Category: Privacy

Apart from video telephony, eMail is one of the services I have to use without encryption and is thus a thorn in my quest for having as much privacy as possible online and to protect myself from the doings of surveillance states. I tried my luck with the Thunderbird GnuPG plugin but in practice there are two many limitations for me (see here for the details). From my point of view the email system as we use it today is broken as far as confidentiality and privacy is concerned and there's no way to fix it. The only cure is a complete redesign with security and privacy in mind. This is where the Darkmail Initiative comes in.

Founded by Ladar Levinson, owner of 'Lavabit', a company that offered secure email storage and that recently had to shut down to prevent the US government from spying on their users after having to hand over their SSL encryption keys, Darkmail sets out to fix that particular problem by designing a new email system with built-in end-to-end encryption. This way, the user is in full control of encryption and services providers can no longer be forced to reveal SSL keys or other sensitive information.

This is the way it ought to be! Instead of just tapping and analyzing all data, surveillance of email will become more selective again as the only point where the email is decrypted is on a person's device. And while I don't support general surveillance of the Internet I very much support targeted tapping to keep us save, provided that a warrant has been obtained from a judge after providing evidence as to its necessity.

Here's a link to a video of an interview the Huffington post did with Lavar a couple of days ago. Apart from a general introduction he also briefly discusses the impact end-to-end encryption will have for online email services such as Google, Yahoo, Microsoft and others. Think targeted adds based on automated scanning of email content (which is no longer possible on the server side)…

End-to-end encryption is the only way to keep email private and confidential. As current methods are insufficient I fully welcome this initiative and decided to back it over at Kickstarter where Ladar is raising money to fund this open source project. Have a look perhaps that's something you'd like to support as well.

And yes, I assume the 'dark' in Darkmail refers to the connection going 'dark' (i.e. being encrypted and not breakable) rather than implying dark dealings 🙂

It's been a while since part 8 of this series on how I've improved protection of my privacy in the face of massive human rights violations against my freedom and privacy by a number of security organizations around the world as revealed by Edward Snowden. I've said good bye to public instant messaging providers and have installed my own server for family internal communication together with secure end to end encryption. Certificate Patrol in the browser protects me of rogue SSL certificates, I've installed GnuPG for email encryption but found it unusable in practice, I've become a regular user of TOR, my browser automatically deletes cookies when I exit it and most importantly, Owncloud keeps my files, calendar and address book in my own domain. For details on all those things click on the "Privacy" link at the end of this post to see the previoius parts of this series. Despite all of this, however, I still feel there are a number of open flanks that still need to be addressed:

• eMail: As a means of communication, email is completely broken and even encrypting the content will not make this form of communication secure. This is because there always needs to be a server somewhere in the Internet to store and forward messages and even if the content is encrypted, the subject, sender and receiver are not. So apart of encryption the only think that could at least make communication between my family members secure and private is to host my own email server at home and have all devices receive and send email via that server at home. This way at least the email and content we send between each other would be secure as that would never end up on an external server.

• My RSS aggregator leaves trails: Not mentioned above is Selfoss, my self hosted RSS aggregator that I installed after Google decided to shut down its Reader cloud service. It's been a tremendous enabler so I'm quite happy Google shut down the only service apart from search that I used to use from them. One thing I'd really like to do when I have a bit of time is to TORify all aggregator web requests to keep information about which web sites I read private. That might be a bit on the paranoid side it's really nobody's business which web sites I'm interested in. Period.

• Voice and Video calling: I still have to find a good replacement for Skype for communication between family members as a central server farm controlled by Microsoft knows about every call and every message I send over the Skype client. This is probably the most pressing issue that I have to address in the near future.

• Metadata: One thing I can do little about is the metadata my communication creates. Phone companies record who calls me and whom I call, anyone observing my IP packets knows what websites I'm interested in, which bank I am a customer of, etc. etc. 

