Slashdot Log In
Protecting IM From Big Brother
Posted by
Zonk
on Friday November 23, @06:29PM
from the another-mark-in-my-file dept.
from the another-mark-in-my-file dept.
holden writes "Ian Goldberg, leading security researcher, professor at the University of Waterloo, and co-creator of the Off-the-Record Messaging (OTR) protocol recently gave a talk on protecting your IM conversations. He discusses OTR and its importance in today's world of warrant-less wire tapping. OTR users benefit from being able to have truly private conversations over IM by using encryption to obtain authentication, deniability, and perfect forward secrecy, while working within their existing IM infrastructure. With the recent NSA wiretapping activities and increasing Big Brother presence, security and OTR are increasingly important. An avi of the talk is available by http as well as by bittorrent and a bunch of other formats."
Related Stories
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Encryption (Score:5, Insightful)
(http://slashdot.org/~nurb432/ | Last Journal: Friday August 27 2004, @03:24PM)
Sure, it eats resources, but do you want others reading your information? I dont. Not even when its "we are out of milk, please pick some up on the way home", as its NONE OF THEIR BUSINESS.
Re:Encryption (Score:4, Informative)
It's a fantastic product, I just wish it was multi-platform... Really nice for Windows though...
Re:Encryption (Score:5, Informative)
(http://kadin.sdf-us.org/ | Last Journal: Tuesday October 16, @01:46PM)
That means that when you're having a chat with someone, you know that what they're saying to you is their actual words, but that the same cryptography that's giving you privacy can't (theoretically) be used to hang you later, by proving absolutely that you said certain things.
OTR's logs are designed to be easily forgeable. This is a major difference in its design from many corporate IM clients (e.g. Sametime), which offer encryption but also create authoritative logs that can be referred back to later.
The point of OTR Messaging is to allow you to have the equivalent of a face-to-face, "off the record" conversation, in the digital, computer-mediated world. Just like when you have an in-person conversation, there's nothing stopping the other person from walking back to their car and blabbing about the whole thing to anyone who'll listen, the encryption itself tries to not serve as authentication after the fact as to what was said.
Re:Encryption (Score:5, Insightful)
(http://rtfm.insomnia.org/~qg/ | Last Journal: Wednesday November 16 2005, @07:11AM)
When the log is presented in court the person who logged it will be asked "is this log an accurate representation of the conversation you had with the accused?" and they say "yes, it is" and the defense then has to show not that it is possible that the log was doctored but that person who has just sworn, under penalty of perjury, is lying. They typically do this by showing instances in the past where the person has submitted false evidence to a court, or they can try to show that the person has something to gain by changing the log and that they had the skills (if any special skills are required, which they wouldn't be). It would be a very tough sell and a jury is more likely to believe that the log is accurate because what kind of idiot would lie in court when the punishment is so severe.
Consider that email is so trivial to fake and yet emails are considered official correspondence in many many many court cases. It's not about the technology, it's about the people making the claims.
Re:Encryption (Score:5, Interesting)
It works (as I understand) by using your key pair to derive and exchange public session keys. The session keys then are used to do actual encryption and are changed frequently. The private key at each end is only ever stored in RAM and is discarded when the session ends or after a timeout.
It's neat because even listening in to the whole session and obtaining the public session keys isn't enough to compromise the session. Of course, having the public keys and obtaining the master private key may go a long way to helping with a mathematical attack of the algorithm.
Encrypted RAM and HDD Storage (Score:4, Interesting)
(http://www.ie-ap.org/ | Last Journal: Tuesday March 28 2006, @05:27AM)
Off to the patent office I go..
Re:Encrypted RAM and HDD Storage (Score:5, Insightful)
Encryption is only part of the solution (Score:5, Insightful)
(http://www.nerdkits.com/)
However, while encryption can protect against "big brother", you can never eliminate the risk from the other end of the line. What happens if the person you are talking to has a rootkit, or prints out the conversation, or otherwise compromises the data? There's no real way to protect your entire conversation.
--
Educational microcontroller kits for the digital generation -- great gift! [nerdkits.com]
Deniability may sound fine (Score:1)
Re:Deniability may sound fine (Score:4, Interesting)
Unless you're in the administration, that will get you tossed in jail. Normal citizens require plausible deniability. For hard drive encryption, this can be accomplished by saving dummy data accessible with a second password. For IM, perhaps we need something similar. If an IM client were to give a user the option of using a dummy password which would still initiate encrypted messages, but with a warning flag to the user on the other end, we might have parity.
