How Turtl has no idea when you're sharing copyrighted stuff

http://turtlapp.tumblr.com/post/81222024691/how-turtl-has-no-idea-when-youre-sharing-copyrighted

by orthecreedence • 12 years ago

158 76 12 years ago

turtlapp.tumblr.com

eudox• 12 years ago

And it's written in Common Lisp! What's not to like?

ztratar• 12 years ago

Quality PR move here and all around great article on security.

yanowitz• 12 years ago

Does anyone here have experience with turtl? Pros/cons? Confidence in security model?

foobarqux2• 12 years ago

The security model is broken. You can't securely do encryption in server side javascript.

orthecreedence14• 12 years ago

Incorrect, my friend! There's no server-side javascript. Turtl is a downloaded, self-contained app, and all encryption happens in that app.

SomeoneWeird• 12 years ago

May I ask why you think that is?

brownbat• 12 years ago

Please, for the love of counsel, do not use moments like these to advertise your service's viability for the distribution of copyrighted materials.

"We hold that one who distributes a device with the object of promoting its use to infringe copyright, as shown by clear expression or other affirmative steps taken to foster infringement, is liable for the resulting acts of infringement by third parties."

- Justice Souter, writing on behalf of the Supreme Court of the United States in MGM Studios, Inc. v. Grokster, Ltd.

orthecreedence14• 12 years ago

Great point. It's worth noting that Turtl is a storage tool, not a means of distribution. The article is not promoting infringement, but instead gives an overview of how it's just not an issue with Turtl, because Turtl has no knowledge of the data being stored.

catshirt• 12 years ago

law evaluates intent. i'm not a lawyer, but i'm not an idiot either and it's pretty easy to read between the lines here.

if the intent is to illustrate security and encryption, there is no reason to invoke "copyrighted material" at all.

rmc• 12 years ago

It allows person A to get a file from person B.

forrestthewoods• 12 years ago

For now. Host a "mystery file" that gets 100,000 downloads with all referrers coming from a site that posts download links to copyright infringing movies and things may change quite suddenly.

selectout• 12 years ago

Been using turtl (free) for a little while now and love it so far. It's made huge leaps and bounds over the past several months and I'm excited to see where it continues to grow.

orthecreedence14• 12 years ago

I'm glad you've been having a good experience! It's been fun building it and I'm excited to to keep growing it and making a viable platform for the more privacy-conscious.

jzelinskie• 12 years ago

The pricing is not clear if files up to size 200MB are free, or you only get 200MB of total space for free.

orthecreedence14• 12 years ago

Thanks, I'll make that more clear.

limsup• 12 years ago

Am I the only one who was totally onboard until I saw it was written in lisp? Can't trust non-pragmatic people.

Zigurd2• 12 years ago

You mean like ITA, which Google bought for $700M?

m0g• 12 years ago

You mean like the people who wrote HN, the site you are reading, right?

korzun• 12 years ago

Even if they do not 'know' what you are storing, posting that will pretty much label your company as a 'kiddie cesspool' by anybody who values their data.

I'm not in need of their service, but they will never have me as a serious client after a blog post like this.

matttah• 12 years ago

On the phone is there a way to get to your main site from the blog? Was curious on your service but no easy way to jump to the main site, but maybe I missed it?

orthecreedence14• 12 years ago

There should be a link on the top left (a logo of a turtle shell). If you click that it will take you to the main site.

snowwrestler• 12 years ago

The shell is centered on my iPhone; tapping it takes me to the blog homepage. There doesn't seem to be any way for me to get to the actual service without Googling the name myself.

cordite• 12 years ago

I honestly think this is one of the best times to advertise something like this.

There have been posts here before about alternative services getting a 51% customer increase on days where a breach in security or general trust is broadcasted to the world.

carlosdp• 12 years ago

I mean, is not being able to take action on illegal file sharing when the feds come knocking really something to be proud of? It's a liability from a company perspective, not a strength IMO.

orthecreedence14• 12 years ago

I'm proud that I'm building something that combats the unconstitutional spying of American citizens, and also helps others around the world avoid surveillance.

This app is largely a response to the overreach of the US government. While I believe in fighting for our constitutional rights politically, private solutions are also a viable means of protest.

We probably will have liability issues down the road. Nobody said this would be easy. However, being completely transparent and publishing all our code open-source will help mitigate a lot of these issues. On top of this, by making the clients able to secure their own data, the company itself can respond to any government information requests without actually revealing any customer data.

jacquesm3• 12 years ago

I'm not sure if I follow you, this seems a lot like attacking Iraq to me.

