16 ms·

Use of Tor and e-mail crypto could increase chances that NSA keeps your data

140 points by guelo 13y ago

foxylad 13y ago
...but that's what they would say, isn't it?
deleted 13y ago
[deleted]
echohack 13y ago
I think I'll start sending random PGP encrypted messages from my email address, along with my normal messages. Should be simple with a little Jenkins job. Good luck, have fun NSA. You liberty hating anti-American bastards.
pavanred 13y ago
If one uses Tor, the article states that the person will not be treated as a United States person unless "proven" otherwise. If that's the case, all the traffic from a Tor exit node will be considered as traffic from non U.S. persons and all data will be stored. Doesn't make sense to me because if you are using Tor right, then requests cannot be traced back to you. How does that help?
- bigiain 13y ago
  It depends on what you mean by "using TOR right" - and that depends on who/where you are and what you're trying to protect yourself against. A Chinese/Egyptian/Turkish dissident might consider it perfectly sensible to use TOR to access their gmail account - that's a perfectly valid way of hiding from your local (non-US) government and spy agencies.
  - pavanred 13y ago
    What I mean by using Tor right, for instance, is avoiding use of certain browser plugins that can potentially give away your location.
    - bigiain 13y ago
      Yeah - fair enough. On oft-hear piece of advice is to never use an identity you ever use elsewhere over TOR - for me, as a "non US person", even if I can trust TOR and TLS/SSL to ensure the privacy of my data in transit, it doesn't matter if the far end of my connection through TOR ends up at my gmail/apple/facebook/linkedin/twitter/dropbox/yahoo/amazon/any-other-US-affiliated-corporation. Being "non US" and located outside the US means the bar for any "legal requests" those companies receive is _very_ low. (Hmmm, I wonder if proxying all my web traffic through a vpn with a definitely-in-the-US endpoint might be a worthwhile bit of civil protest? I wonder if tcp connections originating from my Digital Ocean vps in New York and heading to US datacenters have slightly better legal protection or "presumtion of domestic provenance" than tcp connections originating here in Australia? Maybe I should be doing this anyway for all the analytics/ad-tracking web-bugs...)
      - jlgaddis 13y ago
        If they can see the bits coming out of your VPS in NYC and heading to other data centers, surely they can see the bits coming from .au into your VPS and correlate them?
- trothamel 13y ago
  I'd assume there's some chance that the person will screw up - even a little. The NSA is very good at exploiting very small mistakes. In the Venona project, http://en.wikipedia.org/wiki/Venona http://en.wikipedia.org/wiki/Venona, they NSA realized that the soviets were re-using one time pads. By knowing A xor C and B xor C, they were able to get A xor B - and from that, they were able to decode the messages. I could imagine things like looking at the tor traffic, and trying to match up things like writing patterns. And of course, there's the very good chance some people aren't using tor right. I don't think that what the NSA is doing is legal - but think there's a good chance it's somewhat effective.
mehrzad 13y ago
This is somewhat unrelated, but I was listening to "Leo Laporte The Tech Guy" on the local talk radio with my dad (who is a big fan, but less into tech than I) and he started describing GPG and PGP to non-tech enthusiasts. This whole NSA scandal may really push forward the use of encryption of securer communication methods.
- Amadou 13y ago
  Only if it pushes developers to make the tools dead-simple to use. If it is harder to use than facebook, 99% of the population will not bother.
  - slacka 13y ago
    Exactly this. Even though we had the company policy and Symantec PGP software installed, the engineers I worked with sill failed to use it regularly. I remember having to logmein to machine in China to try to figure out why they couldn't read our emails. This is why PGP never took off. Until the tools take 5 min to setup. And encryption/decryption is as easy as clicking a checkbox in your mail client, PGP will never take off. Things like the public key directory have to handled transparently to the user. It's too bad Mozilla dropped support for Thunderbird. Tight integration with GnuPG could have made mainstream PGP a reality.
burke 13y ago
This is fairly obvious. From the NSA's perspective, people that act like people who have something to hide are more likely to be hiding something. I'd be surprised if they didn't take it into account.
- bigiain 13y ago
  And this is why we should (and we should encourage everybody we can to) regularly do the most mundane of browsing using TOR. I'm making a personal effort to use TorBrowser whenever I have some trivial need to use a government website. I suspect I'd stop short of applying for a visa via TOR, but I'll happily look up my local state or federal politicians and their websites, or renew my car registration, or any of the other day-to-day things - in much the same way as I always choose to use BitTorrent for fully legal purposes when available - sure, we all know that 99% of Torrent traffic is copyright infringement, but at least _some_ of it is me grabbing the latest Ubuntu/Raspbian/GameOfThones (no, wait, not that last one...)
  - hobs 13y ago
    Do you just want them to store more? Because using tor to renew your car registrations seems like an obvious way to connect some dots. If that's all, then I salute you!
    - bigiain 13y ago
      Yeah - both store more, and have an archive of obviously non-intelligence relevant encrypted/TOR traffic. I like to think that one day someone will have burn gigawatts of cpu/gpu power subverting the TOR network and breaking TLS/SSL, only to discover I'd been looking up what day the recycling bins are next collected in my local area. More to the point - I want the expectation of privacy and the deployment of tools to maintain privacy in the face of technological and legal "advances" in surveillance to seem closer to "technologically informed libertarian" rather than "paranoid wingnut" or "jetliner-hijacking 3rd-world-sympathiser".
