6 ms·

From encryption to darknets: As governments snoop, activists fight back

67 points by duck 15y ago

kijin 15y ago
> until late last year, no Android phone offered full-disk encryption. AFAIK full-disk encryption offers the best protection against offline attacks. How much good would it do in a mobile phone that is almost always turned on?
- moxie 15y ago
  You have to combine it with online access control protection: http://www.whispersys.com/screenlock.html http://www.whispersys.com/screenlock.html But it also makes a data wipe easier to do securely, and gives you an additional last minute option when you see trouble coming (just turn your phone off).
deleted 15y ago
[deleted]
CWuestefeld 15y ago
governments ... are actively trying to find out what is being said and transmitted over their airwaves and networks. Ahem... their airwaves and networks? Perhaps part of the problem here is that the governments believe that they own these communications channels. But the airwaves and networks are like the seas and the atmosphere: some of it happens to fall within a government's borders, but it's impossible to "own" them.
- stinkytaco 15y ago
  They don't own them, but a compelling argument could be made that we do. We "own" the airwaves and networks because they traverse our property, either personnel or collective. We use our agents -- the government -- to negotiate on our behalf for the network's physical location and maintenance (through right-of-way agreements or leasing of spectrum) and we expect that they are run with the public interest in mind (free over the air programming, required news broadcasts, etc.). This is the reason it infuriates me when telecoms start talking about the "free market". There's nothing free about it, they are using public thoroughfare and public airwaves to make money, essentially a state sponsored monopoly. Their job is to operate in the public's interest.
  - CWuestefeld 15y ago
    We "own" the airwaves and networks because they traverse our property, ... We use our agents -- the government -- to negotiate on our behalf Our current conception of property rights does not recognize any ownership of these resources. This is very similar to resources such as the atmosphere; and rivers, lakes, and oceans. All these things are subject to "tragedy of the commons" issues, as well as market failures due to externalized costs. You're right that there's nothing free about the market in communications spectrum. Because there is no recognized ownership, we must rely, as you note, on the stewardship by our governmental agencies. The problem with this, of course, is the inherent inefficiencies of centralized control, as well as the errors created as a result of public choice economics. The Coase Theorem [1] demonstrates that if we were to recognize an ownership interest in these resources, then we could expect that those problems could be worked out by an actual market, where today there is none in operation. [1] http://en.wikipedia.org/wiki/Coase_theorem http://en.wikipedia.org/wiki/Coase_theorem
    - stinkytaco 15y ago
      I've never bought the "tragedy of the commons" theory, though I'm familiar with the argument, mostly because I fail to see a tragedy. A robustly protected public utilities system is one of the reason the US is a first world country and Somalia is not. Hardin’s arguments lack any practical value. Can you imagine what an unregulated wireless spectrum would look like? I've also never accepted the Coase Theorem because it too ignored the practical problem of "whomever builds the tallest tower wins". You simply can't build wireless network (or wired that have any practical use) without government control. Or, if you do, the market will work out a natural monopoly over time because of the need for standardization. It's the same reason it's so hard to break into the social network market, one platform is better and the larger it is, the better it gets. Imagine that extrapolated to something as economically essential as the telecomm system. We enable free markets by providing basic infrastructure (roads, telecom, etc.). But that's getting off the topic of the discussion. The spectrum, in practice, is the property of the government and, by extension, the people. Wired networks are more complicated, but shared ownership is implied by right-of-way agreements, or at least the obligation to operate them in the public interest is implied. As long as that's true, governments are obligated to protect the public's interest in a free and open form of communication over those networks.
