{"id":2128,"date":"2021-01-17T08:26:45","date_gmt":"2021-01-17T07:26:45","guid":{"rendered":"https:\/\/hjinterim.wordpress.com\/?p=2128"},"modified":"2021-01-17T08:26:45","modified_gmt":"2021-01-17T07:26:45","slug":"whats-wrong-with-signal-whatsapp-telegram-protonmail-tutanota","status":"publish","type":"post","link":"https:\/\/hjinterim.tech\/index.php\/2021\/01\/17\/whats-wrong-with-signal-whatsapp-telegram-protonmail-tutanota\/","title":{"rendered":"What’s Wrong with Signal, Whatsapp, Telegram, Protonmail, Tutanota?"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

I’m a public interest technologist. I’m here to educate. You are losing your Internet privacy and Internet security every day if you don’t fight for it. Your data is collected with endless permanent data mining. Learn about a TOR router, a VPN, antivirus, spyware, firewalls, IP address, Wi-Fi triangulation, data privacy regulation, backups and tech tools, and evading mass surveillance from NSA, CIA, FBI. Learn how to be anonymous on the Internet so you are not profiled. Learn to speak freely with pseudo anonymity. Learn more about the dangers of the internet and the dangers of social media, dangers of email.<\/p>\n\n\n\n

Interesting, while I concur with your observations, to some extent, it’s unavoidable short of cutting yourself off from the Internet. Even with a private server, metadata can be gleaned by monitoring port 25 traffic from the server, and any traffic to a foreign host will show reply-to addresses, recipients, etc. even if the actual content is encrypted (which, honestly, is highly unlikely). From this, an intruder could build their own copy of your most frequently used contacts. Short of establishing a separate address for each contact (can you imagine giving separate emails adds to your banks, broker, mutual funds, insurance carriers, etc.), anyone you correspond then has your contact. When their list is compromised (as you discussed in your FB), you now show up as a known associate.<\/p>\n\n\n\n

Even if you did use separate addresses for each type of contact (1 for work, 1 for side business, 1 for family, 1 for college friends, 1 for HS friends, etc.), unless they’re all on different services under different registrars, there is a high likelihood a determined intruder could associate any or all of these addresses with you.<\/p>\n\n\n\n

A cardinal rule of honest security consultants is there is no point in spending more on security than the value of what you are protecting. In this context, spend refers to more than money, it also means time, effort, and usability. There are so many easy targets, why would the average criminal go after a tougher target? In most cases they won’t, they’ll target people fool enough to publish PII on their open FB account. If they target an individual, the attacker probably has a reason to believe the target has something of value or there is another motive (revenge, rivalry, etc.). Perfect security is a fool’s errand: the goal is to raise the cost to the attacker.<\/p>\n\n\n\n

Bottom line: yes, metadata is a threat vector; yes, contact lists are a threat vector; and yes, using a “secure” app doesn’t compensate for unsecure practices surrounding the app.<\/p>\n\n\n\n

Using multiple identities becomes much easier with QubesOS<\/a>. You can use VMs for the same but QubesOS<\/a> should be more isolated, secure and thus better at compartmentalizing your internet usage. Getting rid of the metadata and friends circle trail is much harder. At the moment I’m thinking about setting up a Matrix server so at least the metadata isn’t as easily collected centrally. One issue with this setup is of course that adversaries can track who uses my DNS name and other users can have all of those Facebook apps installed on their phones.<\/p>\n\n\n\n

Some are quick to promote apps as being safe for your use just because they are encrypted. I will talk about how many of the popular apps that are commonly thought to be safe because of encryption are actually wrought with danger because pundits who claim this knowledge haven’t really thought about the flaws of each of these apps.<\/p>\n\n\n\n

The main flaw is something called a relationship map<\/strong>. Because of the meta data surrounding the use of each of these apps, this flaw can result in complete identification of all parties involved in a conversation and their profiles. I will explain how this occurs and how understanding how this works is part of what the intelligence community calls SIGINT<\/strong><\/a> (Signals Intelligence). Click on the link to download a pdf file with description how this works.<\/p>\n\n\n\n

