after he had supposedly logged out or let his screensaver take over. If anything the guy's employer was monitoring the searches through software, the employer's or something else. Was he searching for searches?

Re:NSA or Chinese great firewall

[therealkevinkretz]

The story was that a search on the work computer caused the employer to call the authorities.

If you think it's unusual for a business to scan/log/search searches and other web traffic, I'm not the naive one.

First rule about Fight Club...

[Anonymous Coward]

Does anyone have replacement recommendations for people who used these services?

The first rule of Fight Club is: You do not talk about Fight Club.

Re:First rule about Fight Club...

[MMC Monster]

Fight clubs may be a suitable replacement for trusted electronic private communication, but the bit rate is horribly slow.

enigmail/pgp/gpg

[Eunuchswear]

Encryption should be end-to-end. How can you trust someone else to do it for you?

Re:enigmail/pgp/gpg

[doconnor]

One advantage of these 3rd party email services is that you can't tell who is emailing who without getting access to their servers. It seems some of them are willing to go out of business to prevent that.

Re:enigmail/pgp/gpg

[intermodal]

The unfortunate thing is, despite this being a huge endorsement for their services, those services are no longer available from them.

Re:enigmail/pgp/gpg

[PetiePooo]

Encryption should be end-to-end. How can you trust someone else to do it for you?

I was thinking the same thing; Phil Zimmerman had it figured out decades ago. As long as both ends keep the snoops out of their computers, with PGP or GnuPG, all they can read is the envelope information between SMTP relays. As far as we know, anyway...

That method requires a little more technical skill than having some SaaS provider do it, but if you've got secrets to protect, that's a small price to pay. Use big keys and EC to help future-proof.

And for keeping even the envelope info private, just run a private email service of your own (with no external mail gateway), and keep the snoops off of it. Allow access only via VPN or SSH tunnels.

Re:enigmail/pgp/gpg

[Hatta]

Can't you do the same thing on a public forum? e.g. I generate a public key with no personally identifable information, and give it to you. To contact me, you encrypt your message with my public key, and post it to e.g. USENET. I then connect to USENET, download a bunch of posts, try to decrypt everything with my private key, and keep the ones that are successful.

Re:enigmail/pgp/gpg

[Anonymous Coward]

Can you elaborate on how that works from a sigint/commint perspective?

'cause I hear you, and I'd like for it to be true, but it sounds like *cough* *cough*... bullshit.

I can set up a mailserver with a MX record, encrypt the hard drives, use TLS & DNSSEC, and even give GPG keys to all of my clients...

I can _even_ set up a VPN on my server, so that outbound email from my clients is diffused through 20 or 30 distinct networks

(and add in some random latency to convoluate hostile signals analysis... works even better if I start attaching bullshit empty files or add coments into mime encoded HTML...)

Unfortunately, at the end of the day -- inbound email is still going to open TCP/25 or TCP/465 to the MX. And unless the sender was using a GPG key for a client on the mailserver and/or a relay.... well... the originating network and packet information is vulnerable to inspection.

Most likely that'll be a corp network or email, and depending on the network there may very well be lots of firewall logs...

So, I might not have their email address if it's all wrapped up in crypto... but I'll still have the outbound mailserver's ipaddr and know right where to go to erad the logfiles.

But seriously... if you still believe these systems help avoid identifying the sender, let me know how that works.

Re:enigmail/pgp/gpg

[Hatta]

If one could protect who the keys are distributed to and posessed by, then this could work

The whole point of public key encryption is that you don't need to protect who the public keys are distributed to and possessed by. And the private keys never need to be transmitted.

Re:enigmail/pgp/gpg

[KingMotley]

I did that. I only get messages that say "Drink more ovaltine".

Re:enigmail/pgp/gpg

[hoggoth]

How long before the NSA adds their own bits to the PGP and GnuPG binaries?
What percentage of you have downloaded the source code, verified the MD5 of the source code against what is reported, then compiled it yourself using compilers that you trust aren't compromised?

Re:enigmail/pgp/gpg

[JesseMcDonald]

Seeing how you can only use public key crypto for a 1:1 communication, this system would not scale at all.

You're thinking of shared (private) key crypto, where each channel needs a unique key. With public key crypto, he can distribute the public key to as many people as he wants, and any of them can send him a message securely by encrypting it with the public key and posting it to a public forum. Only the person with the corresponding private key can decrypt any of the messages, and if he's careful not to give away his interest in any particular encrypted messages, no one need know which ones he is capable of decrypting.

Re:enigmail/pgp/gpg

[Valdrax]

Only the person with the corresponding private key can decrypt any of the messages...

That's the problem right there. You can't encrypt a single message for multiple recipients without making a separate, encrypted copy for each recipient, unless every recipient has a copy of the same private key. A shared secret is no secret at all.

That means that signal to noise ratio worsens with every conversation you aren't a party to, so the more people use it, the less useful it is, because you have to download more and more messages for each message you want that you can't decrypt -- and that you can't tell you can't decrypt without spending CPU to try. Imagine having to read all of Twitter just to get the one message sent to you.

That's what I mean by saying it won't scale.

Re:enigmail/pgp/gpg

[JesseMcDonald]

That's the problem right there. You can't encrypt a single message for multiple recipients without making a separate, encrypted copy for each recipient, unless every recipient has a copy of the same private key.

While that is true, most systems employ a mix of public- and private-key cryptography, if only because public-key crypto is comparatively slow and become more so for large plaintexts. The message itself is encrypted once with a single symmetric key, which is then encrypted separately for each recipient. There is thus no need to duplicate and distribute the entire message for each recipient, just the message-specific symmetric key.

There is a large amplification effect, so this is not a practical system for general mail delivery, any more than most people would use blind drops to exchange casual letters. It's reasonable so long as the encrypted messages represent a small fraction of the normal traffic on the forum. Any more and the forum operators will take steps to block such messages as spam.

Re:enigmail/pgp/gpg

[PetiePooo]

What percentage of you have downloaded the source code, verified the MD5 of the source code against what is reported, then compiled it yourself using compilers that you trust aren't compromised?

The authors of those programs make it easy to verify by publishing the hash along with the source and encouraging people to verify their downloads. I expect your distribution's maintainer follows those protocols when building the released version. That build is automatically signed when built and verified upon download when installing it on your system.

As for trusting your compiler, I assume you're referring to Ken Thompson's seminal Reflections on Trusting Trust (PDF). It's an interesting academic exercise, but I'm pretty sure if such a compiler were out there and in common use, someone would have noticed. Especially now that there is a published way to detect it.

Installing the distro's version is likely safe, although you must realize you're opening up your circle of trust to include the distro's maintainer and server farm instead of just the original author(s) and their source repository.

The bad part of this is, until we get NSA's unconstitutional programs back under control, simply encrypting your emails may be enough to trigger their systems to preserve it.

Re:enigmail/pgp/gpg

[PetiePooo]

"And for keeping even the envelope info private, just run a private email service of your own (with no external mail gateway) ..."

And ensure no TCP traffic to your gateway goes through any compromised Internet nodes.

Those ellipses conveniently left off the rest of the quote instructing to allow access only via VPN or SSH. Good crypto is designed to defeat MITM and eavesdropping attacks. Listening in? Fine with me; all you'll get is ciphertext. Modify even a single bit and I'll be alerted.

Re:enigmail/pgp/gpg

[PetiePooo]

Free association is what is threatened here.

True. So if that's a concern, connect to that darkmail system via a VPN over TOR.

Re:enigmail/pgp/gpg

[HiThere]

Where are you going to find these candidates who will support the constitution after being elected. (Yeah, I changed your target group. But the ones who change their minds after being elected are a big part of the problem.)

Re:enigmail/pgp/gpg

[HiThere]

Encryption protects the contents of the message, not who it's directed to. So if you want to disguise who the communication is directed to, you need to hide it in something that will be downloaded by lots of people. Steganography of porn videos is the best idea I have. If the message is properly encrypted it can't be read by anyone who doesn't have the right key. Most people who download it won't even know it's there. And any govt. agents that are attempting to track the messages will be thoroughly distracted.

Unfortunately, it doesn't disguise the sender, only the recipient. And it's an approach that uses a lot of bandwidth. Perhaps you could produce the pictures for someone else to post, but then how will your target audience find the right porn flicks to decode?

Re:enigmail/pgp/gpg

[bigberk]

Nobody mentioned Thunderbird with built-in SMIME capability!

Supports full public key crypto with no extra extensions needed. Generate a self signed certificate, and a big key (it can support 8192 bit RSA).

Now you've got end to end crypto. Use Thunderbird with any ISP including gmail with IMAP and SMTP if you want; they won't have a clue what's being sent through anyway.

For additional security, I think Thunderbird supports storing the crypto on a hardware token (smart card) but I haven't tried this.

Simple option(s)...

[pla]

Does anyone have replacement recommendations for people who used these services?

I would say "something hosted outside the US", but as the international banking community has shown, Uncle Sam's jack-booted foot extends well outside our own borders.

So that really leaves "GPG" as you sole realistic option. End to end encryption, with no one but you and the recipient knowing what you wrote. Of course, "they" can compromise either end, but it deprives them of the ability to funnel everything on the wire into their data centers for 4th-amendment violating goodness.

Or, we could all go back to writing letters. Oddly enough, that still has more legal protections behind it than any other form of communication.

Re:Simple option(s)...

[Anonymous Coward]

There is one flaw...they may not know what the message says, but they can still tell WHO you are emailing

Re:Simple option(s)...

[JeanCroix]

Or, we could all go back to writing letters. Oddly enough, that still has more legal protections behind it than any other form of communication.

Well, except for that whole thing about USPS photographing and storing images of every envelope it processes. They've resorted to actually opening and reading them in the past; I don't think, given the current state of affairs, that they're beyond that now.

Re:Simple option(s)...

[Anonymous Coward]

https://www.neomailbox.net/

Neomailbox is a good one. Hosted in Switzerland, also provides VPN services.

They have stronger privacy laws than we do, which helps on the non-technical end.

