CryptoSeal VPN shuts down rather than risk NSA demands for crypto keys

[Wilikon]

So this is how they will play it: destroying US VPN businesses who will refuse a backdoor to the NSA... The meaning is almost as if any US based VPN services will be compromised as the law forbids them to even mention it.


http://arstechnica.com/information-technology/2013/10/cryptoseal-vpn-shuts-down-rather-than-risk-nsa-demands-for-crypto-keys/

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CryptoSeal Privacy Consumer VPN service terminated with immediate effect


With immediate effect as of this notice, CryptoSeal Privacy, our consumer VPN service, is terminated.  All cryptographic keys used in the operation of the service have been zerofilled, and while no logs were produced (by design) during operation of the service, all records created incidental to the operation of the service have been deleted to the best of our ability.

Essentially, the service was created and operated under a certain understanding of current US law, and that understanding may not currently be valid.  As we are a US company and comply fully with US law, but wish to protect the privacy of our users, it is impossible for us to continue offering the CryptoSeal Privacy consumer VPN product.

Specifically, the Lavabit case, with filings released by Kevin Poulsen of Wired.com (https://www.documentcloud.org/documents/801182-redacted-pleadings-exhibits-1-23.html) reveals a Government theory that if a pen register order is made on a provider, and the provider's systems do not readily facilitate full monitoring of pen register information and delivery to the Government in realtime, the Government can compel production of cryptographic keys via a warrant to support a government-provided pen trap device.  Our system does not support recording any of the information commonly requested in a pen register order, and it would be technically infeasible for us to add this in a prompt manner.  The consequence, being forced to turn over cryptographic keys to our entire system on the strength of a pen register order, is unreasonable in our opinion, and likely unconstitutional, but until this matter is settled, we are unable to proceed with our service.

We encourage anyone interested in this issue to support Ladar Levison and Lavabit in their ongoing legal battle.  Donations can be made at https://rally.org/lavabit  We believe Lavabit is an excellent test case for this issue.

We are actively investigating alternative technical ways to provide a consumer privacy VPN service in the future, in compliance with the law (even the Government's current interpretation of pen register orders and compelled key disclosure) without compromising user privacy, but do not have an estimated release date at this time.

To our affected users: we are sincerely sorry for any inconvenience.  For any users with positive account balances at the time of this action, we will provide 1 year subscriptions to a non-US VPN service of mutual selection, as well as a refund of your service balance, and free service for 1 year if/when we relaunch a consumer privacy VPN service.  Thank you for your support, and we hope this will ease the inconvenience of our service terminating.

For anyone operating a VPN, mail, or other communications provider in the US, we believe it would be prudent to evaluate whether a pen register order could be used to compel you to divulge SSL keys protecting message contents, and if so, to take appropriate action.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (Darwin)

iEYEARECAAYFAlJSnR8ACgkQB62+B9LgMB+VQQCcCtJO9W9tNVZHd5q8YGBykO1+
PuEAn39cWbDwt6UQd2GyZUZ7y79cVQXh
=vGGD
-----END PGP SIGNATURE-----

[Carlton Banks]

Wow, the US really does want nothing but a compliance based society. They should expect all those that expect legitimate privacy (often their most creative thinkers) to leave the country. And I hope that's what happens.

[pedrog]

Wow, the US really does want nothing but a compliance based society. They should expect all those that expect legitimate privacy (often their most creative thinkers) to leave the country. And I hope that's what happens.

Mostly it will kill this industry in the US...

[scarsbergholden]

if a pen register order is made on a provider, and the provider's systems do not readily facilitate full monitoring of pen register information and delivery to the Government in realtime, the Government can compel production of cryptographic keys via a warrant to support a government-provided pen trap device.

whoa... did not realize this was the situation. US government don't mess around....

[trilightzone.org]

Sometimes we wonder where all this is going to end ? What is next, a camera in the living room for each U.S citizen ?

[Carlton Banks]

Sometimes we wonder where all this is going to end ? What is next, a camera in the living room for each U.S citizen ?

That's a great plan you've got there Citizen Trilightzone, this will stop all living room based crime dead in it's tracks. Report to your local police station for collection of your Patriotic Crime Hero Award.

[Kluge]

Sometimes we wonder where all this is going to end ? What is next, a camera in the living room for each U.S citizen ?

It's called the Kinect!

[Wilikon]

Sometimes we wonder where all this is going to end ? What is next, a camera in the living room for each U.S citizen ?

It's called the Kinect!

It is called: "Any gadget you own that has a built mic and built in webcam in your possession".
http://xiaopan.co/forums/threads/how-hackers-can-switch-on-your-webcam-and-control-your-computer.3642/


OK but now think what kind of tools an unlimited budget for the CIA/NSA (compared to the "regular" hackers) can give you. Tinfoil hats' conspiracy is REALITY.

