EFF’s ‘Secure Messaging Scorecard’ Rates Digital Communication Tools
San Francisco – In the face of widespread Internet data collection and surveillance, we need a secure and practical means of talking to each other from our phones and computers. Many companies offer “secure messaging” products – but how can users know if these systems actually secure? The Electronic Frontier Foundation (EFF) released its Secure Messaging Scorecard today, evaluating dozens of messaging technologies on a range of security best practices.
https://www.eff.org/press/releases/which-messaging-technologies-are-truly-safe-and-secure
telling them face to face works well idk where to download the app tho.
I’ll post this here but whatsapp is about to become even more secure due to some fancy crypto codework by fellas such as Moxie Marlinspike and crew. It doesn’t sounds perfect yet but it’s almost certainly the best their is’
Whatsapp brings strong end-to-end crypto to the masses | Ars Technica
Any corporate app will be backdoored where the ads get in and if folk are using it for criminal stuff the feds will get the messages in the clear from the memory buffers of seized devices (how would people otherwise read them?). The independent research and any apps those chaps make probably is robust but what happens is the “cool kids” can’t be bothered with extra effort and end up still using it insecurely.
Long before the Snowden scandals a lot of Google and other traffic was already encrypted; other than the ad cookies which were the biggest sources of dataleaks (they cannot have too much encrypt or the ad networks servers would not be profitable).
It was only this year UK GCHQ finally admitted they kept on 3 Enigma machines to decode comms from “friendly” Scandinavian countries with long standing ties to Germany as they thought these countries and DE were becoming too socialist and the USA wanted to get corporate advantages over them – I was tipped off about this by several techie types in high school who said “why else would British Telecom invent a lot of stuff for computers; but let the Americans claim all the credit for them?”
The Danish clearly realised this which is why Regnecentralen was a way of diverting the defence budget for university and schools computers instead (they just accepted whatever they sent across the comms lines could be monitored and were more careful what they said)
You can’t deny that ephemeral keys and perfect forward secrecy are making things much closer to the utopian future we all dream of though, no?
such a “utopian” future still remains dependent on networks having the capacity to handle the overheads of encryption and users being sensible and managing expectations. One of the old boffins I mentioned in other posts had some input into what was an equivalent for analogue Police radios in the 1990s; it made scanner traffic sound like a annoyed goose and cracking it today is still not trivial.
It never got widely used in many areas as sending the keys meant the radio links had to be twice as strong and the money wasn’t there to upgrade them (they were already that bad they let in foreign telly sound and DTELS claimed the foreign telly was sent too strong when every other EU country used the same kit and coexisted with the same frequencies..)
Today cops have TETRA but you can now use very basic equipment to check if any British public service worker is in the vicinity using their radio. You can’t decrypt the info and it could be anyone from MI5 to the local park ranger; but if you are in a environment where any of these radio users are potentially hostile who they actually are becomes irrelevant.
GCHQ and the NSA (and the advertisers; who all share personnel) have most likely moved along from bulk data collection anyway; after all even if the wanted to simply check on everyone called Abdul or Ahmed making a phone call in Manchester they would have terabytes to go through. Even the ad networks want this sort of ethnic graded data to sell their stuff (google for instance keep subtly trying to work out “what kind of Asian I might be”) without letting on they are doing so.
I don’t the bigger data gatherers ever used it for tracking down drug users or political activists as there would be too much data taking too long to process. The one bit of truth was that they monitor multiples of 30/32 phone calls or prime target in real time as thats the easiest amount to grab off a phone system without incurring excessive collection costs.
The moment you transmit a signal you give away your position; encryption can never hide that bit; and once that signal goes across a network out of your control someone else can intercept it.
Probably the saddest thing that will end up happening is when a real unimmaginable event happens and it turns out we had evidence, that we couldn’t access because laws prevented it, and so those laws get changed. And the same thing happens time and time again until all liberty ceases to exist and everybody is employed arresting everyone else who is also a convicted criminal and you’ve been framed star.
Real crimes, terrorist events and wars always create real evidence; bodies, firearms residue, explosives traces, victims. Old men are still being hauled out of their nursing homes for stuff they did in World War II, others (as you mentioned elsewhere) are being nicked for more recent crimes against vulnerable people; and this is in spite of very powerful people trying to protect the guilty.
if anything laws on encryption and more importantly access to comms (especially wireless) have been made less harsh; in my lifetime all GSM mobile frequencies were once NATO allocations; your laptop and tablet WIFI takes a bite out of civil and mil aviation radar frequencies which the air forces really didn’t want to give away; (I was surprised myself that cheap commercial devices would be trusted to use these bands correctly) a few years ago Ofcom and other EU Communications Ministries forbade using an encrypted two way radio but now several kinds are permitted. Its only the Americans who try to limit some encrypt software; whereas Germany encourages you to use it as a safety measure.
younger peopel especially do not need NSA/GCHQ or cops to destroy their own liberty; they are doing it already by using all these superficial chat apps; making snap judgments against each other on appearance, gender, race, beliefs and even music/arts subcultures; the cops/feds are most of the time only pickign up the pieces from this after things go tits up.
