Linux Advocate Dietrich Schmitz shows how the general public can take action to truly protect their privacy using GnuPG with Evolution email. Read the details.
Linux Advocate Dietrich Schmitz reminds CIOs that XP Desktops destined for MS end of life support can be reprovisioned with FOSS Linux to run like brand new. Read how.
Linux Advocate Dietrich Schmitz reminds readers of a long ago failed petition by Mathematician Prof. Donald Knuth for stopping issuance of Software Patents.
Showing posts with label National Security Agency. Show all posts
Showing posts with label National Security Agency. Show all posts
RetroShare shown running on my Fedora 20 LXDE Desktop
Maybe you feel defeated? You have that sense of helplessness?
Yout think, "Don't fight it. We can't win against them. There is no privacy on the Internet."
Give up?
No. Don't give up. Fight back. There is an easy tool, now, today, at your disposal, which as far as I am concerned is not difficult to install and immediately use that will assure 100% privacy on the Internet.
What tool? It's shown above running on my desktop. It's called RetroShare.
You see, the NSA is perfectly happy you use Google's tools, including Drive, Gmail. They are clear text and there's no difficutly in their getting to that repository if they choose to do so.
On the other hand, the NSA is not happy about tools like RetroShare. So much so, in fact, they cannot invade your privacy space on Retroshare. They cannot penetrate the encryption. Enjoy privacy on your own terms with RetroShare.
RetroShare is a mature product in continual refinement since 2006. The feature set is robust. To learn more, check out their wiki, FAQ, and screenshots.
So, go ahead and try RetroShare. If you get on-line, give me a shout. I'm here.
RetroShare is open source and free. Download here.
Regular readers will know that I have taken issue with Google since last year on how they manage Gmail and Drive. For starters, should any governmental agency manage to break through Google's firewall (oops, the NSA did and pitched camp last year), they will have unfettered access to your meta data and direct access to your Gmail and Drive files. (Image right: Google's End-to-End Logo) Why? Because they are stored in clear text (unencrypted) format. That's odd. Google Cloud does just the opposite. Hmmm. I Wonder why. (Taps fingers.....) That's because Google Cloud is for the 'paying customers' who INSIST that their data meet critical mandated security thresholds (FIPS). So, Google Cloud customers, in the interest of keeping them from leaving altogether, are being assured, by Google, their data is FIPS-compliant and cannot be viewed by third-parties. How nice of them. When it was determined last year that the Fox is in the Hen House, many corporations left en masse U.S. domestic cloud ISPs for Western- and Eastern-Europe ISPs to avoid the NSA. This concern is quite understandable on many levels and still nothing has been done to impede, much less stop the NSA from continuing their global eavesdropping. Gmail and Drive are considered part of Google's consumer-facing services which are, at present, offered for free. Most everyone using Gmail likes the fact that they get it for free, but, were they to make the effort to read their 'Terms of Service' agreement, would discover that Google reserves the right to parse any and all meta and personal clear text data belonging to the respective account holder. Principally, the main thrust of this stipulation is so that Google can use intelligent advertisements positioned in the account holder's Gmail gutter margins that reflect subjects which might be of potential interest to said account holder by virtue of the parsing logic applied to their data stream. Very nice, yes? No!!!!!!!!!!!! This is fundamentally wrong. Users may be stuck with the current terms of service for getting their free Gmail and Drive, but, do they have a recourse? Certainly, one option would be to drop using Gmail and Drive entirely in favor of some other solution. Another solution is being provided by Google who have been under great public pressure to do something to protect account holders' right to privacy. The solution is being named End-to-End in an announcement posted on Google's website. It's not even available yet and coding for the solution is being worked on and tested before it will ever reach production release to the general public. While that may sound good, a cursory inspection of the Google Code website reveals a few issues which I feel make this solution unacceptable from the start. 1) Google is only offering 'the solution' as a Google Chrome browser extension. Many use Chrome. I don't because it is 'proprietary'. That means it is not 100% open source and so violates one of the cornerstones of FOSS: Transparency. We cannot and do not know what is or isn't in proprietary code and because of that, potential rogue code and abuses can be introduced without the general public's knowledge and/or approval. That is what Transparency is all about. So, Google wants you to have 'their' solution on 'their' terms, stipulating the use of 'their' browser which in and of itself has volumes of code nobody can claim to know or understand. 