[Littleshop]

So this is how they will play it: destroying US VPN businesses who will refuse a backdoor to the NSA... The meaning is almost as if any US based VPN services will be compromised as the law forbids them to even mention it.

Of course I could argue why this is bad for so many reasons but I am not....

This type of thing is bad for the NSA's own interest.  Sure they can get some great info for a bit but long term they are cutting their own sources.  The best tactic would be to use NSA letters rarely on the bigger more important cases but do this far less often then they are doing now, reserved for actual terrorist plans not drugs, copyright stuff, leaker patriots and child porn.  Let the FBI go after those other cases using only constitutional warrants.

The strategy they are using now will just cause VPN providers to all close in the USA (due to lack of business) and new ones will open from outside of US control and the NSA will get nothing.  Anyone wanting to avoid the NSA reach will use an overseas provider. 

[biggie]

I was considering https://www.privateinternetaccess.com/ but they are physically in the u.s with a u.k office. Guess that's out of the question now.

[theonewhowaskazu]

if a pen register order is made on a provider, and the provider's systems do not readily facilitate full monitoring of pen register information and delivery to the Government in realtime, the Government can compel production of cryptographic keys via a warrant to support a government-provided pen trap device.

as far as I can see, there is literally no way of getting around this issue except by onion routing. 

This is sure to drive even more users to TOR, not sure if that's a good thing or a bad thing in the long run.

[pbflash]

as far as I can see, there is literally no way of getting around this issue except by onion routing. 

This is sure to drive even more users to TOR, not sure if that's a good thing or a bad thing in the long run.

Do you really think the NSA can't trace TOR? Something like 60% of TORs development money came from the US Govt.

[theonewhowaskazu]

as far as I can see, there is literally no way of getting around this issue except by onion routing. 

This is sure to drive even more users to TOR, not sure if that's a good thing or a bad thing in the long run.

Do you really think the NSA can't trace TOR? Something like 60% of TORs development money came from the US Govt.

Enlighten me: How exactly do they get thru onion routing?

The answer: They can't.

There is a huge difference between legitimate parts of the government and illegitimate parts.

[pbflash]

The answer: They can't.

Are you 100% sure? If you are then I guess you have nothing to worry about. I'm not 100% sure that they can't or that they won't be able to in the very near future.

[theonewhowaskazu]

The answer: They can't.

Are you 100% sure? If you are then I guess you have nothing to worry about. I'm not 100% sure that they can't or that they won't be able to in the very near future.

The only way in which they could is if they were pulling off the equivalent of a 51% attack on the TOR network. Which they basically don't have. If you don't trust me, trust the NSA themselves: http://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document

[dserrano5]

If you want to make it harder for the NSA to trace/hack/control Tor and have at least 50 spare Kb/s, then please set up your own relay. You don't have to be an exit node.

[Lethn]

Wait a minute, all you need to operate a VPN is a connection, so U.S customers can just go to someone outside the country to set things up and with Bitcoin it's now going to be even easier so the only way the NSA could realistically stop all this is shooting themselves in the foot china style and blocking off all access to the outside world.

"But it's all to keep us safe!" I'm sure government loyalists will say 

[pedrog]

as far as I can see, there is literally no way of getting around this issue except by onion routing. 

This is sure to drive even more users to TOR, not sure if that's a good thing or a bad thing in the long run.

Do you really think the NSA can't trace TOR? Something like 60% of TORs development money came from the US Govt.

Enlighten me: How exactly do they get thru onion routing?

The answer: They can't.

There is a huge difference between legitimate parts of the government and illegitimate parts.

They can "deanonymize" some users, they just need to control enough nodes.

[theonewhowaskazu]

as far as I can see, there is literally no way of getting around this issue except by onion routing. 

This is sure to drive even more users to TOR, not sure if that's a good thing or a bad thing in the long run.

Do you really think the NSA can't trace TOR? Something like 60% of TORs development money came from the US Govt.

Enlighten me: How exactly do they get thru onion routing?

The answer: They can't.

There is a huge difference between legitimate parts of the government and illegitimate parts.

They can "deanonymize" some users, they just need to control enough nodes.

At best, its just a random thing. You basically need to set up a lot of nodes and just hope that the target user relays thru them.

If you're concerned about stuff like this, the best thing you can do is, guess what, set up your computer as a relay.

[Mike Christ]

If you want to make it harder for the NSA to trace/hack/control Tor and have at least 50 spare Kb/s, then please set up your own relay. You don't have to be an exit node.

Thanks for reminding me about this; I used to have a relay setup but reformatted and forgot about the whole thing.