[unclug] anti-surveillance meeting?
Tom_Roche at unc.edu
Fri Sep 6 17:05:43 EDT 2013
>> some people expressed interest in getting students involved with the group
A topic that might be of interest:
> how US and UK spy agencies defeat internet privacy and security
> NSA surveillance: A guide to staying secure
> Bruce Schneier
> As was revealed today, the NSA also works with security product
> vendors to ensure that commercial encryption products are broken in
> secret ways that only it knows about. We know this has happened
> historically: CryptoAG and Lotus Notes are the most public examples,
> and there is evidence of a back door in Windows. A few people have
> told me some recent stories about their experiences, and I plan to
> write about them soon.
Perhaps we could get Padilla or Waddell to present on Outlook backdoors ?-)
> How do you communicate securely against [NSA-level surveillance]?
> Snowden said it in an online Q&A soon after he made his first
> document public: "Encryption works. Properly implemented
> strong crypto systems are one of the few things that you can rely on."
> five pieces of advice:
> 1) Hide in the network. Implement hidden services. Use Tor to
> anonymize yourself. Yes, the NSA targets Tor users, but it's work
> for them. The less obvious you are, the safer you are.
> 2) Encrypt your communications. Use TLS. Use IPsec. Again, while
> it's true that the NSA targets encrypted connections – and it may
> have explicit exploits against these protocols – you're much better
> protected than if you communicate in the clear.
> 3) Assume that while your computer can be compromised, it would take
> work and risk on the part of the NSA – so it probably isn't. If you
> have something really important, use an air gap. Since I started
> working with the Snowden documents, I bought a new computer that has
> never been connected to the internet. If I want to transfer a file,
> I encrypt the file on the secure computer and walk it over to my
> internet computer, using a USB stick. To decrypt something, I
> reverse the process. This might not be bulletproof, but it's pretty
> 4) Be suspicious of commercial encryption software, especially from
> large vendors. My guess is that most encryption products from large
> US companies have NSA-friendly back doors, and many foreign ones
> probably do as well. It's prudent to assume that foreign products
> also have foreign-installed backdoors. Closed-source software is
> easier for the NSA to backdoor than open-source software. Systems
> relying on master secrets are vulnerable to the NSA, through either
> legal or more clandestine means.
> 5) Try to use public-domain encryption that has to be compatible
> with other implementations. For example, it's harder for the NSA to
> backdoor TLS than BitLocker, because any vendor's TLS has to be
> compatible with every other vendor's TLS, while BitLocker only has
> to be compatible with itself, giving the NSA a lot more freedom to
> make changes. And because BitLocker is proprietary, it's far less
> likely those changes will be discovered. Prefer symmetric
> cryptography over public-key cryptography. Prefer conventional
> discrete-log-based systems over elliptic-curve systems; the latter
> have constants that the NSA influences when they can.
> Since I started working with Snowden's documents, I have been using
> GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit, and a few
> other things I'm not going to write about. There's an undocumented
> encryption feature in my Password Safe program from the command
> line); I've been using that as well.
> I understand that most of this is impossible for the typical
> internet user. Even I don't use all these tools for most everything
> I am working on. And I'm still primarily on Windows, unfortunately.
> Linux would be safer.
> The NSA has turned the fabric of the internet into a vast
> surveillance platform, but they are not magical. They're limited by
> the same economic realities as the rest of us, and our best defense
> is to make surveillance of us as expensive as possible.
Schneier was also on Democracy Now! today: from ~38-45 min into
FWIW, Tom Roche <Tom_Roche at pobox.com>
More information about the unclug