Category: Action Reports

Recent­ly there was a con­fer­ence for activists inter­est­ed in secu­ri­ty issues — obvi­ous­ly some­thing that any activist should be inter­est­ed in. Notes from the gath­er­ing are being com­piled along with pre­vi­ous doc­u­ments into a print­ed book­let for activists which is expect­ed to be dis­trib­uted next year.
In the mean­time I’ve been doing a lit­tle addi­tion­al research on solu­tions spe­cif­ic to secur­ing email com­mu­ni­ca­tion…

Emails and pass­words used by activists are vuner­a­ble to snoop­ing from both the state and from pri­vate inves­ti­ga­tion. Even seem­ing­ly unim­por­tant infor­ma­tion gath­ered from emails can help build a pro­file on a per­son and their asso­ciates. Per­son­al infor­ma­tion might pro­vide your ene­mies with lever­age to turn some­body you know into a grass or make it eas­i­er to place an infil­tra­tor in a posi­tion of trust.

What most peo­ple do not realise is that by default, the vast major­i­ty of email and even pass­words are sent over the inter­net in plain text that can be rmon­i­tored by any­one. Sit down at a com­put­er in a library, col­lege or inter­net cafe and any­one else on that net­work can eas­i­ly read the emails you send and receive, not to men­tion steal your pass­word. There are sev­er­al ways to avoid this depend­ing on how you access your mail.

Most activists tend to use web based mail these days so we’ll start with those.

If you look in the address bar on your web brows­er you will see that most address­es start with the let­ters http:// but some­times you will see https://. The ‘s’ indi­cates that the con­nec­tion is using SSL, a secure encrypt­ed link between your brows­er and the web serv­er. Most browsers also dis­play a locked pad­lock sym­bol some­where to pro­vide a visu­al con­fir­ma­tion that the con­nec­tion is secure. When you are view­ing web­pages over a SSL con­nec­tion (such as on Indy­media), the data being trans­fered is no longer in plain text and can not be read by peo­ple attempt­ing to mon­i­tor you. This pro­tec­tion also applies to infor­ma­tion you sub­mit in web forms, such as user­names and pass­words when check­ing web­mail.

In oth­er words, the most basic and essen­tial thing to do to secure your email is use SSL con­nec­tions if you use web­mail. For exam­ple, if you use rise­up web­mail you should go to https://mail.riseup.net rather than http://mail.riseup.net

We should now brei­fly look at the use of POP and SMTP for those not using web­mail. If you don’t know what these are, don’t wor­ry, they are two of the most com­mon pro­to­cols used for down­load­ing and upload­ing mes­sages using an email client installed on your own com­put­er. Exam­ples of email clients include Out­look, Eudo­ra, Pega­sus and Thun­der­bird. Again, the prob­lem you need to be aware of is that these pro­to­cols are by default not secure and all emails and pass­words are sent as plain text. You need to con­fig­ure your account set­tings with­in your email client to use a secure authen­ti­cat­ed con­nec­tion such as SSL. It’s beyond the scope of this arti­cle to explain how but the help func­tion of your client plus the help pages for your email provider will pro­vide specifics.

It’s obvi­ous­ly essen­tial to use SSL (or sim­i­lar) to pro­tect your email pass­word. How­ev­er, when you send an email it will still trav­el over the inter­net in plain text as SSL only pro­tects the con­nec­tion between your com­put­er and the serv­er. To pro­tect the con­tents of the email for the entire trip it will need to be encrypt­ed so that only the intend­ed recip­i­ent can read it.

You may have heard of PGP ( http://en.wikipedia.org/wiki/Pretty_Good_Privacy), a com­put­er pro­gram that encrypts (scram­bles) and decrypts (unscram­bles) doc­u­ments and emails. The ini­tials stand for pret­ty good pri­va­cy and like it says, it’s pret­ty good! Some peo­ple claim that the worlds most pow­er­ful com­put­ers could use brute force to break the encryp­tion in a mater of just a few hun­dred of years while oth­er put the time required at longer than the age of the uni­verse. Of course, com­put­ers get faster all the time so either way the time frame might even­tu­al­ly be reduced to with­in a human life­time but even so, it’s like­ly that by the time any­one broke the encryp­tion the con­tent would no longer be valu­able. ( http://axion.physics.ubc.ca/pgp-attack.html)

I will not go into detail how PGP works as there is plen­ty of infor­ma­tion about it on the web. More impor­tant is how to use it. The trou­ble with PGP has tra­di­tion­al­ly been that peo­ple not to con­fi­dent using com­put­ers have been unable to use it effec­tive­ly. How­ev­er, over the years it has become much eas­i­er to use as it has been pro­vid­ed with a sim­ply graph­i­cal point and click inter­face and also inter­grat­ed into email clients. Once installed and con­fig­ured cor­rect­ly, it’s now a sim­ple mater of click decrypt or encrypt plus typ­ing your passphrase.