Re:Simple option(s)...

[Anonymous Coward]

Does anyone have replacement recommendations for people who used these services?

I would say "something hosted outside the US", but as the international banking community has shown, Uncle Sam's jack-booted foot extends well outside our own borders.

So that really leaves "GPG" as you sole realistic option. End to end encryption, with no one but you and the recipient knowing what you wrote. Of course, "they" can compromise either end, but it deprives them of the ability to funnel everything on the wire into their data centers for 4th-amendment violating goodness.

Or, we could all go back to writing letters. Oddly enough, that still has more legal protections behind it than any other form of communication.

This is exactly right. A read (or re-read) of Cryptonomicon should be high on the to-do list of any privacy-inclined individuals.

Re:Simple option(s)...

[Anonymous Coward]

Separate your email identity from yourself. This isn't worth the trouble for most people in the U.S., but would be for people in really oppressive countries. VPN -->TOR-->Webmail account not tied to your name. Use GPG to encrypt the message contents.

Re:Simple option(s)...

[93 Escort Wagon]

Well, except for that whole thing about USPS photographing and storing images of every envelope it processes.

On the plus side - when I lost the most recent Bed, Bath, and Beyond coupon, the NSA helpfully provided another copy to me.

Re:Simple option(s)...

[Type44Q]

Or, we could all go back to writing letters. Oddly enough, that still has more legal protections behind it than any other form of communication.

The entire point of all these [not necessarily so recent] revelations is that legal protections are no protection.

Re:Simple option(s)...

[SuricouRaven]

At this point, I imagine a machine could be devised to read a letter without opening the envelope at all - perhaps some form of MRI machine that detected the layout of the ink. It'd cost millions to develop, but the NSA can afford it.

They probably divert letters to a list of 'suspect' addresses to a scanning facility located hidden away at major sorting offices.

Re:Simple option(s)...

[FictionPimp]

On the upside, if VPN's become illegal there will be less remote workers. This could be a big boon for the IT market as companies scramble to bring IT back in house.

Re:Simple option(s)...

[FictionPimp]

Not to mention all the new connections that will need to be installed as companies have to shutdown their p2p vpns.

Re:Simple option(s)...

[spacepimp]

As an American if it is hosted outside of the US and encrypted, it will be double scrutinized and subject to complete and total surveillance.

Re:Simple option(s)...

[TheGratefulNet]

On the plus side - when I lost the most recent Bed, Bath, and Beyond coupon, the NSA helpfully provided another copy to me.

time to add a new definition to the term bed bugs

Re:Simple option(s)...

[Archangel Michael]

Trade Federation: "Is it Legal"
Senator Palpatine: "I will make it legal"

Legality is the buzzword of tyrants. Almost everything Hitler did was legal. AND he was democratically elected. This is the problem with tyrannies, is they don't usually happen overnight.

And trust me, I have enough (R) and (D) friends to know, that most of these people can agree that the government has too much snooping power. The problem is, they see the other (R) and (D) as the enemy, and those in power like it that way, and keep marching us towards tyranny. But Bread* and Circuses** keeps the masses happy enough to not really change.

*Government handouts are slavery.
**Kardashians and Royal Babies distract us from the "phoney scandals" in a two pronged approach of distractions. It is, however, entertaining!

Re:Simple option(s)...

[pla]

Well, except for that whole thing about USPS photographing and storing images of every envelope it processes.

Funny thing about that, I haven't used a return address on physical mail in years. I always just write the recipient's address in both places, so on the off chance it gets returned instead of delivered - It still gets delivered.

Of course, that wouldn't work well if sending something of actual value to a potentially bad address - But I don't think I've ever sent anything of actual value in the mail - Information I can reproduce, checks I can cancel, letters to Grandma, meh, no big deal if one gets lost every few years.


They've resorted to actually opening and reading them in the past; I don't think, given the current state of affairs, that they're beyond that now.

I actually didn't seriously mean to suggest that we should use snail mail as an alternative to email... More of a throwaway joke. :)

Re:Simple option(s)...

[ArsonSmith]

I tried this, but my mother just started complaining about unreadable junk mail from some random address.

Re:Simple option(s)...

[Richy_T]

There's always the dead-letter-drop option. Encrypt and leave in a public place. They could still trace to a degree but if there's enough noise to signal...

Re:Simple option(s)...

[Richy_T]

This is essentially how freenet works (for various definitions of "work")

Re:Simple option(s)...

[Richy_T]

Very hard to do. Sooner or later they will be able to tie your identity to your email address and then you're done.

Re:Simple option(s)...

[Richy_T]

A kettle costs $10.

Re:Simple option(s)...

[Type44Q]

It is, however, entertaining!

I find it all mind-numbingly inane but I'm weird like that.

Re:Simple option(s)...

[aaaaaaargh!]

Crypto AG with their backdoors are also based in Switzerland. More information.

In a nutshell, you cannot trust such companies unless they open source all their software and make the way they operate very transparent. Even then, you should better think twice to whom you give away your trade secrets.

Re:Simple option(s)...

[SuricouRaven]

I considered the classic kettle, but it runs the risk of leaving some evidence of tampering.

Re:Simple option(s)...

[laxisusous]

I would recommend BitMessage. It is open source and peer2peer. Also the senderID and message are encrypted plus the receiver is completely unknowable. Also the BitMessage wiki has a pretty good breakdown of various other secure messaging services that are also available.

Re:Weird!

[intermodal]

The same thing the Fourth Amendment is for. Keeping out people who have no business reading your mail.

Re:Weird!

[Dr Damage I]

Anyone who thinks their private communications should be just that... private

Re:Weird!

[MathFox]

The customers of the company I work for do not like it when their blueprints are publicly available. Would you like to have your code and documentation searched by gmail to show ads? (What information do these ads leak to the company that pays for it?)
And any "alien" Amazon, Microsoft, Yahoo or Google cloud data is up for collection by the NSA. Sounds like a good reason to encrypt at least some of your mail.

Distributed Mail

[barlevg]

To me, the takeaway message from all of this is that, if you value privacy above all else in your email exchanges, you can't trust a company, because either they'll sell you up the river for a song, or they'll shutter themselves to avoid government pressure. So here's my question: why don't more people simply run their own mail servers? It's certainly not difficult. There are a few problems, of course, namely, needing an always-on computer, sorting out the issue of dynamic IP (dyndns is a great, free solution), and the issue of small mail servers flagging spam blacklists. I also seem to remember various residential ISPs (like Comcast) having running a mail server be against their TOS, but I can't find anything to back that up, so I might be remembering incorrectly. In any case, none of these problems are insurmountable, and I really wonder if this is the solution for the privacy-paranoid among us.

Re:Distributed Mail

[ahadsell]

The issue that Silent Circle points out is that SMTP is inherently unable to provide security against traffic analysis. Even if the body of the email is encrypted, the headers cannot be.

So yes, you can run your own email server, and require that only gpg traffic pass through it. But that won't keep you secure against traffic analysis (aka "metadata collection") with collection performed at your ISP.

Re:Distributed Mail

[BaronAaron]

Running a mail server from home is near impossible on most ISPs. The majority of ISPs block incoming traffic, and in some cases even outgoing traffic, on port 25 (SMTP). Even if you can get around this using alternate ports, chances are your ISPs IP range is blanket blacklisted by most anti-spam lists.

Your best bet for privacy and control of your e-mail would be to setup a collocated or rented server. You'll have to configure some sort of encryption for your e-mail messages in case the data center gets raided and the servers/hard drives confiscated.

In the end, your SMTP traffic can still be sniffed acrossed the network anyway, since most SMTP traffic is unencrypted.

Re:Distributed Mail

[Bigbutt]

Not only that, many _other_ ISPs won't send mail to mail servers located in comcast space or accept mail coming from comcast space. It's why I set up my own colocated server. The problem with that is all the difficulties dealing with such a system including spam and attackers.

The last time I checked I was getting a bit over a million ssh break in attempts each month. I eventually blocked all of Taiwan at my firewall due to the majority of attempts coming from their address space.

The other issue is with the colocated site address space. Since I have no control over the other addresses they host, DNS blacklist sites that blacklist IP ranges prevent mail from my mail server from being delivered. There are some sites that will let me communicate with their NOC and get put on a white list but there are others, like shaw.ca, that have no way to communicate with them to get off their list. They want me to contact the DNS blackhole sites they use but the DNS blackhole site has no way to get off their list (it's been a while, I remember shaw.ca).

And Microsoft sucks. They have my server blocked with no way to clear it however I can pay a fee to Microsoft to open up my server to Hotmail (for example) so I can send advertising. And on the funny side, Microsoft only blocks me about 50% of the time.

[John]

Re:Distributed Mail

[Hatta]

Most ISPs block port 25 because of spam. Most customers of ISPs can't be trusted not to leave their mail server as an open relay.

What you want to do is use GPG on top of email (or any other text medium, USENET, web forums, whatever) or use something like Retroshare. To be honest, plain old email needs to go the way of Telnet.

Re:Distributed Mail

[JesseMcDonald]

... SMTP is inherently unable to provide security against traffic analysis. Even if the body of the email is encrypted, the headers cannot be.

I2P-Bote is one alternative, an experimental distributed e-mail system which addresses the header issue. It's implemented as a distributed hash table with connectivity through I2P. The design allows senders and receivers to remain anonymous, in addition to encrypting the content of the messages.

Re:Distributed Mail

[barlevg]

It's not just Comcast IPs. No matter how many times I corrected Gmail, it never stopped marking emails sent from my university research computer (namely notifications that a job had completed) as spam.

Re:Distributed Mail

[chihowa]

With the use of SMTP over TLS (which is almost universally supported by MTAs), and assuming that a MitM attack isn't occurring, the ISP shouldn't be able to get any metadata from the email headers (they're encrypted, too). The most that they'll get is that one IP address connected to another IP address on port 25 (which is metadata, too, but not as specific as email headers).

