'Invisible' - Encrypted instant messaging project seeks to obscure metadata.

'Invisible' - Encrypted instant messaging project seeks to obscure metadata.(TechWorld). By JeremyKirk.

Cyber “security researchers are have a working prototype of an instant messaging application that aims to thoroughly obscure and scrub evidence that two parties have been chatting.”

“The Invisible.im Project,” notes Mr. Kirk, “is looking for developers, and aims to solve a difficult security problem of online messaging services: metadata, or information about other data that can give law enforcement and governments, leads on people they’re investigating.”

“Even if an IM conversation between two people is encrypted,” adds Mr. Kirk, “a determination that two people merely communicated, can be enough for authorities to ask a court for warrants for other information — that could eventually compromise their [previous] conversations. That information could come from buddy lists; or, instant messaging servers that broker conversations and log information.”

“Invisible.im makes it possible for any member of the public to communicate with a journalist (or, indeed anyone) without leaving a retrospectively recoverable forensic trail behind on third-party servers,” according to the project’s website. Mr. Kirk notes that “Invisible.im was launched by [cyber] security IT analyst Patrick Gray; and HD Moore, Chief Research Officer at the security company Rapid7; the vulnerability researcher known as “The Grugg,” and another researcher, Ducktor Richo.”

Mr. Kirk adds that “the foundation of Invisible.im is built around XMPP, the widely used chat protocol. But, rather than using servers across the Internet to broker the transfer of messages, Invisible.im sets up a local XMPP server on a user’s computer. That local XMPP server then connects to the TOR hidden service.

TOR is short for The Onion Router, an [Internet] anonymity network that encrypts Internet traffic in order to give greater privacy to a Web browser. TOR can also be used to set up a “hidden” website; or, one hosted on the network whose true IP address is masked.”

“Chats are encrypted,” he notes, “using OTR, Off-The-Record, an encryption plugin. Invisible.im will use “ephemeral” encryption keys for those OTR sessions, which are scrubbed when the chat session ends. Chats will also have another layer of encryption by virtue of using TOR.”

“An “anonymous” mode of Invisible.im will allow a person to contact another person, for example, by downloading Invisible.im ; and, then entering the hidden service address of the person,” notes Mr. Kirk.

“The project is considering creating an address book so people can find the verifiable addresses of others they wish to contact. A more secure mode will allow two people who have been cryptographically verified, to chat. In that mode,” he notes, “no one can tell they are on each other’s ‘buddy lists’ or, that they have ever had a conversation, let alone when,” according to the project’s website.”

“It means authorities will not be able to infer relationships between users of the program — by passively observing internet traffic,” it said.

There Is No Such Thing As ‘NSA Proof’

While Invisible.im is clearly a move towards greater Internet privacy, I know of no ‘cyber maginot line;’ or, firewall that is absolutely, 100 percent foolproof. Brendan Sasso writing in the June 17, 2014 DefenseOne.com, contends that “while thousands, perhaps millions to billions of us as well as private-sector companies, nation-states, others, etc. — are taking measures such as adopting end-to-end encryption, there is nothing ‘NSA-Proof’ out there.”

“If they want it [NSA], they can get it,” is the bottom line to his article. And, that is almost certainly the truth. Joseph Lorenzo Hall, the Chief Technologist for The Center for Democracy and Technology, said “the idea of becoming ‘NSA-Proof, is “just silly.” “If they want it, they can get it,” he added. “The agency [NSA] can hack or, bypass many security measures — if it is determined enough,” Hall said.