Irreal

Over at The Intercept, Micah Lee has an outstanding article on secure chatting. If you need to set up secure chatting with someone or if you simply want all your chats to be free from snooping by the usual Nosy Parkers, this article will tell you how to do it.

You’ll need to install Tor, a secure chat application (which one varies with your OS), and then do a bit of set up. After that, you just select someone to chat with and your conversation and the associated metadata are secure. Lee uses the metaphor of Romeo and Juliet wanting to chat so that their families can’t listen in and, perhaps more important, don’t know the chats are taking place.

There are step-by-step instructions for setting up a secure chat solution for Windows, Linux, and OS X. It also explains how to use the Android SecureChat application to set it up on an Android phone. The article says that SecureChat can not yet do Tor securely on iOS but from what I can tell from their site, that inadequacy has been remedied so that secure chat on mobile is also a possibility¹.

Everyone with the slightest bit of paranoia should read this article. It’s got a lot of good advice and even if you don’t need or want it today, you may need it tomorrow. Read it and bookmark it for the time you do need it.

Matthew Green has a nice post recounting the history of government mandated backdoors. If you’re too young to remember the first round of the Crypto Wars from the 1990s, you’ll find Green’s history fascinating. Back then it was about the NSA designed Clipper chip that would allow secure communications while at the same time ensuring government access to those communications when needed.

As Green points out, the system was extremely fragile and Matt Blaze wrote a famous paper showing how the system could be defeated. For that and various other reasons the Clipper chip was abandoned and the government gave up on mandating backdoors.

More recently, we’ve had the FREAK and LogJam exploits both of which were enabled by the government’s now abandoned crypto export regulations. The point of these episodes is that trying to insert backdoors into crypto systems always has unintended consequences and introduces weaknesses.

Nonetheless, the government is back for another round and insisting loudly that the fate of the nation depends on their being able to read all our communications. The best way to read Green’s history is as a cautionary tale of what’s apt to happen if they succeed. If you have any interest in this area, be sure to read the post.

Finally, there’s a real push to get rid of one of the worst exploit vectors. Ever since Alex Stamos’ tweet calling for an end-of-life for Flash there is accelerating agreement that it’s time to kill flash.

The idea of Flash is a good one. A standard, ubiquitous app that all browsers can use to display video—sort of like PDF for video. It makes it easier on content providers, browser manufacturers, and users. Sadly, Flash is so riddled with security holes that it’s unusable. Anyone with a clue has long since disabled it. I stopped using it over a year ago and probably waited too long.

Even though I seldom notice it’s no longer installed, I occasionally run across some video that I would like to watch but that is available only in Flash. I just move on but maybe an official end-of-life for Flash will get content providers to stop publishing in it. We’ll all be better off for it.