Slashdot Log In
Protecting IM From Big Brother
Posted by
Zonk
on Fri Nov 23, 2007 06:29 PM
from the another-mark-in-my-file dept.
from the another-mark-in-my-file dept.
holden writes "Ian Goldberg, leading security researcher, professor at the University of Waterloo, and co-creator of the Off-the-Record Messaging (OTR) protocol recently gave a talk on protecting your IM conversations. He discusses OTR and its importance in today's world of warrant-less wire tapping. OTR users benefit from being able to have truly private conversations over IM by using encryption to obtain authentication, deniability, and perfect forward secrecy, while working within their existing IM infrastructure. With the recent NSA wiretapping activities and increasing Big Brother presence, security and OTR are increasingly important. An avi of the talk is available by http as well as by bittorrent and a bunch of other formats."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Encryption (Score:5, Insightful)
Sure, it eats resources, but do you want others reading your information? I dont. Not even when its "we are out of milk, please pick some up on the way home", as its NONE OF THEIR BUSINESS.
Re:Encryption (Score:4, Informative)
It's a fantastic product, I just wish it was multi-platform... Really nice for Windows though...
Parent
Re: (Score:2)
Re: (Score:2, Interesting)
I regularly use OTR in Pidgin with MSN and Jabber (Gmail chat) and have never had a problem. Adium X on the Mac also includes OTR support out of the box.
I try to use OTR as much as possible, all of the time. I figure if I only protect the stuff that needs to be secret, it sticks out like a sore thumb. And the more encrypted traffic on the internet in general, the harder it is for them to break it all even if they do have magic quantum computers.
Trying to get more people to use PGP/GPG with me over emai
Software freedom gets you software you can trust. (Score:3, Insightful)
Re:Software freedom gets you software you can trus (Score:2)
Re: (Score:2, Funny)
Re: (Score:2, Interesting)
Re: (Score:2)
And I do agree i have to trust the person at the other end not to divulge/record/forge that i need to get milk.
Re:Encryption (Score:5, Informative)
That means that when you're having a chat with someone, you know that what they're saying to you is their actual words, but that the same cryptography that's giving you privacy can't (theoretically) be used to hang you later, by proving absolutely that you said certain things.
OTR's logs are designed to be easily forgeable. This is a major difference in its design from many corporate IM clients (e.g. Sametime), which offer encryption but also create authoritative logs that can be referred back to later.
The point of OTR Messaging is to allow you to have the equivalent of a face-to-face, "off the record" conversation, in the digital, computer-mediated world. Just like when you have an in-person conversation, there's nothing stopping the other person from walking back to their car and blabbing about the whole thing to anyone who'll listen, the encryption itself tries to not serve as authentication after the fact as to what was said.
Parent
Re:Encryption (Score:5, Insightful)
When the log is presented in court the person who logged it will be asked "is this log an accurate representation of the conversation you had with the accused?" and they say "yes, it is" and the defense then has to show not that it is possible that the log was doctored but that person who has just sworn, under penalty of perjury, is lying. They typically do this by showing instances in the past where the person has submitted false evidence to a court, or they can try to show that the person has something to gain by changing the log and that they had the skills (if any special skills are required, which they wouldn't be). It would be a very tough sell and a jury is more likely to believe that the log is accurate because what kind of idiot would lie in court when the punishment is so severe.
Consider that email is so trivial to fake and yet emails are considered official correspondence in many many many court cases. It's not about the technology, it's about the people making the claims.
Parent
Re: (Score:3, Interesting)
Try to fake an email that looks like it authentically came from Amazon.com to a Yahoo account -- even fr
Re: (Score:3, Informative)
Ya know, "the boss sent me an email saying we should fire all workers who had signed the latest union agreement".
Re:Encryption (Score:5, Interesting)
It works (as I understand) by using your key pair to derive and exchange public session keys. The session keys then are used to do actual encryption and are changed frequently. The private key at each end is only ever stored in RAM and is discarded when the session ends or after a timeout.
It's neat because even listening in to the whole session and obtaining the public session keys isn't enough to compromise the session. Of course, having the public keys and obtaining the master private key may go a long way to helping with a mathematical attack of the algorithm.
Parent
Encrypted RAM and HDD Storage (Score:4, Interesting)
Off to the patent office I go..
Re:Encrypted RAM and HDD Storage (Score:5, Insightful)
Parent
Re: (Score:2)
Have fun proving that you had the idea before Theo [wikipedia.org].
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:2, Interesting)
See Shredding Your Garbage: Reducing Data Lifetime Through Secure Deallocation http://www.stanford.edu/~blp/papers/shredding.pdf [stanford.edu]
Re: (Score:2)
Encryption is only part of the solution (Score:5, Insightful)
However, while encryption can protect against "big brother", you can never eliminate the risk from the other end of the line. What happens if the person you are talking to has a rootkit, or prints out the conversation, or otherwise compromises the data? There's no real way to protect your entire conversation.
