Peerio is a company providing encrypted file storage with integrated instant messager in the cloud. Available for Windows, Mac and Linux (if using the Chrome browser), smartphone apps are on the way, it is being developed by the makers of Cryptocat and miniLock, two other cloud based encryption utilities.
Before you can use Peerio you will have to register for an account selecting a username, the email address you provide will receive a verification link for you to click on, after that you can create a short PIN code to pair devices with Peerio. A long passphrase is generated during account creation to stop users from picking a weak one, this is very important as encryption keys are derived from that passphrase.
Although I see why the developers do this, I am not a fervent supporter of having something as important as the passphrase picked by a third party app instead of my trusted offline password manager, and most likely people without a password manager will write it down anyway.
encrypted file storage Peerio
Peerio interface is clean and easy to use, you will see three tabs “Messages“, “Files” and “Contacts“, and a column allowing you to classify uploaded documents by file type (Photos, Videos, PDF, etc), everything is automatically synchronizing. After you have added a contact, that person will be able to talk with you in real time, to send him a large file, drag and drop the files you wish to share inside the window to upload them to the cloud, another button lets you destroy those files from your account and the account of the people it is being shared with.
This platform is comparable to Mega, a more established encrypted cloud storage with messenger that offers far more space. Peerio developers have no way to know what you are sharing, only users hold the private key to decrypt data downloaded from Peerio Canadian cloud servers, the company can’t read anything but they admit that timestamps and login IPs are kept, that is all they can hand over if they are forced to.
A substitute method to send large files with end to end encryption is using an instant messenger and encrypting the files with PeaZip before the transfer. Peerio’s main leverage is that it does all the encryption work in the background but it also has the disadvantage that to send big files you will be asked to upgrade to their upcoming paid for plans, and, the part that bugs me the most, is that you have to convince your friends to open an account with Peerio.
Peerio erasing shared cloud files
If you are small company and your employees need to share files often, perhaps Peerio will work, but for the individual, it is best that you encrypt a file and upload it with a proxy to a cyberlocker or use NeoRouter to avoid the metada treasure trove that cloud servers are, with the extra benefit of always having the data available in your hard drive.
Other secure ways to share large files without a cloud server involved are Bittorrent Sync and Infinit.
SecureGmail is an open source Chrome browser extension to encrypt and decrypt Gmail messages with one click. After installation you will see a red padlock next to the compose button in Gmail, clicking on it will launch the compose window with a red bar that says “Secured“. Unlike other encryption extensions, SecureGmail does not allow Google servers to keep a draft of your message and encryption takes place in your browser, Google will be unable to read anything other than scrambled text, however, attachments are not encrypted, SecureGmail only works for text.
You will be asked to enter a password after you have written the email and, optionally, a password hint. You will have to either, transmit the password to the receiver by secure means, or enter a password hint that the receiver can easily guess. When the other end receives the message he will see scrambled text and a warning saying “This message is encrypted, decrypt message with password“.
encrypted Gmail messages SecureGmail
The strength or SecureGmail is that Google is kept out of the equation by not giving the company any way to read plain text, SecureGmail open source code allows others to check for bugs and email encryption is extremely easy and quick, but there are also many SecureGmail downfalls, the first one is that both parts must have the same extension installed to be able to encrypt and decrypt data, the second problem is that sender and receiver must be both using the same browser, SecureGmail only works in Chrome, and a third obvious problem is that the password has be transmitted, this will encourage people to reuse passwords and it will reduce security.
SecureGmail can be useful for an organisation that has their email hosted by Gmail, but only for staff conversations as sending email to outsiders would be sure to slam against one of the problems highlighted above. If you need a way to encrypt email that can be delivered anywhere, consider learning about PGP and Enigmail or download the Mailvelope extension.
People concerned about privacy should not be using Gmail, but if you do, encrypting it will give the NSA some work to do in between reading clear text messages. Encryption can not protect you from the who is communicating with who server metadata, trying to fool the NSA using Gmail is like trying to win the lottery by praying to Allah, a total waste of time.
There are plenty of reasons not involving national security about why you will want to encrypt your email messages, like not wanting readable email messages stored in your inbox for ever and protecting yourself from embarrassment if a typo sends an email message to the wrong inbox. In scenarios where metadata collection is not an issue, an extension that encrypts email is adequate protection.
Nitrokey is a physical USB thumbdrive developed in Germany to encrypt email with OpenPGP, GnuPG or S/MIME, use One Time Passwords, encrypt your computer hard drive files, manage digital certificates and act as a double authentication token with websites that have adopted the Universal 2dn Factor U2F standard supported by Google services, OpenSSH and WordPress. The hardware design and software code of this encryption thumbdrive has been made open source to allow the review of their security and for developers to be able to integrate their own applications.