While I can still close a number of holes in my privacy armor, especially the meta data issue clearly shows that raising the shields is just treating the symptoms but is definitely not a cure for secret service agencies in many countries trampling on our human rights of freedom and privacy by collecting all data they can get hold of. I recently heard a pretty interesting analogy: Security agencies are like the immune system of the body, which detects and protects us from harm attacking our body. Without an immune system the body would not survive. But then there are autoimmune diseases where the immune system attacks the body which is ultimately fatal. And that's what just happening right now and we have to do everything to ensure that security agencies act as a proper immune system and not like an autoimmune disease. In other words, treating the symptoms by raising the shields is not enough, it's very important to treat the illness as well.

Due to Nokia's decision to back away from freedom and open source I was forced over the past year or so to rely on a two device strategy while traveling as there were two crucial applications missing for me on Android so far: A decent camera and offline maps + navigation functionality. While the camera issue has improved significantly in the past year I was still hanging on to Nokia Maps and its offline capabilities as Android's Google maps was just too expensive to use abroad and leaked too much of my location information to Google. But now, things have changed.

Open Street maps has come a long way over the years and Open Street Maps for Android (OSMAND) has developed beyond my wildest hopes and now offers car navigation on Android with downloadable maps that worked just great during my recent car trips between Germany, the Czech Republic and Austria. Car navigation worked well, there's a lane assistant that even Google maps does not have and it's ultra configurable to show or hide many details one can be interested in or not. Finding and address is quick, the routes calculated are good, the lane assistant worked.

The only two major downsides I came across was that while it perfectly calculated a route between Austria and Germany it wouldn't come up with a route for my trip between the Czech Republic and Austria so I had to split that particular route in two parts. Also, while route calculation for short tips is quick, trips of several hundred kilometers take a bit to calculate, I estimate it to be in the order of 30 seconds. Nokia maps does better in this regard. Like Google maps, Osmand also stops navigating in tunnels when the GPS signal is not present. This is better in Nokia maps which continues to show the route based on a speed estimation. One thing neither Osmand nor Nokia maps in offline mode can do is to show the current traffic situation which is a strong point of Google maps. Having said this, I feel that those drawbacks are a small price to pay for getting an open source solution that doesn't transmit location information to some big web company.

The screenshots on the left show how Osmand looks in practice and I was more than happy to pay the six Euros for the full version to be able to download more than four maps for offline use. So while I had my old Nokia phone as a backup with me on my current trips I didn't use it a single time once I figured out how well Osmand works. From now on I guess it will remain in the cabinet.

Kudos to the OSM and Osmand team and all people contributing to the open maps, this is really incredible!

The next step in raising my shields against all sorts of three letter agencies spying on my data packets on the Internet has been to think about how I can protect myself better against spying on my instant messaging communication between my family members. In part one of this series I've already made the first and most important step by installing "Off The Record" (OTR), an end to end encryption for all sorts of instant messaging services. The server behind the service, however, was still property of a public company and hence my data packets were probably still routed half around the world ready for interception and collection of metadata (i.e. who communicates with whom and when). Time to change that as well.

XMPP is the protocol of choice for running your own instant messaging server as it is supported by quite a number of desktop and mobile messaging clients such as Pidgin that I'm already using. On the network side, one can choose from a number of different solutions and after looking around a bit I chose Prosody. On a Linux based system such as a Raspberry Pi it is straight forward to install as it is included in the software catalog. A "sudo apt-get install prosody", a few changes in the configuration file that are described on Prosody's web page and creating a TCP port forwarding rule in my DSL router was pretty much everything to get it working.

I've been trying it for a week now together with Pidgin and OTR encryption and it works like a charm and the three letter agencies have to work a bit harder now to intercept our family instant messaging traffic to collect metadata. And on the cost side it don't cost me a penny extra as I have the server running together with the Selfoss RSS server (see here and here) that runs on the same Raspberry Pi.

Most users today are very happy that web services recognize them when they come back to use a service over many weeks or even months as they don't have to identify themselves each time they visit a site. While this is undoubtedly convenient it creates a number of severe privacy issues:

• On sites like my favorite online shopping portal I like to browse for things anonymously. If I keep being recognized then the shopping portal can record all searches and results I have clicked on. To me that feels like I if I was observed by a dozen cameras in a store and the store then analyzes the recordings and keeps the results indefinitely. No thanks.