2) As if #1 wasn't bad enough, Google has chosen to 'reinvent the wheel'. Namely, the long-standing, mature, fully-debugged gpg2 open source OpenPGP standard codebase is being rejected out of hand, again because they want to do things 'their' way by creating a duplicate, immature, bug-laden codebase port of gpg2 as an incomplete subset into slow, interpretive Javascript. That's right. Javascript. gpg2 is fully compiled C/C++ code. 3) Google chooses to adopt a new Eliptical Curve cryptographic standard over the proven mature RSA standard. Recall that NIST is now in a public relations dilemma having been exposed as consorting with the NSA in introducing 'weakened' cryptographic string constants into their ECC codebase last year. In discovering the problem with ECC, the NIST insist they had no part or knowledge of the NSA's intentional introduction of weakened code and put the code out for public review and follow up action to correct any seen defects based on public comment. That leaves a 'cloud' in my mind over any software dependent on EC. In terms of severity, in comparison to items 1 and 2, a thorough audit of EC might restore confidence and make item 3 less an issue in the long-term. But fundamentally, Google's developers, it would appear, are taking shortcuts and making fundamental flawed decisions by forcing a solution which requires proprietary Chrome (Transparency violation) and creating their own immature crypto codebase to 'emulate' a subset of gpg2 OpenPGP features. EC will only be compatible with version 2.1 of gpg2. I am giving this project a 'thumbs down'. Unacceptable. Back to the drawing board Google. -- Dietrich
English: from http://logo-contest.gnupg.org/subm-6.html, copyright info see http://gnupg.org/misc/logo-contest.en.html (Photo credit: Wikipedia)
by Dietrich Schmitz
Folks, I've been on a privacy jag for over a year now since whistle blowerEdward Snowden broke the story of how the NSA monitor everybody's electronic communications (PRISM).
It is understandable that many have been reluctant to start using email encryption. But there is no risk and if done with strong encryption such as free open source Gnu Privacy Guard (GPG), you can be assured that only your intended recipient will be able to open and read your mail.
So, with that, today I am bringing to your attention a youtube video put up by none other than Edward Snowden himself wherein he provides a step-by-step tutorial of how to encrypt your email with a Windows version of GPG encryption, called GPG4Win.
So, even if you aren't a Windows user per se, you can watch to get a feel for the steps required to set up your public/private key pair and publishing to a key server and how to import a public key from one of your email contacts who has set up encrypted email also.
I use Fedora 20 LXDE with Evolution and GPG. Once you've created the keys, you don't have to repeat the same process. It is a 'one-time' affair and then creating and sending email is done with the existing GPG keys in place.
It's not hard after you've done it a few times. Trust me. It will make sense.
Here's Edward Snowden's youtube tutorial. Enjoy! -- Dietrich
That's a screen shot (below) of the BitBucket repository for commits to ongoing development of dwb (dynamic web browser).
Oh, that's nice. What's my point?
dwb is 100% pure Gnu Public Licensed code. That means, you, anyone, developers, users, the world, can see it, change it, for free. That has always been the basis for GPLv2 and the primary reason for why I opt to use dwb. Want to know what's going on with their code? Help yourself -- look around. Only, don't forget to turn the lights out when you leave. ;)
dwb (dynamic web browser) BitBucket repository commits page
You don't get that with Google's Chrome. Nope. Sorry. They won't let you see their code base. Of course, they are within their legal rights to do so, but, that doesn't mean I have to use their browser if I cannot know what it is doing, do I?
Ask yourself this question: Notice lately how Google Plus will periodically 'freeze' with the cpu utilization at 100%?
What are they doing exactly? (Shrugs)
That's Chrome doing whatever it does. :/ Whatever has a big question mark hanging over it for me. My confidence in Google to 'Do No Evil' has fallen dramatically in the past 9 months since the Edward SnowdenNSA Prism and other revelations.
You see, 'proprietary code' (not open source) often leads to some level of exploitation for commercial or 'other' purposes. Because Chrome is 'closed source', we cannot know for certain 'if' Google cooperates in some capacity with governmental information collection and sharing. That's because there is no public access for review of their code base, unlike dwb.
Taking the overt step to use dwb is my personal choice. Yours may be different, but, if you truly believe in the power we (Humanity) hold over the "n'er-do-wells" of the world by embracing Open Source, then I urge you to make it your policy to not use proprietary software. Take a stand and fight back. Set an example for others to follow and use open source applications only such as dwb, Mozilla Firefox, for the sake of security through transparency.
It's all out in the open now. The NSA can 'cherry pick' your private and personal Internet meta data whenever they wish. Right?
Wrong. They cannot.
That is, of course, provided you, the general public, place obstacles in their way which will impede, or, better yet, stop them entirely from peering into your private affairs.
Yes, that's right. You have tools at your disposal which will most assuredly put the kibosh on the NSA. Stop them cold in their tracks. They'll come, discover they can't see anything, and leave.
