Discussion:
Any good practical means against universal surveillance?
(too old to reply)
Mok-Kong Shen
2013-08-03 11:05:38 UTC
Permalink
There have been recently in German media quite some debates on Internet
security for the common people and serious concerns were also expressed
by the German president. A German minister even recommended the
citizens to take care of the security of their communications
"themselves", without however telling them "how" -- similar IMHO to
recommending citizens to take care of not being robbed "themselves".
(It may incidentally be noted that in Germany, in distinction to USA,
a permission is required to buy guns and that permission is not easy
to get). Now are there any good ideas of how the common people could
defend themselves against Prism, Tempora, etc., noting that some mighty
Eastern countries may have comparable, though yet unrevealed, projects
running as well? Each individual idea may not be good enough, but
perhaps through appropriate combinations there could result in
something not too bad?

As a start I venture to sketch a humble idea of my own in the
following:

If it could be managed to have sufficiently large volumes of encrypted
emails constantly on the Internet, the surveillance mechanisms would
very likely at least loose much of their efficiencies, if not be
entirely bogged down due to overloading. To achieve that, it would
thus principally depend on whether there are sufficient number of
common people who would voluntarily take the trouble to do encryptions
(or at least do some additional keystrokes, see (3) below) and so IMHO
this is the biggest problem to be faced by the present idea.

We assume that each email has a plaintext part and an attached file
with encrypted stuff. It may be noted that for such senders (let's call
them activists):

(1) They certainly may not have all the time materials that necessarily
need to be kept secrect, in which case for convenience the attachment
can be a dummy file, in particular an arbitrarily chosen one from a
number of dummies stored on stock. Whether the file contains genuine
stuff could e.g. be indicated by a chosen keyword in the plaintext part
of the email.

(2) Not all their friends would like to do any encryption work to
communicate with them, in which case these friends need only tolerate
the activists' sending them emails with dummies.

(3) Those activists who live on the maxim of having absolutely nothing
to hide could always send dummies as attachment.

Note also that the idea of having only one part of the whole message
that is encrypted could also be applied e.g. to the webpages, which may
contain a dynamically varying encrypted part for the partners to
receive.

Key management could be a big stumbling block for the idea in practice.
Since I have anyway a bias favouring symmetric encryptions (I mistrust
PKI whose software/hardware security I am unable to verify for poverty
of knowledge and other practical reasons), I envisage that each pair of
partners would somehow aggree and keep a master key for their
communications, from which session keys could be generated via
encrypting certain data that partly involve time, message number etc.
At least for a certain part of the activists who live in democratic
countries secure transfer and keeping of these master keys among them
shouldn't be a too big problem IMHO.

Note that we capitalize on encryption, i.e. the difficulties (efforts
and resources required) of the agencies to find the (potentially, but
not certainly, vital for them) secret informations and do not (and
cannot) hinder their collection of the meta data. Hence the portion of
emails from the activists need not be significant in relation to the
total volume of emails on the Internet.

A tiny remark is that in countries where the law enforcement could
demand surrendering of the encryption keys, the dummies couldn't be
entirely arbitrarily random, since otherwise it would be impossible to
satisfy the demands of the authority.

A somewhat different, seemingly also viable, idea is the following:
The activists could send genuine (i.e. for communication) or dummy
(i.e. to enhance the load of cryptanalysis) messages to Usenet groups
like alt.anonymous.messages. I am ignorant whether that group has
currently more than a few congeners, if at all. Anyway, if there is
a "run" for such services, evidently many more of its genre would be
needed, which IMHO shouldn't nevertheless be an unsolvable problem.
BTW, some activists could run something analogous to certain Internet
forums with browser as interface for posting, excepting that there will
be encrypted stuffs posted, with membership available to the general
public or limited in some specific way. (Note that on some computers
access to Usenet groups may not have been installed, but access to
a forum needs only a browser which is always available.)

