CryptoParty Observations

The CryptoParty phenomenon is past its first anniversary. The interest in cryptography and secure communication has always been there. The existence of CryptoParty before Edward Snowden leaked the criminal practices of secret services around the world is a good indicator for that. The questions is if crypto flash mobs of tutors and students can make a difference. Cryptography has deep roots in mathematics (which can and have to be reduced to a minimum when explaining, remember that every formula in an article for a wide audience halves your readership). In addition most tools used for encryption are not point-and-click capable (which is partly due to the user interface, but the real reason is the fact that secure communication doesn’t feature an on/off switch). Too bad. Despite these difficulties CryptoParty events work somehow. At almost all local events here participants learned something, tutors did too.

A couple of days ago someone asked me for a „mini crypto handbook with just the essentials“. I have given this idea some thoughts, but I doubt that you can improve your data’s and communication’s security by a short laundry list of things to do or not to do. You might get to the point of encryption quite fast, but managing the keys and verifying the identity of your communication partner(s) is the most important aspect. Then there is the problem that once data is decrypted it tends to leave residue in clear text. Unless you use encrypted storage all of the time and everywhere there is a chance that traces of data will leak and stay without cryptographic protection. It’s a bit like dealing with radioactive material – always use secure containers and equipment.

Give the extra effort of security all of our lives will still have an „unencrypted component“. You cannot securely communicate with partners who do not support secure communication. Calling a taxi, ordering pizza, phone calls with friends & family, even communication with companies or public authorities are probably easy to intercept. Observing the communication of an individual or an organisation as a whole can therefore be very informative if the pattern of encrypted and unencrypted information is analysed. If you only use cryptography when important, then you betray the fact that something interesting is going on. Using cryptography indiscriminately would be better – if it were possible with every communication end-point. Intelligence services know this, so does everyone else.

There are not short-cuts, it seems.

A Beacon of Opinions

Having privacy is nice these days. However maintaining a sense of privacy is hard when it comes to social media, blogs or other ways where you can leak personal information. Creating different accounts is a first step, but separating personal and professional opinion only works if you maintain the division all of the time. This must also be true for all connections to others, be it people or organisations. Once you make an exception, the whole concept doesn’t work any more. Your opinion will be the strongest beacon, and everyone with an honest interest in you will use it to connect. Privacy gone.

It’s not follow the money in the digital world. It’s follow the opinion.

Mißbrauch von Crypto durch Marketing

Die Deutsche Telekom, Web.de und GMX schalten nun die Transportverschlüsselung (nennt sich SSL/TLS) für versendete und empfangene E-Mails ein. Ganz toll. Andere verwenden diese Technologie schon seit etlichen Jahren. Die Branche feiert also eine Selbstverständlichkeit, die andere schon längst praktizieren. Fein, es gibt ja sonst keine guten Neuigkeiten über Telekommunikationsanbieter, die in den Wolken schweben. Zwei Dinge leistet SSL/TLS allerdings nicht.

  • Eine versendete E-Mail kann durch SSL/TLS nicht vor Dritten geschützt werden.
    Einem E-Mail-Server in der Zustellungskette stehen nach wie vor die Inhalte einer E-Mail zur Verfügung. Deswegen nennt sich die eingesetzte Verschlüsselung auch Transportverschlüsselung. Während des Transports wird die E-Mail verschlüsselt übertragen. An allen beteiligten Stationen liegt sie im Klartext vor. Transportverschlüsselung macht nur Sinn, um Dritten, die nur den Transport der E-Mails sehen (wie beispielsweise die Leute am Nebentisch im Internet-Café, der BND, GCHQ oder ein korrupter Mitarbeiter). Genau dafür war sie auch gedacht, nicht mehr und nicht weniger. Das jetzt als Schutz vor Überwachung zu feiern, speziell von Wolken- und Kommunikationsanbietern, die auf kompromittierter Infrastruktur sitzen, ist bestenfalls ein schlechter Witz.
  • SSL/TLS kann den Absender einer E-Mail nicht authentisieren.
    E-Mails können auch bei Transportverschlüsselung nach wie vor einen gefälschten Absender haben. Der Transportverschlüsselung ist es herzlich egal wer sie verwendet.

De-Mail ist übrigens auch nicht besser, egal was man einem da einreden möchte. Die Industrie folgt also der Politik und lügt Kunden an. Schöne neue Welt.

