Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Privacy Security

Secure Voice Communications While Travelling? 85

Posted by Cliff from the thwarting-eavesdroppers-everywhere dept.
captnitro asks: "My father works for the US Dept of Commerce in the Eastern Bloc. His hotel room phones are routinely bugged -- a few (former) coworkers have had their stays 'shortened' and politely asked to leave the country, when they said dumb things over the phone. A few days ago he asked me what I use for secure voice when I don't have broadband. Remembering PGPfone from a while back, I looked up the link, but apparently they're no longer supporting/distributing it. While I wouldn't recommend he say much of anything in a bugged room, it got me thinking -- what do *you* use for simple, no-nonsense (requiring modem + sound card), low-bandwidth secure voice app? Unix works, and scriptability gets geek points, but I'll take what I can get."
This discussion has been archived. No new comments can be posted.

Secure Voice Communications While Travelling? More

Secure Voice Communications While Travelling?

Comments Filter:

  • solution (Score:3, Funny)

    by the_other_one ( 178565 ) * on Friday September 19, 2003 @10:13PM (#7009798) Homepage
    Call on the shoe phone
    Within a cone of silence
    Talk very loudly

  • NCT (Score:5, Funny)

    by Henry V .009 ( 518000 ) on Friday September 19, 2003 @10:19PM (#7009820) Journal
    Me? I bring my Navajo Code Talker with me wherever I go. I do have certain problems with system interoperability, but that is understandable, I'm told.

  • Man I'm naieve (Score:4, Funny)

    by Anonvmous Coward ( 589068 ) on Friday September 19, 2003 @10:20PM (#7009825)
    " His hotel room phones are routinely bugged -- a few (former) coworkers have had their stays 'shortened' and politely asked to leave the country, when they said dumb things over the phone."

    Can somebody explain to me the dynamics involved here? I've been sent to my room before for telling everybody at the dinner table that my mom had to buy larger underwear after gaining some weight, but I've never been told to leave the country...
    • Well, you didn't actually mention that the reason she was gaining weight was in fact that she was pregnant, and that it wasn't dad's, it was uncle Harry did you? If you had, you'd probably would have been better off in a different country :-)

  • If the phones are bugged (Score:1, Informative)

    by Anonymous Coward
    Wouldn't there be a chance the walls are as well?

    Maybe speaking in a special way interchanging important words and phrases for nonsensical words and phrases or using voice inflections or a predetermined voice signals could help bypass that. We could call this a "code"...

  • asterisk or gnuphone (Score:3, Interesting)

    by tzanger ( 1575 ) on Friday September 19, 2003 @10:29PM (#7009861) Homepage

    You could use gnuphone with a SSH or other VPN tunnel, or even a full blown asterisk [asterisk.org] point and use encrypted IAX transfers. Any old SIP phone would work too.

    All of these are IP solutions. Any decent pair of phone encoders (where you encrypt and decrypt the audio stream) would be a lower-tech solution that might work better.

  • Analog Hole (Score:5, Insightful)

    by zulux ( 112259 ) on Friday September 19, 2003 @10:29PM (#7009862) Homepage Journal
    Voice has a *huge* analog hole - any microphone within 100 ft can pick the converation up, and parabolic dish or laser bounched off the window can extand that range to blocks.

    So given that you want to be secure, you *really* have to rule out speach.

    So try IM.

    • laser bounched off the window can extand that range to blocks

      Apparently bouncing a laser off a window doesn't work well in practice- the vibrations are too small and any wind gives bigger deflections than the persons voice does.

    • So given that you want to be secure, you *really* have to rule out speach.

      So try IM.

      IM would be great for this situation, but when if you want a "peer to peer" solution it just doesn't hold up. Assume there are two road warriors out there that need to communicate securely. Their best option really is the phone system. You could do an old-school modem to modem link that used encryption to filter the communications but the problem with this is that it's hard to verify that the person on the other end re



      • Perhaps you could use normal unsecured teliphone for authentication:

        You: Hi Bob! How's it going?
        BOB: Fine, how's the weather there in Vienna?
        You: Fine. Say, who was it that had the lampshade on their head at the company party?
        Bob: Sally.
        You: OK bob, see out on IM.

        Then you could use cheap IM technology, like a Palm Device that has TopGun SSH over a cell connection to the internet.

