Having read your insistence that all internet data is vulnerable to US government snooping and that there is no communication which is safe I have read into this a little further.
What I have read tells me that whilst it has been reported in the press on the back of recent leaked NSA & GCHQ documents that there are three areas of application to the NSA & GCHQ undermining of the SSL protocol technology layer, as well as personal privacy and commercial privacy, the actual facts are sparse and ambiguous. On a closer reading of the claims I believe that the issues of privacy both commercially as well as individually is undoubtably true. The claim regarding the SSL/TLS protocol is very unlikely to be true in my opinion. The claim amounts to saying that the efforts of the NSA primarily represent undermining the protocol itself by having code inserted into the protocol via development, in cooperation with developers as far as algorithmic paradigms are concerned as well as manipulating the NIST as far as standards are concerned.
The actual accessing of data appears to have been a mixture of court judgements as well as commercial cooperation with some of the main players in data storage. It would appear that there has been only a relatively small amount of effort implemented on SSL activities or “code breaking” in the form of super computers designed for that specific purpose. Even this is a “battering ram” approach and has nothing to do with mathematical developments giving rise to vulnerabilities in existing cryptographic paradigms.
I cannot find a single shred of evidence that any mathematical development exists which has overtaken the SSL algorithmic paradigm. What I have found is that SSL (TLS) and S/MIME appear to share the same vulnerability by reason of their common 256 SHA Key requirement. There is no evidence that anything other than meta-data has been read from e-mails however. The contents cannot be read where the e-mail is encrypted unless you have the “master” keys. Proof needed.
And this is the point really. Of all the claims being made about the NSA and GCHQ, the only one which should really concern anyone or surprise anyone is the claim that the NSA has “somehow” altered or restructured the SSL/TLS protocol in collusion with the public standards agency (NIST). See http://blog.cryptographyengineering.com/2013/09/on-nsa.html “Which Standards” Paragraph.
I am not convinced that the reporting of this NSA & GCHQ activity and ambition, along with its successes is sufficiently well understood, and so it gives rise to a claim that all cryptographic exchanges are flawed and therefore useless. I would simply encourage anyone who has an interest to read the articles available (mostly in the press) and recognise the language being used. See http://www.nbcnews.com/technology/after-nsa-encryption-cracking-revelation-can-we-trust-internet-security-8C11092386 ........it is full of euphemisms and slights of hand as usual and in reality amounts to a few short claims which ought to surprise no one at all. What is more, no one in the computer security industry is surprised by the majority of it. The only real surprise is the claim that SSL/TLS is compromised internally. Even this has to be qualified as the NSA has shown its hand before. See http://www.zdnet.com/has-the-nsa-broken-ssl-tls-aes-7000020312/ para 9. And whilst this "antecedence" is clear evidence of the NSA's methodologies this still does not amount to proving that the NIST has cooperated with the NSA in guaranteeing that private and commercial security is compromised by default.
The claim that the Secure Sockets Layer itself has been “managed” so as to have loopholes built into it, is unproven. Where data and e-mails have been harvested it has been done primarily via tapping into Tier 1 servers and VPN Tunnels with consent or else by reason of court orders.
http://siliconangle.com/blog/2013/09/09/google-strengthens-its-encryption-methods-to-hinder-nsa-espionage/
Strong Cypher Encryption Works!
The first link below reports on an interview with Mr Snowden who provoked this present crisis, in which he confirms that despite everything “Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it.”
http://www.theguardian.com/world/2013/jun/18/edward-snowden-live-q-and-a-eight-things
In other words a competent use of security at the ISP (end point) would guarantee security because cryptographic key encipherment works. “Properly implemented strong crypto systems are one of the few things that you can rely on” is a very telling phrase coming from a former contracted Administrator of the NSA. It is also very telling that the NSA has now released 900 other Administrators from their contracts, leaving them with just 100 such contracted personal. They are moving their system into a cloud based remote machine management system to remove the human risk of another Mr Snowden. If you or I were simply seeking to achieve a secure and private platform fire walled through to the internet bypassing the ARPA requirement for DNS resolution, it would be a simple matter to build such a communications network.
US Reporting
http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html?hp&_r=1&
I would still bet my last dollar that much of the claims being made have yet to be properly qualified and in the end we will find that its been a good story about privacy and not as some are claiming NSA genius in defeating internet security per se. It is ironic that the majority of “scary” reports are giving a heads up to the Guardian in the UK for the “leaks” concerning the NSA. However just read the UK press and then compare it with the USA press. The one is mildly indifferent and amused. The other is full of fear tactics. Too much Hollywood as usual?
I am not sharing this to be argumentative but the question has been raised about how secure e-mails are because of the stated position of g-mail in the OP (now removed) and not because of NSA activities. Although the relevance of the disclosures regarding the NSA is obvious, it would not matter one bit if g-mail were citing a legal precedent with the intention of handing the information over freely or else preparing us for the fact that they already have done. This is because if they are legally required to do so their commercial well being is entirely dependant on cooperating with the NSA.
