Re: Truly Trulymail

[Ari Silverstein]

On Mon, 30 Aug 2010 21:50:58 -0700 (PDT), TrulyMail Support wrote:

>> Looks fairly interesting, but I'd like a lot more info on who they are....
>
> I'm John from TrulyMail Support. What would you like to know about us?
>
> The short version is that we are a Chilean company and we offer a
> secure, powerful, easy-to-use, email client which includes
> automatically encrypted messages between TrulyMail users (and optional
> encryption between email users) along with many other features. Our
> system is quite rich and you can read more about it here:
> http://trulymail.com/Features.aspx

Thanks for the info, John.

What is you and your companies background in delivering and
implementing encryption?

Who is "John", who are the investors, management and directors of
Trulymail?
--
´Looking Above and Beyond the Ramp: A Study of Buffalo Studentsÿ
Attitudes toward Alternative Modes of Transportation"

[TrulyMail Support]

On Aug 31, 12:10*pm, Ari Silverstein <AriSilverst...@yahoo.com> wrote:

> Thanks for the info, John.
>
> What is you and your companies background in delivering and
> implementing encryption?

TrulyMail (the company) has been around a short time (two years). Our
products include the TrulyMail Client and related TrulyMail services
(encrypted, private messaging, for example). We have been offering
these products for about two years now.

> Who is "John", who are the investors, management and directors ofTrulymail?

I am John (though, I am not the only one here named John). The
identities of our investors is not public information. Is this
something that is important for you to know? If so, may I ask why?

[Ari Silverstein]

On Tue, 31 Aug 2010 01:42:07 -0700 (PDT), TrulyMail Support wrote:

> On Aug 31, 12:10*pm, Ari Silverstein <AriSilverst...@yahoo.com> wrote:
>
>> Thanks for the info, John.
>>
>> What is you and your companies background in delivering and
>> implementing encryption?
>
> TrulyMail (the company) has been around a short time (two years). Our
> products include the TrulyMail Client and related TrulyMail services
> (encrypted, private messaging, for example). We have been offering
> these products for about two years now.
>
>> Who is "John", who are the investors, management and directors ofTrulymail?
>
> I am John (though, I am not the only one here named John). The
> identities of our investors is not public information. Is this
> something that is important for you to know? If so, may I ask why?

If you're dealing with security products, especially without open
source coding, /who/ you are and your background is extremely
important.

The fact that you ask this question is startling.

And informative.
--
Talk about F-Cars - www.ferrarichat.com/forum/member.php?u=89702

[TrulyMail Support]

> If you're dealing with security products, especially without open
> source coding, /who/ you are and your background is extremely
> important.

I guess it all depends on who we are targeting as our customer. For
John Q. Public to choose a system to keep his private messages
private, does he care about who made Thunderbird+GPG+Enigmail or who
made TrulyMail?

I believe he does not. I believe his primary concern is how to keep
his private communications private without spending a day getting
three pieces of software installed, setup, and configured to
interoperate. Of course, the easier path for him is to use TrulyMail,
click the Next button a few times, and have everything done
automatically.

You are clearly a very detail-oriented person. You want to know
everything about whatever topic you dig into. There is nothing wrong
with that. There are many open source systems out there which allow
you to go through the code line-by-line and you can see everything it
does.

We are not that kind of company. We are a 'bring secure, convenient
communications to the masses' kind of company.

Different fits for different people.

[Ari Silverstein]

On Tue, 31 Aug 2010 07:48:47 -0700 (PDT), TrulyMail Support wrote:

>> If you're dealing with security products, especially without open
>> source coding, /who/ you are and your background is extremely
>> important.
>
> I guess it all depends on who we are targeting as our customer. For
> John Q. Public to choose a system to keep his private messages
> private, does he care about who made Thunderbird+GPG+Enigmail or who
> made TrulyMail?
>
> I believe he does not. I believe his primary concern is how to keep
> his private communications private without spending a day getting
> three pieces of software installed, setup, and configured to
> interoperate. Of course, the easier path for him is to use TrulyMail,
> click the Next button a few times, and have everything done
> automatically.

Let me translate. You want newbies, dumbasses and those with no
education in anything cryptology to guy into your product.

OK, at least we have your marketing plan down.

