Slashdot Mirror
A Year After Snowden's Disclosures, EFF, FSF Want You To Fight Surveillance
Today, as the EFF notes, marks one year from Edward Snowden's first document leaks, and the group is using that as a good spur to install free software intended to make it harder for anyone (the NSA is certainly not the first, and arguably far from the worst) to spy on your electronic communications. Nowadays, that means nearly everything besides face-to-face communication, or paper shipped through the world's postal systems. Reader gnujoshua (540710) highlights one of the options: 'The FSF has published a (rather beautiful) infographic and guide to encrypting your email using GnuPG. In their blog post announcing the guide they write: "One year ago today, an NSA contractor named Edward Snowden went public with his history-changing revelations about the NSA's massive system of indiscriminate surveillance. Today the FSF is releasing Email Self-Defense, a guide to personal email encryption to help everyone, including beginners, make the NSA's job a little harder.'" Serendipitous timing: a year and a day ago, we mentioned a UN report that made explicit the seemingly obvious truth that undue government surveillance, besides being an affront in itself, chills free speech. (Edward Snowden agrees.)
Some decent tools on their site.
Source files for GnuPG infographic
These are the source graphics for the Email Self-Defense infographic from the
Free Software Foundation, available at .
License
-------
Copyright (c) 2014 Free Software Foundation, Inc.
Licensed under the Creative Commons Attribution license (CC-BY). See full
source and attribution text at the above site.
That sounds BSDish to me! ;)
So, it's not just the US spying on Americans in America, it's apparently Canadians spying on Canadians in Canada.
-- Tigger warning: This post may contain tiggers! --
There's no point in encrypting your email with something like GPG if you're the only one using it, and most people aren't going to use it until it's easy.
I know, you'll tell me it's easy. Just download this software, install it, and it'll work for your email client assume you're still using an email client and there's a plugin available for it, which there might not be. Otherwise you need to copy and paste and stuff, and... oh right, then there's also the whole issue of managing keys and keeping a backup copy safe. Most people don't back anything up.
You have to make it easy. Someone will get angry because I appear to be praising Apple, but take iMessage's encryption for example. Do people using it know that their messages are encrypted? Probably not. Are they given a choice? No. Do they know that they're generating encryption keys? Probably not. Are they asked to manage their own encryption keys? No.
That's easy. GPG isn't. Email encryption needs to be that easy, or people won't use it.
I understand that it is important to have suspicions about NSA activities confirmed by hard documentation, but did anyone, anywhere, really think that the NSA was playing by the rules? That agency's non-approach to personal liberty has been a running gag in Hollywood for years.
> the seemingly obvious truth that undue
> government surveillance, besides being
> an affront in itself, chills free speech.
When I first read this, I was completely shocked that, because the NSA monitors this, anyone would ever think they are anything but a bunch of swell guys.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Basically, we're making it WAY too easy for the NSA to spy on us. But, even if we all switched to encrypted mail, that's not enough: with their metadata collection, they can still infer a lot of things from our communications patterns. So technically, we need I2P, Freenet or similar anonymizing technology to hide in the crowd. However, to REALLY fix the problem once and for all, we need to take it to the political arena, and fight for majorities to get Congress to reign in NSA in earnest, no matter what "Yes We Scan" Obama wants. If we don't, Orwell's 1984 will remain in effect, no matter how much we use OSS, encryption and so on.
cpghost at Cordula's Web.
Encryption misses the point. Encryption isn't privacy. The major threat to privacy from the US government is not from the content of your communications being read without a warrant it is that your communications are going to be monitored without a warrant so they will be able to monitor all your associations, purchases, communications and movement and locations. Basically it is like having a tail on 24x7 with someone looking over your shoulder... they don't need to know what you are saying until they want to and if they want to then you are past the point where encryption will mean much since they can put a keylogger on your system or maybe even break your 256 bit encryption.
The only protection from the surveillance state is either to eliminate communications technology altogether or to return to the rule of law.
