• Posted on August 20, 2016 at 5:48 pm

HBO’s John Oliver took a close look at the state of journalism. Everyone is in dire need of facts and story research. No one wants to pay, as it seems. This is not really the truth. It’s a simplification. Every newspaper has its online edition. Contrary to paper the digital articles allow for the sampling of statistics. The paper edition throws a few hundred grams of data into a mailbox. There is no feedback channel. You do not know who reads which article. You do not even know how many people read the paper. You may know some information about your readers from the data subscribers leave voluntarily. That’s it.

The online edition offers much more feedback. You can track users. You can record their favourite interests. You can take the time spent on the web site. You can do a lot more. What if I don’t want to be tracked? Where is the Do Not Track button in the online form for buying subscriptions? Someone isn’t paying attention.

I read a couple of news outlets (let’s use this term). I cannot afford to buy a subscription for all sources. This brings me to another business model that is absent from the market. I would like to read articles from many newspapers and pay by article at the end of the month. Trouble is that this requires a cross-newspaper identification which in turn can be used for tracking again (and it can only be done in an ideal world where copyrighted material can be syndicated easily, so it is pure fiction). Facebook and Google think about this for some time. I would prefer the news without the tracking.

So who wants to sell me some news?

Crypto Easter Eggs in Software

  • Posted on May 27, 2015 at 12:59 am

The Logjam paranoia is spreading. After decades of using software with cryptographic features, every couple of months researchers discover features and code from the dawn of communication over the Internet. DES, 40/56/64 bit keys, RC4, 16 bit primes (yes, you read that right), and a lot more legacy cruft is still in memory on computer systems all over the world. Unless the code bases get cleaned up LibreSSL-style, there will be more of these ghosts from the past.

Delete these lines of code, remove the dependencies. No excuses.

Urgency gone totally wrong

  • Posted on April 24, 2015 at 11:04 am

Every once in a while someone has a problem that needs to be fixed. Or someone wants to ask something. Often it’s just about a task, a piece of information, an appointment, or similar. What do people do then? Well, if it’s really urgent you usually resort to synchronous communication such as the telephone. You can also call it smartphone, but it doesn’t change the fact that you pick up the phone and talk to someone in real time. That’s the theory. In fact people send emails, text messages (which might not get delivered), or private messages on obscure social media platform where you log in every three months.

Stupidity is on the rise.

New Year, Same Problems

  • Posted on January 2, 2015 at 10:49 pm

Welcome to 2015! I am pretty sure you are amazed what the year has in stock for you. Go ahead, figure it out. Meanwhile I know some things haven’t changed. Hands-free kits.

I like headphones. It saves yourself from listening to the verbal diarrhoea of people talking in public. Noise-cancelling gear is especially helpful. Or headphones that have a tight grip on your ears, so no acoustic bullshit can get to you. Usually headphones work fairly well.

Then there are hands-free kits. Basically these kits are headphones you can talk to, because they listen. They come in all forms and flavours. Wired, wireless, colourful, with/without battery, with/without blue LEDs, etc.; amazing. Sometimes they even work. Most of the time they don’t. The battery is low. Cables break. You lose your earplugs. It’s windy outside. It rains. The wireless kits disconnect and re-connect, turning your conversation into a bad rap song. Environmental noise drowns anything you say. Perfect.

So, yes, 2015 is great.

CryptoParty Observations

  • Posted on October 11, 2013 at 10:23 pm

The CryptoParty phenomenon is past its first anniversary. The interest in cryptography and secure communication has always been there. The existence of CryptoParty before Edward Snowden leaked the criminal practices of secret services around the world is a good indicator for that. The questions is if crypto flash mobs of tutors and students can make a difference. Cryptography has deep roots in mathematics (which can and have to be reduced to a minimum when explaining, remember that every formula in an article for a wide audience halves your readership). In addition most tools used for encryption are not point-and-click capable (which is partly due to the user interface, but the real reason is the fact that secure communication doesn’t feature an on/off switch). Too bad. Despite these difficulties CryptoParty events work somehow. At almost all local events here participants learned something, tutors did too.

