How Turtl has no idea when you're sharing copyrighted stuff(turtlapp.tumblr.com)
turtlapp.tumblr.com
How Turtl has no idea when you're sharing copyrighted stuff
http://turtlapp.tumblr.com/post/81222024691/how-turtl-has-no-idea-when-youre-sharing-copyrighted
79 comments
Great point. It's worth noting that Turtl is a storage tool, not a means of distribution. The article is not promoting infringement, but instead gives an overview of how it's just not an issue with Turtl, because Turtl has no knowledge of the data being stored.
law evaluates intent. i'm not a lawyer, but i'm not an idiot either and it's pretty easy to read between the lines here.
if the intent is to illustrate security and encryption, there is no reason to invoke "copyrighted material" at all.
if the intent is to illustrate security and encryption, there is no reason to invoke "copyrighted material" at all.
Unless you are using it as an example of how your solution works differently. Which they are.
I don't see anywhere that they are claiming their business is for copyright infringement, in fact, it doesn't seem like it's for mass distribution at all unless you give out your key, and then you just defeat the point of the service.
I don't see anywhere that they are claiming their business is for copyright infringement, in fact, it doesn't seem like it's for mass distribution at all unless you give out your key, and then you just defeat the point of the service.
They are not claiming you should use it for infringement. They are however advertising that it works great for infringement. "That’s how [they] like it"
It doesn't really matter what you or I think anyway. If it came down to being sued by a copyright holder, a blog post like this is definitely not going to help their case.
It doesn't really matter what you or I think anyway. If it came down to being sued by a copyright holder, a blog post like this is definitely not going to help their case.
Of course it's not going to help; but mostly because humans are driven by emotion.
Sharing copyrighted material is not a crime unless is an illicit sharing, that is, when you do not hold a license that allows you to do so. So there are many exceptions such as: when you download a song that explicitly allow copies for any of your own devices; the same applies when you are the copyright holder, or when the license does not cover the country where you live.
Sharing copyrighted material is not a crime unless is an illicit sharing, that is, when you do not hold a license that allows you to do so. So there are many exceptions such as: when you download a song that explicitly allow copies for any of your own devices; the same applies when you are the copyright holder, or when the license does not cover the country where you live.
It's clearly positioned as an alternative to a tool that prevents copyright infringement. I don't think it is obvious that their intention here is not to present an alternative that facilitates infringement [0]. It seems like they are even proud of that [1].
[0] I am not saying it is good or bad, right or wrong.
[1] Observing, not judging.
[0] I am not saying it is good or bad, right or wrong.
[1] Observing, not judging.
[deleted]
Disagree. They are simply stating a consequence of the design of Turtl: it's not possible (or not knowingly possible today) to understand if the end user is sharing copyrighted material. I don't feel that this is a point "feature" - it applies to any and all content by design and the intent is not therefore to provide a safe harbor of illegal material.
Some people are looking for data protection in the cloud (trading the risk for the convenience). If companies like Turtl or SpiderOak didn't exist myself, and many others, would be forced to rely on similar solutions that are self-hosted. Is that intent? I don't think so. That would imply me locking my vehicle or house at night is some sort of indicator of nefarious activity.
What really annoys me is that people go off the handle about intent and fall back to "the law" being the overriding position in these sort of arguments. Bull shit. I have content I've created that I don't want to share with the world. I shouldn't have any shame or feeling of guilt associated with protecting my assets (digital or physical).
"Read between the lines" - give me a break. I hope that's not everyone's first perspective when they read positions as such. It's that line of thinking that's shifting us to a "guilty until proven innocent" mentality of usage of the Internet.
Some people are looking for data protection in the cloud (trading the risk for the convenience). If companies like Turtl or SpiderOak didn't exist myself, and many others, would be forced to rely on similar solutions that are self-hosted. Is that intent? I don't think so. That would imply me locking my vehicle or house at night is some sort of indicator of nefarious activity.