This is pointless. The 5 people that do this will be protected when they communicate with one another. That's it.
Lets be clear. I don't care if Google or Facebook are spying on me (well, I do, but that's an entirely different topic.) The NSA is definitely the "worst" despite what this says. I'm even less concerned about foreign governments or criminals spying on me. The real danger is to our entire way of life. What the NSA is doing could be used to turn us into a true totalitarian state... very easily. What China, or some script kiddy, or even what Google can do with this information pales in comparison to the atrocities the federal government could commit with this power. The only thing restraining them at this time is their own will not to do so. That is NOT acceptable in my opinion. How long before we elect the next Nixon? or Stalin? It will happen, it always does. What will they do with this power?
"Nowadays, that means nearly everything besides face-to-face communication, or paper shipped through the world's postal systems" -- so we trust that mail sent via the post office is NOT being intercepted? Wow and we used to think that about our phone records and emails too!
The essence of this demand is "You have a responsibility to smarten-up."
That has never, and will never, work. Humans simply do not work that way.
My optimistic side says the major players will make it easy, like your example from Apple, and then all will be good.
My cynical side says the government will simply slap some gag orders on the industry players, and impose backdoors, and roll merrily along with the surveillance.
The *only* people who can be protected from this are those smart enough, and motivated enough, to do something that is not easy.
In honor of the day I ask everyone to turn off PC+smartphone, remove the batteries for both, and go outside to play.
For the GB people: go to your officials and complain about the CCTV cams.
So, you encrypt, and they don't feel you are a threat, they just start ignoring some traffic. If you don't, and constantly say things that trigger a responce on their part, now you generate traffic for them that they can't choose to ignore. I say we don't encrypt, and add bomb, jihad, and other trigger words they may "love" to everything and just flood them with more traffic than they can ever process. We did it to the germans in WWII, just flooded them with so much bullshit it killed their intelligence gathering network.
No - check out the "UKUSA Agreement"...
The Canadians are spying on the Americans, New Zealanders, Australians and Brits.
The Americans are spying on the Canadians, New Zealanders, Australians and Brits.
The New Zealanders are spying on the Americans, Canadians, Australians and Brits.
The Australians are spying on the Americans, Canadians, New Zealanders, and Brits.
The Brits are spying on the Australians, Americans, Canadians, and New Zealanders.
All perfectly technically legal.
All rather unstoppable as long as the NSA shills can keep the sheeple thinking that gnupg is too difficult.
It's not that postal mail cannot be intercepted at all. But unlike electronic communications, it is extremely expensive to systematically capture and record every single letter that goes through the postal system. So it's a reasonably safe assumption that most letters are not opened.
Yeah, basically we're paying foreigners to spy on us. Raisin our taxes 'n Outsourcing 'merican jobs. Great!
Use 4k keys folks - the spooks really hate that! Takes at least twice as long to break our codes.
If you have the time and money you use transistors and cables to build your own macro-sized AES encrypting typewriter. You can check all parts yourself. You can send the result per mail, or even scan it and send it to the recipient with E-Mail.
The large corporations could employ secretaries that all day do nothing else than handle these machines. Their communications would be perfectly secure! This will kill unemployment!
A lot of sites encrypt their traffic with SSL.
Yet, SSL handle only the encryption between a server, and the client application. (and can be made totally transparent to the user).
Whereas the anti-surveillance discussed here are end-to-end (from one user to the other) and will always require some minimal end-user intervention (key handling, although the interaction can be minimized and user interface efforts can make the experient as easy as possible).
(Facebook/Apple Messengers, Google Hangouts, etc.).
Note that OTR (Off-the-Record) is standard, and is capable to be used above any of those, just like OpenPGP works over email.
But again, this requires either using full blown clients (pidgin, adium, jitsi, messagebird, or any other OTR compliant client) or using extensions (like cryptocat) to be able to use it from within a webapp.
