Commsec

[Null0x]

With recent legislature getting a green light, I've been heavily considering my communications security. I'm sure like many others, I've been using Facebook for IM (not sure how that happened...) and Skype for voice.

Neither of these are very secure methods of communication, being ex-commrsrch I know the importance of it.

So, some light digging reveals TOX (http://www.tox.im)

It's still in the alpha builds, but so far I can vouch for utox and antox. The concept of not having something to log in to is a bit strange, for sure.

Anyways, feel free to add me: 563176EF93E67E33896E3347933D29580DECC8CB76A5991889899C913BBB2909D9D6EBCFD26E

QR for antox


Alternatively, I'm not opposed to other programs, what do you use to keep your comms secure?

[Ziu Echoes]

It seems like a cool idea. Property going to try it when they get a more  stable version for Android.

But at least with me you alway have that 1 or 2 people in you life that refuse to use anything secure. And that how i away end up haveing to use facebook im or whatever.

[Sporadica]

The one thing with stuff like this is it requires that everyone get on whatever app you have

the app is secure lets say, but EVERYONE i know uses facebook and skype, and I dont think the masses care enough toprotect themselves to make apps like these blow up

Id rather use an app where I can still be on facebook or skype or something so I can still actually talk to people instead of being the only guy on the network of all my friends/business colleagues

[mikethemugger]

What new legislation are you referring too?

[Null0x]

What new legislation are you referring too?

Bill C-51, I'm sure the US has something similar.

[Null0x]

These programs are always very cool, but like a couple others mentioned it's not practical for everyday use as it requires whoever you are communicating with to be on the same system.

True, it's also still in Alpha dev at the moment so it's not like you can even 'sync' across platforms (PC, Phone, etc) which is the problem with not having the concept of an account or central server.

These usually end up being put aside for "make believe" time when you and 1 or 2 other Wogs want to pretend to be all secure and clandestine while talking about absolutely nothing, but not used when something actually important comes up and you need to contact someone "right now" and cant wait for everyone else to get into their secure program.  Personal experience talking here.  :P

Anecdotal, just because you talk about nothing doesn't mean everyone else does.

Another aspect to consider here is that unless this is an open source program and has been verified by you or someone you trust, it is not secure. 

Open source, I can start reading the code and verify for you but it'll be an exercise in futility since it's pretty obvious nobody around here is going to hop on-board.

Also, if this goes on your phone, it is NOT secure or anonymous.  End of story.  Cell phones, especially smart phones, are the antithesis of privacy and security.  I don't care what provider you have, what OS your using, or what app you are running, if it is sent to or from your phone it is recorded somewhere, and if it came from the google play store then yes, google has the keys to it. 

I'm apt to agree with you on most of these points, but first Tox is set up to encrypt its transmissions (not sure which encryption level they're using) which, sure, given enough time will eventually be cracked but it'll take a helluva long time to do it and secondly it isn't on the Play store you have to manually install the APK, Google doesn't have any tendrils in the stew.

Just my $.02 but the harder you try to conceal your comms, the harder people will try to look at them. 

Which isn't an argument in favour of not doing it.

Sit and think about what you are wanting to accomplish.  If you just don't want anyone in your business then you really shouldn't have a Facebook or smart phone to begin with.

flip-side: It would actually be more suspicious if you didn't have those things.

If you want a system for secure comms when needed but don't need to be James Bond all the time, nothing beats the old fashioned approach of having code words or phrases that only you and a select few know to express certain things.

Come on, that's the easiest level of commsec to break.

If you just really want to sit in your basement and feel like a godsdamn secret agent on a clandestine mission (Nothing wrong with that if that's your thing) then consider setting up a BBC for you and your friends,

I'm not sure what you mean by a BBC, my search is inundated with the British Broadcasting Channel

or get into HAM radio or shortwave listening. 

Unless I'm able to get a hold of a crypto module for me and everyone out there (fat chance) HAM is going to be about as secure as Facebook. This isn't about keeping secrets, this is about making the lives of anyone out there who's tasked with infiltrating your privacy a hard time.

When you say I don't care about the right to privacy because I have nothing to hide, that is no different than saying I don't care about freedom of speech because I have nothing to say or freedom of the press because I have nothing to write.

[mikethemugger]

What does it matter when the Eschelon program is recording everything we say and type? lol. This conversation is actually pretty interesting though. I've toyed with the idea of setting up a VPN, but ultimately I have no use for it atm.

[Null0x]

What does it matter when the Eschelon program is recording everything we say and type? lol. This conversation is actually pretty interesting though. I've toyed with the idea of setting up a VPN, but ultimately I have no use for it atm.

Because if everything you say and type is encrypted Echelon is going to have to spend (a great deal of) time decrypting it in order to read "Hey, wanna catch a movie tonight?"

It's not about total secrecy, but just enough to make life a living hell for the powers that be.

Also the VPN isn't a bad idea, but why not just go TOR?

[mikethemugger]

Aha, nice trick Circuit. I'm looking into TOR. Not sure about freeware but I'll give it a whirl.