• Except for Safari and perhaps Firefox in the future, browsers allow the use of third-party cookies on web pages. This way, advertisers can track a user's path through the Internet because each time a web site is visited that links to some content of the advertiser, the same cookie is sent back thus creating a trail of where the user went for the advertising company. 

• The third-party cookie mechanism also allows popular social networking services to keep track of where their users go when they leave their website. 

All these things are totally unacceptable to me. Fortunately there's an easy fix for this. In the web browser a few simple settings protect users from such schemes:

• Disallow 3rd party cookies ("Accept 3rd party cookies = never"). It's done by the Safari browser by default and I've used it for many months now without any bad side effects.

• Configure the browser to delete all cookies when it is closed ("Keep until: I close Firefox"). This way, Amazon and other web services I use do not recognize me again once I restart the browser. The downside is of course that I have to log-in again for personalized services. But with the browser's autocomplete username and password feature it is only a minor inconvenience.

• On a few websites such as my blogging service I would like to remain logged in despite browser restarts. For this, there's a cookie whitelist in Firefox (click on the "Exception" button in the Privacy Tab in Preferences). Only cookies on the whitelist survive browser restarts if the option "Keep Until" is set as described in the previous bullet point.

The images below show the settings I have made in Firefox to ensure as much privacy for myself as possible for normal web surfing. For advanced privacy needs I then use a TORified browser as described in a previous post.

  

This has already been part 7 of my "Raising the Shields" series and it will probably not be the last. In case you have missed some of them and are interested, here's a link that shows them all in sequential order.

In the previous post in my series on how to protect your privacy online I've looked at the TOR software which hides your location from prying eyes and encrypts all data right until the TOR exit node. I was delighted how easy it has become in recent years to install and use the package so the next logical step was to see how usable the Android variant of the package has become.

Installation of TOR on Android is straight forwarded. All that is required even on non-rooted devices is to install Orbot for the basic TOR functionality and Orweb, the web browser that uses Orbot. Both are available from app stores or can be installed directly from here and here.

On non-rooted devices only the Orweb browser uses the TOR functionality provided by Orbot so all other applications continue to work as before and are obviously as unprotected as before. This can be both good and bad depending on the usage scenario. If TOR is only to be used for specific privacy sensitive web browsing sessions then this is the best setup as all security measures are automatically taken care of such as Java script being disabled, use of a generic browser ID when contacting web sites to prevent browser fingerprinting, no use of persistent cookies and no Flash. While this is perfect for privacy, such settings are likely to stand in the way for many everyday usage scenarios that are perhaps a bit less privacy sensitive. For these, the standard browser can be used as before as no settings are changed and Internet access is as direct as before.

If Orbot is installed on a rooted Android device it can be used as an Internet proxy just like on the PC and all programs that are capable of standard proxy functionality can use a TOR tunnel. This way, mobile email, instant messaging and other applications can be protected as well.

When starting Orweb, it offers the user to also start the Orbot background app if it hasn't been started before.  After a couple of seconds the secure TOR tunnel is established and while using TOR has somewhat of a a speed impact I found it entirely usable. Unfortunately there are some usability restrictions introduced by the privacy model. There's no browsing history in the browser from which a previously visited website can be quickly reached and there are also no bookmarks. While I can understand both measures I think there should really be a bookmark feature even if it is a compromise, perhaps with a warning to the user that using bookmarks could reveal privacy sensitive information when the device is stolen. A solution to the problem could perhaps be bookmarks stored somewhere on the web anonymously and reachable via a short bit.ly link?

To sum up, I found TOR a great privacy protection tool for mobile use. It's easy to install and use but as on the PC, privacy and security means there are some usability limitations. I therefore prefer using TOR like on the PC in a two browser setup, one for my standard web browsing needs and another one for stuff where I would like to guard my privacy.

