Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

A Year After Snowden's Disclosures, EFF, FSF Want You To Fight Surveillance

timothy posted about 5 months ago | from the why-make-it-easy-for-'em? dept.

Electronic Frontier Foundation 108

Today, as the EFF notes, marks one year from Edward Snowden's first document leaks, and the group is using that as a good spur to install free software intended to make it harder for anyone (the NSA is certainly not the first, and arguably far from the worst) to spy on your electronic communications. Nowadays, that means nearly everything besides face-to-face communication, or paper shipped through the world's postal systems. Reader gnujoshua (540710) highlights one of the options: 'The FSF has published a (rather beautiful) infographic and guide to encrypting your email using GnuPG. In their blog post announcing the guide they write: "One year ago today, an NSA contractor named Edward Snowden went public with his history-changing revelations about the NSA's massive system of indiscriminate surveillance. Today the FSF is releasing Email Self-Defense, a guide to personal email encryption to help everyone, including beginners, make the NSA's job a little harder.'" Serendipitous timing: a year and a day ago, we mentioned a UN report that made explicit the seemingly obvious truth that undue government surveillance, besides being an affront in itself, chills free speech. (Edward Snowden agrees.)

cancel ×

108 comments

Sorry! There are no comments related to the filter you selected.

Pissed Roast (1)

Anonymous Coward | about 5 months ago | (#47173401)

Some decent tools on their site. [resetthenet.org]

Fight Slashdot Beta! (-1)

Anonymous Coward | about 5 months ago | (#47173419)

The Beta is tyranny!
 
Boycott Dice!
Boycott ThinkGeek!
 
Down with Beta! Down with Dice!

Re:Fight Slashdot Beta! (-1)

Anonymous Coward | about 5 months ago | (#47173451)

Off your meds again I see.

License for infographic files (0)

Anonymous Coward | about 5 months ago | (#47173427)

Source files for GnuPG infographic

These are the source graphics for the Email Self-Defense infographic from the
Free Software Foundation, available at .

License
-------

Copyright (c) 2014 Free Software Foundation, Inc.

Licensed under the Creative Commons Attribution license (CC-BY). See full
source and attribution text at the above site.

That sounds BSDish to me! ;)

Re:License for infographic files (0)

Anonymous Coward | about 4 months ago | (#47177265)

This is not a software. This is a piece of art work, and hence release under creative commons.

Today's Vancouver Sun says Canada spying on them (2)

WillAffleckUW (858324) | about 5 months ago | (#47173439)

So, it's not just the US spying on Americans in America, it's apparently Canadians spying on Canadians in Canada.

Re:Today's Vancouver Sun says Canada spying on the (1)

Anonymous Coward | about 5 months ago | (#47173761)

No - check out the "UKUSA Agreement"...
The Canadians are spying on the Americans, New Zealanders, Australians and Brits.
The Americans are spying on the Canadians, New Zealanders, Australians and Brits.
The New Zealanders are spying on the Americans, Canadians, Australians and Brits.
The Australians are spying on the Americans, Canadians, New Zealanders, and Brits.
The Brits are spying on the Australians, Americans, Canadians, and New Zealanders.

All perfectly technically legal.
All rather unstoppable as long as the NSA shills can keep the sheeple thinking that gnupg is too difficult.

Re:Today's Vancouver Sun says Canada spying on the (0)

Anonymous Coward | about 5 months ago | (#47173817)

Yeah, basically we're paying foreigners to spy on us. Raisin our taxes 'n Outsourcing 'merican jobs. Great!

Use 4k keys folks - the spooks really hate that! Takes at least twice as long to break our codes.

Re:Today's Vancouver Sun says Canada spying on the (1)

WillAffleckUW (858324) | about 5 months ago | (#47173901)

Yeah, basically we're paying foreigners to spy on us. Raisin our taxes 'n Outsourcing 'merican jobs. Great!

Use 4k keys folks - the spooks really hate that! Takes at least twice as long to break our codes.

Hey it's only $10,000,000,000 a year!

Which if we spent on building wind and solar we would solve the Global Warming crisis with.

Re:Today's Vancouver Sun says Canada spying on the (0)

Anonymous Coward | about 4 months ago | (#47178019)

All perfectly technically legal.

It is illegal as fuck. But I guess that is what "technically legal" means.
Seriously, I've never heard of a situation where someone even considers if something is legal unless they know that it probably isn't. If you have to check what you are doing with a lawyer you already know that you shouldn't be doing it.
Then there are of course the cases where something should be legal but isn't.

Re:Today's Vancouver Sun says Canada spying on the (0)

Anonymous Coward | about 4 months ago | (#47178033)

No - check out the "UKUSA Agreement"...
The Canadians are spying on the Americans, New Zealanders, Australians and Brits.
The Americans are spying on the Canadians, New Zealanders, Australians and Brits.
The New Zealanders are spying on the Americans, Canadians, Australians and Brits.
The Australians are spying on the Americans, Canadians, New Zealanders, and Brits.
The Brits are spying on the Australians, Americans, Canadians, and New Zealanders.

All perfectly technically legal.
All rather unstoppable as long as the NSA shills can keep the sheeple thinking that gnupg is too difficult.

Since EU has made a ruling that it violates human rights it is strictly illegal for the Brits to be involved. (Human rights applies regardless of nationality, it doesn't matter if they live in another country.)
I suspect Canada has similar laws.

Re:Today's Vancouver Sun says Canada spying on the (0)

Anonymous Coward | about 5 months ago | (#47173997)

Link? I don't see mention of it on their home page.

Re:Today's Vancouver Sun says Canada spying on the (1)

WillAffleckUW (858324) | about 5 months ago | (#47174121)

twitter - no link for you - they changed the title twice - last title was "Government orders federal departments to keep tabs on all demonstrations" and also coverage of bill S-4 in Globe and Mail.

No point encrypting if you're the only one... (5, Insightful)

nine-times (778537) | about 5 months ago | (#47173447)

There's no point in encrypting your email with something like GPG if you're the only one using it, and most people aren't going to use it until it's easy.

I know, you'll tell me it's easy. Just download this software, install it, and it'll work for your email client assume you're still using an email client and there's a plugin available for it, which there might not be. Otherwise you need to copy and paste and stuff, and... oh right, then there's also the whole issue of managing keys and keeping a backup copy safe. Most people don't back anything up.

You have to make it easy. Someone will get angry because I appear to be praising Apple, but take iMessage's encryption for example. Do people using it know that their messages are encrypted? Probably not. Are they given a choice? No. Do they know that they're generating encryption keys? Probably not. Are they asked to manage their own encryption keys? No.

That's easy. GPG isn't. Email encryption needs to be that easy, or people won't use it.

Re:No point encrypting if you're the only one... (4, Informative)

PRMan (959735) | about 5 months ago | (#47173475)

Gmail is working on it. And they're trying to get other e-mail providers onboard.

Re:No point encrypting if you're the only one... (1)

Anonymous Coward | about 5 months ago | (#47173591)

Listen, Google does evil. It has done nothing but evil - but it does it with a smile. I wouldn't trust anything Google does because it's always in favor of their business model. The product they sell is intimate details about you, and free software is the currency they use to pay for their product.

I haven't seen the details on Google's "encryption", but I wouldn't trust it unless the encryption/decryption happens only in the browser/client sending or receiving an email.

If the encryption is just mail servermail server it has no protection from government spying. We already know the NSA is heavily tapped into all American corporate/cloud networks.

Re:No point encrypting if you're the only one... (2)

NotInHere (3654617) | about 5 months ago | (#47173645)

The W3C should standardize the way 'End-to-End' communicates with the website. It has a huge potential, not just for mail but also for chat or with WebRTC.

