8 ms·

Encrypt Everything

127 points by rosser 15y ago

spindritf 15y ago
Installing, properly configuring and maintaining software like I2P, Tor, full-disk encryption seem difficult to me and has many non-obvious pitfalls. Instead of going through confusing tutorials and trying to get it right, I would rather use turn-key, ready-to-use solutions made by someone more versed than me. Ubuntu allows you to set up an encrypted LVM on a whole drive with a single setting in the installer. Just grab the ISO with the alternate installer[1] and choose "use the whole disk for encrypted LVM" (or compatible) in the partitioning tool. The installer also allows for advanced configuration, like setting up swap and /tmp on partitions encrypted with one-time keys, while still making it fairly difficult to screw up. Tails comes with preinstalled and preconfigured Tor and I2P and, what's important, with almost all other connectivity blocked. Just download it[2], verify the signatures, and put on a USB key. Right now, it's difficult to add persistent storage[3] but they're working on it. Also, as an additional precaution, physically removing the USB key will make Tails shut down and wipe memory. [1] http://www.ubuntu.com/download/ubuntu/alternative-download#alternate http://www.ubuntu.com/download/ubuntu/alternative-download#a... [2] https://tails.boum.org/index.en.html https://tails.boum.org/index.en.html [3] https://tails.boum.org/forum/How_do_I_do_what_unetbootin_does/#comment-fc6a0040a29918839343a50396ef4082 https://tails.boum.org/forum/How_do_I_do_what_unetbootin_doe...
- sliverstorm 15y ago
  I would rather use turn-key, ready-to-use solutions made by someone more versed than me. Privacy doesn't work like that. It isn't set-it-and-forget-it. If you aren't constantly policing yourself, all the full-disk encryption and Tor networks in the world can't keep you anonymous.
  - wvs 15y ago
    Privacy doesn't, but encryption does. You don't want to set up Tor or I2P only to find out later that traffic you thought was encrypted actually wasn't.
    - gcr 15y ago
      Hence the need for constant policing yourself and auditing the software you use.
  - mahyarm 15y ago
    Switching on FileVault 2 on OSX makes things significantly more work and difficult for someone to attack you on that vector. Many times all you need is to make it annoying and expensive enough to be secure. Most people in the USA have locks that can be picked in 10 seconds with an auto jiggler and windows that can be broken with a large rock. Most people don't have walls, interior locks and bars that will start making thieves to carry power tools. Yet that is enough to stop a lot of casual theft.
- acabal 15y ago
  The complexity and presentation of encryption tools are the biggest things preventing them from being used by everyday people. I have a CS degree from a university you've heard of, have been using Linux for much of my computing career, and am a professional programmer, and even I found the I2P front page and "gentle introduction" intimidating and obtuse. I spent 15 minutes reading it and I literally have no idea exactly what it does. It's even more important to start encrypting everything when agencies like the NSA are building datacenters of never-before-seen size to store everyone's communications forever. Without getting too tin-foil-hat about things, it's not a big stretch for me to imagine--given what NSA is publicly doing today--a world where the government can pull up things you said in an offhand email two decades ago as evidence against you. Encryption everywhere is so important now and will only get more important as governments wise up to technology. Someone needs to make it easy for people to do.
- dcreemer 15y ago
  Can I suggest the "Tor Browser Bundle[1]" -- I've only tried it on Mac OS X, but it seems to nicely, and easily integrate a Tor proxy and a pre-configured Firefox for one-click anonymous browsing. [1] https://www.torproject.org/download/download-easy.html.en https://www.torproject.org/download/download-easy.html.en
joejohnson 15y ago
>>>Intermediate: >>> - Encypting your Entire Hard Drive with Truecrypt (Mac and Windows) Do people recommend this method, or is Apple's built-in full disk encryption sufficient?
- mistercow 15y ago
  I would not put much trust in any encryption system whose source code I did not have access to.
  - deleted 15y ago
    [deleted]
  - joejohnson 15y ago
    I never get that argument. I could download TrueCrypts source code, but that would take forever to read, if I could even read it all. So I'm basically taking the internet's consensus that someone has read the source and it does what it says it does. Is this a safer bet?
    - derrida 15y ago
      Yes, especially with encryption. "Many eyes make bugs shallow". And of course someone has read the source, someone wrote it. But the number of eyes on the code would be more than closed source.
      - joejohnson 15y ago
        That makes sense. Thanks.
    - Ralith 15y ago
      Would you rather use a program vetted by a wide variety of unassociated security researchers, or one whose manufacturer merely insists it was very careful programming?
    - petercooper 15y ago
nextstep 15y ago
From the page called "Filling Out Webforms": ...So many websites began asking you questions that seemed innocuous, but were actually designed to allow you to be controlled; so that Chinese authorities could make sure you were unable to view photos of Tiananmen Square, American authorities could make sure you were unable to view magazines published by "enemy" countries, and corporations were able to gather all your information to sell you as a data-package. I consider myself rather paranoid, but I think this might be a litte exaggerated. However, this is all definitely possible, and if the governments haven't already begun mass surveillance, they probably will.
- deleted 15y ago
  [deleted]
- morganpyne 15y ago
  Certainly the UK seems to have taken a giant leap in this direction recently (unless this is a misguided April fool article): http://www.bbc.co.uk/news/uk-politics-17576745 http://www.bbc.co.uk/news/uk-politics-17576745 I think you are deluding yourself though if you believe that most major govts are not doing wholesale digital trawling to the best of their (advanced) abilitites already, regardless of whatever legislation is currently in place.
