PDA

View Full Version : Harvard & MIT Students Have Created an Email So Secure Even the NSA Can't Crack It



Ares
20th May 2014, 08:08 AM
Nearly a year ago, former CIA technical assistant Edward Snowden stepped forward to say he was responsible for one of the most explosive leaks in history. The National Security Agency was exposed, and Andy Yen, a Harvard PhD candidate, was appalled.

"I posted on Facebook, 'Hey, I don't really like the fact the government is wiretapping us. What's happening in America?'"

After Yen posed the question, dozens started chiming in, equally as startled and determined to change the conversation. As Snowden had said last summer:

I can't, in good conscience, allow the U.S. government to destroy privacy, Internet freedom and basic liberties for people around the world with this massive surveillance machine they're secretly building.

At the time, Yen was working at the European Organization for Nuclear Research in Switzerland, known as CERN, where the elusive "God Particle" was discovered, coincidentally alongside a handful of other Cambridge, Mass.-educated students from either Harvard or MIT. A team of five suddenly formed, all focused on creating a service stronger than Lavabit, Snowden's email provider.

That service is called ProtonMail (https://protonmail.ch/), and it is launching out of private beta Friday.

ProtonMail is end-to-end encrypted email that is based offshore in Switzerland, where the team could operate free of surveillance mandates. Although "encryption is not necessarily a new technology," according to Yen, "only one to two percent of the population knows how to do it." ProtonMail handles the entire process without forcing users to install any software, and promises NSA-proof correspondence.

"Even we don't have the ability to read that email," Yen asserted. "If we can't read it, we obviously can't turn it over to any government agencies."

A main motivation behind starting ProtonMail was the human rights component. Referencing a writer in China who blogged about the service, Yen said, "Say you're an activist in China fighting for democracy, this is a life or death service."

Because of that, fellow co-founder Jason Stockman added they will be offering a "free for life" version of ProtonMail. The catch is similar to that of Dropbox's model — the service will be free, unless you're a "power user," and then ProtonMail will ring in at roughly $5 a month.

Although the service sounds too technical, Stockman assures, "If you can use Gmail, you can use ProtonMail." Encryption and decryption are completely invisible to the end-user, meaning the experience is no different from the platforms people currently log in to daily. Users can simply sign in from the startup's website, and will soon be offered secure chat and file storage, as well.

ProtonMail was recognized as a semi-finalist in the MIT $100K Entrepreneurship Competition, and the team is currently being advised by the MIT Venture Mentoring Service. With the half the team still in Switzerland, the technology has also been reviewed by computer security experts at CERN.

Since May 1, when the team launched its invitation-only beta, ProtonMail has garnered nearly 1,000 users. With its public beta launch, Yen said they want people to try and find bugs, as well as share any suggestions they have to improve the service.

"We're definitely not for 100 percent of the population, " Stockman said, "but for those who don't like what the government is doing."

http://bostinno.streetwise.co/2014/05/16/protonmail-encrypted-email-service/

Dachsie
20th May 2014, 09:04 AM
ProtonMail is end-to-end encrypted email that is based offshore in Switzerland, where the team could operate free of surveillance mandates.


"If you can use Gmail, you can use ProtonMail." Encryption and decryption are completely invisible to the end-user, meaning the experience is no different from the platforms people currently log in to daily. Users can simply sign in from the startup's website, and will soon be offered secure chat and file storage, as well.

This description sounds exactly like the way Dr. Katherine Albrecht advertised her project, StartMail, which recently fully launched.

Someone correct me if I am wrong but I must say

"...ay, there’s the rub!"

The rub is "end-to-end encrypted email."

I think end-to-end means that the sender and the receiver of an email must both be users of this email program for the email to be private.

That is why I chose not to sign up for StartMail as I realized that only a tiny percentage of my email would be fully private and uncrackable by the NSA.

madfranks
20th May 2014, 10:51 AM
I still like PGP. But yes, the receiver must know how to use the software as well as the sender.

Ares
20th May 2014, 11:31 AM
This description sounds exactly like the way Dr. Katherine Albrecht advertised her project, StartMail, which recently fully launched.

Someone correct me if I am wrong but I must say

"...ay, there’s the rub!"

The rub is "end-to-end encrypted email."

I think end-to-end means that the sender and the receiver of an email must both be users of this email program for the email to be private.

That is why I chose not to sign up for StartMail as I realized that only a tiny percentage of my email would be fully private and uncrackable by the NSA.

I'm a StartMail beta tester. I've been using it for about a month and a half now. You're correct though. The only way the email is secure is if both users have an address at StartMail, or even ProtonMail. I can send myself an email from startmail to another email address that I have and it's in plain text.

Shami-Amourae
20th May 2014, 11:56 AM
Just a warning, most of these things are developed with back doors for the NSA and other Jewish organizations. Basically when you use them it raises flags and you will be scrutinized even more. I personally just use a ton of identities and try to confuse the system with random shit.

Libertytree
20th May 2014, 12:09 PM
Just a warning, most of these things are developed with back doors for the NSA and other Jewish organizations. Basically when you use them it raises flags and you will be scrutinized even more. I personally just use a ton of identities and try to confuse the system with random shit.

I feel like this too, it seems to be a way of herding cats. So, instead of them finding you, you find them, waiting.

Shami-Amourae
20th May 2014, 12:18 PM
I feel like this too, it seems to be a way of herding cats. So, instead of them finding you, you find them, waiting.

Yeah that's my point. You will fly under the radar if you act like a Joe Blow instead of someone suspicious.

Ares
20th May 2014, 12:39 PM
Just a warning, most of these things are developed with back doors for the NSA and other Jewish organizations. Basically when you use them it raises flags and you will be scrutinized even more. I personally just use a ton of identities and try to confuse the system with random shit.

Not sure about Startmail, but Proton Mail uses Open Source Cryptographic libraries.

They also had this to say about how the encrypted email works:

ProtonMail's segregated authentication and decryption system means logging into a ProtonMail account that requires two passwords. The first password is used to authenticate the user and retrieve the correct account. After that, encrypted data is sent to the user. The second password is a decryption password which is never sent to us. It is used to decrypt the user’s data in the browser so we never have access to the decrypted data, or the decryption password. For this reason, we are also unable to do password recovery. If you forget your decryption password, we cannot recover your data.


We use only the most secure implementations of AES, RSA, along with OpenPGP. Furthermore, all of the cryptographic libraries we use are open source. By using open source libraries, we can guarantee that none of the encryption tools we are using have clandestinely built in back doors. We are constantly consulting security experts including IT scientists at CERN (the European Organization for Nuclear Research).

https://protonmail.ch/pages/security_details.php