> You are clearly a very detail-oriented person. You want to know
> everything about whatever topic you dig into. There is nothing wrong
> with that. There are many open source systems out there which allow
> you to go through the code line-by-line and you can see everything it
> does.

Hardly detail oriented. Examining open source code isn't my cop of tea
either.

But I do believe in peer review and your rather flippant attitude "see
you in Santiagoe" toward your code is utter ********.

But, hey, there is a large market for morons who will trust their
privacy with people like you so have at it. Expect to get zero
credibility from anyone has any teensy bit of workable knowledge
regarding encryption.

> We are not that kind of company. We are a 'bring secure, convenient
> communications to the masses' kind of company.

You're a bring the bucks to John kinda company who hides behind single
names and averts the honest intentions of prying eyes.

> Different fits for different people.

Most certainly but you can have your profits and your credibility as
well. For whatever reason, none of which I can think of that is either
honest or straightforward, Trulymail has decided to take the lowest of
low roads.

The only reasons you would do so are:

1) Trulymail is comprised of a set of waffling imbeciles.
2) You're crooked

You see, transparency is the lifeblood of professional cryptology. The
breast that feeds its reliability and innocence. You guys are as
valuable as a tit on a boy pig.

Now you are exposed which is a good thing for everyone including you.
Repent. Turn away from the Dark Side.

This "trust us, we're really good guys" is a bunch of hocus-pocus BS,
it demeans you and it demeans your products.

Remember Allende.
--
Ari's Fun Times!
http://tr.im/hrFG
Motto: Run, rabbit, Run!

[Steve Terry]

"Ari Silverstein" <AriSilverstein@yahoo.com> wrote in message
news:8e4kfpFr7gU1@mid.individual.net...
> On Tue, 31 Aug 2010 07:48:47 -0700 (PDT), TrulyMail Support wrote:
<snip>
> This "trust us, we're really good guys" is a bunch of hocus-pocus BS,
> it demeans you and it demeans your products.
>
>
I trust them, nobody from Santiago or Nigeria would lie to us.

Steve Terry
--
"I would like to plead for my right to investigate natural phenomena
without having guns pointed at me.
I also ask for the right to be wrong without being hanged for it."
- Wilhelm Reich, November 1947

[a]

**** off, Ari. You're just trolling John for the sake of being difficult.
Hundreds of apps exist where you don't know the makers and their history.





"Ari Silverstein" <AriSilverstein@yahoo.com> wrote in message news:8e4kfpFr7gU1@mid.individual.net...
> On Tue, 31 Aug 2010 07:48:47 -0700 (PDT), TrulyMail Support wrote:
>
>>> If you're dealing with security products, especially without open
>>> source coding, /who/ you are and your background is extremely
>>> important.
>>
>> I guess it all depends on who we are targeting as our customer. For
>> John Q. Public to choose a system to keep his private messages
>> private, does he care about who made Thunderbird+GPG+Enigmail or who
>> made TrulyMail?
>>
>> I believe he does not. I believe his primary concern is how to keep
>> his private communications private without spending a day getting
>> three pieces of software installed, setup, and configured to
>> interoperate. Of course, the easier path for him is to use TrulyMail,
>> click the Next button a few times, and have everything done
>> automatically.
>
> Let me translate. You want newbies, dumbasses and those with no
> education in anything cryptology to guy into your product.
>
> OK, at least we have your marketing plan down.
>
>> You are clearly a very detail-oriented person. You want to know
>> everything about whatever topic you dig into. There is nothing wrong
>> with that. There are many open source systems out there which allow
>> you to go through the code line-by-line and you can see everything it
>> does.
>
> Hardly detail oriented. Examining open source code isn't my cop of tea
> either.
>
> But I do believe in peer review and your rather flippant attitude "see
> you in Santiagoe" toward your code is utter ********.
>
> But, hey, there is a large market for morons who will trust their
> privacy with people like you so have at it. Expect to get zero
> credibility from anyone has any teensy bit of workable knowledge
> regarding encryption.
>
>> We are not that kind of company. We are a 'bring secure, convenient
>> communications to the masses' kind of company.
>
> You're a bring the bucks to John kinda company who hides behind single
> names and averts the honest intentions of prying eyes.
>
>> Different fits for different people.
>
> Most certainly but you can have your profits and your credibility as
> well. For whatever reason, none of which I can think of that is either
> honest or straightforward, Trulymail has decided to take the lowest of
> low roads.
>
> The only reasons you would do so are:
>
> 1) Trulymail is comprised of a set of waffling imbeciles.
> 2) You're crooked
>
> You see, transparency is the lifeblood of professional cryptology. The
> breast that feeds its reliability and innocence. You guys are as
> valuable as a tit on a boy pig.
>
> Now you are exposed which is a good thing for everyone including you.
> Repent. Turn away from the Dark Side.
>
> This "trust us, we're really good guys" is a bunch of hocus-pocus BS,
> it demeans you and it demeans your products.
>
> Remember Allende.
> --
> Ari's Fun Times!
> http://tr.im/hrFG
> Motto: Run, rabbit, Run!

