[00:00.000 --> 00:05.100]  Then, without further ado, I would like to present the Open-Source Telephony Network.
[00:05.320 --> 00:07.740]  Ladies and gentlemen, Lee Azzarello and Mark Belinsky.
[00:08.080 --> 00:08.520]  Let's hear it for them.
[00:16.060 --> 00:16.880]  How's everybody doing today?
[00:17.440 --> 00:17.760]  Good!
[00:18.360 --> 00:18.840]  Great.
[00:19.440 --> 00:22.280]  We are actually the Open Secure Telephony Network.
[00:22.540 --> 00:27.260]  But Open-Source Telephony Network also works because we are, in fact, an open-source project.
[00:27.480 --> 00:29.080]  Yeah, it's also open-source, so...
[00:29.580 --> 00:31.280]  So, it's really exciting to be here today.
[00:31.940 --> 00:34.800]  Lee and I both work for the Guardian project.
[00:36.760 --> 00:41.420]  Myself, my name is Mark Belinsky, and I am a creative technologist at the Guardian project.
[00:42.120 --> 00:46.260]  My background is a family that came as refugees to this country.
[00:46.820 --> 00:57.660]  And so, my interest is really in how freedom is expressed under closed societies and how we can build the technologies to support people and their human rights abroad.
[01:00.820 --> 01:02.260]  My name is Lee Azzarello.
[01:02.560 --> 01:04.530]  I also work with the Guardian project.
[01:05.600 --> 01:08.480]  This is my, I think, seventh HOPE conference.
[01:08.780 --> 01:14.340]  And I owe a lot to HOPE, not to get too nostalgic.
[01:14.640 --> 01:18.200]  But, you know, definitely the hacker community here has influenced me a lot.
[01:18.390 --> 01:30.200]  And the work I'm doing with Guardian project on secure voice over IP is definitely came out of this kind of culture.
[01:30.420 --> 01:34.000]  It makes me feel good that it's sort of arrived and we have a...
[01:34.000 --> 01:40.900]  Yeah, so I built the infrastructure and I did all the engineering and systems for OSTN or OSTel.
[01:41.500 --> 01:49.000]  So, this is going to be a highly technical talk and there's going to be a lot of international context to kind of set up why it is that we're doing this.
[01:49.640 --> 02:05.380]  So, to give a little background about what the Guardian project is, Guardian project is a research and development company that's really trying to push the limits of what secure anonymous communication can be on the mobile phone.
[02:05.480 --> 02:13.340]  And how can we establish standards and really raise the level for all players, not just ourselves, to really build better tools.
[02:14.260 --> 02:19.440]  We're open-source by default and trying to establish security by default as well.
[02:20.160 --> 02:30.440]  And the reasoning being that together we have more collective computing power in our pockets by having all of these phones actually sitting in there.
[02:31.100 --> 02:37.300]  So, we have more power as little brother than big brother potentially has if we use them effectively.
[02:37.620 --> 02:39.360]  I mean, these are basically Linux stations.
[02:39.360 --> 02:41.620]  So, how can we leverage them?
[02:44.700 --> 02:52.380]  So, our goal is really for people around the world to have their devices help them to attain human rights.
[02:53.440 --> 03:00.140]  To make sure that Internet communication is open, that people can experience freedom, and that they can embrace it.
[03:00.540 --> 03:06.780]  And the reasoning being that mobile is really becoming the pervasive technology that's out there.
[03:06.780 --> 03:12.480]  People, even in the poorest parts of the world, have mobile phones in their pockets.
[03:12.840 --> 03:15.800]  Increasingly, they have feature phones.
[03:16.000 --> 03:22.060]  And as the price point is lowering dramatically, we're seeing this proliferation of smartphones.
[03:22.340 --> 03:26.900]  And especially on the Android platform becoming the default globally.
[03:27.100 --> 03:30.880]  Maybe you can describe what a feature phone is in case people don't know.
[03:30.880 --> 03:31.480]  Sure.
[03:31.680 --> 03:37.060]  So, a feature phone being a phone that still has access to Internet and some basic functionality.
[03:37.660 --> 03:48.520]  Generally, they're Java-based phones, but not quite up to the full app interface that we're used to with Android, iOS, Symbian to a certain extent.
[03:48.520 --> 03:48.820]  Yeah.
[03:49.600 --> 03:56.880]  And they're generally much lower costs than something like a Nexus One or Galaxy or something like that.
[04:00.240 --> 04:05.500]  And a lot of why we're in here today is because of phone phreaking.
[04:05.800 --> 04:09.700]  And yet, we're seeing that landlines are starting to get lower and lower and lower.
[04:09.700 --> 04:24.280]  So, how can we take the lessons from pheakers of old and start applying them in the 21st century when this has been shifting to where we have POTS now changing into PSTN?
[04:25.820 --> 04:26.340]  Yeah.
[04:26.600 --> 04:28.980]  And I mean, it's more of the history.
[04:30.120 --> 04:34.360]  This audience is probably more familiar than most about the history of telephony.
[04:35.920 --> 04:40.880]  And, you know, like, IP telephony has been around a lot.
[04:41.560 --> 04:49.700]  But, like, you know, the PSTN, a lot of, like, you know, trunk lines and IP for much longer than before we had them, like, in our hands.
[04:49.920 --> 04:57.560]  But, you know, now pretty much IP telephony is to the level where this is just as good as anything else.
[04:59.340 --> 05:03.280]  And, yeah, it's kind of changing up the landscape and it's changing up the carrier landscape.
[05:03.900 --> 05:09.980]  And the way that the carriers work with or, you know, have these sort of arbitrary distinctions.
[05:10.920 --> 05:13.320]  But the carriers define the space.
[05:13.320 --> 05:18.380]  And they define it in a very different way than any of the technologies that we define in the Internet age.
[05:18.680 --> 05:18.920]  Right?
[05:19.220 --> 05:20.680]  It's more than a walled garden.
[05:20.880 --> 05:22.260]  It's literally citadels.
[05:22.260 --> 05:35.500]  So, you have these monoliths of the Verizon building, the AT&T building, just these huge systems where they usher in this consciousness that you pay for data, you pay for voice.
[05:35.840 --> 05:44.140]  And there's no real relation to the Internet age where you can't really conceptualize paying for chat, for instant message.
[05:44.140 --> 05:45.120]  Yeah, you pay for SMS.
[05:46.000 --> 05:46.520]  Right?
[05:46.620 --> 05:51.400]  What if the carrier started to charge us per every IRC message that we started communicating on, right?
[05:51.540 --> 05:52.720]  That seems like an anathema.
[05:52.740 --> 05:56.080]  But that's something that is taken for granted in the telephone systems.
[05:56.340 --> 06:07.960]  So, as we're redesigning or trying to reinterpret what secure telephony can be, these are kind of some of the issues that we're thinking about.
[06:08.740 --> 06:22.080]  And, you know, so to distill all that, since we now, like most people, many people have the capabilities of doing IP telephony on their handsets, the carrier only sees data.
[06:22.600 --> 06:31.880]  And how they see that data is really what we're concerned with, with the open secure telephony network as a standard best practices.
[06:31.880 --> 06:47.460]  And to a certain extent, the hardware hacking community is iterating faster than the software hacking community in this arena, where if you look at a place like India, the different carriers don't necessarily interoperate across internal borders.
[06:47.720 --> 06:55.860]  So, say there's an AT&T in New Jersey and a Verizon in New York, to call one another would be like placing an international call, right?
[06:55.940 --> 06:56.620]  Which is absurd.
[06:56.820 --> 07:00.680]  That's way too expensive and way too complicated, and the phone call is probably going to drop anyway.
[07:00.680 --> 07:11.780]  And so you see this growing quad SIM hardware, where you can literally put four SIM cards into one phone, so that you could just place a call to your grandma who lives, you know, just over the water.
[07:11.960 --> 07:12.840]  They're super cool.
[07:13.060 --> 07:16.320]  I don't know how many people have actually seen them, but it's like the most ridiculous looking thing.
[07:16.460 --> 07:19.760]  You basically like open this thing up and there's four SIM slots.
[07:20.520 --> 07:24.300]  And your software is like, which phone service would you like to use?
[07:25.460 --> 07:29.680]  Right, but we're thinking about building a better system so that you don't actually have to do things like that.
[07:30.340 --> 07:30.820]  It's a hack.
[07:31.960 --> 07:42.240]  So while a lot of what Guardian does is open-source by default, we still try to be as interoperable as possible so that we can bring these standards to all groups.
[07:42.400 --> 07:46.860]  Of course, for security, we are open-source so that the code itself can be verified.
[07:47.520 --> 07:55.820]  But we're trying to port to the different systems so that we can give people access, whether they're on iOS, whether they're on Blackberry or otherwise.
[07:56.900 --> 08:02.440]  But I'd love to do a little survey, given that we're talking about secure mobile, to get a sense of what we have here in the audience.
[08:02.780 --> 08:06.420]  So, if you could raise your hand or your phone if you have an Android phone.
[08:08.000 --> 08:08.640]  All right.
[08:08.840 --> 08:09.060]  Nice.
[08:09.420 --> 08:10.120]  Not surprising.
[08:10.700 --> 08:11.280]  All right, iPhone?
[08:16.050 --> 08:16.490]  Blackberry?
[08:19.290 --> 08:21.030]  Now we know who works for the government.
[08:23.510 --> 08:26.550]  And to translate, we're talking about BBM for voice.
[08:27.530 --> 08:27.610]  Right?
[08:29.190 --> 08:29.630]  Nokia?
[08:31.790 --> 08:33.970]  Who of those are Nokia N900?
[08:36.250 --> 08:37.430]  That's what we thought.
[08:38.190 --> 08:38.430]  Other?
[08:41.130 --> 08:42.310]  What is that?
[08:42.410 --> 08:43.010]  What's a Windows phone?
[08:45.710 --> 08:47.250]  That's like the N900, right?
[08:48.310 --> 08:48.870]  Sorry.
[08:49.050 --> 08:49.370]  Bad joke.
[08:50.670 --> 08:59.470]  So, 2600 laid the groundwork of why we're talking about the need to have secure communication.
[08:59.690 --> 09:00.010]  Right?
[09:00.150 --> 09:05.590]  This is their sketch of Bob and Alice trying to have a phone call in the United States.
[09:05.590 --> 09:14.650]  And this infrastructure is replicated around the world where there are various names for various interceptors legally or extra legally.
[09:14.970 --> 09:21.370]  Trying to get between you and your friend Alice as you try to actually place a call.
[09:21.870 --> 09:24.770]  At the same time, it's a little bit more than that.
[09:25.110 --> 09:32.190]  With mobile phones, there's also the extension of the phone itself as well as the apps that lay within it.
[09:34.820 --> 09:37.160]  And that's an important distinction.
[09:38.060 --> 09:39.760]  Should we talk about baseband now?
[09:39.980 --> 09:40.220]  Yeah.