  • bad idea (Score:5, Informative)

    by Asgard ( 60200 ) * <jhmartin-s-5f7bbb@toger.us> on Friday September 19, 2003 @10:30PM (#7009867) Homepage
    If you are in a foreign country and the state agencies are bugging your calls, you better be darn sure of what their crypto laws say because you might get arrested for spying if you break them.

    • hehe (Score:3, Funny)

      by SHEENmaster ( 581283 )
      Alright bob, switch it over to the strongest legal encryption over here.

      Gung'f tbbq. Yrg'f xvpx fbzr ovt-oebgure nff naq fhccbeg frangbe Trbetr'f vqrn gb oblpbgg nyy pbzzhavfg angvbaf.

      Bu fuvg! Gurl'er ng zl qbbbe! Qnzavg, jrer lbh frevbhf jura lbh fnvq guvf jnf yrtny

    • If obvious crypto voice links are simultaneously needed and illegal, you're between a rock and a hard place.

      Rehearse beforehand with a few phrases, much like what the BBC used to broadcast to undercover groups in occupied Europe during WW2.

      "Mr Green likes to eat bananas near the pharmacy."

      Translation: "They're stalling."

      "My socks were laundered yesterday."

      Translation: "I think they're willing to settle for a contract in the projected amount."

      Etc.

      You won't have the full flexibility that you'd like, b

  • Tricky, may need tempest shielding (Score:3, Insightful)

    by WolfWithoutAClause ( 162946 ) on Friday September 19, 2003 @10:36PM (#7009893) Homepage
    If he has a laptop then he may be best off just using SSL, a modem, and one of the instant messaging technologies (even something really crude like talk would work).

    It all depends on how secure he really needs to be though; in theory they can tap his laptop keyboard remotely, and/or watch his display just by analysing the emitted radio waves. The only solution to that is tempest-level shielding. I do vaguely remember somebody selling a conductive tent that you go inside and it blocks the laptop's emissions.

    Of course if he goes the voice route then he has to worry about being physically overheard- it doesn't matter how encrypted his laptop link is then! Similarly if his typing or screen is being videoed; or if somebody subverts his laptop then all bets are off.

    • Tempest and laptops (Score:3, Informative)

      by metalhed77 ( 250273 )
      I'm almost certain that tempest can't read laptop screens, which I assume the man is question uses as he is a traveler.
      • Actually, I think in some cases it can. Although the screen isn't a CTR the gfx chip is still designed as if its running one. Sniff the chip emissions and you're in business.

        Of course, I could be off my rocker about this one.
      • Man... who are you crashing our discussion board never having read Cryptomonicon?! :-)) Joe
      • Laptop screens can be watched quite easily, unless they have been Tempest shielded.
    • The only solution to that is tempest-level shielding.

      Or he could encrypt the message before he types it into the computer, perhaps using a deck of cards and solitaire [counterpane.com], though that's a bit slow, but at least he wouldn't have to have encryption software on his laptop. Obfuscating the encrypted text might be tough though.

      • Recommendation: check for hidden cameras before using solitaire, and make sure they are waterproof before hand, 'cause you're going to have to take them into the shower with you to keep them secure after alerting the previously unhampered monitoring personnel by sending garbage text or images who's lsb's decode to pure alphabetic ascii....

        i'd think if you're being hosted by a hostile nation, tempest security would be very amusing to them.

        "That's an awfully nice 50-lb laptop, sir. Did you notice you wer

    • Oh and the last gotcha I heard about was using MRI to read hard drives. You know magnetic storage...

      When I heard about it, it was "room sized". I believe they were aiming for briefcase size, and that was a few years back now.

      No idea on the range.

      Q.

  • Linphone over SSH? (Score:2, Interesting)

    by ThenAgain ( 627263 )
    This is something I've been meaning to experiment with myself for communicating with one of my clients with he's out of town.

    It seems like it should be possible to use Linphone (www.linphone.org) over an ssh tunnel. ssh compression may also help with the bandwidth constraint.

  • You should read Slashdot more often (Score:3, Funny)

    by Anonymous Coward on Friday September 19, 2003 @10:45PM (#7009941)
    Can yuo tlak liek tihs? [slashdot.org]

  • Don't talk (Score:5, Funny)

    by duffbeer703 ( 177751 ) on Friday September 19, 2003 @10:56PM (#7009986)
    Since the gov't isn't willing to provide secure communications, don't talk on the phone. Talk in person in a hotel room with loud music. Bagpipes and tapes of japanese people talking are particularly good.

