6 ms·

Brazilian government studying the creation of a free encrypted email service

89 points by aoldoni 13y ago

byoogle 13y ago
> State may finance the project through ad sales. We'll just go ahead and let these advertisers spy on you instead.
- galaktor 13y ago
  Government-controlled email service financed through adverts... not very trust-inspiring.
eksith 13y ago
Maybe that will work for privacy which we can also work with here, but doesn't solve the anonymity problem. This reminds me... Anonymous remailers have been around for quite a while. The idea being, you get your mail through a forwarding service that wraps the package to the final destination (or another anonymous forwarder) so the sender doesn't know where the final destination is actually. I don't know of something similar can be implemented with email because you still need headers to be visible. Unless email too can be wrapped in multiple layers of encryption, headers and all, that each subsequent relay must decrypt before finding the destination.
- vidarh 13y ago
  > I don't know of something similar can be implemented with email because you still need headers to be visible. Anon.penet.fi - the first well known anonymising e-mail remailer - is 20 years this year: http://en.wikipedia.org/wiki/Penet_remailer http://en.wikipedia.org/wiki/Penet_remailer - it's not only possible, it's trivially easy as you can rewrite the headers as you please. For just anonymity from someone without ability to eavesdrop you don't need much - just strip out the headers from the sender, and replace the sender and recipient addresses. For protection against eavesdropping you need at a minimum encryption between sender and the relay, and the relay and the recipient (which could be another relay). EDIT: against a dedicated opponent you want more, including end to end encryption as well, of course. There are lots of e-mail remailer designs around (most substantially more advanced than the Penet remailer)
- facorreia 13y ago
  Anonymity is forbidden by the Brazilian Constitution.
zorked 13y ago
Built by the people who can't even keep the president's emails safe with the help of US ad networks. Sure that's going to work. The Brazilian government's reaction to all this has been amazingly incompetent even by Brazilian-government standards.
- talles 13y ago
  Exactly what I thought
- d0100 13y ago
  Correios was tasked with this some time ago, but as with many things, it was put on the back burner. But now it has more attention and support.
anxiousest 13y ago
I'm getting fed up with these nonsense notions and governments feigning victimhood to route citizen to their honeypot schemes. Brazil is a country that wants sovereignty over its citizens' digital lives, mainly to spy on them: http://internacional.elpais.com/internacional/2013/08/11/actualidad/1376172139_847597.html http://internacional.elpais.com/internacional/2013/08/11/act... Being spied upon by (wait for it) a spy agency does not change the fact that a government run email service is the last place you want to host your email to keep it away from the government. It’s something that Iran would do (and did).
PauloManrique 13y ago
We are one step away from a communist takeover in Brazil and now they talk about a "safe e-mail"? Yeah right.
- vidarh 13y ago
  And which one of your many fragmented communist or socialist parties that combined has ~5% of the votes for your national congress is it that'd supposedly be strong enough to carry out such a takeover? None of your big parties are anywhere near being communist, despite the history of some of their elements. EDIT: Not that you should trust your government to run a "safe email service" regardless. See it for what it is: A way of showing how annoyed they are about the NSA revelations.
  - PauloManrique 13y ago
    The president party is socialist and got much more than 5%. Deals with cuba, bringing doctors (which is almost slavery since they receive only 7% of the price, everything else goes to Cuba), teachers, the marxist brainwashing that teachers are doing on schools and colleges, "Foro de Sao Paulo", which is a reunion of the current party of the president, presidents of Venezuela, Bolivia and the colombian Farc, the list goes on and on.
    - vidarh 13y ago
      PT is centre-left. It is no more "socialist" than most mainstream European "socialist" parties, none of which are socialist in anything but name. PT might have been socialist some years back, just like many of the European socialist parties used to be (many even used to be communist).
  - marcosdumay 13y ago
    A comment that clearly doesn't understand our political system. Party fragmentation is a non-issue, as they'll get combined. We are suffering a communist takeover - in everything but name - from some of the biggest parties around (including parties that used to have "liberal" on their name just shortly ago). Those parties that call themselves communist are quite divided, some supporting and some opposing the takeover.
kbart 13y ago
The last place I would trust my private data is ANY government. They would better spend that money on PGP promotion and public education to get some real privacy.
rslonik 13y ago
