Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypt your Google chats and make the NSA sad

github.com

Post reply on HN
Print view View original

81–90 of 195 posts

Re: Encrypt your Google chats and make the NSA sad

#81

Post by anologwintermut »

sweis wrote: post #2

As far as I can tell, this is using CBC mode without any authentication: https://raw.github.com/mdp/gibberish-aes/master/dist/gibberi... If that's the case, then this implementation is vulnerable to a variety of attacks.

It's worse that that. It uses a questionable javascript crypt library (written by a former twitter dev, not a cryptographer) and a fixed IV derived from the password which is re-used for each message. This is oh I read the wikipedia article on AES level cryptography deployed against people who would have written the Wikipedia entry if not for that fact that what they know is probably not public.

Better idea: Just make a plugin that uses OTR[0]. Don't try to roll your own crypto, especially when you are up against people who know what they are doing. [0] http://www.cypherpunks.ca/otr/

Re: Encrypt your Google chats and make the NSA sad

#83

Post by 205guy »

freshhawk wrote: post #8

This would definitely be the level of security that falls under this statement from Snowden: Q: Is it possible to put security in place to protect against state surveillance? A: "You are not even aware of what is possible. The extent of their capabilities is horrifying. We can plant bugs in machines. Once you go on the network, I can identify your machine. You will never be safe whatever protections you put in place.…

Further thinking along this line: most people in the world today are dependent on their phones and internet for information and communication. A lot of people suspected total listening capabilities and now we mostly know that's the case. But what if the NSA had total interference capabilities, as Snowden's quote implies? I suspect it does.

I've been finding HN to be a hub for all the facets, ideas, and fallout from this news. And the snowball of issues (privacy, gov't, business, foreign relations, internationl trade, future of the internet) is worrying to me. But what if it were suddenly gone?

And just as I had that thought, I started getting errors reloading this thread and the main page. Maybe HN is straining at the traffic, but what if some of that traffic came from somewhere else or some server was remotely hobbled? What if your ISP had "disruptions" of traffic to _your_ IP addres, or your 3G/4G became spotty?

Imagine if someone with total knowledge could track the spread of keywords through networks (physical and social) and then enable "slow-downs" to keep the level of spreading below a critical threshhold? If I didn't see all the articles subitted to HN or didn't have time to read them all because the servers crashed, then I might not be so alarmed at the situation.

We in the US and other European nations go on happily enjoying freedom to access all this information, unlike many countries, but would we know if or when we couldn't anymore?

Coincidence or not: when I tried to submit this, I got a message saying "Oops, our bad. If you see this a lot, shoot us an email at info@ycombinator.com. Be sure to tell us your IP. Sorry, news.ycombinator.com is currently unavailable. Please try again soon." Maybe I need to take some keywords out of the text...

Re: Encrypt your Google chats and make the NSA sad

#84

Post by XorNot »

downandout wrote: post #75
freshhawk wrote: post #8

This would definitely be the level of security that falls under this statement from Snowden: Q: Is it possible to put security in place to protect against state surveillance? A: "You are not even aware of what is possible. The extent of their capabilities is horrifying. We can plant bugs in machines. Once you go on the network, I can identify your machine. You will never be safe whatever protections you put in place.…

> We can plant bugs in machines. I've long thought that NSA and CIA would be buyers of access to botnets with backdoor access to people's machines in the US and abroad. You can buy surreptitious installs of your own malware from other malware providers very cheaply - usually under $1. $300 million and you have the whole US covered. It wouldn't surprise me a bit if there is a budget for this, with agents actively inte…

Or you know, he's referring to actually physically bugging the machine with a hardware keylogger. Which, for someone you're interested in, is way more reliable then simply hoping they're still using unpatched Windows.

Re: Encrypt your Google chats and make the NSA sad

#85

Post by [deleted] »

freshhawk wrote: post #8

This would definitely be the level of security that falls under this statement from Snowden: Q: Is it possible to put security in place to protect against state surveillance? A: "You are not even aware of what is possible. The extent of their capabilities is horrifying. We can plant bugs in machines. Once you go on the network, I can identify your machine. You will never be safe whatever protections you put in place.…

[deleted]

Re: Encrypt your Google chats and make the NSA sad

#86

Post by andreyf »

leot wrote: post #57

Google, Yahoo, and Microsoft could all make the vast majority of email vastly more secure by implementing PGP-by-default. Send: You enter an email address, a little key appears beside it if it's recognized as having an associated public key, and a warning appears that the email can't be encrypted if an additional email address is entered that doesn't have an associated key. Receive: email encrypted with your public k…

Where would the private keys be stored? What happens if I lose my laptop?

Re: Encrypt your Google chats and make the NSA sad

#87

Post by andreyf »

leot wrote: post #57

Google, Yahoo, and Microsoft could all make the vast majority of email vastly more secure by implementing PGP-by-default. Send: You enter an email address, a little key appears beside it if it's recognized as having an associated public key, and a warning appears that the email can't be encrypted if an additional email address is entered that doesn't have an associated key. Receive: email encrypted with your public k…

Where would the private keys be stored? How do you handle the use-case of a non-technical user losing their laptop?

Re: Encrypt your Google chats and make the NSA sad

#88

Post by andreyf »

leot wrote: post #57

Google, Yahoo, and Microsoft could all make the vast majority of email vastly more secure by implementing PGP-by-default. Send: You enter an email address, a little key appears beside it if it's recognized as having an associated public key, and a warning appears that the email can't be encrypted if an additional email address is entered that doesn't have an associated key. Receive: email encrypted with your public k…

Where would the private keys be stored? How do you handle the use-case of a non-technical user losing their laptop?

Re: Encrypt your Google chats and make the NSA sad

#89

Post by andreyf »

leot wrote: post #57

Google, Yahoo, and Microsoft could all make the vast majority of email vastly more secure by implementing PGP-by-default. Send: You enter an email address, a little key appears beside it if it's recognized as having an associated public key, and a warning appears that the email can't be encrypted if an additional email address is entered that doesn't have an associated key. Receive: email encrypted with your public k…

Where would the private keys be stored? How do you handle the use-case of a non-technical user losing their laptop?

Re: Encrypt your Google chats and make the NSA sad

#90

Post by andreyf »

leot wrote: post #57

Google, Yahoo, and Microsoft could all make the vast majority of email vastly more secure by implementing PGP-by-default. Send: You enter an email address, a little key appears beside it if it's recognized as having an associated public key, and a warning appears that the email can't be encrypted if an additional email address is entered that doesn't have an associated key. Receive: email encrypted with your public k…

Where would the private keys be stored? How do you handle the use-case of a non-technical user losing their laptop?
Post reply on HN