    - dfc 13y ago
      You do realize that: "A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic; who can operate onion routers of his own; and who can compromise some fraction of the onion routers."[1] If your attacker is not "a global passive adversary"(GPA) what dots are they going to connect if you renew your car registration? If your attacker is a GPA they are already connecting all the dots. [1] https://svn.torproject.org/svn/projects/design-paper/tor-design.html https://svn.torproject.org/svn/projects/design-paper/tor-des...
joezydeco 13y ago
How about steganography? We all fire off so many pictures and attachments that there has to be an avenue here.
- e3pi 13y ago
  Know of any non-obvious stego of 10MB, 100MB, and larger file size?
  - nwh 13y ago
    I suppose you need a large carrier for a large message to be hidden. Very high resolution home movies maybe? I assume you can't use content that is already public, as then the original can be compared with the modified version to prove that hidden data exists.
    - atondwal 13y ago
      porn. It gets transcoded enough that the stego could fly through as just another lossy transcoding. Better yet, lossy transcode it to something and back, then stego, as long as your target has a copy of the same transcoder and knows what you're using as reference. You should also be careful to strip metadata as to which transcoder you're using. They're PETABYTES of the stuff floating around. And if you're willing to pay a few bucks for private cams, there's no way anyone else can have a copy of your screencap, so no amount of clever transcoding will get them a reference copy.
      - nwh 13y ago
        Porn is actually quite a good one. It's something that doesn't look out of place if hidden away, and gives some plausibility to owning the stuff. More so than having home videos and no family, for example.
- monsterix 13y ago
  Try doodling your mails off the iPad instead... send text in binary form instead of HTML.
bigiain 13y ago
Since I (and the majority of global internet users) are not "US persons", they're claiming they're entitled to intercept and store all my communications anyway - so my personal reaction to this is going to be to increase the use of tor and crypto for random everyday stuff. I'll start GPG encrypting email to anybody I know will be able ro deal with it. I might even start randomly mailing GPG encrypted mail for no reason except to thwart traffic analysis (perhaps I'll automate mailing randomly chosen chunks of 1984 and Brave New World to randomly chosen public keys/emails from public keyservers - perhaps some faceless NSA analyst might one day have burned countless cpu-years decrypting my 2048bit GPG mail, only to be Rickrolled with a 70 year old cautionary tale about themself…)
- deleted 13y ago
  [deleted]
- gundy 13y ago
  If the US wants "freedom" on the internet and no internet nationalism (which just means that non-citizens get rights too), it should grant online citizenship to all people of the world. They can all be members of the empire and actually get representation rather than just the tyranny of US foreign policy.
- dfc 13y ago
  "I will start GPG encrypting email to anybody I know who will be able to deal with it" As sad as it is to say, lets be honest and admit that this is a fairly small number. How long do you think it will be till your less committed friends get tired of decrypting your emails and just ignore what you send? Make sure you only pick people that use actual email clients because gpg and Gmail is no fun. As far as the "Thomas Crowne Affair attack" goes generating effective cover traffic is not easy and random traffic is definitely a bad idea. Basic traffic analysis would be able to separate your legit emails from your cover traffic. Addendum: I noticed you just generated your new gpg key yesterday. Why not go big and use a 4096 bit key?
  - bigiain 13y ago
    Now I'm thinking of a patched SMTP server, that queues all outgoing mail - and sends mail every hour on the hour to each of my GPG enabled recipients, with a queued "real mail" if there is one or a random encrypted NSA RickRoll if there's no real mail to send. (I suspect that'd last about 121 minutes before most of my friends spam filtered me forever)
mfwoods 13y ago
This shouldn't be a surprise at all. Using Tor hides your location, so they assume you are foreign unless proven otherwise. If I were to agree with the law that allows all of the snooping that the NSA does, I'd say this is pretty reasonable. As a European, what I find more disturbing about all the news about PRISM and related programs, is how US centric the reports about it are and how little other western governments are objecting to all of this. We are always told how the USA is the EU's biggest ally, yet US politicians try to legitimize everything by saying it's only non-US citizens they spy on, and say it like then it's suddenly okay. I get that some spying is a necessary evil and 100% freedom and privacy is not feasible, especially if there are nations that are less than friendly towards you. But that's a whole different thing than recording as much data as possible, especially from friendly nations. I don't think many friendships would survive if it turned out your best friend has been hiring private investigators with the goal to records as much of your life as possible.
- jlgreco 13y ago
  > This shouldn't be a surprise at all. Using Tor hides your location, so they assume you are foreign unless proven otherwise. That covers Tor, but not the rest... > As a European, what I find more disturbing about all the news about PRISM and related programs, is how US centric the reports Agreed. I worry that the American government has done damage to the cause of globalisation that will take a very long time to heal. This is a problem for us all.
