VoIP Wiretapping 284
pisqon writes "VoIP News has an article discussing a U.S. government decision that will extend wiretapping regulations to the Internet. From the article: 'The Federal Communications Commission voted 5-0 last week to prohibit businesses from offering broadband or Internet phone service unless they provide police with backdoors for wiretapping access. Formal regulations are expected by early next year.'" Update: 03/28 04:52 GMT by Z : As several readers have pointed out, this story is a mite out of date. Good conversation in the comments, though.
Only makes sense (Score:3, Interesting)
Re:Only makes sense (Score:4, Insightful)
Re:Only makes sense (Score:5, Insightful)
A criminal needing to communicate privately can do it a number of ways.. being encrypted email.. encrypted IM..
How can wiretaps even be remotely useful anymore? Unless you catch someone who is being stupid and talking on a potentially insecure phone line about something he shouldn't have done..
there are so many other ways that are much safer, doesn't make sense
Re:Only makes sense (Score:5, Insightful)
Re:Only makes sense (Score:4, Funny)
Re:Only makes sense (Score:5, Interesting)
Sure, you're not gonna catch Danny Ocean that way (sorry, just saw Ocean's 12 last night), but you will get 95% of people you're after.
Re:Only makes sense (Score:3, Insightful)
Re:Only makes sense (Score:2, Insightful)
a lot of people are stupid, when they're high on drugs they're even more stupid.
anyways, this is not about deciding if wiretaps are useful or not, it's just about deciding that you don't get out of the wiretapping requirement simply because you use this new technique called voip to provide the end line to the user.
does th
Re:Only makes sense (Score:5, Informative)
Very simple. Phones are still very widely used and as others have pointed out, wiretaps often still provide evidence to be used in a trial. Preventing VoIP phones from being able to be tapped is just inhibiting our ability to prosecute criminals effectively.
Just because there are other, better ways to communicate secretly, it certainly doesn't mean your average theif, drug dealer, income tax evader, or whatever uses them. Phones are easily accessible, cheap, a very large majority of people have them. Obviously they are an ideal and often the first thought of way to communicate.
Re:Only makes sense (Score:5, Interesting)
Re:Only makes sense (Score:5, Insightful)
But the point stands that this will only catch small-timers that aren't smart enough to set up encrypted communications.
Anyone who thinks that big organized crime doesn't have their own IT guys who know this stuff forwards and backwards, and set up secure communications and encrypted storage for their bosses is a fool.
N.
Re:Only makes sense (Score:3, Funny)
Obligatory Sneakers quote:
Martin: Organized crime?
Cosmo: Hah. Don't kid yourself. It's not that organized.
Re:Only makes sense (Score:5, Insightful)
As far as VOIP goes, it's very significant that it allows you to cross the line between the internet and the telephone network and breaks the government tracking of that relatively closed system on a global scale. The internet isn't just implemented in a fashion that is open and relatively uncontrolled, it is also destroying the existing control of another network by interfacing with it. Would you really not expect a response from the governments who have benefited from that control?
Outside the VOIP thing, even if you can't crack into someones communications, I can think of lots of benefits in being able to monitor their lines if you're trying to investigate them. Unless they're flooding their channel with a constant encrypted data stream to you can track the timing of their communications. You can track where the communications are being relayed from and to. And you can track what they communicate anytime they access systems that are outside the closed system they would presumably be using for their communications.
I'd suggest you stay away from a life of crime... you don't seem to have a very good understanding of the dangers involved
Security minded (Score:2)
Big question is: although crime benefits from a little discretion, maybe not all criminals are fully aware of security.
Re:Only makes sense (Score:2)
Even those things you mentioned above (email, im) seem just plain silly because the medium you're talking through requires delay.. on the phone you actually hear the person you're talking to on the other side.
Re:Only makes sense (Score:3, Interesting)
Re:Only makes sense (Score:3, Informative)
Then it's a good thing that we don't. Read up [cornell.edu].
