Untraceable Messaging Service Raises a Few Eyebrows 236
netbuzz writes "A messaging service called VaporStream announced today at DEMOfall will allow any two parties to communicate electronically without leaving any record of their interaction on any computer or server. Messages cannot be forwarded, edited, printed or saved. After they're read, they're gone."
There's always a way. (Score:5, Insightful)
Re: (Score:2)
How "Disappearing Inc" solved this N years ago (Score:5, Insightful)
Their tech guy explained that it was really important to define the problems you're trying to solve and the problems you're *not* trying to solve. If you're trying to help cooperating users communicate privately, you can do it, but if you're trying to prevent uncooperative users from getting around it, that's probably impossible and certainly snake oil at best. They weren't trying to keep the users from breaking the system with some kind of DRM nonsense - they were building something that would let the users make sure that they didn't keep records of their email that they weren't deliberately trying to keep. It's the Ollie North email backups problem, not the Mr. Phelps problem.
Re:There's always a way. (Score:4, Funny)
Re: (Score:2, Insightful)
Re: (Score:2, Interesting)
For those people who understand deeply SMTP and how email MTA and clients work - this gives them much power in the current legal system.
I wonder, does
Re:There's always a way. (Score:5, Funny)
I've got off three copyright cases so far by forging emails giving me express permission from the author to use the software.
And I'm halfway through a settlement case for my last de-facto relationship relying on an email 'she sent me' which explains that I can have everything!
I figure if the RIAA can do it, it's not imorral for me to do it. Besides, this Bitch deserves it.
Re: (Score:2)
Re: (Score:2)
I find this amazing (not that I doubt you). So you're saying if I bring a bunch of email printouts to court, they're generally accepted? My first move as the other side would be to say...
Usually they grab the drives when they grab you. (Score:3, Informative)
I think you'll find that this is basically SOP as part of the discovery process. If you're under suspicion of anything that even remotely involves a computer, expect to have every computer seized.
That's where most of the email evidence comes from; it's not from people voluntar
no. it doesn't work like that in court (Score:2)
Re: (Score:2)
Re: (Score:2)
Maybe, maybe not - it could be set up such that when you're logged in and post anonymously, an entry goes into a table with your user ID and the article ID. It would know you posted to this article, but not which post was yours. Not saying this is how it DOES work, just that there are ways to prevent you from moderating without specifically tracking your anonymous posts.
Re: (Score:2)
Well the judges that the RIAA has in their pocket I suppose...
^^ Mod funny! (Score:2)
Re: (Score:3, Funny)
Re:There's always a way. (Score:5, Insightful)
Better yet. Run the whole process on virtual machines on a virtual network. Record the virtual state and I/O from outside the virtual machine/network and replay the whole process (including message display and "deletion") at your convenience.
DRM can make screenshots impossible (Score:5, Funny)
No, the real threat here is from Muslim extremists. I've heard rumors that an Egyptian named Abu Ali Al-Hasan Ibn al-Haitham is working on technology to foil such electronic protection mechanisms. If his "qamara" experiments succeed, all hope of being able to send unsavable or unforwardable messages may be lost.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Re:There's always a way. (Score:5, Insightful)
Or hell, I could just take photos of the screen.
This might well be secure from the average end user, but there will always be someone who can circumvent it, and in the case of a software hack, it only takes one.
Photos? (Score:2)
Somehow I don't think this a form of DRMIM.
Screenshot proves identity? (Score:2, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Interesting)
Scanners, photocopiers and printers already (so I understand) refuse to scan/copy/print images containing the eurion constellation [wikipedia.org].
If DRM'd images were displayed with a similar type of watermarking, which digital cameras could detect, then that could close off taking photos. (Screenshots themselves won't be possible with the DRM operating system in control - the DRM'd content won't display on screen with an app capable of taking a screenshot).
OK, so you could get away with fi
In a VM? (Score:2)
Re: (Score:2)
So, the server sends you a public key. You send the server a public key. You both encrypt the data you send to the other with their public key. That data can't be decrypted without the private key that matches the public key, which never traverses the network. How exactly do you break that, short of a vulnerability in the encryption scheme or a computer the size of the Earth?
Re: (Score:2)
Re: (Score:2)
He/she apparently knows dick-all about cryptography and was just trolling. His/her usage of the bogus term "unencrypt" gave this away even before the BS claim itself.
Screen capture? (Score:3, Insightful)
Re: (Score:3, Insightful)
Use colours that can't be captured. (Score:4, Funny)
Re: (Score:2)
Re: (Score:3, Funny)
ScatterChat (Score:5, Informative)
- dshaw
PS: No, I'm neither affiliated with ScatterChat or CDC in any way.