FaceKicker 15y ago
It's somewhat ironic that this site doesn't support https
user2459 15y ago
Here are some tips from the EFF on encryption: https://ssd.eff.org/tech/encryption https://ssd.eff.org/tech/encryption
rmk2 15y ago
This would be a lot nicer if the dm-crypt tutorial for GNU/Linux wasn't directly copied from the ArchLinux Wiki, but without actually fixing links and explanations... It's not bad to collect these things, but it's not really well done, and one could have linked better resources, such as Markus Gattol's site about dm-crypt for linux[1], or at least the original resources... [1]: http://www.markus-gattol.name/ws/dm-crypt_luks.html http://www.markus-gattol.name/ws/dm-crypt_luks.html
zokier 15y ago
Hyperboles, image macros, Guy Fawkes masks, factual errors. Sounds like an average Pirate Party operation. The intentions are good for sure, but I doubt that this site is useful for a lot of people as it stands now. Of course it being a wiki it has a chance to evolve and grow into an actual gold mine of information. But I'm quite skeptical for now.
- dasil003 15y ago
  Yes. I have a fondness in my heart for manic armless lazy-eye shouting guy, but it really doesn't send the right signal.
- AJ007 15y ago
  Their marketing message is very weak. I love the message, but it could be done better. Most people would never imagine online banking and shopping without encryption. Neither would the financial institutions or the stores. However, widespread use of encryption seems to come to an end there. I thought differently about this in the past, but today I wonder if widespread encryption for the mass market would weaken their own security. Sending someone an encrypted message does not protect that message if the receiver passes it along on unencrypted channels. The rumor of Wikileaks collecting a good deal of secret documents through Tor nodes makes one wonder if even few of the "elite" really understand security and encryption. I would like encryption to be mandatory. I would like to not have to avoid public Wifi for concern of being hacked. I want to be able to send my employees server credentials via email. I think we will move in that direction, and the big companies will be responsible.
summerdown2 15y ago
> to counteract the increasing threat of total communications surveillance by governments So I guess SSL man in the middle will be coming soon? If it isn't here already, of course. Doesn't anyone else feel that the answer to over-surveillance from the government isn't a technological arms race but a political debate about the virtues of freedom?
- elemeno 15y ago
  It's already here and it's been here for a while. I work in the financial industry where there are some strict regulatory requirements about information flow (you know, things like like insider trading and maintaining firewalls between different parts of big banks and stuff like that) and all the large banks that I know of are performing an SSL man-in-the-middle on their gateways and have been for quite a while. Within a corporate setting it's very easy to do - you issue your own certs which are set to be trusted by internal computers and reencrypt with those at the gateways.
  - pyre 15y ago
    I don't think that this is what was meant in the post you are replying to.
  - bigiain 15y ago
    That works when "the corporation" controls your desktop and the certs your browser trusts, doesn't work so well when your (personal) smartphone or iPad is connecting out of the office over the cell network. The recent Mozilla/Trustwave (and DigiCert before) debacles make it very clear that a nation-state level adversary is almost certainly capable of SSL mitm-ing just about any internet traffic they want. Unless you're getting your data in and out of your country via encrypted packets over ham radio (and into a country you trust), there's just too few businesses a government agency would have to "lean on" to ensure your SSL encrypted packets are reliably secure.
- bigiain 15y ago
  Keep in mind too, that "encrypt everything" only solves part of the "problem" of communications surveillance. If the apparently-not-april-fools-gag reports out of the UK [1] over the weekend are to be believed, police agencies are deciding amongst themselves that the time/date/length/frequency/endpoints of any internet communication are things that they don't need warrants or oversight for. Encrypting the _contents_ of your email/texts/phonecalls/websitevisits still gives them access to the social graph in which you're communicating. Suppose one of your "brogrammer" colleaues sends out email to a group of recipients every Friday afternoon, one to you with some regular work-related business, and a dozen to his 'bros'. You send your usual response, and so do his bros, then he texts a particular number, gets a call back from that number. When that number becomes part of an investigation and turns out ,say, to be a cocaine dealers "burner phone" - guess what _you_ just started to look like part of? And if you've got some hacktivist-motivated software in place to strongly encrypt the mail between you and your coworker, how do you think _that's_ going to look to the investigators? (feel free to invent your own bad scenario about the "war on terror" or the "saving children from pedophiles" or the "occupy movement" or "overzealous corporate IP enforcement" instead of the "war on drugs") I don't know how to solve that - but some TOR-like multi-juristiction-distributed email/text/IM routing mechanism, where the source/destination information is part of the encrypted payload so "they" only get to see the hop between you and your nearest node, along with (crypographically) randomised message forwarding delays, payload padding, and "bogus messages" to mitigate traffic analysis (the first to stop someone noticing "Alice sent a message into node 1 and Bob simultaneously received a message from node 2", the second prevents leaks like "Alice sent a 13.2k message into node 1, and Bob received a 13.2k message from node 2", and the third to solve "Alice sent 8 messages into node 1 and Bob received 8 messages from node 2") [1] http://www.examiner.com/technology-in-national/u-k-gov-t-set-to-announce-real-time-phone-email-web-monitoring-proposal http://www.examiner.com/technology-in-national/u-k-gov-t-set...

