They mentioned having a "web of trust" to help fight spam. But if you use that, doesn't it mean someone like NSA, who can get everyone's public keys (which I assume is what they're going to use for this, just like for PGP), could then identify who are the people talking to each other, and essentially invalidate all their metadata gather protections? Or would that key be ephemeral, too?
Announcing The Dark Mail Alliance – Founded by Silent Circle and Lavabit
41–50 of 217 posts
Re: Announcing The Dark Mail Alliance – Founded by Silent Circle and Lavabit
#42I hope they are successful. For a long time I have wished that someone with the expertise and time would be motivated to create a new email system from the ground up, and make that system widely available and 'open' (in the sense of open protocols).
There are many challenges, but if they can pull it off there are many benefits as well. And perhaps the nicest part is that it is hard to actively oppose such efforts without revealing an intent.
Re: Announcing The Dark Mail Alliance – Founded by Silent Circle and Lavabit
#43Earlier quoted context omitted.
I thought even extremely strong encryption was computationally quite light- it's cracking the crypto that takes computing muscle.
Maybe they are going to require "Proof of work" - https://bitcoin.it/wiki/Proof_of_work
If only there was some way to make spammers do the work of Bitcoin miners....
Re: Announcing The Dark Mail Alliance – Founded by Silent Circle and Lavabit
#44What's wrong with bitmessage?
Bitmessage doesn't scale, it's POW doesn't solve any spam problems, and it's largely insecure. There's been quite a lot of public discussion about just how hilariously insecure it is.
I didn't know that. Is anyone working on an improved version? It seems like a great idea in principle.
Re: Announcing The Dark Mail Alliance – Founded by Silent Circle and Lavabit
#45I appreciate the cheekiness of calling it the "Dark Mail Alliance", but from a purely PR perspective, it would make sense to reconsider your name if you are taking the position that encrypted end-to-end email is not solely an interest of those pursuing shady or deviant activities.
Re: Announcing The Dark Mail Alliance – Founded by Silent Circle and Lavabit
#46"Stay connected with the Dark Mail Alliance [Enter your e-mail] "
And over an unencrypted channel no less, www.darkmail.info doesn't have ssl, so the NSA will know if you are interested.
Re: Announcing The Dark Mail Alliance – Founded by Silent Circle and Lavabit
#47Anyone gone through the checklist yet? http://craphound.com/spamsolutions.txt
What's the relevance? This isn't a spam fighting endeavor.
When you go through the trouble of reinventing email to provide proper security, you should also solve the spam problem as part of the protocol.
It would be great if the recipient could specify the amount of proof of work required for example. Or ask for a certain amount of bitcoin in exchange for accepting promotional material. Or a mail attribute that indicates it's a newsletter. Lots of interesting possibilities.
Re: Announcing The Dark Mail Alliance – Founded by Silent Circle and Lavabit
#48SPOILER:
A year from now we find out this is an NSA black ops project.
Re: Announcing The Dark Mail Alliance – Founded by Silent Circle and Lavabit
#49Sounds like another reinvention of the wheel, the "email" part of http://retroshare.sourceforge.net/
Re: Announcing The Dark Mail Alliance – Founded by Silent Circle and Lavabit
#50Earlier quoted context omitted.
Bitmessage doesn't scale, it's POW doesn't solve any spam problems, and it's largely insecure. There's been quite a lot of public discussion about just how hilariously insecure it is.
I didn't know that. Is anyone working on an improved version? It seems like a great idea in principle.
There's room for improvement, but there's a lot of core issues that just can't be flushed out.
The concept of the POW is to stop spam, as all addresses are inevitably public, it doesn't really work though, as spammers typically have access to botnets which can spam all day long. Normal users just have to wait minutes to send a message.
The scale issue is a weird one, they plan to split the network into different "streams" with different address types, which just sort of muddles the entire setup. Ultimately the limit is how much CPU and bandwidth the network can survive with while mirroring the entire content of the entire network.
There's lots of problems with timing attacks that have been "resolved" with random sleeps, though nobody is really convinced of that too much.