Encryption technologies that provide plausible deniability are possible, but I doubt they will enter widespread use (or even encryption in general) until the big players champion them. Why one of the major IM providers has not jumped on this as a differentiating feature is beyond me. I guess I see why Google would not include it in GTalk, seeing as they want to use the data to target ads (ditto yahoo and MS), but why isn't it built into ichat yet?
OTR is classy (Score:1)
Terrorist collaborator? (Score:1)
In the meantime... (Score:2)
Join the Encryps (Score:1)
(Last Journal: Friday July 20, @11:20AM)
AIM encryption (Score:2)
Zonealarm's IM security (Score:1)
Just days before... (Score:1)
(http://www.manjos.com/)
The real problem is U.S. government corruption. (Score:5, Insightful)
(http://www.futurepower.net/)
The real problem is U.S. government corruption. See this example from Cooperative Research, a complete 911 Timeline of 3962 events: U.S. Government corruption TimeLines [cooperativeresearch.org].
The government should serve the people, not spy on them.
1984 (Score:3, Funny)
(http://dotancohen.com/)
Re:1984 (Score:4, Informative)
(http://gnu.org/)
Pfft. Don't talk to me, I log all my IM sessions (Score:3, Interesting)
(Last Journal: Saturday December 09 2006, @10:46PM)
Anyone who is IM'ing with super-secret encoding and hoping that they are safe better not be IM'ing me, or someone like me who checks the "log" button...
Sorry, sometimes I like to refer back to them, and that is the way they are kept. I am too lazy to do anything about it.
I always assume I am just part of the noise in the s/n ratio that "they" are listening to.
What's the opposite of tin-foil hat?
Re:Pfft. Don't talk to me, I log all my IM session (Score:5, Informative)
(http://brobding.mine.nu/)
I downloaded the ogg (Score:1)
(http://gquigs.blogspot.com/)
Semi-random (webcam of the CSC office) (Score:2)
(http://www.holdenkarau.com/)
Shared Secret FTW (no more finger print checking) (Score:1)
how to boil a frog (Score:2, Insightful)
HR 1955 (Score:5, Informative)
Ian Goldberg (Score:1, Interesting)
-Ryan
Testing out IM spying (Score:2)
Needless to say neither one of us vanished in the night, and neither of us received any unwanted visitors.
Pidgin w/encryption (Score:1)
I've used it for about a half a year (via Jabber's servers), and it has been a great experience.
However, I only use it w/one of my other nerd IM contacts. There's just no way I could get everyone else to get this set-up. That's the problem.
Same goes for encrypted email. Encryption just needs to be baked in from the get go.
https://mail.google.com/mail/ (Score:1)
Hmm (Score:2, Interesting)
Nearly all ssh clients have built-in SSH proxy (Score:3, Informative)
(http://www.macvana.com/)
Simply ssh to your machine at home... direct Pidgin / GAIM / MSN (or any SOCKS capable app) to use your new local proxy server and your traffic is hidden from corporate big brother.
Once traffic leaves your machine to the internet, it's goes out unencrypted as usual... only useful to not let the boss know you've got to pick up milk on the way home.
Also, careful this doesn't hide DNS traffic.
Why does it use a separate keyring? (Score:4, Insightful)
(http://grendel.dyndns.org/)
Trivial (Score:1)
some solutions... (Score:1)
Kopete (Score:1)
So whats the difference.. (Score:1)
(http://nullbyte.org/)
I've been using simp for ages, and it even encrypts the logs (in a sense that the logs appear as gobbledegook).
Oh wait.. I guess its only for msn messenger / yahoo / icq
IRC + SSL (Score:2)
how about messenger plus scripts? (Score:1)
Broken (Score:2)
(Last Journal: Monday October 09 2006, @07:35PM)
A lot of people think encryption == secure; it doesn't.
Re:Ok (Score:3, Funny)
(http://swoolley.homeip.net/ | Last Journal: Sunday August 26, @03:41PM)
Re:Ok (Score:1)
(http://www.quickfox.net/)
Re:Or, technology for terrorists (Score:2)
(http://chameleon-translations.com/)
In amongst all your right-wing smearing and ranting, I discern one valid point: that the most repressive governments are likely to declare encryption illegal and punish all encryptors as harshly as they punish people caught openly opposing them. This would render encryption useless.