127 points by rosser 15y ago

Installing, properly configuring and maintaining software like I2P, Tor, full-disk encryption seem difficult to me and has many non-obvious pitfalls. Instead of going through confusing tutorials and trying to get it right, I would rather use turn-key, ready-to-use solutions made by someone more versed than me. Ubuntu allows you to set up an encrypted LVM on a whole drive with a single setting in the installer. Just grab the ISO with the alternate installer[1] and choose "use the whole disk for encrypted LVM" (or compatible) in the partitioning tool. The installer also allows for advanced configuration, like setting up swap and /tmp on partitions encrypted with one-time keys, while still making it fairly difficult to screw up. Tails comes with preinstalled and preconfigured Tor and I2P and, what's important, with almost all other connectivity blocked. Just download it[2], verify the signatures, and put on a USB key. Right now, it's difficult to add persistent storage[3] but they're working on it. Also, as an additional precaution, physically removing the USB key will make Tails shut down and wipe memory. [1] http://www.ubuntu.com/download/ubuntu/alternative-download#alternate http://www.ubuntu.com/download/ubuntu/alternative-download#a... [2] https://tails.boum.org/index.en.html https://tails.boum.org/index.en.html [3] https://tails.boum.org/forum/How_do_I_do_what_unetbootin_does/#comment-fc6a0040a29918839343a50396ef4082 https://tails.boum.org/forum/How_do_I_do_what_unetbootin_doe...