Uhh, VoIP is digital (Score:4, Interesting)
Re:Uhh, VoIP is digital (Score:3, Insightful)
Re:Uhh, VoIP is digital (Score:3, Interesting)
Re:Uhh, VoIP is digital (Score:2, Insightful)
Re:Uhh, VoIP is digital (Score:5, Informative)
Re: (Score:3, Informative)
Boring!!! (Score:3, Informative)
Re:Uhh, VoIP is digital (Score:3, Interesting)
Granted, there may be a way to use client-level multihop source routing with encryption so that each stage only knows the next link the client wants the packet forwarded to, but that's a step that may be less obvious to take than merely encryption of content. Running a server that permitted this might also be rare enough to raise red flags.
Re:Uhh, VoIP is digital (Score:2)
Good news, at least. (Score:4, Insightful)
Internet too? (Score:5, Insightful)
Re:Internet too? (Score:2, Funny)
Re:Internet too? (Score:2)
So come on, cite some material we can look at here to back up your claims.
Thanks!
Re:Internet too? (Score:2)
Re:Internet too? (Score:2)
I don't think they where really reading the letters or contents, but they were able to sniff for certain chemicals and flag those letters for closer inspection.
Re:Internet too? (Score:2)
This is precisely why tools such as PGP are so important. Without them how could you possibly have any notion that your communications are actually private?
Re:Internet too? (Score:2)
yes and it only works with open source code you've inspected and compiled yourself - anything else will be required to have such a backdoor installed for the government to use.
Re:Internet too? (Score:2)
Regarding the post office, it's presumably been a long-studied problem about how to eavesdrop on letters. Hell, monarchs of old used personal seals partly for that reason (also to authenticate, probably); and the CIA and KGB probably practiced on diplomatic pouches whenever possible...
Re:Internet too? (Score:2)
Re:Internet too? (Score:2)
Re:Internet too? (Score:2)
Re:Feeling Privacy (Score:2)
"If it's not morally ok, you will go to jail. "
Who the hell decides what's morally ok? Not all laws are just, ya know, and not all illegal activities are immoral.
Re:Feeling Privacy (Score:3, Insightful)
Nobody believes that anymore, even on the left. Everybody would sure like it to be true, though.
And if it is morally ok, and a lot of people are doing it, you still might go to jail. Ever heard of something called marijuana?
Re:Feeling Privacy (Score:5, Insightful)
Privacy is the freedom to control access to information about yourself and your behavior from those who you would rather not know it because it is embarrassing, incriminating, or simply against your wishes.
Freedom is not synonymous with an open society either, in fact an fully open society is the least free (libre) arrangement of human interaction because there isn't any haven from the will of others to impose themselves or their ideas upon you. No thought may go unchecked by the group, no dream unconfirmed to the mores of the society at large.
You cleave to the idea that there is the 'truly moral' while simultaneously evoking that the 'government is us', which I find a little silly.
If the government is in fact 'us', then the tyranny of the mass is reason enough to demand and safeguard our privacy, and insist on something less than an fully open society.
If there is a 'truly moral' way of living, then there cannot be a government of the people, for the people, and by the people because it would imply either that this moral truth is known by people, thereby rendering moot the need for government at all, or that in the absence of this knowledge personally, the collective acts of a nation can be somehow conformed to a superior standard of conduct, which betrays the notion that the people are self-governing, since they do not possess the knowledge of the moral truth themselves and are instead being governed by the ideology that is external to them.
It is a logical fallacy that we are somehow "safe" from a sub-set of the population that is opposed to a particular behavior or belief and is empowered to act with authority to eliminate that behavior.
There is an enormous difference between what is moral and what is legal. Legality is the thing of government and of power. Morality is the thing of humanity and of ethics.
What is criminal today can overnight become legal, and vice versa, simply by the caprice of a majority of 538 human beings in the District of Columbia. That isn't a complaint, it is a fact. To live under the illusion that you aren't potentially a target of someone's bias, prejudice, or ideological action is really pretty foolish.
I'm sure that few people in the Arab-American or American-Islamic communities realized they would become the enemy, subject to seizure, torture, imprisonment without charge, and social stigma simply for the way the looked, who they spent time with, the books they read, or the location of their religious centers on September 10th 2001. They likely felt just as most Japanese-Americans did on December 6th 1941.
