In this episode of Yellow Hat Technology Podcast I was speaking with Olivier Gajek from Whiteout.io. Whiteout.io is Lavabit successor.

URL: https://whiteout.io/

Well, I think the interesting thing about our approach is that we’re very flexible. You can use our client with your existing email address, with your Gmail address, with your Yahoo address, with your existing IMAP server or you can use our complete service with the privacy oriented mailbox that encrypts everything, all of your messages in the cloud. That's what we're currently raising funds for at Indiegogo.

In this episode of Yellow Hat Technology Podcast I was speaking with Olivier Gajek from Whiteout.io. This is our conversation:

Hi Olivier how are you?

Fine, I’m fine. How are you?

Great! A subject over this episode will be Whiteout email encryption service you help to develop.

Yeah

In front of me I have your Indiegogo campaign.

Yeah

With the title "Whiteout: Email Privacy. Open Source. End-to-End." So let's speak one by one about this. What do you mean by email privacy?

Well the idea is to make sure that your emails are protected. You know, if you think about the information that we put out into the cloud and onto our mobile devices we put more and more information out there, where it's uniquely accessible, which is what we want:

Uniquely accessible to us but we also don't want it to be accessible to people who don't have any business getting to our information. That may be [what we lose it], that maybe a surveillance, that may be economical spies, that may just be break-ins.

So people wants to benefits of cloud mobile and ubiquitous information accessibility but they also want the protection. My personal feeling on the state of the industry is that we've given people great functionality in terms of cloud and mobile but we've given them miserable protection.

It's like at the car industry where we make very fast cars but we don't give them air bags at this time, we don't give them seat belts we don't give them...

Keys, keys from that car!

Yeah exactly. Exactly so all the doors are open as it were. So now we just, as an industry, as an information technology industry, we believe that we just need to at a whole level of protection to cloud, mobile.

We're starting with email because it turns out that email is probably the most important, the most ubiquitous and the most persons store for information that you have.

I'm not sure if you are familiar with Lalabit; if you are familiar with LaLaBit, I don't know... scandal?

Yes of course! So Lalabit, of course, a privacy focused email service using encryption to protect emails using, and I think that was the problem, a server-side encryption where you still have to trust the provider of the service and that's kind of the one big caveat: about who do you trust.

After the Lavabit shut down, after the Snowden revelations, I think a clear consensus among the security experts is that you need end-to-end encryption which means that the encryption happens on your device and that everything that travels across the wire into the cloud is in fact encrypted before it hits the wire.

So you don’t necessarily have to trust the cloud provider - that's the important thing. As long as you have some way to confirm that you have strong cryptography on your client machine – your desktop or your mobile - then you don't have to trust the cloud provider anymore.

And so end to end encryption really becomes the quality that people are asking for...

Yes, that’s the third point of your Indiegogo campaign title. So end-to-end mean there’s difference between Lalabit and Whiteout? Lalabit has keys on their home servers?

Exactly! There's always a tradeoff in security between convenience and security. You always have to choose where you make the trade off.

But the most extreme security is not to use any computers and there're certain people for whom that might be a very good idea :-)

On the other end of the spectrum, you just have people who don't have anything... who believe they have nothing to protect and who don't care about security at all, and value convenience above everything else.

So you have to make a trade-off and with the Lavabit model where you just had a webmail interface and at you just use the website and the application run on the server.

You know, that's replicating the delivery model of Gmail or Yahoo Mail. That’s certainly very convenient but it doesn't give you the security that you want.

The provider of the webmail can in fact compromise your account and that's not... you want to exclude that possibility. So then, you have to move the security versus convenience trade-off one more notch toward security and that means end- to-end encryption.

I also like how you compare an encrypted email to a postcard - a lot of people can see what's inside that message.

Is because you in fact handed it over to other people. You handed it over to other servers to transmit across a variety of connections.

In the olden days, when email was starting out, the message may have traveled across four, five, six, seven different servers. Today the servers connect directly but you don't really know who they connect to and how they connect.

And again the Snowden revelations - we learned that in fact well-known mail servers are very much targets for surveillance because everything shows up there.

This weakness, our feature, that everything shows up in regular email, when they were creating the protocol, they knew about this. Protocol was designed this way.

Well exactly, I mean, it's you have the conflicting requirements of being able to connect easily, being able to connect to a variety of systems that come from different manufacturers, so it has to be kind of an open protocol.

But at the same time, you know, people which are using that technology, they become concerned about a level of protection that makes sure that they stay in control of their other information.

Whoever sits on the lines, the optical lines, can see what's transferred around these lines.

Yeah exactly and that gives you know that that gives the opportunity for very, very comprehensive surveillance and just capturing everything. That's something a lot of people today are not comfortable with.

Especially in Germany, especially in Germany.

Well, that's excellent point. I think, that is not an accident. You know, What’s really surprising is that we use the PGP standard.

Standard, which has been around 20 years ago invented by Americans but most of the implementations available today are being maintained and developed by Germans. So that's kind of interesting anecdote.

Another point of your Indiegogo campaign is an open-source. So, your entire solution will be an open-source?

Yes, it's published and that's really also part of our reaction, and the general reaction, towards the Edwards Snowden.

I've been working in the security software industry for a long time and it’s very obvious to me that that with the insights of that Edward Snowden revealed, the laws have changed.

In the past it was an option to make a little bit of a security improvement as long as people used that security but today you really have to deliver trusted security trusted algorithms, you can not invent new algorithms.

Also you have to open-source your technology so that independent people, that the very small number of people that we all still trust, can take a look at your solution and pass judgment.

What’s your technical or carrier background?

Well, I myself coming from a software development background. I've been in the software industry now for over 25 years and my co-founders, who’re much younger than I am, come from a computer science background with a strong specialization in browser based Security.

Who’s in the team?

Co-founder Tankred Hase, Felix Hammerl, both here from Munich and Andris Reinman from Estonia.

Why to choose IndieGoGo and not Kickstarter?

We chosed IndieGoGo because they have a longer track history here in Europe. They've been here, I think, for over 2 years.

Kickstarter just came online in Germany this month, so we were more familiar with IndieGoGo.

Also campaign structures are different. On Kickstarter I have to make the funding threshold otherwise I have to give the money back. That wasn't really appropriate for us because we are already financed.

So we're just using IndieGoGo and the campaign to generate an early community of supporters and happy users and a little bit of financing contribution, but it wasn't the main goal.

So IndieGoGo has more flexible campaigns, better structured and it seemed more appropriate.

What else we should mention about Whiteout.io?

Well, I think the interesting thing about our approach is that we’re very flexible. You can use our client with your existing email address, with your Gmail address, with your Yahoo address, with your existing IMAP server or you can use our complete service with the privacy oriented mailbox that encrypts everything, all of your messages in the cloud. That's what we're currently raising funds for at IndieGoGo. So we're very excited about the feedback that we’re getting also from people sending us support.

33 days left, 53 people have supported you in 13 days - so send some money to Whiteout!

Yes please that’d be great!

What is your presence on social networks?

So we're on Twitter @WhiteoutIO, we're on Facebook and GitHub of course where we interact with the developer community and where we publish our source code.

That was Olivier Gajek from Whiteout. Thank you for your time.

And thank you very much.

And this was 6 episode of Yellow Hat Technology Podcast my name is Jasom Dotnet. Follow me on Twitter, Google+, YouTube, SoundCloud, LinkedIn. Download, listen, share.

Interviewee: Olivier Gajek

Category: Technology