8 ms·
How Turtl has no idea when you're sharing copyrighted stuff
- eudox 13y agoAnd it's written in Common Lisp! What's not to like?
- ztratar 13y agoQuality PR move here and all around great article on security.
- yanowitz 13y agoDoes anyone here have experience with turtl? Pros/cons? Confidence in security model?
- foobarqux 13y agoThe security model is broken. You can't securely do encryption in server side javascript.
- orthecreedence 13y agoIncorrect, my friend! There's no server-side javascript. Turtl is a downloaded, self-contained app, and all encryption happens in that app.
- foobarqux 13y agoSorry, my mistake. I guess I just assume everything is a webapp these days.
- SomeoneWeird 13y agoMay I ask why you think that is?
- orthecreedence 13y agoIt's true you can't reliably do crypto in javascript served from a web server. The idea is that someone could hack into your server, replace `crypto.aes.js` with `crypto.plaintext.js` and suddenly your app is silently sending plaintext back to the server where ciphertext is expected. The correct way is to create a (signed) package of your app so that it pulls in no external scripts or files. Makes updates a pain (no free auto-upgrades you get from the web) but makes the app a lot more difficult to attack.
- brownbat 13y agoPlease, for the love of counsel, do not use moments like these to advertise your service's viability for the distribution of copyrighted materials. "We hold that one who distributes a device with the object of promoting its use to infringe copyright, as shown by clear expression or other affirmative steps taken to foster infringement, is liable for the resulting acts of infringement by third parties." - Justice Souter, writing on behalf of the Supreme Court of the United States in MGM Studios, Inc. v. Grokster, Ltd.
- orthecreedence 13y agoGreat point. It's worth noting that Turtl is a storage tool, not a means of distribution. The article is not promoting infringement, but instead gives an overview of how it's just not an issue with Turtl, because Turtl has no knowledge of the data being stored.
- catshirt 13y agolaw evaluates intent. i'm not a lawyer, but i'm not an idiot either and it's pretty easy to read between the lines here. if the intent is to illustrate security and encryption, there is no reason to invoke "copyrighted material" at all.
- mden 13y agoUnless you are using it as an example of how your solution works differently. Which they are. I don't see anywhere that they are claiming their business is for copyright infringement, in fact, it doesn't seem like it's for mass distribution at all unless you give out your key, and then you just defeat the point of the service.
- abbasmehdi 13y agoIt's clearly positioned as an alternative to a tool that prevents copyright infringement. I don't think it is obvious that their intention here is not to present an alternative that facilitates infringement [0]. It seems like they are even proud of that [1]. [0] I am not saying it is good or bad, right or wrong. [1] Observing, not judging.
- forrestthewoods 13y agoFor now. Host a "mystery file" that gets 100,000 downloads with all referrers coming from a site that posts download links to copyright infringing movies and things may change quite suddenly.
- selectout 13y agoBeen using turtl (free) for a little while now and love it so far. It's made huge leaps and bounds over the past several months and I'm excited to see where it continues to grow.
- orthecreedence 13y agoI'm glad you've been having a good experience! It's been fun building it and I'm excited to to keep growing it and making a viable platform for the more privacy-conscious.
- jzelinskie 13y agoThe pricing is not clear if files up to size 200MB are free, or you only get 200MB of total space for free.
- orthecreedence 13y agoThanks, I'll make that more clear.
- trollingineer 13y agoTORTLE <<<<< Dropbox
- limsup 13y agoAm I the only one who was totally onboard until I saw it was written in lisp? Can't trust non-pragmatic people.
- korzun 13y agoEven if they do not 'know' what you are storing, posting that will pretty much label your company as a 'kiddie cesspool' by anybody who values their data. I'm not in need of their service, but they will never have me as a serious client after a blog post like this.
- matttah 13y agoOn the phone is there a way to get to your main site from the blog? Was curious on your service but no easy way to jump to the main site, but maybe I missed it?
- orthecreedence 13y agoThere should be a link on the top left (a logo of a turtle shell). If you click that it will take you to the main site.
- snowwrestler 13y agoThe shell is centered on my iPhone; tapping it takes me to the blog homepage. There doesn't seem to be any way for me to get to the actual service without Googling the name myself.
- orthecreedence 13y agoThanks for the heads up, apparently I have a mobile template I didn't know about/check before publishing the blog. I'll fix this shortly.
- cordite 13y agoI honestly think this is one of the best times to advertise something like this. There have been posts here before about alternative services getting a 51% customer increase on days where a breach in security or general trust is broadcasted to the world.
- carlosdp 13y agoI mean, is not being able to take action on illegal file sharing when the feds come knocking really something to be proud of? It's a liability from a company perspective, not a strength IMO.
- orthecreedence 13y agoI'm proud that I'm building something that combats the unconstitutional spying of American citizens, and also helps others around the world avoid surveillance. This app is largely a response to the overreach of the US government. While I believe in fighting for our constitutional rights politically, private solutions are also a viable means of protest. We probably will have liability issues down the road. Nobody said this would be easy. However, being completely transparent and publishing all our code open-source will help mitigate a lot of these issues. On top of this, by making the clients able to secure their own data, the company itself can respond to any government information requests without actually revealing any customer data.
- jacquesm 13y agoI'm not sure if I follow you, this seems a lot like attacking Iraq to me.
- orthecreedence 13y agoWould you mind elaborating? Is "attacking Iraq" a metaphor/figure of speech that I'm not aware of? If so, wouldn't that imply the project is based on completely false grounds (ie, "WMDs" that don't exist)? It's been shown pretty clearly that mass surveillance exists and is a part of our every day lives now.