What really annoys me is that people go off the handle about intent and fall back to "the law" being the overriding position in these sort of arguments. Bull shit. I have content I've created that I don't want to share with the world. I shouldn't have any shame or feeling of guilt associated with protecting my assets (digital or physical).
"Read between the lines" - give me a break. I hope that's not everyone's first perspective when they read positions as such. It's that line of thinking that's shifting us to a "guilty until proven innocent" mentality of usage of the Internet.
> "Read between the lines" - give me a break.
"Everyone's" first perspective is not what should matter to you if you're evaluating legal risk; which is the context of the advise being offered here. When a civil suit is brought against, you, the standards of proof are entirely different than criminal, and these standards are ignored to the author's peril when constructing a message like the one linked here.
To get specific, when someone brings a civil suit against you, the first bar they must pass is relatively low. Once they have passed this bar, they can wrap you up in a very expensive lawsuit for a very long time. I know because I've been in this circumstance for the last four years. Before an actual trial, you get the opportunity to challenge the suit in a variety of ways. A judge gets to decide whether the plaintiff's complaint passes the tests for your challenge. If they do, the trial proceeds, and ultimately you end up in front of a jury.
This is the part where you're gambling -- with huge sums of money at stake -- when it comes to copyright. It doesn't matter if "everyone" decides to read between the lines; it only matters if the selected jury does. That is a gamble of epic proportions. Both lawyers are jockying to select a jury that they feel will fall on their side of the case, but keep in mind that the standard of proof in civil trials is a "preponderance of evidence", not "beyond reasonable doubt".
"Everyone's" first perspective is not what should matter to you if you're evaluating legal risk; which is the context of the advise being offered here. When a civil suit is brought against, you, the standards of proof are entirely different than criminal, and these standards are ignored to the author's peril when constructing a message like the one linked here.
To get specific, when someone brings a civil suit against you, the first bar they must pass is relatively low. Once they have passed this bar, they can wrap you up in a very expensive lawsuit for a very long time. I know because I've been in this circumstance for the last four years. Before an actual trial, you get the opportunity to challenge the suit in a variety of ways. A judge gets to decide whether the plaintiff's complaint passes the tests for your challenge. If they do, the trial proceeds, and ultimately you end up in front of a jury.
This is the part where you're gambling -- with huge sums of money at stake -- when it comes to copyright. It doesn't matter if "everyone" decides to read between the lines; it only matters if the selected jury does. That is a gamble of epic proportions. Both lawyers are jockying to select a jury that they feel will fall on their side of the case, but keep in mind that the standard of proof in civil trials is a "preponderance of evidence", not "beyond reasonable doubt".
And that seems to be the unfortunate truth. Something that has no direct intent can be positioned such that it's creators or users end up in a legal quandary. I don't see how that can move forward in a positive manner - the question is what is questioned next?
It seems as though only actors which are threatened by true privacy have a position, and that position includes significant wealth, political power and greed. Those actors set a precedent based on already won battles which don't seem to revolve around facts but, again, money and power. Everyone else is then left to spend "huge sums of money" to defend a position that was never unconstitutional in the first place.
Frustrating.
It seems as though only actors which are threatened by true privacy have a position, and that position includes significant wealth, political power and greed. Those actors set a precedent based on already won battles which don't seem to revolve around facts but, again, money and power. Everyone else is then left to spend "huge sums of money" to defend a position that was never unconstitutional in the first place.
Frustrating.
> "Read between the lines" - give me a break. I hope that's not everyone's first perspective when they read positions as such.
He wasn't talking about everyone's first perspective. He was talking about a judge in a copyright infringement lawsuit's final perspective.
He wasn't talking about everyone's first perspective. He was talking about a judge in a copyright infringement lawsuit's final perspective.
This is true but the opinion in MGM v. Grokster is pretty clear:
You risk being held liable for contributory infringement if you advertise infringement as a possible use for your product.
