Just a guy in Vermont trying to connect all the dots...
Author's posts
Dec 13
Verizon Launches Voice Cypher Secure VoIP Mobile App… With A Government Backdoor
Verizon Wireless this week did something that initially seemed quite impressive – they launched “Voice Cypher”, an app available for iOS, Android and Blackberry that promises secure end-to-end encryption. It uses VoIP and is an “over-the-top” (OTT) app that works on any carrier. If you read the marketing material on their web site, it all sounds great! Indeed their “Learn More” page has all the right buzzwords and security lingo – and says quite clearly: Voice Cypher provides end-to-end encryption between callers, even if the call crosses over multiple networks.” They include the requisite network diagram that shows how it protects against all threats:
It turns out there’s just one small little detail … as reported by BloombergBusinessweek, the app comes complete with a backdoor so that Verizon could decrypt the phone calls if requested to do so by law enforcement!
As the Businessweek article states:
Cellcrypt and Verizon both say that law enforcement agencies will be able to access communications that take place over Voice Cypher, so long as they’re able to prove that there’s a legitimate law enforcement reason for doing so.
Unfortunately, in this post-Snowden era I don’t know that many of us put a great amount of trust in our governments to only access communications with a “legitimate law enforcement reason”. Or perhaps the concern is that what gets classified as “legitimate” can be widely construed to mean almost anything.
The article does point out that Verizon is bound by CALEA to provide lawful intercept to the phone networks, but points out an interesting caveat that Verizon could have used:
Phone carriers like Verizon are required by U.S. law to build networks that can be wiretapped. But the legislation known as the Communications Assistance for Law Enforcement Act requires phone carriers to decrypt communications for the government only if they have designed their technology to make it possible to do so. If Verizon and Cellcrypt had structured their encryption so that neither company had the information necessary to decrypt the calls, they would not have been breaking the law.
A Verizon Wireless representative indicated that they believe government agencies looking for ways to protect sensitive information may be customers of this service, as may be corporate customers concerned about leaking private information.
But… as we continue to hear more and more information about the massive amount of pervasive monitoring and surveillance by government agencies from many different governments around the world, you do have to wonder how safe those agencies and companies will feel with a “secure” solution that already comes with a backdoor. The problem with a known backdoor is that even if you may trust Verizon Wireless to only allow legitimate law enforcement access… how do you know that some attacker may not be able to penetrate that backdoor? The “secure end-to-end encryption” isn’t entirely secure.
Given that the service has a higher price tag of $45 per month per device, I do wonder how many businesses or agencies will actually embrace the service.
On reading about this Voice Cypher service, it certainly sounds quite interesting. We need more secure voice solutions out there – and it’s very cool that Verizon Wireless is delivering this as an OTT mobile app that will work across different carriers.
It’s just too bad that it’s not truly “secure end-to-end”. ![]()
P.S. I also recorded an audio commentary on this same topic.
Dec 13
TDYR 195 – Verizon’s ‘Secure’ Voice Cypher App… With A Government Backdoor
Dec 12
Emily Taylor’s Must-Read Post: Ofcom in denial over UK IPv6 failure
On her blog yesterday, Emily Taylor wrote an outstanding post “Ofcom in denial over UK IPv6 failure” that begins:
For the UK to reap the economic and social benefits of next generation technology, like the Internet of Things, we need plenty of internet address space. The original addresses have run out, and we must implement IPv6. Experts say the UK has been more negative about the adoption of IPv6 than almost any other nation. Various initiatives aimed at stimulating adoption have fizzled out. The big ISPs convey a lack of urgency and Ofcom, rather than pushing industry to adopt, seems more focused on thinking of work-arounds. Why is our regulator failing to show leadership?
I was going to try to summarize her post… but the more I read it, the more I just realized it is brilliantly done as it is. She weaves together many threads such as the Internet of Things, the problems with Carrier-Grade NAT, the issues with the potential selling of IPv4 addresses… any summary won’t do it justice.
And then once you’ve read that, why don’t you please visit our Start Here page to find resources related to IPv6 to help you get started!
We definitely agree with her final quote from Vint Cerf:
“The Internet needs to keep evolving and there are things that should happen beyond IPv6 but to overcome the present address space exhaustion, we need to implement IPv6 essentially everywhere”.