Just because what you do is "what everyone is doing" doesn't make it morally OK. It makes it popular. It was popular to ignore the Nazi rise to power and the lynchings in the deep south and the Inquisition, too. None of those are considered morally OK. Morality, when viewed through the lens of history, generally is the opposition to power being abused, not the tacit acquiescence to brutality.
Living a life shrouded in secrecy isn't an un-free life if you are doing it because you choose not to share the intimate details of your life, not because you have to. Living a life under surveillance and scrutiny by anonymous actors who believe they are above reproach and constantly on the lookout for any small breech of one of a myriad of civil and criminal laws that no one can abide by is not freedom. When everything is a crime and the enforcers pick and choose to whom and when the law will apply, that is not government by the people. When you think that what you are doing is truly morally OK, and that the government will never think you aren't, you are living a life that is not free.
With a warrant they can... (Score:5, Informative)
Sure they can. A warrant is a temporary suspension of your normal rights, after having proven reasonable suspicion to a court of law. If you're going to quote me the amendment, it is unlawful search and seizure. As long as they go through the proper channels, they can know what toothpaste you use, and how many condoms are left in your bedroom drawer. [Bad geek joke] For anyone here, that means all of them [/joke]
Kjella
Re:Internet too? (Score:2)
Why should one particular medium be immune? People have gone to jail because of fatal disclosures in their email. IM isn't particularly different in that respect.
They can open anything, if they can show enough probable cause [answers.com] to get a warrant. (The Patrio
Re:Internet too? (Score:2)
Re:Internet too? (Score:5, Interesting)
I vividly remember my dad going into a rage when his mail was being read by the local post office. He went to the mailbox, and I followed him (I was a little kid, it was natural for me to follow.) Had the letter in his hand, shaking it, saying "Look at this! Look at this! These bastards are reading my mail!" The whole top of the letter had been ripped open, and then taped shut.
At the time, he was a semi-high mucky-muck in the Republican Party in California. If the letter came from from party headquarters, some democrat (presumably) opened the letter and read it. After opening and reading it, they'd tape it shut, rubber stamp it with "sorry, damaged in handling", and send it on. Complaints to the local Post Master were ignored (federal government workers, at least at that time, were almost all Democrat, for some strange reason....) For a little more information, see the paragraph under Hobbies list here [comcast.net].
Privacy invasion is more subtle now, but there is zero reason to think things have changed for the better since then.
netmeeting (Score:4, Insightful)
Re:netmeeting (Score:5, Informative)
For now....
Re:netmeeting (Score:3, Informative)
Is Skype [dev'd outside of USA] exempt? (Score:5, Interesting)
Remember the "can't export crypto technology" era?
Those who did their crypto development outside USA
were exempt from the restriction (mostly), ie,
since they wouldn't have to export code in an
electronic form.
Perhaps software-only VoIP systems like Skype
will be exempt from the FCC's "must provide a
backdoor" ruling.
Has Skype made any statement on its position?
Re:Is Skype [dev'd outside of USA] exempt? (Score:5, Interesting)
Skype CEO Niklas Zennstrom told me last fall that "we do not have any legal obligation to provide any means for interception" in his company's VoIP software. How will you force a company based in Luxembourg to insert backdoors in its software when it has no obligation to do so?
This doesn't qualify as an official statement from Skype, but it pretty much says it all, I think.
Re: (Score:2)
Re:Is Skype [dev'd outside of USA] exempt? (Score:2)
I think you're missing an important point...
Skype don't need no stinkin' phone numbers...
(at least when talkin' computer-to-computer)
Re:Is Skype [dev'd outside of USA] exempt? (Score:2)
Point well taken...
Now, since Skype isn't making $'s on those
computer-to-computer calls, perhaps it could
be pursuaded to open the spec's to the part
of its P2P technology that supports them.
