Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.programming > #3649 > unrolled thread

Any good practical means against universal surveillance?

Back to article view | Back to comp.programming

Contents

  Any good practical means against universal surveillance? Mok-Kong Shen <mok-kong.shen@t-online.de> - 2013-08-05 20:33 +0200
    Re: Any good practical means against universal surveillance? Axel Vogt <&noreply@axelvogt.de> - 2013-08-05 22:24 +0200
      Re: Any good practical means against universal surveillance? Mok-Kong Shen <mok-kong.shen@t-online.de> - 2013-08-06 13:56 +0200
    Re: Any good practical means against universal surveillance? Anonymous <anonymous@foto.nl1.torservers.net> - 2013-09-06 20:20 -0400

#3649 — Any good practical means against universal surveillance?

There have been recently in German media quite some debates on Internet
security for the common people and serious concerns were also expressed
by the German president. A German minister even recommended the
citizens to take care of the security of their communications
"themselves", without however telling them "how" -- similar IMHO to
recommending citizens to take care of not being robbed "themselves".
(It may incidentally be noted that in Germany, in distinction to USA,
a permission is required to buy guns and that permission is not easy
to get). Now are there any good ideas of how the common people could
defend themselves against Prism, Tempora, etc., noting that some mighty
Eastern countries may have comparable, though yet unrevealed, projects
running as well? Each individual idea may not be good enough, but
perhaps through appropriate combinations there could result in
something not too bad?

As a start I venture to sketch a humble idea of my own in the
following:

If it could be managed to have sufficiently large volumes of encrypted
emails constantly on the Internet, the surveillance mechanisms would
very likely at least loose much of their efficiencies, if not be
entirely bogged down due to overloading. To achieve that, it would
thus principally depend on whether there are sufficient number of
common people who would voluntarily take the trouble to do encryptions
(or at least do some additional keystrokes, see (3) below) and so IMHO
this is the biggest problem to be faced by the present idea.

We assume that each email has a plaintext part and an attached file
with encrypted stuff. It may be noted that for such senders (let's call
them activists):

(1) They certainly may not have all the time materials that necessarily
need to be kept secrect, in which case for convenience the attachment
can be a dummy file, in particular an arbitrarily chosen one from a
number of dummies stored on stock. Whether the file contains genuine
stuff could e.g. be indicated by a chosen keyword in the plaintext part
of the email.

(2) Not all their friends would like to do any encryption work to
communicate with them, in which case these friends need only tolerate
the activists' sending them emails with dummies.

(3) Those activists who live on the maxim of having absolutely nothing
to hide could always send dummies as attachment.

Note also that the idea of having only one part of the whole message
that is encrypted could also be applied e.g. to the webpages, which may
contain a dynamically varying encrypted part for the partners to
receive.

Key management could be a big stumbling block for the idea in practice.
Since I have anyway a bias favouring symmetric encryptions (I mistrust
PKI whose software/hardware security I am unable to verify for poverty
of knowledge and other practical reasons -- the proprietary software or
hardware involved could contain backdoors implanted by the secret
agencies and the trustworthieness of the certificate agencies, i.e.
the human factors, are questionable, concrete symmetric algorithms are
in general easier to understand than concrete asymmetric algorithms
IMHO), I envisage that each pair of partners would somehow agree and
keep a master key for their communications, from which session keys
could be generated via encrypting certain data that partly involve
time, message number etc. At least for a certain part of the activists
who live in democratic countries secure transfer and keeping of these
master keys among them shouldn't be a too big problem IMHO.

Note that we capitalize on encryption, i.e. the difficulties (efforts
and resources required) of the agencies to find the (potentially, but
not certainly, vital for them) secret informations and do not (and
cannot) hinder their collection of the meta data. Hence the portion of
emails from the activists need not be significant in relation to the
total volume of emails on the Internet.

A tiny remark is that in countries where the law enforcement could
demand surrendering of the encryption keys, the dummies couldn't be
entirely arbitrarily random, since otherwise it would be impossible to
satisfy the demands of the authority.

A somewhat different, seemingly also viable, idea is the following:
The activists could send genuine (i.e. for communication) or dummy
(i.e. to enhance the load of cryptanalysis) messages to Usenet groups
like alt.anonymous.messages. I am ignorant whether that group has
currently more than a few congeners, if at all. Anyway, if there is
a "run" for such services, evidently many more of its genre would be
needed, which IMHO shouldn't nevertheless be an unsolvable problem.
BTW, some activists could run something analogous to certain Internet
forums with browser as interface for posting, excepting that there will
be encrypted stuffs posted, with membership available to the general
public or limited in some specific way. (Note that on some computers
access to Usenet groups may not have been installed, but access to
a forum needs only a browser which is always available. In less
democratic geographic locations one could send messages from a call
shop or internet cafe (utilising the facility available there to access
the Internet, thus not involving one's own IP address, nor email
address), taking due care of possible observations by agents there.)