  - D9u 13y ago
    Just what is the cause of globalisation given the current political & economic climate? Is it global surveillance? Military domination? Economic centralization? Or is it something more benign?
    - jlgreco 13y ago
      Economic and travel freedom? Mutual understanding and the exchange of culture?
  - 13y ago
gt565k 13y ago
The NSA operates a Tor exit node at Georgia Tech, and likely at other research institutes and universities. The fact of the matter is, people who use Tor are the ones trying to hide from the government, and it only makes sense for the NSA to run Tor exit nodes and analyze all traffic passing through them. You probably have more privacy by not using Tor at all.
- fixxer 13y ago
  Can you cite your source regarding the NSA operated Tor exit? I do not mean this to be snarky -- if you have a legitimate source other than hearsay, I'd love to see it.
  - gt565k 13y ago
    No I cannot, because this individual stated that "a 3 letter federal agency" operates the node. Thus never really saying it was the NSA. Given the recent news though, one can only guess it was the NSA. Is it really that hard to believe? Considering that the Georgia Tech Research Institute (GTRI) gets mostly DoD contracts and research grants and a lot of those contracts are for classified projects.
    - dfc 13y ago
      It all makes sense now. No it is not hard to believe that NSA doles out a lot of research money to schools across the country. Information Assurance is one of NSA's core missions.
    - wiml 13y ago
      The US Office of Naval Research (ONR) is a three-letter agency...
    - fixxer 13y ago
      When I was in college, we always heard rumors of CIA doing this and NSA doing that... with the exception of the few NSA mathematicians who took sabbaticals in our math department, I generally assumed it was BS. (They were really nice guys, by the way. I learned elliptical factorization from one of them. Sure wish I remembered it!) This was the late 90s, not the heydey of LSD research and all that crazy stuff. I only wish... Now, as for DoD funding institutional research, absolutely (they funded me last year for something completely benign and outside the scope for "info wars"). They fund research at a lot more places than GT. So, yes, plausible. But, unlikely IMO that NSA has an active presence on your campus doing intelligence work. BTW, I challenge your claim that GT gets "mostly DoD". I'm sure your school is primarily funded by NSF (the preferred government tit to suck on). DoD is actually a pain in the ass to deal with because they don't go away after the money changes hands. Same is true for SBIR/STTR. Finally, DoD classifies everything. Don't let that label fool you into thinking the work is sensitive (or even interesting). Within academia, this is less so because the objective of funding institutional research to produce publications. Contract R&D is not something that is popular with faculty (or the school, since depending on the IP ownership, it can put their tax exempt status at risk.) That said, keep snooping and let us know what you find in that room labeled "no personnel permitted without super-duper top secret clearance".
dfc 13y ago
If you want to read the documents without having to use that awful viewer or load js from every social networking site known to man: (increment the p# from 1-9) Procedures used by NSA to target non-US persons: Exhibit A: https://s3.amazonaws.com/s3.documentcloud.org/documents/716633/pages/exhibit-a-p1-large.gif https://s3.amazonaws.com/s3.documentcloud.org/documents/7166... Procedures used by NSA to minimize data collection from US persons: Exhibit B: https://s3.amazonaws.com/s3.documentcloud.org/documents/716634/pages/exhibit-b-p1-large.gif https://s3.amazonaws.com/s3.documentcloud.org/documents/7166... It is amazing how many requests the guardian wants to make to third party sites.
- deleted 13y ago
  [deleted]
- mpyne 13y ago
  > It is amazing how many requests the guardian wants to make to third party sites. Maybe they're just trying to make sure every social site knows you're there so that NSA can figure it out later with PRISM? ;)
- nano111 13y ago
  Or all pages in PDF: https://s3.amazonaws.com/s3.documentcloud.org/documents/716633/exhibit-a.pdf https://s3.amazonaws.com/s3.documentcloud.org/documents/7166... https://s3.amazonaws.com/s3.documentcloud.org/documents/716634/exhibit-b.pdf https://s3.amazonaws.com/s3.documentcloud.org/documents/7166...
ewzimm 13y ago
The only long-term way to hide data is not to use public networks for communication. Eventually, quantum computers should be able to eat though any of today's crypto. It will be interesting to see what happens when everyone running for public office has their entire life on display.
- taway2012 13y ago
  > Eventually, quantum computers should be able to eat though any of today's crypto Probably not. Quoting from http://blog.agilebits.com/2013/03/09/guess-why-were-moving-to-256-bit-aes-keys/ http://blog.agilebits.com/2013/03/09/guess-why-were-moving-t...: A quantum of bits [Update: March 20, 2013] I reached out to the cryptographic community for any insight into Molly’s question about why the NSA insists that TOP SECRET material be encrypted using 256-bit keys. The answer came from Steven Bellovin of Columbia University: @jpgoldberg @marshray Just heard that during the AES competition, NSA said in the open meetings it was for defense against quantum computing Quantum computers, if they are every made practical, will be able to do amazing things. They will certainly change how we design cryptographic systems. It’s not that quantum computers will be faster or more powerful. Indeed, in some very important respects they will be less powerful than current computers. But there are some things that they will be able to do in less “time”. I put “time” in scare quotes because it has a different meaning in this context from the ordinary use of the word. Oh, what a big difference