Re:No point encrypting if you're the only one... (0)

Anonymous Coward | about 5 months ago | (#47173877)

And once we trust that Gmail does this for us, the government will pass a secret law that forces Google to open secret backdoors and legally forces all involved Google employees to keep it a secret, with extra provisions to prevent another leak before it can happen.

Re:No point encrypting if you're the only one... (2)

mlts (1038732) | about 5 months ago | (#47173893)

Maybe this is pure Ludditism, but the best security is gotten by having a MUA that is separate from the e-mail provider, and the MUA handles PGP/gpg or S/MIME keys.

There is something nice and convenient about Web based E-mail, but it is at a cost of end to end security.

It isn't as good as end to end, but with Exchange, one can do encrypted TLS connectors with other Exchange sites that one does a lot of E-mail or other messaging with. This will secure the E-mail as it goes from site "A" to site "B". However, if site "C" still uses unencrypted SMTP, then anything going there isn't really secured.

Re:No point encrypting if you're the only one... (1)

AmiMoJo (196126) | about 4 months ago | (#47178121)

It's a trade off. Less security for transparent operation and ease of use. Infinitely preferably to the current situation where there is zero security.

Re:No point encrypting if you're the only one... (1)

nine-times (778537) | about 4 months ago | (#47178679)

There is something nice and convenient about Web based E-mail, but it is at a cost of end to end security.

Not necessarily. We would just need a standard protocol for handling encrypted webmail, and then universal browser implementation for that protocol. Like maybe you wrap the output in <encrypted></encrypted> tags, and then browsers know how to interpret the tags and have access to the private keys. Google already syncs settings and extensions with your chrome profile, so if you trusted Google to do it, they could even sync your private keys. If you didn't trust Google, then we'd just need to figure out a different way to get access to your keys if you want to access your webmail away from your own computer.

Of course, then mail clients and mobile devices would need to support the same form of encryption as what the web browsers are using. That's the biggest issue: developing a standard for handling these things that everyone can agree on, and that everyone will implement. We already know how to do this. We're just not doing it.

Re:No point encrypting if you're the only one... (1)

mlts (1038732) | about 4 months ago | (#47179091)

We sort of have that with OpenPGP encrypted files, and Web add-ons. However, it assumes one is going to load their private keys into the Web browser... and because the Web browser is the first thing that gets its face curb-stomped come a 0-day, this may not be a wise thing unless there is OS support for keeping the keys, decryption module, and decrypted text viewer/attachment manager well out of the browser's OS context.

The reason I suggest an old fashioned MUA is because they tend to not be as vulnerable to malformed E-mail messages when configured properly. The spammy E-mails either try to get someone to download a wrapped executable (.scr extensions are commonplace), or get the user to visit a bad site. The E-mail themselves tend to not by themselves be dangerous, assuming scripting is turned off by default.

Re:No point encrypting if you're the only one... (2)

TheGratefulNet (143330) | about 4 months ago | (#47174443)

gmail will NEVER have encrypted mail, end to end.\

why?

think about it. their whole business model is about looking at your stuff. if you encrypt it, they can't see it.

also, the other main reason is that you can't do searches if your on-disk data is encrypted.

so, a web company will NEVER give true end to end (including on-disk) enryption. its againt their whole business model for many reasons.

Re:No point encrypting if you're the only one... (1)

AmiMoJo (196126) | about 4 months ago | (#47178443)

What they are talking about is encrypting email before it leaves Google's servers and goes out onto the wider internet. The NSA/GCHQ intercept email sent that way - it was in the Snowden slides. This would at least make bulk surveillance much harder, if not impossible. Sure, they could force Google to hand over decrypted copies, but at least that would require some kind of legal process instead of just hoovering everything up into a massive database.

This also has the added benefit of being transparent to the user, guaranteeing widespread adoption. It's similar to BBM or iMessage - you wouldn't trust you life to it, but considering most people use no encryption at all right now it is a massive improvement.

Re:No point encrypting if you're the only one... (1)

exomondo (1725132) | about 4 months ago | (#47176291)

Gmail is working on it. And they're trying to get other e-mail providers onboard.

I can't seem to find much credible evidence to back that and certainly an end-to-end encryption model would run contrary to their entire profit model for gmail, if implemented correctly it would mean no more targeted advertising and I wouldn't think they would be very keen on doing that.

Re:No point encrypting if you're the only one... (1)

AHuxley (892839) | about 4 months ago | (#47176513)

Where your "free" fully encrypted email/chat reverts to plain text for advertizing, that is where 5+++ governments, ex gov staff, former gov staff are waiting.
You have seen the lists of brands that fully, willingly and over years allowed this to happen on/deep in/to/from their own branded, dedicated networks.
The backhaul, client, server can have all the fancy, best, open source crypto you like.

Re:No point encrypting if you're the only one... (1)

Anonymous Coward | about 5 months ago | (#47173503)

I didn't know that either. Good information! Yeah, I've noticed the same thing with PGP encryption. No one wants to pay much attention to it and few people will go through the small amount of effort to encrypt their emails. I think the issue is people think either 1) it seems suspicious or 2) they don't care if the government (who they think are the only entity who can spy on people) reads their emails.

I think what should be emphasized is that anyone given a fair amount of technological sophistication can spy on your information. As we get to the future, the potential for holes that are currently unknown being found by more people gets higher and there may be a time when anyone can download a prewritten program that will open up hundreds of thousands of users emails and there'll be nothing anyone can do. Once it's released, it's tough to unreleased.

Also, there's the supposed mind-control that's being used by government(s) and secret organization(s) that manipulate people into ignoring security through techno-psychological manipulation. The same stuff that's being used to get people to ignore it and think it's just conspiracy (and even go as far as manipulating people into accusing others of being stupid -- all in order to defend the manipulation system set in place).

Re:No point encrypting if you're the only one... (2)

mcelrath (8027) | about 5 months ago | (#47173571)

I've been using GPG for more than a decade, but in recent years I've stopped signing my messages because it often trips up poorly-configured spam filters. That, combined with the fact that you can't be certain that the recipient has received or read a message makes using GPG (and potentially losing your email) risky.

While "read receipts" exist in many proprietary formats, we need it to be standardized and deployed globally. Hey, let's use our GPG keys to do it?

Re:No point encrypting if you're the only one... (1)

mlts (1038732) | about 5 months ago | (#47173935)

I've used both PGP and GPG, but I have run into the spam filters. With S/MIME, I've run into people flipping out when they see the ribbon icon in a received E-mail on Outlook, to the point getting their company's legal department and a LEO involved because they thought a validated signature was malware.

What I'd like to see is a signing system that piggybacks onto GPG, or perhaps S/MIME that would allow for read receipts (provided the receiver chose to allow it to be sent)... but maybe allow for mail to be "un-sent", although the mechanism involved would have to be flawless, or else it would be a big security issue.

Re:No point encrypting if you're the only one... (2)

McDutchie (151611) | about 5 months ago | (#47173583)

This argument hasn't changed in twenty years, in spite of massive improvements in ease of use. Apparently, it's impossible to make it "easy enough" for the average user. I think this means ease of use actually has very little to do with the problem. The problem is with the average user's priorities. People value convenience more highly than privacy, and as long as people don't change those values, encryption will never take on. Typically people will only change their priorities under threat of dire and immediate consequences for them personally. Everyone will lock their door so they don't get burglarised. But email privacy is too abstract and invisible still. It's going to take some huge cases of identity theft, with real monetary loss, to get people to change â" and then people will probably sooner abandon email than use email encryption. Finally, the kind of convenience that you propose necessarily will render the whole thing insecure. Letting strangers (like Google) manage your private keys defeats the whole purpose.

