Email can’t be completely private

It was never designed to protect anonymity. The closure of two ultra-private services shows why it still can't

Topics: MIT Technology Review, email surveillance, Privacy, NSA, lavabit, Silent Circle,

Email can't be completely private (Credit: Brian A Jackson via Shutterstock)

The closure of two “ultra-private” e-mail services shows just how weak the system really is.

When Lavabit—an e-mail service used by National Security Agency leaker Edward Snowden—suspended service last week amid hints that it had received a government demand for information, a competing service called Silent Circle made a draconian decision: to obliterate all of its customers’ stored e-mail.

The episode pointed out two fundamental weaknesses in e-mail. First, even if an e-mail service encrypts messages for secrecy, as Lavabit and Silent Circle did, the e-mail headers and routing protocols reveal who the senders and receivers are, and that information can be valuable in its own right. And second, the passcodes used as keys to decrypt messages can be requested by the government (if held by the e-mail company) or simply stolen by sophisticated malware.

When e-mail was created 40 years ago, security or anonymity wasn’t part of the design. The routing and labeling protocols plainly state what computer sent it or forwarded it, what computer received it, and what time all this happened. “There are far too many leaks of information and metadata intrinsically in the e-mail protocols themselves,” says Mike Janke, CEO of Silent Circle, whose customers include people in companies and government agencies with secrets to protect. “It doesn’t matter what you try to do with e-mail, there are these inherent weaknesses. So we got rid of Silent Mail [the company’s e-mail service]. We deleted all of it, burned it, and threw it in the ocean with locks and chains on it. People lost all their e-mail, but the response went from ‘Why would you do this?’ to ‘Thanks for doing this.’ “

Lavabit and Silent Circle and some other providers have offered a straightforward proposition: they will keep your e-mail encrypted at all times, except when you are reading and writing it on your own computer. This is in contrast to services like Gmail, which encrypts e-mail only for the trip over the network but stores the messages “in the clear” in its servers and mines that data to serve you ads.

Lavabit’s founder, Ladar Levinson, says he suspended operations rather than be “complicit in crimes against the American people.” Levinson could not be reached for comment but told the New York Times that he was under a gag order, implying that he received a National Security Letter, in which the FBI or NSA demands information for an investigation relevant to national security and requires the recipient to not reveal even having received the letter. In contrast to Silent Circle, the Lavabit data has not been deleted, he says.



Janke says that news triggered an emergency conversation with Phil Zimmermann, a Silent Circle founder who in 1991 created the e-mail encryption protocol known as PGP for “pretty good privacy” (see “An App Keeps Spies Away from Your iPhone”). “Once we saw what happened with Lavabit, we realized it wasn’t days, it was hours that we had to make a decision,” Janke says. But he adds that he never did receive a request.

The problem—besides the metadata that accompanies all e-mail—was that 98 percent of Silent Mail customers opted to let Silent Circle hold the encryption keys, which made using the service much easier. When users manage their own keys, they have to log into a special system to exchange cryptographic keys with each person they want to e-mail with. By possessing the keys to manage this process, the company could decrypt the messages if forced to. “If we got a legitimate request, we could in fact turn it over,” Janke says (see “NSA Chief Says U.S. Phone and Web Surveillance Sets Standard for Other Countries”).

Silent Circle remains in business, because fewer than 5 percent of its customers were using the now-deleted mail service. Most of them use other Silent Circle services that encrypt phone, text, and video content. This allows users to, for example, send an encrypted file via text message and even attach a time limit so that it will be deleted from both the sending and receiving devices after some period.

Yet these services also can be undermined by malware that can steal encryption keys stored on computers or grab data that has been decrypted by the user. “It is very difficult to be malware-protected,” says Radu Sion, a computer scientist and security expert at Stony Brook University. “A highly determined adversary—I don’t want to say the government here—will have access to any machine in the world.”

Existing e-mail services could become a little more private by encrypting header information. The techniques are well understood, but there is limited demand for them, Sion says. “The public is not asking for it since people don’t care about privacy, really,” he says. “And the cloud e-mail providers make lots of money by mining your messages.”

Meanwhile, Silent Circle is working on replacing its defunct e-mail service with a system that doesn’t rely on traditional e-mail protocols and keeps no messages or metadata within the company’s grasp. It is based on a protocol often used for instant messages and other applications. Janke says the goal is for this to not be e-mail, but “for all intents and purposes it looks, feels, and acts like e-mail.”

David Talbot

David Talbot, the founder of Salon, is the author of the New York Times bestseller “Brothers: The Hidden History of the Kennedy Years.” He is now working on a book about the legendary CIA director Allen W. Dulles and the rise of the national security state.

More Related Stories

Featured Slide Shows

  • Share on Twitter
  • Share on Facebook
  • 1 of 14
  • Close
  • Fullscreen
  • Thumbnails

    13 of "Girls'" most cringeworthy sex scenes

    Hannah and Adam, "Pilot"

    One of our first exposures to uncomfortable “Girls” sex comes early, in the pilot episode, when Hannah and Adam “get feisty” (a phrase Hannah hates) on the couch. The pair is about to go at it doggy-style when Adam nearly inserts his penis in “the wrong hole,” and after Hannah corrects him, she awkwardly explains her lack of desire to have anal sex in too many words. “Hey, let’s play the quiet game,” Adam says, thrusting. And so the romance begins.