A couple of days ago someone asked me for a „mini crypto handbook with just the essentials“. I have given this idea some thoughts, but I doubt that you can improve your data’s and communication’s security by a short laundry list of things to do or not to do. You might get to the point of encryption quite fast, but managing the keys and verifying the identity of your communication partner(s) is the most important aspect. Then there is the problem that once data is decrypted it tends to leave residue in clear text. Unless you use encrypted storage all of the time and everywhere there is a chance that traces of data will leak and stay without cryptographic protection. It’s a bit like dealing with radioactive material – always use secure containers and equipment.

Give the extra effort of security all of our lives will still have an „unencrypted component“. You cannot securely communicate with partners who do not support secure communication. Calling a taxi, ordering pizza, phone calls with friends & family, even communication with companies or public authorities are probably easy to intercept. Observing the communication of an individual or an organisation as a whole can therefore be very informative if the pattern of encrypted and unencrypted information is analysed. If you only use cryptography when important, then you betray the fact that something interesting is going on. Using cryptography indiscriminately would be better – if it were possible with every communication end-point. Intelligence services know this, so does everyone else.

There are not short-cuts, it seems.

A Beacon of Opinions

  • Posted on September 16, 2013 at 12:30 am

Having privacy is nice these days. However maintaining a sense of privacy is hard when it comes to social media, blogs or other ways where you can leak personal information. Creating different accounts is a first step, but separating personal and professional opinion only works if you maintain the division all of the time. This must also be true for all connections to others, be it people or organisations. Once you make an exception, the whole concept doesn’t work any more. Your opinion will be the strongest beacon, and everyone with an honest interest in you will use it to connect. Privacy gone.

It’s not follow the money in the digital world. It’s follow the opinion.

Es gibt keine leichten Auswege aus dem Überwachungswahn

  • Posted on July 7, 2013 at 8:58 pm

Seit Bekanntwerden des weltweiten Überwachungsskandals grassieren zwei konträre Ansichten durch das Internet. Die Eingeweihten und Paranoiker sagen: „Wir haben es immer schon gewußt.“ Man liebt es ja, wenn eine Verschwörungstheorie an Wahrheit gewinnt. Dem gegenüber stehen diejenigen, die den Rechthabern vorwerfen: „Ihr habt versagt.“ Den Satz gibt es auch als Selbsterkenntnis. Man kann sich jetzt eine der Seiten aussuchen und damit den eigenen Grad der Unglücklichkeit bestimmen. Das ist der einfache Weg. Es gibt noch einen differenzierten Ansatz, den niemand interessiert.

Dass man Kommunikation an natürlichen Engpässen überwachen kann, ist kein Geheimnis. Das ganze wird noch leichter, wenn man Klartext verwendet oder keine eigenen Schlüssel hat. Man kann nun lang und breit über dezentrale Systeme, Kryptographie, Schlüssellängen, supertolle Apps zu Abhilfe, eigene Infrastruktur und die Rettung der Welt durch Bits, Bytes und Mathematik reden. Man kann auch viel an den derzeit bekannten Lösungen für bestimmte Probleme herumkritisieren. Natürlich ist vieles Da Draußen™ nicht mit genial intuitiven Oberflächen versehen (dazu zählen aber auch Videorekorder). Wenn nur Eingeweihte Eingeweihtes bedienen und entwickeln, dann wird sich am bedienungsunfreundlichen Status Quo kaum etwas ändern. Es bedarf weiterer Dialoge zwischen den Kennern und den, die es benutzen, um diese Pattsituation aufzulösen. Dazu Bedarf es gegenseitigem Respekt zwischen denen, die etwas wissen, und denen, die etwas wissen – und etwas benutzen – wollen. Elitäres Herumgehampel (auf beiden Seiten wohlgemerkt) hilft nur den Geheimdiensten.