[09:40.240 --> 09:40.380]  Yeah.
[09:40.700 --> 09:49.260]  So, the mobile phones, the carriers have a baseband, what's called a baseband.
[09:49.480 --> 09:56.880]  And essentially, it's another telephone inside of your mobile phone that you can't control.
[09:56.880 --> 09:58.040]  The carriers can't control it.
[09:58.540 --> 10:10.780]  There have been provable cases of reverse engineering where it was discovered that there's a secondary microphone in the baseband, that you have no software application access to it.
[10:11.520 --> 10:13.440]  So, it's essentially its own computer.
[10:13.780 --> 10:17.980]  There's one phone, and I forget what the name, what the model is, where...
[10:18.760 --> 10:29.820]  Oh, I think it was an open moco, and their solution to the baseband is to treat it as a modem and send AT commands to it, and just figure out what the hell it does, and then program that into the core.
[10:30.420 --> 10:34.600]  But it really is a black box, and only the carriers know how it works.
[10:34.600 --> 10:36.660]  Why a separate microphone?
[10:38.700 --> 10:41.020]  We'll wait for questions until later.
[10:41.180 --> 10:42.860]  But yeah, why a separate microphone?
[10:42.860 --> 10:44.000]  That's a very good question.
[10:45.520 --> 10:52.760]  And yeah, so that's what a lot of the lawful intercept in the states.
[10:53.240 --> 10:55.680]  CALEA was up in the previous slide.
[10:55.820 --> 11:03.760]  And as part of lawful intercept in United States federal law, it's a...
[11:04.700 --> 11:05.100]  away.
[11:05.300 --> 11:06.420]  It is literally a back door.
[11:09.000 --> 11:13.220]  So the question is, you know, how do you have an actual private conversation?
[11:13.360 --> 11:19.980]  Because I think most people conceptualize that they're having private conversations, but they're not necessarily able to do that, which is extremely problematic.
[11:20.020 --> 11:30.880]  This is the conversation that we were having in the 90s, where encryption was a dangerous weapon, and then suddenly it was opened up, and now we have Internet banking and all of these innovations.
[11:30.880 --> 11:35.800]  Increasingly, businesses aren't even having phone calls when they're operating internationally.
[11:36.080 --> 11:42.440]  So people will send their people into the field in Russia, and their phones are off.
[11:42.620 --> 11:52.040]  Yeah, the official... an unnamed corporation had an official rule of no cell phone conversations outside of the United States.
[11:52.040 --> 11:54.560]  That was their solution to secure voice.
[11:54.920 --> 11:58.800]  So the opportunity here for us also is that the cost of business is just rising.
[11:58.800 --> 12:09.560]  I was in Iraq working with the mobile telcos there, as we were drafting the first bylaws that were going to come into effect in the country.
[12:09.780 --> 12:24.180]  And it was really a terrifying moment, as I was talking about the privacy and security standards that they need to have in those bylaws as the telcos, because that is just necessary for... and fundamental for human rights.
[12:24.180 --> 12:26.620]  And the counter-argument was the TV show 24.
[12:28.720 --> 12:35.600]  And this is an Iraqi who's lived in Iraq their whole life, and is the vice president of this company, using 24 as an argument.
[12:36.060 --> 12:46.500]  And what I had come back with is saying, you know, if you have to transcribe all of your cell phone records, all the conversations, this could be a corruption tool to put yourself out of business.
[12:46.900 --> 12:48.880]  And that's something that they heard really loud and clear.
[12:49.060 --> 12:55.420]  And then they were much more interested in having those privacy and security standards suddenly put in, so they wouldn't be burdened by government bureaucracy.
[12:56.260 --> 13:06.720]  And so I think it's a way to have a legal, a business, and a technical way of really encouraging the proliferation of these security standards in whatever way that we can.
[13:06.720 --> 13:07.140]  Yeah.
[13:07.480 --> 13:12.380]  And I'm sure there's a lot of people in the audience, myself included, who do like 24 a lot.
[13:12.540 --> 13:24.220]  But, you know, keep in mind that 24 has defined hacking the network as purchasing like a MiFi, and connecting to that, and breaking the firewall, so...
[13:25.440 --> 13:29.900]  And increasingly we're seeing countries around the world actually just blocking BlackBerry.
[13:29.900 --> 13:32.880]  You go to a country like Kazakhstan where they've done this.
[13:33.460 --> 13:37.320]  And they're effectively cutting themselves off from international business.
[13:37.820 --> 13:44.280]  As much as businesses are continuing to actually use BlackBerry or will continue to use them in the future, right?
[13:44.500 --> 14:00.420]  And so can we draw a distinction to say you either, you know, play in a secure, encrypted manner so that everybody's protected, or you just don't enter into international business dealings with X, Y, and Z company that you would otherwise be dealing with because you have to send email,
[14:00.560 --> 14:03.300]  you have to be on the messenger, you have to just communicate.
[14:04.840 --> 14:19.060]  In China we saw TomSkype, which is a Chinese version of Skype that's actually with the Skype company, that has a very explicit back door for all communications to go to the Chinese authorities.
[14:19.780 --> 14:32.600]  So even the technology standards that we currently understand as kind of this secure best practices in the 21st century with voice over IP, still has its security flaws.
[14:32.740 --> 14:36.220]  And the question is, how much does that exist in the other versions of Skype?
[14:36.820 --> 14:44.900]  And currently they've... Microsoft, after buying Skype, has issued a statement saying that they're moving from supernodes to their own servers.
[14:45.160 --> 14:47.020]  Well, no, they're making their own supernodes.
[14:47.200 --> 14:53.740]  So they haven't got rid of supernodes, but they just made better ones than your local Internet connection could ever provide.
[14:53.740 --> 15:02.600]  Yeah, they're making the biggest ones, so your communication's probably going to go through their supernodes, not through the peer-to-peer method that they used to in the past.
[15:02.760 --> 15:09.500]  And as an official statement, Microsoft kind of tried to dance around it and they said, like, we haven't changed the core peer-to-peer functionality of Skype.
[15:09.500 --> 15:15.880]  We've improved the service by adding more of our own high-quality infrastructure, blah, blah, blah, blah, blah.
[15:17.420 --> 15:26.420]  And when I was in Bangladesh, it was amazing because my cell phone reception was much better than in the U.S., especially in New York, but I had to give a thumbprint to actually get a SIM card.
[15:27.060 --> 15:32.680]  In India now, you have to give a social security number, or their equivalent of a social security number, to actually get a SIM card.
[15:34.000 --> 15:39.960]  And this is becoming increasingly terrifying because the phone represents the ultimate intimacy.
[15:40.240 --> 15:42.480]  I mean, people have this on them all the time.
[15:42.720 --> 15:46.780]  Who here does not have a phone next to them for more than an hour a day?
[15:49.500 --> 15:50.520]  I mean, I have it on...
[15:50.520 --> 15:51.800]  That's about ten hands, by the way.
[15:52.040 --> 15:52.200]  Yeah.
[15:53.420 --> 15:55.000]  I have this on me at all times.
[15:55.180 --> 16:01.900]  And I think people expect that it's on you at all times, and there's a certain level of privacy and protection when something's so intimate with you.
[16:02.620 --> 16:04.320]  And yet, not so much.
[16:07.900 --> 16:16.280]  And again, to go back to the 2600 octopus, it's beyond just the expected methods of interception.
[16:16.280 --> 16:18.080]  It's also what's actually in your pocket.
[16:18.580 --> 16:22.020]  So again, late in the day, so I really like this show of hand stuff.
[16:22.300 --> 16:23.700]  Who plays Angry Birds?
[16:23.880 --> 16:25.000]  Because I know I do.
[16:26.120 --> 16:29.320]  But on iOS, they have access to your entire contact list.
[16:30.200 --> 16:30.680]  Right?
[16:31.000 --> 16:43.100]  And if an average of five phones have access to your SMS and MMS messages, that gets to be really interesting in an era of Anthony Wiener, to give a little New York shout out.
[16:44.800 --> 16:52.420]  Which is all fun and good to laugh at until you actually look at the statistics of how many Anthony Wieners are out there.
[16:56.660 --> 16:59.200]  That bad pun was not intended, I apologize.
[17:00.120 --> 17:01.120]  Own it, own it.
[17:01.260 --> 17:02.400]  Okay, totally intended.
[17:03.100 --> 17:12.300]  So in the UK, a service, Recombu, found that 47% of adults in England send sexy texts to their significant others.
[17:12.540 --> 17:13.500]  That's about half.
[17:13.940 --> 17:18.380]  And about 10% of those have actually sent it to the wrong person.
[17:20.560 --> 17:22.880]  So like, that's funny because that's user error.
[17:23.340 --> 17:29.280]  But for everybody else, five of their apps can access all their MMSs.
[17:29.420 --> 17:32.800]  And we're not thinking about secure MMS, secure SMS.
[17:33.200 --> 17:34.280]  This is just on the phone.
[17:34.960 --> 17:39.100]  And now we can remotely install apps with Google Play, which is hugely convenient.
[17:39.100 --> 17:48.840]  But that just means install app that could potentially read all the sexy texts, et cetera, that are sitting on whoever's mobile phone that you have the email address for.
[17:49.080 --> 17:54.280]  And with Yahoo's security standards for email, that makes it pretty dangerous.
[17:54.520 --> 17:56.820]  I think the kids call them sexts, Mark.
[17:57.480 --> 17:57.980]  Sexts.
[17:58.460 --> 18:00.520]  Yes, the kids call them sexts.
[18:03.720 --> 18:05.460]  So we have a little bit of bait.
[18:05.460 --> 18:07.380]  We're gonna do a live demo.
[18:07.700 --> 18:10.460]  And we're going to ask you to try and hack us.
[18:11.020 --> 18:15.520]  So we set up a open Wi-Fi node called OSTN Open.
[18:15.960 --> 18:18.440]  No, OSTN dash demo.
[18:19.220 --> 18:19.620]  Oh.
[18:19.980 --> 18:20.700]  Oh, yeah.
[18:20.880 --> 18:21.940]  It doesn't say open.
[18:22.060 --> 18:22.540]  It says demo.
[18:22.860 --> 18:23.760]  Just read it differently.
[18:24.220 --> 18:24.880]  It's a substitution.
[18:25.160 --> 18:25.900]  It's encrypted.
[18:26.260 --> 18:28.280]  It says OSTN and then some other four-letter word.
[18:29.040 --> 18:31.900]  You can find it.
[18:31.900 --> 18:35.220]  And we're gonna do a call over this for the rest of the talk.
[18:35.640 --> 18:38.480]  And ask you to intercept it and try to break the encryption.
[18:39.780 --> 18:40.900]  So, are you calling me?
[18:40.960 --> 18:41.420]  Am I calling you?
[18:41.460 --> 18:42.180]  You can call me.
[18:42.360 --> 18:42.720]  All right.
[18:48.970 --> 18:49.730]  Yo, what's up?