Re:No point encrypting if you're the only one... (1)

nine-times (778537) | about 5 months ago | (#47173773)

Apparently, it's impossible to make it "easy enough" for the average user.

And yet, as I point out, Apple has done it with iMessage. A lot of sites encrypt their traffic with SSL.

I think the real problem is one of standards. Email is from a time when everyone wanted open standards. Rather than improve and refine those standards, everyone is moving towards closed systems (Facebook/Apple Messengers, Google Hangouts, etc.). Nobody is even trying to improve email anymore.

SSL:Completely different level (1)

DrYak (748999) | about 5 months ago | (#47173851)

A lot of sites encrypt their traffic with SSL.

Yet, SSL handle only the encryption between a server, and the client application. (and can be made totally transparent to the user).
Whereas the anti-surveillance discussed here are end-to-end (from one user to the other) and will always require some minimal end-user intervention (key handling, although the interaction can be minimized and user interface efforts can make the experient as easy as possible).

(Facebook/Apple Messengers, Google Hangouts, etc.).

Note that OTR (Off-the-Record) is standard, and is capable to be used above any of those, just like OpenPGP works over email.
But again, this requires either using full blown clients (pidgin, adium, jitsi, messagebird, or any other OTR compliant client) or using extensions (like cryptocat) to be able to use it from within a webapp.

Also, for obvious reason, OTR disturbs the "search" fonction on chat web-apps (as the webserver only sees encrypted text and can't search).

Re:SSL:Completely different level (1)

nine-times (778537) | about 5 months ago | (#47174195)

Yet, SSL handle only the encryption between a server, and the client application.

You can use the same encryption scheme for encrypting anything.

...will always require some minimal end-user intervention...

Not necessarily. You just need to make key management easy. I know people are going to get angry every time I bring up Apple, but OSX can store certificates/keys in the keyring, which can then be backed up to iCloud. Don't trust Apple if you like, but my point is that it's not impossible to make the whole thing much more automatic, safe, and easy for normal users.

Re:SSL:Completely different level (0)

Anonymous Coward | about 4 months ago | (#47174503)

I agree with you in principal. I'll admit, I'm not exactly a fan of Apple, but you give a fairly good example. However, there's one big thing you're overlooking about the way Apple's iMessage and SSL are encrypted: those 3rd parties are a weak point. We know that the government has definitely sent NSLs or otherwise subverted those who hold the keys. Or, how about the Heartbleed bug exposing not only what should have been encrypted information, but also private keys. So, even though your message was encrypted, it did absolutely nothing stop the surveillance.

Re:SSL:Completely different level (1)

TheCarp (96830) | about 4 months ago | (#47174927)

A guy I know was working on a solution to this a few years back, but it just kind of stagnated and died after the initial specifications. Called it the "Passive privacy system".

Basically a PPS enabled emailer would transparently generate gpg keys on first use, with no password, and advertise them in headers. If you begin a conversation with someone else who supports it but whose key you don't have, then it uses a header based conversation to exchange keys and starts encrypting all messages within a couple of emails.

Then....if a user decides later that they actually care, they can always generate new keys and/or add passwords to protect their keys.... but that becomes an added level of security on top of a rather strong base level.

Re:No point encrypting if you're the only one... (1)

McDutchie (151611) | about 4 months ago | (#47175221)

And yet, as I point out, Apple has done it with iMessage. A lot of sites encrypt their traffic with SSL.

Both of these are surely compromised by the NSA by now. Certainly SSL is.

I think the real problem is one of standards.

That is a really good point. The move to closed systems is a disease that is killing the internet.

Re:No point encrypting if you're the only one... (1)

Defenestrar (1773808) | about 4 months ago | (#47175847)

Really? It's easy enough? Let's talk market share then. How many easy to use GPG FOSS plugins are there for Outlook 2013? 2010? How about the light email clients which comes with Windows 7 or 8? What about the Android basic email client? of the Android Gmail client? In the Windows environment all of the recent Outlook versions have hooks for plugins. There's even what's effectively an MS Office App store for addons. That sounds like a dead easy way for people to get a GPG plugin for the industry standard client... but where is it?

Re:No point encrypting if you're the only one... (1)

MTobix (3684323) | about 4 months ago | (#47177951)

That sounds like a dead easy way for people to get a GPG plugin for the industry standard client... but where is it?

Hi, I am the development lead of gpg4o - a GnuPG integration for Outlook
I can tell you that there is no dead easy way for getting GnuPG into Outlook. You are facing three major problems
- Outlook hooks are very tricky especially if your manipulating mails
- There are many dialects of OpenPGP message formats
- Hiding the complexity of GnuPG for the avarege end-user, so that a non-nerd can use it.


We spend several man-years with research and development for polishing our product.

These are the reasons the Open Source Plugins for Outlook are failing in the daily use.

Tobias

Encryption isn't privacy (5, Interesting)

bigpat (158134) | about 5 months ago | (#47173585)

Encryption misses the point. Encryption isn't privacy. The major threat to privacy from the US government is not from the content of your communications being read without a warrant it is that your communications are going to be monitored without a warrant so they will be able to monitor all your associations, purchases, communications and movement and locations. Basically it is like having a tail on 24x7 with someone looking over your shoulder... they don't need to know what you are saying until they want to and if they want to then you are past the point where encryption will mean much since they can put a keylogger on your system or maybe even break your 256 bit encryption.

The only protection from the surveillance state is either to eliminate communications technology altogether or to return to the rule of law.

Re:Encryption isn't privacy (1)

nine-times (778537) | about 5 months ago | (#47173751)

I think you missed my point. I'm not saying there's no point in encrypting your email. I'm saying there's no point if the recipient doesn't have their own software and keys to decrypt the encrypted message.

Re:Encryption isn't privacy (1)

bigpat (158134) | about 5 months ago | (#47174119)

Sorry. I was hijacking your statement to make another. Of course you are correct that for encryption to be effective it has to be the default for everyone rather than some special thing only criminals, national security types and paranoid people use. Basically using encryption now is like raising a big red flag saying 'look at me look at me I am using encryption!!'

But my point is that even with encryption it does not thwart 95% of the threat from unconstitutional government surveillance or criminal hackers. Sure if Google can make encryption more standard then that would be a great accomplishment, but it is just one small slice of the privacy pie.

Re:Encryption isn't privacy (1)

DrYak (748999) | about 5 months ago | (#47173929)

Encryption isn't privacy.

Encryption isn't everything and all privacy.
But encryption is part of the solution, as much as Tor, etc.

your communications are going to be monitored without a warrant so they will be able to monitor all your associations, purchases, communications and movement and locations. Basically it is like having a tail on 24x7 with someone looking over your shoulder...

Perfect privacy will require several component. Encryption is one of the them. Connection obfuscation like Tor is another. Relying on pseudonymous identities (Do Not Track Me single-use email addresses, for example) is yet another.

then you are past the point where encryption will mean much since they can put a keylogger on your system or maybe even break your 256 bit encryption.

the 256 bits encryption is safe. the actual maths behind it have been repeatedly proven to be sound and secure.
getting the password stolen (keylogger, side channel, implementation bugs, etc.), on the other hand is likely to be what will happen. (and as both software and hardware is shown to be backdoored, they won't even need the effort of puting an new keylogger, just use the backdoors).

The only protection from the surveillance state is either to eliminate communications technology altogether or to return to the rule of law.