[Bear Bottoms]

Ari Silverstein <AriSilverstein@yahoo.com> wrote in
news:8e4f2tFo5nU1@mid.individual.net:

> On Tue, 31 Aug 2010 01:42:07 -0700 (PDT), TrulyMail Support wrote:
>
>> On Aug 31, 12:10*pm, Ari Silverstein <AriSilverst...@yahoo.com> wrote:
>>
>>> Thanks for the info, John.
>>>
>>> What is you and your companies background in delivering and
>>> implementing encryption?
>>
>> TrulyMail (the company) has been around a short time (two years). Our
>> products include the TrulyMail Client and related TrulyMail services
>> (encrypted, private messaging, for example). We have been offering
>> these products for about two years now.
>>
>>> Who is "John", who are the investors, management and directors
>>> ofTrulymail?
>>
>> I am John (though, I am not the only one here named John). The
>> identities of our investors is not public information. Is this
>> something that is important for you to know? If so, may I ask why?
>
> If you're dealing with security products, especially without open
> source coding, /who/ you are and your background is extremely
> important.
>
> The fact that you ask this question is startling.
>
> And informative.

I installed this program three weeks ago and nobody has hacked my email yet.
Can you read my email? No. Good program.

--
Bear Bottoms
Freeware website: http://bearware.info

[Gordon Burditt]

>I am John (though, I am not the only one here named John). The
>identities of our investors is not public information. Is this
>something that is important for you to know? If so, may I ask why?

If someone wants to keep his mail private, he probably has an idea
*WHO* he most wants to keep it private from. For example:

- his wife and her lawyer
- other companies competing with his company in the field he's working on.
- nations unfriendly to his nation.
- anyone who might want to hold him for ransom or assassinate him
- anyone who might want to trade on insider information for profit

Designers of cryptosystems can leave in trap doors so they can read
the traffic. Especially if it's not open-source, you have to trust
them not to do so. Or sometimes it's done so their servers are the
ones that do the encryption/decryption in the first place (as is the
case for digital cell phones, so the cell phone companies handle the
cleartext).

It would be extremely prudent to try to determine if your investors are,
for example:

- The NSA, KGB, and Mossad
- Al Queda and similar terrorist groups
- North Korea, Iraq, and Iran
- A Columbian drug cartel
- TransUnion, Equifax, and Experian
- Organized crime

before using their cryptosystem.

[nemo_outis]

gordon@hammy.burditt.org (Gordon Burditt) wrote in
news:2radnZPtks1AVeDRnZ2dnUVZ_uWdnZ2d@posted.internetamerica:

> If someone wants to keep his mail private, he probably has
> an idea *WHO* he most wants to keep it private from. For
> example:
>
> - his wife and her lawyer
> - other companies competing with his company in the field
> he's working on. - nations unfriendly to his nation.
> - anyone who might want to hold him for ransom or
> assassinate him - anyone who might want to trade on insider
> information for profit

Yes, a risk and consequence analysis, however informal and
unstructured, is a prudent idea. However, it's not likely
that any prudent man, even though untutored in the intricacies
of encryption, would entrust TrulyMail with really serious
matters where disclosre could have severely adverse
consequences. TrulyMail is plainly intended for more light-
duty matters of ordinary privacy.

Perhaps the best analogy is that if ordinary mail is
equivalent to a postcard that anyone can read, then TrulyMail
would provide protection equivalent to a letter enclosed in an
envelope. Better privacy, yes, but far from impregnable
security. Ordinary privacy, not bombproof spy-versus-spy
privacy.