Eg, let us take those no-profit calls off
their hands & into our own (and, also,
onto our LANs, for the first time - a
big gap in Skype's current implementation
- ie, I'd like to use SKype on a LAN,
that's -NOT- connected to the Internet,
for a one-lead (LAN-only) -INTERNAL-
tel. system.)
Perhap
My problem with this. (Score:3, Insightful)
Security with a stick does not work... (Score:4, Insightful)
Personally, I don't have a problem with the security thing. It's just for the police, and I personally don't have anything to hide from them.
The USA is not designed to have a transparent citizenship. The USA was designed for government to be transparent. Everything our founding fathers did was designed for maximum personal freedom, maximum personal privacy, and to minimize the chance of government curruption. And over the past 20 years, under republican control, we have lost many rights your grandparents took for granted.
During WWII we locked up anyone who had slanted eyes because they *might* sympathize with the enemy. We tried countless times to kill Casto. We assasinated the head of state of Chili. Lets face it, the USA does not have a good history when it comes to human rights. Whenever someone with money thinks someone without money is a threat, the powers that be make life a living hell on everyone.
Re: (Score:3, Insightful)
Re:Security with a stick does not work... (Score:2)
Except for the junk about "corporate masters". I think its more special interest groups that cause the problems than corporations.
Regardless, Good post. Someone mod him up.
Re:Security with a stick does not work... (Score:2)
We lost rights under republican control? Um... Communications Decency Act, DMCA, Child Online Protection Act, Clipper Chip, crypto export restrictions? Remember all those blue ribbons all over the web during the late 90s? Any of this ring a bell? The democrats are certainly a second close.
Re:My problem with this. (Score:2, Insightful)
Re:My problem with this. (Score:5, Insightful)
Presumably you're not a pretty girl, then. [slashdot.org] Thanks to Safety Cap (253500) for this story of a on-duty cop copying nudie pics for his off-duty enjoyment.
But that's only one cop. Click for the Top 10 List of Police Database Abuses [g4tv.com].
It includes such charming cop activities as "Prosecutor's Office Uses Database to Smear Prosecutor's Political Opponent", "Police Lieutenant Charged With Abusing Database to Influence Elections", and "Cop Uses Database to Find Woman's Unlisted Phone Number -- Gives It to Woman's Ex"
But that's just local cops you say? We can trust the FBI, you say? Well, Martin Luther King [thirdworldtraveler.com] couldn't.
And the FBI even tried to get the Mafia [thirdworldtraveler.com] to silence Dick Gregory when he spoke against narcotic trafficking. And framed environmental activists [thirdworldtraveler.com]. Not to mention COINTELPRPO [thirdworldtraveler.com], or the FBI helping Chicago police murder Fred Hampton in cold blood [providence.edu].
But that's all in the past you say? Well, if two years ago [labournet.net] is "the past". [sfgate.com]
But you have nothing to hide, so I guess you're safe.
Tell that to "[m]ost of the 110,000 persons removed for reasons of 'national security' [who] were school-age children, infants and young adults not yet of voting age" [pbs.org] forced by the U.S government to move to:
* Manzanar War Relocation Center
* Tule Lake War Relocation Center
* Heart Mountain War Relocation Center
* Minidoka War Relocation Center
* Topaz War Relocation Center
* Poston War Relocation Center
* Gila River War Relocation Center
* Granada War Relocation Center
* Rohwer War Relocation Center
* and Jerome War Relocation Center
You, know, mostly I let the links speak for themselves. I'm going to deviate from that this time, and I'll get modded down for it, but sometimes you just have to say it.
You don't deserve to vote. You don't deserve the nation created by Jefferson and Madison and Washington. You don't deserve to inherit the legacy of the brave men and women who sacrificed their lives to make America (more or less) free.
YOU DON'T DESERVE TO BE AN AMERICAN.
It's one thing if you realize that government is always a threat to liberty, and weighing the alternatives, reluctantly decide to cede more power to the government.
But you aren't doing that. With the whole frigging internet at your finger-tips -- much more than Thomas Jefferson ever had -- you can't even be bothered to type into Google "police surveillance abuse" and read the fucking history of your own fucking country.
