Re: [liberationtech] Fwd: Firefox OS with built in support for OpenPGP encryption
----- Forwarded message from Micah Lee
Bernard Tyers - ei8fdb wrote:
Stefan: Why not?
For verification, OpenPGP on smartphones is *possibly* ok. For a device used to sign or encrypt smartphones are totally inappropriate regardless of the potential convenience.
No such agency and the like are almost certainly able (with the help of carriers and manufacturers) backdoor and exploit all the major smartphone brands and models [0].
Smartphones are horrendously complex, rely heavily on untrusted binary blobs, have mutiple CPUs some without direct owner/user control (eg the CPU doing the baseband processing) [1]. Currently these devices are impossibly difficult to secure.
Erik
[0] http://www.spiegel.de/international/world/privacy-scandal-nsa-can-spy-on-sma... [1] http://www.geeky-gadgets.com/baseband-hacking-a-new-way-into-your-smartphone...
I completely disagree. Ubiquitous end-to-end encryption will help protect against *dragnet* surveillance. The fact that smartphones are imminently pwnable doesn't change this fact. Even if you're using a Carrier IQ-infested/baseband backdoored device, adversaries would still need to *target* you in order to compromise your OpenPGP conversations. Saying that we shouldn't encourage OpenPGP on smartphones is like saying we shouldn't encourage it on Windows computers either. There's a big difference between encrypted internet traffic and endpoint security, and just because the endpoint isn't 100% secure doesn't mean you should give up on encrypting traffic. Undetectable, sniffing the wire eavesdropping is the preferred way that NSA and GCHQ conduct surveillance. Every time they try to hack into a laptop or smartphone they run the risk of detection. They might be really good, and detection might be very unlikely, but it's still risky because these are active attacks, and they are much more expensive than getting handed all the data passively. They can't afford to do *dragnet* endpoint attacks. There doesn't seem to be these same complaints against OTR on smartphones, and in fact Gibberbot and ChatSecure seem to be celebrated by this community, but they suffer all the same problems (and likely even more, because they run on Android and iOS) that OpenPGP built-in to Firefox OS would. For that matter, RedPhone, CSipSimple and OStel, TextSecure, and Orbot also all from running on smartphones. Should all these projects get discouraged too? At this point, nothing is completely secure. The most talented hackers I know use ThinkPads (with alleged Chinese hardware backdoors [0]) and run Debian (researchers recently crashed 1.2k Debian packages with automated fuzzing [1] -- how many of these are overflows, how many have already been systematically weaponized by the NSA?). Should we discourage people using OpenPGP on ThinkPads, or when using Debian? The best we can strive to do is make surveillance more expensive, force it to be targeted, force it to be detectable, and make the cost of spying on everyone as expensive as possible. I'm really happy to hear that Firefox OS is building end-to-end encryption tools into their phone, something that I hope all smartphone OSes copy. [0] http://www.afr.com/p/technology/spy_agencies_ban_lenovo_pcs_on_security_HVgc... [1] http://lists.debian.org/debian-devel/2013/06/msg00720.html -- Micah Lee @micahflee -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys@stanford.edu. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5
Bear in mind that most spying is not done by TLAs but by commerce, contractors, orgs, edus, religions, hackers, entreprenuers, comsec peddlers, criminals and venal individuals. Against these lightly- or un-regulated swarming, ubiquitous data harvesters encryption and anonymization is essential. Not least because they sell data to the TLAs without the pretense of regulation aimed at limiting official spying which serves as a diverting cloak for the other kinds who join the far greater crowd fingerpointing away from themselves. One of the greatest online deceptions are privacy policies, along with nefarious log files and other management tools, tricks, traps, con-jobs, built into every digital enterprise, defended as necessary for sysadmining and protecting the democracy, the internet, the people. Far worse duplicity than official propaganda which, no surprise, copies the unofficial practices as advised by self-serving advisory boards and consultants from com, org, edu, religion, individual, criminals, the lot. Best way to spot a duplicity expert is to gander a cryptographer or a proponent of ubiquitous encryption anonymization and privacy. These stalwarts work both sides for MITM rewards. Which is why these lists are predominately popluated by leeches with a few newbies looking for mentors. This has always been the case, not new with digital intercourse At 08:33 AM 9/21/2013, you wrote:
cypherpunks@al-qaeda.net
participants (2)
-
Eugen Leitl -
John Young