Using the Internet privately and anonymously with an off the shelf web browser is next to impossible. The combination of IP address, cookies, what the browser willingly tells web servers about you, add-ons such as Flash communicating with a remote server outside of the browser context, etc. etc., leaves little privacy and anonymity. There's a project, however, that promises help and it's called 'The Onion Router', or TOR for short.

TOR is based on a network of relay nodes that forwards encrypted data packets to and from a client to a TOR entry node, nodes in between and an exit node. Before a packet is sent, it is encrypted several times and each TOR node can just remove one encryption layer. Imagine the layers of an onion and you understand why the project has chosen this name. This way each node only knows its direct neighbors and hence your original IP address is concealed.

I tried TOR a number of years ago for the first time and at the time it was far too slow for my taste for everyday use. When I recently tried it again, however, I noticed that even during high times during the day, speed is acceptable for web browsing. Don't expect multi megabit speeds though. In addition to web browsing, TOR can also be used with email programs such as Thunderbird to anonymize the location from which you access your emails and also other programs that can handle proxying such as for example SSH for remote server management and Instant messaging clients such as Pidgin.

While a number of years ago, setting up TOR was a bit of a tricky exercise, things have become much easier these days. The TOR website features a browser bundle that is easy to install and comes preconfigured for immediate use with Firefox in a separate directory from your main Firefox installation. A single click starts the TOR software and once a connection to the TOR network is established the package automatically loads the TORified Firefox that has no plugins except for NoScript to disable JavaScript. Also, it starts no external programs when requested by the web page to ensure there is no information leakage via IP connections established outside the browser context.

While Panopticlick says my normal browser is unique among 3 million other users, which means that even without cookies I am instantly recognizable by web servers, the TORified Firefox browser is only unique among 1500 others. A pretty good value.

One thing to keep in mind when using TOR is that one can't be certain if the exit node is hosted by a white hat or a black hat. Therefore beware of using usernames and passwords in SSL connections as the exit node could produce valid SSL certificates for websites on the fly if they have access to a certificate authority and thus could launch a man in the middle attack on you. There's ways to detect this, too, such as removing all SSL certificates in the TORified Firefox which triggers an alert each time an HTTPS protected web page is visited and each time a certificate is changed afterward.

All things considered, I'd say TOR is very simple to use on a PC today and being aware of its limitations in terms of exit node security it can provide anonymity while still being fast enough. In a follow up post I will have a closer look at the Android version of TOR and a TORified browser.

On my way to putting some more privacy through encryption and self hosting between me and the rest of the world the next step was looking at email as that is certainly one of the main means of communication for me.

As I already use Thunderbird as my email client instead of a web mailer interface, getting PGP (Pretty Good Privacy) encryption to work is quite easy. The only thing that is required on my Linux notebook is the installation of the Enigmail plugin in Thunderbird, which is straight forward. On a Windows box, GPG (Gnu Privacy Guard) has to be installed in addition.

Once installed, the next step is to create a public/private encryption key pair of which the public key is then distributed to friends and colleagues so they can use it to encrypt email they want to send to me. The other end needs to do the same and once you have imported someone's public key into Enigmail's key repository, encryption works both way. Also, each end can digitally sign their emails so it can be verified that the email is not forged.

So much for the elevator pitch version, for detailed step by step instructions on how to get this working, have a look here.

Simplicity is Key

As I want to use email encryption to communicate with non-technical people one thing that is very important to me is that the Engimail plugin can be configured to automatically encrypt emails to addresses for which a public key has been imported. While not straight forward, this can be done by creating Enigmail encryption settings per email address. One can also configure Enigmail not to ask for a password to access the key store which makes encrypting and decrypting emails completely transparent to the user. Not quite ideal from a security point of view but probably the only option from a non-technical user usability point of view…

There is one big catch, however: Emails remain encrypted on the PC and searching the body text later on in Thunderbird is not possible as the decryption module is not hooked into search. I don't search my emails a lot but I need that function from time to time to find an important email I have sent or received ages ago. A pretty high price to pay for encrtyption if I can't search my email anymore. The obvious solution for this would be too hook decryption into the code that searches my email database. Another option would be, since my hard drive is encrypted anyway, to remove encryption from received and sent emails and only keep the sender's signature. This way, search would work again and emails would remain readable.