Zigurd2• 12 years ago

All Internet services, especially US-based internet services, are going to have to start working this way because trust has been thrown on the pyre by the NSA.

einhverfr3• 12 years ago

I mean, is not being able to take action on illegal file sharing when the feds come knocking really something to be proud of? It's a liability from a company perspective, not a strength IMO.

In the Post-Snowden world, I think it is.

This being said, shouting "yes we can do this if you share copyrighted works!" means begging to be sued by the content provider on a contributory infringement basis. Hence it is far better to point to non-infringing uses, and general privacy features.

typicalbender3• 12 years ago

I don't know anything about how Dropbox or Turtl handle data and when they do their encryption but it would still be possible for Turtl to do hash level checking even with client side encryption. They could just hash the file and encrypt it all client side and then send both back to the server. It seems that this article is insinuating that Dropbox has full access to your data (which I dont know is true or not).

quasque• 12 years ago

Dropbox does have full access to its users data, and uses this property to enable its deduplication and public sharing features.

orthecreedence14• 12 years ago

this article is insinuating that Dropbox has full access to your data

They do. They send data over HTTPS from the Dropbox client, and they store it "encrypted" on S3, but they hold the encryption keys and also have full access to the unencrypted data while it's in memory on the servers.

Turtl encrypts all data with the user's personal key before it leaves the client, meaning the server has no access to the unencrypted data.

As far as hashing in the client, that's true, we actually could do that, and it might be a viable option if we ever implement public file sharing. Right now, all sharing is person-to-person (and private).

typicalbender3• 12 years ago

Cool thanks for the info. I don't actually use Dropbox's service but its awesome to see a solution that cares about the security of its users data.

umanwizard• 12 years ago

How will they know the hash coming back from the client hasn't been manipulated?

typicalbender3• 12 years ago

The request can be signed and then checked for authentication on the back end. Using public key encryption it would be sent safely to the server and checked for authenticity.

lmm• 12 years ago

Could they use a homomorphic encryption scheme where it's still possible to verify a hash without getting access to the encrypted data?

ChuckMcM3• 12 years ago

While I like the efforts you've gone to in order to hide what is inside the service, I hope that you also appreciate the level of force arrayed against you.

It seems that one of the challenges of these services is that in order to avoid the copyright goons everyone you know, even those folks you only know by some IRC handle, have to be willing to go to jail for you. Because otherwise one of them will get turned, they will then be pressured to get you to indict yourself. This is how it worked against Anonymous, and how it works on most disobedience rings (civil or otherwise). One of your friends will share with you a folder that has copyrighted material in it, once they are sure you have accessed it they will re-iterate that some (or all) of the material there is copyrighted. At this point the most common thing that happens is that thinking they are 'safe', someone will say something stupid like 'don't worry, its our secret' or something like that.

And almost simultaneously the door will explode open as the SWAT guys come in and put them in cuffs and read you your rights. All because someone you thought you knew, was unwilling to spend time in jail rather than help the FBI with their investigation.

Law enforcement has a number of tools (many dubious like the CFAA) which they can employ against you, and they will.

The best you can hope to achieve is to keep a solid (and I mean solid, no slip ups anywhere) public front of respecting the copyright holders rights and your willingness to protect them. Otherwise you will be served papers to decrypt other buckets and you will be sent to jail for contempt if you do not facilitate rooting out copyright infringement on your service. Not even keeping your servers and company in a foreign country will help unless it is a country which doesn't care about its relationship with the US.

orthecreedence14• 12 years ago

I have to ask: why not just email someone a copyrighted file? Once the file is downloaded to their email client, they are in the same position as they would be in if you shared it via Turtl.

As a Turtl user, you'd have to be careful about who you share with (or accept shares from). We even outline this on our security page (https://turtl.it/docs/security#when-is-turtl-not-secure).

It seems at some point the app you're using becomes irrelevant and what you actually do with it becomes much more relevant (such as a bittorrent client).

ChuckMcM3• 12 years ago

   > why not just email someone a copyrighted file? Once the 
   > file is downloaded to their email client, they are in 
   > the same position as they would be in if you shared it 
   > via Turtl.

Not exactly, there have been a couple of ultimately unsuccessful cases which are similar (but not exact) with people getting mailed kiddie porn and the federal agents tried to arrest them when the mailman handed over the letter/package.

