AltSci Cell

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

by Javantea
Sept 2, 2013

I work in the security industry, so you can probably guess that I am jaded and paranoid. You might guess that I'm depressed, but I'm not. This three-day weekend, I spent time on projects that I enjoy, not leaving the house for any reason except to buy bananas and other necessary food items. Many people in the security industry believe that secure software is impossible. They believe that sometime down the road our best efforts will be overcome by some hacker who wants something that we have. To avoid destruction, we have a process of looking for bugs, making sure that our employees' access rights are limited in some way. But that only goes so far. Sometimes there are serious gaps. So what do you do? Duct tape it together. Vendors sell duct tape by the roll. Then devs, admins and security consultants write Perl or Python scripts to hold everything together and we hope that it doesn't introduce bigger bugs than the ones we're solving.

But I have a different idea in mind. If we put our minds to the task, we can create a secure system. The cost of security is a fraction of the development cost (not dwarfing the development cost like some projects). For a while I thought that Django seemed pretty good at security. It didn't take long for a security bug to show up in a strange place that I didn't have time to check. It happens. Now I know where to look. Do I think there will be another high severity vulnerability in one of my Django projects? It's possible, but if I put a bit of time into it, it may be the one.

So given a simple web platform with good security, what do you do with it? Well, you replace anything important that goes on the web. That means this blog should be converted to Django eventually. But this blog isn't as important as other stuff. So far I have written a handful of Django websites: AI3, AltSci Brasil, J4va.com, and AltSci Crypto Mailing List. You've probably heard of AI3 and AltSci Brasil, but the other two may be a surprise. AltSci Crypto Mailing List is unfinished, but I've only spent a few days of free time on it. It's not an easy project, but it's going to be interesting.

What's interesting about a mailing list that uses end-to-end encryption? If you are paying attention, you know that the NSA has been reading all communication on the Internet for years, possibly decades. If you want to speak freely and not be held responsible for your speech by corrupt dictators, you need to encrypt your communication, create a psuedonym, and anonymize your traffic. Who has time for all that? Well, actually I do. I've been using anonymization and pseudonyms for a decade. I can say that when I think about a person wanting to kill me because of the software I write, I have plenty of time to use Tor and create a pseudonym. At the same time, I don't have nearly enough time to write the software I need to write.

The idea behind the mailing list is simple. In on sentence: instead of encrypting and sending to the server (which is harder to trust), you encrypt and sign messages to the owner who is running a script to encrypt and send to each member.
To get a copy of the messages, an attacker would need to: MitM a member and not get caught, compromise a member, or join the ML. All of which require effort and/or money.

This mailing list concept was designed specifically to keep the NSA and other evil actors out of small groups' communications and to increase the cost to them of reading public mailing list's messages. Thus instead of having no privacy with a public mailing list, you have a countermeasure: cost.

Can the NSA afford to obtain access to AltSci Crypto Mailing List? Sure. Can they afford to obtain access to thousands of encrypted mailing lists? Their budget is $10 billion. The salary of 1,000 high salary people is 1,000 * $100,000 = $100 million. Therefore, they could hire 1000 people to monitor these lists and still have $9.9 billion left over for cracking RSA, Diffie-Hellman, SHA-3 and elliptical curve cryptography. But if they are short on cash because they spent so much cracking crypto and buying supercomputers and hard drives to store everyone's communication on, they may have not budgeted in hacking a handful of mailing lists. Of course if they actually are able to crack any algorithm that PGP uses, like say SHA-1, then we're in trouble.

While I dislike setting deadlines for projects because they are always broken, I expect the AltSci Crypto Mailing List to be finished in late September. Feel free to join the list with the expectation that you'll get an e-mail from crypto@altsci.com just like a real Mailing List. When the Crypto Mailing List starts working, you'll receive an announcement.

Feel free to send me an email about the Mailing List. If you have any suggestions, I'm happy to take them into account. The reason it's not finished after about 10 hours of work on it is because RFC 3156 and traditional OpenPGP is giving me a little trouble.

Javantea out.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.20 (GNU/Linux)

iEYEARECAAYFAlIk6WcACgkQpmRrABlU/tJsxACfQPV/LqcT1ZUe5iGG5RA+QGEL
OIcAnRPw6y5rVR518Pw0IILhzRIu07nl
=bf7s
-----END PGP SIGNATURE-----