A Convicted Hacker and an Internet Icon Join Forces to Thwart NSA Spying

The internet is littered with burgeoning email encryption schemes aimed at thwarting NSA spying. Many of them are focused on solving the usability issues that have plagued complicated encryption schemes like PGP for years. But a new project called Dark Mail plans to go further: to hide your metadata.

Metadata is the pernicious transaction data involving the To, From and subject fields of email that the NSA finds so valuable for tracking communications and drawing connections between people. Generally, even when email is encrypted, metadata is not. Dark Mail ambitiously aims to revamp existing email structures to hide this data while still making the system universally compatible with existing email clients.

The project has made for an interesting pairing between Texas technologist Ladar Levison and convicted hacker Stephen Watt, whom hes hired to help develop the code. Both have had previous battles with the government in very different ways.

Levison is the owner of Lavabit, who defiantly closed his pro-privacy encrypted email business last year rather than submit to government demands to hand over the private SSL keys for his email service. The keys would have helped authorities decrypt traffic that passed between Lavabit customersincluding NSA whistleblower Edward Snowdenand the Lavabit web site.

Watt once had a lucrative Wall Street career coding software for real-time stock-trading systems until he wrote a packet-sniffing program for a long-time friend and found himself embroiled in a multi-million-dollar bank card heist that netted him a two-year prison term.

Theyll be discussing the project at the Hackers on Planet Earth conference in New York today and in August at the Def Con hacker conference in Las Vegas.

The project is composed of several parts: an email client called Volcano; server software called Magma Classic and Magma Dark; and the Dark Mail, or Dmail, protocol, which theyre designing to replace existing protocols for sending and retrieving email that dont hide metadata.

Most email encryption services that purport to hide metadata are generally in a walled garden run by a single service provider, Levison says, so that users of that email service can communicate only with other users of the same service. Levison and Watt dont want a closed system but want Dark Mail to work with existing email programs, like Outlook.

If you trust your server, you can use Outlook and the server will handle everything for you, Levison says. The preference would be that you use the Dark Mail client, but I understand that this is not even a possibility for some organizations.

But to make their scheme universally deployable with current systems requires an aggressive overhaul of existing protocols and software infrastructure.

See the original post:
A Convicted Hacker and an Internet Icon Join Forces to Thwart NSA Spying