I’m tired of this shit

[[!meta description="""I’m getting really tired and bored about those crypto nerds who do not understand threat models, general public and who assume they

Shooting the ambulance

It seems that there’s a national sport among crypto nerds, and it’s shooting the ambulance. Yeah, I know, I’ve been kind of naive thinking that some people with common sense could be more vocable than the people who enjoy ranting on stuff, saying that this is shit, and that only them know the truth.

I’m speaking specifically about the own mailbox project and the torrent of flame and more or less accurate accusation it received from @aeris in this three posts. I also like to point out that the answers provided by the Own Mailbox team doesn’t makes them right. There are issues with the project, but I do not think it’s a reason for burning them alive, but instead would have been interesting to help them to improve.

This is something aeris have an issue with – I already pointed that out in the way Crypto Parties are ran around here in Paris.

The point he’s missing in those articles is – as always – what is the threat model own mailbox tries to solve; as well as mixing up a lot of things (blaming a mail server for the insecurity of TLS or for the possibility of MitM attack is … out of scope).

So, let’s try to think about that.

Everything is broken

First, as Quinn Norton once wrote, if you pretend to work in the security and tries to improve the safety of people, you have to acknowledge that: Everything is brooken. It basically states that there’s no way to have a secure system. It does not exists, it will not exists any time soon.

If you look at a project like own mailbox, where you will display decrypted text on an end-point – because if you’re not you’re either using bad crypto or no-one is actually reading the content.

Eventually, you’ll have decoded data – sensitive data – displayed and stored at least in memory of a computer. A computer which is flawed by malware, spyware, adware and other nasty things. Whatever your crypto level is, even if you have a fully patched computer with as few software as you need, you’ll probably have some 0-day active that a motivated attackers can exploit to get access to this memory.

It means that, with a sufficient amount of time and of motivation, someone else than the emitter and recipient of the message would be able to get their hands on your data, for the simple reason that – at some point – you need to read it.

And if you have a bullet-proof mailbox – which is the promises made by own mailbox – well, it’s way much easier to target the end-node and to read the mails at the same time as the user.

After all, Hacking Team was doing basically exactly that. And there’s no reason to believe that they were the only one to do that.

And no, free software will not save you there, with so many attacks on web browser, or PDF, it’s not enough to run free software on your computer. One way to solve this issue is to use an air gap computer, a computer that have never been and never will be connected to a network of a kind. It means you need to burn your mails on a CDRom or a DVDROm and to check them onto the airgap system.

And this is something you cannot do with the general public. Because maintaining such a computer – set asides the financial costs – requires time. Like at least one hour a day. Every day. And to get a good understanding at how the computer works. Which is something a lot of people – because they do not want to or because they cannot to – won’t do.

Also, assuming that the average computer/smartphone/tablet/whatever security is higher than the one of a small brick that cannot be easily improved and extended is a hell of a mistake. Key generation whould only be done on airgap computer with hardware random number generator if you want to have really secure keys – and stored on a read-only devices.

Never forget Jessica

This is the second most important error done I think. We forget about Jessica. Specifically we make two mistakes. The first one, that everyone is willing to spend a lot of time figuring out their safety and to protect themselves and their relatives against a theoretical threat.

Let’s stand back a little bit. We already have hard time to have people using simple means to protect themselves against a real threat like AIDS, syphilis or other STI – use condoms people. Seriously – how would we have them protect themselves against philosophical and political threats?

Especially if we expect them to understand things that could take some months or years to get by? What is the point of full-encrypted mail? What means end-to-end? What’s the NSA/GCHQ/insert-your-own-agency-here doing exactly? And why they’re doing it? They’re trying to protect us, of course. Against terrorism. That’s what they said.

If you want user to actively use crypto, you need them to not think about using it. And if you focus only on the technical issue, you’re missing the point that it’s a political one. Because if your government wants to spy on you, they will sub-contract a hacking team like, and you’ll be screwed.

This is what – I think – aeris is missing. The people who’ll actually get the own-mailbox are people who already understand why they need to protect themselves (yay, there’s actually some of them out there), but who can’t afford to host themselves another way – essentially by a lack of time and of skills.

People who will get these kind of devices are not the hard core activists who tries to avoid cops enter their house to seize computer look-a-like devices. Because, in this situation, hosting your mail in your office is useless at best, dangerous at worst.

So, most of the people who will use this kind of device or services aren’t really people at risk of being sent in jail because they sent an email. They’re probably the one who will use it as a nice gadget, on a side.

This kind of devices have no chance to ever be used in life or death situation. And even if they were, crypto won’t protect you from bullets.

