Linux Advocate Dietrich Schmitz shows how the general public can take action to truly protect their privacy using GnuPG with Evolution email. Read the details.
Linux Advocate Dietrich Schmitz reminds CIOs that XP Desktops destined for MS end of life support can be reprovisioned with FOSS Linux to run like brand new. Read how.
Linux Advocate Dietrich Schmitz reminds readers of a long ago failed petition by Mathematician Prof. Donald Knuth for stopping issuance of Software Patents.
RetroShare shown running on my Fedora 20 LXDE Desktop
Maybe you feel defeated? You have that sense of helplessness?
Yout think, "Don't fight it. We can't win against them. There is no privacy on the Internet."
Give up?
No. Don't give up. Fight back. There is an easy tool, now, today, at your disposal, which as far as I am concerned is not difficult to install and immediately use that will assure 100% privacy on the Internet.
What tool? It's shown above running on my desktop. It's called RetroShare.
You see, the NSA is perfectly happy you use Google's tools, including Drive, Gmail. They are clear text and there's no difficutly in their getting to that repository if they choose to do so.
On the other hand, the NSA is not happy about tools like RetroShare. So much so, in fact, they cannot invade your privacy space on Retroshare. They cannot penetrate the encryption. Enjoy privacy on your own terms with RetroShare.
RetroShare is a mature product in continual refinement since 2006. The feature set is robust. To learn more, check out their wiki, FAQ, and screenshots.
So, go ahead and try RetroShare. If you get on-line, give me a shout. I'm here.
RetroShare is open source and free. Download here.
[Edit: Some raised concern about sharing their F2F key via regular email. To use a 'darknet' method, try either cryptocat.bin or cryptocat.org]
It's all starting to make sense now. We've heard rumors that this National Security Agency was snooping around in our private affairs.
Turns out, it's been going on for longer than we think, like, since 1952? That's the latest.
So much for the book 1984. Should have been 1952. Okay so what if George Orwell was off by about 32 years. Still, it's amazing how he pegged the future with such eery accuracy.
Okay great so, now what do we do given that our every move is being examined like getting a colonoscopy?
You should now not worry what people think if you take extra precautions with your privacy, particularly on the Interwebs. That's right. Let them call you paranoid and then throw one of these stories in their face and say with confidence: YES, I AM PARANOID AND I AM FINE WITH THAT!
So seriously, is there anything that can be done on the Interwebs without having it owned and/or seen by someone these days?
Actually, I am glad you asked the question. It just so happens there is.
An interesting piece of software has been in development going on several years now, called RetroShare. Errrm okay, sooooo.
So let's check it out.
RetroShare
What is RetroShare?
RetroShare is the next generation sharing network, which provides:
Reliable Identification and Authentication of your friends.
Plus an Introduction Scheme which connects you to the friends of your friends, and facilitates network growth.
Encrypted Communication, ensuring all shared information is known only to you and your peers.
A Communication Platform which can potentially support services such as Secure Email, File Sharing, Streaming, Video or Voice over IP, Photos, Wall and Messaging
A Decentralised Social Sharing Network designed **For the People** with no dependancies on any corporate system or central servers.
You see, this is a 2048-bit RSA-encrypted SSL tunnel through which your activity travels but every node along the P2P network is on its own 'private' channel. In other words, there may be thousands of users using RetroShare but you only see those 'Friends' with whom you explicitly take the step of sharing your private F2F key.
Setting up RetroShare is easy. Once installed, you send an email to your Friend(s) with a copy of the F2F key. Then, they do the same, by installing RetroShare and sending you their F2F key.
The result? Log into RetroShare and immediately you'll see your Friend on the private chat, and if you choose you can also share file folders with them and also emails.
Probably one of the most interesting aspects of RetroShare aside from being P2P is that email is a totally closed loop--just between you and strictly your Friends. For an email to reach you, the sender must possess a copy of your F2F key and you must have their F2F key.
It completely eliminates spam. And provided that you are only friending people with whom you are personally familiar, there's no loss of privacy whatsoever, in terms of your private activities.
Aside from eliminating spam, it's going to be really hard for any kind of eavesdropping on this system because of the SSL tunnel and 2048-bit length RSA encryption key cipher strength. How hard? Reheheheheheheheheheheheheheheheheheheheheheeeeeally hard. Here is an example of how hard:
I fully expect to see comments stream in with assurances that this key is crackable. No one has been able to substantiate such claims to me. But please, bring it.
