How to Beat the "Heat:" Anti-Surveillance 101

[tannybogus]

Fri Aug 01, 2008 at 07:41:44 AM PDT
TeacherKen's diary is yet another reminder of the threat to privacy, security and freedom that we all face. Governments around the world, with the help of multinational corporations, are rapidly eliminating the zone of privacy to which we are all entitled as living, breathing human beings.

Once upon a time, there were jurists like William O. Douglas and legislators like Frank Church who stood as bulwarks against such intrusions in the United States, but authoritarians have largely captured the American federal courts and Democrats in Congress---'nuff said.

So who's going to protect your privacy in the face of this international threat?

ohmproject's diary :: ::
You're going to have to do it for yourself.

If you get aggressive about protecting your privacy, it will do two things. First, you may actually be able to reclaim some of that umbra and penumbra that William O. said we were guaranteed by the Constitution. Second, and perhaps more importantly, it will make the government/corporate snoops' job much harder. If enough of us do a good job of protecting our Internet privacy, their current surveillance techniques aimed en masse at the public will collapse of their own weight.

And the result just might be more effective law enforcement.

Here's a few things you can do along with answers to the common objections:


http://www.dailykos.com/storyonly/2008/8/1/9492/86632/806/560580

[bdf]

1. Choose your VPN s/w with care

There is no perfect VPN protocol. They all have flaws, it's just a matter of finding the one which has the least egregious flaws for how you want to use it.

The most commonly-used VPN software is PPTP. The security of version 2 is crap (version 1 was worse). It's commonly-used because it was created by Microsoft and is bundled with Windoze. Clones are available for Linux (pptpd/poptop) and Mac. Many routers have it built in, so you can take the workload off your PC and put it onto the router. But it's still crap. Really. I'll ignore esoteric issues like how it fails to handle fragmented packets (common on the internet because of semi-clueless admins deciding to block all ICMP packets) that appear out of order (very common). The security aspect alone means it is crap. It's not the fact that the NSA can crack it easily but that organizations with far fewer resources can also do so. To quote security expert Bruce Schneier (author the lauded Applied Cryptography) on PPTP V2:

At this point we still do not recommend Microsoft PPTP for applications where security is a factor. full article

The next most commonly-used VPN software is IPSec. It was designed by a committee, and it shows. The saying that "a camel is a horse designed by a committee" understates the case. If you imagine a committee sitting down to design a fly and coming up with an elephant, you have the committee that designed IPSec. It was designed under the aegis of the Internet Engineering Task Force, but it's still crap. Most of the reasons it is crap are highly esoteric, and some of them have been remedied by unofficial extensions to the protocol (some of which were later adopted in subsequent revisions to the protocol). One killer was that if you temporarily lost the internet connection between the endpoints the tunnel did not automatically re-establish when the connection returned, nor did it offer any warning that the connection had failed because it didn't realize that the connection had failed. But these types of flaw are merely indicative that the committee thought "fly" and came up with "elephant"—if they were that clueless about things that most internet-savvy people can figure out, what about the horrendously-complex stuff like cryptography that few understand? Again, I turn to Schneier (the emphasis in the second quote is mine):

Even though the protocol is a disappointment--our primary complaint is with its complexity--it is the best IP security protocol available at the moment.

and

We are of two minds about IPsec. On the one hand, IPsec is far better than
any IP security protocol that has come before: Microsoft PPTP, L2TP, etc. On
the other hand, we do not believe that it will ever result in a secure operational
system. It is far too complex, and the complexity has lead to a large number
of ambiguities, contradictions, inefficiencies, and weaknesses. It has been very
hard work to perform any kind of security analysis; we do not feel that we fully
understand the system, let alone have fully analyzed it.

We have found serious security weaknesses in all major components of IPsec.
As always in security, there is no prize for getting 90% right; you have to get
everything right. IPsec falls well short of that target, and will require some major
changes before it can possibly provide a good level of security.

...

We strongly discourage the use of IPsec in its current form for protection of
any kind of valuable information, and hope that future iterations of the design
will be improved. However, we even more strongly discourage any current alter-
natives, and recommend IPsec when the alternative is an insecure network. Such
are the realities of the world. full article

Elsewhere, Schneier has stated that IPSec is probably more secure than PPTP. IPSec ought to be a hell of a lot more secure than PPTP, because the underlying cryptographic algorithms of IPSec are currently believed to be far more secure than those of PPTP. But because of the obfuscated design nobody is sure that the security of those algorithms has not been severely weakened by misuse. It probably is more secure, but it could be weaker.

IPSec is available for Windoze (I think it may even be bundled with more recent releases). It's available for Unix/Linux (4 or 5 years ago it was a third-party add-on and horrendously difficult to configure, these days it's bundled with the distributions and has a GUI that makes is slightly easier). It's probably available for Mac. Most modern routers support it so you can have the hard work done by the router instead of your PC. But each vendor implements different subsets of the bewildering array of optional features in the specification (usually using different names for those features they have in common)—getting two vendor's implementations to interoperate can be a nightmare from hell.

The last alternative (of all those worth consideration—there are several others for Unix/Linux that have serious flaw on top of the major flaw of not being available for any other platform) is OpenVPN. Its major flaw is that although it is available for Unix/Linux, Windoze and Mac, no major router manufacturer yet supports it. So if you go with OpenVPN you can't move the workload from your PC to your router. Other than that it appears not to suffer any of the flaws that bedevil PPTP and IPSec. It has had a few security flaws in its implementation, but not in its design concepts. The implementation flaws have been fixed quickly after being discovered.

OpenVPN is available for free at http://www.openvpn.net">OpenVPN Web Site

All I'm doing here is point out that you need to choose your VPN package carefully and showing that two very popular VPN packages have flaws that may make them unsuitable for your purpose. I believe that OpenVPN is currently the best option but you should do your own investigation because:

1. I could be talking out of my arse and not have any clue about all this stuff.
   
2. I could be knowledgeable but mistaken about OpenVPN's security.
   
3. Some horrendous security hole could yet be discovered in OpenVPN (but that could be said of any encryption package available). Such a hole is more likely to be discovered in IPSec than in OpenVPN.
   
4. I could be an NSA plant trying to steer you into using a really weak encryption package that the NSA can break in their sleep using abacuses.
   

Don't just use the first VPN package you happen to come across on your computer's applications menu and think that because you're using a VPN your traffic is secure against eavesdropping. If you're using Windoze the VPN package you're most likely to encounter first is PPTP (laughably insecure) and the second is IPSec (it might be secure but nobody is certain); you probably won't find a third on that menu unless you download it and install it yourself.

Damn, all that because an otherwise good article gave the impression that you could just pick any VPN to use and you'd be safe.