My personal view of the current surveillance is fairly analogous to
one of, say, an intimidating disease of pandemic nature. In such cases
one knows that one doesn't have "really" effective means to solve the
problem, but one must/should nonetheless join efforts/thoughts to
reduce, as far as possible. the "impact" of the evils. As I indicated,
there appears unlikely to be a way to stop collection of meta data.
What seems to be viable is IMHO a reduction of the practical efficiency
of the huge computing resources of the agencies. And that I think is
quite possible in practice by presenting to their machines an
additional very huge load of cryptanalysis. In fact, imagine that there
were 100 Internet forums each with daily an average of 100 encrypted
posts, such that with a probability of 1/10000 a post may contain
a message of the importance and urgency comparable to, say, "Snowden is
escaping with a jet of a certain Latin-American president", I am pretty
sure that the cooling system of their computers would very soon need
some unscheduled maintenance work :)

M. K. Shen
Thor Kottelin
2013-08-03 11:32:08 UTC
Permalink
Post by Mok-Kong Shen
If it could be managed to have sufficiently large volumes of encrypted
emails constantly on the Internet, the surveillance mechanisms would
very likely at least loose much of their efficiencies, if not be
entirely bogged down due to overloading.
Indeeed. To quote Phil Zimmermann:

'What if everyone believed that law-abiding citizens should use postcards
for their mail? If a nonconformist tried to assert his privacy by using an
envelope for his mail, it would draw suspicion. Perhaps the authorities
would open his mail to see what he's hiding. Fortunately, we don't live in
that kind of world, because everyone protects most of their mail with
envelopes. So no one draws suspicion by asserting their privacy with an
envelope. There's safety in numbers. Analogously, it would be nice if
everyone routinely used encryption for all their email, innocent or not,
so that no one drew suspicion by asserting their email privacy with
encryption. Think of it as a form of solidarity.' --
http://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html

But unfortunately, it is difficult for John Doe to implement email
encryption. There are software to install, concepts to learn and keys to
protect. Most people lack the interest to bother.
--
Thor Kottelin
http://www.anta.net/
VanguardLH
2013-08-04 04:34:47 UTC
Permalink
Post by Mok-Kong Shen
If it could be managed to have sufficiently large volumes of encrypted
emails constantly on the Internet, ...
Encrypted e-mail has been available for a very long time now. That
only protects the content of the message. It does not hide the source
and destination of the e-mail. It also doesn't scramble the headers,
and Subject is a header so make sure not to reveal the content of the
encrypted body of an e-mail. Twould be stupid to terroists to send
encrypted e-mails detailing their plans to assassinate the US Prez if
the Subject said "Obama assassination set for Friday at 2:17 PM using
missile."
Post by Mok-Kong Shen
We assume that each email has a plaintext part and an attached file
with encrypted stuff.
You've never looked at an encrypted e-mail, have you?
Post by Mok-Kong Shen
Key management could be a big stumbling block for the idea in practice.
Since I have anyway a bias favouring symmetric encryptions (I mistrust
PKI whose software/hardware security I am unable to verify for poverty
of knowledge and other practical reasons),
Lack of detailed inside knowledge doesn't preclude the applicability
of a technology. Encryption is a lot easier than you sketch. If you
don't like PKI (whose keys are managed by who knows who) then use
x.509 certs. The client you used here supports SMIME certs, too.
Post by Mok-Kong Shen
I envisage that each pair of
partners would somehow aggree and keep a master key for their
communications,
Encryption is an invite process. Someone who wants to *receive*
encrypted e-mails from you must first send you a digitally signed
e-mail. You use their public key from that cert to encrypt your
e-mails sent to them. If you want them to send you encrypted e-mails,
you first send them a digitally signed e-mail to give them your public
key. Only the inviter has the private key needed to decrypt.

The vast majority of e-mail users don't encrypt their messages because
they don't consider their messages important enough to hide from
someone sniffing their e-mail traffic (or getting a subpoena to
monitor it), don't know about encryption, or it's too much of a
nuisance to use. E-mail clients will let you send e-mails as
plain/HTML text unless you choose on-the-fly to encrypt one at a time,
encrypt all e-mails you send which won't work for the majority of your
e-mails to recipients who never got your public key, and some let you
designate by contact record if they get encrypted e-mails or not.
Post by Mok-Kong Shen
A tiny remark is that in countries where the law enforcement could
demand surrendering of the encryption keys, the dummies couldn't be
entirely arbitrarily random, since otherwise it would be impossible to
satisfy the demands of the authority.
The recipient of an digitally signed e-mail can only surrender the
public key. They don't have the private key. The sender would have
to surrender their certificate; however, it's obvious, in that case,
that the sender would delete that cert from their e-mail client (well,
actually from their local key store) and start using a new one.

I gave up on your other proposals since it doesn't look like you know
how encryption for e-mail works. Just how would encryption protect
you from investigation and possibly charges of complicity when the
e-mail itself along with server logs would show you were communicating
hot and heavy with a known terrorist right before that terrorist
committed their heinous act? Encryption protects content, not
routing. Even if you are in a country whose laws state that you are
not required to incriminate yourself, not divulging the content of an
encrypted e-mail will be construed as admission of guilt.

