Please, for the love of counsel, do not use moments like these to advertise your service's viability for the distribution of copyrighted materials.
"We hold that one who distributes a device with the object of promoting its use to infringe copyright, as shown by clear expression or other affirmative steps taken to foster infringement, is liable for the resulting acts of infringement by third parties."
- Justice Souter, writing on behalf of the Supreme Court of the United States in MGM Studios, Inc. v. Grokster, Ltd.
Great point. It's worth noting that Turtl is a storage tool, not a means of distribution. The article is not promoting infringement, but instead gives an overview of how it's just not an issue with Turtl, because Turtl has no knowledge of the data being stored.
While I like the efforts you've gone to in order to hide what is inside the service, I hope that you also appreciate the level of force arrayed against you.
It seems that one of the challenges of these services is that in order to avoid the copyright goons everyone you know, even those folks you only know by some IRC handle, have to be willing to go to jail for you. Because otherwise one of them will get turned, they will then be pressured to get you to indict yourself. This is how it worked against Anonymous, and how it works on most disobedience rings (civil or otherwise). One of your friends will share with you a folder that has copyrighted material in it, once they are sure you have accessed it they will re-iterate that some (or all) of the material there is copyrighted. At this point the most common thing that happens is that thinking they are 'safe', someone will say something stupid like 'don't worry, its our secret' or something like that.
And almost simultaneously the door will explode open as the SWAT guys come in and put them in cuffs and read you your rights. All because someone you thought you knew, was unwilling to spend time in jail rather than help the FBI with their investigation.
Law enforcement has a number of tools (many dubious like the CFAA) which they can employ against you, and they will.
The best you can hope to achieve is to keep a solid (and I mean solid, no slip ups anywhere) public front of respecting the copyright holders rights and your willingness to protect them. Otherwise you will be served papers to decrypt other buckets and you will be sent to jail for contempt if you do not facilitate rooting out copyright infringement on your service. Not even keeping your servers and company in a foreign country will help unless it is a country which doesn't care about its relationship with the US.
To be fair, Anonymous' trouble with the law has nothing to do with copyright, and people are not generally assaulted by SWAT teams for having folders containing copyright material shared with them. Even in the Megaupload case, the indictment included a long history of incriminating emails, not a single setup by an informant or slip-up.
But yes, if you want to run a file sharing site whose main purpose is uploading copyrighted material, you had better avoid leaving a paper trail containing anything damaging.
I have to ask: why not just email someone a copyrighted file? Once the file is downloaded to their email client, they are in the same position as they would be in if you shared it via Turtl.
It seems at some point the app you're using becomes irrelevant and what you actually do with it becomes much more relevant (such as a bittorrent client).
Yeah I gotta say, this blog post is a really terrible idea. A "reasonable person", if this came up in a court of law, would probably conclude that despite your disclaimers to the contrary, you know or should've known that this blog post serves as a recommendation or even incitement to share copyrighted materials over your service.
As in all hack attempts, while the security may be rock solid, it is still susceptible to the "guy gets locked in a room with Bubba who loves breaking kneecaps with his bat"
You should probably avoid saying "We are a winknudge plausibly deniable file locker!" until you have asked your lawyer "What does contributory infringement mean? Are US judges typically very lenient with parties who attempt to evade the law with wink-and-nod mechanisms that can be seen through by the average tadpole?"
For now. Host a "mystery file" that gets 100,000 downloads with all referrers coming from a site that posts download links to copyright infringing movies and things may change quite suddenly.
Even if they do not 'know' what you are storing, posting that will pretty much label your company as a 'kiddie cesspool' by anybody who values their data.
I'm not in need of their service, but they will never have me as a serious client after a blog post like this.
Been using turtl (free) for a little while now and love it so far. It's made huge leaps and bounds over the past several months and I'm excited to see where it continues to grow.
I'm glad you've been having a good experience! It's been fun building it and I'm excited to to keep growing it and making a viable platform for the more privacy-conscious.
I honestly think this is one of the best times to advertise something like this.
There have been posts here before about alternative services getting a 51% customer increase on days where a breach in security or general trust is broadcasted to the world.
On the phone is there a way to get to your main site from the blog? Was curious on your service but no easy way to jump to the main site, but maybe I missed it?
I don't know anything about how Dropbox or Turtl handle data and when they do their encryption but it would still be possible for Turtl to do hash level checking even with client side encryption. They could just hash the file and encrypt it all client side and then send both back to the server. It seems that this article is insinuating that Dropbox has full access to your data (which I dont know is true or not).
> this article is insinuating that Dropbox has full access to your data
They do. They send data over HTTPS from the Dropbox client, and they store it "encrypted" on S3, but they hold the encryption keys and also have full access to the unencrypted data while it's in memory on the servers.
