Email goes 'Dark' -- encrypted, that is

In the light of a seemingly endless series of revelations about the NSA's multi-faceted infiltrations of just about every network there is, including the private fiber used by Google and Yahoo, more and more folks are stepping up to offer possible solutions.

But because both the Internet and encryption aren't as singular or straightforward as they could be, it isn't likely to be something that can be delivered as a single product anytime soon.

The most common analogy used about email security is that it's no better than a postcard written in pencil and sent via conventional mail. To do something about it, two big names in security, Lavabit and Silent Circle, are joining forces to create a project they call the Dark Mail Alliance.

Silent Circle, a provider of both encrypted email and phone solutions, and Lavabit, a secure email provider, both made headlines earlier this year when they voluntarily shut down their email services in the wake of Edward Snowden's leaks about NSA actions against ISPs, rather than be a party to such spying. Their plan is to help create a new email system that is as resistant as technologically possible to spying.

The idea isn't to offer a product per se, but rather to create an open standard that could be freely implemented by themselves or by third parties. "1,000 Lavabits all around the world," was how Jon Callas, CTO and founder of Silent Circle, described it in a discussion with Infoworld.

This decentralized plan is both the best and worst thing about the project: Best in the sense that no one person has explicit control over it, but worst in the sense that it's also not possible to guarantee how consistently it can be delivered if it's an open project.

The technical details of Dark Mail involve taking existing email clients -- Outlook and Exchange were cited as possible targets -- and outfitting them with add-ons that would use the XMPP Web messaging protocol in conjunction with another encryption protocol developed by Silent Circle, named, appropriately enough, SCIMP, or Silent Circle Instant Message Protocol. Encryption keys are held on the end user's system and not managed by the email providers themselves, so a court order against the ISP will yield nothing. Both the message's contents and metadata (e.g., to/from headers) are encrypted.

The thing is, the technical details of encrypted email aren't themselves the real obstacle. The difficulties tend to be social -- that is, getting people to use the existing standards and projects in the first place. Many existing packages, such as Enigmail, already allow you to equip email clients with encryption without too much difficulty. But few non-technical users bother with them, in big part because in order to send someone else an encrypted message, they have to be running the same software. The lack of a common implementation, as common as a web browser, is a big stumbling block, but end user indifference is ultimately the biggest reason why most email isn't encrypted.

The other issue is something Silent Circle and Lavabit are at least attempting to tackle: Participation from common email providers. If Gmail supported the Dark Mail standard, for instance, that would provide a great many existing email users with a near-seamless way to make use of it, but so far, no third-party mail providers have piped up. That might well be a defensive measure: If they announced early on they were working on such a thing, it would give attackers all the more time to try and plan a way to subvert it.

The Snowden papers have also showed how even those who do take the pains to encrypt can have their privacy subverted by attackers who simply perform an end-run around the encryption and intercept information either before or after it's ever encrypted. Unfortunately, the only way to prevent such a thing is via such extreme measures as an air-gapped system.

So what can we expect from Dark Mail? If it's ever implemented as its creators intend, it ought to serve two functions: Give end users a way to casually encrypt email without going through a whole hassle, and make them that much more conscious of how, on the current Internet, there may not be any safe places at all.

This story, "Email goes 'Dark' -- encrypted, that is," was originally published at InfoWorld.com. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest developments in business technology news, follow InfoWorld.com on Twitter.

Source: http://www.infoworld.com/t/encryption/email-goes-dark-encrypted-229947
Related Topics: tina fey   Anna Kendrick