Re:ScatterChat (Score:5, Insightful)
Re: (Score:2, Insightful)
Re: (Score:3, Informative)
Re: (Score:2)
Unless you want the fact that you spoke to a certain person to be secret...
Re: (Score:2)
I CAN'T HEAR YOU. CAN YOU SPEAK UP!
Re: (Score:2)
The NSA would have only recorded:
Re: (Score:2)
Faraday Cage (Score:2)
So if you wanted to block visible light (lambda ~= 400nm) you would have to make sure that your sheeting didn't have any holes bigger than around 200 nm.
I think sheet metal would probably work fine.
Re: (Score:3, Funny)
You're missing the point. VaporStream is ScatterChat, but they are going to change the splash screen.
Ctrl + C, Ctrl + V (Score:4, Insightful)
Re: (Score:2)
My mama always told me to eat my vegetables. What exactly did your mama do for a living?
majjjjjjjy'a p (Score:2, Funny)
ggyG p (Score:2)
If you're using vim, you can save yourself three keystrokes:
Vjjjjjjjy p
And if you're grabbing the whole document, you can further shorten this to:
Gygg p
One word: (Score:5, Funny)
Er..
Bending over for a second . . . (Score:5, Insightful)
Re: (Score:2)
not recordable (Score:3, Insightful)
Re:not recordable (Score:5, Funny)
Re: (Score:2)
BTW-I have REALLY high tolerances, and REALLY expensive tastes!
LOL!
I like yer style!
obligatory (Score:5, Funny)
Oh, I thought it said VaporSteam, the gaming service that would allow you to play Duke Nukem Forever.
Re: (Score:2)
message gone! (Score:3, Funny)
*ding* "I just received my password! Er, now I can't find it."
insecure. (Score:4, Insightful)
Re: (Score:2)
(disclaimer: I'm a n00b and all-unknowing!)
When I check my e-mail with either evolution (for my cox.net account) or hotmail, I always see who it is from, who/if it has been cc'd or bcc'd, the subject line, and whether there were attatchments.
So, isn't this all stored together at least at one point?
With the number of people running Win IE and Outlook, does this null teh whole works at a weak point?
G-mail and Google Desktop tied in with the above?
I'm not trying to flame, just a
Re: (Score:2)
Still traceable? (Score:3, Insightful)
I hereby claim this to still be traceable, even if it is a little more difficult than you would otherwise expect.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Making the news (Score:5, Interesting)
TFA: This software sounds pretty damned cool. The article does not discuss specifically end user concern over the loose security (or even outright disclosure) practices of service providers (for profit, etc.) here lately, and I think that this user is the market for this software. People just aren't tickled by the idea of companies databasing and exploiting private conversations for the purpose of ad display. While this is certainly not the first software that is able to address these concerns, this is the first time I have seen it discussed in the context of who may not like it instead of the opposite. No specific information about the mechanics of the system is given.
While the idea of governmental interest in the personal conversations is not exactly preposterous, there is an awful lot of political hype on the subject. I think that the article could have given some more insight and a lot less innuendo. Potential for controversy does not controversy make. The article is actually bracketed by assumptions. and
Could not a software roundup have given a little pertintent information in place of all the speculation?
look at it but don't blink (Score:5, Funny)
Re: (Score:3, Funny)
Microsoft has been shipping this since 2003 (Score:3, Informative)
This is just another document DRM system. Microsoft has been shipping this in Office since 2003. They call it "Trustworthy Messaging [microsoft.com]. It includes 128-bit encryption and "content expiration", as Microsoft puts it.
Nothing new here.
Re:Microsoft has been shipping this since 2003 (Score:5, Informative)
First quiery (Score:2, Funny)
Re: (Score:2)
Re: (Score:2)
Oh, that's easy... (Score:2)
How it works... (Score:3, Informative)
Anyone can go to the company's web site and sign up for the service at $39.95 per year. It is Web-based, meaning that no hardware or software purchases are required. The company also says that VaporStream is completely immune to spam and viruses."
I guess their angle is to defend against MITM attacks. If it is web based, it sounds like the sender (Adam) logs in via HTTPS and sends a message to the recipient (Betty). The service adds a unique ID to the message, strips the headers and forwards it on to Betty.
Security problems that keep the bad guys from using it? The first is the $39.95 per month fee. No sense registering with that credit card 'cause that is tracable. How about sniffing one step upstream from Void's servers for originating IPs. That'll give you who is using it. Then traffic analysis watching for outgoing e-mail messages. If it works with your existing e-mail address then it uses SMTP, which is quite possibly plain text. You can sniff the contents of the message and the recipient. Statistical analysis of the HTTPS traffic just before the SMTP intercept can probably tell you who the sender was.
Let's not even get into the whole "recent hole in OpenSSL", staging a MITM/DNS poising attack with a proxy or phishing site.
