4 ms·

I suggest every software developer take a course or two on cryptography and make privacy integral in the products you develop.

silvestrov 13y ago
Cryptography doesn't help at all when your government will require you by law to provide them with a decrypted dump. That's what they did with Verizon. Verizon could not provide you with privacy no matter how much they wanted.
- tlrobinson 13y ago
  End-to-end encryption and p2p networks help in that respect.
- anemitz 13y ago
  There's no expectation of privacy at the service provider level in this case. If Verizon, or any service provider, has access to the unencrypted data or the decryption mechanism, the system is insecure. However, cryptography does help you as an individual user of a service. There's no reason we can't build systems which are provably secure and retain strict end-user data privacy.
  - silvestrov 13y ago
    There is one reason: the government will make sure there are laws which enables them to require providers to give them decypted dumps. If the provider says "can't do", they will be shut down. In the end the government can force the OS vendors to install keyloggers. The ones who make the law always win.
    - deleted 13y ago
      [deleted]
- Ihmahr 13y ago
  That is why you should put your servers in iceland or similar places. With asymetric encription there is no need; Only the user knows and not the service provider.
  - _k 13y ago
    Why in Iceland ?
    - deleted 13y ago
      [deleted]
    - Ihmahr 13y ago
      Mostly out of reach of nsa, fbi etc. More than average respect for privacy etc. Cheap green energy.
- epsylon 13y ago
  And, above all, end-to-end cryptography doesn't protect you against traffic analysis, which is what the NSA is doing with this metadata (which allows them to choose targets subject to a full blown surveillance).
- e3pi 13y ago
  Google: Deniable Cryptography and Rubberhose(update: Waterboarding) Cryptanalysis
anemitz 13y ago
This is precisely the type of attitude we should all have as hackers. It's easy to sit back and say "oh government this or corporation that sucks", we need to step up our game as builders of the software sitting on millions of devices. This is a privacy arms race -- and right now we're losing.
- sharkweek 13y ago
  Who are the developers who go work on these projects for the government? I feel like this is some cutting edge technology they create, so they have to be some of the best, right? Is the money that good or is there an allure to having a security clearance.
  - ndr 13y ago
    I guess the money is that good.
  - tlrobinson 13y ago
    Well, in this case there's no technology involved. The government simply told Verizon to hand over their records. I like how ErrataSec put it: "Welcome to Echelon 2.0: Outsourced Edition"
richtr 13y ago
While this is sound advice there is the problem that if you get very big/popular the government can knock at your door with sealed court orders to enable things like wiretapping. Case in point: "Microsoft’s tweaks to Skype could facilitate wiretapping" http://www.extremetech.com/computing/132935-microsoft-tweaking-skype-to-facilitate-wiretapping http://www.extremetech.com/computing/132935-microsoft-tweaki... If that has happened or not under the current system we will never know - which is the exact issue the OP was citing.
- tlrobinson 13y ago
  Build open-source, encrypted, p2p networks. Fortunately the 1st Amendment is still mostly respected, at least relative to some of the others. [Edit] Now, monetizing such software is an interesting problem. Ripple/OpenCoin may have found one model: include a cryptocurrency that's used as credits in the system, and claim a large portion for yourself, which you can later sell. The problem is if they open source the software too early someone could easily create a new network with the currency allocated to themselves. [Edit] Perhaps that could be solved with a new open source license that forbids forking the network.
  - anemitz 13y ago
    I've also been considering the possibilities of an OSS security focused business. Random thoughts: * Build infrastructure necessary for other developers to build provably secure products on, license this. * Free consumer versions, paid/managed versions for corporations and governments. * Things like secure telephony have business models built in where you could charge per minute (or message) (and probably still be less than incumbent carrier minutes).
    - einhverfr 13y ago
      If you get there and want someone to bounce ideas off of or help out, feel free to let me know. (chris at efficito dot com). The one huge problem I see here is that designing a managed version which could guarantee security against a wiretap order would be quite difficult. In essence you would have to push all key management issues to your users, and that leaves you a lot less to actually manage.

