Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It’s Always Sunny in Reykjavik or How I NSA-Proofed My Email (2013)

27months.com

Post reply on HN
Print view View original

21–30 of 53 posts

Re: It’s Always Sunny in Reykjavik or How I NSA-Proofed My Email (2013)

#21

Post by rsync »

darklajid wrote: post #18

My biggest gripe is not the server (I run my own), it's the client(s). Currently I use Trojita on the desktop and K-9 on my mobile. I never managed to get PGP to play with Trojita, so for signing/encrypting/decrypting I have Claws installed as well. Trojita often randomly hangs and needs to be killed. K-9 is functional, but is to mail what Gimp is to painting.. Mailpile (I'm a backer) might be interesting, but is sti…

I'm curious - have you ever used a text/curses based email client ? It's amazingly fast and you can forget all about browser security since you do it over SSH. It's an extremely efficient workflow (albeit with some hacks required to get modern functionality).

I switched to pine in ... 1993 ? I've never used anything else (except for brief stints of corporate email account and consulting, many years ago).

You'll note that in the "screenshots from famous developers"[1] that Brian Kernighan (Unix legend, the K in K&R and AWK) is using alpine in his 2015 screenshot...

[1] https://anders.unix.se/2015/12/10/screenshots-from-developer...

Re: It’s Always Sunny in Reykjavik or How I NSA-Proofed My Email (2013)

#22

Post by drzaiusapelord »

rsync wrote: post #19

In his "overview of features" he is missing one very interesting and valuable security gain when you host your own mail server: - local mail delivery does not traverse any network So if you are user A on a mailserver and your wife/friend/uncle is user B, when you send mail to them that mail is simply a local copy operation (provided they don't POP or IMAP it to a local mailtool). That's pretty interesting, I think. I…

Well, its going over ssh which uses networking. If you're viewing the email on a networked terminal connection, its still traversing a network as it displays it in pine and that data gets sent over ssh. I don't see why using ssh suddenly makes you immune to these concerns. This is no different than using a rich webmail client over SSL.

Re: It’s Always Sunny in Reykjavik or How I NSA-Proofed My Email (2013)

#23

Post by emmetjumbleio »

throwaway7767 wrote: post #8
pvg wrote: post #3

The idea that putting your server in Iceland somehow makes it NSA-proof seems questionable. If anything, Google's servers in the US are likely better protected both legally and by Google's resources. The FBI had little trouble getting access to Robert Ulbricht's servers, with the help of the Reykjavik Metropolitan Police.

> The FBI had little trouble getting access to Robert Ulbricht's servers, with the help of the Reykjavik Metropolitan Police. Notably in that case, the Icelandic police did not even seek a court order, as they didn't need to since the server was owned by a US citizen. They just got a letter from the US police and decided to perform a raid. So you're absolutely right. I'd question the technical compentency of anyone w…

Europe is a safer place than Iceland to host data and it will be interesting to watch how the "Microsoft" case plays out in the Irish courts over the coming months.

Re: It’s Always Sunny in Reykjavik or How I NSA-Proofed My Email (2013)

#24

Post by darklajid »

plue wrote: post #9

Maybe you would like to fix your crypto a bit too? https://starttls.info/check/27months.com

So, your link lead me down a rabbit hole to improve my score on a random site, until I came here [1] and read the Postfix opinion on starttls.info.

For anyone else trying to 'fix' unbroken things: Hold off for a minute, read the link here first.

1: http://postfix.1071664.n5.nabble.com/Disabling-Anonymous-Dif...

Re: It’s Always Sunny in Reykjavik or How I NSA-Proofed My Email (2013)

#25

Post by [deleted] »

grhmc wrote: post #14
Spooky23 wrote: post #2

How do you prevent mail that you send from going to recipients whose mail is not hosted in your magical Icelandic data bunker? End of the day, all of this stuff is nonsense. The only thing standing between your stuff and unauthorized access is your contract and the actions of the third party running the datacenter. The only way you can exert any meaningful control over your data is to host it yourself... as in have c…

Then you have to make sure all your hardware wasn't Carly Fiorina'd through an NSA shipment interception.

[deleted]

Re: It’s Always Sunny in Reykjavik or How I NSA-Proofed My Email (2013)

#26

Post by darklajid »

rsync wrote: post #21
darklajid wrote: post #18

My biggest gripe is not the server (I run my own), it's the client(s). Currently I use Trojita on the desktop and K-9 on my mobile. I never managed to get PGP to play with Trojita, so for signing/encrypting/decrypting I have Claws installed as well. Trojita often randomly hangs and needs to be killed. K-9 is functional, but is to mail what Gimp is to painting.. Mailpile (I'm a backer) might be interesting, but is sti…

I'm curious - have you ever used a text/curses based email client ? It's amazingly fast and you can forget all about browser security since you do it over SSH. It's an extremely efficient workflow (albeit with some hacks required to get modern functionality). I switched to pine in ... 1993 ? I've never used anything else (except for brief stints of corporate email account and consulting, many years ago). You'll note…

Yes. I was using (al)pine for a while. It's bearable, okay even.

