"Users who try to use anonymity, or cover themselves up on the internet, are usually doing things that aren’t so-to-speak legal; we have the right to terminate, fine, or suspend your account at anytime due to you violating the rules -- Do you have any other questions? Thank you for contacting Comcast." Read the rest
Andrew Lewman, head of operations for The Onion Router (TOR), an anonymity and privacy tool that is particularly loathed by the spy agencies' capos, credits Tor's anonymous bug-reporting system for giving spies a safe way to report bugs in Tor that would otherwise be weaponized to attack Tor's users. Read the rest
Tor (The Onion Router) is a military-grade, secure tool for increasing the privacy and anonymity of your communications; but it's been the subject of plenty of fear, uncertainty and doubt.
The Electronic Frontier Foundation's 7 Things You Should Know About Tor debunks some of the most common myths about the service (which even the NSA can't break) and raises some important points about Tor's limitations.
Open Wireless Movement, a joint project of the Electronic Frontier Foundation, Fight for the Future, Mozilla, Free Press and others, will reveal its sharing-friendly wifi router firmware at the HOPE X conference in NYC next month. The openwireless operating system allows you to portion out some of your bandwidth to share freely with your neighbors and passersby, while providing a high degree of security and privacy for your own communications.
The Open Wireless Movement's goals are to both encourage the neighborliness that you get from sharing in your community, and undermining the idea that an IP address can be used to identify a person, establishing a global system of anonymous Internet connectivity. The project includes an excellent FAQ on the myths and facts about your legal liability for things that other people do with your network. Read the rest
Piratebox, a great project for making standalone wireless fileservers, has gone 1.0. The 1.0 has a slick 4chan-style message board, a responsive UI, and does UPnP discovery for your file-sharing needs. Combined with cheap wireless gear and a little battery, it's a perfect file-sharing boxlet that you can take anywhere in order to share anything -- for example, buskers could use it to distribute copies of their music to watchers. Piratebox is the technology that underlies Librarybox, a fork that is specialized for use by libraries and archives. Read the rest
Michael from Beta Boston writes, "The privacy protections offered by tools like Tor aren't just for journalists and spies; they're important for everyone. Almost every modern abusive relationship has a digital component, from cyberstalking to hacking phones, emails, and social media accounts, but women's shelters increasingly have found themselves on the defensive, ill-equipped to manage and protect their clients from increasingly sophisticated threats. Recently the Tor Project stepped in to help change that, and we took a long look at the work cut out for them."
This is an important point: when you make it so that no one can keep secrets from the state and its enforcement arm, you also make it so that no one can keep secrets from crooks, thugs, stalkers, and every other kind of bad guy. Read the rest
TAILS -- The Amnesiac Incognito Live System -- is a highly secure operating system intended to be booted from an external USB stick without leaving behind any trace of your activity on either your computer or the drive. It comes with a full suite multimedia creation, communications, and utility software, all configured to be as secure as possible out of the box.
It was Edward Snowden's tradecraft tool of choice for harvesting and exfiltrating NSA documents. Yesterday, it went 1.0. If you need to turn a computer whose operating system you don't trust into one that you can use with confidence, download the free disk image. (Note: TAILS won't help you defend against hardware keyloggers, hidden CCTVs inside the computer, or some deep malware hidden in the BIOS). It's free as in speech and free as in beer, and anyone can (and should) audit it.
Google has changed the commenting system on YouTube so that you need to be a Google Plus user to post; the new system uses algorithms to promote some comments above others, and has the perverse effect of making trolls more visible. Vi Hart, the incomparable math-vlogger (and a regular favorite around here) describes how Google's decision to double down on its flagging Facebook-alike G+ service by ramming YouTube users into it has made her lose faith in the service: now her regular, good commenters comments hover at the bottom of the pile, while hateful trolls whose messages generate a lot of replies are judged "good" by G+ and promoted to the top.
The promise of G+ in the beginning was that making people use their real names would incentivize them to behave themselves. It's abundantly clear now that there are more than enough people who are willing to be jerks under their real names. In the meantime, people who have good reason not to post under their own names -- vulnerable people, whistleblowers, others -- are now fully on display to those sociopaths who are only too happy to press the attack with or without anonymity. Read the rest
More information on the malicious software that infected Tor Browser through Freedom Hosting's servers, which were then seized by law-enforcement: it turns out that infected browsers called home to the NSA. Or, at least, to an IP block permanently assigned to the NSA. Read the rest
My latest Guardian column is "Data protection in the EU: the certainty of uncertainty," a look at the absurdity of having privacy rules that describes some data-sets as "anonymous" and others as "pseudonymous," while computer scientists in the real world are happily re-identifying "anonymous" data-sets with techniques that grow more sophisticated every day. The EU is being lobbied as never before on its new data protection rules, mostly by US IT giants, and the new rules have huge loopholes for "anonymous" and "pseudonymous" data that are violently disconnected from the best modern computer science theories. Either the people proposing these categories don't really care about privacy, or they don't know enough about it to be making up the rules -- either way, it's a bad scene.