In the mean time, you can also make the surveillance job as difficult and expensive as possible.
Thus: encrypt and obfuscate as much as possible, even for trivial everyday activities.

Re:Encryption isn't privacy (2)

bigpat (158134) | about 5 months ago | (#47174397)

I don't disagree with the idea that some of these things might be worth doing, especially if you have intellectual property or activities that are worth protecting. Just disagree with the notion that it would be easier to get a few billion people talking with encryption than it would be to just get some politicians elected who might actually put some constitutional restraints back on the NSA and other US government agencies. Encryption is better than not having encryption, but relying on encryption when you don't have well managed keys or security in other parts of your system is what I think can lead to a screen door on a submarine mentality where you think you have a door.

Re:Encryption isn't privacy (0)

Anonymous Coward | about 5 months ago | (#47173961)

It forces the people into self-censorpship. People will not talk about things they think could potentially get them in trouble. You make the population control themselves.

Re:Encryption isn't privacy (0)

Anonymous Coward | about 4 months ago | (#47178863)

Its absolute bullshit

Encryption isn't privacy (1)

LessThanObvious (3671949) | about 4 months ago | (#47176293)

That is exactly right. The push to encourage encryption does not solve the issue. De-funding and dismantling the NSA and taking back our freedoms through clear legislation is the only way to get what we deserve as a nation. Encrypting ordinary communication beyond simply using SSL/TLS is like bowing down and saying you don't expect the first amendment to protect you. When the teeth are gone from the fourth amendment the first amendment losses it strength as well. The moment we start editing our communications to keep our privacy, real freedom is lost. That said if you want to say anything private and keep it private strong encryption and a low profile are the only means to assure such privacy.

Re:No point encrypting if you're the only one... (1)

twistedcubic (577194) | about 5 months ago | (#47173633)

People in the United States may find this useless, but in countries whose economies and government are easily manipulated by outside interests, this would be more popular, I think.

Re:No point encrypting if you're the only one... (4, Insightful)

Capslock118 (936446) | about 5 months ago | (#47173653)

I agree 100%. I'd say 50% of my communication is with my family, and there is not a single person in that group that would be able to handle GPG. And anyway, we are at the point of "every message on every device", and again most of my family communicates on their smartphones, not on a desktop or laptop. Even if they did use a desktop/laptop the message would still have to be easily read on all of their devices (including default apps). There is just no point in wasting my time with email encryption since I am not any kind of political advocate and no one I communicate with would be able to use encryption. Heck, I have S/MIME on all of my devices for email and that works great and it's automatic......but I am the only person in my circle who uses that even though it's arguable easier to use than GPG (because it's supported by most of the default email applications out there). Why even bother with trying to ram encryption into email when there are other secure communication protocols out there?

Agreed (2, Insightful)

Anonymous Coward | about 5 months ago | (#47173669)

The essence of this demand is "You have a responsibility to smarten-up."

That has never, and will never, work. Humans simply do not work that way.

My optimistic side says the major players will make it easy, like your example from Apple, and then all will be good.

My cynical side says the government will simply slap some gag orders on the industry players, and impose backdoors, and roll merrily along with the surveillance.

The *only* people who can be protected from this are those smart enough, and motivated enough, to do something that is not easy.

Re:No point encrypting if you're the only one... (2, Informative)

Anonymous Coward | about 5 months ago | (#47173683)

Do people using it know that their messages are encrypted? Probably not.

Are their messages encrypted? Probably not. [cnet.com]

Easy enough your grandma can't do it.

Re:No point encrypting if you're the only one... (1)

anethema (99553) | about 4 months ago | (#47176081)

Pretty much no one expects email attachments to be encrypted.

iMessage was the example and they are certainly encrypted.

Now whether the NSA can't just backdoor in who knows, but on the face of it, they are.

Re:No point encrypting if you're the only one... (0)

spire3661 (1038968) | about 5 months ago | (#47173715)

The problem with imessage is there is no way to VERIFY its actually encrypted. There is no EASY encryption, all of it requires diligence.

Re:No point encrypting if you're the only one... (0)

Anonymous Coward | about 5 months ago | (#47174263)

iMessage works over wifi if you're connected, and I can certainly confirm it's encrypted by inspecting the traffic.

Derp.

Re:No point encrypting if you're the only one... (1)

Bob9113 (14996) | about 5 months ago | (#47173747)

Just download this software, install it, and it'll work for your email client assume you're still using an email client and there's a plugin available for it, which there might not be. Otherwise you need to copy and paste and stuff, and... oh right, then there's also the whole issue of managing keys and keeping a backup copy safe. Most people don't back anything up.

The first automobiles didn't have keys, but people have learned to use and manage them. And for those keys you can't even download the management equipment, you have to go to a hardware store to get copies.

The problem is not that it is hard, the problem is that people don't realize the threat.

take iMessage's encryption for example. Do people using it know that their messages are encrypted? Probably not. Are they given a choice? No. Do they know that they're generating encryption keys? Probably not. Are they asked to manage their own encryption keys? No.

Is iMessage secure? No.

Re:No point encrypting if you're the only one... (1)

nine-times (778537) | about 5 months ago | (#47173859)

The first automobiles didn't have keys, but people have learned to use and manage them. And for those keys you can't even download the management equipment, you have to go to a hardware store to get copies.

People understand what cars do better than they understand computers, and when you lose your car keys, you don't lose the whole car.

Is iMessage secure? No.

Explanation needed.

Re:No point encrypting if you're the only one... (1)

vux984 (928602) | about 5 months ago | (#47173783)

Someone will get angry because I appear to be praising Apple, but take iMessage's encryption for example. Do people using it know that their messages are encrypted? Probably not. Are they given a choice? No. Do they know that they're generating encryption keys? Probably not. Are they asked to manage their own encryption keys? No.

Does trusting Apple to write your encryption software, manage your encryption keys for you, and handle your actual communications make any sense in the least?

I mean, yes, sure if you want to trust Apple.

But if your position is that you trust Apple not to intercept and monitor your data, and to refuse to cooperate with government entities not to intercept and monitor your data then all you need is some transport layer security to prevent someone 'not Apple' from monitoring it during transmission. So https/ssl/tls is all you need.

On the other hand, if you don't trust apple not to intercept and monitor your data, or you expect they will cooperate with government entities to intercept and monitor your data then you can't trust them to provide the end point software, or the encryption tools -- doublely so in a closed source manner where you can't even audit it.

There is no scenario where you can simultaneously NOT trust apple AND rely on their proprietary encryption solution at the same time. That's like trusting a burglar to set up your home security system; especially if you aren't even allowed to fully inspect it. Its plainly idiotic.

Email encryption needs to be that easy, or people won't use it.

Sadly I agree. Which is why people don't use it.

But for it to be that trustWORTHY, it has to built from the ground up with that goal in mind. It HAS to be open source, it has to be deterministically buildable, it has to be auditable, it has to be distributed and peer to peer system with no point of central compromise. The whole system has to be open and monitored by multiple parties.

Thus while it -can- exist if enough people want it, it CAN'T be a solution built and distributed and run by a single corporate entity.

Re:No point encrypting if you're the only one... (1)

mlts (1038732) | about 5 months ago | (#47174005)

Sometimes, I wonder about an encryption protocol implementation like iMessage being broken up into multiple companies, all separate, perhaps in different countries:

1: The company that codes the client.
2: The company with the servers where messages reside.
3: The company that writes the protocol.
4: The company that officially signs the executables to be distributed, but vets the code base for unauthorized changes before doing so.

By splitting this up, it would take compromise of at least two of the above, and definitely the company with the servers.

