Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypt your Google chats and make the NSA sad

github.com

Post reply on HN
Print view View original

141–150 of 195 posts

Re: Encrypt your Google chats and make the NSA sad

#141

Post by salade_verte »

mcpherrinm wrote: post #38
salade_verte wrote: post #11

Earlier quoted context omitted.

Thanks, can you suggest me a better AES implementation ?

If you're asking that question, and really aim to write crypto safe from the NSA, then I think you have a lot more learning to do. Just naming off a different mode isn't going to cut it. The Matasano crypto challenges seem to be popular lately. That would be a decent place to start.

I'm happy with AES and I don't want to write my own crypto.

I was asking for a better AES javascript library, because I found a couple of different js AES libraries, but, as you said, I don't know anything about cryptography, and I wanted to know if some are better than others.

thanks

Re: Encrypt your Google chats and make the NSA sad

#142

Post by patrickaljord »

drdaeman wrote: post #140
patrickaljord wrote: post #76

Earlier quoted context omitted.

Because then you'd be talking to yourself as nobody uses XMPP with OTR.

At least Adium, Gajim, Kopete and qutIM have built-in OTR support. So, I guess, it's a bit more than nobody.

Yeah I remember using OTR on kopete when I was in college. I had one instance opened on my laptop and the other on my PC. It was pretty cool and easy to set up. What wasn't easy was finding anyone I knew to talk to with beside the few other linux nerds at school.

Re: Encrypt your Google chats and make the NSA sad

#143

Post by jafaku »

bdamm wrote: post #39
salade_verte wrote: post #11

Earlier quoted context omitted.

Thanks, can you suggest me a better AES implementation ?

Your implementation is vulnerable to MITM attacks. That will be the case no matter which AES mode you choose. You are on the tip of the greatest problem with modern cryptography, which is that there is no real way for widespread confidentiality to be created without trusting a third party such as a CA. But once you trust a CA, then you become vulnerable to the backdoors available through the CA community (not just on…

Does bitmessage have anything to do with this?

Re: Encrypt your Google chats and make the NSA sad

#144

Post by magic_haze »

leot wrote: post #101
andreyf wrote: post #87

Earlier quoted context omitted.

Where would the private keys be stored? How do you handle the use-case of a non-technical user losing their laptop?

I'm talking about the non-extreme-security case of where the online email provider stores your private keys.

So, in practical terms, how would this be more secure than what we have now? The main crux of PRISM is that they have highly automated mechanisms of accessing user data from many major internet companies. If you store your private keys alongside that, what are you trying to protect against?

Re: Encrypt your Google chats and make the NSA sad

#145

Post by mpyne »

salade_verte wrote: post #138
mpyne wrote: post #131

Earlier quoted context omitted.

Wait, you're trying to beat NSA by writing your own crypto? This is worse than useless :), all you'll do is flag that communication for further research (which the NSA will then break within a couple of hours if need be), at least with plain text you'll stay in the noise of the masses.

I don't want to beat the NSA, I was just asking for a better javascript AES script. I have nothing to hide, that's why I would be very happy to get out of the noise of the masses and make the NSA waste a couple of hours :)

Don't get me wrong; I use crypto too (GPG), but NSA is not the ones I'm worried about. ;)

Re: Encrypt your Google chats and make the NSA sad

#146

Post by leot »

sliverstorm wrote: post #125
leot wrote: post #107

Earlier quoted context omitted.

I don't understand why everyone seems to think this is an issue. It's as though the only alternative to the status quo is local host browser-level crypto. The implementation I'm referring to doesn't preclude Gmail from reading emails it has of yours. It just means that only Gmail can read them, because only Gmail has your private key, a private key that's associated with two-factor authentication, and a private key y…

That would work fine, if all the NSA did was sniff traffic on the backbones.

The idea that the biggest reason to have PGP is to protect ourselves from some nefarious gov't entity is silly, though in the longer-run it can definitely help make this happen. PGP/PKI affords incredible technological advantages. If webmail providers offered it, OpenID (etc., etc.) would become quickly redundant (e.g.).

Re: Encrypt your Google chats and make the NSA sad

#147

Post by dlss »

Groxx wrote: post #46
dlss wrote: post #9

"A" for effort, but I won't be happy until something like this also obscures who you are talking to.

Be happy: https://github.com/prof7bit/TorChat (description: https://github.com/prof7bit/TorChat/wiki )

Wow -- that does make me happy. Thanks for the link!

(Also: Pascal?! I guess I can't complain -- I'm just glad this exists :)

Re: Encrypt your Google chats and make the NSA sad

#148

Post by cpleppert »

xefer wrote: post #45
tlrobinson wrote: post #43

Earlier quoted context omitted.

Possibly, if they had say, a backdoor in all Intel/AMD processors. The question is what he meant by "We can plant bugs in machines."

"We can plant bugs in machines" to me sounds more like a clue that this guy really doesn't know what the hell he's talking about.

Weird phrasing for starters. I mean that isn't how one would describe malware or a rootkit. I can't imagine hardware would be worth the effort if you can just as easily compromise the OS with physical access.

I just don't know what to make of this guys story. He has no high school diploma, started out as a security guard and was then given a diplomat cover as a system administrator?

He further claims that his job as a systems administrator gave him access to NSA analyst intercept software which I find difficult to believe. I can't imagine use of the software isn't physically locked to a machine in a secure environment. You wouldn't expect a systems administrator to have access to everything, which he claims he had, everything is compartmentalized.

Re: Encrypt your Google chats and make the NSA sad

#149

Post by unreal37 »

downandout wrote: post #75
freshhawk wrote: post #8

This would definitely be the level of security that falls under this statement from Snowden: Q: Is it possible to put security in place to protect against state surveillance? A: "You are not even aware of what is possible. The extent of their capabilities is horrifying. We can plant bugs in machines. Once you go on the network, I can identify your machine. You will never be safe whatever protections you put in place.…

> We can plant bugs in machines. I've long thought that NSA and CIA would be buyers of access to botnets with backdoor access to people's machines in the US and abroad. You can buy surreptitious installs of your own malware from other malware providers very cheaply - usually under $1. $300 million and you have the whole US covered. It wouldn't surprise me a bit if there is a budget for this, with agents actively inte…

I think he's referring to how the CIA was able to get the Stuxnet/Flame worm to disrupt the Iran nuclear centrifuges.[1] If the CIA or NSA want to put a virus on your machine, they can. Easily.

They can literally plant a worm or virus anywhere they want, because humans make mistakes. Heck, imagine they have hacked into the Windows auto-updater somehow and your own computer downloads and installs software on the first Tuesday every month without you even doing anything.

[1] http://www.news.com.au/technology/cia-suspected-for-super-we...

Post reply on HN