NSA-proof email encryption? Cobblers, sniff German hackers

'Comical, shameless game' based on tech that won't stop determined g-men


Analysis German hackers have poured scorn on Deutsche Telekom's plan to offer "secure email", describing it as little more than a marketing gimmick.

Deutsche Telekom and partner United Internet are rolling out SSL-encrypted connections between users’ computers and the companies' mail servers as part of the “Email made in Germany” offer.

Deutsche Telekom's email service T-Online or United Internet's GMX and Web.de services will also avoid routing customers’ email traffic through US-hosted infrastructure - and thus avoid surveillance by Uncle Sam's spooks.

René Obermann, chief exec of Deutsche Telekom, described the offer as a response to the NSA PRISM and XKEYSCORE global internet dragnet controversy: "Germans are deeply unsettled by the latest reports on the potential interception of communication data. Our initiative is designed to counteract this concern and make email communication throughout Germany more secure in general."

The two firms said in a statement that the scheme would offer secure communication for two-thirds of all email users in Germany.

Ralph Dommermuth, chief exec of United Internet AG, added: "Alongside email encryption and the designation of secure e-mail addresses, a third key element relates to data processing and archiving, which is carried out in Germany. This ensures that Germany's stringent data privacy laws are complied with."

Der Spiegel reported that Germany is a focus of the NSA's surveillance operation, which hoovers metadata on up to half a billion communications per month - including emails, text messages and phone calls.

Messages sent to mail servers outside Germany will not be encrypted in transit, at least initially, which means the data can be intercepted by network taps, installed in the internet's arteries worldwide, that are run by the NSA and the UK's eavesdropping centre, GCHQ.

Any service offered within Germany will be subject to EU data retention laws and rules allowing cops and g-men to lawfully intercept or seize data (see El Reg's recent analysis of the Lavabit and Silent Mail shutdowns for details). Metadata collection is unavoidable in the EU and US, so all the "Email Made in Germany" scheme offers is some protection against crooks snooping on email exchanges, rather than anything genuinely spy-proof.

"Email Made in Germany" only promises that email will be protected in transit with no guarantees that it will be stored in an encrypted format. Lavabit offered encrypted storage before it shut up shop last week, perhaps permanently, as a result of pressure from the US authorities to hand over those messages.

German hackers at the Chaos Computer Club dismissed Deutsche Telekom and United Internet's offer as a shrewdly timed marketing stunt. Like security experts, they repeat the advice that end-to-end encryption using packages such as PGP are the only way to ensure email privacy:

Advertising these changes under the label “E-Mail Made in Germany” seems like a desperate effort to bring the already failed project "De-Mail" back into the spotlight. Indeed, these providers are claiming that De-Mail would even improve upon the new practice “in features”.

The supposed improvement is in effect only a shameless game with the users’ increasing problem awareness precipitated by the NSA scandal. It is comical at best if providers are now selling a well-aged technology as a groundbreaking innovation.

What users of these mail services are not being told is that encrypting traffic between mail providers does not mean that the e-mails themselves will also be stored encrypted. Rather, the NSA scandal has shown that centralised services can not be regarded as trustworthy with regard to access from intelligence agencies.

Ultimately, the technologies employed are not capable of preventing the installation of wiretapping infrastructure within the system. The provider and intelligence agencies still have complete access to the contents of e-mails and, consequently, will be able to fully analyze them.

The CCC stands by its recommendation of end-to-end encryption using GnuPG/PGP or S/MIME as a sensible instrument to prevent unauthorised access to e-mail.

Chaos Computer Club's statement refers to De-Mail, a German encrypted email service that links users' addresses with verified identities, confirmed during the sign-up process using state-issued identification cards. De-Mail can be used to complete official documents, such as tax returns, online.

Andre Meister, writing in German on the Netzpolitik.org blog, adds: "The basic problem with email is that it’s a postcard readable by all — [and this] changes nothing. The contents of the mail aren't encrypted, even if the e-mails are stored on encrypted hard drives." ®

Similar topics


Other stories you might like

  • VMware claims 'bare-metal' performance on virtualized GPUs
    Is... is that why Broadcom wants to buy it?