So Folks, this is really is a nice implementation and I seriously recommend you try it. Now that cat has been let out of the bag that 'big brother' truly IS watching (like we didn't know pfffft chaahhh), go get your copy of RetroShare and let your paranoid Friends know about it too.
We can all live in a state of paranoia together, you know, as the paranoid circle of Friends on RetroShare. ;)
In my last story, Is OpenSSL's Cryptography Broken?, I reported the ongoing developments surrounding a suspect security problem with the implementation of openssl. The story, unfortunately, continues to unfold with suspicion now turning to confirmation in a NY Times report that the NSA inserted altered random number generator code into the Dual Eliptic Curve Deterministic Random Bit Generator so as to predict private key encoding and provide a 'backdoor' entry point mechanism. (Image credit: fearlessmen.com) Despite strong denials coming from the National Institute of Standards and Technology (NIST) who oversaw the development of the Eliptic Curve Cryptography (ECC) standard, many now are left having a strong distrust of the agency. From a The Register story NIST publicly responded:
The US National Institute of Standards and Technology (NIST) has vehemently denied accusations that it deliberately weakened encryption standards to help the NSA's monitoring activities.
"We want to assure the IT cybersecurity community that the transparent, public process used to rigorously vet our standards is still in place," said NIST in a statement.
"NIST would not deliberately weaken a cryptographic standard. We will continue in our mission to work with the cryptographic community to create the strongest possible encryption standards for the U.S. government and industry at large."
The statement from NIST said that working with the NSA was 'standard operating procedure' and required by law. In an attempt to throw a 'wet blanket' on the bonfire, NIST has reopened the standard for public comment.
Regardless, one outspoken Developer, Bruce Schnierer, said in a podcast:
NIST took a big credibility hit unfortunately. There are good people there doing good work but we don't know which of their standards are tainted, we don't know how much collaboration there is with the NSA.
And unfortunately because trust is lost when they get up and say the NSA doesn't affect our standards we don't believe them. We need a way to get back trust.
Cryptography standards have all now been put into question in addition to the public relations disaster that confronts NIST.
Whether or not NIST will recover remains to be seen as it is quite likely that all cryptography standards will require rigorous audits.
In the meantime, the prevailing perception is that many cryptographic standards have been compromised and privacy is not assured by virtue of their use on the Internet. As such, it will take a significant amount of time to pragmatically review each standard and thoroughly vet code before a level of confidence in these needed privacy measures will be restored.
And, the question of whether or not trust should be placed in agencies such as NIST is now the main focus and primary concern. Is NIST history? Only time will tell.
Last month, in early August, a colleague Friend of mine, +Scott Doty contacted me. He expressed his concern regarding Red Hat's implementation of OpenSSL.
The issue brought to my attention by Scott concerns a specific bugzilla ticket which was opened in 2007 and has never been addressed.
I offered Scott to reach out to Red Hat's public relations the same day he contacted me. The answer returned the following day was essentially a 'no comment' and that I should refer to the comments section on the ticket -- deemed to be 'self-explanatory'. If you take the time to review the ticket, you'll see where Scott appended his own comments in the August time frame toward the bottom. It's fairly long.
Red Hat had absolutely no intention of fixing the bug, specifically, regarding the treatment of the Elliptic Curve Cryptography implementation in OpenSSL, and according to the comments on the ticket they felt ECC was patent encumbered.
Yet, in other sources on the Internet, one can find reference to a 'work-around' which would avoid any IP infringement issues. Quoting from Wikipedia.org's ECC page:
"...However, according to RSA Laboratories, "in all of these cases, it is the implementation technique that is patented, not the prime or representation, and there are alternative, compatible implementation techniques that are not covered by the patents."[3] Additionally,Daniel J. Bernstein has stated that he is "not aware of" patents that cover the Curve25519 elliptic curve Diffie–Hellman algorithm or its implementation.[4]RFC 6090, published in February 2011, documents ECC techniques, some of which were published so long ago that even if they were patented any such patents for these previously published techniques would now be expired...."
Alright, so it struck Scott as being odd that such a bug was laying around collecting dust, and I agreed.
