Free App Lets the Next Snowden Send Big Files Securely and Anonymously

Wired.Com

Onionshare creator Micah Lee, who works as a staff technologist and crypto guru for Glenn Greenwald’s news site The Intercept. Image: Courtesy of Micah Lee

When Glenn Greenwald discovered last year that some of the NSA documents he’d received from Edward Snowden had been corrupted, he needed to retrieve copies from fellow journalist Laura Poitras in Berlin. They decided the safest way to transfer the sizable cache was to use a USB drive carried by hand to Greenwald’s home in Brazil. As a result, Greenwald’s partner David Miranda was detained at Heathrow, searched, and questioned for nine hours.

That’s exactly the sort of ordeal Micah Lee, the staff technologist and resident crypto expert at Greenwald’s investigative news site The Intercept, hopes to render obsolete. On Tuesday he released Onionshare—simple, free software designed to let anyone send files securely and anonymously. After reading about Greenwald’s file transfer problem in Greenwald’s new book, Lee created the program as a way of sharing big data dumps via a direct channel encrypted and protected by the anonymity software Tor, making it far more difficult for eavesdroppers to determine who is sending what to whom.

“If you use a filesharing service like Dropbox or Mega or whatever, you basically have to trust them. The file could end up in the hands of law enforcement,” Lee says. “This lets you bypass all third parties, so that the file goes from one person to another over the Tor network completely anonymously.

“It’s basically 100 percent darknet.”

When Onionshare users want to send files, the program creates a password-protected, temporary website hosted on the Tor network—what’s known as a Tor Hidden Service—that runs on their computer. They provide the recipient with the URL and password for that site, preferably via a message encrypted with a tool like PGP or Off-The-Record encrypted instant messaging. The recipient visits that URL in a Tor Browser and downloads the file from that temporary, untraceable website, without needing to have a copy of Onionshare.

“As soon as the person has downloaded the file, you can just cancel the web server and the file is no longer accessible to anyone,” Lee says.

Lee hopes to have others examine Onionshare’s code to suss out flaws. For now it only runs as a bare-bones command-line tool on the Tor-based operating system Tails, which can be launched on Windows or Mac machines. He plans to add a version that runs directly on Windows and Mac computers soon.

Onionshare can be particularly useful when someone sending a file wants to remain anonymous even to the recipient, Lee says. If whistleblowers can securely send an Onionshare URL and password to a journalist, they potentially could use it to leak secrets anonymously without being exposed. That flips the model of how Tor enables leaks: Sites like WikiLeaks and news organizations using the anonymous leak software SecureDrop host their own Tor Hidden Services. Onionshare could put more power in whistleblowers’ hands, helping them send secrets to journalists who don’t have that sort of anonymous submission system in place.

But Lee also sees Onionshare being used for more common file-sharing situations where everyone involved knows each other but require utmost secrecy. It’s a safe bet that Greenwald and Miranda will be fans.

“The internet is amazing in that it doesn’t have borders,” Lee says. “If you need to send files that are very sensitive, better to use the internet to send them rather than to travel and get searched at the border.”

“Actually, everything on the internet is searched,” he corrects himself a moment later. “That’s why we need encryption.”

..

.

‘We still don’t encrypt server-to-server data’ admits Microsoft to EU Committee

A senior Microsoft executive has told a European parliamentary committee that the company does not encrypt its server-to-server data communications.

Dorothee Belz, EMEA VP for Legal and Corporate Affairs made the remark when answering a question from Claude Moraes, MEP during a meeting at the European Parliament on Monday.

“Generally, what I can say today is server-to-server transportation is generally not encrypted,” she said. “This is why we are currently reviewing our security system.”

In raising the issue of server-to-server encryption, Moraes had alluded to a surveillance programme codenamed MUSCULAR, first reported by the Washington Post on 30 October. Via this programme, the NSA and GCHQ purportedly infiltrated communication links to data centres operated by Google and Yahoo. Millions of user records are alleged to have been retrieved from under the noses of both companies as a result.

It’s just one of several leaks by former intelligence agency contractor Edward Snowden that has concerned the EU’s Committee for Civil Liberties, Justice and Home Affairs (LIBE) in a series of parliamentary hearings.

Prior to taking questions from MEPs, Belz, who appeared alongside executives from Google and Facebook, reiterated earlier statements from Microsoft by stressing that the company did not openly provide “direct access” to its servers. However, her later admission that the firm has as yet failed to establish server-to-server encryption has raised fears among many within digital liberties groups that a significant breach of privacy could still be perpetrated.

Sam Smith, a technologist at Privacy International, said the unencrypted data could hypothetically relate to any of Microsoft’s cloud services, from Hotmail and Outlook.com email accounts to Xbox Live, Office 365 and SkyDrive cloud storage.

Wired.co.uk approached Microsoft in order to determine which products exactly were implicated by Belz’s remarks. However, the company declined to comment beyond stating that it had begun to investigate measures for better securing customer information in general. A spokesperson said, “We are evaluating additional changes that may be beneficial to further protect our customers’ data.”

This response seems unlikely to reassure Smith who commented, “Unless Microsoft takes immediate action to rectify this situation, any business or individual using their services to store or transmit sensitive data will have been fundamentally let down by a brand that suggested it was worthy of trust.”

Executive Director of the Open Rights Group, Jim Killock, agreed, calling Microsoft’s admission an “unacceptable fudge”. He added, “It’s clear that agencies are willing to go to any length to get data without permission and to use it how they like.

“They’re not respecting legal access mechanisms, their interest is in wholesale access to whatever they can get their hands on. So Microsoft is already running a very, very significant risk of having their data accessed and made available outside of established legal mechanisms.”

According to Carlo Daffara, CTO of cloud services provider CloudWeavers, it isn’t necessarily surprising that Microsoft had previously failed to encrypt server-to-server communications, given the cost and complexity of such measures. However, he argued that following this summer’s spate of surveillance programme revelations, comprehensive encryption techniques would now become a “necessity” from a business perspective.

“Users want assurances that their data is secure,” he explained. “It is now a matter of public opinion, and public cloud companies risk losing quite a lot of business if they don’t adapt fast.”

Google, in contrast to Microsoft, announced earlier this month that it had taken swift action to begin encrypting communication connections between the company’s data centres around the world.

The tech giant’s public statements on encryption were at the time accompanied by enraged, anti-NSA comments from a number of its employees on social media. Mike Hearn, a security engineer for the company, stated on Google+ at the time that he was issuing “a giant Fuck You to the people who made these slides,” referring to the leaked documents published in the Washington Post.

When speaking to MEPs on Monday, however, Nicklas Lundblad, Google’s Director of Public Policy and Government Relations, took a more sober tone. In fact, he explained that the process of implementing encryption was “not finished” and that it would be an ongoing project for the company.

Statements from Microsoft and Google executives followed an earlier, strongly-worded presentation by US Representative Jim Sensenbrenner in which he condemned the actions of the NSA, especially with regard to widespread electronic surveillance of non-US citizens.

“The NSA has weakened, misconstrued and ignored the civil liberties protections that we drafted into the law,” he said, commenting on his role as an architect of the now infamous Patriot Act which, post-9/11, provided American intelligence agencies with much greater powers of digital surveillance than they previously possessed.

“We never intended to allow the national security agency to peer indiscriminately into the lives of innocent people all over the world,” noted Sensenbrenner, who is now, along with Senator Patrick Leahy, proposing new legislation in the form of the “Freedom Act”. The new bill aims to better safeguard the privacy of foreign nationals from US intelligence agency snooping.

Wired.Co.UK