Read the rest
Since the mid-noughties, de-anonymising has become a kind of full-contact sport for computer scientists, who keep blowing anonymisation schemes out of the water with clever re-identifying tricks. A recent paper in Nature Scientific Reports showed how the "anonymised" data from a European phone company (likely one in Belgium) could be re-identified with 95% accuracy, given only four points of data about each person (with only two data-points, more than half the users in the set could be re-identified).
Some will say this doesn't matter. They'll say that privacy is dead, or irrelevant, or unimportant. If you agree, remember this: the reason anonymisation and pseudonymisation are being contemplated in the General Data Protection Regulation is because its authors say that privacy is important, and worth preserving.
Part of the plot in Homeland revolves around "hidden services" on the Tor network. Now, a fan of mine in Norway called Tor Inge Røttum has set up a hidden service and stashed copies of all my books there. He writes:
A hidden service in Tor is a server, it can be any server, a web server, chat server, etc. A hidden service can only be accessed through Tor. When accessing a hidden service you don't need an exit node, which means that they are more secure than accessing the "clearnet" or the normal Internet (if you want). Because then the exit nodes can't snoop up what you are browsing. Hidden services are hard to locate as most of them aren't even connected to the clearnet.
I don't have any servers or computers that I can run 24/7 to host a hidden service, but fortunately there is a free webhost that is hosting websites on Tor: http://torhostg5s7pa2sn.onion.to
After creating the domain I wrote a dirty bash script to download most of Cory's books and create a HTML file linking to them. It's available on pastebin: http://pastebin.com/3YR6j8zJ
How cool is that? Read the rest
Gwern's "Using Silk Road" is a riveting, fantastically detailed account of the theory and practice of Silk Road, a Tor-anonymized drugs-and-other-stuff marketplace where transactions are generally conducted with BitCoins. Gwern explains in clear language how the service solves many of the collective action problems inherent to running illicit marketplaces without exposing the buyers and sellers to legal repercussions and simultaneously minimizing ripoffs from either side. It's a tale of remix-servers, escrows, economics, and rational risk calculus -- and dope.
But as any kidnapper knows, you can communicate your demands easily enough, but how do you drop off the victim and grab the suitcase of cash without being nabbed? This has been a severe security problem forever. And bitcoins go a long way towards resolving it. So the additional security from use of Bitcoin is nontrivial. As it happened, I already had some bitcoins. (Typically, one buys bitcoins on an exchange like Mt.Gox; the era of easy profitable "mining" passed long ago.) Tor was a little more tricky, but on my Debian system, it required simply following the official install guide: apt-get install the Tor and Polipo programs, stick in the proper config file, and then install the Torbutton. Alternately, one could use the Tor browser bundle which packages up the Tor daemon, proxy, and a web browser all configured to work together; I’ve never used it but I have heard it is convenient. (I also usually set my Tor installation to be a Tor server as well - this gives me both more anonymity, speeds up my connections since the first hop/connection is unnecessary, and helps the Tor network & community by donating bandwidth.)
The Dictator's Practical Guide to Internet Power Retention, Global Edition is a wry little 45-page booklet that is, superfically, a book of practical advice for totalitarian, autocratic and theocratic dictators who are looking for advice on how to shape their countries' Internet policy to ensure that the network doesn't loosen their grip on power.
Really, though, this is Laurier Rochon's very good critique of the state of Internet liberation technologies -- a critical analysis of what works, what needs work, and what doesn't work in the world of networked technologies that hope to serve as a force for democratization and self-determination.
It's also a literal playbook for using technology, policy, economics and propaganda to diffuse political dissent, neutralize opposition movements, and distract and de-politicize national populations. Rochon's device is an admirably compact and efficient means of setting out the similarities (and dissimilarities) in the Internet control programs used by Singapore, Iran, China, Azerbaijan, and other non-democratic states -- and the programs set in place by America and other "democratic" states in the name of fighting Wikileaks and piracy. Building on the work of such fierce and smart critics as Rebecca McKinnon (see my review of her book Consent of the Networked), The Dictator's Guide is a short, sharp look at the present and future of networked liberation.
Read the rest
Firstly, the country you rule must be somewhat "stable" politically. Understandably "stable" can be defined differently in different contexts. It is essential that the last few years (at least) have not seen too many demonstrations, protests questioning your legitimacy, unrest, political dissidence, etc.
In Juarez, we saw fearful human beings — sources — who need to get their information into the right hands. With our packet-switching mind-set, we realized that there may be a technological workaround to the fear: Sources don’t need to physically turn to corrupt authorities, distant journalists or diffuse nonprofits, and rely on their hope that the possible benefit is worth the risk of exposing themselves.
Technology can help intermediate this exchange, like servers passing packets on the Internet. Sources don’t need to pierce their anonymity. They don’t need to trust a single person or institution. Why can’t they simply throw encrypted packets into the network and let the tools move information to the right destinations?
In a sense, we are talking about dual crowdsourcing: Citizens crowdsource incident awareness up, and responders crowdsource justice down, nearly in real time. The trick is that anonymity is provided to everyone, although such a system would know a unique ID for every user to maintain records and provide rewards. This bare-bones model could take many forms: official and nonprofit first responders, investigative journalists, whistleblowers, neighborhood watches.
I'll be interested to hear what people in Juarez, and throughout Mexico, think of the editorial. Read the rest