There is the say­ing that a lit­tle knowl­edge is a dan­ger­ous thing and that is cer­tain­ly true of encyrp­tion tech­nol­o­gy. PGP uses Pub­lic Key Cryp­tog­ra­phy and it is vuner­a­ble to what is known as a man in the mid­dle attack. This vuner­a­bil­i­ty exists only dur­ing the exchange of pub­lic keys required to ini­ti­ate exchange of encrypt­ed mes­sages. Again, it is beyond the scope of this arti­cle to describe the attack and you can eas­i­ly look up the infor­ma­tion else­where. The impor­tant thing is that if these keys can not be exchanged in per­son then it is vital to con­firm that the keys have not been sub­sti­tut­ed on route. This is done by com­par­ing the keys ‘fin­ger­print’ by read­ing them out on the phone etc.

Final­ly. They say mis­ery likes com­pa­ny and so, iron­i­caly, does pri­va­cy. The more peo­ple who rou­tine­ly encrypt their com­mu­ni­ca­tions the more secure every­one becomes. If you were the only one using encryp­tion then it might draw atten­tion to you and any­one you com­mu­ni­cate with. If you only use encryp­tion for ‘dodgy’ emails then this might also attract atten­tion. Once you have the soft­ware installed and con­fig­ured it makes sence to use it when­ev­er pos­si­ble regard­less of the con­tents of the email.

Fur­ther read­ing:
http://en.wikipedia.org/wiki/E‑mail_privacy
http://en.wikipedia.org/wiki/Email_Encryption
http://en.wikipedia.org/wiki/Pretty_Good_Privacy
http://www.andrebacard.com/pgp.html
http://en.wikipedia.org/wiki/GNU_Privacy_Guard

Soft­ware
http://www.pgpi.org
http://www.gnupg.org/ (also known as gpg, open source ver­sion of pgp)
http://www.gpg4win.org/ (gpg installer for win­dows)
http://macgpg.sourceforge.net/ (Mac OSX port of GnuPG)

Addi­tion­al soft­ware sug­ges­tions

Don’t have your own com­put­er or don’t take it with you every­where you go? Well there are inter­est­ing options avail­able now util­is­ing USB mem­o­ry sticks. These have got real­ly cheap recent­ly and you can get a 1gb dri­ve for under 20 pounds. That’s a lot of space and it fits in your pock­et.

Peo­ple have been devel­op­ing what are called portable appli­ca­tions ( http://portableapps.com/). These run from the USB stick rather than need­ing to be actu­al­ly installed on a spe­cif­ic com­put­er. More impor­tant­ly they are con­fig­ured so that tem­po­rary files ect are store on the stick so as not to leave a trace on the com­put­er they are run­ning on.

With one of these sticks and the right soft­ware you can walk into a library etc and use a pub­lic com­put­er to run your own soft­ware and access your own files. It is a very use­ful way to have access to your mail etc and the data on the stick can be encrypt­ed using soft­ware such as True­Crypt.

Any­way, in the con­text of the arti­cle above I want­ed to men­tion a cou­ple of specifc portable appli­ca­tions. Both are portable email clients based on Thun­der­bird.

