Re: [cryptography] ICIJ's project - comment on cryptography tools

2013-04-09 Thread Kevin W. Wall
Some OT comments to an OT response... On Mon, Apr 8, 2013 at 8:30 AM, ianG i...@iang.org wrote: On 7/04/13 09:38 AM, Nico Williams wrote: [big snip] We've built a house of cards, not so much on the Internet as on the web (but not only!). Web application security is complete mess. And

Re: [cryptography] ICIJ's project - comment on cryptography tools

2013-04-08 Thread ianG
On 8/04/13 04:06 AM, Peter Gutmann wrote: Kevin W. Wall kevin.w.w...@gmail.com writes: I think you're giving the NSA way too much credit on why security sucks. Even if we were to restrict 'security' to the scope of cryptography, even there, I think the NSA has much less to do with dumbing down

Re: [cryptography] ICIJ's project - comment on cryptography tools

2013-04-08 Thread Jeffrey Goldberg
On Apr 8, 2013, at 7:38 AM, ianG i...@iang.org wrote: We all know stories. DES is now revealed as interfered with, yet for decades we told each other it was just parity bits. But it turned out that the interference was to make it *stronger* against attacks, differential cryptanalysis,

Re: [cryptography] ICIJ's project - comment on cryptography tools

2013-04-06 Thread ianG
On 6/04/13 07:27 AM, Nico Williams wrote: On Fri, Apr 5, 2013 at 9:17 PM, NgPS n...@rulemaker.net wrote: In the movies and presumably in real life, bad guys have smart crooked lawyers advising them. Surely the bad guys have the resources to set up bunch of servers a la iMessage/Whatsapp, and

Re: [cryptography] ICIJ's project - comment on cryptography tools

2013-04-05 Thread NgPS
On Thu, Apr 04, 2013 at 11:51:06PM +0300, ianG wrote: http://news.cnet.com/8301-13578_3-57577887-38/apples-imessage-encryption-trips-up-feds-surveillance/ iang, who never even knew it was encrypted! Presumably messages are stored in clear text on Apple's servers, similarly on servers of

Re: [cryptography] ICIJ's project - comment on cryptography tools

2013-04-05 Thread NgPS
On Thu, Apr 04, 2013 at 04:39:31PM -0500, Nico Williams wrote: Basically, this is complaint by the DEA is disinformation or misinformation (or both!). If the former case we might even be staring at the start of a new crypto wars period. In the movies and presumably in real life, bad guys have

Re: [cryptography] ICIJ's project - comment on cryptography tools

2013-04-05 Thread Nico Williams
On Fri, Apr 5, 2013 at 9:17 PM, NgPS n...@rulemaker.net wrote: In the movies and presumably in real life, bad guys have smart crooked lawyers advising them. Surely the bad guys have the resources to set up bunch of servers a la iMessage/Whatsapp, and write/deploy their own apps on their mobile

[cryptography] ICIJ's project - comment on cryptography tools

2013-04-04 Thread ianG
In a project similar to Wikileaks, ICIJ comments on tools it used to secure its team-based project work: ICIJ’s team of 86 investigative journalists from 46 countries represents one of the biggest cross-border investigative partnerships in journalism history. Unique digital systems

Re: [cryptography] ICIJ's project - comment on cryptography tools

2013-04-04 Thread ianG
On 4/04/13 21:43 PM, Jon Callas wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Apr 4, 2013, at 6:27 AM, ianG i...@iang.org wrote: In a project similar to Wikileaks, ICIJ comments on tools it used to secure its team-based project work: ICIJ’s team of 86 investigative

Re: [cryptography] ICIJ's project - comment on cryptography tools

2013-04-04 Thread Steven Bellovin
On Apr 4, 2013, at 4:51 PM, ianG i...@iang.org wrote: On 4/04/13 21:43 PM, Jon Callas wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Apr 4, 2013, at 6:27 AM, ianG i...@iang.org wrote: In a project similar to Wikileaks, ICIJ comments on tools it used to secure its team-based

Re: [cryptography] ICIJ's project - comment on cryptography tools

2013-04-04 Thread Nico Williams
On Thu, Apr 4, 2013 at 3:51 PM, ianG i...@iang.org wrote: On 4/04/13 21:43 PM, Jon Callas wrote: This is great. It just drives home that usability is all. Just to underline Jon's message for y'all, they should have waited for iMessage: Encryption used in Apple's iMessage chat service

Re: [cryptography] ICIJ's project - comment on cryptography tools

2013-04-04 Thread Peter Gutmann
ianG i...@iang.org writes: An internal Drug Enforcement Administration document seen by CNET discusses a February 2013 criminal investigation and warns that because of the use of encryption, it is impossible to intercept iMessages between two Apple devices even with a court order approved by a

Re: [cryptography] ICIJ's project - comment on cryptography tools

2013-04-04 Thread James A. Donald
On 2013-04-05 10:47 AM, James A. Donald wrote: How does it work? Is it really secure, and if it is, how did they manage a not one click for security user interface? Already answered by others on this list. Not secure, apple can MIM it. ___

Re: [cryptography] ICIJ's project - comment on cryptography tools

2013-04-04 Thread ianG
On 5/04/13 05:36 AM, James A. Donald wrote: On 2013-04-05 10:47 AM, James A. Donald wrote: How does it work? Is it really secure, and if it is, how did they manage a not one click for security user interface? Already answered by others on this list. Not secure, apple can MIM it. Seems