Re:No point encrypting if you're the only one... (2)

nine-times (778537) | about 4 months ago | (#47174527)

Does trusting Apple to write your encryption software, manage your encryption keys for you, and handle your actual communications make any sense in the least?

It makes more sense than not encrypting your messages at all. Actually it's dramatically changing the sort of problem that you're dealing with. If you really just don't trust Apple at all, then I get it. Don't use their products at all, because they could have put in NSA backdoors to everything, so use FOSS.

But my point wasn't that we should trust Apple. My point was that Apple managed to create an encryption scheme for messaging that results in every message being encrypted, without the user being expected to do special configuration and key management, and it's baked into their software by default. If Apple can do it, why can't someone else?

For starters, if we want GPG to be the default for encryption, why can't we have thunderbolt built in such a way that it includes GPG, Enigmail, and everything else? Why not have the default setup prompt to set up encryption, generating keys or restoring them if they don't already exist? And what's your plan to standardizing backup/recovery of keys?

Fine, don't trust Apple, but then build your own system that's at least as good.

That's like trusting a burglar to set up your home security system

Only if you assume that Apple is a burglar, in which case, don't trust them with anything. But in reality, it's just too much of a big deal to not trust anyone with anything. I put my money in a bank, even knowing it's possible for them to make unethical use of my banking records. I store my email on Gmail. I store my website with my web host. I accept SSL certificates from certificate authorities. I buy my phone from Apple and my laptop from Lenovo. There could be hardware chips built in by the manufacturers that are logging my keys. Realistically what am I going to do if I don't trust anyone? Even when I use Linux, I'm still trusting people. I didn't do a code audit myself.

Re:No point encrypting if you're the only one... (1)

vux984 (928602) | about 4 months ago | (#47175095)

But my point wasn't that we should trust Apple.

Except that's exactly what it is.

My point was that Apple managed to create an encryption scheme for messaging that results in every message being encrypted, without the user being expected to do special configuration and key management, and it's baked into their software by default. If Apple can do it, why can't someone else?

What is the value of every message being encrypted if Apple can decrypt them at will? That's like locking your car door to keep the valet out, and then handing the valet your keys.

Of course its easy. But its also completely POINTLESS.

For starters, if we want GPG to be the default for encryption, why can't we have thunderbolt built in such a way that it includes GPG, Enigmail, and everything else? Why not have the default setup prompt to set up encryption, generating keys or restoring them if they don't already exist?

These are all good ideas.

And what's your plan to standardizing backup/recovery of keys?

I don't have the answer to that one. That's a hard problem.

Only if you assume that Apple is a burglar don't trust them with anything.

The point of end to end encryption is that if you trust the end points, you can afford NOT to trust the intermediary.

If you DO trust the endpoints, and they are the same entity as the intermediary then WHAT IS THE POINT OF IMPLEMENTING END TO END ENCYRPTION?

If you trust apple, then you trust apple. If you don't, then you don't. But what is the point of trusting Apple to provide the endpoints to provide you security against Apple compromising the comm channel in the middle? Apple doesn't EVER need to compromise the middle -- they already own the end points. So WHAT exactly are you accomplishing?

Realistically what am I going to do if I don't trust anyone? Even when I use Linux, I'm still trusting people. I didn't do a code audit myself.

Its not about absolute security. Its about identifying who you trust and who you don't.

If I trust mozilla to provide me end point encryption and I do not trust verizon or google. Then using mozilla endpoints to encrypt messages so that I can send them over a verizon communication channel to be stored on a google server, to be retreived by someone else using verizon, using a mozilla endpoint... that is all perfectly reasonable.

I trust mozilla, so they can 'touch' the encyrpted data. I don't trust verizon or google. So they can't. That's logical.

Likewise, if I decide to trust apple to provide my endpoints that's fine too. But who am I protecting it FROM? I just need transport layer security to get it to apple's servers over verizons network, and since I trust apple, that's good enough. What does end to end encryption get me? That I trust Apple but I don't trust Apple? How is that not irrational?

Re:No point encrypting if you're the only one... (1)

Anguirel (58085) | about 4 months ago | (#47175647)

If you DO trust the endpoints, and they are the same entity as the intermediary then...

But Apple isn't the same entity as the intermediary. Apple is involved with both endpoints by providing the hardware and software, but there's a cell tower, whatever service provider you have, whatever network connections are in between, whatever storage exists to ensure delivery even if the end point isn't currently available, whatever service provider the other person has, and another cell tower on the other end. Assume I trust Apple. I still don't trust all that stuff in the middle, particularly the cell phone and cell tower broadcast that anyone near that tower can pick up.

Which is exactly what you go on to describe with regards to trusting Mozilla, but not Verizon or Google. Is it that there's an extra Apple storage point in the middle? So in your second example, if I trusted Mozilla *and* Google, but not Verizon, I don't need to bother with the extra security, just use SSL? And what if I trust the code Apple wrote, and the general security surrounding the encryption keys by Apple, but I don't trust that a third party never has access to the server Apple is using? Does that change things?

Re:No point encrypting if you're the only one... (1)

vux984 (928602) | about 4 months ago | (#47175759)

But Apple isn't the same entity as the intermediary. Apple is involved with both endpoints by providing the hardware and software, but there's a cell tower, whatever service provider you have, whatever network connections are in between, whatever storage exists to ensure delivery even if the end point isn't currently available, whatever service provider the other person has, and another cell tower on the other end. Assume I trust Apple. I still don't trust all that stuff in the middle, particularly the cell phone and cell tower broadcast that anyone near that tower can pick up.

Which is why you need transport layer security, like https/ssl/tls. You don't need or benefit from "end to end encryption". I already wrote this in my original post.

So in your second example, if I trusted Mozilla *and* Google, but not Verizon, I don't need to bother with the extra security, just use SSL?

Bingo. And that is the world most of us live in. We trust the browsers/clients we use and we trust the services we deal with (be it google, dropbox, the bank), but we don't trust the commchannel and want to be secure from our data being overheard between the trusted endpoints. (Whether that trust, especially in the service endpoints has been misplaced is a separate issue, but that IS the trust model.)

And what if I trust the code Apple wrote, and the general security surrounding the encryption keys by Apple, but I don't trust that a third party never has access to the server Apple is using?

That's an interesting position. I suppose it does change things. But it it a rational position to hold? Why do you trust that a 3rd party never gets to tamper with the client, but has free access to the server?

I concede it does amount to a net reduction in the attack surface; since there are 'fewer' places to attack. And I agree a reduction in the attack surface is a genuine benefit to the security.

In terms of a malicious Apple or a coerced Apple you are still out of luck, and end-to-end encryption gets you nothing.

But in terms of Apple itself being the victim of an opportunistic attacker who is able to compromise Apple in some partial but incomplete way then, in that scenario, yes, apple's end to end security was better than not having it.

So I will revise my position; a single entities proprietary end to end encryption is the most worthless end-to-end encryption one can possibly have. But it IS better than not having it at all.

Is that fair? :)

Re:No point encrypting if you're the only one... (1)

nine-times (778537) | about 4 months ago | (#47176063)

What is the value of every message being encrypted if Apple can decrypt them at will?

IIRC Apple doesn't get your encryption keys in their system. I don't remember exactly how it works, but I remember reading that the encryption is from one endpoint to the other, and Apple doesn't actually have the ability to decrypt the message in transit. Now you could complain that they might have put in a back door. Well sure. That's possible with any closed source software-- and really even with FOSS software that hasn't been audited by someone you trust.

Of course its easy. But its also completely POINTLESS.