Setting aside my joke about breeding pigeons earlier, I also think that it is missing the point a little to assume “Christians” need have no concerns. We have a command to be as cunning as serpents in our understanding of worldly realities, whilst being as innocent as doves in our conduct and intentions. The recent conference “Sleeping Virgins and the Soon Coming of Christ” brought out several interesting points in this area of reality with regard to North Korea and China. I have no doubt that when the time comes we will find that some brethren have already been preparing!
If you encrypt your e-mails they cannot be read by anyone else unless they steal the private keys. Keeping those keys secure will be the real security. What we need is a Certificate Issuing Authority that is trustworthy in the sense that its directors are willing to go underground rather than compromise others. Technical pastors as it were. Not one but a number of them. The internet is already beyond any one group of interested parties, nations and individuals, regardless of wealth and knowledge. No one is going to let it fail. So if it not allowed to fail commercially; and given that it is latency driven, it is likely to stand. That and a private mailing system or two should be helpful as well then we can be rid of the money men and our dependancy on them. Get rid of the power to control by money and you have done much to get rid of the bogey man!
The following URL’s link to an extended blog article written by John Couzins who is a British Security Expert and makes easy reading of the issues involved.
http://johncouzins.wordpress.com/2011/06/27/the-history-of-ssltls/
http://johncouzins.wordpress.com/2011/07/11/technical-implementation-attacks-on-ssltls/
http://johncouzins.wordpress.com/2011/07/31/certificate-weaknesses-in-ssltls/
http://johncouzins.wordpress.com/2011/08/11/human-weaknesses-in-ssltls/
http://johncouzins.wordpress.com/2011/08/17/conclusion-on-ssltls/
If you managed to read all of these links you will realise that the Internet is a human device and the only rock solid stability is that of Math and its underlying certainty. The whole issue of the NSA is essentially not a technical issue per se, it is a human issue right down to the transport layers themselves and their original limitations. It is also possible to imagine that an Intelligence Agency with sufficient resources could exploit both the technical vulnerabilities of the original and developed transport and security layers of the OSI model building on the weaknesses of the TCP/IP stack.
http://en.wikipedia.org/wiki/Internet_protocol_suite
As all intelligence gathering agencies have limitations as to what they can and cannot achieve in the real world so those who use these same resources can also understand the weaknesses as well. If the weaknesses can be exploited and understood it must also be possible to implement best practise and at the same time “fill out” that knowledge with human intelligence of the ordinary kind. That is to say “be ye as cunning as serpents”.
When I spoke earlier of the recent SermonIndex Conference I was speaking about two things primarily. The first is the rather graphic description which Edgar gave of the 24 brethren who were rounded up because their names were written in the folds of a bible. The pastor and the elders lost their lives in a truly terrible way. Thank God all such sacrifices work for good with the Lord, but would we ourselves want to put other brethren at risk simply because we did not exercise wisdom. The other reference was with regard to China and the removal of the SIM card from the phone itself as a mechanism to deter tracking technologies in meetings. When I heard these two things I was reminded of Paul after his conversion on the Damascus road and his escape from Damascus with the help of trusted brethren through a gap in the city wall at night. On arrival in Jerusalem he was feared by the brethren and had to be taken to the apostles and formally tested by them in order to establish a basis for trusting him. After this it is said that Paul went about the city freely according to the measure of time given him, and then was moved on by other trusted brethren. The conclusion was that there was peace and fellowship in the city of Jerusalem in those days despite the efforts of the Pharisees to murder both Paul and the other apostles.
It is remarkable to me that the brethren in Jerusalem were not able to discern that Paul was a true believer and therefore to be trusted. How much more if these brethren in Jerusalem in the days of the apostles were not given to know that which would ordinarily be seen as essential for their welfare, must we be vulnerable to wolves and deceivers in our day? We can spiritualise these things if we desire, but to do so would be to deny a reality. If God is to be sovereign in our lives we must be real in our own lives as well. We are not puppets or play things. We are the children of God and have a true part to play in working out our own salvation and the salvation of others. It is God’s will that we cannot know that which belongs to God. We have to trust and we have to distrust as well. It is only in being real with others and expressing that reality which makes for the sovereign work of God in our own experience.
Britain and the USA have been the harlots of the world since the 18th Century. Britain devised this harlot system and the USA has made a brothel of it. Lets get real. Our nations are dogs and whores and thats a fact. We love money and we love lots of it. It is for our own gratification. We are beasts with it and ravenous wolves without it. When we think we haven't enough we go out and devour for it. We will sacrifice everything without exception to make money and we will kill anyone to keep it. I would like to think that Britain is somehow a lesser harlot than the USA but alas I think I am deluding myself.