The thumbdrive keeps three RSA encryption keys of up to 4096 bits, they are all linked to the same identity but used for different purposes, authentication, signing and encryption, the keys are hardcoded in the device, this makes it impossible for viruses to extract them, the One Time Passwords are compatible with Google Authenticator and hardware encryption is using the AES256bit algorithm with plausible deniability using hidden volumes. The dongle comes with a default administrator PIN set to 12345678 that you should change.
Encryption USB thumdribe NitroKey
A more expensive version, called “NitroKey Storage“, allows you to store up to 64GB of encrypted data in the device, everything is secured using AES256bit hardware encryption. The USB thumbdrive will work in all operating systems, including Linux, it can be used for authentication as well as encryption.
If you are worried about a trojan horse in your computer stealing your encryption keys, Nitrokey can stop just that. Carrying your encryptions keys with you in your pocket, instead of having them in your hard drive makes identity theft less likely, and NitroKey’s open source lets you check its firmware integrity, the developers advertise this as a way to thwart the NSA practise of intercepting hardware in the post to implant backdoors on them.
This is not a very cheap dongle but in line with what encryption thumbdrives normally cost, you can buy a Yubikey for half price but it does not have any encryption abilities other than U2F authentication, Nitrokey offers email and data encryption on top of secure U2F logins.
The best selling point of this thumbdrive comes in the form of being open source supporting standard security programs. The developers also mention that the key has a tamper-proof design and that you can set up a hidden encrypted container to avoid mandatory surrendering of your data when crossing the border or in countries where it is illegal not to reveal your password to law enforcement.
Recently released Snowden’s NSA documents published by the German magazine Spiegel reveal the NSA has a dedicated team to crack VPN traffic and feed it to their data mining software. The documents list over 200 commercial VPN providers, like Astrill, CyberGhostVPN, iPredator and PrivateInternetAccess (PIA), they include companies that no longer exist like Xerobank and also name small VPN providers.
One of the leaked NSA slides says that copyright violators, pedophiles and Internet scam artists all use Internet anonymity, highlighting that terrorists using anonymity are the NSA main concern, however, this is a three year old document and contemporary news indicate that the NSA and GCHQ now also have orders of using their skills to hunt down pedophiles on the Internet.
The 51 pages long slide titled “Internet Anonymity 2011” starts explaining the differences in between encryption and Internet anonymity, contrasting how encryption hides content and VPNs hide metadata, which is important for the NSA. There are commentaries in favour and against Internet anonymity and it briefly introduces the different proxies and VPN protocols available (PPTP; SSH; OpenVPN; L2TP; SSTP).
A short analysis spells out how commercial VPN providers work and exposes that the NSA is listing all servers VPN providers have, with a noted complaint about a free VPN provider called HotSpotShield because their list of servers is not readily available for the NSA and the staff has to reverse engineer them.
After VPN traffic has been decrypted, everything is stored in XKEYSCORE, a Google like supercomputer used by the NSA to quickly search for specific words or computer IPs.
NSA VPN exploit
To crack OpenVPN the NSA advises to use XKEYSCORE with X.509 digital certificates, it then shows some real examples of how they fingerprint HostSpotShield, Easy hide IP, Comodo VPN Trust Connect and SecurityKiss, enumerating the ports each service is using with references to their RSA key. Other documents mention that the NSA is aiming at processing 100,000 requests per hour by 2011, this means that they should be able to decrypt and reinject data of 100,000 VPN users, a capability that I am guessing will have considerably increased since then.
There are comparisons in between single hop proxies, picking as example Psiphon, multihop proxies that pick JonDo as example and Tor, the comparison lists the advantages and disadvantages of each one of the methods and ends with the conclusion that Tor remains the safest anonymous proxy available.
According to the NSA, “sophisticated targets” use Tor to access terrorist forums, it specifically names the terrorist forums al-Faloja, CEMF, al-Hisbah, shumukh, using this as the main reason why the NSA needs to identify Tor traffic, which apparently is hard to do. The only breakthrough the NSA mentions is the capability they have of identifying a few Tor servers, due to their unique characteristics of random digital certificate issuers and the certificates being always only valid for 2 hours.
NSA VPN providers
The secret documents call the Torbutton a “thorn in the side of SIGINT” (intelligence gathering) because it disables all active content and they have no work around. To crack Tor the presentation recommends “implanting a web server with poisoned content intended for target“, which in plain language means getting the target to download a file infected with a trojan horse.
A different 43 pages long NSA presentation gives more technical details about VPN traffic cracking and they mention that all branches have a specialist VPN representative to spy on a target. The same presentation says that the VPN team provides vulnerability analysis and suggests alternative approaches if exploitation is unrealistic. In one particular slide, the NSA stresses in capital letters that VPN exploits are POTENTIAL, depending on many different factors.