Well it really really depends. If you think that security is binary-- either "secure" or "not secure"-- then you grossly misunderstand the issue. Even if Apple can read your messages, which I could be wrong about but I believe they officially say that they can't, I would still trust Apple with a lot more information than I would trust the Internet are large. It's not locking your car to keep the valet out, it's asking the valet to lock your car once he's parked it.

And besides, as I've said, I don't really care about Apple. I'm not saying, "Don't encrypt your email! Just use Apple's Messenger instead because it's way better and secure!" I'm saying that if you want people to encrypt their email, look at what Apple's done as a possible model for how to accomplish that, because they succeeded in making it an easy process.

If you DO trust the endpoints, and they are the same entity as the intermediary then WHAT IS THE POINT OF IMPLEMENTING END TO END ENCYRPTION?

Yeah, kind of my point in saying, "Only if you assume that Apple is a burglar don't trust them with anything." There's levels of trust. I've given Apple my credit card before, and I trust that they're not going to charge me for anything that I didn't buy. Therefore, if I were going to send credit card information over the internet, I'd prefer to use their encryption over nothing.

But again, this isn't about Apple. I have no problem with you distrusting Apple. Still, you're going to have to trust someone sometime. You trust Mozilla? Fine, then let them implement an encryption scheme as simple for users to work with as Apple's is. I'd be perfectly happy with that.

If it hasn't come through in our discussions, my preference is for there to be improvements to be made to email, according to open standards that can be implemented by Mozilla, Apple, Google, and everyone else, that make encryption dead-simple. The fact is, email could stand to be improved in many ways, but it won't be anytime soon because you have Apple running off and doing it their own way, Google running off and doing it their own way, and Mozilla allowing you to install a plugin that calls another application that most people don't have installed, which then allows you to run a wizard, that dumps out a key, that needs to be backed up in some unspecified way or you lose all of your email, which also renders your email unreadable anywhere else.

Re:No point encrypting if you're the only one... (1)

sexconker (1179573) | about 5 months ago | (#47173841)

The guide breaks it down into 6 simple steps, which each have several sub steps, which each have several actual things you need to do. All presuming you're running Thunderbird in Linux and that people you email will put up with the bullshit.

I particularly like the step that tells you to blindly sign Adele's key. It's right before the step that tells you to never sign keys you didn't actually verify.

Re:No point encrypting if you're the only one... (1)

muridae (966931) | about 4 months ago | (#47174649)

Did you read their instructions? My parents use Thunderbird for email, because it's what I recommended for them. I decided to test on my clean box (browser only for the most part) and see how fast I could get my email, encrypt it with Enigmail and GPG, generate and upload a 4k key, and send out a signed email. Less than 10 minutes, most of that was waiting for the download because I've got torrents running elsewhere. With TBird installed, it was a few seconds to install GnuPG, a second for Enigmail, and less than a minute for me to get a key. The instructions walked through how to upload keys to any of various key servers, and sent off an email to my parents to see the same infographic and instructions on how they can and should do the same thing.

Sure, it used to be all command line tool with no GUI, that was only usable by *nix geeks; no longer. The plugin is all built into TBird or your email program of choice's plugin system, and has a GUI that is just a few clicks away. Sure, it won't work on webpage email systems yet; if that's what you rely on then you have some valid complaints against the email provider and not against encryption.

Re:No point encrypting if you're the only one... (2)

nine-times (778537) | about 4 months ago | (#47175907)

Did you read their instructions?

Yes. And I'm an IT guy, and I'll tell you that an awful lot of people would have trouble with those directions even if they wanted to follow them. For your average person, they'd have to install Thunderbird, GPG, and Enigmail-- and with that, you've already lost 90% of users. You haven't even gotten to dealing with the encryption keys, but give those instructions to most people and they'll say, "But can't I just use the Internet?" by which they mean, they would rather use webmail than install 3 applications. They won't even understand what those 3 applications are. You can forget about Linux.

Plus, let's say they follow those directions and encrypt all of their email in Thunderbird. Now they're traveling and they want to read their email in webmail. Uh oh. It looks all weird. No problem, they'll just access it on their iPhone-- but it looks like gibberish there too!

Sorry, it's not going to work like this. It needs to be much much easier than this.

Re: No point encrypting if you're the only one... (0)

Anonymous Coward | about 4 months ago | (#47177015)

Anon cause my phone doesn't have my new password. And you're argument of "joe-normal's email program of choice doesn't make encryption easy" sounds like a complaint for the program or webpage, not against encryption.

I find the rest horribly funny; the discussion i had with my mother about the infographic was similar but with a different result. Like i said, they use Thunderbird already. "So I got your message about encrypting emails, dad has wanted to do that for a while. The steps looked easy, but I'll let him do it. What would this do to the emails on my phone?" I tell her that gmail doesn't support it yet, but my favorite K9 does. "So would this encrypt everything?" No, just the mail we send each other, your newsletters and ads would still be normal. "Would you fix my phone with K9?" Sure. And then a discussion about Doctor Who, since K9.

No, it isn't perfect and transparent yet. But the EFF's audience isn't clueless either. If we put the time needed ton increase encryption use just to double (each help just one person) then it would be a great step for privacy. The EFF infographic makes it desirable, we geeks have to step up and make it happen.

I'm setting up two people with keys who've never been encrypted before, what are you doing?

Re: No point encrypting if you're the only one... (1)

nine-times (778537) | about 4 months ago | (#47178851)

Usually don't reply to anonymous cowards, but I gather you're the same guy, so here goes:

And you're argument of "joe-normal's email program of choice doesn't make encryption easy" sounds like a complaint for the program or webpage, not against encryption.

That's because I'm not at all opposed to encryption. I'm saying that this stunt to advocate encryption will be ineffective. My argument is basically that we need to standardize on forms of encryption that will then be built into all platforms natively, including effective methods of key management, that make the whole process transparent to end-users. If end users need to install software, if they even need to understand that their email is encrypted in order to access it, then you're doing it wrong.

the discussion i had with my mother...

That's all well and good. Your mother sounds much more sensible than most people. You may think that she's clueless, but most people are both clueless and stubborn. They barely understand the concept of encryption, don't understand anything about how it works, are not very interested in security, and will outright refuse to accept changes in their workflow. If I were to set something up like this for my own mother, I wouldn't trust her to do it. I would have to set it up for her and then keep a copy of the keys myself as a safeguard. Even then, I'd worry that at some point, she'd decide to generate her own new keys and then lose them, because you just don't know what the hell that woman is going to do.

Myself, I wouldn't use GPG because there's not wide enough support. I use Outlook for work, and last time I tried it, the GPG plugin didn't work in Outlook and just crashed everything. I would sooner try to use S/MIME, which is more widely supported. But that's sort of my point-- you need a single set of standards that everyone is using, or else the encryption schemes have limited utility.

Re:No point encrypting if you're the only one... (1)

FuzzNugget (2840687) | about 4 months ago | (#47175579)

But do you trust Apple enough to believe they haven't installed any backdoors in their closed-source software?

Re:No point encrypting if you're the only one... (1)

nine-times (778537) | about 4 months ago | (#47175809)

Whether you do or not isn't really my point. I was just using it as an example. They made it easy, and if you want people to encrypt their email, it needs to be equally easy.

History changing revelations? (0)

Anonymous Coward | about 5 months ago | (#47173471)

I understand that it is important to have suspicions about NSA activities confirmed by hard documentation, but did anyone, anywhere, really think that the NSA was playing by the rules? That agency's non-approach to personal liberty has been a running gag in Hollywood for years.

Anonymous Cowards only. (-1)

Anonymous Coward | about 5 months ago | (#47173489)

In honor of the day I ask everyone to remain Anonymous in this thread.