In the meantime, we have seen a series of news releases with Snowden giving out new information. One of the claims has been that the capability of NSA to penetrate presumed to be secure cryptography standards has become much improved to such an extent that they are now collecting information flowing over SSL with impunity and have broken a few other cryptographic standards, purportedly. I say this only because it's Snowden's word vs. the NSA and the NSA is completely 'mum' on the topic.
The sensational news story "Report: NSA Can Break Internet Encryption"arrived last week and created quite a stir. The title is a carefully crafted wording. Naturally, it is quite an unsettling thought to have all presumed Internet security breached, but the story's author hedged a bit at the end of his story saying:
"...Despite the NSA's ability to crack web encryption with these means, Wired's Kim Zetter notes that "these methods don’t involve cracking the algorithms and the math underlying the encryption, but rather rely upon circumventing and otherwise undermining encryption."
And Snowden himself said during a Q&A with The Guardian in June that cryptography works.
"Properly implemented strong crypto systems are one of the few things that you can rely on," he said...."
Now, the distinction to be made ties into the title of the story -- namely that, provided that an 'implementation' of strong cryptography coded 'properly' with no side-effect bugs cannot be hacked.
Put another way, bug-laden cryptography can result in weakening of the underlying cipher's strength and so can potentially be cracked.
This would seem to suggest that the NSA have found defects in various cryptographic standards, or, by whatever means, have introduced themselves intentionally crafted bugs in such a way to induce such weakening, thereby achieving their end-goal to crack encryption methodologies.
This led me to think more about OpenSSL and that languishing buzilla ticket. Just yesterday, I had an exchange with +Jan Wildeboer to whom I regularly communicate, usually on Google Plus. I broached the matter of the Red Hat OpenSSL bugzilla ECC ticket with him and curiously enough, today, he cc'd me with this Google Plus post (thank you Jan):
A few days ago Bruce Schneier, who has reviewed the leaked Snowden documents, warned against the use of elliptic curve cryptography on the grounds that it requires users to agree on curve parameters and he no longer trusts the parameters to not have back doors. Specifically he's talking about the NIST curves. NIST is a US organisation that was previously widely respected and considered trustworthy.
However, his warning seemed to be based more on general conservatism than any specific intelligence cleaned from the leaked documents. We know the NSA has tried to subvert the standards setting process and we know they may have advanced mathematical attacks that the public doesn't know about. ECC requires various constants to be agreed on globally for an instantiation to be used. Hence, the concern.
But that isn't specific evidence. Unfortunately, today I learned (via Gregory Maxwell) that the process for selecting the "random" curve parameters appears on the surface to be completely implausible. The parameters are the output of SHA1, which should be good if the seed was selected in a reproducible manner. But they were not. The seeds are extremely large constants with no explanations of where they came from. That smells very strongly of something that might be hacked.
It gets better. It turns out that these constants are not only unexplainable but were actually generated by an employee of the NSA. And it turns out that the IEEE working group that worked on standards for ECC was actually holding its meetings on the NSA campus and its membership therefore had to be approved by the NSA as well.
At this point it is fair to assume that the NIST SECG curves should be abandoned for all uses. Bitcoin uses secp256k1 which was not selected in the same way and is more likely to be OK, and besides the NSA is unlikely to care about stealing peoples wallets (we don't use ECC for secrecy, just authenticity). And luckily academics like djb and Tanja Lange have created new variants of ECC independently of the NSA which are technically better anyway. But the upgrade process away from the SEC curves is going to be a pain.
So, that's quite interesting. It would now appear that ECC is borked and quite possibly has been so for quite some time, thanks to the handy-work of the NSA.
The cat is now out of the bag. I am now wondering how many other cryptographic standards need a thorough audit and scrubbing of any questionable code and fixing of languishing bugs?
[Update: I've put up my F2F key on cryptobin.org -- here: https://cryptobin.org/g247b695 -- reach me by email: dietrich shift 2 linuxadvocates dot com to obtain the password. ]
Have you heard of the expression 'talk is cheap'?
With all of the controversy generated by the disclosure of NSA's PRISM surveillance program, you'd think there'd be a groundswell of interest in taking action to mount new privacy legislation.
Not so far. But legislation isn't good enough. What the public needs is an effective countermeasure to ensure that Privacy is maintained.
RetroShare is a true prototypical software application which immediately offers the following benefits:
