FOSDEM 2009: SmallMail
This is a modal window.
The media could not be loaded, either because the server or network failed or because the format is not supported.
Formal Metadata
| Title |
| |
| Title of Series | ||
| Number of Parts | 70 | |
| Author | ||
| License | CC Attribution 2.0 Belgium: You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor. | |
| Identifiers | 10.5446/39554 (DOI) | |
| Publisher | ||
| Release Date | ||
| Language |
Content Metadata
| Subject Area | ||
| Genre | ||
| Abstract |
|
FOSDEM 200925 / 70
3
4
6
16
17
18
19
20
21
22
23
24
25
26
27
29
30
31
32
33
35
40
41
44
46
47
48
50
51
54
55
57
58
59
60
62
65
67
68
69
70
00:00
Discrete element methodBoom (sailing)InformationInternet service providerInformation privacyComputerGroup actionInformation privacyNeuroinformatikEncryptionInformationQuicksortSound effectBitInternet service providerXMLComputer animationLecture/Conference
00:59
InformationInternet service providerInformation privacyComputerEmailFinitary relationDecision theoryTelecommunicationClient (computing)Server (computing)Service (economics)Normal operatorEmailProjective planeInformation privacyServer (computing)Web pageMessage passingInternet service providerService (economics)Patch (Unix)InformationSound effectLink (knot theory)Goodness of fitNeuroinformatikSoftware developerPoint (geometry)SoftwareDirection (geometry)TelecommunicationAddress spaceClient (computing)Moment (mathematics)Row (database)Rule of inferenceInternetworkingCommunications protocolCodeOperator (mathematics)Content (media)EncryptionScripting languageAuthorizationDifferent (Kate Ryan album)Computer programmingProxy serverWeb 2.0MereologyStandard deviationGroup actionMeasurementWeightDisk read-and-write headEvent horizonQuicksortSurfaceArchaeological field surveyBitData transmissionPurchasing
08:14
Service (economics)Uniform resource locatorWebsiteEmailInformation privacyDecision theoryContent (media)TelecommunicationLink (knot theory)Internet service providerLecture/Conference
08:26
Service (economics)EmailInformation privacyOpen setMessage passingSoftwareServer (computing)WordUniform resource locatorRepository (publishing)Electronic mailing listPublic-key cryptographyEmailDisk read-and-write headMultiplication signDifferent (Kate Ryan album)Price indexVector potentialEncryptionSpacetimeQuicksortSoftwareSurfaceBoss CorporationoutputNeuroinformatikSpeech synthesisFamilyMessage passingInheritance (object-oriented programming)Dressing (medical)Subject indexingWater vaporProxy serverAddress spaceClient (computing)Point (geometry)Descriptive statisticsRandom matrixForcing (mathematics)Software crackingKey (cryptography)Domain nameLevel (video gaming)Group actionService (economics)File viewerData managementPlastikkarteLine (geometry)Translation (relic)Server (computing)InternetworkingCommunications protocolUniform resource locatorWordLecture/Conference
15:30
XML
Transcript: English(auto-generated)
00:12
I'm going to introduce, well, let's first introduce Small Sister. Small Sister is a very small group of mainly Dutch citizens that know a bit about computers
00:25
and they are a bit concerned about what happens to privacy, especially where computers are involved. The main thing we like to do is provide information for computer and online privacy
00:40
so that people know how they can in front really endanger their privacy and how they can afford things. We like to educate people about the value of encryption, learn them that there are tools available that provide them very good privacy and we also inform politicians about
01:06
what the effects are of their measures. We're not only aiming at other people but also trying to do some politics and getting those in. As a last part, we are giving information about privacy solutions but we find that
01:24
there are some holes in what's available. There are very good tools available and we don't feel like reinventing another wheel but there may be holes that need patching and we like to do that too.
01:41
And what I'm doing, I'm just here as a developer talking about my project that I think is very interesting. The tool, it's the first tool that Small Sister is making a tool is Smallmail. Email is, the current standard email is bad for privacy and even if you use a good tool as PGP
02:09
it still remains bad for privacy because as you look at the data retention directive your provider can read notes where you send them and the governments ask them either to keep it
02:26
or directly send them a carbon copy of John sent a message to Alice at that time. Sometimes even how many bytes and what's the tool?
02:41
Well, we want to protect the ordinary citizens. Well, a lot of people already have good tools for privacy. I think the government itself, the intelligence agencies and the other thing is we like to point out and show how fatally flawed the concept is of data retention.
03:04
Like we take all people and collect all information about all their communications and well, I don't think it will become safer but they collect a lot of data and I think all the wrong things.
03:23
What is Smallmail doing? Well, we don't really look at anonymizing the people that are communicating with each other. Well, people can communicate anonymously or just only using a handle.
03:43
You need a kind of email address to get an email to someone but we are looking more at privacy issues. We like to have the communication secrets from third parties. Well, the government should not know I'm talking with someone in private.
04:04
I would also be able to email in private without the government having a record of every email I send. And to achieve that, we also like to hide that communication is happening. As far as possible.
