INB4 Moxie starts dropping hints not to use his code and moves to Iceland.
His app is fine - but that hair - holy geeze.
In the 70’s the government would point to the evil East Germany spying on everybody and speak with pride about how America would never do such a thing.
Now nearly universal surveillance is touted as “Keeping America Safe!”
Sigh…
Yeah. That hair is far more of a national crime than the text encryption.
They’re never going to succeed in outlawing the one-time pad, and that’s truly unbreakable, and cheap, and all spooks everywhere know it. So really, terrorists aren’t the problem.
We are.
No, he doesn’t.
He doesn’t think. He just says whatever some dweeb from No Such Agency tells him to say.
Around that time, the State Department was looking to use technology to support pro-democracy movements overseas. Mr. Marlinspike’s work caught the attention of Ian Schuler, manager of the department’s Internet freedom programs. Encrypted messaging was viewed as a way for dissidents to get around repressive regimes.
With help from Mr. Schuler, Radio Free Asia’s Open Technology Fund, which is funded by the government and has a relationship with the State Department, granted Mr. Marlinspike more than $1.3 million between 2013 and 2014, according to the fund’s website.
This is a problem. Major privacy and security apps are developed with heavy financial dependence upon the US federal government, particularly the State Department. People have searched for backdoors built into these applications, but that’s not the real problem. The real problem is that software developers, nominally radical and critical of the US government, end up acting as spokespeople for US policy goals. Listen to their public statements about the oppressive governments they’re trying to defend activists from, and they’re always the US foreign policy targets of the day, most often China and Iran. US allies, and the US itself, are much more rarely mentioned.
It’d be bad for funding.
Better keep quiet about the hand that feeds you - but write code that works for both their and our dissidents. Because the words don’t matter, the code does.
The problem isn’t that activists can’t have private conversations. It’s that the public conversations are being manipulated that is the problem.
By the way, Cory Doctorow is associated with the Open Technology Fund.
A touch nit picky… Ever done a key exchange for a symmetric cipher, 'specially a one time? Also, what metrics did you use to measure the entropy of your key,and the resulting ciphertext?
(I’ve always wondered if decreasing entropy in misleading ways might serve to piss of cryptanalysis analysts more than increasing across the board… Make your key spit out a series of ciphertext that is just deadbeefdeadbeef…)
One time pads are only secure if you start with an out of band key exchange. In this day and age it is becoming increasingly difficult, witness the detainment of David Miranda in London. Any keys he was carrying would have been lost.
Yup!!
When I was exchanging partial keys for work I knew that using three keys sent through the post office, FedEx, and dhl were unlikely to be all apprehended by a malicious agent… Unless that agent is the government.
In-person meeting with exchange of physical token with the keys. Could be a sheet of paper with hex strings, could be a portable data storage medium. I’d say paper is a little bit better as you can burn it easier than you can securely erase a flash memory, especially in the age of wear leveling where copies of your red data multiply over the “empty” sectors.
Tamper evidence is way easier than tamper resistance.
Take the key. Make a block of random numbers of the same size, an one-time pad. XOR with the key.
Send the result (or the OTP) in a physical package, heavily armed with tamper-evident measures. If it arrives intact, send the OTP (or the result) by any channel. This one can be intercepted.
XOR the halves, get the key again.
Ha! It was always paper, always a single sheet (never on a pad), three key officers, and while it was all recorded we had cubbies to hide the forms from the cameras.
Then tamper proof bags, dual officers for mailing each part of the key, biometrics for the room, ledgers that detailed every operation, so on and so on.
It literally took three hours to rotate a key.
Oh, and we rotated vendors for sending key material. And we sent them from a rotating set of drop off points.
Also, when writing sensitive data on paper, put the paper on glass. Prevents the red stuff impressing into a black medium to be recovered from later.
Yeah, the level of maturity we had it honestly would be easier to kidnap two or three key officer wives and just use collusion.
…
But then we had grumble officers, and we rotated.
Should probably stop talking. Keys are hard! Knocking over a bank is easier! Becoming a banker is waaaaaay easier and more lucrative!
I am reminded of 1984 where Winston Smith used a drop of powder to detect surveillance of his book but the police had been on to that all along.