[18:51.830 --> 18:52.630]  Hey, RMJG?
[18:54.090 --> 18:54.890]  Yep, RMJG.
[18:55.290 --> 18:57.290]  So we get a four-letter.
[18:57.490 --> 19:02.070]  It's called a four-digit alphanumeric short authentication string.
[19:02.750 --> 19:04.150]  And that just...
[19:04.150 --> 19:06.350]  And we could talk to each other before that in the clear.
[19:06.510 --> 19:07.870]  So it's opportunistic encryption.
[19:09.250 --> 19:13.870]  And if we both agree that we see the same thing on both sides, we've agreed to do that.
[19:13.990 --> 19:17.470]  And after that, it drops down to an SRTP stream.
[19:17.650 --> 19:20.090]  So all of the voice data is now encrypted.
[19:21.530 --> 19:23.230]  The signaling is encrypted as well.
[19:24.570 --> 19:26.890]  The signaling is encrypted with the certificate authority.
[19:28.410 --> 19:28.970]  Is it?
[19:29.410 --> 19:29.810]  I'm...
[19:29.810 --> 19:30.190]  Yeah.
[19:30.410 --> 19:30.670]  Oh, right.
[19:31.630 --> 19:32.030]  You...
[19:32.530 --> 19:33.130]  Next slide.
[19:33.350 --> 19:33.790]  Yeah, yeah, yeah.
[19:33.790 --> 19:34.190]  There you go.
[19:34.310 --> 19:34.470]  Cool.
[19:34.590 --> 19:35.750]  That's what I was gonna talk about.
[19:36.410 --> 19:37.250]  So, yeah.
[19:37.390 --> 19:38.010]  This is...
[19:38.010 --> 19:42.570]  As you can see, SIP is very complicated, as is everything else that it represents.
[19:43.750 --> 19:44.150]  But...
[19:44.150 --> 19:46.150]  So the stuff on the...
[19:46.150 --> 19:47.890]  Which stage...
[19:49.250 --> 19:51.630]  The right side is...
[19:51.630 --> 19:52.890]  The stage left...
[19:53.870 --> 19:56.050]  Is the voice stream.
[19:56.210 --> 20:02.430]  And you can see that the ZRTP is an authentication protocol that happens in the voice stream, which is pretty interesting.
[20:02.990 --> 20:05.430]  The SIP stuff is purely for signaling.
[20:05.850 --> 20:07.350]  It's for setting up the call.
[20:08.270 --> 20:10.190]  It's, you know, ringing another person's phone.
[20:10.410 --> 20:11.890]  That person answering or not.
[20:12.150 --> 20:13.410]  Hanging up a call.
[20:13.750 --> 20:15.890]  There's some other stuff that can happen.
[20:16.310 --> 20:22.190]  There's cool features that the SIP RFC describes, which no one in the universe has implemented.
[20:22.190 --> 20:23.570]  That includes other planets.
[20:24.810 --> 20:25.390]  But...
[20:25.390 --> 20:25.610]  Yeah.
[20:25.730 --> 20:28.250]  So all the signaling stuff up there in...
[20:28.250 --> 20:28.570]  In...
[20:29.170 --> 20:30.190]  In Oztel.
[20:30.270 --> 20:31.370]  And as well as what the...
[20:31.370 --> 20:35.410]  The Open Secure Telephony Network spec requires is...
[20:35.410 --> 20:37.510]  Is you have to encrypt that as well.
[20:37.610 --> 20:38.970]  Because you can learn a lot from SIP headers.
[20:39.330 --> 20:42.550]  Especially about IP addresses of the calling parties.
[20:44.690 --> 20:45.270]  So...
[20:45.270 --> 20:51.190]  We're doing that through running a certificate authority on the server itself.
[20:52.090 --> 20:53.870]  And that was a...
[20:53.870 --> 20:57.090]  Kind of a design constraint of the back end.
[20:57.250 --> 20:57.890]  Which is free switch.
[20:59.590 --> 21:01.190]  And free switch is...
[21:01.770 --> 21:03.230]  We're really not doing that much.
[21:03.350 --> 21:05.370]  I chose it because it happened to be...
[21:05.370 --> 21:07.390]  I knew asterisk and...
[21:08.350 --> 21:12.030]  And free switch was interesting and kind of new.
[21:12.290 --> 21:15.530]  And used XML instead of some weird, you know, baroque syntax.
[21:16.210 --> 21:16.690]  But...
[21:17.770 --> 21:18.530]  It does...
[21:18.530 --> 21:19.230]  It does a lot.
[21:20.610 --> 21:21.090]  And...
[21:21.090 --> 21:23.550]  Most of the work that I did was turning that allot stuff off.
[21:23.730 --> 21:25.530]  So all free switch is doing is user registration.
[21:26.710 --> 21:27.190]  So...
[21:27.190 --> 21:28.790]  Users can register and you can call them.
[21:29.710 --> 21:30.190]  And...
[21:30.190 --> 21:30.550]  And...
[21:30.550 --> 21:31.490]  Proxying the...
[21:31.490 --> 21:32.450]  The encrypted bits.
[21:32.610 --> 21:33.470]  Or just transferring noise.
[21:35.250 --> 21:35.730]  Um...
[21:35.730 --> 21:35.990]  So...
[21:35.990 --> 21:36.310]  So...
[21:36.310 --> 21:38.670]  The idea for Open Secure Telephony Network is to really create...
[21:38.670 --> 21:39.610]  Uh...
[21:39.610 --> 21:40.090]  A standard.
[21:40.750 --> 21:41.030]  And...
[21:41.030 --> 21:45.470]  Develop a system that can be interoperable on every mobile phone and desktop platform.
[21:45.710 --> 21:47.250]  And get them to play nice with each other.
[21:47.690 --> 21:47.850]  Uh...
[21:47.850 --> 21:49.370]  Because currently there are a lot of...
[21:49.370 --> 21:49.570]  Uh...
[21:49.570 --> 21:51.950]  Piecemeal solutions or people working on it.
[21:52.190 --> 21:52.410]  Um...
[21:52.410 --> 21:53.530]  And making great strides.
[21:53.690 --> 21:53.890]  But...
[21:53.890 --> 21:55.050]  How can we really...
[21:55.050 --> 21:55.150]  Uh...
[21:55.150 --> 21:55.890]  Again just...
[21:55.890 --> 21:56.730]  Raise the bar.
[21:57.110 --> 21:57.390]  Uh...
[21:57.390 --> 22:01.130]  And make it so that anybody can launch their own OSTN system.
[22:01.630 --> 22:01.970]  Um...
[22:01.970 --> 22:02.370]  In...
[22:02.370 --> 22:03.990]  A federated architecture.
[22:04.310 --> 22:05.190]  So that...
[22:05.190 --> 22:05.370]  Uh...
[22:05.370 --> 22:05.610]  Uh...
[22:05.610 --> 22:06.510]  Anybody can launch their own.
[22:06.710 --> 22:07.570]  Similar to...
[22:07.570 --> 22:08.990]  The way that email had...
[22:08.990 --> 22:09.270]  Uh...
[22:09.270 --> 22:10.190]  Worked before...
[22:10.190 --> 22:11.170]  So many of us...
[22:11.170 --> 22:11.430]  Uh...
[22:11.430 --> 22:12.410]  Had moved to the cloud.
[22:12.710 --> 22:12.950]  Right?
[22:13.050 --> 22:14.330]  You could create your own server.
[22:14.710 --> 22:14.890]  Uh...
[22:14.890 --> 22:15.570]  Install it.
[22:15.850 --> 22:16.970]  Establish a...
[22:16.970 --> 22:17.650]  Uh...
[22:17.650 --> 22:18.450]  An email address.
[22:18.770 --> 22:21.490]  And that could easily federate and communicate with...
[22:21.490 --> 22:21.650]  Uh...
[22:21.650 --> 22:22.670]  Any of the other...
[22:22.670 --> 22:22.950]  Um...
[22:22.950 --> 22:23.670]  Guys that are out there.
[22:23.790 --> 22:24.210]  And that's...
[22:24.210 --> 22:24.590]  I mean...
[22:24.590 --> 22:25.590]  And I think the point is...
[22:25.590 --> 22:25.850]  Is that...
[22:25.850 --> 22:26.210]  That...
[22:26.210 --> 22:26.570]  Like...
[22:26.570 --> 22:26.910]  The...
[22:26.910 --> 22:30.270]  The software's out there.
[22:30.630 --> 22:30.870]  Uh...
[22:35.370 --> 22:35.730]  You can choose from.
[22:35.830 --> 22:36.650]  You can do that.
[22:37.050 --> 22:37.510]  Um...
[22:37.510 --> 22:37.970]  And...
[22:37.970 --> 22:39.150]  Many people do do that.
[22:40.250 --> 22:40.710]  Um...
[22:40.710 --> 22:41.170]  And...
[22:41.170 --> 22:41.330]  Uh...
[22:41.330 --> 22:42.790]  But for VoIP, you know, the...
[22:42.790 --> 22:43.750]  The tools are also out there.
[22:43.890 --> 22:44.270]  And one of...
[22:44.270 --> 22:44.950]  One of our...
[22:44.950 --> 22:47.730]  High-level assertions is that you can do that as well.
[22:48.050 --> 22:48.430]  Um...
[22:48.430 --> 22:52.050]  And just like people run their own email servers, you could run your own, uh...
[22:52.050 --> 22:53.110]  Voice over IP service.
[22:54.430 --> 22:55.230]  And so...
[22:55.230 --> 22:57.210]  Our example of this is, uh...
[22:57.210 --> 22:57.630]  OSTel.
[22:58.010 --> 22:58.470]  So...
[22:58.470 --> 23:01.150]  If you scan the QR code, you can download the, uh...
[23:01.150 --> 23:01.870]  The Android app.
[23:02.630 --> 23:03.090]  Um...
[23:03.090 --> 23:03.430]  Warning.
[23:03.590 --> 23:05.930]  If you have CSIP Simple, it'll ask you to, uh...
[23:05.930 --> 23:06.390]  Get rid of it.
[23:06.670 --> 23:07.030]  Uh...
[23:07.030 --> 23:07.670]  So that it works.
[23:08.270 --> 23:09.810]  It's also a non-market source.
[23:09.970 --> 23:10.710]  So it's, uh...
[23:10.710 --> 23:11.310]  It's experimental.
[23:11.730 --> 23:11.990]  Um...
[23:11.990 --> 23:14.190]  It's a nightly build from a while ago.
[23:14.330 --> 23:15.890]  It was the most stable one we could find.
[23:16.350 --> 23:16.670]  Um...
[23:16.670 --> 23:17.430]  With some rebranding.
[23:17.430 --> 23:17.910]  Uh...
[23:17.910 --> 23:19.510]  So you have to have non-market sources enabled.
[23:19.730 --> 23:21.430]  And we've been working with CSIP Simple.
[23:21.690 --> 23:22.470]  And, uh...