You can encrypt all you want. That doesn't obviate tracking.
Mok-Kong Shen
2013-08-04 06:18:24 UTC
Permalink
Post by VanguardLH
Post by Mok-Kong Shen
If it could be managed to have sufficiently large volumes of encrypted
emails constantly on the Internet, ...
Encrypted e-mail has been available for a very long time now. That
only protects the content of the message. It does not hide the source
and destination of the e-mail. It also doesn't scramble the headers,
and Subject is a header so make sure not to reveal the content of the
encrypted body of an e-mail. Twould be stupid to terroists to send
encrypted e-mails detailing their plans to assassinate the US Prez if
the Subject said "Obama assassination set for Friday at 2:17 PM using
missile."
That's way I mentioned also in the later part of OP the possibility of
communication via e.g. alt.anonymous.messages. One could send stuffs
from callshops or interentcafes thus without one's own IP address,
taking due care of possible observing agents there.
Post by VanguardLH
Post by Mok-Kong Shen
We assume that each email has a plaintext part and an attached file
with encrypted stuff.
You've never looked at an encrypted e-mail, have you?
I was expressing that because the plaintext part plays a role in the
scheme in my OP as well, see points (1)-(3).
Post by VanguardLH
Post by Mok-Kong Shen
Key management could be a big stumbling block for the idea in practice.
Since I have anyway a bias favouring symmetric encryptions (I mistrust
PKI whose software/hardware security I am unable to verify for poverty
of knowledge and other practical reasons),
Lack of detailed inside knowledge doesn't preclude the applicability
of a technology. Encryption is a lot easier than you sketch. If you
don't like PKI (whose keys are managed by who knows who) then use
x.509 certs. The client you used here supports SMIME certs, too.
There are two "big" problems here which are often ignored (with or
without knowledge): (1) How does one know that the software/hardware
involved in digital signatures is without backdoors? (2) How does
one know that the CAs involved are trustworthy? (One could certainly
"believe", but that's religion, isn't it?)
Post by VanguardLH
Post by Mok-Kong Shen
I envisage that each pair of
partners would somehow aggree and keep a master key for their
communications,
Encryption is an invite process. Someone who wants to *receive*
encrypted e-mails from you must first send you a digitally signed
e-mail. You use their public key from that cert to encrypt your
e-mails sent to them. If you want them to send you encrypted e-mails,
you first send them a digitally signed e-mail to give them your public
key. Only the inviter has the private key needed to decrypt.
The vast majority of e-mail users don't encrypt their messages because
they don't consider their messages important enough to hide from
someone sniffing their e-mail traffic (or getting a subpoena to
monitor it), don't know about encryption, or it's too much of a
nuisance to use. E-mail clients will let you send e-mails as
plain/HTML text unless you choose on-the-fly to encrypt one at a time,
encrypt all e-mails you send which won't work for the majority of your
e-mails to recipients who never got your public key, and some let you
designate by contact record if they get encrypted e-mails or not.
You were sketching the current practice. I was suggesting in OP to
employ symmetric encryption. That means more work, more inconvenience
etc. (but that's clear from the No Free Lunch Principle).
Post by VanguardLH
Post by Mok-Kong Shen
A tiny remark is that in countries where the law enforcement could
demand surrendering of the encryption keys, the dummies couldn't be
entirely arbitrarily random, since otherwise it would be impossible to
satisfy the demands of the authority.
The recipient of an digitally signed e-mail can only surrender the
public key. They don't have the private key. The sender would have
to surrender their certificate; however, it's obvious, in that case,
that the sender would delete that cert from their e-mail client (well,
actually from their local key store) and start using a new one.
Again: I was considering symmetric encryption. (BTW, do you encrypt
your disk storage with assymetric encryption?)

M. K. Shen
Post by VanguardLH
I gave up on your other proposals since it doesn't look like you know
how encryption for e-mail works. Just how would encryption protect
you from investigation and possibly charges of complicity when the
e-mail itself along with server logs would show you were communicating
hot and heavy with a known terrorist right before that terrorist
committed their heinous act? Encryption protects content, not
routing. Even if you are in a country whose laws state that you are
not required to incriminate yourself, not divulging the content of an
encrypted e-mail will be construed as admission of guilt.
You can encrypt all you want. That doesn't obviate tracking.
unruh
2013-08-04 15:16:57 UTC
Permalink
Post by Mok-Kong Shen
Again: I was considering symmetric encryption. (BTW, do you encrypt
your disk storage with assymetric encryption?)
public key encryption is used for key interchange, not for encryption of
a file. It is far too slow for that.

