4 ms·

"Today, email can be routinely and automatically scanned for interesting keywords, on a vast scale, without detection. This is like driftnet fishing." -- Phil

"Today, email can be routinely and automatically scanned for interesting keywords, on a vast scale, without detection. This is like driftnet fishing." -- Phil Zimmermann, 1991

StavrosK 11y ago
This is why I'm for any attempt to encryption that makes such large-scale surveillance hard. It doesn't have to be perfect (although it should also not be marketed as perfect), but things like encrypting all connections, opportunistically encrypting communications, and everything else that would require someone to actively tap an endpoint, rather than just tap any backbone random router, still does a lot of good for privacy. Do it, just don't call it "secure" ("secure" to me means person-to-person secure).
- lisper 11y ago
  Would love to get your feedback on this then: https://github.com/Spark-Innovations/SC4 https://github.com/Spark-Innovations/SC4
  - StavrosK 11y ago
    I've never seen it before, I'll investigate when I get home, but it looks great at a first glance. PGP does need a bit of an update, at least from an implementation perspective, in my opinion.
    - lisper 11y ago
      > I've never seen it before Yeah, it's new :-) I'm recruiting beta testers.
      - StavrosK 11y ago
        Hmm, the demo doesn't work for me, but this looks like a great idea. I'll agree with the other commenter, that I can't trust my browser as much as I can trust my OS, but I understand that this is just a proof of concept.
        lisper 11y ago
        It doesn't??? It should. Can you please tell me what browser you're using, and what symptoms you're seeing? (Feel free to send it to the email address listed on the github page if you don't want to clutter up this comment thread.) [UPDATE] Should be fixed now.
        StavrosK 11y ago
        Sorry for being so vague, I figured you'd see the problem immediately: The link just 404s: https://sc4.us/sc4.html https://sc4.us/sc4.html Feel free to email me, my email is in my profile. I also toyed with the idea of implementing something like this with TweetNaCl, so props to you for actually going through with it.
        lisper 11y ago
        Oops! Changed the server config a while back but forgot to update the link in the readme. Try it now. (The correct link is https://sc4.us/sc4 https://sc4.us/sc4 )
        StavrosK 11y ago
        That works, thanks. As far as I can see, there's not much glue code between TweetNaCl and the browser. Have you thought of writing/porting this to something like Python? Making it a command-line utility or a library might make adoption easier.
        lisper 11y ago
        Yes, that's definitely coming. If you're interested, here is the precursor to SC4, written in C: https://github.com/rongarret/clmm https://github.com/rongarret/clmm
  - ryukafalz 11y ago
    The fact that it's meant to be run in a browser is somewhat concerning. HTTPS is... okay... but for a GPG replacement I wouldn't really want to be dependent on the CA system or a remote server.
    - lisper 11y ago
      Two responses: 1. You can run it on your own server, and you can run it from a FILE: URL (though that part is still work in progress). 2. This implementation is not the only one there will ever be. The goal of this implementation is just to make something that non-technical people can easily use in order to establish the (open) file interchange protocol. Then anyone who wants to can write native clients, email plugins, etc.
MichaelGG 11y ago
>startling prediction of the mass surveillance methods that were eventually adopted by the NSA after 9/11 Except Carnivore was known about well before that. Not sure why everyone is pretending this is all new.
- amyjess 11y ago
  And Echelon and Room 641A were widely known before Snowden. And when the Boston Bombers struck (not long before Snowden), the public was complaining about "How did the government not stop them before they did it? They see everything on the Internet!". People were pointing out that the government couldn't do anything because they were just two guys who didn't talk about it on the Internet, not because the government wasn't watching.

"Today, email can be routinely and automatically scanned for interesting keywords, on a vast scale, without detection. This is like driftnet fishing." -- Phil Zimmermann, 1991

StavrosK 11y ago

This is why I'm for any attempt to encryption that makes such large-scale surveillance hard. It doesn't have to be perfect (although it should also not be marketed as perfect), but things like encrypting all connections, opportunistically encrypting communications, and everything else that would require someone to actively tap an endpoint, rather than just tap any backbone random router, still does a lot of good for privacy. Do it, just don't call it "secure" ("secure" to me means person-to-person secure).

lisper 11y ago
Would love to get your feedback on this then: https://github.com/Spark-Innovations/SC4 https://github.com/Spark-Innovations/SC4
- StavrosK 11y ago
  I've never seen it before, I'll investigate when I get home, but it looks great at a first glance. PGP does need a bit of an update, at least from an implementation perspective, in my opinion.
  - lisper 11y ago
    > I've never seen it before Yeah, it's new :-) I'm recruiting beta testers.
    - StavrosK 11y ago
      Hmm, the demo doesn't work for me, but this looks like a great idea. I'll agree with the other commenter, that I can't trust my browser as much as I can trust my OS, but I understand that this is just a proof of concept.
      - lisper 11y ago
        It doesn't??? It should. Can you please tell me what browser you're using, and what symptoms you're seeing? (Feel free to send it to the email address listed on the github page if you don't want to clutter up this comment thread.) [UPDATE] Should be fixed now.
        StavrosK 11y ago
        Sorry for being so vague, I figured you'd see the problem immediately: The link just 404s: https://sc4.us/sc4.html https://sc4.us/sc4.html Feel free to email me, my email is in my profile. I also toyed with the idea of implementing something like this with TweetNaCl, so props to you for actually going through with it.
        lisper 11y ago
        Oops! Changed the server config a while back but forgot to update the link in the readme. Try it now. (The correct link is https://sc4.us/sc4 https://sc4.us/sc4 )
        StavrosK 11y ago
        That works, thanks. As far as I can see, there's not much glue code between TweetNaCl and the browser. Have you thought of writing/porting this to something like Python? Making it a command-line utility or a library might make adoption easier.
        lisper 11y ago
        Yes, that's definitely coming. If you're interested, here is the precursor to SC4, written in C: https://github.com/rongarret/clmm https://github.com/rongarret/clmm
- ryukafalz 11y ago
  The fact that it's meant to be run in a browser is somewhat concerning. HTTPS is... okay... but for a GPG replacement I wouldn't really want to be dependent on the CA system or a remote server.
  - lisper 11y ago
    Two responses: 1. You can run it on your own server, and you can run it from a FILE: URL (though that part is still work in progress). 2. This implementation is not the only one there will ever be. The goal of this implementation is just to make something that non-technical people can easily use in order to establish the (open) file interchange protocol. Then anyone who wants to can write native clients, email plugins, etc.

MichaelGG 11y ago

>startling prediction of the mass surveillance methods that were eventually adopted by the NSA after 9/11 Except Carnivore was known about well before that. Not sure why everyone is pretending this is all new.

amyjess 11y ago
And Echelon and Room 641A were widely known before Snowden. And when the Boston Bombers struck (not long before Snowden), the public was complaining about "How did the government not stop them before they did it? They see everything on the Internet!". People were pointing out that the government couldn't do anything because they were just two guys who didn't talk about it on the Internet, not because the government wasn't watching.