The successful prosecutions I've read about involved three things, 1) an opportunity, 2) an awareness of the legality, and 3) the follow through even when there is no reasonable doubt.

Bittorrent is a good example here, and cassette tapes are as well. All of the outward facing material from these folks are focused on legitimate uses of the service, it doesn't keep people like cassette makers from being sued, but it gives them a pretty credible defense. In the linked article you mentioned using Turtl specifically to avoid copyright enforcement, a judge or jury reading that could be persuaded that you intended to facilitate copyright infringement and that intent would make you liable for any copyright infringement that occurred by anyone using the Turtl service. The point I was trying to make is that you are doing the prosecution's job for them when you write

"So how does Turtl deal with copyrighted material?

We don’t. We don’t know what you’re storing. Neither do copyright holders. Neither does the government.

That’s how we like it =]"

It will not be difficult for a prosecutor to use your words to a Jury and show that you like that people can violate copyright with your service and that you made the service so that they could.

And once the prosecution has made the jury understand that, you will be convicted of abetting copyright infringement and either broke for the rest of your life paying off an infringement judgement from hell, or serving time in prison.

All for stuff other people did using your service, because you made it so they could. See how that works?

comex• 12 years ago

To be fair, Anonymous' trouble with the law has nothing to do with copyright, and people are not generally assaulted by SWAT teams for having folders containing copyright material shared with them. Even in the Megaupload case, the indictment included a long history of incriminating emails, not a single setup by an informant or slip-up.

But yes, if you want to run a file sharing site whose main purpose is uploading copyrighted material, you had better avoid leaving a paper trail containing anything damaging.

Justsignedup• 12 years ago

As in all hack attempts, while the security may be rock solid, it is still susceptible to the "guy gets locked in a room with Bubba who loves breaking kneecaps with his bat"

jsun• 12 years ago

Yeah I gotta say, this blog post is a really terrible idea. A "reasonable person", if this came up in a court of law, would probably conclude that despite your disclaimers to the contrary, you know or should've known that this blog post serves as a recommendation or even incitement to share copyrighted materials over your service.

einhverfr3• 12 years ago

My immediate concern is whether this could be construed as advertising the service of copyright violation. If so, there may be the same concerns that ultimately lead to the downfall of grokster.

If I were to launch a service like this, I would describe this issue in terms of general privacy, and the fact that the nobody else has any idea of what is going on. With Snowden, the obvious point is that it is private from the NSA.....

mixologic• 12 years ago

I find bittorrent sync to be a vastly superior way to share files with people. (http://www.bittorrent.com/sync).

orthecreedence14• 12 years ago

I'm actually very interested in the service (been hearing a lot about it lately). Does it require one of your computers to be on at all times? Or is there some sort of storage conduit that doesn't decrypt your data, but only acts to make it available to your other devices (mobile, desktop, etc)?

plicense• 12 years ago

What an example of "Make hay while the sun shines".

Raticide• 12 years ago

So it works the same as Mega?

patio11• 12 years ago

You should probably avoid saying "We are a wink nudge plausibly deniable file locker!" until you have asked your lawyer "What does contributory infringement mean? Are US judges typically very lenient with parties who attempt to evade the law with wink-and-nod mechanisms that can be seen through by the average tadpole?"

jobigoud• 12 years ago

I'm not too convinced about the plausible deniability here, could someone that has reviewed their tech comment on the following:

- Encryption works by blocks and do not generally hide the size of the plaintext.

- Once I get the encrypted material, I thus approximatively know the size of the original file within a few bytes (uncertainty is due to padding to block size).

- I collect a few candidates files with size in the right range (There might be only one but it's still deniable).

Knowing your login information and the algorithm used to "derive the key from the login information", can't I encrypt the candidate and test against the encrypted material ?

anywhichway• 12 years ago

No. Since asymmetric encryption is slow the standard strategy is to generate a random symmetric key to encrypt your file. Then you just encrypt the symmetric key with your asymmetric key. This has the added benefit of each new encryption attempt leading to a unique result.

orthecreedence14• 12 years ago

Knowing your login information

I'm not sure how much more clear I can be. Turtl doesn't know your login information, and doesn't know any of the keys derived from your login information. That's the point of the login...it's a familiar way people use to authenticate themselves with a service, but with the added benefit that it's actually generating a master key for them.

Also, not sure how many files there are floating around the internet (and off of it) but it's quite a bit, so comparing file sizes isn't going to give any real information (at least in regards to copyright protection).

How Turtl has no idea when you're sharing copyrighted stuff

Related Stories