Dasselbe gilt für die Beschwerden über TOR und andere Anonymisierungsnetzwerke. Ich finde es toll, dass auch anderen die Langsamkeit von TOR auf die Nerven geht. Die langsamen Geschwindigkeiten liegen aber nicht nur am Code, sondern sie liegen auch daran, dass es einfach nicht genug TOR Nodes gibt. Der Grund dafür liegt wiederum daran, dass manche Internetanbieter den Betrieb von TOR Nodes untersagen und gleichzeitig Behörden prinzipiell den Betreibern von TOR Nodes das Leben schwer machen. Möchte man da Abhilfe schaffen, so bedarf es keiner Programmierarbeit. Man greife zum Telefon, Stift oder Drucker und verleihe dem Wunsch nach mehr TOR Nodes bei seinem Internetanbieter oder seinem Abgeordneten etwas Nachdruck. Internetanbieter könnten ja irgendwann TOR Dienste ins Portfolio aufnehmen (ja, man wird ja noch träumen dürfen).

Wer mehr TOR Nodes braucht, der kann auch welche kaufen. betreibt welche und bittet im Gegenzug um Unterstützung. Es gibt auch andere Organisationen, die dieses tun. Wieso nicht der Großmutter einfach einen TOR Node schenken und auf die Geburtstagskarte „Liebe Oma, dieser Betrag sorgt dafür, dass die Gestapo nicht wieder kommt.“ schreiben? Die (aussterbende) Kriegsgeneration freut sich sicherlich über eine solche Geste. Man kann ja auch notfalls Blumen oder Pralinen dazulegen.

Spy Service with Trust Issues

  • Posted on June 26, 2013 at 4:06 pm

You really should have heard about PRISM and Tempora. You should know that this is only the part that was published with a source and some evidence of what’s going on. Keep in mind that there is a lot going on that we do not know about yet and probably never will. The fall-out of the scandal may be an eroded trust in IT staff and systems. The director of the N.S.A., Gen. Keith B. Alexander, has confirmed the lack of trust by establishing a buddy system for NSA’s IT staff. The concept isn’t new, and it’s used by the military, other agencies or in the field of cryptography.

The consequence rephrased reads like this: PRISM and Tempora have effectively destroyed the trust in IT systems – both for the people being victims of surveillance and the surveillants. The NSA now resorts to “a two-man rule” in order to restore trust internally (which will not prevent further whistle-blowers from leaking information). The victims try to restore trust by using encryption and tools to anonymise their communication. Both implications do not help either side. Furthermore the government agencies will continue their efforts and hide them from the general public in order to pursue their Greater Goal™ or the War on Stuff™.  Meanwhile everyone else is shopping ebay for slightly used civil rights.

A job well done. Let’s burn some books, basic liberties, journalists, and system administrators to make the world a better place.

Leistungsschutzrecht und Links

  • Posted on June 23, 2013 at 9:45 pm

Google setzt den Wunsch der Verleger in Deutschland um und entfernt alle Links auf Zeitungsartikel. Ich werde diesem Beispiel folgen und auch keine Links mehr auf Artikel in Online-Zeitungen setzen. Hat man sich ja so oder ähnlich gewünscht.

  • Comments are off for Leistungsschutzrecht und Links
  • Tags:

“No wall can stand against the yearning of justice…”

  • Posted on June 19, 2013 at 11:10 pm

Barack “I know what you did last Summer!” Obama held a speech in Berlin today. The Guardian has published the full text of it (and will probably be closed down and its staff will be sent to Guantánamo) on its web site. The speech contains a unique gem of sarcasm.

No wall can stand against the yearning of justice, the yearnings for freedom, the yearnings for peace that burns in the human heart.

I fully agree, but one of us is lying. NSA Director Keith “I owe him another friggin’ beer” Alexander has no interest in justice, freedom, and peace. Congratulations! You should have saved yourself the trouble of the American Revolution.

