SIGAINT

» see sigaint.org as it lived, on the wayback machine

~ the obit ~

SIGAINT was built by people who assumed every part of the stack was hostile. The web interface was SquirrelMail, chosen because it does not need JavaScript and therefore cannot be used to run anything on your machine. Passwords could not be recovered, because recovery means the operator knows something about you. A free account got fifty megabytes and expired after a year of silence. Paid accounts added IMAP and full disk encryption, and they never expired.

The two-address design was the clever part. Every inbox came with a sigaint.org address that accepted mail from the ordinary internet and a separate .onion address that only accepted mail from other Tor-enabled services. If you cared about the difference, the difference was visible in the address you handed out. Security writers recommended it. So did operational security guides that later turned up in places nobody wanted them.

Then in February 2017 it simply stopped. The .org and the onion both answered 500, week after week, and the people who ran it never posted anything anywhere.

~ the rap sheet ~

~ the seventy exit nodes ~

April 2015 was the one time SIGAINT's operators talked publicly, and it was because somebody had come for their users. Roughly seventy malicious Tor exit nodes were rewriting the clearnet page so that its link to the hidden service pointed at an impostor onion address, harvesting logins from anyone who followed it. The administrator told Motherboard the hidden service itself was never broken into and that the scale of the operation suggested a government rather than a criminal. SSL went on the gateway afterward.

That incident is the reason the 2017 disappearance reads the way it does. The service had already been probed by someone with resources, and then two years later it went quiet in a way that looked nothing like a hosting bill going unpaid.

~ the part nobody solved ~

The Register wrote it up on 2 March 2017 with the honest headline, which was that SIGAINT was in the dark and so was everybody else. A Reddit thread from the period has a user offering ten thousand dollars for a download of their own messages and saying, plainly, that they had stored their entire life in that inbox. No seizure banner ever went up, which is what usually happens when law enforcement takes a hidden service. No exit statement either, which is what usually happens when operators walk away on purpose.

Both of those absences are evidence of nothing. That is the condition SIGAINT left its users in, and nine years later it has not improved. A mailbox with no password recovery and no operator you can write to is exactly as strong and exactly as fragile as the people running it, and one day in February they were gone.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »