Crypto Easter Eggs in Software

The Logjam paranoia is spreading. After decades of using software with cryptographic features, every couple of months researchers discover features and code from the dawn of communication over the Internet. DES, 40/56/64 bit keys, RC4, 16 bit primes (yes, you read that right), and a lot more legacy cruft is still in memory on computer systems all over the world. Unless the code bases get cleaned up LibreSSL-style, there will be more of these ghosts from the past.

Delete these lines of code, remove the dependencies. No excuses.

Urgency gone totally wrong

Every once in a while someone has a problem that needs to be fixed. Or someone wants to ask something. Often it’s just about a task, a piece of information, an appointment, or similar. What do people do then? Well, if it’s really urgent you usually resort to synchronous communication such as the telephone. You can also call it smartphone, but it doesn’t change the fact that you pick up the phone and talk to someone in real time. That’s the theory. In fact people send emails, text messages (which might not get delivered), or private messages on obscure social media platform where you log in every three months.

Stupidity is on the rise.

New Year, Same Problems

Welcome to 2015! I am pretty sure you are amazed what the year has in stock for you. Go ahead, figure it out. Meanwhile I know some things haven’t changed. Hands-free kits.

I like headphones. It saves yourself from listening to the verbal diarrhoea of people talking in public. Noise-cancelling gear is especially helpful. Or headphones that have a tight grip on your ears, so no acoustic bullshit can get to you. Usually headphones work fairly well.

Then there are hands-free kits. Basically these kits are headphones you can talk to, because they listen. They come in all forms and flavours. Wired, wireless, colourful, with/without battery, with/without blue LEDs, etc.; amazing. Sometimes they even work. Most of the time they don’t. The battery is low. Cables break. You lose your earplugs. It’s windy outside. It rains. The wireless kits disconnect and re-connect, turning your conversation into a bad rap song. Environmental noise drowns anything you say. Perfect.

So, yes, 2015 is great.

Postfix outbound SMTP via TOR Hidden Service

I have been looking to link my portable Postfix on my laptop with another Postfix reachable by a TOR Hidden Service. I did some tinkering with TCP proxies, stunnel and other setups. Yesterday I found the article SMTP over Hidden Services which will do the trick. The description uses Postfix’ transport map to send  individual domain via the SMTP Hidden Service uplink. If you want all e-mails for all domains to go through the SMTP link, use the line

*   smtptor:[78uhrgdnsawillgetyoughe746.onion]

in your transport map after the .onion line. Works like a charm. The only downside is that I had to give up server certificate verification, but this can be done in a separate setup on the server side.

  • Comments are off for Postfix outbound SMTP via TOR Hidden Service
  • Tags:

Sandman Chronicles #65

Came across my copy of The Sandman Chronicles by Neil Gaiman . Browsed a bit. If you never read it, you really should. Found a quote from #65. It is from Rose Walker.

Have you ever been in love? Horrible, isn’t it? It makes you so vulnerable. It opens your chest and it opens up your heart and it means that someone can get inside you and mess you up. You build up all these defenses. You build up this whole armor, for years, so nothing can hurt you, then one stupid person, no different from any other stupid person, wanders into your stupid life… You give them a piece of you. They don’t ask for it. They do something dumb one day like kiss you, or smile at you, and then your life isn’t your own anymore. Love takes hostages. It gets inside you. It eats you out and leaves you crying in the darkness, so a simple phrase like “maybe we should just be friends” or “how very perceptive” turns into a glass splinter working its way into your heart. It hurts. Not just in the imagination. Not just in the mind. It’s a soul-hurt, a body-hurt, a real gets-inside-you-and-rips-you-apart pain. Nothing should be able to do that. Especially not love. I hate love.

  • Comments are off for Sandman Chronicles #65
  • Tags:

CryptoParty Observations

The CryptoParty phenomenon is past its first anniversary. The interest in cryptography and secure communication has always been there. The existence of CryptoParty before Edward Snowden leaked the criminal practices of secret services around the world is a good indicator for that. The questions is if crypto flash mobs of tutors and students can make a difference. Cryptography has deep roots in mathematics (which can and have to be reduced to a minimum when explaining, remember that every formula in an article for a wide audience halves your readership). In addition most tools used for encryption are not point-and-click capable (which is partly due to the user interface, but the real reason is the fact that secure communication doesn’t feature an on/off switch). Too bad. Despite these difficulties CryptoParty events work somehow. At almost all local events here participants learned something, tutors did too.

A couple of days ago someone asked me for a „mini crypto handbook with just the essentials“. I have given this idea some thoughts, but I doubt that you can improve your data’s and communication’s security by a short laundry list of things to do or not to do. You might get to the point of encryption quite fast, but managing the keys and verifying the identity of your communication partner(s) is the most important aspect. Then there is the problem that once data is decrypted it tends to leave residue in clear text. Unless you use encrypted storage all of the time and everywhere there is a chance that traces of data will leak and stay without cryptographic protection. It’s a bit like dealing with radioactive material – always use secure containers and equipment.