Something you may remember GL were the ctrypto-wars, where in the 80s/90s the US placed a ban on export of strong encryption as a munition. Looks like a similar scheme is occurring again.
New privacy battle looms after moves by Apple, Google – Business Insider
@Tryptameanie 574384 wrote:
Something you may remember GL were the ctrypto-wars, where in the 80s/90s the US placed a ban on export of strong encryption as a munition. Looks like a similar scheme is occurring again.
New privacy battle looms after moves by Apple, Google – Business Insider
I remember working for a system integrator where we got loads of Dell servers and had to declare we weren’t going to send them to China because of this law (90% of the computer was put together there :laugh_at:) and US designed IP phone still have the same warnings. We could still send the same kit to Hong Kong and if it or the data on it crossed the border everyone “turn brind eye and forget to put on specs” (including USA salesman) as “business is business”); although the Chinese usually had more sense anyway than to buy back their own computer at a 50% markup :laugh_at:
Chinese and German ones do not but you have to turn off encrypt on a DECT phone to get it to work with a repeater because of the overhead issues and intellectual property issues). The donut munchers always say this when new crypto tech arrives; TBH as there was a stage in the 90s where the civillian tech outstripped law enforcement capabilities I’m not surprised they are wary of new technologies.
What is worth reading are the comments on the Arstechnica article; especially the ones saying “how will FB make their money back if they can’t mine the data for advertising?”. This factor wasn’t as present 20-30 years ago.
PS : I found this. I only understand about 10% of it to be fair but from what I can see there are already identified flaws in the crypto; perhaps not deliberate but caused by time-to-market/resourcing constraints. they are not totally unfixable but the fixes are not trivial; and most importantly who will pay or provide the resources?
One of the fixes also seems to require face to face meetings between trusted parties anyway..
[ATTACH]86905[/ATTACH]
@General Lighting 574393 wrote:
PS : I found this. I only understand about 10% of it to be fair but from what I can see there are already identified flaws in the crypto; perhaps not deliberate but caused by time-to-market/resourcing constraints.
Now I would be VERY interested to hear your thoughts my friend. Hows about sending your old buddy a PM 😀
The PDF from the German profs (which is a public shared document) is now attached, it was missing from the original post (it is called 904.pdf).
Thanks buddy.
having skimmed a bit more of the document I have noticed a few clangers (such as not using the entire capacity of QR code in the encrypt) and some passwords stored in plaintext on the device; also google Cloud can still get some phone numbers to index (at least of the receipients if not the sender; a bit like how in analogue day the feds would shut off the talkthrough on their radio repeater if they thought folk were scanning them but you could still hear the control room).
I don’t think they are “conspiracies” or deliberate backdoors but ways of getting round resource constraints; the kids who use whatsapp are going to whine if the messages take too much space on the device or the app becomes slow or any other issues occur due to the mobile terminal equipment’s CPU becoming overloaded. Also I believe if the apps don’t hand over some info to Google or block things like ad delivery networks they can’t be put on the app store (such as adblock which you have to install from their own site).
Also even if the code is open source how many people are going to bother checking it out? you’d need to compare code on x64/i686, ARM, and across Linux kernel and Android. (the crypto uses stock Android encrypt functions BTW; they are not badly backdoored (if at all) and not trivial to crack but will still have some limitations)
Google do notmake it easy to inspect an Android kernel and give vague reasons for this (probably more commercial ones than wanting the encrypt to be easily crackable)
You can buy a cheap ish ARM single board computer and run Android on it but it is really bloody difficult to properly inspect whatsapp as well as the protocols keep changing so you’d have to reverse engineer that as well; then theres going through all the data you would get. Even though the hardware isn’t expensive its months of work; it might be withiin the scope of a teenager from Northern Europe (especially in the countries where the weather gets so harsh in winter there is little else to do other than work with computers and electronics) – but kids who can do any of that stuff (the hardest bits would be going through a lot of very boring and similar looking data) probably get fed up being teased even by their own friends for spending time doing that sort of thing instead of trading photos stolen from other less tech aware kids on snapchat; so probably keep quiet about it their skills until GCHQ / MIVD / PET offer them a college course or apprenticeship and enough Euros / computer kit to keep them happy; and they get a paid job doing the datamining….
0
Voices
24
Replies
Tags
This topic has no tags