- jacquesm 13y agoMass surveillance and copyright have nothing whatsoever to do with each other. If you're going to attack copyright in order to rid us of mass surveillance that's like attacking Iraq in order to get rid of Al Qaeda.
- typicalbender 13y agoI don't know anything about how Dropbox or Turtl handle data and when they do their encryption but it would still be possible for Turtl to do hash level checking even with client side encryption. They could just hash the file and encrypt it all client side and then send both back to the server. It seems that this article is insinuating that Dropbox has full access to your data (which I dont know is true or not).
- quasque 13y agoDropbox does have full access to its users data, and uses this property to enable its deduplication and public sharing features.
- orthecreedence 13y ago> this article is insinuating that Dropbox has full access to your data They do. They send data over HTTPS from the Dropbox client, and they store it "encrypted" on S3, but they hold the encryption keys and also have full access to the unencrypted data while it's in memory on the servers. Turtl encrypts all data with the user's personal key before it leaves the client, meaning the server has no access to the unencrypted data. As far as hashing in the client, that's true, we actually could do that, and it might be a viable option if we ever implement public file sharing. Right now, all sharing is person-to-person (and private).
- typicalbender 13y agoCool thanks for the info. I don't actually use Dropbox's service but its awesome to see a solution that cares about the security of its users data.
- umanwizard 13y agoHow will they know the hash coming back from the client hasn't been manipulated?
- typicalbender 13y agoThe request can be signed and then checked for authentication on the back end. Using public key encryption it would be sent safely to the server and checked for authenticity.
- ChuckMcM 13y agoWhile I like the efforts you've gone to in order to hide what is inside the service, I hope that you also appreciate the level of force arrayed against you. It seems that one of the challenges of these services is that in order to avoid the copyright goons everyone you know, even those folks you only know by some IRC handle, have to be willing to go to jail for you. Because otherwise one of them will get turned, they will then be pressured to get you to indict yourself. This is how it worked against Anonymous, and how it works on most disobedience rings (civil or otherwise). One of your friends will share with you a folder that has copyrighted material in it, once they are sure you have accessed it they will re-iterate that some (or all) of the material there is copyrighted. At this point the most common thing that happens is that thinking they are 'safe', someone will say something stupid like 'don't worry, its our secret' or something like that. And almost simultaneously the door will explode open as the SWAT guys come in and put them in cuffs and read you your rights. All because someone you thought you knew, was unwilling to spend time in jail rather than help the FBI with their investigation. Law enforcement has a number of tools (many dubious like the CFAA) which they can employ against you, and they will. The best you can hope to achieve is to keep a solid (and I mean solid, no slip ups anywhere) public front of respecting the copyright holders rights and your willingness to protect them. Otherwise you will be served papers to decrypt other buckets and you will be sent to jail for contempt if you do not facilitate rooting out copyright infringement on your service. Not even keeping your servers and company in a foreign country will help unless it is a country which doesn't care about its relationship with the US.
- orthecreedence 13y agoI have to ask: why not just email someone a copyrighted file? Once the file is downloaded to their email client, they are in the same position as they would be in if you shared it via Turtl. As a Turtl user, you'd have to be careful about who you share with (or accept shares from). We even outline this on our security page (https://turtl.it/docs/security#when-is-turtl-not-secure https://turtl.it/docs/security#when-is-turtl-not-secure). It seems at some point the app you're using becomes irrelevant and what you actually do with it becomes much more relevant (such as a bittorrent client).
- 13y ago
- einhverfr 13y agoMy immediate concern is whether this could be construed as advertising the service of copyright violation. If so, there may be the same concerns that ultimately lead to the downfall of grokster. If I were to launch a service like this, I would describe this issue in terms of general privacy, and the fact that the nobody else has any idea of what is going on. With Snowden, the obvious point is that it is private from the NSA.....
- mixologic 13y agoI find bittorrent sync to be a vastly superior way to share files with people. (http://www.bittorrent.com/sync http://www.bittorrent.com/sync).
- orthecreedence 13y agoI'm actually very interested in the service (been hearing a lot about it lately). Does it require one of your computers to be on at all times? Or is there some sort of storage conduit that doesn't decrypt your data, but only acts to make it available to your other devices (mobile, desktop, etc)?
- plicense 13y agoWhat an example of "Make hay while the sun shines".
- Raticide 13y agoSo it works the same as Mega?
- patio11 13y agoYou should probably avoid saying "We are a wink nudge plausibly deniable file locker!" until you have asked your lawyer "What does contributory infringement mean? Are US judges typically very lenient with parties who attempt to evade the law with wink-and-nod mechanisms that can be seen through by the average tadpole?"
- jobigoud 13y agoI'm not too convinced about the plausible deniability here, could someone that has reviewed their tech comment on the following: - Encryption works by blocks and do not generally hide the size of the plaintext. - Once I get the encrypted material, I thus approximatively know the size of the original file within a few bytes (uncertainty is due to padding to block size). - I collect a few candidates files with size in the right range (There might be only one but it's still deniable). Knowing your login information and the algorithm used to "derive the key from the login information", can't I encrypt the candidate and test against the encrypted material ?
- anywhichway 13y agoNo. Since asymmetric encryption is slow the standard strategy is to generate a random symmetric key to encrypt your file. Then you just encrypt the symmetric key with your asymmetric key. This has the added benefit of each new encryption attempt leading to a unique result.
- orthecreedence 13y ago> Knowing your login information I'm not sure how much more clear I can be. Turtl doesn't know your login information, and doesn't know any of the keys derived from your login information. That's the point of the login...it's a familiar way people use to authenticate themselves with a service, but with the added benefit that it's actually generating a master key for them. Also, not sure how many files there are floating around the internet (and off of it) but it's quite a bit, so comparing file sizes isn't going to give any real information (at least in regards to copyright protection).