Give the extra effort of security all of our lives will still have an „unencrypted component“. You cannot securely communicate with partners who do not support secure communication. Calling a taxi, ordering pizza, phone calls with friends & family, even communication with companies or public authorities are probably easy to intercept. Observing the communication of an individual or an organisation as a whole can therefore be very informative if the pattern of encrypted and unencrypted information is analysed. If you only use cryptography when important, then you betray the fact that something interesting is going on. Using cryptography indiscriminately would be better – if it were possible with every communication end-point. Intelligence services know this, so does everyone else.

There are not short-cuts, it seems.

A Beacon of Opinions

Having privacy is nice these days. However maintaining a sense of privacy is hard when it comes to social media, blogs or other ways where you can leak personal information. Creating different accounts is a first step, but separating personal and professional opinion only works if you maintain the division all of the time. This must also be true for all connections to others, be it people or organisations. Once you make an exception, the whole concept doesn’t work any more. Your opinion will be the strongest beacon, and everyone with an honest interest in you will use it to connect. Privacy gone.

It’s not follow the money in the digital world. It’s follow the opinion.

Mißbrauch von Crypto durch Marketing

Die Deutsche Telekom, Web.de und GMX schalten nun die Transportverschlüsselung (nennt sich SSL/TLS) für versendete und empfangene E-Mails ein. Ganz toll. Andere verwenden diese Technologie schon seit etlichen Jahren. Die Branche feiert also eine Selbstverständlichkeit, die andere schon längst praktizieren. Fein, es gibt ja sonst keine guten Neuigkeiten über Telekommunikationsanbieter, die in den Wolken schweben. Zwei Dinge leistet SSL/TLS allerdings nicht.

  • Eine versendete E-Mail kann durch SSL/TLS nicht vor Dritten geschützt werden.
    Einem E-Mail-Server in der Zustellungskette stehen nach wie vor die Inhalte einer E-Mail zur Verfügung. Deswegen nennt sich die eingesetzte Verschlüsselung auch Transportverschlüsselung. Während des Transports wird die E-Mail verschlüsselt übertragen. An allen beteiligten Stationen liegt sie im Klartext vor. Transportverschlüsselung macht nur Sinn, um Dritten, die nur den Transport der E-Mails sehen (wie beispielsweise die Leute am Nebentisch im Internet-Café, der BND, GCHQ oder ein korrupter Mitarbeiter). Genau dafür war sie auch gedacht, nicht mehr und nicht weniger. Das jetzt als Schutz vor Überwachung zu feiern, speziell von Wolken- und Kommunikationsanbietern, die auf kompromittierter Infrastruktur sitzen, ist bestenfalls ein schlechter Witz.
  • SSL/TLS kann den Absender einer E-Mail nicht authentisieren.
    E-Mails können auch bei Transportverschlüsselung nach wie vor einen gefälschten Absender haben. Der Transportverschlüsselung ist es herzlich egal wer sie verwendet.

De-Mail ist übrigens auch nicht besser, egal was man einem da einreden möchte. Die Industrie folgt also der Politik und lügt Kunden an. Schöne neue Welt.

Wer sich für die Hintergründe interessiert oder wer auch mal große Firmen beim Lügen ertappen will, der/die/das schaue bitte zur nächstgelegenen CryptoParty.

Es gibt keine leichten Auswege aus dem Überwachungswahn

Seit Bekanntwerden des weltweiten Überwachungsskandals grassieren zwei konträre Ansichten durch das Internet. Die Eingeweihten und Paranoiker sagen: „Wir haben es immer schon gewußt.“ Man liebt es ja, wenn eine Verschwörungstheorie an Wahrheit gewinnt. Dem gegenüber stehen diejenigen, die den Rechthabern vorwerfen: „Ihr habt versagt.“ Den Satz gibt es auch als Selbsterkenntnis. Man kann sich jetzt eine der Seiten aussuchen und damit den eigenen Grad der Unglücklichkeit bestimmen. Das ist der einfache Weg. Es gibt noch einen differenzierten Ansatz, den niemand interessiert.

Dass man Kommunikation an natürlichen Engpässen überwachen kann, ist kein Geheimnis. Das ganze wird noch leichter, wenn man Klartext verwendet oder keine eigenen Schlüssel hat. Man kann nun lang und breit über dezentrale Systeme, Kryptographie, Schlüssellängen, supertolle Apps zu Abhilfe, eigene Infrastruktur und die Rettung der Welt durch Bits, Bytes und Mathematik reden. Man kann auch viel an den derzeit bekannten Lösungen für bestimmte Probleme herumkritisieren. Natürlich ist vieles Da Draußen™ nicht mit genial intuitiven Oberflächen versehen (dazu zählen aber auch Videorekorder). Wenn nur Eingeweihte Eingeweihtes bedienen und entwickeln, dann wird sich am bedienungsunfreundlichen Status Quo kaum etwas ändern. Es bedarf weiterer Dialoge zwischen den Kennern und den, die es benutzen, um diese Pattsituation aufzulösen. Dazu Bedarf es gegenseitigem Respekt zwischen denen, die etwas wissen, und denen, die etwas wissen – und etwas benutzen – wollen. Elitäres Herumgehampel (auf beiden Seiten wohlgemerkt) hilft nur den Geheimdiensten.