it is. In this context it means the number of distinct steps an algorithm must take in performing some computation. Searching through 2128 keys (on a classical, non-quantum, computer) takes a number of steps that is proportional to 2128. But for a quantum computer it takes a number of steps proportional to the square root of that number, 264. If a quantum computer is ever built capable of performing that task, we don’t know how the actual speed of each individual step will compare to those of current computers, but the NSA is taking no chances. Something with the effective strength of a 64-bit key isn’t strong enough. A 256-bit key against a quantum brute force attack would have the effective strength of a 128 bit key against a classical brute force attack. I very much doubt that we will see a quantum computer actually capable of handing such things within the next thirty years. But if the past is any guide, my predictions about the future should be taken with a large grain of salt.
hispeedencrypt 13y ago
I think this is the saddest aspect of these spying programs and the ensuing paranoia... it actually might discourage people from using encryption or anonymizing proxies... for fear it will get them on a watch list. If you start using PGP for all your email, then you by inference "have something to hide". Brilliant logic. What a mess.
- nano111 13y ago
  I think the opposite
e3pi 13y ago
"The document, titled Minimization Procedures Used by the National Security Agency in Connection with Acquisitions of Foreign Intelligence, is the latest bombshell leak to be dropped by UK-based newspaper The Guardian." All good news! 1: The Guardian is still time-releasing, I thought they caved under a IGIC -sorry, what ever its called over there - gag order. 2: Now we know what to do to backup into the NSA cloud! Another USA world benefit: a highly secure service for all the world to avail themselves for free. 3: web app $opportunity$! tor p2p delivery and crypto of your files into free NSA Cloud, for only $0.99!
- gsnedders 13y ago
  The D-notice system is a "request" to not publish — they are completely non-binding. They still are unable to publish anything covered by the Official Secrets Acts, but any leak from a foreign intelligence agency is not covered by that.
- selimthegrim 13y ago
  It's called a D-notice. http://en.wikipedia.org/wiki/DA-Notice http://en.wikipedia.org/wiki/DA-Notice
  - e3pi 13y ago
    > "....The Ministry of Defence has issued a D notice preventing the UK media from 'publish[ing] information that may "jeopardise both national security and possibly UK personnel"'. http://www.guardian.co.uk/world/2013/jun/17/defence-d-bbc-me... http://www.guardian.co.uk/world/2013/jun/17/defence-d-bbc-me....
ChrisAntaki 13y ago
The title implies the NSA would delete any of it, by their own volition. I don't believe they would, since any data could retroactively become useful to them.
mpyne 13y ago
I suppose that means the NSA has been keeping my data since 2002 or so.
chacham15 13y ago
I think that the idea that "using crypto will cause the nsa to keep your data longer" is a hindrance to progress. Everyone should be using crypto and everyone should have privacy. When we begin to be afraid of what someone will do if we protect our interests, we start giving up those interests and that is not something I am prepared to do.
- teeja 13y ago
  Maybe the prospect of someday burning gigawatts to decipher my elliptic-curved peanut-butter-cookie recipes will alert them to what a charade they're part of. We must create boogeymen from a vacuum so that we can burn taxpayer dollars to further enrich the right people. Unlike biochemicals, encryption, storage and analysis are benevolent forms of collateral damage as they lead to increases in computing power and mathematical insights.
donniezazen 13y ago
If you access a known account through Tor or any other identity hiding protocol could possibly expose you. And I wonder if it is impossible for US government to break encryption if it is specifically after you.
damaru 13y ago
That's always what I have though about using tor and other encryption, if you try to hide clumsily it might have the adverse effect. If you know how to use all the tools and don't make the error of login to social network, then it can be useful, but in general I doubt it can protect us. Sending letter might become the most secure way of communication after all, or book with hidden glued pages!
linuxhansl 13y ago
That might be the case, but even the NSA will not be able to decrypt a well encrypted message - or so we think at least. That all said - and I realize that this might be controversial - I fully agree with wiretaps as long as there is a warrant (and I mean a real warrant from a real court on a case-by-case basis). With its sweeping data collection the NSA is doing itself a disservice as it will eventually lead to wider use of strong encryption, which will make wiretaps with warrants much more expensive (or even impossible) to serve. I think new laws for stricter limitations on exporting cryptography software or even restricting cryptography itself are likely in the near future. This will lead to interesting trials where folks might be forced to reveal their encryption keys; and the inability to prove whether there actually is encrypted data (good encrypted data is indistinguishable from random data, and some folks wipe old harddrives with random data before they are discarded, how would one prove that this is really random data?)
aspensmonster 13y ago
I think this is the more interesting aspect: >"reasonably believed to contain evidence of a crime that has been, is being, or is about to be committed." Is this sort of intelligence gathering of domestic signals handed over to other relevant authorities? I'm sure the DEA would love to have the NSA's assistance in tracking down drug dealers. I'm just not convinced it has much of anything to do with national security. Also, does use of HTTPS constitute "communications that are enciphered?"