--
Educational microcontroller kits for the digital generation -- great gift! [nerdkits.com]
Re: (Score:2)
Thank you, Captain Obvious (Score:2)
Uh, no shit? Obviously you're screwed if the other party is untrustworthy, since the whole point of the communication in question is to transmit your sensitive information to that party. Keep in mind,
In the meantime... (Score:2)
Re: (Score:2)
If you need a "ghetto" works-almost-anywhere free secure instant messenger to talk to Alice or Bob, create an account for your friend on your Linux machine and let them SSH in using PuTTY. Then use "write" to talk to each other, or if you're really fancy, use "talk". SSH is great for this because it (a) uses strong crypto, (b) lets you check for man-in-the-middl
AIM encryption (Score:2)
What's the problem? (Score:2)
The real problem is U.S. government corruption. (Score:5, Insightful)
The real problem is U.S. government corruption. See this example from Cooperative Research, a complete 911 Timeline of 3962 events: U.S. Government corruption TimeLines [cooperativeresearch.org].
The government should serve the people, not spy on them.
1984 (Score:3, Funny)
Re: (Score:2)
Re:1984 (Score:4, Informative)
Parent
Pfft. Don't talk to me, I log all my IM sessions (Score:3, Interesting)
Anyone who is IM'ing with super-secret encoding and hoping that they are safe better not be IM'ing me, or someone like me who checks the "log" button...
Sorry, sometimes I like to refer back to them, and that is the way they are kept. I am too lazy to do anything about it.
I always assume I am just part of the noise in the s/n ratio that "they" are listening to.
What's the opposite of tin-foil hat?
Re:Pfft. Don't talk to me, I log all my IM session (Score:5, Informative)
Parent
Semi-random (webcam of the CSC office) (Score:2)
how to boil a frog (Score:2, Insightful)
HR 1955 (Score:5, Informative)
Re: (Score:2, Informative)
The Internet has aided in facilitating violent radicalization, ideologically based violence, and the homegrown terrorism process in the United States by providing access to broad and constant streams of terrorist-related propaganda to United States citizens.
Uuuh huh.
Nearly all ssh clients have built-in SSH proxy (Score:3, Informative)
Simply ssh to your machine at home... direct Pidgin / GAIM / MSN (or any SOCKS capable app) to use your new local proxy server and your traffic is hidden from corporate big brother.
Once traffic leaves your machine to the internet, it's goes out unencrypted as usual... only useful to not let the boss know you've got to pick up milk on the way home.
Also, careful this doesn't hide DNS traffic.
Why does it use a separate keyring? (Score:4, Insightful)
Re: (Score:2)
Re:Deniability may sound fine (Score:4, Interesting)
Unless you're in the administration, that will get you tossed in jail. Normal citizens require plausible deniability. For hard drive encryption, this can be accomplished by saving dummy data accessible with a second password. For IM, perhaps we need something similar. If an IM client were to give a user the option of using a dummy password which would still initiate encrypted messages, but with a warning flag to the user on the other end, we might have parity.
Encryption technologies that provide plausible deniability are possible, but I doubt they will enter widespread use (or even encryption in general) until the big players champion them. Why one of the major IM providers has not jumped on this as a differentiating feature is beyond me. I guess I see why Google would not include it in GTalk, seeing as they want to use the data to target ads (ditto yahoo and MS), but why isn't it built into ichat yet?
Parent
Re: (Score:2)
Re: (Score:2)
Which is pretty decent. The only item lacking is if the feds demand your password so they can impersonate you talking to someone else. A nice dummy password that will allow them to do that, but presage the first message with a warning that the channel is compromised.
Re: (Score:2)
I don't know about where you're from, but here in the U.S. we still (for now, at least) have something called the Fifth Amendment. You just have to change your answer from "I do not recall" to "on the advice of my counsel, I respectfully decline to answer the question based on the protection afforded to me under the Fifth Amendment of the United States Constitution."
Re: (Score:2)
I don't know about where you're from, but here in the U.S. we still (for now, at least) have something called the Fifth Amendment.
The 5th amendment only applies if you in particular are charged with a crime. If you are subpoenaed or being sued and the court orders you to reveal the password, you will go to jail for contempt of court if you refuse to submit it. Even when charged with a criminal offense, not being testimony as to your actions, it may well hold up in court to charge you. Finally, in many parts of the world legislation requiring this has already been passed and at least three bills in congress have specifically required
Re: (Score:3, Funny)
Re: (Score:2)
Continuing your thought however, I think OTR, and other encryption programs like it, could receive a substantial boost in usage if we could get popular distributions like Ubuntu to include and enable them by default. You and I may think about the security of our conversations, but the majority of people probably do not bother. I can't see much of a good reason to not mak
Re: (Score:2)
Re: (Score:3, Informative)
For a reason why, google "hushmail subpoena"