PGP on Mobile

I also need encryption and decryption of my emails to work on my Android smartphone. Again it turned out that I have the necessary stuff already in place since I already use K-9 mail instead of Google's native Android email program. While K-9 doesn't support PGP encryption out of the box there's an OpenPGP plugin called APG in Google's app store. K-9 needs to be reinstalled after APG is up and running but this is quite painless by exporting and importing K-9's configuration to a file.

Unfortunately, and that's another big catch for me, APG only supports simple emails. Emails that come in multipart MIME format, e.g. because there's a file attachment, or because it has been setup up this way by the originator are not yet supported. When looking at the APG website and mailing list, it looks like there has been no real development since 2010. In other words, the project seems to have stalled.

Things That Are Never Encrypted

Despite encryption, the sender and receiver of an email are always sent as plaintext, so the metadata of whom I communicate with can still be recorded. Also the subject line of encrypted emails is also in the plain, something that one should also be aware of as well.

Summary

Being unable to search through stored emails that are encrypted and K-9's very limited PGP support, secure emailing becomes quite impractical for me for the moment. A typical
convenience trumps security decision. But these shortcomings are not inherent to the basic encryption process and could be fixed in furture software versions of Enigmail, Thunderbird and K-9.

It's quite obvious that privacy and anonymity doesn't come built into most computing and online products today. I hope my 'Raising the Shields' posts are giving you some ideas and background information what is possible and what you might want to use yourself both while mobile and at home.

While doing some research I came across an interesting site called 'PRISM Break – Opt out of PRISM, the NSA's global data surveillance program'. Lots of great links there to programs that protect your privacy online in areas such as web browsing, email, search (ever head of Duck Duck go!?), maps, instant messaging, voice and video calling, cloud storage, etc. etc. etc.

I immediately found half a dozen tools I haven't come across so far and that I definitely want to try out in the weeks to come. So head over and have a closer look!

In the majority of cases, https provides privacy and security by encrypting and decrypting data traffic to and from a web server. The mechanism is based on web server SSL (Secure Socket Layer) certificates and public/private keys that are exchanged during connection establishment. Data sent to the other end is always encrypted using the public key of the recipient. Decryption is only possible with the corresponding private key on the other side. This kind of encryption works as the private keys are never exchanged and hence nobody intercepting the data on its way from source to destination can decrypt the information. There is one weakness, however, most people are not aware about.

How does a web browser know that the web server's public key was actually sent from the web server and not from someone that sits in between the web browser and the server? For this purpose the web server sends an SSL certificate during the https session establishment that is signed by a certificate authority the web browser trusts. To get such a signed certificate a web site owner has to register with a certificate authority that web browsers trust. Unfortunately, there are a huge number of certificate authorities today that are trusted by web browsers and many are operated by what some would consider less than trusted entities. And here lies the weakness.

If a man in the middle gets hold of such a certificate authority he can create certificates for any domain on the fly. As a web browser does not check if the certificate authority for a web site has changed since it was last visited this goes unnoticed and opens the door to anyone that is able to perform a man in the middle attack with traffic diversion.

This is where Certificate Patrol, a Firefox add-on comes in. It stores certificates it has previously seen and compares them against the certificate presented by a website it has come across before. If they don't match a warning is shown to the user with the details. There are valid reasons for websites to exchange their certificates such as for example once their validity time has expired. This is also checked and Certificate Patrol informs the user that the certificate change was likely o.k. due to this reason. I've been using the add-on for quite some time now and it has become quite refined these days. I haven't come across fraudulent certificates so far but it feels good to know that I would see it should it ever happen. What's missing at this point is something similar in Thunderbird for ensuring the certificates for POP3 and SMTP email communication are not tampered and a similar solution for my smartphone.

Agreed, creating certificates on the fly and inserting oneself in the
traffic stream is far from easy to do but I would not be surprised if
this was part of the toolkit of certain three-letter agencies.