UNC Linux Users Group

[Tom Roche <Tom_Roche AT unc.edu>]

https://lists.ibiblio.org/sympa/arc/unclug/2013-August/000541.html
>> some people expressed interest in getting students involved with the group

A topic that might be of interest:

http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security
> how US and UK spy agencies defeat internet privacy and security

http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance
> NSA surveillance: A guide to staying secure
> Bruce Schneier        

...

> As was revealed today, the NSA also works with security product
> vendors to ensure that commercial encryption products are broken in
> secret ways that only it knows about. We know this has happened
> historically: CryptoAG and Lotus Notes are the most public examples,
> and there is evidence of a back door in Windows. A few people have
> told me some recent stories about their experiences, and I plan to
> write about them soon.

Perhaps we could get Padilla or Waddell to present on Outlook backdoors ?-)

> How do you communicate securely against [NSA-level surveillance]?
> Snowden said it in an online Q&A soon after he made his first
> document public: "Encryption works. Properly implemented
> strong crypto systems are one of the few things that you can rely on."

...

> five pieces of advice:

> 1) Hide in the network. Implement hidden services. Use Tor to
> anonymize yourself. Yes, the NSA targets Tor users, but it's work
> for them. The less obvious you are, the safer you are.

> 2) Encrypt your communications. Use TLS. Use IPsec. Again, while
> it's true that the NSA targets encrypted connections – and it may
> have explicit exploits against these protocols – you're much better
> protected than if you communicate in the clear.

> 3) Assume that while your computer can be compromised, it would take
> work and risk on the part of the NSA – so it probably isn't. If you
> have something really important, use an air gap. Since I started
> working with the Snowden documents, I bought a new computer that has
> never been connected to the internet. If I want to transfer a file,
> I encrypt the file on the secure computer and walk it over to my
> internet computer, using a USB stick. To decrypt something, I
> reverse the process. This might not be bulletproof, but it's pretty
> good.

> 4) Be suspicious of commercial encryption software, especially from
> large vendors. My guess is that most encryption products from large
> US companies have NSA-friendly back doors, and many foreign ones
> probably do as well. It's prudent to assume that foreign products
> also have foreign-installed backdoors. Closed-source software is
> easier for the NSA to backdoor than open-source software. Systems
> relying on master secrets are vulnerable to the NSA, through either
> legal or more clandestine means.

> 5) Try to use public-domain encryption that has to be compatible
> with other implementations. For example, it's harder for the NSA to
> backdoor TLS than BitLocker, because any vendor's TLS has to be
> compatible with every other vendor's TLS, while BitLocker only has
> to be compatible with itself, giving the NSA a lot more freedom to
> make changes. And because BitLocker is proprietary, it's far less
> likely those changes will be discovered. Prefer symmetric
> cryptography over public-key cryptography. Prefer conventional
> discrete-log-based systems over elliptic-curve systems; the latter
> have constants that the NSA influences when they can.

> Since I started working with Snowden's documents, I have been using
> GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit, and a few
> other things I'm not going to write about. There's an undocumented
> encryption feature in my Password Safe program from the command
> line); I've been using that as well.

> I understand that most of this is impossible for the typical
> internet user. Even I don't use all these tools for most everything
> I am working on. And I'm still primarily on Windows, unfortunately.
> Linux would be safer.

> The NSA has turned the fabric of the internet into a vast
> surveillance platform, but they are not magical. They're limited by
> the same economic realities as the rest of us, and our best defense
> is to make surveillance of us as expensive as possible.

Schneier was also on Democracy Now! today: from ~38-45 min into

http://traffic.libsyn.com/democracynow/dn2013-0906-1.mp3 (audio)
http://dncdn.dvlabs.com/ipod/dn2013-0906.mp4 (video)
http://www.democracynow.org/2013/9/6/undermining_the_very_fabric_of_the 
(transcript)

FWIW, Tom Roche <Tom_Roche AT pobox.com>