140 points by guelo 13y ago

foxylad 13y ago

...but that's what they would say, isn't it?

deleted 13y ago

[deleted]

echohack 13y ago

I think I'll start sending random PGP encrypted messages from my email address, along with my normal messages. Should be simple with a little Jenkins job. Good luck, have fun NSA. You liberty hating anti-American bastards.

pavanred 13y ago

If one uses Tor, the article states that the person will not be treated as a United States person unless "proven" otherwise. If that's the case, all the traffic from a Tor exit node will be considered as traffic from non U.S. persons and all data will be stored. Doesn't make sense to me because if you are using Tor right, then requests cannot be traced back to you. How does that help?

bigiain 13y ago
It depends on what you mean by "using TOR right" - and that depends on who/where you are and what you're trying to protect yourself against. A Chinese/Egyptian/Turkish dissident might consider it perfectly sensible to use TOR to access their gmail account - that's a perfectly valid way of hiding from your local (non-US) government and spy agencies.
- pavanred 13y ago
  What I mean by using Tor right, for instance, is avoiding use of certain browser plugins that can potentially give away your location.
  - bigiain 13y ago
    Yeah - fair enough. On oft-hear piece of advice is to never use an identity you ever use elsewhere over TOR - for me, as a "non US person", even if I can trust TOR and TLS/SSL to ensure the privacy of my data in transit, it doesn't matter if the far end of my connection through TOR ends up at my gmail/apple/facebook/linkedin/twitter/dropbox/yahoo/amazon/any-other-US-affiliated-corporation. Being "non US" and located outside the US means the bar for any "legal requests" those companies receive is _very_ low. (Hmmm, I wonder if proxying all my web traffic through a vpn with a definitely-in-the-US endpoint might be a worthwhile bit of civil protest? I wonder if tcp connections originating from my Digital Ocean vps in New York and heading to US datacenters have slightly better legal protection or "presumtion of domestic provenance" than tcp connections originating here in Australia? Maybe I should be doing this anyway for all the analytics/ad-tracking web-bugs...)
    - jlgaddis 13y ago
      If they can see the bits coming out of your VPS in NYC and heading to other data centers, surely they can see the bits coming from .au into your VPS and correlate them?
trothamel 13y ago
I'd assume there's some chance that the person will screw up - even a little. The NSA is very good at exploiting very small mistakes. In the Venona project, http://en.wikipedia.org/wiki/Venona http://en.wikipedia.org/wiki/Venona, they NSA realized that the soviets were re-using one time pads. By knowing A xor C and B xor C, they were able to get A xor B - and from that, they were able to decode the messages. I could imagine things like looking at the tor traffic, and trying to match up things like writing patterns. And of course, there's the very good chance some people aren't using tor right. I don't think that what the NSA is doing is legal - but think there's a good chance it's somewhat effective.

mehrzad 13y ago

This is somewhat unrelated, but I was listening to "Leo Laporte The Tech Guy" on the local talk radio with my dad (who is a big fan, but less into tech than I) and he started describing GPG and PGP to non-tech enthusiasts. This whole NSA scandal may really push forward the use of encryption of securer communication methods.

Amadou 13y ago
Only if it pushes developers to make the tools dead-simple to use. If it is harder to use than facebook, 99% of the population will not bother.
- slacka 13y ago
  Exactly this. Even though we had the company policy and Symantec PGP software installed, the engineers I worked with sill failed to use it regularly. I remember having to logmein to machine in China to try to figure out why they couldn't read our emails. This is why PGP never took off. Until the tools take 5 min to setup. And encryption/decryption is as easy as clicking a checkbox in your mail client, PGP will never take off. Things like the public key directory have to handled transparently to the user. It's too bad Mozilla dropped support for Thunderbird. Tight integration with GnuPG could have made mainstream PGP a reality.

burke 13y ago

This is fairly obvious. From the NSA's perspective, people that act like people who have something to hide are more likely to be hiding something. I'd be surprised if they didn't take it into account.

bigiain 13y ago
And this is why we should (and we should encourage everybody we can to) regularly do the most mundane of browsing using TOR. I'm making a personal effort to use TorBrowser whenever I have some trivial need to use a government website. I suspect I'd stop short of applying for a visa via TOR, but I'll happily look up my local state or federal politicians and their websites, or renew my car registration, or any of the other day-to-day things - in much the same way as I always choose to use BitTorrent for fully legal purposes when available - sure, we all know that 99% of Torrent traffic is copyright infringement, but at least _some_ of it is me grabbing the latest Ubuntu/Raspbian/GameOfThones (no, wait, not that last one...)
- hobs 13y ago
  Do you just want them to store more? Because using tor to renew your car registrations seems like an obvious way to connect some dots. If that's all, then I salute you!
  - bigiain 13y ago
    Yeah - both store more, and have an archive of obviously non-intelligence relevant encrypted/TOR traffic. I like to think that one day someone will have burn gigawatts of cpu/gpu power subverting the TOR network and breaking TLS/SSL, only to discover I'd been looking up what day the recycling bins are next collected in my local area. More to the point - I want the expectation of privacy and the deployment of tools to maintain privacy in the face of technological and legal "advances" in surveillance to seem closer to "technologically informed libertarian" rather than "paranoid wingnut" or "jetliner-hijacking 3rd-world-sympathiser".
  - dfc 13y ago
    You do realize that: "A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic; who can operate onion routers of his own; and who can compromise some fraction of the onion routers."[1] If your attacker is not "a global passive adversary"(GPA) what dots are they going to connect if you renew your car registration? If your attacker is a GPA they are already connecting all the dots. [1] https://svn.torproject.org/svn/projects/design-paper/tor-design.html https://svn.torproject.org/svn/projects/design-paper/tor-des...