tptacek 15y ago
If you want a counterpoint to this, I have one: http://news.ycombinator.com/item?id=1690871 http://news.ycombinator.com/item?id=1690871 The article touches on this towards the end.
- etherael 15y ago
  Interesting perspective. If the alternative to pursuing tools in this area is complete subjugation, perhaps some people are willing to bear the costs of risking going against that. What use is your life if it's not really yours? It's a position people at least ought to be able to choose for themselves.
  - tptacek 15y ago
    I certainly wouldn't criticize anyone directly facing down a violent authoritarian regime. If, on the other hand, you're marketing to those people from the relative safety of a western computer keyboard...
    - etherael 15y ago
      Unless you're from Bhutan, you're already facing down a violent authoritarian regime. It's all just a question of degrees. People in Iran may well look to North Korea and be thankful that at least they don't have it that bad. Those of us behind the "relative safety of a western computer keyboard" may have more of an obligation to act than those under more strenuous restrictions. At least in our case we likely won't be hanged from a crane, as you say. Or at least our governments will have the good courtesy to have us shipped off to a friendly tinpot dictatorship first so we can be spared the humiliation of having such a thing done at home. I don't think marketing really comes into it, all the circumvention tool vendors are quite direct and honest with the current state of their efforts and the extent upon which they can be relied. Also, they're not commercial efforts, and the creators stand to make no real direct economic gains from their adoption.
      - tptacek 15y ago
bootload 15y ago
"... Security experts agree that trying to protect communications on a non-smartphone is basically a lost cause... I think there's perhaps more anonymity in a $20 phone. ..." Well they'd say that wouldn't they. Old school tradecraft: Using an 'output-feedback mode stream cipher' (Pontifex) and a cheap phone gives you a secure and anonymous, 1 to many messaging system. It was designed specifically for covert 'dead-drops' communication. There are a few caveats, but it's lo-tech & bruce reckons it works ~ http://www.schneier.com/solitaire.html http://www.schneier.com/solitaire.html
- pyre 15y ago
  I'm not quite understanding this. I understand what Pontifex/Solitaire is, but how do they fit together with the cheap phone and dead-drops? I could see using Pontifex to encrypt text messages, but how do dead-drops fit into this? Communicating the location of the drops? Dead-dropping the phone with encrypted messages on it?
  - bootload 15y ago
    "... how do they fit together with the cheap phone and dead-drops? ..." If you don't want anyone to know you are sending a message to another person you encrypt a message & leave it at a specific place with a marker. I assume you get this. But if you give a call with an an encrypted message on any phone you potentially give the game away. With a cheap $20 phone used minimally or once, sending a hand encrypted message using Solitaire you get anonymity and security.
    - pyre 15y ago
      Ok. But, 1. Where does the one-to-many part come in? 2. Is there any reason other than plausible deniability to use a cheap cellphone vs. anything else (piece of paper, memory card, etc)?