Let’s make it happen!
Dec 12
Congrats To Norway’s .NO On Over 5,000 DNSSEC-Signed Domains!
Congratulations to the Norid team on going live with DNSSEC for the .NO country-code top-level domain (ccTLD) this week! You may recall we wrote about .NO being signed in the root zone of DNS back on November 18 (and the cake they baked to celebrate!), but this news this week now moves them to the fully “Operational” status in our DNSSEC deployment maps.
As they note on their page about the news, the .NO registry started accepting DNSSEC records from .NO domain registrants on Tuesday, December 9th. They also indicated that they had 16 registrars (and now today I count 17).
Even better… after the first day, Norid’s Unni Solås reported on Twitter that they had passed 3,000 signed .NO domains:
It's 5 PM on .no's #DNSSEC D-day, and we're passing 3K signed domains while I type this. Steady going!
— Unni Solås (@unniquity) December 9, 2014
and on the second day they were over 5,300:
#DNSSEC deployment, day 2: .no passed 5300 signed domains this afternoon.
— Unni Solås (@unniquity) December 10, 2014
Presumably two days later they will have even more DNSSEC-signed domains!
By the way, the Norid folks have a great DNSSEC project description (in English) that walks through the different stages of their deployment. This could be very useful for any other ccTLDs looking to deploy DNSSEC.
Anyway… great work by the Norid team and others there in Norway – and we’re looking forward to hearing more about DNSSEC in Norway.
P.S. If you want to sign your domain with DNSSEC or enable DNSSEC validation on your network, please visit our Start Here page to find resources aimed at your type of organization or role.
Dec 12
Great Story About New Curling Club In Brooklyn, NY
Great post this week in the New York Times about a new curling club starting up in Brooklyn: “In the Borough of Beards, Lay Down Some Ice, and Out Come the Brooms“.
It reports that they had over 100 people turn out for their November Open House and now are setting up more leagues. Two sites to learn more:
Congratulations to the folks there on the launch of their new club!
If you’d like to help us bring curling to the Monadnock region of New Hampshire, please fill out our form and let us know! Thanks!
Dec 12
Great Story About New Curling Club In Brooklyn, NY
Great post this week in the New York Times about a new curling club starting up in Brooklyn: “In the Borough of Beards, Lay Down Some Ice, and Out Come the Brooms“.
It reports that they had over 100 people turn out for their November Open House and now are setting up more leagues. Two sites to learn more:
Congratulations to the folks there on the launch of their new club!
If you’d like to help us bring curling to the Monadnock region of New Hampshire, please fill out our form and let us know! Thanks!
Dec 11
Opinion – A New iPhone App Aiming To Make Podcasting Easy For Everyone
How can podcast creation be made even easier on the iPhone? I recently stumbled upon a new iPhone app called simply "Opinion" that is aimed at making podcasting no longer just "a medium reserved for tech geeks and media corporations" but rather a medium available to everyone.
Given that it's audio, it may be best to listen... so I recorded a "The Dan York Report" podcast today using the app and you can hear my thoughts in the recording:
UPDATE: One quick production note - I recorded this podcast on my iPhone 5s just using the internal microphone of the 5s. I did not attach a headset or any other kind of external mic. (People have asked about this.) I was sitting in a quiet room, but it was just with the raw iPhone 5s microphone. Nothing else.
If you are interested in trying it out yourself, you can download Opinion in the AppStore for the iPhone. As I note in the recording, it will install onto the iPad, but in doing so it just behaves as an iPhone app (i.e. it doesn't make use of the iPhone's screen and just looks like a huge iPhone app).
You can find more info, too, at www.opinionpodcasting.com.
A quick summary of some of my thoughts:
- The app was extremely easy to use.
- I liked how you could stop and start the recording, generating new tracks within the same session. You can then easily move tracks around if you wanted to. For instance, I realized that I had left something out that I wanted to include earlier, so I recorded another track and then moved that back into the earlier flow.
- The editing tool nicely lets you split tracks so, for instance, I could split an existing track to insert a new track.