Looking at my logs, SMTP over TLS is almost universally deployed, too, so I don't understand this particular argument. The endpoints are still vulnerable, which is what they should be concerned about (what with them being a "trusted" endpoint and all). Why are they complaining about SMTP?

Encrypted

[DeBaas]

The company announced that it could 'see the writing on the wall'

They were however not able to read it.....

Re:Encrypted

[the_B0fh]

How old were you when you had your funny bone surgically removed?

Re:Weird!

[JeffreyHornby]

political types who don't want their election strategies sent to the their opposition because someone at the NSA supports the other political party. political dissidents in "friendly" countries like Saudi Arabia who would be turned over at the drop of a hat. people who are negotiating contracts with the government and don't want their negotiating strategies revealed. whistleblowers.

Penet.fi all over again...

[Moskit]

Just this time it's not Scientology sect, but governments.

http://en.wikipedia.org/wiki/Penet_remailer

The only lesson learned is that there is no such thing as fully anonymous email service, it's always just a certain degree, especially when it comes to USA power play.

Pigeons!

[schneidafunk]

Encrypted messages sent by pigeon carriers worked in the past!

Re:Weird!

[Anonymous Coward]

So i guess, you didn't use envelopes for your mail before email?
Why use clothes even? What do you have to hide?
Why whisper?

That's right... it's called privacy.

NSL order to not reveal NSLs

[KiloByte]

I don't think Silent Circle would commit an effective suicide just preventively. Lavabit, while technically not saying a word about NSLs, told us very clearly what the request was. If the government criminals are not idiots, they learned and worded the Silent Circle order in a way that prevented such disclosure.

Re:NSL order to not reveal NSLs

[Anonymous Coward]

From the article:

"We have not received subpoenas, warrants, security letters, or anything else by any government, and this is why we are acting now"

Re:NSL order to not reveal NSLs

[Anonymous Coward]

PRZ already has been in the government sights (suspected ITAR violations of PGP). I can understand why he is leery.

Of course, there is Hushmail which is still around. It isn't perfect (they had to comply with an Interpol order and hand over stuff), but it is probably the best bet and is pretty sound.

Re:NSL order to not reveal NSLs

[davecb]

Phil Zimmerman, one of the Silent Circle founders, has a history of fighting back publicly. See also https://en.wikipedia.org/wiki/Phil_Zimmermann I therefor suspect he is telling the truth.

In addition, orders to not disclose the existence of orders have been found unenforcable in common-law jurisdictions.

--dave

Re:Weird!

[Desler]

It's for the same reason why you lock your front door and put blinds on your windows.

What the heck is going on?

[bickerdyke]

What the heck is going on over there?

Do you really have running governmant agents around closing shops at will?

That's not a good sign.

Re:What the heck is going on?

[gmuslera]

Both Lavabit and Silent Circle closed by their own will. What government agents did, or will do, is to force all secure mail providers to give them a backdoor for them to access all that "secure" mail (or else put them in prison). So, for that reason, will not be any secure/private mail in US, if someone claims that do, or is lying already or soon will face the choice to lie to its customers or close.

Re:Weird!

[Anonymous Coward]

So what'd be "encrypted email" for?

It's like the envelope in snail mail. You put your mail in an envelope to protect it until it arrives at its destination, don't you? Encryption accomplishes the same thing for e-mail.

Comcast and Mail Servers

[barlevg]

Found it!

Under "Technical Restrictions," they list

use or run dedicated, stand-alone equipment or servers from the Premises that provide network content or any other services to anyone outside of your Premises local area network (“Premises LAN”), also commonly referred to as public services or servers. Examples of prohibited equipment and servers include, but are not limited to, email, web hosting, file sharing, and proxy services and servers

However, I don't think they go to the trouble of enforcing this very often.

Re:Comcast and Mail Servers

[CanHasDIY]

Found it!

Under "Technical Restrictions," they list

use or run dedicated, stand-alone equipment or servers from the Premises that provide network
content or any other services to anyone outside of your Premises local area network (“Premises
LAN”), also commonly referred to as public services or servers. Examples of prohibited
equipment and servers include, but are not limited to, email, web hosting, file sharing, and proxy
services and servers

However, I don't think they go to the trouble of enforcing this very often.

They will, if enough people start running their own mail servers.

Re:Comcast and Mail Servers

[archer, the]

The Comcast quote says "public services". If I have a mail server that only has accounts for my family living at this residence, I'm not providing "services to anyone outside of [my] Premises local area network". Wouldn't that be an allowed server?

Of course, Comcast could change the contract without me having any say in the matter.

Re:Comcast and Mail Servers

[barlevg]

Presumably you might want to access your mail via webmail, in which case you're off-LAN. Interestingly this seems to forbid me from SSHing into my home computer from the outside world.

Re:Comcast and Mail Servers

[thaylin]

This does not stop it. You just cant give access to anyone outside your network. If the server is just for your personal email you are good.

Re:Comcast and Mail Servers

[Archangel Michael]

Every stand alone Email Client is an SMTP server, with limited relay capability. YOU can use a SMTP server on Comcast network, just not a "public one".

Set up your own domain, with your own SMTP server, is perfectly within the guidelines you just quoted. Key phrase "anyone outside of your premises".

Hype or Reallity?

[Ronin Developer]

Okay, playing devil's advocate here.

LavaBit shuts down "citing" pressure they have received from gov't agencies. No evidence is provided to indicate that reason behind the shutdown...just they guy's word.

Given how everybody is rallying against the gov't at this time - could this actually just be an action of protest rather than a true, official, take-down? Everybody will just assume that the gov't forced the take down "just because". Who would be the wiser? Right? Makes their point, right?

Now, we have Silent Circle shutting down because they "see the writing on the wall". What writing, is that, exactly? Certainly, if they (or LavaBit) have a take down notice but can't share it to confirm the take down...we really don't have proof of their motivations do we? So, trusting souls that we are, we have to assume their motivations are real and not hype for political or protest purposes.

Just say'n.

Re:Hype or Reallity?

[Anonymous Coward]

Okay, playing devil's advocate here.

LavaBit shuts down "citing" pressure they have received from gov't agencies. No evidence is provided to indicate that reason behind the shutdown...just they guy's word.

Given how everybody is rallying against the gov't at this time - could this actually just be an action of protest rather than a true, official, take-down? Everybody will just assume that the gov't forced the take down "just because". Who would be the wiser? Right? Makes their point, right?

Now, we have Silent Circle shutting down because they "see the writing on the wall". What writing, is that, exactly? Certainly, if they (or LavaBit) have a take down notice but can't share it to confirm the take down...we really don't have proof of their motivations do we? So, trusting souls that we are, we have to assume their motivations are real and not hype for political or protest purposes.

Just say'n.

Yes, I'm certain you're right. These companies and individuals who have literally spent years standing up their businesses to finally be able to turn a profit are shutting them all back down again, forcing their employees into the unemployment line, and all without any hint of duress from the government, just to make a statement.

Please feel free to pull your head out of your ass and sign up for the next Econ 101 class. I promise you this wasn't in the fucking business plan.

Re:Hype or Reallity?

[gmuslera]

The government wanted them to be open, but with a backdoor, not closed. And the enforcing of that backdoor was, for the case of Lavabit, giving them the chance to go to jail for helping Snowden or put their backdoor.

The crazy times

[jovius]

Security investigations lead to closures of secure services.

Citizen...

[wbr1]

Does anyone have replacement recommendations for people who used these services?

Citizen, we welcome you to use the new service at secure.nsamail.com. This will ensure that no terrorists, paedophiles, or drug dealiers co-opt your email account for their nefarious purposes.

Thank you for your cooperation.

Re:Citizen...

[wbr1]

In addition, if you are one of the first 100,000 to sign up, we will give you an expedited TSA search pass to use when you travel. (Good for a single one-way trip only, limit one per citizen.)

Re:Citizen...

[Anonymous Coward]

Oh man, such a badly disguised version of Paranoia (the RPG) I have never seen!

Re:Citizen...

[thaylin]

In addition, if you are one of the first 100,000 to sign up, we will give you an expedited TSA search pass to use when you travel. (Good for a single one-way trip only, limit one per citizen.)

To a location of the governments choosing, some place with a federal pen.

Re:Citizen...

[number11]

I've yet to see the NSA leak mail.

Just because they won't let you see it doesn't mean that it doesn't happen. For example, when they pass along mail to the DEA, who then lies to courts about where they got it.

Re:Citizen...

[lxs]

NSA: Safe and secure communications. Just don't send any Powerpoint slides. We lose them by the dozen.

Re:American Dissonance

[Anonymous Coward]

I could start by spelling dissidence correctly.

Open WhisperSystems

[Anonymous Coward]

Open WhisperSystems (https://whispersystems.org) doesn't have encrypted e-mail, however they do have Android-based encrypted phone (RedPhone) and text (TextSecure) capabilities. They are working on iPhone releases in the near future of their products. Btw, all of it is open source and they DO release the source code as well.

Re:Were they contacted?

[Captain Hook]

Who wants to bet that they were just or already contacted by the US government like Lavabit, and ommitted that from their closing explanation for legal reasons?

Their statement about closing the service specifically said they hadn't been contacted so if they have been contacted then they didn't just make an ommission it would have been an outright lie.

Because Lavabit has been officially contacted they can't destroy any data, they can shutup shop to prevent anyone else falling into the net which is what they have done but for anyone who have already used the service and have any data already on the Lavabit servers, it's just a matter of time before their data is decrypted one way or another..

I suspect that Silent Circle are shutting up shop before any warrents arrives, that means that it's completely legal for them to destroy any and all data they have. I wouldn't be surprised if the data is already wiped at a software level and the hardware destruction is either in progress or getting planned.

Re:Weird!

[DizTorDed]

With that in mind, why do we put mail in lined envelopes? People do not seem to remember that email is sent plain text. Can be read by anyone. If you do not care who reads it, then why just have one recipient? CC everyone? CC the NSA and CIA? The conversation I share with people is not sensitive, not dangerous, does not contain anything that would cost a person their life. That conversation though, is between the person and myself. I feel uneasy using email due to this reason.