joezydeco 13y ago

How about steganography? We all fire off so many pictures and attachments that there has to be an avenue here.

e3pi 13y ago
Know of any non-obvious stego of 10MB, 100MB, and larger file size?
- nwh 13y ago
  I suppose you need a large carrier for a large message to be hidden. Very high resolution home movies maybe? I assume you can't use content that is already public, as then the original can be compared with the modified version to prove that hidden data exists.
  - atondwal 13y ago
    porn. It gets transcoded enough that the stego could fly through as just another lossy transcoding. Better yet, lossy transcode it to something and back, then stego, as long as your target has a copy of the same transcoder and knows what you're using as reference. You should also be careful to strip metadata as to which transcoder you're using. They're PETABYTES of the stuff floating around. And if you're willing to pay a few bucks for private cams, there's no way anyone else can have a copy of your screencap, so no amount of clever transcoding will get them a reference copy.
    - nwh 13y ago
      Porn is actually quite a good one. It's something that doesn't look out of place if hidden away, and gives some plausibility to owning the stuff. More so than having home videos and no family, for example.
monsterix 13y ago
Try doodling your mails off the iPad instead... send text in binary form instead of HTML.

bigiain 13y ago

Since I (and the majority of global internet users) are not "US persons", they're claiming they're entitled to intercept and store all my communications anyway - so my personal reaction to this is going to be to increase the use of tor and crypto for random everyday stuff. I'll start GPG encrypting email to anybody I know will be able ro deal with it. I might even start randomly mailing GPG encrypted mail for no reason except to thwart traffic analysis (perhaps I'll automate mailing randomly chosen chunks of 1984 and Brave New World to randomly chosen public keys/emails from public keyservers - perhaps some faceless NSA analyst might one day have burned countless cpu-years decrypting my 2048bit GPG mail, only to be Rickrolled with a 70 year old cautionary tale about themself…)

deleted 13y ago
[deleted]
gundy 13y ago
If the US wants "freedom" on the internet and no internet nationalism (which just means that non-citizens get rights too), it should grant online citizenship to all people of the world. They can all be members of the empire and actually get representation rather than just the tyranny of US foreign policy.
dfc 13y ago
"I will start GPG encrypting email to anybody I know who will be able to deal with it" As sad as it is to say, lets be honest and admit that this is a fairly small number. How long do you think it will be till your less committed friends get tired of decrypting your emails and just ignore what you send? Make sure you only pick people that use actual email clients because gpg and Gmail is no fun. As far as the "Thomas Crowne Affair attack" goes generating effective cover traffic is not easy and random traffic is definitely a bad idea. Basic traffic analysis would be able to separate your legit emails from your cover traffic. Addendum: I noticed you just generated your new gpg key yesterday. Why not go big and use a 4096 bit key?
- bigiain 13y ago
  Now I'm thinking of a patched SMTP server, that queues all outgoing mail - and sends mail every hour on the hour to each of my GPG enabled recipients, with a queued "real mail" if there is one or a random encrypted NSA RickRoll if there's no real mail to send. (I suspect that'd last about 121 minutes before most of my friends spam filtered me forever)

mfwoods 13y ago

This shouldn't be a surprise at all. Using Tor hides your location, so they assume you are foreign unless proven otherwise. If I were to agree with the law that allows all of the snooping that the NSA does, I'd say this is pretty reasonable. As a European, what I find more disturbing about all the news about PRISM and related programs, is how US centric the reports about it are and how little other western governments are objecting to all of this. We are always told how the USA is the EU's biggest ally, yet US politicians try to legitimize everything by saying it's only non-US citizens they spy on, and say it like then it's suddenly okay. I get that some spying is a necessary evil and 100% freedom and privacy is not feasible, especially if there are nations that are less than friendly towards you. But that's a whole different thing than recording as much data as possible, especially from friendly nations. I don't think many friendships would survive if it turned out your best friend has been hiring private investigators with the goal to records as much of your life as possible.