Wer sich für die Hintergründe interessiert oder wer auch mal große Firmen beim Lügen ertappen will, der/die/das schaue bitte zur nächstgelegenen CryptoParty.

Es gibt keine leichten Auswege aus dem Überwachungswahn

Seit Bekanntwerden des weltweiten Überwachungsskandals grassieren zwei konträre Ansichten durch das Internet. Die Eingeweihten und Paranoiker sagen: „Wir haben es immer schon gewußt.“ Man liebt es ja, wenn eine Verschwörungstheorie an Wahrheit gewinnt. Dem gegenüber stehen diejenigen, die den Rechthabern vorwerfen: „Ihr habt versagt.“ Den Satz gibt es auch als Selbsterkenntnis. Man kann sich jetzt eine der Seiten aussuchen und damit den eigenen Grad der Unglücklichkeit bestimmen. Das ist der einfache Weg. Es gibt noch einen differenzierten Ansatz, den niemand interessiert.

Dass man Kommunikation an natürlichen Engpässen überwachen kann, ist kein Geheimnis. Das ganze wird noch leichter, wenn man Klartext verwendet oder keine eigenen Schlüssel hat. Man kann nun lang und breit über dezentrale Systeme, Kryptographie, Schlüssellängen, supertolle Apps zu Abhilfe, eigene Infrastruktur und die Rettung der Welt durch Bits, Bytes und Mathematik reden. Man kann auch viel an den derzeit bekannten Lösungen für bestimmte Probleme herumkritisieren. Natürlich ist vieles Da Draußen™ nicht mit genial intuitiven Oberflächen versehen (dazu zählen aber auch Videorekorder). Wenn nur Eingeweihte Eingeweihtes bedienen und entwickeln, dann wird sich am bedienungsunfreundlichen Status Quo kaum etwas ändern. Es bedarf weiterer Dialoge zwischen den Kennern und den, die es benutzen, um diese Pattsituation aufzulösen. Dazu Bedarf es gegenseitigem Respekt zwischen denen, die etwas wissen, und denen, die etwas wissen – und etwas benutzen – wollen. Elitäres Herumgehampel (auf beiden Seiten wohlgemerkt) hilft nur den Geheimdiensten.

Dasselbe gilt für die Beschwerden über TOR und andere Anonymisierungsnetzwerke. Ich finde es toll, dass auch anderen die Langsamkeit von TOR auf die Nerven geht. Die langsamen Geschwindigkeiten liegen aber nicht nur am Code, sondern sie liegen auch daran, dass es einfach nicht genug TOR Nodes gibt. Der Grund dafür liegt wiederum daran, dass manche Internetanbieter den Betrieb von TOR Nodes untersagen und gleichzeitig Behörden prinzipiell den Betreibern von TOR Nodes das Leben schwer machen. Möchte man da Abhilfe schaffen, so bedarf es keiner Programmierarbeit. Man greife zum Telefon, Stift oder Drucker und verleihe dem Wunsch nach mehr TOR Nodes bei seinem Internetanbieter oder seinem Abgeordneten etwas Nachdruck. Internetanbieter könnten ja irgendwann TOR Dienste ins Portfolio aufnehmen (ja, man wird ja noch träumen dürfen).

Wer mehr TOR Nodes braucht, der kann auch welche kaufen. Torservers.net betreibt welche und bittet im Gegenzug um Unterstützung. Es gibt auch andere Organisationen, die dieses tun. Wieso nicht der Großmutter einfach einen TOR Node schenken und auf die Geburtstagskarte „Liebe Oma, dieser Betrag sorgt dafür, dass die Gestapo nicht wieder kommt.“ schreiben? Die (aussterbende) Kriegsgeneration freut sich sicherlich über eine solche Geste. Man kann ja auch notfalls Blumen oder Pralinen dazulegen.

Spy Service with Trust Issues

You really should have heard about PRISM and Tempora. You should know that this is only the part that was published with a source and some evidence of what’s going on. Keep in mind that there is a lot going on that we do not know about yet and probably never will. The fall-out of the scandal may be an eroded trust in IT staff and systems. The director of the N.S.A., Gen. Keith B. Alexander, has confirmed the lack of trust by establishing a buddy system for NSA’s IT staff. The concept isn’t new, and it’s used by the military, other agencies or in the field of cryptography.