SIGINT is the gathering of military or other intelligence by interception of electronic signals and consisting of COMINT and ELINT.<\/p>\n\n\n\n

What is Signals Intelligence?<\/strong><\/p>\n\n\n\n

SIGINT involves collecting foreign intelligence from communications and information systems and providing it to customers across the U.S. government, such as senior civilian and military officials. They then use the information to help protect our troops, support our allies, fight terrorism, combat international crime and narcotics, support diplomatic negotiations, and advance many other important national objectives.<\/p>\n\n\n\n

NSA\/CSS collects SIGINT from various sources, including foreign communications, radar and other electronic systems. This information is frequently in foreign languages and dialects, is protected by codes and other security measures, and involves complex technical characteristics. NSA\/CSS needs to collect and understand the information, interpret it, and get it to our customers in time for them to take action. Our workforce is deeply skilled in a wide range of highly technical fields that allow them to this work, and they develop and employ state-of-the-art tools and systems that are essential to success in today’s fast-changing communications and information environment. Our researchers are working constantly to help us anticipate and prepare for future developments.<\/p>\n\n\n\n

2. How are the activities of the NSA\/CSS regulated and who monitors them?<\/strong><\/p>\n\n\n\n

The U.S. Constitution, federal law, executive order, and regulations of the Executive Branch govern NSA’s activities. As a defense agency, NSA operates under the authority of the Department of Defense. As a member of the Intelligence Community, NSA also operates under the Office of the Director of National Intelligence. NSA\/CSS activities are subject to strict scrutiny and oversight both from the outside and from within. External bodies such as the House Permanent Select Committee on Intelligence (HPSCI) and the Senate Select Committee on Intelligence (SSCI), the President’s Intelligence Oversight Board, the Foreign Intelligence Surveillance Court, the Department of Defense, and the Department of Justice provide oversight to ensure the Agency’s adherence to U.S. laws and regulations. Internally, the Office of the Inspector General conducts inspections, audits, and investigations to make certain that NSA\/CSS operates with integrity, efficiency, and effectiveness, while the Office of the General Counsel provides legal advice. Most importantly, each NSA\/CSS employee is charged with knowing, understanding, and obeying to the fullest the laws of the nation.<\/p>\n\n\n\n

3. What Defines the Intelligence Role of NSA\/CSS?<\/strong><\/p>\n\n\n\n

Executive Order 12333 (EO 12333) authorizes agencies of the Intelligence Community to obtain reliable intelligence information, consistent with applicable Federal law and EO 12333, with full consideration of the rights of U.S. persons. Pursuant to EO 12333, NSA is authorized to collect, process, analyze, produce, and disseminate Signals Intelligence information and data for foreign intelligence and counterintelligence purposes to support national and departmental missions, and to provide signals intelligence support for the conduct of military operations. The executive order, however, prohibits the collection, retention, or dissemination of information about U.S. persons except pursuant to procedures established by the head of the agency and approved by the Attorney General.<\/p>\n\n\n\n

A life example how SIGINT works<\/strong><\/p>\n\n\n\n

Watch and learn about this little puzzle that will challenge your brain and your thought process.<\/p>\n\n\n\n

India may be working with the American National Security Agency (NSA) to intercept email, chat, VPN data, VoIP and voice call records among others. This is based on documents that were newly released by Edward Snowden to Danish newspaper Dagbladet Information<\/a> and The Intercept. You can download the files here<\/a>. Also see these documents<\/a> that were used by The Intercept editor Glenn Greenwald for writing his book on the issue.<\/p>\n\n\n\n

According to these documents, India is an \u201cApproved\u00a0SIGINT<\/a>\u00a0partner\u201d with the NSA. SIGINT is a common term used in intelligence circles that stands for signals Intelligence, and refers to capturing of communication between two people. Decrypting of messages, traffic analysis etc. are also part of SIGINT.\u00a0The agency then taps these SIGINT partnerships for creating two major programs called RAMPART-A and\u00a0WINDSTOP for collecting data in transit between the source and the servers<\/strong>, as opposed to collecting data from each Internet company (Google, Microsoft, Yahoo) separately. Considering WINDSTOP\u00a0only partners with second parties, primarily the UK, to access communications into and out of Europe and Middle East, third-party partner like India should fall under RAMPART-A.<\/p>\n\n\n\n