Re:Weird!

[jeffmeden]

The customers of the company I work for do not like it when their blueprints are publicly available. Would you like to have your code and documentation searched by gmail to show ads? (What information do these ads leak to the company that pays for it?)
And any "alien" Amazon, Microsoft, Yahoo or Google cloud data is up for collection by the NSA. Sounds like a good reason to encrypt at least some of your mail.

Using SMTP to transmit that kind of info in the clear is a bad idea, even if the endpoints are credible. Interception is your biggest risk if you are two known parties trading in proprietary information, and probably doing so to/from fixed geographic locations as well. Why not encrypt the payload to guard against this?

What an encrypted email service does is different, they offer a quasi-anonymous way for people to send/receive email so that they can accept messages from unknown parties and trust that the contents will be a secret (if they arrived without being snooped). A person in Snowden's position is attracted to this because he can trade emails with otherwise uninvolved persons (who wouldn't necessarily be subject to scrutiny by the feds or "evil corp X") and the only real "link" between any of those parties is heavily encrypted on the server (and the provider doesnt even hold the keys) unless a snooper gets really lucky and intercepts enough of them to put the pieces together.

Re:Or...

[CanHasDIY]

Does anyone have replacement recommendations for the NSA?

A rotting stump.

Re:Weird!

[gmuslera]

What you read, how you live, with who, etc, is your privacy. What you write, in the other hand, is intellectual property, is that is what is being examined for you and the rest of the world before even is finished/patented/protected. And won't be surprised if this is used to capture that, you could be discussing the next billon dollars next idea with someone, that communication be intercepted and end that idea patented before you can by some corporation "close" to the government.

Pyrate saying:

[vm146j2]

Anything known by more than one person is no secret!

Arrrgh!

Re:Take action

[CanHasDIY]

Stop making excuses and justifications for this behavior by "elected" leaders. Pack your bags, gather your family, take your intelligence and talent (and savings - while you can!) - and leave this sorry ass country behind. Go somewhere and create a new life where you will be respected and appreciated. Don't think such a place exists? Get a passport...and then look forward to dumping it for a new and improved one in the future.

Or we could, you know, not be a bunch of chickenshits, and actually stand the fuck up for ourselves. Well, OK, maybe not a cut-and-run pussy like yourself, but the rest of us...

Seriously, guys, the only reason they get away with this kind of shit is because we let them, and we let them because we're too busy either looking for an exit like this asshole, or arguing with each other about trivial nonsense.

You want to effect change? Just stand up. That's it - Just. Stand. Up.

Remember when the press covered stuff like this?

[Kohath]

Does anyone remember when the press covered stuff like this? Before 2009, the Lavabit shutdown would have been national news. Everyone would have known the name of Lavabit's owner.

His name is Ladar Levison.

distributed encrypted p2p email system

[Janek Kozicki]

Lavabit and silent circle inspired me to think about some kind of peer to peer distributed email system.

Although currently everyone can install an email server (e.g. there are several available in debian). It is not what would solve the problem. Not just because it requires technical expertise, but also because it requires too much dedication on your side to maintain your freshly installed server. Also to make sure it has outside access with SMTP port, and so on. Not mentioning that it needs about 100% uptime. Such solution is too much centralized.

I was thinking about p2p email more like this one which I googled right after I had this initial idea. This is a proof of concept so it can work.

Key features would be:
1) uses p2p distributed encrypted file system, like tahoe
2) each p2p node can act as email receiver/sender
3) to send email to someone you use nick@1.2.3.4 where 1.2.3.4 is any IP that is running p2pemail. Simplest would be 127.0.0.1 if you just run a p2pemail node yourself.
4) everyone can have p2pemail account, just connect via https to nearest p2pemail node. It can be running on your computer or anywhere else. Doesn't matter. This just requires setting up an account name on your side, and a lenghty password, which is also used as a sha256 seed for private key for encryption of your emails and also as a PGP signature for you emails.
5) PGP signing emails would be so easy, that it would be a new standard.
6) all encryption and decryption is done locally on your computer either in javascript or in your email client. Just make sure that your browser and computer are not compromised.
7) if any of p2pemail nodes are running compromised code (eg. like compromised tor nodes) they still cannot read your email, because they have no acces to your private key. The only hope they can have is to monitor when you are accessing your data, but only if a request to the compromised node is made.
8) even if huge NSA datacenter decided to store all p2pemail data, they still cannot read it, and have nobody to file a warrant to.

If we combined that with bitcoins we would get additional (optional) features:
9) buy storage with bitcoins, while buying decide how many copies of your data you want to have (can change this anytime later). Offer any price you want, lower bids might not be taken.
10) provide encrypted storage space and get paid. If you store multiple copies of same data (might be possible before p2pemail gets popular) ensure that at least it is on different physical locations, otherwise you might be compromising security
11) create whitelists with people from whom you want to receive email, add mandatory bitcoin fees if anyone not on the whitelist wants to send you email.
12) You can create various stages if whitelisting, depending on domains you can define different prices to receive email. Or you can say that first email is free for everyone, and each next will be paid or not depending on if you received spam. Or configure spamassasin to decide for you.

PROBLEM: where do my friends send email to?
ANSWER: your_nick@p2pemail.org/net/com/info (we need to register many domains, and use many IPs to resolve those dns-es)

PROBLEM: Will my address still be the same after long time?
ANSWER: your nick in p2pemail will be the same, tell your friends that if they cant send email (eg. govt seized all p2pemail domain names), then they have to find some p2pemail node. Google it, or install one themselves. If they can't do that, you can solve this by installing a node yourself, and making sure it has the same domain name all the time. Services like dyndns can help you with that.

well maybe that's just a pipe dream. But the proof of concept implementation that I linked above gives some hope. What do you think?

Re:distributed encrypted p2p email system

[Esion Modnar]

Could something be done using TOR? If web servers can be setup on TOR, why not mail servers? Forgive me, but I barely know enough about TOR to spell it.

Re:distributed encrypted p2p email system

[Janek Kozicki]

Running p2pemail node behind TOR would simply add an extra (and welcome) layer of security.

Running classical email server (like squirrelmail or something that gmail/hotmail/yahoo uses) behind TOR would make it complicated (if not outright impossible) for users to access.

Re:distributed encrypted p2p email system

[Hatta]

Look into Retroshare. It provides end to end encrypted communications, with analogs to email, IM, forums, status feeds, with file sharing and VOIP too.

Re:distributed encrypted p2p email system

[Janek Kozicki]

But if I make a retroshare account, can people from outside send email to my retroshare account? This is the kind of integration that is needed for breakthrough. Because this will allow more and more people to switch seamlessly to retroshare, without cutting out people who didn't switch yet.

Re:distributed encrypted p2p email system

[IamTheRealMike]

Check out Pond, by Adam Langley. It's Tor based secure end to end mail with a variety of interesting tricks, done by a real cryptographer (one of the people who upgraded OpenSSL to support forward secrecy, and then upgraded Google to use it).

Re:distributed encrypted p2p email system

[AlienSexist]

Interesting idea for sure. But wasn't one of the purported aspects of the NSA snooping the collection of metadata? So even if the messages are encrypted, a compromised node will still have the routing information, or how else could it relay? That metadata is useful on its own. I realize that nothing can be a perfect solution, but your idea definitely addresses encryption and decentralization.

Re:distributed encrypted p2p email system

[kruhft]

bitmessage

Re:distributed encrypted p2p email system

[Janek Kozicki]

I looked briefly at retroshare. One thing I couldn't find (quickly) and maybe you know the answer.

Since it has internal email (and forum) system - how those emails (and forums) are stored? Is that a distributed p2p filesystem?

best regards

Re:distributed encrypted p2p email system

[Richy_T]

This is like suggesting that SSH should take telnet connections for backwards compatibility.

Re:distributed encrypted p2p email system

[Hatta]

Yes, all the correspondance is shared with everyone in an encrypted container, and you only read what your key can decrypt. This will have scaling problems, but if retroshare gets big enough that that's a problem, that's a big success.

Re:distributed encrypted p2p email system

[Janek Kozicki]

Not exactly, email is wildly popular, while telnet was never so popular.

I think that it should be possible to write some kind of retroshare email gateway which would accept email from outside. But internally in order to be compatible with the rest of retroshare network people who want to receive emails from outside would need to befriend such gateway. I suppose that such retroshare gateways could have multiple identities, so that people could befriend all currently running gateways (a shared identity), without chosing a particular one. Or could jut befriend selected ones.

Now if such gateway code gets implemented into retroshare itself, so that each retroshare node can act as an email gateway we almost have what I was talking about in OP. In order to not compromise any security people will have to chose what gateways to befriend, and it doesn't even matter that their running node is such a gateway if it hasn't been befriended.

Well - yes - email can be snooped and read before they reach the trusted & encrypted retroshare network. But in fact the same problem would happen in what I described in OP. Before email reaches p2pemail node is not proteced by any kind of security, especially if it travels in plaintext. But in order to get people to switch we need this backward compatibility.

Inside retroshare network people could have two identities - one trusted which cannot befriend email gateways, and another which would be used for contacts with the outside world. Once one of your friends joins retroshare, you give him your trusted identity, so that he will not have to send email to the untrusted one anymore. Only the untrusted one will be the one that receives spam, unless we use some kind of "pay-to-deliver" e.g. with bitcoins + whitelisting.

Re:distributed encrypted p2p email system

[chihowa]

From the site linked:

Dear God, please don't use Pond for anything real yet. I've hammered out nearly 20K lines of code that have never been reviewed. There are no binaries here for a good reason. Unless you're looking to experiment you should go use something that actually works.

Just FYI. Good encryption is not easy to do correctly. Join the project and help him out, but heed his warning if you need something that has been vetted and is thought to be actually secure.

Re:distributed encrypted p2p email system

[Janek Kozicki]

I just found http://en.wikipedia.org/wiki/I2P this one and the email system I2P-Bote look quite promising.