One is called Mobil­i­ty Email and it includes OpenPGP and S/MIME encryp­tion. It sup­ports IMAP, POP, SMTP and web based email. It is designed to from any loca­tion with no instal­la­tion or con­fig­u­ra­tion, allow­ing access your email and con­tacts on mul­ti­ple machines. Most impor­tant­ly, no per­son­al data is left behind once the appli­ca­tion is closed.

http://en.wikipedia.org/wiki/Mobility_Email
http://www.mobilityemail.net/

There is also the offi­cial Mozil­la Thun­der­bird Portable Edi­tion (for­mer­ly Portable Thun­der­bird). There are two pack­ages avail­able, one with GPG and Enig­mail pre­con­fig­ured to encrypt and sign your email.
http://portableapps.com/apps/internet/thunderbird_portable

Note. Those npeo­ple who don’t require porta­bil­i­ty may well be inter­est­ed in using the ori­nary Thun­der­bird email client plus openPGP and the Enig­mail exten­sion to pro­vide an easy to use and ful­ly interi­grat­ed email encryp­tion sys­tem. It’s cross plat­form, free and has a large com­mu­ni­ty of user and devel­op­ers. You can even use it with the Web­mail exten­sions to access yahoo, hot­mail and gmail accounts etc.
http://enigmail.mozdev.org/

——————————————————————————–

Rise­up users and PGP

It’s a lit­tle known fact but rise­up users can use PGP from with­in their web­mail accounts. I only dis­cov­ered this recent­ly and as far as I can tell it’s only been an option since rise­up upgrad­ed to ver­sion 4 of IMP in late 2005.

Only the IMP web­mail has the PGP fea­ture, not Squir­rel­mail which I guess most rise­up peo­ple use sim­ply because it’s at the top of the login page. How­ev­er, you can swap between the two with­out prob­lem if you’ve already been using Squir­rel.

The PGP fea­tures are not enabled by default and it’s a bit hid­den away which might explain why I’ve nev­er heard men­tion of it. The rise­ups doc­u­men­ta­tion on secu­ri­ty makes no men­tion of the fea­ture, not even in their PGP page. I checked on google for any­thing about pgp on rise­up but could­n’t find any­thing either so I decid­ed to write a ‘how to’.

HOW TO SET UP PGP IN RISEUP

To enable the fea­ture you have to login to the IMP web­mail (obvi­ous­ly make sure you are using a secure con­nec­tion https:// as described in the arti­cle above). When logged in you click options from the top nav­i­ga­tion menu then click ‘PGP Options’ under oth­er options on the right hand side.

Now you tick ‘Enable PGP func­tion­al­i­ty?’ then click ‘Save Options’ and the page refresh­es and you have a bunch more options. I sug­gest you don’t tick ”Should your PGP pub­lic key to be attached to your mes­sages by default?’ but you prob­a­bly should click ‘Should the body of text/plain mes­sages be scanned for PGP data?’

Fur­ther down the page you have two more sec­tions which weren’t there until you enabled PGP. One of these is ‘Your PGP Public/Private Keys’. If you already have a PGP keys then you will need to upload them here by click­ing upload and either copy and past­ing the appro­bri­ate key or brows­ing the file on your machine and attach­ing it.

How­ev­er, if you don’t have a PGP key pair then you can actu­al­ly cre­ate them now from with­in IMP. Per­son­al­ly I feel this is a bit of a secu­ri­ty risk as it requires you to trust rise­up, but then again you have to trust rise­up if you are plan­ning on using web­mail with your email in the first place. Cre­at­ing a key pair using IMP is easy, just fol­low the instruc­tions.

Once you have you keys cre­at­ed or uploaded you need to enable the address book. This is per­haps the most illog­i­cal part of the con­fig­u­ra­tion. There is a line on the page where the words ‘PGP Options’ appears on the left and the fol­low­ing on the right ’ Address Books | S/MIME Options »’

Click on the link to Address Books and then on the new page you will see a pull down menu towards the bot­tom with the words ‘Choose the address book to use when adding address­es’ writ­ten above. Change the selec­tion from ‘None’ to ‘My Address Book’ with­in the drop down menu and then click ‘Save Options’ at the very bot­tom of the page.

You can now return to the PGP Options page and upload your friends PGP pub­lic keys to the new­ly enabled address book. It’s just a mat­ter of cut and past­ing the key block from an email etc.

That should be it… click ‘Save Options’ again just incase and then return to your Inbox

USING PGP ON RISEUP

When you cre­ate a new mes­sage you will find new options below the text body, just below the Send Mes­sage but­ton. These are a drop down menu from which you can choose to sign and/or encrypt your mes­sage with PGP, and also a tick box enabling you to send a copy of your PGP pub­lic key with your mes­sage. When you click Send Mes­sage you will be asked for your passphrase in a seper­ate box and then you click Send Mes­sage again.