\"\"
Approved SIGINT partners<\/figcaption><\/figure>\n\n\n\n

RAMPART-A provides NSA with collection against long-haul international leased communications through special access initiatives with world-wide\u00a0SIGINT<\/a>\u00a0partnerships. RAMPART-A has access to over 3 Terabytes of data per second encompassing all communication technologies such as voice, fax, telex, modem, e-mail, internet chat, VPN, VoIP and voice call records. This program has \u201cTURMOIL\u201d capabilities according to the documents, which means that these sensors can passively collect vast amounts of data. It may also be used for\u00a0spotting common internet encryption technologies that the NSA can exploit.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

New Delhi is mentioned in another slide that lists all units that are part of SIGINT platform. The NSA has Computer Network Exploitation in 50,000 locations around the world and from the graphic above it looks like there are at least five of them in India that are part of SIGINT.<\/strong> It is not clear where exactly these are or which companies they are.<\/p>\n\n\n\n

These documents also talk about FAIRVIEW, which has corporate relationships with ISP and Telco\u2019s and collects communications data from fiber cables and various infrastructure through which data passes through. These documents don\u2019t however mention if FAIRVIEW has relationships with Indian companies.<\/p>\n\n\n\n

Data collected upstream internationally are of two kind according to these documents: DNI selectors has all information about a user\u2019s activity online, while DNR selectors are meta data of voice calls made and messages sent through Telco\u2019s.<\/p>\n\n\n\n

How Indian embassy was targeted<\/strong><\/p>\n\n\n\n

Another document leaked by Snowden shows that Indian embassy in US was monitored. The NSA used the following methods for collecting information from the embassy and officials there:<\/p>\n\n\n\n

\u2013 Implants<\/strong> (sensors or recording devices possibly) in the Indian embassy to collect data.
\u2013 Screen grabs<\/strong>. Method is called Vagrant
\u2013 Created images of disks.<\/strong> This is bizarre considering that India is a part of SIGINT.
\u2013 It also used a method termed \u2018magnetic\u2019 through which a sensor collected data from magnetic emanations<\/strong>. We\u2019re not sure what this means.<\/p>\n\n\n\n

This document is from 2010 and it indicates that snooping from these offices were dropped shortly afterwards.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

These new documents also mention the amount spent by NSA on foreign partners to create and maintain the RAMPART-A and WINDSTOP programs. However, there is no country-wise split so it is not clear how much was spent in India or paid to Indian companies.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

What about NATGRID, CMS and Netra?<\/strong><\/p>\n\n\n\n

Indian government has been building Central Monitoring System<\/a> (CMS) for monitoring all online communication in India, Netra<\/a> for keyword based tracking of online content and NATGRID<\/a> for linking all available personal data of people in India. This year, India made it to the Enemies of the Internet report<\/a> published by Reporters Without Borders for the first time, along with US, UK and Russia, for creating these three monitoring tools. That being the case, we don\u2019t know if these projects are already part of RAMPART-A or if the government is considering sharing this data with the NSA in the future.<\/p>\n\n\n\n

With these three projects, Indian government will be able to intercept all online communication in India, but it does not have the decryption code for deciphering these messages. It had approached the US government<\/a> last year seeking help to decrypt messages sent over services such as WhatsApp and Skype. It had similarly fought long and hard<\/a> to get these codes from BlackBerry as well. However, by the time the mobile phone manufacturer agreed to hand over these details<\/a>, the popularity of Blackberry handsets had already declined in India.<\/p>\n\n\n\n

Proton Email Client<\/strong><\/p>\n\n\n\n

EMAIL systems claim to be highly secure. The newest of them, ProtonMail, attracted widespread attention. But just how secure is it?<\/strong><\/p>\n\n\n\n