The BR Gov said the brazillian equivalent of USPS can do the job because they delivered letters for 350 yrs and everybody trust then (maybe it's because only them can do it by law).
- PauloManrique 13y ago
  Yeah, this is how we trust then: http://www.youtube.com/watch?v=bO_-KSuhOHs http://www.youtube.com/watch?v=bO_-KSuhOHs
swah 13y ago
What's the problem with PGP?
- dudus 13y ago
  None. Gov is just too proud to seek professional guidance over the issue and is planning to reinvent the wheel. Probably we'll see millions being spent into something nobody will use.
  - hobs 13y ago
    Dont forget, those millions will likely go to some crony who gets to spend all the money on their new yacht.
- chongli 13y ago
  It works! That's the problem. Governments can't have that!
nefasti 13y ago
Too see how much our Government understands the problem, the Minister of Communication asked the "Correios" to build the secure email system, "Correios" is the Brazilian equivalent of USPS. There are dozen more qualified departments to work on this, and the incredible idea is to build an encryption and certification for email text, they never heard of OpenPGP. It looks like he really thinks because it´s email(electronic mail) gasp the postal services should handle this.
- AJ007 13y ago
  Based on this translation -- "The executive secretary admitted that the cost of maintaining a service encrypted email is top. But pointed out that, similarly to what today are companies like Google and Facebook, the Post can sell advertising to fund it." Ads aren't worth much when you don't know who you are showing them to, or the context of where they are being shown. You might as well buy advertising on a billboard that is laying face down.
  - bilbo0s 13y ago
    "Advertising" comprises many things. There are a lot of companies that would "advertise" in the context you describe. Think Coca-Cola or Pepsi. Not stating whether or not this is a good idea, but finding advertisers would not be much of a problem with such a system.
- freehunter 13y ago
  After reading Cuckoo's Egg, I was surprised to find out that the German Bundespost (German USPS) used to control their national networking infrastructure. Brazil's decision is not without precedent.
  - deleted 13y ago
    [deleted]
  - annnnd 13y ago
    There is a difference between networking infrastructure and e-mail services. I wouldn't call it a precedent as it is not similar enough.
unhammer 13y ago
The Norwegian postal service already has an encrypted email service, DigiPost. The selling point is that companies and the government should be able to send you email securely. Good intentions, but I have not tried it yet since it requires putting Java in your browser, and I don't know anyone who has (https://no.wikipedia.org/wiki/Digipost https://no.wikipedia.org/wiki/Digipost says they have at least 230.000 users, ~5% of the population).
noarchy 13y ago
So after these revelations of government spying, the idea is to trust email to a government? There is a potential user of such a system born every minute, I suppose.
- reycharles 13y ago
  > So after these revelations of a foreign government spying, the idea is to trust email to the national government? I changed your statement. I don't think it's entirely unreasonable to trust the local government over a foreign country's government. Of course, you could see this as a sign as "all governments are rotten".
  - noarchy 13y ago
    We know the US isn't the only country engaged in widespread spying. I'd be surprised if Brazil isn't doing it. We're all probably better off assuming that any country that can spy, is doing it. Of course, people can call me paranoid for saying this, but I suspect the tide is turning in favour of such paranoia.
    - facorreia 13y ago
      Brazil has its own intelligence agency. http://www.abin.gov.br http://www.abin.gov.br
    - bilbo0s 13y ago
      The thing is ... for your average upper class Brazilian, having Brazil spy on you is less detrimental than having the US spy on you. For instance, the US can, unilaterally, SEVERELY curtail your ability to travel. If your name lands on one of the lists the US keeps, it won't matter what airport in the world you are in... those lists will follow you. In Brazil, by way of contrast, that upper middle class Brazilian will actually have some rights that will be respected. He/She has NO rights that an American court needs to respect in the US. That's an extreme, and somewhat contrived, example. But I think it illustrates how many non Americans are thinking about the implications of the whole "..Non-Americans have no rights.." thing.
ramon 13y ago
So, Correios will probaly hire some Brazilian IT to build this service.. okay, it's safe! :) Should be built by National Security Agency instead if you're looking for security, right?
batemanesque 13y ago
if the Brazilian government is so concerned w/ civil liberties, maybe they should focus their attention on addressing rampant police brutality & overreach rather than geek-pandering gimmicks like this.
- vidarh 13y ago
  This has nothing to do with "geek pandering" and everything to do with expressing their dislike for the NSA revelations.

