The Dangers of Online Encryption
This is scary. I was reading this piece about how Hushmail gave up the goods to the Canadian governments. For background, Hushmail’s been in the encrypted/anonymous email business for years now - they were supposed to be offering completely encrypted, they can’t even decrypt your emails type of service. In my head, they always seemed like an inviolate sort of organization and their fall freaks the hell out of me.
So there’s a couple things afoot here, first, the last time I checked Hushmail, probably about a year ago - they were still a java applet based web app. So, when you went to their site, you downloaded a java applet that handled all the encryption/decryption locally - Hushmail never knew your secrets or handled your plain text. Apparently, at some point they got enough complaints that they offered a pointedly less secure but more convenient plain html interface. Now this is distinct from the html interface that Clipperz and PassPack use - their model is much closer to the java version but they use javascript instead of java - all the encryption still happens on your desktop. Hushmail, did not opt for that route, strangely, instead they went very traditional and had the server handle encryption/decryption - that means you have to tell the server your password and it handles your clear text for you.
Now, Hushmail suggested that this was a vulnerability should someone get into the system - little did people suspect that the Canadians could make Hushmail itself exploit this vulnerability, capturing the passwords permanently for the particular accounts in question and handing everything over to the government. This is of course, perfectly reasonable - they have to abide by rules and in all these vulnerabilities were disclosed to the users who opted themselves to trade security for convenience.
But here’s the thing. Sure the java applet is more secure, since everything is local - but Hushmail controls that, too. So, if they wanted they could simply modify their applet to call the mothership with your passwords and it’s the same thing. Impressively, they even disclose this vulnerability to the clients. Arguably you could check the source code (by decompiling the java) and looking around but that’s quite an event. This same vulnerability exists in the Clipperz and PassPack model - although their code is or will be open so many eyes can check it out. Which is convenient.
It remains, though, that because these are web apps you download a new copy every time. There’s no sense of versioning or having something inviolate on your desktop. So changes can be made to the code you run as frequently as the developers like - they can target changes to specific accounts and all that subterfuge and it would be up to you to figure out if you’ve got something malicious going on. If it worked more like a desktop app where you downloaded from somewhere a specific code set and continued to use that until you yourself decided to upgrade it would seem much more secure. Changes would be easier to detect and if you had an old (and ideally verified secure) version you would never have to update if you didn’t want to - changes could not be pushed on you without your consent.
Obviously, these are all things for the ultra paranoid - this level of security most likely affects nearly no one. Still, it is scary that even this bastion of security in the online world is so easily compromised. The world just got a little scarier to me, not much, but a little.