- I also used the editing tool to remove / trim the ends of tracks. I would cut the track which would create a new track with the audio I wanted to delete - and then I would just delete the track.
- The workflow right now involves having a single "session" inside of the app. When you are done with the recording you upload it to some site or service. When you want to record again you are doing so in the same session, i.e. you need to delete some or all tracks in order to record again. This is in contrast to another app I use, Hindenburg Field Recorder, that lets you save your recording sessions inside the app. I don't think this is necessarily a bad thing, as most of the time I wind up simply deleting the older recording sessions in Hindenburg Field Recorder because they take up space. This "one session" approach has its merits.
- One thing I like about it is that I could use this workflow to make a simple "intro" and "outro" for my TDYR podcasts. It could go like this:
- Record an intro track.
- Record an outro track.
- Record a main episode track and then move it between the intro and outro.
- Upload the finished episode to SoundCloud.
- The next time... delete the main episode track.
- Record a new main episode track.
- Move it between the intro / outro tracks.
- Upload the new finished episode to SoundCloud.
- Repeat....
This could be quite cool!
- I haven't tried it yet, but the app has the ability to import music from your iPhone's Music library. You could then bring in songs or other audio. In my case, I could record my intro or outro on my regular computer, complete with music, then upload it to my iPhone via iTunes... and then have it available in Opinion.
- The app worked really well from a usage perspective with having very nice touch gesture support.
- Recording up to 10 minutes of audio is free - after that it is $5 for unlimited recording space. Definitely a reasonable price.
- I'm not a big fan of the name as it's really generic... but I can see what they are getting at.
Let me end my just pointing out that Opinion has some nice export options. SoundCloud has a dedicated export function, but you can also send it via email or, more usefully, the "More" button lets up export to DropBox, Evernote or other apps and services you have on your iPhone:
UPDATE: Sadly, the Opinion app does NOT let you upload to DropBox yet. I asked the developers on Twitter about this, and they said they are considering this for a future version. (So I would encourage you to ask them on Twitter about this, too, to let them know you want it.)
UPDATE #2 Yea! The developers have implemented DropBox support and it will apparently be out in the next version.
All in all I found it a rather impressive app!
What do you think? Will you give it a try?
If you found this post interesting or useful, please consider either:
- following me on Twitter;
- adding me to a circle on Google+;
- following me on Ello;
- following me on App.net;
- subscribing to my email newsletter; or
- subscribing to the RSS feed.
Dec 11
DANE Interim Meeting on Dec 2 Focused on Email and S/MIME
For those of you interested in tracking the evolution of the DANE protocol to add a DNSSEC-secured layer of trust to TLS certificates, the DANE Working Group within the IETF recently held an “Interim Virtual Meeting” via conference call on December 2, 2014, where the focus was all around using DANE for securing email using S/MIME. The minutes for the meeting can be found at:
The primary two drafts that were discussed were:
- Using Secure DNS to Associate Certificates with Domain Names For S/MIME,
draft-ietf-dane-smime - Enterprise Requirements for Secure Email Key Management,
draft-osterweil-dane-ent-email-reqs
I was not able to attend myself but the minutes do provide a view into what occurred during the session. There has also been further discussion on the DANE mailing list (to which anyone is welcome to subscribe).
What continues to be fascinating is how much interest there is in using DANE for better securing email communication, and this session was for those looking to use DANE for email systems using S/MIME. It will be interesting to see where this goes over the next months. At IETF 91 in November Eric Osterweil from Verisign demonstrated a version of Thunderbird that supported this usage of DANE. He said they were looking at making that available publicly and that could certainly be of interest to many.
If you want to learn more about DANE, please visit our DANE page – and if you like to get started with DNSSEC please visit our Start Here page to find resources to help you begin.
Dec 11
TDYR 194 – Trying Out Opinion, A New Podcasting App For IPhone
Dec 10
The Directory Problem – The Challenge For Wire, Talko And Every Other "Skype-Killer" OTT App
How do they gather the "directory" of people that others want to talk to?
The fundamental challenge all of these applications face is this:
People will only USE a communication application if the people they want to talk to are using the application.
And where I say "talk" it could also be "chat" or "message" or... pick your communication verb.
It's all about the "directory" of users.
