https://guardianproject.info/ Recent content in About Guardian Project on Guardian Project Hugo -- gohugo.io Mon, 08 Feb 2010 06:08:34 -0400 https://guardianproject.info/apps/info.guardianproject.ripple/ Tue, 17 Dec 2024 06:26:42 +0000 https://guardianproject.info/apps/info.guardianproject.ripple/ https://guardianproject.info/2024/12/06/seeking-ruby/jekyll-contractors-to-start-asap/ Fri, 06 Dec 2024 00:00:00 +0000 https://guardianproject.info/2024/12/06/seeking-ruby/jekyll-contractors-to-start-asap/ <p><strong>Guardian Project is seeking Ruby/Jekyll contractors for mobile/free software and privacy work!</strong></p> <p>We’re looking for self-motivated, free software hackers to work with Guardian Project on privacy and internet freedom for mobile devices. Our work is 100% free software and we have a steady stream of projects that tie into F-Droid, Debian, Android, Fastlane, Mobifree and other exciting projects. We work to support people and communities around the world. This is a flexible, remote position but we also like to work in person when possible.</p> <h2 id="about-you">About you</h2> <ul> <li><p>Have at least a few years of experience with Ruby/Jekyll.</p></li> <li><p>Demonstrated the ability to work collaboratively.</p></li> <li><p>Understand public, free software workflows</p></li> <li><p>Are proactive and self-directed.</p></li> <li><p>Fluent in Git.</p></li> </ul> <h2 id="bonus-points-for">Bonus points for</h2> <ul> <li><p>Debian (and derivatives)</p></li> <li><p>Experience with GitLab CI</p></li> <li><p>Python and bash skills</p></li> <li><p>Understanding privacy implications of metadata</p></li> <li><p>Life experiences that are underrepresented in tech work</p></li> <li><p>Fluency in more than one language</p></li> <li><p>User research and UX design</p></li> <li><p>Blogging and writing</p></li> </ul> <h2 id="about-us">About us</h2> <p>This is for projects managed by Hans-Christoph Steiner. We are centered in Vienna, Austria so ideally you work in a similar time zone, but that is not a requirement. We work in English but our team members speak many languages. This work is tied to specific projects and will be contracted per project.</p> <p>Please reply to jobs@guardianproject.info or find us in any of the regular channels!</p> https://guardianproject.info/apps/org.torproject.torbrowser_alpha/ Thu, 28 Nov 2024 06:48:03 +0000 https://guardianproject.info/apps/org.torproject.torbrowser_alpha/ https://guardianproject.info/apps/org.torproject.torbrowser/ Wed, 27 Nov 2024 06:45:06 +0000 https://guardianproject.info/apps/org.torproject.torbrowser/ https://guardianproject.info/2024/08/05/seeking-part-time-grant-administrator/ Mon, 05 Aug 2024 00:00:00 +0000 https://guardianproject.info/2024/08/05/seeking-part-time-grant-administrator/ <p>Location: Fully remote (African/European time zone) or Vienna, Austria.</p> <p>Type: Part-time contractor.</p> <h2 id="about-us">About us</h2> <p>Guardian Project is a small organization working to make a big impact in data privacy and secure communications. From the average person looking to use the internet and their mobile device more securely, to journalists needing to safely communicate with sources, to activists looking for secure communication channels, Guardian Project creates solutions that focus on privacy so you have true freedom.</p> <p>Since we started this work back in 2008, our team has grown significantly and our impact reach has as well. To help us scale our project even further, we are looking for a dynamic and skilled Grand Administrator to join our team. This role is crucial for the smooth operation of our contractor administration and the effective management of our grants and funding opportunities.</p> <p>This team is rooted in Vienna, Austria with a number of contractors around the world. We work mainly in English, our team members speak many languages. Work is contract-based but with the possibility to shift into full-time employment in the future.</p> <h2 id="what-you-ll-do">What you&rsquo;ll do</h2> <h3 id="support-our-contractors">Support our Contractors</h3> <p>Our team consists primarily of independent contractors, passionate about creating meaningful change through technological solutions. Our freelancers need your support in the following areas:</p> <ul> <li>Drafting and executing working contracts for new and existing team members</li> <li>Onboarding new team members and making them feel welcome, introducing them to our internal communication platforms</li> <li>Setting up email accounts</li> <li>Conducting monthly check-ins with team members to confirm the contract status and update records as necessary</li> <li>Process contractor invoices and liaise with our tax accountant</li> <li>Event planning and organizing our annual team retreat</li> </ul> <h3 id="grant-management">Grant Management</h3> <p>Since our organization&rsquo;s funding is partially dependent on grants, we are looking for someone to support us in all things grant management, including the following areas:</p> <ul> <li>Research and identify new upcoming grant and private funding opportunities relevant for our organization´s mission</li> <li>Inform and liaise with the team to assess suitability and requirements</li> <li>Prepare grant applications together with team support</li> <li>Build and sustain relationships with grant funders and partners</li> <li>Manage reporting requirements for various grants, ensuring all reporting is accurate and submitted on time</li> </ul> <h3 id="networking-and-relationship-management">Networking and Relationship Management</h3> <ul> <li>Stay up to date on industry events and networking opportunities to enhance visibility and outreach opportunities</li> <li>Attend industry conventions and gatherings to represent Guardian Project</li> <li>Manage leads for private funding opportunities and maintain relationships with existing and potential grant partners</li> <li>Liaise with other impactful technology and human rights organizations around the world and stakeholders at different levels</li> </ul> <h3 id="enhance-our-outreach-and-engagement">Enhance our Outreach and Engagement</h3> <ul> <li>Monitor our blog and social media accounts</li> <li>Curate relevant content on our online channels to engage our community and enhance our impact</li> </ul> <h2 id="who-you-are">Who You Are</h2> <ul> <li>Strong organizational skills with the ability to manage multiple tasks and deadlines effectively</li> <li>Results oriented and willing to expand your current skill set</li> <li>Excellent communication skills, both written and verbal, with a knack for relationship building and stakeholder management</li> <li>Comfortable working independently in a small team</li> <li>Proficient in using office and financial software, including MS Office and cloud-based document management.</li> <li>Detail-oriented with a high level of accuracy in handling administrative and financial duties.</li> </ul> <h3 id="it-s-a-bonus-if-you">It&rsquo;s a bonus if you</h3> <ul> <li>Have a Bachelor’s degree in Business Administration or Non-profit Management</li> <li>Have experience in grant writing and administration</li> <li>Have experience working in an international, multicultural team</li> <li>Are based in Vienna, Austria and can speak German</li> </ul> <h2 id="what-we-offer">What We Offer</h2> <ul> <li>A supportive and dynamic work environment where your work directly contributes to Guardian Project´s mission</li> <li>Flexible working hours and vacation time</li> <li>Fully or mostly remote work environment</li> <li>A great deal of autonomy and responsibility, with a huge impact on our organization</li> <li>A competitive hourly rate</li> <li>In-person team retreats and meet-ups</li> <li>Opportunities for professional development and growth within the organization</li> </ul> <h2 id="ready-to-apply">Ready to Apply?</h2> <p>Please send your resume and a cover letter explaining why you are a good fit for this position to <a href="mailto:jobs@guardianproject.info">jobs@guardianproject.info</a>. We aim to fill this position in September 2024. Join us in our mission to create a safer, more secure internet and mobile experience! We look forward to receiving your application!</p> https://guardianproject.info/2024/04/03/first-time-using-calyxos-review/ Wed, 03 Apr 2024 00:00:00 +0000 https://guardianproject.info/2024/04/03/first-time-using-calyxos-review/ <p>“But how are you planning on using the phone?” he asked me. I paused, a bit confused. “As a replacement for my iPhone. I want to do everything with this phone that I can do with my iPhone, and use it as I normally would.” He took a beat to respond, “Wow, alright. Well let&rsquo;s give it a shot.”</p> <p>I would describe myself as tech-curious, but the reality is I am not your typical CalyxOS user. In fact, I didn´t know CalyxOS existed until recently. I am not a software developer, I can´t write code and until recently, I never worked in tech. But none-the-less I found myself needing a replacement for my iPhone and asked HC if they could help me out.</p> <p>And in no time my refurbished Google Pixel 4a phone had arrived, loaded and ready to go with CalyxOS. So here is my very unprofessional review of how it went.</p> <p>I walked into the Calyx setup process with no expectations. Well, actually I take that back. I expected it to be similar to my 20-something years of iOS experience that I was used to. I expected there to be some sort of introduction and for some sort of apps to be pre-loaded into the phone. I of course knew that the apps and home screen from my old iPhone wouldn´t magically appear on my Google Pixel, and that I would need to manually download them if I wanted to keep using them on my new device. So I was prepared for that, but otherwise, I walked in blind.</p> <p><strong>First impressions</strong> The introduction and set up process went incredibly smoothly. It was a very similar experience to when I started up a new iPhone for the first time. I needed to select a language and location and then I needed to connect to wifi. So far so good, except that my wifi password is incredibly long and annoying. But that is on me, not Calyx.</p> <p>Date and time set up no problem. It accurately identified my general location and the recommended time-zone was correct.</p> <p>On to location services there were two options, one was automatically enabled, the other I needed to make a choice. If my memory serves, I don´t think I had this choice when setting up my iPhones in the past. I choose to allow apps to use my location that have asked my permission and kept going. I set up my pin and two fingerprints. This was all very similar to my older iOS phones. Then I encountered the <a href="https://microg.org/">microG</a> instructions.</p> <p><strong>What is MicroG?</strong> The microG explanation was helpful since I had no idea what microG does. For the uninitiated, it acts like an open source replacement for Google Play services and related software. But it only includes the “useful parts” and most interestingly, it does not have any advertising or location tracking, a bonus if you ask me.</p> <p><strong>Installing the Apps Bundle</strong> Then it was time to install the apps bundle. This was new, since usually the apps come pre-installed on my iPhone. But I thought it was nice that I had a choice here. In any case I left all apps selected and downloaded all of them. I will be doing write-ups on my experiences with those separately in case you want to follow along.</p> <p>As they were downloading, there was a useful description about each app, which was a very nice touch for the uninitiated. Because I will be honest, I did not recognize the majority of these apps.</p> <p>Next was a prompt asking if I wanted to restore a backup. Which I didn´t have, so I kept going to navigation.</p> <p><strong>Navigation Options</strong> Here I had two options, gesture navigation and 3-button navigation. I was not sure what the term gesture navigation meant initially, so the little animation explaining the swiping actions made it very clear. I thought, “Let´s keep this simple” and I went with 3-buttons and off we went to my phone´s home screen.</p> <p><strong>My new home with CalyxOS</strong> My first thought was, “I downloaded a whole bunch of apps, but where are they?” As an iOS user, I was used to seeing all the pre-installed apps just appear, so this threw me off but only for a second or two. I started swiping around on the screen and found them in no time by swiping upwards. But then I quickly realized I did not know what the majority of the apps do, so I would need to familiarize myself with them in order to use them.</p> <p>Some apps were more self explanatory than others. For example, the usual basic phone apps, camera, clock, contacts, music, phone, calculator were all very obvious. Then there were some new apps that I didn´t quite know what they did, but the title made it very obvious. For example, K-9 Mail, Riseup VPN, Firewall, Calyx VPN and the Aurora Store.</p> <p>A note about the Aurora Store. I saw the little Google Drive logo on the shopping bag, so I thought that might be a place where I can download my Google Play apps. But if I did not see that tiny logo, I might not have known to look there.</p> <p>F-Droid I knew as an app store from my previous work and I also recognized Tor Browser, Orbot and OnionShare. I kind of assumed those three were connected because all the logos were purple and there was an onion theme going on which I associated with Tor. So we can say in this case, the branding worked!</p> <p><strong>A wrinkle in the time-space continuum</strong> My only issue with the entire experience was that my location was around 600 kilometers off from my actual real-time location. No matter what app I used, Organic Maps, Google Maps, or SatStat, all said I was in some industrial area in a city 600 kilometers away from my house. In fact, they were so consistent that I thought, maybe it is a wrinkle in the time-space continuum and I really am in two places at once! All jokes aside, I reached out to the very helpful Calyx development team and they are helping me solve the <a href="https://gitlab.com/CalyxOS/calyxos/-/issues/2257">issue</a></p> <p>Who knows, at the end of the day it might be the hardware, since no one else has reported this bizarre issue and my phone was refurbished to begin with.</p> <p><strong>Final Thoughts</strong> All in all my experience unboxing and setting up a Calyx phone went very smoothly. And as a tech-curious user, with very little experience in software engineering, I can say it was a very easy switch from iOS to CalyxOS.</p> <p>CalyxOS gives you an alternative to big tech, without sacrificing usability. It gave me choices in terms of my data privacy that made me feel safe and more empowered. And it gave me a whole bundle of open source, privacy conscious apps to try out, so I can expand my horizons.</p> <p>Moving forward, I am curious to see more iOS and Android users migrate towards CalyxOS as a viable alternative.</p> https://guardianproject.info/2024/03/18/ietf119-conference-report-monday-march-18-2024/ Mon, 18 Mar 2024 00:00:00 +0000 https://guardianproject.info/2024/03/18/ietf119-conference-report-monday-march-18-2024/ <p><em>It&rsquo;s Opening Day of the <a href="https://www.ietf.org/how/meetings/119/">119th IETF meeting</a> in Brisbane Australia. This post commences a daily rundown of privacy and Internet Freedom activities at this IETF meeting. For the rundown on IETF119 Hackathon, see my <a href="https://guardianproject.info/2024/03/17/ietf119-hackathon-report/">Hackathon report</a></em></p> <h2 id="dispatch">Dispatch</h2> <p>IETF meetings don&rsquo;t often kick off with the open dispatch but this time it happened. Dispatch sessions are meant to help specification authors find a home for their work if a home isn&rsquo;t obvious. There are two classes of dispatch request:</p> <ul> <li>Smaller items that have been spun off from mature work. A good example is when a specification has a component that needs a formal record-type declaration.</li> <li>New work, possibly not yet well-defined, where the authors themselves haven&rsquo;t a clue where it belongs. This is somewhat rarer because IETF offers several mechanisms for new work to develop interest and work its way into the formal process.</li> </ul> <p>We got some of both this time. Unfortunately, the one that needs the most work is in the latter category and brought to IETF by a privacy-focused team. I need to write a separate post with a crisp definition of a better method for achieving success at the IETF because we can&rsquo;t make headway until hyptothetical participants learn from past mistakes (including my own).</p> <h2 id="cfrg">CFRG</h2> <p>There has a frightening amount of new cryptography coming into the IETF over the last three to five years, driving by privacy-preserving measurement, quantum computing and the endless search for better performance. Most of it entires IETF through the Cryptography Forum Research Group. It stikes me that this space is moving very quickly and I&rsquo;m concerned we&rsquo;re baking mistakes into Internet protocols in a way that will be hard to retrieve in the future.</p> <h2 id="ohttp">OHTTP</h2> <p>The Oblivious HTTP Application Intermediation (OHAI) Working Group has brought its key draft - <a href="https://datatracker.ietf.org/doc/draft-ietf-ohai-ohttp/10/">Oblivious HTTP</a> to RFC status as of January 25, 2024 (<a href="https://datatracker.ietf.org/doc/rfc9458/">RFC9458</a>). This was a focused effort, well-managed by the <a href="https://datatracker.ietf.org/wg/ohai/about/">Working Group</a> chairs.</p> <p>The Working Group remains in place to tackle future items that arise from the early deployments. Better handling of large data transactions is the first such item, giving rise to a new specification for <a href="https://datatracker.ietf.org/doc/draft-ietf-ohai-chunked-ohttp/">Chunked Oblivious HTTP Messages</a>.</p> <h2 id="hackathon-demo">Hackathon Demo</h2> <p>I presented the results from our interoperability testing on the <a href="https://datatracker.ietf.org/doc/draft-ietf-httpbis-unprompted-auth/">The HTTP Signature Authentication Scheme</a> to the wider IETF attendee audience at the Hackathon Demo event and felt lucky to have six people show interest (the competition being free food nearby).</p> https://guardianproject.info/2024/03/17/ietf119-conference-report-hackathon-march-17-2024/ Sun, 17 Mar 2024 00:00:00 +0000 https://guardianproject.info/2024/03/17/ietf119-conference-report-hackathon-march-17-2024/ <p><em>Hackathon Weekend at the <a href="https://www.ietf.org/how/meetings/119/">119th IETF meeting</a> in Brisbane Australia. This post commences a daily rundown of privacy and Internet Freedom activities at this IETF meeting.</em></p> <p>IETF&rsquo;s Hackathon, held at each face-to-face IETF meeting, is designed to encourage interoperability testing of standards under development. See this meeting&rsquo;s wiki page for a description of<a href="https://wiki.ietf.org/en/meeting/119/hackathon">this year&rsquo;s twenty-four projects</a>.</p> <p>The <a href="https://datatracker.ietf.org/doc/draft-ietf-httpbis-unprompted-auth/">The HTTP Signature Authentication Scheme</a> has been winding its way through the <a href="https://datatracker.ietf.org/wg/httpbis/charter/">HTTPbis Working Group</a> since being adopted as a Working Group draft in July 2022. This work proposes a mechanism by which HTTP servers can offer authenticated resources without telegraphing they do so (thus resisting probing attacks).</p> <p>Until very recently, Guardian Project had the <a href="https://gitlab.com/guardianproject/httpsignatureauthentation/-/tree/main/http-sigauth-java">only extant implementation</a> of this specification. It was originally demonstrated at the IETF113 (March 2022) Hackathon. That changed in the last month with new implementations by <a href="https://github.com/google/quiche/">Google</a> and <a href="https://github.com/francoismichel/http-signature-auth-go">Université catholique de Louvain</a>. We were able to pull together an interoperability test among these three for the Hackathon!</p> <p>Interoperability proved surprisingly easy, implying that each of the authors had the same understanding of the wording of the specification, at least for this baseline test. While we were unable to conduct a full pairwise test across the three server implementations and the three client implementations, we did get sufficient coverage to call it an early win. The testing team agreed more exercise will be necessary on the handling of the three supported HTTP versions as well as a variety of key related issues that will arise with the specification &ldquo;in practice&rdquo;. Still this effort seems technically solid.</p> <p>Potentially the most significant issue going forward is defining an approach to integrating this work into the prominent protocol stacks. Since HTTP and TLS have been in the field for more than a quarter century, their programming libraries have ossified (and narrowed) around conventional practices which does not support layer interaction in the manner necessary to support this work. In particular, this work uses the <a href="https://www.openssl.org/docs/man1.1.1/man3/SSL_export_keying_material.html">keying materials exporter</a> available at the TLS layer but not currently available in most HTTP layers where this spec needs the keying materials to create the proper HTTP authentication header. Time will tell.</p> https://guardianproject.info/2024/02/24/the-future-of-our-fdroid-compatible-app-repository/ Sat, 24 Feb 2024 00:00:00 +0000 https://guardianproject.info/2024/02/24/the-future-of-our-fdroid-compatible-app-repository/ <p>Guardian Project has been running its own <a href="https://guardianproject.info/fdroid/">fdroid-compatible app repository</a> since <a href="https://guardianproject.info/2012/03/15/our-new-f-droid-app-repository-out-of-date/">2012</a>. Up until now, we worked to ensure that our repository had the same standards of free software as the official F-Droid repository. Therefore, the Guardian Project repository was included in the official F-Droid client app by default. A lot has changed since then, for the better. F-Droid has long since stopped shipping pre-built binaries from any provider. Back in the day, F-Droid shipped some binaries, like Mozilla&rsquo;s Firefox APKs, and allowed some non-free libraries in apps. The free software ecosystem on Android has since blossomed, so F-Droid no longer needs to make those kinds of compromises. And F-Droid is completing a big update on how repositories are handled.</p> <p>Guardian Project remains committed to producing free software. But for some of our key use cases, it is unfortunately not yet possible to address them without including some proprietary libraries in our free software apps. This means that the Guardian Project repository is <a href="https://gitlab.com/fdroid/fdroidclient/-/merge_requests/1302">no longer included</a> in F-Droid by default. Now, F-Droid can enforce that apps only use free software libraries while Guardian Project cannot yet. This ties in nicely to two other key development efforts with the official F-Droid client app. First, the index signer keys for selected repositories are now <a href="https://gitlab.com/fdroid/fdroidclient/-/merge_requests/1296/diffs?commit_id=54e3975660f97c60ffdd038b1965a30822e033db">built-in</a>, that means that the client will automatically verify that the user added the real repository. Second, F-Droid <a href="https://gitlab.com/fdroid/fdroidclient/-/merge_requests?milestone_title=1.20">v1.20</a> will ship a massive overhaul of the core plumbing and user experience for adding, removing, and managing repositories. This makes it much easier and safer for users to use repositories that are not built-in.</p> <p>What kinds of exceptions does Guardian Project make? We still work to avoid as many kinds of tracking as possible. And the code that we create is free software. The exceptions are all related to proprietary libraries getting built into some of our apps:</p> <ul> <li>ProofMode uses a number of Google Play Services libraries, such as Play Integrity (SafetyNet), FusionLocationProvider, and others, to provide extra assurances about the provenance of media files generated on an Android device.</li> <li>Circulo and Haven use proprietary Google libraries to assist with accurately finding location and to display maps.</li> <li>Save (aka OpenArchive) needs to integrate with widespread proprietary services like Dropbox or Google Drive. When it is useful, we produce free software versions of our apps and get them included on <a href="https://f-droid.org/packages/net.opendasharchive.openarchive.release/">f-droid.org</a>.</li> <li>There is work underway to get Tor Browser <a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/27539#note_2989340">included</a> in f-droid.org. One key blocker has been a proprietary binary library that the build system is <a href="https://gitlab.com/guardianproject/fdroid-metadata/-/issues/3">including</a> anyway, even though it should be disabled in the build.</li> <li>Getting Orbot into f-droid.org is on our roadmap, it is already free software and otherwise compliant. We welcome help maintaining the <a href="https://gitlab.com/fdroid/fdroiddata/-/blob/master/metadata/org.torproject.android.yml">build metadata</a> in <em>fdroiddata</em>.</li> </ul> <p>We will continue to <a href="https://gitlab.com/guardianproject/fdroid-metadata/-/issues/4">mark</a> the apps in our repository with Anti-Features according to the <a href="https://f-droid.org/docs/Anti-Features/">F-Droid standard</a>. If you have found something we have overlooked, please <a href="https://gitlab.com/guardianproject/fdroid-metadata/-/issues">open an issue</a> so we can fix it. One side benefit of this change is that we can now also include some other important apps for privacy, until there are free software alternatives without any proprietary libraries. Firefox and Signal are two likely candidates, since both apps can be built as free software, but the official builds include proprietary libraries. In any case, any third party apps we might include here will have to meet the same standards as our own apps.</p> https://guardianproject.info/apps/org.torproject.torservices/ Fri, 23 Feb 2024 16:15:59 +0000 https://guardianproject.info/apps/org.torproject.torservices/ https://guardianproject.info/apps/org.witness.proofmode/ Tue, 13 Feb 2024 21:16:25 +0000 https://guardianproject.info/apps/org.witness.proofmode/ https://guardianproject.info/apps/org.torproject.android.ay/ Tue, 13 Feb 2024 21:16:21 +0000 https://guardianproject.info/apps/org.torproject.android.ay/ https://guardianproject.info/apps/org.torproject.android.guc/ Tue, 13 Feb 2024 21:16:21 +0000 https://guardianproject.info/apps/org.torproject.android.guc/ https://guardianproject.info/apps/org.torproject.android.gum/ Tue, 13 Feb 2024 21:16:21 +0000 https://guardianproject.info/apps/org.torproject.android.gum/ https://guardianproject.info/apps/org.torproject.android/ Tue, 13 Feb 2024 21:16:21 +0000 https://guardianproject.info/apps/org.torproject.android/ https://guardianproject.info/apps/org.torproject.android.pbb/ Tue, 13 Feb 2024 21:16:21 +0000 https://guardianproject.info/apps/org.torproject.android.pbb/ https://guardianproject.info/apps/org.torproject.android.tk/ Tue, 13 Feb 2024 21:16:21 +0000 https://guardianproject.info/apps/org.torproject.android.tk/ https://guardianproject.info/2023/11/10/quick-set-up-guide-for-encrypted-client-hello-ech/ Fri, 10 Nov 2023 00:00:00 +0000 https://guardianproject.info/2023/11/10/quick-set-up-guide-for-encrypted-client-hello-ech/ <p>The Encrypted Client Hello (ECH) mechanism <a href="https://tools.ietf.org/html/draft-ietf-tls-esni">draft-spec</a> is a way to plug a few privacy-holes that remain in the Transport Layer Security (TLS) protocol that&rsquo;s used as the security layer for the web. OpenSSL is a widely used library that provides an implementation of the TLS protocol. The <a href="https://defo.ie/">DEfO project</a> has developed an implementation of ECH for OpenSSL, and proof-of-concept implementations of various clients and servers that use OpenSSL, and other TLS libraries, as a demonstration and for interoperability testing. DEfO is funded by the Open Technology Fund (OTF).</p> <p>This guide is aimed at those who would like to try out ECH with our experimental Debian <em>unstable</em> packages for OpenSSL, <em>curl</em> and <em>nginx</em>. The DEfO project is making packages temporarily available so people can carry out such experiments before upstream maintainers include ECH in standard releases.</p> <p>This guide describes two set ups: one assumes that you want to setup everything (i.e. a web server and associated DNS authoritative server) on one virtual machine and a second describes a way to set up an ECH-enabled web server if you have an existing DNS configuration elsewhere. Many other configurations are of course possible. Comments/questions are welcome via <a href="mailto:info@defo.ie">email</a> or as GitLab issues/merge requests.</p> <p>In summary this guide shows how to: - find and install our Debian <em>unstable</em> packages - configure a minimal DNS setup (using dnsmasq or bind) that enables use of ECH from browsers - configure a minimal <em>nginx</em> setup for an ECH enabled web sites - test your DNS set up and that ECH is working</p> <p>We assume the reader is comfortable with simple DNS management and system administration tasks. When commands shown below should be run as <code>root</code> they are prepended with a &lsquo;#&rsquo;, if not they are prepended with a &lsquo;$&rsquo;.</p> <h2 id="install-packages">Install packages</h2> <p>You need to first have access to a virtual machine running Debian <em>unstable</em>. Many online resources describe many ways to do this.</p> <p>We start with an empty (minimal) Debian <em>unstable</em> system and install OpenSSL from the DEfO apt repository.</p> <pre><code class="language-bash"># apt install ca-certificates # echo &quot;deb [trusted=yes] https://defo.ie/debian/ ./&quot; &gt; /etc/apt/sources.list.d/defo.list # apt update # apt install openssl </code></pre> <h2 id="pick-some-dns-names-to-use">Pick some DNS names to use</h2> <p>In the text below we assume that the web server for which we wish to benefit from ECH is called <code>hidden.example.com</code></p> <p>ECH also involves a so-called <code>public_name</code> - that&rsquo;s present in the outer ClientHello when ECH is used and hence is visible to a network observer, unlike the server name we include inside the Encrypted Client Hello. The <code>public_name</code> we use below is <code>example.com</code>`</p> <p>You should obviously substitute your chosen DNS names.</p> <h2 id="generate-an-ech-key-pair">Generate an ECH key pair</h2> <p>For ECH to work, we need a new asymmetric key pair. (Different from those used for TLS server authentication), so next we generate an ECH key pair:</p> <pre><code class="language-bash"># mkdir /etc/echkeydir/ # openssl ech -public_name example.com -pemout /etc/echkeydir/example.pem.ech </code></pre> <p>Note that we need this file later to set up DNS as well as <em>nginx</em>. <em>Nginx</em> will make use of the private key from the ECH key file, whilst the DNS will be used to publish the corresponding public key in an HTTPS resource record (that&rsquo;s where ECH-enabled browsers will look for ECH public keys).</p> <p>The file name chosen should end with <code>.pem.ech</code></p> <h2 id="set-up-dns">Set up DNS</h2> <p>There are many ways in which one can set up the DNS records required to enable experimenting with ECH. We document two ways here, the first is where the main DNS name with which you&rsquo;re experimenting is newly registered DNS name and has no existing DNS set up. The second describes a case where a DNS name exists but we need to add some new resource records to enable ECH.</p> <p>In both cases, <code>&lt;IP&gt;</code> should be the IPv4 address for the host running the web server. (We leave IPv6 handling as an exercise for the reader, but there&rsquo;s nothing ECH-specific required for IPv6.)</p> <h3 id="standalone-new-setup-dnsmasq-as-a-authoritative-dns-server-to-serve-the-ech-key-on-the-same-vm">Standalone/New setup : dnsmasq as a authoritative DNS server to serve the ECH key (on the same VM)</h3> <p>In this case we also need to pick some DNS nameserver names, we assume the authoritative primary nameserver for both web server DNS names is <code>ns.example.com</code> with a secondary of <code>ns2.example.com</code>`</p> <p>The DNS set up to use starting from a clean dnsmasq install:</p> <pre><code class="language-bash"># apt install dnsmasq # cat &lt;&lt;EOF &gt; /etc/dnsmasq.d/example.conf no-resolv no-hosts auth-server=ns.example.com,ns2.example.com auth-zone=example.com auth-sec-servers=ns2.example.com auth-soa=42,admin.example.com host-record=example.com,&lt;IP&gt; host-record=hidden.example.com,&lt;IP&gt; dns-rr=hidden.example.com,65,&lt;ascii-hex encoded HTTPS rdata&gt; EOF # systemctl restart dnsmasq </code></pre> <p>Note that you need to bump the SOA version (42 in the above) every time you change the config and make sure the zone distributes to ns2.</p> <p>The <code>&lt;ascii-hex encoded HTTPS rdata&gt;</code> will be published as the HTTPS resource record (type == 65) for <code>hidden.example.com</code> and can be produced from the file we generated earlier via a shell script you can download and use as follows:</p> <pre><code class="language-bash">$ _curl_ https://raw.githubusercontent.com/sftcd/openssl/ECH-draft-13c/esnistuff/pem2rr.sh -o pem2rr.sh $ chmod u+x pem2rr.sh $ ./pem2rr.sh /etc/echkeydir/example.pem.ech 0001000005003b0039fe0d0035db0020002059907d619054c907a1f296ceb63dde1d57f72f15db172601a2f6b55e66e7cd0f00040001000100066261722e69650000 $ </code></pre> <h3 id="existing-dns-name-setup-using-bind-to-publish-new-ech-related-resource-records">Existing DNS name setup: using bind to publish new ECH related resource records</h3> <p>Let&rsquo;s assume you have an existing bind-based DNS setup for <code>example.com</code><code>, but are moving the IP address for that to a new VM that'll run the ECH-enabled web server for both</code>example.com<code>and</code>hidden.example.com`<code>. The change you might then make using the bind</code>nsupdate` command on the authoritative DNS server would then look like:</p> <ul> <li>Change/add IP address records for our DNS names.</li> </ul> <pre><code class="language-bind">$ sudo nsupdate -l &gt; update delete example.com a &gt; update delete example.com aaaa &gt; update add example.com 300 a &lt;IP&gt; &gt; update add hidden.example.com 300 a &lt;IP&gt; &gt; send &gt; quit $ </code></pre> <ul> <li>Add new HTTPS resource record for <code>hidden.example.com</code></li> </ul> <p>First we need to get the base64 encoded public from our <code>/etc/echkeydir/example.pem.ech</code> file:</p> <pre><code class="language-bash">$ tail -2 /etc/echkeydir/example.pem.ech | head -1 ADr+DQA2mQAgACAF7cLT+KtK0oR2DrRCGXmzBWM1eHgJgDEGLqL644/OcAAEAAEAAQAHaG9iYS5pZQAA $ </code></pre> <p>That base64 encoded value is what we need to publish in the DNS&hellip;</p> <pre><code class="language-bash">$ sudo nsupdate -l &gt; update delete hidden.example.com HTTPS &gt; update add hidden.example.com 300 HTTPS 1 . ech=&lt;base64-encoded-value&gt; &gt; send &gt; quit $ </code></pre> <h2 id="checking-your-dns-set-up">Checking your DNS set up</h2> <p>You can check that value is correctly published in the DNS e.g. using the <code>dig command</code>`:</p> <pre><code class="language-bash">$ dig +short https hidden.example.com 1 . ech=ADr+DQA2mQAgACAF7cLT+KtK0oR2DrRCGXmzBWM1eHgJgDEGLqL644/OcAAEAAEAAQAHaG9iYS5pZQAA $ </code></pre> <p>If your version of <code>dig</code> is older and doesn&rsquo;t know about HTTPS resource records, then you may need to check via:</p> <pre><code class="language-bash">$ dig +short +unknownformat -t TYPE65 hidden.example.com \# 67 0001000005003C003AFE0D0036990020002005EDC2D3F8AB4AD28476 0EB4421979B30563357878098031062EA2FAE38FCE70000400010001 0007686F62612E69650000 $ </code></pre> <p>The 2nd-last invocation of <code>dig</code> above shows the presentation format version of the HTTPS resource record. The last invocation above shows the equivalent in ascii-hex, which (minus the spaces) is what <code>dnsmasq</code> needs in it&rsquo;s configuration file.</p> <p>We assume <code>dnsmasq</code> will likely accept presentation format for HTTPS resource records in future as <code>bind</code> tooling already.</p> <h2 id="set-up-nginx-to-serve-an-outer-and-an-inner-hidden-website">Set up <em>nginx</em> to serve an outer and an inner (hidden) website</h2> <p>Install <em>nginx</em>-light from the DEfO repo, as above:</p> <pre><code class="language-bash"># apt install _nginx_-light certbot python3-certbot-_nginx_ </code></pre> <p>If you don&rsquo;t already have a web server config for <code>example.com</code> then you can create a basic pair of <code>sites-enabled</code> configuration files via the following commands:</p> <pre><code class="language-bash"># rm /etc/_nginx_/sites-enabled/default # cp /etc/_nginx_/sites-available/default /etc/_nginx_/sites-enabled/example.conf # sed -i 's/server_name _;/server_name example.com;/' /etc/_nginx_/sites-enabled/example.conf # echo &quot;ssl_echkeydir /etc/echkeydir/;&quot; &gt;&gt; /etc/_nginx_/sites-enabled/example.conf # cp /etc/_nginx_/sites-available/default /etc/_nginx_/sites-enabled/hidden.example.conf # sed -i -e 's/server_name _;/server_name hidden.example.com;/' -e sed 's/\(listen.*\)default_server;/\1;/' /etc/_nginx_/sites-enabled/hidden.example.conf # systemctl restart _nginx_ </code></pre> <p>It&rsquo;s possible the <code>sed</code> commands above may not work for you, e.g. if default files change, or perhaps you won&rsquo;t use those if you have an existing web server config for <code>example.com</code><code>. In that case you can simply edit the config files to ensure the following, before running</code>certbot``:</p> <ul> <li>you have <code>example.com</code> and <code>hidden.example.com</code> servers set up with correct <code>server_name</code>`</li> <li>optionally change the DocRoot (<code>root</code>) in these configuration files to serve different content</li> <li>there&rsquo;s a line within the <code>http</code> stanza as follows: <code>ssl_echkeydir /etc/echkeydir/;</code>`</li> <li>the <code>ssl_echkeydir</code> line can in <code>_nginx_.conf</code> within the <code>http</code> stanza or within either of the files in <code>sites-enabled</code> when it must be outside the <code>server</code> stanza</li> </ul> <h2 id="run-certbot-to-get-a-tls-server-certificate">Run certbot to get a TLS server certificate</h2> <p>Next you need to rRun <code>certbot</code> to get TLS server public keys certificates for both DNS names (<code>example.com` and `hidden.example.com</code>). Those can be in the same certificate (or not) for the purposes of this experimental setup.</p> <pre><code class="language-bash"># certbot --nginx ...iteractions... # </code></pre> <p><code>certbot</code> may prompt you for e.g. an email address or approval and if you have an existing certificate for <code>example.com</code> you may be prompted as to whether you want to add <code>hidden.example.com</code> to that certificate.</p> <h2 id="use-curl-to-test-the-set-up">Use <em>curl</em> to test the set up</h2> <p>Install our ECH-enabled <em>curl</em> package from the DEfO repo and run:</p> <pre><code class="language-bash">$ curl -v --ech true --doh-url https://1.1.1.1/dns-query https://hidden.example.com/ |&amp; grep Succeeded </code></pre> <p>You should see this in the output:</p> <pre><code class="language-bash">ECH: result: status is Succeeded, inner is hidden.example.com, outer is example.com </code></pre> <h2 id="check-with-browsers">Check with browsers</h2> <p>If you&rsquo;re running a recent browser version (chromium-based since version 105, firefox since before then:-) you can enable ECH in the browser by <a href="https://defo.ie/#clients">following our client configuration instructions</a>. Unfortunately, browsers don&rsquo;t provide user interface to show if ECH has succeeded or not, but you can verify that your browser is able to use ECH if you visit <a href="https://defo.ie/ech-check.php">https://defo.ie/ech-check.php</a>.</p> <h2 id="feedback">Feedback</h2> <p>All going well, you should now have an ECH-enabled web site and be able to extend/play with that as you like. We&rsquo;d appreciate feedback on this guide if you have a chance. As before, comments/questions are welcome via <a href="mailto:info@defo.ie">email</a> or as GitLab issues/merge requests.</p> https://guardianproject.info/2023/11/09/defo-developing-ech-for-openssl-round-two/ Thu, 09 Nov 2023 00:00:00 +0000 https://guardianproject.info/2023/11/09/defo-developing-ech-for-openssl-round-two/ <p>Encrypted ClientHello (ECH) plugs a privacy-hole in TLS, hiding previously visible details from network observers. The most important being the name of the web-site the client wishes to visit (the Server Name Indication or SNI). This can be a major privacy leak, like when accessing a dissident news source hosted on a Content Delivery Network (<a href="https://en.wikipedia.org/wiki/Content_delivery_network">CDN</a>). A visible domain name also provides a straightforward method for censors to block websites and internet services. <a href="https://www.tolerantnetworks.com/about-us.html">Tolerant Networks Limited</a> and the Guardian Project successfully ran the <a href="https://www.opentech.fund/">OTF</a>-funded <a href="https://defo.ie/">DEfO</a> project that <a href="https://guardianproject.info/2021/11/30/implementing-tls-encrypted-client-hello/">developed interoperable implementations</a> of ECH for OpenSSL, Conscrypt and, via those libraries, a range of ECH-enabled web servers and clients. This second funded project, DEfO-2, is a timely continuation of that project from the same the team. As needed for disambiguation, we use DEfO-1 to refer the completed project and DEfO-2 for this current project. When there’s no ambiguity, we use the DEfO acronym to cover both past and future work related to ECH for OpenSSL, related applications and other TLS stacks.</p> <p>As the IETF standard for ECH completes, our key objectives are to:</p> <ul> <li>Upstream DEfO code</li> <li>Integrate ECH into more clients and servers</li> <li>Gain and document operational experience</li> <li>Submit key code for red team audits</li> <li>Publish open-source ECH provisioning tools</li> </ul> <p>The key challenges we expect to face in meeting those objectives are: firstly, dealing with the OpenSSL and other upstream code bases (e.g. nginx, Apache HTTP Server) - satisfying upstream developers when dealing with complex code changes, as are involved here, has proven to be quite time and effort consuming. Secondly, it is a challenge to arrange the trials we have envisaged for DEfO-2 but doing so should help to demonstrate that web sites can easily and safely enable ECH without putting themselves at risk of interoperability failures or adverse attention from censors and without further centralising the web. Lastly, there are some remaining technical challenges not addressed in DEfO-1 (proprietary TLS ClientHello extension handling, interactions between TLS Hello Retry Request and ECH, and privacy analyses of split-mode ECH deployments) that we plan to address in DEfO-2.</p> <p>The key challenges we aim to mitigate for users is the ease with which user activity can be tracked and blocked based on clear text SNI. Secondarily, our focus on web-server integrations and provisioning mechanisms for ECH addresses Internet centralisation (which itself poses potential risks for censorship) by ensuring this technology can be easily deployed without having to depend on entities such as global-scale CDNs.</p> <p>The primary gaps addressed by DEfO are: the privacy-leak that is clear text SNI in TLS and secondly that nobody else has been developing an ECH implementation for OpenSSL, which is one of the most widely used TLS stacks, particularly for web servers. That situation has not changed since DEfO-1 started. Arguably filling that gap has become more pressing as some browsers now ship with ECH support.</p> <p>ECH is designed to contribute to the safety of users by removing one the the main remaining aspects of the web that allows network observers to easily monitor and censor web traffic based on either client DNS queries (browsers typically only use ECH when DoH has been used) and the Server Name Indication (SNI) in the TLS handshake, which is encrypted via ECH. The eventual goal is that use of ECH becomes near ubiquitous, and that goal is very achievable for web sites that make use of a CDN. DEfO however also has a focus on ECH support in various web servers and proxies (Apache, nginx, lighttpd, HAProxy) so that users of deployments that don’t use a commercial CDN can also benefit from ECH. The result of using ECH should be that neither the DNS query nor the TLS exchange leak the name of the web server with which the browser is establishing contact, thus taking away a still-easy opportunity for monitoring and censorship.</p> <p>Censors however, especially at the nation-state level, might choose to block all uses of ECH, which is something that is to be expected. The main mitigation for that envisaged is that browsers, even while not using ECH, will emit “fake” (or GREASEd) ECH values, thus increasing the costs if a censor decides to block all use of ECH. The extent to which GREASEing will be an effective mitigation for blocking all ECH will essentially end up as a political/commercial decision for censors, browser makers, and web sites, but what we can say is that for now at least, browser makers and the larger CDNs do seem committed to making use of ECH. So we can have some hope that even the most capable censors might have to think hard before blocking all ECH. In DEfO-2 we are also planning some significant-scale trials that, if successful, should go a long way towards helping other significant web sites overcome fears related to enabling ECH. Overcoming a fear that one’s web site may be blocked if one deploys ECH will be a valuable result of DEfO-2 should our trials come to fruition as we hope.</p> <p>We do see a number of usability issues for those deploying web servers that need to be addressed, and that we plan to address in DEfO-2. Our approach is to aim for the same level of usability for web server administrators as has been achieved by <a href="https://certbot.eff.org/"><em>certbot</em></a> as it interacts with Let&rsquo;s Encrypt or other CAs. Making it easy to enable ECH, especially for &ldquo;smaller&rdquo; web properties is high priority for DEfO.</p> <p>The outcome for which we hope is the upstreaming of ECH into important code bases, and to have demonstrated that one can deploy ECH easily at either small or large scale. The impact we expect is that we continue to significantly contribute to the use of ECH becoming near ubiquitous.</p> <h2 id="timeliness">Timeliness</h2> <p>The time is now ripe for DEfO-2:</p> <ul> <li><a href="https://support.mozilla.org/en-US/kb/faq-encrypted-client-hello">Firefox</a> now supports ECH by default.</li> <li>Chrome supports ECH in <a href="https://groups.google.com/a/chromium.org/g/blink-dev/c/KrPqrd-pO2M/m/_8Lfd5xcAwAJ">10% of stable releases</a> as of August 2023.</li> <li>Brave now also supports ECH, <a href="https://github.com/brave/brave-browser/issues/1851#issuecomment-1763176335">behind the same flags</a> as Chromium</li> <li>These browser developments, plus the server code developed by DEfO-1, now enable us to plan real-world experiments</li> <li>Cloudflare has <a href="https://developers.cloudflare.com/ssl/edge-certificates/ech/">beta support</a> for enabling ECH.</li> <li>During the run-time of DEfO-2 we expect to be in a position to run trials with significant players that could significantly assist with the goal of making use of ECH common for large web sites.</li> <li>The DEfO-2 project timeline should also cover the finalisation of the IETF specification for ECH, significant progress on ancillary specifications (e.g. for provisioning) and provide sufficient time for upstreaming of DEfO code</li> <li>DEfO-2 benefits from the same team as DEfO-1 – Tolerant Networks and the Guardian Project having co-operated successfully on DEfO-1 are looking forward to continuing that collaboration and to extending the team for DEfO-2</li> <li>HPKE, a core part of ECH, but with broader applicability, is now RFC9180 and the OpenSSL maintainers merged our DEfO code for HPKE in November 2022.</li> </ul> <h2 id="our-development-projects">Our development projects</h2> <p>The DEfO project implemented Encrypted ClientHello (ECH) support for OpenSSL and Conscrypt, carried out interoperability testing of those implementations, and also used those libraries to ECH-enable various web servers and clients. We deployed services using these web servers and the DNS infrastructure required to support automated key upated for the HTTPS RRs associated with those services. Here we provide a short overview of that work in order to help with larger scale experiments and with further development of the ECH specification.</p> <h3 id="libraries">Libraries</h3> <p>As part of the DEfO project, we ECH-enabled two important TLS libraries:</p> <ul> <li><a href="https://www.conscrypt.org/">Conscrypt</a> is a Java Security Provide (a library) that provides a Java &ldquo;wrapper&rdquo; for the C++ language boringssl library. Conscrypt is commonly used as the TLS provider for applications running on Android devices and is thus an attractive target to allow many clients to be ECH-enabled. (We do not target browser clients in DEfO as work on ECH-enabling those is being done by browser-makers.) The authors of boringssl (Google) have added ECH support to a version of their code, and we used that to enhance Conscrypt to call the new borinssl APIs required to use ECH and to provide mechanisms for applications to default to, or signal use of, ECH.</li> <li>OpenSSL is a long-lived library providing cryptographic and TLS services that is used by many applications, including many web servers and hence is an attractive target for ECH-enabling, especially for server-side functionality. Our ECH-enabled fork of OpenSSL is here.</li> <li>We have and will continue to work with the developers of other TLS libraries (e.g. wolfSSL) to assist in ECH-enabling their code, mostly via interoperability testing.</li> </ul> <h3 id="clients">Clients</h3> <p>We ECH-enabled implemented the following TLS client applications:</p> <ul> <li>OpenSSL <code>s_client</code> - this client application comes as part of the OpenSSL build but is commonly used for testing and as an extremely simple scriptable TLS client.</li> <li><em>curl</em> is a widely-used command line web client that can use OpenSSL for TLS support, so we <a href="https://github.com/sftcd/curl/blob/ECH-experimental/docs/ECH.md">ECH-enabled that</a>.</li> <li>F-Droid is an Android client application that provides an installable catalogue of FOSS applications and that uses Conscrypt. We made an ECH-enabled build called <a href="https://f-droid.org/packages/ie.defo.ech_apps/">DEfO ECH Apps</a></li> </ul> <h3 id="servers">Servers</h3> <p>We ECH-enabled implemented the following web servers:</p> <ul> <li>The Apache HTTP Server is one of the two most commonly used web servers today, you can try our <a href="https://github.com/sftcd/httpd">ECH-enabled fork</a>.</li> <li><em>nginx</em> is the other web server in the &ldquo;top two.&rdquo;, you can try our <a href="https://github.com/sftcd/nginx">ECH-enabled fork</a>.</li> <li>lighttpd is a web server that is commonly used on smaller devices such as home routers, you can try our <a href="https://github.com/sftcd/lighttpd1.4">ECH-enabled fork</a>.</li> <li>HAProxy is widely used as an HTTP ingress proxy and so is a good target for exploring ECH split-mode, you can try our <a href="https://github.com/sftcd/haproxy">ECH-enabled fork</a>.</li> <li>OpenSSL <code>s_server</code> - this example server application is part of the OpenSSL build and is commonly used for testing and experimentation.</li> </ul> <h3 id="test-tools">Test tools</h3> <p>Amongst the test tooling we developed are:</p> <ul> <li>Comprehensive OpenSSL make test targets for HPKE and ECH.</li> <li><a href="https://github.com/defo-project/EchInteropTest">ECHInteropTest</a> is a Java client for interoperability testing on Android.</li> <li><a href="https://github.com/sftcd/echdnsfuzz"><em>echdnsfuzz</em></a> is a catalogue of &ldquo;interesting&rdquo; ECHConfigList values that could cause issues for clients combined with a service to randomly select one of those for publication in the public DNS every 30 minutes. This is a useful part of fuzz-testing an ECH-enabled client application.</li> </ul> <h2 id="issues-arising">Issues Arising</h2> <p>We saw the following issues that could benefit from further work to ease deployment of ECH:</p> <ul> <li>For HAProxy, since DEfO-1 we have achieved support for HelloRetryRequest in ECH split-mode but have further work to do on ECH key rotation.</li> <li>There can sometimes be a lack of clarity as to which software component should be responsible for choosing to attempt real (i.e. non-GREASEd) ECH, and hence to be responsible for the additional DNS queries required to acquire an ECHConfig. For libraries like OpenSSL and boringssl it clearly only makes sense for that decision (and hence any new DNS handling code) to be outside the library. For a browser, it as clearly makes sense for that code to be in the browser application layer. With &ldquo;middleware&rdquo; though, such as OkHTTP or Conscrypt it can be hard to know which is the correct decision.</li> <li>The new DNS code required for handling HTTPS RRs is not too complex but the full generality of SVCB is extremely complex. Adding such complexity (and associated caching) is a major change for clients like curl that have to date only had to have a very simple model for DNS - essentially only querying A/AAAA and having almost trivial caching in the application itself.</li> <li>The client implementation of ECH is relatively complex in that it &ldquo;touches&rdquo; the TLS state machine in many ways, and hence requires changes in a lot of places. As well as increasing the cost of implementing this also increases the costs associated with testing and upstreaming.</li> <li>Achieving the same level of usability as <code>certbot</code> for web server administrators may be challenging, but is an important goal to make it easy for web server administrators to be able to easily deploy ECH.</li> </ul> <h2 id="conclusions">Conclusions</h2> <p>ECH is demonstrably implementable and can be deployed. We don&rsquo;t yet know if new issues will become apparent as larger-scale experiments are carried out, but we should find out during the run-time of DEfO-2.</p> https://guardianproject.info/apps/info.guardianproject.pixelknot/ Wed, 08 Nov 2023 06:45:10 +0000 https://guardianproject.info/apps/info.guardianproject.pixelknot/ https://guardianproject.info/apps/info.guardianproject.pixelknot.sq/ Wed, 08 Nov 2023 06:45:10 +0000 https://guardianproject.info/apps/info.guardianproject.pixelknot.sq/ https://guardianproject.info/2023/11/03/fifa2023-report/ Fri, 03 Nov 2023 00:00:00 +0000 https://guardianproject.info/2023/11/03/fifa2023-report/ <p><a href="https://web.archive.org/web/20231102110707/https://internetfreedom.africa/">Forum on Internet Freedom in Africa (FIFAfrica)</a> organized by the <a href="https://web.archive.org/web/20231102060008/https://cipesa.org/">Collaboration on International ICT Policy for East and Southern Africa (CIPESA)</a> took place in September 26-29, 2023 in Dar es Salaam, Tanzania at the Hyatt Regency Hotel.</p> <p>The first two days - the <a href="https://web.archive.org/web/20231103185024/https://whova.com/embedded/event/rWwmoMGALzfjDBkAPdWzA1K4LxMjt38D6BmWiph4wK4%3D/generating/?refer=undefined&amp;day=0">26th</a> and <a href="https://web.archive.org/web/20231103185107/https://whova.com/embedded/event/rWwmoMGALzfjDBkAPdWzA1K4LxMjt38D6BmWiph4wK4%3D/generating/?refer=undefined&amp;day=1">27th</a> of September - were invite only. The rest of the days - <a href="https://web.archive.org/web/20231103185923/https://whova.com/embedded/event/rWwmoMGALzfjDBkAPdWzA1K4LxMjt38D6BmWiph4wK4%3D/generating/?refer=undefined&amp;day=2">28th</a> and <a href="https://web.archive.org/web/20231103190038/https://whova.com/embedded/event/rWwmoMGALzfjDBkAPdWzA1K4LxMjt38D6BmWiph4wK4%3D/generating/?refer=undefined&amp;day=3">29th</a> of September - were meant for all the other participating attendees.</p> <p>The theme of the event was &ldquo;The Internet Freedom we want for Africa&rdquo; which was highlighted during the <a href="https://web.archive.org/web/20231103190144/https://whova.com/embedded/session/rWwmoMGALzfjDBkAPdWzA1K4LxMjt38D6BmWiph4wK4%3D/3354886/?widget=primary">opening ceremony</a>. It was well organized with a dedicated media and photography team who did a great job in their coverage. Attendees and attending organizations were diverse coming from all over the world. They were not only limited to digital security folks but also there were attendees from academia, law, policy and government.</p> <p>Apart from the opening and closing ceremony, the event had multiple tracks (2 to 4) happening at a time. There were booths from where attending organizations would showcase what they were working on. The Guardian Project had one right in the middle of the <a href="https://web.archive.org/web/20231103190633/https://wearehorizontal.org/index">Horizontal</a> and <a href="https://web.archive.org/web/20210921162650/https://www.a11ylab.com/?lang=EN">Accessibility Labs</a> booths. Talk of being in good company :)</p> <p>The Guardian Project booth was a hub of activity for the two days. We were showcasing <a href="https://encirculo.org/en/">Circulo</a>, <a href="https://guardianproject.info/apps/org.witness.proofmode/">Proofmode</a>, <a href="https://likebutter.app/">Butterbox</a> and <a href="https://f-droid.org/en/">F-Droid</a>. The interest in what we do and the solutions we provide was so genuine that we ran out of business cards and stickers. Only a few people had heard of us and were super intrigued with our products that they had them installed on their devices to try them out. There was a <a href="https://web.archive.org/web/20231103194105/https://whova.com/embedded/session/rWwmoMGALzfjDBkAPdWzA1K4LxMjt38D6BmWiph4wK4%3D/3374537/?widget=primary">cocktail party</a> at the end of the day which was a good event for further networking with the other attendees.</p> <p>Our session, <a href="https://web.archive.org/web/20231103194507/https://whova.com/embedded/session/rWwmoMGALzfjDBkAPdWzA1K4LxMjt38D6BmWiph4wK4%3D/3354924/?widget=primary">Resilient Communications ButterBox, Proofmode and Circulo</a> was slotted on the last day at the very end of the day. We did not have a lot of attendees since most people were making the best of their time networking or were planning to leave. To thank the attendees of our session, Happy made a song about the products we were showcasing. Her performance was cut short as all participants were directed to the <a href="https://web.archive.org/web/20231103195433/https://whova.com/embedded/session/rWwmoMGALzfjDBkAPdWzA1K4LxMjt38D6BmWiph4wK4%3D/3354927/?widget=primary">closing ceremony</a>. It was all festive as they thanked the participants and then launched the <a href="https://web.archive.org/web/20231019180633/https://internetfreedom.africa/wp-content/uploads/2023/10/SIFA23-Report.pdf">State of Internet Freedom in Africa Report</a>.</p> <p>In conclusion, FIFAfrica 2023 was an awesome event. Lots of connections were made that have turned into friendships. The attendees were friendly and festive. The planning was splendid. We are looking forward to the next one in 2024. Thanks CIPESA.</p> https://guardianproject.info/2023/07/25/achieve-onion-layers-of-security-with-the-triad-of-apple-tizing-apps/ Tue, 25 Jul 2023 00:00:00 +0000 https://guardianproject.info/2023/07/25/achieve-onion-layers-of-security-with-the-triad-of-apple-tizing-apps/ <p><em>Our summer intern Alfred just graduated high-school and is preparing to attend a major university to focus on a technical degree. He has a personal interest in privacy and security, and is working with us on a variety of projects this summer as part of a broad, crash-course in all things Guardian Project!</em></p> <p>Last week, I worked with three different apps for the iPhone that, when they work together, allow for a secure and private mobile internet experience. Since they all build on the Tor Network, they also offer an untraceable way to share and download media. My task was to test the user experience in these apps and see how they interact with each other and to make sure that they’re working in the intended ways following a test plan.</p> <p>The first app Orbot, which acts as a secure vpn is the core of the security. It makes it very difficult to track the user when browsing. The first thing you want to do before you start browsing is to open the Orbot app and complete the setup with the vpn configuration.</p> <p><img src="image5.jpg" alt="orbot ios" /></p> <p>Once set up you could press start to use the default vpn or if you’d need more security you would click the ‘Choose how to Connect’ option below that and it’ll take you to a page where you can connect to an even more secure network because Orbot provides you with a network proxy. Choosing other options provides you with even more proxies making your ip or your browsing harder to detect or track.</p> <p><img src="image2.jpg" alt="orbot ios" /></p> <p>Now that you’ve activated the Orbot vpn you can access the Onion Browser where you can freely browse as if you were using your regular browsing app like Chrome or Safari but now with even more security and privacy.</p> <p><img src="onionbrowser.png" alt="onion browser app" /></p> <p>Then, I continued my testing with the Onion Share mobile app. This app allows you to freely and securely share media using a secure “.onion” download link, that can be opened by anyone with Onion Browser or Tor Browser.</p> <p><img src="image3.png" alt="onionshare for ios" /></p> <p>As you can see in the interface you can choose to send photos, files, or even whole folders to share media in. OnionShare then creates a link that can only be accessed through using any Tor-enabled web browser, such as Onion Browser or Tor Browser. You can then download the files and view them as normal.</p> <p>This is the screen you’re greeted with when launching Tor Browser on the desktop. As you can see the interface resembles that of a normal browser. When connected to the Tor now, you’re able to open up links from OnionShare which can’t be opened anywhere else.</p> <p><img src="image1.png" alt="tor browser on desktop" /></p> <p>This is what the OnionShare screen on the desktop looks like using the Tor Browser. From here you can select to download the files and view them.</p> <p><img src="image4.png" alt="tor browser on desktop" /></p> <p>I think it&rsquo;s interesting and very helpful how the usage of the combination of these apps not only provides you a secure browsing experience but also allows you to share different forms of media while also making it incredibly difficult to trace and track.</p> <p>You can download the Orbot+Onion Browser+OnionShare for iOS QA Test Plan that was used to guide this work here: <a href="https://github.com/guardianproject/orbot-apple/blob/main/testing/OrbotOnionBrowserOnionShareiOS-TestPlan-July2023.xlsx">Download Test Plan</a></p> https://guardianproject.info/2023/06/15/improving-website-resilience-with-libresilient-and-ipfs/ Thu, 15 Jun 2023 00:00:00 +0000 https://guardianproject.info/2023/06/15/improving-website-resilience-with-libresilient-and-ipfs/ <p>We&rsquo;re always looking for techniques to make services more resilient to all sorts of issues. That&rsquo;s why we took special interest in <a href="https://resilient.is/">LibResilient</a> and mapped out it&rsquo;s capabilities. It&rsquo;s a JavaScript library for decentralized content delivery in web-browsers and markets itself as easy to deploy to any website. We&rsquo;ve looked at LibResilient primarily in the context of static websites. While it should work with dynamic websites too, that was out of focus for us.</p> <p>Under the hood LibResilient uses <a href="https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API">Web Workers</a>. Technically it&rsquo;s a piece of JavaScript that websites can install into the browsers of their visitors. I like to compare it to cookies, except that it&rsquo;s not just data but actually a program for manipulating your network request. The main purpose of Web Workers is to enable web apps to optimize their network connections. Web Workers are pretty low-level API.</p> <p>LibResilient delivers implementations for common use-cases on top of Web Workers in the form of plug-ins. We&rsquo;ve looked at the 3 most basic of those plug-ins.</p> <ul> <li><em>fetch plugin</em> - routes network requests directly to the web-server as if LibResilient wasn&rsquo;t present.</li> <li><em>cache plugin</em> - stores HTML, JavaScript, images and other files inside the browsers local storage</li> <li><em>alt-fetch plugin</em> - allows to configure a list of website mirrors and tries to fetch files from there</li> </ul> <p>These enable us to keep a website online and even update it if the main web-server running that site has an outage. It&rsquo;s key that visitors must have managed to load the website at least once before. Only than can LibResilient work it&rsquo;s magic and install itself and the list of site mirrors into the users browser. This solution doesn&rsquo;t work for first time visitors, during the period of an outage.</p> <p>Of course this requires to run website mirrors. Static websites really shine in this regard, because they are very easy to mirror and static web-space is quite inexpensive these days.</p> <p>We also looked into using IPFS Gateways as mirrors. To accomplish this we had to first add and pin websites to IPFS. Next we had to publish the pinned copy of the site to IPNS. Then we could use the IPNS-key-fingerprint to use every public IPFS gateway as mirror. However, public gateways tend to require quite long to answer requests, which is bad for LibResilient because it uses relatively short timeouts to fail-over between mirrors. So to get some sense of reliability, paid IPFS gateways guaranteed to pin your website are a more stable choice.</p> <h1 id="publishing-libresilient-to-ipfs">Publishing LibResilient to IPFS</h1> <p>This is a for publishing a static LibResilient enabled website to IPFS.</p> <h2 id="requirements">requirements</h2> <p>You will need VPS, or some other kind of tiny but always online server to make your data available on IPFS. This guide assumes that your server is running some flavor of GNU/Linux. It also assumes that you are familiar with the concept of static websites and that your site is already hosted on the internet.</p> <p>Mind that IPFS can be very slow, if you run into timeouts don&rsquo;t give up. Just wait a few minutes and give it a few more retries, it will work eventually.</p> <h2 id="install-ipfs">Install IPFS</h2> <p>This short snipped will install <code>kubo</code> the official IPFS binary build on your server:</p> <pre><code class="language-bash">wget https://dist.ipfs.tech/kubo/v0.18.1/kubo_v0.18.1_linux-amd64.tar.gz echo &quot;15d42b47b8529edda3e8e2d6fe6c14958d939c4efd07dea02e204743e05216f3 kubo_v0.18.1_linux-amd64.tar.gz&quot; \ | sha256sum --check tar -xzf kubo_v0.18.1_linux-amd64.tar.gz mv kubo/ipfs /usr/local/bin/ipfs rm -rf kubo kubo_v0.18.1_linux-amd64.tar.gz </code></pre> <p>Setup kubo daemon to always run in background as systemd service. (Note: this is tested for Debian and might require different steps on other GNU/Linux distributions.)</p> <pre><code class="language-bash">adduser ipfs --gecos '' --disabled-password su ipfs -c '/usr/local/bin/ipfs init --profile server' cat &lt;&lt; EOF &gt; /etc/systemd/system/ipfs-daemon.service [Unit] Description=IPFS Daemon [Service] Restart=always User=ipfs group=ipfs WorkingDirectory=/home/ipfs ExecStart=/usr/local/bin/ipfs daemon [Install] WantedBy=default.target EOF systemctl enable ipfs-daemon.service systemctl start ipfs-daemon.service </code></pre> <p>Tip: If you&rsquo;re behind a firewall or NAT make sure to open ports 4001/tcp and 4001/udp so IPFS can connect to the internet.</p> <h3 id="publish-site-to-ipfs">Publish site to IPFS</h3> <p>Next we&rsquo;ll publish the website to IPFS. You&rsquo;ll need to copy your static website to the IPFS server. For this guide we&rsquo;ll assume there&rsquo;s a copy of your website at <code>/home/ipfs/website</code>.</p> <pre><code class="language-bash">ipfs add -r /home/ipfs/website&quot; </code></pre> <p>The last line of the output of this command should look something like this:</p> <pre><code>added QmcoZGQZnaGGdcv3zWf1pdcpMQXuXz74tUy7veWdxCiPck website </code></pre> <p>Copy the CID and pin it. Pinning means that your IPFS daemon will never automatically delete these files to free up memeory.</p> <pre><code class="language-bash">ipfs pin add QmcoZGQZnaGGdcv3zWf1pdcpMQXuXz74tUy7veWdxCiPck </code></pre> <p>Now it&rsquo;s time to make make it available via IPNS. So we need to generate an IPNS key. This key will serve as address for accessing the website using IPFS. It also serves as key for publishing updates to your website.</p> <p>NOTE: all commands in this section are to be executed by <code>ipfs</code> user.</p> <pre><code class="language-bash">ipfs key gen --type=rsa --size=2048 example-site </code></pre> <p>This is how you can list your keys:</p> <pre><code class="language-bash">ipfs key list -l </code></pre> <p>the relevant output should look something like this:</p> <pre><code>k2k4r8ls72x686fmm2s0px4plejbHkhOm9uuzrxwedsaag1w72ene5rw example-site </code></pre> <p>The hash of the key, on the left side is going to be the IPNS name of your website. It&rsquo;s a fixed name that doesn&rsquo;t change even when you update your site.</p> <pre><code class="language-bash">ipfs name publish --key=example-site QmcoZGQZnaGGdcv3zWf1pdcpMQXuXz74tUy7veWdxCiPck </code></pre> <p>When your IPFS node is working and could connect to some peers, your site should now be accessible using IPNS. Although publishing may take several minutes. There are so-called <a href="https://ipfs.github.io/public-gateway-checker/">public gateways</a> which allow users to access IPFS and IPNS content using http. E.g.: <a href="https://cloudflare-ipfs.com/ipns/k51qzi5uqu5dlfqyi5ofzusx23myrrfzxlbzjho4nso0nq28lueo1994l0uwzw">https://cloudflare-ipfs.com/ipns/k51qzi5uqu5dlfqyi5ofzusx23myrrfzxlbzjho4nso0nq28lueo1994l0uwzw</a></p> <p>You can also use <code>ipfs</code> to check if the files got ingested correctly. E.g.:</p> <pre><code class="language-bash">ipfs ls /ipns/k51qzi5uqu5dlfqyi5ofzusx23myrrfzxlbzjho4nso0nq28lueo1994l0uwzw ipfs cat /ipns/k51qzi5uqu5dlfqyi5ofzusx23myrrfzxlbzjho4nso0nq28lueo1994l0uwzw/index.html </code></pre> <h3 id="update-libresilient-config-to-include-ipns-link">Update LibResilient config to include IPNS link</h3> <p>Now that your site is available on IPNS you can finally add it to your LibResilient <code>config.json</code>. You can actually add as many gateways as you&rsquo;d like with LibResilient&rsquo;s <code>alt-fetch</code> plugin. Here&rsquo;s a simple example where we added two gateways:</p> <pre><code class="language-json">{ &quot;plugins&quot;: [{ &quot;name&quot;: &quot;fetch&quot; }, { &quot;name&quot;: &quot;alt-fetch&quot;, &quot;endpoints&quot;: [ &quot;https://cloudflare-ipfs.com/ipns/k51qzi5uqu5dlfqyi5ofzusx23myrrfzxlbzjho4nso0nq28lueo1994l0uwzw&quot;, &quot;https://ipfs.io/ipns/k51qzi5uqu5dlfqyi5ofzusx23myrrfzxlbzjho4nso0nq28lueo1994l0uwzw&quot;, ] }], &quot;loggedComponents&quot;: [&quot;service-worker&quot;, &quot;fetch&quot;, &quot;alt-fetch&quot;] } </code></pre> <p>NOTE: We have to use IPNS, because as you can see we need write the IPFS address to a file which itself is part of the website. With IPNS updating the site also won&rsquo;t require changing <code>config.json</code> for every update.</p> <p>When you&rsquo;ve made your pick of IPFS gateways and added them to your <code>config.json</code> you can publish it to your web-server.</p> <h3 id="publish-updated-site-to-ipfs">Publish updated site to IPFS</h3> <p>Now you also need to publish the change to IPFS. Again start by copying the site to your IPFS server. We again assume the updated copy of your static website is located at <code>/home/ipfs/website</code>.</p> <p>Next we can unpin the old version of the website. (Tip: you can list pinned files and directories with: <code>ipfs pin ls</code> pinned directories will be marked as <code>recursive</code>)</p> <pre><code class="language-bash">ipfs unpin QmcoZGQZnaGGdcv3zWf1pdcpMQXuXz74tUy7veWdxCiPck </code></pre> <p>Then we can add the updated site to IPFS and publish it to IPNS again.</p> <pre><code class="language-bash">ipfs add -r /home/ipfs/website&quot; ipfs name publish --key=example-site QmcoZrn004DGdRvuZWf1pdcpMQXuXghjCUy7ve5Og45dNU </code></pre> <p>You can repeat this step whenever you want to publish an updated version of your static website.</p> https://guardianproject.info/2023/06/11/eu-should-not-require-sharing-unpatched-vulnerabilities/ Sun, 11 Jun 2023 00:00:00 +0000 https://guardianproject.info/2023/06/11/eu-should-not-require-sharing-unpatched-vulnerabilities/ <p>We, the undersigned organisations, write to express our concern with vulnerability disclosure requirements under the proposed Cyber Resilience Act (CRA). The CRA’s objective to encourage software publishers to patch vulnerabilities and report cyber incidents is salutary. However, the CRA’s mandatory disclosure of unmitigated vulnerabilities will undermine the security of digital products and the individuals who use them.</p> <p>The CRA would require organisations to disclose software vulnerabilities to government agencies within 24 hours of exploitation (<em>Cyber Resilience Act, Articles 11.1, 13.6, 14.4</em>). However, such recently exploited vulnerabilities are unlikely to be mitigated within such a short time, leading to real-time databases of software with unmitigated vulnerabilities in the possession of potentially dozens of government agencies. The more this kind of information is spread, the more likely it is to be misused for state intelligence or offensive purposes, or to be inadvertently exposed to adversaries before a mitigation is in place. In addition, laws that require disclosure of unmitigated vulnerabilities to government agencies create an international precedent that may be reflected by other countries.</p> <p>We call on you to help improve the CRA by including safeguards that help prevent misuse of vulnerability information:</p> <ol> <li>Limit details. The regulation should not require disclosure of technical details of unmitigated vulnerabilities to government bodies that would enable another party to reconstruct the vulnerability or develop code to exploit it.</li> <li>Prohibit offensive uses. The regulation should include a clear restriction on the use of software vulnerabilities by public bodies, i.e. for intelligence, surveillance, or offensive purposes.</li> <li>Provide time to mitigate. In the absence of user harm or a substantial incident, organisations should have a reasonable time to remediate or address the vulnerability before requiring disclosure of its details to governments. A typical standard period for the mitigation of known vulnerabilities is 90 days.</li> <li>Secure vulnerability information. Agencies should be obligated to protect vulnerability information with robust security safeguards and shared only on a very strict need-to-know basis.</li> <li>Protect good faith security researchers. The regulation should distinguish between vulnerabilities discovered in good faith for defensive purposes and those that are exploited by malicious actors. Good faith security researchers who follow coordinated vulnerability disclosure standards should be protected from retaliation.</li> </ol> <p>We share the goal of strengthening the security of digital products and protecting individuals. The above safeguards will help the CRA achieve its goals of a more resilient and protective technology ecosystem. We appreciate your consideration of our recommendations.</p> <p><a href="https://edri.org/wp-content/uploads/2023/06/CRA-Vulnerability-Handling-Open-Letter.pdf">original PDF with all signers</a></p> https://guardianproject.info/2023/06/02/improving-usability-of-tor-on-smartphones-in-latin-america/ Fri, 02 Jun 2023 00:00:00 +0000 https://guardianproject.info/2023/06/02/improving-usability-of-tor-on-smartphones-in-latin-america/ <p>Between 2022 and 2023 Guardian Project, with support from <a href="https://okthanks.com">Okthanks</a> and the <a href="https://torproject.org">Tor Project</a>, organized and participated in a total of 12 workshops in Ecuador, Mexico and Brazil with the participation of 161 people. The workshops focused both on the broad topic of “Tor for Smartphones”, while also taking deeper dives into specific topics like virtual private networks