Turtl encrypts all data with the user's personal key before it leaves the client, meaning the server has no access to the unencrypted data.
As far as hashing in the client, that's true, we actually could do that, and it might be a viable option if we ever implement public file sharing. Right now, all sharing is person-to-person (and private).
I mean, is not being able to take action on illegal file sharing when the feds come knocking really something to be proud of? It's a liability from a company perspective, not a strength IMO.
I'm proud that I'm building something that combats the unconstitutional spying of American citizens, and also helps others around the world avoid surveillance.
This app is largely a response to the overreach of the US government. While I believe in fighting for our constitutional rights politically, private solutions are also a viable means of protest.
We probably will have liability issues down the road. Nobody said this would be easy. However, being completely transparent and publishing all our code open-source will help mitigate a lot of these issues. On top of this, by making the clients able to secure their own data, the company itself can respond to any government information requests without actually revealing any customer data.
All Internet services, especially US-based internet services, are going to have to start working this way because trust has been thrown on the pyre by the NSA.
> I mean, is not being able to take action on illegal file sharing when the feds come knocking really something to be proud of? It's a liability from a company perspective, not a strength IMO.
In the Post-Snowden world, I think it is.
This being said, shouting "yes we can do this if you share copyrighted works!" means begging to be sued by the content provider on a contributory infringement basis. Hence it is far better to point to non-infringing uses, and general privacy features.
I'm actually very interested in the service (been hearing a lot about it lately). Does it require one of your computers to be on at all times? Or is there some sort of storage conduit that doesn't decrypt your data, but only acts to make it available to your other devices (mobile, desktop, etc)?
I'm not too convinced about the plausible deniability here, could someone that has reviewed their tech comment on the following:
- Encryption works by blocks and do not generally hide the size of the plaintext.
- Once I get the encrypted material, I thus approximatively know the size of the original file within a few bytes (uncertainty is due to padding to block size).
- I collect a few candidates files with size in the right range (There might be only one but it's still deniable).
Knowing your login information and the algorithm used to "derive the key from the login information", can't I encrypt the candidate and test against the encrypted material ?
I'm not sure how much more clear I can be. Turtl doesn't know your login information, and doesn't know any of the keys derived from your login information. That's the point of the login...it's a familiar way people use to authenticate themselves with a service, but with the added benefit that it's actually generating a master key for them.
Also, not sure how many files there are floating around the internet (and off of it) but it's quite a bit, so comparing file sizes isn't going to give any real information (at least in regards to copyright protection).
No. Since asymmetric encryption is slow the standard strategy is to generate a random symmetric key to encrypt your file. Then you just encrypt the symmetric key with your asymmetric key. This has the added benefit of each new encryption attempt leading to a unique result.
My immediate concern is whether this could be construed as advertising the service of copyright violation. If so, there may be the same concerns that ultimately lead to the downfall of grokster.
If I were to launch a service like this, I would describe this issue in terms of general privacy, and the fact that the nobody else has any idea of what is going on. With Snowden, the obvious point is that it is private from the NSA.....
[+] [-] brownbat|12 years ago|reply
"We hold that one who distributes a device with the object of promoting its use to infringe copyright, as shown by clear expression or other affirmative steps taken to foster infringement, is liable for the resulting acts of infringement by third parties."
- Justice Souter, writing on behalf of the Supreme Court of the United States in MGM Studios, Inc. v. Grokster, Ltd.
[+] [-] orthecreedence|12 years ago|reply
[+] [-] ChuckMcM|12 years ago|reply
It seems that one of the challenges of these services is that in order to avoid the copyright goons everyone you know, even those folks you only know by some IRC handle, have to be willing to go to jail for you. Because otherwise one of them will get turned, they will then be pressured to get you to indict yourself. This is how it worked against Anonymous, and how it works on most disobedience rings (civil or otherwise). One of your friends will share with you a folder that has copyrighted material in it, once they are sure you have accessed it they will re-iterate that some (or all) of the material there is copyrighted. At this point the most common thing that happens is that thinking they are 'safe', someone will say something stupid like 'don't worry, its our secret' or something like that.
And almost simultaneously the door will explode open as the SWAT guys come in and put them in cuffs and read you your rights. All because someone you thought you knew, was unwilling to spend time in jail rather than help the FBI with their investigation.
Law enforcement has a number of tools (many dubious like the CFAA) which they can employ against you, and they will.