The second presentation illustrates the NSA success cracking PPTP traffic and goes onto name Iran Air, the Afghan government, Turkish diplomats and Kabul bank as some of those using PPTP to secure their communications. The NSA justification for spying on bank communications is that by following the money they find who is at the other end. And one very important reminder adds on the last page that “If it’s not exploitable now, that doesn’t mean it won’t be later“.
GCHQ Tor exploit
PPTP has been considered insecure for a long time, these documents not only confirm it, they also illustrate that it is being exploited on a daily basis. If you use a VPN make sure to only connect with the most secure protocol, OpenVPN. A second security measure should be to only sign up with a VPN company that has competent security staff, the NSA VPN exploitation for OpenVPN appears to rely on finding the pre-shared key.
Other jewels found on the leaked documents are that the NSA admits to not being able to crack PGP encryption and OTR (Off-the-Record Messaging), two of the documents show metadata without any transcription for the conversation, marked by NSA staff with the sentence “no decrypt available for PGP encrypted message“.
As for remailers, the “Internet Anonymity” NSA slides disclose that the agency considers Mixmaster and Mixminion the most secure remailers due to their high latency, adding that they are hardly used by anybody.
Without a doubt, the leaks show that the NSA has lots of interests in wiretapping VPN traffic. People worried about illegal spying could stick to Tor since the NSA admits that they can’t crack it, but a different GCHQ (UK secret service) presentation leaked in the same article and titled “potential technique to deanonymise Tor users“, mentions that the UK secret services is considering using Tor exit nodes they own to help them deanonymise Tor users, the presentation is highly technical and appears to be a future project, that, if it has been implemented, means that the GCHQ has deployed their own honeypot Tor exit nodes to log all traffic and with it any passwords you enter.
I can only see two solutions for the paranoid, one of them, is using double authentication to login to the VPN, you could use a key based SSH login with PuTTY, this places the encryption keys in your power and not in the server, this way only a trojan horse could steal your keys. The second solution, is to combine a VPN with Tor, which will slow down your Internet browsing.
Martus is an open source encrypted bulletin board for individuals and groups tracking human rights violations. It has been developed by Benetech, a non profit organisation pushing for social change. It is written in Java, available for Windows, Mac, Linux and Android, I downloaded the 130MB Windows version to try it out.
During installation a wizard guides you over the necessary steps to set it up, you will be forced to choose a strong password with a minimum of 8 characters and will be given tips to do it safely being told not to use dictionary words and to combine alphabet letters with special characters, everything will have to be entered twice before encrypting it in your device. If you forget your credentials nobody will be able to recover them, not even Martus staff.
Martus encrypted bulleting board Tor settings
Within the software there is the option to activate the Tor network to hide from your ISP that you are connecting to Martus servers and to get around filters if a server is blocked from your location.
The data you enter will be backed up to the server connecting to port 443 (SSL) or 997 using 3027 bit encryption, server administrators will not be able to read anything, data is encrypted with your own keys, and if you don’t wish to use the default Martus server, which during my tests resolved to an Amazon EC2 data centre in the US, any organisation can set up their own, “Advanced Settings” in Martus allow activists to enter the IP address of the specific server they would like to connect to together with the server public code and a magic word for authentication.
You will also be given a public Martus key, this is used to anonymously exchange information with your contacts, entering one of your friends access token in the address book allows you to be in touch with him and transfer encrypted data. There is no need to know any phone number, email address or Instant Messenger, the access code alone allows you to interact with others, anonymity can be strengthened further if you both use Tor, which only requires that you tick a button in Martus.
The hard part of Martus is to securely exchange access keys with your friends in a way that can not be intercepted, Martus recommends that you to use the Off-The-Record (OTR) software or a face to face meeting to do this.
Template forms in Martus can organise data records with little effort, or you can create a custom form yourself. The last step of the installation wizard involves exporting your account key to a secure location, like an external USB thumbdrive, to restore account access in case your computer is stolen or infected by a virus. The key is exported as a .dat file and optionally can be split in three pieces for extra security, in the later case, you will need all of the parts to access your Martus account. These parts can be distributed in between various members of a group living in different countries so that if one of them is compromised, it will not be enough to access the account.
Martus server settings
Martus report layout is plain and clear, two buttons on top allow you to connect or disconnect from Martus server or Tor with a single click and the tabs on the left hand side let you switch in between the received and saved reports, the form incorporates fields with the date, author and server where data is being backed up.
The Android version of Martus requires you to have a desktop Martus account first to be able to configure it, the rest works the same, data is encrypted with your passphrase on the phone to protect you if it is seized, and any picture, audio or text you have stored will have been already backed up to the Martus server and can be retrieved later on if the phone is confiscated, another choice is to designed a second person with access to your Martus desktop account to retrieve data you have uploaded in case you are not released from custody. Other nice details are that program automatically locks and asks for your password if you leave it running in the background, and there is a PDF manual you can download in multiple languages explaining how to operate Martus.