There's a war out there right now... and it's a war for the future of our communications between each other. It's a war for messaging... and it's also a war for voice and video.
And it all comes back to... which communications application or service can provide the most comprehensive directory of users?
Which communications tool will be the one that people use the most? Will any of them replace the default communications of the mobile phone?
Today's Fragmented User Experience
The reality is that today we use several different tools for real-time communications ... and that creates a bit of a frustrating user experience. If I want to send a message to Joe, do I send him a message on Skype? Facebook? WhatsApp? Google+? Twitter? SMS? iMessage? BBM? Wire? email?
If I want to call him and speak via voice or video, do I use Skype? Facebook Messenger? Google+ Hangouts? Facetime? Wire? Talko? Viber? Firefox Hello? <insert WebRTC or OTT app du jour here>? Or just call him on his regular old phone line?
By trial and error we start to figure out which of the people with whom we regularly communicate are available over which channels. Certain family members may be through Facebook... others through WhatsApp or Skype. Work colleagues through Jabber or Yammer... except for some of them who primarily use Skype. These friends detest Facebook and so they are in Google+ ... and then there's that guy who thinks all of these new apps are junk and only wants to talk to you via SMS and phone.
It's a mess.
And every new app and service wants to fix it... and wants to be THE communications application/service that you use.
Skype/Microsoft Has A Directory
Over the years, I think it would be impossible to count the number of times we've seen new communications applications trumpted as "Skype-killers". "This new app/service WILL be the one to replace Skype. It's new. It's better. It supports (something). Everyone will switch and the world will be so much better!"
Except they don't switch.
Even when Skype's audio quality is no longer what it once was.
And why not?
Because Skype has a massive user directory.
When I speak at a conference I can ask the attendees "who has a Skype ID?" and usually almost every hand goes up. They may not use Skype as their primary communication tool, but they have an ID. They can be found on Skype.
Now a large part of this is because Skype has now been around for over 11 years and truly led the disruption that "consumer VoIP" has caused in the larger telecom industry. Part of it is that Skype prioritized the user experience and made it drop-dead simple to install and use. Part of it is that Skype made it easy to find other Skype users.
But the point is that Skype amassed this huge directory - and now is the default way that many of us communicate via voice or video over the Internet. Certainly many of us, myself included, would like a better mechanism at this point... but we still use Skype because that's where the people are! The directory of users is there.
Facebook Has A Directory (Two, Actually)
When it comes to a user directory, certainly one of the biggest in the world right now is Facebook. With over a billion users Facebook has an enormous ability to connect people together.
With Facebook Messenger, they are definitely aiming to replace SMS and become THE messaging application you use on your mobile phone.
And now in many regions of the world, Facebook lets you initiate voice conversations through simply clicking on a telephone icon in the Messenger interface.
They make it simple and easy... and it works because "everyone" has a Facebook account (or at least 1 billion people do).
Facebook has a massive user directory.
(Of course, every chat and voice conversation can then be mined for data for Facebook advertisers... but that's a topic for another post...)
Facebook actually as two massive user directories if you consider that they also own WhatsApp and most stats right now say that WhatsApp has over 600 million users. (Which is actually more than Facebook Messenger, which recently crossed the 500 million user mark.)
Put these two together and while there is certainly duplication between the two directories, they do represent a huge directory of users.
P.S. And Facebook actually has a third user directory in the form of Instagram (which now has 300 million users)... but we've not yet seen them do anything with real-time communications there.
Google Has A Directory
And then of course Google has its own massive directory. Everyone who has a "Google Account". Every Gmail user. Every Google+ user. Every Google docs user.
Hundreds of millions of Google users.
Google's focus today seems to be on Hangouts, which is available from the desktop and also from the iOS and Android mobile platforms. While Hangouts started out inside of Google+, Google has separated the application out. I'll note that just today they are rolling out a new version of Hangouts on Android that lets you add your phone number so that you are easier to find. They may at some point also integrate their Google Voice offering better into Hangouts.
Apple Has A Directory
It goes without saying that Apple has its own massive directory from the hundreds of millions of iPhone and Mac users, almost all of whom get integrated into Apple's iMessage and Facetime services through their Apple ID. With iMessage and Facetime, Apple's directory includes my own phone number, as well as my email addresses.