However, few governments are quite that bad. Most will punish encryptors less harshly. Furthermore, most governments (such as the Western ones that we are able to put political pressure on) can be forced not to criminalise encryption. Encryption can then help to avoid government interference in certain protests.
Note that it is these very governments that kill thousands, and more. If you are worried about the almost negligible amount of private terrorism in the West, then you ought to be trying to stop the killing that fuels it.
Re:Or, technology for terrorists (Score:1, Insightful)
Toss toss. Everyone keeps bringing up that piss-ant September 11 event. 3000 people is not a lot in the grand scheme of things. How many people has the Farce on Terror killed? How many died in Vietnam or Hiroshima? How many people die of cancer or AIDS related problems each year? Let's stop and look at how many people die on the roads or from gunshot wounds (non war) annually around the world.
Encryption can certainly be used by the bad guys, but the bad guys are used as an excuse by the government for reigning in civil liberties and spying on the citizens. The book should have been called 2014 because that's about how far I see we have left at the current rate before they listen and log everything you do in your shitty little life to use against you.
If the government (particularly the US gumbiment) were serious about saving lives wouldn't they implement stricter gun control laws? Wouldn't they spend more money on cancer and HIV research instead of blowing it all on a farce against some unknown army of people who don't actually exist. Can't they build safer roads and find ways of solving problems that don't involve invading other countries shooting up the place and taking what they want.
There are so many things that kill more and regularly than a couple of planes crashed into a couple of buildings. This continual using it as an excuse for all the bullshit that governments are doing is just frustrating. We all know that pollies have small cocks. When the two American penises were leveled the pollies all got together and needed to find new ways of proving the enormity of their willies. It shits me!!
We have a very US friendly government here. It's also election day and people have the shits with all of the things our current government has done to bring us more in line with the US. There's workplace reform, terrorism legislation that really means nothing, copyright reform, free trade agreements that actually impede more on our rights and give the US whatever they wanted, etc. At least the people here haven't bought into the "we'll keep you safe" arguments that I heard from the current government during the campaign. It'll be interesting to see who actually wins the election and what the new evil overlords of the country do in their first term toward reversing some of the anti-terror rules that have come about and dont' really add anything to security.
End rant!
Now, don't get me wrong; I don't support extremists killing innocent people for whatever reason it is they dream up. There needs to be some law allowing control and prosecution of people like that. I just don't believe that the government needs far reaching and sweeping authoritarian power to do it.
It's enough in many places to simply say "we think you're a terrorist" and get someone. If they can't catch you in the act of planning or committing some event (with actual written plans, explosives, weapons, etc in your possession) then they shouldn't catch you.
Re:Here's My Big Question (Score:2)
Here's the thing: "Bad guys" are rare. As a result, the majority of people the government would end up watching are "good guys". Let's say that 1 in 100 users being watched is a "bad guy", and the government gets the "good guy/bad buy" decision right 99% of the time. That implies that about 1 "good guy" is incorrectly labeled a "bad guy" for every "bad guy" correctly labeled a "bad guy". I'd rather minimize the information the government might use to incorrectly label me a "bad guy", even if it means increasing the very slight risk that one of the "bad guys" will hurt me or someone I care about.
Or, in Franklin's words: "Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety."
Live Free or Die (Score:1)
Class Project: Explain why America is called 'The Land of The Free' & give examples.
But what if everyone is a 'Bad Guy'? (Score:1)
Re:Overkill (Score:2)
Re:Or, technology for terrorists (Score:1)
Although there does seem to be a REMARKABLE metal disconnect for an amazing number of brownshirts in this country. Ones that will say at first, "If you outlaw guns, only outlaws will have guns!!!111oneone!" then turn around and say, "If you outlaw encryption, daddy president will make us all nice and safe and happy from terrorists". Unbelievably deluded. (Of course, as crypto is digital, you can't even restrict by physical means or material cost).
Terrorists funded by $10 billion (well a shitload more, now that American pumped up the price of oil) rich oil or ancillary industry magnates is hardly going to be deterred. They weren't then, they aren't now.
WTF does restricting encryption accomplish? SPECIFICS please. A suicide bomber on American soil will be deterred suddenly becuase they found out the encrypted messages they were using results in a $1000 fine and a year in jail? What, the gonna scrape up the giblets and put them in a bucket in a prison cell? I'm sorry, but you are either a troll or f'ing retarded.
It's like outlawing baseball bats to prevent death-by-Slugger-to-skull. The tool itself is not the problem here, or there, nor is it the only means to accomplish the undesired behavior.