Re:Anonymous Cowards only. (0)

Anonymous Coward | about 5 months ago | (#47173689)

In honor of the day I ask everyone to turn off PC+smartphone, remove the batteries for both, and go outside to play.

For the GB people: go to your officials and complain about the CCTV cams.

Re:Anonymous Cowards only. (0)

Anonymous Coward | about 5 months ago | (#47173971)

In honor of the day, I urge everyone to blindly grab and dump data without concern for the collateral consequences and without doing any due diligence to ensure it is only relevant to whatever beef you claim to have.

Misuse (2)

Impy the Impiuos Imp (442658) | about 5 months ago | (#47173499)

> the seemingly obvious truth that undue
> government surveillance, besides being
> an affront in itself, chills free speech.

When I first read this, I was completely shocked that, because the NSA monitors this, anyone would ever think they are anything but a bunch of swell guys.

Re:Misuse (0)

Anonymous Coward | about 5 months ago | (#47173661)

Nobody is surprised the NSA is monitoring enemies of the state.

What surprised everyone is that every American is an enemy of the state.

Fixing a social problem with technical means? (5, Insightful)

cpghost (719344) | about 5 months ago | (#47173579)

Basically, we're making it WAY too easy for the NSA to spy on us. But, even if we all switched to encrypted mail, that's not enough: with their metadata collection, they can still infer a lot of things from our communications patterns. So technically, we need I2P, Freenet or similar anonymizing technology to hide in the crowd. However, to REALLY fix the problem once and for all, we need to take it to the political arena, and fight for majorities to get Congress to reign in NSA in earnest, no matter what "Yes We Scan" Obama wants. If we don't, Orwell's 1984 will remain in effect, no matter how much we use OSS, encryption and so on.

Re:Fixing a social problem with technical means? (1)

Anonymous Coward | about 5 months ago | (#47173803)

It has to be a two-pronged approach. The political side is a very necessary piece, but if it is the sole approach then there will still be an immense temptation to spy on the public still because the public's information is ripe for the picking and hey, nobody is watching.... If the technological piece is the sole approach, you can expect the gov't to use its muscle to subvert the technology or outright ban it. The two approaches must work in concert: Slap the gov't on the nose and stop them from taking our data and subverting our technology, but also secure ourselves so that it will be more difficult to get meaningful information covertly and reduce the gains from doing so.

Re:Fixing a social problem with technical means? (1)

mlts (1038732) | about 5 months ago | (#47174053)

Another issue is that some protocols are viewed negatively. Tor comes to mind, because it is anonymous and works well... but it becomes a source of abuse, and it is also associated with the Four Horsemen of the Infocalypse. If one could get mainstream users not just using Tor, but setting up usable exit nodes, it might change the perception.

Re:Fixing a social problem with technical means? (1)

Shatrat (855151) | about 5 months ago | (#47174139)

Historically, technical means are a valid way to help fix social problems. Would we have ended slavery as quickly without the cotton gin?

Re:Fixing a social problem with technical means? (2)

mooingyak (720677) | about 5 months ago | (#47174411)

Historically, technical means are a valid way to help fix social problems. Would we have ended slavery as quickly without the cotton gin?

Isn't that backwards?

quoting from first link from "cotton gin effect on slavery" [teachinghistory.org]

The cotton gin freed slaves from the arthritic labor of separating seeds from the lint by hand. At the same time, the dramatically lowered cost of producing cotton fiber, the corresponding increase in the amount of cotton fabric demanded by textile mills, and the increasing prevalence of large-scale plantation agriculture resulted in a dramatic increase in the demand for more slaves to work those plantations. Overall, the slave population in the South grew from 700,000 before Whitney’s patent to more than three million in 1850—striking evidence of the changing Southern economy and its growing dependence on the slave system to keep the economy running.

Re:Fixing a social problem with technical means? (2)

Shatrat (855151) | about 4 months ago | (#47174845)

Well shit, I guess maybe we shouldn't encrypt our emails after all.

Re:Fixing a social problem with technical means? (0)

Anonymous Coward | about 5 months ago | (#47174233)

Its not going to matter the NSA and other agencies are using supercomputers, and black list hackers to find ways around it. If that doesn't work they will blackmail any company to give up the keys, or they will be shut down su(facing charges of harboring terrorism). Add to that all the rumors of software companies adding back doors, customizing software specifically for surveillance, Google, Apple AT&T, Concast ect being the right hand of the US spying network and I do not see how anything can be expected to be 'secure' from prying eyes.

As far as Apple and law enforcement claiming they couldn't access their phones to obtain a 'suspects' data, I am of the gray area, I can't help but think it was nothing more then PR to get people to buy their phones making people think they were secure.

People of this country are of the thought 'well if your not doing anything wrong or illegal then you have nothing to hide'! And I've said this before this whole spying game has been going in this country for a very long time and no one bothered to flip out when it was revealed, now all the sudden they've gone to far? No one knows the extent of previous domestic spying simply because records went missing, or they are locked up still listed as classified.

Re:Fixing a social problem with technical means? (1)

jbn-o (555068) | about 4 months ago | (#47176695)

It's not enough, true, but we need to get Americans trained in the practice of being more politically active and to seriously consider the consequences of their consumerism. Today, encouraging people to think of encryption as required for increased secure communications is good. We can't fix anything "once and for all" because any change to anything can be reverted (hence Andrew Jackson's warning "...eternal vigilance by the people is the price of liberty, and that you must pay the price if you wish to secure the blessing" applies here too). Software proprietors and others who want to rob computer users of their freedom spend billions training people to think ephemerally (in fact, /.'s chosen "firehose" structure of fast and frequent updates usually from corporate repeaters exists to further that end). We need ordinary people to become more aware of the consequences of ignorance, make better choices, and train future generations that the acceptable social norm is lifelong political involvement. I think failing to meet this need is one of Snowden's fears ("The greatest fear that I have regarding the outcome for America of these disclosures is that nothing will change... [policymic.com] "), and why Stallman says things like "I don't want any fans I want Freedom Fighters, who could actually help in his revolution [blogspot.nl] ". I have no doubt that whomever follows that murderous war criminal Obama in the US White House will follow the same behavior he both chose to follow from George W. Bush and ramp up. I'm not certain what will stop the horrors of "Terror Tuesday" killings, indiscriminate NSA spying, and more, but I won't object when groups want to raise awareness and help normalize objecting to the loss of our civil liberties.

pointless (4, Insightful)

Charliemopps (1157495) | about 5 months ago | (#47173599)

This is pointless. The 5 people that do this will be protected when they communicate with one another. That's it.

Lets be clear. I don't care if Google or Facebook are spying on me (well, I do, but that's an entirely different topic.) The NSA is definitely the "worst" despite what this says. I'm even less concerned about foreign governments or criminals spying on me. The real danger is to our entire way of life. What the NSA is doing could be used to turn us into a true totalitarian state... very easily. What China, or some script kiddy, or even what Google can do with this information pales in comparison to the atrocities the federal government could commit with this power. The only thing restraining them at this time is their own will not to do so. That is NOT acceptable in my opinion. How long before we elect the next Nixon? or Stalin? It will happen, it always does. What will they do with this power?

Re:pointless (2)

Joe Gillian (3683399) | about 5 months ago | (#47173815)

It's also pointless because the NSA doesn't care about reading emails - they have no need to. Even with encryption, they can read the headers on the email and the sender/receiver email addresses and link those with real people. They can see who you're communicating with and how often you do so. If they really want to know what you're saying, they have a myriad of options at their disposal:

- Call the FBI (or other nationwide law enforcement agency for those not in the US) and have them raid you and everyone you talk to, either allowing them to obtain the private keys off your PC or by jailing you indefinitely for contempt of court for refusing to hand the keys over.