jlgreco 13y ago
> This shouldn't be a surprise at all. Using Tor hides your location, so they assume you are foreign unless proven otherwise. That covers Tor, but not the rest... > As a European, what I find more disturbing about all the news about PRISM and related programs, is how US centric the reports Agreed. I worry that the American government has done damage to the cause of globalisation that will take a very long time to heal. This is a problem for us all.
- D9u 13y ago
  Just what is the cause of globalisation given the current political & economic climate? Is it global surveillance? Military domination? Economic centralization? Or is it something more benign?
  - jlgreco 13y ago
    Economic and travel freedom? Mutual understanding and the exchange of culture?
- 13y ago

gt565k 13y ago

The NSA operates a Tor exit node at Georgia Tech, and likely at other research institutes and universities. The fact of the matter is, people who use Tor are the ones trying to hide from the government, and it only makes sense for the NSA to run Tor exit nodes and analyze all traffic passing through them. You probably have more privacy by not using Tor at all.

fixxer 13y ago
Can you cite your source regarding the NSA operated Tor exit? I do not mean this to be snarky -- if you have a legitimate source other than hearsay, I'd love to see it.
- gt565k 13y ago
  No I cannot, because this individual stated that "a 3 letter federal agency" operates the node. Thus never really saying it was the NSA. Given the recent news though, one can only guess it was the NSA. Is it really that hard to believe? Considering that the Georgia Tech Research Institute (GTRI) gets mostly DoD contracts and research grants and a lot of those contracts are for classified projects.
  - dfc 13y ago
    It all makes sense now. No it is not hard to believe that NSA doles out a lot of research money to schools across the country. Information Assurance is one of NSA's core missions.
  - wiml 13y ago
    The US Office of Naval Research (ONR) is a three-letter agency...
  - fixxer 13y ago
    When I was in college, we always heard rumors of CIA doing this and NSA doing that... with the exception of the few NSA mathematicians who took sabbaticals in our math department, I generally assumed it was BS. (They were really nice guys, by the way. I learned elliptical factorization from one of them. Sure wish I remembered it!) This was the late 90s, not the heydey of LSD research and all that crazy stuff. I only wish... Now, as for DoD funding institutional research, absolutely (they funded me last year for something completely benign and outside the scope for "info wars"). They fund research at a lot more places than GT. So, yes, plausible. But, unlikely IMO that NSA has an active presence on your campus doing intelligence work. BTW, I challenge your claim that GT gets "mostly DoD". I'm sure your school is primarily funded by NSF (the preferred government tit to suck on). DoD is actually a pain in the ass to deal with because they don't go away after the money changes hands. Same is true for SBIR/STTR. Finally, DoD classifies everything. Don't let that label fool you into thinking the work is sensitive (or even interesting). Within academia, this is less so because the objective of funding institutional research to produce publications. Contract R&D is not something that is popular with faculty (or the school, since depending on the IP ownership, it can put their tax exempt status at risk.) That said, keep snooping and let us know what you find in that room labeled "no personnel permitted without super-duper top secret clearance".

dfc 13y ago

If you want to read the documents without having to use that awful viewer or load js from every social networking site known to man: (increment the p# from 1-9) Procedures used by NSA to target non-US persons: Exhibit A: https://s3.amazonaws.com/s3.documentcloud.org/documents/716633/pages/exhibit-a-p1-large.gif https://s3.amazonaws.com/s3.documentcloud.org/documents/7166... Procedures used by NSA to minimize data collection from US persons: Exhibit B: https://s3.amazonaws.com/s3.documentcloud.org/documents/716634/pages/exhibit-b-p1-large.gif https://s3.amazonaws.com/s3.documentcloud.org/documents/7166... It is amazing how many requests the guardian wants to make to third party sites.

deleted 13y ago
[deleted]
mpyne 13y ago
> It is amazing how many requests the guardian wants to make to third party sites. Maybe they're just trying to make sure every social site knows you're there so that NSA can figure it out later with PRISM? ;)
nano111 13y ago
Or all pages in PDF: https://s3.amazonaws.com/s3.documentcloud.org/documents/716633/exhibit-a.pdf https://s3.amazonaws.com/s3.documentcloud.org/documents/7166... https://s3.amazonaws.com/s3.documentcloud.org/documents/716634/exhibit-b.pdf https://s3.amazonaws.com/s3.documentcloud.org/documents/7166...

ewzimm 13y ago

The only long-term way to hide data is not to use public networks for communication. Eventually, quantum computers should be able to eat though any of today's crypto. It will be interesting to see what happens when everyone running for public office has their entire life on display.

taway2012 13y ago
> Eventually, quantum computers should be able to eat though any of today's crypto Probably not. Quoting from http://blog.agilebits.com/2013/03/09/guess-why-were-moving-to-256-bit-aes-keys/ http://blog.agilebits.com/2013/03/09/guess-why-were-moving-t...: A quantum of bits [Update: March 20, 2013] I reached out to the cryptographic community for any insight into Molly’s question about why the NSA insists that TOP SECRET material be encrypted using 256-bit keys. The answer came from Steven Bellovin of Columbia University: @jpgoldberg @marshray Just heard that during the AES competition, NSA said in the open meetings it was for defense against quantum computing Quantum computers, if they are every made practical, will be able to do amazing things. They will certainly change how we design cryptographic systems. It’s not that quantum computers will be faster or more powerful. Indeed, in some very important respects they will be less powerful than current computers. But there are some things that they will be able to do in less “time”. I put “time” in scare quotes because it has a different meaning in this context from the ordinary use of the word. Oh, what a big difference it is. In this context it means the number of distinct steps an algorithm must take in performing some computation. Searching through 2128 keys (on a classical, non-quantum, computer) takes a number of steps that is proportional to 2128. But for a quantum computer it takes a number of steps proportional to the square root of that number, 264. If a quantum computer is ever built capable of performing that task, we don’t know how the actual speed of each individual step will compare to those of current computers, but the NSA is taking no chances. Something with the effective strength of a 64-bit key isn’t strong enough. A 256-bit key against a quantum brute force attack would have the effective strength of a 128 bit key against a classical brute force attack. I very much doubt that we will see a quantum computer actually capable of handing such things within the next thirty years. But if the past is any guide, my predictions about the future should be taken with a large grain of salt.