What is it that will stop them from seeing your private data?:
I recommend to Linux users free Gnu Public Licensed Evolution email for both personal and business needs. (Image left, Edward Snowden, credit: Flickr user DonkeyHotey)
Evolution email running on my Fedora 20 LXDE Desktop
Evolution is feature-complete, mature (that means stable), and supports GnuPG (OpenPGP) encryption formatted email.
Use it once or twice and I am confident you'll get the hang of it. It will even use your existing Gmail or other email account with secure TLS POP3/IMAP connectivity.
And, for those eager to install Evolution, here is a good tutorial to get you up to speed quickly.
Need to wrap your mind around GPG? Read more about it here.
Just to give you a visual of what an Evolution created gpg-encrypted gmail looks like 'after the fact' from Gmail's web view -- there's truly nothing to see -- this is what the Google staff and NSA would find:
Evolution GPG-protected email stored on Gmail. Nothing to see.
And, as always, if you have questions or need help, do not hesitate to contact me.
So, NSA? Please turn off the lights when you leave. Nothing to see here. Thanks!
Watch the below video to help you to configure and use Mailvelope.
I am endorsing Mailvelope as the 'easiest' software, 'to date', and can assure you that if you create your PGP with a minimum of 2048-bit key length, the NSA will never be able to read your email. NEVER.
Please take control of your email privacy with Mailvelope.
Questions, concerns, do not hesitate to contact me.
Okay so Google are pushing today for changes to be made to Internet request for access to their data infrastructure by third party entities, namely, our Government. I think this is the wrong way to go about it, and I won't sign their petition (below). (Image credit: zeroknowledgeprivacy.org) If Google can encrypt their 'Google Cloud' product, then they should apply the same standard for the general consumer (public) of their Gmail/Drive services. If software vendors like SpiderOak, Wuala, and now Microsoft and Yahoo can muster the requisite technology to facilitate encrypting all of consumers' private data, there is no excuse for Google not following suit. Do the right thing Google. ENCRYPT GMAIL/DRIVE with Zero Knowledge Encryption technology. -- Dietrich
Theatrics. That's all it is. We see blustering, cries of 'outrage' by Eric Schmidt in a public reaction of 'surprise' to the fact that the NSA penetrated their firewall and set up camp reading any and all of their 'clear text' data files with impunity. This same company, prides itself on selling Chromebooks with an unblemished record at Pwnium 2013 of no successful hack which resulted in fully owning the ChromeOS operating system. How is it that so much effort can be put forth to develop ChromiumOS with a sincere intent to make security a prime order of concern yet Google'sdata centers store data in clear text? This isn't being discussed in any of the media stories. The real 'top dog' priority for Google is advertising revenue. And, they know full well that if they encrypted the public's data they could no longer parse it to exploit, mine, for advertising purposes and that would put a major choke hold on a part of their revenue stream they so cherish. The public's trust, good faith, and right to privacy takes a 'back seat' to Google's penchant for profit. Google is colliding directly with 'Do No Evil' as they continue to change their ways with a clear intent to take major portions of their technology base proprietary. That is the bottom line and there is no clear indication from them policy-wise, one way or another, as to what they plan to do at this point, if at all, other than public 'feel good' talk and expletives from Google Engineers seen in today's news. Google. You've been owned real bad and at the Public's expense. It's time for you to fix your F'ing security. I think you just might have screwed the pooch this time. -- Dietrich
Another revelation has been made that the NSA have been camping out on the inside of the Google cloud firewall, cherry picking data -- yours -- like taking candy from a baby -- the method for how the NSA exploit to break through the front-end SSL server is documented in slides like the one shown above.
Sadly, the data fest has been going on for quite some time and Google and Yahoo officially disclaim any knowledge that such activities have been occurring.
It's too bad because the entire cloud behind the firewall has been 'clear text' as shown in the above slide, which means your data isn't encrypted and directly human readable.
Why hasn't Google taken steps to protect your Drive data with encryption?
The truth of the matter is: MONEY
Advertising revenue is obtained by parsing your documents and positioning adverts in the gutter margins as users of Google services like Drive and Gmail go about their daily business. If Google were to encrypt your data, then they could not read it and run adverts any more.
It is outrageous that Google chose not to take action because of this and I would suspect the same pertains for Yahoo.
This is a major error of negligence and abrogation of responsibility on the part of Google to protect the public's right to privacy.
The technology has been available right along which is now routinely used by other cloud services like SpiderOak, Wuala, and Kim Dot Com'sMega to encrypt the entire data stream of data space in the cloud. It's not difficult to implement and even SpiderOak have now offered their own software framework, Crypton.io, for Developers to implement Zero-Knowledge Encryption (ZKE) at any Cloud ISP.
