Encrypt your Google chats and make the NSA sad

#1

Post by salade_verte » Mon, Jun 10, 2013, 6:11 PM UTC

Encrypt your Google chats and make the NSA sad
github.com

Re: Encrypt your Google chats and make the NSA sad

#2

Post by sweis » Mon, Jun 10, 2013, 6:37 PM UTC

As far as I can tell, this is using CBC mode without any authentication: https://raw.github.com/mdp/gibberish-aes/master/dist/gibberi...

If that's the case, then this implementation is vulnerable to a variety of attacks.

Re: Encrypt your Google chats and make the NSA sad

#3

Post by rogerbraun » Mon, Jun 10, 2013, 6:38 PM UTC

I like this, but the easiest way to do this without pretty much any configuration is to log in to Google Talk with a Jabber client that has OTR support, such as Adium or Pidgin.

Re: Encrypt your Google chats and make the NSA sad

#4

Post by sspiff » Mon, Jun 10, 2013, 6:39 PM UTC

While this is a nice effort, why use Google Talk at all for chatting if you're going to do all this effort (per user configuration etc) if you could just use an XMPP client with OTR[1] support, or use an XMPP server you can trust?

[1] https://en.wikipedia.org/wiki/Off-the-Record_Messaging

Re: Encrypt your Google chats and make the NSA sad

#5

Post by switch33 » Mon, Jun 10, 2013, 6:42 PM UTC

Somewhat relevant(IRC for gmail): https://github.com/progrium/irc-for-gmail

Also, it sucks that this AES plugin for gmail uses greasemonkey. There are a bunch of exploits abusing greasemonkey really.

Re: Encrypt your Google chats and make the NSA sad

#6

Post by mtgx » Mon, Jun 10, 2013, 6:43 PM UTC

Still waiting for Google to implement OTR and ZRTP in Hangouts by default...especially now after all this.

Re: Encrypt your Google chats and make the NSA sad

#7

Post by chubot » Mon, Jun 10, 2013, 6:44 PM UTC

sweis wrote: post #2

As far as I can tell, this is using CBC mode without any authentication: https://raw.github.com/mdp/gibberish-aes/master/dist/gibberi... If that's the case, then this implementation is vulnerable to a variety of attacks.

Oh cool, I am on stage 3 of the Matasano challenge which covers this. I am learning something useful. :)

Re: Encrypt your Google chats and make the NSA sad

#8

Post by freshhawk » Mon, Jun 10, 2013, 6:48 PM UTC

This would definitely be the level of security that falls under this statement from Snowden:

Q: Is it possible to put security in place to protect against state surveillance?

A: "You are not even aware of what is possible. The extent of their capabilities is horrifying. We can plant bugs in machines. Once you go on the network, I can identify your machine. You will never be safe whatever protections you put in place."

(from http://www.guardian.co.uk/world/2013/jun/09/nsa-whistleblowe...)

Re: Encrypt your Google chats and make the NSA sad

#9

Post by dlss » Mon, Jun 10, 2013, 6:56 PM UTC

"A" for effort, but I won't be happy until something like this also obscures who you are talking to.

Re: Encrypt your Google chats and make the NSA sad

#10

Post by rubikscube » Mon, Jun 10, 2013, 6:56 PM UTC

freshhawk wrote: post #8

This would definitely be the level of security that falls under this statement from Snowden: Q: Is it possible to put security in place to protect against state surveillance? A: "You are not even aware of what is possible. The extent of their capabilities is horrifying. We can plant bugs in machines. Once you go on the network, I can identify your machine. You will never be safe whatever protections you put in place.…

This talk about "bugs" in machines makes one wonder if that is related to why Intel was one of the companies mentioned in a recent article. Intel stands apart from the rest of the companies. Google, Apple, Facebook don't specialize in hardware.