    The future of high-performance computing will be virtualized, VMware's Uday Kurkure has told The Register.

    Kurkure, the lead engineer for VMware's performance engineering team, has spent the past five years working on ways to virtualize machine-learning workloads running on accelerators. Earlier this month his team reported "near or better than bare-metal performance" for Bidirectional Encoder Representations from Transformers (BERT) and Mask R-CNN — two popular machine-learning workloads — running on virtualized GPUs (vGPU) connected using Nvidia's NVLink interconnect.

    NVLink enables compute and memory resources to be shared across up to four GPUs over a high-bandwidth mesh fabric operating at 6.25GB/s per lane compared to PCIe 4.0's 2.5GB/s. The interconnect enabled Kurkure's team to pool 160GB of GPU memory from the Dell PowerEdge system's four 40GB Nvidia A100 SXM GPUs.

    Continue reading
  • Nvidia promises annual updates across CPU, GPU, and DPU lines
    Arm one year, x86 the next, and always faster than a certain chip shop that still can't ship even one standalone GPU

    Computex Nvidia's push deeper into enterprise computing will see its practice of introducing a new GPU architecture every two years brought to its CPUs and data processing units (DPUs, aka SmartNICs).

    Speaking on the company's pre-recorded keynote released to coincide with the Computex exhibition in Taiwan this week, senior vice president for hardware engineering Brian Kelleher spoke of the company's "reputation for unmatched execution on silicon." That's language that needs to be considered in the context of Intel, an Nvidia rival, again delaying a planned entry to the discrete GPU market.

    "We will extend our execution excellence and give each of our chip architectures a two-year rhythm," Kelleher added.

    Continue reading
  • Amazon puts 'creepy' AI cameras in UK delivery vans
    Big Bezos is watching you

    Amazon is reportedly installing AI-powered cameras in delivery vans to keep tabs on its drivers in the UK.

    The technology was first deployed, with numerous errors that reportedly denied drivers' bonuses after malfunctions, in the US. Last year, the internet giant produced a corporate video detailing how the cameras monitor drivers' driving behavior for safety reasons. The same system is now apparently being rolled out to vehicles in the UK. 

    Multiple camera lenses are placed under the front mirror. One is directed at the person behind the wheel, one is facing the road, and two are located on either side to provide a wider view. The cameras are monitored by software built by Netradyne, a computer-vision startup focused on driver safety. This code uses machine-learning algorithms to figure out what's going on in and around the vehicle.

    Continue reading
  • AWS puts latest homebrew ‘Graviton 3’ Arm CPU in production
    Just one instance type for now, but cheaper than third-gen Xeons or EPYCs

    Amazon Web Services has made its latest homebrew CPU, the Graviton3, available to rent in its Elastic Compute Cloud (EC2) infrastructure-as-a-service offering.

    The cloud colossus launched Graviton3 at its late 2021 re:Invent conference, revealing that the 55-billion-transistor device includes 64 cores, runs at 2.6GHz clock speed, can address DDR5 RAM and 300GB/sec max memory bandwidth, and employs 256-bit Scalable Vector Extensions.

    The chips were offered as a tech preview to select customers. And on Monday, AWS made them available to all comers in a single instance type named C7g.

    Continue reading
  • Beijing reverses ban on tech companies listing offshore
    Announcement comes as Chinese ride-hailing DiDi Chuxing delists from NYSE under pressure

    The Chinese government has announced that it will again allow "platform companies" – Beijing's term for tech giants – to list on overseas stock markets, marking a loosening of restrictions on the sector.

    "Platform companies will be encouraged to list on domestic and overseas markets in accordance with laws and regulations," announced premier Li Keqiang at an executive meeting of China's State Council – a body akin to cabinet in the USA or parliamentary democracies.

    The statement comes a week after vice premier Liu He advocated technology and government cooperation and a digital economy that supports an opening to "the outside world" to around 100 members of the Chinese People's Political Consultative Congress (CPPCC).

    Continue reading

Biting the hand that feeds IT © 1998–2022