VPNs) and anonymous web browsing. Through a variety of methods, we gathered feedback from the participants in each of those sessions. We also ran detailed individual tests with volunteers to collect insights related to new features and usability improvements on specific apps. Our top takeaways from this process were, as follows:</p> <p><img src="gpchiapasworkshop.png" alt="chiapas workshop photo" /></p> <ul> <li><strong>Changing Misconceptions of Performance</strong> A positive outcome of each workshop was the opportunity to show participants how much has the Tor network speed improved and address misconceptions related to downloading files and watching videos, one of the main reasons why users stopped using Tor in the past.</li> <li><strong>Ease of Onboarding Matters</strong> When working with at-risk individuals, it’s important for the first experience to be easy and straightforward.</li> <li><strong>Support Flexible Use</strong> People’s behaviors around using VPNs tend to vary. Many will use it in certain situations. They are not running it all of the time for everything, but only when they need it.</li> <li><strong>Consider Physical Security</strong> One of the high-level threats we identified during the workshops we ran was the existence of physical check-points run by drug cartels in the south of Mexico. People entering or leaving an area are asked either to provide access to their phones for review or leave them at the checkpoint until they leave the area. It is not clear what they are looking for when they get access to a device, but in many cases, people who left their devices at the checkpoint do not return to claim them out of fear. For this reason, we encourage the use of app icon camouflage features on privacy and security focused apps.</li> <li><strong>Awareness and Education</strong> The primary reason people in Latin America have been slow to adopt Tor tools is not that they do not work in their context, but due to awareness they exist. They have a hard time understanding what they do and how they work, and have many misconceptions about them. Continued outreach and education about which tools to use when is needed to increase adoption.</li> </ul> <p><img src="gpusabilitycuecards.png" alt="usability cue cards" /></p> <p><strong>We are proud to share this 20 page report on our usability focused work on Tor in Latin America</strong> Thank you to everyone who made this work possible, from our partners at Tor Project, our community partners, funders, designers, developers, and other supporters. Without all of you, we would not be able to do this important work to broaden the reach and effectiveness of privacy-enhancing tools in Latin America.</p> <p><a href="GuardianProject-TorUsabilityOnSmartphonesLatinAmerica-May2023-v0.0.2.pdf">Download the full report PDF here.</a></p> https://guardianproject.info/2023/04/04/ietf116-conference-report-friday-march-31-2023/ Tue, 04 Apr 2023 00:00:00 +0000 https://guardianproject.info/2023/04/04/ietf116-conference-report-friday-march-31-2023/ <p><em>Day Five of the <a href="https://www.ietf.org/how/meetings/116/">116th IETF meeting</a> in Yokohama Japan. For the rundown on Day Four, see my <a href="https://guardianproject.info/2023/03/30/ietf116-conference-report-thursday-march-30-2023/">daily report</a>.</em></p> <p>With a lot of focus on privacy with respect to Internet protocols, novel new cryptography schemes are an important requirement for new protocol designs. For example, <a href="https://datatracker.ietf.org/wg/ppm/about/">Privacy Preserving Measurement</a> is relying on new cryptography to support distributed aggregation of a wide range of measurements in the advertising domain as well as application telemetry. <a href="https://datatracker.ietf.org/wg/privacypass/about/">Privacy Pass</a> is relying on new cryptography to allow web browsing across the broad Internet after a single, lightweight authentication to an authority. IETF Working Groups are encouraged to work with the <a href="https://irtf.org/cfrg">Crypto Forum Research Group</a> of the Internet Research Task Force (<a href="https://www.ietf.org/about/groups/irtf/">IRTF</a>) to develop, test and refine new cryptography techniques that meet defined security/privacy goals and can scale for Internet-wide use.</p> <p>One area receiving a lot of attention is <em>signature blinding</em>. <a href="https://en.wikipedia.org/wiki/Blind_signature">Blinding</a> is used when a message&rsquo;s signing party is different from the message originator (digital cash, electronic voting are examples). There are many types of blind signature, used for different purposes. IETF&rsquo;s interest is in how these algorithms work at Internet scale (Privacy Pass potentially being the most high-volume example). No fewer than three results [<a href="https://datatracker.ietf.org/meeting/116/materials/slides-116-cfrg-key-blinding-for-signature-schemes">1</a>] [<a href="https://datatracker.ietf.org/meeting/116/materials/slides-116-cfrg-the-bbs-signature-scheme">2</a>] [<a href="https://datatracker.ietf.org/meeting/116/materials/slides-116-cfrg-rsa-blind-signatures-with-public-metadata">3</a>] were presented on this topic.</p> <p><a href="https://eprint.iacr.org/2023/130">Verifiable Distributed Aggregation Functions</a> are a key set of <em>multi-party computing</em> techniques for improving the privacy of Internet measurement - split the counting across a group of non-colluding hosts and reassemble it in a manner only the requester (and not the individual aggregators) can see. While there is consensus around the approach, there is work to be done on the algorithm details, specifically around performance and elimination of attack vectors. <a href="https://datatracker.ietf.org/meeting/116/materials/slides-116-cfrg-plasma">PLASMA</a> - a new proposal for distributed aggregation - was presented along with a <a href="https://datatracker.ietf.org/meeting/116/materials/slides-116-cfrg-vdaf">deeper analysis</a> of two other proposals (PRIO and POPLAR).</p> <p>There is also worry about the forthcoming era of <em>quantum computing</em> and its <a href="https://scienceexchange.caltech.edu/topics/quantum-science-explained/quantum-cryptography">impact on the cryptographic tools used today</a>. The search is on for cryptographic methods that are safe <em>post-quantum</em> and, along with them, ways to migrate currently-encrypted data into the post-quantum era. Currently being discussed are <em>hybrid</em> or <em>composite</em> schemes that layer the old techniques and the new techniques. For me, the math goes off into fairy land pretty quickly, but if <em>Composite Key Encapsulation Mechanisms</em> turns you on, there&rsquo;s plenty happening at IETF nowadays [<a href="https://datatracker.ietf.org/doc/html/draft-ounsworth-pq-composite-kem-00">1</a>] [<a href="https://datatracker.ietf.org/doc/html/draft-ietf-tls-hybrid-design">2</a>] [<a href="https://datatracker.ietf.org/doc/draft-wussler-openpgp-pqc/">3</a>] [<a href="https://datatracker.ietf.org/doc/draft-tjhai-ipsecme-hybrid-qske-ikev2/00/">4</a>].</p> <p>It turns out, it&rsquo;s not just me whose eyes glaze over at the mathematics involved in much of this work. IETF has found that IRTF&rsquo;s research in this area should recognize that a presentation acceptable to other mathematicians might not be too useful for protocol implementers. With this in mind, the Crypto Forum is pulling together <a href="https://datatracker.ietf.org/meeting/116/materials/slides-116-cfrg-guidelines-for-writing-cryptography-specifications">a set of guidelines</a> for writing cryptographic specifications within the IETF context.</p> https://guardianproject.info/2023/03/30/ietf116-conference-report-thursday-march-30-2023/ Thu, 30 Mar 2023 00:00:00 +0000 https://guardianproject.info/2023/03/30/ietf116-conference-report-thursday-march-30-2023/ <p><em>Day Four of the <a href="https://www.ietf.org/how/meetings/116/">116th IETF meeting</a> in Yokohama Japan. For the rundown on Day Three, see my <a href="https://guardianproject.info/2023/03/30/ietf116-conference-report-wednesday-march-29-2023/">daily report</a>.</em></p> <p>The IETF is getting serious about interoperability among messaging services (<a href="https://www.eff.org/deeplinks/2022/04/eu-digital-markets-acts-interoperability-rule-addresses-important-need-raises">this</a> might have had something to do with it). The charter for the Messaging Layer Security Working Group (MLS) specifically <em>excluded</em> interoperability, though the group organized a draft that addressed the basic concepts that would allow MLS-compatible systems to federate. In early 2023, a new Working Group - More Instant Messaging Interoperability (<a href="https://datatracker.ietf.org/group/mimi/about/">MIMI</a>) - was chartered to expand on the MLS federation work. Given IETF&rsquo;s relatively long and somewhat checkered history with messaging, the Working Group&rsquo;s charter included this reminder to itself:</p> <pre><code>Numerous prior attempts have been made to address messaging interoperability, including the IETF's extensive prior work on XMPP, SIP/SIMPLE, and their related messaging formats. The MIMI working group will draw lessons from these prior attempts, seek to avoid re-hashing old debates, and will focus on the minimal standards suite necessary to facilitate interoperability given the feature set of modern messaging applications. </code></pre> <p>Thus, its remit had some strict limits:</p> <pre><code>The More Instant Messaging Interoperability (MIMI) working group will specify the minimal set of mechanisms required to make modern Internet messaging services interoperable. </code></pre> <p>&hellip;<em>minimum</em> being the operative word. So, what&rsquo;s <em>in scope</em>?</p> <ul> <li>messaging interoperability</li> <li>user discovery</li> <li>messaging content format</li> <li>(an appropriate) MLS profile</li> <li>message delivery service and transport mechanisms</li> <li>establishment of end-to-end cryptographic identity</li> <li>identifier naming conventions</li> </ul> <p>Specifically <em>out of scope</em> are:</p> <ul> <li>metadata processing to manage spam and abuse</li> <li>interoperable mechanisms for group administration or moderation across systems</li> <li>extensions to the MLS protocol (if needed, requirements will be referred to the MLS working group or other relevant working groups in the security area)</li> <li>definition of completely new identity formats or protocols</li> <li>extensions to SIP, SDP, MSRP, or WebRTC</li> <li>development of anti-spam or anti-abuse algorithms</li> <li><em>oracle</em> or look-up services that reveal the list of messaging services associated with a given user identity without the user&rsquo;s permission</li> </ul> <p>This being the first formal meeting after group charter, discussions are still at the stage where defining what <em>in scope</em> means is still open, as are the most basic tenets of the technical mechanisms to implement the required features. Grab your popcorn!</p> https://guardianproject.info/2023/03/30/ietf116-conference-report-wednesday-march-29-2023/ Thu, 30 Mar 2023 00:00:00 +0000 https://guardianproject.info/2023/03/30/ietf116-conference-report-wednesday-march-29-2023/ <p><em>Day Three of the <a href="https://www.ietf.org/how/meetings/116/">116th IETF meeting</a> in Yokohama Japan. For the rundown on Day Two, see my <a href="https://guardianproject.info/2023/03/29/ietf116-conference-report-tuesday-march-29-2023/">daily report</a>.</em></p> <p>The long-running work on <a href="https://datatracker.ietf.org/wg/masque/about/">MASQUE</a> - proxying all network-layer datatypes over QUIC (HTTP/3) - is nearing completion, with the specification for <a href="https://datatracker.ietf.org/doc/draft-ietf-masque-connect-ip/">Proxying IP in HTTP</a> in IESG review. With these components in place, the <a href="https://datatracker.ietf.org/doc/draft-schinazi-masque-proxy/">original MASQUE concept</a> - a non-probable relay for client traffic providing privacy guarantees - has been revived, now defined within the new framework and leveraging <a href="https://www.ietf.org/archive/id/draft-ietf-httpbis-unprompted-auth-02.html">HTTP Unprompted Authentication</a>.</p> <p>Privacy-preserving measurement is much on the minds of IETF attendees as the <a href="https://datatracker.ietf.org/wg/ppm/about/">Privacy Preserving Measurement Working Group</a> continues to make progress. Two new concepts were debuted in the Privacy Enhancements and Assessments Research Group <a href="https://datatracker.ietf.org/rg/pearg/about/">PEARG</a> meeting: <a href="https://datatracker.ietf.org/meeting/116/materials/slides-116-pearg-secure-partitioning-protocols">Secure Partitioning Protocols</a> and <a href="https://datatracker.ietf.org/meeting/116/materials/slides-116-pearg-ipa">Interoperable Private Attribution</a>. Partitioning is new work looking at how multi-party statistical aggregation can be efficiently accomplished with improved privacy guarantees and is applicable to the on-going work on the Distributed Aggregation Protocol <a href="https://datatracker.ietf.org/doc/draft-ietf-ppm-dap/">DAP</a>. <a href="https://datatracker.ietf.org/meeting/116/materials/slides-116-pearg-ipa">Private attribution</a> measures events that occur in different contexts to the same person (shown an ad, then bought the product, for example). As a sort of counterpoint, PEARG attendees also heard about the design decisions made in the development of a <a href="https://datatracker.ietf.org/meeting/116/materials/slides-116-pearg-dp3t-deploying-decentralized-privacy-preserving-contact-tracing">privacy-preserving contact tracing application</a> rolled out during the recent COVID-19 pandemic. Perhaps the defining characteristic of the design of this app was <em>purpose limitation</em> - building out features that specifically <em>can not</em> be used for any other purpose (such is the wide-spread fear of these applications being used as the infrastructure of a much more broader system of social control).</p> https://guardianproject.info/2023/03/29/ietf116-conference-report-tuesday-march-28-2023/ Wed, 29 Mar 2023 00:00:00 +0000 https://guardianproject.info/2023/03/29/ietf116-conference-report-tuesday-march-28-2023/ <p><em>Day Two of the <a href="https://www.ietf.org/how/meetings/116/">116th IETF meeting</a> in Yokohama Japan. For the rundown on Day One, see my <a href="https://guardianproject.info/2023/03/28/ietf116-conference-report-monday-march-28-2023/">daily report</a>.</em></p> <p>The <a href="https://datatracker.ietf.org/wg/ohai/about/">OHAI Working Group</a> has submitted the core draft of <a href="https://datatracker.ietf.org/doc/draft-ietf-ohai-ohttp/">Oblivious HTTP Application Intermediation</a> to the RFC Editor for editorial finalization and publication. OHAI is designed to support <em>transational</em> uses of the HTTP protocol that seek IP address privacy (by means of a relay pair, one associated with the client and one associated with the target resource). The target resource is, thus, said to be <em>oblivious</em> to the requester&rsquo;s IP address. While the initially-imagined use case for OHAI was access to the DNS service (with some in the IETF feeling DNS-over-HTTP did not go far enough to protect user privacy), the dominant use case imagined today is <em>telemetry</em> - monitoring vendor-, application- or operating system-defined usage parameters on centralized systems.</p> <p>It&rsquo;s fair to ask how OHAI-capable services are to be discovered. The OHAI Working Group is proposing to use DNS <em>Service Binding Records</em> (SVCB, defined <a href="https://datatracker.ietf.org/doc/draft-ietf-dnsop-svcb-https/">here</a> and well-described <a href="https://www.sobyte.net/post/2022-01/dns-svcb-https/">here</a>). TLS 1.3 Encrypted Client Hello is among the other IETF standards leveraging SVCB. SVCB records, similar to the (also new) HTTPS records, allow a host of define multiple ways to make connection with parameterization using just the DNS lookup (as opposed to the multiple round-trip mechanism of HTTP&rsquo;s Alt-Svc header). The draft - <a href="https://datatracker.ietf.org/doc/draft-ietf-ohai-svcb-config/">Discovery of Oblivious Services via Service Binding Records</a> has been under Working Group discussion since IETF113 and is close to submission for last call (technical completion).</p> <p>Speaking of <a href="https://datatracker.ietf.org/doc/rfc8446/">TLS 1.3</a> and Service Binding Records, Encrypted Client Hello <a href="https://www.ietf.org/archive/id/draft-ietf-tls-esni-14.html">ECH</a> was, in fact, the reason SVCB records were defined. DNS lookup is the only point at which certain cryptographic information can be made available before all the connection encryption starts to happen. Unfortunately, the SVCB draft is stuck in the RFC Editor work queue behind ECH, even though there is language in ECH that references SVCB. The Working Group is therefore required to remove all the SVCB language from the ECH draft so that it may proceed. This procedural detail - and accompanying delay - has important consequences: the major open source software package that requires modification before ECH can expect wide adoption (OpenSSL) is waiting for ECH to become a full-fledged RFC before the submitted pull requests will be granted. Meanwhile there is plenty of experimentation with ECH happening on the live Internet with Mozilla/Firefox and Cloudflare running experiments.</p> <p>It turns out there&rsquo;s an alternative (or perhaps <em>parallel</em>) proposal for TLS 1.3 - <a href="https://datatracker.ietf.org/doc/draft-ietf-tls-ctls/">CompactTLS</a> - an effort begun in 2019 and now in it&rsquo;s eighth revision. cTLS proposes to <code>save bandwidth by trimming obsolete material, tighter encoding, a template-based specialization technique, and alternative cryptographic techniques. cTLS is not directly interoperable with TLS 1.3 or DTLS 1.3 since the over-the-wire framing is different.</code> cTLS is undergoing formal analysis and implementation work proceeds, though no results are currently available.</p> <p>The <a href="https://datatracker.ietf.org/wg/httpbis/charter/">HTTPbis Working Group</a> formally adopted the <a href="https://datatracker.ietf.org/doc/draft-ietf-httpbis-unprompted-auth/">HTTP Unprompted Authentication</a> specification in the month before IETF116. As a reminder, Unprompted Authentication allows a server to offer authenticated services without advertising that it does so (meaning the authenticated resources can not be actively probed). A number of semantic elements are under discussion, mostly to understand how this new feature is unique among existing HTTP features (and can, or can not, be aligned with <em>adjacent</em> capabilities). An action item for IETF117 is a formal analysis of the cryptography used, with several alternatives being proposed.</p> https://guardianproject.info/2023/03/28/ietf116-conference-report-monday-march-27-2023/ Tue, 28 Mar 2023 00:00:00 +0000 https://guardianproject.info/2023/03/28/ietf116-conference-report-monday-march-27-2023/ <p><em>This post begins a daily blog, live from the 116th meeting of the <a href="https://www.ietf.org/how/meetings/116/">Internet Engineering Task Force</a> in Yokohama, Japan, March 25-31, 2023. We&rsquo;re focusing on standards activities of importance to the Internet Freedom community.</em></p> <p>Since IETF114 (<a href="https://guardianproject.info/2022/07/28/ietf114-conference-report-thursday-july-28-2022/">report</a>), the <a href="https://datatracker.ietf.org/wg/ppm/about/">Privacy Preserving Measurement Working Group</a> has been deliberating over two distinct proposals offering very different technical methodologies for undertaking measurement activities while respecting user privacy. <a href="https://datatracker.ietf.org/doc/html/draft-dss-star">STAR</a> offers an approach called <em>k-anonymity</em> - reporting a measurement value only if <em>k</em> or more parties are also reporting the same value. This approach theoretically prevents rare values being used to single-out individuals. Distributed Aggregation Protocol, <a href="https://datatracker.ietf.org/doc/draft-ietf-ppm-dap/">DAP</a>, uses an approach that distributes individual measures across a set of aggregators, none of which gets to see all the granular measurement data - the fully-aggregated total only seen by the third-party who requested it (who, in turn, gets to see none of the granular measurements). At IETF116 we&rsquo;re learning about the operational experience with these technologies, with multiple implementations of both running in different testbeds. <a href="https://datatracker.ietf.org/meeting/116/materials/slides-116-ppm-poplarstar-measurements">Performance analysis</a> has also been undertaken.</p> <p>Though it&rsquo;s very early days, it&rsquo;s becoming clear that both approaches have had to make operational modifications (based on privacy vulnerabilities or performance or security) that seem to <em>decrease</em> their uniqueness and call into question the need to have two approaches. Both approaches, for example, are considering adding <em>differential privacy</em> features. Operationally, STAR performs best when <em>k</em> is within the range 10-100 and it is being argued that such a range is insufficient for Internet-scale use cases. Operationally, DAP can benefit from a more distributed computation model (using <em>helpers</em>) but this is offset by performance loss due to the volume of network traffic generated. DAP is already at a performance deficit compared to STAR, partially because it handles the negative impact of malicious clients (those that purposely submit erroneous values). Will we see a unified approach in the future? I sense there&rsquo;s a long way to go here.</p> <p>The concept of <em>web filtering</em> - raised initially at IETF115 - was again discussed in a side meeting hosted by the <a href="https://www.iwf.org.uk">Internet Watch Foundation</a> who are focused on combating child abuse, trafficking and exploitation, a problem they say is exacerbated by the distribution of specific types of content on the Internet. IWF is raising this problem within the IETF in hope of a technical solution to finding and removing the types of content that encourage, they say, these behaviors. This problem area strikes at the heart of the design of the Internet which, at its core, is <em>content-neutral</em>. Perhaps more importantly, there is significant concern that tools developed to suit this particular use case could be easily adapted to induce censorship of less well-defined content and for less-altruistic purposes.</p> https://guardianproject.info/2023/03/04/arti-next-gen-tor-on-mobile/ Sat, 04 Mar 2023 10:00:00 -0400 https://guardianproject.info/2023/03/04/arti-next-gen-tor-on-mobile/ <p>For software projects with recurring bugs, efficiency or security issues there&rsquo;s a joke making the rounds in the software industry: &ldquo;Let&rsquo;s re-write it in <a href="https://en.wikipedia.org/wiki/Rust_(programming_language)">Rust</a>!&rdquo; It&rsquo;s a fairly new low-level programming language with the declared goal to help developers avoid entire classes of bugs, security issues and other pitfalls. Re-writing software is very time consuming, so it rarely happens, especially when just one more fix will keep a project up and running.</p> <p><a href="https://torproject.org">Tor-Project</a> was started in 2001 using the <a href="https://en.wikipedia.org/wiki/C_(programming_language)">C programming lanugage</a>. However a few years ago they set out to actually re-write their project in Rust. That projects codename is <a href="https://arti.torproject.org/">Arti</a> and it was <a href="https://blog.torproject.org/arti_100_released/">first released</a> in 2022. While Arti is working great, it doesn&rsquo;t have all features of the original Tor implementation yet. However, they are steadily working on getting there. For example, rough <a href="https://www.pluggabletransports.info/">Pluggable Transports</a> support was added to Arti in the recent 1.1.0 release.</p> <p>We already have early <a href="https://gitlab.com/guardianproject/arti-mobile-ex/">test builds of Arti</a> running on both Android and iOS. The integration we came up with is pretty basic, but so far it seems to work reliable for accessing the Tor network. Maintaining code for both iOS and Android in the same project will hopefully simplify shipping new Arti releases for us, make integrating Tor capabilities into any app simpler. To make it useful for the broader mobile developer community, we&rsquo;re also investigating whether we can provide easy to use API bindings. We&rsquo;ve created a <a href="https://gitlab.com/guardianproject/arti-mobile-ex/-/tree/main/android/sample">sample app</a> on Android to test and illustrate what a minimalistic integration of Arti looks like. It&rsquo;s as simple as adding a few lines of code.</p> <p>Support for features like advanced censorship circumvention or onion services is not exactly straight forward on mobile operating systems, because they tend to be way more locked down than traditional computers. Currently, we can successfully test pluggable transports in &ldquo;managed&rdquo; mode on old versions of Android. However this technique will likely not work on the latest version of Android and never worked iOS to begin with. We have shared our findings with the Arti developer team and hope they&rsquo;ll work on getting us to full Pluggable Transports support, integraing with our existing <a href="https://gitlab.com/guardianproject/IPtProxy">IPtProxy Library</a> soon.</p> https://guardianproject.info/2023/02/28/steps-towards-trusted-vpns/ Tue, 28 Feb 2023 00:00:00 +0000 https://guardianproject.info/2023/02/28/steps-towards-trusted-vpns/ <p>VPNs have become quite popular in recent years for a number of reasons, and more and more they are being touted as a privacy tool. The question is whether using a VPN does improve privacy. It is clear that VPNs are quite useful for getting access to things on the internet when direct connections are blocked. VPN providers include a number of tactics in both their client apps and server infrastructure to ensure that their users are able to make a connection. Then once users are connected, all of their traffic that goes over the VPN will see the internet from the point of view of the VPN&rsquo;s server. That is how VPNs &ldquo;unblock&rdquo; the internet. In contrast, some are using VPNs to selectively block things, like making a system-wide <a href="https://www.digitalocean.com/community/tutorials/how-to-block-advertisements-at-the-dns-level-using-pi-hole-and-openvpn-on-ubuntu-16-04">adblocker</a>.</p> <p>To answer the question about whether they are a useful privacy tool, let&rsquo;s start with the history of where VPNs came from. VPN stands for Virtual Private Network. They were developed by large companies with multiple offices and travelling employees. The goal was to link together all of these offices so that internal data could be freely shared between them without that data going over the internet as easily readable unencrypted plain text. Then travelling employees could also safely access the internal data via any internet connection. The key piece of this picture is that the users, employees in this case, already had to trust their VPN provider. The VPN provider was the company they worked for, and the data they were handling belonged to the company. So there was no attempt to hide user information from the VPN provider. Indeed quite the opposite: companies linked the VPN access to each employee&rsquo;s &ldquo;single sign-on&rdquo; account. Built into the design of VPNs is full trust of the VPN provider, with the aim of keeping the data private from the internet. This setup was also by design, since many large companies wanted to ensure their employees work laptops were still going through the corporate firewall, where the company could block certain sites (e.g. malware, porn), then also <a href="https://www.fortinet.com/resources/cyberglossary/data-exfiltration">monitor employees</a> internet activity to ensure they are not exposing files that the company does not want to be public.</p> <p><a href="https://en.wikipedia.org/wiki/File:Virtual_Private_Network_overview.svg"><img src="Virtual_Private_Network_overview.svg.png" alt="Virtual Private Network overview" /></a></p> <p>This does not paint a good picture for a tool to protect privacy. But there is hope! It is possible to use a VPN to improve your privacy if you pay attention to some key details. For VPN services to provide privacy, you have to put a lot of trust in the people who are operating the service. The VPN provider can see <strong>all</strong> of your traffic that goes over the VPN, and they have a strong link to your user account with them. The privacy advantage of a VPN is that the destination sites cannot see which IP address your device is coming from, they will see the VPN provider&rsquo;s IP address. And your ISP will see you are using a VPN, but not which sites you visit. With HTTPS, TLS, and end-to-end encryption being widespread, any encrypted content will be protected from the VPN provider also. But the VPN provider can still see where you are connecting from, which sites and services you are using, what time of day, and even potentially correlate traffic to link activities of their users. In other words, the VPN operator sees lots of metadata about you, so much so that they could paint a quite detailed portrait of your personal life if they ever did let their data be analyzed.</p> <h2 id="how-to-build-a-privacy-respecting-vpn-service">How to build a privacy-respecting VPN service</h2> <p>There are good signals that VPN services can send to show that they are tackling the real issues. For example, shipping free software clients, maintaining a <a href="https://www.eff.org/deeplinks/2016/05/canary-watch-one-year-later">warrant canary</a>, posting a clear privacy policy describing the logging policy, and publishing the unredacted results of third party audits. If the VPN operator is doing the right thing, then VPNs can provide a relatively private way to access the internet. With a consistent track record of transparency, they can build up a trusted reputation for protecting privacy. Unfortunately, we cannot rest there since a VPN provider can change their setup quite easily, whether willingly or under duress. Maintaining consistent, regular, and transparent communications is therefore essential.</p> <ul> <li>Calyx Institute&rsquo;s <a href="https://calyxinstitute.org/legal/privacy-policy">Privacy Policy</a> and <a href="https://calyxinstitute.org/about/financials-and-annual-reports">Financials and Annual Reports</a></li> <li>Mozilla&rsquo;s <a href="https://www.mozilla.org/en-US/privacy/principles/">Data Privacy Principles</a></li> <li>Mullvad&rsquo;s <a href="https://mullvad.net/help/swedish-legislation/">Swedish legislation relevant to us as a VPN provider</a> and <a href="https://mullvad.net/help/no-logging-data-policy/">Privacy Policy</a></li> </ul> <p>On top of that, the <a href="https://vpnalyzer.org/">VPNalyzer</a> project is working to make monitoring VPN services a lot easier and possible to crowdsource. This gives a third party perspective from some respected organizations.</p> <h3 id="know-as-little-as-possible-about-your-users">Know as little as possible about your users</h3> <p>Many VPN providers require an account and payment information. This is usually personally identifiable information, like name, credit card information, email address, phone number, billing address, etc. The most private services have <a href="https://f-droid.org/2022/02/28/no-user-accounts-by-design.html">no user accounts by design</a>. Calyx, Lavabit, and Riseup VPNs do not require any account or payment at all, so they do not have that information to give out or leak. Providers that accept payment need a way to tie payment to service, that is usually done using accounts tied to email addresses or phone numbers. Personal details are not required to make accounts and payments work. Mullvad uses a randomly generated account number only, there is no link to other identifiers unless you provide them. Additionally, Mullvad is one of the few VPN vendors that accepts cash payments. Many technically minded implementers laugh at the idea of processing envelopes of cash, but it is an effective, real world solution to minimizing personal data that software methods struggle to match.</p> <h3 id="keep-as-little-information-as-possible">Keep as little information as possible</h3> <p>The VPN servers unavoidably see lots of information about what users are doing. The default with most servers is to keep logs of that data. The longer this data is kept, the greater the risk it will be used to identify users and their activities. It does not help that standard practice for running servers is to keep logs for a long time. Many service providers keep those logs for years.</p> <p>VPN providers must be clear about what logs they are keeping, and how long they are stored. Even better, they will provide information about how they do store the data that they do keep. For example, if the servers do not use full disk encryption, then it would be straightforward to recover the deleted logs. That is much harder on systems using full disk encryption.</p> <ul> <li>A <a href="https://cure53.de/audit-report_ivpn.pdf">2019 audit</a> of <a href="https://www.ivpn.net/blog/independent-security-audit-concluded">IVPN</a> showed that, at that time, the auditors confirmed that IVPN performed no &ldquo;statistical logging of customer-traffic&rdquo;, &ldquo;logging of traffic, IP addresses or DNS requests&rdquo; on the servers that the auditors were given access to.</li> <li>Mullvad says, &ldquo;we never store any activity logs of any kind.&rdquo; in their <a href="https://mullvad.net/en/help/no-logging-data-policy/">no logging data policy</a></li> </ul> <h3 id="proven-track-record-of-resisting-unjust-legal-intrusion">Proven track record of resisting unjust legal intrusion</h3> <p>There are many legal ways for authorities to get private data, this is an essential part of a functioning justice system. But these powers are sadly abused in basically every country in the world, it is only a question of degrees. A VPN provider needs to represent its users legal interests, and push back on legal orders when there is the possibility they are unjust. Calyx Institute&rsquo;s Nick Merrill provides the shining example in this regard. With the ACLU, he fought a <a href="https://en.wikipedia.org/wiki/Doe_v._Ashcroft">legal case</a> for over a decade to prevent unjust intrusion for his users. Ladar Levison shut down his email company <a href="https://en.wikipedia.org/wiki/Lavabit">Lavabit</a> rather than allow the US Government to monitor Edward Snowden&rsquo;s email account.</p> <p>There are other ways to ensure that the legal processes are not abused. These include warrant canaries and disclosure when data had to be turned over via legal procedures.</p> <ul> <li>Mozilla&rsquo;s <a href="https://www.mozilla.org/en-US/about/policy/transparency/">Transparency</a> policy</li> <li>ProtonVPN&rsquo;s <a href="https://protonvpn.com/blog/transparency-report/">Transparency Report &amp; Warrant Canary</a></li> <li>Riseup&rsquo;s <a href="https://riseup.net/canary">Canary Statement</a></li> </ul> <h3 id="publish-as-much-as-possible-as-free-open-source-software">Publish as much as possible as free open source software</h3> <p>F-Droid works to build <a href="https://f-droid.org/2022/05/24/buildserver-overhaul-sponsored-by-calyx-institute.html">services</a> where free software, <a href="https://f-droid.org/2022/07/22/maven-central.html">code</a> <a href="https://f-droid.org/2022/09/30/free-software-and-inspection-are-key-to-software-we-can-trust.html">inspection</a>, <a href="https://f-droid.org/2023/01/15/towards-a-reproducible-fdroid.html">reproducible builds</a> provide a method to ensure that the software we deliver is trustworthy. VPN vendors recognize how important trust is, so the good ones work to get their apps into f-droid.org. The F-Droid community provides the best screening for ensuring Android apps are truly free software. On top of that, F-Droid flags apps for <a href="https://f-droid.org/docs/Anti-Features/">Anti-Features</a>, which are things that users may not like, but might accept. Here are VPN clients that do maintain their free software clients in f-droid.org:</p> <ul> <li><a href="https://f-droid.org/packages/se.leap.bitmaskclient/">Bitmask</a></li> <li><a href="https://f-droid.org/packages/org.calyxinstitute.vpn/">Calyx VPN</a></li> <li><a href="https://f-droid.org/packages/nl.eduvpn.app/">eduVPN</a></li> <li><a href="https://f-droid.org/packages/net.ivpn.client/">IVPN</a></li> <li><a href="https://f-droid.org/packages/com.lavabit.pahoehoe/">Lavabit Encrypted Proxy</a></li> <li><a href="https://f-droid.org/packages/net.mullvad.mullvadvpn/">Mullvad VPN</a></li> <li><a href="https://f-droid.org/packages/org.outline.android.client/">Outline</a></li> <li><a href="https://f-droid.org/packages/ch.protonvpn.android/">ProtonVPN</a></li> <li><a href="https://f-droid.org/packages/one.librem.tunnel/">Purism Librem Tunnel</a></li> <li><a href="https://f-droid.org/packages/se.leap.riseupvpn/">Riseup VPN</a></li> <li><a href="https://f-droid.org/packages/com.tailscale.ipn/">Tailscale</a></li> <li><a href="https://f-droid.org/packages/com.wireguard.android/">WireGuard</a></li> </ul> <h3 id="use-external-auditors-to-confirm-source-code-and-operations">Use external auditors to confirm source code and operations</h3> <p>External auditors are important because they can bring fresh eyes on the source code, and good auditors are experts at finding issues in source code and server setups. And responsible organizations will publish the full, unredacted audit report once they have fixed the issues. Even if a VPN app is included in F-Droid, there are key aspects of the service that cannot be independently verified. For this, we must rely on the people who run the service to do the right thing. Audits can demonstrate that they were doing the right thing at the point of time of the audit. Here are some examples:</p> <ul> <li>IVPN&rsquo;s <a href="https://cure53.de/audit-report_ivpn.pdf">2019 audit of IVPN</a></li> <li>Mozilla VPN had their app source code <a href="https://blog.mozilla.org/security/files/2021/08/FVP-02-report.final_.pdf">audited</a> in 2021 and fixed the issues that were found.</li> <li>Mullvad&rsquo;s <a href="https://cure53.de/pentest-report_mullvad_2020_v2.pdf">Pentest-Report Mullvad Apps, Clients &amp; API 05.2020</a>, <a href="https://cure53.de/pentest-report_mullvad_v2.pdf">Pentest-Report Mullvad VPN Clients 09.2018</a>, and <a href="https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leaks-found-cure53s-infrastructure-audit/">2020 Infrastructure Audit</a></li> <li>Outline&rsquo;s <a href="https://s3.amazonaws.com/outline-vpn/static_downloads/ros-report.pdf">2017 Pentratration Test Report</a> and <a href="https://s3.amazonaws.com/outline-vpn/static_downloads/cure53-report.pdf">Pentest &amp; Audit Report Jigsaw Outline 09.-12.2018</a></li> <li>Proton VPN open sourced their client apps and had them <a href="https://www.zdnet.com/article/protonvpn-apps-handed-to-open-source-community-in-transparency-security-push/">audited</a> in 2019.</li> </ul> <h3 id="publicly-verifiable-binaries-via-reproducible-builds">Publicly verifiable binaries via reproducible builds</h3> <p>Source code is the easiest place to conduct an audit of software, but it is the binary files that actually run on your device. Auditing binaries rarely happens since it is so much more time intensive. And yet, there are ways to change how software works without changing the source code. This can be done by injecting changes into the process that converts the source code into the executable binary. <a href="https://reproducible-builds.org/">Reproducible Builds</a> is the indisputable method for proving that a given binary was generated by given source code.</p> <p>There are some generic VPN clients in Debian that are built reproducibly, but there are no Android or iOS VPN apps or branded desktop client apps that meet this standard yet. We recommend that VPN providers work with <a href="https://wiki.debian.org/ReproducibleBuilds">Debian</a>, <a href="f-droid.org/docs/Reproducible_Builds">F-Droid</a>, the <a href="https://reproducible-builds.org/">Reproducible Builds</a> group, or any other relevant <a href="https://reproducible-builds.org/who/projects/">project</a> to achieve this key step.</p> <h3 id="apple-ios">Apple iOS</h3> <p>This post focuses on Android because iOS has a number of issues that make using VPNs for privacy less effective. For example, VPNs on iOS will <a href="https://www.bleepingcomputer.com/news/security/unpatched-ios-bug-blocks-vpns-from-encrypting-all-traffic/">leak IP addresses</a>. Apple knows about this issue, yet still has <a href="https://www.theregister.com/2022/08/19/apple_ios_vpn/">not fixed</a> it after a couple years. On top of that, it is not possible to have reproducible builds on iOS because the actual executable binaries are encrypted by Apple&rsquo;s proprietary Digital Restrictions Management (DRM), so only Apple could ever reproducibly build something. If you are running Apple iOS, you are stuck trusting Apple to do the right thing, since they operate a relatively opaque, proprietary, strictly walled garden.</p> <h2 id="run-your-own-vpn">Run your own VPN</h2> <p>The VPN security model means you have to put a ton of trust in the operator. Questions of trust get much easier when you are talking about yourself or own organization. There are many projects that aim to make it as easy as possible to run your own VPN service. The good ones are all free software and have been audited, both the client source code and the server side setup.</p> <ul> <li><a href="https://amnezia.org">Amnezia</a> is a free service to create a personal VPN on your server.</li> <li><a href="https://leap.se/">LEAP VPN</a> is a &ldquo;white label&rdquo; VPN setup used to build Bitmask, CalyxVPN, RiseupVPN and more.</li> <li><a href="https://getoutline.org/">Outline</a> &ldquo;makes it easy to create a VPN server, giving anyone access to the free and open internet.&rdquo;</li> <li><a href="https://we-pn.com/">WEPN</a> is a free software kit to become your own VPN provider, designed around a small hardware device.</li> </ul> <p>There are also generic VPN client apps based on standard protocols:</p> <ul> <li><a href="https://f-droid.org/packages/nl.eduvpn.app/">eduVPN</a></li> <li><a href="https://f-droid.org/packages/de.blinkt.openvpn/">OpenVPN for Android</a></li> <li><a href="https://f-droid.org/en/packages/com.github.shadowsocks/">Shadowsocks</a></li> <li><a href="https://f-droid.org/packages/org.strongswan.android/">strongSwan</a></li> <li><a href="https://f-droid.org/packages/com.WireGuard.android/">WireGuard</a></li> </ul> <h2 id="comparing-vpns-to-tor-and-masque">Comparing VPNs to Tor and MASQUE</h2> <p>If it is privacy that you seek, then there are other tools to review. Tor is a longstanding community project that aims to make privacy proxies without compromise. Tor works similarly to VPN in that it is tunneling traffic to shared servers, the big difference is that your traffic is tunneled through three relays (in comparison to single hop VPNs). Each individual Tor relay cannot see the enough to put together a picture of who is doing what. At most, a relay can see what is done, but not who. Or that someone is accessing Tor, but not their destination. <a href="https://guardianproject.info/apps/org.torproject.android/">Orbot</a> provides a VPN mode, but this is still full Tor protection, since it is just using the device&rsquo;s VPN user experience to provide access to the Tor network. <a href="https://www.torproject.org/">Tor Browser</a> then adds whole other layers of privacy protection that can only be implemented in the internet-enabled app. This includes things like reducing metadata leaks in the HTTPS connection or web APIs, or isolating websites from each other within the browser, so they cannot read data about other sites the user has visited.</p> <p>A new approach that is somewhere in between a VPN and Tor are multi-hop <a href="https://guardianproject.info/2020/02/25/masque-review/">MASQUE</a> relays. MASQUE is a new protocol that is similar to VPN and proxy protocols. MASQUE is built on HTTP/3 aka QUIC, so it does not stick out as much as VPN or WireGuard traffic. It also allows for multi-hop configurations. MASQUE is only newly deployed, so there is not the two decades of experience working to minimize metadata leaks in the processes for relaying traffic.</p> <p>Apple iCloud Private Relay is a <a href="https://blog.cloudflare.com/icloud-private-relay/">two hop deployment</a> on MASQUE, which means that the Apple side can see that the user is sending traffic, and the Cloudflare side can see the destination, but not the user. That does provide a real privacy improvement over a single hop system. Unfortunately, Apple iCloud Private Relay fails most of the other tests laid out in this post. Plus given the history of NSA programs like PRISM, and the willingness for US companies like Apple and Google to <a href="https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data">take part</a>, this setup is not clear protection from NSA and Five Eyes surveillance and targeting. It would be relatively straightforward for those kinds of agencies to correlate the data from the Apple and Cloudflare side if they have access to the metadata from both sides.</p> <p>If privacy is your primary concern, then it is worth investing time into tools like Tor. If you have limited time and are mostly concerned about mass surveillance, then a good VPN is worth considering for some added privacy protection.</p> https://guardianproject.info/2022/09/28/scanning-apps-off-the-record/ Wed, 28 Sep 2022 00:00:00 +0000 https://guardianproject.info/2022/09/28/scanning-apps-off-the-record/ <p>Smart phones have brought us so many wonderful capabilities. They let people around the world access vast realms of information. They let app developers solve problems large and small in a way most relevent to their local context. They are personal computers for the world. They also have given surveillance capitalism an unprecedented reach into everyone&rsquo;s lives. Repressive governments use them in ways that the East German Stasi secret police could only have dreamed of. And as promising as artificial intelligence is, it is also threatening humanity. People around the world are pushing back. This public interest work requires technical inspection of apps. There are organizations highlighting algorithmic transparency and calling out surveillance capitalism. Journalists are linking apps into key stories about the misdeeds of powerful companies. Activists are exposing the hidden machinations of their governments. All of these people require technical skills to see what a given app is going.</p> <p>It turns out that a lot of the technical bits required to do these kinds of investigations can be automated. When combined with good user experience design, many of the barriers to entry can be removed. This allows more people to get involved, and for many of these problems to be crowdsourced even. This is the central focus of our project Tracking the Trackers. We have just completed the third round of work to bring the initial automation to a more accessible user experience.</p> <p>We have discussed these workflows with a number of organizations doing this kind of work to learn about their processes, and how they might be improved. And we want to hear from more. There is a lot of potential to pool limited resources to build up a shared, free software resource that is greater than the sum of its parts. And there are many complementary projects:</p> <ul> <li>EFF&rsquo;s <a href="https://github.com/EFForg/apkeep">apktool</a> - tool for downloading Android apps from various sources</li> <li>F-Droid <a href="https://f-droid.org/2020/12/21/announcing-issuebot.html"><em>issuebot</em></a> - automatically review apps via GitLab issues and merge requests</li> <li><a href="https://about.gitlab.com/topics/ci-cd/">GitLab CI</a> - server-less processing tied to issue trackers and merge requests</li> <li><a href="https://git.app-check.org/app-check">MobilSicher AppCheck</a> - dynamic analysis for finding personal data leaks in apps</li> <li><a href="https://pts-project.org/">PiRouge</a> - mobile forensic and network traffic analysis platform</li> <li><a href="https://beta.pithus.org/about/">Pithus</a> - mobile threat intelligence platform for activists, journalists, NGOs, researchers</li> </ul> <h2 id="putting-it-all-together">Putting it all together</h2> <p>We have developed a stack to integrate as many tools that are relevant into a single, productive user experience. Detailed inspection of apps is a process that must be tracked, so the focus is on issue trackers and merge requests. Each app is tracked as an issue. A person opens up a new issue, adding what they know about the app, including links to it in an app store, the Application ID, links to any source code, etc. Then <em>issuebot</em> kicks in and downloads the app and any source code it can find. Once successful, it will launch various analysis processed on what it downloaded. Those results are then compiled into a report which is posted to the issue tracker for the human reviewers. The bot leaves its mark using a GitLab label called <code>fdroid-bot</code>. If someone found more files to download and would like <em>issuebot</em> to run again, they just remove the <code>fdroid-bot</code> label and <em>issuebot</em> will try the whole process again.</p> <p>It runs a number of different scans and processes to check:</p> <ul> <li>Inspect apps from F-Droid, Google Play, APKPure, Huawei App Gallery, and GitHub Releases.</li> <li>Get the source code</li> <li>Build the app from source</li> <li>Find the license of the source code</li> <li>Extract info about libraries, classes, domain names, URLs, permissions, services, etc.</li> <li>Apply signature collections</li> <li>What kinds of <a href="https://f-droid.org/docs/Anti-Features">Anti-Features</a> an app has, e.g. tracking, ads, non-free dependencies, known vulnerabilities, etc.</li> <li>Whether all the dependencies are also free software</li> </ul> <p>Using this process, the F-Droid community reviews all apps for <a href="https://f-droid.org/docs/Anti-Features/">Anti-Features</a> before accepting them into the <f-droid.org> collection. For some years now, F-Droid have reviewed new apps and updates via merge requests with <em>issuebot</em>. It automatically checks issues on the <a href="https://gitlab.com/fdroid/rfp/-/issues">Requests for Packaging</a> tracker, this is the starting point of the process of adding new apps to the collection. The collection is then maintained via merge requests on the <a href="https://gitlab.com/fdroid/fdroiddata/-/merge_requests"><em>fdroiddata</em></a> project. There are hundreds of reviews there to browse through, an some <a href="https://gitlab.com/fdroid/rfp/-/issues/2224#note_1118052837">scans</a> that are more interesting.</p> <p>We believe this same workflow fits well to many processes for inspecting apps. GitLab provides the core workflow that fits how many researchers and organizations are already doing this work:</p> <ul> <li>Detailed inspection happens over time, over multiple work sessions.</li> <li>Multiple people are involved in the process.</li> <li>Work can happen asynchronously across time zones and organizations.</li> <li>Public GitLab also opens up crowdsourcing opportunities</li> </ul> <p>We have setup a instance of this setup for public interest organizations and investigators to use. This is called the &ldquo;Off The Record&rdquo; tracker. Access is available on request, send an email to <a href="mailto:support@guardianproject.info">support@guardianproject.info</a> to make the request. Additionally, the whole stack is free software. Organizations are free to run it as they need to, with any privacy requirements that might need. That also makes it cheap to host this software, so that it can be affordably provided as a service to people working in the public interest. It can be <a href="https://gitlab.com/fdroid/issuebot#installing-into-a-gitlab-project">self-hosted</a> with any GitLab &ldquo;Community Edition&rdquo; instance with CI/CD Runners, and also runs on the gratis <a href="https://gitlab.com/">https://gitlab.com/</a> hosting. It does touch some proprietary services, but only via public APIs so that the functionality is included in the stack.</p> <p>One new development is the creation a standard pattern for managing profiles for collections of signatures to detect Anti-Features in Android apps. F-Droid <a href="https://gitlab.com/fdroid/suss">SUSS</a> (Suspicious or Unwanted Software Signatures) is the first live project, with F-Droid&rsquo;s <code>scanner</code> tool using it. Before this round of work began, there were multiple silos where related activities were happening. F-Droid scans for non-free software, Mobil Sicher detects when apps transmit personal data, Exodus Privacy find for tracking software, and IzzySoft looks for Anti-Features of all kinds. We hope that standardizing data formats and workflows will make contribution and shared maintenance easier, as well as making it easy for organizations to maintain their own collections of signatures they want to detect. YARA serves as template for this effort. It began at one malware company, and is now used by a <a href="https://virustotal.github.io/yara/#who-s-using-yara">wide variety</a> of organizations. YARA has become the standard tool for writing malware signatures for desktop platforms. Unfortunately, it is <a href="https://github.com/VirusTotal/yara/issues/1145">not well structured</a> to work for scanning Android apps or source code, but it can serve as a inspiration and model.</p> <h2 id="appendix">Appendix</h2> <h3 id="a-know-the-local-laws-on-software-inspection">A) Know the local laws on software inspection.</h3> <p>In many places, just the act of inspecting software can get you in trouble with local governments or companies. This could be anything from <a href="https://www.vidstromlabs.com/blog/the-legal-boundaries-of-reverse-engineering-in-the-eu/">unclear laws</a> <a href="https://www.eff.org/issues/coders/reverse-engineering-faq">regarding</a> <a href="https://www.twobirds.com/en/insights/2020/germany/vertraglicher-ausschluss-von-reverse-engineering">reverse engineering</a> to overreach from law enforcement. Running the inspection in private means the app reviewers are much less exposed unwarranted or unjust interference. Anyone doing software inspection should familiarize themselves with local laws and regulation that affect it.</p> <p>The biggest challenges that remain for making software inspection commonplace are around how organizations and governments apply this software. Any organization that wants to start working on auditing software in the public interest will need:</p> <ul> <li>Legal guidelines for getting any required permissions before downloading apps to review.</li> <li>A home organization for this repository that has a public mission aligned with these goals.</li> <li>Legal representation to handle any issues that arise, and to push back against illegitimate requests.</li> </ul> <h3 id="b-what-no-ios">B) What, no iOS?</h3> <p>We recognize that it is also important to inspect iOS apps. Compared to Android, the Apple mobile ecosystem is smaller and much more closed and restrictive. Therefore, it is much more more difficult to inspect. The application executable binary in the <code>.ipa</code> file is <a href="https://stackoverflow.com/questions/5784169/does-apple-modify-ios-application-executables-on-apps-submitted-to-the-app-store/5784332#5784332">encrypted</a> which prevents examination of the binary. The only way to get the actual <code>.app</code> files is to have a jailbroken iOS device, then manually install them on the device. Only then can they be extracted and inspected.</p> <p>(<em>This work was funded by NLnet as <a href="https://nlnet.nl/project/EthicalApps/">The Search for Ethical Apps</a> under the umbrella of <a href="https://guardianproject.info/2022/09/01/the-search-for-ethical-apps-lets-start-with-governments/">Guardian Project</a>&rsquo;s <a href="https://guardianproject.info/tags/tracking-the-trackers/">Tracking the Trackers</a> effort.</em>)</p> https://guardianproject.info/2022/09/01/the-search-for-ethical-apps-lets-start-with-governments/ Thu, 01 Sep 2022 00:00:00 +0000 https://guardianproject.info/2022/09/01/the-search-for-ethical-apps-lets-start-with-governments/ <p>Governments across the world are moving services to mobile apps. The vast majority of these apps are only available in the Google Play store or in the Apple App store. Installing apps from these services requires users to agree to their terms of service. This means governments require their citizens to sign opaque and privacy invading contracts with foreign Big Tech in order to use digital services. This feeds ever more into Big Tech data control, filtering, and information bubbles. There are some exceptions here, like China has multiple app stores that are popular. Chinese Big Tech also require restrictive terms of service agreements. Additionally, many of apps are developed by the same firms that are tied into the surveillance capitalism ecosystem. So they include features that track the end users. The governments are not demanding data transparency, and these firms have not been delivering it.</p> <p>In Austria, there is a clear example: the <a href="https://www.a-trust.at/en/Handy-Signatur/"><em>Handy Signatur</em></a> app. Public health insurance providers require this app for people to access their accounts online. Since COVID-19 countermeasures forced schools into online-mode, many public schools have been requiring education apps for students, parents and teachers to connect with and interact with the school. People with the that app can also sign petitions and download vaccination certificates those without have to do much more work.</p> <p>Mobile phone users want to know about what apps are doing with their personal data. Citizens around the world gaining consciousness about these issues. In order to build public pressure, a critical mass must be aware of these problems. To learn, they must first discover how widespread and entrenched this problem is. We received funding from <a href="https://nlnet.nl/project/EthicalApps/">NLnet</a> to work on this key area. This project integrates existing tools and builds a &ldquo;software kit&rdquo; to make it easy to generate data about the apps governments require. This data will be simple to index so that it citizens and search it and discover the terms their governments are requiring them to take to access e-government services.</p> <p>Journalists are just starting to report on this large and growing problem. One of the few stories in the European media came recently in the Dutch media: &ldquo;<a href="https://fd.nl/economie-politiek/1383007/overheid-dwingt-burger-in-de-richting-van-google-en-apple"><em>Overheid dwingt burger in de richting van Google en Apple</em></a>&rdquo; (The authorities force citizens towards Google and Apple). On top of transparency, governments should also ensure that the apps they make and use are available without privacy concerns or corporate control, and that they are not feeding data to companies that control search algorithms and limit user autonomy.