Silent Circle Follows Lavabit By Closing Encrypted E-mail Service 470
Okian Warrior writes "Silent Circle shuttered its encrypted e-mail service on Thursday, in an apparent attempt to avoid government scrutiny that may threaten its customers' privacy. The company announced that it could 'see the writing on the wall' and decided it would be best to shut down its Silent Mail feature. 'We’ve been debating this for weeks, and had changes planned starting next Monday. We’d considered phasing the service out, continuing service for existing customers, and a variety of other things up until today. It is always better to be safe than sorry, and with your safety we decided that the worst decision is always no decision.' The company said it was inspired by the closure earlier Thursday of Lavabit, another encrypted e-mail service provider that alluded to a possible national security investigation."
Does anyone have replacement recommendations for people who used these services?
NSA or Chinese great firewall (Score:3, Interesting)
Simple option(s)... (Score:5, Interesting)
I would say "something hosted outside the US", but as the international banking community has shown, Uncle Sam's jack-booted foot extends well outside our own borders.
So that really leaves "GPG" as you sole realistic option. End to end encryption, with no one but you and the recipient knowing what you wrote. Of course, "they" can compromise either end, but it deprives them of the ability to funnel everything on the wire into their data centers for 4th-amendment violating goodness.
Or, we could all go back to writing letters. Oddly enough, that still has more legal protections behind it than any other form of communication.
Re:enigmail/pgp/gpg (Score:5, Interesting)
One advantage of these 3rd party email services is that you can't tell who is emailing who without getting access to their servers. It seems some of them are willing to go out of business to prevent that.
Re:Weird! (Score:5, Interesting)
Re:Nicely done (Score:4, Interesting)
Brilliant!
I think the idea in this case was that lavabit and silent circle didn't have any way to decrypt your email. If this was true, then it wouldn't matter where it was as long as that remained true and email was between two users of the service ( obviously the NSA could read your sent and received email by just hacking the recipient/ sender of each email) .
distributed encrypted p2p email system (Score:5, Interesting)
Although currently everyone can install an email server (e.g. there are several available in debian). It is not what would solve the problem. Not just because it requires technical expertise, but also because it requires too much dedication on your side to maintain your freshly installed server. Also to make sure it has outside access with SMTP port, and so on. Not mentioning that it needs about 100% uptime. Such solution is too much centralized.
I was thinking about p2p email more like this one [psu.edu] which I googled right after I had this initial idea. This is a proof of concept so it can work.
Key features would be:
1) uses p2p distributed encrypted file system, like tahoe [tahoe-lafs.org]
2) each p2p node can act as email receiver/sender
3) to send email to someone you use nick@1.2.3.4 where 1.2.3.4 is any IP that is running p2pemail. Simplest would be 127.0.0.1 if you just run a p2pemail node yourself.
4) everyone can have p2pemail account, just connect via https to nearest p2pemail node. It can be running on your computer or anywhere else. Doesn't matter. This just requires setting up an account name on your side, and a lenghty password, which is also used as a sha256 seed for private key for encryption of your emails and also as a PGP signature for you emails.
5) PGP signing emails would be so easy, that it would be a new standard.
6) all encryption and decryption is done locally on your computer either in javascript or in your email client. Just make sure that your browser and computer are not compromised.
7) if any of p2pemail nodes are running compromised code (eg. like compromised tor nodes) they still cannot read your email, because they have no acces to your private key. The only hope they can have is to monitor when you are accessing your data, but only if a request to the compromised node is made.
8) even if huge NSA datacenter decided to store all p2pemail data, they still cannot read it, and have nobody to file a warrant to.
If we combined that with bitcoins we would get additional (optional) features:
9) buy storage with bitcoins, while buying decide how many copies of your data you want to have (can change this anytime later). Offer any price you want, lower bids might not be taken.
10) provide encrypted storage space and get paid. If you store multiple copies of same data (might be possible before p2pemail gets popular) ensure that at least it is on different physical locations, otherwise you might be compromising security
11) create whitelists with people from whom you want to receive email, add mandatory bitcoin fees if anyone not on the whitelist wants to send you email.
12) You can create various stages if whitelisting, depending on domains you can define different prices to receive email. Or you can say that first email is free for everyone, and each next will be paid or not depending on if you received spam. Or configure spamassasin to decide for you.
PROBLEM: where do my friends send email to?
ANSWER: your_nick@p2pemail.org/net/com/info (we need to register many domains, and use many IPs to resolve those dns-es)
PROBLEM: Will my address still be the same after long time?
ANSWER: your nick in p2pemail will be the same, tell your friends that if they cant send email (eg. govt seized all p2pemail domain names), then they have to find some p2pemail node. Google it, or install one themselves. If they can't do that, you can solve this by installing a node yourself, and making sure it has the same domain name all the time. Services like dyndns can help you with that.
well maybe that's just a pipe dream. But the proof of concept implementation that I linked above gives some hope. What do you think?
