Thursday, September 12, 2013

SHHHHH its a Secret

As we all know the NSA is watching us like Big Brother. Watching what we say watching what we do and maybe even more. But there are some things that you can do to make it less viable to track you. Prism-break.org is a great place to start.

There are three different "solutions" that you can try. Some are harder than others so I will try to give you the Pro's and cons of each.


PGP Email Signing and Verification

PGP works like most Asymmetric key systems. When you generate a key pair there is both a private key and a public key. The difference between HTTPS (SSL) is the reason to trust these keys are different. In HTTPS you generate your key from a trusted source for example Verisign or Level 3 Communications. These certificates are embedded directly in to the browser so that they are always trusted. This makes the trust a tree structure. PGP works on a different structure instead of getting a key from a trusted source you are able to sign (verify) other people keys. This makes is more of a cyclic structure. Since your key is signed by someone I trust I can trust that this is your key.



Example GPG Public Key.
Pros
  • You don't need to make a new account assuming that you already have at least 1 email address
  • You only need to a minimum of 1 key for all of your email addresses. (Just a note this means that people will be able to realize that they all come from the same person)
  • It works with any email service.
  • There are plugins for Thunderbird called Enigmail.
Cons
  • Its not as easy for a non technically savvy person.
  • If you are using searching with Google you wont be able to search for information because it will look like garbage.


Crypto Cat OTR (Off the Record) Messaging Service

A simple plugin for your major web browsers that allow you to communicate with another person or a group with privacy. It also deletes any of the information from there server after all party logout making it the easiest way to communicate securely. They even have an short pdf explaining on what they do and what they don't do. But since its a work in progress there are many bugs that can go unnoticed.

Pros
  • After you logout the chat is lost for ever
  • Its a plugin for Chrome and Firefox so no messy installation 
  • Easist way to send messages
  • No account needed
Cons

PyBitmessage

This is my personal favorite because it works on the same concept of bitcoin transactions. (and because I fix bugs in it) You create a address which you give to others and can send information to just like an email. It hides all of the metadata information like the sender, recipient length of decripted message and more.


Pros
  • Operates exactly like email with added bonus of having subscribing to email addresses. This means the owner of the email address can broadcast to all of the users that are subscribed to him.
  • Able to send files
  • Sending info to addresses with no distinguishable information 
  • Anonymity to a certain extent (other than the IP address its sent from)
  • Hides metadata like the sender and receiver of messages
Cons
  • Difficult to get it to work on a Windows Computer
  • its an application so you have to install it
  • Hard to remember addresses
  • Need to get other people to use it to comunicate
  • Since its opensource and a web application there may be mistakes that decrease the privacy of the chat (broadcast public keys, or spammers)

No comments:

Post a Comment