[23:22.470 --> 23:25.430]  If you take the new one off the trunk, it actually, uh...
[23:25.970 --> 23:27.930]  Has an installation wizard connected to it.
[23:28.470 --> 23:28.930]  And, uh...
[23:28.930 --> 23:29.490]  Called OSTN.
[23:29.670 --> 23:30.090]  O-S-T-N.
[23:30.370 --> 23:30.490]  Yeah.
[23:30.630 --> 23:31.070]  Called OSTN.
[23:31.550 --> 23:31.910]  Uh...
[23:31.910 --> 23:35.150]  This version, unfortunately, has some bugs with, um...
[23:35.150 --> 23:35.630]  Cyanogen.
[23:36.110 --> 23:37.790]  So if you want to, uh...
[23:37.790 --> 23:39.570]  Pick a new one, it might have better interoperability.
[23:40.150 --> 23:42.210]  But again, we're kind of young, uh...
[23:42.210 --> 23:42.930]  As a project.
[23:43.230 --> 23:45.490]  And so, trying to push it along and, uh...
[23:45.490 --> 23:46.410]  Really get all the...
[23:46.410 --> 23:47.990]  The pieces moving and...
[23:47.990 --> 23:48.810]  And working together.
[23:49.050 --> 23:49.250]  Yeah.
[23:49.410 --> 23:51.530]  And interestingly, I mean, part of, uh...
[23:51.530 --> 23:51.830]  Um...
[23:51.830 --> 23:53.130]  Part of the...
[23:53.130 --> 23:53.510]  Um...
[23:53.510 --> 23:54.790]  The first phase was...
[23:54.790 --> 23:55.410]  Was research.
[23:55.830 --> 23:56.210]  Um...
[23:56.210 --> 23:57.170]  And, um...
[23:57.170 --> 23:57.630]  It was...
[23:57.630 --> 23:58.730]  It was a lot harder than I thought.
[23:58.810 --> 24:00.130]  Like, just doing the research to...
[24:00.130 --> 24:01.590]  To try and, like...
[24:01.590 --> 24:04.110]  Like, figure out how this stuff works.
[24:04.230 --> 24:04.450]  And...
[24:04.450 --> 24:05.770]  And I've worked professionally.
[24:06.010 --> 24:09.390]  And, I mean, I built a CLEC with another person in 2005.
[24:09.750 --> 24:10.230]  So, like, I...
[24:10.230 --> 24:12.190]  I thought that I knew how SIP works.
[24:12.910 --> 24:14.090]  And then, like...
[24:14.090 --> 24:14.850]  But, uh...
[24:14.850 --> 24:16.930]  You know, going into, uh...
[24:16.930 --> 24:17.370]  Doing...
[24:17.370 --> 24:19.170]  Doing cryptography, um...
[24:19.170 --> 24:21.310]  With all of these different protocols, uh...
[24:21.310 --> 24:22.510]  Is where the challenge started.
[24:22.890 --> 24:23.330]  Um...
[24:23.330 --> 24:24.670]  It has really low coverage.
[24:25.210 --> 24:25.650]  Um...
[24:25.650 --> 24:26.710]  Especially in a free switch.
[24:27.010 --> 24:27.210]  The...
[24:27.210 --> 24:27.550]  The...
[24:27.550 --> 24:29.190]  The SIP TLS, um...
[24:29.730 --> 24:30.090]  Uh...
[24:30.090 --> 24:31.310]  Source code has really low coverage.
[24:31.470 --> 24:31.870]  And there's...
[24:31.870 --> 24:34.770]  There's currently a memory leak in the version of free switch that I'm running.
[24:34.970 --> 24:35.970]  Because of, uh...
[24:35.970 --> 24:37.050]  TLS SIP registrations.
[24:37.630 --> 24:38.070]  Um...
[24:38.070 --> 24:38.950]  And I just restart it.
[24:39.030 --> 24:39.650]  And that's the solution.
[24:40.150 --> 24:40.590]  Um...
[24:40.590 --> 24:41.610]  But, uh...
[24:41.610 --> 24:41.630]  Um...
[24:41.630 --> 24:42.370]  You know...
[24:42.370 --> 24:43.850]  That was...
[24:44.850 --> 24:45.250]  Um...
[24:46.270 --> 24:46.670]  Just...
[24:46.670 --> 24:48.390]  Figuring out how to put all the pieces together.
[24:49.150 --> 24:49.550]  Um...
[24:49.550 --> 24:50.050]  Coherently.
[24:51.530 --> 24:51.930]  Um...
[24:51.930 --> 24:52.690]  Was a big challenge.
[24:52.970 --> 24:53.950]  So, the...
[24:53.950 --> 24:54.670]  The...
[24:54.670 --> 24:55.610]  Actual client development.
[24:56.010 --> 24:56.370]  Um...
[24:56.790 --> 24:57.490]  Is, uh...
[24:57.490 --> 24:58.370]  Sort of the next phase.
[24:58.530 --> 24:58.990]  So, it's...
[24:58.990 --> 24:59.950]  It's experimental.
[25:00.330 --> 25:01.210]  And, um...
[25:01.210 --> 25:03.990]  I look forward to doing some more client development to make it.
[25:04.070 --> 25:05.430]  So, it's like, you know...
[25:05.430 --> 25:05.690]  Uh...
[25:05.690 --> 25:08.570]  For example, features like registering for a new account in app.
[25:09.370 --> 25:09.810]  Um...
[25:09.810 --> 25:10.250]  And, uh...
[25:10.250 --> 25:10.730]  We'll get a...
[25:10.730 --> 25:12.070]  Like a client that's in the market.
[25:12.270 --> 25:15.090]  CSIP Simple has all sorts of really cool features in the trunk now.
[25:15.470 --> 25:15.910]  Um...
[25:15.910 --> 25:17.230]  That I'd like to take advantage of.
[25:17.950 --> 25:20.890]  And working out those bugs in, um...
[25:20.890 --> 25:21.110]  The...
[25:21.110 --> 25:21.810]  The...
[25:21.810 --> 25:23.930]  The SIP system, um...
[25:23.930 --> 25:24.610]  With the TLS.
[25:24.710 --> 25:25.110]  I mean...
[25:25.110 --> 25:26.570]  Is beneficial because...
[25:26.570 --> 25:27.230]  It's...
[25:27.230 --> 25:29.050]  It allows for layers of encryption.
[25:29.530 --> 25:29.990]  Um...
[25:29.990 --> 25:31.070]  In case of, uh...
[25:31.070 --> 25:32.590]  Systems failure at any given point.
[25:32.790 --> 25:35.170]  Oh, and it's also an interesting little, uh...
[25:35.170 --> 25:35.450]  Like...
[25:35.450 --> 25:37.050]  State of the art kind of hack.
[25:37.390 --> 25:37.650]  Um...
[25:37.650 --> 25:38.090]  Right now.
[25:38.550 --> 25:38.810]  Uh...
[25:38.810 --> 25:39.050]  There...
[25:39.050 --> 25:40.450]  There's been reports of certain...
[25:40.450 --> 25:42.370]  Certain countries doing, um...
[25:42.370 --> 25:43.590]  Some port filtering.
[25:43.710 --> 25:46.030]  Like outgoing traffic filtering on port 5060.
[25:46.250 --> 25:47.610]  Which is the plain text SIP port.
[25:48.210 --> 25:48.730]  Um...
[25:48.730 --> 25:48.990]  Uh...
[25:48.990 --> 25:49.730]  So it's like, you know...
[25:49.730 --> 25:50.370]  If you're in...
[25:50.370 --> 25:52.550]  A country that does that, you know...
[25:52.550 --> 25:52.790]  Nationally.
[25:52.930 --> 25:54.130]  Then you can't make VoIP calls.
[25:54.290 --> 25:54.510]  Or...
[25:54.510 --> 25:55.430]  It works bad.
[25:55.570 --> 25:55.750]  Or whatever.
[25:56.350 --> 25:56.670]  Um...
[25:56.670 --> 25:57.970]  And fortunately, uh...
[25:57.970 --> 25:58.610]  SIP TLS.
[25:58.810 --> 25:59.490]  Or SIP AS.
[25:59.930 --> 26:00.390]  Um...
[26:00.390 --> 26:01.050]  Is, uh...
[26:01.050 --> 26:02.070]  On port 5061.
[26:02.510 --> 26:02.930]  Win.
[26:04.290 --> 26:05.610]  They'll never figure out...
[26:05.610 --> 26:06.530]  They'll never figure that out.
[26:06.810 --> 26:08.190]  They'll never even see this talk.
[26:08.510 --> 26:08.650]  Shh.
[26:11.450 --> 26:11.910]  Um...
[26:11.910 --> 26:12.430]  And...
[26:12.430 --> 26:13.970]  If you look at the OSTel side.
[26:14.190 --> 26:15.210]  It doesn't look fancy.
[26:15.390 --> 26:16.690]  And that's kind of the point.
[26:16.690 --> 26:19.050]  It is just like any other VoIP client.
[26:19.250 --> 26:19.730]  Um...
[26:19.730 --> 26:22.770]  The user interface is just like what you would expect with a phone.
[26:23.210 --> 26:23.690]  Um...
[26:23.690 --> 26:25.970]  Except for this added alphanumeric string.
[26:26.430 --> 26:28.230]  Which does the ZRTP, uh...
[26:28.230 --> 26:28.350]  Connect.
[26:28.890 --> 26:29.170]  Um...
[26:29.170 --> 26:31.570]  And allows for that verification that you have the...
[26:31.570 --> 26:32.930]  The P2P, uh...
[26:32.930 --> 26:33.290]  Encryption.
[26:46.190 --> 26:46.670]  Uh...
[26:46.670 --> 26:49.950]  Can hear people in a very crisp way.
[26:50.150 --> 26:53.910]  Which has been a problem with the telephone companies for a very long time.
[26:54.110 --> 26:54.170]  Yeah.
[26:54.230 --> 26:54.530]  And low.
[26:54.730 --> 26:55.850]  There's wideband and narrowband.
[26:56.670 --> 26:57.110]  Um...
[26:57.110 --> 26:57.410]  The...
[26:57.410 --> 26:59.590]  If you're on WiFi, the default codec, um...
[27:00.350 --> 27:00.790]  Is...
[27:00.790 --> 27:01.090]  Uh...
[27:01.090 --> 27:01.570]  What is it?
[27:01.730 --> 27:03.670]  It's, um...
[27:03.670 --> 27:03.810]  Uh...
[27:03.810 --> 27:05.090]  It's, uh...
[27:05.090 --> 27:05.230]  Uh...
[27:05.350 --> 27:07.210]  64, um...
[27:08.710 --> 27:09.190]  KBPS.
[27:09.790 --> 27:10.270]  Um...
[27:10.270 --> 27:10.690]  Mono.
[27:11.050 --> 27:11.750]  16-bit.
[27:11.990 --> 27:12.850]  So, it sounds good.