This is no longer an option. ZKE should be considered a mandate and, as such, consumers and businesses should insist upon having it or boycott using the respective Cloud ISP's services. If we all insist on it, we will have power in numbers and can have an effect on the outcome hopefully in a positive way.
The benefit to the user of rented Cloud data space employing ZKE is that all data stored in the Cloud is first encrypted locally (in the memory space of the user's PC) and a private key is maintained locally by the user not physically present on the Cloud data drive. This makes the data on the Cloud transparent and as such the ISP will have Zero Knowledge of what is being stored other than an encrypted byte stream written to a block level drive.
With ZKE for a third party to request access would then require their serving the owner of said data with a warrant before viewing the personal and privately protected information. Good citizens presented with a warrant will comply and unlock their data if the warrant is justified by a Court Judge as having 'probable cause' for issuance. That has always been historically the case up to 9/11 but with the Patriot Act, the erosion of the U.S. Constitution was begun.
Today, some twelve years hence, the degree to which the law has been disregarded is allowing unobstructed intrusion into all corners of our private electronic communications.
I am drawing the line here. Google must take steps immediately to adopt ZKE for all of their media storage used by consumers and businesses or I will no longer support and use any of their services whatsoever.
They have two weeks to come up with a clear public plan to protect the public's data from unwarranted access or I will end it. Boycott Google Cloud services if they fail to act.
[Edit: Some raised concern about sharing their F2F key via regular email. To use a 'darknet' method, try either cryptocat.bin or cryptocat.org]
It's all starting to make sense now. We've heard rumors that this National Security Agency was snooping around in our private affairs.
Turns out, it's been going on for longer than we think, like, since 1952? That's the latest.
So much for the book 1984. Should have been 1952. Okay so what if George Orwell was off by about 32 years. Still, it's amazing how he pegged the future with such eery accuracy.
Okay great so, now what do we do given that our every move is being examined like getting a colonoscopy?
You should now not worry what people think if you take extra precautions with your privacy, particularly on the Interwebs. That's right. Let them call you paranoid and then throw one of these stories in their face and say with confidence: YES, I AM PARANOID AND I AM FINE WITH THAT!
So seriously, is there anything that can be done on the Interwebs without having it owned and/or seen by someone these days?
Actually, I am glad you asked the question. It just so happens there is.
An interesting piece of software has been in development going on several years now, called RetroShare. Errrm okay, sooooo.
So let's check it out.
RetroShare
What is RetroShare?
RetroShare is the next generation sharing network, which provides:
Reliable Identification and Authentication of your friends.
Plus an Introduction Scheme which connects you to the friends of your friends, and facilitates network growth.
Encrypted Communication, ensuring all shared information is known only to you and your peers.
A Communication Platform which can potentially support services such as Secure Email, File Sharing, Streaming, Video or Voice over IP, Photos, Wall and Messaging
A Decentralised Social Sharing Network designed **For the People** with no dependancies on any corporate system or central servers.
You see, this is a 2048-bit RSA-encrypted SSL tunnel through which your activity travels but every node along the P2P network is on its own 'private' channel. In other words, there may be thousands of users using RetroShare but you only see those 'Friends' with whom you explicitly take the step of sharing your private F2F key.
Setting up RetroShare is easy. Once installed, you send an email to your Friend(s) with a copy of the F2F key. Then, they do the same, by installing RetroShare and sending you their F2F key.
The result? Log into RetroShare and immediately you'll see your Friend on the private chat, and if you choose you can also share file folders with them and also emails.
Probably one of the most interesting aspects of RetroShare aside from being P2P is that email is a totally closed loop--just between you and strictly your Friends. For an email to reach you, the sender must possess a copy of your F2F key and you must have their F2F key.
It completely eliminates spam. And provided that you are only friending people with whom you are personally familiar, there's no loss of privacy whatsoever, in terms of your private activities.
Aside from eliminating spam, it's going to be really hard for any kind of eavesdropping on this system because of the SSL tunnel and 2048-bit length RSA encryption key cipher strength. How hard? Reheheheheheheheheheheheheheheheheheheheheheeeeeally hard. Here is an example of how hard:
I fully expect to see comments stream in with assurances that this key is crackable. No one has been able to substantiate such claims to me. But please, bring it.
So Folks, this is really is a nice implementation and I seriously recommend you try it. Now that cat has been let out of the bag that 'big brother' truly IS watching (like we didn't know pfffft chaahhh), go get your copy of RetroShare and let your paranoid Friends know about it too.
We can all live in a state of paranoia together, you know, as the paranoid circle of Friends on RetroShare. ;)