Also, everyone seems to think actual people uses email. They’re not. Less and less. We’re using Facebook messenger, twitter DM, GMail (which is less and less compatible with third-party clients), WhatsApp, SnapChat, SMS, etc …

I’m not saying that it’s a good thing. I’m trying to understand who are the people who’re gonna use this. And it won’t be the social-media addict who only uses a Mac and GMail, it won’t be the Uber Nerd who uses only mutt and altern.org emails, nor will it be company – because they can’t handle the load on those devices.

It won’t neither be the poorest people who do not have access to a correct enough ADSL line. So it will be people who already understand what it means to being watch and wants to add a little bit more security on their devices.

The thing is, we won’t get everyone doing key management the perfect way for – at least – two reasons. The first one being that no one know what is perfect key management. The second one being that even the crypto nerds fails at it on a regular basis.

So this is it.

I really think that own-mailbox commercial team have an issue. Their answer is out of scope. There is some issues to be addressed. The funnier one is pretending that needing JavaScript for a webmail client would be a security issue … it will be if you’re living in a place where there is MitM interception on the line + a way to tamper with TLS. Which is typically the case where you do not want to have a box with all your emails in your houses.

But going after them, saying that the devices is blatantly flawed without even having one at hand in the first place is kind of stupid and counter productive. There’s an issue around the terms used (100% secure is always false), but I believe that – since it’s a free software project – aeris could have, at least, open bugs or ticket. I did not find a repo for own-mailbox though – didn’t look for it hard neither.

But aeris choose to get out for blood. Yes, this porject is far from perfect, but it’s still a plus, and if it gets some people to use more opportunistic crypto, then it’s fine enough for me.

aeris, you really should understand that no, no one can use the tools you’re using as part of their regular routine. And in most case it’s not even a

Crypto fallacies

This post is a follow-up on what I tweeted yesterday – hours before the constitutional council gave its approval of the new French Intelligence bill. First tweet is here

Where I come from

Before writing this article, I think it’s important to give some context about what I’ve done the last few years.

So, before joining the Telecomix Crypo Munition Buro and #telekompaketet, I wasn’t that much in security and crypto. I learned that on the late, and with some specific goals in minds – I’ll be back to that later. I was a mercenary sysadmin, working for anyone willing to pay me to maintain their system.

I didn’t understood the difference between free software and open source back in the time, neither was I aware of a lot of issues in the world. Looking to it through my small internet periscoped visor. Most of the news I was reading back in the time were tied to computer, video games and – to some extent – foreign diplomacy.

Not the mainstream media, but not much better. I worked for government and the police – maintained the fingerprint database used by cops and sold by the former Sagem – now known as Morpho XL. I worked for oen of the traditionalist newspaper. For startup trying to build customer profile and senders of millions of mails.

But I was reading those few news. I was joining the twitter (2009 … damn, that’s already 6 years?) and already having fight with people humping on the Facebook boat.

Because what was clear for me was that my privacy should be kept under my own personal control, not under the control of anyone or anything else. I always been shy about sharing data over over public and free network who will track you in the end.

I got this habit of watching for my privacy since high school. I accessed the internet for the time at this time. And at home we even had high-speed internet (512 Mbps in 1997, was part of an 31337, not chasing for those AOL 50h of free internet CD Roms).

I got this habit not because of the teaching of someone, but because of my father. See, my father wasn’t an abusive one. He was kinda distant, avoiding me, but he was not an abusive one. At the time we had internet and when I discovered some of the endless possibilities of the computers being connected to each other, I also learned that my father was a paedophile. He has been convicted for that. Twice. At least the second time it was related to detention of pictures from internet.

Yep, that’s about how I learned how it was important to understand how things works and why it was paramount to protect your privacy. Because cops would breaks into your house and seize your hardware for the sole purpose of you living in the same house than a sexual offender.

So, everything started there for me. Since then I always had a full encrypted drive, I’ve used the privacy mode in my browser as much as I could, I learned to delete cookies and Internet Cache on a lot of browsers (from Netscape Navigator and Mozaic to chrome to Internet Explorer 6).

This is when I started caring for the law about computers and communication. And censorship. I did not really get a grasp of what politics where, but still, I was keeping an eye at it.

Got a degree in computer science and got working, trying to earn my independence and to get out of my parents house – almost 20 years later I still can’t speak to my father and yes, it’s part of the reason I’m severely depressed – and so on.

We’re now in 2009, end of the year and I’m bored at work. There is a lot of signal coming from Tunisia that things will getting ugly there. That’s when I started to act for someone else than me.