! It’s worth point­ing out that if you have pop­up fil­ter­ing acti­vat­ed (and you should), then you must con­fig­ure it to allow pop­ups from tern.riseup.net and petrel.riseup.net oth­er­wise you won’t get the enter passphrase win­dow appear­ing and you won’t be able to encrypt or decrypt any­thing.

When you recieve a PGP encrypt­ed mes­sage you will find a box that reads “This mes­sage has been encrypt­ed with PGP. You must enter the passphrase for your PGP pri­vate key to view this mes­sage.” (again, pop­ups must be enabled or it won’t work). Obvi­ous­ly you type your passphrase and you get to read your mes­sage.

! Don’t for­get to log out when you have fin­ished or some­body else might come along and con­tin­ue using your web­mail ses­sion with the passphrase still cached so be able to read your encyrpt­ed mes­sages!

That cov­ers it all I think. For the best secu­ri­ty it would be prefer­able to use PGP local­ly on your own machine which you are sure is secure. How­ev­er, the PGP option with rise­up is still very very use­ful. DONT FORGET.. YOU MUST USE A SECURE SSL CONNECTION TO HTTPS://RISEUP.NET

Final­ly, a few quick notes on choos­ing a PGP passphrase.

Do not use the same pass­word as you use for your email or any oth­er pur­pose. .
Do not write it down but obvi­ous­ly choose some­thing you can remem­ber.
Avoid dic­tio­nary words and names of your fam­i­ly or pets.
Aim for at least 12 to 16 char­ac­ters
Mix uper case and low­er case let­ters, num­bers and punc­tu­a­tion for the strongest passphrase.

——————————————————————————–

Use secure email providers

Fol­low­ing the link to rise­ups pages on secu­ri­ty I found this infor­ma­tion which is quite inter­est­ing. Basi­cal­ly it’s about a pro­to­cal which mail servers can use to talk to each oth­er secure­ly so that emails are passed from source to des­ti­na­tion and not be read on route. Not all mail servers offer this ser­vice but rise­up does and it lists oth­er activist tech col­lec­tives that pro­vide such mail mail servers. Obvi­ous­ly it would be bet­ter to encrypt all mail using PGP etc but that’s not cur­rent­ly real­is­tic so for those mes­sages that still go as plain text it is a very good idea to be using a mail ser­vice that pro­vides Start­TLS.

(tak­en from rise­up…)

What is Start­TLS?

There are many gov­ern­ments and cor­po­ra­tions which are sniff­ing gen­er­al traf­fic on the inter­net. Even if you use a secure con­nec­tion to check and send your email, the com­mu­ni­ca­tion between mail servers is almost always inse­cure and out in the open.

For­tu­nate­ly, there is a solu­tion! Start­TLS is a fan­cy name for a very impor­tant idea: Start­TLS allows mail servers to talk to each oth­er in a secure way.

If you and your friends use only email providers which use Start­TLS, then all the mail traf­fic among you will be encrypt­ed while in trans­port. If both sender and recip­i­ent also use secure con­nec­tions while talk­ing to the mail servers, then your com­mu­ni­ca­tions are like­ly secure over its entire life­time.

We will repeat that because it is impor­tant: to gain any ben­e­fit from Start­TLS, both sender and recip­i­ent must be using Start­TLS enabled email providers. For mail­ing lists, the list provider and each and every list sub­scriber must use Start­TLS.

Which email providers use Start­TLS?
Cur­rent­ly, these tech col­lec­tives are known to use Start­TLS:

* riseup.net
* resist.ca
* mutualaid.org
* autistici.org/inventati.org
* aktivix.org
* boum.org
* squat.net
* tao.ca
* indymedia.org
* eggplantmedia.com
* so36.net

We rec­om­mend that you and all your friends get email accounts with these tech col­lec­tives!

Addi­tion­al­ly, these email providers often have Start­TLS enabled:

* uni­ver­si­ties: berkeley.edu, johnhopkins.edu, hampshire.edu, evergreen.edu, ucsc.edu, reed.edu, oberlin.edu, pdx.edu, usc.edu, bc.edu, uoregon.edu, vassar.edu, temple.edu, ucsf.edu, ucdavis.edu, wisc.edu, rutgers.edu, ucr.edu, umb.edu, simmons.edu.
* orga­ni­za­tions: action-mail.org, no-log.org
* com­pa­nies: speakeasy.net, easystreet.com, runbox.com, hushmail.com, dreamhost.com, frognet.net, frontbridge.com, freenet.de, blarg.net, green­net (gn.apc.org)

What are the advan­tages of Start­TLS?