> Designers of cryptosystems can leave in trap doors so they
> can read the traffic. Especially if it's not open-source,
> you have to trust them not to do so. Or sometimes it's
> done so their servers are the ones that do the
> encryption/decryption in the first place (as is the case
> for digital cell phones, so the cell phone companies handle
> the cleartext).
>
> It would be extremely prudent to try to determine if your
> investors are, for example:
>
> - The NSA, KGB, and Mossad
> - Al Queda and similar terrorist groups
> - North Korea, Iraq, and Iran
> - A Columbian drug cartel
> - TransUnion, Equifax, and Experian
> - Organized crime
>
> before using their cryptosystem.

A lovely idea. How the flying **** would you suggest an
ordinary person - the kind of person that TrulyMail is clearly
intended for - would go about doing anything of the sort? Are
you seriously suggesting that Mossad or the NSA could not
disguise the true principals of such a company from the
investigations of all but an equally well-resourced agency?
Hogwash!

Have you considered how many "trust relationships" you have in
your life? from a contractor putting a roof on your house, to
the girl you dated and married, to the oncoming drivers in the
other lane every morning commute? Are you sure your
greengrocer isn't poisoning you? Have you vetted him? Do you
know his grandmother's maiden name?

Do you run a full background check of the airline pilot before
you board a flight or do you just "trust" in the mechanisms of
the airline to do this? And how thorough are they? - even if
they did a good job initially, perhaps the pilot has become
sucicidally depressed of late?

In short, there are a gazillion trust relationships you rely
upon every day of your life - trust relationships that could
portentially have far more adverse consequences than disclosed
email. Let's not obsess about cryptographic mechanisms - some
folks just want a little better privacy than open email.

Regards,

[Ari Silverstein]

On Wed, 01 Sep 2010 04:20:44 GMT, nemo_outis wrote:

> gordon@hammy.burditt.org (Gordon Burditt) wrote in
> news:2radnZPtks1AVeDRnZ2dnUVZ_uWdnZ2d@posted.internetamerica:
>
>> If someone wants to keep his mail private, he probably has
>> an idea *WHO* he most wants to keep it private from. For
>> example:
>>
>> - his wife and her lawyer
>> - other companies competing with his company in the field
>> he's working on. - nations unfriendly to his nation.
>> - anyone who might want to hold him for ransom or
>> assassinate him - anyone who might want to trade on insider
>> information for profit
>
> Yes, a risk and consequence analysis, however informal and
> unstructured, is a prudent idea. However, it's not likely
> that any prudent man, even though untutored in the intricacies
> of encryption, would entrust TrulyMail with really serious
> matters where disclosre could have severely adverse
> consequences. TrulyMail is plainly intended for more light-
> duty matters of ordinary privacy.

Untutored men have no prudence when examining the trust factor of
Trulymail. By definition. They are conned into believing Trulymail and
Trulymail alike products actually do what they exorbitantly claim to
do.

But you knew that. Why the falsehoods, the lies and the deceit from
you?

> Perhaps the best analogy is that if ordinary mail is
> equivalent to a postcard that anyone can read, then TrulyMail
> would provide protection equivalent to a letter enclosed in an
> envelope. Better privacy, yes, but far from impregnable
> security. Ordinary privacy, not bombproof spy-versus-spy
> privacy.

There is nothing, nothing at all, zero, nada, that corroborates this
proclamation of yours. Nothing from you, certainly nothing from closed
lipped, tightly concealed, "working in the shadows" Trulymail.

There were times on thse forums, outis, where you were so much more
truthful, foregoing and inquisitive. Why the falsehoods, the lies and
the deceit from you?

> How the flying **** would you suggest an
> ordinary person - the kind of person that TrulyMail is clearly
> intended for - would go about doing anything of the sort? Are
> you seriously suggesting that Mossad or the NSA could not
> disguise the true principals of such a company from the
> investigations of all but an equally well-resourced agency?
> Hogwash!

No one suggests anything other than that. Which is not the point and,
again, you know that. Why the falsehoods, the lies and the deceit from
you?

It is incumbent on any crypto system provider to be all in or all out
if they are ethical and true purveyors of privacy. What might be
private to one person (a sentimental note to a friend) and private to
another (overthrow of a government) is inconsequential to the privacy
goals of the user. They buy Trulymail to be assured that regardless of
their messages *their commo is private*.