04:22
The moment you do some things on the internet, there will be data on your internet uplink but it doesn't have to be TCP data that goes directly to your final destination. There are some very good tools that can hide where your data is going to.
04:43
Tor is a very good tool for that and I will use it. And the thing is, keep it simple. Don't reinvent rules. Just add to a great body of privacy code that already is there and use it when needed.
05:04
Who wants email? That's a client server protocol. But Smallmail is, because of privacy, very very different from SMTP. One thing is, we don't just encrypt the body of the message.
05:22
We also encrypt the header. Which means that the server operator only sees someone knocking on his door. Can you dump this message in the mailbox for that person? The server operator doesn't know what the handler is, the one who sends the email.
05:47
Of course, if you want to get your email from a server, you have to identify it to the server. The server operator doesn't see the content of the email because it's encrypted.
06:01
It doesn't know who sent you the email. It's anonymous to the server. You can even create your accounts from the server anonymously, if the server operator allows it. And the server is simple. It's a simple script. Anybody can run on his own computer and handle a server.
06:25
It can be distributed. The server can be in a totally different country, so it's hard for the authorities to find out what it is. To achieve a privacy between the sender of the email and the server operator, we use the header service from Tor.
06:48
Tor is a program I recommend, but most of you can use it as a web proxy. The normal operation is that you send the replicas into Tor and in the end it
07:05
will move it through its network to a server and you get a web page back. It's a very good use and I recommend everybody to install it, try it out, use it when needed.
07:20
But we use a different feature in Tor, the header service. We have a server and our Tor proxy is specially configured to know that it can receive some information. What happens is the server points a computer in a network.
07:44
The Tor network acts as an introduction point. All of those computers can be in totally different continents. They will be in a proxy network handling data, so it's not entirely clear that the byte that goes over this link also goes over that link.
08:04
You hide a lot of your data transfer. When a client wants to make a connection, it connects through the introduction point which connects back to the server.
08:40
It goes through several hubs. The hubs are chosen randomly and they will make it very hard for any attacker to trace how your data goes.
08:57
What happens when you start anonymizing or privatizing your email?
09:04
It shows that some of the email habits are very, very, very bad. We send our confidential documents in plain text to our ISP, to another ISP, Gmail indexes it. Yeah, well, we have to change a few habits to make a private email.
09:28
Use encryption, that means we have to do key management. You cannot just send an email to a small-mail user.
09:40
You need to have his public key so you can encrypt your email and he can decrypt it again. We made a simple fee card with a small-mail address and the private key, so it's relatively easy to exchange, but it's still something that is different.
10:04
Yeah, there are some issues with message listings. The server hides the time that it received the message from the person that receives it, the client that downloads the message.
10:22
So the client, well, it helps to remove stuff. Yeah, it makes that message sent times are not there. The subject of the message is encrypted, so we need to decrypt the message before we can just put a subject line in the header.
10:41
It's a bit different. One thing that is open is, well, if you do a CC, you usually see, well, I send this message to the destination, my boss, his secretary, the secretary of the receiver, etc. Do you want that in every email? Do you want to restrict it?
11:04
Well, I don't want to have a CC list of all customers that received the promotional address. That's something, yeah, why do things differently? I'm getting to my closing words. Yes. First, I'd like to thank NLnet for subsidizing me to have full-time time writing it.
11:28
Try the software. I'll put URLs on the last slide. Improve it, improve documentation, make translations. Once we already have a Dutch translation ready and the English version,
11:43
I'm sure there are some French-speaking people around here and German-speaking people that could do it. Help to keep the world a safe and safe place. Inform everybody around you about the dangers of computers when it comes to your privacy.
12:02
And if you do have some sort of space to spare, we could use a few more servers to run the network. And I planned some time for questions, so there is four minutes left for questions. Anyone have a question here? Questions, anyone?
12:34
Let's say someone compared it with IMAP. It has a message push command, and it can pull messages and index messages.
12:47
It doesn't do anything like message forwarding, because how do you send a message failure when the server doesn't... You don't want the server to know, but in Tor all of the servers are connected on the Internet.
13:04
So it's... Forwarding is not necessary anymore. That was a UECP-based requirement, but nowadays it's... Well, everybody is connected to everyone. So it's... Yeah. I kept it out to make that protocol simpler. Yeah?
13:27
That's my official smallmail address. I can explain it. This is the user ID that derives from a public key.
13:44
This is the hostname generated by the Tor proxy from encrypted decryption keys. And the .onion is the top-level domain that Tor uses for hidden services.
14:05
Okay? Yeah? Well, there's an address book in the client that works nicely.
14:24
So it's... And I'm just programming on... You can just say Peter, associating Peter in your client with this address.
14:42
You haven't seen the public key, the fee card, yes? With the PGP public key. Okay. Yeah? You can spend, if you want, but how should any server know about the difference between the whistleblower
15:05
or the one that's whistleblowing his own Viagra shop? Okay. One, two... Do another question and I see this alarm clock will ring soon.
15:21
Nobody? Okay. Thank you.
Recommendations
Series of 70 media