Email applications that say they’re strong enough to foil government snoops and advertisers too often have chinks in their armor. In 2014, a federal judge forced the now-defunct secure email company Lavabit to turn over its encryption keys to the government, though Lavabit earlier claimed its service was \u201cso secure that even our administrators can\u2019t read your email.” Going further back, we learned that encrypted email provider Hushmail was totally cool with spilling secrets to the government, which it did by grabbing user passwords to decrypt email and turning them over to law enforcement in plaintext. It, too, claimed that even its own admins couldn’t read the encrypted email.<\/p>\n\n\n\n

But ProtonMail, founded in August, 2013, by scientists who met while working at the European Organization for Nuclear Research in Geneva, seems to offer protections other email services don’t. The service claims on its website that it \u201ccannot decrypt or share your data with third parties.” It also boasts extra legal protection because it\u2019s based in Switzerland, a country with strict privacy laws. And it’s attracting loads of backing it raised $2 million in seed funding in March, and about half a million users have requested an invitation for a free 500MB account.<\/p>\n\n\n\n

The Good<\/strong><\/p>\n\n\n\n

Let’s start with ProtonMail’s security advantages. It requires two passwords, which provides an added layer of protection.<\/p>\n\n\n\n

\u201cIt\u2019s actually really nice that they have two sets of passwords,\u201d \u201cThe login password gets sent to the server, and that\u2019s how you prove that your username is actually yours. And the second is the mailbox password, which never gets sent to ProtonMail\u2019s server. The second password runs in your browser and decrypts your messages there.\u201d<\/p>\n\n\n\n

Another significant security perk is ProtonMail stores your email encrypted to disk, which means the emails would be undecipherable without your password if a government agency compelled the company to hand over your communications.<\/p>\n\n\n\n

Of course, this doesn\u2019t mean ProtonMail couldn’t give the government plaintext messages\u2014just that it would require ProtonMail to actively attack you and steal the required password. Most email services can much more easily hand over your communications because they store them in plaintext or in such a way that the service could easily decrypt them.<\/p>\n\n\n\n

The Bad<\/strong><\/p>\n\n\n\n

Now let’s address ProtonMail’s weaknesses. One of the big issues is that it isn’t easy to know whether a message sent to another ProtonMail user is being encrypted to the recipient\u2019s correct public key, which is stored on ProtonMail\u2019s key server. For example, if Alice sends Bob a message encrypted to his public key, it’s harder for anyone else to read the message. But since ProtonMail distributes the encryption keys to users, it has the technical ability to give Alice its own keys in addition to Bob\u2019s, thus encrypting the messages in a way that would allow it to eavesdrop.<\/p>\n\n\n\n

This problem is not unique to ProtonMail. Apple’s iMessage and the now-encrypted WhatsApp have the same flaw. (Services like Text Secure, Silent Circle, and Threema, on the other hand, allow users to verify fingerprints to assure that they have the proper keys for one another, thus mitigating that threat.)<\/p>\n\n\n\n

ProtonMail does allow you to export your public key and send it to another person, but you can’t easily confirm whether your ProtonMail messages are being sent to the same key. It would take serious tech chops to verify the key. \u201cThey could look at the network request or open the browser’s JavaScript inspector, both of those are able to show them. And a normal UI that I wouldn’t say that’s a reliable defense against man-in-the-middle attacks,\u201d<\/p>\n\n\n\n

This isn’t ProtonMail’s only weakness. It could also serve malicious code to a targeted individual (based on a specific IP address, for example) if legally compelled to do so. \u201cYou have to completely trust that the server is not compromised because every single time you load the page, you download a new copy of the JavaScript\u201d \u201cThey could just wait until you load the page and give you a malicious version of the JavaScript. This would be much more difficult to do if it was a browser add-on or a native program you install because then if they wanted to make their client malicious, they would have to add a backdoor and make it malicious for everyone, and everybody would have evidence of that backdoor.\u201d<\/p>\n\n\n\n