</p> <p>This first step is to make a repository with the apps related to government services. This then provides a template for others to do the same in other countries. Next steps are include pushing organizations and companies to do the same, for example school and banking apps; getting more country repositories and perhaps an EU repository; an helping governments, organizations, and companies set up good distribution options. Governments should also list F-Droid as an option for getting the apps whenever they mention Google Play and Apple App Store. And when governments go <a href="https://f-droid.org/packages/de.bwl.lfdi.app/">all</a> <a href="https://www.baden-wuerttemberg.datenschutz.de/lfdi-bw-app-f-droid/">the way</a>, they should be lauded. 🎉</p> <p>We work partners to make this come to life:</p> <ul> <li>F-Droid provides all the tools for securely publishing and managing app repositories. F-Droid&rsquo;s community app <a href="https://gitlab.com/fdroid/rfp/-/issues">review</a> <a href="https://gitlab.com/fdroid/fdroiddata/-/merge_requests">process</a> gives us a template to build upon for reviewing all apps in an open way. F-Droid provides another option that does not lock anyone into any service. There are no terms of service, or even <a href="https://f-droid.org/2022/02/28/no-user-accounts-by-design.html">user accounts</a> to sign up for. And F-Droid provides a decentralized app distribution ecosystem where anyone can publish their own apps via their own repositories. If the app is free software, it can be included in the main <a href="https://f-droid.org">f-droid.org</a> repository. Millions of users have installed F-Droid themselves, and companies like Fairphone have shipped devices with F-Droid pre-installed. Anyone can freely install F-Droid on any Android device. So F-Droid provides app distribution without being locked into any service, unlike Google Play.</li> <li>ITUJ&rsquo;s <a href="https://mobilsicher.de/">mobilsicher</a> project will provide the user facing service for Germany. Their new repository will serve both as an app distribution provider, and as an example of how other organizations can do the same. Their impressive <a href="https://git.app-check.org/app-check">app-check</a> review <a href="https://appcheck.mobilsicher.de/">platform</a> is a complete stack for human reviewers to do dynamic analysis, and the database they have built up will be integrated into the review process.</li> <li><a href="https://exodus-privacy.eu.org/">Exodus Privacy</a> focuses on tracking embedded in Android apps. It works based on users requesting apps be reviewed. It is an important source for this project since it is narrowly focused on detecting and reporting tracking in any Android app.</li> <li>EFF created and maintains <a href="https://github.com/EFForg/apkeep"><em>apkeep</em></a>, the essential tool for getting the actual app files to inspect when the source code is not available.</li> <li><a href="https://beta.pithus.org/about/">Pithus</a> is a mobile threat intelligence platform for activists, journalists, NGOs, researchers that is a entirely open platform supported and maintained by the community.</li> <li><a href="https://github.com/techlore/plexus">Techlore Plexus</a> is a catalog of Android apps that have been reviewed in terms of compatibility with Google-free devices. For example, they list whether an app requires Google Play Services to run.</li> </ul> <p>Of course, this is not the complete solution for <a href="https://www.ethicsinapps.eu/">ethical apps</a>. This is a stepping stone towards the end goal of &ldquo;<a href="https://publiccode.eu/">Public</a> <a href="https://www.eff.org/deeplinks/2017/10/public-money-public-code-show-your-support-free-software-europe">Money</a>, <a href="https://publiccode.asia/">Public</a> <a href="https://blog.okfn.org/2017/09/20/public-money-public-code/">Code</a>&rdquo;. This project will push governments down that road by outlining easier steps to take as they move towards free software: making apps available for public audit, allowing users to install apps without agreeing to any terms of service, etc. It enables users of free platforms like CalyxOS, LineageOS, Murena, etc. to get access to public services via their mobile devices. It gives users with Google Play devices the option to disable Google Play, because they can get the apps they need via F-Droid.</p> <h2 id="the-shape-of-the-work">The shape of the work</h2> <p>Here is the general idea of what this project will do, as outlined in the funding propsal:</p> <h3 id="1-low-maintenance-repositories">1. Low maintenance repositories</h3> <p>Launch an F-Droid app repository for a pre-curated set of apps that includes direct download links. Ongoing software maintenance is covered since it will be integrated into F-Droid&rsquo;s core offering. App updates, verification, and hosting for the Austria repository are all covered indefinitely by existing Guardian Project/F-Droid efforts. Once complete, other launches will require only a website and a launch campaign.</p> <ul> <li>Integrate APK download tools like EFF&rsquo;s <em>apkeep</em>, <em>gplaycli</em>, etc. into <em>issuebot</em></li> <li>Build existing automation scripts into user tools</li> <li>Link repo publishing with <em>issuebot</em> posts in GitLab project</li> </ul> <h4 id="2-ongoing-review">2. Ongoing Review</h4> <p>Build a public facing app review site based on existing F-Droid methods and software. This would clearly show the technical factors that go into the review process. Chosen contributors can submit and review apps there, the public can watch. This needs some software development and a GitLab instance (could be free hosting on gitlab.com).</p> <ul> <li>Integrate review tools from collaborators</li> <li>Sync tracking lib data with Exodus Privacy&rsquo;s public database</li> <li>Create canonical F-Droid database of proprietary libraries</li> <li>Build out data publishing system, so all extracted data is navigable by scripts</li> </ul> <h4 id="3-community-review">3. Community Review</h4> <p>Expand software tooling to allow submission and review to more contributors. Stage 2 should be running smoothly before opening it up to the public. On top of software development, this needs staff or committed volunteer time spent on managing the community.</p> <ul> <li>user research on how people think about data extracted from apps</li> <li>UX design for <em>issuebot</em> to represent extracted data in GitLab tracker posts</li> <li>document tools so community manager can effectively curate user interactions</li> </ul> <h4 id="4-launch-for-new-organization">4. Launch for new Organization</h4> <p>Launch a campaign for other countries and perhaps EU-wide in partnership with civil society organizations and governments. This could happen after any of the previous stages, e.g. we could help one government setup a &ldquo;pre-curated&rdquo; website and another organization with a &ldquo;community review&rdquo; setup.</p> <h3 id="total-budget-48-000">Total Budget: 48,000€</h3> <p>(<em>We&rsquo;re a little late in publishing this post, the project runs from April through September 2022</em>).</p> https://guardianproject.info/2022/08/29/serving-websites-privately-over-tor-onion-services-from-your-laptop/ Mon, 29 Aug 2022 00:00:00 +0000 https://guardianproject.info/2022/08/29/serving-websites-privately-over-tor-onion-services-from-your-laptop/ <p>In this day and age when our data is consistently being tracked and profited off of, sharing information safely and securely is difficult. However, that does not necessarily mean that all network services are subject to such scrutiny. Users now have the ability to combine the security of HTTPS with the privacy benefits of Tor Browser and share information through Tor’s anonymous network services – <a href="https://community.torproject.org/onion-services/">Onion Services</a>. By using an onion service, users can hide their location while active, connect to other Tor users, and retain their privacy throughout. But to do so, one needs to know how to set up an Onion Service.</p> <p>While the following instructions are specific to a Mac, with minor differences this can be applied to other devices and systems.</p> <h2 id="step-1-download-and-set-up-the-tor-service">Step 1 → Download and Set Up the Tor Service</h2> <p>While there are multiple ways to download and set up tor, the simplest is to follow the instructions at <a href="https://torproject.org/download/">https://torproject.org/download/</a> that goes along with the operating system you are using.</p> <p>For further information, you can follow the Tor installation guide: <a href="https://community.torproject.org/onion-services/setup/install/">https://community.torproject.org/onion-services/setup/install/</a></p> <p>Once you have successfully downloaded tor, to check if tor is running you can either open the browser and establish connection or use commands to check its success:</p> <pre><code>/opt/homebrew/bin/brew services start tor /opt/homebrew/bin/brew services stop tor </code></pre> <p>Please note, in this step you are running the tor service on your machine to host the onion server. In later steps, we will be using the Tor Browser app to view the site remotely.</p> <h2 id="step-2-download-and-set-up-a-web-server-optional-during-development-but-required-for-production">Step 2 → Download and Set Up a Web Server (Optional during Development, but required for Production)</h2> <p>In order to set up a website or some content for a client to access, we need to set up a local web server. A web server is the computer software and underlying hardware that communicates with a web browser using HTTP to distribute web pages to the client who requested it, with local web server examples including Apache and Nginx. The reason for this is that when it comes to the finished product, you can copy the fields into the apache web directory and that would be your web server</p> <p>However, for websites that we are building on npm, as npm has its own built in web server for development, it has its own local host web server ready. Hence, we can just point our hidden service web server at that, for testing and development. Once we arrive at production, we will use the apache or another web server to host our local service.</p> <p>To install these web servers on MacOS can be difficult, so specifically for this operating system, it is best to install (or update) the homebrew package, which will then allow you to run the following command:</p> <pre><code>/opt/homebrew/bin/brew install apache </code></pre> <p>If you have having trouble choosing a local web server or downloading it, a useful guidance tool is: <a href="https://www.javatpoint.com/how-to-install-apache-on-mac">https://www.javatpoint.com/how-to-install-apache-on-mac</a></p> <p>The default location where web servers run is on <a href="https://localhost:80">https://localhost:80</a>. Hence, once you have downloaded the web server software, to check if it is working, open your browser and go to <a href="https://localhost:80">https://localhost:80</a>. If you have successfully downloaded the web server software, you will be notified of this success.</p> <p>For further steps, or multiple uses you may need to start or stop the web server software which can be done using the following commands:</p> <pre><code>sudo apachectl start sudo apachectl stop </code></pre> <h2 id="step-3-modify-your-tor-configuration-file">Step 3 → Modify your Tor Configuration File</h2> <p>In order to create the onion service link, you must mody the the tor configuration file (torrc) by adding the following lines and save the changes:</p> <pre><code>HiddenServiceDir /var/lib/tor/my_website/ HiddenServicePort 80 127.0.0.1:80 </code></pre> <p>The HiddenServiceDir line is to inform tor of where to save the onion v3 service link, hence you must modify this line to point to a file whose permissions include both readable and writable. The HiddenServicePort line is informing Tor of the port people visiting your Onion Service will be using, which is currently set as localhost.</p> <p>While the torrc file is saved in different places depending on the operating system being used, for MacOS, the file can be found at this filepath:</p> <pre><code> /Library/”Application Support”/TorBrowser-Data/Tor/ </code></pre> <h2 id="step-4-create-the-hidden-service-folder-optional">Step 4 → Create the Hidden Service Folder (Optional)</h2> <p>While this step is not necessary, doing this reduces the chance of problems later on.</p> <p>Once you have modified your tor configuration file, you should create the HiddenServiceDir directory where Tor will create the hostname file, which will contain your new onion v3 service address. For MacOS, this file should be created in the tor folder which can be found with this file path:</p> <pre><code>HiddenServiceDir /opt/homebrew/etc/tor/ </code></pre> <p>The folder should be given the permissions to allow tor to read and write to it, which can be done by calling:</p> <pre><code>filename chmod 700 </code></pre> <h2 id="step-5-restart-tor-and-check-for-the-onion-service-link">Step 5 → Restart Tor and Check for the Onion Service Link</h2> <p>Once you have restarted Tor, it should have created the file hostname with the new onion v3 service in the directory which you pointed it to with the HiddenServiceDir line in your torrc. If it has not, potential areas to check for faults are: - The HiddenServiceDir directory’s file permissions - If Tor was properly restarted - The torrc file modifications and if there are any incorrect file paths or mistakes - The log files which you can find using <a href="https://support.torproject.org/#Logs">https://support.torproject.org/#Logs</a></p> <h2 id="step-6-test-your-onion-service">Step 6 → Test Your Onion Service</h2> <p>If you have successfully acquired your onion service link, you can then run it on Tor and it should direct you to the page which has been initially configured on apache (the same page we saw at localhost:80). If not, potential problems could include: - Your web server software is no longer running and needs to be started - The page is found at a different port - One important thing to remember is that once you have gotten your onion address, a new one will not be generated, this is your permanent link whose content can be manipulated.</p> <h2 id="step-7-build-the-file-web-page-being-used">Step 7 → Build the File/Web Page Being Used</h2> <p>Once your onion service link is up and running, it is now time to display on it the html files you intend to share. To do so, if the files are a Node app or a progressive web app, and not a static html page or website, it is important to build the code first by running:</p> <pre><code>npm run build </code></pre> <p>A potential problem could be that when you run a web service, especially a Node app or a progessive web app, it renders links for the domain it thinks it is at, not the one you intend it to be at. For a typical static website it wouldn&rsquo;t matter because it is a static set of pages; however, when using a live node application, it&rsquo;s helpful to know what the public address is.</p> <p>To fix this problem, to your code you should add the following line which points directly to your new onion service address, like the example here:</p> <pre><code>public:’2xx7phs7hw5fduqulcrthkmfaesxbsy5om5xpkpsn4y54mnbj4b6ekd.onion’ </code></pre> <h2 id="step-8-run-the-file-and-test-your-onion-service">Step 8 → Run the File and Test your Onion Service</h2> <p>1- For this step, there are two potential methods depending on the type of content you intend to display on your Onion Service. For html documents or simple websites, the simplest method to run the file is to copy it into the folder which localhost:80 (or whichever port you are using) is connected to. For MacOS, the folder can be found at:</p> <pre><code>/Library/WebServer/Documents </code></pre> <p>To copy, the command to run is:</p> <pre><code>sudo cp /path/from /path/to </code></pre> <p>Once that is done, simply restart your Tor browser, head to your new onion service address and your html file can be found there.</p> <p>2- To run a Node app or progress website, first the file needs to be running on your local server. To do so, one tip is to specify the port you intend to run it on, especially other ports that are running other websites or html content. For that, run the following command (changing it to point to the port you are using):</p> <pre><code>npm run service – –port 4000 </code></pre> <p>To connect to this npm web server on port 4000 instead of apache, we need to modify the onion service configuration in the torrc:</p> <pre><code>HiddenServicePort 80 127.0.0.1:4000 </code></pre> <h2 id="accessing-the-onion-site">Accessing the Onion site</h2> <p>Once the website is running on localhost at the port you have specified, restart your Tor service. Then, navigate to your new onion service address where your website is now live for all the people you have shared your secure link with. You can use any Tor-enabled browser, such as <a href="https://www.torproject.org/download/">Tor Browser for Desktops</a>, <a href="https://www.torproject.org/download/">Tor Browser for Android</a>, or <a href="https://onionbrowser.com">Onion Browser for iOS</a> devices. You can also use a Tor-enabled vpn like <a href="https://orbot.app">Orbot for Android and iOS</a>, to allow any browser, like Chrome or Brave, to access an onion address.</p> https://guardianproject.info/2022/08/19/dweb-versus-web3-an-interns-journey/ Fri, 19 Aug 2022 00:00:00 +0000 https://guardianproject.info/2022/08/19/dweb-versus-web3-an-interns-journey/ <p>Close your eyes and imagine. You are sitting, designing the next game-changing innovative idea; however, you are not worried about any information leakage or spread, as you are in control. You not only hold ownership of your data, but with each online activity, your fear of being tracked dissipates more. This new internet you explore on understands each input, tailoring the content to your specific needs as it no longer runs on basic commands, but rather uses the combination of technologies and concepts such as machine learning, big data, and decentralized ledger technology to process information in a smart, human-like manner. This image in your mind is no longer a distant fantasy, but rather a closely approaching reality – this reality is the decentralized web, otherwise referred to as the DWeb.</p> <p>The DWeb can be understood through comparison to the current internet paradigm. Currently all web traffic travels through centralized servers controlled by the well-known oligopoly that consists of Meta, Google, AWS, etc. Hence, these servers not only hold power by controlling web traffic, permissions and protocols, but also expose our information as an asset to be exploited for profit. Contrastingly, decentralization implies that users retain control of their own data; to hold permission access there can be no middle-man in the process of sending and receiving data, meaning there is peer-to-peer connectivity and links point not to the web server where the information resides, rather the content itself. For these reasons, content can be stored in multiple places at once, thus eliminating the need for a centralized server. While this may seem complicated, the benefits it reaps are unparalleled; from better security to improved privacy rights, user control over data and even greater adaptability to changes. However, the key idea is that through decentralization no monopoly can form, or so one would hope.</p> <p>Having understood the DWeb as any decentralized technical project, the question arises if the implementation of decentralization actually follows through with the virtues of shared ownership and governance. To answer this question, we look towards the ubiquitous example of a decentralized project, Web3 – the Ethereum Solana based application. While the two terms have been interchangeably used, it is necessary to differentiate the theory, the DWeb, and how it can be manipulated in its application, starting with Web3. The DWeb is the umbrella term for all decentralized technological projects, while Web3 is an application of the decentralized web whose services are increasingly powered by blockchains, crypto-assets, artificial intelligence, machine learning, and meta-verses. As the current web, Web2, revolves around personal data being commercialized and is largely dictated by monopoly, censorship and control, Web3 is advertised as the revolutionary shift that solves these problems.</p> <p>When understanding if Web3 can fulfill this shift we look to why Web2 was a cause for concern. As 90% of websites are controlled by a handful of companies, they hold power and influence over its design and experience, thus manipulating it for self-benefit. While Web3 claims to overcome this through the umbrella of decentralization as enabling end-users to own their own data, the fact of the matter is that the same venture capital investors who guided the development of Web2 are now funding Web3 and thus shaping the design and experience to cater to their needs; hence, most of the benefits associated with a decentralized web no longer stand. For instance, what has been understood as a positive side effect of Web3 is the emphasis it will create towards open source software. Particularly with regard to the ineffective traditional funding model, a cause of the misalignment of big corporation&rsquo;s profit models and open source projects, Web3 is said to face this concern as startups will be able to fund themselves with cryptocurrencies. However, if the system designers’ goal is to distribute wealth into the hands of the already wealthy, then the advancement of software that is free and open to all will not be a foremost priority. Hence, while the theory pushes forth ideas of shared ownership, the application is subject to the people who are in control and what they stand to gain.</p> <p>While it is now clear that applications of decentralization don’t necessarily follow through with the virtues of shared ownership and governance, decentralization is not the problem. Rather, when a term is as broadly applicable as this one, greater effort needs to be given to clearly defining it, differentiating its theory and how it can be realized to reflect its core tenets or principles. For instance, when looking at Web3, a step towards ensuring the control remains in the hands of the users, not only does the system need to be decentralized, but its funding should be as well.</p> <p>Sources: - <a href="https://supplain.io/news/web3-solve-web2-problems">https://supplain.io/news/web3-solve-web2-problems</a> - <a href="https://metal.equinix.com/blog/web3-and-open-source/">https://metal.equinix.com/blog/web3-and-open-source/</a> - <a href="https://hypha.coop/dripline/debate-over-dweb-vs-web3/">https://hypha.coop/dripline/debate-over-dweb-vs-web3/</a> - <a href="https://coinmarketcap.com/alexandria/article/what-is-web-3-0">https://coinmarketcap.com/alexandria/article/what-is-web-3-0</a> - <a href="http://milesberry.net/2006/11/open-source-and-web-20/">http://milesberry.net/2006/11/open-source-and-web-20/</a></p> https://guardianproject.info/2022/07/29/ietf114-conference-report-friday-july-29-2022/ Fri, 29 Jul 2022 00:00:00 +0000 https://guardianproject.info/2022/07/29/ietf114-conference-report-friday-july-29-2022/ <p><em>Day Five of the <a href="https://www.ietf.org/how/meetings/114/">114th IETF meeting</a> in Philadelphia USA. For the rundown on Day Four, see my <a href="https://guardianproject.info/2022/07/28/ietf114-conference-report-thursday-july-28-2022/">daily report</a>.</em></p> <p>A quiet day today with only the <a href="https://datatracker.ietf.org/wg/mls/charter/">Messaging Layer Security</a> Working Group holding its session. Draft 16 of the <a href="https://datatracker.ietf.org/doc/draft-ietf-mls-protocol/">MLS protocol</a> completed last-call in mid-July and has been submitted for review after significant technical and editorial feedback from the working group. Are we getting close (again)? The <a href="https://datatracker.ietf.org/doc/draft-ietf-mls-architecture/">MLS Architecture</a> document was lightly revised and version 8 submitted for review. Two new drafts were presented: <a href="https://datatracker.ietf.org/doc/draft-mahy-mls-content-neg/">MLS Content Negotiation</a> and <a href="https://datatracker.ietf.org/doc/draft-robert-mls-extensions/">MLS Extensions</a>. The former has yet to be adopted as a Working Group item, but the latter was adopted during IETF114 (before the MLS session, over the mailing list).</p> <p>Federation (between messaging systems supporting MLS) was upgraded to BoF (Birds of a Feather) status at IETF114, with the <a href="https://datatracker.ietf.org/doc/bofreq-mahy-mimi-more-im-interop/">formal announcement</a> that the activity would, if agreed by BoF participants, be seeking Working Group status. The implication here is that the current MLS Working Group might <em>fold the tent</em> after completion of the architecture and protocol work (a MLSbis Working Group would conceivably follow to handle protocol extensions and updates). The existing draft on <a href="https://datatracker.ietf.org/doc/html/draft-ietf-mls-federation">MLS Federation</a> would then be picked up by this new Working Group as a starting point.</p> https://guardianproject.info/2022/07/28/ietf114-conference-report-thursday-july-28-2022/ Thu, 28 Jul 2022 00:00:00 +0000 https://guardianproject.info/2022/07/28/ietf114-conference-report-thursday-july-28-2022/ <p><em>Day Four of the <a href="https://www.ietf.org/how/meetings/114/">114th IETF meeting</a> in Philadelphia USA. For the rundown on Day Three, see my <a href="https://guardianproject.info/2022/07/27/ietf114-conference-report-wednesday-july-27-2022/">daily report</a>.</em></p> <p>At IETF112 (online) a formal Birds of a Feather (BoF) session was held on the concept of <a href="https://datatracker.ietf.org/meeting/112/materials/slides-112-priv-chair-slides-agenda-01">Privacy Preserving Measurement</a>. A Working Group was <a href="https://datatracker.ietf.org/wg/ppm/about/">chartered</a> and, at IETF113 in Vienna, we were treated to an incredibly detailed presentation on <a href="https://eprint.iacr.org/2021/576.pdf">Prio</a>, an academic concept for supporting privacy in the context of Internet-scale measurement. Quickly following that presentation was an IETF proposal for a <a href="https://datatracker.ietf.org/doc/draft-ietf-ppm-dap/">defined protocol</a> for <em>distributed aggregation</em> of measurement data, based on Prio&rsquo;s core concepts and using a range of cryptographic and system architecture techniques to separate measurements from the identities of the human users being measured.</p> <p>Here at IETF114, an alternative proposal was brought forward by <a href="https://brave.com/about/">Brave Software</a> called <a href="https://datatracker.ietf.org/doc/html/draft-dss-star">STAR</a>. STAR uses techniques (specifically, distributed <a href="https://www.geeksforgeeks.org/shamirs-secret-sharing-algorithm-cryptography/">Shamir Secret Sharing</a>) which make the system simpler to build and presents a smaller attack surface for adversaries. Brave reported that STAR is in production use for some telemetry in the current <a href="https://brave.com/download/">Brave browser</a>. Several enhancements are planned, among them use of Oblivious HTTP Application Intermediation (<a href="https://www.ietf.org/id/draft-ietf-ohai-ohttp-02.html">OHAI</a>) to reduce exposure of Brave users&rsquo; IP addresses when they share telemetry data.</p> <p>In what is certainly a milestone in the IETF&rsquo;s efforts to have positive impact on user privacy, Apple presented its experience with deploying its <em>private label</em> version of the <a href="https://datatracker.ietf.org/wg/privacypass/about/">Privacy Pass protocol</a> called Private Access Tokens - defined <a href="https://www.ietf.org/archive/id/draft-private-access-tokens-01.html">here</a> and announced <a href="https://developer.apple.com/news/?id=huqjyh7k">here</a>. Private Access Tokens is a service fully compliant with Type 2 (Publicly Verifiable Basic Tokens) of the Privacy Pas specification, using the Split Origin/Attester/Issuer model and supporting origin-bound or cross-origin tokens. Apple has also made developer tools available so applications (and not just browsers) can make use of the technology. Importantly, two open source implementations of the Type 2 spec are also available, and several CDN vendors are cooperating in providing test points. See more <a href="https://datatracker.ietf.org/meeting/114/materials/slides-114-privacypass-deployment-experience-00">here</a>.</p> <p>Significant progress has been made on the protocol&rsquo;s <a href="https://datatracker.ietf.org/meeting/114/materials/slides-114-privacypass-base-drafts-update-00">three base drafts</a>. The success of these drafts might, however, be overtaken by the need to support an important use case - rate limiting. Rate limiting can be used to subjugate DDoS type attacks and it can also be used to enforce <em>paywall</em> type subscription services. The challenge? Rate limiting necessarily weakens the privacy guarantees that form the basis for Privacy Pass. The Working Group <a href="https://datatracker.ietf.org/meeting/114/materials/slides-114-privacypass-rate-limited-tokens-slides-v2-00">is debating</a> what sort of damage limitation needs to be applied to this degradation in order to keep the value of the idea strong enough to justify the expense of maintaining it while also encouraging trust in the service by users.</p> <p>With the HTTP protocol <a href="https://httpwg.org/specs/">long defined</a>, the <a href="https://datatracker.ietf.org/wg/httpbis/charter/">HTTPbis Working Group</a> is chartered to maintain and develop the core specifications as well as extensions to the protocol agreed to be generally useful. To that end, the Working Group heard four new proposals for extension. Important for privacy are <a href="https://datatracker.ietf.org/doc/draft-pauly-httpbis-geoip-hint/">GeoIP</a> and <a href="https://datatracker.ietf.org/doc/draft-schinazi-httpbis-transport-auth/">HTTP Transport Authentication</a>.</p> <p>GeoIP attempts to address the problem of sharing personal location data, but in a manner that doesn&rsquo;t induce harm or threaten privacy. The author&rsquo;s idea is to support a location <em>hint</em>, as an option, on HTTP transactions. They were quickly reminded that IETF has tried to address location privacy for over a decade with nothing to show for it. In the end, however, most participants agreed it was important for IETF to address this area, even if the specific proposal was (tragically?) flawed.</p> <p><a href="https://datatracker.ietf.org/doc/draft-schinazi-httpbis-transport-auth/">HTTP Transport Authentication</a> has been revived after a long period of dormancy caused by the work on proxying over HTTP/3 (now almost complete). Impacted by that proxying work as well as many of the new concepts being developed around <em>oblivious</em> services (those that don&rsquo;t leak the user&rsquo;s IP address), this proposal has moved away from it&rsquo;s focus on CONNECT tunnel authentication to a proxy server in favor of a general authentication scheme to suit situations in which servers do not want to expose the fact they are hosting authenticated services (<em>silent</em> or non-probe-able authentication). The Working Group found the concept useful but asked for a number of editorial changes before they would vote to accept it as a work item. A technical flaw will need to be addressed as well.</p> https://guardianproject.info/2022/07/27/ietf114-conference-report-wednesday-july-27-2022/ Wed, 27 Jul 2022 00:00:00 +0000 https://guardianproject.info/2022/07/27/ietf114-conference-report-wednesday-july-27-2022/ <p>*Day Three of the <a href="https://www.ietf.org/how/meetings/114/">114th IETF meeting</a> in Philadelphia USA. For the rundown on Day Two, see my <a href="https://guardianproject.info/2022/07/26/ietf114-conference-report-tuesday-july-26-2022/">daily report</a>.</p> <p>Interest is starting to consolidate on the need for additional definition for serving media over the QUIC transport layer, particularly for streaming and conferencing applications. Following an informal gathering at IETF113 in March 2022, a formal Birds of Feather session met today with a draft <a href="https://datatracker.ietf.org/meeting/114/materials/slides-114-moq-moq-charter-proposal-00">charter proposal</a> and two draft documents describing the intended <a href="https://www.ietf.org/id/draft-gruessing-moq-requirements-02.html">use cases</a> and a <a href="https://www.ietf.org/id/draft-jennings-moq-quicr-proto-01.html">protocol</a>. <a href="https://datatracker.ietf.org/meeting/114/materials/slides-114-moq-if-time-permits-quicr-01">Here&rsquo;s</a> a more visual overview. There was broad concensus (at this well-attended session) as to the need for this work, but a split between one camp that sought a much narrower set of use cases (not wanting to <em>boil the Internet</em> as it were) and another who wanted to <em>solve this problem once</em>. This will be addressed as the BoF leaders work towards a vote on chartering the effort. Either way, this is substantial work ahead. I mention this here not so much in the realm of privacy as to look towards a future where QUIC&rsquo;s efficiency and scalability benefits might make media-rich services available to those of lesser economic means or with mediocre connectivity.</p> <p>Directly related to our interests in privacy and a free and open Internet, the MASQUE Working Group presented the status of what will be the last of its core specifications, <a href="https://www.ietf.org/archive/id/draft-kuehlewind-masque-connect-ip-01.html">CONNECT-IP</a>. With implementations ready for interoperability testing, the protocol definition is being scrubbed for <a href="https://github.com/ietf-wg-masque/draft-ietf-masque-connect-ip/issues">burning issues</a>. Of these, some headway was made at the meeting, though all are still officially under discussion.</p> <p>Recall the challenges with actual interoperability testing with CONNECT-IP at the Hackathon last weekend (see <a href="https://guardianproject.info/2022/07/24/ietf114-hackathon-report-sunday-july-24-2022/">report</a>)? With spec definition work almost complete, the Working Group&rsquo;s mission will also be complete and, officially, put the group in a position to disband. But those interoperability challenges provide the next raison d&rsquo;être for continuation and, with five proposals already before the group, concensus was that the group leaders should move forward with re-chartering with a new mission which - at least by concensus of those present - will focus on assuring MASQUE is deployable in real-world scenarios. With CONNECT-IP lowest in the protocol stack individual vendors and implementors face vastly different integration scenarios and, in many cases, with quite different teams who have (historically) faced divergent requirements. That said, the demand for proxying IP over QUIC is already huge, with both major mobile device vendors lining up extensive services for their platforms using the MASQUE model. IETF&rsquo;s implementation-checks-definition model is well-suited to this sort of aggressive development, thankfully.</p> https://guardianproject.info/2022/07/26/ietf114-conference-report-tuesday-july-26-2022/ Tue, 26 Jul 2022 00:00:00 +0000 https://guardianproject.info/2022/07/26/ietf114-conference-report-tuesday-july-26-2022/ <p><em>Day Two of the <a href="https://www.ietf.org/how/meetings/114/">114th IETF meeting</a> in Philadelphia USA. For the rundown on Day One, see my <a href="https://guardianproject.info/2022/07/25/ietf114-conference-report-monday-july-25-2022/">daily report</a>.</em></p> <p>Lucas Pardue, of Cloudflare and co-chair of the QUIC Working Group, gave a not-so-tongue-in-cheek <a href="https://datatracker.ietf.org/meeting/114/materials/slides-114-anrw-sessa-keynote-00">talk</a> about the breakdown of the OSI layering model of the Internet. His focus was on the <em>top</em> of the stack, illustrating handsomely what QUIC and HTTP/3 have done (unknowingly to most) to our perception of layers. A key challenge: tools for HTTP/1 are widely available and the protocol and its impacts are widely understood. HTTP/2 and HTTP/3? Not so much (both are binary, not text-based, protocols). Yet, here in mid-2022, the world of the Internet is predominantly (91%!) HTTP/2 and HTTP/3 traffic. Similarly, TLS/1.3 and QUIC represent 87% of traffic. And many of the now-being-standardized protocols for privacy insert several layers of proxy into every transaction. From a <em>sound knowledge</em> perspective, we seem to have taken a rather quick, and rather deep, step backwards.</p> <p>The <a href="https://datatracker.ietf.org/wg/ohai/about/">OHAI Working Group</a> has brought the core draft of <a href="https://datatracker.ietf.org/doc/draft-ietf-ohai-ohttp/">Oblivious HTTP Application Intermediation</a> nearly to Working Group Last Call (technical finalization). With multiple interoperable implementations said to exist, this bodes well for rapid completion and standardization. The twistingly-worded name engenders confusion (or distain) but the goal is laudable: make the requester&rsquo;s IP address private in any <em>transactional</em> HTTP-based protocol. Transactional protocols include DNS and Online Certification Status Protocol. But the dominant imagined use case is <em>telemetry</em> - monitoring vendor-, application- or operating system-define usage parameters on centralized systems. A few holes remain, however, for services that do not want (or need) to be tightly-coupled (systems that are not, for example, an operating system&rsquo;s fault reporting service).</p> https://guardianproject.info/2022/07/25/ietf114-conference-report-monday-july-25-2022/ Mon, 25 Jul 2022 00:00:00 +0000 https://guardianproject.info/2022/07/25/ietf114-conference-report-monday-july-25-2022/ <p><em>Day One of the <a href="https://www.ietf.org/how/meetings/114/">114th IETF meeting</a> in Philadelphia USA.</em></p> <p>With privacy a key consideration in new protocol design, cryptography has become a major focus of IETF activities. The Internet Research Task Force (IRTF) has the <a href="https://irtf.org/cfrg">Crypto Forum Research Group</a> where new cryptography schemes are brought forward and vetted for use in IETF protocols. Well, <em>new</em> is a misnomer. Much of the mathematics has long been defined, at least at its core, and the work is rather being brought into the IETF context where important engineering considerations apply: use of memory (at rest or in flight), processing required, round-trips required, etc.. Of significance at this meeting, mechanisms for <em>blinding</em> a digitial signature are in high demand given the prevalence of multi-tiered approaches to privacy (that is, approaches that insert one or more proxies between entities in a transaction). Something similar is in the works for cryptographic keys. A number of IETF protocol specifications, still in development, are in line to receive these mathematical gems including <a href="https://datatracker.ietf.org/group/privacypass/about/">Privacy Pass</a>, <a href="https://datatracker.ietf.org/doc/draft-private-access-tokens/">Private Access Tokens</a>, <a href="https://datatracker.ietf.org/wg/ohai/charter/">Oblivious HTTP Application Intermediation</a> and others. An excellent summary of the National Institute for Standards and Technology (NIST) <a href="https://csrc.nist.gov/publications/detail/nistir/8413/final">Post-Quantum Cryptography <em>contest</em></a> was also provided. The topic itself, let alone the solutions chosen, is not for the weak-kneed.</p> <p>Among IETF&rsquo;s most difficult challenges - for those of us interested in privacy - is the massive amount of surveillance that Internet users endure in everyday life. One problem is simply defining what <em>surveillance</em> means, in the commercial rather than law enforcement sense. Toward that end, the <a href="https://datatracker.ietf.org/rg/pearg/about/">Privacy Enhancements and Assessments Research Group</a> hosted an excellent <em>first principles</em> presentation teasing out ideas around <em>decoupling</em> who we are versus what we do, and specifically architectures and design principles to increase decoupling for the purpose of preserving privacy. IETF has a new Working Group looking at <a href="https://datatracker.ietf.org/wg/ppm/about/">Privacy Preserving Measurement</a> where some of the decoupling ideas are key. While one approach to privacy preserving measurement has been presented to IETF in the past, PEARG hosted a well-considered survey presentation that looked at a number of techniques in this field at different stages of development. Not considered here: the <a href="https://cleaninsights.org">Clean Insights</a> project, with which Guardian Project is associated and which was perhaps the first to take a user-consent approach, and the <a href="https://opendp.org">Open Differential Privacy Project</a> which seeks to make its tools explicitly transparent for public scrutiny.</p> https://guardianproject.info/2022/07/24/ietf114-hackathon-report-sunday-july-24-2022/ Sun, 24 Jul 2022 00:00:00 +0000 https://guardianproject.info/2022/07/24/ietf114-hackathon-report-sunday-july-24-2022/ <p><em>This post begins a daily blog, live from the 114th meeting of the <a href="https://www.ietf.org/how/meetings/114/">Internet Engineering Task Force</a> in Philadelpha Pennsylvania USA, July 23-29, 2022 (in-person meetings having restarted in March 2022 after the COVID pandemic abated). We&rsquo;re focusing on standards activities of importance to the Internet Freedom community.</em></p> <p>The <a href="https://www.ietf.org/how/runningcode/hackathons/114-hackathon/">Hackathon</a> event kicks off each IETF event, with projects that run the gamut from early implementations of just-emerging specifications to full multi-vendor interoperability testing of nearly-mature protocols. At this event, I sat in on the <a href="https://datatracker.ietf.org/wg/masque/about/">MASQUE</a> team&rsquo;s effort to commence work on the new <a href="https://datatracker.ietf.org/doc/draft-ietf-masque-connect-ip/">CONNECT-IP</a> specification. With the recent completion of two key specifications - <a href="https://datatracker.ietf.org/doc/draft-ietf-masque-connect-udp/">CONNECT-UDP</a> and <a href="https://datatracker.ietf.org/doc/draft-ietf-masque-h3-datagram/">H3 Datagrams</a> - MASQUE has become IETF&rsquo;s solution for proxying all types of network traffic over QUIC and HTTP/3, including VPN and other privacy-focused scenarios. CONNECT-IP will complete the trio. But this initial effort didn&rsquo;t go well. Google and Ericcson (co-authors on the spec) had brought teams who, indeed, implemented the key protocol elements of CONNECT-IP live and in-the-moment but were both stymied setting up testbeds that could deliver raw IP packets for routing by this new code. Wait, you might say, aren&rsquo;t these network engineers? True, but it was mostly the practicalities that got in the way - only laptops as test machines, working from the open source <a href="https://github.com/google/quiche">QUICHE</a> repository on a machine that also hosts an environment for building production code, even deciding what sort of packets could be used for testing and where to route them. These are the frustrations of a first-ever effort.</p> <p>Other teams had much better luck even if they are not specifically focused on privacy. Fourteen vendors worked together on the first interoperabiltiy test of <em>Low Loss Low Latency Scalable Throughput</em>, <a href="https://www.ietf.org/archive/id/draft-ietf-tsvwg-l4s-arch-12.html">L4S</a>, an ambitious effort that was ultimately successful (that is, both at functioning at all and producing excellent results). Another team working on the Drone Remote ID Protocol <a href="https://datatracker.ietf.org/wg/drip/about/">DRIP</a> were also successful - despite the lack of hackable drones or access to the key server software this protocol will eventually have to interoperate with &ndash; and produced the first working demonstration of DRIP&rsquo;s session registration protocol (which, it happens, involves almost all aspects of the proposed standard). These two projects will surely be the hits of the upcoming Hackdemo Happy Hour!</p> <p>With the Hackathon complete, IETF turns to the serious business of creating new specifications. This week&rsquo;s meeting will see working sessions on <a href="https://datatracker.ietf.org/group/ohai/about/">Oblivious HTTP Application Intermediation</a>, <a href="https://datatracker.ietf.org/wg/privacypass/about/">Privacy Pass</a>, <a href="https://datatracker.ietf.org/wg/mls/charter/">Messaging Layer Security</a> and <a href="https://datatracker.ietf.org/wg/ppm/about/">Privacy Preserving Measurement</a> in addition to emerging ideas from the Internet Research Task Force&rsquo;s <a href="https://datatracker.ietf.org/doc/charter-irtf-pearg/">Privacy Enhancements and Assessments Research Group</a>. And MASQUE, where we&rsquo;ll have some explaining to do about our Hackathon gaff.</p> https://guardianproject.info/2022/07/20/rightscon-report-surveillance-and-facial-recognition-protection-or-instruments-of-control/ Wed, 20 Jul 2022 00:00:00 +0000 https://guardianproject.info/2022/07/20/rightscon-report-surveillance-and-facial-recognition-protection-or-instruments-of-control/ <p>Safety is one of the foremost questions we seek to answer as we roam about in our everyday lives, taking precautions to reduce the likelihood of all threats. It is the very reasoning behind the use of surveillance technology from civilians to the state government, as it hinders crime through fear of persecution and retribution. However, variables such as the time taken for assistance can limit this objective. In these instances, surveillance is not a means of protection, but rather justice, as facial recognition technology can discern the perpetrator to bring to justice. However, the concern arises: do those with the access to this means of seeking justice utilize it for other purposes?</p> <p><img src="rightscon_report_blog.png" alt="cameras and surveillance image" /></p> <p><a href="https://www.rightscon.org/">RightsCon 2022</a> offered not just the answer, but further explanation through <a href="https://www.stopspying.org/events/2022/6/6/rightscon-surveillance-and-the-city-mapping-cameras-with-facial-recognition-capabilities-in-new-york-city">‘Surveillance and the city: mapping cameras with facial recognition capabilities in New York City’</a>. NYC was the exemplary location due to its tradition of being a sanctuary to large immigrant communities. So when the NYPD refused to respond favorably to questions regarding how, in which cases, and for what purposes facial recognition is used, Surveillance Technology Oversight Project’s (S.T.O.P.) 2021 Surveillance Census and Amnesty International’s Decode NYC Surveillance initiative answered in its stead. Amnesty and S.T.O.P confirmed that the “map of NYC surveillance cameras strikingly reflects structural racism, segregation, and the oversurveillance and discriminatory policing of BIPOC communities”. Hence, not only is it clear that these technologies are used for means other than justice, it is evident that they are instruments to control minorities and marginalized groups.</p> <p>While at first glance this act limits civic space for protest as being able to identify protestors and prosecute as they deem fit, the control seeps deeper. Authorities purposefully display racial biases by invading these populations’ private sanctuary to propagate them as predators who must be watched to keep them at bay, propagating structural inequality to future generations. So even though surveillance offers protection, it can also be used to invade your privacy to be used against you. Compounding this fact with the inaccuracy of facial recognition software, for reasons such as the inability of facial recognition software - testing primarily on white men - to discern between individuals of minority groups, the threat of surveillance’s invasion becomes abundantly clear.</p> <p>The United Nations Declaration of Human Rights (UDHR) 1948, Article 12 states that “No one shall be subjected to arbitrary interference with his privacy”. Guardian Project’s intent is to secure the implementation of this declaration by opposing breaches in privacy with services such as <a href="https://guardianproject.info/apps/obscuracam/">ObscuraCam</a> - a secure smart camera that protects privacy by removing all identifying data stored in photos, including the option to pixelate, redact or cover faces to skirt facial recognition. By allowing users to share photos and videos without the fear of data such as their location being shared along with it for misuse, users have the option to secure privacy through novel methods. However, this does not curb the surveillance data and facial recognition from cameras of external parties, only the users’ own photos and videos. And thus, surveillance in itself remains susceptible to exploitation that furthers agendas opposing the public’s welfare. In spite of that, eradication is not the solution as its ability to protect and provide justice remains strong. This renders the question of how surveillance’s purposes can be restricted to those which follow collective society - a question Guardian Project began to answer with <a href="https://proofmode.org">ProofMode</a>.</p> <p>Recognizing the need to collate and retain data for protection purposes, <a href="https://proofmode.org">ProofMode</a> was created to safely store media; ensuring no original files would be tampered with, using cryptography to verify the media and the identities it contains, and offering PGP encryption to protect the content and its metadata. Nonetheless, the aspect of ProofMode that demonstrates how surveillance’s purposes can be restricted to those of protection and justice is the idea it was founded on - capturing data for protection, but encrypting the identities so that the information cannot be used against you, only retrieved and made useful with consent. ProofMode began the conversation into the difference between facial detection and recognition, enforcing the idea that detecting means simply acknowledging a face, and recognition is identifying the person. By opening this discussion, we now can understand that to hinder surveillance from becoming an instrument of control, the identities captured should be protected and encrypted so that only when there is a threat should recognition software be used to solely identify the perpetrator and ensure the innocent retain their anonymity.</p> <p>To further walk this path of opposing the gross misuse of surveillance and facial recognition technology, the next steps should be educating the public on these instruments of control, making them aware of the systems in palace that assist in retaining anonymity, and inviting them to the aforementioned discussion. In conjunction, a goal for Guardian Project should be integrating the publicly available maps of surveillance for ease of access and use into ObscuraCam. These maps offer two distinct functions for users with one common goal that aligns with ObscuraCam’s mission - self-protection; foremost, it protects users from external threats by offering a watchful eye, the original intended goal; secondly, it assists users against the watchful eye by skirting surveillance that can be used against them in acts of defiance such as protests. The third functionality is one that benefits not just individual users, but society at large - advancing knowledge of structural inequality. Increasing awareness of the areas of clustered surveillance escalates knowledge of the presence and level of the structural inequality to amass support against such. With greater awareness, the suveillant’s power diminishes as people have the ability to take back their privacy, rendering the project obsolete until the objective is re-routed inline with the mass. To do so, transparency and awareness through discussion are what we must strive to achieve, ensuring surveillance and facial recognition be used only for protection and not as an instrument of control.</p> https://guardianproject.info/2022/03/28/ietf113-conference-report-friday-march-25-2022/ Mon, 28 Mar 2022 00:00:00 +0000 https://guardianproject.info/2022/03/28/ietf113-conference-report-friday-march-25-2022/ <p>Final day of the 113th IETF meeting, in Vienna Austria.</p> <p>The IETF is looking to make a clear contribution to the problem of hyper-aggressive measurement of user activities on the Internet and the many misuses thereof. To do so, the IETF recognizes that some measurement is important but that many desirable measurements require data most people consider sensitive. It also recognizes that aggregated measurements often provide the most value, rather than individual ones. Yet, today, parties interested in measurement need to collect and store individual records in order to aggregate them, exposing themselves to potential violations of their privacy agreements with users (or governments) and to theft of that data by outsiders. Instead, IETF is looking at ways this aggregation can be managed in ways that protect user privacy while still providing much of the statistical power needed. The <a href="https://datatracker.ietf.org/group/ppm/about/">Privacy Preserving Measurement Working Group</a> has formed.</p> <p>The IETF&rsquo;s effort centers around new cryptographic techniques that allow an intermediary aggregation service to aggregate measurements in a variety of ways <em>without</em> learning the individual values themselves, then passing that aggregated information along to <em>collectors</em> (organizations that use the measurements). The protocol design will include mechanisms for:</p> <ul> <li>Safe submission of individual measurements by the client (potentially including proof of validity)</li> <li>Verification of such validity proofs at the <em>aggregator</em> when provided by the client</li> <li>Computation of aggregates at the <em>aggregator</em></li> <li>Reporting of results to the <em>collector</em> without leaking the individual measurements</li> </ul> <p>The Working Group is chartered to deliver one or more protocols that can accommodate multiple privacy-preserving algorithms as necessary. Two such algorithms are already under consideration - one based on <a href="https://educatedguesswork.org/posts/ppm-prio/">Prio</a> (<a href="https://datatracker.ietf.org/doc/draft-gpew-priv-ppm/">Draft</a>), the other based on <a href="https://www.ietf.org/staging/draft-dss-star-00.html">STAR</a>. The protocol(s) will be designed to limit abuse by both clients and servers (aggregation servers, collector servers), including exposure of individual user measurements and denial of service attacks.</p> <p>While this work has the character of <em>seeming</em> appropriate and necessary, there are many aspects to consider - just in the protocol design, let alone the social and policy implications - that caused attendees to say, to the effect, &ldquo;<em>I&rsquo;m leaving here more confused than when I entered</em>&rdquo;. The unique trust model implied, the increased centralization implied, the completeness of the approach (that is, how much measurement it subsumes), the alignment with laws and agreements already in place, the pragmatics around what organizations can run such a service - these are questions yet unaddressed. But at least now IETF has a solid stake in the ground from which to move forward.</p> https://guardianproject.info/2022/03/27/ietf113-conference-report-thursday-march-24-2022/ Sun, 27 Mar 2022 00:00:00 +0000 https://guardianproject.info/2022/03/27/ietf113-conference-report-thursday-march-24-2022/ <p>Day four of the 113th IETF meeting, in Vienna Austria.</p> <p><a href="https://datatracker.ietf.org/group/privacypass/about/">Privacy Pass</a> - originating at Cloudflare in 2017 as a solution to user frustration with CAPTCHA - has been in full swing as an IETF activity since mid-2020. Privacy Pass allows a client to solve some form of validity check (a CAPTCHA, a puzzle, a user-pass authentication) to then receive some number of tokens to be used at websites accepting Privacy Pass, thus eliminating the need to do a CAPTCHA at each site. Sites hosted on large CDNs like Cloudflare benefit (Cloudflare provides the service for them) and users get a more convenient experience. Users accessing the Internet through Tor are even more positively affected since they are most prone to CAPTCHA. Privacy Pass is now in Version 3 and working to support a multi-issuer environment to provide another uplift to the user experience (tokens can be validated across issuers). Just prior to this IETF meeting, a standardized mechanism for exchanging Privacy Pass tokens was adopted by the Working Group - <a href="https://datatracker.ietf.org/doc/draft-ietf-privacypass-auth-scheme/">The Privacy Pass HTTP Authentication Scheme</a>. Both request and response mechanisms are provided so that use of (or demand for) the token can be either server- or client-initiated. Going forward, it will be interesting to see if Privacy Pass benefits mostly the web browsing environment or finds its way into applications using HTTP as a substrate for richer styles of interaction.</p> <p>It&rsquo;s important to point out that Privacy Pass, in practice, requires relatively-centralized infrastructure (issuers, who grant and redeem tokens). In fact, the mathematics behind the multi-issuer capability in Version 3 requires that the number of issuers is limited to avoid users being de-anonymized too easily. A more complete discussion of centralization and Privacy Pass is available <a href="https://datatracker.ietf.org/doc/html/draft-mcfadden-pp-centralization-problem-01">here</a>. IETF members have, for some years now, expressed concern about increasing centralization - not only of Internet hardware (which the work of IETF can not in practice impact) but also of the protocol designs themselves. The Internet Architecture Board has, during its recent Open Meetings, taken on the weight of this discussion, providing a forum for both studies of, and individual views on, the topic. A formal statement from the group, though, has been harder to achieve. As an alternative, individual voices have been encouraged, the most recent being former IAB member <a href="https://datatracker.ietf.org/person/Mark%20Nottingham">Mark Nottingham</a> who has produced <a href="https://datatracker.ietf.org/doc/draft-nottingham-avoiding-internet-centralization/"><em>Centralization and Internet Standards</em></a> that tries to define the problem in ways that can eventually be addressed within the IETF.</p> <p>Though it seems like very early days here, I&rsquo;m encouraged both that discussions are vocal and pubic, and that more <em>human-centric</em> voices are now present at IETF who have been working <em>within the system</em> to provide tools and guidelines that can inform protocol design in ways that maybe, just maybe, will pull us back from the edge.</p> https://guardianproject.info/2022/03/26/ietf113-conference-report-wednesday-march-23-2022/ Sat, 26 Mar 2022 00:00:00 +0000 https://guardianproject.info/2022/03/26/ietf113-conference-report-wednesday-march-23-2022/ <p>Day three of the 113th IETF meeting, in Vienna Austria.</p> <p>Messaging Layer Security (<a href="https://datatracker.ietf.org/wg/mls/about/">MLS</a>) is (finally) closing in on <a href="https://www.ietf.org/about/glossary/?query=wglc">Last Call</a> at protocol Draft 14 and architecture Draft 7 (which will be taken forward together). Sometimes referred to as the <em>TLS for messaging systems</em>, Messaging Layer Security creates a uniform secure group discussion protocol, scalable to very large groups and providing similarly uniform security guarantees across providers. The near completion of the architecture and protocol drafts, and commencement of interoperability testing has prompted the Working Group to dust off the <a href="https://datatracker.ietf.org/doc/html/draft-ietf-mls-federation">Federation draft</a> as the next object of their affection. Will I be able to connect my <a href="https://wire.com/en/">Wire</a> client to the <a href="https://www.messenger.com/">Facebook Messenger</a> server? Don&rsquo;t hold your breath, but in the meantime you&rsquo;ll be able to enjoy the manifest benefits of secure group chat (with security guarantees as high as the industry knows how to produce) on your own network.</p> <p>Oblivious HTTP Application Intermediation (<a href="https://datatracker.ietf.org/wg/ohai/charter/">OHAI</a>) is another in the suite of new designs aimed at reducing misuse of the client&rsquo;s IP address. OHAI is complementary to <a href="https://datatracker.ietf.org/wg/masque/about/">MASQUE</a> - the former focused on <em>transactional</em> service protocols like DNS and <a href="https://datatracker.ietf.org/doc/rfc8954/">OCSP</a> queries, the latter on fully bi-directional interactive exchanges. Like MASQUE, proxies are involved (between requester and request destination) and in both cases the client (user) has to trust the proxy. However, in the case of bad-actor clients, it is imagined that the proxy will want to communicate on a side channel with its counterpart to stop things like reply attacks or other mischief via <em>shadow banning</em>. This, however, raises the spectre of collusion among the intermediaries - something OHAI was initially defined to avoid. There seems to be significant effort remaining on this proposal.</p> <p>As mentioned in the prior post, the Human Rights Protocol Considerations(<a href="https://sandbox-ng.ietf.org/group/hrpc/documents/">HRPC</a>) Research Group considered a new Individual Contribution on <a href="https://datatracker.ietf.org/doc/draft-giuliano-blocking-considerations/">Regional Internet Blocking Considerations</a>. While the current geopolitical environment was the impetus for this work, the content isn&rsquo;t specific to a particular event. Rather, it catalogs - for policy makers - the technical mechanisms available to <em>withdraw</em> geographic areas from connection to the global network, effectively <em>de-mystifying</em> the concept. Also via HRPC, the IETF got its first look at the idea of <em>content provenance</em> in the work of the <a href="https://c2pa.org">Coalition for Content Provenance and Authenticity</a> and their efforts to create <a href="https://c2pa.org/specifications/specifications/1.0/specs/C2PA_Specification.html">specifications</a> around this idea. Guardian Project&rsquo;s pioneering <a href="https://proofmode.org/about">ProofMode</a> work got a shout out! Of special importance here, and perhaps more significance to IETF than the <em>data at rest</em> work of the specification itself, are its generally-applicable definitions in the area of <em>Harms Modelling</em>, readapted from work by <a href="https://docs.microsoft.com/en-us/azure/architecture/guide/responsible-innovation/harms-modeling/">Microsoft</a>. This concept is core to HRPC&rsquo;s research mission as defined in <a href="https://datatracker.ietf.org/doc/html/rfc8280">rfc8280</a> and this is the most rigor I&rsquo;ve seen in defining the concept in ways that can have protocol impact.</p> https://guardianproject.info/2022/03/24/ietf113-conference-report-tuesday-march-22-2022/ Thu, 24 Mar 2022 00:00:00 +0000 https://guardianproject.info/2022/03/24/ietf113-conference-report-tuesday-march-22-2022/ <p>Day two of the <a href="https://www.ietf.org/how/meetings/113/">113th IETF meeting</a>, in Vienna Austria. The crisis in Ukraine is on everyone&rsquo;s mind, lending immediacy to the work of the Global Access to the Internet for All (GAIA) Research Group. While past and continuing work has focused on Internet access for the world&rsquo;s population (especially those disadvantaged by economics, distance, mobility, and social constraints) the situation in Ukraine resulting from military activities give cause for both concern and hope. While communications access points have been obviously targeted, the inherently decentralized topology of the Internet infrastructure in Ukraine has afforded surprising resiliency, increased by the willingness of nominal competitors to patch the communication systems back together for the good of all. Few will remember that this resiliency from military attack was the raison d&rsquo;être for ARPANet, predecessor to the Internet. Perhaps, in this era of increasing centralization (hardware and software), the crisis in Ukraine will give us the impetus to consider changes to the trajectory of consolidation we&rsquo;ve allowed to occur. We&rsquo;ll follow up on this topic tomorrow after the Human Rights Protocol Considerations (HRPC) Research Group who will take up the topic of Regional Internet Blocking.</p> <p>Another important consideration from today&rsquo;s GAIA presentations: the environmental impact of decisions we make about the architecture of the Internet. While it&rsquo;s easy to trash cryptocurrency for its unfathomable consumption of electricity (live dashboard <a href="https://ccaf.io/cbeci/index">here</a>), it&rsquo;s almost certainly necessary to think about these same considerations in the work of the IETF, impacting as it does, billions of people on a daily basis.</p> https://guardianproject.info/2022/03/21/ietf113-conference-report-monday-march-21-2022/ Mon, 21 Mar 2022 00:00:00 +0000 https://guardianproject.info/2022/03/21/ietf113-conference-report-monday-march-21-2022/ <p>It&rsquo;s opening day at the <a href="https://www.ietf.org/how/meetings/113/">113th IETF meeting</a>, the first in-person meeting in two years due to the COVID pandemic and being held in Vienna Austria. We&rsquo;re focusing on standards activities of importance to the Internet Freedom community.</p> <p>New work is brought to the IETF via Birds-of-a-Feature sessions and also each technical area&rsquo;s Dispatch Working Group. The Application area often sees the most unique and interesting ideas and this meeting was no exception. The <a href="https://openethics.ai/">Open Ethics Initiative</a> introduced its idea for an <em>ethics disclosure</em> or <a href="https://openethics.ai/oetp/">transparency protocol</a> to help promote trust among users and service providers in a way similar to nutrition labelling on foods. Two <a href="https://www.ietf.org/archive/id/draft-mahy-dispatch-immi-content-00.html">new</a> <a href="https://www.ietf.org/archive/id/draft-mahy-dispatch-immi-mls-mime-00.html">drafts</a> have been written related to the format of data exchange among messaging services. I know what you&rsquo;re thinking: &ldquo;but messaging services don&rsquo;t interoperate&rdquo;. Exactly. These drafts are a push to get that to happen, initially in the context of the Messaging Layer Security (<a href="https://datatracker.ietf.org/wg/mls/about/">MLS</a>) effort. Along the same lines, a plea was made to liberate messaging from the confines of the encapsulating (and in some cases proprietary) protocols, to be used as first-class network transactions on their own via the <a href="https://datatracker.ietf.org/doc/draft-spinella-event-streaming-open-network/">Event Streaming Open Network</a>. And, the team doing Encrypted Client Hello (<a href="https://tools.ietf.org/id/draft-ietf-tls-esni-13.html">ECH</a>) introduced an idea to <a href="https://datatracker.ietf.org/doc/draft-farrell-tls-wkesni/">liberate ECH&rsquo;s host configuration information from the DNS</a> to which some folks believe it is inextricably bound. Well, they didn&rsquo;t present it <em>quite</em> that way, but&hellip; Liberation was the theme of the event, it seems!</p> <p>The Privacy Enhancements and Assessments Research Group (<a href="https://pearg.org">PEARG</a>) had a detailed presentation on the EU&rsquo;s General Data Protection Regulation (<a href="https://gdpr.eu">GDPR</a>) as it relates to network privacy. It&rsquo;s much richer than I imagined, indicating there&rsquo;s a lot more there in terms of enforcement in the future. The long-incubating <a href="https://datatracker.ietf.org/doc/draft-irtf-pearg-censorship/">A Survey of Worldwide Censorship Techniques</a> seems to be near <em>last call</em> in its Version 5. The difficulty of getting it published has as much to do with hesitancy around the term <em>censorship</em> as with the actual content.