161–170 of 240 posts
Earlier quoted context omitted.
If we had more systems capable of resisting a local search and seizure this might be the case but as it stands almost none do.
Oh no, you're describing the solution rather than the problem: a global search, copy, and seizure converted to a local one that happens on per-target basis. Way better than mass collection with FISA warrants and systems like QUANTUM.
Earlier quoted context omitted.
I would argue the biggest downside to encrypted email is the sender, recipient, date, and size are known to all intermediaries. First of all, sometimes knowing who you talk to is more important than knowing what you say. Traffic analysis lets you draw all kinds of conclusions. Secondly, there are two parties, so double the chances for rubber hose cryptography. An opponent can approach either party and ask for details…
If you don't trust the other party you should not be sending him sensitive data. He has to be able to see it so of course he will be able to reveal it.
If you really want secure email, having it hosted and owned by a U.S. company is a recipe for disaster. Since we know that the U.S. gov't will gladly issue gag orders and blackmail, why even bother? It's great that Lavabit is innovating but Protonmail is already ahead by simply not being in the U.S..
If you really want secure email, having it hosted and owned by a U.S. company is a recipe for disaster. Since we know that the U.S. gov't will gladly issue gag orders and blackmail, why even bother? It's great that Lavabit is innovating but Protonmail is already ahead by simply not being in the U.S..
So the employees of their "support centers in [California]"[0] can't be blackmailed and gagged? Or do they not have access to the systems? [0] https://protonmail.com/about
Not saying this is what happened of course but without legislation all 'secure servers' must be considered corrupted or corruptible. There isn't a technical solution to trust.
..or even going into extreme tinfoil hat mode - how do we even know this is the same person. Again no technical solution
Edit: why the down vote? - perhaps a counter argument would be better, I'd like to be proved wrong.
Earlier quoted context omitted.
> > Search isn't possible > It absolutely is, in both theory and practice. The server stores an encrypted index, and the client walks it (requesting parts as needed). It's going to little slower, and a lot more complex but it's doable. Are you suggesting that to search your mailbox, the client should download every single encrypted message in the entire mailbox and decrypt them all locally to search them? If not, how…
So what, you hash each word in the e-mail and search for the hash, and this returns which emails include those hashed words? Would that be horribly insecure? I guess it would be impossible to salt those hashes, and it probably risks defeating the whole crypto.
You wouldn't use a hashing algorithm to build the index. They are talking about an inverted index in a binary format, something like what lucene outputs. That binary index would be encrypted with a block cipher (AES, Blowfish) using a secret key and would then be stored on the server.
The mobile client comes along and downloads & decrypts the index in memory, searches it for some terms(s), the index returns 10 result, of which, the user selects one and the mobile client downloads and decrypts to show to the user.
If I was a government spook I'd set up an email service, then make a big show of closing it down because the government. Then decide to make a big show of 'No, Security is paramount' and reopen my mail service. Not saying this is what happened of course but without legislation all 'secure servers' must be considered corrupted or corruptible. There isn't a technical solution to trust. ..or even going into extreme tinf…
Well, there is but it's not email and it's not as convenient as end to end encrypted messages. You just need to meet up once in a while -not a problem for most communication-and exchange random data which you use either to encrypt the whole message one time pad style, or piece by piece as passwords. One pair of random data per contact. Lavabit or spookmail or whoever don't get anything exciting to look at other than who is communicating.
If I was a government spook I'd set up an email service, then make a big show of closing it down because the government. Then decide to make a big show of 'No, Security is paramount' and reopen my mail service. Not saying this is what happened of course but without legislation all 'secure servers' must be considered corrupted or corruptible. There isn't a technical solution to trust. ..or even going into extreme tinf…
"There isn't a technical solution to trust." Well, there is but it's not email and it's not as convenient as end to end encrypted messages. You just need to meet up once in a while -not a problem for most communication-and exchange random data which you use either to encrypt the whole message one time pad style, or piece by piece as passwords. One pair of random data per contact. Lavabit or spookmail or whoever don't…
Earlier quoted context omitted.
he has said that he used pgp in his emails with poitras and greenwald because he knew from personal experience that, properly implemented, nsa was unable to decrypt messages protected with it
Are you saying he didn't use Lavabit and Cryptocat?