Apple also makes the user experience insanely simple. When I go to call a contact, I am offered the choice of calling them via Facetime (audio or video) or the regular phone. When I send a message, Apple automagically sends the message over iMessage if the recipient is registered in Apple's directory. As a user I have no clue about this unless I realize that "blue bubbles" are iMessage and "green bubbles" are regular SMS.
The point is that Apple can do all this and make it so simple because they have this massive user directory.
LINE And WeChat Have Directories
While we in North America don't tend to know their names, there are apps building huge user directories in Asia. WeChat, based in China, now has over 468 million monthly active users worldwide. LINE, out of Japan and used in much of Asia, has over 170 million monthly active users. There are others such as KakaoTalk in Korea that have large directories.
The Telcos Have Directories
Of course, the original user directories for mobile phone users reside with all of the mobile service providers / telephone companies. They have the customer names and phone numbers. Their challenge is one of sharing that information between each other - and also their general challenges with embracing the world of OTT communications apps that threaten their basic revenue streams.
Some telcos have tried - and continue to try. Telefonica had "Tu ME" and now has "Tu Go". Orange has Libon. T-Mobile did have "Bobsled" but that seems to have disappeared. And then of course there was (and still is, although on life support) Joyn, the traditional telcos attempt to provide rich communication services and fight back against OTT apps. As Dean Bubley wrote at the time, RCS/Joyn was in trouble from the start and now seems to have faded from consideration.
I should note that Telefonica is doing some great work in the WebRTC space and is involved with Mozilla's latest Firefox Hello effort. There are other traditional carriers who are also doing some good work with WebRTC and other OTT works ... but I've still not really seen any of them figure out how to tie their apps and services back to the large user directories they collectively have.
Everyone Wants To OWN The Directory
Notice a common thread across all of these directories?
They are all owned / controlled by corporations - some of whom are among the largest in the world.
They have NO interest in sharing their directories.
They are all about the "lock-in".
Well... I should say... they are glad to "share" in the sense that they are glad for you to use their directory as a source of identity in your application or service. "Login with Facebook" or "Login with Google" or "Login with Twitter" ...
A better way to say it would be:
They have no interest in federation / interoperability between directories.
They want to own the directory. They want to be THE source of "identity" ... but that's a topic for yet another post.
And each of the ones I've listed is a commercial entity with their own investors or shareholders and their own ideas of what they will do with your data and your communication...
(NOTE: This is not a new problem - I wrote about "walled gardens" back in 2007 with regard to email and messaging - some names have changed but the problem remains.)
One Directory To Rule Them All?
Amidst all this we've seen various attempts to provide a global directory for IP communications. ENUM was one in the open standard space, but the original vision of "public ENUM" ran into a barrage of security and privacy issues and faded from view. (ENUM is still heavily used within SIP-based networks either within telcos or within peering relationships between telcos.)
On the corporate side, he original Google Voice was an attempt to put users in control, at least as far as a telephone number. Give out one number and have it ring many devices or apps. The .TEL people tried this with their original vision for that top-level domain. iNum tried to offer this with their numbers. Many other attempts have been made...
The question with all of these is how to make the directory accessible to other entities in a secure fashion - and how to deal with privacy issues, telemarketers, spammers, attackers, etc.
Back to the "Directory Problem"
How, then, does a new startup like Wire or Talko or Firefox Hello or whoever-releases-their-WebRTC-app-today build up a significant enough directory of users so that the application is usable by large numbers of people?
How do they compete with these massive user directories being built by Facebook, Google, Apple and others?
I don't know.
(If I did I'd probably start up a company... ;-) )
What I do know is that, as I said in my initial thoughts on Wire, "my iPhone is littered with the dead carcasses of so many other apps that have launched trying to be THE communication platform we all want to use."
Some may opt to use the identity systems of one of the major vendors mentioned before - but now you are putting your user directory in the hands of some other entity and relying on them to be there. And... you are excluding people who may not use that system.
Some apps/services may make it easy for you to "find your friends" through using your "social graph"... the connections you have on Facebook, Google, etc.
Some apps use your phone number as an identifier, but they still have to build up their own directory of users.