[27:13.030 --> 27:13.850]  And then, um...
[27:13.850 --> 27:16.330]  The default narrowband is speaks at 8K.
[27:16.550 --> 27:17.150]  8 kilobits.
[27:17.550 --> 27:18.030]  Um...
[27:18.030 --> 27:20.130]  But, interestingly, this is not implemented.
[27:20.330 --> 27:21.190]  This is, uh...
[27:21.190 --> 27:21.890]  Very experimental.
[27:22.090 --> 27:25.550]  There's a really cool project called Codec 2 out there.
[27:26.470 --> 27:26.950]  Um...
[27:26.950 --> 27:29.450]  Just to give some background, uh...
[27:29.450 --> 27:30.030]  Uh...
[27:30.030 --> 27:32.290]  Voice codecs are one of the big problems of voice over IP.
[27:32.430 --> 27:33.350]  Because there are so many of them.
[27:33.550 --> 27:35.930]  And there's also a very wide range of bandwidth constraints.
[27:36.570 --> 27:36.930]  Um...
[27:36.930 --> 27:41.190]  Some of the more sophisticated systems will dynamically adjust codecs and bit rates and stuff.
[27:41.290 --> 27:41.830]  And that's been...
[27:41.830 --> 27:44.430]  That goes all the way back to, like, real player and stuff like that.
[27:44.770 --> 27:45.070]  Um...
[27:45.070 --> 27:46.630]  For, you know, non, uh...
[27:46.630 --> 27:48.170]  Synchronous, uh...
[27:48.170 --> 27:48.490]  Communication.
[27:49.950 --> 27:50.310]  Um...
[27:50.310 --> 27:51.090]  But, um...
[27:51.090 --> 27:51.330]  Um...
[27:51.330 --> 27:51.490]  Um...
[27:51.490 --> 27:52.430]  So, you know, in...
[27:52.430 --> 27:56.010]  In situations like, you know, a bit more, uh...
[27:56.010 --> 27:57.090]  Like bandwidth constraint...
[27:57.090 --> 27:58.230]  Constrained environments.
[27:58.690 --> 28:01.030]  Or, like, kind of contested, uh...
[28:01.030 --> 28:01.450]  Uh...
[28:01.450 --> 28:01.510]  Uh...
[28:01.510 --> 28:01.630]  Uh...
[28:01.630 --> 28:03.370]  Territories or governments or something.
[28:03.510 --> 28:05.650]  You might not be guaranteed even eight kilobits per second.
[28:06.050 --> 28:09.130]  So, Codec 2 is a research project that went, um...
[28:09.130 --> 28:11.770]  Kind of like paper and patent trawling, um...
[28:11.770 --> 28:12.450]  From the 80s.
[28:12.710 --> 28:14.010]  And looked up, uh...
[28:14.010 --> 28:14.290]  Uh...
[28:14.290 --> 28:14.350]  Uh...
[28:14.350 --> 28:14.510]  Uh...
[28:16.050 --> 28:16.570]  Uh...
[28:16.570 --> 28:17.330]  Look for Codec 2.
[28:18.310 --> 28:19.290]  David Rowe.
[28:19.370 --> 28:20.390]  David Rowe.
[28:20.730 --> 28:21.250]  Um...
[28:21.250 --> 28:22.270]  David Rowe, um...
[28:22.270 --> 28:24.010]  Looked up a bunch of, uh...
[28:24.010 --> 28:26.450]  Algorithms for speech coding from the 80s.
[28:26.690 --> 28:27.250]  And, uh...
[28:27.250 --> 28:28.910]  And found that a lot of them were public domain.
[28:29.570 --> 28:30.130]  Um...
[28:30.130 --> 28:32.330]  Unfortunately, all of the algorithms that made...
[28:32.330 --> 28:33.230]  Made, uh...
[28:33.230 --> 28:35.210]  Your voice sound good were patented.
[28:36.030 --> 28:36.590]  Um...
[28:36.590 --> 28:37.810]  So, it's a work in progress.
[28:38.290 --> 28:38.530]  Um...
[28:38.530 --> 28:39.990]  But ideally, like, it...
[28:39.990 --> 28:41.810]  It is in CSIP Simple right now.
[28:42.050 --> 28:43.130]  As an available Codec.
[28:43.430 --> 28:45.570]  And there are examples, um...
[28:45.570 --> 28:48.450]  On the web of 1.2, uh...
[28:48.450 --> 28:49.890]  Kilobits per second voice.
[28:50.170 --> 28:51.090]  So, that's pretty cool.
[28:51.830 --> 28:56.790]  So, our version of OSTN, OSTN, is OSTel.
[28:56.990 --> 28:57.370]  Uh...
[28:57.370 --> 28:58.830]  But anybody can replicate this.
[28:59.030 --> 28:59.410]  And, uh...
[28:59.410 --> 29:01.630]  Create, you know, a 2600 or any...
[29:01.630 --> 29:02.410]  Any other one.
[29:02.790 --> 29:02.950]  Uh...
[29:02.950 --> 29:04.370]  What's exciting is that the...
[29:04.370 --> 29:06.930]  The platform we've currently gotten to work on...
[29:06.930 --> 29:07.590]  Every platform.
[29:07.910 --> 29:12.570]  So, it's functioning on Android, iPhone, Blackberry, uh...
[29:12.570 --> 29:15.430]  Symbian, Mac, PC, and Linux.
[29:15.710 --> 29:20.150]  So, if you wanna make an encrypted call between any of those systems, you can.
[29:20.150 --> 29:21.070]  And, uh...
[29:21.070 --> 29:22.390]  I encourage you to go to the wiki.
[29:23.210 --> 29:23.610]  Um...
[29:23.610 --> 29:26.150]  And you can find it all through austell.me.
[29:26.350 --> 29:26.710]  Uh...
[29:26.710 --> 29:27.730]  Where you can register for account.
[29:28.030 --> 29:28.630]  Go to wiki...
[29:28.630 --> 29:32.030]  Go to the wiki and find out exactly what client works on which platform.
[29:32.250 --> 29:33.790]  What is the licensing on that client?
[29:34.130 --> 29:34.330]  Uh...
[29:34.330 --> 29:35.190]  How open is it?
[29:35.270 --> 29:36.150]  How trusted is it?
[29:36.170 --> 29:37.290]  How much do we support it?
[29:49.730 --> 29:50.130]  Um...
[29:50.130 --> 29:51.210]  We're looking into developing new...
[29:51.210 --> 29:53.490]  Like, new and more interesting ways of, uh...
[29:53.490 --> 29:54.190]  Signing up for an account.
[29:54.690 --> 29:55.070]  Um...
[29:55.070 --> 29:56.110]  Rather than visiting a webpage.
[29:57.130 --> 29:57.510]  Um...
[29:57.510 --> 29:59.270]  Ideally, you should be able to sign up for an account here.
[29:59.330 --> 30:00.250]  I think that would be awesome.
[30:00.410 --> 30:03.270]  And there's a couple of authentication mechanisms, um...
[30:03.270 --> 30:04.010]  That I'm...
[30:04.010 --> 30:04.750]  I'm, uh...
[30:04.750 --> 30:05.190]  Looking into.
[30:05.330 --> 30:06.910]  But I haven't quite decided on one yet.
[30:07.430 --> 30:09.250]  And we're trying to make it as easy as possible.
[30:09.490 --> 30:09.970]  So that...
[30:09.970 --> 30:11.550]  You don't necessarily need a phone number.
[30:11.650 --> 30:15.030]  Because again, even the phone number is thinking in a way that's pre-described.
[30:15.490 --> 30:15.850]  Um...
[30:15.850 --> 30:16.910]  We have Twitter handles.
[30:17.030 --> 30:18.230]  We have email accounts.
[30:18.370 --> 30:20.150]  We have all sorts of other, uh...
[30:20.150 --> 30:22.750]  Systems of personal identification that we can opt into.
[30:23.370 --> 30:23.770]  Um...
[30:23.770 --> 30:24.770]  Can I just...
[30:24.770 --> 30:27.650]  By knowing your Twitter account, start to call you on that?
[30:27.950 --> 30:28.210]  Um...
[30:28.210 --> 30:29.850]  Or have other, um...
[30:30.830 --> 30:31.250]  ID...
[30:31.250 --> 30:32.030]  Aliases, you know?
[30:32.330 --> 30:32.350]  Yeah.
[30:32.590 --> 30:33.390]  The idea is like...
[30:33.390 --> 30:34.210]  An email...
[30:34.210 --> 30:35.210]  Call your email address.
[30:35.470 --> 30:37.330]  You know, being able to alias, uh...
[30:37.330 --> 30:37.670]  Your...
[30:37.670 --> 30:40.450]  Your phone identity with, uh...
[30:40.450 --> 30:41.910]  Some kind of token that's...
[30:41.910 --> 30:43.230]  That's known somewhere else.
[30:45.490 --> 30:46.050]  Um...
[30:46.050 --> 30:49.270]  So, there are some problems with, uh...
[30:49.270 --> 30:51.290]  That we've encountered while building the system.
[30:51.770 --> 30:51.950]  Uh...
[30:51.950 --> 30:52.970]  Tor being one of them.
[30:53.290 --> 30:53.610]  Uh...
[30:53.610 --> 30:54.650]  And there are some others.
[30:55.170 --> 30:55.390]  Uh...
[30:55.390 --> 30:57.850]  So, Guardian Project has worked intimately with Tor.
[30:58.090 --> 30:59.950]  Porting them onto the Android platform.
[31:00.470 --> 31:00.670]  Uh...
[31:00.670 --> 31:01.510]  Creating Orbot.
[31:01.930 --> 31:02.390]  Uh...
[31:02.390 --> 31:04.150]  Which this is a lovely icon for.
[31:04.590 --> 31:04.930]  Um...
[31:04.930 --> 31:05.690]  And Orweb.
[31:05.790 --> 31:06.890]  And creating, uh...
[31:06.890 --> 31:10.930]  An ability for any app to integrate Tor into their, uh...
[31:10.930 --> 31:11.410]  Workings.
[31:11.870 --> 31:12.290]  Um...
[31:12.290 --> 31:13.250]  Most recently, and...
[31:13.250 --> 31:16.170]  And largely, Twitter has actually, uh...
[31:16.170 --> 31:16.890]  Opened themselves up.
[31:17.030 --> 31:18.450]  So, you can now run, uh...
[31:18.450 --> 31:19.910]  Twitter over Tor, uh...
[31:19.910 --> 31:20.110]  Thankfully.
[31:20.790 --> 31:21.230]  Um...
[31:21.230 --> 31:24.510]  But, with voice, it becomes a little bit more complicated.
[31:24.730 --> 31:24.970]  Yeah.
[31:25.330 --> 31:27.550]  You can't do UDP over Tor.
[31:27.830 --> 31:28.550]  I mean, there's...
[31:28.550 --> 31:28.730]  Uh...
[31:28.730 --> 31:30.210]  Just, like...