sliverstorm 15y ago
I would rather use turn-key, ready-to-use solutions made by someone more versed than me. Privacy doesn't work like that. It isn't set-it-and-forget-it. If you aren't constantly policing yourself, all the full-disk encryption and Tor networks in the world can't keep you anonymous.
- wvs 15y ago
  Privacy doesn't, but encryption does. You don't want to set up Tor or I2P only to find out later that traffic you thought was encrypted actually wasn't.
  - gcr 15y ago
    Hence the need for constant policing yourself and auditing the software you use.
- mahyarm 15y ago
  Switching on FileVault 2 on OSX makes things significantly more work and difficult for someone to attack you on that vector. Many times all you need is to make it annoying and expensive enough to be secure. Most people in the USA have locks that can be picked in 10 seconds with an auto jiggler and windows that can be broken with a large rock. Most people don't have walls, interior locks and bars that will start making thieves to carry power tools. Yet that is enough to stop a lot of casual theft.
acabal 15y ago
The complexity and presentation of encryption tools are the biggest things preventing them from being used by everyday people. I have a CS degree from a university you've heard of, have been using Linux for much of my computing career, and am a professional programmer, and even I found the I2P front page and "gentle introduction" intimidating and obtuse. I spent 15 minutes reading it and I literally have no idea exactly what it does. It's even more important to start encrypting everything when agencies like the NSA are building datacenters of never-before-seen size to store everyone's communications forever. Without getting too tin-foil-hat about things, it's not a big stretch for me to imagine--given what NSA is publicly doing today--a world where the government can pull up things you said in an offhand email two decades ago as evidence against you. Encryption everywhere is so important now and will only get more important as governments wise up to technology. Someone needs to make it easy for people to do.
dcreemer 15y ago
Can I suggest the "Tor Browser Bundle[1]" -- I've only tried it on Mac OS X, but it seems to nicely, and easily integrate a Tor proxy and a pre-configured Firefox for one-click anonymous browsing. [1] https://www.torproject.org/download/download-easy.html.en https://www.torproject.org/download/download-easy.html.en

joejohnson 15y ago

>>>Intermediate: >>> - Encypting your Entire Hard Drive with Truecrypt (Mac and Windows) Do people recommend this method, or is Apple's built-in full disk encryption sufficient?

mistercow 15y ago
I would not put much trust in any encryption system whose source code I did not have access to.
- deleted 15y ago
  [deleted]
- joejohnson 15y ago
  I never get that argument. I could download TrueCrypts source code, but that would take forever to read, if I could even read it all. So I'm basically taking the internet's consensus that someone has read the source and it does what it says it does. Is this a safer bet?
  - derrida 15y ago
    Yes, especially with encryption. "Many eyes make bugs shallow". And of course someone has read the source, someone wrote it. But the number of eyes on the code would be more than closed source.
    - joejohnson 15y ago
      That makes sense. Thanks.
  - Ralith 15y ago
    Would you rather use a program vetted by a wide variety of unassociated security researchers, or one whose manufacturer merely insists it was very careful programming?
  - petercooper 15y ago

nextstep 15y ago

From the page called "Filling Out Webforms": ...So many websites began asking you questions that seemed innocuous, but were actually designed to allow you to be controlled; so that Chinese authorities could make sure you were unable to view photos of Tiananmen Square, American authorities could make sure you were unable to view magazines published by "enemy" countries, and corporations were able to gather all your information to sell you as a data-package. I consider myself rather paranoid, but I think this might be a litte exaggerated. However, this is all definitely possible, and if the governments haven't already begun mass surveillance, they probably will.

deleted 15y ago
[deleted]
morganpyne 15y ago
Certainly the UK seems to have taken a giant leap in this direction recently (unless this is a misguided April fool article): http://www.bbc.co.uk/news/uk-politics-17576745 http://www.bbc.co.uk/news/uk-politics-17576745 I think you are deluding yourself though if you believe that most major govts are not doing wholesale digital trawling to the best of their (advanced) abilitites already, regardless of whatever legislation is currently in place.

FaceKicker 15y ago

It's somewhat ironic that this site doesn't support https

user2459 15y ago

Here are some tips from the EFF on encryption: https://ssd.eff.org/tech/encryption https://ssd.eff.org/tech/encryption

rmk2 15y ago

This would be a lot nicer if the dm-crypt tutorial for GNU/Linux wasn't directly copied from the ArchLinux Wiki, but without actually fixing links and explanations... It's not bad to collect these things, but it's not really well done, and one could have linked better resources, such as Markus Gattol's site about dm-crypt for linux[1], or at least the original resources... [1]: http://www.markus-gattol.name/ws/dm-crypt_luks.html http://www.markus-gattol.name/ws/dm-crypt_luks.html

zokier 15y ago

Hyperboles, image macros, Guy Fawkes masks, factual errors. Sounds like an average Pirate Party operation. The intentions are good for sure, but I doubt that this site is useful for a lot of people as it stands now. Of course it being a wiki it has a chance to evolve and grow into an actual gold mine of information. But I'm quite skeptical for now.