Charles
Hardly novel technology (Score:4, Interesting)
Now, there is the issue that the server database is still presumably storing messages on disk, so we aren't matching up to the featured product's boast of never writing messages to disk. Offhand, I don't see a problem with this, since I think we have to trust in the physical integrity of the server. However, there's a simple solution: keep the database on a RAM disk.
In any case, I think this whole boast of the message never being written to disk is ridiculous, because you have absolutely no assurance that some intermediate machine is not caching it in transit.
Re: (Score:2)
Did I read the right article? (Score:5, Insightful)
This is not a DRM system.
This system assumes that the sender and the recipient both want to keep the message a secret. Of course somebody can take a screenshot. Or they could just photograph the screen. Or use their brain to remember the message and then their mouth to repeat it. If your big criticsm is that this system doesn't prevent the recipient from reproducing the message, well, please just stop typing.
The point of this system is that the message itself leave no trail, unlike email or instant messaging. After the message is read, there's no ability to trace the message from the sender to the recipient, and there's very little ability to intercept the message. Sure it can be done, but the right combination of SSL and other precautionary measures should make this a fairly secure experience.
As I said, this seems to be just a suped-up BBS system. Unless I'm missing something, the technology is really nothing new or exciting. The only new thing here seems to be the marketing package, but they seem to be doing a pretty good job of providing a new service using existing technology.
Re: (Score:3, Insightful)
I did read the article, in particular this bit:
Those of us that you're complaining about are simply pointing out that that claim is incorrect. The message most certainly *can* be saved, it just isn't by default.
I like this quote (Score:5, Funny)
Now THAT's a convincing argument.
we've had this for years (Score:3, Insightful)
Relying on any kind of proprietary service for secure communications is achieving the exact opposite: you have no way of knowing whether these people play by the rules.
Oh nos another Dan Brown novel (Score:2, Informative)
That book sucked. All Dan Brown books are the same but it's weird that things out of his books happen to make news years later such as this and the mechanical fly incident.
Questionable... (Score:2, Insightful)
Let's do it! (Score:3, Funny)
I mean, why *untraceable* messages unless they're terrorists that ALSO wanna distribute child porn! Sick!
------------------
Now, I've another question: you can't trace the messages, but can you trace the service was used (a protocol, a port? whatever?).
Because, since you are obviously hiding stuff from CIA and FBI, we plan to make your life a misery, y'know?
IM + Firewall = Bugz (Score:2, Funny)
From RTFA:
OMG! I'm already using it!! It's my IM client behind our corporate firewall!!!
Is it secure? One way to find out (Score:2, Interesting)
I call "Snake oil" (Score:3, Interesting)
I suspect that this is intended to give a false sense of security while providing Big Brother a way to watch people who _think_ that their communications are secure. Digital cell phones, anyone? Yes, it is illegal to listen in on the cell phone frequencies in the USA unless you are in law enforcement, but since when are criminals interested in obeying the law except to prevent drawing attention to themselves (e.g. -- don't speed on your way _to_ commit a crime, and don't speed on the way out unless you are already fleeing from someone who spotted you).
I also suspect that the hype about the government not being pleased with this is inteded to further the false image that this is secure.
There are ways to communicate securely in the digital age, depending on how you define "securely". The longgevity of the data is critical. Being able to decrypt today's troop movement orders for tomorrow morning after six months' time is not very useful because the data will be useless after tomorrow morning. Being able to decrypt, for example, today's communication about a terror plot to take place on January 20, 2009 (the day the next new President will be sworn into office in the USA for our non-US readers) in six months would be very valuable.
You cannot make a blanket statement that a system is "secure". A system is only secure for a given use in a given context.
Again, I have to call "Snake oil" on this one.
(*) This note was added in response to a comment in the Capacitor thread yesterday about people wanting information from "qualified" individuals, therefore I felt it appropriate to state my qualifications in this area.
The perfect secret medium (Score:2)
Its perfectly untraceable because it doesn't exist.
Re: (Score:2)
Re: (Score:2, Informative)
Over the Internet: Your connection to VaporStream uses secure SSL technology, creating a secure line between your computer and our network.
They claim you send your destination mail address first, then separately the message, the recipient gets a notification with your address, this is discarded when the message is opened.
Nothing you'd actually call a new technology anywhere in sight but patant pending notices left and right!
Re: (Score:3, Insightful)
Re:False (Score:5, Funny)
Re: (Score:2, Redundant)
Re: (Score:2)
What was the name of that dohickey some guy built out of parts from Radio Shack that could read the emissions from a CRT across the street and display an accurate image?? Dunno. Anyway, unlikely as it may be that this technology would be used much, it was proven that a CRT could be read remotely without even being visible.
Re: (Score:2, Funny)
Re: (Score:2)
Re: (Score:2)
Besides, the desktop one won't fit in my scanner...