  • speakfree (Score:4, Informative)

    by zcat_NZ ( 267672 ) <zcat@wired.net.nz> on Friday September 19, 2003 @11:05PM (#7010024) Homepage
    speak freely [fourmilab.ch] is a Free program for Windows and *nix. It supports strong encryption (by default) and is very light on bandwidth. It works more like a walkie-talkie than a phone though.

    Or you could just send GPG-encrypted emails..

    • Simple Announcement on the page is:
      On January 15th, 2004, Speak Freely will be discontinued and removed from this Web site. Existing users may continue to use the program as long as they wish, but no further releases will be forthcoming. For details and the reasons why Speak Freely is being discontinued, please see the full end of life announcement.

      Full annoucement at:
      http://www.fourmilab.ch/speakfree/eol/

  • Nothing (Score:5, Funny)

    by Johnny Mnemonic ( 176043 ) <mdinsmore@NoSPaM.gmail.com> on Friday September 19, 2003 @11:21PM (#7010081) Homepage Journal

    What do I use? Nothing. Either of these are true: 1) the gov't in question can crack any lame, consumer oriented encyrption I use; therefore any security I use just provides me with a false sense of security. Or, 2) the gov't in question can't crack it, and their interests are raised. In this instance, "their interests are raised" means I am dragged down to the police station and my testicles have electrodes taped to them; my screams aren't encrypted, natch.

    I would suggest that your father not talk about stupid things on the phone when visiting hostile foreign countries, and when he does so, to not depend on consumer grade security. He may as well use the decoder ring he got with a box of cereal.

  • PGPfone is still available (Score:3, Informative)

    by SiMac ( 409541 ) on Friday September 19, 2003 @11:34PM (#7010133) Homepage
    From the PGPi [pgpi.org] website, including the source.

    Might not work on newer hardware, but it's still available.

  • Eastern Bloc??? (Score:4, Funny)

    by Ross Finlayson ( 17913 ) on Saturday September 20, 2003 @12:32AM (#7010306) Homepage
    Hello? 1973 called. They want their story back :-)

  • To maintain my privacy (Score:2, Funny)

    by Anonymous Coward
    I always code my vocabulary using a one time hash known only to me. A one time hash is impossible to break but care must be taken to wear a tin foil hat during the encryption phase.

    But for the average Commerce Dept. worker, he should record his messages on an mp3 device while walking through a park. Then use steganography to hide the messages inside emails that appear to be spam generated by some common mutating virus with titles like, "Your mortgage is approved", "Prize Award Notification", and "Enlarge y

  • encryption may not be the answer (Score:3, Insightful)

    by morcheeba ( 260908 ) on Saturday September 20, 2003 @01:23AM (#7010438) Journal
    If they see you using encryption, they may through him out just for that. I'd suggest discrection.

  • Be aware of the risk (Score:4, Insightful)

    by Piquan ( 49943 ) on Saturday September 20, 2003 @02:43AM (#7010606)
    Remember that no matter what you do, there's risks. Encrypt a voice connection? A room bug will have no trouble listening to that. Even if the room itself has no transmitters, somebody can point a laser at the window and hear what's up. Besides, the encryption doesn't buy you great security: to the NSA, encrypted phone calls are pretty much a joke.

    Email may be better. It stands up to cryptanalysis better, and room bugs don't get it. But, it is vulnerable to a lot of new problems: Van Eck emissions, screen flicker, and even a good ol' pair of binoculars across the street.

    If you use these, remember that the security of the mechanism is only as good as the security of the computer. If you get 0wnz0r3d, then you're screwed.

    Now, consider the idea of "proportional response". Right now, your dad gets phone taps. What do you think will happen if he starts encrypting communication? Sure, a regular phone tap falls apart under almost any sort of encryption. But start using encryption, and they're more likely to put more resources into finding out what you're up to. That's when the things like room bugs and Van Eck attacks come into play.

    So, you have to figure out: how much of a risk does your dad represent to them? How much are they willing to spend to monitor his communications? That's the first step to deciding what appropriate encryption would be.

  • He's a government employee; I'd expect that if they wanted his communications to be secure, they would be. I'm sure they have all kinds of nifty toys that are provided to those they think need them.