The consequence rephrased reads like this: PRISM and Tempora have effectively destroyed the trust in IT systems – both for the people being victims of surveillance and the surveillants. The NSA now resorts to “a two-man rule” in order to restore trust internally (which will not prevent further whistle-blowers from leaking information). The victims try to restore trust by using encryption and tools to anonymise their communication. Both implications do not help either side. Furthermore the government agencies will continue their efforts and hide them from the general public in order to pursue their Greater Goal™ or the War on Stuff™.  Meanwhile everyone else is shopping ebay for slightly used civil rights.

A job well done. Let’s burn some books, basic liberties, journalists, and system administrators to make the world a better place.

Leistungsschutzrecht und Links

Google setzt den Wunsch der Verleger in Deutschland um und entfernt alle Links auf Zeitungsartikel. Ich werde diesem Beispiel folgen und auch keine Links mehr auf Artikel in Online-Zeitungen setzen. Hat man sich ja so oder ähnlich gewünscht.

  • Comments are off for Leistungsschutzrecht und Links
  • Tags:

“No wall can stand against the yearning of justice…”

Barack “I know what you did last Summer!” Obama held a speech in Berlin today. The Guardian has published the full text of it (and will probably be closed down and its staff will be sent to Guantánamo) on its web site. The speech contains a unique gem of sarcasm.

No wall can stand against the yearning of justice, the yearnings for freedom, the yearnings for peace that burns in the human heart.

I fully agree, but one of us is lying. NSA Director Keith “I owe him another friggin’ beer” Alexander has no interest in justice, freedom, and peace. Congratulations! You should have saved yourself the trouble of the American Revolution.

  • Comments are off for "No wall can stand against the yearning of justice…"
  • Tags:

PRISM, the „Cloud“ and Espionage

There should be no surprise about the PRISM initiative and NSA‘s activities. Some people became a member of the EFF on 12 September 2001. It is an illusion to believe that any collection of data is safe from access by third parties especially if it is stored in centralised locations. Sane critics have criticised the „Cloud“ since marketing departments discovered the brand name for centralised storage (the „Cloud“ may be dispersed, distributed, virtualised or whatever, but there are still „Cloud“ providers who hold the key access to the whole infrastructure). Right after 9/11 the term Total Information Awareness (TIA) was coined. Take a look at what TIA entails. This is what you see now, but don’t assume that only the USA do this.

Russia, China and the USA are the Axis of Surveillance. The differences are merely semantics. Some European states also pursue total information awareness. They just don’t talk about it, and there are no whistle-blowers – yet (hopefully). Once you rely on the infrastructure of other’s, be careful.

The next CryptoParty in Vienna will discuss countermeasures against surveillance by totalitarian regimes.

Communication by Whistle

I have seen a couple of CrypoParty events. People gather. Some people like their tools. Some people like to communicate. Some people like their personal agenda. If you are lucky, then the three biases match. More often than not you are not lucky. This is where the party gets interesting.

Since PRISM hit the news there’s been talk about the mechanics of whistle-blowing. You need a source, you need its content, you need someone willing to dig through this content, you need someone who is able to write about this discovery in the right manner, and — above all — you need to protect your source (i.e. the whistle-blower). That’s the theory. In practice this neat list of requirements usually breaks down at some point.

First of all there may be no source. Good journalists (very rare these days) might find out by themselves though. Getting sources means to be trustworthy, which is a problem on its own. You need to be reliable and you need to have a basic grasp of operations security to get this right — on both ends.

Then there is the content. Not everything is useful (see, this is where the agenda comes into play). Provided you want the content to be published, it should be something that matters. Leaking the user’s manual of the local latrine in Mazar-i-Sharif is of limited interest for the general public. Sad, but true.

Provided you have a source and the content. What do you do? Well, reading of taking a look at it would be terrific. Few people do. Why? Because you have to understand what the content means and what it is. If you can’t tell the design plans for a nuclear bomb from your shopping list, then you should ask someone for help. You need additional experts (who also know what operations security is). That’s the toughest task.

Let’s assume you were lucky and you actually made sense of the information you got. Great! All you have to do is to prepare your findings for publications. Regardless if you use pure text, audio recordings or video, you need to put the content into the right form. You will need to explain what it means, you have to talk about the implications, and you must find a language that can be understood by your audience. That’s even tougher than to understand what the content is about. You have to be the translator between different groups. You need to find the right metaphors and ways to emphasise the meaning of the leaked information.

The last part is the most important issue. You have to protect your source at all costs! That’s how it works. True, some have seen so much that they don’t care any more. Good for you, but even the most desperate source deserves protection from harm, be it physical injury, mental stress or regal repercussions. Can you do that?