But I guess I don't see how you could turn that into a 'mobile' client. For the time I used pine I was ssh-ing into a box of mine for most of the day, while I was in front of a computer. I didn't care much about mail notifications on the go.

Now I do. If there's some (reliable! I don't care about the initial one-off effort) way to make that work with emails on the go, I'd be glad to learn about that.

Re: It’s Always Sunny in Reykjavik or How I NSA-Proofed My Email (2013)

#27

Post by throwaway7767 »

emmetjumbleio wrote: post #23
throwaway7767 wrote: post #8

Earlier quoted context omitted.

> The FBI had little trouble getting access to Robert Ulbricht's servers, with the help of the Reykjavik Metropolitan Police. Notably in that case, the Icelandic police did not even seek a court order, as they didn't need to since the server was owned by a US citizen. They just got a letter from the US police and decided to perform a raid. So you're absolutely right. I'd question the technical compentency of anyone w…

Europe is a safer place than Iceland to host data and it will be interesting to watch how the "Microsoft" case plays out in the Irish courts over the coming months.

Safer for whom, and from whom?

If your adversary is the NSA, you need to determine how interested they are in you. If you're on the shortlist, I doubt any national borders or legal frameworks will protect you - TAO doesn't respect them.

If it's law enforcement like in the Ulbricht case, some countries may have stricter requirements for a local search warrant to be issued. But I doubt you can make such a sweeping generalisation about "europe".

Re: It’s Always Sunny in Reykjavik or How I NSA-Proofed My Email (2013)

#28

Post by nikcub »

venomsnake wrote: post #17
nikcub wrote: post #16

In marketing speak "NSA proof" is the new post-Snowden[1] "military grade encryption" Email is hard to secure and identified personal accounts are difficult to keep private. The "better" answer is to do what those on Wall St figured out after various scandals and Sarbanes-Oxley - if you want something to remain private keep it off email. [1] Sorry.

>Email is hard to secure Email is trivial to secure. Just need to be able to exchange OOB one RSA key. But being able to securely communicate with "isis_recruiter34@jihadistan.jihad" don't give you much when LEO knows that you are communicating with each other. Nowadays you need security, anonymity and usability - which are often with contradicting requirements.

We're talking past the difference in email, the protocol, that can be secured - and email, the worldwide communication network, that is largely insecure[1] [2]

[1] https://www.nicta.com.au/pub-download/full/8943/

[2] https://www.google.com/transparencyreport/userdatarequests/?...

Re: It’s Always Sunny in Reykjavik or How I NSA-Proofed My Email (2013)

#29

Post by jbandela1 »

I think the author is extremely misguided.

1) Iceland is not a safe harbor from the NSA. Iceland is fully within the U.S. orbit. Iceland, actually does not maintain a standing army and its defense is the responsibility of the U.S. In addition, banking is a significant portion of Iceland's economy, and thus vulnerable to the U.S. cutting of access to SWIFT. Basically, if the U.S. really wants something from Iceland, it will be able to get it.

2) By making the front page of HN, the author is sure to have been noticed by somebody at the NSA. Because, the NSA has pretty broad authorizations for intercepting and decrypting foreign messages (that is actually why they exist), there is a very good chance that they are probably reading the author's email right now. If the email server had been in the U.S., there would have been at least some political/legal considerations about reading the email. By being in Iceland, there are none, and I am sure the author's email presented a very easy challenge (and probably is the butt of an inside joke about how this naive person thought their setup was NSA-proof)

Re: It’s Always Sunny in Reykjavik or How I NSA-Proofed My Email (2013)

#30

Post by nikcub »

throwaway7767 wrote: post #8
pvg wrote: post #3

The idea that putting your server in Iceland somehow makes it NSA-proof seems questionable. If anything, Google's servers in the US are likely better protected both legally and by Google's resources. The FBI had little trouble getting access to Robert Ulbricht's servers, with the help of the Reykjavik Metropolitan Police.

> The FBI had little trouble getting access to Robert Ulbricht's servers, with the help of the Reykjavik Metropolitan Police. Notably in that case, the Icelandic police did not even seek a court order, as they didn't need to since the server was owned by a US citizen. They just got a letter from the US police and decided to perform a raid. So you're absolutely right. I'd question the technical compentency of anyone w…

> Notably in that case, the Icelandic police did not even seek a court order, as they didn't need to since the server was owned by a US citizen.

And the trial judge didn't allow Ulbricht's challenge to suppress that evidence[1] on fourth amendment grounds as Ulbricht didn't claim or demonstrate ownership of the server[2]

Which is a shame, as it would have been an interesting case and could have changed a lot of that trial.

[1] and everything that followed per fruit of poisonous tree - which was most of the case

[2] http://www.wired.com/2014/10/silk-road-judge-technicality/

Post reply on HN