Martus Android phone
This is a very well thought out program, it has everything an activist needs, privacy with encryption, anonymity with Tor, no backdoor, the possibility to set up your own Martus server so that you don’t have to rely on others, and being able to share account credentials in between various people so that if something happens to one person, others will still be able to bring back any photos you have uploaded.
If anything could be improved in this program, is that there is no real time communication to sort out discrepancies, like a chatroom or IM, but you could always ask questions to your contacts adding them to a data form being shared.
Dstrux is an online platform to share notes and files that will self-destruct on the date you specify and tracks when somebody has seen the message you sent to them. The files and notes you share are encrypted in your browser before uploading them to dstrux servers with SSL, the system stops everybody, including dstrux, from seeing what you are sharing.
This service can be used to share messages with other people while not exposing the data to Internet wire-tapping, but the main idea is to be able to exchange personal data in social media like Facebook or by email without having to upload photos and messages to websites that will archive your messages for years and share it with third parties.
Self-destructing files dstrux
Signing up for a dstrux account can be done with your Facebook account or entering an email address and password, linking your Facebook account with this service means revealing your identity so I selected email signup instead.
After login in you will see a simple interface with “Received“, “Shared” and “Forwarded” tabs and a notification alarm bell on top that tells you the date and time a contact has seen a message you sent to them with the date it was destroyed. If you wish to share a file or note with somebody upload it from your computer, set the timer to days,hours or minutes and optionally add blurring to the photo. Blurring stops the receiver from being able to capture a full screenshot of the picture you are sharing, when turned on, the photo will only be visible by sections as you hoover your mouse over it.
The receiver does not need an account with dstrux to be able to read the messages but dstrux encourages them to open one to reply to you in the same fashion. Note that destroyed files will still be available in your “Shared” tab, clicking on them will show metadata about who has seen them, you can delete obsolete files clicking on the trash can.
This is an easy to use service, my only criticism is that sharing integration has been made with Facebook and email, I would have appreciated an open link that I can post in Usenet or an online chatroom to share with a group of people that don’t know me.
Dstrux appears designed for one to one data sharing and privacy in mind, I would not suggest this service for anonymity or sharing files in between groups.
Cyborg Unplug is a hardware device that scans your WiFi network, detects unauthorised gadgets connected to the network spying on you, like a wireless cam or microphone, and disconnects them.
There are two models available, one that works with the 2.4GHz band and detects and disconnects gadgets like Google Glass, warning you with a blinking LED light or sending an alert to a smartphone app, and a more expensive model that works in the 5GHz band, normally used by businesses, emits and audio alert and can monitor Bluetooth connections in addition to WiFi.
The hardware is nothing out of the ordinary, a simple WiFi router with an Atheros chipset, the magic is the firmware powering Cyborg Unplug, it runs a modified Linux based OpenWRT for embedded devices that blocks appliances from getting to the Internet. The code is open source, available for download, it can be installed in compatible hardware if you are a tech able to make your own.
Anti spy device Cyborg Unplug
Unlike WiFi jamming, this device detects specific MAC addresses of surveillance gadgets like Google Glass or drones and disconnects them from your wireless network sending a de-authentication packet. The Cyborg Unplug owner gets to decide what kind of gadget can and can not be connected to WiFi, white listing them with a check box. Since the device relies on knowing the spying devices MAC addresses, Cyborg Unplug will be updated as new ones hit the market, with lists downloaded to Cyborg Unplug using the Tor network to avoid exposing your WiFi IP anywhere.
This device can only be legally used in your own WiFi network, using it somewhere you are not authorised would get you in serious trouble. The developer recommends you to only turn the “Territory Mode” on, this mode blacklists targeted gadgets and allows access to everything else, a more restrictive “All Out Mode” kicks off the wireless network all devices in range, including paired smartphones. This can be illegal in some jurisdictions and you are the only person responsible for illegitimate usage.
The biggest downfall of this device is that it will not prevent a recording, it only prevents streaming over WiFi, the second problem is that if the spying device is sending out data using a 4G mobile phone network it gets away with it, but not many do that because 4G it is still expensive for video.
Home users worried about their own WiFi network being exploited should configure their router filtering MAC addresses. The substantial use I see in Cyborg Unplug is for businesses like restaurants or offices providing WiFi access. I liked how easily this devices can kick out drones, webcams or Google Glass while allowing laptops and tablets in with very little work.
Cyborg Unplug can be handy as part of a security layer administering wireless Internet services, but not as a stand alone bullet that will prevent WiFi abuse.