If public key is broken it is also possible that symmetric is. And if
"roll your own" symmetric then it is 100% likely that it is broken.

Ie, there is no great advantage to symmetric only, and a lot of extra
work.
Mok-Kong Shen
2013-08-05 17:20:15 UTC
Permalink
Post by unruh
Post by Mok-Kong Shen
Again: I was considering symmetric encryption. (BTW, do you encrypt
your disk storage with assymetric encryption?)
public key encryption is used for key interchange, not for encryption of
a file. It is far too slow for that.
If public key is broken it is also possible that symmetric is. And if
"roll your own" symmetric then it is 100% likely that it is broken.
Ie, there is no great advantage to symmetric only, and a lot of extra
work.
I have a different view (at least relative to my own knowledge).
There are acknowledged good symmetric algorithms e.g. AES that are
IMHO easier to understand and also to program oneself or else to
examine the correctness of implementations (open source) of others
than the asymmetric algorithms. In practical PKI, if I don't err,
often much proprietary stuffs are being used, which could be a very
serious risk to security and further the trustworthiness of the
CA's is a big problem, as I mentioned. (Yes, one doesn't "role
one's own" but then the secret agencies role for you!!!)

M. K. Shen
unruh
2013-08-06 00:32:44 UTC
Permalink
Post by Mok-Kong Shen
Post by unruh
Post by Mok-Kong Shen
Again: I was considering symmetric encryption. (BTW, do you encrypt
your disk storage with assymetric encryption?)
public key encryption is used for key interchange, not for encryption of
a file. It is far too slow for that.
If public key is broken it is also possible that symmetric is. And if
"roll your own" symmetric then it is 100% likely that it is broken.
Ie, there is no great advantage to symmetric only, and a lot of extra
work.
I have a different view (at least relative to my own knowledge).
There are acknowledged good symmetric algorithms e.g. AES that are
IMHO easier to understand and also to program oneself or else to
examine the correctness of implementations (open source) of others
than the asymmetric algorithms. In practical PKI, if I don't err,
often much proprietary stuffs are being used, which could be a very
serious risk to security and further the trustworthiness of the
CA's is a big problem, as I mentioned. (Yes, one doesn't "role
one's own" but then the secret agencies role for you!!!)
You err.
Eg, gpg is a public key based encryption facility.
The trustworthyness of CAs is irreleavant if you have some way of
verifying the public key with your reqpondent. Since it is a public key
there is no problem of secrecy, just of making sure this is their
public key which you could do over the phone. Ie, the trustworthyness of
the CA is not an issue unless you are communicating with a completely
unknown person, in which case you have even greater problem with
symmetric key.
Post by Mok-Kong Shen
M. K. Shen
Mok-Kong Shen
2013-08-07 12:22:08 UTC
Permalink
Post by unruh
Post by Mok-Kong Shen
Post by unruh
Post by Mok-Kong Shen
Again: I was considering symmetric encryption. (BTW, do you encrypt
your disk storage with assymetric encryption?)
public key encryption is used for key interchange, not for encryption of
a file. It is far too slow for that.
If public key is broken it is also possible that symmetric is. And if
"roll your own" symmetric then it is 100% likely that it is broken.
Ie, there is no great advantage to symmetric only, and a lot of extra
work.
I have a different view (at least relative to my own knowledge).
There are acknowledged good symmetric algorithms e.g. AES that are
IMHO easier to understand and also to program oneself or else to
examine the correctness of implementations (open source) of others
than the asymmetric algorithms. In practical PKI, if I don't err,
often much proprietary stuffs are being used, which could be a very
serious risk to security and further the trustworthiness of the
CA's is a big problem, as I mentioned. (Yes, one doesn't "role
one's own" but then the secret agencies role for you!!!)
You err.
Eg, gpg is a public key based encryption facility.
The trustworthyness of CAs is irreleavant if you have some way of
verifying the public key with your reqpondent. Since it is a public key
there is no problem of secrecy, just of making sure this is their
public key which you could do over the phone. Ie, the trustworthyness of
the CA is not an issue unless you are communicating with a completely
unknown person, in which case you have even greater problem with
symmetric key.
Have you carefully examined gpg to ensure that everything there
is ok? You may be able to do so, but I would think that it is much
simpler for many people to examine e.g. an AES code instead.