The best you can hope to achieve is to keep a solid (and I mean solid, no slip ups anywhere) public front of respecting the copyright holders rights and your willingness to protect them. Otherwise you will be served papers to decrypt other buckets and you will be sent to jail for contempt if you do not facilitate rooting out copyright infringement on your service. Not even keeping your servers and company in a foreign country will help unless it is a country which doesn't care about its relationship with the US.
[+] [-] comex|12 years ago|reply
But yes, if you want to run a file sharing site whose main purpose is uploading copyrighted material, you had better avoid leaving a paper trail containing anything damaging.
[+] [-] orthecreedence|12 years ago|reply
As a Turtl user, you'd have to be careful about who you share with (or accept shares from). We even outline this on our security page (https://turtl.it/docs/security#when-is-turtl-not-secure).
It seems at some point the app you're using becomes irrelevant and what you actually do with it becomes much more relevant (such as a bittorrent client).
[+] [-] jsun|12 years ago|reply
[+] [-] Justsignedup|12 years ago|reply
[+] [-] patio11|12 years ago|reply
[+] [-] forrestthewoods|12 years ago|reply
[+] [-] korzun|12 years ago|reply
I'm not in need of their service, but they will never have me as a serious client after a blog post like this.
[+] [-] selectout|12 years ago|reply
[+] [-] orthecreedence|12 years ago|reply
[+] [-] eudox|12 years ago|reply
[+] [-] cordite|12 years ago|reply
There have been posts here before about alternative services getting a 51% customer increase on days where a breach in security or general trust is broadcasted to the world.
[+] [-] matttah|12 years ago|reply
[+] [-] orthecreedence|12 years ago|reply
[+] [-] typicalbender|12 years ago|reply
[+] [-] orthecreedence|12 years ago|reply
They do. They send data over HTTPS from the Dropbox client, and they store it "encrypted" on S3, but they hold the encryption keys and also have full access to the unencrypted data while it's in memory on the servers.
Turtl encrypts all data with the user's personal key before it leaves the client, meaning the server has no access to the unencrypted data.
As far as hashing in the client, that's true, we actually could do that, and it might be a viable option if we ever implement public file sharing. Right now, all sharing is person-to-person (and private).
[+] [-] umanwizard|12 years ago|reply
[+] [-] quasque|12 years ago|reply
[+] [-] carlosdp|12 years ago|reply
[+] [-] orthecreedence|12 years ago|reply
This app is largely a response to the overreach of the US government. While I believe in fighting for our constitutional rights politically, private solutions are also a viable means of protest.
We probably will have liability issues down the road. Nobody said this would be easy. However, being completely transparent and publishing all our code open-source will help mitigate a lot of these issues. On top of this, by making the clients able to secure their own data, the company itself can respond to any government information requests without actually revealing any customer data.
[+] [-] Zigurd|12 years ago|reply
[+] [-] einhverfr|12 years ago|reply
In the Post-Snowden world, I think it is.
This being said, shouting "yes we can do this if you share copyrighted works!" means begging to be sued by the content provider on a contributory infringement basis. Hence it is far better to point to non-infringing uses, and general privacy features.
[+] [-] jzelinskie|12 years ago|reply
[+] [-] orthecreedence|12 years ago|reply
[+] [-] mixologic|12 years ago|reply
[+] [-] orthecreedence|12 years ago|reply
[+] [-] ztratar|12 years ago|reply
[+] [-] jobigoud|12 years ago|reply
- Encryption works by blocks and do not generally hide the size of the plaintext.
- Once I get the encrypted material, I thus approximatively know the size of the original file within a few bytes (uncertainty is due to padding to block size).
- I collect a few candidates files with size in the right range (There might be only one but it's still deniable).
Knowing your login information and the algorithm used to "derive the key from the login information", can't I encrypt the candidate and test against the encrypted material ?
[+] [-] orthecreedence|12 years ago|reply
I'm not sure how much more clear I can be. Turtl doesn't know your login information, and doesn't know any of the keys derived from your login information. That's the point of the login...it's a familiar way people use to authenticate themselves with a service, but with the added benefit that it's actually generating a master key for them.
Also, not sure how many files there are floating around the internet (and off of it) but it's quite a bit, so comparing file sizes isn't going to give any real information (at least in regards to copyright protection).
[+] [-] anywhichway|12 years ago|reply
[+] [-] plicense|12 years ago|reply
[+] [-] einhverfr|12 years ago|reply
If I were to launch a service like this, I would describe this issue in terms of general privacy, and the fact that the nobody else has any idea of what is going on. With Snowden, the obvious point is that it is private from the NSA.....
[+] [-] yanowitz|12 years ago|reply
[+] [-] foobarqux|12 years ago|reply
[+] [-] Raticide|12 years ago|reply
[+] [-] trollingineer|12 years ago|reply
[deleted]