[31:30.210 --> 31:30.810]  Uh...
[31:30.810 --> 31:30.970]  The...
[31:30.970 --> 31:33.350]  The latency of going through that many proxies.
[31:33.650 --> 31:33.930]  Like...
[31:33.930 --> 31:34.370]  Like...
[31:34.370 --> 31:35.710]  Literally by design, um...
[31:35.710 --> 31:37.510]  You can't do synchronous, uh...
[31:37.510 --> 31:39.170]  Two-way, um...
[31:39.170 --> 31:39.390]  Data.
[31:39.550 --> 31:40.430]  There's just too many...
[31:40.430 --> 31:41.290]  It bounces around too much.
[31:42.210 --> 31:42.650]  Um...
[31:43.130 --> 31:43.350]  But...
[31:44.030 --> 31:46.730]  But there's potential for things like, uh...
[31:46.730 --> 31:47.410]  Push to Tor.
[31:48.010 --> 31:48.450]  Uh...
[31:48.450 --> 31:49.210]  What if we could have a...
[31:49.210 --> 31:51.250]  A push to talk system that runs over Tor.
[31:52.070 --> 31:52.510]  Um...
[31:52.510 --> 31:55.210]  Based on the systems and protocols that we've already been developing.
[31:56.370 --> 31:56.810]  Um...
[31:56.810 --> 31:57.170]  Those are...
[31:57.170 --> 31:58.170]  Like push to talk systems.
[31:58.430 --> 31:58.610]  Uh...
[31:58.610 --> 31:58.770]  It's...
[31:58.770 --> 31:59.830]  It's funny cause like, I...
[31:59.830 --> 32:00.090]  I...
[32:00.090 --> 32:01.550]  When I first, um...
[32:01.550 --> 32:01.890]  Um...
[32:01.890 --> 32:04.690]  Found out that there's all these mobile handsets in China that have these, like...
[32:04.690 --> 32:06.510]  Voice SMS push to talk features.
[32:06.510 --> 32:07.850]  I was like, oh, like a walkie-talkie?
[32:07.970 --> 32:08.210]  Awesome.
[32:08.550 --> 32:10.810]  And then I saw one work and I was like, oh...
[32:10.810 --> 32:11.210]  This is...
[32:11.210 --> 32:12.110]  This is awesome.
[32:12.290 --> 32:12.850]  Like, it...
[32:12.850 --> 32:15.570]  It literally shows up like SMS and...
[32:15.570 --> 32:23.070]  You know, you record little voice messages and it's like near real-time, just like you can have text conversations, but it's with voice and it's literally a global walkie-talkie.
[32:23.390 --> 32:23.830]  It's...
[32:23.830 --> 32:24.230]  Sweet.
[32:25.330 --> 32:25.770]  Um...
[32:25.770 --> 32:29.490]  In addition to having to hack Free Switch itself, uh...
[32:29.490 --> 32:30.870]  ZRTP is not a standard.
[32:31.810 --> 32:32.570]  It's kind...
[32:32.570 --> 32:33.050]  I mean...
[32:33.050 --> 32:33.670]  There's a spec.
[32:33.910 --> 32:38.570]  There's a specification and a reference implementation that Phil Zimmerman wrote.
[32:39.250 --> 32:39.750]  Um...
[32:39.750 --> 32:40.110]  But yeah.
[32:40.790 --> 32:44.390]  The people's implementations aren't really standardized, so...
[32:44.390 --> 32:44.710]  I mean, it's...
[32:44.710 --> 32:46.190]  And it's very young as a...
[32:46.190 --> 32:46.710]  Um...
[32:46.710 --> 32:47.310]  As a protocol.
[32:47.590 --> 32:48.110]  So that...
[32:48.110 --> 32:50.330]  I think, you know, HTTP went through a lot of growing pains.
[32:51.150 --> 32:54.790]  You're saying that the mainstream libraries are working off of patches, not...
[32:54.790 --> 32:55.030]  Yeah.
[32:55.030 --> 32:55.130]  So...
[32:55.690 --> 33:19.750]  So the official release of the ZRTP implementation in CSIP Simple, which is using a Java library called PJSIP, which is using a patch set from the GNU ZRTP CPP, C++ library that does ZRTP, is literally a patch set that goes... that applies to a specific release of PJSIP.
[33:19.910 --> 33:21.070]  And that's the official release.
[33:21.350 --> 33:21.770]  So...
[33:21.770 --> 33:22.210]  Oops.
[33:23.010 --> 33:35.410]  And so we found it really important to work together with a lot of the VoIP clients that are coming out that are starting to bring in ZRTP because otherwise there's just not going to be interoperability.
[33:35.570 --> 33:40.810]  And as it develops further and they grow further apart, it's going to be increasingly a headache.
[33:41.010 --> 33:58.870]  So it's been great to work with people like Private Wave and their implementations because we've had a lot of issues with codecs not working out and communicating with each other and figuring out, okay, how do we finagle the CSIP Simple library and the open-source standard to make sure that it's robust enough,
[33:58.910 --> 34:11.190]  but also for them to play nice with us as well and allow for that all to grow, whether it's a proprietary for-profit system or just the open-source available to everyone methods.
[34:11.450 --> 34:23.310]  There are a lot of political barriers for interoperability as well, especially in the codec space through patents and just platforms.
[34:25.510 --> 34:30.510]  There's a lot of the iOS clients use... I'm just going to call it QuickTime.
[34:30.650 --> 34:31.770]  I don't do any iOS development.
[34:31.910 --> 34:38.830]  I don't know if QuickTime is the API, but QuickTime doesn't support any OGG codecs at all.
[34:39.370 --> 34:43.750]  So there goes speaks, which is our default narrow band codec, but it does support some other ones.
[34:43.950 --> 34:58.330]  So there's a lot of... there's certain interoperability barriers that are not just technical, but there are solutions to them and that's part of the project is to kind of define... better define those solutions and document them.
[34:59.190 --> 35:03.810]  And the technology right now is very young because we've just been implementing it.
[35:04.030 --> 35:14.730]  So security might have its own lapses and issues, but you can... there's a benefit in using voice because you can actually beat engineering attacks if your voice sounds funny.
[35:14.890 --> 35:15.110]  Right?
[35:15.170 --> 35:18.530]  If somebody has a gun to your head, then your voice changes, potentially.
[35:18.890 --> 35:24.430]  So there are layers and layers of security as we implement it.
[35:24.570 --> 35:26.170]  Yeah, and it's interesting.
[35:26.430 --> 35:46.270]  And it's one of those things that's subtle and sometimes taken for granted or not acknowledged in that... so what I was talking about before with like all the SIP signaling is using SSL, and actually is SSL, not TLS, and a certificate authority that's the server.
[35:46.310 --> 35:48.390]  So it's obviously not signed by a root CA.
[35:48.570 --> 35:49.790]  So it's not quote unquote trusted.
[35:50.630 --> 36:00.450]  But... so if someone jacks your signaling and the call still works for whatever reason, it doesn't matter really because if the call works, you can talk to the person on the other line.
[36:00.850 --> 36:13.030]  And if you know them, then you can move on and do the ZRTP negotiation and then you're still assured of a private conversation of the actual audio bits.
[36:13.290 --> 36:17.830]  And if you don't recognize them or if you don't want to talk to them, you can just hang up.
[36:19.610 --> 36:21.090]  What about encrypted GSM?
[36:22.870 --> 36:24.970]  Encrypted GSM is a fun subject.
[36:25.710 --> 36:30.390]  We haven't done any development on that level yet.
[36:31.430 --> 36:33.490]  OpenBTS is a really awesome project.
[36:34.750 --> 36:42.150]  And it's essentially a... it's a GSM transceiver.
[36:42.590 --> 36:47.290]  And on the other end is a SIP registrar.
[36:47.530 --> 36:51.910]  So you register, you know, so you get a bunch of phones with GSM service.
[36:52.630 --> 37:03.870]  And they connect to the OpenBTS station and they register to, in this case, like, you know, FreeSwitch or Asterisk or OpenSIPS or any of the other SIP registrars.
[37:04.190 --> 37:09.730]  So it's kind of like, like, the idea of doing encrypted GSM is definitely a possibility.
[37:09.730 --> 37:11.170]  And it's an interesting one.
[37:11.290 --> 37:15.330]  Though there are more than just technical barriers with that as well.
[37:17.290 --> 37:18.370]  Like it's illegal.
[37:20.250 --> 37:21.490]  So here's a big question.
[37:22.770 --> 37:24.470]  Can we replace the telephone company?
[37:27.050 --> 37:33.970]  And, yeah, running a pirate GSM service is complicated because, for one, it's illegal.
[37:34.590 --> 37:39.070]  Depending on what state, like, you know, nationality you belong to or something.
[37:39.110 --> 37:39.470]  Does that matter?
[37:39.550 --> 37:39.850]  I don't know.
[37:40.190 --> 37:40.930]  It's illegal.
[37:41.090 --> 37:42.190]  Let's just call it like that.
[37:42.190 --> 37:44.590]  Or what country you're in.
[37:45.230 --> 37:49.830]  I mean, one of the issues is, you know, needing radio spectrum.
[37:50.110 --> 37:54.530]  And in countries like Iraq, radio spectrum is unregulated and filthy.
[37:54.710 --> 38:00.530]  So you can actually just build it, experiment with it, grow it, and see how it can actually scale.
[38:00.890 --> 38:03.950]  So there are options for doing something like that.
[38:04.490 --> 38:10.890]  In the States, you know, so if you build an OpenBTS system, it's a software radio.
[38:11.150 --> 38:15.290]  So you can, you know, you can broadcast on whatever frequency your radio supports.
[38:16.010 --> 38:19.450]  There are certain frequencies that it's illegal to broadcast on.
[38:19.690 --> 38:26.230]  And, for example, you could basically, you could become an AT&T, you know, broadcast, or, you know, transceiver.
[38:26.530 --> 38:29.130]  And iPhones will wander onto your GSM network.
[38:31.130 --> 38:36.170]  One of the goals with OSTN is to get peering and federation happening.
[38:36.590 --> 38:38.910]  But fundamentally, peering and federation is hard.
[38:39.130 --> 38:41.330]  And the telephone companies figured this out.
[38:41.390 --> 38:44.210]  And that's how they were able to scale really hugely.
[38:44.510 --> 38:48.250]  And they did it using tones, which is why we're all here.
[38:49.410 --> 38:55.030]  We're trying to figure out how do we take something like that and implement that in our system.
[38:55.550 --> 39:02.050]  Yeah, and like, one of the reasons I really like the email metaphor is this one.
[39:03.030 --> 39:10.410]  You know, email, anyone who's run an MTA with a certain amount of users knows that email is...
[39:10.410 --> 39:11.550]  It could be pretty hard.
[39:11.710 --> 39:13.950]  I mean, it's kind of easy, but it's still pretty hard.
[39:13.970 --> 39:15.550]  And it's kind of awesome that it works.