My Suggestion

[Spottywot]

I'm on the verge of installing this Enigmail addon for Thunderbird, however as Thunderbird still uses my web based mail provider it will still show who it's too and from etc, does anyone know of a completely peer to peer e-mail system which could get around this?

GPG Messages On Public Forums

[Greyfox]

Just post your GPG messages on public forums! The recipients can pick up all messages on a variety of forums and try to decrypt them. Anything that actually decrypts is for them! Bonus: No telling who they're to if you do that. With a little work it could be anywhere from pretty hard to pretty much impossible to tell who they're from either!

Re:GPG Messages On Public Forums

[PReDiToR]

I see one problem with that.

-----BEGIN PGP MESSAGE-----
Version: GnuPG v2.0.17 (MingW32)

hQIMA9r02fcNIfpbARAAnr7Dw4hNFZHBe2BKfQsRBMxCmXqme2PMZMUbD8tiWijY
klNtfywXEhWQePnjBfxE6M7C2ukVNGFEGFrWym6Cpc9CGLQ+tBORm+hXRHdSkV7V
wwl5oYsFsvtWyxjLS/0EPYXuD1rhBnI58CvM4gNnZ5za7B5+uTgwiqdS7QcUjoMQ
y/qptV9MnDubbTwS6IouEoHRdq3fsjJFLLYCWsCrcuzHRFCmTeACR4ejGYtd/C3B
5T82susPWS1f89bYG1kLFiLLbicO9bg3ZRyKhEufjVfTrj+QQbOCXIQ50P3XHbz4
Qv1x3qmqd713dGjeVJQ8ndUCrR+c4e/1lpZP6lkX/qtpL9jW/tGjJ6PGXmH+4Zgv
j7AqbS6vo4VlSjBsfpmOy3uqJQP7P5FBVf6L0KUdmFAV9GwvnpxfacBh3No0/Pwx
sUCUUkxfJx1fcW6Bs1oG68Od5b6SWHxXRBaeshShr+zS3sSH8vRYWmoKDxcmgQp0
wl9ujghdp0z6fcHj70Wt8cvr+FvvjbGkZCjJ5rJauC0oExA0qdkB+v1qRe4AY2er
IhkRpYh3jlQTUKKJn38u5nWOuh1KqoC7CVXMXyY7IwJDY1dR0vUvUrl0S2Rlm+qK
PhsRINB8Rg8ens3DIU42yBkI2HOxCCfrwavftQISZUB+SNvHbmShHvABFK3eYu/S
jAG1Czt19cXPzcJgmzpW54qlc+AqdglY8gJmHKxlGJRbue6a5CO7b+r3zo/Z86o/
bA/dLz1YSryPfjyWkph0vZP0EK3JJUVfpt+0jQp4ZAJF2Xw67bl9EFrTdMfs1moG
I1q9GT7UC+0iIQu3etaeUgBE8NFUt9JUIlKOpQPMS0m1obp2sjeaFkZs5QnR
=RcFx
-----END PGP MESSAGE-----

Re:GPG Messages On Public Forums

[PPH]

That will work. Right up to where law enforcement says anyone posting/downloading encrypted content from such forums is dealing in child porn. Guilty unless you prove your innocence.

Re:GPG Messages On Public Forums

[J'raxis]

Not a bad idea. This is similar to the anonymity system used by Bitcoin---all the transactions are completely out in the open, posted to this one big file called the "block chain," but also encrypted. Each user has a wallet containing the private keys that identify the Bitcoin transactions that were for them.

One problem with this though is the eventual amount of data involved. For your method to be effective at protecting people, it would have to be used by more than a few dozen people---hundreds or thousands, so each individual gets "lost in the crowd." But then we're talking about a datastore even bigger than the Bitcoin blockchain, which is already multiple GiBs.

Re:GPG Messages On Public Forums

[chill]

Yeah, the problem is when I click on your name and go to your Slashdot profile you forgot to post your public key in your bio.

You DID know Slashdot allows that, right? Right below the box where you have your sig is one for your public key.

Re:Weird!

[Lothsahn]

This is the reason why the fourth and fifth amendments exist. The fourth/fifth amendments does not exist for the purpose of protecting criminals. The fourth/fith amendments exist to protect innocent citizens from otherwise accidentally incriminating themselves. If it's extremely dangerous (and often incriminating) to speak to the police for a few hours in an interrogation, imagine what the police could do with years worth of email conversation.

This is how it works:
1) The government suspects you of a crime (rightly or wrongly)
2) The government looks up your email history to try to find something with which to convict or embarass you (do you honestly think that if you have years of email conversations that there's not SOMETHING in there that could do this?)
3) The government uses that as leverage against you

Remember, most people "don't have anything to hide", and therefore don't care that much about their privacy. The problem is that most Americans commit 3 felonies a day, and therefore, by definition do have something to hide, even IF they've done nothing wrong intentionally.

If you think it can't happen to you, think again. They searched for years and eventually found something to prosecute him with.

Seriously, watch the first video. 15 minutes now could very well save you from a life of jail, if the police come knocking.

what's happening

[rlwhite]

It appears that what is happening is that the government is applying pressure to anyone who enables communication in a way where the government cannot detect who is talking to whom. This is a logical extension of the methods that Snowden leaked. He showed that they already have full coverage of the metadata of phone calls, texts, emails, and webpage views routed through the US. The leaks have pressured the US to close the loops. This is a very dangerous threat to our Constitutional rights. Secrecy does not equal guilt, and our founders went to great lengths to enshrine that principle in our Bill of Rights.

Alternative

[siralucard]

mailpile

Re:Remember when the press covered stuff like this

[safetyinnumbers]

Does anyone remember when the press covered stuff like this?

It was second from the top on http://www.bbc.co.uk/news/ this morning:
http://www.bbc.co.uk/news/world-us-canada-23627656

Security agencies blemish our view of government

[Jameson Burt]

Continuing revelations about U.S. security agencies (torture, forbidding free speech, spying on their citizens, promoting specific denominations of Christianity) blemishes all other government agencies (Commerce, Agriculture, Education). We envision these other benign government agencies' surveys spying on us, maybe even sharing information with government security agencies. Does U.S. extensive security represent a new necessity, obsessive employees, employees seeking promotions, or a cowardly and impotent population.

A recommendation for those seeking privacy

[jekk]

> Does anyone have replacement recommendations for people who used these services?

For those from outside the US, your best bet is probably to use small, local players who might not yet have had pressure applied to them. For those inside the US, I have one recommendation: run for Congress.

Re:A recommendation for those seeking privacy

[MrThreadThat]

I am a developer/owner of one of these "small local players". I provide ThreadThat dot com for free. I hope it helps some of those kicked off Lavabit.

Re:Weird!

[intermodal]

Yes, exactly. In today's world, everyone is probably a felon and doesn't even realize it. That's exactly why it behoves us all to jealously guard our privacy, even when we shouldn't have to. It's not paranoia, it's simple prudence. I don't lock my doors because I think I'll be robbed. I lock my doors because I'd be foolish not to.

Blackberry as alternative?

[Esion Modnar]

I understand that the Blackberry network is encrypted, and their servers are in Canada. Of course, what's the likelihood that Blackberry (via the Canadian government cooperating with the US) has already been sharing stuff? At least its not in the US.

Re:Blackberry as alternative?

[J'raxis]

The likelihood is about 100%.

As seen on Slashdot. And if they're helping a much less powerful and reaching government than the U.S., what do you think the odds are of them helping the U.S. too?

Re:Weird!

[whoever57]

People do not seem to remember that email is sent plain text. Can be read by anyone.

Perhaps your email is, but I use technologies like smtp-tls, encrypted imap sessions, etc., so much of my email is encrypted in transit and it can only be read at the endpoints.

startmail?

[jason777]

I don't know a lot about it, but the owner of startpage is forming startmail for private mail...probably similar to these guys. I wonder if startmail is going to face the same problem? From what I understand, the government basically comes in an puts a rack server in your rack, and the server basically listens to all the traffic, and send it back. Totally unconstitutional, and you cant deny them to do this. That's why lavabit just said no and turned their service off.

Re:Weird!

[camperdave]

I put blinds on the window to keep the sunlight out.

Re:Weird!

[SuricouRaven]

Can happen, has happened.

I can't find any name now, but there was an incident many years ago when police in the US charged a man with possession of child pornography after an internet investigation lead to his IP address. It turned out to be a mistake on their part - when the family were eventually able to get an independent examination of their computer (Which itsself took months, as the prosecution considered it evidence and refused to permit access) it was found to be infected with a trojan that was responsible for relaying the images around the internet. It was very embarrassing for the prosecutors - but during the investigation they noticed that the accused, while in high school, had once shown a Playboy issue to a friend. So they offered him a plea: They'd drop the possession of child pornography charge if he instead confessed to the lesser charge of 'distributing pornography to a minor' and registered as a sex offender. IIRC, he eventually got off by taking his story to the media - even had the story shown on a TV program (50-50?) about overzealous prosecutors, and all charges were drops to quell public outrage.

I can't find a name now though, because all google gives me is page after page after page of false results - a mixture of people discussing 'sexting' and news stories on unrelated events.

Re:we the people need anonymous p2p communication

[J'raxis]

BitMessage and TOR are outside anyone's control. (Before you say it, the recent attack on TOR was not an attack on TOR but on a single, centralized hosting provider for TOR websites.)

Re:Weird!

[Seumas]

Last time we brought this up on here, some jagoff went berzerk about how he was a respectable family man with a job who had never committed a felony blah blah blah.

The government and public education system has already won the war on the Bill of Rights by confusing and corrupting what they mean and what they're for in the minds of those they've churned out into society.

Re:Remember when the press covered stuff like this

[Kohath]

Remember when the press in the USA covered stuff like this?

SEAL Protection

[Lincolnshire Poacher]

What, you mean that boasting about two former SEALs on your board doesn't protect my data? I am shocked! Can't they go all Chuck Norris on the NSLs?