There really is no other way to read that case, and despite technical differences between Ginsberg (really, really bad) and Breyer (really, really good), all 9 justices on the court agreed with that basic idea. Advertise infringing uses? Get held liable. What this means is one really should shy away from saying things that may be taken as advertising infringing uses.
You can read the whole thing at http://www.law.cornell.edu/supct/html/04-480.ZS.html
Please do so.
You risk being held liable for contributory infringement if you advertise infringement as a possible use for your product.
There really is no other way to read that case, and despite technical differences between Ginsberg (really, really bad) and Breyer (really, really good), all 9 justices on the court agreed with that basic idea. Advertise infringing uses? Get held liable. What this means is one really should shy away from saying things that may be taken as advertising infringing uses.
You can read the whole thing at http://www.law.cornell.edu/supct/html/04-480.ZS.html
Please do so.
While I like the efforts you've gone to in order to hide what is inside the service, I hope that you also appreciate the level of force arrayed against you.
It seems that one of the challenges of these services is that in order to avoid the copyright goons everyone you know, even those folks you only know by some IRC handle, have to be willing to go to jail for you. Because otherwise one of them will get turned, they will then be pressured to get you to indict yourself. This is how it worked against Anonymous, and how it works on most disobedience rings (civil or otherwise). One of your friends will share with you a folder that has copyrighted material in it, once they are sure you have accessed it they will re-iterate that some (or all) of the material there is copyrighted. At this point the most common thing that happens is that thinking they are 'safe', someone will say something stupid like 'don't worry, its our secret' or something like that.
And almost simultaneously the door will explode open as the SWAT guys come in and put them in cuffs and read you your rights. All because someone you thought you knew, was unwilling to spend time in jail rather than help the FBI with their investigation.
Law enforcement has a number of tools (many dubious like the CFAA) which they can employ against you, and they will.
The best you can hope to achieve is to keep a solid (and I mean solid, no slip ups anywhere) public front of respecting the copyright holders rights and your willingness to protect them. Otherwise you will be served papers to decrypt other buckets and you will be sent to jail for contempt if you do not facilitate rooting out copyright infringement on your service. Not even keeping your servers and company in a foreign country will help unless it is a country which doesn't care about its relationship with the US.
It seems that one of the challenges of these services is that in order to avoid the copyright goons everyone you know, even those folks you only know by some IRC handle, have to be willing to go to jail for you. Because otherwise one of them will get turned, they will then be pressured to get you to indict yourself. This is how it worked against Anonymous, and how it works on most disobedience rings (civil or otherwise). One of your friends will share with you a folder that has copyrighted material in it, once they are sure you have accessed it they will re-iterate that some (or all) of the material there is copyrighted. At this point the most common thing that happens is that thinking they are 'safe', someone will say something stupid like 'don't worry, its our secret' or something like that.
And almost simultaneously the door will explode open as the SWAT guys come in and put them in cuffs and read you your rights. All because someone you thought you knew, was unwilling to spend time in jail rather than help the FBI with their investigation.
Law enforcement has a number of tools (many dubious like the CFAA) which they can employ against you, and they will.
The best you can hope to achieve is to keep a solid (and I mean solid, no slip ups anywhere) public front of respecting the copyright holders rights and your willingness to protect them. Otherwise you will be served papers to decrypt other buckets and you will be sent to jail for contempt if you do not facilitate rooting out copyright infringement on your service. Not even keeping your servers and company in a foreign country will help unless it is a country which doesn't care about its relationship with the US.
To be fair, Anonymous' trouble with the law has nothing to do with copyright, and people are not generally assaulted by SWAT teams for having folders containing copyright material shared with them. Even in the Megaupload case, the indictment included a long history of incriminating emails, not a single setup by an informant or slip-up.
But yes, if you want to run a file sharing site whose main purpose is uploading copyrighted material, you had better avoid leaving a paper trail containing anything damaging.
But yes, if you want to run a file sharing site whose main purpose is uploading copyrighted material, you had better avoid leaving a paper trail containing anything damaging.