Instead, you just blithely assume that since what you're doing isn't illegal yet that since you're not on a watch-list yet that the color your skin or your accent or your politics aren't "suspicious" yet, you can sit back fat and happy without giving thought to how this might affect others or even -- governments and laws do change -- yourself in the future.
And yet you get to go into a voting booth and pull the lever because of people who did know better and who made the hard choices and who often die
Who is approving these? (Score:5, Informative)
Why is this "news"?
Re:Who is approving these? (Score:2)
Are you implying that things that have happened in the past aren't news? It may not be new news, but it's still news...Then again, I'm sure with some digging somebody can find the original
Re:Who is approving these? (Score:2)
Encryption (Score:2, Interesting)
Just encrypt the audio in whatever software you use...
So encrypt it (Score:3, Interesting)
That way, just like PGP or S/MIME encrypted email, they'll be able to see who you called and at what time, but not what you said.
Perhaps now is the time to make sure VoIP offerings can be easily encrypted - before they are taken up by the masses. If high grade opportunistic encryption was available it might jsut be used, whereas to trya nd introduce it retrospectively... well we all know how successful that has been with email.
how are they gonna wiretap "ssh-tunnels"? (Score:5, Insightful)
as soon as the VOIP software offers encrpytion plugins on both side of the line, wiretapping is just as feasable as reading encrypted email or viewing ssh-terminal sessions...
this won't work... the most likely thing that will happen is that the service providers will leave the country. Or worse, that companies outside will be more competitive and push local companies out of the market.
What's to prevent a company in India from making this software for willing costumers to use?
Re:how are they gonna wiretap "ssh-tunnels"? (Score:2)
Bomb them back to the stone age?
Re:how are they gonna wiretap "ssh-tunnels"? (Score:2)
it's not like normal people would even care anyhow, how much are you seeing encryption devices on normal phones?(they're on market).
Re:how are they gonna wiretap "ssh-tunnels"? (Score:2)
Bombs. And lots of them. Examples: Iraq... Afghanistan...
I suppose then I'd have to learn the name of yet another world leader too...
Yes, this is mostly sarcasm...
Crypto? (Score:3, Interesting)
Microsoft stock on the up? (Score:5, Funny)
hahaha (Score:3, Insightful)
keep that finger in that leaking dyke, we wouldnt want all the water to rush out
ever think the "bad guys" are the people listening not the people talking ? whatever USA can tap all they like the bad guys will just use any number of public encryption methods to talk, you would think the gov would realize this, but "intelligence" isn't something they seem to be blessed with
Re:hahaha (Score:3, Funny)
Besides, some people actually pay good money to do things like this.
Call me old fashioned... (Score:5, Insightful)
But maybe there is more to it?
Congress gave telephone companies $500 million to buy new equipment to comply with CALEA. Why should Internet companies not receive the same treatment? Is it because Verizon, SBC and the other former Bells have well-connected lobbying outposts in Washington, D.C.--but Vonage, 8x8 and other VoIP start-ups do not?
According to the article, congress gave telcom companies $500,000,000 to enforce the laws they passed? Why doesn't the government give me money to enforce their pollution laws, so I can get my car fixed up. Instead I have to pay to comply with the law.
People must be aware they are giving something up here. They are giving away freedom. What if some day comes, when a David Duke wins the white house? Congress is filled with people who vote along lobbyist lines. And we end up with laws that remove our consitutional rights- like having police wiretap without a warrent or snoop around the library to see what we are reading. What if they take away our 2nd amendment rights, first by requiring registration, than banning assult style wepons, then slowly, state by state, taking away wepons you already own. What if the states decide to put up a camera on every street corner.... then one day in your house.
The point is the founding fathers did not add the Bill or Rights because it sounded like a nice set of rights. They added those Rights so the people could fight an overbearing government if the need ever came. What if England had decided the colony could not have any guns, and decided that neighbors must report what other neighbors say. We would not be a country today, we would be English. The founding fathers gave people certain Rights to make sure we stay free.
Those that give away those Rights are comminting suicide for the rest of us. They are chaining us all. Rossoue was right "Man is born free, yet everywhere he is in chains". People, don't give you your rights!