Also, for obvious reason, OTR disturbs the "search" fonction on chat web-apps (as the webserver only sees encrypted text and can't search).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Yeah, basically we're paying foreigners to spy on us. Raisin our taxes 'n Outsourcing 'merican jobs. Great!
Use 4k keys folks - the spooks really hate that! Takes at least twice as long to break our codes.
Hey it's only $10,000,000,000 a year!
Which if we spent on building wind and solar we would solve the Global Warming crisis with.
-- Tigger warning: This post may contain tiggers! --
The problem with public key encrypted email is that your keys only work for encrypting email you receive, not the email you send. In order for an email to be private, the receiver has to set up encryption.
While I'm sure I could set up encryption for my email quite easily, I can assure you most of my friends and family have no interest in going to the effort.
In addition to that, encryption only encrypts the body of the message. The to/from addresses, header line, and other tags are sent in plain text, regardless of whether you "encrypt" your email. And the NSA, et. al. claim they're only interested in that header information in the first place to identify who your contacts are, not what you're saying to them.
So encrypt away -- they're still getting the info they want from your email headers.
I do not fail; I succeed at finding out what does not work.
In honor of the day, I urge everyone to blindly grab and dump data without concern for the collateral consequences and without doing any due diligence to ensure it is only relevant to whatever beef you claim to have.
Link? I don't see mention of it on their home page.
Great article but this part isn't correct:
"Nowadays, that means nearly everything besides face-to-face communication, or paper shipped through the world's postal systems."
As shown here - every single piece of 1st class mail in the U.S. is photographed (and probably handed over to the FBI or NSA or whomever started this stupid program up in the first place to get the Post Office to do that):
http://www.nytimes.com/2013/07...
Short of radical political reform, which seems a long shot in the U.S. in the near term - technical solutions coming from open software will be the few ways we can restore some privacy to communications.
twitter - no link for you - they changed the title twice - last title was "Government orders federal departments to keep tabs on all demonstrations" and also coverage of bill S-4 in Globe and Mail.
-- Tigger warning: This post may contain tiggers! --
Did it occur to anyone that perhaps the NSA is behind this particular initiative? Gee golly, now I downloaded a new encryption scheme from people I've never met who PROMISE it hasn't been compromised...
If the US Government really wants to read your mail they will go to the source, if they haven't already, and pressure them into giving them a back door into all encryption OR they will take you to court and sue you out of business with your own tax money.
the NSA is certainly not the first, and arguably far from the worst
What's this argument? First of all, prove that you're not from the NSA.
What other country is ACTUALLY KILLING THOUSANDS OF FOREIGN PEOPLE based on oil interests and using it's spying network to determine the targets???? What other country is fighting against democracy in Latin America and Europe (by making coups like the recent one in Paraguay and subverting justice like in Sweden)? What evil could Chinese spying do to an American citizen? I'm not talking about stealing trade secrets, I'm talking about real harm. Will an American be detained indefinitely without accusation due to Chinese spying? No. Just American spying do real harm to both Americans and foreigners.
To be effective, end to end email encryption needs to be view as something more than just "a bonus for more sophisticated users" like the EFF is treating it. As long as only the sender or receiver is sophisticated enough to use email encryption, the option becomes worthless. Encryption only can be used when it becomes easy enough that both sender and receiver choose to use it.
Take the Thunderbird email client for example, at first start the program provides a setup wizard to take you through the items that are critical in using the program. As part of that, they even partner with companies like gandi.net to help you create a new email account if you don't already have one. But at no point do they partner with a Certificate Authority to encourage you to get a personal certificate for S/MIME configuration. Mozilla Foundation seems to never consider it a critical step. While they provide a knowledge base article of S/MIME Certificate providers (including free ones such as StartCom, Comodo, and secorio), this article is not kept up to date and none of the information is provided directly in Thunderbird itself. And the email account provider that the Mozilla Foundation has partnered with (gandi.net) does not even provide S/MIME personal certificates as an option even as a payed option despite also being a certificate authority.