67 points by duck 15y ago

kijin 15y ago

> until late last year, no Android phone offered full-disk encryption. AFAIK full-disk encryption offers the best protection against offline attacks. How much good would it do in a mobile phone that is almost always turned on?

moxie 15y ago
You have to combine it with online access control protection: http://www.whispersys.com/screenlock.html http://www.whispersys.com/screenlock.html But it also makes a data wipe easier to do securely, and gives you an additional last minute option when you see trouble coming (just turn your phone off).

deleted 15y ago

[deleted]

CWuestefeld 15y ago

governments ... are actively trying to find out what is being said and transmitted over their airwaves and networks. Ahem... their airwaves and networks? Perhaps part of the problem here is that the governments believe that they own these communications channels. But the airwaves and networks are like the seas and the atmosphere: some of it happens to fall within a government's borders, but it's impossible to "own" them.

stinkytaco 15y ago
They don't own them, but a compelling argument could be made that we do. We "own" the airwaves and networks because they traverse our property, either personnel or collective. We use our agents -- the government -- to negotiate on our behalf for the network's physical location and maintenance (through right-of-way agreements or leasing of spectrum) and we expect that they are run with the public interest in mind (free over the air programming, required news broadcasts, etc.). This is the reason it infuriates me when telecoms start talking about the "free market". There's nothing free about it, they are using public thoroughfare and public airwaves to make money, essentially a state sponsored monopoly. Their job is to operate in the public's interest.
- CWuestefeld 15y ago
  We "own" the airwaves and networks because they traverse our property, ... We use our agents -- the government -- to negotiate on our behalf Our current conception of property rights does not recognize any ownership of these resources. This is very similar to resources such as the atmosphere; and rivers, lakes, and oceans. All these things are subject to "tragedy of the commons" issues, as well as market failures due to externalized costs. You're right that there's nothing free about the market in communications spectrum. Because there is no recognized ownership, we must rely, as you note, on the stewardship by our governmental agencies. The problem with this, of course, is the inherent inefficiencies of centralized control, as well as the errors created as a result of public choice economics. The Coase Theorem [1] demonstrates that if we were to recognize an ownership interest in these resources, then we could expect that those problems could be worked out by an actual market, where today there is none in operation. [1] http://en.wikipedia.org/wiki/Coase_theorem http://en.wikipedia.org/wiki/Coase_theorem
  - stinkytaco 15y ago
    I've never bought the "tragedy of the commons" theory, though I'm familiar with the argument, mostly because I fail to see a tragedy. A robustly protected public utilities system is one of the reason the US is a first world country and Somalia is not. Hardin’s arguments lack any practical value. Can you imagine what an unregulated wireless spectrum would look like? I've also never accepted the Coase Theorem because it too ignored the practical problem of "whomever builds the tallest tower wins". You simply can't build wireless network (or wired that have any practical use) without government control. Or, if you do, the market will work out a natural monopoly over time because of the need for standardization. It's the same reason it's so hard to break into the social network market, one platform is better and the larger it is, the better it gets. Imagine that extrapolated to something as economically essential as the telecomm system. We enable free markets by providing basic infrastructure (roads, telecom, etc.). But that's getting off the topic of the discussion. The spectrum, in practice, is the property of the government and, by extension, the people. Wired networks are more complicated, but shared ownership is implied by right-of-way agreements, or at least the obligation to operate them in the public interest is implied. As long as that's true, governments are obligated to protect the public's interest in a free and open form of communication over those networks.

tptacek 15y ago

If you want a counterpoint to this, I have one: http://news.ycombinator.com/item?id=1690871 http://news.ycombinator.com/item?id=1690871 The article touches on this towards the end.

etherael 15y ago
Interesting perspective. If the alternative to pursuing tools in this area is complete subjugation, perhaps some people are willing to bear the costs of risking going against that. What use is your life if it's not really yours? It's a position people at least ought to be able to choose for themselves.
- tptacek 15y ago
  I certainly wouldn't criticize anyone directly facing down a violent authoritarian regime. If, on the other hand, you're marketing to those people from the relative safety of a western computer keyboard...
  - etherael 15y ago
    Unless you're from Bhutan, you're already facing down a violent authoritarian regime. It's all just a question of degrees. People in Iran may well look to North Korea and be thankful that at least they don't have it that bad. Those of us behind the "relative safety of a western computer keyboard" may have more of an obligation to act than those under more strenuous restrictions. At least in our case we likely won't be hanged from a crane, as you say. Or at least our governments will have the good courtesy to have us shipped off to a friendly tinpot dictatorship first so we can be spared the humiliation of having such a thing done at home. I don't think marketing really comes into it, all the circumvention tool vendors are quite direct and honest with the current state of their efforts and the extent upon which they can be relied. Also, they're not commercial efforts, and the creators stand to make no real direct economic gains from their adoption.
    - tptacek 15y ago

bootload 15y ago

"... Security experts agree that trying to protect communications on a non-smartphone is basically a lost cause... I think there's perhaps more anonymity in a $20 phone. ..." Well they'd say that wouldn't they. Old school tradecraft: Using an 'output-feedback mode stream cipher' (Pontifex) and a cheap phone gives you a secure and anonymous, 1 to many messaging system. It was designed specifically for covert 'dead-drops' communication. There are a few caveats, but it's lo-tech & bruce reckons it works ~ http://www.schneier.com/solitaire.html http://www.schneier.com/solitaire.html

pyre 15y ago
I'm not quite understanding this. I understand what Pontifex/Solitaire is, but how do they fit together with the cheap phone and dead-drops? I could see using Pontifex to encrypt text messages, but how do dead-drops fit into this? Communicating the location of the drops? Dead-dropping the phone with encrypted messages on it?
- bootload 15y ago
  "... how do they fit together with the cheap phone and dead-drops? ..." If you don't want anyone to know you are sending a message to another person you encrypt a message & leave it at a specific place with a marker. I assume you get this. But if you give a call with an an encrypted message on any phone you potentially give the game away. With a cheap $20 phone used minimally or once, sending a hand encrypted message using Solitaire you get anonymity and security.
  - pyre 15y ago
    Ok. But, 1. Where does the one-to-many part come in? 2. Is there any reason other than plausible deniability to use a cheap cellphone vs. anything else (piece of paper, memory card, etc)?