</p> <p>The major news today, however, is that the <a href="https://datatracker.ietf.org/wg/masque/documents/">MASQUE Working Group</a>, whose charter is to develop mechanisms that allow configuring and concurrently running multiple proxied stream- and datagram-based flows inside an HTTPS connection, is coming to closure on <a href="https://datatracker.ietf.org/doc/html/draft-ietf-masque-connect-udp">CONNECT_UDP</a> and <a href="https://www.ietf.org/id/draft-ietf-masque-h3-datagram-06.html">HTTP Datagrams</a> while <a href="https://datatracker.ietf.org/doc/draft-ietf-masque-connect-ip/">CONNECT_IP</a> has a few more issues to sort out. Though QUIC and HTTP/3 are the focus of this work, these changes are being defined for HTTP/2 and HTTP/1.1 as well, implying the medium-term availability of robust proxying options in the Internet&rsquo;s service hubs. As we mentioned in yesterday&rsquo;s post, <a href="https://www.ietf.org/archive/id/draft-schinazi-httpbis-transport-auth-05.html">HTTP Transport Authentication</a> is an idea for privately authenticating these flows. We hope this work gets picked up again upon completion of these three initial efforts.</p> https://guardianproject.info/2022/03/20/ietf113-hackathon-project/ Sun, 20 Mar 2022 00:00:00 +0000 https://guardianproject.info/2022/03/20/ietf113-hackathon-project/ <p><em>This post begins a daily blog, live from IETF113 in Vienna Austria, March 19-25, 2022 (first in-person meeting after six remote-only meetings during the COVID pandemic).</em></p> <p>The <a href="https://www.ietf.org/how/runningcode/hackathons/113-hackathon/">Hackathon</a> event kicks off IETF and, at this meeting, we picked up work originally done by one of our teammates implementing version 5 of <a href="https://www.ietf.org/archive/id/draft-schinazi-httpbis-transport-auth-05.html">Internet Draft HTTP Transport Authentication</a>. <em>HTTP Transport Authentication</em> is designed to authenticate such protocol flows in a manner that does not reveal any information to an attacker during failure cases. Therefore, applications using <em>HTTP Transport Authentication</em> are resistant to active probing by network adversaries.</p> <p>We got the original code running in Google Conscrypt (TLS for Java/Android), verified its function (as defined in the Internet Draft) and created a public open source repository with a demonstration capability. We presented the work to Hackathon attendees (~50 people) and discussed the work with the specification’s author.</p> <p>Here’s the specification for HTTP Transport Authentication <a href="https://www.ietf.org/archive/id/draft-schinazi-httpbis-transport-auth-05.html">Internet Draft</a>. Here’s our implementation <a href="https://github.com/guardianproject/HTTPTransportAuthentication">repository</a>.</p> https://guardianproject.info/2022/02/28/privacy-preserving-analytics-in-the-real-world-mailvelope-case-study/ Mon, 28 Feb 2022 00:00:00 +0000 https://guardianproject.info/2022/02/28/privacy-preserving-analytics-in-the-real-world-mailvelope-case-study/ <p>We love <a href="https://mailvelope.com/">Mailvelope</a>. It&rsquo;s a popular browser extension for encrypting email messages. Now, <a href="https://cleaninsights.org">Clean Insights</a> is helping Mailvelope understand which webmail providers are most popular with their users so they can prioritize their development efforts.</p> <p>Anyone who has written software knows it takes hard work to craft a great user experience. That&rsquo;s even more challenging in Mailvelope&rsquo;s case. Their browser extension integrates with more than a dozen ever-changing third party webmail interfaces. The Mailvelope team asks itself questions like, &ldquo;Is time better spent improving the GMail integration or the mailbox.org one?&rdquo; The answer often hinges on which providers are most popular among Mailvelope users, information not yet readily available to the Mailvelope team.</p> <p>So, Mailvelope asked us to set up the <a href="https://gitlab.com/cleaninsights/clean-insights-js-sdk/">Clean Insights JavaScript SDK</a> to measure which providers are most popular while respecting users&rsquo; consent and preserving their privacy. In drastic contrast to the web analytics norms, we only collect what we need in order to make important decisions.</p> <p>We decided we don&rsquo;t care <em>how many</em> visits a user makes in a given week. We just care <em>that</em> a user visited that webmail provider during the week. So that&rsquo;s all we record. We don&rsquo;t record what time of day they visited, how many times, or any information about their identity or who they communicate with. This results in a simple to analyze report from each user like:</p> <ul> <li>During the week of February 27th, a user visited &ldquo;mail.google.com&rdquo; at least once.</li> <li>During the week of February 27th, a user visited &ldquo;*.gmx.net&rdquo; at least once.</li> <li>During the week of March 6th, a user visited &ldquo;*.gmx.net&rdquo; at least once.</li> </ul> <p>By adding up the weekly counts from all users, we&rsquo;ll get a handy list of which providers are popular and be able to see changes in that popularity over time.</p> <h2 id="privacy-and-anonymity">Privacy and Anonymity</h2> <p>In addition to Clean Insights&rsquo; default privacy-preserving features (for example, not storing IP addresses), we configured this measurement campaign to protect Mailvelope users&rsquo; privacy in some special ways.</p> <p>Users can use Mailvelope with any webmail provider they like. Some users may be using a personal or corporate mail server at mail.myorganization.com. While knowing how many users used mailbox.org today doesn&rsquo;t implicate any individual, knowing <em>someone</em> visited mail.your-name-here.com wouldn&rsquo;t be nearly so anonymous. So, we set up Mailvelope to only track visits to the short list of default providers Mailvelope supports. When a user uses Mailvelope with a non-default provider, we record that a user used a non-default provider but record neither <em>who</em> nor <em>which provider</em>.</p> <p>You can see how we did it by checking out <a href="https://github.com/mailvelope/mailvelope/pull/788/files">the code</a> or reading about it on the Mailvelope blog (link to come).</p> <h2 id="consent">Consent</h2> <p>We chose to seek user consent right away even though our privacy techniques spare us from GDPR&rsquo;s familiar cookie consent requirement. We’re spared that because among <a href="https://matomo.org/faq/new-to-piwik/how-do-i-use-matomo-analytics-without-consent-or-cookie-banner/">other things</a>, we don’t use a tracking cookie, we don’t capture personal information, and we don’t track users across sites. And we chose to ask early, right in the “Let’s Start” dialogue, since the next thing we’ll measure with Clean Insights is “What trips up users during onboarding?”</p> <p><img src="mailvelope_install_dropdown.png" alt="mailvelope install consent dropdown" /></p> <p>Being able to withdraw is a critical component of consent, so users can always change their response in a new page we added to Mailvelope&rsquo;s settings menu.</p> <p><img src="mailvelope_analytics_settings.png" alt="mailvelope analytics settings page" /></p> <h2 id="next-steps">Next Steps</h2> <p>You may remember we added consent very early in Mailvelope&rsquo;s user journey. That&rsquo;s because the next order of business for us is to analyze what steps users take in their onboarding journey. Particularly, we&rsquo;re interested to discover whether any steps pose a big enough hurdle to new users that they choose to uninstall. More on that to come!</p> <h2 id="using-clean-insights-in-your-project">Using Clean Insights in Your Project</h2> <p>Every software project is different. Just like Mailvelope, you might have a particular question on your mind and specific aspects of user privacy you want to protect. We&rsquo;d love to help you use <a href="https://cleaninsights.org">Clean Insights</a> to answer those questions without compromising privacy. If that&rsquo;s interesting to you, you can find us at <a href="mailto:support@guardianproject.info">support@guardianproject.info</a> or visit the project website at <a href="https://cleaninsights.org">cleaninsights.org</a>.</p> https://guardianproject.info/2022/02/23/spearphishing-for-developers/ Wed, 23 Feb 2022 00:00:00 +0000 https://guardianproject.info/2022/02/23/spearphishing-for-developers/ <p>I received an interesting email that points to a new direction in targeting developers to exploit them. This email is a reply to a message that I actually wrote to an <a href="https://mail.gnu.org/archive/html/bug-gnulib/2012-01/msg00336.html">email list</a> in 2012, that was posted on a public thread on a public list. It also uses the name of a person that posted on that thread: &ldquo;Paul Eggers&rdquo;. Oddly, it did not use that person&rsquo;s actual email from the original thread. Especially considering that I replied to the message to ask for more info, but got no answer. I guess this was just to ensure that the real &ldquo;Paul Eggers&rdquo; did not respond.</p> <p>The focus of the message is a link to download a file. This uses a respectable file sharing service, <em>onecloud.live.com</em> and it even includes a password for the downloaded file, which seems like it builds up the look of authenticity. The use of a password-protected ZIP also means it won&rsquo;t be automatically scanned by malware and anti-virus checkers.</p> <p>I wasn&rsquo;t able to fully unzip the file using the ZIP tools I used. That made me think that perhaps the password method only works in specific ZIP software packages. Then the password method would ensure that the ZIP is only run in ZIP software that is vulnerable to the included exploit. And otherwise, the contents would not be readable for further inspection.</p> <p>This points to an attack method that I have not encountered before. Spearphishing relies on building up a story so that even a careful user will want to click the link and execute the contents. Getting a reply to a thread is an effective way to do that. The contents of public lists are easily readable and indexable, so this kind of attack can be highly automated. Just put in a target email, and the automation sends the target a message with context.</p> <p>Here&rsquo;s the full email source:</p> <pre><code>Return-Path: &lt;info@long.frog.tw&gt; Delivered-To: gphans@rodolpho.mayfirst.org Received: from rodolpho.mayfirst.org by rodolpho.mayfirst.org with LMTP id hSGSC25fFmL8LAAAME+P1Q (envelope-from &lt;info@long.frog.tw&gt;) for &lt;gphans@rodolpho.mayfirst.org&gt;; Wed, 23 Feb 2022 11:23:10 -0500 Received: from rodolpho.mayfirst.org (localhost [127.0.0.1]) by rodolpho.mayfirst.org (Postfix) with ESMTP id D9F313CE34 for &lt;hans@guardianproject.info&gt;; Wed, 23 Feb 2022 11:23:06 -0500 (EST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on rodolpho.mayfirst.org X-Spam-Level: X-Spam-Status: No, score=0.7 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,RCVD_IN_MSPIKE_H2, SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=disabled version=3.4.2 X-Spam-Language: en X-Envelope-From: &lt;info@long.frog.tw&gt; X-Greylist: delayed 1661 seconds by postgrey-1.36 at rodolpho; Wed, 23 Feb 2022 11:23:06 EST Received: from mg3.eee.tw (mg3.eee.tw [103.17.10.233]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by rodolpho.mayfirst.org (Postfix) with ESMTPS id 858E03CE1E for &lt;hans@guardianproject.info&gt;; Wed, 23 Feb 2022 11:23:06 -0500 (EST) Received: from cp21.g-dns.com (cp21.g-dns.com [103.17.8.40]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mg3.eee.tw (Postfix) with ESMTPS id AF4F419009B3 for &lt;hans@guardianproject.info&gt;; Wed, 23 Feb 2022 23:54:59 +0800 (CST) DKIM-Filter: OpenDKIM Filter v2.11.0 mg3.eee.tw AF4F419009B3 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mg3.eee.tw; s=default; t=1645631699; bh=MvWrTbFx4VjqxMbQ1oeJJLPDVIB1s899FwwgZkbZ1wQ=; h=Date:From:To:Subject:From; b=JwtVM6G26JoedbLznxwWCmDxeFdQK2eAjM0spiAV8JGrfqpH1+MVTJ7V+8jItocF6 PbzZ70Ryif/OnczcFbObjb966oc8G4HfyXFid8QzoCc2x///YtHxybz/dpv01grV+/ 7Nu86lLukMGzGcQr2C3Lhgz9Gakdx8j2fNSoWIBw= Received: from 104.120.6.109.rev.sfr.net ([109.6.120.104]:40052 helo=mail.long.frog.tw) by cp21.g-dns.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (Exim 4.94.2) (envelope-from &lt;info@long.frog.tw&gt;) id 1nMtyx-005qBz-Pz for hans@guardianproject.info; Wed, 23 Feb 2022 23:54:59 +0800 MIME-Version: 1.0 Date: Wed, 23 Feb 2022 07:54:58 -0800 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) From: &quot;Paul Eggert&quot; &lt;info@long.frog.tw&gt; To: &quot;Hans-Christoph Steiner&quot; &lt;hans@guardianproject.info&gt; Subject: Re: sys/types.h on Android includes stdint.h before defining time_t Message-ID: &lt;uwhaose67qs7epo7ckd62gsd8qqz0kkn@long.frog.tw&gt; X-YuanJhen-MailScanner-Information: Please contact the ISP for more information X-YuanJhen-MailScanner-ID: AF4F419009B3.AB186 X-YuanJhen-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details X-YuanJhen-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=1.79, required 6, autolearn=disabled, BAYES_60 0.80, DKIM_VALID -0.10, HTML_MESSAGE 0.30, HTML_MIME_NO_HTML_TAG 0.38, MIME_HTML_ONLY 0.42, T_SCC_BODY_TEXT_LINE -0.01) X-YuanJhen-MailScanner-SpamScore: 1 X-YuanJhen-MailScanner-From: info@long.frog.tw X-Virus-Scanned: ClamAV using ClamSMTP Hi,&lt;br /&gt; I have not seen any reply about the receipt documentation I sent you before. Have you checked it?&lt;br /&gt; In case it wasn't delivered, here I upload it again:&lt;br /&gt; &lt;br /&gt; &lt;br /&gt; https://onedrive.live.com/download?cid=8E46FC281A596F46&amp;amp;resid=8E46FC281A596F46%21106&amp;amp;authkey=AOYFYKwyPe_KuGI&lt;br /&gt; &lt;br /&gt; &lt;br /&gt; &lt;br /&gt; &lt;br /&gt; &lt;br /&gt; File password: WT5667&lt;br /&gt; &lt;br /&gt; On 01/26/2012 12:14 PM, Hans-Christoph Steiner wrote: &gt; ./stdint.h:32:3: error: invalid preprocessing directive #@ This looks like some sort of problem in the way the patch was applied. Perhaps you need to re-run gnulib-tool, or ./bootstrap, or ./autogen.sh, or whatever-it-is-with your package, to re-import the patched gnulib from scratch. </code></pre> <p><strong>Update March 23rd, 2022</strong></p> <p>So I never received a reply from the email I replied to, so this does not seem to be a very sophisticated attack. Plus now, I&rsquo;ve received the same kind of message again responding to the same thread. It has a different email address in the <em>From:</em> field, and talks about invoices. So it seems clear that this is an automated mass spam operation, not so targeted. Plus replying to a technical thread with a message about invoices or receipts seems quite tone deaf.</p> <p>Here&rsquo;s the full source text of this new message:</p> <pre><code>Return-Path: &lt;INSERT.INTO@arbonnetruth.com&gt; Delivered-To: gphans@rodolpho.mayfirst.org Received: from rodolpho.mayfirst.org by rodolpho.mayfirst.org with LMTP id SAA4IDlXO2KkcgAAME+P1Q (envelope-from &lt;INSERT.INTO@arbonnetruth.com&gt;) for &lt;gphans@rodolpho.mayfirst.org&gt;; Wed, 23 Mar 2022 13:22:01 -0400 Received: from rodolpho.mayfirst.org (localhost [127.0.0.1]) by rodolpho.mayfirst.org (Postfix) with ESMTP id AE00E3CE3B for &lt;hans@guardianproject.info&gt;; Wed, 23 Mar 2022 13:21:59 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on rodolpho.mayfirst.org X-Spam-Level: *** X-Spam-Status: No, score=3.2 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_VALID_EF,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG, MIME_HTML_ONLY,RCVD_IN_PSBL,SPF_HELO_PASS,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=disabled version=3.4.2 X-Spam-Language: en X-Envelope-From: &lt;INSERT.INTO@arbonnetruth.com&gt; X-Greylist: delayed 601 seconds by postgrey-1.36 at rodolpho; Wed, 23 Mar 2022 13:21:59 EDT Received: from arbonnetruth.com (arbonnetruth.com [93.170.123.227]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rodolpho.mayfirst.org (Postfix) with ESMTPS id 596443CE1C for &lt;hans@guardianproject.info&gt;; Wed, 23 Mar 2022 13:21:59 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=mail; d=arbonnetruth.com; h=MIME-Version:Date:Content-Type:Content-Transfer-Encoding:From:To:Subject: Message-ID; i=INSERT.INTO@arbonnetruth.com; bh=tyizJcC18eXfvncOzYHJ5lCpMuLeYzPK5gBPVLAfqRw=; b=O19O9I/UZQxRYOrfLzW3V+Olc/uEnUNezLzdN+XqMNb4Boj5KBxyjgsQy5h18K0uBoyNF5UKQyg8 tqaKIYKt4PPu8K4BqLrbyXZ0UfpeTQ2oxZ7uTILWi1W+LUTz9fVGfC5lulA1q2YOlJ+Q2YNEDnFq +m+bHLzVQwIJX8wT04A= MIME-Version: 1.0 Date: Wed, 23 Mar 2022 09:11:54 -0800 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) From: &quot;Paul Eggert&quot; &lt;INSERT.INTO@arbonnetruth.com&gt; To: &quot;Hans-Christoph Steiner&quot; &lt;hans@guardianproject.info&gt; Subject: Re: sys/types.h on Android includes stdint.h before defining time_t Message-ID: &lt;2lixlvd5g6qeonv0dkkyzyjbbx1foep1@arbonnetruth.com&gt; X-Virus-Scanned: ClamAV using ClamSMTP Greetings,&lt;br /&gt; Kindly review a next invoice documentation:&lt;br /&gt; &lt;br /&gt; &lt;br /&gt; https://onedrive.live.com/download?cid=1D05D1D2994A703C&amp;amp;resid=1D05D1D2994A703C%21116&amp;amp;authkey=AALIqV8bfVVLE9E&lt;br /&gt; &lt;br /&gt; File password: MT7658&lt;br /&gt; &lt;br /&gt; On 01/26/2012 12:14 PM, Hans-Christoph Steiner wrote: &gt; ./stdint.h:32:3: error: invalid preprocessing directive #@ This looks like some sort of problem in the way the patch was applied. Perhaps you need to re-run gnulib-tool, or ./bootstrap, or ./autogen.sh, or whatever-it-is-with your package, to re-import the patched gnulib from scratch. </code></pre> https://guardianproject.info/2021/12/23/ietf-year-end-review-2021/ Thu, 23 Dec 2021 00:00:00 +0000 https://guardianproject.info/2021/12/23/ietf-year-end-review-2021/ <p>In terms of potential impact on Internet Freedom, it’s been a banner year at the Internet Engineering Task Force <a href="https://ietf.org/">(IETF)</a>. <a href="https://datatracker.ietf.org/doc/rfc9000/">QUIC</a> (featuring the improved privacy and security of <a href="https://datatracker.ietf.org/doc/html/rfc8446">TLS1.3</a>) reached Proposed Standard status, with implementations and rollouts from every major vendor on both server and client, and with multiple <a href="https://en.wikipedia.org/wiki/QUIC#Source_Code">open source toolkit options</a> for developers. <a href="https://datatracker.ietf.org/doc/draft-ietf-tls-esni/">Encrypted Client Hello</a> for TLS1.3 gained traction via the <a href="https://defo.ie">DEfO project</a> that, through pull requests, makes a huge privacy enhancement easily available to the major security library (OpenSSL) underpinning the Internet’s most important service engines (nginx, apache, lighttpd, haproxy on the server, even curl on the client). IP address privacy got new attention with a working group formed around Oblivious HTTP Application Intermediation (<a href="https://datatracker.ietf.org/doc/charter-ietf-ohai/">OHAI</a>), as did Privacy-Preserving Measurement (<a href="https://datatracker.ietf.org/doc/bofreq-privacy-preserving-measurement/">PPM</a>) which seeks to drastically reduce the amount of personal information swept up in the pervasive monitoring of all public Internet activity. Meanwhile, the Internet Research Task Force (<a href="https://irtf.org">IRTF</a>) has focused on developing new cryptographic techniques to serve these rapidly-evolving privacy-focused activities. IRTF also fosters work on truly-global Internet access and, in a sense, serves as the IETF’s conscience through it’s work on the <a href="https://datatracker.ietf.org/rg/hrpc/about/">human rights implications of protocol design</a>.</p> <p>Yet, it’s valid to ask: will the Internet be more free when/if these proposals become widely-deployed standards? While there’s sound reason for hope, I see two major concerns that could significantly reduce the positive impact of this work.</p> <p>The first concern is extreme pushback from the major state actors who want more control over how their citizens use the Internet. While QUIC, TLS1.3 and ECH appear to be headed for full adoption in regions where the Internet is already nominally free, they amount to a <a href="https://www.poker.org/poker-hands-ranking-chart/">royal flush</a> for the good guys in the regions where it is not. The reaction? Stop playing the game (the major state actors have already blocked QUIC). What’s going to be the reaction when ECH makes ubiquitous domain-fronting possible? Will that just increase the number of states participating in blocking QUIC? It’s important to remember, state actors <a href="https://www.huawei.com/us/technology-insights/industry-insights/innovation/new-ip">have options</a>.</p> <p>The second concern is centralization. The Internet has gotten more centralized over time, both in the way the breadth of its content is hosted and in the number of services users visit to view that content. Further, national gateways have seen massive consolidation in the last five years as most states reduce exposure in the name of terrorism prevention and reducing the flow of disinformation. This centralization has worsened the <a href="https://datatracker.ietf.org/doc/rfc7258/">pervasive monitoring</a> all users suffer under and has made it difficult (at best) to trust service providers with even the most benign-seeming of our personal data. Yet, the privacy solutions under development at IETF - OHAI and PPM, along with <a href="https://datatracker.ietf.org/wg/privacypass/about/">Privacy Pass</a> and others - all rely on layers of new infrastructure operated by these same providers, seeming to require us to put even more trust in them. Directionally, is that sustainable? It’s important to remember, we users also <a href="https://permission.io/blog/web-3-0/">have options</a>.</p> <p>During 2022, I’ll be looking more critically at how IETF addresses these concerns. IETF continues to be the most open and responsive standards organization determining the Internet’s future. It feels like we’re reaching a point where Internet Freedom isn’t any longer a niche interest, but rather the central focus of progress for mankind in terms of our intercommunication as citizens of the planet. The best option would seem to be an IETF at the forefront of that progress.</p> https://guardianproject.info/code/cleaninsights/ Thu, 09 Dec 2021 11:00:55 -0400 https://guardianproject.info/code/cleaninsights/ <p><strong>Clean Insights</strong> gives developers a way to plug into a secure, private measurement platform. It is focused on assisting in answering key questions about app usage patterns, and not on enabling invasive surveillance of all user habits. Our approach provides programmatic levers to pull to cater to specific use cases and privacy needs. It also provides methods for user interactions that are ultimately empowering instead of alienating.</p> <p>Clean Insights is available as a lightweight, minimal impact, freely licensed toolkit to include in your mobile app, desktop app, website or back-end service. This code can be integrated into your application or service to measure specific events and interactions that you want to gain more insight on.</p> <p>Learn more at <a href="https://cleaninsights.org">CleanInsights.org</a></p> https://guardianproject.info/code/cleaninsights/ Thu, 09 Dec 2021 11:00:55 -0400 https://guardianproject.info/code/cleaninsights/ <p><strong>Clean Insights</strong> gives developers a way to plug into a secure, private measurement platform. It is focused on assisting in answering key questions about app usage patterns, and not on enabling invasive surveillance of all user habits. Our approach provides programmatic levers to pull to cater to specific use cases and privacy needs. It also provides methods for user interactions that are ultimately empowering instead of alienating.</p> <p>Clean Insights is available as a lightweight, minimal impact, freely licensed toolkit to include in your mobile app, desktop app, website or back-end service. This code can be integrated into your application or service to measure specific events and interactions that you want to gain more insight on.</p> <p>Learn more at <a href="https://cleaninsights.org">CleanInsights.org</a></p> https://guardianproject.info/2021/12/08/debian-over-https/ Wed, 08 Dec 2021 00:00:00 +0000 https://guardianproject.info/2021/12/08/debian-over-https/ <p>Debian&rsquo;s package manager <a href="https://wiki.debian.org/SecureApt"><em>apt</em></a> has a time-tested method of securely providing packages from the network built on OpenPGP signatures. Even though this signing method works well for verifying the indexes and package files, there are new threats that have become relevant as man-in-the-middle attacks and data mining become ever easier. Since 2013, <em>apt</em> developers have supported encrypted transport methods HTTPS and Tor Onion Service. We have been <a href="https://guardianproject.info/2016/07/31/howto-get-all-your-debian-packages-via-tor-onion-services/">recommending</a> <a href="https://guardianproject.info/2019/01/23/use-onions/https-for-software-updates/">their</a> <a href="https://guardianproject.info/2014/10/16/reducing-metadata-leakage-from-software-updates/">use</a> since <a href="https://guardianproject.info/2013/10/31/issues-when-distributing-software/">2013</a>.</p> <p>Most major mirrors already support HTTPS, and now <a href="https://security.debian.org">https://security.debian.org</a> has finally joined the party. That means it is possible to use HTTPS on all of the official repositories. On top of that, many Debian Developers are working on making <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992692">HTTPS the default</a> for new installs.</p> <h2 id="the-threats">The threats</h2> <p>Now is a good time to reiterate the areas of concern:</p> <ol> <li>Package authenticity (software can be modified while being downloaded).</li> <li>Repository availability (whole sites or specific URL paths can be selectively blocked by the network).</li> <li>Package availability (software security updates can be individually blocked).</li> <li>Who is downloading what package (currently visible to anyone who can see the network traffic, including open wifi, etc.).</li> <li>Vulnerabilities in <em>apt</em> or its signature validation (<em>apt</em> can be exploited, authenticity checks can be bypassed).</li> </ol> <p>The current <em>apt</em> model with HTTP covers #1 well, but only covers #2 and #3 with a one week window (the <code>Valid-Until</code> header sets the expiration date on the repo metadata). That gives attackers a short-term window where blocking and replay attacks remain effective. The And it does not cover #4 or #5 at all.</p> <p>Using HTTPS adds a weak backup security layer for #1. HTTPS makes it much more difficult for certain files from a mirror to be selectively blocked or replayed, as well as making related errors louder and earlier (e.g. #2 and #3). Tracking package downloads needs only simple passive listening with HTTP, but with HTTPS, the attacker must build full indexes of package sizes, then parse the size from TLS streams. So HTTPS helps a little with #4. Lastly, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1829">there</a> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1358">have</a> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3587">been</a> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3462">bugs</a> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1252">in</a> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0501"><em>apt</em>&rsquo;s</a> GPG verification. With HTTP, any network can inject exploits into <em>apt</em>&rsquo;s downloads. HTTPS helps with #5 by providing a backup layer of encryption, albeit weaker.</p> <p>It is of course important to point out that HTTPS itself has flaws, and it is not the best option out there, especially for protecting anonymity. HTTPS is quite easy to use for <em>apt</em> repositories, so there is hardly any trade-off to using it. That is why it is the focus of this post. If protecting privacy is important to you, you should use the <a href="https://onion.debian.org">Tor Onion Service repositories</a>, especially if #4 and #5 concern you.</p> <h2 id="the-risks-of-adding-https">The risks of adding HTTPS</h2> <ul> <li><p>The only security critique of using HTTPS for repositories that still makes sense is that there might be vulnerabilities in the code that handles HTTPS, since its a lot more complicated that HTTP. In <em>apt</em>, HTTPS requires GnuTLS, which is currently linked in by default. In order to fully protect against exploits related to the HTTPS code, the machine would need to use a custom build of <em>apt</em> with GnuTLS support not included. It is possible to limit exposure of the HTTPS implementation by setting <code>Acquire::AllowTLS false</code>. This kind of attack seems to be theoretical as of the time of writing, whereas there are at least 6 CVEs related to exploiting the GPG verification.</p></li> <li><p>Using HTTPS makes using caching proxies much harder to setup. Caching proxies can reduce the leakage of metadata about which machine is getting which package, so using direct HTTPS connections would therefore increase the leakage of that kind of metadata.</p></li> </ul> <h2 id="things-that-can-be-improved">Things that can be improved</h2> <p>There are some additional bits of metadata that can be protected when using HTTPS, thereby further improving the privacy protections in <em>apt</em>:</p> <ul> <li>With <a href="https://www.gnutls.org/manual/gnutls.html#On-Record-Padding">TLSv1.3 Record Padding</a>, TLS streams <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001335">can be padded</a>, which would obscure the size of the packages being downloaded from network observers.</li> <li><del>Pipelining downloads through a reused HTTPS connection makes it even more difficult for the network observer to track packages by size.</del> Update 2021-12-09: It turns out that <em>apt</em> is <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001335#10">already</a> <a href="https://salsa.debian.org/apt-team/apt/commit/895417ef99bb1371d8970da1afe87c6d64382f67">pipelining</a> requests by default, so that can be crossed off the list of things to be improved.</li> <li>The Server Name Indication (SNI) field in TLS will leak the domain name in plaintext. The upcoming TLS Encrypted Client Hello standard will encrypt that.</li> </ul> <p>The SNI field issue does not exist when using Tor Onion Services. Package sizes would still be visible to network observers when using Onion Services, so TLS padding and pipelining would help there also.</p> https://guardianproject.info/2021/11/30/implementing-tls-encrypted-client-hello/ Tue, 30 Nov 2021 00:00:00 +0000 https://guardianproject.info/2021/11/30/implementing-tls-encrypted-client-hello/ <p>As part of the <a href="https://defo.ie/">DEfO</a> project, we have been working on accelerating the development <a href="https://www.ietf.org/archive/id/draft-ietf-tls-esni-13.html">Encrypted Client Hello (ECH)</a> as standardized by the IETF. ECH is the next step in improving Transport Layer Security (TLS). TLS is one of the basic building blocks of the internet, it is what puts the S in HTTPS. The ECH standard is nearing completion. That is exciting because ECH can encrypt the last plaintext TLS metadata that it is possible to encrypt. So ECH will bring some real improvements in privacy and censorship resistance.</p> <p>ECH is built on top of TLSv1.3 and <a href="https://blog.cloudflare.com/handshake-encryption-endgame-an-ech-update/">completes unfinished work</a> from the TLSv1.3 effort, now that private DNS is a thing. ECH is now in draft-13 and there are many implementations that are interoperating. ECH is working for <a href="https://github.com/sftcd/openssl">OpenSSL</a>, <a href="https://bugs.chromium.org/p/boringssl/issues/detail?id=275">BoringSSL</a>, <a href="https://github.com/sftcd/nginx">nginx</a>, <a href="https://github.com/sftcd/httpd">Apache HTTPD</a>, <a href="https://github.com/sftcd/lighttpd1.4">lighttpd</a>, <a href="https://github.com/sftcd/haproxy/commits/ECH-experimental">HAProxy</a>, <a href="https://github.com/guardianproject/conscrypt/tree/2.6.alpha1638179154.job1828169525">Conscrypt</a>, <a href="https://github.com/niallor/curl">curl</a>, and more. There is work underway in <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1725938">Firefox</a> and <a href="https://bugs.chromium.org/p/chromium/issues/detail?id=1091403">Chromium</a>. It has been sketched out for <a href="https://github.com/square/okhttp/issues/6539">OkHTTP</a>. Draft versions of ESNI and ECH have been deployed in Firefox releases and some production web services.</p> <p>The main downside of ECH is that it is <a href="https://defo.ie/report.html#issuesarising">complex</a>, and most of that is unavoidable. Large scale websites have complicated server-side setups, and ECH has to work in those setups. That is where ECH&rsquo;s complexity comes from. <a href="https://www.ietf.org/archive/id/draft-ietf-dnsop-svcb-https-07.html">DNS SVCB and HTTPS RR Types</a> is a related standard to encapsulate the complexity of large scale websites a single DNS lookup. It adds additional complexity since it might include the TCP port number for the service, while TLS implementations mostly assume that the port number is known before doing a DNS lookup.</p> <p>ECH was formerly known as Encrypted SNI (ESNI), which it replaces. So do not expect updates to ESNI unless ECH proves too complicated for implementers. ECH is more complex to implement in the TLS library than ESNI. Once it is implemented in the TLS library, then implementing the next level of managing the keys and hostnames is quite similar between ESNI and ECH. The rest of this post will be diving into details about that complexity and what it takes to implement ECH.</p> <p><img src="do-not-stick-out.jpg" alt="Do Not Stick Out" /></p> <h2 id="do-not-stick-out">Do Not Stick Out</h2> <p>ECH implementers must also work to ensure that their implementation does not create packets that look <a href="https://www.ietf.org/archive/id/draft-ietf-tls-esni-13.html#name-do-not-stick-out">look different</a> than other implementations. How ECH is implemented will affect fingerprintability. Right now, BoringSSL, OpenSSL, and Firefox all put the ECH extension in different places, so it is easy for a network observer to tell which of them is serving as the client in a TLS session. Ideally, all implementations would create network packages that look identical to the network observer. To get an idea of this problem in the real world, see <a href="https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40014">this detailed technical discussion</a> of metadata ordering in DTLS as used in WebRTC.</p> <h2 id="getting-the-keys">Getting the keys</h2> <p>ECH encrypts the first stage of the negotiation between the client and server, the <em>ClientHello</em> packet using a new type of key and related configuration. This is known as an &ldquo;ECH Config&rdquo;. This negotiation is what sets up the encrypted TLS connection, so to encrypt the negotiation, so the keys can not be derived from the certificates and negotiation itself. ECH also needs new methods distributing this ECH Config. HTTPS/SVCB therefore includes ECH Config Lists, and DNS is the recommended way to get ECH Config Lists. Other distribution methods are also possible, and ECH implementation should provide a method to directly supply ECH Config Lists.</p> <p>When using ECH in conjunction with HTTPS/SVCB, the DNS needs to be handled differently than the common, decades old practices that most TLS stacks are built on. The ECH Config List must match the IP address so that multi-CDN setups still work. That ensures the server gets the ECH Config that matches its ECH private keys, not the one for a separate server. If the A/AAAA lookup is done separately from the HTTPS/SVCB lookup, they might not match since the results could come from different caches, etc. It is not yet clear where the right place to handle that DNS is, but it is clear that clients that implement HTTPS/SVCB and ECH will need to consider that DNS will touch different parts of the stack.</p> <p>Which part of the stack will handle the HTTPS/SVCB look up depends on whether the code is acting as a library or more as the client itself. For example, libraries like OkHTTP or Conscrypt can both act as a TLS library, providing the blocks for implementing TLS in an app. They can also act as the TLS client itself, the app just needs to open the hostname and port to get a connection. This is especially true for OkHTTP, which can also handle DNS itself with its own DNS-over-HTTPS implementation. Most apps will expect to just open a URL and have it work without providing anything else. In the case of HTTP libraries like OkHTTP or Volley, Conscrypt becomes the provider of TLS functions rather than the client. OkHTTP&rsquo;s default setup will probably want to treat Conscrypt like the client and do zero config. But there are use cases where apps want to handle DNS in OkHTTP, in that case Conscrypt is a library. Another way this could be broken down would be to have Conscrypt only be the TLS library, then leave the DNS to the HTTP stacks. Then each HTTP library would have to have their own ECH and HTTPS/SVCB handling (In Android, that would mean <tt>HttpURLConnection</tt>, OkHTTP, Volley, Apache HTTP Client, etc). Python provides another example with HTTP libraries like <a href="https://github.com/psf/requests/issues/5972">Requests</a> working in combination with the core <a href="https://bugs.python.org/issue45567"><tt>ssl</tt></a> module.</p> <p>One thing that is clear here: whichever piece initiates the HTTPS/SVCB DNS query should also handle the ECH Config, and setting up the lower levels. On top of this, ECH has GREASE and &ldquo;Retry Configs&rdquo;. GREASE is a key part of ensuring that ECH connections do not stick out. GREASE makes the network observer see TLS packets that look the same as connections that successfully used an ECH Config to encrypt. Retry Configs are sent by the server if it cannot decrypt what the client sent. Whichever piece of the code handles the ECH Config List should then also handle GREASE and the Retry Configs.</p> <p><a href="https://blog.cloudflare.com/encrypted-client-hello/"><img src="tls-ech-negotiation.png" alt="TLS ECH Negotiation" /></a></p> <h2 id="outer-and-inner-clienthello">Outer and Inner <em>ClientHello</em></h2> <p>This post began by saying that ECH was complex. Most of that complexity stems from the concept of <em>ClientHelloOuter</em> and <em>ClientHelloInner</em>. They are sort of parallel versions of the TLS <em>ClientHello</em>, with <em>ClientHelloOuter</em> being plaintext and <em>ClientHelloInner</em> being encrypted. Many of the same bits of metadata can be set in either <em>ClientHelloOuter</em> or <em>ClientHelloInner</em>, or even in both. And the outer and inner values can be different. For example, the outer plaintext SNI could be set to a generic domain name, while the inner could be set to a different domain name that the client wants to protect. Whenever the client needs to manage what is set in &ldquo;inner&rdquo;, &ldquo;outer&rdquo;, etc., then extra complexity is exposed all the way up to the app using the ECH client. Also, so many possible configuration options also means so many ways that the negotiation might fail.</p> <p>BoringSSL&rsquo;s <code>SSL_set1_ech_config_list()</code> provides a good example of this complexity:</p> <blockquote> <p>If a supported ECHConfig is found, <tt>ssl</tt> will encrypt the true ClientHello parameters. If the server cannot decrypt it, e.g. due to a key mismatch, ECH has a recovery flow. <tt>ssl</tt> will handshake using the cleartext parameters, including a public name in the ECHConfig. If using <tt>SSL_CTX_set_custom_verify</tt>, callers should use <tt>SSL_get0_ech_name_override</tt> to verify the certificate with the public name. If using the built-in verifier, the <tt>X509_STORE_CTX</tt> will be configured automatically.</p> <p>If no other errors are found in this handshake, it will fail with <tt>SSL_R_ECH_REJECTED</tt>. Since it didn&rsquo;t use the true parameters, the connection cannot be used for application data. Instead, callers should handle this error by calling <tt>SSL_get0_ech_retry_configs</tt> and retrying the connection with updated ECH parameters. If the retry also fails with <tt>SSL_R_ECH_REJECTED</tt>, the caller should report a connection failure.</p> </blockquote> <h2 id="a-walk-through-which-pieces-needs-to-do-what">A walk through which pieces needs to do what</h2> <p>Let us return to the Python example to go through the pieces needed to implement ECH there. Starting at the lowest level, the Python <tt>ssl</tt> is built on top of OpenSSL, so the new ECH functions in OpenSSL need to be included and exposed in <tt>ssl</tt>&rsquo;s API. Unlike with a plain TLSv1.3 connection, <tt>ssl</tt> would not set up an ECH connection without additional configuration as long as <tt>ssl</tt> does not include the additional DNS requirements needed to fetch the ECH Config. The DNS could instead be implemented in the HTTP library. Requests is built on top of urllib3, so urllib3 could implement HTTPS/SVCB handling. Then Requests would automatically get ECH connections. Since it can be necessary to handle the ECH Config outside of DNS, urllib3 and Requests could provide methods for the app to submit the ECH Config. This would mean overriding any HTTPS/SVCB handling in Requests and urllib3.</p> <p>Based on this outline, these are the pieces that need to be implemented:</p> <ul> <li>HTTPS/SVCB DNS queries for getting ECH Config Lists, IP, and other config.</li> <li>A way to provide ECH Config Lists as bytes directly to the <tt>ssl</tt> module.</li> <li>A method to ensure encrypted DNS is used so all metadata is encrypted.</li> <li>A method to enable and disable GREASE, ideally with GREASE default on.</li> <li>A callback that gets called whenever ECH negotiation fails and the server offers a &ldquo;Retry Config&rdquo;.</li> <li>Potentially also controls of what to send in the <em>ClientHelloOuter</em> versus the <em>ClientHelloInner</em>.</li> </ul> <p>From the point of view of the client implementation, there is a big difference between TLS before and after ECH. This new complexity may look scary but this is a clear path to providing strong privacy protections with TLS that can be as widely deployed as TLSv1.3 is now.</p> https://guardianproject.info/2021/11/29/announcement-anynews-1.0-censorship-resistant-news-and-media-distribution/ Mon, 29 Nov 2021 00:00:00 +0000 https://guardianproject.info/2021/11/29/announcement-anynews-1.0-censorship-resistant-news-and-media-distribution/ <h2 id="summary">Summary</h2> <p>For content publishers, AnyNews is a news distribution suite focused on service to censorship-prone geographies, easily integrated into existing content sources. AnyNews is open-source and easily branded (or customized, if desired) without extensive effort or expense. AnyNews integrates technologies to counter a range of censorship regimes and is designed to accommodate new technologies more easily and quickly as they arise. Tools are provided to support a range of publishing options for environments that suffer from connectivity or performance problems. Service engagements are possible when custom software is required.</p> <p><img src="./anynews_homescreen_cubanet.jpg" alt="AnyNews Home Screen" width="380px" height="800px" /></p> <h2 id="product-concept">Product Concept</h2> <p>Content providers of all types are confronted with a diversity of censorship and network-disruption regimes around the world, with widely-varying political and social forces involved, and manifesting a bewildering array of content access issues to users. Further, within a given community, independent individuals are impacted by political and social forces in different ways. In such an environment, it has been a difficult technical struggle to stand up censorship resilient services that provide an easy, understandable user experience while also satisfying the heavy security and privacy demands of the most heavily-impacted users. New thinking is required to avoid the nightmare scenario of costly and slow application development focused on the most challenging technical demands while, in doing so, alienating many others who give up in frustration and put themselves at risk.</p> <p>AnyNews is an open source software project that incorporates a variety of censorship-resistant technologies to mitigate these threats and does so in a way that is responsive to a wider range of use cases.</p> <h2 id="core-capability">Core Capability</h2> <p>AnyNews is designed for information publication - a one-way, source-to-user interaction - using news feed technologies. The published content can be text, media (imagery, audio, video) or a combination. Information is typically organized by reverse chronology and/or defined categories. Most common publication formats are already integrated. The AnyNews Web Client updates its content regularly without user interaction. Changes to your edition of the AnyNews application occur automatically and immediately upon publication without requiring a special user interaction.</p> <p>The AnyNews Web Client is a &ldquo;news reader&rdquo; type application pre-configured to read a single feed, or a defined set (typically, as offered by a single publisher, with a single publisher&rsquo;s branding). The user experience is clear and straight-forward but offers full-integrated media play and features like saving and sharing. Internationalization of the application is easily accommodated.</p> <p><img src="./anynews_media_playlist.jpg" alt="AnyNews Media Playlist Screen" width="380px" height="800px" /></p> <h2 id="supported-content-formats">Supported Content Formats</h2> <p>AnyNews has built-in support for <a href="https://validator.w3.org/feed/docs/rss1.html">RSS 1.0</a>, <a href="https://cyber.harvard.edu/rss/rss.html">RSS 2.0</a>, and <a href="https://www.tutorialspoint.com/rss/what-is-atom.htm">ATOM 1.0</a>.</p> <p>Publishers with customized versions of these formats, RDF, NewsML, JSON, XML or later versions of ATOM (such as OData.org&rsquo;s <a href="https://www.odata.org/documentation/odata-version-3-0/atom-format/">version</a>) can be supported via a service engagement in one of two ways:</p> <ul> <li><p>Modification of our deployment/mirroring tools to convert the published format to one of our supported formats (fastest, cheapest approach)</p></li> <li><p>Modify the AnyNews Web Client to support the custom format (slower, costlier approach better suited to engagements where the Web Client itself is almost being customized)</p></li> </ul> <h2 id="circumvention-in-the-anynews-web-client">Circumvention in the AnyNews Web Client</h2> <p>The AnyNews Web Client is built using Progressive Web App (PWA) technology. While on the one hand accessing the AnyNews Web Client feels like accessing a web page in the browser, the AnyNews Web Client is saved to the device’s home screen on first use and, henceforth, acts like a native application. With this approach, users don&rsquo;t visit their vendor&rsquo;s app store (which might censor your app or be otherwise unaccessible in their country). AnyNews Web Client technology also allows automatic update of the app without app store access or (in the case of Apple/iOS) app store approval.</p> <p>Within the AnyNews Web Client itself, censorship or surveillance can be mitigated with optional CDN mirroring. The Web Client is initially configured to retrieve from one or more mirror sites, each user selecting a mirror randomly on initial startup and then re-trying from the set in random-round-robin style if/when the initial mirror fails. These hosts can be on different CDN providers and/or in different geographies. The actual set of mirroring hosts can be changed over time and automatically updated to the AnyNews Web Client. For some content providers, it is also useful to host the AnyNews Web Client itself on a CDN mirror as well.</p> <h2 id="serving-marginalized-communities">Serving Marginalized Communities</h2> <p>AnyNews provides tools to pre-process news content for delivery to community-centered hubs at the very edge of the network in places where Internet connectivity for individuals is poor, non-existent or expensive, or under circumstances of natural disaster that make individual connection to the network impossible. These tools can be used to re-publish content to a laptop, tablet or IoT device as small as a Raspberry Pi powered by solar panels and with a highly-intermittent Internet connection.</p> <h2 id="native-application-wrappers">Native Application &ldquo;Wrappers&rdquo;</h2> <p>It&rsquo;s possible to produce versions of the AnyNews Web Client <em>wrapped</em> in a native (iOS, Android) application layer for delivery to users via the App Stores. While the App Stores are sometimes subject to censorship, most users are more familiar with this model for acquiring applications and may have a greater sense of trust in applications delivered in that way.</p> <p>On Google’s Android, two additional circumvention technologies can be integrated in the native application:</p> <ul> <li><p>Integration with Tor via Guardian Project’s <em><a href="https://play.google.com/store/apps/details?id=org.torproject.android">Orbot</a>, Tor for Android</em>. The AnyNews Android app checks for the presence of Orbot on the user’s device and automatically configures itself to run using Orbot when present.</p></li> <li><p>Integration with Clostra&rsquo;s <em><a href="https://www.clostra.com/newnode-mesh-network">NewNode technology</a></em>. NewNode is automatically activated at start-up if Orbot is not present on the device.</p></li> </ul> <p>As we are working through some operating system limitations, our AnyNews native app for iOS does not offer circumvention technologies beyond the mirroring capabilities in the PWA.</p> <p>Our tools for building the native app wrappers are not ready for public consumption at this point, so native wrappers are an optional part of Anynews and available via service engagement.</p> <h2 id="repository">Repository</h2> <p>The AnyNews repositories are <a href="https://gitlab.com/guardianproject/anynews">HERE</a>.</p> <h2 id="issue-trackers">Issue Trackers</h2> <ul> <li><a href="https://gitlab.com/guardianproject/anynews/anynews-web-client/-/issues">AnyNews Web Client Issue Tracker</a></li> <li><a href="https://gitlab.com/guardianproject/anynews/AnyNews-Republisher/-/issues">AnyNews Republisher Issue Tracker</a></li> </ul> <h2 id="license">License</h2> <p>AnyNews is released under <a href="https://www.gnu.org/licenses/gpl-3.0.txt">GNU Public License v3.0</a>.</p> <h2 id="service-engagement-opportunities">Service Engagement Opportunities</h2> <p>AnyNews is open source. We’ve documented the steps you’ll need to make AnyNews work with your content and simplify deployment. If you&rsquo;d prefer help in developing your AnyNews strategy, we can assist. Engagement types:</p> <ul> <li><p>Assistance with Open Source</p></li> <li><p>Branding-only Engagement</p></li> <li><p>Deployment Strategy Engagement</p></li> <li><p>Customization Engagement (customized Web Clients or news source customizations)</p></li> <li><p>Native App &ldquo;Wrappers&rdquo;</p></li> <li><p>Long-term Deployment Support</p></li> </ul> <h2 id="acknowledgements">Acknowledgements</h2> <p>Guardian Project thanks the <a href="https://www.opentech.fund/">Open Technology Fund</a>, via it&rsquo;s <a href="https://www.opentech.fund/labs/engineering-lab/">Engineering Lab</a>, for funding the improvements in AnyNews that led to this release.</p> https://guardianproject.info/2021/11/24/ietf112-meeting-update-november-2021/ Wed, 24 Nov 2021 00:00:00 +0000 https://guardianproject.info/2021/11/24/ietf112-meeting-update-november-2021/ <p>The 112th meeting of the Internet Engineering Task Force (IETF) took place November 8-12, 2021 - as a virtual event for the sixth time in succession due to the COVID-19 pandemic. Here’s a summary of the work I found important to the Internet Freedom community.</p> <h2 id="privacy-preserving-measurement">Privacy Preserving Measurement</h2> <p>While we often (rightly) focus on unwanted surveillance of targeted individuals by nation-states and other bad actors, the Internet’s surveillance economy presents a major threat to personal privacy and freedom for all users of the Internet, as Mozilla so aptly describes on <a href="https://wiki.mozilla.org/State_Of_The_Internet/Surveillance_Economy">this wiki page</a>. Since IETF significantly boosted its focus on privacy at IETF105 (July 2019, where privacy was the <a href="https://datatracker.ietf.org/meeting/105/materials/slides-105-ietf-sesse-privacy-modern-concerns-steven-m-bellovin-00">plenary topic</a>), participants at both research and engineering levels have begun to address this problem - initially with research studies and statements of requirements, and then with proposals. Later we’ll discuss proposals that try to offer more anonymity in the way users access the Internet. But new at this conference was a Birds of a Feather session formed around the idea of <a href="https://datatracker.ietf.org/doc/bofreq-privacy-preserving-measurement/">Privacy Preserving Measurement</a> (PPM) and led by Mozilla’s Eric Rescorla who has collected significant thoughts and technical ideas <a href="https://educatedguesswork.org/tags/privacy%20preserving%20measurement/">here</a>. This thinking would insert a layer of protection between end users and the data collection infrastructure in a way that would significantly impact the bad (for privacy) practices of current-term measurement tools - over-collection, under-protection and deep-interlinking. An architecture for PPM was proposed and, as there was significant interest from IETF attendees, a Working Group is being established to undertake the technical effort. There is a future work effort here to understand how this work overlaps or dove-tails with <a href="https://cleaninsights.org">CleanInsights</a>.</p> <h2 id="oh-hi-oblivious-http-application-intermediation">Oh, Hi! (Oblivious HTTP Application Intermediation)</h2> <p>Representative of over-collection, under-protection and deep-interlinking is the common practice of linking together sequences of interactions within or across services. Particularly pernicious are interactions with the DNS (the centralized monitor that can easily catalog all the sites a user visits when name resolution is requested) but the problem generalizes to other core services as well as simple browsing. While services like Tor work to make the practice of linkage difficult, this approach shares a fingerprint with bots and attackers, inducing providers to, at minimum, make the anonymous user experience difficult. <a href="https://datatracker.ietf.org/wg/ohai/about/">Oblivious HTTP Application Intermediation</a> (OHAI) is a new Working Group addressing the problem of request linking in a manner that reduces the negative experience for users while keeping the bots at bay. The Working Group’s initial focus will not be safe browsing, however. It will instead focus on generalizing the earlier work on DNS over HTTPS (<a href="https://tools.ietf.org/id/draft-ietf-doh-dns-over-https-10.html">DoH</a>) and an earlier <a href="https://datatracker.ietf.org/doc/draft-pauly-dprive-oblivious-doh/">proposal</a> specific to DNS.</p> <h2 id="ip-address-privacy">IP Address Privacy</h2> <p>The network addressing mechanism used by the Internet Protocol was among the most innovative concepts of the early Internet. But the Internet’s pioneers did not anticipate that, over time, the IP address would become an enforcement mechanism for censors and state prosecutors as well as the most attractive tracking token for the surveillance economy. IETF has <a href="https://datatracker.ietf.org/doc/draft-ip-address-privacy-considerations/">begun an investigation</a> into this problem. The <a href="https://www.broadband-forum.org">Broadband Forum</a> - whose manufacturers provide the majority of WiFi access points to the Internet - has undertaken its own study, to be published in 2022. Both studies catalog the abuses themselves and the technically-sound and unsound ways in which the IP address is currently put to use in managing networks. Separately, CDN provider Cloudflare has been researching <a href="https://blog.cloudflare.com/addressing-agility/">Addressing Agility</a> (decoupling IP addresses from DNS domain names, at Internet scale, on the server side). This latter effort points the way to at least one approach for curbing IP address abuse, though no concrete proposals have yet been brought to IETF.</p> <h2 id="masque-multiplexed-application-substrate-over-quic-encryption">MASQUE (Multiplexed Application Substrate over QUIC Encryption)</h2> <p>QUIC (<a href="https://datatracker.ietf.org/wg/quic/about/">the protocol</a>) and MASQUE (a <a href="https://datatracker.ietf.org/wg/masque/documents/">set of activities</a> to formalize the legitimate ways in which network traffic can be proxied using QUIC’s enhanced performance, security and privacy) are now mainstay IETF activities. Of importance at IETF112, this question: Do QUIC and MASQUE, taken together, represent a mechanism that creates an overlay atop the heritage Internet? And if so, what does that (or will that) mean? An oversimplified pessimistic view is that these tools can be used to eliminate the (public) Internet in favor of an oligopoly of private networks that will, among themselves, define the rules for how they interconnect and how users connect to them. An oversimplified optimistic view is that the same tools can be used to prevent such an oligopoly and enhance the public Internet (in fact, University of California Berkeley-affiliated researchers presented some work promoting <a href="https://ccronline.sigcomm.org/2021/revitalizing-the-public-internet-by-making-it-extensible/">a similar plan</a>). Is this where the <em>long Internet</em> battle is going to be fought?</p> <h2 id="closing-thoughts">Closing Thoughts</h2> <p>I’m ten conferences into my participation at IETF, and there are certainly patterns forming. Focusing solely on Internet Freedom, one can fairly ask if the kinds of solutions we see proposed at IETF are the right ones. Is IETF the right forum for making decisions about planet-wide human freedom of communication and interaction? Or is IETF too compromised by its constituent organizations? Or, rather, does that make IETF the perfect place to address the key technical questions in our increasingly-technical world? The only certainty would seem to be that participation in this forum is the best way to understand how the situation is evolving and what avenues are available to have a voice in that evolution.</p> https://guardianproject.info/2021/10/18/the-ietf-and-internet-freedom/ Mon, 18 Oct 2021 00:00:00 +0000 https://guardianproject.info/2021/10/18/the-ietf-and-internet-freedom/ <p>It seems useful to clarify the relationship between the near-term work of keeping the Internet open on a daily basis - work that dominates the efforts of the Internet Freedom community - and the long term work of the industry on crafting operational standards for the same network.</p> <p>Those involved in Internet Freedom are typically focused on the “problems of today”, creating solutions using existing technologies offering immediate effect. Often, it’s hard to tell if Internet standards are helping, hurting, or just in the way. However, looking back at the (roughly) 15-year history of Internet Freedom work, it’s useful to recognize the many times we’ve said to ourselves “*Gosh, I would have done that differently if I’d had a chance to think about it*”.</p> <p>The standards bodies offer one mechanism for broad deliberation on what it means to have the opportunity of a universally-accessible Internet. There’s a lot of time to “*think about it*”, there’s input from many stakeholders and broad involvement in getting the final document &ndash; the standard &ndash; written. For several years now, members of the Internet Freedom community have been asking themselves if such a process is useful in their context. It’s easy to imagine, for example, that if the community had spent even a small effort over fifteen years voicing its concerns over, and hopes for, Internet Freedom to the right standards bodies, there might be more … Internet freedom. We’re testing that theory now, taking part in the activities of the <a href="https://www.ietf.org">Internet Engineering Task Force</a> (IETF).</p> <h2 id="what-is-the-ietf">What is the IETF?</h2> <p>Since 1993 the IETF has operated as the standards-development body of the Internet under the auspices of the Internet Society, an international membership-based non-profit organization. The IETF is the formal successor to similar (but smaller) bodies - based in the United States - that participated in orchestrating and managing the deployment of the Internet after 1981, when the original research project (<a href="https://en.wikipedia.org/wiki/ARPANET">ARPANet</a>) was expanded into the global scientific community. The Internet became a fully public entity in the mid-1990s.</p> <p>The IETF is organized into informal topic-based discussion groups (“birds of a feather”, BoFs) and formal “working groups”. Membership in these groups is open to the public, both for in-person and mailing-list participation. International participation is encouraged. The IETF operates, formally, in an inclusive manner and maintains a strict code-of-conduct for its activities that encourages “small voices” to participate. The IETF operates in a bottom-up manner for idea development and task-creation, largely driven by these groups. The Internet Architecture Board (<a href="https://en.wikipedia.org/wiki/Internet_Architecture_Board">IAB</a>) plays a modest role in defining vision and strategy.</p> <p><a href="https://en.wikipedia.org/wiki/Rough_consensus">Rough consensus</a> is the primary basis for decision making. There are no formal voting procedures. An important part of rough consensus is demonstrated interoperability among independently-developed implementations of proposed standards. Generally speaking, as work moves from “idea” toward “standard”, the act of clarifying the idea is informed by the act of implementing it. In the early years of the IETF, this approach was unique among standards bodies.</p> <p>While the details of IETF operations have changed considerably over time, the basic mechanism remains: (1) publication of a proposed specification, (2) development of software based on the proposal, (3) review and independent testing by participants, and (4) republication as a revised proposal, a draft standard, and possible, eventually as an Internet standard. Two types of working document are available: the Internet Draft (generally speaking, the idea) and the Request for Comment (generally speaking, the standard). It is perhaps a credit to the spirit of iterative improvement through constant testing and discussion that IETF’s completed documents are not titled “Internet Standard”.</p> <p>An allied organization within IETF is the Internet Research Task Force (<a href="https://irtf.org/">IRTF</a>) that promotes longer-term research on the evolution of the Internet. Made up largely of academic researchers, IRTF operates in a manner that brings cutting edge research into the decision-making processes of IETF activities.</p> <h2 id="who-s-who-at-ietf">Who’s Who at IETF?</h2> <p>The modern IETF is composed of technical representatives from commercial vendors, academic researchers, researchers and advocates from non-profit entities and independent “concerned citizens”. While the IETF’s modern code of conduct makes it possible for anyone to attend a meeting or mailing list and have a voice in the conversation, the IETF remains an “implementation-centric” forum. That is, “talk is cheap” and ideas have to be implementable - or have impact on implementations - to be considered for standardization. Thus, individuals and organizations who are successful within IETF are able to both espouse their ideas and “code them up” (or, at minimum, understand the process of coding them and the hard problems that arise from coding them). Experience shows, however, that these criteria still allow for a broad range of meaningful participation and impact.</p> <p>IETF now has the Human Rights Protocol Considerations (<a href="https://datatracker.ietf.org/rg/hrpc/about/">HRPC</a>) research group (chartered in 2017) monitoring and informing IETF working groups. HRPC draws its mission directly from RFC 1958 (“Architectural Principles of the Internet”, 1996). Key participants include both technical people and rights advocates.</p> <p>The Internet Architecture Board (IAB) has, as of 2019, given considerable attention to the problem of privacy (as distinct from the IETF’s successful, long-duration work on security). The Privacy Enhancements and Assessment Research Group (<a href="https://datatracker.ietf.org/rg/pearg/about/">PEARG</a>) brings important research activities on privacy to the IETF.</p> <h2 id="what-are-some-memorable-ietf-standards">What are some memorable IETF standards?</h2> <p>The specifications for Internet Protocol (IP, <a href="https://datatracker.ietf.org/doc/html/rfc791">RFC 791</a> in 1981), Transmission Control Protocol (TCP, <a href="https://datatracker.ietf.org/doc/html/rfc793">RFC 793</a> in 1981) and Hypertext Transfer Protocol (HTTP, <a href="https://datatracker.ietf.org/doc/html/rfc1945">RFC 1945</a> in 1996) are the foundation of the modern Internet.</p> <p>The most significant update to the foundational protocols is Quick UDP Internet Connections (QUIC, <a href="https://datatracker.ietf.org/doc/html/rfc9000">RFC 9000</a> in 2016), a new “hybrid” transport protocol informed by the evolved use cases impacting TCP.</p> <p>The most significant technical update, in terms of the Internet Freedom community’s interest, was Transport Layer Security Version 1.0 (TLS, <a href="https://datatracker.ietf.org/doc/html/rfc2246">RFC 2246</a> in 1999) and its improved form, Version 1.1 (<a href="https://datatracker.ietf.org/doc/html/rfc4346">RFC 4346</a> in 2006). Two important “Best Current Practice” pieces impacting Internet Freedom are <a href="https://datatracker.ietf.org/doc/html/rfc7258">RFC 7258</a> “Pervasive Monitoring Is An Attack” and <a href="https://datatracker.ietf.org/doc/draft-irtf-hrpc-guidelines/">draft-irtf-hrpc-guidelines-10</a> “Guidelines for Human Rights Protocol and Architecture Considerations”. These works have stimulated a significant portion of IETF&rsquo;s activity on privacy and Internet accessibility.</p> <h2 id="among-the-current-work-of-ietf-what-is-most-important-to-the-internet-freedom-community">Among the current work of IETF, what is most important to the Internet Freedom community?</h2> <ul> <li>TLS 1.3 (<a href="https://datatracker.ietf.org/doc/html/rfc8446">RFC 8446</a>)</li> </ul> <p>The Transmission Control Protocol (TCP) was designed for long-lived connections between clients and servers. HTTP broke that in a big way and Transport Layer Security (TLS) magnified the problem further, with the two biggest challenges being the lengthy setup (or “handshake”) phase and the negotiation of cryptographic modes and strategies, many of which quickly went out of date. TLS 1.3 is an effort to mitigate these challenges with so-called Zero-RTT. More importantly, TLS 1.3 fixes a few security flaws created by wrong assumptions made in earlier designs. See below.</p> <ul> <li><a href="https://datatracker.ietf.org/doc/draft-ietf-tls-esni/">ECH / eSNI</a> (draft)</li> </ul> <p>Encrypted Client Hello (ECH/ECHo) is successor work to the earlier Encrypted Server Name Identifier (eSNI) effort. Security requirements evolve as bad actors get smarter. While the designers of TLS thought they’d made the transport layer “secure” (thus, the name), several omissions were quickly spotted. Among these was the public visibility of the requested server name (the SNI). A plan was put forward to encrypt the SNI, but quickly that too became insufficient and a plan was advanced to encrypt the entire “client hello” message - that is, all the data that exists about the attempted connection before the actual encrypted session begins.</p> <p>ECH/eSNI has its opponents, of course. TLS 1.3 is already blocked in specific geographies because of this feature.