Trulymail fails this test in spades. MOF, there is no test for
Trulymail which is by many magnitudes a much greater indiscretion.

> In short, there are a gazillion trust relationships you rely
> upon every day of your life - trust relationships that could
> portentially have far more adverse consequences than disclosed
> email. Let's not obsess about cryptographic mechanisms - some
> folks just want a little better privacy than open email.

What a hypocritical oaf you are. you fashion arguments to meet your
personal agendas. In this case, it is to attack me.

Let's look at neom outis when he had a pair and not consumed with
emotional issues and insane rants.

"Ok, I've given you some high-level stuff to think about; now I'm
going to give you some specifics.

The first is regarding encryption. This is the main line of
defence in preserving computer security/privacy. There are a lot
of different approaches out there, some of which are suspect, and
some of which are downright snakeoil. For instance, Microsoft's
encrypting file system for NTFS (available as part of Windows
NT/2k/2k3/XP) is easy to implement incorrectly (e.g., leave key
on HD), has inherent flaws (e.g., is not OTFE) and many suspect
there are backdoors put in it for law enforcement."

http://preview.tinyurl.com/29php9v

And dozens more like this.

Yet you are willing to cut Trulymail a pass card because...well, hell,
because why? They have already admitted to having zero expertise in
implementing encryption yet you blither and blather on in their
defense?

Gee, maybe I should shutup and let you defend their snake oil.
--
Talk about F-Cars - www.ferrarichat.com/forum/member.php?u=89702

[nemo_outis]

Ari Silverstein <AriSilverstein@yahoo.com> wrote in
news:8e69t4FoiuU1@mid.individual.net:

You still here? You were dismissed.

[Ari Silverstein]

On Tue, 31 Aug 2010 22:30:37 -0500, Gordon Burditt wrote:

>>I am John (though, I am not the only one here named John). The
>>identities of our investors is not public information. Is this
>>something that is important for you to know? If so, may I ask why?
>
> If someone wants to keep his mail private, he probably has an idea
> *WHO* he most wants to keep it private from. For example:
>
> - his wife and her lawyer
> - other companies competing with his company in the field he's working on.
> - nations unfriendly to his nation.
> - anyone who might want to hold him for ransom or assassinate him
> - anyone who might want to trade on insider information for profit

Or you might say that they perceive different levels of capabilities
of their adversaries and adjust accordingly.

The Trulymail model has no verifiable privacy against any of your
adversaries mentioned. For all anyone knows, they could read emails,
contact your adversaries and sell their info.

Very lucrative, btw.

[Mr. B]

Ari Silverstein wrote:

> On Mon, 30 Aug 2010 21:50:58 -0700 (PDT), TrulyMail Support wrote:
>
>>> Looks fairly interesting, but I'd like a lot more info on who they
>>> are....
>>
>> I'm John from TrulyMail Support. What would you like to know about us?
>>
>> The short version is that we are a Chilean company and we offer a
>> secure, powerful, easy-to-use, email client which includes
>> automatically encrypted messages between TrulyMail users (and optional
>> encryption between email users) along with many other features. Our
>> system is quite rich and you can read more about it here:
>> http://trulymail.com/Features.aspx

1. Where is the source code? It would be nice if we could see what you mean
when you say "strong key encryption."
2. Why should we use this when we can already send encrypted email, and when
we have been doing so for a long time now? What exactly does your software
bring to the table, and why should we sacrifice compatibility with existing
cryptosystems?

-- B

[TrulyMail Support]

<<< my apologies if this post gets repeated, the reply function was
not working as I expected >>>

> 1. Where is the source code? It would be nice if we could see what you mean
> when you say "strong key encryption."

TrulyMail is not open-source (at least not at this time). Accordingly,
our source code is not available to the public. If you would like to
audit our source code, we would be happy to show you some key parts of
it if you are ever in Santiago.

For us, strong-key means 4096-bit keys. That's quite a bit higher than
what is offered by PGP and others.

> 2. Why should we use this when we can already send encrypted email, and when
> we have been doing so for a long time now?

If you have a system you like, keep using it. We feel there are plenty
of users who do not encrypt now who should and will, if we make it
easy enough for them.

> What exactly does your software
> bring to the table, and why should we sacrifice compatibility with existing
> cryptosystems?

