How and Why to Stay Secure in your Electronic Comunications

unskewedewd · Sep 9, 2013

The How:

Most people don't need this information, but on the chance that there are some here who do, I felt obligated to provide it.

http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance

...How do you communicate securely against such an adversary? Snowden said it in an online Q&A soon after he made his first document public: "Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on."

I believe this is true, despite today's revelations and tantalizing hints of "groundbreaking cryptanalytic capabilities" made by James Clapper, the director of national intelligence in another top-secret document. Those capabilities involve deliberately weakening the cryptography.

Snowden's follow-on sentence is equally important: "Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it."

Endpoint means the software you're using, the computer you're using it on, and the local network you're using it in. If the NSA can modify the encryption algorithm or drop a Trojan on your computer, all the cryptography in the world doesn't matter at all. If you want to remain secure against the NSA, you need to do your best to ensure that the encryption can operate unimpeded.

With all this in mind, I have five pieces of advice:

1) Hide in the network. Implement hidden services. Use Tor to anonymize yourself. Yes, the NSA targets Tor users, but it's work for them. The less obvious you are, the safer you are.

2) Encrypt your communications. Use TLS. Use IPsec. Again, while it's true that the NSA targets encrypted connections and it may have explicit exploits against these protocols you're much better protected than if you communicate in the clear.

3) Assume that while your computer can be compromised, it would take work and risk on the part of the NSA so it probably isn't. If you have something really important, use an air gap. Since I started working with the Snowden documents, I bought a new computer that has never been connected to the internet. If I want to transfer a file, I encrypt the file on the secure computer and walk it over to my internet computer, using a USB stick. To decrypt something, I reverse the process. This might not be bulletproof, but it's pretty good.

4) Be suspicious of commercial encryption software, especially from large vendors. My guess is that most encryption products from large US companies have NSA-friendly back doors, and many foreign ones probably do as well. It's prudent to assume that foreign products also have foreign-installed backdoors. Closed-source software is easier for the NSA to backdoor than open-source software. Systems relying on master secrets are vulnerable to the NSA, through either legal or more clandestine means.

5) Try to use public-domain encryption that has to be compatible with other implementations. For example, it's harder for the NSA to backdoor TLS than BitLocker, because any vendor's TLS has to be compatible with every other vendor's TLS, while BitLocker only has to be compatible with itself, giving the NSA a lot more freedom to make changes. And because BitLocker is proprietary, it's far less likely those changes will be discovered. Prefer symmetric cryptography over public-key cryptography. Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can.

Since I started working with Snowden's documents, I have been using GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit, and a few other things I'm not going to write about. There's an undocumented encryption feature in my Password Safe program from the command line); I've been using that as well.

I understand that most of this is impossible for the typical internet user. Even I don't use all these tools for most everything I am working on. And I'm still primarily on Windows, unfortunately. Linux would be safer.

The NSA has turned the fabric of the internet into a vast surveillance platform, but they are not magical. They're limited by the same economic realities as the rest of us, and our best defense is to make surveillance of us as expensive as possible

Trust the math. Encryption is your friend. Use it well, and do your best to ensure that nothing can compromise it. That's how you can remain secure even in the face of the NSA.
Click to expand...

The Why:

http://www.theguardian.com/commenti...rveillance-revelations-encryption-expert-chat

Explaining the latest NSA revelations Q&A with internet privacy experts

The Guardian's James Ball and cryptology expert Bruce Schneier answer questions about revelations that spy agencies in the US and UK have cracked internet privacy tools
James Ball and Bruce Schneier
theguardian.com, Friday 6 September 2013 10.41 EDT

Today, the Guardian's James Ball, who reported on the latest NSA and GCHQ revelations, and cryptology expert Bruce Schneier, who wrote about the implications, will take your questions on the new revelation that the US and UK governments can crack much of the encryption protecting personal data, online transactions and emails as well as the ongoing debate over surveillance. Toss your questions below and as you wait for a response, re-visit yesterday's stories:

How US and UK spy agencies defeat internet privacy and security

How internet encryption works

The US government has betrayed the internet. We need to take it back
[...]

First Question: ...
Click to expand...

Mushroom · Sep 10, 2013

This is simple.

If you are paranoid, don't do anything by computer. Every computer can be hacked if it is tied to the Internet, and absolutely nothing sent over the internet is safe or secure. Everything can be captured, cracked, and used against you.

Everything.

I laugh whenever these things come up, because they mostly work off of the ignorance of people. Saying things that they think will make some happy, but really giving nothing of value but teaching new buzzwords to individuals.

Log in or Sign up

How and Why to Stay Secure in your Electronic Comunications

unskewedewd New Member

Mushroom Well-Known Member

Share This Page

Log in or Sign up

How and Why to Stay Secure in your Electronic Comunications

unskewedewd New Member

Mushroom Well-Known Member

Share This Page

Useful Searches