Tag: Encryption

AirVPN’s Responses to TorrentFreak’s VPN Questions

Back in 2011, TorrentFreak did a survey of third party VPN services in response to some high-profile incidents in which companies running VPNs ratted out their customers. Recently, TorrentFreak did a similar survey that had a fairly striking omission–TorrentFreak didn’t include and apparently didn’t bother to even ask its questions of AirVPN, which I and others concluded was the best VPN available based on its 2011 survey. TorrentFreak hasn’t explained why AirVPN was left out, but AirVPN went ahead and answered TorrentFreak’s questions in their user forums, and TorrentFreak finally got around to updating its original story to include AirVPN’s answers.

Anyway, since I don’t like the format in which TorrentFreak offered up the answers, here are their questions with AirVPN’s answers, which  highlight why I continue to be a loyal AirVPN customer.

1. Do you keep ANY logs which would allow you to match an IP-address and a time stamp to a user of your service? If so, exactly what information do you hold and for how long?

No, we don’t keep any log that might be exploited to reveal customers’ personal data during connections, including real IP address. For example OpenVPN logs are sent to /dev/null (Air is based on OpenVPN). Our privacy policy is available here: https://airvpn.org/privacy

On top of that our VPN servers do not maintain any account database.

2. Under what jurisdictions does your company operate and under what exact circumstances will you share the information you hold with a 3rd party?

Italy. We do not share any information with any 3rd party.

3. What tools are used to monitor and mitigate abuse of your service?

Automatic triggering based on patterns to detect and if possible block as soon as possible various types of attacks (for example UDP floods) against or from our servers.

4. In the event you receive a DMCA takedown notice or European equivalent, how are these handled?

They are ignored. Now and then we reply asking for a more substantiated proof and asking to disclose the technical method according to which a takedown notice has been prepared, but so far none of the entities we queried disclosed such information, in absence of which the notices pertaining to p2p are simply vague and unproven claims from some private entity.

5. What steps are taken when a valid court order requires your company to identify an active user of your service?

No help can be given about past connections because we don’t log, monitor or inspect our clients traffic, and we don’t and can’t require a proof of identity from our customers. However, if the court order pertains to presumed actions which infringe our Terms of Service and in particular that in any way violate, directly or indirectly, or aid the violation of, the ECHR, we can try to help the court in the best way we can with subsequent investigations and if possible with the help of proper and competent authorities.

6. Is BitTorrent and other file-sharing traffic allowed on all servers? If not, why?

Yes. p2p protocols are perhaps a set of the most exciting protocols invented in the last 12-13 years, so they are actively encouraged on every server. We do not discriminate against any application or protocol, in compliance with our mission and to stay a mere conduit of data.

7. Which payment systems do you use and how are these linked to individual user accounts?

We accept Bitcoin, many credit cards, PayPal. Each payment is linked to an account only in order to provide service delivery and to comply to our refund policy.

8. What is the most secure VPN connection and encryption algorithm you would recommend to your users?

We put into practice the recommendations of security expert and best practices on our setup, based exclusively on OpenVPN with the following features:

Data Channel: AES-256-CBC
Control Channel: HMAC SHA1
RSA keys size: 2048 bit
PFS (Perfect Forward Secrecy): yes. TLS re-keying is performed by default every 60 minutes through DHE as well as at each new connection. As an additional option the re-keying time interval can be lowered by the client unilaterally.

The client key is used to authorize the access to the system, not to encrypt the data channel, so that even if an adversary catches the client private key, the client traffic can’t be decrypted.

Full Transcript of Edward Snowden’s Appearance at SXSW

Courtesy of Inside.com

Ben Wizner:    Okay. I think we’ll get started. There wasn’t a lot of applause when we came on stage. I guess you are here to see somebody else. My name is Ben Wizner I’m joined by my colleague Chris Soghoian from the ACLU. And maybe we can bring up on screen the main attraction.

Edward Snowden:    Hello.

Continue reading “Full Transcript of Edward Snowden’s Appearance at SXSW”

Cold Boot Attack Against Android Phones

Researchers at Erlangen University in Germany have demonstrated a cold boot attack against Android phones. Princeton researchers originally first demonstrated cold boot attacks in PCs. The DRAM in most computers (and mobile phones) will retain data for up to a few seconds after a device is shut off, and the period of time the data is retained can be extended significantly by lowering its temperature.

In the mobile device cold boot attack, the researchers put Android phones in a freezer that was -15 degrees Celsius, and left the device for an hour until its temperature fell below 10 degrees Celsius. The researchers then forced the phone to reboot into Android’s fastboot mode which allowed them to run their code to scan for encryption keys in RAM, contacts, photographs, etc. that survived the rebooting thanks to the extremely low temperature of the phone.

One oddity here is that while they were able to recover data from phones that had their boot loader unlocked and phones that still had the boot loader locked, they were only able to recover the full disk encryption keys from the unlocked phones,

To break disk encryption, the bootloader must be unlocked before the attack because scrambled user partitions are wiped during unlocking.

So at least for this sort of attack, you’re better off with a locked phone.

Frost - Cold Boot Attack Against Mobile Phone

Phoneme: A Script to Encrypt All Gmail Archives with PGP

Phoneme is a Python script that will encrypt all of the email sitting in your Gmail account using GPG.

Every time it runs it will skip any messages that already start with “BEGIN PGP MESSAGE” in the body, so you won’t end up repeatedly re-encrypting messages.

A (very) simple script to encrypt all existing email in a gmail account with your gpg keys. The intent is that Phoneme is simple enough that even a layperson ought to be able to tell that there’s nothing suspicious going on with the code and it does what it says on the tin.

Phoneme goes through your email, encrypts it with your public key as the recipient, **DELETES THE PLAINTEXT UNENCRYPTED ORIGINAL** and appends it back to the folder it originally was in with the from and date information intact. It does not however remove the plaintext original from your trash folder, so when the full encryption process has finished you may want to check your trash folder and make sure everything is ok before you hit ‘delete forever’

Military Grade Encryption is Bullshit

Frequently security products insist on claiming that they use “military grade encryption.” Such claims are nonsensical marketing statements rather than factual statements about the strength of the encryption used by the product.

Andrew Fernandes made the case against the phrase best in a 1998 interview when asked about Microsoft’s claim that the _NSAKey he found in the Windows CryptoAPI just meant that Windows complied with “NSA encryption standards”,

It’s sort of like saying the phrase “military grade encryption.” Whenever you´re dealing with a security product and somebody says it´s military grade encryption your bullshit detector should really go off. And the reason for that is that the military has no standards of encryption. The military uses everything from good crypto to bad crypto to crackable crypto to uncrackable crypto to stuff that´s designed never to be used to stuff that should be used every day. And it uses it for all purposes and everything in between. But the phrase military grade crypto is an absolutely meaningless and content free statement.