While we think we bring a lot to the table (see our features page on
our website: http://trulymail.com/Features.aspx) we also understand
that there are users who prefer to stick to the systems they already
know.

You have a choice. We think we are a great choice but it all depends
on your needs.

[Ari Silverstein]

On Tue, 31 Aug 2010 07:07:27 -0700 (PDT), TrulyMail Support wrote:

> <<< my apologies if this post gets repeated, the reply function was
> not working as I expected >>>
>
>> 1. Where is the source code? It would be nice if we could see what you mean
>> when you say "strong key encryption."
>
> TrulyMail is not open-source (at least not at this time). Accordingly,
> our source code is not available to the public. If you would like to
> audit our source code, we would be happy to show you some key parts of
> it if you are ever in Santiago.

*LOL*

What a crock.

> For us, strong-key means 4096-bit keys. That's quite a bit higher than
> what is offered by PGP and others.

If your implementation sucks, it doesn't matter if you have 400,096
megabit keys.

>> 2. Why should we use this when we can already send encrypted email, and when
>> we have been doing so for a long time now?
>
> If you have a system you like, keep using it. We feel there are plenty
> of users who do not encrypt now who should and will, if we make it
> easy enough for them.

> You have a choice. We think we are a great choice but it all depends
> on your needs.

I chose to pass.

Quickly, completely and what may be forever.
--
"You can't trust code that you did not totally create yourself"
Ken Thompson "Reflections on Trusting Trust"

[TrulyMail Support]

> > ...we would be happy to show you some key parts of
> > it if you are ever in Santiago.
>
> *LOL*
>
> What a crock.

It is clear that you would be best served by an open-source solution.
If you believe everyone is best served by the same thing, you should
hear some horror stories of our users about trying to get encrypted
email to work when they used GPG and their broker used PGP. The short
version is that in the end, they gave up and used clear-text email -
far less than ideal.

> If your implementation sucks, it doesn't matter if you have 400,096
> megabit keys.

You're welcome to try to decrypt our messages. I'll buy you a nice
dinner if you can do it.

> I chose to pass.

You get to. Good luck to you, sir.

[Ari Silverstein]

On Tue, 31 Aug 2010 07:58:02 -0700 (PDT), TrulyMail Support wrote:

>>> ...we would be happy to show you some key parts of
>>> it if you are ever in Santiago.
>>
>> *LOL*
>>
>> What a crock.
>
> It is clear that you would be best served by an open-source solution.
> If you believe everyone is best served by the same thing, you should
> hear some horror stories of our users about trying to get encrypted
> email to work when they used GPG and their broker used PGP. The short
> version is that in the end, they gave up and used clear-text email -
> far less than ideal.

Oh I see so the alternative is to "trust you" and your Wizard of Oz
act behind your curtain?

Har.

You could be a honeypot, a NSA/CIA front company, a terrorist node and
a whole lot of other much nastier things than a clear text email
provider.

>> If your implementation sucks, it doesn't matter if you have 400,096
>> megabit keys.
>
> You're welcome to try to decrypt our messages. I'll buy you a nice
> dinner if you can do it.

I won't be in Santiago anytime soon. Offer rings as hollow as your
unknown implementation of this "encryption" you have.

>> I chose to pass.
>
> You get to. Good luck to you, sir.

None to you.
--
Just Say Now!
http://firedoglake.com/justsaynow

[=?utf-8?Q?B=E2=84=AEar_Bottoms?=]

On Tue, 31 Aug 2010 07:07:27 -0700 (PDT), TrulyMail Support wrote:

> If you would like to
> audit our source code, we would be happy to show you some key parts of
> it if you are ever in Santiago.

I often fly down to South America.

How about next Tuesday?

--
Bâ„®ar Bottoms

[TrulyMail Support]

On Aug 31, 11:08Â*pm, Bâ„®ar Bottoms <bearbotto...@gmai.invalid> wrote:
> On Tue, 31 Aug 2010 07:07:27 -0700 (PDT),TrulyMailSupport wrote:
> > If you would like to
> > audit our source code, we would be happy to show you some key parts of
> > it if you are ever in Santiago.
>
> I often fly down to South America.
>
> How about next Tuesday?

I'm not free on Tuesday but I'm free that Friday. Will that work for
you?