** ** Developers Scramble to Build NSA-Proof Email****
http://www.wired.com/threatlevel/2013/09/the-scramble-to-build-encryption/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+wired27b+%28Wired%3A+Blog+-+Threat+Level%29 **** ** ** ** ** By David Kravets**** 09.05.13**** 6:30 AM**** ** ** Edward Snowden's revelations about the NSA's mass internet surveillance is** ** driving development of a slew of new email tools aimed at providing**** end-to-end encryption to users, and it has boosted interest in existing**** privacy tools too.**** ** ** The latest entry in the crypto mail field is Scramble, encrypted webmail**** software coded by recent Stanford University computer science graduate**** Daniel Posch. Though it's incomplete and untested - don't use it to thwart** ** the NSA - Scramble tries to provide the same type of security as encryption* *** clients like GPG, but with the convenience of webmail.**** ** ** "I care about this stuff and want there to be secure email, secure against** ** governments, not just individual hackers," says Posch.**** ** ** Webmail encryption is always a dicey endeavor. The Canadian secure email**** provider Hushmail had a promising model that used a Java applet to perform** ** encryption in the user's browser so that even the company didn't know the*** * users' private keys. But in 2007, it surfaced that Hushmail was receiving*** * orders via a Canadian court that forced it to subvert its own security. The* *** mechanism is still unclear, but it's axiomatic that since Hushmail was**** serving the applet, it could easily be forced to sabotage that applet as**** well.**** ** ** Last month, Lavabit, the U.S.-based secure email provider favored by Edward* *** Snowden, shut down altogether rather than comply with a still-secret**** government demand to compromise one or more of its users. The next day,**** encrypted messaging company Silent Circle proactively shuttered its email*** * offering, announcing that, among other things, "email cannot be secure."**** Silent Circle's secure messaging service, which uses apps instead of the web **** browser, remains alive.**** ** ** Daniel Posch. Photo: Courtesy**** ** ** Posch's approach is in some ways similar to Hushmail's: His software sends** ** users Javascript code that performs encryption in the browser, so the server **** never knows the secret key. That makes it vulnerable if an attacker**** penetrates the server and modifies the Javascript, or a government forces*** * the provider to do the same. To that end, Posch plans to write a Chrome**** plug-in that the user can install once to handle the crypto - a stronger**** approach.**** ** ** There are other grace notes in his project. Scramble uses the hash of the*** * user's public PGP key as the email address, linking the user's cryptographic **** identity to the account, instead of their less mathematically rigorous "real **** life" identity. (Scramble users, in their encrypted address book, would**** assign contact names to the email addresses.)**** ** ** It comes at a time when the demand for encrypted email is swelling.**** "Interest [has] been growing a lot since the Prism and NSA stories come**** out," said Lukas Pitschl, the lead developer of open-source GPGMail, an**** Apple Mail add-on that makes PGP encryption easy. Traffic to the website**** where his mail client can be downloaded has doubled to 3,000 daily hits, he* *** said.**** ** ** File-sharing kingpin Kim Dotcom plans to start his own encrypted email**** system. And a project called Mailpile just raised more than $100,000 on the* *** crowdfunding site IndieGoGo to fund a web-based, encrypted email client.**** ** ** Jon Callas, a Silent Circle founder, says his company is planning to take*** * another run at secure email. He says he's primarily concerned with email**** metadata like the sender, receiver and subject line, as well as the IP**** addresses and transit server information in the header of encrypted email.** ** ** ** "The real threat that I see, is that just like your cell phone is a tracking **** device, your email is a tracking device, and even worse than your phone**** because it's kept around forever," says Callas. "Metadata in email, it's**** obnoxious and permanent."**** ** ** "We are working on a new email system that is end-to-end secure that doesn't **** have those metadata concerns. It's still a ways off," Callas says.**** ** ** For its part, Scramble is still in the "proof of concept" phase - he**** released it last week on the Liberationtech message board and he wants his** ** peers to review the code and the concept. "I'm putting it out there as open* *** source, trying to get people interested," he said. "For it to be foolproof,* *** you need peer review by other security engineers."**** ** ** ==========================================**** (F)AIR USE NOTICE: All original content and/or articles and graphics in this **** message are copyrighted, unless specifically noted otherwise. All rights to* *** these copyrighted items are reserved. Articles and graphics have been placed **** within for educational and discussion purposes only, in compliance with**** "Fair Use" criteria established in Section 107 of the Copyright Act of 1976. **** The principle of "Fair Use" was established as law by Section 107 of The**** Copyright Act of 1976. "Fair Use" legally eliminates the need to obtain**** permission or pay royalties for the use of previously copyrighted materials* *** if the purposes of display include "criticism, comment, news reporting,**** teaching, scholarship, and research." Section 107 establishes four criteria* *** for determining whether the use of a work in any particular case qualifies** ** as a "fair use". A work used does not necessarily have to satisfy all four** ** criteria to qualify as an instance of "fair use". Rather, "fair use" is**** determined by the overall extent to which the cited work does or does not*** * substantially satisfy the criteria in their totality. If you wish to use**** copyrighted material for purposes of your own that go beyond 'fair use,' you **** must obtain permission from the copyright owner. For more information go to: **** http://www.law.cornell.edu/uscode/17/107.shtml **** ** ** THIS DOCUMENT MAY CONTAIN COPYRIGHTED MATERIAL. COPYING AND DISSEMINATION IS **** PROHIBITED WITHOUT PERMISSION OF THE COPYRIGHT OWNERS.**** ** ** ** ** ** ** ** ** ** ** ** ** __._,_.___ __,_._,___ -- -- Thanks for being part of "PoliticalForum" at Google Groups. For options & help see http://groups.google.com/group/PoliticalForum * Visit our other community at http://www.PoliticalForum.com/ * It's active and moderated. Register and vote in our polls. * Read the latest breaking news, and more. --- You received this message because you are subscribed to the Google Groups "PoliticalForum" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