  • Basically, at the start, we've got two choices. Either:
    1. Your dad is paranoid and is not being bugged. Those people said stupid things in public, too.
    2. Your dad is being bugged by his hosts, presumeably because there is information that his hosts may gain from bugging that he (or his employer/country) doesn't want to release.

    In the first case, try any of the suggestions listed in previous comments to make him feel better.

    In the second case, he simply shouldn't talk about anything that is considered sens

  • Make up a spoken language ala Tolkien in LOTR then make up sign language for it. Then a video phone over SSH. Not 100% secure but surely will take some time to understand the langague

    Rus
  • If your father is indeed a government employee, and the need for secrecy is work related, why in gods name would anything sensitive be spoken in a non-secure location? Any sensitive official communications should be conducted within the nearest embassy.

  • whoever monitors this will feal like a moron (Score:1, Interesting)

    by Anonymous Coward
    Check this out. Many computer games now have built in voice communications such as the worlds most populat first person shooter video game: counter-strike a mod for half-life. Have your dad jump into the game join a server have his contact meet him in the server and they can talk secret navaho code over the ingame voicecoms. So that way #1. there would be no real way to disect the outgoing transmission for video/sound. and #2. make the people monitoring feal like complete morons.

    Yelling plant the bomb o
    • Actually I think the client / server communications in Everquest are encrypted - the reason being of course to keep the 1337 crew from knowing where all the good lewt dropping mobs are popping ... but if he is a good typist and has a decent laptop he could spend half his day in EQ doing his secret discussions.

      Given how determined the 1337 crew is about getting their phat lewtz and how determined Sony is about not having that happen, four years in the making has made EQ a pretty secure communications (typin

  • NSK 200 - Secure GSM/DECT phone (Score:4, Insightful)

    by neonstz ( 79215 ) * on Saturday September 20, 2003 @07:57AM (#7011188) Homepage

    If you really want to get secure you should take a look at the NSK 200 [kdefence.com], a GSM/DECT-phone which is approved for NATO Secret. I don't know if it is available for everyone though.

    • Motorolla also sells crypto modules for it's cell phones. a google search for "motorolla crypto cell phone" should find what your looking for.
    • NATO Secret = Not very high level

      From the bottom:
      Confidential - Not a very big deal - getting cleared for confidential stuff is fairly easy. A lot of times, it's used for things like - a plant works on secret/TS stuff in parts of the plant. Your the employee of a subcontractor who is working on something non classified. If you visit, and you don't have a clearence, you will have to be escorted EVERYWHERE - including the rest room, even if you stay in the "Open" part of the plant (aka, not secret stuff i
      • Yeh. A professor I know at mit has a top secret clearance with sci access.

        To quote a us-military site:
        TOP SECRET: Applied to information or material the unauthorized disclosure of which reasonably could be expected to cause exceptionally grave damage to the national security.

        In addition to the above, some classified information is so sensitive that even the extra protection measures applied to Top Secret information are not sufficient. This information is known as "Sensitive Compartmented Information" (

      • NATO Secret != Secret (or at least I think so).

        Nato levels are: NATO Restricted, NATO Confidential, NATO Secret and Cosmic Top Secret.

        To know stuff like missile and radar performance data etc you usually need NATO Secret.

  • Or some such?

    Tunneled through ssh?

    Sharp Zaurus [zaurus.com]
    tkcPhone [thekompany.com]
    IPSECon Sharp Zaurus [liebchen-online.de]

    I would imagine that you could get a SIP phone to compile for the Zaurus or some one that uses another VOIP protocl. As someone above suggested, connect it through an Asterisk [asterisk.org] server. I've got a test one setup myself on an old PIII 500 w/ 256 MB RAM, a nic and a sound card working with software based SIP phones. Then, if you are near someplace with Ethernet, wireless access or have a phoneline handy, you can connect out.

    Goo

  • IAD (Score:1, Insightful)

    by Anonymous Coward
    He should get in touch with the US government's IAD (Information Assurance Directorate). They'll advise him and can provide something properly certified as secure.

    If you just use some random program recommended by random slashdotters you don't know how secure it really is. Even if the crypt is good there are other things to worry about (e.g. EM emissions, your laptop getting hacked).
  • Simple,

    Buy a prepaid cell phone at a store. If you talking about low level class stuff you should be fine. It is much harder to track the cellphone and then tap into it. If your attacker has the hardware to do that, you should worry about other things then.

    If you travel a lot you can look into getting a sat phone. Remeber that they work best outdoors, so that will not help much unless you have a seperate antenna unit.
  • My father works for the US Dept of Commerce in the Eastern Bloc.