I don't know the answer... but I see this as a fundamental challenge for any new entrant in the space. How do they gain the directory of users so that people will be able to communicate with others using this new service?
THAT is what the team at Wire needs to answer... and Talko... and every other app.
Unless, of course, they just want to be happy as a smaller, more niche player.
But most of these apps and services want to be THE communication platform you use more than any other. Their success - and funding - is tied to that goal.
A Final Thought - The Bigger Picture
Let me end with one thought... this "directory problem" is in fact tied to the larger challenge of "identity" on the Internet. Back in the pre-Internet days our "identity" for real-time communications was simple - our telephone number. We might have had several phone numbers, but they were ours and they were/are globally unique and globally routable.
With the Internet, we gradually moved to where email addresses were (and still are in many ways) our "identity" online and became the identifiers that we used for many forms of communication.
BUT... when we've moved to IP-based real-time communications, first with instant-messaging / chat and then with voice and video, we've also moved into a realm of fractured identities and identifiers with, as noted above, many different companies vying to have us use their system so that their directory is the most complete and comprehensive.
I do definitely worry about a future in which our identities and the user directories are controlled by large corporations. This, to me, seems like it could be a severe barrier to the "permissionless innovation" that has brought about the "Internet of opportunity" that we have today.
I'd like to hope that we'll arrive at some form of distributed and decentralized identities and directories that can be federated together so that people can find each other. (Which is why I'm intrigued by what the Matrix.org folks and others are doing.) I do worry, though, that the financial incentives are there for the larger corporate players to fight each other for dominance... and leave us regular users of the Internet without a choice.
Thoughts?
An audio commentary on this topic is available on SoundCloud:
UPDATE #1 - On Twitter, Aswath Rao asserted that Firefox Hello doesn't have the directory problem because it provides a way to pass a URL out to anyone so that they can simply call you at that URL. I documented this myself in a post back on December 2nd. I can see his point, but I would argue that for Firefox Hello to be truly useful to me in my regular ongoing communications, I need some form of a "directory", either as a directory in the cloud maintained by Mozilla, or as a local address book in my Firefox browser that keeps track of those URLs. To the degree that Mozilla wants to let Firefox Hello users build up their contact list, I think they still have this issue of building the directory.
UPDATE #2 - In the comments to this post, Tim Panton points out that in many cases people do not want to be contacted. I agree, and in fact I think that the prevalence of email spam is in part what has driven so much of us to separate (walled gardens) messaging apps such as Facebook, Twitter, etc. Within those walls I have MUCH stronger control over who may contact me at what point. I do agree that any communications app/service needs those kind of controls - whether that is part of the directory or part of the client application or in the service infrastructure seems to be a bit of an implementation consideration.
UPDATE #3 - The folks at FireRTC contend that they don't have to worry about the directory because they are leveraging PSTN telephone numbers. As I replied, they can certainly use the phone number as an identifier to locate other users. This is a great idea and is done by many similar apps, including Facetime, WhatsApp, Viber and more. BUT... all that does is help bootstrap the directory creation process. They still have to build their directory so that users of their app can find and contact other users.
UPDATE #4 - Aswath and I have been engaged in a Twitter discussion where he points out that WebRTC addresses can be much more decentralized like email addresses have been. He argues that they can provide much greater richness and freedom than a static directory of users.
He's right... BUT... we now come back to the "discovery" issue that directories also address. How do I find your WebRTC URL to call you at? Sure, you can email it or IM it to me ... and I can then store it in my address book or contact list. But somehow I have to get it first - and I have to know that it is the current and best address to use for you.
I often use Facebook to send a private message to someone because it's easier than finding their email address and sending them a message. Now, if I synced my contact lists across all my devices perhaps it would be easier... but I don't and so sometimes FB messaging is easiest. I can see the same kind of thing happening with WebRTC URLs.
UPDATE #5 - In response to this post, Phil Wolff wrote a long series of tweets with ideas for further research on this topic.
If you found this post interesting or useful, please consider either:
- following me on Twitter;
- adding me to a circle on Google+;
- following me on Ello;
- following me on App.net;
- subscribing to my email newsletter; or
- subscribing to the RSS feed