    13 of "Girls'" most cringeworthy sex scenes

    Marnie and Elijah, "It's About Time"

    In an act of “betrayal” that messes up each of their relationships with Hannah, Marnie and Elijah open Season 2 with some more couch sex, which is almost unbearable to watch. Elijah, who is trying to explore the “hetero side” of his bisexuality, can’t maintain his erection, and the entire affair ends in very uncomfortable silence.

    13 of "Girls'" most cringeworthy sex scenes

    Marnie and Charlie, "Vagina Panic"

    Poor Charlie. While he and Marnie have their fair share of uncomfortable sex over the course of their relationship, one of the saddest moments (aside from Marnie breaking up with him during intercourse) is when Marnie encourages him to penetrate her from behind so she doesn’t have to look at him. “This feels so good,” Charlie says. “We have to go slow.” Poor sucker.

    13 of "Girls'" most cringeworthy sex scenes

    Shoshanna and camp friend Matt, "Hannah's Diary"

    We’d be remiss not to mention Shoshanna’s effort to lose her virginity to an old camp friend, who tells her how “weird” it is that he “loves to eat pussy” moments before she admits she’s never “done it” before. At least it paves the way for the uncomfortable sex we later get to watch her have with Ray?

    13 of "Girls'" most cringeworthy sex scenes

    Hannah and Adam, "Hard Being Easy"

    On the heels of trying (unsuccessfully) to determine the status of her early relationship with Adam, Hannah walks by her future boyfriend’s bedroom to find him masturbating alone, in one of the strangest scenes of the first season. As Adam jerks off and refuses to let Hannah participate beyond telling him how much she likes watching, we see some serious (and odd) character development ... which ends with Hannah taking a hundred-dollar bill from Adam’s wallet, for cab fare and pizza (as well as her services).

    13 of "Girls'" most cringeworthy sex scenes

    Marnie and Booth Jonathan, "Bad Friend"

    Oh, Booth Jonathan -- the little man who “knows how to do things.” After he turns Marnie on enough to make her masturbate in the bathroom at the gallery where she works, Booth finally seals the deal in a mortifying and nearly painful to watch sex scene that tells us pretty much everything we need to know about how much Marnie is willing to fake it.

    13 of "Girls'" most cringeworthy sex scenes

    Tad and Loreen, "The Return"

    The only sex scene in the series not to feature one of the main characters, Hannah’s parents’ showertime anniversary celebration is easily one of the most cringe-worthy moments of the show’s first season. Even Hannah’s mother, Loreen, observes how embarrassing the situation is, which ends with her husband, Tad, slipping out of the shower and falling naked and unconscious on the bathroom floor.

    13 of "Girls'" most cringeworthy sex scenes

    Hannah and the pharmacist, "The Return"

    Tad and Loreen aren’t the only ones to get some during Hannah’s first season trip home to Michigan. The show’s protagonist finds herself in bed with a former high school classmate, who doesn’t exactly enjoy it when Hannah puts one of her fingers near his anus. “I’m tight like a baby, right?” Hannah asks at one point. Time to press pause.

    13 of "Girls'" most cringeworthy sex scenes

    Hannah and Adam, "Role-Play"

    While it’s not quite a full-on, all-out sex scene, Hannah and Adam’s attempt at role play in Season 3 is certainly an intimate encounter to behold (or not). Hannah dons a blond wig and gets a little too into her role, giving a melodramatic performance that ends with a passerby punching Adam in the face. So there’s that.

    13 of "Girls'" most cringeworthy sex scenes

    Shoshanna and Ray, "Together"

    As Shoshanna and Ray near the end of their relationship, we can see their sexual chemistry getting worse and worse. It’s no more evident than when Ray is penetrating a clothed and visibly horrified Shoshanna from behind, who ends the encounter by asking if her partner will just “get out of me.”

    13 of "Girls'" most cringeworthy sex scenes

    Hannah and Frank, "Video Games"

    Hannah, Jessa’s 19-year-old stepbrother, a graveyard and too much chatting. Need we say more about how uncomfortable this sex is to watch?

    13 of "Girls'" most cringeworthy sex scenes

    Marnie and Desi, "Iowa"

    Who gets her butt motorboated? Is this a real thing? Aside from the questionable logistics and reality of Marnie and Desi’s analingus scene, there’s also the awkward moment when Marnie confuses her partner’s declaration of love for licking her butthole with love for her. Oh, Marnie.

    13 of "Girls'" most cringeworthy sex scenes

    Hannah and Adam, "Vagina Panic"

    There is too much in this scene to dissect: fantasies of an 11-year-old girl with a Cabbage Patch lunchbox, excessive references to that little girl as a “slut” and Adam ripping off a condom to ejaculate on Hannah’s chest. No wonder it ends with Hannah saying she almost came.

  • Recent Slide Shows

Comments

Loading Comments...