Re:Distributed Mail (Score:4, Interesting)
Not only that, many _other_ ISPs won't send mail to mail servers located in comcast space or accept mail coming from comcast space. It's why I set up my own colocated server. The problem with that is all the difficulties dealing with such a system including spam and attackers.
The last time I checked I was getting a bit over a million ssh break in attempts each month. I eventually blocked all of Taiwan at my firewall due to the majority of attempts coming from their address space.
The other issue is with the colocated site address space. Since I have no control over the other addresses they host, DNS blacklist sites that blacklist IP ranges prevent mail from my mail server from being delivered. There are some sites that will let me communicate with their NOC and get put on a white list but there are others, like shaw.ca, that have no way to communicate with them to get off their list. They want me to contact the DNS blackhole sites they use but the DNS blackhole site has no way to get off their list (it's been a while, I remember shaw.ca).
And Microsoft sucks. They have my server blocked with no way to clear it however I can pay a fee to Microsoft to open up my server to Hotmail (for example) so I can send advertising. And on the funny side, Microsoft only blocks me about 50% of the time.
[John]
Re:enigmail/pgp/gpg (Score:5, Interesting)
Can't you do the same thing on a public forum? e.g. I generate a public key with no personally identifable information, and give it to you. To contact me, you encrypt your message with my public key, and post it to e.g. USENET. I then connect to USENET, download a bunch of posts, try to decrypt everything with my private key, and keep the ones that are successful.
Re:Nicely done (Score:5, Interesting)
Re:Nicely done (Score:5, Interesting)
No I think the way lavabit stored the keys was faulty. They were stored on their own servers and unlocked by the users password when they logged in. So the NSA couldn't crack your email unless they watched you log in, then they would have your password. I suspect the NSA ordered them to allow the NSA to do this very thing and the owners realized that the only way to prevent them from gaining access was to shut down the service so no-one could log-in and give the NSA access to their accounts. Someone in the Lavabit thread suggested that they should have had a client side app that generated keys for you, then there would have been no-way for anyone to crack it unless your local machine was key-logged.
Re:distributed encrypted p2p email system (Score:4, Interesting)
Check out Pond [imperialviolet.org], by Adam Langley. It's Tor based secure end to end mail with a variety of interesting tricks, done by a real cryptographer (one of the people who upgraded OpenSSL to support forward secrecy, and then upgraded Google to use it).
Re:Weird! (Score:5, Interesting)
The fourth/fith amendments exist to protect innocent citizens from otherwise accidentally incriminating themselves.
And even more specifically, the fourth and fifth amendment exist to protect innocent citizens from being forced into incriminating themselves by an overreaching government who is trying to silence dissidents.
People frequently overlook the historical context of the Bill of Rights. You have a bunch of people who had just fought a revolution against a government that they believed was oppressive, and they were trying to safeguard themselves against falling under another oppressive government. The Bill of Rights was created specifically for that reason. Essentially, you have a bunch of people who were recently rebels, who want to limit the government's ability to quash a rebellion, silence dissidents, or subvert a popular uprising.
To guide them, they look through their recent history for the tools employed by the power they had just thrown off. The British had limited speech, forbidden ownership of guns, stationed military personnel in people's homes, performed searches without cause, etc. In order to prevent a new oppressive government from using those tools, the authors of the Bill of Rights made them illegal.
So it's not really a defense to say, "This should be ok, because we're only trying to catch dissidents, terrorists, and enemies of the state!" The founding fathers were dissidents, terrorists, and enemies of the state. The Bill of Rights was written to protect exactly those kinds of people.
Re:Nicely done (Score:2, Interesting)
Accelerating a thing makes time go slower for it, not faster. So you would need to accelerate the Earth, not the ship. And besides, if you can accelerate an object at least as massive as a human body into near-lightspeed, you already have a Death Star, so why do you need a software crack? Just get to your new starship and hold Earth hostage.
Re:Nicely done (Score:4, Interesting)
There is nothing more right wing than claiming the press favors democrats. There are two sets of press, those like MSNBC that favor the democrat view and those like Murdoch properties like Fox News that go out of their way to advocate the republican party line. In the middle are those companies like CNN that are after rating and don't give a damn about content, including whether it's even factual. These middle organizations generally have individual reporters with extreme bias, like Nancy Grace who advocates for government authority regardless if that authority benefits republican or democrats.
Frankly there are almost NO news organizations that care about presenting all the issues and trying to remove reporter bias. They don't exist because (stupid) people want their "news" (or entertainment as Fox calls it) biased to their political view point. There are a couple vary rare organizations that still strive for that, but they have terrible ratings.
If you want it you need two things first, people to actually demand unbiased coverage (the biggest requirement) and to monopolize the coverage, and that means breaking up the big networks. The more competition in coverage and the less central control by large egomaniacal CEO's with agendas and you will see less bias, but that would require reinstating the ownership rules that the republicans works so hard to waive so Murdoch could build his empire.