If you don't care, they don't care. (Score:2, Insightful)
Accepting the idea that the government is somehow a separate population from the people is what starts making that idea truth. WE ARE THE GOVERNMENT.
I am not afraid of the people who make and enforce the laws because I know that there are more of us than them, and there always will be. I trust society will do what's in it's own best interests to ensure justice is met. I realize that I might have to face injusti
Closed and secretive.... (Score:2)
Re:Call me old fashioned... (Score:2)
And that's what CALEA gives them. So in this case you actually agree with the government, even if you don't realize it.
According to the article, congress gave telcom companies $500,000,000 to enforce the laws they passed? Why doesn't the government give me money to enforce their pollution laws, so I can get my car fixed up.
You're not a monopoly with an army of lobbyists.
Re:Call me old fashioned... (Score:3, Insightful)
Why is the article datelined 8/9/04? (Score:2)
Ashcroft... (Score:2)
And I can't resist it... the only guy to lose his senate seat to a dead guy. What an asshat.
BTW, even though Ashcroft is gone, that does not mean that many people he hired are gone. The people he advanced to leadership positions are now the ones running the show. Think about that. That is how a shadow government forms. Right now Ashcroft is probably in some high level burrocrat's office lighting up a cigarette while influencing world events.
Why not use two VOIPs half-duplex? (Score:5, Insightful)
Re:Why not use two VOIPs half-duplex? (Score:2)
if you'd be just chatting to another voipper you'd be better off running some chat program through encrypted tunnel anyways.
The real problem... (Score:3, Insightful)
Time and resources will go into collecting and analysing the recorded voice conversations, which will be wasted, and oftentimes nobody will be bothered to think of other ways wiretap targets may be communicating.
The end of wiretapping (Score:5, Insightful)
LE needs to face up to the fact that their job is going to get harder, and there's just nothing they can do about it. Either they'll have to intercept communications by other-than-remote means (i.e. break into someone's house and install a bug), or socially engineer around crypto, or just somehow gather evidence about crimes by means completely different than intercepting communication.
It's a shame. There are probably legitimate uses for wiretapping, where it can be used to obtain information about actual crimes. But so much goodwill has been squandered (e.g. the drug war, etc) that I doubt many people will care about the loss of this tool. The terrorist angle probably helps a little, but people are getting pretty jaded about that too.
BOHICA.... (Score:3, Funny)
identification (Score:2, Interesting)
(It won't hurt,just a little pinch...)
Re:identification (Score:3, Interesting)
End-to-End Protocols, Man-In-The-Middle providers (Score:5, Informative)
For pure IP telephony, though, the obvious way to wiretap is to tweak the call setup, so instead of the voice channel going from Alice to Bob, there are two voice channels, from Alice-to-KGB and KGB-to-Bob. Even if there's end-to-end encryption on the voice channel (which is sadly lacking in too many implementations), that doesn't stop the wiretap from working, because the KGB is an endpoint and has the key. If you have an adequate public key infrastructure, you can prevent this by authenticating the call setup messages. But if you don't have that, you're toast; in some cases you can use SSH-like "remember the signature key they used last time" protocols, or you can read your Diffie-Hellman authentication message over the phone if you recognize the other person's voice, but for tricks like that, your VOIP software needs to give you visibility into and ideally control over that process.
So regulatable VOIP service providers, who handle the database lookup portion of calls in countries with wiretap-greedy spooks, may be forced to pay extra to develop wiretap-friendly control software. An intermediate step, which the FBI has been all too successfull in getting US regulators to approve, is to get visibility into the call setup process, similar to old-fashioned pen registers, so they at least know who's talking to whom, and can often get that from the telcos without a formal warrant, using some less-stringent process like an administrative subpoena, and often with gag orders forbidding the telco to tell the wiretap victim.
That's a big problem with closed applications such as Skype, by the way - even if they use some good crypto algorithms, which they say they do, you can't tell what they're doing with them, and whether they're leaking authentication information. (Too bad, because they're a non-US provider who might be harder to bully, at least if they build some corporate separation between their software developers and their VOIP-to-Telco service providers, which I'm not sure if they have.)