And that’s why tools, agendas or (secure) communication are a good start — but you need a whole lot more.

Somebody is lying

Unless you have been living in a cave (or Abbottabad) for the past decade you have probably heard about NSA’s PRISM project. The security agencies have taken the „Cloud“ to the next level in order to access communication data and metadata. This is hardly a surprise for anyone keeping track of government activities. You don’t need strange conspiracy theories to stay sceptic. Provided someone wants to listen to the communication of non-US citizens and these non-US citizens use technology hosted in the US, then accessing the data gets a lot easier. The „Cloud“ is the best what could happen to agencies.

Of course the companies listed in the PRISM slide deck know nothing about it. Firstly everything except denying will hurt your business. Secondly all you need to not know anything any more is to receive a national security letter (NSL). Once you get this letter, you cannot say what’s going on behind the scenes. Too bad. Hence I’d take everything the compromised companies claim publicly with a large grain of salt. Press releases and speeches by CEOs usually have an agenda which doesn’t necessarily has something to do with truth.

No Work in Progress!

Beim Vermeiden der gedruckten Tageszeitung zum Frühstück bin ich über einen Blogartikel gestoßen, der die Zeile „Dieser Artikel ist noch work in progress.“ gleich nach dem Titel enthielt. Der Hinweis ist zwar nett gemeint, aber leider hilft das dem Leser (in diesem Falle ich, also kein -in) nicht.

Ein Artikel ist zum Zeitpunkt des Lesens durch Dritte fertig. Die Idee mit den Versionierungen oder Datumsangeben helfen da nicht. Warum? Weil es sich nicht um Software-Entwicklung handelt. Ein Autor kann nicht davon ausgehen, dass alle Leserinnen in periodischen Abständen wiederkehren und die neue Fassung lesen. Niemand macht das, nicht in Blogs, nicht bei digitalen Zeitungen oder Magazinen, nirgendwo. Alles das, was sich ein Autor beim Schreiben denkt, muß zum Zeitpunkt des Publizierens im Text enthalten sein. Natürlich neigt man dazu gelegentlich Sektionen mit dem klangvollen Update: hinzuzufügen. Man sollte sicher aber im Klaren darüber sein, dass es Leser, die den Text schon gelesen haben, nicht mehr verfolgen und daher auch nie sehen werden.

Helft mit das Internet sauber zu halten! Publiziert keine Entwürfe! Danke.

Travel

Yours truly has been without Internet recently. It’s amazing what a period of having crappy Internet connections can do to a mind. While tweets even fit through the smallest pipe most other content wasn’t accessible. This is actually a good thing. It clears some of the thoughts that clog your brain throughout the busy days with lots of routine, interruptions and information.

There are three things I do when being away. I have a look around. When being in your day job or at home there’s not much time for simply looking at something. You always have to be somewhere on time. No glimpsing, no observing, lots and lots of getting from A to B and not wasting time. Shame. Then there is writing. Writing something for the sake of spilling words is great. Just putting words on a page. No goal, no agenda, no thoughts of your audience in mind. Fun. And then there is photography. Just take the camera, walk around, have a hard look at what you can see, find a good spot and take a picture. Go where few people would go. Use angles few people would use. Rediscover the world.

We all should do this more often.

How not to keep a secret #DCRI

If you have a secret, then you probably will not talk about it. That’s a very basic fact about secrets. By not talking to others about your secret, these others will not know. So far so good. If your secret consists of a tower, an area and fences around it, then you have a hard time hiding this information. Your only option is to hide in plain sight, find a plausible explanation for the things people see and – again – not to talk about it. The French Direction centrale du renseignement intérieur (DCRI) has provided a lesson to show how it doesn’t work.

The Station hertzienne militaire de Pierre-sur-Haute is a French military compound. It has a Wikipedia page describing the location and its purpose along with photographs. Thanks to the DCRI everyone knows now that the article contains classified information. The DCRI summoned a Wikipedia systems administrator to their office and threatened him in order to force the deletion of the article. Keeping secrets by blackmailing is not going to work. In the age of satellites, Internet maps and drones there is no way you can prevent someone from taking photographs. De-emphasize, don’t make sure everyone focuses on your little secret. Distractions work, too. Area 51 is known for its UFO sightings and conspiracy theories. No one talks about the military prototypes being tested there. It’s all about aliens.

Maybe the DCRI should watch a couple of X Files episodes to get a clue.

Top