Live data from Hacker News

Encrypt your Google chats and make the NSA sad

github.com

131–140 of 195 posts

Re: Encrypt your Google chats and make the NSA sad

#131
post #2

As far as I can tell, this is using CBC mode without any authentication: https://raw.github.com/mdp/gibberish-aes/master/dist/gibberi... If that's the case, then this implementation is vulnerable to a variety of attacks.

Thanks, can you suggest me a better AES implementation ?

Wait, you're trying to beat NSA by writing your own crypto? This is worse than useless :), all you'll do is flag that communication for further research (which the NSA will then break within a couple of hours if need be), at least with plain text you'll stay in the noise of the masses.

Re: Encrypt your Google chats and make the NSA sad

#132
post #6

Still waiting for Google to implement OTR and ZRTP in Hangouts by default... especially now after all this.

Have a good time waiting, sir. In the meanwhile you might be interested in the following fact: 1. Google is removing XMPP as protocol http://www.zdnet.com/google-moves-away-from-the-xmpp-open-me... 2. On the other hand, however, duckduck is giving us some alternatives https://duck.co/topic/duckduckgo-s-new-public-xmpp-jabber-se...

Forget about DuckDuckGo, it's based in the US. Better use Startpage.com, which is based in the Netherlands.

Re: Encrypt your Google chats and make the NSA sad

#135

Earlier quoted context omitted.

Partisan towards... what? He is a very strong civil libertarian.

Here's Glenn either being intellectually dishonest or intellectually incompetent. http://www.samharris.org/blog/item/dear-fellow-liberal2

When I read that I see Sam Harris attributing things like "honor killings" to the doctrine of Islam as if Islam is a monolithic entity. He's equating the extremists with the mainstream and that is exactly what the islamaphobes do - insist that the crazies are the ones who have the true interpretation of islam and that the vast majority of regular muslims don't count because they aren't crazy. It is kind of like saying that all christians should be judged by the actions of the Westboro Baptists. The crazies get the headlines but they only define the fringe, not the mainstream.

FWIW, the one thing I can agree with Sam Harris on is that European integration of muslims (and other minorities) is slow compared to the US because they have less of a commitment to freedom of speech. For all of our racial problems, the US does a better job of integrating immigrant communities because we have a culture of airing our dirty laundry, of hashing out our feelings - bigotry and all - and thus working through the differences rather than sheltering people from possibly being offended. Its ugly and frequently unpleasant but in the long run I think we reach a level of accommodation a lot sooner.

FWIW, I'm an atheist who married a woman from an immigrant muslim family although I've probably been in more mosques than she has.

Re: Encrypt your Google chats and make the NSA sad

#136
post #97
post #47

Earlier quoted context omitted.

Intercept could also mean man-in-the-middle.

Which would be trivial if they had agreements with the various mostly US providers to quickly get man-in-the-middle signed keys from their CA's. Although this seems like it would be quick to spot since if you were watching certificate fingerprints change then you'd see the switchover and switchback.

I use the Cert Patrol plugin ( http://patrol.psyced.org/ ) and I've noticed periods of a few days to a week where SSL certs on major sites like google have changed rapidly. Usually they were all from the same authority so I didn't think much of it. But now I am even more paranoid. Thanks man.

Re: Encrypt your Google chats and make the NSA sad

#137
post #80
post #78

Earlier quoted context omitted.

Not even then. I remember reading about how he uses the freest (as in freedomest) setup he can get: http://stallman.org/stallman-computing.html He mentions its a Lemote machine which doesn't look like it uses an AMD/Intel processor, as it uses Longsoon: http://en.wikipedia.org/wiki/Loongson "Unlike processors from Intel, Advanced Micro Devices or VIA Technologies, Loongson does not support the x86 instruction set. Th…

Actually, iirc the Chinese made that processor because they were afraid of the US putting backdoors in Intel and AMD chips

So they put theirs.

Just kidding, obviously. But one can't be sure their hardware's all right, unless they go way beyond what we'd consider reasonable.

Re: Encrypt your Google chats and make the NSA sad

#138
post #131

Earlier quoted context omitted.

Thanks, can you suggest me a better AES implementation ?

Wait, you're trying to beat NSA by writing your own crypto? This is worse than useless :), all you'll do is flag that communication for further research (which the NSA will then break within a couple of hours if need be), at least with plain text you'll stay in the noise of the masses.

I don't want to beat the NSA, I was just asking for a better javascript AES script. I have nothing to hide, that's why I would be very happy to get out of the noise of the masses and make the NSA waste a couple of hours :)

Re: Encrypt your Google chats and make the NSA sad

#140
post #4

While this is a nice effort, why use Google Talk at all for chatting if you're going to do all this effort (per user configuration etc) if you could just use an XMPP client with OTR[1] support, or use an XMPP server you can trust? [1] https://en.wikipedia.org/wiki/Off-the-Record_Messaging

Because then you'd be talking to yourself as nobody uses XMPP with OTR.

At least Adium, Gajim, Kopete and qutIM have built-in OTR support.

So, I guess, it's a bit more than nobody.

Post reply on HN