  • Comments are off for "No wall can stand against the yearning of justice…"
  • Tags:

PRISM, the „Cloud“ and Espionage

  • Posted on June 19, 2013 at 12:47 pm

There should be no surprise about the PRISM initiative and NSA‘s activities. Some people became a member of the EFF on 12 September 2001. It is an illusion to believe that any collection of data is safe from access by third parties especially if it is stored in centralised locations. Sane critics have criticised the „Cloud“ since marketing departments discovered the brand name for centralised storage (the „Cloud“ may be dispersed, distributed, virtualised or whatever, but there are still „Cloud“ providers who hold the key access to the whole infrastructure). Right after 9/11 the term Total Information Awareness (TIA) was coined. Take a look at what TIA entails. This is what you see now, but don’t assume that only the USA do this.

Russia, China and the USA are the Axis of Surveillance. The differences are merely semantics. Some European states also pursue total information awareness. They just don’t talk about it, and there are no whistle-blowers – yet (hopefully). Once you rely on the infrastructure of other’s, be careful.

The next CryptoParty in Vienna will discuss countermeasures against surveillance by totalitarian regimes.

Communication by Whistle

  • Posted on June 11, 2013 at 12:58 am

I have seen a couple of CrypoParty events. People gather. Some people like their tools. Some people like to communicate. Some people like their personal agenda. If you are lucky, then the three biases match. More often than not you are not lucky. This is where the party gets interesting.

Since PRISM hit the news there’s been talk about the mechanics of whistle-blowing. You need a source, you need its content, you need someone willing to dig through this content, you need someone who is able to write about this discovery in the right manner, and — above all — you need to protect your source (i.e. the whistle-blower). That’s the theory. In practice this neat list of requirements usually breaks down at some point.

First of all there may be no source. Good journalists (very rare these days) might find out by themselves though. Getting sources means to be trustworthy, which is a problem on its own. You need to be reliable and you need to have a basic grasp of operations security to get this right — on both ends.

Then there is the content. Not everything is useful (see, this is where the agenda comes into play). Provided you want the content to be published, it should be something that matters. Leaking the user’s manual of the local latrine in Mazar-i-Sharif is of limited interest for the general public. Sad, but true.

Provided you have a source and the content. What do you do? Well, reading of taking a look at it would be terrific. Few people do. Why? Because you have to understand what the content means and what it is. If you can’t tell the design plans for a nuclear bomb from your shopping list, then you should ask someone for help. You need additional experts (who also know what operations security is). That’s the toughest task.

Let’s assume you were lucky and you actually made sense of the information you got. Great! All you have to do is to prepare your findings for publications. Regardless if you use pure text, audio recordings or video, you need to put the content into the right form. You will need to explain what it means, you have to talk about the implications, and you must find a language that can be understood by your audience. That’s even tougher than to understand what the content is about. You have to be the translator between different groups. You need to find the right metaphors and ways to emphasise the meaning of the leaked information.

The last part is the most important issue. You have to protect your source at all costs! That’s how it works. True, some have seen so much that they don’t care any more. Good for you, but even the most desperate source deserves protection from harm, be it physical injury, mental stress or regal repercussions. Can you do that?

And that’s why tools, agendas or (secure) communication are a good start — but you need a whole lot more.

Somebody is lying

  • Posted on June 8, 2013 at 4:32 pm

Unless you have been living in a cave (or Abbottabad) for the past decade you have probably heard about NSA’s PRISM project. The security agencies have taken the „Cloud“ to the next level in order to access communication data and metadata. This is hardly a surprise for anyone keeping track of government activities. You don’t need strange conspiracy theories to stay sceptic. Provided someone wants to listen to the communication of non-US citizens and these non-US citizens use technology hosted in the US, then accessing the data gets a lot easier. The „Cloud“ is the best what could happen to agencies.

Of course the companies listed in the PRISM slide deck know nothing about it. Firstly everything except denying will hurt your business. Secondly all you need to not know anything any more is to receive a national security letter (NSL). Once you get this letter, you cannot say what’s going on behind the scenes. Too bad. Hence I’d take everything the compromised companies claim publicly with a large grain of salt. Press releases and speeches by CEOs usually have an agenda which doesn’t necessarily has something to do with truth.