This com­bi­na­tion of secure email providers and secure con­nec­tions has many advan­tages:

* It is very easy to use! No spe­cial soft­ware is need­ed. No spe­cial behav­ior is need­ed, oth­er than to make sure you are using secure con­nec­tions.
* It pre­vents any­one from cre­at­ing a map of whom you are com­mu­ni­cat­ing with and who is com­mu­ni­cat­ing with you (so long as both par­ties use Start­TLS).
* It ensures that your com­mu­ni­ca­tion is pret­ty well pro­tect­ed.
* It pro­motes the alter­na­tive mail providers which use Start­TLS. The goal is to cre­ate a healthy ecol­o­gy of activist providers–which can only hap­pen if peo­ple show these providers strong sup­port. Many of these alter­na­tive providers also also incor­po­rate many oth­er impor­tant secu­ri­ty mea­sures such as lim­it­ed log­ging and encrypt­ed stor­age.

What are the lim­i­ta­tions of Start­TLS?

How­ev­er, there are some notable lim­i­ta­tions:

* Your com­put­er is a weak link: your com­put­er can be stolen, hacked into, have key­log­ging soft­ware or hard­ware installed.
* It is dif­fi­cult to ver­i­fy: for a par­tic­u­lar mes­sage to be secure, both the ori­gin and des­ti­na­tion mail providers must use Start­TLS (and both the sender and recip­i­ent must use encrypt­ed con­nec­tions). Unfor­tu­nate­ly, it is dif­fi­cult to con­firm that all of this hap­pened. For this, you need pub­lic key encryp­tion (see below).
Start­TLS

——————————————————————————–

512 bit encryp­tion bro­ken in less than a sec­ond

The prob­lem with tech­nol­o­gy as a means for secure com­mu­ni­ca­tion is it’s own advance­ment. What is secure today may not be secure tomor­row. And peo­ple who think they’re safe, using PGP or whathavey­ou, then share infor­ma­tion over email that should only be shared face-to-face.

source: http://www.khaleejtimes.com/DisplayArticleNew.asp?xfile=data/theworld/2006/November/theworld_November597.xml§ion=theworld
crypt broke

————-
“The report’s authors, Onur Aci­icmez, Cetin Kaya Koc and Jean-Pierre Seifert depict a con­crete attack on OpenSSL on a Pen­tium 4 proces­sor, albeit using a key that would be con­sid­ered quite short by today’s stan­dards (512 bit).”

Hmmm.. What is described requires the attack­er to be run­ning hiden soft­ware on the machine per­form­ing the encryp­tion oper­a­tion — in oth­er words it requires that attack­er to have installed soft­ware either with phys­i­cal access to a machine or remote access. Now cer­tain­ly, if you are using an inse­cure oper­at­ing sys­tem like win­dows then it would be a risk, how­ev­er a far eas­i­er attack in this case would be to use a key­log­ger, either soft­ware or hard­ware.

In oth­er words, Seifert and his col­leagues dis­cov­ery is unim­por­tant in rela­tion to email secu­ri­ty since much eas­i­er and more prac­ti­cal exploits exist already.

Blog­gers writ­ting about the new tech­nique have sug­gest­ed it it is the secu­ri­ty of appli­ca­tions using Dig­i­tal Rights Man­age­ment (DRM) most like­ly to be threat­ened by such tech­niques. For exam­ple, user might use the tech­nique to remove the license pro­tec­tion on WMA audio files they pur­chase so that they can share them with friends. In this sit­u­a­tion they would obvi­ous­ly be well placed to install the spy process­es required in the attack.

You attempt to dis­cour­age peo­ple from using the tech­nol­o­gy employed by finan­cial and gov­ern­ment insti­tu­tions etc is a waste of time. The weak point in all these secu­ri­ty mea­sures is the peo­ple using them. Obvi­ous­ly there is a lot to be said for low tech ‘cold war’ solu­tions like going to meet some­body face to face but it’s a lie to sug­gest they are them­selves are with­out sig­nif­i­cant risk.