I have to ask: why not just email someone a copyrighted file? Once the file is downloaded to their email client, they are in the same position as they would be in if you shared it via Turtl.
As a Turtl user, you'd have to be careful about who you share with (or accept shares from). We even outline this on our security page (https://turtl.it/docs/security#when-is-turtl-not-secure).
It seems at some point the app you're using becomes irrelevant and what you actually do with it becomes much more relevant (such as a bittorrent client).
As a Turtl user, you'd have to be careful about who you share with (or accept shares from). We even outline this on our security page (https://turtl.it/docs/security#when-is-turtl-not-secure).
It seems at some point the app you're using becomes irrelevant and what you actually do with it becomes much more relevant (such as a bittorrent client).
> why not just email someone a copyrighted file? Once the
> file is downloaded to their email client, they are in
> the same position as they would be in if you shared it
> via Turtl.
The successful prosecutions I've read about involved three things, 1) an opportunity, 2) an awareness of the legality, and 3) the follow through even when there is no reasonable doubt.
Bittorrent is a good example here, and cassette tapes are as well. All of the outward facing material from these folks are focused on legitimate uses of the service, it doesn't keep people like cassette makers from being sued, but it gives them a pretty credible defense. In the linked article you mentioned using Turtl specifically to avoid copyright enforcement, a judge or jury reading that could be persuaded that you intended to facilitate copyright infringement and that intent would make you liable for any copyright infringement that occurred by anyone using the Turtl service. The point I was trying to make is that you are doing the prosecution's job for them when you write
"So how does Turtl deal with copyrighted material?
We don’t. We don’t know what you’re storing. Neither do copyright holders. Neither does the government.
That’s how we like it =]"
It will not be difficult for a prosecutor to use your words to a Jury and show that you like that people can violate copyright with your service and that you made the service so that they could.
And once the prosecution has made the jury understand that, you will be convicted of abetting copyright infringement and either broke for the rest of your life paying off an infringement judgement from hell, or serving time in prison.
All for stuff other people did using your service, because you made it so they could. See how that works?
I find your point (2) very weird.
Child porn is strict liability (meaning, there's no requirement to show you did anything on purpose). The law generally doesn't require that you be aware of the legality of what you're doing ("ignorance of the law is no excuse").
Now, it's easy for me to believe that if you can show affirmatively that you received child porn by accident, for example through the unknown-to-you malicious actions of others, the judge might let you off, but that's not actually encoded in the law; the federal agents you mention have an accurate view of things.
Can you point out a case where someone knew they were in possession of or receiving child porn, but got off because they were under the impression it was legal?
Child porn is strict liability (meaning, there's no requirement to show you did anything on purpose). The law generally doesn't require that you be aware of the legality of what you're doing ("ignorance of the law is no excuse").
Now, it's easy for me to believe that if you can show affirmatively that you received child porn by accident, for example through the unknown-to-you malicious actions of others, the judge might let you off, but that's not actually encoded in the law; the federal agents you mention have an accurate view of things.
Can you point out a case where someone knew they were in possession of or receiving child porn, but got off because they were under the impression it was legal?
Possession of child porn is not a strict liability offense. You still need to have the intent to possess whatever media is at issue and you must know what the media contains.
Now, it's easy for me to believe that if you can show affirmatively that you received child porn by accident, for example through the unknown-to-you malicious actions of others, the judge might let you off, but that's not actually encoded in the law; the federal agents you mention have an accurate view of things.
If you can show affirmatively that you received child porn by accident, the judge will let you off, because there wasn't any intent to possess child porn. Moreover, the prosecution will go after the person who sent the porn to you, and will likely recommend a good civil attorney for your lawsuit against that person.
Now, it's easy for me to believe that if you can show affirmatively that you received child porn by accident, for example through the unknown-to-you malicious actions of others, the judge might let you off, but that's not actually encoded in the law; the federal agents you mention have an accurate view of things.