If the attitude of email client software developers was that IMAP over SSL and SMTP over SSL should be provided as a third-party add-on "for more sophisticated users" then we would be in even worse shape today. Fortunately, these are considered options that should be easily access-able to everyone. We need to change how we think about presenting end to end email encryption to notices and start treating it as a critical offering instead of a secondary/side option.
That is exactly right. The push to encourage encryption does not solve the issue. De-funding and dismantling the NSA and taking back our freedoms through clear legislation is the only way to get what we deserve as a nation. Encrypting ordinary communication beyond simply using SSL/TLS is like bowing down and saying you don't expect the first amendment to protect you. When the teeth are gone from the fourth amendment the first amendment losses it strength as well. The moment we start editing our communications to keep our privacy, real freedom is lost. That said if you want to say anything private and keep it private strong encryption and a low profile are the only means to assure such privacy.
There are several good programs out there already to secure your communications. There are several programs here that are easily set up that use gpg.
http://wjlanders.users.sourceforge.net/
Keys are automatically generated for you. Some of the programs use mixmaster remailers.
All perfectly technically legal.
It is illegal as fuck. But I guess that is what "technically legal" means.
Seriously, I've never heard of a situation where someone even considers if something is legal unless they know that it probably isn't. If you have to check what you are doing with a lawyer you already know that you shouldn't be doing it.
Then there are of course the cases where something should be legal but isn't.
No - check out the "UKUSA Agreement"...
The Canadians are spying on the Americans, New Zealanders, Australians and Brits.
The Americans are spying on the Canadians, New Zealanders, Australians and Brits.
The New Zealanders are spying on the Americans, Canadians, Australians and Brits.
The Australians are spying on the Americans, Canadians, New Zealanders, and Brits.
The Brits are spying on the Australians, Americans, Canadians, and New Zealanders.
All perfectly technically legal.
All rather unstoppable as long as the NSA shills can keep the sheeple thinking that gnupg is too difficult.
Since EU has made a ruling that it violates human rights it is strictly illegal for the Brits to be involved. (Human rights applies regardless of nationality, it doesn't matter if they live in another country.)
I suspect Canada has similar laws.
It boils down to different trust models.
Trusting every involved government to stop indiscriminately spying on all its citizens require quite a leap of faith.
Encrypting between your correspondent and you doesn't require trust in 3rd parties like government or secret agencies.
Under this situation, having encryption anyway is always good in case that the gov decides to deceive you.
But yeah, I agree with you that achieving *proper* encryption isn't easy.
Now there's another effect: increasing usage of encryption increases (as I've said above) the cost of spying.
So use TOR even if it's just for pr0n !
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
OTR basically works this way above any chat stream.
It's made entirely transparent, user won't notice that encryption is happening (I mean, unless they log into GMail and notice that the GTalk/Hangout chat logs only contain encrypted garbage).
The only required action from the user is running through a "socialist millionaire" identity confirmation.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Yet, SSL handle only the encryption between a server, and the client application.
You can use the same encryption scheme for encrypting anything.
TLS/SSL is not an encryption scheme. It's protocol which defines how a client application and a server negociate an encryption. You can't use it for mush else.
AES is an encryption scheme, you could encrypt anything with it (an SSL connection, a ZRTP media transmission, password-protect an archive, encrypt a file with OpenPGP)
of course libraries like openssl will implement both (because what purpose would be SSL without actually being able to encrypt ?!) and other functionnality (S/MIME, similar to openPGP in that it use PKI for encryption, but instead use the same central authority model as SSL, instead of the web-of-trust model like openPGP).
Note that several Linux distribution also feature the same level of use simplification.
You just need to make key management easy. I know people are going to get angry every time I bring up Apple, but OSX can store certificates/keys in the keyring, which can then be backed up to iCloud {...} it's not impossible to make the whole thing much more automatic, safe, and easy for normal users.
I've never said it's impossible to make it better. But the user will always need some level of intervention (like at least caring that encryption happens, and checking that correct keys are used).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]