[39:15.930 --> 39:20.870]  Just like it's awesome that you can call someone around the world with, you know, over the PSTN and it works.
[39:21.090 --> 39:23.950]  And they've solved a lot of really hard scalability problems.
[39:23.950 --> 39:34.650]  And so the goal is like, you know, like, so if we want to replace like the, you know, the public switched telephone network, addressing is a big deal.
[39:34.890 --> 39:37.950]  Not like IP addressing, but like, you know, contact addressing.
[39:38.210 --> 39:44.590]  And there are a lot of projects that attempt to address this.
[39:45.070 --> 39:46.030]  There's no standard.
[39:46.230 --> 39:48.770]  Again, this is a very conflicted space.
[39:48.770 --> 39:57.370]  And one of the reasons is that because of these, you know, telco, like, citadels, like, they don't want to interoperate with you.
[39:57.670 --> 40:02.070]  Like, it's in their best interest, like, financially to not do that.
[40:02.830 --> 40:09.570]  So making things like hearing easy, like it would be with email, is like, fundamentally different.
[40:11.530 --> 40:17.310]  And so even free switch, when you're hacking core, doesn't necessarily make sense to continue to develop on.
[40:17.450 --> 40:23.350]  So we're not necessarily stuck with that solution and looking into other things like OpenSIP and otherwise.
[40:23.350 --> 40:25.410]  So, yes, some stuff that's simpler.
[40:26.030 --> 40:31.790]  You know, the real, the back-end stuff, like, I put a lot of research, like, R&D into it.
[40:32.310 --> 40:35.950]  And through that, I discovered that the less back-end stuff, the better.
[40:36.810 --> 40:40.810]  Unfortunately, like, working with this type of voice over IP NAT is a huge issue.
[40:41.430 --> 40:48.970]  Skype solved it by being like a DOS service and just slamming your network with a bunch of stuff to figure out what's going on.
[40:49.570 --> 40:55.910]  But, you know, having, proxying bits is the easiest way to get through a lot of NAT issues.
[40:57.310 --> 41:02.170]  There are probably people in the audience who have had one-way audio on various types of phone calls.
[41:02.710 --> 41:06.090]  That's, that's a common problem with NAT.
[41:07.470 --> 41:09.790]  So, so you still need some back-end infrastructure.
[41:10.270 --> 41:12.810]  I'd like to have as much in here as possible.
[41:13.310 --> 41:16.630]  Ideally peer-to-peer, but that's, you know, that's for the future.
[41:16.630 --> 41:18.570]  And you've got to register somewhere.
[41:18.770 --> 41:22.370]  You've got to store your contact list so you can call other people.
[41:27.070 --> 41:28.570]  So we have Morbate.
[41:29.170 --> 41:32.230]  Can you build your own telephony network?
[41:32.730 --> 41:33.950]  We created the spec.
[41:34.450 --> 41:35.230]  OSTN is there.
[41:35.470 --> 41:36.870]  You can see the code.
[41:37.370 --> 41:40.650]  Can you actually build a 2600 network?
[41:40.830 --> 41:45.270]  Or what other network you want to name it and actually implement it?
[41:45.270 --> 41:47.970]  And then we can work together on the Federation issue.
[41:48.250 --> 41:50.050]  Either through tones or otherwise.
[41:50.970 --> 41:52.870]  It probably won't be through tones, but that would be novel.
[41:53.650 --> 42:01.030]  Yeah, so this is a, I'm in my other, with my other hat, I do a lot of systems architecture.
[42:01.410 --> 42:03.210]  And I really like a framework called Chef.
[42:03.410 --> 42:09.750]  I won't pimp that here, because I know that that's kind of a not okay thing to talk about with a bunch of geeks.
[42:09.750 --> 42:18.750]  But, so I wrote a Chef cookbook that, for free switch, that automates, taking a Linux server.
[42:18.890 --> 42:19.510]  I did it on Debian.
[42:20.550 --> 42:21.970]  I've done it on Ubuntu as well.
[42:22.050 --> 42:24.710]  I think the package names in the cookbook are okay.
[42:25.310 --> 42:29.750]  But there might be some like, you know, little differences in the package names, but nothing fundamentally different.
[42:30.410 --> 42:37.310]  And you can get your own free switch set up with all of the bad stuff turned off and all of the security stuff enabled.
[42:37.310 --> 42:40.930]  It builds a root CA on that server for you.
[42:41.110 --> 42:44.730]  If you want to distribute that root certificate to all your clients, you may do so.
[42:44.890 --> 42:47.510]  If not, you can just trust it.
[42:47.670 --> 42:51.850]  But it's an important distinction, because it doesn't generate a self-signed SSL certificate.
[42:51.850 --> 42:54.670]  It actually is a legitimate root certificate authority.
[42:57.510 --> 43:03.090]  And if you're going to do this, the most important thing you need is a fully qualified domain name.
[43:03.510 --> 43:05.330]  And really, literally, that's all you need.
[43:05.330 --> 43:06.530]  If the server that...
[43:06.530 --> 43:12.230]  If you have Chef running on the server, and you have a fully qualified domain name, and it resolves.
[43:12.650 --> 43:14.070]  And you know what...
[43:14.070 --> 43:19.330]  Yeah, as long as it resolves, like hostname-f works.
[43:20.370 --> 43:30.730]  And then literally no interaction, you will have a running free switch server with all of these secure by default stuff and enabled and with no users.
[43:30.730 --> 43:33.210]  But there's even a script to generate some users for you.
[43:36.710 --> 43:39.430]  So, one of the issues is, where do you host it?
[43:39.510 --> 43:42.090]  And how do you ensure that it is secure?
[43:42.270 --> 43:44.890]  That the host itself is not going to be confiscated?
[43:47.250 --> 43:48.990]  Yeah, you can host it anywhere you want.
[43:49.510 --> 43:53.490]  You could host it on your phone, but you probably don't want to do that.
[43:54.790 --> 43:59.310]  Yeah, so Amazon AWS is a pretty common place to host.
[44:00.510 --> 44:07.150]  There's a company called Open Hosting that I just have to kind of talk about a little.
[44:07.610 --> 44:10.550]  Full disclosure, I have worked with some of the founders.
[44:11.190 --> 44:12.210]  But they're really cool.
[44:14.390 --> 44:15.190]  They're smaller.
[44:15.570 --> 44:16.530]  They're getting started.
[44:17.030 --> 44:23.550]  They have a really cool feature where they're running KVM as their virtualization system.
[44:24.290 --> 44:26.970]  And you can upload a raw Kimu image and they'll boot it for you.
[44:27.090 --> 44:27.730]  So it's really cool.
[44:27.830 --> 44:32.110]  So you can like basically make your own servers on your laptop and just send it to them and they'll boot them.
[44:32.510 --> 44:34.710]  Or you can use a bunch of predefined systems.
[44:35.030 --> 44:36.870]  And they have like the serial BIOS things.
[44:36.870 --> 44:42.870]  You can actually see your, you know, in it doing stuff and talk to the BIOS over VNC.
[44:43.430 --> 44:46.550]  So they have a lot of kind of clever stuff that goes outside of the Amazon metaphor.
[44:46.930 --> 44:48.170]  And their storage is really fast.
[44:48.310 --> 44:49.030]  And I can go on and on.
[44:49.350 --> 44:51.050]  But, so yeah.
[44:51.530 --> 44:55.750]  But, you know, really any server that has a fully qualified domain name, you can host it on.
[44:56.190 --> 44:57.330]  And we only have 15 minutes.
[44:57.450 --> 44:58.270]  We should maybe take questions.
[44:58.670 --> 44:58.990]  Yeah.
[44:59.270 --> 44:59.570]  Let's get...
[44:59.570 --> 44:59.890]  All right.
[44:59.950 --> 45:00.490]  Let's get to that.
[45:00.630 --> 45:03.730]  And there's definitely an issue with the clients also.
[45:03.730 --> 45:10.010]  Just because for us, we found that the CSIP simple trunk, release trunk moves really fast.
[45:10.630 --> 45:16.550]  And working with the actual certificate authorities causes issues depending on which clients you're working.
[45:16.550 --> 45:16.750]  Oh, yeah.
[45:16.870 --> 45:18.410]  You can't use commercial CAs for this.
[45:18.770 --> 45:19.990]  It's a free switch thing.
[45:20.090 --> 45:22.070]  I mean, you can, but it's broken.
[45:22.650 --> 45:27.690]  So our question is, how do we get this into everybody's hands literally as well as figuratively?
[45:27.690 --> 45:30.450]  How can the design challenge of that be overcome?
[45:30.850 --> 45:33.930]  So we need developers, testers, translators, designers.
[45:33.930 --> 45:55.070]  And we're looking to build a cryptonomicon as such with this growing wiki of information that details the trials and tribulations of implementing encrypted voice as well as establishing a code book for the laws of each country to say whether you can have your own OpenBTS,
[45:55.310 --> 46:01.910]  whether you can have your own telephony, what are the dangerous points of interception that we found, and otherwise.
[46:01.910 --> 46:06.610]  And we want to do some shout-out thank yous before we get to the Q&A.
[46:07.670 --> 46:15.210]  So thanks to Jake Applebaum, Phil Zimmerman, Moxie, Private Wave, Ooze, and tenstaggy.net.
[46:17.090 --> 46:18.290]  Eleanor Saita.
[46:19.850 --> 46:24.410]  She and Jake helped me a lot with some authentication stuff.
[46:30.920 --> 46:32.860]  How did you know that was the last slide?
[46:36.180 --> 46:37.120]  Oh, previous one.
[46:38.260 --> 46:38.540]  Yes.
[46:38.800 --> 46:41.080]  So you can go to github.com slash...
[46:41.080 --> 46:43.840]  Yeah, that's my GitHub username, Azzarello.
[46:44.080 --> 46:47.000]  But yeah, that's the whole... I have a couple of other cookbooks in there.
[46:47.420 --> 46:52.140]  It's not perfectly organized right now, but the free switch one is the most important.
[46:52.300 --> 46:56.500]  And that has a read me with documentation of a lot of what I said.
[46:56.500 --> 47:01.400]  And you can email us directly, and we're happy to answer questions or otherwise.
[47:01.580 --> 47:07.060]  And there's a blog post on guardianproject.info that details the 12-step program of setting up your own OSTN.
[47:07.860 --> 47:09.560]  All right, let's go to the Q&A.
[47:10.860 --> 47:12.260]  Really interesting idea.
[47:12.840 --> 47:19.920]  And I very much favor the general, you know, by deploying, you know, alternative telephony infrastructure.
[47:22.060 --> 47:24.860]  The ZRTP thing is a little worrisome to me.
[47:24.980 --> 47:28.420]  I didn't actually know that it existed because I've had my head down for too long.
[47:28.560 --> 47:33.900]  And when you started mentioning it, I read the RFC during the talk.
[47:34.040 --> 47:38.060]  And I like the fact that John Callas is associated with it.