</p> <ul> <li>DNS Security (<a href="https://datatracker.ietf.org/doc/html/rfc7858">DoT</a>, <a href="https://datatracker.ietf.org/doc/html/rfc8484">DoH</a>, <a href="https://datatracker.ietf.org/wg/dnssec/charter/">DNSSEC</a>, <a href="https://datatracker.ietf.org/doc/html/draft-pauly-dprive-oblivious-doh-04.html">Oblivious DNS</a>, Private DNS, etc)</li> </ul> <p>A key benefit of the Internet over pre-existing networking techniques was the ability to address servers using human-readable names. Old-schoolers recognize this was, in fact, a late-arriving component of the Internet protocols and, in some minds, handled in an ill-considered manner. That skepticism has been borne out in numerous failures of the Domain Name Service (DNS) and, in more recent times, the way in which DNS has been co-opted by national authorities in certain geographies - malicious operators of the DNS can know all the servers/services you visit based solely on the server names you want resolved.</p> <p>There are many schemes being advanced to improve this situation. Private DNS abrogates the architected “hierarchy of authority” built into the original DNS (which is the part that’s been broken by malicious providers) and implies “trust Google” or “trust Cloudflare”. DNSSEC is a collection of small, but meaningful, improvements to the DNS implementation aimed at sealing off the (many) leaks of metadata found in the original DNS design. DNS-over-HTTP (DoH) and DNS-over-TLS (DoT) provide ways for an individual user’s web browser to select a trustworthy DNS provider (like the Private DNS providers) and ask them to do their lookups over a secure link. ObliviousDNS could (in theory) remove even the need to have a trusted provider (though it adds the idea of a “trusted proxy”. A further advantage with ObliviousDNS (and the other “Oblivious” proposals, and the reason for the term) is that the user’s IP address is not leaked either (the bugaboo of most other privacy schemes being proposed in standards bodies).</p> <ul> <li><a href="https://datatracker.ietf.org/wg/privacypass/about/">Privacy Pass</a></li> </ul> <p>Bots, it seems, have taken over the Internet. Automated programs submit billions of requests to websites, probing in most cases for weaknesses or purposely attempting to flood the system. With provision of most web content now in the hands of a tiny number of content delivery networks, those networks put up defenses in the form of “roadblocks” that only humans can cross. This has become overbearing on some services, to the frustration of users. One attempted solution is Privacy Pass. The idea is to provide valid users (who’ve successfully crossed the roadblock once) with a token that can be presented on many future accesses so the roadblock is not in their way again. A key criteria for this token, however, is that it can not be used to identify and track an individual (human) across their access to many sites served by the content delivery network. If implemented properly, Privacy Pass could be a big win for users who don’t want their access tracked and monitored.</p> <ul> <li>Messaging Layer Security (<a href="https://datatracker.ietf.org/wg/mls/about/">MLS</a>)</li> </ul> <p>In short, while secure messaging systems exist, the mechanisms by which they implement security for “group messaging” (greater than 2 parties) are typically divergent from standards, layered in a proprietary way on top of standards, or do not scale to large conversations. MLS is an activity designed to improve this situation by applying the lessons (good and bad) learned with TLS. MLS also hopes to achieve what has now been defined as a modern level of security and privacy (thanks to the Signal team who raised the bar quite high). MLS defines both an architecture and protocol that would standardize the way privacy and security are provided, with room for future upgrade, without denying the individuality of each service and that application-level feature demands of the different user groups.</p> <h2 id="what-are-the-limits-to-ietf-s-effectiveness">What are the limits to IETF’s effectiveness?</h2> <p>We should reject the idea that “the standards process is too slow”. IETF’s method of working dramatically speeds up the standards process while still allowing for as much disagreement and clarification as required for a standard to be considered “deliberative”. Further, the end result of IETF standardization is not only a descriptive document, but multiple interoperable implementations of that document’s standard. Again, that’s another big difference between IETF and the strictly “declarative” standards bodies. With few exceptions, IETF has avoided the problems of too-early standardization based on a fad or a reaction, while still being responsive to perceived needs - be they technical or social/cultural.</p> <p>There is, however, the Hammer/Nail analogy: when you’re a hammer, everything looks like a nail. The IETF solves problems using the Internet infrastructure, even when certain problems might be better solved elsewhere, or in ways that are not infrastructural.</p> <h2 id="what-is-the-most-important-problem-to-internet-freedom-facing-ietf-today">What is the most important problem (to Internet Freedom) facing IETF today?</h2> <p>There appears to be broad agreement that the most important problem facing the IETF is “The Problem of Centralization”.</p> <p>Centralization initially arose in the hardware sense as the mesh of routers that connect the Internet fell into fewer and fewer hands. This happened “innocently”, over time, and in the name of cost efficiency. But this slow change violated one of the fundamental design strengths of the Internet’s original core architecture: resilience. In recent times, there has been a strong tendency for nation-states to acquire tight control over the gateway routers that allow traffic into and out of their geographic area, further decreasing the resiliency of the Internet and serving as a vehicle for censorship and mass surveillance.</p> <p>This problem has been further complicated and accelerated by the development of data centers of unimagined scale and worldwide presence whose internal operations are largely opaque and filled with “middle boxes” performing specialized tasks. Unfortunately, the presence of these “middle boxes” can slow the pace of technological change.</p> <p>Lastly, and mostly unimagined at the dawn of the Internet, a small set of application software service providers has come to dominate Internet traffic and exercise an oversized amount of influence on the way users perceive the Internet or are allowed access to its resources.</p> <p>The problem of centralization is magnified at IETF due to the organization’s inherent nature of “defining the Internet”. Its solutions are “large scale” and large scale solutions by definition fall into the hands of the largest organizations. Thus, it can sometimes seem that the IETF has moved far from the founding principles of decentralized, decoupled, cooperative, associative solutions that characterized the original Internet.</p> <p>However, sometimes it takes a pendulum-swing of the magnitude we now see to drive people to action. And, by nature, IETF has a constantly-evolving but actively-engaged community. The “big names” of thirty years ago have significantly less presence today. There is hope, thus, that a new community of people who care about the problem of centralization will rise up to make their voices heard. Indeed, there are signs this is already happening.</p> <p>Formally, the IRTF’s <a href="https://datatracker.ietf.org/rg/dinrg/history/">Decentralized Internet Infrastructure Research Group</a> was chartered in September 2017 to address the interest of infrastructure centralization. Parallel (and in a way orthogonal) advancements in blockchain technology, distributed hash tables and decentralized cryptographic authority are creating what is effectively an “overlay network” on top of the Internet as defined by the IETF. Colloquially, it’s being called <a href="https://www.forbes.com/sites/forbestechcouncil/2020/01/06/what-is-web-3-0/?sh=4002a4bc58df">Web 3.0</a>. These activities have forced IETF to take notice.</p> <h2 id="what-s-next-in-our-ietf-participation">What’s next in our IETF participation?</h2> <p>Monitoring IETF activities - bringing that knowledge to the teams doing current-term Internet Freedom work - and presenting the current-term work of the Internet Freedom community to the IETF - has begun to bear fruit in terms of synergy between the two approaches to keeping the Internet open. Discussion, however, will probably not be enough.</p> <p>Another important way the community might participate is active (and early) involvement in the implementation of important IETF proposals. Doing so would give the Internet Freedom community a “seat at the table” where core problems and concerns arise and where key decisions are made. The Internet Freedom community brings extensive expertise in open source software development, a counterpoint to the mostly closed-source implementations undertaken by the IETF’s vendor organizations. The benefits of transparency and loosely-coupled cooperation - so key to the most successful software projects that built the Internet - are difficult to overstate in this context.</p> <p>Certain of these efforts are already underway - ECH, and specifically the <a href="https://defo.ie">DEfO</a> project, is an example - and the impact this is having on key pieces of “infrastructural” open source software (the Apache web server, the OpenSSL security layer, for example) is important. Keeping open source software current and “in tune” with developing standards may be the best way to “square the circle” of Internet freedom work &ndash; assuring that solutions to the problems and challenges of today lead to the creation of a better Internet for the future.</p> https://guardianproject.info/apps/org.havenapp.main/ Fri, 13 Aug 2021 00:00:00 +0000 https://guardianproject.info/apps/org.havenapp.main/ https://guardianproject.info/apps/org.witness.sscphase1/ Fri, 13 Aug 2021 00:00:00 +0000 https://guardianproject.info/apps/org.witness.sscphase1/ https://guardianproject.info/2021/03/02/new-insights-into-clean-analytics/ Tue, 02 Mar 2021 00:00:00 +0000 https://guardianproject.info/2021/03/02/new-insights-into-clean-analytics/ <p>There is a giant problem with the &ldquo;collect it all&rdquo; status quo that pervades on the Internet, this has been clear for a long time. Tracking people has become so <a href="https://www.ghostery.com/study/">widespread</a> that <a href="https://noyb.eu">organizations</a>, <a href="https://f-droid.org">communities</a>, <a href="https://exodus-privacy.eu.org">projects</a> and <a href="https://privacylab.yale.edu/">university</a> <a href="https://privacylab.at">labs</a> have sprung up dedicated to detecting and publicizing their presence. Data and analytics are clearly useful for software creators and funders, but they also easily lead to harming people&rsquo;s privacy and well-being. The past year of work on Clean Insights has clarified our goals to make analytics possible without injuring the very people we aim to serve. Clean Insights takes the world of data analytics and turns it on its head. The Clean Insights approach starts with thinking about the data, then choosing only the data that is clearly safe to use. A user&rsquo;s location, complete device description, or other identifying information is dangerous to gather. A simple count of how many times a feature was used, or a webpage was visited, can be gathered without links to people.</p> <p>There are some widely known efforts for preserving privacy when doing analytics. The most famous is perhaps &ldquo;<a href="https://en.wikipedia.org/wiki/Differential_privacy">differential privacy</a>&rdquo;, which is used by the US Census Bureau and Apple. This approach has certain assumptions:</p> <ul> <li>Personally Identifiable Information (PII) is collected and stored.</li> <li>A legal compliance team reviews the legal ramifications of storing PII.</li> <li>A security team defends the stored data.</li> <li>Administrative staff handles compliance with data regulations.</li> <li>A PR team to do outreach when PII is leaked or spilled.</li> </ul> <p>These assumptions are only possible for large, well-funded organizations to fulfill. Apple already has extensive staff around the world to handle all this. A dissident newspaper from a small country does not. Metrics are nonetheless valuable for this dissident newspaper, and for so many other small- and medium-sized organizations. So Clean Insights starts with different core assumptions that are much more broadly applicable:</p> <ul> <li>As little data as possible is stored to reduce the security and leakage risks.</li> <li>The stored data does not reveal identities if made public.</li> <li>Legal review is reduced as much as possible.</li> <li>No expensive computing resources required.</li> </ul> <p><a href="https://www.accessnow.org/understanding-differential-privacy-matters-digital-rights/"><img src="local-vs-global.png" alt="Clean Insights vs differential privacy" /></a></p> <h2 id="starting-out-with-clean-insights">Starting out with Clean Insights</h2> <p>In order to make the Clean Insights approach work, it must start with <a href="https://gitlab.com/cleaninsights/clean-insights-design/-/blob/master/docs/Clean%20Insights%20-%20%20Feb%202020.pdf">thinking about the data</a>. When setting up metrics and analytics, there is a natural temptation to want to have all the information. We recommend starting with a very small set of safe measurements as a way to avoid temptation, which might lead the project into hazardous ground. For web server logs, start by eliminating the PII at the source: use a privacy log configuration for <a href="https://guardianproject.info/2017/06/08/tracking-usage-without-tracking-people/">Apache</a> or <a href="https://f-droid.org/2019/04/15/privacy-preserving-analytics.html">NGINX</a>. Or use a <a href="https://gitweb.torproject.org/webstats.git/tree/src/sanitize.py">sanitizing script</a>. For other scenarios, do a quick review and see what kinds of counts can be easily and safely gathered and start with those. These are not always easy questions to answer. What kind of data is available? What can that data actually tell us? What are the risks of gathering and storing that data? One of the safest types of useful data is simple counts of events.</p> <ul> <li>How many times did an image fail to download?</li> <li>How many conversations do users have open?</li> <li>How many notifications are swiped away without being viewed?</li> <li>How long did users wait for Tor to be available?</li> </ul> <p>The existing analytics tools skirt this step, instead making it easy to gather as much as possible. They can then rapidly display all sorts of pretty graphs and charts derived from the data. That points to another key problem with the status quo in metrics: the emphasis on what it easy to represent. When there is a big pile of &ldquo;collect it all&rdquo; data, there are many views that analytics packages instantly provide. This is often in conflict with what is actually valuable. These instant graphs oversimplify things, making it easy to forget that good metrics come from first thinking in depth about the problems that can be solved by metrics. The old adage is <a href="https://en.wikipedia.org/wiki/Garbage_in,_garbage_out">garbage in, garbage out</a>. Data about campaigns that is easy to graph may end up leading the effort astray if the valuable metrics are hidden behind lots of pretty charts that distract.</p> <p>One recent example of gathering less data is GitHub: they recently &ldquo;<a href="GitHub got rid of cookie consent screen https://www.theregister.com/2020/12/17/github_will_no_longer_present/">removed all non-essential cookies</a>&rdquo;. Their analytics did not need the extra data those cookies provided. On top of that, using such tracking methods now requires an <a href="https://www.smashingmagazine.com/2021/03/state-gdpr-2021-cookie-consent-designers-developers/">extensive and complicated</a> design process.</p> <h2 id="stored-data-needs-maintenance">Stored data needs maintenance</h2> <p>Large collections of PII are valuable to others besides the software designers. Databases are routinely stolen. Tracking is also very useful to attackers to find their targets. PII is also key for building a social graph, which can be used to uncover networks of dissidents. Or sometimes it is just vandalism, and the private data is simply dumped onto the open internet.</p> <p>Then there are data regulations like the EU&rsquo;s GDPR. They require that services turn over all the user&rsquo;s personal data when they request it. Users can also request that their data be deleted. Implementing such a system is a chunk of work. First, figure out up front what data is being either deliberately or inadvertently collected. Then compare that to which data is actually technically required. From that perspective, it is possible to eliminate the need for a complicated system managing user data by ensuring that PII is not gathered at all. That can also eliminate unwanted surprises down the line. If you find out after years of running a service that you have been collecting personal data, and users make requests, you might suddenly have a pile of work tracking down all that data and assembling it for delivery to the user. A bug in that system could then leak data to the wrong user, which can lead to large fines from regulators.</p> <h2 id="measure-responsibly">Measure responsibly</h2> <p>Even with all these methods to do metrics more responsibly, the question remains: does it need to be measured? There are working projects that have achieved widespread adoption and usage without tracking users. Debian and F-Droid have risen while not really gathering many metrics at all. It is not always a simple question: so many important problems require grant funding to solve. Yet many funders require extensive metrics. Digital privacy tools have been largely funded by governments, from Tor to Signal. Governments should measure and evaluate the projects they are funding. Governments should also be open about the data they have. The well-established methods governments use to track projects require lots of data, including PII. This is a catch-22 when working on software privacy, where the goal is to make it impossible to gather PII. Government-funded agencies like <a href="https://opentech.fund">OTF</a> funded so many key privacy tools. They put a lot of work into running government-funded grants without requirements to track their users. This meant pushing back against the US Federal Government&rsquo;s widespread policies about measurement and evaluation. Using metrics based on safe data sources means projects can provide useful analytics and strong privacy at the same time. Even when considering that usability and user research are <a href="https://guardianproject.info/2021/02/18/usability-the-wonderful-powerful-idea-that-betrayed-us/">central</a> to driving the big tracking companies&rsquo; ever expanding data collection, we believe that usability and user research can still be done responsibly. It is possible to use data to inform UX Design without tracking people at all. As these techniques are widely adopted, they will also help designers focus on what is most important, thereby delivering better digital experiences for users.</p> https://guardianproject.info/2021/02/18/usability-the-wonderful-powerful-idea-that-betrayed-us/ Thu, 18 Feb 2021 00:00:00 +0000 https://guardianproject.info/2021/02/18/usability-the-wonderful-powerful-idea-that-betrayed-us/ <p>Usability triggered a revolution in computing, taking arcane number crunching machines and making them essential tools in so many human endeavors, even those that have little to do with mathematics. It turned the traditional design approach on its head. Initially, experts first built a system then trained users to follow it. User experience design starts with goals, observes how people actually think and act in the relevant context, then designs around those observations, and tests with users to ensure it fits the users&rsquo; understanding. These ideas were pioneered in the Silicon Valley. This was driven by the unusual confluence of a pioneering spirit and deep engineering skills. That merged with a strong <a href="https://en.wikipedia.org/wiki/Midpeninsula_Free_University">counter</a>-<a href="https://en.wikipedia.org/wiki/Homebrew_Computer_Club">culture</a> looking to <a href="https://en.wikipedia.org/wiki/People%27s_Computer_Company">empower</a> individuals and communities. So much of the best of digital technology has its roots in these ideas. I feel fortunate to have grown up immersed in these ideas in the Silicon Valley of the 70s and 80s, and still feel that sense of idealism that these ideas can truly make the world a better place.</p> <p>Unfortunately, &ldquo;making the world a better place&rdquo; has become a catch phrase. It is now mostly associated with single-minded investors (aka Venture Capitalists) looking to make money as fast as possible. One key piece is inspiring engineers to work non-stop by constantly telling them they are doing something valuable. Yet another social media doodad monetized by <a href="https://en.wikipedia.org/wiki/Surveillance_capitalism">surveillance capitalism</a> is clearly the opposite of making the world a better place. On top of that, these now well honed ideas of usability are widely used to <a href="https://www.vox.com/2018/2/27/17053758/phone-addictive-design-google-apple">make</a> <a href="https://dl.acm.org/doi/10.1145/2254129.2254137">digital media</a> technology <a href="https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0180094">literally</a> an <a href="https://psycnet.apa.org/doiLanding?doi=10.1037%2Fadb0000379">addictive</a> <a href="http://rali.bournemouth.ac.uk/wp-content/uploads/2015/03/raian_ali_et_al_2015_refsq_the_emerging_requirement_for_digital_addiction_labels.pdf">drug</a> so that wealthy investors can make money even faster. The rise of usability parallels the rise of surveillance capitalism. These two support each other and feed off of each other. Software must be fluid and easy in order to become addictive. Even if the task at hand is mundane: just keep clicking, look at the pretty animations, and keep following the likes! The Silicon Valley <a href="https://www.thesocialdilemma.com/">insiders</a> <a href="https://vimeo.com/462049229">know</a> how destructive their wares are, <a href="https://www.businessinsider.de/international/silicon-valley-parents-raising-their-kids-tech-free-red-flag-2018-2/">they ban their own children from using them</a> while continuing to sell them to the world.</p> <p>Those of us who still truly believe in usability as a potential force of good are left feeling used and abused, wondering what on earth we can now do to stop the monster we helped create. Tools and design processes can be used for both good and evil. It is important to note that does not mean technology is neutral. &ldquo;<a href="https://weaponsofmathdestructionbook.com/">Algorithms are opinions embedded in code</a>&rdquo;. Basically all <a href="https://medium.com/thoughts-and-reflections/racial-bias-and-gender-bias-examples-in-ai-systems-7211e4c166a1">technologies</a> <a href="https://www.propublica.org/article/machine-bias-risk-assessments-in-criminal-sentencing">have</a> <a href="https://peopleofcolorintech.com/articles/recognizing-cultural-bias-in-ai/">a bias</a>, and the designers of those technologies have power to affect those biases. When someone designs a knife for use in the kitchen, it looks quite different than a knife designed to attack other humans. Of course, both can be used to attack people, but its much easier to attack with the switchblade, and a switchblade is a bad kitchen tool. Using <a href="https://www.interaction-design.org/courses/gamification-creating-addictive-user-experience">addictive design</a>, we have been sold on the idea that a switchblade is an all-purpose tool.</p> <table> <thead> <tr> <th><!-- --></th> <th><!-- --></th> </tr> </thead> <tbody> <tr> <td><img src="paringknife.jpg" alt="paring knife" /></td> <td><img src="switchblade.jpg" alt="switchblade" /></td> </tr> </tbody> </table> <p>Like social media, a hammer is great when you need it, but otherwise should be left in the toolbox. The <a href="http://openresearch.ocadu.ca/id/eprint/1743/ - http://openresearch.ocadu.ca/id/eprint/1743/7/Hsu_Cheryl_2017_MDES_SFI_MRP.pdf">tools</a> of addictive design have convinced us to constantly carry our hammer around. It buzzes in our pocket, nagging us to try it out in just about any context. It uses our innate human desire for social approval to reward us whenever we use the hammer. Now its use is so widespread, wielding the hammer no longer looks out of context. There are people hammering while eating, working, walking, talking, and even in the bathroom.</p> <h2 id="meet-usability-s-offspring-surveillance-capitalism">Meet Usability’s Offspring: Surveillance Capitalism</h2> <p>Mobile phones could truly benefit people, but it is nearly impossible to open your phone to do one thing. Apps and ads immediately compete for your attention and time. Posting updates to family and friends happens through Facebook. Search, maps, and many other activities happen through Google. YouTube steers us to watch another video. Facebook inserts itself into our personal relationships. All of these are designed to keep you using them more and more, since that is how those companies make money. These services are built on usability, which causes us to use them more and more. <strong>Remember, with surveillance capitalism, the users are <a href="https://quoteinvestigator.com/2017/07/16/product/">not the customer, they are the product</a>.</strong> So those companies are using usability design to figure out how to keep users &ldquo;engaged&rdquo;, meaning using that platform as much as possible. That is the design problem they are solving. <strong>When the user is the customer, that can look very different.</strong> WhatsApp became massively popular with a business model of charging a dollar a year, regardless of usage. Their users were also their customers. Now <a href="https://arstechnica.com/tech-policy/2021/01/whatsapp-users-must-share-their-data-with-facebook-or-stop-using-the-app/">Facebook</a> aims to change all that, and WhatsApp users <a href="https://www.bloomberg.com/news/articles/2021-01-11/why-whatsapp-s-privacy-rules-sparked-moves-to-rivals-quicktake">do not like it</a>. Turns out it is very difficult to compete with free, so responsible business models are at a tremendous disadvantage. And many WhatsApp users are now <a href="https://www.nytimes.com/2021/01/13/technology/telegram-signal-apps-big-tech.html">flooding to Signal</a>, which is a non-profit foundation working to survive on donations.</p> <p>Foundations and governments need to measure and evaluate the projects that they fund, and they are starting to request surveillance capitalism techniques from the projects they fund. Schools are using web services that use addictive design, ostensibly to help kids learn, but are nonetheless getting kids hooked. Metrics are central to addictive design, it is based on tracking actual people and what keeps their attention. A/B testing provides a rapid way to test how to suck people in. <a href="https://en.wikipedia.org/wiki/Recommender_system">Recommender systems</a> are very effective at getting users to click on the next video or post. For those kinds of predictions to work, they first need a lot of data about how lots of people respond.</p> <table> <thead> <tr> <th>&ldquo;<a href="http://openresearch.ocadu.ca/id/eprint/1743/7/Hsu_Cheryl_2017_MDES_SFI_MRP.pdf">how designers shift the burden of responsibility through design</a>&ldquo;</th> </tr> </thead> <tbody> <tr> <td><a href="http://openresearch.ocadu.ca/id/eprint/1743/7/Hsu_Cheryl_2017_MDES_SFI_MRP.pdf"><img src="shifting-responsibility.png" alt="how designers shift the burden of responsibility through design" /></a></td> </tr> </tbody> </table> <h2 id="data-driven-design-is-dangerous-and-powerful">Data-driven design is dangerous and powerful</h2> <p>Data-driven design can also be used to find the borders of what things they will tolerate beyond things in their interest. For example, so many software business models involve offering a service without payment, then finding ways to get the users to pay. This can be with their data or by upselling. An ethical approach to this kind of business model is to clearly define upfront what types of things require payment. Unfortunately, a more common approach is to <a href="https://www.nirandfar.com/want-to-hook-your-users-drive-them-crazy/">first get users hooked</a> on the service without paying. Getting users hooked is offered as a design service, the design equivalent of someone pushing addictive drugs. Once hooked, when the cost of migrating away from the tool is high, hit users with payment requirements. Using data-driven design, a service can measure that response in detail. Tracking all the users provides even better targeting of users based on profiling them.</p> <p><strong>Data-driven design is clearly powerful but it need not lead to harmful practices.</strong> Usage data can let small organizations effectively direct resources to the areas of biggest need. Crash report analytics quickly point out important bugs that otherwise would have taken days or weeks of effort to track down. Neither of these need data about people to be effective techniques.</p> <h2 id="measure-effectiveness-rather-than-engagement">Measure effectiveness rather than &ldquo;engagement&rdquo;</h2> <p>The best mobile software would be designed to make users spend as little time as possible using it. This is hard to measure. Users who find the software difficult to use would also use it as little as possible. We need to figure out how to measure that difference. Once we do, we can begin to understand what makes a good design in which people use the tool to efficiently solve a problem, then put the tool away once they are done. I think this is one of the biggest questions we can now work on as part of our work on Clean Insights. It is clear that learning to measure effectiveness will not be easy. Creating the discipline of <a href="https://en.wikipedia.org/wiki/User_experience_design">user experience design</a> was also not. After thinking about human-computer interaction and usability for over 25 years, I watched these ideas go from a nice idea to the dominant paradigm. <strong>It is clearly possible to reclaim usability by thinking ethically about how data is collected and used.</strong></p> <p>One key thing that makes user-centered design work so well is the cycle of research, design, implementation and testing. This is akin to scientific experiments, where there is a hypothesis that is tested. It can happen so fast because it can be decentralized and pieced out into a wide range of scales. User-focused design starts by trying to solve a problem, and iterates to continually improve. The goals often change as well, in response to new use cases, business models, technologies, and even product goals.</p> <p>So often, the central focus shifts from real needs to keeping users &ldquo;engaged&rdquo;. Designing for engagement shifts the focus away from the task at hand, and instead is about making people use the software as much as possible. That distracts from providing solutions that reduce the time the user needs to complete a task. For example, no one is asking for software to help them send and receive ever more messages. The goal is effective communication and organization. If software is really addressing that need, that means users will spend less and less time using that communication tool. That is in direct conflict with a design process focused on &ldquo;engagement&rdquo;, which pushes for as much eyeball time as possible. The same design thinking based on psychology used in addictive design can also be used to actively <a href="https://www.researchgate.net/profile/Aditya-Purohit-4/publication/340903372_Designing_for_Digital_Detox_Making_Social_Media_Less_Addictive_with_Digital_Nudges/links/5ea3740ea6fdccd7945168ae/Designing-for-Digital-Detox-Making-Social-Media-Less-Addictive-with-Digital-Nudges.pdf">avoid addictive qualities</a>.</p> <p>As long as a person is being tracked and profiled, there is an inevitable pull towards trying to keep that person &ldquo;engaged&rdquo;. If the data is instead about actions, not people, then the emphasis is on what the user wants to achieve. Billions have been spent on learning how to effectively track people, that does not need to be thrown away. The analytics software can be retooled to focus on usage rather than people. Responsible collection of usage data is the clear place to start in order to shift from &ldquo;engagement&rdquo; to effectiveness.</p> https://guardianproject.info/2021/02/10/clean-insights-february-2021-update-on-privacy-preserving-measurement/ Wed, 10 Feb 2021 00:00:00 +0000 https://guardianproject.info/2021/02/10/clean-insights-february-2021-update-on-privacy-preserving-measurement/ <p>Greetings, all. I hope this finds you healthy and well, finding ways to enjoy the season (whichever it may be). While everyday still provides new challenges in the life of our team at Guardian Project, we continue to strive to be productive as productive as we can be in our professional and personal lives.</p> <p>I&rsquo;ve just posted an updated presentation on <a href="https://cleaninsights.org">Clean Insights</a>, reflecting on the symposium in May, and the work we have done since then. You can see and share it from here:</p> <ul> <li><p><a href="https://www.youtube.com/watch?v=vo6FI-WDLG0">Watch update on YouTube</a></p></li> <li><p>You can also listen to this update on the <a href="https://guardianproject.info/podcast/2021/clean-insights-update.html">Guardian Project Podcast</a></p></li> </ul> <p>Thanks to <a href="https://die.netzarchitekten.com/">Benjamin Erhart</a>, our lead developer on Clean Insights, we&rsquo;ve made substantial progress over the last few months on delivering our new software development kits. If you visit our Gitlab project page, you will find design documents and SDKs for Android, iOS, Javascript (both for desktop and web) and soon Python (Thanks, to <a href="https://irl.xyz">Iain Learmonth</a> for this contribution). While this work is ongoing, the code is stable, and we feel it is ready to start getting it into all of your hands, so that you can start asking all the questions we have yet to consider.<br /> <a href="https://gitlab.com/cleaninsights">Clean Insights on Gitlab</a></p> <p>Here is an example of how easy it is to implement a measurement of a specific event or a visit to certain view in your app:</p> <ul> <li><a href="https://gitlab.com/cleaninsights/clean-insights-android-sdk/-/blob/master/app/src/main/java/org/cleaninsights/example/Main2Activity.java#L48">Sample code for Android integration</a></li> </ul> <p>We are still relying on Matomo as our backend aggregator, analysis tool and dashboard, and it continues to work well enough for our 1.0 solution. That said, to enhance the privacy of Clean Insight-enabled clients, we&rsquo;ve design and implemented a proxy service, the <a href="https://gitlab.com/cleaninsights/clean-insights-matomo-proxy">Clean Insights Matomo Proxy</a>. The CIMP reduces the amount of metadata and logging that Matomo can do, since it is only communicate to directly by the no-logging proxy.</p> <ul> <li><a href="https://gitlab.com/cleaninsights/clean-insights-matomo-proxy">Clean Insights Matomo Proxy</a></li> </ul> <p>All of this software is available for you to implement and deploy on your own. We also have a public testbed and hosted service available at <a href="https://metrics.cleaninsights.org">https://metrics.cleaninsights.org</a> that we can make available for anyone who isn&rsquo;t able to run and maintain their own instance. We can also assist you with considering the insights you want to gain, threat modeling the risks it poses to your users, and implementing the SDK into your software, be it a mobile app, web app, desktop app, back-end service or operating system. Our deisgn partners at Okthanks also have a variety of concepts and soon sample projects and code for implementing effective and ethical Consent UX to achieve the right kind of &ldquo;opt-in&rdquo;.</p> <p>Please reach out if you have interest in using Clean Insights. We have weekly scrum meetings, email lists and a public discussion room on the Matrix network. More info on these on the <a href="https://cleaninsights.org/dev">Developer Page</a></p> https://guardianproject.info/2020/12/15/new-data-sources-api-key-identifiers-and-broadcastreceiver-declarations/ Tue, 15 Dec 2020 00:00:00 +0000 https://guardianproject.info/2020/12/15/new-data-sources-api-key-identifiers-and-broadcastreceiver-declarations/ <p>A central focus of the <a href="https://gitlab.com/trackingthetrackers/wiki">Tracking the Trackers</a> project has been to find simple ways to detect whether a given Android APK app file contains code which tracks the user. The ideal scenario is a simple program that can scan the APK and tell a non-technical user whether it contains trackers, but as decades of experience with anti-virus and malware scanners have clearly demonstrated, scanners will always contain a large degree of approximation and guesswork. Tracking the Trackers grew out of experiments in using machine learning to detect malware. This provided the spark to apply this to privacy issues.</p> <p>The malware research clearly demonstrates that network domain names and code signatures are quite reliable techniques for identifying malware. This also applies to tracking, since the majority of tracking happens via tracking companies&rsquo; SDKs which send data to specific domain names. The hard part is that code signatures and domain names are not easy to reliably extract, and are often easy to obfuscate when someone is looking to hide what an app is actually doing. This is common in malware, and we are also starting to see obfuscation in the world of tracking.</p> <p>Android gives us a break with its <a href="https://developer.android.com/guide/topics/manifest/manifest-intro"><em>AndroidManifest.xml</em></a>. It is a hard requirement for Android apps so it is always there, it contains some key declarations that set up how the code is run, and it is easy to extract and parse. So we put extra effort in thinking about the data that is contained in the <em>AndroidManifest.xml</em>.</p> <p>Towards the goal of simple scanners for tracking, we are excited by two new data sources that we found in the <em>AndroidManifest.xml</em> that are useful signals for automatically detecting tracking in Android apps: API Key Identifiers and <em>BroadcastReceiver</em> Declarations.</p> <h3 id="api-key-identifiers">API Key Identifiers</h3> <p>Tracking services provide their customers with servers to submit the data for processing and analytics. These are usually part of the service&rsquo;s API. A common pattern for publicly accessible network APIs is to require the use of an API Key. This key grants access to the service and provides an unique identifier for the customer so that the submitted data goes to the right place. In order to submit the key to the API, the key data must be identified to the server somehow. That is the API Key Identifier. This is generally something that never changes, since changing it could mean locking out all customers. For example, <a href="https://developers.google.com/android/reference/com/google/android/gms/analytics/Tracker">Google Firebase Analytics</a> has used <code>ga_trackingId</code> as its API Key Identifier for many years. API Key Identifiers are a great way to track trackers. They are tiny and easy to extract. Most services require them. The entire set that we have found is small enough to fit into a single machine learning search space. And it is quite unlikely that an app would include them by accident or without having set up a tracking service.</p> <p>We also found <a href="https://github.com/Exodus-Privacy/etip/issues/62#issuecomment-613964965">some evidence</a> of obfuscated API Key Identifiers, the source has not yet been identified. We found many API Key Identifiers that were not the same but matched a pattern. This pattern looks like it could be encoding some information:</p> <ul> <li><tt>com.APpuz.lHMBA142332.APIKEY</tt></li> <li><tt>com.BCcyZzWehh.IOfazFfwIH109433.APIKEY</tt></li> <li><tt>com.CDwo.buYv134822.APIKEY</tt></li> <li><tt>com.DErSuvPp.bEyhwTQb93737.APIKEY</tt></li> <li><tt>com.EOoOEpvG.ZuepOuto31966.APIKEY</tt></li> <li><tt>com.FIKDGlAZIZ.vrlGNzSLEm110206.APIKEY</tt></li> <li><tt>com.GicPdlXU.iXbdAAkA69030.APIKEY</tt></li> </ul> <p>API Key Identifiers are now <a href="https://github.com/Exodus-Privacy/etip/issues/62">included as a data point</a> gathered in <a href="https://guardianproject.info/2020/12/11/%CE%B5xodus-etip-the-canonical-database-for-tracking-trackers/">Exodus ETIP</a>. If you have some clues about any of this, please <a href="https://gitlab.com/trackingthetrackers/wiki/-/issues/6">let us know</a>.</p> <h3 id="broadcastreceiver-declarations"><em>BroadcastReceiver</em> Declarations</h3> <p>In Android, apps and the <a href="https://developer.android.com/about/versions/11/reference/broadcast-intents-30">system</a> can publicly broadcast events, and any app can listen for these events. Some of these events contain detailed information, like the <a href="https://gitlab.com/trackingthetrackers/wiki/-/issues/5">complete metadata</a> about which song is currently playing. Charging and battery status can be used to <a href="https://blog.lukaszolejnik.com/battery-status-readout-as-a-privacy-risk/">re-identify users</a>. These broadcast events are generic Android <code>Intents</code> which an app registers a receiver by name in order to get the info when it is sent. The specific pieces of interest are the <em><a href="https://developer.android.com/reference/android/content/BroadcastReceiver">BroadcastReceiver</a> <a href="https://developer.android.com/reference/android/content/IntentFilter">IntentFilter</a> <a href="https://developer.android.com/guide/components/intents-filters#Building">Action</a></em> names.</p> <p>Like other bits in the <em>AndroidManifest.xml</em>, the <em>BroadcastReceiver</em> Declarations are easy to extract. Unfortunately, <em>BroadcastReceiver</em> Declarations are not nearly has definitive when it comes to marking tracking. They are still worth including, since they are easy to extract, and the whole set of unique, extracted names is small enough to be used as a search space for the machine learning.</p> <p>The scope of how apps can receive data via <em>BroadcastReceivers</em> was also recently <a href="https://developer.android.com/about/versions/oreo/background#broadcasts">narrowed</a> to a large degree by Google, due to privacy concerns. The upside is that apps cannot receive system-wide broadcasts unless they are already running. The downside is that scanners have to do static code analysis, and perhaps even dynamic analysis, in order to see which <em>BroadcastReceiver IntentFilter Action</em> names an app has declared.</p> <h2 id="usage-considerations">Usage Considerations</h2> <p>The possibility of false positives is still there. For example, if someone makes a &ldquo;build flavor&rdquo; that builds without tracker SDKs but forgets to exclude the API Key Identifiers, then a simple scanner will flag this as tracking, even though it could not be. The tracker SDK is not included, which is the code that gathers and uploads the tracking data. In this example, the developer can easily fix it after a scanner flags the app as a tracker, by moving the API key configuration out of the &ldquo;build flavor&rdquo;.</p> <p>A trickier case to review is when an app includes opt-in tracking. We believe that opt-in tracking and data reporting should not be flagged as a tracker, especially when the opt-in user experience makes it clear to the user what data is being gathered, and under what condition it is being sent. In that case, the simple scanner will flag the app, since it contains the API Key Identifier.</p> <p>This is why we think that machine learning is very promising for tracking apps that track us. There are many good signals, but none of them definitely mark an app as a tracker. They must always be considered as a group with the whole picture, and given well-labeled data, machine learning can do this kind of task quite accurately.</p> <h2 id="join-the-hunt">Join the Hunt!</h2> <p>Finding API Key Identifiers is work that can be done in bite-sized pieces, by people in their spare time. Many if not most tracker SDKs require API keys in order to use their service, so start by looking through <a href="https://etip.exodus-privacy.eu.org/trackers/all">ETIP</a> for entries that are missing <code>Api_key_ids</code> entries. Usually, this is documented in their SDK developer documentation. There are also many SDKs which set the API Key via a <a href="https://github.com/Exodus-Privacy/etip/issues/62#issuecomment-598272804">method call</a> rather than a declaration in an XML file. In that case, the API Key Identifier might be found by reading the strings out of the JAR file. We also welcome more information about <em>BroadcastReceiver</em> declarations. We are tracking new data sources and approaches in our <a href="https://gitlab.com/trackingthetrackers/wiki/-/issues">issue tracker</a>.</p> <p>For any kind of mass scanning to be usable, future work should focus on expanding the set of easy to extract features, and finding which of those are useful. Complicated and resource-intensive extractions like domain names, code signatures, and source/sink tracing still hold promise for delivering high accuracy, but would likely remain only useful when scanning individual or small sets of apps.</p> <p>(<em>This work was supported by NLnet&rsquo;s <a href="https://nlnet.nl/thema/NGIZeroPET.html">NGI Zero PET</a> fund.</em>)</p> https://guardianproject.info/apps/net.opendasharchive.openarchive.release/ Sat, 12 Dec 2020 00:00:00 +0000 https://guardianproject.info/apps/net.opendasharchive.openarchive.release/ https://guardianproject.info/2020/12/11/%CE%B5xodus-etip-the-canonical-database-for-tracking-trackers/ Fri, 11 Dec 2020 00:00:00 +0000 https://guardianproject.info/2020/12/11/%CE%B5xodus-etip-the-canonical-database-for-tracking-trackers/ <p>There is a new story to add to the list of horrors of <a href="https://en.wikipedia.org/wiki/Surveillance_capitalism">Surveillance Capitalism</a>: the United States&rsquo; Military is <a href="https://www.vice.com/en/article/jgqm5x/us-military-location-data-xmode-locate-x">purchasing tracking and location data</a> from companies that track many millions of people. We believe the best solution starts with making people aware of the problem, with tools like <a href="https://exodus-privacy.eu.org/">Exodus Privacy</a>. Then they must have real options for stepping out of &ldquo;big tech&rdquo;, <a href="https://www.theguardian.com/technology/2017/nov/28/android-apps-third-party-tracker-google-privacy-security-yale-university">where tracking dominates</a>. <a href="https://f-droid.org">F-Droid</a> provides Android apps that are reviewed for tracking and other <a href="https://f-droid.org/en/docs/Anti-Features/">&ldquo;anti-features&rdquo;</a>, and F-Droid is built into mobile platforms like <a href="https://calyxos.org/">CalyxOS</a> that are free of proprietary, big tech software.</p> <p>Right now, the most effective method for automatically analyzing Android APK files is to search for well known strings in the extracted contents of the APK. Domain names are one example, like if an app is sending data to <code>google-analytics.com</code> or <code>facebook.com</code>, then it is clear that it is doing some kind of tracking. These lists of well known strings must be created and managed by people, then gathered and reviewed. <a href="https://exodus-privacy.eu.org/">Exodus Privacy</a> created their <a href="https://etip.exodus-privacy.eu.org/">Exodus Tracker Investigation Platform (ETIP)</a> for exactly this purpose. <a href="https://github.com/YalePrivacyLab/tracker-profiles">Yale Privacy Lab</a>, <a href="https://github.com/jawz101/potentialTrackers"><em>jawz101</em></a>, Guardian Project, F-Droid, and others have centralized their efforts on εxodus ETIP as the canonical database for these strings.</p> <h2 id="searching-the-open-web-for-key-bits-of-info">Searching the open web for key bits of info</h2> <p>Since tracking is mostly done by companies trying to get customers, they advertise and document their services on the web. We spent some time searching for that information to see what we could find. We mostly searched using two bits of information: the API Key Identifiers that we <a href="https://gitlab.com/trackingthetrackers/extracted-features/-/blob/master/axml-meta-data-run">extracted</a> and &ldquo;top 10&rdquo; lists of companies that provide tracking and related services. From this, we added over 50 new service profiles to the εxodus ETIP database. We also added upwards of 100 pieces of additional information to existing entries like SDK identity strings, links to documentation, privacy policies, and information on the company&rsquo;s tracking methods.</p> <p>From that research, we saved some choice promises from selected tracking companies:</p> <ul> <li>&ldquo;Glassbox offers customer experience analytics solutions that doesn’t just tell you what a customer is doing. It tells you why.&rdquo;</li> <li>&ldquo;Target traffic from all sources, including the 50% from the hidden web where third-party cookies are blocked, to increase targetable inventory.&rdquo;</li> <li>&ldquo;Collect customer and product data in real time, from anywhere&rdquo;</li> <li>&ldquo;PlaytestCloud will capture the whole gameplay experience, turning you into a spectator with super powers.&rdquo;</li> <li>&ldquo;We record the players’ screen, their touches and what they have to say at all times.&rdquo;</li> <li>&ldquo;We curate geospatial ground truth data sets on a global scale&rdquo;</li> <li>&ldquo;Take segmentation and analysis from overnight to real-time. Our DMP works in-session for perfect match rates even on passerby traffic.&rdquo;</li> </ul> <h2 id="crowdsourcing-the-hunt-for-trackers">Crowdsourcing the hunt for trackers</h2> <p>Tracking the trackers is the kind of work that fits in very well with crowdsourcing. Tracking companies are disappearing and renaming themselves all the time, in order to avoid too much scrutiny. But they still must reach out to developers in order to find customers. That means we can find them. Join in the search! Non-technical people can also contribute, for example, when you read news about a tracking company, <a href="https://etip.exodus-privacy.eu.org/trackers/all">search</a> to see if it is already in ETIP. If not, <a href="https://github.com/Exodus-Privacy/etip/issues">file an issue</a> to request it is added. Android developers with little bits of spare time can add code signatures, domain names, and other key technical details to ETIP. Or even <a href="https://gitlab.com/trackingthetrackers/scripts/-/blob/master/find-ga_trackingId.py">code up quick scripts</a> with new ideas for detecting tracking.</p> <p>There are a number of forums where you can ask for assistance in getting started. Hope to hear from you soon!</p> <ul> <li><a href="https://exodus-privacy.eu.org/en/page/contribute/">Contributing to Exodus Privacy</a></li> <li><a href="https://forum.f-droid.org">F-Droid Forum</a></li> <li><a href="https://f-droid.org/about/#contact">F-Droid chat rooms</a></li> <li><a href="https://guardianproject.info/contact/">Guardian Project channels</a></li> </ul> <p>(<em>This work was supported by NLnet&rsquo;s <a href="https://nlnet.nl/thema/NGIZeroPET.html">NGI Zero PET</a> fund.</em>)</p> https://guardianproject.info/2020/12/07/distribution-in-depth-mirrors-as-a-source-of-resiliency/ Mon, 07 Dec 2020 00:00:00 +0000 https://guardianproject.info/2020/12/07/distribution-in-depth-mirrors-as-a-source-of-resiliency/ <p><img src="distribution.png" alt="distribution" /></p> <p>There are many ways to get the apps and media, even when the Internet is expensive, slow, blocked, or even completely unavailable. Censorshop circumvention tools from ShadowSocks to Pluggable Transports can evade blocks. Sneakernets and <a href="https://briarproject.org/how-it-works/">nearby connections</a> work without any network connection. Hosting on Content Delivery Networks (CDNs) can make hosting drastically cheaper and faster. One method that is often overlooked these days is repository mirrors. Distribution setups that support mirrors give users the flexibility to find a huge array of solutions for problems when things are not just working. Mirrors on local networks can be much cheaper. Mirrors in specific countries are often not blocked or filtered. Mirrors can be copied onto portable storage and moved to where the users are.</p> <p>Repository mirrors are mostly associated with free software distribution. Every major GNU/Linux distro, from <a href="https://www.debian.org/mirror/list">Debian</a> to Red Hat, is available via mirrors. Software collections like Android/Java&rsquo;s <a href="https://maven.apache.org/guides/mini/guide-mirror-settings.html">Maven Central</a> and Python&rsquo;s <a href="https://pip.pypa.io/en/stable/reference/pip_install/#install-index-url">PyPI</a> support mirrors as well. <a href="https://f-droid.org/docs/Running_a_Mirror/">F-Droid</a>&rsquo;s infrastructure is also based on mirrors. Free software repositories have proven so valuable, that there generally are mirrors maintained around the world. Local mirrors of popular free software repositories are available in all continents, and most countries.</p> <p>Mirrors also add conceptual complexity to distribution. Users who are used to internet services that work without configuration could easily find discussion of mirrors confusing. Mirrors also mean that more pieces of infrastructure need to be maintained. When systems with mirrors are well organized, then this work can be broken into small chunks and widely shared, often even by volunteers, so that the overall system is resilient and maintainable even given limited resources.</p> <p><a href="https://commons.wikimedia.org/wiki/File:InternetPopulation2011_DeSabbata_Graham_OII.png"><img src="InternetPopulation2011_DeSabbata_Graham_OII.png" alt="Internet Population" /></a></p> <h2 id="building-a-repository-mirror-system">Building a repository mirror system</h2> <p>Good mirroring support must disconnect how the data is downloaded from how the data integrity is maintained. That means data can come from anywhere, and still be properly verified before installing it. This is usually done with an index of files signed by public key cryptography. A system built on HTTPS and trusted servers is a bad candidate for mirroring. This separation of concerns is a key property of distribution systems that allows them to be flexible while still providing fully verified distribution.</p> <p>Then, it must be easy for users to configure the mirrors in use. First and foremost, mirrors should work without the user doing anything. To ensure flexibility, they must be easy to add and remove, and new mirrors must be easy to find. Both end users and repository operators should be able to specify mirrors to be used. Legal requirements must also be heeded: the whole system should not require any service that might be legally questionable in any relevant jurisdiction. EU users need GDPR-compliant services. If the aim is to distribute in China, then the system cannot require Google Cloud Services. Instead, it should also be able to go through cloud services available in China.</p> <p>There are many CDN providers around the world. Many of these are in effect a mirroring service since they are pointed at a website hosted elsewhere, then they just cache the files. Some of them are so cheap, that files can be hosted there without signing up. This happens usually via source code repositories like GitHub. For example, <a href="https://rawgit.org/">RawGit</a> is an automatic, CloudFlare-based CDN for any public repository on GitHub, <a href="https://gitlab.com">gitlab.com</a>, or BitBucket. These fronting services are so cheap because they are basically only serving cached files. Each given URL is set to be served from the cache for a long time, up to a year, without checking whether the file has changed. In order to taken advantage of this kind of CDN setup, the repository must be designed accordingly. That means each unique file should have a unchanging, unique URL. There are two techniques for doing that:</p> <ol> <li>For software, include the version in the filename or path, e.g. <code>org.fdroid.fdroid_1001000.apk</code> or <code>1.10/F-Droid.apk</code>.</li> <li>For media, include the hash of the file in the filename or path, e.g. <code>icon_CQLCGleZNBzDPRNp1ADs121TecVHFmUbe-Au-4qXF08=.png</code> or <code>CQLCGleZNBzDPRNp1ADs121TecVHFmUbe-Au-4qXF08=/icon.png</code>.</li> </ol> <p>Mirrors are like all internet services in that there are always potential <a href="https://guardianproject.info/2014/10/16/reducing-metadata-leakage-from-software-updates/">privacy leaks</a>. To protect users&rsquo; privacy, it is important to be conscious of the potential metadata that is visible in the system, and who can get that data. For example, transport encryption (TLS, HTTPS, etc) should be used even though the signed index provides strong integrity checks in order to reduce metadata leaks. Even with transport encryption, the oeprators of the mirrors themselves will still see the metadata. When there are individual files that users can download, the mirror operators could see which user is downloading which file. Metadata like the description of a movie file or the icon of an app will give away the user&rsquo;s interests. When possible, this metadata should be grouped to reduce the detail in the metadata. Icons can be downloaded in random groups of 10. Text descriptions can be grouped by language or other more neutral grouping.</p> <h2 id="example-f-droid">Example: F-Droid</h2> <p>F-Droid repositories, aka &ldquo;<em>repos</em>&rdquo;, are collections of packages, mostly Android APK app files, which are organized in a single folder. That folder contains a signed index file which lists the entire contents and related metadata. This includes descriptive texts, available graphics, etc. This file structure is not tied to any particular transport method as long as the <em>repo/</em> folder and index remain intact. The client keeps the public key of the index signature locally, and uses that to verify the index file. The index also includes a list of URLs pointing to official mirrors. By default, repositories are served over HTTPS, but nothing in the repository structure requires that. This allows F-Droid to use repositories from SD Cards and USB OTG thumb drives using <code>file:///</code> URLs. A mirror is then simply defined: a mirror is any available copy of a repository. The mirror need not even be a complete copy, as long as the index and desired packages are present.</p> <p>F-Droid automatically handles much of the process of using the mirrors. Each <em>repo</em> can include a list of official mirrors in the index. The F-Droid Android client will automatically use all of the official mirrors, automatically choosing one when downloading based on which is working. The mirrors are still completely configurable. Anyone can create their own mirror, either via the <code>fdroid mirror</code> command for any <em>repo</em>, or <a href="https://f-droid.org/docs/Running_a_Mirror/">via <em>rsync</em></a> for <em>f-droid.org</em>. And F-Droid user can then <a href="https://f-droid.org/tutorials/add-repo/">&ldquo;subscribe&rdquo;</a> to any mirror via the mirror URL. Users can also disable any mirror from the repo&rsquo;s details screen.</p> <p><center> <link rel="stylesheet" href="https://guardianproject.info/css/hugo-easy-gallery.css" /> <div class="box" style="max-width:60%"> <figure itemprop="associatedMedia" itemscope itemtype="http://schema.org/ImageObject"> <div class="img"> <img itemprop="thumbnail" src="add-mirror.png" alt="add-mirror.png"/> </div> <a href="add-mirror.png" itemprop="contentUrl"></a> <figcaption><h4>click a link to add a new mirror</h4> </figcaption> </figure> </div> <br /> <div class="box" style="max-width:60%"> <figure itemprop="associatedMedia" itemscope itemtype="http://schema.org/ImageObject"> <div class="img"> <img itemprop="thumbnail" src="disable-mirrors.png" alt="disable-mirrors.png"/> </div> <a href="disable-mirrors.png" itemprop="contentUrl"></a> <figcaption><h4>disabling selected mirrors</h4> </figcaption> </figure> </div> </center></p> <p>The <a href="https://guardianproject.info/fdroid/">Guardian Project</a> <em>repo</em> includes many of these mirroring channels: Mayfirst webserver, Tor Onion Service, Amazon AWS S3, GitHub Pages, GitHub Raw (Fastly), gitlab.com (Google Cloud), GitCDN/RawGit/Cloudflare and of course SD Card and USB OTG drives. F-Droid <em>repos</em> are particularly well suited to this kind of mirroring since the files are available via URLs that do not change. CDNs cache files by URL. <a href="https://f-droid.org">f-droid.org</a> is mirrored by free software mirror providers around the world, including <a href="https://mirrors.tuna.tsinghua.edu.cn/fdroid/repo">China</a>, <a href="https://fdroid.tetaneutral.net/fdroid/repo">France</a>, <a href="https://ftp.fau.de/fdroid/repo">Germany</a>, <a href="https://plug-mirror.rcac.purdue.edu/fdroid/repo">Indiana</a>, <a href="https://fdroid-mirror.calyxinstitute.org/fdroid/repo">New York</a>, <a href="https://ftp.osuosl.org/pub/fdroid/repo">Oregon</a>, <a href="https://mirror.librelabucm.org/fdroid/repo/">Spain</a>, <a href="https://ftp.lysator.liu.se/pub/fdroid/repo">Sweden</a>, and <a href="http://lysator7eknrfl47rlyxvgeamrv7ucefgrrlhk7rouv3sna25asetwid.onion/pub/fdroid/repo">Tor Onion Service</a>. Local mirrors mean faster, more reliable, and cheaper access, especially for people in places like China, where government policy and infrastructure design works to downplay access to foreign networks.</p> <p><a href="https://guardianproject.info/2016/06/02/building-the-most-private-app-store/">Extensive</a> <a href="https://f-droid.org/docs/Security_Model/">work</a> has gone into making F-Droid the most private &ldquo;app store&rdquo; for mobile devices, including minimizing the potential metadata leaks. There is a single index file for all the packages, and it includes all the translations. So all users fetch the exact same index file, so the <em>f-droid.org</em> and mirror servers cannot infer from the index which language the device is using. The app icons and screenshsots are downloaded on demand, so that is one metadata leak. F-Droid requires either HTTPS or Tor Onion Service transport encryption to minimize such leaks.</p> <p>F-Droid <em>repos</em> default to keeping 3 releases per package available. Also, the index is not tied to the mirror, the F-Droid Android client will happily fetch the index from one mirror, and each package from other mirrors. F-Droid will keep searching all the mirrors for a package until it finds it, so a mirror can be out of date yet still useful. Today&rsquo;s update might only bring a couple new files, even if a mirror is delayed, it will still have all the previous content. That property ensures that distribution is not an all-or-nothing prospect. Instead, it can still transparently provide some level of access when there are troubles with the internet. This makes lots of different kinds of relibility problems look quite similar from the point of view of the F-Droid client app: outages, network troubles, blocks, and even working around expensive data.</p> <p>Someone with a Raspberry Pi with an SD Card can be a local mirror server, even if they have irregular access to the internet. The Raspberry Pi can be easily brought to unmetered WiFi, then synced up with the main <em>repo</em> using <code>fdroid mirror</code> or <code>rsync</code>. Then when it is brought back to its home, the local users can get apps and updates even if there is no active internet connection in the area. This also works with <a href="https://en.wikipedia.org/wiki/USB_On-The-Go">USB OTG</a> flash drives. A whole <em>repo</em> can be zipped up and broadcasted using a service like the satellite TV &ldquo;<a href="https://knapsackforhope.org/">Knapsack for Hope</a>&rdquo; service, their app already makes it easy to decode the broadcast and write it to USB OTG.</p> <p><center> <div class="box" style="max-width:60%"> <figure itemprop="associatedMedia" itemscope itemtype="http://schema.org/ImageObject"> <div class="img"> <img itemprop="thumbnail" src="usb-otg-mirror.png" alt="usb-otg-mirror.png"/> </div> <a href="usb-otg-mirror.png" itemprop="contentUrl"></a> <figcaption><h4>A f-droid.org mirror available via USB OTG drive.</h4> </figcaption> </figure> </div> </center></p> <h2 id="example-ubuntu">Example: Ubuntu</h2> <p>Ubuntu uses a system of mixed mirrors and CDNs <a href="https://wiki.ubuntu.com/Mirrors#Country_mirror_requirements">based on standardized domain names</a>, which includes some level of <a href="https://wiki.ubuntu.com/DynamicMirrorDecisions">automatic setup</a> based on measurement. The domain name is <code>COUNTRYCODE.archive.ubuntu.com</code>. During install, the user chooses the country to set up the device accordingly. The mirror is then set to use the mirror domain name based on that country, e.g. a device set to Uganda would use <code>ug.archive.ubuntu.com</code>. When a country-specific mirrors exists, that domain name points to it. Ubuntu has over 50 in-country mirrors. Otherwise, any other <code>*.archive.ubuntu.com</code> domain name points to a mirror running on a major CDN. This setup allows Ubuntu to change the mirror server-side setup separately from the user&rsquo;s selection on their device. Additionally, users are then still free to edit the configuration and use any URL that they want, including pointing to local media like CDROMs and thumb drives. And anyone can <a href="https://wiki.ubuntu.com/Mirrors">create their own mirror</a> without first getting permission.</p> <p><img alt="select best server" src="select-best-server.png" width="100%"/></p> <p><img src="Select-Ubuntu-Mirror-Archive.png" alt="Select-Ubuntu-Mirror-Archive" /></p> https://guardianproject.info/2020/11/28/managing-offline-maps-with-f-droid-and-osmand/ Sat, 28 Nov 2020 00:00:00 +0000 https://guardianproject.info/2020/11/28/managing-offline-maps-with-f-droid-and-osmand/ <p>When disaster strikes, our mobile devices can provide us with many tools to deal with a wide variety of problems. The internet is not available in every corner of the planet, and large scale outages happen. Digital maps allow us to carry detailed maps of the entire planet in our pockets. And the good map apps allow the user to download entire regions to the device so that they operate without internet at all. Unfortunately, the big map apps from Google and Apple provide limited offline capabilities. For example, it is <a href="https://annoyingtechnicaldetails.wordpress.com/2020/09/23/cannot-easily-redistribute-downloaded-offline-files-for-google-maps/">not possible</a> to share offline data from one device to another. Online maps are also a major privacy leak, since location data is the most sensitive data. With online maps, the service operator sees each tile of the map that you look at, each time you look at it, as well as all the locations you search for.</p> <p><a href="https://osmand.net/">OsmAnd</a> is a great map app for offline usage, since offline usage is the primary mode of operation. It lets you download entire regions to your device, then search and navigate without any network connection at all. This is also a big win for privacy: In offline mode, OsmAnd can only see which regions you have downloaded, and nothing else. OsmAnd provides private, resilient services. The maps will work as long as your device is working. The maps are still usable even if GPS is unavailable, since they can be searched and operated with only your fingertips.</p> <p>F-Droid is the most private and flexible mobile distribution system, so we recently worked to make it a lot easier to ship OsmAnd map files via F-Droid repos. That means that entire countries can be made available through the F-Droid distribution methods, including offline methods like mirrors on USB-OTG drives and local repos on a Raspberry Pi that provides the WiFi connection.