If you can show affirmatively that you received child porn by accident, the judge will let you off, because there wasn't any intent to possess child porn. Moreover, the prosecution will go after the person who sent the porn to you, and will likely recommend a good civil attorney for your lawsuit against that person.
You appear to be correct. Do you know of something discussing this directly?
Sounds like you can get people easily arrested by mailing them child porn without a return address and anonymously tiping off police.
Kind of like destroying someone's reputation via sybil attacks, on an app like lulu or yelp or whatever. The NSA had slides on how fake victims could write blogs about being raped or mistreated or whatever.
Kind of like destroying someone's reputation via sybil attacks, on an app like lulu or yelp or whatever. The NSA had slides on how fake victims could write blogs about being raped or mistreated or whatever.
Yes, that's actually happened before. It's never turned out well for the actual perpetrator.
The mail service has a remarkable ability to track mail packages, even those not sent by certified or registered mail. Additionally, police stations log all calls received--there's no such thing as an anonymous call. The use of a pay phone, prepaid cell phone, or online burner number is a huge red flag--it supports the recipient's defense that someone is attempting to ruin their reputation. Plus, almost all child pornography cases are coordinated with a special DOJ task force, due to the international scope of this offense.
Once it's been established that the recipient is being framed, the police--and the FBI--turn their attention to finding the actual perpetrator. The use of the postal service makes the frame-up a federal crime.
This is actually how the FBI actually cracked one of the more infamous child porn rings a few years ago--some idiot tried to frame his neighbor over some stupid dispute and they traced it back to him quite easily.
The mail service has a remarkable ability to track mail packages, even those not sent by certified or registered mail. Additionally, police stations log all calls received--there's no such thing as an anonymous call. The use of a pay phone, prepaid cell phone, or online burner number is a huge red flag--it supports the recipient's defense that someone is attempting to ruin their reputation. Plus, almost all child pornography cases are coordinated with a special DOJ task force, due to the international scope of this offense.
Once it's been established that the recipient is being framed, the police--and the FBI--turn their attention to finding the actual perpetrator. The use of the postal service makes the frame-up a federal crime.
This is actually how the FBI actually cracked one of the more infamous child porn rings a few years ago--some idiot tried to frame his neighbor over some stupid dispute and they traced it back to him quite easily.
It's an issue, but hopefully a fairly minor one.
The classic Japanese serial novel Musashi ( http://www.amazon.com/Musashi-Epic-Novel-Samurai-Era-ebook/d... ) includes a fairly disturbing subplot about the protagonist's reputation being trashed by a little old lady of no significance who follows him around insulting him to anyone who will listen. Despite the fact that no one knows her, and many significant and influential people know (and like) him, this prevents him from landing a respectable job.
The classic Japanese serial novel Musashi ( http://www.amazon.com/Musashi-Epic-Novel-Samurai-Era-ebook/d... ) includes a fairly disturbing subplot about the protagonist's reputation being trashed by a little old lady of no significance who follows him around insulting him to anyone who will listen. Despite the fact that no one knows her, and many significant and influential people know (and like) him, this prevents him from landing a respectable job.
This was the case I was thinking of when I wrote that: http://en.wikipedia.org/wiki/Jacobson_v._United_States
The wikipedia write-up suggests other grounds. From the majority opinion (via wikipedia):
> The evidence that petitioner was ready and willing to commit the offense came only after the Government had devoted 2½ years to convincing him that he had or should have the right to engage in the very behavior proscribed by law.
Jacobson was let off on grounds of entrapment; the reasoning was that the government specifically persuaded him to do what he otherwise wouldn't have done (or at least, what it could not be reasonably shown that he otherwise would have done). It's not obvious that that has much to do with whether he was or wasn't aware that child porn was illegal; the fact that the entrapment campaign included political literature protesting government intrusion tends (IMO) to suggest that he was.
Legality does get coverage as an issue, but it seems to be mostly (again, all I did was read the wiki article) as a way to show that Jacobson wasn't a suitable target for the entrapment campaign in the first place; the argument went that buying legal child porn doesn't demonstrate that he's likely to buy the same child porn after it becomes illegal.