89 points by aoldoni 13y ago

byoogle 13y ago

> State may finance the project through ad sales. We'll just go ahead and let these advertisers spy on you instead.

galaktor 13y ago
Government-controlled email service financed through adverts... not very trust-inspiring.

eksith 13y ago

Maybe that will work for privacy which we can also work with here, but doesn't solve the anonymity problem. This reminds me... Anonymous remailers have been around for quite a while. The idea being, you get your mail through a forwarding service that wraps the package to the final destination (or another anonymous forwarder) so the sender doesn't know where the final destination is actually. I don't know of something similar can be implemented with email because you still need headers to be visible. Unless email too can be wrapped in multiple layers of encryption, headers and all, that each subsequent relay must decrypt before finding the destination.

vidarh 13y ago
> I don't know of something similar can be implemented with email because you still need headers to be visible. Anon.penet.fi - the first well known anonymising e-mail remailer - is 20 years this year: http://en.wikipedia.org/wiki/Penet_remailer http://en.wikipedia.org/wiki/Penet_remailer - it's not only possible, it's trivially easy as you can rewrite the headers as you please. For just anonymity from someone without ability to eavesdrop you don't need much - just strip out the headers from the sender, and replace the sender and recipient addresses. For protection against eavesdropping you need at a minimum encryption between sender and the relay, and the relay and the recipient (which could be another relay). EDIT: against a dedicated opponent you want more, including end to end encryption as well, of course. There are lots of e-mail remailer designs around (most substantially more advanced than the Penet remailer)
facorreia 13y ago
Anonymity is forbidden by the Brazilian Constitution.

zorked 13y ago

Built by the people who can't even keep the president's emails safe with the help of US ad networks. Sure that's going to work. The Brazilian government's reaction to all this has been amazingly incompetent even by Brazilian-government standards.

talles 13y ago
Exactly what I thought
d0100 13y ago
Correios was tasked with this some time ago, but as with many things, it was put on the back burner. But now it has more attention and support.

anxiousest 13y ago

I'm getting fed up with these nonsense notions and governments feigning victimhood to route citizen to their honeypot schemes. Brazil is a country that wants sovereignty over its citizens' digital lives, mainly to spy on them: http://internacional.elpais.com/internacional/2013/08/11/actualidad/1376172139_847597.html http://internacional.elpais.com/internacional/2013/08/11/act... Being spied upon by (wait for it) a spy agency does not change the fact that a government run email service is the last place you want to host your email to keep it away from the government. It’s something that Iran would do (and did).

PauloManrique 13y ago

We are one step away from a communist takeover in Brazil and now they talk about a "safe e-mail"? Yeah right.

vidarh 13y ago
And which one of your many fragmented communist or socialist parties that combined has ~5% of the votes for your national congress is it that'd supposedly be strong enough to carry out such a takeover? None of your big parties are anywhere near being communist, despite the history of some of their elements. EDIT: Not that you should trust your government to run a "safe email service" regardless. See it for what it is: A way of showing how annoyed they are about the NSA revelations.
- PauloManrique 13y ago
  The president party is socialist and got much more than 5%. Deals with cuba, bringing doctors (which is almost slavery since they receive only 7% of the price, everything else goes to Cuba), teachers, the marxist brainwashing that teachers are doing on schools and colleges, "Foro de Sao Paulo", which is a reunion of the current party of the president, presidents of Venezuela, Bolivia and the colombian Farc, the list goes on and on.
  - vidarh 13y ago
    PT is centre-left. It is no more "socialist" than most mainstream European "socialist" parties, none of which are socialist in anything but name. PT might have been socialist some years back, just like many of the European socialist parties used to be (many even used to be communist).
- marcosdumay 13y ago
  A comment that clearly doesn't understand our political system. Party fragmentation is a non-issue, as they'll get combined. We are suffering a communist takeover - in everything but name - from some of the biggest parties around (including parties that used to have "liberal" on their name just shortly ago). Those parties that call themselves communist are quite divided, some supporting and some opposing the takeover.

kbart 13y ago

The last place I would trust my private data is ANY government. They would better spend that money on PGP promotion and public education to get some real privacy.

rslonik 13y ago

The BR Gov said the brazillian equivalent of USPS can do the job because they delivered letters for 350 yrs and everybody trust then (maybe it's because only them can do it by law).