</p> <p>To see an example of this in action, try adding our new <a href="https://guardianproject-wind.s3.amazonaws.com/fdroid/repo?fingerprint=182CF464D219D340DA443C62155198E399FEC1BC4379309B775DD9FC97ED97E1">Wind Offline repo</a> to F-Droid, and look for the &ldquo;OsmAnd&rdquo; category. The whole repo is managed by scripts, which is available on <a href="https://gitlab.com/guardianproject/wind-repo/">GitLab</a>.</p> <p>(<em>This work was supported by the prize money from the <a href="https://wirelesschallenge.mozilla.org/#winners">Mozilla WINS</a> competition as part of the <a href="https://guardianproject.info/code/wind/">Wind</a> project.</em>)</p> https://guardianproject.info/apps/info.guardianproject.orfox/ Thu, 06 Aug 2020 00:00:00 +0000 https://guardianproject.info/apps/info.guardianproject.orfox/ https://guardianproject.info/2020/06/08/easy-translation-workflows-and-the-risks-of-translating-in-the-cloud/ Mon, 08 Jun 2020 00:00:00 +0000 https://guardianproject.info/2020/06/08/easy-translation-workflows-and-the-risks-of-translating-in-the-cloud/ <p>Crowdsourced translation has opened up software and websites to whole new languages, regions, and uses. Making translating easier has brought in more contributors, and deploying those languages requires less work. A number of providers now offer &ldquo;live&rdquo;, integrated translation, speeding up the process of delivering translated websites. On the surface, this looks like a big win. Unfortunately, the way such services have been implemented opens up a big can of worms. Third parties must be trusted with user data. The translators cannot work without being tracked. Displaying the translation requires JavaScript. The security profile is more complicated and harder to defend.</p> <p>For projects with elevated security and privacy requirements, these are deal breakers. Translators can get in trouble for working on publishing software or translating censorship circumvention documentation. Minority languages are suppressed in many places around the world, even publicly working in some languages can get people into trouble.</p> <p>We have been working for many years now to help make software and website translation easier, more accessible, and more efficient. We also balance that with privacy and security concerns. This post outlines how to balance all those concerns.</p> <h2 id="live-integrated-translation-systems">Live, integrated translation systems</h2> <p>Using this new class of translation services means that the translations are not shipped with the website or app, but instead dynamically downloaded and delivered. These translation services require that third party code is integrated into the website or app to deliver the translations. All of the regular <a href="https://browserleaks.com/">privacy</a> and <a href="https://owasp.org/www-project-top-ten/">security</a> concerns of dynamic web services apply here.</p> <p>For example, Transifex Live is based around <a href="https://docs.transifex.com/live/installing-the-JavaScript-snippet">JavaScript</a>, it uses JavaScript to dynamically load the translated strings from the Transifex CDN hosted on Amazon AWS. They also provide an iFrame option, which has its own <a href="https://stackoverflow.com/a/9428051">security concerns</a>. Crowdin provides &ldquo;<a href="https://support.crowdin.com/in-context-localization/">in-context localization</a>&ldquo; which lets translators see the translations live in the website as they are working. This is a huge benefit to the translators, but it has all the same issues as Transifex Live. Their code must run in your site. They use other providers like Amazon to provide their own service. All of these third-parties have to be trusted to provide security and privacy. On top of that, Crowdin and Transifex are monolithic, proprietary offerings, it is not possible run your own instance. Like many cloud-based services, it is all-or-nothing: accept all the tracking, the privacy concerns, and security issues, or do not use such a service</p> <p>Lastly, the data from the translation contributors must be considered. These live services provide the translators a direct channel to feed data into the website. A malicious translator could feed an exploit to the website using this channel. Such a setup relies entirely on any automated checks that the translation platform provides. These checks are optional, and often disabled by default. Also, attackers regularly find ways around even the best checkers and sanitizers, like Mozilla <a href="https://github.com/mozilla/bleach">Bleach</a> or Ruby <a href="https://github.com/flavorjones/loofah">loofah</a>.</p> <p>For all these reasons, projects like <a href="https://weblate.securedrop.org/">SecureDrop</a> and <a href="https://translate.tails.boum.org/">Tails</a> self-host Weblate to provide crowdsourced translation..</p> <h2 id="static-sites-with-live-previews">Static sites with live previews</h2> <p>Static sites built with tools like Jekyll and Hugo offer big benefits in terms of privacy, security, and cost of operation. But they generally require more technical skills to operate, and have restricted possibilities in terms of dynamic interaction. There is a lot that still can be done, and things are improving fast. The dream of live localization and in-context translation workflows without privacy and security concerns is within reach.</p> <p>Live display of translations is not possible with a fully static site. Live translation requires front end JavaScript or a dynamic backend server. The vast majority of web tracking and security vulnerabilities come from JavaScript, sites that serve high risk communities should use static sites that work without JavaScript enabled.</p> <p>Translation updates can be highly <a href="https://guardianproject.info/2020/04/23/figuring-out-crowdsourced-translation-of-websites/">automated</a> with a static site. This means new translations can be reviewed and deployed within minutes.</p> <p>Jekyll and Hugo can also provide live previews while editing the source pages and translations. Unfortunately, using these features requires base level familiarity with technical things like working in the terminal. When Jekyll or Hugo is installed locally on the translators computer, <code>jekyll serve</code> and <code>hugo serve</code> generate the whole website on the fly, and the browser will automatically refresh the page with each change.</p> <h2 id="wordpress-translation-and-static-sites">Wordpress, Translation, and Static Sites</h2> <p>Wordpress remains a popular option for running websites, especially for small and non-technical organizations. It provides intuitive editing and publishing tools combined with a wide array of attractive templates to build on. It is free software that can be self-hosted, and it can even be used as a static site generator. Even with the rise of Jekyll, Hugo, and so many other static site generators, Wordpress remains a <a href="https://www.brianshim.com/webtricks/wordpress-static-site-generator/">good option</a> for small organizations with privacy and security concerns, given that it is used with the <a href="https://wordpress.org/plugins/static-html-output-plugin/">static HTML output plugin</a>. The one missing piece is crowdsourced translation that fits in with all that.</p> <p><a href="https://poedit.net/">Poedit</a> provides an alternate approach that is self-hosted and free software, but is not entirely a typical crowdsourced translation workflow. It is an editor app that runs locally on the translator&rsquo;s own machine. It supports translating Wordpress directly via its API. Then the results are included when Wordpress generates the static HTML output.</p> <p>Using self-hosted Weblate, the full website and translation workflow can be as private as needed. The static HTML output can be fed <a href="https://docs.weblate.org/en/latest/formats.html#html-files">directly to Weblate</a> or <a href="https://guardianproject.info/2020/04/23/figuring-out-crowdsourced-translation-of-websites/#translation-setup-with-po4a">use <em>po4a</em></a> to set up an automated workflow that is tailored to your needs.</p> <p>If self-hosting the translation platform is not a requirement, then Crowdin and Transifex are options for translating the static HTML that comes from Wordpress. It is important to consider that both of these will send data to many different companies, so they cannot be considered private. Using Crowdin sends data to Amazon, Google, and Sentry. Using Transifex sends data to Amazon, ChurnZero, Google, jsDelivr, New Relic, Sentry, Stripe, Adobe (Typekit), and VWO. Both can potentially also send data to Facebook, GitHub, GitLab, LinkedIn, and Twitter since those can be used for signing in.</p> <p>Two good patterns for setting up the languages are the hosting each language on a subdomain like how wikipedia does it; or, use path segments for each language. With GitHub Pages and GitLab Pages, each language can be a project, then each language will be deployed to a sub-directory, e.g.:</p> <ul> <li><a href="https://mysite.gitlab.io/en">https://mysite.gitlab.io/en</a> comes from <a href="https://gitlab.com/mysite/en">https://gitlab.com/mysite/en</a></li> <li>the main site is the language chooser, e.g. <a href="https://mysite.gitlab.io">https://mysite.gitlab.io</a> comes from <a href="https://gitlab.com/mysite/mysite.gitlab.io">https://gitlab.com/mysite/mysite.gitlab.io</a></li> </ul> <p>One idea further improve the Wordpress workflow is to combine the <a href="https://www.transifex.com/integrations/wordpress-multilingual-plugin/">Transifex Wordpress Plugin</a> with the [Wordpress Static HTML Output Plugin](<a href="https://wordpress.org/plugins/static-html-output-plugin/">https://wordpress.org/plugins/static-html-output-plugin/</a> to customize and streamline the whole process. This could work with Crowdin, Transifex, and Weblate, since they all provide APIs to integrate with.</p> https://guardianproject.info/2020/06/02/onion-browser-release-2.6-tutorial/ Tue, 02 Jun 2020 00:00:00 +0000 https://guardianproject.info/2020/06/02/onion-browser-release-2.6-tutorial/ <p>In this tutorial we&rsquo;re going to talk about the best practices to browse the web securely on iOS using <a href="https://onionbrowser.com">Onion Browser</a> Release 2.6 and the <a href="https://torproject.org">Tor network</a>. <a href="https://onionbrowser.com">Onion Browser for iOS</a> is a free, open-source web browser app developed originally by <a href="https://mike.tig.as/">Mike Tigas</a>, with Release 2.6 as a collaboration with the Guardian Project. Onion Browser has Tor built-in and uses Tor to protect your web activity.</p> <p>You can also watch the <a href="https://www.youtube.com/playlist?list=PL4-CVUWabKWeHeBpadBLjzlWVa7binXpj">Onion Browser Video Tutorial</a> on YouTube.</p> <!--  --> <p class="ctr"> <a href="image25.jpg"> <img class="size1" src="image25.jpg"> </a> </p> <h2 id="who-is-this-tutorial-designed-for">Who is this Tutorial designed for?</h2> <p>A few questions for you:</p> <ul> <li>Is your internet content being blocked?</li> <li>Are you concerned about your privacy while browsing the web?</li> <li>Do you want to protect your data from aggressive advertisers?</li> </ul> <p>If any of these are true, this tutorial is for you!</p> <h2 id="don-t-have-an-ios-device">Don&rsquo;t have an iOS device?</h2> <!--  --> <p class="ctr"> <a href="image21.png"> <img class="size1" src="image21.png"> </a> </p> <p><a href="https://guardianproject.info/apps/orbot">Try Orbot</a>, the Tor connection for Android devices developed by the Guardian Project. Orbot allows you to route the apps on your phone through Tor.</p> <!--  --> <p class="ctr"> <a href="image20.png"> <img class="size1" src="image20.png"> </a> </p> <p>You may also try the <a href="https://torproject.org">Tor Browser for Android</a>, the official Tor browser for Android developed by the Tor Project team.</p> <h2 id="first-what-exactly-is-the-tor-network">First, what exactly is the Tor network?</h2> <!--  --> <p class="ctr"> <a href="image11.png"> <img class="size1" src="image11.png"> </a> </p> <p>The Tor network is a collection of servers, run by volunteers, that allows users to improve their privacy and security on the Internet. Tor&rsquo;s users employ this network by connecting to their favorite services through a series of virtual tunnels rather than making a direct connection, thus allowing both organizations and individuals to share information over public networks without compromising their privacy.</p> <p>Here&rsquo;s how Tor works: When you connect to the internet using Tor, a circuit is created. A circuit is a group of 3 different Tor relays located in different parts of the world that work together with encryption to obfuscate your connection to websites and web services, making it hard for third parties to trace the activity back to you.</p> <!--  --> <p class="ctr"> <a href="image17.png"> <img class="size3" src="image17.png"> </a> </p> <h2 id="onion-browser-with-tor-is-an-important-application-for-ios-users">Onion Browser, with Tor, is an important application for iOS users</h2> <p>Why? Because when you use Onion Browser</p> <ul> <li>All your browsing is private, since your traffic is encrypted through the Tor network</li> <li>No one can see your activities, save your history, or influence your browsing</li> <li>And there is no trace left behind since tabs don&rsquo;t hang around. They close when you&rsquo;re done, so every search is new</li> </ul> <h2 id="how-is-the-onion-browser-different-from-other-browsers-for-ios">How is the Onion Browser different from other browsers for iOS?</h2> <p>Security and privacy require some compromises, and you should be aware that there are some limitations when using the Onion Browser:</p> <ul> <li>Apple requires all web browser apps to use the same core web rendering engine. Due to this limitation, we are unable to compile and include our own web engine, based on Firefox Gecko, as with Tor Browser for desktop and Android</li> <li>Onion Browser only tunnels traffic within the Onion Browser app. If you are using a smartphone be aware that information outside of Onion Browser is not protected</li> <li>Sometimes your bandwidth speeds will be reduced, depending on the relays you are connecting to</li> <li>Websites that flag Tor as suspicious will show a CAPTCHA loop and you won&rsquo;t be able to access them</li> <li>Certain features of many websites may be disabled or work poorly on Onion Browser, especially at the higher security levels</li> </ul> <h2 id="onboarding">Onboarding</h2> <p>After <a href="https://apps.apple.com/us/app/onion-browser/id519296448">downloading Onion Browser from the App Store</a>, we&rsquo;ll give you a smooth start to using the app. After the initial loading screen, you&rsquo;ll be invited to connect to Tor before you start browsing. Be advised: Onion Browser always needs to connect to Tor before you browse. There&rsquo;s no operational mode that doesn&rsquo;t use Tor.</p> <p><!--  --> <!--  --> <p class="ctr"> <a href="image24.png"> <img class="size2" src="image24.png"> </a> <a href="image14.png"> <img class="size2" src="image14.png"> </a><br /> </p></p> <p>There are two options here: connecting directly to Tor, as most users do, or connecting via a special &ldquo;bridge&rdquo;. This latter option requires configuration, and we&rsquo;ll discuss it in a separate section of this tutorial. Select &ldquo;Connect to Tor&rdquo; and the app will let you know when it is ready.</p> <!--  --> <p class="ctr"> <a href="image18.png"> <img class="size3" src="image18.png"> </a> </p> <p>Click on &ldquo; Next&rdquo; to set up your security level.</p> <!--  --> <p class="ctr"> <a href="image30.png"> <img class="size3" src="image30.png"> </a> </p> <p>There are three levels of security you can select, according to your needs. For many users, Level 2 is the best choice to start. Click on &ldquo;Learn More&rdquo; to see more details about each option. Tap &ldquo;Start Browsing&rdquo; to begin using Onion Browser.</p> <h2 id="the-onion-browser-home-page">The Onion Browser Home Page</h2> <p>On the home page of Onion Browser you&rsquo;ll see a couple of website suggestions, as well as more information about the app. We&rsquo;d welcome your support for our work. Use the Donate Link to see the ways you can contribute with a donation. You can also subscribe to the Tor Newsletter to get updates about security and privacy on the Internet from the Tor team.</p> <!--  --> <p class="ctr"> <a href="image22.png"> <img class="size3" src="image22.png"> </a> </p> <p>On the home page, in the top navigation bar, you&rsquo;ll see there are two icons you don&rsquo;t find in other browsers, a Shield on the top left side and an Onion on the top right side.</p> <p><!--  --> <!--  --> <p class="ctr"> <a href="image15.jpg"> <img class="size2" src="image15.jpg"> </a> <a href="image5.jpg"> <img class="size2" src="image5.jpg"> </a> </p></p> <p>We&rsquo;ll discuss these in a bit. The Onion Browser also includes features you&rsquo;ll recognize like Bookmarks, Share, New Tab, Switch Tabs, and Accessing Settings. These are common in other browsers and work in the same manner here.</p> <h2 id="visiting-websites">Visiting websites</h2> <p>When you visit websites, Onion Browser will give you additional information about the security and nature of your connection.</p> <ul> <li>HTTPS websites will show a green lock on the right side of the URL bar, tap on it to verify the Certificate Information.</li> </ul> <!--  --> <p class="ctr"> <a href="image1.png"> <img class="size3" src="image1.png"> </a> </p> <ul> <li>Tap on the Shield icon to see your current security level</li> </ul> <!--  --> <p class="ctr"> <a href="image13.png"> <img class="size3" src="image13.png"> </a> </p> <ul> <li>Tap on the Onion icon to see the Tor circuit you are using, sometimes your current circuit will be too slow or it will not work properly, for those cases use the &ldquo;New Circuit&rdquo; button and you will be automatically connected to a new one.</li> </ul> <!--  --> <p class="ctr"> <a href="image7.png"> <img class="size3" src="image7.png"> </a> </p> <p>On this drop-down menu, you will also find the option to connect to Tor using bridges. Please remember that you should always try to connect to Tor without using bridges and only use them if that fails. We&rsquo;ll talk more about bridges later.</p> <ul> <li>The Share icon allows you to send a link to the website you are looking at using other apps in your device. It also allows you to open the link using Safari if the site is not opening properly using Tor. This will be out of the Tor network and is not safe</li> </ul> <!--  --> <p class="ctr"> <a href="image19.png"> <img class="size3" src="image19.png"> </a> </p> <ul> <li>The same applies to open images and links with Safari. But you can also open links safely on a new tab, and navigate them the same way you will do it on any other browser</li> </ul> <!--  --> <p class="ctr"> <a href="image12.png"> <img class="size3" src="image12.png"> </a> </p> <ul> <li><p>If your screen times out or you send the browser to the background all your current tabs will disappear when you return to your browser, this is a security feature that can be changed in your settings</p></li> <li><p>Downloading content is easiest with the Share icon. Display your content (such as a PDF-formatted article) in a tab, then tap the Share icon. Select &lsquo;Save to Files&rsquo;, then on the next screen, choose the desired locations (&ldquo;Downloads&rdquo; folder is shown here). Tap &lsquo;Save&rsquo; and the content will be saved in the Downloads folder for later use or further sharing.</p></li> </ul> <p><!--  --> <!--  --> <p class="ctr"> <a href="image23.png"> <img class="size2" src="image23.png"> </a> <a href="image16.png"> <img class="size2" src="image16.png"> </a><br /> </p></p> <h2 id="security-connectivity">Security &amp; Connectivity</h2> <h3 id="bridges">Bridges</h3> <p>There&rsquo;s a special way to connect to the Tor network, designed for users in the most restrictive geographies or users personally at risk of invasive monitoring. Bridges are like special on-ramps for Tor that are more aggressive about defeating monitoring. That comes at a cost in performance, though. We like to reserve these pathways for most impacted users, so please use them sparingly.</p> <p>If you know bad actors are monitoring Tor usage in your geography, you&rsquo;ll want to configure a bridge immediately when you first open Onion Browser. You can do that right from the first onboarding screen, before connecting to Tor</p> <!--  --> <p class="ctr"> <a href="image6.jpg"> <img class="size3" src="image6.jpg"> </a> </p> <p>Whether you configure your bridge immediately or after you&rsquo;ve been using Onion Browser for a while, you need to be careful how you get your bridge information. You have several options. See the Bridge Configuration settings (accessed during on-boarding as above or by tapping on the Onion icon when viewing a website and then tapping &lsquo;Bridge Configuration&rsquo;).</p> <!--  --> <p class="ctr"> <a href="image2.jpg"> <img class="size3" src="image2.jpg"> </a> </p> <p>Your first option should be the list of bridges using the so-called Obfs4 technology, a list already built into Onion Browser. Select the &ldquo;Built-in Obfs4&rdquo; option and Onion Browser will instruct Tor to use that selection of bridges as it attempts to connect. Tap &ldquo;connect&rdquo;.</p> <p>Unfortunately the bridges on that list can become crowded and connection may fail here, too. If you know a trustworthy person who uses a bridge to connect to Tor, your second option is to have your friend help you by sending you a bridge QRCode your device can scan and automatically configure to use that bridge. Or, less securely, you can copy/paste a bridge identifier that your friend sends you via another service (messaging, for example). To use this option, tap &ldquo;Custom Bridges&rdquo;, and then either scan the provided QRCode or paste your provided bridge into the text area shown, then tap &ldquo;Connect&rdquo;.</p> <p><!--  --> <!--  --> <p class="ctr"> <a href="image4.jpg"> <img class="size2" src="image4.jpg"> </a> <a href="image8.jpg"> <img class="size2" src="image8.jpg"> </a><br /> </p></p> <p>If these options fail, you can get access to a fresh selection of Obfs4 bridges using the service called MOAT to get up-to-date information in real-time. This option works in a way that does not expose itself to suspicion. To use this option, select &ldquo;Built-in Meek/Azure&rdquo; and tap &ldquo;connect&rdquo;.</p> <p>Last, the Tor Project itself also maintains a list of bridges. For this option, tap &lsquo;Custom Bridges&rsquo;, then &lsquo;Request Bridges from torproject.org&rsquo; and follow the instructions there. You&rsquo;ll get a bridge identifier, and you&rsquo;ll paste it into the text area, same as you would if a friend provided it to you. After pasting, tap &ldquo;connect&rdquo;. Note that this method of contacting the Tor Project to get a bridge identifier is an action that itself might be blocked.</p> <p>Again, we want to steer you away from using bridges. The degradation of the user experience can be extreme and please remember that there are people who actually require this capability to get any connection at all. As capacity is limited, we want to give those people the first opportunity.</p> <h3 id="biometric-authentication">BioMetric Authentication</h3> <p>You can place a second level of access security on Onion Browser by using its authentication option. You might prefer this option if you believe you face a physical security threat, if there is a chance your device might get stolen or if your device might be otherwise misused by people you don&rsquo;t trust.</p> <p>First, you need to set up your iOS device to require security at login via a 6-digit numeric Passcode, FaceID or TouchID. Use the iOS Settings app. Select and configure the method you prefer. If you&rsquo;ve already done that, there&rsquo;s no need to change. Be aware that all manipulations of our authentication settings here will require you to enter your password.</p> <!--  --> <p class="ctr"> <a href="image10.png"> <img class="size3" src="image10.png"> </a> </p> <p>Now tap the Onion Browser settings icon to get to the Settings page. You&rsquo;ll see a selection option for <strong>&ldquo;Lock App with TouchID/FaceID or Device Passcode&rdquo;</strong>. Select that option to enable it and restart Onion Browser. On your next use, Onion Browser will require your ID (in whatever form you&rsquo;ve requested) before it will start up.</p> <h2 id="useful-tips">Useful Tips</h2> <h3 id="dark-mode">Dark Mode</h3> <p>The Onion Browser has a built-in Dark Mode that allows it to comply with the system setting for the &ldquo;dark&rdquo; color scheme. To set Dark Mode, visit the iOS Settings application and tap Display &amp; Brightness. Select your appearance here and Onion Browser will comply with this setting.</p> <!--  --> <p class="ctr"> <a href="image3.png"> <img class="size3" src="image3.png"> </a> </p> <h3 id="tab-security-hide-web-pages-when-switching-apps">Tab Security - Hide Web Pages When Switching Apps</h3> <p>Hiding web pages when switching apps is a feature required by people who are in danger of having their device removed from their person by other bad actors. If that happens, the contents of their open tabs can be seen and perhaps screen-shotted by those bad actors and used in prosecution. While hiding web pages sounds great at first, it means you lose your browsing &ldquo;state&rdquo; when switching back to Onion Browser later. Frankly, it is terribly inconvenient for most users. So, there are lesser options, too. From the Onion Browser Settings page, tap &ldquo;Tab Security&rdquo;</p> <!--  --> <p class="ctr"> <a href="image29.jpg"> <img class="size3" src="image29.jpg"> </a> </p> <p>Then select from:</p> <h4 id="forget-in-background">Forget in Background</h4> <p>Happens when you tap the HOME button, otherwise switch apps, or the display times-out and the login screen is presented.</p> <h4 id="forget-at-shutdown">Forget at Shutdown</h4> <p>Happens only when user actually closes the app or shuts down the device</p> <h4 id="remember-tabs">Remember Tabs</h4> <p>Tabs are NOT hidden; this setting is also called &ldquo;Startup in last state&rdquo; and it&rsquo;s the opposite of &ldquo;remove web pages when switching apps&rdquo; because it means your browsing state is saved between sessions. For many, this is a tremendous time-saver, but users concerned about their device being taken from them should not enable this feature.</p> <p><em>NOTE: Your bookmarks are also an indication of your browsing interests. Creating many bookmarks on the device leaves a certain &ldquo;fingerprint&rdquo; about your browsing intentions in the same way open tabs indicate what&rsquo;s actually being used. See the</em> Nextcloud Bookmarks <em>feature as a way to resolve this problem.</em></p> <h3 id="onion-browser-as-your-default-system-browser">Onion Browser As Your Default System Browser</h3> <p>There are a lot of ways you can acquire a link to web content and resources. Many applications, when seeing a link, will offer the option to open that link in the web browser. On iOS, Safari is the system browser, registered to open links, and iOS doesn&rsquo;t usually allow other browsers to have that privilege. Safari doesn&rsquo;t use Tor, so it&rsquo;s not safe to open links that way. We can&rsquo;t make Onion Browser the &ldquo;system browser&rdquo;, but there is a way to disable Safari and allow Onion Browser to open your links. Follow these steps:</p> <p>Open the iOS Settings app. Tap &ldquo;Screen Time&rdquo; (if it&rsquo;s your first time using this feature, several help screens will follow).</p> <!--  --> <p class="ctr"> <a href="image28.png"> <img class="size3" src="image28.png"> </a> </p> <p>Tap &ldquo;Content &amp; Privacy Restrictions&rdquo; to enable it. Tap &ldquo;Allowed Apps&rdquo;. Tap &ldquo;Safari&rdquo; to disable it. This way, Safari won&rsquo;t be opened when links are clicked in any app starting with http:// or https://. OnionBrowser can now open the links safely.</p> <h3 id="nextcloud-bookmarks">NextCloud Bookmarks</h3> <p>Bookmarks make it easy to access frequently-desired content as well as to preserve access to infrequently-visited, but necessary, sites. However, bookmarks can also represent intent or interest and, for those in danger of losing their device to bad actors, this can be an issue.</p> <p>If you use NextCloud, you can manage your Onion Browser bookmarks on your other devices and synchronize them with Onion Browser. Here&rsquo;s how:</p> <p><!--  --> <!--  --> <p class="ctr"> <a href="image26.png"> <img class="size2" src="image26.png"> </a> <a href="image9.png"> <img class="size2" src="image9.png"> </a><br /> </p></p> <p>Tap the Bookmarks icon, then tap &lsquo;Sync with Nextcloud&rsquo;.Enter the link for your Nextcloud server along with your username and password, then tap &lsquo;Sync Bookmarks&rsquo;.</p> <p>If you&rsquo;re not a Nextcloud user and this sounds interesting, find more about NextCloud at nextcloud.com.</p> <h2 id="some-failure-modes-and-how-to-recover">Some Failure Modes and How to Recover</h2> <p>Let&rsquo;s talk about ways in which Onion Browser - and the mountain of software and Internet network architecture behind it - can let you down. Yes, it DOES happen. Sometimes your network just doesn&rsquo;t have the performance and responsiveness it requires. Sometimes your network is under heavy surveillance. Sometimes the Tor network is under direct attack by bad actors. Let&rsquo;s look at a few of the failures you might experience and see what you can do to mitigate at least some of the impacts. We regret that this list is not complete.</p> <h3 id="on-start-up">On Start-up</h3> <p>What if I have no network connection of any kind and I don&rsquo;t realize it? What if my network connection is very slow? What if Tor is blocked in my country?</p> <p>First, if you know - via friends or trusted information sources - that Tor is blocked in your country, you&rsquo;ll need configure access via a bridge on your very first startup. Please revisit the prior discussion on how to properly configure Tor bridge access. Please remember, bridges tend to degrade the user experience in a number of ways. They&rsquo;re a &ldquo;last resort&rdquo;.</p> <p>If you&rsquo;re not connected to a local or wide-area network (and don&rsquo;t realize it) or if your connection is very poor (low-bandwidth), or if Tor is blocked in your country, Onion Browser won&rsquo;t be able to start. Unfortunately, there&rsquo;s no safe way to automatically distinguish between these different conditions. First, try to verify that the device itself has a connection or move to another location &amp; network. Please remember, Tor can be slow to start up - especially on your first use - even under the best circumstances because it has to discover its network of nodes (at least partly) before it can build circuits. This does take a little patience.</p> <h3 id="on-restart">On Restart</h3> <p>What if Tor fails to start or restart properly within Onion Browser (can this happen, for example, when switching tabs)?</p> <p>If Tor fails on start/restart, Onion Browser assumes that it&rsquo;s because the Tor nodes available from your location are blocked. Onion Browser will urge you to configure bridges. You won&rsquo;t be able to proceed, though. You actually need to stop Onion Browser (switch to another app, or kill the app by swiping it out of iOS&rsquo; app-cards overview) and then start it again.</p> <p>If you experience a lot of this type of failure, you may want to consider the Onion Browser setting that allows you to &ldquo;Remember Tabs&rdquo; (also called &ldquo;start up in last state&rdquo;). That&rsquo;s available using &ldquo;Settings -&gt; Tab Security -&gt; Remember Tabs&rdquo;.</p> <h3 id="after-a-heavy-use-session">After A Heavy-Use Session</h3> <p>There&rsquo;s a lot going on within Onion Browser and sometimes after a lot of use (or maybe due to a lot of tabs open for a long time) Onion Browser will run out of working memory on the device. In this case, iOS will probably kill the app by itself (though you may have to swipe it away from the app-cards overview under certain circumstances). When you start it again, it will be a fresh start.</p> <p>This is another good time to remember, if your situation allows it, use the &ldquo;Remember Tabs&rdquo; feature.</p> <h3 id="failures-under-regular-use">Failures Under Regular Use</h3> <p>You may experience using Onion Browser in a normal way, seemingly fine, and then when tapping a link or visiting a new site nothing seems to happen. It&rsquo;s hard to know if the link or site is the problem, or if Onion Browser or Tor is the problem.</p> <p>You can check if Tor is still running by creating a new tab and visiting, for example, DuckDuckGo.com. If Tor really has failed, you should leave the app and enter back after a few seconds (that is, switch to another app, then return). That action should restart Tor. If that fails to help, go to iOS&rsquo; app-cards overview, swipe-away Onion Browser and start it again.</p> <p>If the new tab opening to DuckDuckGo.com does work, then Tor is still operating and that&rsquo;s a good indicator that the link or website you visited contains some JavaScript Onion Browser thinks is unsafe.</p> <p>Onion Browser has a pop-up and ad blocker integrated. These, unfortunately, might interfere with the web page in a way that makes it break. These features cannot be switched off, currently.</p> <p>Lastly, failure can happen when the Security Level currently set for the page is denying the website from taking certain actions. Loading media is one such action, though not every time. If you&rsquo;re sure leaking your browsing information to somebody listening on your connection isn&rsquo;t a problem, you might want to lower the security level to &ldquo;Bronze&rdquo;, at least for that site.</p> <h3 id="what-are-these-circuits-you-talk-about">What Are These &ldquo;Circuits&rdquo; You Talk About?</h3> <p>The circuit is the path your communications take through the Tor network (whose nodes exist in many countries in the world). Normally, you don&rsquo;t need to take specific care regarding the circuit, because that&rsquo;s Tor&rsquo;s business. However, depending on the &ldquo;exit node&rdquo; Tor has chosen, you might see a website localized wrongly or a website that mistakes you for a hostile due to your country-of-origin (which Tor has set). In those cases you can request a new circuit. It&rsquo;s easy, right there on the circuit display.</p> <!--  --> <p class="ctr"> <a href="image7.jpg"> <img class="size3" src="image7.jpg"> </a> </p> <p>The circuit display could also hint to the reason of a slow connection. If you&rsquo;re routed around the world, that might be the problem. However, Tor typically tries to avoid these situations automatically and chooses circuits with hops near you.</p> <h3 id="custom-site-settings">Custom Site Settings</h3> <p>Now that we&rsquo;ve introduced &ldquo;Security Levels&rdquo; in the new Onion Browser, there&rsquo;s much less need to store custom settings for individual websites. That&rsquo;s a good thing because these settings are hard to remember once customized. For example, did you remove all restrictions from a website because you were once on a less restricted network? Well, when you&rsquo;re back on your surveilled network, it&rsquo;s hard to remember that you customized just that one site. That can lead to an unplanned exposure.</p> <p>We hope you like the new &ldquo;Security Levels&rdquo; mechanism - it&rsquo;s much easier to monitor how much risk you&rsquo;re exposed to using this mechanism. Enjoy it!</p> <h2 id="support">Support</h2> <p>Work on Onion Browser during 2019 and through mid-2020 was funded by the <a href="https://www.opentech.fund/">Open Technology Fund</a> and sponsored by the <a href="https://guardianproject.info/">Guardian Project</a>. <a href="https://github.com/mtigas">Mike Tigas</a> was development architect, <a href="https://github.com/tladesignz">Benjamin Erhart</a> was lead developer. <a href="https://okthanks.com/">OkThanks</a> provided user-centered design services.</p> <p>To contribute to the long-term maintenance of Onion Browser, please visit the <a href="https://onionbrowser.com/donate">donation page</a>.</p> https://guardianproject.info/2020/05/20/on-the-classification-of-tracking/ Wed, 20 May 2020 00:00:00 +0000 https://guardianproject.info/2020/05/20/on-the-classification-of-tracking/ <p>This position paper tries to outline a framework for defining trackers in smart phones and lists mechanisms for identifying them. It hopes to serve as the foundation for the work done in the Tracking-the-Trackers project.</p> <p>In <a href="#section-1-levels-of-unwanted-behaviour">section 1</a> we start with an abstract analysis of levels of unwanted behaviour in the context of tracking.</p> <p>Next, in <a href="#section-2-an-attacker-s-perspective-and-a-taxonomy">section 2</a>, we focus on an attacker’s perspective, on anonymity and pseudonymity. This foundation allows us to define terms which are needed throughout the paper.</p> <p>Finally, we list proposed mechanisms for identifying trackers - based on the threat model (attacker) as well as the level of acceptable tracking.</p> <h2 id="scope">Scope</h2> <p>This document talks about trackers in general on mobile devices (smartphones). However, for the purpose of verification, we exclusively focus on Android apps. First of all, Android has a <a href="https://www.idc.com/promo/smartphone-market-share/os">85% global market share</a>, secondly Android apps (APKs) are easier to work on. With iOS apps, monitoring trackers (or instrumenting running code) is not as easy as on Android based systems. Therefore, whenever any claims are made, we refer to the Android ecosystem. We however believe that very similar behaviours exist on iOS based systems.</p> <p>Also, this document does not talk about contact tracing (as in Covid-19 contact tracing).</p> <h2 id="section-1-levels-of-unwanted-behaviour">Section 1: Levels of unwanted behaviour</h2> <p>The following section tries to categorize tracking respectively potential unwanted behaviour in apps by level of severity. This is done with a perspective for categories (labels) in a machine learning approach.</p> <h3 id="level-0-no-tracking-at-all-no-network-communication">Level 0: No tracking at all / no network communication</h3> <p>The most harmless situation: an app is downloaded or shared in an anonymous way (Tor, etc.) and only uses offline features and/or uses unlinkable side channels for updates (for example flash cards). An example could be a map application which only displays a map and reads a phone’s GPS position to display the user’s location. There is no network communication at all and it still offers a useful service to its users. Map updates may be installed via flash cards or other physical transportation media. The app does not need to request a new map interactively from any server.</p> <h3 id="level-1-inadvertent-tracking">Level 1: Inadvertent tracking</h3> <p>This category includes tracking but the service provider and the app never intended to actually use the resulting data / meta-data for the purpose of tracking individuals.</p> <p><strong>Example</strong>: to illustrate this category, recall our map app from above. Only this time, it does request map (base layer) updates from a map server every 7 days. It also checks every day, if the map viewer app is the latest version. Based on this information, an attack could theoretically derive weekly IP address &ldquo;beacons&rdquo; from some user. Since the update check was not personalized, an attack can not be for sure, if an update request is from the same person or not. Hence, a user still has potentially enough anonymity.</p> <p>This and the next category probably (to be verified) constitute the majority of &ldquo;clean&rdquo; apps.</p> <h3 id="level-2-unintentional-tracking-by-use-of-chatty-libraries">Level 2: Unintentional tracking by use of chatty libraries</h3> <p>This category tracks users already quite heavily. The motive is not to increase ad revenue, build up user profiles to sell them nor to pass on the data to an aggregator. The unintentional tracking stems more from the fact that the app developer(s) used libraries which help them in developing the app and/or which are simply useful for the overall user experience.</p> <p><strong>Example</strong>: if we revisit our map example, we could imagine that the map app now also includes a search functionality. Users can type in the initial letters of a street name and for every letter they type, an AJAX HTTP request is sent to the map server. In addition, the developers felt that it would be useful to receive APM (application performance monitoring) logs as well as crash reports as well as a set of libraries to measure which features of an app the users actually use the most. These logs are sent periodically to some log collection server run by the developers.</p> <p>Note that we still do not talk about (Google, Facebook etc) cookies here. We only talk about watching what users are typing (including backspace and corrections - an attacker can literally watch their thoughts via the global click-stream).</p> <h3 id="level-3-ad-revenue-focused-tracking-of-users-and-or-user-behaviour-pseudonymized">Level 3: Ad-revenue focused tracking of users and/or user behaviour (pseudonymized)</h3> <p>With this category, we are entering the area often described as surveillance capitalism: users are receiving cookies (if it&rsquo;s a web based app) and or have unique IDs embedded in the app and these unique identifies (which are not tied to a person in the first place and hence are a &lsquo;nym of the user) are being sent for nearly every network interaction. These IDs may (but not necessarily have to ) serve as authentication / authorization token ( see OAUTH 1,2, OpenID Connect) or may be purely auto-generated and simply serve for tracking actions users takes over the course of his day (so that the interest of a user may be extracted). These tracking IDs may then be forwarded and sold to aggregators.</p> <p>While this may be acceptable to some users, since the techniques use pseudonymization, there is an implicit trap hidden in this approach: unique IDs are usually long enough so that they are unique globally (for example UUID strings). Thus, they can easily be correlated with real PII data and the pseudonymization vanishes instantly.</p> <h3 id="level-4-ad-revenue-focused-tracking-of-users-and-or-user-behaviour-linked-to-person">Level 4: Ad-revenue focused tracking of users and/or user behaviour (linked to person)</h3> <p>This category fits most non-open source commercial apps such as FB messenger, twitter, etc. (but it can occur as well in open source apps). The business model is to fully understand a user, his/her interests, his/her behaviour, location (-&gt; location tracking), and very important - his/her circle of friends (contacts), etc. The &ldquo;gold&rdquo; in the app gold rush is a users&rsquo; interest and intent. In order to serve him/her adds better and faster (in the sub-millisecond range). Again, as in the previous category, these tracking IDs may then be forwarded and sold to aggregators.</p> <p>We assume the vast majority of apps fall into this category.</p> <h3 id="level-5-full-scale-stealthy-tracking-surveilling-the-spouse-kids-state-actors-apt-attacks-general-surveillance-etc">Level 5: Full scale stealthy tracking (surveilling the spouse, kids, state actors, APT attacks, general surveillance, etc.)</h3> <p>This category would fit any technique which tries to secretly monitor as many actions on the whole smartphone (or potentially also via the smart phone on computers) of a person.</p> <p><strong>Example</strong>: kids tracking apps. Or hidden apps which check what your husband/wife is doing on his/her phone (and forwarding call logs , messages, etc.). State actors tracking dissidents, journalists or any chosen target also would use these techniques.</p> <p>Often these apps can be identified by their extended permissions but not necessarily so. Well written apps in this category may be impossible to detect without major reverse engineering efforts.</p> <h2 id="conclusions">Conclusions</h2> <p>Our work in the Tracking the Trackers project limits itself to Levels 3 and 4. We intentionally omit level 5, since this is a cat-and-mouse game with the attackers. It is rather trivial to change some behaviour for an attacker while our detection mechanism remains open source.</p> <h1 id="section-2-an-attacker-s-perspective-and-a-taxonomy">Section 2: an attacker’s perspective and a taxonomy</h1> <blockquote> <p>&ldquo;There is nothing as practical as a good theory&rdquo; &ndash; Kurt Lewin</p> </blockquote> <p>This section builds upon the work of <a href="http://dud.inf.tu-dresden.de/literatur/Anon_Terminology_v0.31.pdf">Pfitzmann and Hansen</a><sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup> who did (to the author&rsquo;s knowledge) the first thorough comparison of terminology in literature with respect to the concepts of anonymity, linkability, pseudonymity, etc. We believe that their work is a good framework for thought. It also hints at some connections to Shannon&rsquo;s information theory and probability. However, the paper does not follow through on the maths.</p> <p>The core insight of their work is that - if you include metadata of communication flows over the internet, and if you assume an attacker which can observe the whole network (passively)<sup class="footnote-ref" id="fnref:2"><a href="#fn:2">2</a></sup>, then true anonymity is nearly impossible to achieve for any regular app or program.</p> <p>In this paper, we first briefly describe Pfitzmann&rsquo;s and Hansens&rsquo; model and especially their attacker&rsquo;s model / threat model. We then replicate their definitions and add some definitions of our own. The next step is to link their definitions to our categories of tracking.</p> <p>Equipped with these theoretical tools, we can proceed to define what we consider tracking in Android apps and derive feature sets for an ML based approach.</p> <h2 id="the-pfitzmann-hansen-threat-model">The Pfitzmann-Hansen threat model</h2> <p>The threat model assumes a classical sender-receiver (source/sink) information model where the communication network is usually the internet. They assume an attacker to be yet another (possibly all-knowing) passive receiver. If messages pass the communication network, attributes (i.e. meta-data<sup class="footnote-ref" id="fnref:3"><a href="#fn:3">3</a></sup> such as time + time zone when a message was sent, received, the packet size, the protocols used etc) may be derived by a receiver. These attributes may become another new message.</p> <p><img src="sender-receiver-model.png" alt="sender-receiver-model" /></p> <p>If we apply Pfitzmann&rsquo;s and Hansens&rsquo; model to our levels, we arrive at the following insights:</p> <ul> <li><strong>Level 0</strong>: the app is quiet → no harm, an all-knowing attacker can see the download of a level 0 app in the very best of cases.</li> <li><strong>Level 1</strong>: the passive attack may derive IP addresses (and hence some ideas of a user’s location) and time stamps of when the app was in use. → the passive attacker can already track the user to some extent iff (if and only if) he also has access to the telecom’s IP address assignment database for that particular time window. This is usually only possible for nation state attackers. <strong>→</strong> out of scope.</li> <li><strong>Level 2</strong>: In this scenario, it already depends a lot if the app is sending APMs, crash reports, or other “chatty library” messages. If unencrypted, a passive attacker may - already in this category gain a lot of information on the user. <strong>→</strong> we propose to include detection of APMs/crash reporting libraries in future versions of the tracking the trackers project.</li> <li><strong>Level 3</strong>: While it is nice to notice that the developers tried to pseudonymise tracking in this category, it does not help the user very much. As long as a passive attacker may detect the pseudonymized IDs in messages flowing to a central server, he wins. He can track the user. Countermeasure: a guaranteed rotation of these unique IDs/tokens every x seconds (at fixed intervals). → we propose to look at this level of tracking in our research in order to identify unique tokens/API keys, unique IDs in apps which are easily detectable in order to guide the F-Droid store developer on how to avoid common pitfalls associated with fixed IDs/API keys etc.</li> <li><strong>Level 4</strong>: for an attacker, this is the gold mine. Here, nearly every action may be passively observed. This is the case, we assume to be the most prevalent one in most apps (proof: just take a random app and look at the tcpdump stream of data it sends every second). We will aim to detect the most common tracking libraries.</li> <li><strong>Level 5</strong>: here the attacker basically gains an upgrade from a passive attacker to an active attacker should he wish so. Game over for the user → out of scope for our research.</li> </ul> <h1 id="summary">Summary</h1> <p>We identified a rough categorization of 5 levels of tracking. We reasoned what information an attacker may gain at each level and we defined the scope of our research.</p> <hr /> <p>(<em>This work was supported by NLnet&rsquo;s <a href="https://nlnet.nl/thema/NGIZeroPET.html">NGI Zero PET</a> fund.</em>)</p> <div class="footnotes"> <hr /> <ol> <li id="fn:1">&ldquo;Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management – A Consolidated Proposal for Terminology&rdquo;, 2008, Andreas Pfitzmann (TU Dresden), Marit Hansen (ULD Kiel). <a href="http://dud.inf.tu-dresden.de/literatur/Anon_Terminology_v0.31.pdf">http://dud.inf.tu-dresden.de/literatur/Anon_Terminology_v0.31.pdf</a> <a class="footnote-return" href="#fnref:1"><sup>[return]</sup></a></li> <li id="fn:2">An assumption which is not far fetched - see the Snowden papers. <a class="footnote-return" href="#fnref:2"><sup>[return]</sup></a></li> <li id="fn:3">Compare with the quote &ldquo;we kill people based on metadata&rdquo; by the former CIA/NSA director Hayden. <a href="https://abcnews.go.com/blogs/headlines/2014/05/ex-nsa-chief-we-kill-people-based-on-metadata">https://abcnews.go.com/blogs/headlines/2014/05/ex-nsa-chief-we-kill-people-based-on-metadata</a> <a class="footnote-return" href="#fnref:3"><sup>[return]</sup></a></li> </ol> </div> https://guardianproject.info/2020/05/06/free-software-tooling-for-android-feature-extraction/ Wed, 06 May 2020 00:00:00 +0000 https://guardianproject.info/2020/05/06/free-software-tooling-for-android-feature-extraction/ <p>As part of the Tracking the Trackers project, we are inspecting thousands of Android apps to see what kinds of tracking we can find. We are looking at both the binary APK files as well as the source code. Source code is of course easy to inspect, since it is already a form that is meant to be read and reviewed by people. Android APK binaries are a very different story. They are first and foremost a machine-executable format. On top of that, many developers deliberately obfuscate as much as possible in the APK to resist inspection.</p> <p>That means inspection requires using tools to look into the binary APK format. There is actually a massive amount of work that goes into inspecting APKs because this is required in order to do useful malware analysis. For the most part, these inspection techniques are the malware companies&rsquo; &ldquo;special sauce&rdquo;, so they are proprietary and generally kept secret. On top of that, malware companies keep secret a lot of the conclusions they about what is useful data to collect, and what should be ignored.</p> <p>One key piece of the Tracking the Trackers project is to make all of research, tooling, and conclusions free, open, and publicly available. First and foremost, that means the tools must be free software. They should also be easily installable so the barrier to entry for new inspectors is as low as possible. We focus on getting software as part of Debian, since once there, so many people have access to those packages since Ubuntu, Kali, and so many other GNU/Linux distros are based on Debian.</p> <h2 id="what-is-available-in-debian-already">What is available in Debian already</h2> <p><a href="https://guardianproject.info/2015/04/30/getting-android-tools-into-debian/">Our work</a> with the <a href="https://wiki.debian.org/AndroidTools">Debian Android Tools Team</a> and <a href="https://java.debian.net/">Debian Java Team</a> over the years means many key tools are already included in Debian and its derivatives, including:</p> <ul> <li>key Android SDK components like <em>apksigner</em>, <em>dx</em> and <em>android.jar</em></li> <li><em>apktool</em></li> <li><em>dexdump/dexlist</em></li> <li><em>enjarify</em></li> <li><em>LibScout</em></li> <li><em>libsmali</em></li> <li><em>procyon</em></li> </ul> <h2 id="tools-we-are-using">Tools we are using</h2> <p>One key aspect of our research is that working with terabytes of APKs, this is necessary to be able to spot and map out as many trackers as possible. Since feature extraction can be a slow and resource intensive process, we needed to use some tools that emphasize speed over flexibility. Even with fast extraction tools, we still have to build up tailored processes to speed things up. Some of these straightforward feature extraction processes would take months to run on ~3TB of APKs on a 32-thread machine with 144GB of RAM.</p> <ul> <li><a href="https://github.com/reddr/LibScout">LibScout</a> - detect SDKs/libraries with their version in binary APKs</li> <li><a href="https://github.com/avast/apkparser">https://github.com/avast/apkparser</a> - faster manifest/resources parser</li> <li><a href="https://github.com/avast/apkverifier">https://github.com/avast/apkverifier</a> - faster APK signature verifier</li> <li><a href="https://github.com/jedisct1/ipgrep">https://github.com/jedisct1/ipgrep</a> - ipgrep extracts possibly obfuscated host names and IP addresses from text, resolves host names, and prints them, sorted by ASN.</li> <li><a href="https://github.com/stricaud/faup">https://github.com/stricaud/faup</a> - Fast URL decoder library</li> <li><a href="https://github.com/cryptax/droidlysis">https://github.com/cryptax/droidlysis</a> - Quickly analyze APKs for the most essential features: permissions, <code>Activity</code> and <code>BroadcastReceiver</code> names, and key method calls.</li> </ul> <p><em>apkverifier</em>, <em>apkparser</em>, and <em>droidlysis</em> are generally useful, but not yet in Debian. So we packaged them to make them easily available. They are currently in the <a href="https://ftp-master.debian.org/new.html">Debian NEW</a> queue, awaiting final review before inclusion.</p> <p>These tools have been assembled into scripts to run the actual feature extract processes, they are maintained in the <a href="https://gitlab.com/trackingthetrackers/extracted-features">https://gitlab.com/trackingthetrackers/extracted-features</a> repo. When the actual data generated is small enough and there are not copyright conflicts, the data is also included there. Mostly, the data sets are too large and sometimes touch on copyright restrictions, so they are unfortunately not publicly available.</p> <p>There are lots of other tasks, including managing large APK collections, gathering data to generate statistics about the features, and downloading publicly available tracker SDK. Those scripts are maintained in <a href="https://gitlab.com/trackingthetrackers/scripts">https://gitlab.com/trackingthetrackers/scripts</a>.</p> <h3 id="gradle-plugins">Gradle Plugins</h3> <p>When working with source code, then it is possible to do other kinds of analysis. Most Android apps are built with the Gradle tool. So we reviewed a wide range of Gradle plugins, and found these three useful in our investigations.</p> <ul> <li><a href="https://github.com/autonomousapps/dependency-analysis-android-gradle-plugin">dependency-analysis-android-gradle-plugin</a> - Produce a report of unused direct dependencies and used transitive dependencies.</li> <li><a href="https://github.com/jeremylong/DependencyCheck">OWASP Dependency-Check</a> - utility that detects publicly disclosed vulnerabilities in application dependencies</li> <li><a href="https://github.com/vanniktech/gradle-dependency-graph-generator-plugin/">gradle-dependency-graph-generator-plugin</a> - Gradle plugin that lets you visualize your Java library dependencies in a graph.</li> </ul> <h2 id="tools-we-reviewed">Tools we reviewed</h2> <p>We looked at quite a few existing tools, and found many interesting and useful ones. While they all produced useful output, many of these were not useful to this project because they were tailored around the use case of a person inspecting a small set of apps, so for example, they were too slow or did not produce machine readable output suitable for working with large APK collections.</p> <ul> <li><a href="https://github.com/U039b/android_permissions_harvester">android_permissions_harvester</a> - for finding which permissions are used based on method calls</li> <li><a href="https://github.com/cryptax/droidlysis">droidlysis</a> - cryptax&rsquo;s (aXelle&rsquo;s) tool: &ldquo;DroidLysis is a property extractor for Android apps&rdquo;. See also her <a href="https://cfp.hack.lu/hacklu19/talk/ZZKNSM/">talk at hacklu 2019</a></li> <li><a href="https://github.com/rednaga/APKiD">APKiD</a> - &ldquo;In addition to detecting packers, obfuscators, and other weird stuff, it can also identify if an app was compiled by the standard Android compilers or dexlib&rdquo;<a href="https://rednaga.io/2016/07/31/detecting_pirated_and_malicious_android_apps_with_apkid/">[1]</a></li> <li><a href="https://github.com/facebook/redex">redex</a> - &ldquo;taking advantage of Redex allows us to normalise the applications prior to analysis&rdquo;<a href="https://blog.quarkslab.com/android-application-diffing-analysis-of-modded-version.html">[1]</a></li> <li><a href="https://github.com/kaitai-io/kaitai_struct_formats/blob/master/executable/dex.ksy">kaitai_struct_formats</a> - generic binary struct parser tool, useful for directly parsing Android <em>classes.dex</em> files.</li> <li><a href="https://github.com/armijnhemel/binaryanalysis-ng">binaryanalysis-ng</a> - a framework for unpacking files recursively and running checks on the unpacked files. Great for someone who needs to inspect small sets of a wide variety of file types.</li> <li><a href="https://github.com/plum-umd/redexer">redexer</a> - infer with which parameters the app uses certain permissions (we name this feature RefineDroid)</li> <li><a href="https://github.com/ytliu/apk-static-xref">apk-static-xref</a> - staticallly generate a cross-reference-graph (XRG) of a component (e.g., Service) of Android APK file</li> <li><a href="https://github.com/dorneanu/smalisca">smalisca</a> - Static Code analysis tool that generates call graphs</li> </ul> <p>(<em>This work was supported by NLnet&rsquo;s <a href="https://nlnet.nl/thema/NGIZeroPET.html">NGI Zero PET</a> fund.</em>)</p> https://guardianproject.info/2020/04/28/features-for-finding-trackers/ Tue, 28 Apr 2020 00:00:00 +0000 https://guardianproject.info/2020/04/28/features-for-finding-trackers/ <p>One key component of the Tracking the Trackers project is building a machine learning (ML) tool to aide humans to find tracking in Android apps. One of the most important pieces of developing a machine learning tool is figuring out which &ldquo;features&rdquo; should be fed to the machine learning algorithms. In this context, features are constrained data sets derived from the whole data set. In our case, the whole data set is terabytes of APKs. This post is an outline of the features that we are focusing on in this current project.</p> <h1 id="confirmed-features">Confirmed Features</h1> <p>These are features that we will definitely used, and already have good tooling to do the <a href="https://en.wikipedia.org/wiki/Feature_extraction">feature extraction</a>.</p> <h2 id="permissions">Permissions</h2> <p>Android apps must request <a href="https://developer.android.com/guide/topics/permissions/overview">permissions</a> from the Android OS to access sensitive user data as well as certain system features. This can naturally give big hints towards tracking attempts. Basically an app which does not request any permissions will have a much harder time of tracking its users, while an app aimed towards tracking will require a myriad of permissions depending on the properties it desires to track (e.g. location, contacts, phone IDs, Bluetooth IDs, WiFi IDs, camera/microphone-access, call-logs and many more)</p> <h2 id="tracking-libraries-and-sdks">Tracking Libraries and SDKs</h2> <p>Code re-use plays a big role in any software project, why write your own tracking functionality when someone else has already implemented a whole library geared towards tracking users. This functionality is provided by different SDKs, which are pre-configured bundles of functionality which in turn (for this use case) are provided by tracking companies. The app developer often has to choose the desired functionality. While importing a tracking library is no guarantee for tracking activities it is certainly a red flag. We compare the libraries imported by the app with a list of known tracking libraries.</p> <h2 id="domain-names">Domain Names</h2> <p>Developers leave URLs in form of strings in the code to allow exchange of information with the world outside of the app. This can be used to transfer information about the user which in turn can be used for tracking. The domains often contain a hint about the purpose behind the data transfer (e.g. <code>https://www.google-analytics.com</code>). Domain names are data sinks for collecting data, which gives us a clear point to focus on analyzing since collecting tracking data does not matter if it never leaves the local device, while domain names are the point in the code where data leaves the device and is sent to be collected and analyzed on a remote server. Combined with other features like permissions and seeing tracking libraries being imported a human reviewer could get a pretty good idea of what type of information could be sent. This human &ldquo;gut feeling&rdquo; of recognizing fishy combinations of features is something a neural network can often learn to approximate by being trained on a sufficient amount of training data. Domain names known to be relevant to tracking are collected and maintaned by <a href="https://exodus-privacy.eu.org/en/">Exodus Privacy</a>.</p> <h1 id="new-experimental-features">New Experimental Features</h1> <p>These are features that show a lot of promise, but there is not existing tooling to easily work with them. We are working to make it easier, and will cover that work in future posts.</p> <h2 id="api-key-id">API Key ID</h2> <p>The <a href="https://github.com/Exodus-Privacy/etip/issues/62"><em>API Key ID</em></a> is a string that identifies bit of authentication data for enabling access to an online service. Many online services require an <em>API Key</em> even if a library or SDK is not required to access it. Even when the SDK is detected, the presence of an <em>API Key</em> shows that the tracking function is actually enabled. For example, the Google Firebase SDK includes lots of functionality, not only tracking, each of which must be enabled with an <em>API Key</em>. So the presence of Firebase is not enough to confirm tracking. A <a href="https://en.epicenter.works/content/analysis-of-the-stopp-corona-app-improvements-through-expert-report">current example</a> of exactly this is the Austrian Red Cross&rsquo; <em>Stopp Corona</em> app to track the spread of covid-19 in Austria.</p> <h2 id="natural-language-processing-nlp">Natural Language Processing (NLP)</h2> <p>As mentioned under the section on domain names, domain names can already give a clear hint at intent. However since this property is well known, URLs might be obfuscated to hide this information. This domain name obfuscation is a well known technique in the world of malware, there is some evidence of use by tracking companies. In this case, a language model might learn that any URL that looks like random letters and numbers might be a sign to consider increasing the probability of classifying this app as tracking slightly, depending on other features like requested permissions, and imported tracking libraries.</p> <h2 id="broadcast-receivers">Broadcast Receivers</h2> <p>Android provides a system for data to be broadcast to all apps on a device, this is known as a <a href="https://developer.android.com/guide/components/broadcasts"><em>Broadcast Receiver</em></a>. A wide range of data is available via this mechanism, both from the Android system as well as apps. The Android OS broadcasts detailed information about the <a href="https://developer.android.com/training/monitoring-device-state/battery-monitoring">battery level, health, and charging status</a>, including details of <a href="https://developer.android.com/reference/android/os/BatteryManager#BATTERY_PLUGGED_AC">how its charging</a>. Many music apps will broadcast detailed information about the song being played, while also <a href="https://gitlab.com/trackingthetrackers/wiki/-/issues/5">collecting those events</a> from the system and other apps. The full extent of this activity is not well described, both what data is broadcasted, what apps are doing with it, and which apps are collecting. As a feature, <em>Broadcast Receivers</em> have a lot of promise since they fit the patterns of useful features for machine learning: small, globally unique, and easy to extract.</p> <h1 id="feature-extraction-process">Feature Extraction Process</h1> <p>We are using tabular data to feed to the machine learning processes, so the process of extracting and pre-processing different features for classification includes similar steps for every feature. The number of features that can reasonably be processed this way is limited to probably tens of thousands of features, or perhaps even hundreds of thousands. Therefore we have collections of the top-<em>n</em> features where <em>n</em> is in the range of thousands: For example, the top thousand tracking libraries, or all built-in permissions. This way we extract the features out of the binary APK file, and source code when available, and loop over our collections of known features. If the feature was found in the APK/source the tabular data will be a 1, else a 0.</p> <p>(<em>This work was supported by NLnet&rsquo;s <a href="https://nlnet.nl/thema/NGIZeroPET.html">NGI Zero PET</a> fund.</em>)</p> https://guardianproject.info/2020/04/23/figuring-out-crowdsourced-translation-of-websites/ Thu, 23 Apr 2020 00:00:00 +0000 https://guardianproject.info/2020/04/23/figuring-out-crowdsourced-translation-of-websites/ <p>Crowdsourced translation platforms like <a href="https://weblate.org/">Weblate</a>, Transifex, Crowdin, etc. have proven to be a hugely productive way to actively translate apps and desktop software. Long form texts like documentation and websites remain much more work to translate and keep translated. Many translation services currently support Markdown and HTML, but very basically, which means much more work for translators and webmasters. Translators can inadvertently break things, either with a typo or because of a lack of knowledge of a specific syntax. This can make the whole page layout break. Webmasters and documentation maintainers must carefully check the process to ensure everything is working smoothly. With the spread of Markdown as a standard format, there is now hope! Software developers can focus efforts on the Markdown translation workflow, and Markdown is more tolerant of syntax errors than HTML.</p> <p>Guardian Project has been working for a decade on making localization and the long term maintenance of translation a lot easier for developers and translators. We call this ongoing collaborative effort &ldquo;Linguine&rdquo; after a name chosen in a multi-project meeting. One of the biggest usability barriers in the world of software and the internet is language. Most of the world does not speak English, yet most of <a href="https://www.bbc.com/future/article/20200414-the-many-lanuages-still-missing-from-the-internet">the internet is written in English</a>.