> The evidence that petitioner was ready and willing to commit the offense came only after the Government had devoted 2½ years to convincing him that he had or should have the right to engage in the very behavior proscribed by law.
Jacobson was let off on grounds of entrapment; the reasoning was that the government specifically persuaded him to do what he otherwise wouldn't have done (or at least, what it could not be reasonably shown that he otherwise would have done). It's not obvious that that has much to do with whether he was or wasn't aware that child porn was illegal; the fact that the entrapment campaign included political literature protesting government intrusion tends (IMO) to suggest that he was.
Legality does get coverage as an issue, but it seems to be mostly (again, all I did was read the wiki article) as a way to show that Jacobson wasn't a suitable target for the entrapment campaign in the first place; the argument went that buying legal child porn doesn't demonstrate that he's likely to buy the same child porn after it becomes illegal.
Yeah I gotta say, this blog post is a really terrible idea. A "reasonable person", if this came up in a court of law, would probably conclude that despite your disclaimers to the contrary, you know or should've known that this blog post serves as a recommendation or even incitement to share copyrighted materials over your service.
As in all hack attempts, while the security may be rock solid, it is still susceptible to the "guy gets locked in a room with Bubba who loves breaking kneecaps with his bat"
You should probably avoid saying "We are a wink nudge plausibly deniable file locker!" until you have asked your lawyer "What does contributory infringement mean? Are US judges typically very lenient with parties who attempt to evade the law with wink-and-nod mechanisms that can be seen through by the average tadpole?"
For now. Host a "mystery file" that gets 100,000 downloads with all referrers coming from a site that posts download links to copyright infringing movies and things may change quite suddenly.
Even if they do not 'know' what you are storing, posting that will pretty much label your company as a 'kiddie cesspool' by anybody who values their data.
I'm not in need of their service, but they will never have me as a serious client after a blog post like this.
I'm not in need of their service, but they will never have me as a serious client after a blog post like this.
Been using turtl (free) for a little while now and love it so far. It's made huge leaps and bounds over the past several months and I'm excited to see where it continues to grow.
I'm glad you've been having a good experience! It's been fun building it and I'm excited to to keep growing it and making a viable platform for the more privacy-conscious.
And it's written in Common Lisp! What's not to like?
I honestly think this is one of the best times to advertise something like this.
There have been posts here before about alternative services getting a 51% customer increase on days where a breach in security or general trust is broadcasted to the world.
There have been posts here before about alternative services getting a 51% customer increase on days where a breach in security or general trust is broadcasted to the world.
On the phone is there a way to get to your main site from the blog? Was curious on your service but no easy way to jump to the main site, but maybe I missed it?
There should be a link on the top left (a logo of a turtle shell). If you click that it will take you to the main site.
The shell is centered on my iPhone; tapping it takes me to the blog homepage. There doesn't seem to be any way for me to get to the actual service without Googling the name myself.
Thanks for the heads up, apparently I have a mobile template I didn't know about/check before publishing the blog. I'll fix this shortly.
I don't know anything about how Dropbox or Turtl handle data and when they do their encryption but it would still be possible for Turtl to do hash level checking even with client side encryption. They could just hash the file and encrypt it all client side and then send both back to the server. It seems that this article is insinuating that Dropbox has full access to your data (which I dont know is true or not).
> this article is insinuating that Dropbox has full access to your data
They do. They send data over HTTPS from the Dropbox client, and they store it "encrypted" on S3, but they hold the encryption keys and also have full access to the unencrypted data while it's in memory on the servers.
Turtl encrypts all data with the user's personal key before it leaves the client, meaning the server has no access to the unencrypted data.
As far as hashing in the client, that's true, we actually could do that, and it might be a viable option if we ever implement public file sharing. Right now, all sharing is person-to-person (and private).
They do. They send data over HTTPS from the Dropbox client, and they store it "encrypted" on S3, but they hold the encryption keys and also have full access to the unencrypted data while it's in memory on the servers.