PauloManrique 13y ago
Yeah, this is how we trust then: http://www.youtube.com/watch?v=bO_-KSuhOHs http://www.youtube.com/watch?v=bO_-KSuhOHs

swah 13y ago

What's the problem with PGP?

dudus 13y ago
None. Gov is just too proud to seek professional guidance over the issue and is planning to reinvent the wheel. Probably we'll see millions being spent into something nobody will use.
- hobs 13y ago
  Dont forget, those millions will likely go to some crony who gets to spend all the money on their new yacht.
chongli 13y ago
It works! That's the problem. Governments can't have that!

nefasti 13y ago

Too see how much our Government understands the problem, the Minister of Communication asked the "Correios" to build the secure email system, "Correios" is the Brazilian equivalent of USPS. There are dozen more qualified departments to work on this, and the incredible idea is to build an encryption and certification for email text, they never heard of OpenPGP. It looks like he really thinks because it´s email(electronic mail) gasp the postal services should handle this.

AJ007 13y ago
Based on this translation -- "The executive secretary admitted that the cost of maintaining a service encrypted email is top. But pointed out that, similarly to what today are companies like Google and Facebook, the Post can sell advertising to fund it." Ads aren't worth much when you don't know who you are showing them to, or the context of where they are being shown. You might as well buy advertising on a billboard that is laying face down.
- bilbo0s 13y ago
  "Advertising" comprises many things. There are a lot of companies that would "advertise" in the context you describe. Think Coca-Cola or Pepsi. Not stating whether or not this is a good idea, but finding advertisers would not be much of a problem with such a system.
freehunter 13y ago
After reading Cuckoo's Egg, I was surprised to find out that the German Bundespost (German USPS) used to control their national networking infrastructure. Brazil's decision is not without precedent.
- deleted 13y ago
  [deleted]
- annnnd 13y ago
  There is a difference between networking infrastructure and e-mail services. I wouldn't call it a precedent as it is not similar enough.

unhammer 13y ago

The Norwegian postal service already has an encrypted email service, DigiPost. The selling point is that companies and the government should be able to send you email securely. Good intentions, but I have not tried it yet since it requires putting Java in your browser, and I don't know anyone who has (https://no.wikipedia.org/wiki/Digipost https://no.wikipedia.org/wiki/Digipost says they have at least 230.000 users, ~5% of the population).

noarchy 13y ago

So after these revelations of government spying, the idea is to trust email to a government? There is a potential user of such a system born every minute, I suppose.

reycharles 13y ago
> So after these revelations of a foreign government spying, the idea is to trust email to the national government? I changed your statement. I don't think it's entirely unreasonable to trust the local government over a foreign country's government. Of course, you could see this as a sign as "all governments are rotten".
- noarchy 13y ago
  We know the US isn't the only country engaged in widespread spying. I'd be surprised if Brazil isn't doing it. We're all probably better off assuming that any country that can spy, is doing it. Of course, people can call me paranoid for saying this, but I suspect the tide is turning in favour of such paranoia.
  - facorreia 13y ago
    Brazil has its own intelligence agency. http://www.abin.gov.br http://www.abin.gov.br
  - bilbo0s 13y ago
    The thing is ... for your average upper class Brazilian, having Brazil spy on you is less detrimental than having the US spy on you. For instance, the US can, unilaterally, SEVERELY curtail your ability to travel. If your name lands on one of the lists the US keeps, it won't matter what airport in the world you are in... those lists will follow you. In Brazil, by way of contrast, that upper middle class Brazilian will actually have some rights that will be respected. He/She has NO rights that an American court needs to respect in the US. That's an extreme, and somewhat contrived, example. But I think it illustrates how many non Americans are thinking about the implications of the whole "..Non-Americans have no rights.." thing.

ramon 13y ago

So, Correios will probaly hire some Brazilian IT to build this service.. okay, it's safe! :) Should be built by National Security Agency instead if you're looking for security, right?

batemanesque 13y ago

if the Brazilian government is so concerned w/ civil liberties, maybe they should focus their attention on addressing rampant police brutality & overreach rather than geek-pandering gimmicks like this.

vidarh 13y ago
This has nothing to do with "geek pandering" and everything to do with expressing their dislike for the NSA revelations.