</p> <p><a href="https://en.wikipedia.org/wiki/Maya_script"><img src="Tortuguero_Box_WDL2658.png" alt="Tortuguero Box" /></a></p> <h2 id="the-app-workflow">The App Workflow</h2> <p>The developer of an Android or iOS app does not need to know much about localization or translation in order to make their apps fully translated. Both supported translation from the beginning as a native feature. Software strings are already broken up into small chunks, which fit nicely into crowdsourced translation software. The progress bars and step-by-step user experiences map easily to these strings. The string file formats also allow for all sorts of valuable <a href="https://docs.weblate.org/en/latest/formats.html#xliff">metadata</a> the give translators context and guidance, as well as to enable automated checks. The strings of an app also do not to be 100% translated to be useful. For example, if all strings are translated except for those in a new feature, most users will never even notice the missing translations. If only the most commonly seen strings are translated, that translation can still be useful since it will provide the user with enough to navigate all the features of the app. Here are three examples of app strings for translation:</p> <p>Android <em>strings.xml</em>:</p> <pre><code class="language-xml">&lt;string name=&quot;app_details__no_versions__show_incompat_versions&quot;&gt;To show incompatible versions here anyway, enable the \&quot;%1$s\&quot; setting.&lt;/string&gt; &lt;string name=&quot;app_details__no_versions__no_compatible_signatures&quot;&gt;No versions with compatible signature&lt;/string&gt; &lt;string name=&quot;app_details__no_versions__none_compatible_with_device&quot;&gt;No versions compatible with device&lt;/string&gt; </code></pre> <p>Python <em>gettext .po</em>:</p> <pre><code class="language-gettext">#: ../fdroidserver/build.py msgid &quot;Don't create a source tarball, useful when testing a build&quot; msgstr &quot;不创建源码 tarball 文件，便于内部版本测试&quot; #: ../fdroidserver/stats.py msgid &quot;Don't do anything logs-related&quot; msgstr &quot;请勿做任何日志相关的操作&quot; #: ../fdroidserver/build.py msgid &quot;Don't refresh the repository, useful when testing a build with no internet connection&quot; msgstr &quot;不刷新资源库，便于没有互联网时的内部版本测试&quot; </code></pre> <p><em>i18next</em> JSON:</p> <pre><code class="language-json">{ &quot;package&quot;: { &quot;anti_features&quot;: &quot;Anti-Features&quot;, &quot;added_on&quot;: &quot;Added on {{ package_added_date }}&quot;, &quot;signed_by_fdroid&quot;: &quot;It is built and signed by F-Droid, and guaranteed to correspond to &lt;a href=\&quot;{{ source_code_url }}\&quot;&gt;this source tarball&lt;/a&gt;.&quot;, &quot;suggest_downloading_via_fdroid&quot;: &quot;Although APK downloads are available below to give you the choice, you should be aware that by installing that way you will not receive update notifications and it's a less secure way to download. We recommend that you install the F-Droid client and use that.&quot;, } } </code></pre> <h2 id="long-form-text">Long Form Text</h2> <p>With documentation, blog posts, and other long form text, it is a very different story. To start with, there are lots of debates of how best to break up a text: paragraphs, sentences, or whole pages? Does each bullet point count as a paragraph or a sentence? Do these rules work for both blog posts, which rarely change after publication, as well as documentation, which must be kept updated? Also, measuring the translation &ldquo;completeness&rdquo; of a long text is harder. If a blog post is 80% translated, it will be very disconcerting for readers when sections switch to English and back. A documentation page that is 20% translated is not useful.</p> <p>With websites, there is also more varied context than with software strings: paragraphs, titles, bullet points, code blocks, <a href="https://jekyllrb.com/docs/front-matter/">YAML Front Matter</a>, etc. There is currently no way to add translation metadata directly to the Markdown or HTML document, so that context is often missing, or it must be manually entered in the translation platform. One really nice property of Markdown is that the plain text version looks good, so if the writer messes up the markup syntax, all is not lost. Translation software can be made to fully &ldquo;understand&rdquo; Markdown (e.g. the <a href="https://en.wikipedia.org/wiki/Abstract_Syntax_Tree">AST</a>), and provide automated syntax checks. Such an approach might totally fail if someone messes up the markup in the source document. In that case, a more naive direct representation might work better. Sites that run linters will want the AST approach, sites with non-technical writers might not. In short: Crowdin, Transifex, and Weblate currently support Markdown, but in a limited way. And these limitations mean much more work for translators, developers, and webmasters.</p> <p>If the translators are technically savvy and know the topic and syntaxes well, then the webmaster doesn&rsquo;t need to worry too much. The translation platform will make it easier for the translators to keep the translations maintained. Another key benefit of crowdsourced translation is that translators don&rsquo;t need as much technical skill to meaningfully contribute, as long as the project fits well into the translation workflow. Due to the current complexity of websites and limitations of the tooling, there is still no single translation workflow for long form text that works well for the majority of websites and documentation. That means it is important to know available workflows and understand which one fits best to your project.</p> <h2 id="user-experience-breakdown">User Experience Breakdown</h2> <p>Website localization is also not nearly as standardized as apps. With apps, a single translation workflow will work for basically all cases. For websites, that is not possible since there are so many different kinds of texts and requirements. For some documentation, it is acceptable to have 20% of the text slightly out of date in the translation. For other documentation, each page needs to be 100% complete, otherwise the original English should be shown. A good translation experience therefore requires customization.</p> <p>The workflow will also vary based on the content and the skills that the translators have. If it is deeply technical documentation, then the translators will be comfortable markup and code syntax since they must have technical knowledge in order to translate the materials. The translators will prefer being closer to the source format. If the content is blog posts from an organization advocating good governance, then the translators are mostly going to be non-technical, and the workflow should minimize exposure to technical details like <a href="https://jekyllrb.com/docs/front-matter/">YAML Front Matter</a> blocks.</p> <p>One large, complicated example is the <a href="https://f-droid.org">F-Droid</a> website, which is built with Jekyll. It has five different kinds of materials that need to be translated, each with its own distinct requirements: <a href="https://hosted.weblate.org/projects/f-droid/website/">chrome strings</a>, <a href="https://hosted.weblate.org/projects/f-droid/website-pages/">pages</a>, <a href="https://hosted.weblate.org/projects/f-droid/website-docs/">docs</a>, <a href="https://hosted.weblate.org/projects/f-droid/website-posts/">blog posts</a>, and <a href="https://hosted.weblate.org/projects/f-droid/website-tutorials/">tutorials</a>. In order to group the strings by these requirements, the site uses <em>i18next</em> JSON for use in Jekyll Liquid tags and custom <a href="https://po4a.org/"><em>po4a</em></a> sections to handle the Markdown and YAML Front Matter. <em>po4a</em> makes it possible to group the translation levels per-section, then add requirements: the entire &ldquo;pages&rdquo; section must be ~95% translated for inclusion, while &ldquo;docs&rdquo; and &ldquo;blog posts&rdquo; sections can be untranslated. Each individual blog post must be completely translated to be published. Each documentation page must be 90% translated to be published. It is not 100% to allow for some time lag between when the original is updated, and the translated is updated. Ideally, the source string edits could be marked as &ldquo;typo correction&rdquo; vs &ldquo;update&rdquo; to aid making better automatic decisions about which translations should still be published.</p> <h2 id="process-and-people">Process and People</h2> <p>If there are people fully engaged in all parts of the translation process, then it is possible to tightly coordinate the updates to the source and the translations. Other projects rely on crowdsourced translations because it is easier for them to acquire volunteer contributions than increasing translation budgets. So the advantages and disadvantages of various workflows have to be weighed:</p> <ul> <li>Delay publishing the source update until the translations are done.</li> <li>Translated pages are reverted to English unless they are 100% updated.</li> <li>Translated pages show outdated parts until they are updated.</li> <li>Translated pages show English parts until they are updated.</li> </ul> <p>There are other trade-offs to consider in terms of the relationship between the translator and the project:</p> <ul> <li>Only trusted translators who can directly update the translations: <ul> <li>Rapid time to publish</li> <li>Less work to translate</li> <li>Much fewer languages supported</li> </ul></li> <li>Trusted reviewers with any contributions from any translator: <ul> <li>More language coverage, quality control from multiple eyeballs on every string</li> <li>Asynchronous, unpredictable workflow</li> </ul></li> <li>Contributions from any translator: <ul> <li>Rapid maintenance updates and even more languages</li> <li>More errors in translation, including potentially vandalous or malicious contributions</li> <li>Skilled translators will be less interested in contributing</li> </ul></li> </ul> <p>When it is possible to achieve 100% translation, like on a small site or when there is a budget to pay for all the documentation to be translated, then the workflow is a lot simpler. That allows the tools to have a more direct user experience. Volunteer-based, &ldquo;best effort&rdquo; translation is a different story. Then it is important to clearly represent which strings and pages should be translated first, and which are non-essential. Crowdin, for example, can show all the documents in a familiar looking file browser, with nice progress bars. There is no indication of priority. This is great if someone is paid to complete the full translation, but is much less clear for volunteers to jump in and contribute to the more important parts.</p> <p><img src="crowdin-markdown-dir.png" alt="" /> <em>Crowdin project file navigation</em></p> <p>Unfortunately, there is no shining example of a user experience that covers this second scenario well. Weblate provides one good tool, where the strings are presented to the translator in order of the priority set in the metadata (e.g. like <a href="https://docs.oasis-open.org/xliff/v1.2/os/xliff-core.html#priority">XLIFF&rsquo;s <em>priority</em></a>). The translator just needs to start translating the first strings Weblate presents.</p> <p><img src="crowdin-priority.png" alt="" /> <em>One hack to add priority to Markdown for Crowdin</em></p> <h2 id="mass-changes-versus-merge-conflicts">Mass Changes versus Merge Conflicts</h2> <p>Sometimes you have to make a small change to some of the coding of the website. The website has suddenly gotten a lot more popular, so you need to work on making the caching work a lot better to reduce the load. That means changing all of file references to include a version or hash value. Those links are also in the source strings that are fed to the translation system. And each change to the source strings prompts all of the translators to update their translations. Normally, this is exactly what should happen. But in this scenario, the translation should not change since it is just the links that changed. To handle this, the webmaster or developer needs to be able to do mass edits on the source and translation while having a way to tell the translation system to ignore this change. This can easily cause merge conflicts if a translator is working at the same time.</p> <p>If these small changes only happen in source, the translations will be marked as needing an update. Some platforms try to be smart about detecting changes, and will even mark strings as changed if both the source and translation were updated together. That produces another scenario: The website fully translated into Tibetan, but now the translator has disappeared. So those trivial changes are bumping more and more strings out of the translation, and soon it will be death by a thousand paper cuts and the Tibetan translation gets kicked out even though the underlying text is current. It is just the inline code updates that are marking things as out of date.</p> <h2 id="automation-and-checks">Automation and Checks</h2> <p>One essential part of any translation workflow is automated checks to make sure that the syntax has not been broken in the translation process. Translation platforms must provide clear errors to the translators, otherwise all of these problems will be pushed to the webmaster or developer who imports new translations. Or worse, they are overlooked and cause crashes or break layouts. Good metadata is a key piece of that process. For example, <em>i18next</em> <code>{{ interpolation }}</code> is not the same as Python <code>{format_strings}</code>, though they look quite similar. The metadata should include the file type and any relevant syntaxes. Most developers are not aware of all of the details of the translation process, so these checks should be enabled automatically, as much as possible. Manually enabling checks can be very hard to understand, since you have to understand both the developer&rsquo;s and translators points of view. These checks really pay off, like when technical contributors can go straight to strings with failing checks and fix the syntax problems, without any knowledge of the languages involved. This is in contrast to a project&rsquo;s Continuous Integration (CI) tests, which generally only the software&rsquo;s maintainers follow. The barrier to entry for fixing failing checks is much lower since they are standardized across every project on the translation platform.</p> <p><img src="weblate-checks.png" alt="" /> <em>Weblate highlights failing checks, the error counts are clickable to edit them all.</em></p> <p><img src="weblate-failing-checks.png" alt="" /> <em>Reviewing a single failing check in Weblate.</em></p> <p>Context is very important for translators, and a good translating experience will provide as much useful context as possible. That said, it cannot replace the real thing. Having a automatic staging website will help catch errors before publication. It also gives translators the feeling that they are building something real, when they are working their way up to being accepted for final publication. <a href="https://staging.tails.boum.org/">Tails</a> and <a href="https://staging.f-droid.org">F-Droid</a> both provide complete staging websites that include all of the the languages, not only the complete ones. Static site generators like Hugo and Jekyll let more technically skilled contributors rapidly build a local copy, and services like GitLab Pages and GitHub Pages can host a staging website <a href="https://eighthave.gitlab.io/fdroid-website/">for</a> <a href="https://bubu.gitlab.io/fdroid-website/">each</a> <a href="https://uniqx.gitlab.io/fdroid-website/">fork</a>.</p> <h2 id="translation-setup-with-po4a">Translation Setup with <em>po4a</em></h2> <p><a href="https://po4a.org"><em>po4a</em></a> is a tool for customizing the representation of text in the translation workflow. It is quite powerful, but also not simple to get started. Each translation platform has its own documentation for directly using Markdown, so follow those docs for a simpler setup. There is a lot to be said for having the translation platform directly handle the files that are being translated, without an intermediate localization format like XLIFF, <em>gettext</em> PO, or JSON. Sometimes other requirements mean that using <em>po4a</em> in the middle will save a lot of effort, like the F-Droid example above.</p> <p>The <em>po4a</em> approach does work quite differently: the translations are stored in the <em>.po</em> files rather than Markdown documents. This feels a bit unnatural at first, as compared to the regular workflow of a static site generator. Translated pages are then converted from <em>.po</em> to <em>.md</em> just for building the site. It gives a lot in return, especially for crowdsourced translation with specific requirements. For example, it makes publishing and unpublishing translated documents happen automatically, based on the pre-configured specifications, like whether it is 100% translated.</p> <p>po4a gives fine grained control over how documents are grouped, and what percentage must be translated before the translated version is published. The direct version means each document is represented by a single translation component. Many websites are organized into three common buckets, folders of Markdown documents should count as a single translation component:</p> <ul> <li>The base pages like &ldquo;about&rdquo;, &ldquo;contact, etc.</li> <li>Documentation</li> <li>Blog posts</li> </ul> <h3 id="projects-using-po4a">Projects using <em>po4a</em></h3> <ul> <li>Debian is using <em>po4a</em> to <a href="https://salsa.debian.org/manpages-l10n-team">translate the <em>man</em> pages</a>.</li> <li>The extensive <a href="https://tails.boum.org/contribute/build/website/">Tails documentation</a> uses <em>po4a</em> to make Markdown pages translatable in <a href="https://ikiwiki.info/plugins/po/">ikiwiki</a>.</li> <li>The Fedora project is using <em>po4a</em> to translate the <a href="https://pagure.io/fedora-docs/docs-fp-o">documentation</a> in <a href="https://translate.fedoraproject.org/">their own Weblate instance</a></li> <li><a href="https://stellarium.org/">Stellarium Astronomy</a> uses <em>po4a</em> to <a href="https://github.com/Stellarium/stellarium/pull/908">translate</a> &ldquo;sky culture descriptions&rdquo;.</li> </ul> <h4 id="coming-soon">Coming Soon:</h4> <ul> <li><a href="https://reproducible-builds.org/">https://reproducible-builds.org/</a> (built with Jekyll): <a href="https://salsa.debian.org/reproducible-builds/reproducible-website/-/merge_requests/56">https://salsa.debian.org/reproducible-builds/reproducible-website/-/merge_requests/56</a></li> <li><a href="https://reuse.software">https://reuse.software</a> (built with Hugo): <a href="https://github.com/fsfe/reuse-website/issues/26">https://github.com/fsfe/reuse-website/issues/26</a></li> </ul> https://guardianproject.info/2020/04/09/the-promise-and-hazards-of-covid-contact-tracing-apps/ Thu, 09 Apr 2020 00:00:00 +0000 https://guardianproject.info/2020/04/09/the-promise-and-hazards-of-covid-contact-tracing-apps/ <p>There has been increasing interest in the possibilities of tracking people who are infected with Coronavirus using all of the various methods that smart phones provide. There is good reason: &ldquo;<a href="https://en.wikipedia.org/wiki/Contact_tracing">contact tracing</a>&rdquo; has been a pillar of public health efforts for decades. It is an effective means to curtail the spread of infectious disease. At the same time, governments, companies, and organizations are acting fast to offer services to help end this current pandemic. The problem is that many of these are taking advantage of these times to introduce more tracking of people, more data collection, and more control over people. We must not let contact tracing be used to reduce privacy and increase unnecessary data collection.</p> <p>Privacy International has been collecting examples of <a href="https://privacyinternational.org/examples/tracking-global-response-covid-19">new data and tracking that are being introduced</a>.</p> <p>Then there this is the specific issue of contact tracing apps that are being introduced around the world. These apps can be made in a way to fully respect privacy, and to build trust with its users. Unfortunately the majority of the ones introduced are failing to live up to this promise. Singapore&rsquo;s TraceTogether was the first to rise to prominence, it is proprietary software with obfuscated operations. (<em>update: the source for a <a href="https://github.com/opentrace-community">reference implementation</a> has since been released, but TraceTogether is still proprietary</em>) A <a href="https://medium.com/@zerotypic/reversing-tracetogether-initial-analysis-edc940e86aa8">some</a> <a href="https://splira.com/2020-03-28/">audits</a> pointed to failings, including potentially sending location data to a third-party analytics service. There are now many of these apps, and based on <a href="https://forensic.defensive-lab.agency/covid/">this analysis</a>, most of them are sending data to third party tracking companies.</p> <p>On top of that, these audits took much more effort because the apps were not open source. There have been many pledges of making these apps open source, but the only one that we have found that is actually open source is <a href="https://privatekit.mit.edu/">Private Kit</a>. <a href="https://fsfe.org/news/2020/news-20200402-02.en.html">Free, open source software is essential</a> for software that needs to be widely trusted. This is only key design element, the CCC has laid out a complete list of <a href="https://www.ccc.de/en/updates/2020/contact-tracing-requirements">requirements for creating trustworthy contact tracing apps</a>.</p> <p>We stand ready to help any of these efforts achieve real privacy and build public confidence. People must trust these apps for them to be effective. Transparency is essential to building trust. They must be secure so they do not leak personal data. And they must be usable by the vast majority of the population.</p> https://guardianproject.info/2020/04/09/we-support-the-open-covid-pledge/ Thu, 09 Apr 2020 00:00:00 +0000 https://guardianproject.info/2020/04/09/we-support-the-open-covid-pledge/ <p>Please join this <a href="https://opencovidpledge.org">Open COVID Pledge</a> by committing to freely share technology for all work that aims to end the Coronavirus Disease 2019 (COVID-19) pandemic.</p> <p>We believe that free software licenses like the GNU GPL and the Apache License already provide these key benefits. We are making this statement to make it clear that all of our code is available for any effort to end the COVID Pandemic.</p> <p>We grant to every person and entity that wishes to accept it, a non-exclusive, royalty-free, worldwide, fully paid-up license to fully use, practice and exploit all our patent and copyright rights, for the sole purpose of ending the COVID-19 pandemic and minimising the impact of the disease, including diagnosis, prevention, containment, and treatment.</p> https://guardianproject.info/2020/03/05/improving-crowdsourced-translation-of-long-form-text/ Thu, 05 Mar 2020 00:00:00 +0000 https://guardianproject.info/2020/03/05/improving-crowdsourced-translation-of-long-form-text/ <p>We are happy to announce the start of work on another step in improving crowdsourced localization, funded by the ISC Project. This is the second part of our ongoing &ldquo;Linguine&rdquo; collaboration to move crowdsourced translation to privacy-respecting free software.</p> <p>Crowdsourced translation has proven enormously successful getting apps and website software translated into many languages. Using tools like Weblate or Transifex, developers can quite easily incorporate translated app strings into their mobile apps and websites. Any kinds of text that is easily broken down into phrases and sentences will fit easily into the crowdsourced workflow. Localization Lab enables a wide range of volunteers to contribute to the most important projects in a wide array of languages.</p> <p>For long form text, from blogs to documentation, large technical hurdles prevent the same fluid workflow. One clear example: Tor Browser is available in 25 languages, but the documentation is still largely just in English. The standard workflow is to first complete the English version, then submit that to translators, then wait for a complete translation. For the regular, small changes that come with maintaining documentation, that workflow makes the update cycle heavy and slow.</p> <p>Few webmasters can review translations. Tools like Weblate establish a review process, then developers need only to run an automatic import to get approved translations from trusted translators.</p> <p>The ideal workflow starts with the traditional method of translating in one complete unit, but now, that work can easily be shared by multiple contributors. Whenever the original documents are updated, those translations can then be maintained via the crowdsourcing. Even for organizations which directly cover their own translation needs, like a blogger who writes in both English and Tibetan, the workflow provided by tools like Weblate makes managing many small changes to documents drastically easier.</p> <p>While blog posts generally do not need frequent updates, a smooth path to crowdsourced translations means, given the same effort, a larger audience can be reached since the information will be available in more languages.</p> <h2 id="how-we-are-doing-this">How we are doing this</h2> <p>There are already many key building blocks in place:</p> <ul> <li>Weblate and Transifex already have basic support for directly translating long form text</li> <li><em>po4a</em> provides good format conversion between <em>Markdown</em> and other text formats</li> <li><em>Markdown</em> is a widely adopted mark-up format for documentation and blog posts</li> <li>Weblate already supports validating <em>Markdown</em></li> <li><em>po4a</em> integration with Jekyll</li> <li>Static Site Generators like Jekyll and Hugo have existing methods of supporting localization</li> </ul> <p>What needs doing is fixing lots of little issues here and there to complete the whole workflow. For example:</p> <ul> <li>Code blocks are quite common in technical documentation, and they often contain texts that should not be translated, e.g. the words from a programming language. <em>po4a</em> can be made to automatically recognize these blocks, and mark them as &ldquo;do not translate&rdquo; using standard tags, which Weblate communicates to translators.</li> <li>Most translators do not have strong technical skills, so specialized syntax like <em>Markdown</em> or configuration examples need to be validated to ensure that the translator did not inadvertently break something with a typo. There are existing methods and tools for validating a wide variety of markup, code, and configuration formats. These will be integrated into the translation review process to ensure that translations will not break the website layout or generation.</li> <li>When using translation sites that do not have good support for long form text, <em>po4a</em> can be integrated via &ldquo;plugins&rdquo; to static site generators like Jekyll or Hugo.</li> <li>Not all workflows allow for transparent integration, for example, Hugo to Weblate. In these cases, there needs to be some “glue” tools to make it work. We will produce and distribute tools for gluing together some common setups to work smoothly with Weblate and/or Transifex.</li> </ul> <p>Since this project is about getting lots of pieces to integrate nicely, all the code generated will be included in all the relevant projects. That is also where we will be looking for feedback, so file issues with <a href="https://github.com/WeblateOrg/weblate/issues/">Weblate</a>, <a href="https://gitlab.com/fdroid/fdroid-website/issues"><em>f-droid.org</em></a>, <a href="https://gitlab.com/guardianproject/info/issues"><em>guardianproject.info</em></a>, etc. and we will track them there!</p> https://guardianproject.info/2020/02/25/masque-review/ Tue, 25 Feb 2020 00:00:00 +0000 https://guardianproject.info/2020/02/25/masque-review/ <p><a href="https://datatracker.ietf.org/wg/masque/about/">MASQUE</a> is set of related IETF drafts for specifying flexible proxying built into a standard webserver. It is meant to be deployed on a server that is serving public websites, then this connection can be reused for proxying generic connections. It is very much a work in progress, so any of this can change. It is currently built on top of the QUIC+HTTP/3 and HTTP/2+TLS+TCP protocols. The website and proxy packets look the same, and all connections to the webserver will be shared and reused, regardless of whether its a web page request or proxy traffic. Each new proxy/website request will reuse any existing connection, providing a key reduction in metadata that makes all the packets blend together from the point of view of the network observer. For example, to prevent the network observer from corrolating requests to proxy with the outbound request to the destination, a client could first connect to the website, then some time later, connect to the proxy.</p> <p>QUIC is an Internet protocol on the verge of being standardized by the IETF, initially developed by Google. Approximately 50% of traffic from Chrome browsers to Google sites currently use QUIC, so it already has some large scale adoption. MASQUE is very similar to Meek and Encrypted <em>ClientHello</em> (aka ECH or Encrypted SNI) domain fronting in how it functions, and all of them &ldquo;hide in plain site&rdquo; by making circumvention traffic look the same as traffic that censors are unwilling to block. Like ESNI, MASQUE could be totally blocked in countries that deem QUIC too large a risk, e.g. China already blocks Google, so blocking the QUIC protocol right now would have very low cost to them. So it must be rolled out and gain broad adoption before it can be an effective circumvention tool.</p> <p>One use case is individuals enabling MASQUE on their personal websites, or organizations on their websites. Another use case is to provide travelling employees with VPN access even with local networks are blocking VPNs based on the protocols (e.g. DPI to identify OpenVPN or Wireguard traffic). Hosting providers and CDNs are not likely to to deploy MASQUE behind their main TLS certificate, as they are not willing to take the risk of getting blocked, just like with domain fronting. MASQUE/QUIC does not change the domain fronting formula, instead, it just provides a different mechanism to leverage.</p> <p>One key feature of MASQUE is a means of requiring authentication to the proxy before it gives any information back at all, including even if it exists. It does this with a custom authentication method where the replies are defined only as <code>200 OK</code> for successful authentication or <code>404 Not Found</code> for everything else. This is an idea that could also be used in Pluggable Transports in general.</p> <h2 id="relation-to-pluggable-transports">Relation to Pluggable Transports</h2> <p>The MASQUE Obsfuscation and HTTP Transport Authentication pieces of MASQUE are directly relevant to Pluggable Transports (PT), and could be included as part of the suite of standards for implementing complete PT solutions. The non-discoverable authentication method is useful for any PT that already requires some kind of key and is served via an public network socket. Standardizing the proxy setup and configuration makes sense to do both for MASQUE as much as PT. Right now, there are a wide variety of proxy configurations for PT with circumvention and VPN service providers.</p> <h2 id="masque-as-onion-routing-and-tor-components">MASQUE as Onion Routing and Tor Components</h2> <p>There are also some efforts to expand the scope of MASQUE into a Tor replacement based on QUIC and HTTP CONNECT proxies. This is a nice idea, but it should not distract from the core MASQUE pieces which will provide real value now. This area of work is now represented by three drafts: HTTP Transport Authentication, MASQUE Obfuscation, and MASQUE. Without a drastically expanded scope, MASQUE cannot replace Tor. It can provide one key but small building block: the base mechanism for onion routing based on HTTP CONNECT and QUIC. This could potentially allow Tor middle relay services to be implemented with a standard webserver like nginx with only a small custom plugin. This would not change the requirement for all of the various Tor network management services.</p> <h2 id="sources">Sources</h2> <ul> <li><a href="https://tools.ietf.org/html/draft-ietf-quic-tls-27">https://tools.ietf.org/html/draft-ietf-quic-tls-27</a></li> <li><a href="https://lists.torproject.org/pipermail/tor-dev/2018-March/013026.html">https://lists.torproject.org/pipermail/tor-dev/2018-March/013026.html</a></li> <li><a href="https://davidschinazi.github.io/masque-drafts/draft-schinazi-masque.html">https://davidschinazi.github.io/masque-drafts/draft-schinazi-masque.html</a></li> <li><a href="https://davidschinazi.github.io/masque-drafts/draft-schinazi-masque-obfuscation.html">https://davidschinazi.github.io/masque-drafts/draft-schinazi-masque-obfuscation.html</a></li> <li><a href="https://davidschinazi.github.io/masque-drafts/draft-schinazi-httpbis-transport-auth.html">https://davidschinazi.github.io/masque-drafts/draft-schinazi-httpbis-transport-auth.html</a></li> <li><a href="https://mailarchive.ietf.org/arch/msg/masque/Cxh1phx6vFgn19jyANmt2YwLDqQ/">https://mailarchive.ietf.org/arch/msg/masque/Cxh1phx6vFgn19jyANmt2YwLDqQ/</a></li> <li><a href="https://datatracker.ietf.org/meeting/104/materials/slides-104-secdispatch-the-masque-protocol-draft-schinazi-masque-00">https://datatracker.ietf.org/meeting/104/materials/slides-104-secdispatch-the-masque-protocol-draft-schinazi-masque-00</a></li> <li><a href="https://guardianproject.info/2019/04/16/exploring-possibilities-of-pluggable-transports-on-android/">https://guardianproject.info/2019/04/16/exploring-possibilities-of-pluggable-transports-on-android/</a></li> </ul> https://guardianproject.info/2020/01/16/tracking-the-trackers-using-machine-learning-to-aid-ethical-decisions/ Thu, 16 Jan 2020 00:00:00 +0000 https://guardianproject.info/2020/01/16/tracking-the-trackers-using-machine-learning-to-aid-ethical-decisions/ <p>F-Droid is a free software community app store that has been working since 2010 to make all forms of tracking and advertising visible to users. It has become the trusted name for privacy in Android, and app developers who sell based on privacy make the extra effort to get their apps included in the F-Droid.org collection. These include <a href="https://f-droid.org/packages/com.nextcloud.client">Nextcloud</a>, Tor Browser, <a href="https://f-droid.org/packages/de.thecode.android.tazreader">TAZ.de</a>, and <a href="https://f-droid.org/packages/de.tutao.tutanota">Tutanota</a>. Auditing apps for tracking is labor intensive and error prone, yet ever more in demand. F-Droid already has tools to aide contributors in this process, visible in the <a href="https://gitlab.com/fdroid/fdroiddata/merge_requests">app submission</a> and <a href="https://gitlab.com/fdroid/rfp/issues">Request For Packaging (RFP)</a> issue trackers. We also have functional prototypes of using machine learning to drastically speed up this process by augmenting humans, rather than replacing them.</p> <p>Since the prime motivation of the F-Droid community is ethical software distribution, algorithms will never replace humans in making ethical decisions. We have also explored using machine learning to detect tracking in a more generic way, without manually compiled lists of tracking libraries. With this funding, we will improve the F-Droid tools, and make them generally available for any use case needing to reliably detect trackers in Android apps. This builds upon our <a href="https://f-droid.org/en/2017/12/14/new-collaborations-on-exposing-tracking.html">collaboration</a> with <a href="https://exodus-privacy.eu.org/">Exodus Privacy</a> and <a href="https://github.com/reddr/LibScout">LibScout</a>.</p> <p>This project comes out of some proof of concept work that <a href="https://www.lo-res.org/~aaron/">Aaron Kaplan</a> and Hans-Christoph Steiner did, working with students in the Vienna Economics University&rsquo;s (WU) <a href="https://www.wu.ac.at/en/infobiz/teaching/sbwl-data-science">Data Science Lab</a>. We focused on using machine learning with Android apps, first to detect malware, then second to detect tracking libraries. It is of course ultimately an outgrowth of the F-Droid community&rsquo;s efforts, and Guardian Project&rsquo;s funded efforts for building systems without any tracking at all. And special thanks to F-Droid founder <a href="https://en.wikipedia.org/wiki/Ciaran_Gultnieks">Ciaran Gultnieks</a> for setting the ethical tone that inspired us all, back in <a href="https://f-droid.org/2010/09/30/no-free-beer.html">2010</a>.</p> <h2 id="funding">Funding</h2> <p>This current 44,500€ project is funded by NLnet&rsquo;s <a href="https://nlnet.nl/PET/">Privacy &amp; Trust Enhancing Technologies (PET) Fund</a>. F-Droid has received large, dedicated, computing resources from the <a href="https://cfarm.tetaneutral.net/machines/list/">GCC Compile Farm</a>, as well as some shared resources from Aaron Kaplan. The budget will be used entirely to pay for people&rsquo;s time for the research, development, and integration work:</p> <ul> <li>Software development to get the existing LibScout and Exodus Privacy tools to be fully integrated into the F-Droid stack.</li> <li>Machine learning research and development.</li> <li>Community management, to coordinate with F-Droid contributors, app developers, tool developers, academic researchers, etc. as well to promote these tools</li> <li>Finalize and package up all the useful parts of this project, which also means getting them included in Debian</li> </ul> <h2 id="related-efforts">Related Efforts</h2> <p>The general approach that we are taking here has been proven in the context of web pages. The Brave Browser includes <a href="https://arxiv.org/pdf/1805.09155">machine learning techniques</a> for blocking ads and trackers in webpages. It is a very similar idea to what we propose, but that example is embedded into a browser and only applies to web sites.</p> <p>Exodus Privacy has manually compiled an extensive list of tracking libraries and domains for receiving user data. It then uses this to scan app from Google Play. Those results are then reported on their website. Exodus Privacy would directly benefit from this work, since they could use the tools we will create.</p> <p>Ghostery uses AI techniques to dynamically block ads in web pages. (<a href="https://www.wired.com/story/ghostery-deploys-ai-in-fight-against-ad-trackers/">https://www.wired.com/story/ghostery-deploys-ai-in-fight-against-ad-trackers/</a>)</p> <p>F-Droid has its own <code>fdroid scanner</code> for doing checks based on manually prepared regular expressions. This was combined with Exodus Privacy into F-Droid&rsquo;s <a href="https://gitlab.com/fdroid/rfp/issues">issuebot</a> which automatically scans apps that users request to be added to F-Droid.</p> <p>LibScout uses machine learning to detect which versions of which libraries are included in an Android app (APK). Using the list of libraries from Exodus Privacy, we worked with the LibScout author to create a functional prototype of a tracking library detector.</p> <p><a href="https://www.sec.cs.tu-bs.de/pubs/2014-ndss.pdf">Drebin</a> clearly demonstrated that machine learning can be used to automatically classify Android apps based on certain aspects of their behavior. Their aim was to find malware. Working with CERT.at and the WU Data Science Lab, we reproduced the results of the Drebin paper.</p> <h2 id="the-challenges">The challenges</h2> <p>The biggest promise of this project is also the biggest technical challenge: finding a way to take datasets about what includes tracking libraries (e.g. F-Droid manual review, LibScout, Exodus Privacy), and turning that into a more general machine learning approach. We will have to explore a wide range of possible features to include in the machine learning that are distinct from the tracking libraries themselves. This general approach will provide tracking detection with more automation and less maintenance work of rerunning the machine learning on updated datasets as new tracking libraries are put into use.</p> <p>The technical methods for determining whether an app includes trackers are well known and described. They currently require knowledge of Android development. Machine learning has been proven to be able to reliably spot trackers in apps, this project will turn working prototypes into production software, integrate it into F-Droid community-driven processes, and make these new tools easily available for anyone else to apply to their specific use cases. Given an Android apps downloaded from anywhere, these new tools will be able to mark which ones have any kind of tracking in them, with a very high degree of certainty. With the portion of the project that involves applying LibScout, at this point, the idea has been proven with prototypes. Applying it is a straightforward matter of bringing a proven prototype to production.</p> <p>Organizations relying on proprietary apps that must follow strict data protection requirements, like banks under the GDPR, can use these tools to ensure that apps they rely on do not contain illegal tracking, and to ensure that such tracking is not added in future releases.</p> <p>These techniques are also applicable to other platforms, like Progressive Web Apps and Apple iOS. Bootstrapping another platform would require a marked training set of apps to feed to the machine learning. F-Droid already provides this set, and Android is the most popular OS in the world, making Android the ideal platform to start this work.</p> <h2 id="humans-at-the-core">Humans at the core</h2> <p>F-Droid is a community run free software project very much in the same spirit as Debian. The community has always aimed to provide 100% verified free software, built from source. From the beginning, there was also an interest in other ethical considerations as well, these are expressed via F-Droid&rsquo;s &ldquo;Anti-Features&rdquo;. These are things tagged with Tracking (contains tracking), Ads (includes advertising), and NonFreeNet (requires a non-free network service). The process of ensuring that the apps are 100% free software as well as tagging apps with the required Anti-Features is a manual process that many people contribute to, that is aided by quite a bit of automation. This project fits directly into this existing ecosystem. It will both quickly provide improvements in contributors&rsquo; workflow based on the existing prototype, as well as experiments towards drastically improving the whole workflow of anyone working to track trackers.</p> <p>F-Droid fits into the whole Android app ecosytem in a very specific role. It is the one source that only distributes free software, and has built a well deserved reputation for not compromising on the ethics that guide the community. This has led it to become the standard &ldquo;clean set&rdquo; in all manner of research into Android malware and tracking. Many academic papers covering Android malware cite f-droid.org as the source of ground truth.</p> <p>In closing, it is important to highlight that it is essential to keep humans always at the center of of these tools. We are building tooling to augment humans, not replace them. Since the prime motivation of the F-Droid community is to build ethical software distribution, algorithms will never replace humans in making decisions based on ethics. The tools can automate the technical details, so that contributors do not need to understand them in order to meaningfully help with the process.</p> https://guardianproject.info/2019/12/17/netcipher-conscrypt-for-the-best-possible-tls/ Tue, 17 Dec 2019 00:00:00 +0000 https://guardianproject.info/2019/12/17/netcipher-conscrypt-for-the-best-possible-tls/ <p>A new NetCipher library has recently been merged: <a href="https://gitlab.com/guardianproject/NetCipher/merge_requests/86"><em>netcipher-conscrypt</em></a>. In the same vein as the other NetCipher libraries, <em>netcipher-conscrypt</em> wraps the Google <a href="https://source.android.com/devices/architecture/modular-system/conscrypt">Conscrypt</a> library, which provides the latest <a href="https://en.wikipedia.org/wiki/Transport_Layer_Security">TLS</a> for any app that includes it. <em>netcipher-conscrypt</em> lets apps then disable old TLS versions like TLSv1.0 and TLSv1.1, as well as disable TLS Session Tickets. This is an alpha release because it only works on recent Android versions (8.1 or newer). The actual functionality works well, the hard part remains making sure that it is possible to inject <em>netcipher-conscrypt</em> as the TLS provider on all Android devices and versions. And the last missing piece is finding the right place in Conscrypt to configure proxying to support Tor or other privacy proxies</p> <p>Before Conscrypt, Android apps relied on the Android OS itself to provide TLS. Normally, software uses the TLS provided by the operating system. Since too often Android devices do not get software updates, lots of users are stuck on old TLS versions. So Google split out the TLS stack from Android itself and made the Conscrypt library from it so it can be independently updated. Guardian Project has been taking this approach for almost 10 years, starting with SQLCipher-for-Android and IOCipher libraries. We are happy to see Google doing this themselves to give us more platform flexibility and security. We plan on using this as a platform for making <a href="https://tools.ietf.org/html/draft-ietf-tls-sni-encryption">ESNI (Encrypted SNI)</a> available to all Android apps.</p> <p>It is exciting to see ideas that we have been championing over the past decade to get mainstream adoption. TLS Session Tickets have always had serious <a href="https://blog.filippo.io/we-need-to-talk-about-session-tickets/">security</a> and <a href="https://www.theregister.co.uk/2018/10/19/tls_handshake_privacy/">privacy</a> issues, Android 10 <a href="https://source.android.com/devices/architecture/modular-system/conscrypt#consrypt-q">now provides</a> an official API for disabling TLS Session Tickets: <a href="https://developer.android.com/reference/android/net/ssl/SSLSockets.html">android.net.ssl.SSLSockets</a> and <a href="https://developer.android.com/reference/android/net/ssl/SSLEngines.html">android.net.ssl.SSLEngines</a>. And the idea of per-app file encryption, which <em>IOCipher</em> provides, can now be largely provided by the built-in <a href="https://source.android.com/security/encryption/file-based">Android File-Based Encryption (FBE)</a>.</p> https://guardianproject.info/2019/12/02/trusted-update-channels-vs.-scratching-your-itch/ Mon, 02 Dec 2019 00:00:00 +0000 https://guardianproject.info/2019/12/02/trusted-update-channels-vs.-scratching-your-itch/ <p>One of the great things about free software is that people can easily take a functional program or library and customize it as they see fit. Anyone can come along, submit bug fixes or improvements, and they can be easily shared across many people, projects, and organizations. With distribution systems like Python&rsquo;s <a href="https://pypi.python.org">pypi</a>, there is an update channel that the trusted maintainers can publish fixes so consumers of the library can easily get updates. When talking about update channels and code, it is unavoidable to also talk about people and trust. One key piece is the trust relationship between the consumer and the maintainer. The ideal software distribution system would be a blind, trustworthy pipe between the software maintainers and each end user.</p> <p>Since we are talking about libraries of code, the natural relationship turns out to be different than the trust relationship: it is between the consumer and the library itself, not the maintainers. I use Requests for handling HTTP, not @nateprewitt&rsquo;s fork. My <em>setup.py</em> includes a reference to <code>'requests'</code>, not to the maintainers who I trust to keep the library updated.</p> <p>There have been cases were libraries were <a href="https://www.zdnet.com/article/backdoor-code-found-in-11-ruby-libraries/">taken</a> <a href="https://www.theregister.co.uk/2018/07/12/npm_eslint/">over</a> and used to distribute malware. Or <a href="https://www.theregister.co.uk/2018/11/26/npm_repo_bitcoin_stealer/">another case</a> where someone offered to take over a popular library, then inserted malware into it. If it is really easy for maintainers to hand over a library to someone else, then that will be abused. If they are too hard to hand over, then many valuable libraries will be abandoned or forked. Having to check for forks is an added cost for library consumers, so ideally there would always be a trusted maintainer.</p> <p>For large projects like Requests or distros like Debian, there is a process for ensuring that new maintainers are doing the right thing. There are also many small libraries that are very valuable. For example, <a href="https://github.com/rory/apache-log-parser">apache_log_parser</a> or <a href="https://pypi.org/project/PyMTP/">pymtp</a>. In these cases, the cost of doing a proper process of handing over to a new maintainer is quite large as compared to the overall effort the library author put into the library. Or it might be a single maintainer who is now overburdened with other work.</p> <p>In F-Droid, reviewing app merge requests, aka <em>fdroiddata</em>, is also about reviewing whether the trust relationship is changing. This is on top of making sure the new code works, ensuring its still free software, and that all of the Anti-Features are properly marked. Getting this review right is important especially when you consider that in F-Droid, many apps are automatically updated without core contributors reviewing it.</p> <p>All developers must consider these trust issues at a number of key points in the process of developing software, including:</p> <ul> <li>when adding a library to any piece of software</li> <li>helping a new maintainer take over existing software</li> <li>reviewing changes to the URL of the source code reposistory</li> </ul> <p>There are also some ideas about how to better map who we need to trust to the process of including software. One interesting example is <a href="https://dpc.pw/cargo-crev-and-rust-2019-fearless-code-reuse"><em>cargo-crev</em></a> for the Rust ecosystem. It provides a system of describing and cryptographically linking trusted developers and their reviews of software packages.</p> https://guardianproject.info/2019/10/08/onions-on-apples-a-new-release-of-onion-browser-for-ios/ Tue, 08 Oct 2019 00:00:00 +0000 https://guardianproject.info/2019/10/08/onions-on-apples-a-new-release-of-onion-browser-for-ios/ <p>During 2019, Guardian Project has been working with developer Mike Tigas to make improvements to his Tor-enabled web browser for iOS, <a href="https://onionbrowser.com/">Onion Browser</a>. Here we re-cap the major improvements currently - and soon-to-be - available.</p> <p>Mike developed Onion Browser on his own, in close collaboration with the Tor Project. Though we’ve worked with Mike in the recent-past, this 2019 project &ndash; funded by the Open Technology Fund &ndash; gave us significantly more bandwidth to address the challenges of running Tor on iOS, especially alongside a full web-browsing feature set.</p> <p>In Onion Browser, our Tor connectivity runs in the same process as the browser itself. Tor Browser for Android uses a similar model, though the general purpose Orbot app for Android is separate from the applications using its services (apps configure Orbot as a proxy, in the same manner as SOCKS). This latter model is not available on iOS and, it turns out, iOS puts some additional restrictions on apps like ours as well. These have, over time, created some thorny problems for Onion Browser.</p> <p>The newest release of Onion Browser upgraded to Tor version 0.4.0.5 which greatly improves reliability when the app comes back from background. The application was updated with modern versions of all the incorporated 3rd-party libraries. This includes an upgrade to the underlying Endless browser-core. The often-requested ability to &ldquo;open the app in its last state&rdquo; feature was added as well as a mechanism to hide the browser’s content when switching between applications. Advanced users of the app had reported issues configuring bridges in previous releases and these have been fixed. It’s now possible to report a bug or rate the app from within the application.</p> <p>With our new work, an important network traffic leakage discovered in earlier releases have been mitigated. Web browsers generally utilize the services of the Online Certificate Status Protocol (OCSP) to determine if a website’s security certificate is still valid. Status checks on iOS are provided by a system library that can’t use the Tor service, so these service calls leak. A mechanism has been found to prevent leakage in a large number of circumstances, but not completely.</p> <p>We’re now completing our second big development push which will feature an upgraded and simplified on-boarding experience as well as improvements to the organization of application settings. We’ve also upgraded the experience of setting per-website security parameters (which can be either one-time-only or “sticky”). The leakage corrections we implemented will also allow us to implement the ability to download and save files in non-HTML content formats, or share such files with other applications. Additionally, we implemented an improved technique to limit Javascript “re-insertion” attacks in WebRTC pages. We expect this release to happen during October or early November.</p> <p>Onion Browser’s medium- and long-term maintenance are a volunteer effort. If you wish to support this project into the future, please visit Mike Tigas’s Patreon page.</p> https://guardianproject.info/2019/10/07/iocipher-64-bit-builds/ Mon, 07 Oct 2019 00:00:00 +0000 https://guardianproject.info/2019/10/07/iocipher-64-bit-builds/ <p>IOCipher v0.5 includes fulil 64-bit support and works with the latest SQLCipher versions. This means that the minimum supported SDK version had to be bumped to <em>android-14</em>, which is still older than what Google Play Services and Android Support libraries require.</p> <p>One important thing to note is that newer SQLCipher versions require an upgrade procedure since they changed how the data is encrypted. Since IOCipher does use a SQLCipher database, and IOCipher virtual disks will have to be upgraded. That can be done by directly using the <a href="https://www.zetetic.net/sqlcipher/sqlcipher-api/#cipher_migrate">SQLCipher migration method</a> on your IOCipher database files before opening them again. It should be possible to stick with SQLCipher <a href="https://github.com/sqlcipher/android-database-sqlcipher/issues/446">v3.5.9 to avoid this</a>, but this has not been tested.</p> https://guardianproject.info/2019/09/03/tor-project-orfox-paved-the-way-for-tor-browser-on-android/ Tue, 03 Sep 2019 00:00:00 +0000 https://guardianproject.info/2019/09/03/tor-project-orfox-paved-the-way-for-tor-browser-on-android/ <p>Last month, we tagged the <a href="https://github.com/guardianproject/Orfox/releases/tag/Orfox-Final-RIP-v16">final release of Orfox</a>, an important milestone for us in our work on Tor. Today, we pushed this final build out to all the Orfox users on Google Play, which forces them to upgrade to the official Tor Browser for Android..</p> <p><img src="orfoxrip.png" alt="Orfox RIP app image" /></p> <p>Our goal was never to become the primary developer or maintainer of the &ldquo;best&rdquo; tor-enabled web browser app on Android. Instead, we chose to act as a catalyst to get the Tor Project and the Tor Browser development team themselves to take on Android development, and upstream our work into the primary codebase. This has happened, and it is a great news for everyone. The work for developing and updating Tor Browser on the desktop and Android are now coordinated and synchronized, and end-users benefit from more frequent updates and improvements.</p> <p>Most importantly, the <a href="https://github.com/amoghbl1">Amazing Amogh</a> can focus on his PhD studies, and not on continuing the heroic task of trying to merge Firefox releases, Tor Browser patches, and Android proxy setting code for four different HTTP network libraries! Thanks, Amogh!</p> <p>From the <a href="https://blog.torproject.org/orfox-paved-way-tor-browser-android">Tor Project&rsquo;s blog</a> announcing the last release of Orfox:</p> <blockquote> <p>Mobile browsing has increasingly become the primary way many people go online. In 2014, Tor Browser was used by millions of people on their desktop computers, but there was not yet a way to use Tor on a mobile device. We have long recognized the need for protecting people&rsquo;s rights to privacy and freedom online, including on mobile devices, but as a small nonprofit organization, we were not yet ready to meet that demand. That&rsquo;s when our friends at Guardian Project began exploring the possibility of providing Tor Browser on Android themselves. Their answer was Orfox.</p> <p>Orfox was first released 23 September 2015. Over the next three years, Orfox continously improved and became a popular way for people to browse the internet with more privacy than standard browsers, and Orfox was crucial for helping people circumvent censorship and access blocked sites and critical resources. It was installed over 14 million times, and maintained over 1 million active users.</p> <p>In late 2017, we began working on our own Tor Browser for Android. Because of Orfox&rsquo;s success, the development path for us was clearer and more in reach. We were able to build upon Guardian Project&rsquo;s work and bring a browser with the full protections of Tor Browser to Android. We released the alpha version of Tor Browser for Android in September 2018 and launched the stable version this May. After nearly a year since we released the alpha version of Tor Browser on Android, the time for sunsetting Orfox has come.</p> </blockquote> <p>If you have Orfox, you will see the upgrade and prompt to install Tor Browser for Android soon. Otherwise, you can just <a href="https://play.google.com/store/apps/details?id=org.torproject.torbrowser&amp;hl=en_US">go directly to install and get it now!</a></p> https://guardianproject.info/2019/06/25/netcipher-update-global-socks-and-tlsv1.2/ Tue, 25 Jun 2019 00:00:00 +0000 https://guardianproject.info/2019/06/25/netcipher-update-global-socks-and-tlsv1.2/ <p><a href="https://guardianproject.info/code/netcipher">NetCipher</a> has been relatively quiet in recent years, because it kept on working, doing it was doing. Now, we have had some recent discoveries about the guts of Android that mean NetCipher is a lot easier to use on recent Android versions. On top of that, TLSv1.2 now reigns supreme and is basically everywhere, so it is time to turn TLSv1.0 and TLSv1.1 entirely off.</p> <h2 id="a-single-method-to-enable-proxying-for-the-whole-app">A single method to enable proxying for the whole app</h2> <p>As of Android 8.0 (26 aka Oreo), it is now possible to set a <code>URLStreamHandlerFactory</code>, which creates <code>URLConnection</code> instances with custom configurations. If an app is using the built-in <code>HttpURLConnection</code> API for its networking, it is now possible to enable global proxying with a single method call when the app starts: <a href="https://guardianproject.github.io/NetCipher/libnetcipher/info/guardianproject/netcipher/NetCipher.html#useGlobalProxy--"><code>NetCipher.useGlobalProxy()</code></a>. Then the actual proxy configuration can be set dynamically, using things like <a href="https://guardianproject.github.io/NetCipher/libnetcipher/info/guardianproject/netcipher/NetCipher.html#useTor--"><code>NetCipher.useTor()</code></a> or <a href="https://guardianproject.github.io/NetCipher/libnetcipher/info/guardianproject/netcipher/NetCipher.html#clearProxy--"><code>NetCipher.clearProxy()</code></a>.</p> <p>The <code>URL.setURLStreamHandlerFactory()</code> method is a little odd because it cannot be unset or changed after it has been set. NetCipher handles this by letting the app configure the proxy settings separately, so they can be disabled even though the custom <code>URLStreamHandlerFactory</code> is still active. Also, it is possible to use <code>URL.setURLStreamHandlerFactory</code> on Android 7.x also, but it leaks DNS, so it is not recommended for privacy proxies. It would still be useful as a failsafe for apps that use <a href="https://guardianproject.github.io/NetCipher/libnetcipher/info/guardianproject/netcipher/NetCipher.html#getHttpURLConnection-java.lang.String-"><code>NetCipher.getHttpURLConnection()</code></a>, in case there are any calls to <code>URL.openConnection()</code> added with the right proxy setup. At the very least, the content will be proxied on Android 7.x, even if it leaks DNS.</p> <h2 id="native-socks-support">Native SOCKS Support</h2> <p>In Android 7.0 (24 aka Nougat), Google switched over to OpenJDK, which brought working SOCKS support to Android. SOCKS is the best protocol for effective proxying, and it is the protocol that Tor itself has always natively supported. Orbot has always provided a separaete HTTP Proxy to support Android, but that has always proven brittle, and was often the source of problems. Since Android 7.0 and above natively support SOCKS, calling <code>NetCipher.useTor()</code> will now default to using SOCKS if the device is running Android 7.0 or higher.</p> <h2 id="bye-bye-tlsv1-0-and-tlsv1-1">Bye bye TLSv1.0 and TLSv1.1</h2> <p>Transport Layer Security (TLS) is the protocol that powers most of the internet these days. It gives HTTPS the S for &ldquo;Secure&rdquo;. After many years of slow updates and an increasing number of vulnerabilities, there is finally critical mass to stop using the old, broken versions. TLS version 1.2 is not seriously vulnerable and is supported basically everywhere. TLSv1.2 was finalized in 2008, so this is very far from the bleeding edge. TLSv1.2 is supported all the way back to <a href="https://developer.android.com/reference/javax/net/ssl/SSLSocket#protocols">Android 4.1</a>. TLSv1.0 and TLSv1.1 are due to be officially deprecated by the IETF, the standards body that actually creates the TLS standard. The major browser vendors have all promised to drop them in 2020.</p> <p>One way to enforce TLSv1.2 support would be to configure the server-side to stop supporting TLSv1.0 and TLSv1.1, like is recommend with SSLv2 and SSLv3. Using NetCipher to do this on the client side means that old app versions and devices of F-Droid and old devices will continue to work. Also, doing it client-side means that all TLS connections will gain this protection regardless of which server the client is connecting to.</p> <p>The <em>NetCipher</em> approach means apps will never use TLS older than v1.2 since they will refuse to connect unless TLSv1.2 is available. The server-side can then safely support TLSv1.0 and TLSv1.1, so older clients and Android devices will still be able to connect, even if they do not support TLSv1.2. It is win-win for everyone.</p> <p>The one case that will fail entirely is connections to servers that do not support TLSv1.2. If a webserver does not support TLSv1.2, it is really too old to be used safely anyway. Even the oldest supported Red Hat Enterprise Linux release (6) supports TLSv1.2, and that was released in 2010.</p> <h2 id="webview-proxying"><code>WebView</code> Proxying!</h2> <p><a href="https://developer.android.com/reference/android/webkit/WebView"><code>WebView</code></a> provides an easy way to show a webpage or build a web app. If you want that page to always go over Tor, that is difficult since <code>WebView</code> has no API to configure proxying. NetCipher has a long running collection of hacks that span the Android versions to get proxying working in <code>WebView</code>. We have revived those, modernized them, and added a full test suite to confirm whether the proxying is leaking. The good news is that proxying is working pretty well on all but Android 5.x (21 and 22), where it totally fails.</p> <p>Another new Android API we discovered is <a href="https://developer.android.com/reference/android/webkit/WebViewClient.html#shouldInterceptRequest(android.webkit.WebView,%20android.webkit.WebResourceRequest)"><code>WebViewClient.shouldInterceptRequest()</code></a>. This is an official API for manipulating HTTP requests in <code>WebView</code>. It is an an easy place to insert custom <code>HttpURLConnection</code> instances, like NetCipher needs to configure proxy support and stronger TLS. Using this API means eliminating Java reflection hacks. But it has a large caveat: it only works for <em>GET</em> requests. Since the request body is not accessible via this API, it is not possible to implement <em>POST</em> or <em>PUT</em> requests. One nice approach for the best of both works is to handle <em>GET</em> with <code>WebViewClient.shouldInterceptRequest()</code>, then <em>POST</em> and <em>PUT</em> could then be implemented separately using the reflection methods in NetCipher WebView.</p> <h2 id="tests">Tests!</h2> <p>This release also brings with it an extensive, new test suite. These let us confirm that things are working on all the supporting Android versions, while also serving as simple example cases. For example, the tests now confirm which Android releases support <code>WebView</code> proxying, based on Cure53&rsquo;s very useful <a href="https://github.com/cure53/HTTPLeaks">HTTPLeaks</a>.</p> https://guardianproject.info/2019/06/04/panickit-1.0-built-in-panic-button-and-full-app-wipes/ Tue, 04 Jun 2019 00:00:00 +0000 https://guardianproject.info/2019/06/04/panickit-1.0-built-in-panic-button-and-full-app-wipes/ <p>Panic Kit is 1.0! After over three years of use, it is time to call this stable and ready for widespread use.</p> <link rel="stylesheet" href="https://guardianproject.info/css/jquery.fancybox-3.4.0.min.css" /> <script src="https://guardianproject.info/js/jquery-3.3.1.min.js"></script> <script src="https://guardianproject.info/js/jquery.fancybox.min.js"></script> <div class="gallery"> <a data-fancybox="gallery" href="https://guardianproject.info/2019/06/04/panickit-1.0-built-in-panic-button-and-full-app-wipes/Screenshot_1559551039.png"> <img src="https://guardianproject.info/2019/06/04/panickit-1.0-built-in-panic-button-and-full-app-wipes/Screenshot_1559551039.png"> <br/> </a> <a data-fancybox="gallery" href="https://guardianproject.info/2019/06/04/panickit-1.0-built-in-panic-button-and-full-app-wipes/Screenshot_1559551407.png"> <img src="https://guardianproject.info/2019/06/04/panickit-1.0-built-in-panic-button-and-full-app-wipes/Screenshot_1559551407.png"> <br/> </a> <a data-fancybox="gallery" href="https://guardianproject.info/2019/06/04/panickit-1.0-built-in-panic-button-and-full-app-wipes/screenshot_fdroid_destructive0.png"> <img src="https://guardianproject.info/2019/06/04/panickit-1.0-built-in-panic-button-and-full-app-wipes/screenshot_fdroid_destructive0.png"> <br/> </a> <a data-fancybox="gallery" href="https://guardianproject.info/2019/06/04/panickit-1.0-built-in-panic-button-and-full-app-wipes/screenshot_fdroid_destructive1.png.png"> <img src="https://guardianproject.info/2019/06/04/panickit-1.0-built-in-panic-button-and-full-app-wipes/screenshot_fdroid_destructive1.png.png"> <br/> </a> <a data-fancybox="gallery" href="https://guardianproject.info/2019/06/04/panickit-1.0-built-in-panic-button-and-full-app-wipes/screenshot_ripple.png"> <img src="https://guardianproject.info/2019/06/04/panickit-1.0-built-in-panic-button-and-full-app-wipes/screenshot_ripple.png"> <br/> </a> </div> <h2 id="built-in-panic-button">Built-in panic button</h2> <p>This round of work includes a new prototype for embedding PanicKit directly into Android. Android 9.0 Pie introduced a new &ldquo;lockdown&rdquo; mode which follows some of the patterns laid out by PanicKit. There is an <em>Enter lockdown</em> button available on the power button menu, so it is rapidly available. This is a great panic trigger button, so we made a prototype of a System Settings app that lets users connect the full flexibility of PanicKit responses to this <em>Enter lockdown</em> button. The functionality that Google links to this new button is extremely limited, it seems to be a <a href="https://www.androidpolice.com/2018/03/08/android-p-feature-spotlight-new-lockdown-option-power-menu-turns-off-fingerprint-unlocking-something-called-extended-access/">one time restriction on how you login</a>. The PanicKit responses are in addition to what Google included. CalyxOS is <a href="https://gitlab.com/calyxos/calyxos/issues/72">working</a> to integrate this, look for test releases soon!