M. K. Shen
unruh
2013-08-07 12:34:01 UTC
Permalink
Post by Mok-Kong Shen
Post by unruh
Post by Mok-Kong Shen
Post by unruh
Post by Mok-Kong Shen
Again: I was considering symmetric encryption. (BTW, do you encrypt
your disk storage with assymetric encryption?)
public key encryption is used for key interchange, not for encryption of
a file. It is far too slow for that.
If public key is broken it is also possible that symmetric is. And if
"roll your own" symmetric then it is 100% likely that it is broken.
Ie, there is no great advantage to symmetric only, and a lot of extra
work.
I have a different view (at least relative to my own knowledge).
There are acknowledged good symmetric algorithms e.g. AES that are
IMHO easier to understand and also to program oneself or else to
examine the correctness of implementations (open source) of others
than the asymmetric algorithms. In practical PKI, if I don't err,
often much proprietary stuffs are being used, which could be a very
serious risk to security and further the trustworthiness of the
CA's is a big problem, as I mentioned. (Yes, one doesn't "role
one's own" but then the secret agencies role for you!!!)
You err.
Eg, gpg is a public key based encryption facility.
The trustworthyness of CAs is irreleavant if you have some way of
verifying the public key with your reqpondent. Since it is a public key
there is no problem of secrecy, just of making sure this is their
public key which you could do over the phone. Ie, the trustworthyness of
the CA is not an issue unless you are communicating with a completely
unknown person, in which case you have even greater problem with
symmetric key.
Have you carefully examined gpg to ensure that everything there
is ok? You may be able to do so, but I would think that it is much
simpler for many people to examine e.g. an AES code instead.
One of the neat things about opnsource is that I do not have to examine
it personally. "Someone" needs to, and there are enough curious people
out there. Also since the chances are that someone will the people
attempting to subvert it have a strong disincentive since they will
be discovered.

The problem of key exchange is sufficiently large for symmetric key that
public key crypto makes use so so much more likely.
Post by Mok-Kong Shen
M. K. Shen
Mok-Kong Shen
2013-08-10 16:53:49 UTC
Permalink
Post by unruh
Post by Mok-Kong Shen
Post by unruh
Post by Mok-Kong Shen
Post by unruh
Post by Mok-Kong Shen
Again: I was considering symmetric encryption. (BTW, do you encrypt
your disk storage with assymetric encryption?)
public key encryption is used for key interchange, not for encryption of
a file. It is far too slow for that.
If public key is broken it is also possible that symmetric is. And if
"roll your own" symmetric then it is 100% likely that it is broken.
Ie, there is no great advantage to symmetric only, and a lot of extra
work.
I have a different view (at least relative to my own knowledge).
There are acknowledged good symmetric algorithms e.g. AES that are
IMHO easier to understand and also to program oneself or else to
examine the correctness of implementations (open source) of others
than the asymmetric algorithms. In practical PKI, if I don't err,
often much proprietary stuffs are being used, which could be a very
serious risk to security and further the trustworthiness of the
CA's is a big problem, as I mentioned. (Yes, one doesn't "role
one's own" but then the secret agencies role for you!!!)
You err.
Eg, gpg is a public key based encryption facility.
The trustworthyness of CAs is irreleavant if you have some way of
verifying the public key with your reqpondent. Since it is a public key
there is no problem of secrecy, just of making sure this is their
public key which you could do over the phone. Ie, the trustworthyness of
the CA is not an issue unless you are communicating with a completely
unknown person, in which case you have even greater problem with
symmetric key.
Have you carefully examined gpg to ensure that everything there
is ok? You may be able to do so, but I would think that it is much
simpler for many people to examine e.g. an AES code instead.
One of the neat things about opnsource is that I do not have to examine
it personally. "Someone" needs to, and there are enough curious people
out there. Also since the chances are that someone will the people
attempting to subvert it have a strong disincentive since they will
be discovered.
The problem of key exchange is sufficiently large for symmetric key that
public key crypto makes use so so much more likely.
Open source is certainly much better than closed source (proprietary)
in that it can be examined by anyone of the public. But by itself
open source doesn't give "absolute" guarantee of correctness and
freedom of backdoors, cf. Ken Thompson's ACM Turing Award Lecture.

M. K. Shen
------------------------------------

P.S. [OT] Lavabit and Silent Circle have shut down their e-mail
service, see
http://www.forbes.com/sites/parmyolson/2013/08/09/e-mails-big-privacy-problem-qa-with-silent-circle-co-founder-phil-zimmermann/
Loading...