Founders and Leadership

Re:Weird!

[bobbied]

So what'd be "encrypted email" for? Horny partners? Surprise birthday parties? I am really curious what they think about it.

Really? You do understand that 99.9% of email traffic is sent unencrypted over the internet. Everybody that handles network packets transporting E-mail can easily capture them and read them. This is roughly equivalent to everybody being forced to use post cards instead of envelopes. Imagine trying to do business on post cards only? You would not want to send bills and checks as post cards.

So encrypted E-mail is equivalent to sending letters in opaque envelopes (roughly) With all the same security advantages over post cards. So in that way you can have a certain level of security in your communications.

Re:Weird!

[iONiUM]

All the comments on that book about "3 felonies a day" say:

... This is the first sentence of the book description. It's the most exciting concept in the book. I wanted to know what felonies "I" was committing. However, I am not out in the woods gathering shell casings from federal land, politicking my way through life, doctoring or practicing law. Where is the chapter on the common man?...

You can find more there, but in essence, there is no mention of what 3 felonies the "common man" is doing per day. Is there any? Is this not FUD?

Don't get me wrong, I think everyone should have privacy, and we do have "stuff" to hide, but I also believe in the truth, and it would seem you, and that book, are spreading FUD.

Re:Weird!

[interkin3tic]

Drug deals, illegal porn, some endangered species poaching, human hunting, but most of it is paranoid nerds talking about bitcoins.

I mean... uh... I have no idea. I don't work for the NSA. I'd have to tell you if I did, and I don't.

Re:Weird!

[Dishevel]

I love that video.

Re:Weird!

[bruce_the_loon]

TLS and encrypted IMAP protect the path, not the content. Only if you deliver directly to and receive directly from the other endpoint is there known protection. Any relay in the system might not store the message encrypted on disk and might not relay on with TLS.

Encryption of the body itself is the only real way to protect the message completely. And that shouldn't need a third party like Lavabit or Silent Circle to do as it is a mail client function.

TOR email?

[duke_cheetah2003]

Does TOR have a facility for email? That would seem to be a good place to get away from snooping.

Yes I know TOR was attacked recently, but I think the network is still the 'best deal in town.'

All one needs to do is setup some kind of email system that works with .onion domains within the network and a high redelivery time so sites that bounce on and off line can still receive email. Could all be done with SMTP modified (and simplified for end-users to run a SMTP host within TOR) specifically to operate with .onion host names.

Maybe I'll look into putting something together, can't be too hard and in theory to me would address the need for truly private email exchanging.

Re:Weird!

[Anonymous Coward]

If later I say "I shut down the service not to help terrorists, as my service was meant only for horny partners and surprise birthday parties, not to really get un-snoopable communication", then I show everyone I am an incompetent and a simpleton.

Silent Circle and Lavabit are not shutting down because they do not want to help terrorists, they are shutting down because they do not want to be complicit in the violation of their customer's rights by the United States government. These companies would rather stop existing than to be compelled participate in an illegal monitoring program.

Lavabit Statement: "I have been forced to make a difficult decision: to become complicit in crimes against the American people or walk away from nearly ten years of hard work by shutting down Lavabit."

Silent Circle Statement: "We see the writing the wall, and we have decided that it is best for us to shut down Silent Mail now. We have not received subpoenas, warrants, security letters, or anything else by any government, and this is why we are acting now. "

Re:American Dissonance

[Esion Modnar]

I think he was trying to spell distance. American Distance. Our encrypted email servers need some distance from America.

Re:Weird!

[intermodal]

That's precisely why, in today's society, exercising one's basic, constitutionally protected civil rights is called "probable cause".

If you have nothing to hide ...

[gstoddart]

If you have nothing to hide, you have nothing to fear. Freedom is Slavery. The government is here to help.

It sounds like we're trending towards not being allowed to encrypt our own stuff because that automatically means we're doing something shady. There's all sorts of reasons I might want to encrypt information that have nothing at all to do with American national security.

Hopefully some non-American company will step up to the plate and give us this, and we can send a big "Fuck You" to the NSA that says we'll encrypt if we want to, and you can eat shit. My rights aren't defined by your security interests.

Sorry, but the rest of the world doesn't give a crap about what you want, and want to retain our privacy without having to cede it to the US government.

Thanks America, you've now essentially broken the internet, and are only going to make computing less secure for all of us. Welcome to the new world, where industry and government demands full control over technology in order to enforce their will on us.

All true

[Anonymous Coward]

This is all true, except I can't find any historical references to protest and demands, actually working. The only evidence I have ever seen things change was under some kind of war or similar military action.

Watergate might have been an exception, but that was the Washington Post, that ws not under government control, nor the rest of the press. Today, the mainstream media is under most control of the NWO. Obama gave an interview to Amazon, and guess what they just bought? The Washington Post.

Re:Weird!

[gstoddart]

So what'd be "encrypted email" for? Horny partners? Surprise birthday parties?

Who gives a damn?

I see no reason to defend the situations in which I could choose to encrypt something. I am not going to open my stuff up to you so that I can prove I'm not a terrorist unless you have something to suggest that I am. That's not how it works in a free society.

This "we'll assume everyone is guilty and ignore the ones we don't care about" mentality is crap, and in complete opposition to privacy, freedom, and everything else the US claims to hold so dear.

It doesn't matter if I'm discussing something I'd like to patent, my financial statements, my medical condition, having an affair, or planning to BASE jump off a building -- it's none of the governments business, and without evidence to suggest I'm doing something they need to be concerned about, they can fuck off.

This is just an undue control over your citizens, and sadly, everyone else on the planet since these guys are tapping pretty much everything.

That more an more people might choose to encrypt on general principles is something the NSA is just going to have to learn to deal with -- because I see no point in helping them any more than I can avoid.

America is rapidly becoming some of the same things they used to criticize the Soviets for. And that is sad.

Move Offshore

[Anonymous Coward]

Why don't these companies just move offshore? The NSA seems to be limited to violating rights via U.S. companies. So, wouldn't it work to just move your company outside the U.S.? Places like Antigua, Equador, or Iceland might work well. I remember 2 years ago, I found myself lookin' for any decent free online email services that were non-US based. I couldn't find any. It amazes me that there's no major free email provider that's keeping everything on servers outside the U.S. The only real options are Yahoo, Google, and Microsoft. Sadly, I don't see that changing anytime soon. Hey, there's a market for anyone lookin' to create a startup. In this post-Snowden era, I imagine a lot of people would be interested in using that service.

Re:Move Offshore

[thbigr]

well said... I wonder that too. Also how can the government do this?

Re:Weird!

[nine-times]

The fourth/fith amendments exist to protect innocent citizens from otherwise accidentally incriminating themselves.

And even more specifically, the fourth and fifth amendment exist to protect innocent citizens from being forced into incriminating themselves by an overreaching government who is trying to silence dissidents.

People frequently overlook the historical context of the Bill of Rights. You have a bunch of people who had just fought a revolution against a government that they believed was oppressive, and they were trying to safeguard themselves against falling under another oppressive government. The Bill of Rights was created specifically for that reason. Essentially, you have a bunch of people who were recently rebels, who want to limit the government's ability to quash a rebellion, silence dissidents, or subvert a popular uprising.

To guide them, they look through their recent history for the tools employed by the power they had just thrown off. The British had limited speech, forbidden ownership of guns, stationed military personnel in people's homes, performed searches without cause, etc. In order to prevent a new oppressive government from using those tools, the authors of the Bill of Rights made them illegal.

So it's not really a defense to say, "This should be ok, because we're only trying to catch dissidents, terrorists, and enemies of the state!" The founding fathers were dissidents, terrorists, and enemies of the state. The Bill of Rights was written to protect exactly those kinds of people.

Both parties need to participate

[sjbe]

I'm on the verge of installing this Enigmail addon for Thunderbird...

Enigmail is great but the problem with it is getting the other folks you communicate with using it as well. This necessarily requires remarkably tech savvy people on both ends. (Don't believe me? Try to explain public key encryption to your mom such that she could do it properly herself. Unless your mom is REALLY geeky you will fail miserably) You can encrypt your message all you want but if the people you are writing to aren't willing to go through the hassle with you then you simply cannot use the product.

Re:Both parties need to participate

[Spottywot]

Thanks for the reply, I don't imagine a situation where I would want to encrypt all my email, I imagine a situation though where I might be discussing sensitive business plans(for example) in which case I would be quite happy to talk the other party through it. However, a peer to peer encrypted email service where the exchange of keys was done automatically would be much more usable for everyday users, if it does not exist it might be an interesting project to pursue.

Re:Weird!

[echnaton192]

Your bad english is the reason you misinterpreted the article. The article says:

At the moment, nobody could snoop into the emails of the companies that shut down their servive. But one company was ORDERED to change that by the government. The only way to protect THE EMAILS from that "lawful" crime against their customers was to shut down their service. the other company did the same BEFORE they received an order that would FORCE them to let the government in.

You simply misunderstood the reasons why they shut down.

@the english speaking commenters here flaming him: Try to read an article in a foreign language you hardly speak and THEN come back ranting about misunderstood articles.

do the smart thing

[Xicor]

just do the smart thing and encrypt everything on your computer before you send it to other ppl. give ppl you trust the means to decrypt, then send everything totally encrypted through unsecure email. even if the NSA forces the email company to give up your emails, they still cant read them.

Re:Weird!

[ssam]

Another reference
http://www.wired.com/opinion/2013/06/why-i-have-nothing-to-hide-is-the-wrong-way-to-think-about-surveillance/

"For instance, did you know that it is a federal crime to be in possession of a lobster under a certain size? It doesn’t matter if you bought it at a grocery store, if someone else gave it to you, if it’s dead or alive, if you found it after it died of natural causes, or even if you killed it while acting in self defense. You can go to jail because of a lobster."

Re:Come to Europe.

[Errol backfiring]

We did, but that was then. In the Netherlands, for example, a minister recently proposed a law that granted the police the right to hack any computer (with a court order, but that does not make it any less dangerous, given the fact that this tiny country already has the most phone taps in the world in place) and install spyware to monitor all communications.

