[cryptography] ICIJ's project - comment on cryptography & tools

2013-04-04 Thread ianG
In a project similar to Wikileaks, ICIJ comments on tools it used to secure its team-based project work: "ICIJ’s team of 86 investigative journalists from 46 countries represents one of the biggest cross-border investigative partnerships in journalism history. Unique digital systems s

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-04 Thread Jon Callas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Apr 4, 2013, at 6:27 AM, ianG wrote: > In a project similar to Wikileaks, ICIJ comments on tools it used to secure > its team-based project work: > > "ICIJ’s team of 86 investigative journalists from 46 countries > represents one of th

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-04 Thread ianG
On 4/04/13 21:43 PM, Jon Callas wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Apr 4, 2013, at 6:27 AM, ianG wrote: In a project similar to Wikileaks, ICIJ comments on tools it used to secure its team-based project work: "ICIJ’s team of 86 investigative journalists from 4

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-04 Thread Steven Bellovin
On Apr 4, 2013, at 4:51 PM, ianG wrote: > On 4/04/13 21:43 PM, Jon Callas wrote: >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA1 >> >> >> On Apr 4, 2013, at 6:27 AM, ianG wrote: >> >>> In a project similar to Wikileaks, ICIJ comments on tools it used to secure >>> its team-based project

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-04 Thread Nico Williams
On Thu, Apr 4, 2013 at 3:51 PM, ianG wrote: > On 4/04/13 21:43 PM, Jon Callas wrote: >> This is great. It just drives home that usability is all. > > Just to underline Jon's message for y'all, they should have waited for > iMessage: > > "Encryption used in Apple's iMessage chat service has s

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-04 Thread Peter Gutmann
ianG writes: >"An internal Drug Enforcement Administration document seen by CNET discusses >a February 2013 criminal investigation and warns that because of the use of >encryption, "it is impossible to intercept iMessages between two Apple >devices" even with a court order approved by a federal j

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-04 Thread James A. Donald
On 2013-04-05 6:51 AM, ianG wrote: "When Apple's iMessage was announced in mid-2011, Cupertino said it would use "secure end-to-end encryption." It quickly became the most popular encrypted chat program in history: Apple CEO Tim Cook said last fall that 300 billion messages have been se

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-04 Thread James A. Donald
On 2013-04-05 10:47 AM, James A. Donald wrote: How does it work? Is it really secure, and if it is, how did they manage a "not one click for security" user interface? Already answered by others on this list. Not secure, apple can MIM it. ___ cryp

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-04 Thread ianG
On 5/04/13 05:36 AM, James A. Donald wrote: On 2013-04-05 10:47 AM, James A. Donald wrote: How does it work? Is it really secure, and if it is, how did they manage a "not one click for security" user interface? Already answered by others on this list. Not secure, apple can MIM it. Seems

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-05 Thread NgPS
On Thu, Apr 04, 2013 at 11:51:06PM +0300, ianG wrote: > http://news.cnet.com/8301-13578_3-57577887-38/apples-imessage-encryption-trips-up-feds-surveillance/ > > iang, who never even knew it was encrypted! Presumably messages are stored in clear text on Apple's servers, similarly on servers of Wha

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-05 Thread NgPS
On Thu, Apr 04, 2013 at 04:39:31PM -0500, Nico Williams wrote: > Basically, this is complaint by the DEA is disinformation or > misinformation (or both!). If the former case we might even be > staring at the start of a new crypto wars period. In the movies and presumably in real life, bad guys ha

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-05 Thread Nico Williams
On Fri, Apr 5, 2013 at 9:17 PM, NgPS wrote: > In the movies and presumably in real life, bad guys have smart crooked > lawyers advising them. Surely the bad guys have the resources to set up > bunch of servers a la iMessage/Whatsapp, and write/deploy their own apps on > their mobile devices, runni

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-06 Thread ianG
On 6/04/13 07:27 AM, Nico Williams wrote: On Fri, Apr 5, 2013 at 9:17 PM, NgPS wrote: In the movies and presumably in real life, bad guys have smart crooked lawyers advising them. Surely the bad guys have the resources to set up bunch of servers a la iMessage/Whatsapp, and write/deploy their ow

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-06 Thread Kevin W. Wall
On Sat, Apr 6, 2013 at 7:34 AM, ianG wrote: > On 6/04/13 07:27 AM, Nico Williams wrote: [snip] > This bit: > >> We hope the NSA types haven't forgotten that good guys >> need crypto, whether LEA like it or not. > > I personally believe that the NSA's policy that the good guys don't need > good cry

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-06 Thread StealthMonger
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ianG writes: > I personally believe that the NSA's policy that the good guys don't need > good crypto is the underlying root to the problem. A goodly portion if > not all. > Internally to the NSA this is known as 'the equity issue' or so I've hea

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-06 Thread Nico Williams
On Sat, Apr 6, 2013 at 6:34 AM, ianG wrote: >> We hope the NSA types haven't forgotten that good guys >> need crypto, whether LEA like it or not. > > I personally believe that the NSA's policy that the good guys don't need > good crypto is the underlying root to the problem. A goodly portion if n

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-07 Thread Peter Gutmann
"Kevin W. Wall" writes: >I think you're giving the NSA way too much credit on why security sucks. Even >if we were to restrict 'security' to the scope of cryptography, even there, I >think the NSA has much less to do with dumbing down crypto security than >other factors. Exactly. If the NSA di

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-08 Thread ianG
On 7/04/13 09:38 AM, Nico Williams wrote: On Sat, Apr 6, 2013 at 6:34 AM, ianG wrote: We hope the NSA types haven't forgotten that good guys need crypto, whether LEA like it or not. I personally believe that the NSA's policy that the good guys don't need good crypto is the underlying root to

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-08 Thread ianG
On 8/04/13 04:06 AM, Peter Gutmann wrote: "Kevin W. Wall" writes: I think you're giving the NSA way too much credit on why security sucks. Even if we were to restrict 'security' to the scope of cryptography, even there, I think the NSA has much less to do with dumbing down crypto security than

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-08 Thread Jeffrey Goldberg
On Apr 8, 2013, at 7:38 AM, ianG wrote: > We all know stories. DES is now revealed as interfered with, yet for decades > we told each other it was just parity bits. But it turned out that the interference was to make it *stronger* against attacks, differential cryptanalysis, that only the N

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-09 Thread ianG
On 9/04/13 03:43 AM, Jeffrey Goldberg wrote: On Apr 8, 2013, at 7:38 AM, ianG wrote: We all know stories. DES is now revealed as interfered with, yet for decades we told each other it was just parity bits. But it turned out that the interference was to make it *stronger* against attacks,

Re: [cryptography] ICIJ's project - comment on cryptography & tools

2013-04-09 Thread Kevin W. Wall
Some OT comments to an OT response... On Mon, Apr 8, 2013 at 8:30 AM, ianG wrote: > On 7/04/13 09:38 AM, Nico Williams wrote: [big snip] >> We've built a house of cards, not so much on the Internet as >> on the web (but not only!). Web application security is complete >> mess. And anyways, we b