Turtl encrypts all data with the user's personal key before it leaves the client, meaning the server has no access to the unencrypted data.
As far as hashing in the client, that's true, we actually could do that, and it might be a viable option if we ever implement public file sharing. Right now, all sharing is person-to-person (and private).
Cool thanks for the info. I don't actually use Dropbox's service but its awesome to see a solution that cares about the security of its users data.
How will they know the hash coming back from the client hasn't been manipulated?
The request can be signed and then checked for authentication on the back end. Using public key encryption it would be sent safely to the server and checked for authenticity.
Signed by whom? The app running on the client's machine? One should know better than to trust that.
Could they use a homomorphic encryption scheme where it's still possible to verify a hash without getting access to the encrypted data?
Dropbox does have full access to its users data, and uses this property to enable its deduplication and public sharing features.
I mean, is not being able to take action on illegal file sharing when the feds come knocking really something to be proud of? It's a liability from a company perspective, not a strength IMO.
> I mean, is not being able to take action on illegal file sharing when the feds come knocking really something to be proud of? It's a liability from a company perspective, not a strength IMO.
In the Post-Snowden world, I think it is.
This being said, shouting "yes we can do this if you share copyrighted works!" means begging to be sued by the content provider on a contributory infringement basis. Hence it is far better to point to non-infringing uses, and general privacy features.
In the Post-Snowden world, I think it is.
This being said, shouting "yes we can do this if you share copyrighted works!" means begging to be sued by the content provider on a contributory infringement basis. Hence it is far better to point to non-infringing uses, and general privacy features.
I'm proud that I'm building something that combats the unconstitutional spying of American citizens, and also helps others around the world avoid surveillance.
This app is largely a response to the overreach of the US government. While I believe in fighting for our constitutional rights politically, private solutions are also a viable means of protest.
We probably will have liability issues down the road. Nobody said this would be easy. However, being completely transparent and publishing all our code open-source will help mitigate a lot of these issues. On top of this, by making the clients able to secure their own data, the company itself can respond to any government information requests without actually revealing any customer data.
This app is largely a response to the overreach of the US government. While I believe in fighting for our constitutional rights politically, private solutions are also a viable means of protest.
We probably will have liability issues down the road. Nobody said this would be easy. However, being completely transparent and publishing all our code open-source will help mitigate a lot of these issues. On top of this, by making the clients able to secure their own data, the company itself can respond to any government information requests without actually revealing any customer data.
I'm not sure if I follow you, this seems a lot like attacking Iraq to me.
Would you mind elaborating? Is "attacking Iraq" a metaphor/figure of speech that I'm not aware of? If so, wouldn't that imply the project is based on completely false grounds (ie, "WMDs" that don't exist)? It's been shown pretty clearly that mass surveillance exists and is a part of our every day lives now.
Mass surveillance and copyright have nothing whatsoever to do with each other. If you're going to attack copyright in order to rid us of mass surveillance that's like attacking Iraq in order to get rid of Al Qaeda.
Thanks for clarifying. Admittedly, the article was a PR move to show the inherent security weakness in apps like Dropbox, using copyright as an example. I touched on the actual surveillance aspects of the app here because the original comment asked if doing what I'm doing is something to be proud of. Violating copyright holders' rights is not (and I don't condone it), but providing storage for people who need/want privacy is something to be proud of.
Then don't position yourself as a mechanism to evade copyright law or as a champion against that. Those are different goals with different consequences and it opens you up to a whole pile of attacks that would otherwise be a non-issue.
All Internet services, especially US-based internet services, are going to have to start working this way because trust has been thrown on the pyre by the NSA.
The pricing is not clear if files up to size 200MB are free, or you only get 200MB of total space for free.
Thanks, I'll make that more clear.
I find bittorrent sync to be a vastly superior way to share files with people. (http://www.bittorrent.com/sync).