Asterisk is open-source, which has the advantage that you can see if something like that is built in, and also has the advantage that it's usually operated by end-users, not by service providers. The SIP protocol family is designed to support proxies and indirection which are useful in building services where some bits are managed by one entity and some by another, e.g. PBXs at both ends, a directory service provider or two in the middle, maybe some voicemail providers or conferencing servers or whatever - it's a big step up from the old H.323 protocols, which pretty much required building closed systems.
different countries, different laws. (Score:5, Insightful)
check [ ] to install the FBI backdoor,
check [ ] to install the EU backdoor,
check [ ] to install the Mossad backdoor,
check [ ] to install the Osama backdoor, or
check [ ] to install self compiled open source VoiP software without backdoors.
Easy to encrypt (Score:2)
An alternative would be to use encryption in IAX2, which a man named Mark Spencer is already working on. Running IAX over stunnel would probably be feasible if bo
Yeah, sure (Score:2)
skype encryption? (Score:4, Insightful)
On an install of Mepis some months ago, I found skype installed and set up. I believed then as I do now that if the Mepis developer or developers were getting any commission or compensation for providing a fully working skype setup by default, then it was a good thing as distro developers need all the support they can get. But some time last year when skype was hitting
One of the problems I continually run into in trusting skype is that the source code is not open. Skype hit upon a winner, and good for them. I'm not expecting them to make source code available so competitors can copy them and then compete. Or so end users may get some advantage by getting the source.
But when it comes to encryption, encryption products or services live or die by peer review. Other products have been shown to be faulty and insecure after peer review by professionals in the encryption field finding faults in the design or implementation or both. With skype, the only way to verify that their design and implementation of encryption is secure is by permitting other professionals in the encryption field to peer review the design and implementation. This would require their viewing of some or all of the source code for the client or end user app. Otherwise, at no point in time should anyone consider using skype for even normal conversations, since most people include financial or banking details, or other sensitive information while conducting personal telephone calls due to the more likely requirement for physical presence requirements for a telephone tap.
One of the downsides of telecoms jumping in on the voip bandwagon is that eventually enough people will be using non-secure voip that a threshold will be reached where the courts decide that no one should have a reasonable expectation of privacy during any call, and thus lowering the bar to the level of cordless phones and permissible interception and recording of such calls.
Skype may have a great service. From what I've read in the recent past about the number of new downloads of the client, Skype has a really great service. But one shouldn't expect any privacy at all, or that Skype can substitute for a land line phone in terms of permissible intercepting (and presence requirements for land lines) unless Skype opens up at least the encryption portion and someone like Zimmerman and others peer review the service and then announce that there is no reason for concern
I look forward to the time that we have end-to-end encryption just like we have (so far) end to end encryption with SSH, SSL, and similar technologies. I also look forward to seeing a report on Skype by Zimmerman and other peer reviewers. Until then, "trust us" is not enough for me, although Skype may be the service that escapes regulation and paves the way for future secure conversations. And if that happens, thanks Skype.
So Vonage can now listen to me and my girlfriend? (Score:3, Insightful)
How long before some 14 year old genius hacker discovers the VOIP backdoors and exploits and records converstations and posts them on the net to make a point?
There is a reason why network security exists... Its not perfect... but without it... we're in a world of shit.
And now our government wants us to install backdoors in everthing we use on the net? So much for security.
mandated backdoors (Score:2)
Police State (Score:4, Insightful)
Is this really a big deal (Score:3, Interesting)
For the techincal side (given that the providers being targeted under this law all have central servers somewhere one would assume), all they need is to plug a big storage device into their network and set things up to dump the audio stream for the phonecalls they are allowed to tap as it passes through the network (either still compressed with whatever compression the phones use or totally uncompressed). Then, provide whatever piece of software is needed to uncompress and listen to the phone calls and thats all the FBI needs.