[47:38.060 --> 47:42.060]  The fact that Phil Zimmerman is associated with it makes me want to run in the other direction.
[47:43.160 --> 47:44.920]  And I don't dislike Phil.
[47:45.120 --> 47:46.580]  I've known him a very long time.
[47:46.740 --> 47:53.440]  But the described mode, and in fact, what I read in the RFC, I can break this.
[47:53.940 --> 47:58.360]  If I can do it in a few minutes of thought, the professionals certainly can.
[47:59.580 --> 48:04.180]  You might want to think about alternative ways of securing the communications.
[48:04.500 --> 48:07.680]  Because this is, you know, an absolutely necessary thing to do and deploy.
[48:08.980 --> 48:16.800]  And finding things where it's a little bit harder to do man-in-the-middle attacks and to do traffic analysis on it.
[48:16.840 --> 48:19.240]  I'm especially concerned about the traffic analysis possibilities.
[48:19.500 --> 48:22.080]  Because the fact that part of the conversation isn't clear.
[48:22.320 --> 48:26.860]  To the extent that the other person is recognizable, you can do automated traffic analysis.
[48:27.180 --> 48:30.120]  To the extent that they're not recognizable, I can do man-in-the-middle.
[48:30.520 --> 48:32.740]  So you're going to lose one way or the other.
[48:33.380 --> 48:38.420]  Yeah, so a good cryptanalysis of ZRTP implementations would be really awesome.
[48:38.740 --> 48:40.540]  I don't need to cryptanalyze it.
[48:40.640 --> 48:41.680]  I'm not going to break it that way.
[48:41.860 --> 48:47.040]  Well, I definitely encourage as much work as possible to get to that level and improve it.
[48:47.580 --> 48:53.200]  It is a developing technology and it is out in the open for a reason.
[48:53.200 --> 48:56.580]  And it could only be made better.
[49:01.590 --> 49:02.790]  Hey, I'm Diggz.
[49:02.990 --> 49:04.210]  I'm one of the founders of Voxeo.
[49:04.990 --> 49:06.910]  I currently work with Voxeo Labs.
[49:07.150 --> 49:09.930]  We're actually setting up an OpenBTS network at Burning Man.
[49:10.050 --> 49:11.510]  We've been doing it for the last several years.
[49:11.670 --> 49:14.710]  So if anybody's going this year, Papa Legba is our camp.
[49:16.150 --> 49:18.890]  Somebody asked over here why I have two microphones and a phone.
[49:19.150 --> 49:20.010]  Echo cancellation.
[49:21.390 --> 49:22.750]  There is a legitimate reason.
[49:24.170 --> 49:27.710]  And we've been doing a lot of work with WebRTC.
[49:28.530 --> 49:35.630]  Wanted to hear your thoughts on that project and how your stuff might play with WebRTC.
[49:35.930 --> 49:37.650]  That would be the bomb.
[49:39.150 --> 49:43.130]  Yeah, there is a demo SIP client written in WebRTC.
[49:43.510 --> 49:48.530]  And I tried to register it to Ostel.me with my account and it failed.
[49:48.630 --> 49:51.710]  I'm assuming that's because it's not doing Secure SIP.
[49:52.610 --> 49:54.410]  That doesn't mean that you can't.
[49:54.410 --> 49:57.750]  But yeah, that's really a next level.
[49:58.010 --> 50:01.550]  It's getting... doing a lot of browser based telephony.
[50:01.970 --> 50:05.190]  I mean, Google's already done that with... they're using a Java plugin.
[50:05.430 --> 50:09.590]  But doing it with WebRTC would be the super hotness.
[50:10.350 --> 50:12.410]  And I mean, that would commoditize...
[50:13.130 --> 50:18.210]  I mean, if you could do it on a secure level, I won't get into JavaScript cryptography.
[50:18.210 --> 50:21.590]  Nadeem did a talk on that a couple... two days ago.
[50:22.430 --> 50:29.330]  But if... yeah, if that could... if that is attainable, then it pretty much commoditizes secure voice.
[50:30.230 --> 50:31.510]  So... WebRTC, yeah.
[50:32.490 --> 50:37.110]  So maybe this is a question that's removed from one layer from you guys.
[50:37.250 --> 50:38.610]  Maybe it's more for the BTS people.
[50:38.750 --> 50:49.590]  But have there been any thoughts into using white space for the purposes of using a, you know, like a GSM network or something like that?
[50:49.770 --> 50:51.110]  I don't know if anyone's looked into that.
[50:51.190 --> 50:52.570]  Is white space a software?
[50:52.850 --> 50:54.550]  I haven't... I don't know what you're talking about.
[50:55.430 --> 50:55.910]  Sorry.
[50:56.170 --> 50:59.250]  That's... that's a spectrum usage where...
[50:59.890 --> 51:04.130]  So this is just... maybe I'm not the person to be talking about this.
[51:04.250 --> 51:10.330]  But basically using a spectrum that's unused in...
[51:10.330 --> 51:14.110]  So FCC's recently kind of sort of allowing testing on this.
[51:14.110 --> 51:18.730]  There's... there's been rules that's been established about it where...
[51:18.730 --> 51:26.170]  Kind of stupidly, they're requiring, you know, geographical databases where it's like...
[51:26.170 --> 51:27.050]  Okay, here...
[51:27.050 --> 51:27.850]  Yeah, yeah, yeah.
[51:27.970 --> 51:29.590]  That would... that would be... that would be awesome.
[51:29.810 --> 51:34.690]  I don't... from... from memory, I don't know too much about the... the commercial spectrum allocation.
[51:34.950 --> 51:37.450]  But I know that there probably is some white space.
[51:37.530 --> 51:38.070]  I like that term.
[51:38.170 --> 51:39.010]  I haven't heard it before.
[51:39.490 --> 51:43.950]  And... and right now in terms of the... the testing, I mean, this is very much...
[51:44.810 --> 51:47.070]  not verifiably secure on our side.
[51:47.250 --> 51:51.350]  We're implementing it saying this is an alpha, this is not ready for field play.
[51:52.590 --> 51:56.890]  And so... as we talk about the security and figure out, okay, when can we start to...
[51:56.890 --> 52:00.270]  actually put our stamp on this and say, yes, this is ready for game time.
[52:01.490 --> 52:03.710]  We're exploring whether we can test it.
[52:04.090 --> 52:06.510]  One of our colleagues, Hans, is working on mesh networking.
[52:06.990 --> 52:13.770]  You know, can we erect a mesh network and have that just as part of a node in an emergency or in a specific case?
[52:13.950 --> 52:17.830]  And then how do we have a more wide release on it?
[52:18.230 --> 52:25.990]  And, you know, I think white space also is figuring out where in the spectrum can we play, whether it's our own spectrum or other... open spectrum.
[52:27.170 --> 52:27.650]  Yeah.
[52:28.850 --> 52:29.330]  Where...
[52:29.330 --> 52:33.050]  So you mentioned that most of this is free software, open-source.
[52:33.350 --> 52:34.590]  Is there some of it that's not?
[52:34.730 --> 52:36.490]  And what is the Guardian project?
[52:36.690 --> 52:37.710]  Are you just...
[52:37.710 --> 52:40.690]  guys who are writing this in your spare time?
[52:40.790 --> 52:41.350]  Is it a company?
[52:42.330 --> 52:56.690]  Well, so in terms of the free versus non-free, the Guardian project is, you know, the sponsor and, you know, that's where we... we're working with the Guardian project.
[52:59.910 --> 53:03.630]  And in terms of... wait, I just went blank.
[53:04.230 --> 53:04.650]  Sorry.
[53:04.650 --> 53:12.730]  The Guardian project is a company based here in New York and we're mostly Android developers and otherwise building out secure tech.
[53:13.310 --> 53:13.670]  Nathan...
[53:13.670 --> 53:16.010]  I have to jump in because the Guardian project is not a company.
[53:16.730 --> 53:18.070]  It's an open-source project.
[53:18.270 --> 53:19.190]  It's totally ephemeral.
[53:19.370 --> 53:19.510]  Yeah.
[53:19.630 --> 53:22.850]  And we have various companies and grants and stuff.
[53:22.990 --> 53:24.450]  But, yeah, we're not a company.
[53:24.570 --> 53:24.710]  Yeah.
[53:24.830 --> 53:30.710]  Everyone in here is part of the Guardian project, whether you're funded for a specific project or not.
[53:31.190 --> 53:31.910]  But, oh, yeah.
[53:32.030 --> 53:37.090]  So in terms of third-party applications, we're developing open-source software.
[53:37.270 --> 53:44.630]  So we're using CSIP Simple as our baseline and the OfTel application as the sort of proof that it works.
[53:44.870 --> 53:46.670]  And that is completely open-source.
[53:47.150 --> 53:49.950]  There might be some proprietary codecs in there, but I don't think so.
[53:50.130 --> 53:50.870]  FFmpeg's in there.
[53:51.510 --> 53:55.010]  But in terms of proprietary software, those are third parties.
[53:55.190 --> 53:55.990]  We're not developing them.
[53:56.390 --> 53:57.810]  The protocols are open.
[53:58.330 --> 54:03.910]  On iOS, the most mature third-party app is called GroundWire.
[54:04.990 --> 54:12.070]  It costs $10 and then you have to pay a $25 enterprise service tax to get ZRTP support for outgoing calls.
[54:12.070 --> 54:15.190]  It's kind of a ridiculous business plan, in my opinion.
[54:15.390 --> 54:18.390]  But, you know, it's working and it gives you these sort of enterprise features.
[54:18.550 --> 54:19.630]  That's the market they're going for.
[54:20.590 --> 54:25.250]  And PrivateGSM is the product from a company called PrivateWave.
[54:26.590 --> 54:28.930]  I think they're based somewhere in Italy.
[54:30.030 --> 54:34.090]  And that runs on, I think, all of them, right?
[54:35.350 --> 54:38.510]  Symbian, BlackBerry, iOS, and Android.
[54:39.790 --> 54:41.090]  Which requires a license.
[54:41.330 --> 54:41.710]  Right.
[54:41.870 --> 54:42.090]  Oh, yeah.
[54:42.150 --> 54:42.950]  Which requires a license.
[54:43.070 --> 54:43.850]  That's also proprietary.
[54:43.850 --> 54:45.450]  But we're not developing any of those.
[54:45.610 --> 54:47.010]  We're just working with the authors.
[54:49.210 --> 54:49.770]  All right.
[54:49.930 --> 54:51.150]  So, thank you so much.
[54:51.310 --> 54:58.130]  Feel free to come up to us for Guardian stickers or otherwise to talk about encrypted VoIP and whatever projects you're working with.
[54:58.130 --> 55:00.030]  And we're trying to extend this further.
[55:00.050 --> 55:01.710]  So, looking for people to help.
[55:01.890 --> 55:03.510]  So, thank you so much for coming out.
[55:03.750 --> 55:05.150]  And until the rest of the day.