silvestrov 13y ago

Cryptography doesn't help at all when your government will require you by law to provide them with a decrypted dump. That's what they did with Verizon. Verizon could not provide you with privacy no matter how much they wanted.

tlrobinson 13y ago
End-to-end encryption and p2p networks help in that respect.
anemitz 13y ago
There's no expectation of privacy at the service provider level in this case. If Verizon, or any service provider, has access to the unencrypted data or the decryption mechanism, the system is insecure. However, cryptography does help you as an individual user of a service. There's no reason we can't build systems which are provably secure and retain strict end-user data privacy.
- silvestrov 13y ago
  There is one reason: the government will make sure there are laws which enables them to require providers to give them decypted dumps. If the provider says "can't do", they will be shut down. In the end the government can force the OS vendors to install keyloggers. The ones who make the law always win.
  - deleted 13y ago
    [deleted]
Ihmahr 13y ago
That is why you should put your servers in iceland or similar places. With asymetric encription there is no need; Only the user knows and not the service provider.
- _k 13y ago
  Why in Iceland ?
  - deleted 13y ago
    [deleted]
  - Ihmahr 13y ago
    Mostly out of reach of nsa, fbi etc. More than average respect for privacy etc. Cheap green energy.
epsylon 13y ago
And, above all, end-to-end cryptography doesn't protect you against traffic analysis, which is what the NSA is doing with this metadata (which allows them to choose targets subject to a full blown surveillance).
e3pi 13y ago
Google: Deniable Cryptography and Rubberhose(update: Waterboarding) Cryptanalysis

anemitz 13y ago

This is precisely the type of attitude we should all have as hackers. It's easy to sit back and say "oh government this or corporation that sucks", we need to step up our game as builders of the software sitting on millions of devices. This is a privacy arms race -- and right now we're losing.

sharkweek 13y ago
Who are the developers who go work on these projects for the government? I feel like this is some cutting edge technology they create, so they have to be some of the best, right? Is the money that good or is there an allure to having a security clearance.
- ndr 13y ago
  I guess the money is that good.
- tlrobinson 13y ago
  Well, in this case there's no technology involved. The government simply told Verizon to hand over their records. I like how ErrataSec put it: "Welcome to Echelon 2.0: Outsourced Edition"

richtr 13y ago

While this is sound advice there is the problem that if you get very big/popular the government can knock at your door with sealed court orders to enable things like wiretapping. Case in point: "Microsoft’s tweaks to Skype could facilitate wiretapping" http://www.extremetech.com/computing/132935-microsoft-tweaking-skype-to-facilitate-wiretapping http://www.extremetech.com/computing/132935-microsoft-tweaki... If that has happened or not under the current system we will never know - which is the exact issue the OP was citing.

tlrobinson 13y ago
Build open-source, encrypted, p2p networks. Fortunately the 1st Amendment is still mostly respected, at least relative to some of the others. [Edit] Now, monetizing such software is an interesting problem. Ripple/OpenCoin may have found one model: include a cryptocurrency that's used as credits in the system, and claim a large portion for yourself, which you can later sell. The problem is if they open source the software too early someone could easily create a new network with the currency allocated to themselves. [Edit] Perhaps that could be solved with a new open source license that forbids forking the network.
- anemitz 13y ago
  I've also been considering the possibilities of an OSS security focused business. Random thoughts: * Build infrastructure necessary for other developers to build provably secure products on, license this. * Free consumer versions, paid/managed versions for corporations and governments. * Things like secure telephony have business models built in where you could charge per minute (or message) (and probably still be less than incumbent carrier minutes).
  - einhverfr 13y ago
    If you get there and want someone to bounce ideas off of or help out, feel free to let me know. (chris at efficito dot com). The one huge problem I see here is that designing a managed version which could guarantee security against a wiretap order would be quite difficult. In essence you would have to push all key management issues to your users, and that leaves you a lot less to actually manage.