Dasselbe gilt für die Beschwerden über TOR und andere Anonymisierungsnetzwerke. Ich finde es toll, dass auch anderen die Langsamkeit von TOR auf die Nerven geht. Die langsamen Geschwindigkeiten liegen aber nicht nur am Code, sondern sie liegen auch daran, dass es einfach nicht genug TOR Nodes gibt. Der Grund dafür liegt wiederum daran, dass manche Internetanbieter den Betrieb von TOR Nodes untersagen und gleichzeitig Behörden prinzipiell den Betreibern von TOR Nodes das Leben schwer machen. Möchte man da Abhilfe schaffen, so bedarf es keiner Programmierarbeit. Man greife zum Telefon, Stift oder Drucker und verleihe dem Wunsch nach mehr TOR Nodes bei seinem Internetanbieter oder seinem Abgeordneten etwas Nachdruck. Internetanbieter könnten ja irgendwann TOR Dienste ins Portfolio aufnehmen (ja, man wird ja noch träumen dürfen).

Wer mehr TOR Nodes braucht, der kann auch welche kaufen. Torservers.net betreibt welche und bittet im Gegenzug um Unterstützung. Es gibt auch andere Organisationen, die dieses tun. Wieso nicht der Großmutter einfach einen TOR Node schenken und auf die Geburtstagskarte „Liebe Oma, dieser Betrag sorgt dafür, dass die Gestapo nicht wieder kommt.“ schreiben? Die (aussterbende) Kriegsgeneration freut sich sicherlich über eine solche Geste. Man kann ja auch notfalls Blumen oder Pralinen dazulegen.

Spy Service with Trust Issues

You really should have heard about PRISM and Tempora. You should know that this is only the part that was published with a source and some evidence of what’s going on. Keep in mind that there is a lot going on that we do not know about yet and probably never will. The fall-out of the scandal may be an eroded trust in IT staff and systems. The director of the N.S.A., Gen. Keith B. Alexander, has confirmed the lack of trust by establishing a buddy system for NSA’s IT staff. The concept isn’t new, and it’s used by the military, other agencies or in the field of cryptography.

The consequence rephrased reads like this: PRISM and Tempora have effectively destroyed the trust in IT systems – both for the people being victims of surveillance and the surveillants. The NSA now resorts to “a two-man rule” in order to restore trust internally (which will not prevent further whistle-blowers from leaking information). The victims try to restore trust by using encryption and tools to anonymise their communication. Both implications do not help either side. Furthermore the government agencies will continue their efforts and hide them from the general public in order to pursue their Greater Goal™ or the War on Stuff™.  Meanwhile everyone else is shopping ebay for slightly used civil rights.

A job well done. Let’s burn some books, basic liberties, journalists, and system administrators to make the world a better place.

Leistungsschutzrecht und Links

Google setzt den Wunsch der Verleger in Deutschland um und entfernt alle Links auf Zeitungsartikel. Ich werde diesem Beispiel folgen und auch keine Links mehr auf Artikel in Online-Zeitungen setzen. Hat man sich ja so oder ähnlich gewünscht.

  • Comments are off for Leistungsschutzrecht und Links
  • Tags:

“No wall can stand against the yearning of justice…”

Barack “I know what you did last Summer!” Obama held a speech in Berlin today. The Guardian has published the full text of it (and will probably be closed down and its staff will be sent to Guantánamo) on its web site. The speech contains a unique gem of sarcasm.

No wall can stand against the yearning of justice, the yearnings for freedom, the yearnings for peace that burns in the human heart.

I fully agree, but one of us is lying. NSA Director Keith “I owe him another friggin’ beer” Alexander has no interest in justice, freedom, and peace. Congratulations! You should have saved yourself the trouble of the American Revolution.

  • Comments are off for "No wall can stand against the yearning of justice…"
  • Tags:

PRISM, the „Cloud“ and Espionage

There should be no surprise about the PRISM initiative and NSA‘s activities. Some people became a member of the EFF on 12 September 2001. It is an illusion to believe that any collection of data is safe from access by third parties especially if it is stored in centralised locations. Sane critics have criticised the „Cloud“ since marketing departments discovered the brand name for centralised storage (the „Cloud“ may be dispersed, distributed, virtualised or whatever, but there are still „Cloud“ providers who hold the key access to the whole infrastructure). Right after 9/11 the term Total Information Awareness (TIA) was coined. Take a look at what TIA entails. This is what you see now, but don’t assume that only the USA do this.

Russia, China and the USA are the Axis of Surveillance. The differences are merely semantics. Some European states also pursue total information awareness. They just don’t talk about it, and there are no whistle-blowers – yet (hopefully). Once you rely on the infrastructure of other’s, be careful.

The next CryptoParty in Vienna will discuss countermeasures against surveillance by totalitarian regimes.

Top