Re:Were they contacted?

[echnaton192]

Because Lavabit has been officially contacted they can't destroy any data, they can shutup shop to prevent anyone else falling into the net which is what they have done but for anyone who have already used the service and have any data already on the Lavabit servers, it's just a matter of time before their data is decrypted one way or another..
 

You are right, except for this one. Strong encryption is - as far as we know from Mr. Snowden who knows a bit more of their abilities than the average person - not compromised. There are attack vectors and they write away encrypted stuff if they later find a way to decrypt it, but they will need more informations before they can do that, provided the encryption and the keys were strong.

But they did state that they may have been forced to provide a way around their protections. Before that happpened, they shut down their servers.

How about...

[DenaliPrime]

anon.penet.fi... Oh, wait...

The problem of trusted third parties

[sjbe]

peer to peer encrypted email service where the exchange of keys was done automatically would be much more usable for everyday users, if it does not exist it might be an interesting project to pursue.

The problem is that the more automated you make it, the less secure it becomes because you necessarily have to trust third parties. The entire point of encryption is that (theoretically) only the sender and the receiver are able to decrypt the message. Once you automate key generation, key security and/or exchanges then it becomes very difficult to ensure the third parties involved are trustworthy. I'm not saying it can't be done but it is not a trivial problem and may very well be too difficult to ever be made truly simple. I'm hopeful but not very optimistic.

Re:The problem of trusted third parties

[Spottywot]

My thought is a system where the keys are generated by the email client itself, i.e. on the users computer and the emails encrypted there and then only to be decrypted on arrival at the intended recipient. The only trust needed would be the software publisher and the recipient.

no subject

[derfy]

Mirror's Edge is getting closer.

Re:Remember when the press covered stuff like this

[Archangel Michael]

Yeah, when GWB was president and they could pin it on him. However, now that their guy is in office, they go silent. I remember the daily scandals of GWB presidency being announced. Today, it is MSNBC coverage of "Fox News" (aka "Faux News") take masquerading as "news". And Obama's in depth interviews are done by the likes of Jay Leno, a comedian talk show host.

It would be funny if it weren't so sad.

Mega Email as a replacement?

[dclozier]

Kim Dotcom's services look like they're coming into a underserved market at this rate.
https://twitter.com/KimDotcom/status/365716466441519105

The $1M Question

[mrbill1234]

Do the NSA have the private root CA keys to make their life that little bit easier. Most of the top CA's are based in the US. Could they even refused if asked?

Re:The $1M Question

[heypete]

The government probably don't have the private keys themselves to the roots (they were generated on HSMs and likely can't be exported or copied) but may be able to compel a CA to issue false certificates.

This is a fairly easy thing to detect (particularly for sites that use certificate pinning, users with the Cert Patrol add-on for Firefox, etc.) -- while it might work for a bit, it probably won't work for very long. It's also a death sentence to CAs: once it gets out that they've issued fake certificates for government-sponsored man-in-the-middle attacks then those roots will almost certainly be removed by browser/system makers.

Re:The $1M Question

[mrbill1234]

What's going on now is already a death sentence for cloud computing.

Re:Weird!

[TheCarp]

That you are about to start telling people to stay off your lawn.

Cowards!!!

[xenobyte]

I think it's pathetic to create such 'secure' systems and then to cave in at the first sign of trouble.

How hard can it be to set up the systems in such a way that it securely wipes all database files, logs etc. in case one of perhaps many possible trigger events occur. These events can be anything from sending a special mail, a bluetooth proximity, a keystroke, or the absence of any of these. This way it will be obvious that the data is irreversibly lost so there's nothing to gain from applying any 'pressure'.

On the positive side: There's now a huge void in the market, just waiting to be filled! - Profit!!!

Re:Weird!

[iONiUM]

I doubt it, because thankfully I don't live in the USA :)

hmmm.....how about Open Square

[BLToday]

how about a service that's completely open to tapping? Where all your posts, you know goes to all the authorities and everyone can see everything you do? So much data that it's all useless, lots of duckface photos and useless comments. You know like Facebook. Then you can secretly communicate in the open not with words but with wash-out filters and peace-signs photos.

Crypto is the answer, jurisdiction-shopping isn't

[Sloppy]

What the government is doing is repugnant, but only because most people are stupid and take the wrong lessons from it. If people had their shit together, then it would actually cause a positive effect, and we'd be talking about how US government's thuggery inadvertently did everyone a favor.

I never even heard of these encrypted email services until yesterday (except for hushmail about a decade ago but that was an even dumber beast) and the more I look into them, the more apparent it is that they sell .. well .. "snakeoil" is maybe too harsh, but I guess I'd have to say they sell the service of closing barn doors after horses escape. If I had to put it really nicely, to the point of sickening insincere sweetness, I suppose I could say they help you deploy "defense in depth" and I might be able to avoid making any gagging sounds as I did it.

Either the sender encrypts your email with your key, or they don't.

If they do it (i.e. if people do things right), then you don't need any service's special help with anything. All you want from your service are reliability, performance, and low prices -- a commodity, just like ISP's service of packet-passing.

If the sender doesn't encrypt the email with your key, then you're fucked. This is the common scenario, and the fact that people are basically fucked but still want to somehow mitigate it, is how this market emerged. Fair enough, I get it: when life hands you lemons, you make lemonaide. But you're taking it way too seriously, expecting far too much from a lossy premise. Your lemonaide is never going to be Dogfish Head 90 Minute IPA, ever, period. You should lament that, that people don't encrypt. You don't know who all read your PLAINTEXT before it got to Silent Circle or Lavabit and then they encrypted the storage of it.

(Worse, from what people are hinting about how lavabit worked, it sounds like they did the storage wrong, and that everyone always knew they would be able to decrypt things under certain circumstances, if forced.)

Users and their endpoint software must provide security. Other people's media and services running on other people's computers, can't really help you. Everything in between the endpoints is untrusted. Gag orders, CALEA-like laws, etc will make even the best-meaning services untrustworthy.

So. If it makes users feel better to move their hosting to other jurisdictions, fine. But for fuck's sake, go beyond just trying to make yourself feel better, and actually do something to make things really better: have a keysigning party. Help webmail users find and upgrade to decent (i.e. openpgp-compatible) mailreaders. And so on. Every time you see an unencrypted email come in, think about WTF went wrong and how that could have been prevented. And if you really do this, then you'll find that you can still host in America.

BTW, we've been through all this before. It's not like anything truly new is happening. All the same issues were coming up ten years ago, and ten years before that. (And probably ten years before that but I missed out on that round.) It always comes down to jurisdiction-shopping being a waste of time. You have the ultimate weapon which makes it all obsolete: 1970s PK tech. The only time you need jurisdiction-shopping is if your government outlaws the tech (France still? Not sure.).

Re:Remember when the press covered stuff like this

[heypete]

Well, it was reported by The New York Times, The Wall Street Journal, The Washington Post, CNN, CBS, and others (ABC, Fox News, NPR, etc.).

As far as I can tell, all the major US news companies reported on the closings.

Re:Weird!

[Richy_T]

Exactly, when I was an email admin, our server was set to negotiate TLS when available. The vast majority of the time, emails went in the clear.

Re:Hushmail

[randomErr]

I'm pushing a few bucks towards the project this afternoon. It looks very promising.

Re:And so it begins

[hebertrich]

Yep , stop using the internet , simple. Go back to your old 56k modems and use them to keep private things private , Alternatively use RTTY , teletype over short wave radio. If you have a problem with a whole class of communications gear , like the internet , use another. Line of sight microwave between peers . Using lasers .. get inventive and have fun hacking something else.

Tor and the NSA

[radiotalent]

With this revelation, it seems more and more likely by the second that the attacks on Tor had nothing to do with pedophiles and everything to due with Snowden and the like.

Re:Crypto is the answer, jurisdiction-shopping isn

[bill_mcgonigle]

Absolutely - end to end security is key, and people need to get over the attitude that SMTP can never be superseded.

But, jurisdiction shopping is part of defense in depth. I need to order a new VPS for work, and it's stuff where latency to the US doesn't matter - can you give me a good reason to host it in the US?

Before today, they said the cost to industry of PRISM was going to be $40B. I'd say it just quadrupled.

Or, as somebody else said, "Atlas just shrugged".

Schneirer had a great point today

[ThatsNotPudding]

http://www.schneier.com/blog/archives/2013/08/lavabit_e-mail.html

Last para:

"When the small companies can no longer operate, it's another step in the consolidation of the surveillance society."

Game. Set. Match.

Re:we the people need anonymous p2p communication

[Qzukk]

single, centralized hosting provider for TOR websites

Or, more specifically, hosting provider for tormail, which started off this chain of events.

I'm beginning to think that the pedos getting swept up was just a cover story for killing tormail.

Re:Remember when the press covered stuff like this

[Kohath]

Number of mentions of the Obama Administration in the five linked stories: zero.

Expect this sort of abuse to continue and escalate until someone in charge of it is held responsible.

No, it's not

[davidwr]

It's unclear if the "European leaders" refer to one of the Ceasars (there are so many to choose from), Napoleon, or one of many others of similar reputations.

Godwin's law is specific to a certain regime and its leadership.

Re:No, it's not

[halexists]

Why is everyone dancing around naming some leader and going on about something called Godwin's law without going into specifics? You'd think the way people are tiptoeing around here that Hitler's Stasi was watching us all.

(They see me trollin... They hatin... patrollin then tryin to catch me ridin dirty...)

Re:we the people need anonymous p2p communication

[0111 1110]

Downloading copyrighted material is also illegal in many countries, but that hasn't stopped millions of people from doing it. It would be difficult to enforce a crackdown on the use of P2P communication software if millions of people used it right from the start. It is difficult to defeat the protection of the herd with sufficiently large numbers in the herd. Off course if the US decides to go for broke and just arrest or execute everyone in giant concentration camps then all bets are off.