hispeedencrypt 13y ago

I think this is the saddest aspect of these spying programs and the ensuing paranoia... it actually might discourage people from using encryption or anonymizing proxies... for fear it will get them on a watch list. If you start using PGP for all your email, then you by inference "have something to hide". Brilliant logic. What a mess.

nano111 13y ago
I think the opposite

e3pi 13y ago

"The document, titled Minimization Procedures Used by the National Security Agency in Connection with Acquisitions of Foreign Intelligence, is the latest bombshell leak to be dropped by UK-based newspaper The Guardian." All good news! 1: The Guardian is still time-releasing, I thought they caved under a IGIC -sorry, what ever its called over there - gag order. 2: Now we know what to do to backup into the NSA cloud! Another USA world benefit: a highly secure service for all the world to avail themselves for free. 3: web app $opportunity$! tor p2p delivery and crypto of your files into free NSA Cloud, for only $0.99!

gsnedders 13y ago
The D-notice system is a "request" to not publish — they are completely non-binding. They still are unable to publish anything covered by the Official Secrets Acts, but any leak from a foreign intelligence agency is not covered by that.
selimthegrim 13y ago
It's called a D-notice. http://en.wikipedia.org/wiki/DA-Notice http://en.wikipedia.org/wiki/DA-Notice
- e3pi 13y ago
  > "....The Ministry of Defence has issued a D notice preventing the UK media from 'publish[ing] information that may "jeopardise both national security and possibly UK personnel"'. http://www.guardian.co.uk/world/2013/jun/17/defence-d-bbc-me... http://www.guardian.co.uk/world/2013/jun/17/defence-d-bbc-me....

ChrisAntaki 13y ago

The title implies the NSA would delete any of it, by their own volition. I don't believe they would, since any data could retroactively become useful to them.

mpyne 13y ago

I suppose that means the NSA has been keeping my data since 2002 or so.

chacham15 13y ago

I think that the idea that "using crypto will cause the nsa to keep your data longer" is a hindrance to progress. Everyone should be using crypto and everyone should have privacy. When we begin to be afraid of what someone will do if we protect our interests, we start giving up those interests and that is not something I am prepared to do.

teeja 13y ago
Maybe the prospect of someday burning gigawatts to decipher my elliptic-curved peanut-butter-cookie recipes will alert them to what a charade they're part of. We must create boogeymen from a vacuum so that we can burn taxpayer dollars to further enrich the right people. Unlike biochemicals, encryption, storage and analysis are benevolent forms of collateral damage as they lead to increases in computing power and mathematical insights.

donniezazen 13y ago

If you access a known account through Tor or any other identity hiding protocol could possibly expose you. And I wonder if it is impossible for US government to break encryption if it is specifically after you.

damaru 13y ago

That's always what I have though about using tor and other encryption, if you try to hide clumsily it might have the adverse effect. If you know how to use all the tools and don't make the error of login to social network, then it can be useful, but in general I doubt it can protect us. Sending letter might become the most secure way of communication after all, or book with hidden glued pages!

linuxhansl 13y ago

That might be the case, but even the NSA will not be able to decrypt a well encrypted message - or so we think at least. That all said - and I realize that this might be controversial - I fully agree with wiretaps as long as there is a warrant (and I mean a real warrant from a real court on a case-by-case basis). With its sweeping data collection the NSA is doing itself a disservice as it will eventually lead to wider use of strong encryption, which will make wiretaps with warrants much more expensive (or even impossible) to serve. I think new laws for stricter limitations on exporting cryptography software or even restricting cryptography itself are likely in the near future. This will lead to interesting trials where folks might be forced to reveal their encryption keys; and the inability to prove whether there actually is encrypted data (good encrypted data is indistinguishable from random data, and some folks wipe old harddrives with random data before they are discarded, how would one prove that this is really random data?)

aspensmonster 13y ago

I think this is the more interesting aspect: >"reasonably believed to contain evidence of a crime that has been, is being, or is about to be committed." Is this sort of intelligence gathering of domestic signals handed over to other relevant authorities? I'm sure the DEA would love to have the NSA's assistance in tracking down drug dealers. I'm just not convinced it has much of anything to do with national security. Also, does use of HTTPS constitute "communications that are enciphered?"