3 ms·

Why use email? I know some drug dealers who are pretty IT savvy and they simply setup Pidgin with OTR on their computers. Some had Macs with Adium. Then they w

Why use email? I know some drug dealers who are pretty IT savvy and they simply setup Pidgin with OTR on their computers. Some had Macs with Adium. Then they would message each other to go on OTR. That's all you should send in an e-mail or text message, "go on OTR".

deleted 14y ago
[deleted]
aes256 14y ago
If I understand correctly, the key feature of OTR is its plausible deniability; the messages you send do not have a digital signature that a third party can use to verify their integrity, but the other party in the conversation is able to verify them. Is that really going to hold up in court? Surely by the same token I could dismiss absolutely everything there is any record of me sending or receiving over HTTP because it could theoretically have been forged or tampered with in transit.
- snowwrestler 14y ago
  Is plausible deniability an actual legal concept at all? I see it used here and on other technical forums in topics like this, but aside from that I've only ever heard of it in political, not legal, contexts. Any lawyers able to shed light?
- oconnore 14y ago
  The most useful feature (of course, not a unique feature) of OTR is perfect forward secrecy. This means that, unlike GPG, you can lose your private key and not give up everything you have ever encrypted. The plausible deniability stuff is probably not that useful in court, as you note.
  - georgeorwell 14y ago
    If the 'plausible deniability' is not that useful in court, that means it isn't plausible deniability. It's better to say that OTR doesn't provide plausible deniability, even though it claims to, if that's what you believe. (I don't have an opinion either way.)
    - aes256 14y ago
      It's plausible deniability, but that alone isn't sufficient to avoid prosecution in most jurisdictions. The standard in most jurisdictions is proof beyond reasonable doubt. I don't think the OTR plausible deniability would be considered reasonable doubt, especially if the content of the messages is corroborated by other evidence.
      - georgeorwell 14y ago
        I always thought the term plausible deniability implied reasonable doubt, and that if it didn't, it wasn't plausible deniability. I mean, there's not much point in claiming something offers plausible deniability if it isn't a valid defense in court. Or is there? Do you have an example from actual case law? All I have is Wikipedia: "Plausible deniability is also a legal concept. It refers to lack of evidence proving an allegation. Standards of proof vary in civil and criminal cases. In civil cases, the standard of proof is "preponderance of the evidence" whereas in a criminal matter, the standard is "beyond a reasonable doubt." If an opponent lacks incontrovertible proof (evidence) of their allegation, one can "plausibly deny" the allegation even though it may be true."
        stinkytaco 14y ago
        However, deniability becomes less plausible when there's other evidence that makes deniability harder... i.e. Someone claims to have had a conversation with you, the logs of the conversation exists and that person can corroborate that the person on one end was them. Of course you can claim that someone was impersonating you, but what if later you had a recorded phone conversation referencing the OTR conversation, etc. In and of itself, a piece of evidence is plausibly deniable. In the face or corroborating evidence, it may not be. Alas, however, I do not have an example from actual case law. EDIT: I knew I had seen some case law sort of related to this before and it was in re Boucher and US v. Fricosu. They are not directly related to "Plausible Deniability", rather they compelled defendents to decrypt their hard drives. Certainly in the Boucher case there was reason to believe that the contents of the drive were incriminating (the file names were the giveaway, I believe) so perhaps this does not fit in to the exact facts we are trying to recreate, but those are the only two cases that relate that I can recall.
revelation 14y ago
Of course, if you use Adium with OTR, absolutely remember to disable logging which is on by default (http://trac.adium.im/ticket/15722 http://trac.adium.im/ticket/15722).
imglorp 14y ago
While OTR might encrypt contents, isn't there still an IP trail at either end plus all the providers in between? A list of associates of a drug dealer is probably more harmful than what was said.
- munin 14y ago
  Yes, but the IP trail is from dealer A to gmail.com and dealer B to gmail.com. Along with non-dealer C through everyone else in the world.

deleted 14y ago

[deleted]

aes256 14y ago

If I understand correctly, the key feature of OTR is its plausible deniability; the messages you send do not have a digital signature that a third party can use to verify their integrity, but the other party in the conversation is able to verify them. Is that really going to hold up in court? Surely by the same token I could dismiss absolutely everything there is any record of me sending or receiving over HTTP because it could theoretically have been forged or tampered with in transit.

snowwrestler 14y ago
Is plausible deniability an actual legal concept at all? I see it used here and on other technical forums in topics like this, but aside from that I've only ever heard of it in political, not legal, contexts. Any lawyers able to shed light?
oconnore 14y ago
The most useful feature (of course, not a unique feature) of OTR is perfect forward secrecy. This means that, unlike GPG, you can lose your private key and not give up everything you have ever encrypted. The plausible deniability stuff is probably not that useful in court, as you note.
- georgeorwell 14y ago
  If the 'plausible deniability' is not that useful in court, that means it isn't plausible deniability. It's better to say that OTR doesn't provide plausible deniability, even though it claims to, if that's what you believe. (I don't have an opinion either way.)
  - aes256 14y ago
    It's plausible deniability, but that alone isn't sufficient to avoid prosecution in most jurisdictions. The standard in most jurisdictions is proof beyond reasonable doubt. I don't think the OTR plausible deniability would be considered reasonable doubt, especially if the content of the messages is corroborated by other evidence.
    - georgeorwell 14y ago
      I always thought the term plausible deniability implied reasonable doubt, and that if it didn't, it wasn't plausible deniability. I mean, there's not much point in claiming something offers plausible deniability if it isn't a valid defense in court. Or is there? Do you have an example from actual case law? All I have is Wikipedia: "Plausible deniability is also a legal concept. It refers to lack of evidence proving an allegation. Standards of proof vary in civil and criminal cases. In civil cases, the standard of proof is "preponderance of the evidence" whereas in a criminal matter, the standard is "beyond a reasonable doubt." If an opponent lacks incontrovertible proof (evidence) of their allegation, one can "plausibly deny" the allegation even though it may be true."
      - stinkytaco 14y ago
        However, deniability becomes less plausible when there's other evidence that makes deniability harder... i.e. Someone claims to have had a conversation with you, the logs of the conversation exists and that person can corroborate that the person on one end was them. Of course you can claim that someone was impersonating you, but what if later you had a recorded phone conversation referencing the OTR conversation, etc. In and of itself, a piece of evidence is plausibly deniable. In the face or corroborating evidence, it may not be. Alas, however, I do not have an example from actual case law. EDIT: I knew I had seen some case law sort of related to this before and it was in re Boucher and US v. Fricosu. They are not directly related to "Plausible Deniability", rather they compelled defendents to decrypt their hard drives. Certainly in the Boucher case there was reason to believe that the contents of the drive were incriminating (the file names were the giveaway, I believe) so perhaps this does not fit in to the exact facts we are trying to recreate, but those are the only two cases that relate that I can recall.

revelation 14y ago

Of course, if you use Adium with OTR, absolutely remember to disable logging which is on by default (http://trac.adium.im/ticket/15722 http://trac.adium.im/ticket/15722).

imglorp 14y ago

While OTR might encrypt contents, isn't there still an IP trail at either end plus all the providers in between? A list of associates of a drug dealer is probably more harmful than what was said.

munin 14y ago
Yes, but the IP trail is from dealer A to gmail.com and dealer B to gmail.com. Along with non-dealer C through everyone else in the world.