[Cryptography] Dark Mail Alliance specs?

ianG iang at iang.org
Sun Mar 30 17:06:05 EDT 2014


On 29/03/2014 18:03 pm, Peter Fairbrother wrote:
> On 29/03/14 02:30, ianG wrote:
>> On 26/03/2014 23:05 pm, Peter Fairbrother wrote:
>>
>>> However, I am of the firm opinion that if it isn't compatible with
>>> ordinary email then it won't get widely adopted, full stop.
>>
>>
>> Facebook, Skype, Snapchat, whatsapp and the apple thing (facetime?) says
>> otherwise, but perhaps the language has changed?
>>
>> Of course, we can all agree or disagree on what "widely adopted" means.
>>
>> My view is, whatever definition you come up with, it will be
>> self-selecting.  The younger generation don't use email, except when
>> forced to by schools.
> 
> Or by work.
> 
> But the first objective is:  "1) to eventually get a majority of all
> email sent end-to-end encrypted to a minimum security standard".
> 
> Older folks, and especially businesses, just plain ain't going to give
> up on email.


Right.  The last telegram was only sent a few years back.  They are
still delivering letters by hand in some countries.  Windows XP is still
in use.

Alternatively, there is a clear play for someone who can create an email
look-alike that uses a completely separate protocol / means.  This could
be a frontend to Jabber / OTR or Skype or ... or it could be an API into
the various messaging agents that advertise email delivery to a certain
select group from the addressbook ... or it could be a new viral
download that runs as its own service and then gateways out to the old
email world when not talking to "us".

Point being, I think the answer will be found by changing our
internalised understanding of email, not by securing it as it is now
constructed.


> A different objective might be "to get a majority of asynchronous
> internet communications sent in end-to-end encrypted form", and while
> that's one I'd support, it's a much bigger bite.


The problem with this is that it breaches some of the laws of security.
 To secure, you must have a definition of what security is (private?
auth or auth? transactional?) and that cannot be done without resort to
humans and an application.

E.g., in some security contexts, unshared messages mean secure messages,
and in other contexts, shared messages mean secure messages.


> Note that of the social media systems you mention, only a small
> proportion of skype calls are end-to-end encrypted


When you say "small proportion" you mean those that are skype to skype?

> (by a secret
> proprietary system), and even that may be changing or have already
> changed where you are, Gubbmint wants to at least be able to see Skype
> calls.


well, we "know" that the protocol was changed pre-Microsoft so as to
open certain features up, including listening to chat.  No details of
course.  Snowden "knows" that Microsoft and Skype are partners of the TLAs.

Is there any information that certain governments are tracking and
listening dynamically to phone calls?

(I'm interested in facts, not popular beliefs...)

> Here in the UK there have recently been calls to change the law to make
> interception of the other media you mentioned easier by installing "deep
> packet inspection" boxes, controlled by GCHQ, to most internet lines..

Ah.  I sense the implication of a threat actor.

Note however the shift from apples to oranges.  These systems that I
suggested deliver more security than alternates, even when they have
some holes in them.  If we are going to compare the holes in one, we
have to compare it to the holes in another.


>> Africa doesn't use the web, they use phones.
>> Email can't be eliminated from spam without fixing one of two things:
>> free of cost and free of identity.
> 
> 
> Yup. However end-to-end encryption does increase cost, if only a little
> -  so perhaps encrypted message may be seen as more valuable than
> unencrypted messages.


Doesn't work.  Never has, never will.  Encryption has to be provided,
every time, all the time, and at no additional cost.  It's the only way
we've ever successfully fielded it.  Skype, SSH, GSM, etc.

If it can be turned off, then your attacker will turn it off.



iang


More information about the cryptography mailing list