- Send out NSLs and obtain pen register orders against everyone you talk to, allowing them to read the already-decrypted messages.

- Use any one of their stash of zero-days and backdoors to install a pen register on your computer.

No amount of encryption is going to stop an agency that can send a small army of thugs to your door for any reason or no reason at all.

paper shipped through the world's postal systems (0)

Anonymous Coward | about 5 months ago | (#47173635)

"Nowadays, that means nearly everything besides face-to-face communication, or paper shipped through the world's postal systems" -- so we trust that mail sent via the post office is NOT being intercepted? Wow and we used to think that about our phone records and emails too!

Re:paper shipped through the world's postal system (0)

Anonymous Coward | about 5 months ago | (#47173801)

It's not that postal mail cannot be intercepted at all. But unlike electronic communications, it is extremely expensive to systematically capture and record every single letter that goes through the postal system. So it's a reasonably safe assumption that most letters are not opened.

Re:paper shipped through the world's postal system (1)

NotInHere (3654617) | about 5 months ago | (#47173849)

If you have the time and money you use transistors and cables to build your own macro-sized AES encrypting typewriter. You can check all parts yourself. You can send the result per mail, or even scan it and send it to the recipient with E-Mail.

The large corporations could employ secretaries that all day do nothing else than handle these machines. Their communications would be perfectly secure! This will kill unemployment!

To encrypt or not? (0)

Anonymous Coward | about 5 months ago | (#47173745)

So, you encrypt, and they don't feel you are a threat, they just start ignoring some traffic. If you don't, and constantly say things that trigger a responce on their part, now you generate traffic for them that they can't choose to ignore. I say we don't encrypt, and add bomb, jihad, and other trigger words they may "love" to everything and just flood them with more traffic than they can ever process. We did it to the germans in WWII, just flooded them with so much bullshit it killed their intelligence gathering network.

Re:To encrypt or not? (-1)

Anonymous Coward | about 5 months ago | (#47173797)

The difference between now and WWII: in the meantime we have invented certain machines that are highly optimized to filter data... damn how are they called? ... Oh yes: Computers!

I bet the chip in your japanese toilet can filter all your digital voice recognized communications for one year in the time you need for one poo.

It only works if every *else* uses it (1)

msobkow (48369) | about 5 months ago | (#47173959)

The problem with public key encrypted email is that your keys only work for encrypting email you receive, not the email you send. In order for an email to be private, the receiver has to set up encryption.

While I'm sure I could set up encryption for my email quite easily, I can assure you most of my friends and family have no interest in going to the effort.

In addition to that, encryption only encrypts the body of the message. The to/from addresses, header line, and other tags are sent in plain text, regardless of whether you "encrypt" your email. And the NSA, et. al. claim they're only interested in that header information in the first place to identify who your contacts are, not what you're saying to them.

So encrypt away -- they're still getting the info they want from your email headers.

Re:It only works if every *else* uses it (1)

AHuxley (892839) | about 4 months ago | (#47176609)

Depends on what you feel like doing. Encryption can be fun just to add to the huge mix of everything the gov is keeping and knowing your repeated use of encryption will be noted.
You could contact the media about past political stories in your state and retype the names, court events, keywords and offer the press support, scans of related paper or not digital work from the past.
Take up photography.
Always have a fully charged video camera (none of that 10/20 min limit hardware) at hand for the expected 'chat down'.
Is it one person, two people at your door, are they using a federal task force email/seal to make their state wide work seem federal?

Great article wrong on paper mail being safe (4, Informative)

sasparillascott (1267058) | about 5 months ago | (#47174033)

Great article but this part isn't correct:

"Nowadays, that means nearly everything besides face-to-face communication, or paper shipped through the world's postal systems."

As shown here - every single piece of 1st class mail in the U.S. is photographed (and probably handed over to the FBI or NSA or whomever started this stupid program up in the first place to get the Post Office to do that):

http://www.nytimes.com/2013/07... [nytimes.com]

Short of radical political reform, which seems a long shot in the U.S. in the near term - technical solutions coming from open software will be the few ways we can restore some privacy to communications.

Who to trust? (0)

Anonymous Coward | about 5 months ago | (#47174303)

Did it occur to anyone that perhaps the NSA is behind this particular initiative? Gee golly, now I downloaded a new encryption scheme from people I've never met who PROMISE it hasn't been compromised...

Think about the bully in the room (0)

Anonymous Coward | about 4 months ago | (#47175025)

If the US Government really wants to read your mail they will go to the source, if they haven't already, and pressure them into giving them a back door into all encryption OR they will take you to court and sue you out of business with your own tax money.

prove it (1)

kwoff (516741) | about 4 months ago | (#47175391)

the NSA is certainly not the first, and arguably far from the worst

What's this argument? First of all, prove that you're not from the NSA.

arguably far from the worst!!!???? (1)

zedaroca (3630525) | about 4 months ago | (#47175643)

What other country is ACTUALLY KILLING THOUSANDS OF FOREIGN PEOPLE based on oil interests and using it's spying network to determine the targets???? What other country is fighting against democracy in Latin America and Europe (by making coups like the recent one in Paraguay and subverting justice like in Sweden)? What evil could Chinese spying do to an American citizen? I'm not talking about stealing trade secrets, I'm talking about real harm. Will an American be detained indefinitely without accusation due to Chinese spying? No. Just American spying do real harm to both Americans and foreigners.

Mozilla Foundation's disappointing lack of action (0)

Anonymous Coward | about 4 months ago | (#47175959)

To be effective, end to end email encryption needs to be view as something more than just "a bonus for more sophisticated users" like the EFF is treating it. As long as only the sender or receiver is sophisticated enough to use email encryption, the option becomes worthless. Encryption only can be used when it becomes easy enough that both sender and receiver choose to use it.

Take the Thunderbird email client for example, at first start the program provides a setup wizard to take you through the items that are critical in using the program. As part of that, they even partner with companies like gandi.net to help you create a new email account if you don't already have one. But at no point do they partner with a Certificate Authority to encourage you to get a personal certificate for S/MIME configuration. Mozilla Foundation seems to never consider it a critical step. While they provide a knowledge base article of S/MIME Certificate providers (including free ones such as StartCom [startcom.org] , Comodo [instantssl.com] , and secorio [secorio.com] ), this article is not kept up to date and none of the information is provided directly in Thunderbird itself. And the email account provider that the Mozilla Foundation has partnered with (gandi.net) does not even provide S/MIME personal certificates as an option even as a payed option despite also being a certificate authority.

If the attitude of email client software developers was that IMAP over SSL and SMTP over SSL should be provided as a third-party add-on "for more sophisticated users" then we would be in even worse shape today. Fortunately, these are considered options that should be easily access-able to everyone. We need to change how we think about presenting end to end email encryption to notices and start treating it as a critical offering instead of a secondary/side option.

Already good programs (0)

Anonymous Coward | about 4 months ago | (#47176471)

There are several good programs out there already to secure your communications. There are several programs here that are easily set up that use gpg.
http://wjlanders.users.sourceforge.net/
Keys are automatically generated for you. Some of the programs use mixmaster remailers.

mail not secure either actually (1)

strstr (539330) | about 4 months ago | (#47177235)

Every letter is scanned and inspected and information saved about mail. To and from.

And NSA whistleblower Russell Tice was talking about there being a light wave technology that allows letters to be read in an automated fashion which my guess is some type of tera hertz wave scanner.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?