The Tricky Legal Questions<\/strong><\/p>\n\n\n\n

This brings us to ProtonMail’s legal advantages. As we’ve established, ProtonMail would have a hard time decrypting your communications, but the service is not so secure that it would be impossible. And while ProtonMail cites its location in Switzerland as added protection, it\u2019s certainly not a fail-safe. That\u2019s because Switzerland has a mutual legal assistance treaty relationship with the United States. These treaties require foreign governments to hand over to a requesting government any information legally available to their local authorities. That means that Switzerland would have to give the US access to any data that it could itself access. So, if you\u2019re planning to use ProtonMail to sell steroids, leak government secrets, or engage in FIFA-style wire fraud\/money laundering\/racketeering schemes, Swiss law probably won\u2019t help you.<\/p>\n\n\n\n

People seem to think that data privacy laws in Europe or in foreign countries pose problems or would be a roadblock but that\u2019s just not the case, because under those treaties the countries obligate themselves to cooperate as broadly and as much as possible.”<\/p>\n\n\n\n

ProtonMail isn’t exempt from Swiss laws. “We have just intentionally selected the framework that gives the best possible protection to our legitimate users. The greatest protection, of course, comes from the underlying technology.\u201d<\/p>\n\n\n\n

As mentioned, ProtonMail encrypts your emails to disk. Unfortunately, it’s an open legal question whether a government could force ProtonMail to falsify keys or serve malicious JavaScript to users.<\/p>\n\n\n\n

\u201cIt is fairly standard for the government to require companies to turn over information about their customers already in their possession. The critical legal question is whether the government can compel companies to do more than that,\u201d a staff attorney in the ACLU’s Speech, Privacy and Technology Project. But, there’s a big distinction: \u201cThere is an important difference between requiring a company to turn over information it already has and conscripting it into becoming a spy for the government … the latter raises serious constitutional questions.\u201d<\/p>\n\n\n\n

Android devices<\/strong><\/p>\n\n\n\n

Google is scared shitless. Their censorship is going way too far. Let’s fight together for freedom of speech! All software should be open source, with respect for user-privacy and freedom of speech. Your Android phone is the biggest spy device in your life, let’s do something about it! https:\/\/android-privacy.com\/<\/p>\n\n\n\n

Just need to finalize hardening that internal NextCloud VM first<\/p>\n\n\n\n

Links that maybe would be in some degree helpful:
https:\/\/www.privacytools.io\/
https:\/\/getsession.org\/
https:\/\/berty.tech\/
https:\/\/puri.sm\/
https:\/\/www.getmonero.org\/
<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

I’m a public interest technologist. I’m here to educate. You are losing your Internet privacy and Internet security every day if you don’t fight for it. Your data is collected with endless permanent data mining. Learn about a TOR router, a VPN, antivirus, spyware, firewalls, IP address, Wi-Fi triangulation, data privacy regulation, backups and tech … Read moreWhat’s Wrong with Signal, Whatsapp, Telegram, Protonmail, Tutanota?<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":1966,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[18,28,19,29,21,22,24,25,26,27],"tags":[],"class_list":["post-2128","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education","category-entities","category-financial-industry","category-government","category-null-null","category-reaching-out-network","category-reporting","category-security","category-security-treats","category-your-help-is-needed"],"_links":{"self":[{"href":"https:\/\/hjinterim.tech\/index.php\/wp-json\/wp\/v2\/posts\/2128","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hjinterim.tech\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hjinterim.tech\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hjinterim.tech\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hjinterim.tech\/index.php\/wp-json\/wp\/v2\/comments?post=2128"}],"version-history":[{"count":0,"href":"https:\/\/hjinterim.tech\/index.php\/wp-json\/wp\/v2\/posts\/2128\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hjinterim.tech\/index.php\/wp-json\/"}],"wp:attachment":[{"href":"https:\/\/hjinterim.tech\/index.php\/wp-json\/wp\/v2\/media?parent=2128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hjinterim.tech\/index.php\/wp-json\/wp\/v2\/categories?post=2128"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hjinterim.tech\/index.php\/wp-json\/wp\/v2\/tags?post=2128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}