I'm actually very interested in the service (been hearing a lot about it lately). Does it require one of your computers to be on at all times? Or is there some sort of storage conduit that doesn't decrypt your data, but only acts to make it available to your other devices (mobile, desktop, etc)?
Quality PR move here and all around great article on security.
I'm not too convinced about the plausible deniability here, could someone that has reviewed their tech comment on the following:
- Encryption works by blocks and do not generally hide the size of the plaintext.
- Once I get the encrypted material, I thus approximatively know the size of the original file within a few bytes (uncertainty is due to padding to block size).
- I collect a few candidates files with size in the right range (There might be only one but it's still deniable).
Knowing your login information and the algorithm used to "derive the key from the login information", can't I encrypt the candidate and test against the encrypted material ?
- Encryption works by blocks and do not generally hide the size of the plaintext.
- Once I get the encrypted material, I thus approximatively know the size of the original file within a few bytes (uncertainty is due to padding to block size).
- I collect a few candidates files with size in the right range (There might be only one but it's still deniable).
Knowing your login information and the algorithm used to "derive the key from the login information", can't I encrypt the candidate and test against the encrypted material ?
> Knowing your login information
I'm not sure how much more clear I can be. Turtl doesn't know your login information, and doesn't know any of the keys derived from your login information. That's the point of the login...it's a familiar way people use to authenticate themselves with a service, but with the added benefit that it's actually generating a master key for them.
Also, not sure how many files there are floating around the internet (and off of it) but it's quite a bit, so comparing file sizes isn't going to give any real information (at least in regards to copyright protection).
I'm not sure how much more clear I can be. Turtl doesn't know your login information, and doesn't know any of the keys derived from your login information. That's the point of the login...it's a familiar way people use to authenticate themselves with a service, but with the added benefit that it's actually generating a master key for them.
Also, not sure how many files there are floating around the internet (and off of it) but it's quite a bit, so comparing file sizes isn't going to give any real information (at least in regards to copyright protection).
No. Since asymmetric encryption is slow the standard strategy is to generate a random symmetric key to encrypt your file. Then you just encrypt the symmetric key with your asymmetric key. This has the added benefit of each new encryption attempt leading to a unique result.
What an example of "Make hay while the sun shines".
My immediate concern is whether this could be construed as advertising the service of copyright violation. If so, there may be the same concerns that ultimately lead to the downfall of grokster.
If I were to launch a service like this, I would describe this issue in terms of general privacy, and the fact that the nobody else has any idea of what is going on. With Snowden, the obvious point is that it is private from the NSA.....
If I were to launch a service like this, I would describe this issue in terms of general privacy, and the fact that the nobody else has any idea of what is going on. With Snowden, the obvious point is that it is private from the NSA.....
Does anyone here have experience with turtl? Pros/cons? Confidence in security model?
The security model is broken. You can't securely do encryption in server side javascript.
Incorrect, my friend! There's no server-side javascript. Turtl is a downloaded, self-contained app, and all encryption happens in that app.
Sorry, my mistake. I guess I just assume everything is a webapp these days.
May I ask why you think that is?
It's true you can't reliably do crypto in javascript served from a web server. The idea is that someone could hack into your server, replace `crypto.aes.js` with `crypto.plaintext.js` and suddenly your app is silently sending plaintext back to the server where ciphertext is expected.
The correct way is to create a (signed) package of your app so that it pulls in no external scripts or files. Makes updates a pain (no free auto-upgrades you get from the web) but makes the app a lot more difficult to attack.
The correct way is to create a (signed) package of your app so that it pulls in no external scripts or files. Makes updates a pain (no free auto-upgrades you get from the web) but makes the app a lot more difficult to attack.
So it works the same as Mega?
"We hold that one who distributes a device with the object of promoting its use to infringe copyright, as shown by clear expression or other affirmative steps taken to foster infringement, is liable for the resulting acts of infringement by third parties."
- Justice Souter, writing on behalf of the Supreme Court of the United States in MGM Studios, Inc. v. Grokster, Ltd.