OK. So what are free/OSS encrypted VOIP options? (Score:3, Interesting)
Bill of Rights, Crypto Communication Tools (Score:5, Informative)
Want to read my stuff? Go ahead and crack it - no warrant necessary.
Get the rabbit installed on a machine behind your firewall
==> http://freenet.sourceforge.net/ [sourceforge.net]
Faster than freenet
==> http://www.i2p.net/ [i2p.net]
Encrypt Jabber
==> http://www.vanemery.com/Linux/Jabber/jabberd.html [vanemery.com]
Onion Routing
==> http://tor.eff.org/ [eff.org]
Emerging Network To Reduce Orwellian Potency Yield
==> http://entropy.stop1984.com/ [stop1984.com]
Free Internet telephony
==> http://skype.com/ [skype.com]
GNU-ified P2p
==> http://www.gnu.org/software/gnunet/ [gnu.org]
DO NOT DENY yourself about 2 hours @ InfoAnarchy.org [infoanarchy.org]
OMG! ==> http://www.infoanarchy.org/wiki/index.php/Main_Pag e [infoanarchy.org]
LearnLearnLearnLearn ==> http://en.wikipedia.org/wiki/Cryptography [wikipedia.org]
=================EMAIL ENCRYPTION===============
GPG (Free PGP)
==> http://gnupg.org/ [gnupg.org]
Integrated with Thunderbird
==> http://enigmail.mozdev.org/ [mozdev.org]
Mutt can't be beat as a mailreader and integrates GPG wonderfully.
==> http://mutt.blackfish.org.uk/ [blackfish.org.uk]
==> http://www.mutt.org/links.html [mutt.org]
==> http://wiki.mutt.org/index.cgi?UserPages [mutt.org]
!!! Please do not immediately send newly created keys to the keyservers (as many HOWTOs instruct new users to). They are already overflowing with "test keys" and other people's experiments from over the years THAT HAVE NO EXPIRATION and will never be deleted. These keys are "orphans" and most will never be used. As keyservers sync together, and most keys are never deleted once submitted - GET YOUR KEY SETUP CORRECTLY AND HAVE PRACTICE WITH IT BEFORE SENDING IT OFF TO THE KEYSERVERS!!! Otherwise storage requirements will continue to grow and using these in the future will become more difficult FOR ALL. Please, if you are just starting out with PGP or GPG or GnuPG or anything similar (the last two are in fact the same thing) use manual key distribution to begin (ascii armor your public key with
$ gpg --export --armor my@email.address.org
and copy and paste it into an email body or attach it to an email
$ gpg --export --armor my@email.address.org > myPubKey.txt
to gain practice with GPG before uploading your key. This way if you need to create another you won't have uploaded your mistakes. Many choices need to be made and it's worth getting things right before "going public" with your new digital ID. Experiment with yourself and a few different email accounts or with some friends first.)
SET AN EXPIRATION OF 2-5 YEARS OR SO AND MAKE SURE YOU HAVE YOUR PREFERENCES THE WAY YOU LIKE THEM BEFORE SENDING TO A KEYSERVER! Better yet is to HOST YOUR KEY ON YOUR WEBSITE (or try using http://biglumber.com/ [biglumber.com] instead to host your key and help c
Search Me (Score:3, Insightful)
Solution is obvious (Score:3, Insightful)
SIP telephony is similar to HTTP. It's ordinarily unencrypted. But it can be tunnelled through any secure connection. Since there are open-source SIP clients in existence, it ought to be trivial to create a secure SIP using openSSL or some other cryptography library. It also ought to be possible to create a similar secure version of the IAX protocol {Inter-Asterisk eXchange} for when you have hardware SIP phones: use SIP from phone to PC running Asterisk, and S-IAX to the next link in the chain.
Depending upon the protocol, you would either use permanent public and private key pairs per person, or temporary session keys. Exchange of used session keys would give plausible deniability {since nobody can prove your correspondent didn't have the encrypting key when you sent them the message; so it might be total bollocks that they made up for reasons that don't concern you}.
Besides getting around Big Brother and the surveillance state, this sort of thing will also be useful in jurisdictions where governments are trying to ban VOIP altogether.