    Pardon me? This is 2003. There hasn't been an "Eastern Bloc" for well over a decade. That's like saying your father works in the USSR, or in Yugoslavia.

  • Some Options (Score:2, Funny)

    by JamesP ( 688957 )
    1 - Pig Latin
    2 - Quenya Syndarin and stuff
    3 - Parseltongue
    4 - Windtalker

    Or just talk like Sean Penn in I AM SAM. Anyone listening to the conversation will die before he finishes the phrase

  • Widely available, universally ignored.
  • I can't believe I just read this entire thing and didn't see one link to Skype [skype.com]! Wasn't this just on Slashdot a few days ago? You'd have to get your friends onto the service, but it reeally is very easy, it's encrypted, and the quality is quite good for 56k.

  • An encrypted communication could look suspicious or be made to look suspicious. Have him use a series of code phrases agreed to in advance with the other party to send coded messages in the clear.

    If he really needs to have privacy, arent there embassy resources he could use?

  • Has he looked at Iridium satellite phones? The hardware is reasonably priced ($1500), per minute charge isn't bad for international usage ($1.50 or so). From the Iridium website: "...a commercially available user terminal will support secure communications by adding a removable National Security Agency (NSA) approved Type I Communications Security (COMSEC) sleeve which fits onto the commercial user terminal."

    The product is an "Iridium Secure Module". Read about it here: http://www.disa.mil/ca/buyguide/cont [disa.mil]
  • I hate to sound nieve but isn't this what the US Embassy is for? Aren't US diplomats supposed to do all their secure business via US Embassy resources?
  • Use a fax. It's really straightforward and pocket size encryptors are readily available.

  • This may not be the best answer given the criteria in the article, but when I have this need I use a $5 phone (which I bought at a drugstore on the way to the airport one time) plugged into a Cisco ATA-186 box that is in turn connected to a Linux laptop running Asterisk [asteriskpbx.org]. The laptop connects using IAX-over-SSH to a server back here in Washington that in turn connects to the office phone system. From there the calls get routed to local extensions, out to POTS, or to other Asterisk systems, as required.

    In ad

    • At least one FSU country I was in had a bandwidth to the Internet of 64KB. Yes, that is the country. Own sattelite dishes require a lot of paperwork. The US embassy has one, the World Bank has one but I don't think that any of the other diplomatic missions do.

      • At least one FSU country I was in had a bandwidth to the Internet of 64KB. Yes, that is the country. Own sattelite dishes require a lot of paperwork. The US embassy has one, the World Bank has one but I don't think that any of the other diplomatic missions do.

        When, in 1995? I'm not aware of any countries at this time with such limited bandwidth.

        Also keep in mind that the State Dept IT infrastructure is horribly backward and is no barometer of anything except for how little funding Helms let slip throu

        • The uplink sitting on top of the cabinet ministers office was 64K about four years ago. They were overdue for an upgrade to 1MB but there was an argument over who should pay. The irony is that they were bang on a fibre connecting them to China and Europe, but there were disputes about who was going to pay to access the node (it was built, but idle).

          Dips can put up what they want, but most didn't have bandwidth to do so. The only ones that impressed me were the Worldbank who had oodles of bandwidth to spar

  • First DoC people will have access to competent advice from State who run the foreign missions.

    It depends upon the country. Some are advanced, some are advanced but with little money and some are stone-age.

    If the target group is small, expect more surveillance because they have the time available. For example in one of the 'stans, you can assume that your telephone is bugged and if it is known to belong to a foreigner, then you are probably right. Foreigners tend to get better lines to make interception

  • Along the lines of speaking in Esperanto, the universally-ignored language, but easier to implement:

    speak in Technical Manual. I speak this language and find that it is TRULY universally ignored. Even my Esperanto-loving friend frequently ignores it. For example:

    Commerce 1: Please follow these directions. Please do not begin parsing my meaning until you have finished following these directions.

    1. Go to the conference, like I did.
    2. Think that Director Moneeski is a big fat idiot.
    3. Think that only bigger, fa
  • If they have GSM coverage then you might want to look at secure GSM phones. As other people have mentioned, you really need to get out of that hotel room.

    Global Teck [global-teck.com] has some stuff.

Slashdot Top Deals

The optimum committee has no members. -- Norman Augustine

Close