I was self hosted, so I had spaces. And root access to my servers. Slim Ammanou was interviewed in some media I was reading (Cant’ remember if it was Read Write Web fr or the blog of Jean Marc Manach, not really important I guess). And some people were doing mirrors of censored blogs in Tunisia.

I was bored, I did knew bash, so I scripted some things to help. WHen someone figured out that the ATI was dropping the SSL around facebiik to catch login and password, I crote a one line that could generates gigabytes of fake password for a specific account.

And someone told me to join IRC and #telekompaketet@irc.telecomix.org. I haven’t fired up an IRC client since the 2000′ so it felt a bit odd, but then a lot of things changed for me, starting with the immolation of Mohamed Bouazizi, the Egyptian revolution and the Syrian civil massacre.

During those last five years I developed my security and crypto skills, and tried to train activists who needed it to communicate. I’ve quit my job and worked for an NGO for nearly a year and a half, chain burning-out myself to the point of severe anxiety disorder and depression, mixed with my attention disorder it doeswn’t goes well.

So this is where I come from. I hope that it will helps you to understand what and why I’m going to say the next few things.

Crypto fallacies

The crypto fallacies is to think that your freedom relies on the tool you use. That, if you use the correct tools, in the way they’re intended to, then you have nothing to fear from an oppressive regime.

It’s false, first because IT security on the general computing is a disaster – and I’m not sure it can be fixed anytime soon – but lmost of all it’s false because you’re opposing an oppressive regime.

If you’re not actively opposing an oppressive regime, you’re silently accepting it and then you’re an accomplice. So, you’re opposing an oppressive regime. An oppressive regime as one specific characteristics, it’s using arbitrary detention and arrest to spread terror and keep thing under control. And no amount of crypto can fight that.

I’ve seen kill list in Syria, written with a carbon pen on a piece of paper. Based on denunciation by neighbors, assumptions by people or just because people did not live in the correct address. I’ve seen people getting shot for no other reason than their skin color, or the way they were dressed.

But most of all, I’ve seen people getting arrested, tortured and shot at because they were protesting into the street. And that’s the thing cryptonerds needs to understand. In the end, the purpose of an activists, is to get in the street, to oppose – violently – the state, and end up in jail (in the bes case scenario). The crypto, or the tech gyzmo you can provides them with won’t prevent that.

Also, if your freedom relies on a specific piece of tech, or a specific knowledge, it means that each and every people who has no access to it can’t be free. Which raises an issue that I have not seen adressed by the most vocal voices in the OpSec for activists people. Sure, you can do IT Training in Mali, but when you have power outtage several hours a day and when the temperature will frequently raises above 40°C, most of our tech is made unusable – believe me, we tried that.

I’ve also seen crypto nerds going extremists and refusing to even consider talking to an activists over an unencrypted channel. That’s an interesting stance since then, the activist would never know how to do that

That’s also a good way to forbid communication, which is mandatory for coordinating actions, getting information out, and care about people. If we would follow those extremists, we would end up in an autistic mode without communicating because it would exposes you to a risk. Risk that still needs to be determined.

And, in the end, if you want to undermine and destroy an oppressive regime, you need to accept the risks. You need to accept that you’ll end up in jail. You need to accept that you’ll be beaten up. You need to accept the fact that if you do not take the streets, then it’s your opponent who have them. And you need to take that back.

And you cannot do it from a computer.

Sure, sysadmin and service operators providing good opportunistic cryptography, with fluid interface and where the security doesn’t get in the way of the user, while protecting their users from the government are needed – and it’s the path I’ve choose, but you have to accept that it’s illegal in most states. Even in NATO countries, or in the EU.

But those sysadmins won’t be protected by crypto. Their freedom is at risk as soon as they decide to fight and to help. And no crypto tool you can use can tight your organisation to a point where no exterior influence can destroy it. We’ve seen it before – with Sabu for instance – we’ll see it again because that’s how things works.

The only thing crypto will buy you is time. This time should be used to coordinate, to share, to care, but it won’t get you out of jail (even TPB founders did serve time). But that’s about it, once you’ll be in the street, you’ll end up in jail whatever the crypto you’re using.

And that is called OpSec (Operation Security). The purpose of OpSec is to be able to run an operation. If the crypto you’re using makes you unable to run it, then you’ve failed your OpSec. And running no Operation is also an Operational failure.

So, yes, crypto is usefull, because it gives you time and space to breathe. It allows you to get some room to distress and coordinates. But your freedom does not rely on a piece of tech. It relies only on you to take it.

Go into the street.