4 ms·

If the NSA is saying that all encrypted communication is automatically suspicious, then everyone should use encryption for all data they send over the internet.

If the NSA is saying that all encrypted communication is automatically suspicious, then everyone should use encryption for all data they send over the internet. Starting today, I am writing email encryption software that, when you send an email to someone else with the software installed, will automatically encrypt it on the way out, and automatically decrypt any encrypted messages on the way in. (A "zero user interface" once installed). The intention is that this will allow people to encrypt their messages with zero effort on their part. Initially it will encrypt email and will run on unixlike machines (Linux and Mac). Later it will run on all major platforms (Windows, iOS, Android) and have functionality for VoIP and social networking (the intention is to replace Skype and Facebook with secure alternatives).

pwnna 13y ago
This should be open source software as there needs to be security reviews and what not. Also, checkout OWS: https://whispersystems.org/ https://whispersystems.org/
- cabalamat 13y ago
  > This should be open source software as there needs to be security reviews and what not. It will be open source.
gfodor 13y ago
If you really want this to work you should target the webmail use case for the big three webmail providers. Nobody wants to use a standalone client on a PC, if that's what you are suggesting. Next up is a mobile client for Android and iOS that works identically to the existing mail client on those platform so there is no learning curve. In other words, this will be a long slog where most of the work is product-oriented and feature Xerox'ing, and not whiz-bang cool encryption oriented. Good luck :)
- chacham15 13y ago
  Im unsure of what you are describing. Are you stating that hotmail should be able to display your decrypted emails? That would imply that they themselves would be able to read it and therefore remove any benefit. Any website you would build would have the same problem unless you resort to js crypto in which the js can be changed on you in a second (when the government forces your company to do so) and send the private key to the nsa. How exactly are you envisioning a solution?
  - ordinary 13y ago
    There is no need for that decryption to occur server-side.
    - sneak 13y ago
      Where will the keys be stored? How will they be distributed and replaced? Who will generate them? How will they get on my phone? What happens when my phone is stolen? How will they get to the people who want to communicate with me?
      - gfodor 13y ago
        Ie, this is a hard design problem. Hacking out a local client usable by unix nerds punts on these problems, more or less. Solve these problems in a way that fits into the workflow of present day average e-mail users (ie, my mom) and you will have something.
- __--__ 13y ago
  Nobody wants to use a standalone client on a PC, if that's what you are suggesting. I do. Am I the only one who finds web-based email clients insufferably slow?
  - Zigurd 13y ago
    And next week, after someone demos an easy-to-use encrypted system, the same naysayers will be all about how it helps drug dealers and other baddies.
- deleted 13y ago
  [deleted]
- cabalamat 13y ago
  > Nobody wants to use a standalone client on a PC What if your standalone client is a website running on your local box with an interface similar to gmail? > In other words, this will be a long slog where most of the work is product-oriented and feature Xerox'ing, and not whiz-bang cool encryption oriented. Yes, you're right. The crypto itself isn't that complicated.
codex 13y ago
No, that's not what the NSA is saying. The regulations only apply to material inadvertently collected while targeting a specific foreign target (who, presumably, might be routing their traffic through the U.S. to evade surveillance). If the information is encrypted, the NSA doesn't know if it's real domestic communications, or foreign communications, until it can be decrypted, so it's kept until it can be decrypted. Otherwise, a foreign target would easily be able to evade intercept simply by making their traffic appear to be domestic.
- MereInterest 13y ago
  And all of their arguments start from the wrong side. It should not be "We stop listening as soon as we know that it is a US citizen." Instead, it should be "We only start listening once we know that it is not a US citizen." And that is ignoring the whole aspect of it that they shouldn't be doing blanket surveillance to begin with, and should only be doing targeted surveillance, whether or not it is against a US citizen.
sneak 13y ago
Users can't and won't securely store key material, even their own. Servers that store key material are subject to wiretaps. We're not lacking secure alternatives because this isn't a technical problem.
- johnchristopher 13y ago
  > Users can't and won't securely store key material, even their own. I believe it is an interface problem. I am surprised Mozilla isn't re-activating Thunderbird with an easier to use encryption procedure and an educational campaign to raise awareness in users instead of making petitions around Firefox.

pwnna 13y ago

This should be open source software as there needs to be security reviews and what not. Also, checkout OWS: https://whispersystems.org/ https://whispersystems.org/

cabalamat 13y ago
> This should be open source software as there needs to be security reviews and what not. It will be open source.

gfodor 13y ago

If you really want this to work you should target the webmail use case for the big three webmail providers. Nobody wants to use a standalone client on a PC, if that's what you are suggesting. Next up is a mobile client for Android and iOS that works identically to the existing mail client on those platform so there is no learning curve. In other words, this will be a long slog where most of the work is product-oriented and feature Xerox'ing, and not whiz-bang cool encryption oriented. Good luck :)

chacham15 13y ago
Im unsure of what you are describing. Are you stating that hotmail should be able to display your decrypted emails? That would imply that they themselves would be able to read it and therefore remove any benefit. Any website you would build would have the same problem unless you resort to js crypto in which the js can be changed on you in a second (when the government forces your company to do so) and send the private key to the nsa. How exactly are you envisioning a solution?
- ordinary 13y ago
  There is no need for that decryption to occur server-side.
  - sneak 13y ago
    Where will the keys be stored? How will they be distributed and replaced? Who will generate them? How will they get on my phone? What happens when my phone is stolen? How will they get to the people who want to communicate with me?
    - gfodor 13y ago
      Ie, this is a hard design problem. Hacking out a local client usable by unix nerds punts on these problems, more or less. Solve these problems in a way that fits into the workflow of present day average e-mail users (ie, my mom) and you will have something.
__--__ 13y ago
Nobody wants to use a standalone client on a PC, if that's what you are suggesting. I do. Am I the only one who finds web-based email clients insufferably slow?
- Zigurd 13y ago
  And next week, after someone demos an easy-to-use encrypted system, the same naysayers will be all about how it helps drug dealers and other baddies.
deleted 13y ago
[deleted]
cabalamat 13y ago
> Nobody wants to use a standalone client on a PC What if your standalone client is a website running on your local box with an interface similar to gmail? > In other words, this will be a long slog where most of the work is product-oriented and feature Xerox'ing, and not whiz-bang cool encryption oriented. Yes, you're right. The crypto itself isn't that complicated.

codex 13y ago

No, that's not what the NSA is saying. The regulations only apply to material inadvertently collected while targeting a specific foreign target (who, presumably, might be routing their traffic through the U.S. to evade surveillance). If the information is encrypted, the NSA doesn't know if it's real domestic communications, or foreign communications, until it can be decrypted, so it's kept until it can be decrypted. Otherwise, a foreign target would easily be able to evade intercept simply by making their traffic appear to be domestic.

MereInterest 13y ago
And all of their arguments start from the wrong side. It should not be "We stop listening as soon as we know that it is a US citizen." Instead, it should be "We only start listening once we know that it is not a US citizen." And that is ignoring the whole aspect of it that they shouldn't be doing blanket surveillance to begin with, and should only be doing targeted surveillance, whether or not it is against a US citizen.

sneak 13y ago

Users can't and won't securely store key material, even their own. Servers that store key material are subject to wiretaps. We're not lacking secure alternatives because this isn't a technical problem.

johnchristopher 13y ago
> Users can't and won't securely store key material, even their own. I believe it is an interface problem. I am surprised Mozilla isn't re-activating Thunderbird with an easier to use encryption procedure and an educational campaign to raise awareness in users instead of making petitions around Firefox.