My personal view of the current surveillance is fairly analogous to
one of, say, an intimidating disease of pandemic nature. In such cases
one knows that one doesn't have "really" effective means to solve the
problem, but one must/should nonetheless join efforts/thoughts to
reduce, as far as possible. the "impact" of the evils. As I indicated,
there appears unlikely to be a way to stop collection of meta data.
What seems to be viable is IMHO a reduction of the practical efficiency
of the huge computing resources of the agencies. And that I think is
quite possible in practice by presenting to their machines an
additional very huge load of cryptanalysis. In fact, imagine that there
were 100 Internet forums each with daily an average of 100 encrypted
posts, such that with a probability of 1/10000 a post may contain
a message of the importance and urgency comparable to, say, "Snowden is
escaping with a jet of a certain Latin-American president", I am pretty
sure that the cooling system of their computers would very soon need
some unscheduled maintenance work

M. K. Shen

----------------------------------------------------------------------

P.S. In another group someone pointed out that the base of my idea is
not new at all. He quoted Philip Zimmermann:

"What if everyone believed that law-abiding citizens should use
postcards for their mail? If a nonconformist tried to assert his privacy
by using an envelope for his mail, it would draw suspicion. Perhaps the
authorities would open his mail to see what he's hiding. Fortunately,
we don't live in that kind of world, because everyone protects most of
their mail with envelopes. So no one draws suspicion by asserting their
privacy with an envelope. There's safety in numbers. Analogously, it
would be nice if everyone routinely used encryption for all their
email, innocent or not, so that no one drew suspicion by asserting their
email privacy with encryption. Think of it as a form of solidarity."

[toc] | [next] | [standalone]

#3650

On 05.08.2013 20:33, Mok-Kong Shen wrote:
> 
...

Perhaps you first should learn to use a proper email adress
and then should be aware, that it is almost trivial to get
your identity (just as mine), using usenet.

Privacy is my concern as well, but not in those groups and
in the usenet (sorry - and do not want to insult you).

[toc] | [prev] | [next] | [standalone]

#3651

Am 05.08.2013 22:24, schrieb Axel Vogt:
> On 05.08.2013 20:33, Mok-Kong Shen wrote:
>>
> ...
>
> Perhaps you first should learn to use a proper email adress
> and then should be aware, that it is almost trivial to get
> your identity (just as mine), using usenet.
>
> Privacy is my concern as well, but not in those groups and
> in the usenet (sorry - and do not want to insult you).

You missed my points. On the one side, I did indicate how to
"not" use one's own email address, if revealing one's identity
could be critical. On the other side, if one lives in a
democratic country and it's not critical to "publically" engage
in an activity aimed to block the huge machinary of those mighty
secret agencies though sending encrypted mails (instead of
plaintext messages) with one's (publically known) email address,
then it doesn't matter whether the agencies note down one's
identity or not, or does it??

M. K. Shen

[toc] | [prev] | [next] | [standalone]

#3700

In article <ktor4t$km9$2@news.albasani.net>
Mok-Kong Shen <mok-kong.shen@t-online.de> wrote:
>
> ....
> As a start I venture to sketch a humble idea of my own in the
> following: ....

What an ironic thread this is a mere month later.

Here's a little something extra for some to gnaw on, readers need 
not bother with it.

7/4RaS0Q+h555swTAYcp4LNo44OeoaoZwsTfjl6orIeTAhS8xQ9VIL22p0//7Ixm 
vCjMgaNE/Hjw5J0EH+mi0g50LjccV0dPT+CfzqXmJXCj+8KPA6wnfG0iJ48ESGM4 
46NLneeQkHFq9ZpQ/zNEjwOerMhmcfctdxHojYx/8wlHPTxQxP6MaSqlSikYJj3r 
w4f5pokGeiK8I3HiHTMi3QGT65e7I4FRNmDnNfW401lgSeRrD3LSPq3EAQ7wCRTs 
rtWXytGJ4y2GioLJCRisuB7GiXyYXNYz/ma27gMzqlyD+hEBky6OfOG3Qc9Hfqx5 
1wDRS5CWNuKy8UVppM55EGOFyIwcI08PnbUCu75aReQ6nSD6zeafYjrvjfdhmnGs 
gFQmvqvQzrt/SPgzYRv4MR2U2jteCEALDQNiL72oaUyFPc9WwuNrU3cZymElObtG 
LmeWsjSk8IpTofm1KtA4APkZqup+ZC4YfeDChODszvKMOe6qrESLQgOIFbeNYmK1 
4Ld/Ft9tgznUclW+o8D6tI4AVRGA4uWTwSlxXZMC/RqJGvr0DMWbDqh6GMPQKk43 
W3nnz2dO3Kfn7EivHVIOA34dZvlRheAE7A7kD2zLm3EEAMro6yDH13h0qOLg2xQ9 
ThTrOpY+KM7Z4Fa0u9qnC1Itkk8hCJoYAgDDgrIz/jfHd2Vb9G9i0igryJZEIwHa 
AtPEh8//R24S+ubSi6U0PPW7RGY1vyhPgcz+wERjxz1htN/C2DFaVK1uWltrNI8/

[toc] | [prev] | [standalone]

Back to top | Article view | comp.programming

csiph-web