dasil003 15y ago
Yes. I have a fondness in my heart for manic armless lazy-eye shouting guy, but it really doesn't send the right signal.
AJ007 15y ago
Their marketing message is very weak. I love the message, but it could be done better. Most people would never imagine online banking and shopping without encryption. Neither would the financial institutions or the stores. However, widespread use of encryption seems to come to an end there. I thought differently about this in the past, but today I wonder if widespread encryption for the mass market would weaken their own security. Sending someone an encrypted message does not protect that message if the receiver passes it along on unencrypted channels. The rumor of Wikileaks collecting a good deal of secret documents through Tor nodes makes one wonder if even few of the "elite" really understand security and encryption. I would like encryption to be mandatory. I would like to not have to avoid public Wifi for concern of being hacked. I want to be able to send my employees server credentials via email. I think we will move in that direction, and the big companies will be responsible.

summerdown2 15y ago

> to counteract the increasing threat of total communications surveillance by governments So I guess SSL man in the middle will be coming soon? If it isn't here already, of course. Doesn't anyone else feel that the answer to over-surveillance from the government isn't a technological arms race but a political debate about the virtues of freedom?

elemeno 15y ago
It's already here and it's been here for a while. I work in the financial industry where there are some strict regulatory requirements about information flow (you know, things like like insider trading and maintaining firewalls between different parts of big banks and stuff like that) and all the large banks that I know of are performing an SSL man-in-the-middle on their gateways and have been for quite a while. Within a corporate setting it's very easy to do - you issue your own certs which are set to be trusted by internal computers and reencrypt with those at the gateways.
- pyre 15y ago
  I don't think that this is what was meant in the post you are replying to.
- bigiain 15y ago
  That works when "the corporation" controls your desktop and the certs your browser trusts, doesn't work so well when your (personal) smartphone or iPad is connecting out of the office over the cell network. The recent Mozilla/Trustwave (and DigiCert before) debacles make it very clear that a nation-state level adversary is almost certainly capable of SSL mitm-ing just about any internet traffic they want. Unless you're getting your data in and out of your country via encrypted packets over ham radio (and into a country you trust), there's just too few businesses a government agency would have to "lean on" to ensure your SSL encrypted packets are reliably secure.
bigiain 15y ago
Keep in mind too, that "encrypt everything" only solves part of the "problem" of communications surveillance. If the apparently-not-april-fools-gag reports out of the UK [1] over the weekend are to be believed, police agencies are deciding amongst themselves that the time/date/length/frequency/endpoints of any internet communication are things that they don't need warrants or oversight for. Encrypting the _contents_ of your email/texts/phonecalls/websitevisits still gives them access to the social graph in which you're communicating. Suppose one of your "brogrammer" colleaues sends out email to a group of recipients every Friday afternoon, one to you with some regular work-related business, and a dozen to his 'bros'. You send your usual response, and so do his bros, then he texts a particular number, gets a call back from that number. When that number becomes part of an investigation and turns out ,say, to be a cocaine dealers "burner phone" - guess what _you_ just started to look like part of? And if you've got some hacktivist-motivated software in place to strongly encrypt the mail between you and your coworker, how do you think _that's_ going to look to the investigators? (feel free to invent your own bad scenario about the "war on terror" or the "saving children from pedophiles" or the "occupy movement" or "overzealous corporate IP enforcement" instead of the "war on drugs") I don't know how to solve that - but some TOR-like multi-juristiction-distributed email/text/IM routing mechanism, where the source/destination information is part of the encrypted payload so "they" only get to see the hop between you and your nearest node, along with (crypographically) randomised message forwarding delays, payload padding, and "bogus messages" to mitigate traffic analysis (the first to stop someone noticing "Alice sent a message into node 1 and Bob simultaneously received a message from node 2", the second prevents leaks like "Alice sent a 13.2k message into node 1, and Bob received a 13.2k message from node 2", and the third to solve "Alice sent 8 messages into node 1 and Bob received 8 messages from node 2") [1] http://www.examiner.com/technology-in-national/u-k-gov-t-set-to-announce-real-time-phone-email-web-monitoring-proposal http://www.examiner.com/technology-in-national/u-k-gov-t-set...