Re:Were they contacted?

[0111 1110]

Strong encryption is - as far as we know from Mr. Snowden who knows a bit more of their abilities than the average person - not compromised.

Has he actually released information about NSA decryption capabilities? I missed that. Do you have a link?

Re:Weird!

[0111 1110]

In order to prevent a new oppressive government from using those tools, the authors of the Bill of Rights made them illegal.

Actually the Bill of Rights was just supposed to be a reminder of what the government was not allowed to do. Anything not specifically allowed in the constitution was supposed to be forbidden to the government. The constitution was supposed to be a way of telling the government, "You can do these things and only these things. In order to do anything else you must actually amend the constitution." Enumerating the nearly infinite set of all things that the government was not allowed to do seemed a lot harder than enumerating the small list of their powers.

Workable versus simple

[sjbe]

My thought is a system where the keys are generated by the email client itself

The problem isn't generating the keys. That's relatively manageable though not completely without risk. The problem is distributing the keys. How do you ensure that the recipient and only the recipient has the private key? Somehow you have to get the key to the recipient without it being compromised along the way. I cannot really conceive of a way to do an email service whereby you could truly trust the third party to handle the key distribution. What is to prevent the service from giving a copy of the key to the NSA or the FBI or someone else? Any such service is going to have to have both the public and private keys. Software publishers and network services have proven to be vulnerable to (il)legal pressure from governments.

Perhaps someone smarter than me can solve the problem but I just don't see a feasible way for it to work AND be simple. I can think of workable solutions and simple solutions but not one that is both.

Re:Workable versus simple

[Spottywot]

Peer to peer, no third party involved. Just some software on your machine and the recipients. Mail would be as secure as the machine its on.

Re:Workable versus simple

[sjbe]

Peer to peer, no third party involved. Just some software on your machine and the recipients

If your proposed peer to peer software is aware on both ends of the public and private key (which it would have to be), effectively you would be trusting a third party for key distribution. Could be that I'm missing something but I don't see how peer to peer software solves that problem for you. I don't know how you ensure that both ends of the conversation are secure along with the tunnel between without already having exchanged keys in which case the peer to peer software is redundant.

The reason Enigmail works, cumbersome thought it can be to use, is because it requires no trusted third party for key distribution. (Key generation is another matter obviously) You generate the private key, get it to your recipient (probably by hand delivering it), and then use the public key to encrypt the message. Only the person with the private key (hopefully just the intended recipient) can decrypt the message. If you rely on a piece of software to get the private key to your recipient then you necessarily are trusting a third party for key distribution which seems to defeat the entire point of public/private key encryption unless you can somehow be sure you can trust the third party completely.

Like I said, I can see ways to make it convenient (like your proposed software) and I can see ways to make it secure but I so far haven't seen any practical way to accomplish both.

Re:Email made in Germany

[Z00L00K]

And in other news - Germany is going the other way changing to encryption of user mails by default: German companies to automatically encrypt customers' emails.

Two of Germany’s biggest internet companies have announced plans to make their email services more secure. This comes amid the controversy about the snooping practices of the US National Security Agency.

Deutsche Telekom AG and United Internet AG announced on Friday that they were joining forces in a project dubbed “E-Mail Made in Germany,” which would see all emails sent from the T-Online, GMX or Web.de services automatically encrypted. ...

Re:Were they contacted?

[echnaton192]

12.12pm ET
Question:

  http://www.theguardian.com/world/2013/jun/17/edward-snowden-nsa-files-whistleblower

Q&A with Mr. Snowden himself:
---cut---
Mathius1
17 June 2013 2:54pm
Is encrypting my email any good at defeating the NSA survelielance? Id my data protected by standard encryption?

Answer:

Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it.
---cut---

Spread the word. FUD does not help if we agree on the fact that we must "remember, remember the 5th of november".

We should not curl down in a fetal position. We should act - as much as we could.

Re:Weird!

[nine-times]

Well it's not as simple as that. If the government were simply not allowed to do anything not specifically explicitly listed in the Constitution, then there wouldn't be a need to list things that they couldn't do. Also, there'd be no real point in having Congress, because no laws would need to be written.

It's true, the Bill of Rights is not supposed to be an exhaustive list of all of a citizen's rights. It's certainly not saying, "Here are the 10 ways that the government is limited, but the government is permitted to do anything else." There's plenty of reason to think that the authors of the Constitution expected us to use our heads and figure out where to draw some of the lines between what the government can or can't do. It's actually pretty absurd to think otherwise. Why else would you have 3 different branches all play a role in creating, interpreting, and executing laws *in addition* to the Constitution? Why have an ability to amend the Constitution? Obviously they expected some level of fluidity and contextual judgment, though we could debate what they expected that level to be.

Re:Weird!

[chihowa]

Since most MTAs do not support TLS or SSL, most email is sent in the clear across the Internet.

The vast majority of mail servers support SMTP over TLS. If you don't see it often enough in the wild, it's because the people running the mail servers are pinching pennies and don't want the extra overhead of encryption or they are incompetent and don't know how to set it up. (Looking through my logs, 99% of all my I receive is through SMTP over TLS. In fact, the only exception I was able to find is mail from hotmail.com.)

Other than that, your post is spot on. Any third party can be coerced into betraying you without your knowledge. The wise thing to do is minimize the number of third parties you need to trust.

Re:Weird!

[almechist]

The fourth/fifth amendments does not exist for the purpose of protecting criminals. The fourth/fith amendments exist to protect innocent citizens...

This, this right here. It's just astounding how many people seem to think that all those rights exist for the benefit of criminals. But they're wrong, the framers of the constitution weren't trying to make it easier for criminals at all, those rights were meant to protect, and pretty much exist solely for the benefit of, the innocent, the average everyday citizen, precisely the people who are always claiming they have "nothing to hide". Our civil rights exist because the founders recognized that a society can only be truly free if the government accepts and abides by the presumption of innocence, the idea that the average person should not be subject to random searches and/or mass fishing expedition type investigations. This is bedrock stuff, exactly the principles our country was founded upon, and that so many people seem so willing to just toss it all away is truly one of the saddest things about the current American decline.

Re:Remember when the press covered stuff like this

[xaxa]

You may prefer The Guardian, who have recently launched a US edition: http://www.theguardian.com/technology/2013/aug/09/lavabit-email-edward-snowden-shuts-down

i'm not sure what mentioning the Obama Administration entails -- names?

Re:Remember when the press covered stuff like this

[Kohath]

i'm not sure what mentioning the Obama Administration entails -- names?

On the rare occasions that the US press talks about something that went wrong in the government, President Obama is portrayed as either a spectator or a victim of whatever went wrong, rather than the guy in charge of directing the government and fixing the problem.

The NSA answers to President Obama. President Obama could declassify anything at any time. President Obama could stop chasing and prosecuting whistleblowers. President Obama could stop the spying. He doesn't do it. He's not a innocent bystander, any more than Bush or Nixon were.

Yandex

[AndyCanfield]

My e-mail address is at Yandex.com. Yandex is in Moscow. My friends and I encrypt and sign messages using gnu PGP keys. The encryption is reliable. Yes, Yandex must answer to the KGB. But the KGB doesn't talk to the NSA.

Spread it around. Get your Internet services from different countries. E-mail, search, storage, web site, translation, maps, they don't have to all be Google, they don't have to all be in the USA. The Internet is global - spread it around.

Re:Weird!

[0111 1110]

Well it's not as simple as that. If the government were simply not allowed to do anything not specifically explicitly listed in the Constitution, then there wouldn't be a need to list things that they couldn't do.

The need to list those things was debated precisely because they were afraid that their inclusion would imply that human beings had no other rights and the government was allowed to do anything it wanted that did not interfere with those enumerated rights. They hoped that including the 9th amendment would make their position clear, but instead it was simply ignored.

"Here are the 10 ways that the government is limited, but the government is permitted to do anything else."

That is exactly how our government interprets it. In fact SCOTUS doesn't even consider them "rights". It calls them "privileges".

There's plenty of reason to think that the authors of the Constitution expected us to use our heads and figure out where to draw some of the lines between what the government can or can't do. It's actually pretty absurd to think otherwise. Why else would you have 3 different branches all play a role in creating, interpreting, and executing laws *in addition* to the Constitution?

The constitution enumerates the broad strokes of what the government is allowed to do. How law makers choose to make use of those powers is up to them. They are allowed to make any law which does not exceed the limited powers granted to the government in the constitution. If a law exceeds the authority granted to the government in the constitution it is unconstitutional and automatically invalid and is supposed to be struck down by the SCOTUS. Laws are specific implementations of powers granted in the constitution.

 

Why have an ability to amend the Constitution?

The ability to amend the constitution was intended to be difficult since it can lead to tyranny of the majority against any minority. The constitution, by limiting what the government is allowed to do, was intended to protect minorities and individuals from the tyranny of mob rule that is the downside to democracy. The democratic process was never really intended to override their fundamental rules of what a just government may properly do.

Obviously they expected some level of fluidity and contextual judgment, though we could debate what they expected that level to be.

They did expect society to make some changes, but they hoped that it would not be necessary and they didn't want it to be easy and they certainly didn't intend it to mean that the constitution was a mere subset of everything the government was allowed to do and that the only thing protecting citizens from its wrath was those few amendments thrown in as an afterthought just in case.

Satellite

[John.Banister]

Elon Musk should provide them with a satellite. If he uses PayPal's new "bill me later" service, he won't have to pay himself for the launch in advance...

Um

[davidmatchey]

Just get your own signing cert? They still allow you to do that, don't they.

Does anyone have replacement recommendations ...

[bbiw]

Vaporware, yes. But I'm working on it.

https://github.com/scholarly/kbsum/wiki/Anonymous-Private-Communications-Service

Unlike others, I don't consider convenience and server-side searching essential features. I consider them fatal features. The only place a message should ever be decrypted is on a computer the recipient physically controls and knows and trusts the administrator.

I am open to suggestions, reviews, criticism, and help.