</p> <h2 id="full-wipes-of-selected-apps">Full wipes of selected apps</h2> <p><a href="https://f-droid.org">F-Droid v1.7-alpha1</a> has alpha support for uninstalling and wiping all data from selected apps in response to a panic trigger, including Ripple and F-Droid. So the whole panic setup could be wiped as part of the response. It is essential to have a complete, tested backup before trying this new feature, since it will delete all of the data for each app that is uninstalled.</p> <p>This requires <a href="https://f-droid.org/packages/org.fdroid.fdroid.privileged.ota">F-Droid Privileged Extension</a> be installed on the device, in order to uninstall apps without a prompt for each app. Android ROMs like CalyxOS, CopperheadOS, Fairphone Open, Replicant, and Lineage-for-microG all include F-Droid Privileged Extension.</p> <h2 id="ripple-is-polished-up">Ripple is polished up</h2> <p>Ripple also received some modernization and polish. Google has reinstated the Ripple app in Google Play, so it is again widely available. Ripple was of course available the whole time via F-Droid. Google suspended Ripple without explanation, then a long while later reinstated it without explanation.</p> <p>This work was made possible in part from donations from Handshake Foundation.</p> https://guardianproject.info/apps/info.guardianproject.locationprivacy/ Fri, 26 Apr 2019 00:00:00 +0000 https://guardianproject.info/apps/info.guardianproject.locationprivacy/ https://guardianproject.info/2019/04/16/exploring-possibilities-of-pluggable-transports-on-android/ Tue, 16 Apr 2019 15:00:00 -0400 https://guardianproject.info/2019/04/16/exploring-possibilities-of-pluggable-transports-on-android/ <p><a href="https://www.pluggabletransports.info">Pluggable Transports</a> (PT) give software developers the means to establishing reliable connections in <a href="https://en.wikipedia.org/wiki/Deep_packet_inspection">DPI-filtered</a> network scenarios. A variety of techniques are supported, all available by implementing just one standard. We looked into how this can be put to work in Android Apps. Hence we crafted 3 fully functional <a href="https://gitlab.com/uniqx/anynews-android#anynews-pt">PT-enabled</a> <a href="https://gitlab.com/uniqx/fdroidclient-pt#f-droid-pt">prototype</a> <a href="https://gitlab.com/uniqx/apps-android-wikipedia-pt#wikipedia-android-pt">Apps</a> based on well known open source projects.</p> <p>All our prototypes rely on <a href="https://github.com/Yawning/obfs4">obfs4</a> which is a stable PT implementation widely deployed by Tor. Guardian Project published a library called <a href="https://github.com/guardianproject/AndroidPluggableTransports">AndroidPluggableTransports</a> for giving Android developers access easy access to PT. Since we could not find any easily accessible sample code, we created a <a href="https://gitlab.com/uniqx/pt-obfs4proxy-minimal-demo">minimal demo project</a>, illustrating a minimal setup for sending a HTTP-request through a OBFS4 connection.</p> <p>Conceptually, a PT establishes point to point connections between a PT client and a PT server. PT servers are also known as &ldquo;bridges&rdquo;. Most app back-ends, on the other hand, consist of multiple services and third party APIs. We&rsquo;re using SOCKS5 for multiplexing several connections over a single PT connection. A nice benefit to this approach is that client side integration looks similar to integrating Tor.</p> <p>Every PT bridge generates an individual set of parameters. These are required for establishing connections to that bridge. In the context of Tor, these parameters are often referred to as a &ldquo;bridge line&rdquo;, which also implies a quasi-standardized formatting of these parameters.</p> <p>Starting a PT connection involves several layers of proxying. This diagram should give you an idea of what&rsquo;s really going on when we start a PT connection:</p> <p><img src="apt-setup-socks5.png" alt="Schematic overview of establishing a PT connection used" /></p> <p>For many organizations it is not an option to run open proxies on the Internet because the bandwidth bills would be too large, or the security risks too high. This means we need to refine our SOCKS5 based approach a bit. An obvious solution is to restrict usage of a PT bridge for one specific app. This can be achieved simply by whitelisting outgoing connections on a bridge&rsquo;s SOCKS5 server. Some SOCKS5 servers have built-in support for this, so we&rsquo;re covered. We published the deployment script we&rsquo;re using to set up our <a href="https://gitlab.com/uniqx/pt-socks5-over-obfs4proxy">SOCKS5-enabled bridges</a> in our prototype environment.</p> <p>While SOCKS5 support is widespread these days, some apps might still need to rely on HTTP-proxying. That&rsquo;s why we also included an embedded HTTP-proxy in our prototype Apps. This proxy is configured to transparently send requests through the SOCK5 connection, which in turn runs through a PT connection.</p> <p>All that required from the app developer&rsquo;s perspective is to configure APT (and our soon-to-be upstreamed proxy helper library) with a bridge line, then configure all network connections to use a either a SOCKS5 or HTTP proxy.</p> <p>We also looked into ways for distributing parameters for <a href="https://github.com/guardianproject/AndroidPluggableTransports/pull/15">PT connections</a>. We started out by supporting bridge-lines as used in Tor browser and Orbot. Copy and pasting these is not very convenient and probably looks arcane to most users. So we came up with the idea of sharing bridge connection parameters as URLs. HTTP(S) URLs are clickable in most Android Apps which makes sharing a lot easier. Apps can subscribe to URL patterns. This way it&rsquo;s possible to intercept clicks on PT bridge parameters and configure PT settings accordingly. While these URLs still look somewhat arcane, they hopefully enable an improved user experience.</p> <p>Here&rsquo;s an example of a bridge-line and how it looks like the in all URL formats:</p> <pre><code>Bridge obfs4 104.224.78.19:443 FD9DAEE45A2FDF70D462914A75ADE99A29957920 cert=LSOd9qOffpIFM4az+ueou7sY0eQRAsI/joW4QgCl/LSDo2ecQzAQHNu281oAivLDZuTQNA iat-mode=0 bridge://obfs4@104.224.78.19:443/FD9DAEE45A2FDF70D462914A75ADE99A29957920?cert=LSOd9qOffpIFM4az%2Bueou7sY0eQRAsI%2FjoW4QgCl/LSDo2ecQzAQHNu281oAivLDZuTQNA&amp;iat-mode=0 http://bridge.onion/FD9DAEE45A2FDF70D462914A75ADE99A29957920?transport=obfs4&amp;ip=104.224.78.19&amp;port=443&amp;cert=LSOd9qOffpIFM4az%2Bueou7sY0eQRAsI%2FjoW4QgCl/LSDo2ecQzAQHNu281oAivLDZuTQNA&amp;iat-mode=0 https://bridges.torproject.org/FD9DAEE45A2FDF70D462914A75ADE99A29957920?transport=obfs4&amp;ip=104.224.78.19&amp;port=443&amp;cert=LSOd9qOffpIFM4az%2Bueou7sY0eQRAsI%2FjoW4QgCl/LSDo2ecQzAQHNu281oAivLDZuTQNA&amp;iat-mode=0 </code></pre> <p>There&rsquo;s still some room for refining this. Tor Browser, for example, will happily accept but fail using our experimental SOCKS5 bridges. Meanwhile our prototype apps will accept but fail to connect to Tor bridges. So it would make sense to explore what metadata apps need to decide whether they are capable of connecting to a specific bridge or not.</p> <p>An important missing puzzle piece in this regard also is to make sure DNS queries can not get filtered. <a href="https://en.wikipedia.org/wiki/DNS_over_HTTPS">DNS-over-HTTPS (DoH)</a> could be a suiteable mitigation. Further down the road, it certainly would make sense to look into sending DNS requests over pluggable transports too.</p> <p>Many Android apps use <code>WebView</code> for transparently embedding web content. Sadly, proxy support of <code>WebView</code> is not very developer friendly. We are shipping a well-tested helper library with <a href="https://gitlab.com/guardianproject/NetCipher/#webview">NetCipher</a> to ease this pain.</p> <p>We also explored an alternative approach to control the networking of Android&rsquo;s <code>WebView</code>. It&rsquo;s possible to replace all network requests a <code>WebView</code> sends by overriding <code>WebViewClient.shouldInterceptRequest()</code>. This technique will work well for read-only (HTTP GET) connections. Sending data (HTTP POST and PUT) is not feasible though. There is no interface, either exposed or hidden, in Android&rsquo;s API which would allow us to retrieve a HTTP request&rsquo;s body.</p> <p>Finally here&rsquo;s a list of alternative scenarios we came up with for using PT on Android. They are not as generic as the approach we chose to implement in the prototype Apps. In some situations these might be easier to implement, perform better or simply convey how PT can be put to use.</p> <p><img src="apt-setup-scenarios.png" alt="Schematic overview of establishing a PT connection used" /></p> https://guardianproject.info/2019/01/23/use-onions/https-for-software-updates/ Wed, 23 Jan 2019 06:35:40 -0400 https://guardianproject.info/2019/01/23/use-onions/https-for-software-updates/ <p>There is a new <a href="https://lists.debian.org/debian-security-announce/2019/msg00010.html" target="_blank">vulnerability in Debian’s apt</a> that allows anything that can Man-in-the-Middle (MITM) your traffic to get root on your Debian/Ubuntu/etc boxes. Using encrypted connections for downloading updates, like HTTPS or Tor Onion Services, reduces this vulnerability to requiring root on the mirror server in order to exploit it. That is a drastic reduction in exposure. We have been pushing for this <a href="https://guardianproject.info/2014/10/16/reducing-metadata-leakage-from-software-updates/">since 2014</a>, and <a href="https://onion.debian.org" target="_blank">Debian</a>, <a href="https://ftp.fau.de" target="_blank">mirror</a> <a href="https://mirrors.kernel.org" target="_blank">operators</a>, and others in the ecosystem have taken some big steps towards making this the standard. This should finally put to rest the idea that plain <a href="https://whydoesaptnotusehttps.com/" target="_blank">HTTP is enough</a> for software updates with signed metadata.</p> <p>To this end, we have always supported <a href="https://f-droid.org/docs/Security_Model/" target="_blank">F-Droid’s practice</a> of requiring HTTPS connections to f-droid.org and mirrors, even though the signed metadata file is the essential mechanism for providing security.</p> <h2 id="using-encrypted-connections-on-your-server">Using encrypted connections on your server</h2> <p>Over the years, we have been honing our <code>apt</code> sources setup to use encrypted connections as much as possible, while getting updates as fast as possible. The hard part of this is that the <a href="http://security.debian.org" target="_blank">official Debian security server</a> only provides HTTP. There are mirrors of that that are available over HTTPS, but they can receive updates hours or days later. The best fix for this would be for Debian to provide an HTTPS connection to <code>security.debian.org</code>. There are still things in the <code>apt</code> source configuration that can help. There are three levels we use:</p> <ol> <li>only Tor Onion Services for all updates, this means always encrypted and over Tor, but can mean that updates are delayed, for example if Tor traffic is blocked.</li> <li>First try Tor Onion, then try HTTPS. This provides a backup connection method in case Tor is not working, for whatever reason, but still could get updates slower than the official security source</li> <li>First try Tor Onion, then try HTTPS, then try HTTP. But HTTP is only enabled for <code>security.debian.org</code></li> </ol> <p>You can see an example of the final option by looking at <a href="https://gitlab.com/fdroid/fdroid-cfarm-bootstrap/commit/24389018a164e110e7204f2b2c62a7b81863cdd4" target="_blank">F-Droid’s compile farm server config</a>.</p> <h2 id="fixing-your-boxes">Fixing your boxes</h2> <p><code>@abelxluck</code> aka <code>@abeluck</code> put out an <a href="https://gist.github.com/abeluck/67525909a17403060cd1722b53d57d00" target="_blank">Ansible Playbook</a> to do this update. Here is a quick script for securely updating on Debian/stretch/amd64 based on the <a href="https://lists.debian.org/debian-security-announce/2019/msg00010.html" target="_blank">info published</a> on the debian-security list:<br /> <code>&lt;br /&gt; #!/bin/sh -ex</code></p> <p><code>apt -o Acquire::http::AllowRedirect=false update || true&lt;br /&gt; apt -o Acquire::http::AllowRedirect=false upgrade --download-only || true</code></p> <p><code>cd /var/cache/apt/archives</code></p> <p><code>test -e apt-dbgsym_1.4.9_amd64.deb &amp;&amp; \&lt;br /&gt; echo &quot;1da507155c7b1ad140739c62fdacceaf5b5ee3765b1a00c3a3527d9d82a8d533 apt-dbgsym_1.4.9_amd64.deb&quot; | sha256sum -c</code></p> <p><code>test -e apt-transport-https-dbgsym_1.4.9_amd64.deb &amp;&amp; \&lt;br /&gt; echo &quot;59f3e1c91664fe3b47048794560ebe9c41f1eeccbdd95f7715282f8cbe449060 apt-transport-https-dbgsym_1.4.9_amd64.deb&quot; | sha256sum -c</code></p> <p><code>test -e apt-transport-https_1.4.9_amd64.deb &amp;&amp; \&lt;br /&gt; echo &quot;c8c4366d1912ff8223615891397a78b44f313b0a2f15a970a82abe48460490cb apt-transport-https_1.4.9_amd64.deb&quot; | sha256sum -c</code></p> <p><code>test -e apt-utils-dbgsym_1.4.9_amd64.deb &amp;&amp; \&lt;br /&gt; echo &quot;e3e157c291b05b2899a545331c7597ab36ca04e02cd9010562b9985b76af60db apt-utils-dbgsym_1.4.9_amd64.deb&quot; | sha256sum -c</code></p> <p><code>test -e apt-utils_1.4.9_amd64.deb &amp;&amp; \&lt;br /&gt; echo &quot;fb227d1c4615197a6263e7312851ac3601d946221cfd85f20427a15ab9658d15 apt-utils_1.4.9_amd64.deb&quot; | sha256sum -c</code></p> <p><code>test -e apt_1.4.9_amd64.deb &amp;&amp; \&lt;br /&gt; echo &quot;dddf4ff686845b82c6c778a70f1f607d0bb9f8aa43f2fb7983db4ff1a55f5fae apt_1.4.9_amd64.deb&quot; | sha256sum -c</code></p> <p><code>test -e libapt-inst2.0-dbgsym_1.4.9_amd64.deb &amp;&amp; \&lt;br /&gt; echo &quot;0e66db1f74827f06c55ac36cc961e932cd0a9a6efab91b7d1159658bab5f533e libapt-inst2.0-dbgsym_1.4.9_amd64.deb&quot; | sha256sum -c</code></p> <p><code>test -e libapt-inst2.0_1.4.9_amd64.deb &amp;&amp; \&lt;br /&gt; echo &quot;a099c57d20b3e55d224433b7a1ee972f6fdb79911322882d6e6f6a383862a57d libapt-inst2.0_1.4.9_amd64.deb&quot; | sha256sum -c&lt;/p&gt; &lt;p&gt;test -e libapt-pkg-dev_1.4.9_amd64.deb &amp;&amp; \&lt;br /&gt; echo &quot;cfb0a03ecd22aba066d97e75d4d00d791c7a3aceb2e5ec4fbee7176389717404 libapt-pkg-dev_1.4.9_amd64.deb&quot; | sha256sum -c&lt;/p&gt; &lt;p&gt;test -e libapt-pkg5.0-dbgsym_1.4.9_amd64.deb &amp;&amp; \&lt;br /&gt; echo &quot;cdb03ddd57934e773a579a89f32f11567710a39d6ac289e73efb20e8825874d1 libapt-pkg5.0-dbgsym_1.4.9_amd64.deb&quot; | sha256sum -c&lt;/p&gt; &lt;p&gt;test -e libapt-pkg5.0_1.4.9_amd64.deb &amp;&amp; \&lt;br /&gt; echo &quot;03281e3d1382826d5989c12c77a9b27f5f752b0f6aa28b524a2df193f7296e0b libapt-pkg5.0_1.4.9_amd64.deb&quot; | sha256sum -c&lt;/p&gt; &lt;p&gt;</code>``````````````````<code>apt -o Acquire::http::AllowRedirect=false upgrade&lt;br /&gt; </code></p> https://guardianproject.info/apps/circulo/ Mon, 21 Jan 2019 14:57:14 -0400 https://guardianproject.info/apps/circulo/ https://guardianproject.info/2018/09/26/wind-is-a-mozilla-national-science-foundation-grand-prize-winner/ Wed, 26 Sep 2018 10:54:38 -0400 https://guardianproject.info/2018/09/26/wind-is-a-mozilla-national-science-foundation-grand-prize-winner/ <p>On August 14th, members of the Guardian Project team traveled to Mountain View to compete in the final round of the <a href="https://wirelesschallenge.mozilla.org/">Wireless Innovation for a Networked Society (WINS) Challenge</a>. We learned in July that our <a href="https://guardianproject.info/2018/07/20/our-wind-project-is-a-mozilla-nsf-challenge-finalist/">Wind  project was a finalist</a>, and we now had the opportunity to compete for one of the grand prizes, in a TED-meets-SharkTank style event, at Mozilla HQ.</p> <p><a href="https://guardianproject.info/wind">Wind</a> is a network designed for opportunistic communication and sharing of local knowledge that provides off-grid services for everyday people, using the mobile devices they already have. In the Wind network, Chime is the hyperlink, but one that exists in time and space, discoverable through beacon broadcasts and human-to-human sharing. All of this is powered by free and open-source software, running on readily available consumer hardware, and can be deployed at little to no cost, in a very short amount of time.</p> <iframe width="560" height="315" src="https://www.youtube.com/embed/fGuiy3rlOVQ" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> <p style="font-size:23px"> Yesterday, on the Mozilla blog, the <a href="https://blog.mozilla.org/blog/2018/09/25/1-6-million-to-connect-unconnected-americans-our-nsf-wins-competition-grand-prize-winners/">winners were announced.</a> We are honored to be one of them, claiming the 4th Grand Prize. </p> <p><p class="has-background has-pale-cyan-blue-background-color"> You can watch our 5 minute power presentation below, or jump to the <a href="https://guardianproject.info/wind/">project page</a> or <a href="https://github.com/guardianproject/wind">github repo</a> for more detail. We have also published our entire <a href="https://github.com/guardianproject/wind/blob/master/Mozilla%20NSF%20Off-Grid%20Challenge_%20Wind.pdf">Wind Concept Proposal Submission paper.</a><br /></p> <iframe width="560" height="315" src="https://www.youtube.com/embed/FOWrappjLsY" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> <p>We are so grateful to be associated not only with the challenge itself, but with all the other impressive finalists and winners. Our work on Wind took quite a different approach than the others, and thus fills some niches and gaps not addressed by the other systems. We believe there are numerous opportunities for collaboration, and looking forward to helping fulfill the complete vision set forth by the WINS challenges.</p> <p>We will use the funding to continue development work on our <a href="https://github.com/sabzo/ayanda">Ayanda</a> and <a href="https://github.com/guardianproject/chimeapp">Chime</a> apps, protocols and libraries. We will also support partners like F-Droid, OpenArchive, LibraryBox to help promote adoption. We will travel and work in the field, finding communities in need both in the U.S., and abroad, who can benefit from a Wind deployment. Lastly, we’ll reach out to colleagues in the humanitarian response communities, to gain feedback and build awareness about our suite of tools and capabilities.<figure class="wp-block-image"></p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-5.jpg" alt="" class="wp-image-13904" srcset="https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-5.jpg 1275w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-5-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-5-300x300.jpg 300w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-5-768x768.jpg 768w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-5-1024x1024.jpg 1024w" sizes="(max-width: 1275px) 100vw, 1275px" /> </figure></p> <p>Some thanks are definitely in order for members of the Guardian Project team and community. Hans’ leadership and collaboration with the <a href="https://f-droid.org/">F-Droid.org team</a> over the last few years, provided innovative and fully functional foundation for the “Off Grid App Store”. In particular, his work implementing USB sharing with F-Droid (see the video above for that in action), enabled a true sneakernet mode, that was a key part of our demo.<br /> <figure class="wp-block-image"></p> <p><img src="https://guardianproject.info/wp-content/uploads/2018/09/disaster_1-1.jpg" alt="" class="wp-image-14002" srcset="https://guardianproject.info/wp-content/uploads/2018/09/disaster_1-1.jpg 1920w, https://guardianproject.info/wp-content/uploads/2018/09/disaster_1-1-300x182.jpg 300w, https://guardianproject.info/wp-content/uploads/2018/09/disaster_1-1-768x466.jpg 768w, https://guardianproject.info/wp-content/uploads/2018/09/disaster_1-1-1024x622.jpg 1024w" sizes="(max-width: 1920px) 100vw, 1920px" /> </figure></p> <p><a href="https://okthanks.com/">Okthanks</a>, our design team, created amazing <a href="https://okthanks.com/blog/peronas-latin-america">user-centered foundations, personas and methods</a> as our guide, and that helped our video presentations turn out great. Rosa and Fabiola ensured we stayed true to communities in Latin America who could benefit from this effort. Fabiola also was a fantastic presenter in front of the judges (again, to the video!). Early on, David conceived of a geocaching based concept that led to the Chime protocol, and which we plan to keep exploring. <a href="http://sabelo.io/about/">Sabelo</a> pushed forward our work on our nearby communications with his <a href="https://github.com/sabzo/ayanda">Ayanda software library</a>. Natalie and the <a href="https://open-archive.org/">OpenArchive</a> team let us prototype support for nearby media publishing. Jason and his <a href="http://librarybox.us/">LibraryBoxen</a> provided some early inspiration for how an off-grid system can be useful in everyday life.</p> <p>Again, our sincere thanks to Mozilla and the National Science Foundation for this wonderful opportunity and financial support. Here’s to a more Windy future for the unconnected world ahead.</p> https://guardianproject.info/2018/08/17/iocipher-is-the-antidote-to-man-in-the-disk-attack/ Fri, 17 Aug 2018 16:56:00 -0400 https://guardianproject.info/2018/08/17/iocipher-is-the-antidote-to-man-in-the-disk-attack/ <p>Recently, at DEFCON 2018, researchers at Check Point <a href="https://blog.checkpoint.com/2018/08/12/man-in-the-disk-a-new-attack-surface-for-android-apps/">announced a new kind of attack</a> made possible by the way many Android apps are implemented. In summary, developers use the shared external storage space in an unsafe manner, by not taking into consideration that other apps also have read and write access to the same space. A malicious app can modify data used by another app, as a vector for compromising that app, causing it to be compromised or crash.</p> <p>While Google does provide <a href="https://developer.android.com/training/articles/security-tips" target="_blank" rel="noopener">guidelines</a> on safe external storage use, most developers ignore them. Here is what they say:</p> <ul> <li>“Perform input validation when handling data from external storage”</li> <li>“Do not store executables or class files on External Storage”</li> <li>“External Storage files should be signed and cryptographically verified prior to dynamic loading”</li> </ul> <p>This is most likely due to lack of time or knowledge…. and, that is where our <a href="https://guardianproject.info/code/iocipher/">IOCipher encrypted virtual filesystem library for Android</a> comes in!</p> <p>IOCipher provides a virtual encrypted disk for Android apps without requiring the device to be rooted. It uses a clone of the standard <code>java.io</code> API for working with files, so developers already know how to use it. Only password handling, and opening the virtual disk are what stand between the developer and working encrypted file storage. It is based on and <a href="https://www.zetetic.net/sqlcipher/" target="_blank" rel="noopener">SQLCipher</a>, and designed to work with <a href="https://github.com/guardianproject/IOCipher" target="_blank" rel="noopener">CacheWord</a> for handling the keys and passwords.</p> <p>Regarding the three guidelines from Google, by storing downloaded data into an IOCipher virtual volume, you both benefit from the use of external storage, while ensuring, thanks to cryptography, that your data or executable code has not been read or modified by another application. If a malicious application tries to access or modify the encrypted volume, it will be detected and not able to load, without causing a crash in the application.</p> <p>You can find IOCipher on Github today (and likely get it implemented in your app today, as well!)</p> <p><a href="https://github.com/guardianproject/IOCipher">https://github.com/guardianproject/IOCipher</a></p> <p> </p> https://guardianproject.info/2018/07/20/our-wind-project-is-a-mozilla-nsf-challenge-finalist/ Fri, 20 Jul 2018 14:28:23 -0400 https://guardianproject.info/2018/07/20/our-wind-project-is-a-mozilla-nsf-challenge-finalist/ <p>For the last few years, we’ve been working on the <a href="https://guardianproject.info/wind/">Wind network concept</a>, as a nearby, local, off-grid companion, or alternative, to the Web. This year, we decided to participate in the <a href="https://wirelesschallenge.mozilla.org/">Wireless Innovation Challenge</a>, sponsored by Mozilla and the National Science Foundation. Today, it was announced that we are a finalist in, as they put it, <a href="https://blog.mozilla.org/blog/2018/07/19/a-science-fair-with-1-6-million-in-prizes/">“A Science Fair with $1.6 Million in Prizes”</a>.</p> <p>Watch the video below to learn more about Wind, or jump right over to the <a href="https://guardianproject.info/wind/">Wind project page</a>.</p> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe src="//www.youtube.com/embed/fGuiy3rlOVQ" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe> </div> <p>_<br /> When disaster strikes, connectivity becomes difficult. Information can save your life, guiding you to safety and services. Networks today are fragile and easy overloaded. There has not been enough investment in the many other possible nets, that may be better suited for situations where connections to the global internet are not available or affordable. The potential in radios, sensors and processing available in the cheapest of smartphones and routers are not fully utilized or realized._</p> https://guardianproject.info/2018/05/16/orbot-over-20-million-served-ready-for-the-next-billion/ Wed, 16 May 2018 07:42:38 -0400 https://guardianproject.info/2018/05/16/orbot-over-20-million-served-ready-for-the-next-billion/ <p>We recently published the <a href="https://github.com/n8fr8/orbot/releases/tag/16.0.2-RC-1">latest release of Orbot (16.0.2!)</a>, and as usual, we make it available via <a href="https://play.google.com/store/apps/details?id=org.torproject.android&amp;hl=en_US">Google Play</a>, as well <a href="https://guardianproject.info/fdroid">F-Droid</a>, and through <a href="https://guardianproject.info/releases/">direct download</a> on our website. Whether we like it or not, Google keeps tracks of things like total installs and active installs (i.e. not uninstalled), and reports on that for us through their dashboard. While publishing this release, we noticed a milestone that made us a bit proud… so pardon this humblebrag.</p> <p>Since we release Orbot roughly 8 years ago, it has been <strong>installed more than 20 million times</strong>, by people from hundreds of different countries and walks of life. Even better, we have cross the <strong>2 million active user</strong> mark, with growing adoption in many “mobile first” parts of the world.</p> <p>Of course, none of this would be possible without Tor Project itself, at the core of what we do, and empowering us through the years, to pave the way on free, open, mobile circumvention. We are also especially excited about the direction things are headed with <a href="https://blog.torproject.org/announcing-tors-next-executive-director-isabela-bagueros">Tor’s new executive director, Isabela Bagueros.</a></p> <p>That is because Isa understands that the vast majority of the world, including her home country of Brazil, accesses the internet using smartphones, which essentially include surveillance, censorship and privacy invasion as core features. Fortunately, she shares our optimism that with the right software and service, we can fight back against this and provide working solutions for human rights defenders, activists, journalists and everyday people. We are really excited about <a href="https://blog.torproject.org/blog/upping-support-mobile-browsing">Tor’s new mobile initiative</a> and their new stewardship of Orfox (soon to be Tor browser for Android!). <em>Also, if you didn’t know Isa is the one responsible for <a href="https://guardianproject.info/2012/05/02/orbot-your-twitter/">Twitter adding proxy features</a> into their Android app many years ago!</em></p> <p>With that global population in mind, we’ve focused this latest release of Orbot on size and efficiency, with the goal of making the app <strong>less than 10 megabytes in size</strong>. This 10MB limit qualifies Orbot to be promoted to <a href="https://www.android.com/versions/oreo-8-0/go-edition/">Android Go devices</a>, which is Google’s attempt to serve <a href="https://www.blog.google/topics/next-billion-users/">“the next billion”</a>. You might have heard about lightweight “Go” editions of apps like YouTube, that are both smaller in size, and have features that enable data saving and offline use. With Orbot, we have started by focusing on reducing our binary size (which adds up over time with regular updates, etc), to reduce it by nearly <sup>1</sup>&frasl;<sub>3</sub>, instead of just letting it grow bigger and bigger with each release. Over the next year, we will be working with the core Tor team to improve the core efficiency of the service running on mobile architectures, and to implement new features for data management, battery saving and more.</p> <p>A deep, onion-infused thank you to the multitudes who have helped us get to this point. We couldn’t have done it with out all of your patches, bug reports, complaints, praise, donations and encouragement. Now, let’s keep it up until we get to the billion install mark!</p> <p> </p> <p> </p> https://guardianproject.info/2018/01/05/orbot-v16-a-whole-new-look-and-easier-to-use/ Fri, 05 Jan 2018 13:14:17 -0400 https://guardianproject.info/2018/01/05/orbot-v16-a-whole-new-look-and-easier-to-use/ <p><a href="https://guardianproject.info/apps/orbot/">Orbot: Tor for Android</a> has a new release (<a href="https://gitweb.torproject.org/orbot.git/tag/?h=16.0.0-RC-2">tag</a> and <a href="https://gitweb.torproject.org/orbot.git/diff/CHANGELOG?h=16.0.0-RC-1-CHANGELOG&amp;id=5542e8e192fcff24284179e7fdb31cf877f79efd">changelog</a>), with a major update to the user experience and interface. This is the 16th major release of Orbot, since it was launched in late 2009.</p> <p>The main screen of the app now looks quite different, with all the major features and functions exposed for easy access. We have also added a new onboarding setup wizard for first time users, that assists with configuring connections to the Tor network for users in places where Tor itself is blocked. This release also continues to support users looking to use Orbot to unblock specific apps, that may not be available on their network or country. From the main screen, users can activate Orbot’s built-in VPN feature, and easily choose which specific apps they want to be routed over the Tor network. You can also refresh your Tor identity, rebuilding all circuit connections through the network, using the circular reload icon in the expanded notification provided by Orbot.</p> <p>The update is rolling out on <a href="https://play.google.com/store/apps/details?id=org.torproject.android">Google Play</a>, and will also be available on <a href="https://guardianproject.info/fdroid/">Guardian Project’s F-Droid Repo</a> soon. You can also find <a href="https://github.com/n8fr8/orbot/releases">Android APKs on Github</a>.</p> <p>THANKS TO: pgerber, syphyr, Khsed4, BjarniRunar, Unpublished, igortoliveira, goapunk, SpotComms, AkshatAgrawal05, dixidroid, arrase and others for the bug reports and fixes on the Orbot app. Thanks to <a href="https://twitter.com/wwwiretap">Sina</a> with Team Cymru for the extra infrastructure provided to help users in places where Tor itself is blocked. Also, <a href="https://twitter.com/mrphs">Nima</a> for the guidance, support and motivation to get this release out sooner rather than later!</p> <div id='gallery-13' class='gallery galleryid-13934 gallery-columns-3 gallery-size-medium'> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122015.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122015-169x300.png" class="attachment-medium size-medium" alt="" srcset="https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122015-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122015-768x1365.png 768w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122015-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122015.png 1440w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122035.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122035-169x300.png" class="attachment-medium size-medium" alt="" srcset="https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122035-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122035-768x1365.png 768w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122035-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122035.png 1440w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122111.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122111-169x300.png" class="attachment-medium size-medium" alt="" srcset="https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122111-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122111-768x1365.png 768w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122111-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122111.png 1440w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122301.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122301-169x300.png" class="attachment-medium size-medium" alt="" srcset="https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122301-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122301-768x1365.png 768w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122301-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122301.png 1440w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122344.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122344-169x300.png" class="attachment-medium size-medium" alt="" srcset="https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122344-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122344-768x1365.png 768w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122344-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2018/01/device-2018-01-05-122344.png 1440w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> </dl> <br style='clear: both' /> </div> <p>/** v16.0.0 RC 1 / 5 Jan 2018 / 309c42be916d866a28adacb0a4f92d692cbd6009 **/</p> <p>7e9890e tweak default bridge behavior based on locale<br /> fec853c updates to notification for Android O / SDK26<br /> b161043 Merge pull request #106 from Unpublished/fix_binary_search<br /> ab472d5 Merge branch ‘syphyr-master’<br /> 4fc3e7e Merge branch ‘master’ of <a href="https://github.com/syphyr/orbot">https://github.com/syphyr/orbot</a> into syphyr-master<br /> 792ee2b Merge branch ‘BjarniRunar-master’<br /> 0d4a735 Merge branch ‘master’ of <a href="https://github.com/BjarniRunar/orbot">https://github.com/BjarniRunar/orbot</a> into BjarniRunar-master<br /> c7b1441 add comment about app updates URL<br /> d21ff80 update strings and code for switching Locale in app<br /> 5c5790c fix binary search<br /> 38b0063 update build to <sup>16000005</sup>&frasl;<sub>6</sub> for 16.0.0-BETA-2<br /> 7da26a3 update strings from transifex<br /> ce714fa use the proper localized start/end params<br /> 38cc29c externalize more strings<br /> 8bcc9a4 update gitignore<br /> 6e3b6ba add onboarding strings localizatoin<br /> 154e373 ensure appupdater check starts up<br /> 703f8a1 move update back to older (reduce version code)<br /> b556518 move update back to older version<br /> 680d108 update json for testing<br /> e4f6348 test updating json<br /> dafcdd7 enable AppUpdater notificatoins through Github<br /> 3b5a361 update handling of vpn enabled and app onclick<br /> e21474c updates to layout and strings for bridge wizard<br /> 2a9691c make sure the back arrow works<br /> 244231c remove activity no longer used<br /> 0284130 remove out activity no longer used<br /> e487f34 update strings<br /> 8fd0bd0 update tor-android to 0.3.19b (updated geoip databases)<br /> ad51bed update transifex configuration<br /> a08c707 update app store descriptions<br /> 2ced17a update build SDK targets to 26<br /> 5c22de2 manifest updates: remove superuser, enable chromebooks<br /> b4aa9d8 more improvements for bridge wizard<br /> df37b8c add bridge wizard testing code<br /> 14ce4f6 big update for new onboarding, bridge wizard<br /> 2ceacf6 move bridges to raw resources<br /> 938a740 improve vpn app enable view on main activity<br /> ba358a4 add new orfox and settings icon<br /> 5bd5a56 VPN should be off by default<br /> e464044 connection might be null<br /> 51216a4 Add new preference: pref_open_proxy_on_all_interfaces<br /> 21b4521 Update version strings in help-&gt;about<br /> 5500b50 update spuport library version<br /> 546310a improve notifications, add refresh/newnym button<br /> 877406f tweak layout<br /> b68132b fix title for tor app section<br /> 7210223 fix handling of intents<br /> 47e10e7 fix issues with bridge selection UI<br /> e6bd23a more UI updates and small improvements<br /> d9bd32a more UI updates<br /> 7303a33 work on the new UI update<br /> 6a19bf6 update UI tweaks for next release<br /> 3741434 don’t show app selection each time you turn VPN on/off<br /> 4df2fcf move “other” installer back to tor resource installer<br /> f3f9162 don’t delete installed binaries<br /> 6493d8d Merge pull request #104 from igortoliveira/remove-java-file<br /> fc4d6aa improve app loading time for VPN app dialog<br /> fbeff25 Remove leftover Java file<br /> 544ea7b update build to use tor version constant from tor-android-binary<br /> 977167b ZMerge branch ‘master’ of github.com:n8fr8/orbot<br /> b07d4fe removed unused submodules, moved to gradle tor-android<br /> d392ecd remove unneeded external dirs for making tor<br /> 3d729fc switch to using tor-android binary in TorService<br /> 6f364de use the new tor-android gradle dependency <a href="https://github.com/n8fr8/tor-android">https://github.com/n8fr8/tor-android</a><br /> c7f834b moving binary files, use tor-android gradle<br /> 3b5e27e removing external depends, moving to tor-android gradle<br /> 898f64a Merge pull request #99 from goapunk/update-BUILD-instructions<br /> e14d647 update BUILD<br /> fce5bde add autopoint to dependencies<br /> 72c7e04 Merge pull request #97 from SpotComms/padding<br /> 8cf412a Merge pull request #98 from goapunk/add-lzma-zstd-as-dependency<br /> c1dfc29 Update BUILD instructions<br /> 9ca36e1 Add lzma and zstd<br /> 6e4b700 Expose *ConnectionPadding<br /> 71e3464 Merge pull request #94 from Unpublished/fix88<br /> cbffc1d remove some transproxy left overs</p> https://guardianproject.info/2017/12/22/haven-building-the-most-secure-baby-monitor-ever/ Fri, 22 Dec 2017 09:07:00 -0400 https://guardianproject.info/2017/12/22/haven-building-the-most-secure-baby-monitor-ever/ <p>About eight months ago, friends at the <a href="https://freedom.press/">Freedom of the Press Foundation</a> reached out to us, to see if we were interested in prototyping an idea they had been batting around. They knew that from projects like <a href="https://guardianproject.info/apps/camerav">CameraV</a> and <a href="https://guardianproject.info/2017/02/24/combating-fake-news-with-a-smartphone-proof-mode/">ProofMode</a>, that we knew how to tap into the sensors on smartphones to do interesting things. They also knew we could connect devices together using encrypted messaging and onion routing, through our work on <a href="https://chatsecure.org">ChatSecure</a> and Tor (<a href="https://guardianproject.info/apps/orbot">Orbot!</a>). They also knew of our deep interest in bringing ideas to life that can solve real problems faced by people out on the front lines (both at home and abroad), who often are more in danger from physical threats, than digital. They had a concept that would bring all of these things together, and just wanted to see if it was even possible. We were game, and well, here we are today, announcing a real working public beta, and a new open-source project, that we are extremely excited about.</p> <p><strong>IT’S NOT JUST A PHONE</strong></p> <p>At some point soon, we should stop calling the smartphones that over two billion people carry with them everyday and everywhere, phones at all. These devices have powerful processors with multiple cores, at gigahertz speeds, and gigabytes of RAM and storage. They have at least two cameras, now often three, arrays of microphones to capture sound near and far, and high definition, hyper sensitive touch screens for controlling them. They contain multiple radios and signal processors, that allow you to make crystal clear calls to someone on the other side of the planet, live stream 4K video, and download a game all at once. Most importantly, for the work we are announcing today, they contain an amazing variety of sensors, that can measure gravity, motion, air pressure, ambient light, temperature, and your precise location on the planet. I don’t think Alexander Graham Bell ever imagined a telephone doing all of these things. Once you step back from thinking of these devices as phones, and instead as powerful general purpose portable computing platforms, a world of possibilities and potential uses opens up wide. Even better, many people have an old second-hand, last generation device lying around, ready to be transformed into a computing platform much more powerful than a Raspberry Pi or some generic Internet of Shoddy (!) Things platform.</p> <p><strong>A SAFE ROOM IN YOUR POCKET</strong></p> <p>This re-imagining of a smartphone as something more, is what inspired the development of <a href="https://guardianproject.github.io/haven/">Haven</a>, a new open-source project and mobile app we are announcing today, built in partnership with Freedom of the Press Foundation. The concept of <a href="https://guardianproject.github.io/haven/">Haven</a>, as imagined by Micah F. Lee and Edward Snowden, is based on the notion that any smartphone could be turned into a personal, portable security device, to watch for unexpected intrusions into physical spaces.</p> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe src="//www.youtube.com/embed/Fr0wEsISRUw" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe> </div> <p>They call it a “safe room” in your pocket, or way to defeat “evil maid” attacks, that lets you know when you’ve been targeted by a “black bag” operation. I also like to think that through Haven, we have unexpectedly created the most powerful, secure and private baby monitor system ever. By tapping into the sensors and processing power on these devices with custom software, a system could feel the vibrations of someone walking, detect the shine of a flashlight, hear the sound of a door opening (or a child crying), or see someone entering into the view of a camera. All of these “intruder alerts” are recorded on the device, so that the victim can have evidence of their unwanted guest. Even better, they can receive real-time secure and private notifications, with images and sound, as it happens, and take appropriate actions.</p> <p>**YOU ARE THE WATCHER<br /> **</p> <p>An important design goal of Haven, is to not require the user to share data with any third-party, or to have centralized infrastructure. It was clear that some might see Haven as a surveillance device (or “self” sous-veillance), which, regardless of who is in control of it, can be problematic and a vulnerability. Thus, it was a fundamental tenet to not require people to give up privacy, in order to gain security. The person we aim to help must have complete control of the system, the sensors and the captured data and media. In addition, the device must not simply record a stream of video, audio and sensors, hoover-ing up all things. Only when configurable sensor thresholds are crossed, is any data recorded permanently in the log. All of the processing and analysis of the sensor data happens locally on the device, and is only stored locally, and not in a cloud. The device itself can be protected by a strong password and disk encryption, to stop intruders from meddling or accessing any data.</p> <p><strong>SIGNAL’D AND ONION’D</strong></p> <p>If the intruders chooses to destroy or make off with a Haven device, thats fine. The every act of vandalism and theft is detected in progress, and the owner of the device is notified in real-time. All photos and audio can be sent remotely via notifications, ensuring the evidence is safe. Haven does currently support optional plaintext SMS notifications. This does leak some data to the mobile operator or anyone who can access your text messages, that you are using Haven.</p> <p style="text-align: center;"> <a href="https://guardianproject.github.io/haven/docs/preso/" target="_blank" rel="noopener"><img class="aligncenter wp-image-13927 size-large" src="https://guardianproject.info/wp-content/uploads/2017/12/havenpreso-11-1024x576.jpg" alt="" width="945" height="532" srcset="https://guardianproject.info/wp-content/uploads/2017/12/havenpreso-11-1024x576.jpg 1024w, https://guardianproject.info/wp-content/uploads/2017/12/havenpreso-11-300x169.jpg 300w, https://guardianproject.info/wp-content/uploads/2017/12/havenpreso-11-768x432.jpg 768w, https://guardianproject.info/wp-content/uploads/2017/12/havenpreso-11.jpg 1500w" sizes="(max-width: 945px) 100vw, 945px" /></a><em>Click to view our <a href="https://guardianproject.github.io/haven/docs/preso/" target="_blank" rel="noopener">online presentation on Haven</a></em> </p> <p> </p> <p>We provided SMS support because we wanted Haven to be used in parts of the world where mobile internet access isn’t available, is too expensive, or is heavily censored. The notification message sent over SMS provide minimal information to an attacker. Better than SMS, however, is the integrated support for sending fully end-to-end encrypted notifications, with photo and audio attachments, over Signal. This method allows you to use a device without a SIM card, or in airplane mode, since Signal utilizes the internet for communication, not the mobile operator network. Haven also includes support for Tor’s Onion Services, through integration with Orbot, the Tor app for Android. This allows you to activate a web service on your device, and make it accessible via a “.onion” address, which you can access from any Tor-enabled browser, like Tor Browser, Orfox or Onion Browser. This provides a surveillance-free, end-to-end encrypted channel between you and your device, through which you can access all data stored in Haven, past and present.</p> <p><strong>INTERNET OF SHODDY THINGS</strong></p> <p>At this point, you might be saying to yourself “Wait, did these paranoid privacy hackers just building a surveillance camera? Are they trying to sell me on some kind of IoT crap?”. While we didn’t set out to try to address the insane amount of vulnerabilities, insecurities, and fundamental flaws that most most commercial home security devices have, we do admit that our work on Haven crosses over into that problem space. We knew that journalists, activists and others were not interested in setting up cameras and microphones watching themselves <sup>24</sup>&frasl;<sub>7</sub>, streaming to the cloud, as a solution to their threat. We also knew, as discussed before, that linking any solution to a centralized cloud service that asked you to trust them, also didn’t make sense.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2017/12/havenpreso-07.jpg"><img class="aligncenter size-large wp-image-13929" src="https://guardianproject.info/wp-content/uploads/2017/12/havenpreso-07-1024x576.jpg" alt="" width="945" height="532" srcset="https://guardianproject.info/wp-content/uploads/2017/12/havenpreso-07-1024x576.jpg 1024w, https://guardianproject.info/wp-content/uploads/2017/12/havenpreso-07-300x169.jpg 300w, https://guardianproject.info/wp-content/uploads/2017/12/havenpreso-07-768x432.jpg 768w, https://guardianproject.info/wp-content/uploads/2017/12/havenpreso-07.jpg 1500w" sizes="(max-width: 945px) 100vw, 945px" /></a></p> <p>What we’ve built then could be seen as a competitor to commercial solutions, except for a few key points. First, it is freely licensed, and open-source, enabling anyone to audit it, improve it, remix it, and use as they see fit. It runs on any hardware that can support the Android operating system back to version 4.1. This includes not just smartphones, but also tablets, Raspberry Pi’s, TV set top boxes and sticks, and the emerging Android Things platform. This makes it portable, battery powered, and able to run on devices that are readily available for very little money, anywhere in the world. It takes advantage of many more sensors than a typical home security product, and can easily be expanded to support more. Most importantly, all network communications can be encrypted using other open-source gold standards such as Signal and Tor. You can receive notifications from and access in real-time your Haven device anywhere in the world, completely privately, without any third-party even knowing you are doing so. This addresses the primary threat of remote network intruders, device botnets, and legal actions, as well. The goal is for someone to be able to use Haven, without anyone knowing they are.</p> <p>With these innovations, we have set the bar for what a personal security device should be, and do. We know that many people this holiday season will be setting up new cameras around the house, on their front door, in their car… pretty much everywhere, and letting a third-party tap into all of that content. We think that Haven shows a better way, that provides just as much, if not more, peace of mind.</p> <p><strong>THE ROAD AHEAD AND YOU!</strong></p> <p>Today, we are announcing our public beta, and beginning to promote the open-source project. Haven was originally built upon our previous work with CameraV and ProofMode, as well as a project called SecurIt from developer Marco Ziccardi (<a href="https://github.com/mziccard">https://github.com/mziccard</a>), which is how we went from an idea to a pretty cool app in about eight months. The team at Guardian Project, has been doing the bulk of the work up to this point, but as with all of our projects, we look to expand our contributions to the community. If you are interested in this project, for your own use, as an activist, or as a developer, designer or hardware hacker, we need your help. Here’s a quick set of things to do to join:</p> <ul> <li>Check out the <a href="https://github.com/guardianproject/haven/issues">Github issues</a> and the <a href="https://github.com/guardianproject/haven/projects">Prototype Project board,</a> pick some things to work on or provide feedback on<br /></li> <li>Come talk with us at the Guardian Project through our points of contact: <a href="https://guardianproject.info/contact">https://guardianproject.info/contact</a><br /></li> <li>Test Haven out on your hardware and let us know if you find any issues (see <a href="http://havenapp.org">havenapp.org</a> for links)<br /></li> <li>Share your user stories, personas, threats and more, to ensure we are keeping your needs in mind<br /></li> <li>Donate (Bitcoin accepted!) to support our ongoing efforts: <a href="https://freedom.press/donate-support-haven-open-source-project/">https://freedom.press/donate-support-haven-open-source-project/</a></li> </ul> <p>Thanks for reading this far, and being interested in our ongoing work, to ensure people are empowered by mobile technology, and not endangered by it. Happy Holidays, and remember: keep watch, stay safe!</p> <p> </p> https://guardianproject.info/2017/12/18/building-a-signing-server/ Mon, 18 Dec 2017 05:43:34 -0400 https://guardianproject.info/2017/12/18/building-a-signing-server/ <p>The Android APK signing model sets the expectation that the signing key will be the same for the entire lifetime of the app. That can be seen in the recommended lifetype of an Android signing key: <a href="https://developer.android.com/studio/publish/app-signing.html#considerations">20+ years</a>. On top of that, it is difficult to <a href="https://guardianproject.info/2015/12/29/how-to-migrate-your-android-apps-signing-key/">migrate an app to a new key</a>. Since the signing key is an essential part to preventing APKs from impersonating another, Android signing keys must be kept safe for the entire life of the app.</p> <p>The F-Droid repo signing keys follow a very similar model: the signing key is the essential way to safely identify an F-Droid repo. So the same considerations apply to F-Droid repo signing keys as to APK signing keys. This also provides some really useful benefits. Since the integrity of the repo index file and the APKs are guaranteed by the repo signature, the files can be delivered via whatever method is most convenient, and their integrity will be automatically verified by the F-Droid client app, the <em>f-droid.org</em> deploy process, and Repomaker.</p> <p>This means the security burden is shifted from the online, public webserver to a private signing machine. Just keeping that machine out of the public eye goes a long way towards improving security. There are a number of additional measures that can be taken to further improve the security of the signing process. Here are some approaches, starting with the easiest and least security, and going on to more secure setups that require more work to setup and run. Signing is not an resource intensive process, so any machine will work, even a 10 year old, basic laptop. We recommend using a minimal <a href="https://www.debian.org">Debian</a> install, and rebuilding the machine from scratch.</p> <h3 id="automated-signing-server-with-with-hsm">Automated Signing Server with with HSM</h3> <p>For a fully automated signing setup, the machine running the signing needs to be online and running. Ideally this machine would have no remote access, at the very least remote access should be very carefully controlled and monitored. A laptop makes it easy to work with even when remote access is disabled, since it provides a built-in keyboard and monitor. If remote access is required, then any basic PC will work fine. Using a Hardware Security Module (HSM) to store the keys prevents them from being stolen if the server is broken into. An attacker could only run the signing process on that server.</p> <p>Ideally, this machine would only be accessible via Tor. That hides the physical location of the server, and hides the traffic from network. This makes it much harder attackers to find the actual machine to attack.</p> <p>For the HSM, we recommend using <a href="https://www.nitrokey.com/">Nitrokey</a> hardware, since they are free software/hardware, and provide a wide range of options. Use a separate machine to put the signing keys on HSM. A good HSM will keep an audit trail of how many signatures have been made, so that information could be used to create an automatic auditing process to raise alarms if too many signatures have been made. That could mean that this server was breached and used to sign unauthorized packages.</p> <p>Other possibility it to use a setup like <a href="https://pagure.io/sigul">Fedora</a>‘s <a href="http://www.devops-blog.net/koji/gpg-signing-rpms-with-sigul-signing-server-koji-integration">Sigul</a> that involves three machines.</p> <h3 id="basic-laptop-dedicated-to-signing">Basic laptop dedicated to signing</h3> <p>Start with a laptop that can be wiped clean and rebuilt from scratch. What is most important is that only the essential software is installed on it, and nothing else. Do not include any browser at all, for example, since that is the most common vector of attack. No remote access setup (e.g. SSH or VNC) should be installed or configured. To sign apps and repos, someone would take out this laptop, connect it to the network, and run the signing process. The signed results can then be published via the network connection. When the signing is complete, the machine can be turned off and disconnected and kept in a safe place.</p> <p>This could be made quite automatic with some custom scripts. The person running the process would only need to take out the machine, connect it, turn it on, wait until the process completes, then put it all away again.</p> <h3 id="fully-offline-signing-laptop-with-usb-thumb-drives">Fully offline signing laptop with USB thumb drives</h3> <p>_<strong>update</strong>: apt-offline has a <a href="https://bugs.debian.org/871656">security bug</a> so it was removed from Debian/buster. It is no longer recommended! Instead, use the Debian &ldquo;<a href="https://www.debian.org/doc/manuals/apt-offline">apt offline</a>&rdquo; setup._</p> <p>This process is based on the same basic, stripped down laptop as the previous example. But this time, the networking should be entirely disabled before the install process. For example, it is easy in many laptops to physically remove the WiFi card. Therefore, it makes sense to use a laptop that does not include an ethernet jack, which are usually not possible to remove. Otherwise, blacklisting all kernel modules related to neworking can suffice. Since this machine is fully offline, the extra work of using an HSM is not as important, but it can’t hurt to include it.</p> <p>Download the full &ldquo;CD&rdquo; or &ldquo;DVD&rdquo; image of Debian to run the install. Be sure to <a href="https://www.debian.org/CD/verify">verify</a> the GPG signatures and the SHA-256 hashes. One essential utility is <em>apt-offline</em>, which automates the process of downloading Debian packages, verifying their signatures, and copying them over to an offline machine.</p> <p>To be extra careful, all of the software used should be verified. Chromebooks are nice, cheap laptops that run Linux natively. They also use Coreboot for the BIOS.</p> <p><li id="buy-a-computer-off-the-shelf-with-cash-avoid-having-it-shipped-especially-across-borders"> Buy a computer off the shelf with cash, avoid having it shipped, especially across borders </li> <li id="buy-a-debian-supported-chromebook-with-removeable-wifi-hardware-and-needs-no-binary-blobs"> Buy a Debian-supported <a href="https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/acer-c720-chromebook">Chromebook</a> with removeable WiFi hardware, and needs no binary blobs </li> <li id="install-a-reproducibly-built-coreboot-binary"> Install a reproducibly built coreboot binary </li> <li id="install-from-a-reproducibly-built-debian-image-wiping-out-chrome-os-entirely"> Install from a reproducibly built Debian image, wiping out Chrome OS entirely </li></p> <h2 id="the-physical-environment">The Physical Environment</h2> <p>The last thing to consider is the physical location where signatures happen, and where essential equipment is stored. The signing environment must be physically secure. Otherwise, there is no way to prevent laptops or HSMs from being lost or used to sign inappropriate content. For the offline machines, keeping them in a locked room is a good start. For an online machine, forcing all network traffic and remote access over Tor hides the physical location of the machine from network observers.</p> <p>For high risk signing keys, using multiple layers of defense is important:</p> <p></p></p> <ul> <li>Restricted physical access to HSMs or smart cards</li> <li>Security cameras</li> <li>Onsite security guards</li> <li>Visitor logging</li> <li>A tools-resistant server safe for online code-signing servers</li> </ul> <p>The signing server should be physically separate from the rest of the infrastructure. And the logs, machine, and network should be periodically audited.</p> <h2 id="difficult-decisions">Difficult decisions</h2> <p>Ideally all of these practices would be put into place, but each of these security measures comes at a cost of difficulty, expense, and complexity. They can also delay the process of getting regular updates out. So there are risks of implementing too strict security policies, much like the risks of not implementing enough.</p> https://guardianproject.info/code/wind/ Wed, 15 Nov 2017 18:11:44 -0400 https://guardianproject.info/code/wind/ <div class="source-code" style="text-align: center;"> <a href="https://github.com/guardianproject/wind" target="_blank" title="Wind on Github"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/wind" target="_blank" title="Wind blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <p>When disaster strikes, connectivity becomes difficult. Information can save your life, guiding you to safety and services. Networks today are fragile and easy overloaded. There has not been enough investment in the many other possible nets, that may be better suited for situations where connections to the global internet are not available or affordable. The potential in radios, sensors and processing available in the cheapest of smartphones and routers are not fully utilized or realized.</p> <p>Wind is a network designed for opportunistic communication and sharing of local knowledge. It is built on impermanence, movement, and spontaneity.  Wind is a direct counterpoint to the metaphor of the Web, a system built upon the concept of fixed physical nodes, centralized authorities and permanent links. It is rooted in the mindsets and needs of people and communities who face challenges communicating. Wind is shaped by the movements and density of people in time and space.</p> <h2 id="background-information">Background Information</h2> <ul> <li><a href="https://guardianproject.info/wind/video/">Videos about the Team</a></li> <li><a href="https://guardianproject.info/wind/code/">Simulations, Code, and Design Info</a></li> </ul> <h2 id="source-code-public-works">Source code &amp; Public Works</h2> <ul> <li><a href="https://github.com/guardianproject/wind">Wind Project Primary Repo</a></li> <li><a href="https://github.com/n8fr8/windfarm">WindFarm Concept and Workshops</a></li> <li><a href="https://github.com/guardianproject/viento">Github: Viento Latin America Localization Efforts</a></li> </ul> <div id='gallery-16' class='gallery galleryid-13885 gallery-columns-1 gallery-size-large'> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <img width="945" height="945" src="https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-1-1024x1024.jpg" class="attachment-large size-large" alt="" srcset="https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-1-1024x1024.jpg 1024w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-1-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-1-300x300.jpg 300w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-1-768x768.jpg 768w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-1.jpg 1275w" sizes="(max-width: 945px) 100vw, 945px" /> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <img width="945" height="945" src="https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-2-1024x1024.jpg" class="attachment-large size-large" alt="" srcset="https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-2-1024x1024.jpg 1024w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-2-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-2-300x300.jpg 300w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-2-768x768.jpg 768w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-2.jpg 1275w" sizes="(max-width: 945px) 100vw, 945px" /> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <img width="945" height="945" src="https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-3-1024x1024.jpg" class="attachment-large size-large" alt="" srcset="https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-3-1024x1024.jpg 1024w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-3-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-3-300x300.jpg 300w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-3-768x768.jpg 768w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-3.jpg 1275w" sizes="(max-width: 945px) 100vw, 945px" /> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <img width="945" height="945" src="https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-4-1024x1024.jpg" class="attachment-large size-large" alt="" srcset="https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-4-1024x1024.jpg 1024w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-4-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-4-300x300.jpg 300w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-4-768x768.jpg 768w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-4.jpg 1275w" sizes="(max-width: 945px) 100vw, 945px" /> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <img width="945" height="945" src="https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-5-1024x1024.jpg" class="attachment-large size-large" alt="" srcset="https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-5-1024x1024.jpg 1024w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-5-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-5-300x300.jpg 300w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-5-768x768.jpg 768w, https://guardianproject.info/wp-content/uploads/2017/11/wind_v3-5.jpg 1275w" sizes="(max-width: 945px) 100vw, 945px" /> </dt> </dl> <br style="clear: both" /> </div> <p><strong>Wind Poster Credits:</strong></p> <p>Written by Nathan Freitas, Guardian Project</p> <p>Editing and graphics by Carrie Winfrey, Okthanks</p> <p><span>Starlings—“</span><a href="https://www.flickr.com/photos/aaddaamn/5196833268/in/photolist-8Ve8tA-bnhGui-8VYWvL-n6QNW6-quZbvB-kbMjgm-dPLU92-5UrUaL-4Lsy65-b41NaM-3xZDq1-iRTAf4-79knxP-c1aj9Y-ZKS7KG-5ZgEFz-aAVfHW-aASykr-7FpmSM-GQD9rb-ThFKXR-fJrWmx-c4n5pf-aAVfY1-84jiWw-t2zJq8-awFd1o-7e2hk4-98vFR6-7Ftgas-5ZkSbE-buNgx5-d355eo-9vsxzx-3TjpyT-jDmwUz-69zuaC-dbioDU-SJbyqE-r5uAFS-igNVC9-cznfHs-Ctjvvh-pRjFGX-6qxUmM-3ToRYA-atpB9i-ULiew8-dMhLvh-qU8qc4"><span>A murmuration of starlings</span></a><span>” by Adam is licensed under CC BY 2.0.</span> <a href="https://creativecommons.org/licenses/by/2.0/"><span>The image is a derivative of the original. </span></a></p> <p><span>Survivor—“</span><a href="https://www.flickr.com/photos/11401580@N03/12024210833/in/photolist-jjxdXT-7Pvvvy-7PvvtQ-qTg64L-pYLEJt-kyDQkz-4FiN3C-7XA986-7GWBYW-7GSFSH-EYcWsg-qD8rZe-6ZANRo-qD6LY2-7ZhJp9-8BrGxG-7XA8Xa-8rmXYp-5bxFWE-9A4JC6-8rbVJJ-7XPzUg-7CdEpg-7ChtS7-7of72j-87zH7W-kq1WDX-8rbVd1-ach6FJ-8QLHQd-qD8r7T-7wCxrF-7512Ws-7XA9kV-qVtAwJ-eKKBXf-hucSca-7PrwEB-7PrwrR-gHXPXR-7GWBWq-9fwLth-7PrwHz-bVsoe7-6zpwL7-9AqNAS-7kzB4h-gHWARA-7PrwG8-7PrwKe"><span>Wat Pathum Wanaram</span></a><span>” by Adaptor-Plug is licensed under CC BY-NC 2.0</span></p> <p><span>Community Organizer—“</span><a href="https://www.flickr.com/photos/chabadlubavitch/36571284030/in/photolist-XHFoBQ-XsH3xS-qJMexo-Yah2cN-5nrQZQ-5ns88Y-5m5dc2-89ZKZN-5nrCSh-5m6Y8a-5mRrrf-63N762-5myMwP-5mbf99-5myM5Z-5mD2ms-5mQ6bT-5opTZP-5oudCE-5myMkV-XZG52Y-7CPBy3-5mD2DU-5nnPdA-Y461cD-Y2mqzy-X1qQrA-WXjfD5-X3VmVU-Y3LKzu-X3VmwN-Y2mrrU-X6fP1D-X3VnwU-5mD2zf-5myMoz-quC8nx-5myMrR-5mQ5Li-5mQ652-5mUmhu-5mUkYA-5mQ6fg-5mQ5Qx-5mUmo5-7CKq5t-63N75n-5mD2e3-5mUm9q-YoFPpr"><span>DSC_2318</span></a><span>” by Chabad Lubavitch is licensed under CC BY 2.0</span></p> <p><span>Medical worker—“</span><a href="https://www.flickr.com/photos/leecannon/7168489648/in/photolist-bVsoe7-6zpwL7-9AqNAS-7kzB4h-gHWARA-7PrwG8-7PrwKe-9wsZpY-a5LQun-oYfy4C-gHWPSJ-ozVYaS-pfsVa8-8SQ4KC-8SPMEW-dS6BQY-Des66N-JuBs3u-avt7mZ-qCZPp7-JdjwY3-8QLJ2y-7GSFUn-92Z3YP-h5NuC3-9wpZci-jHGmmK-qpgv79-5rZktF-qCZR5b-pYLFBR-aqqxF1-qCZQaW-qCZP2o-pYLEFx-5mP98E-kyG2C9-5pmwpc-bHguS4-jdYkSF-7Chtef-5SGGe9-pYxYvh-5S8Z2M-bYtuVu-949wzU-7MmMZW-akK9uZ-pYxZPj-SLnrTd"><span>Me</span></a><span>” by Lee Cannon is licensed under CC BY-SA 2.0</span></p> <p><span>Journalist—“</span><a href="https://www.flickr.com/photos/chabadlubavitch/36787344602/in/photolist-Y3LKU7-X3VmE3-Y39j6j-Y2mtwq-XHFmUm-XHFn51-Y3vyyF-X6fNwc-YiVAxr-XDQL3m-Y7n7rc-Y3vywM-Y2msXu-XHFnby-5mQ6Cv-63Sk4u-5Mtwn4-XUVKh5-Yh9oWM-X3VnuE-63N752-Yah2aJ-Y39iVu-X3VnrU-Y7nj4R-WZsgmZ-WZsghR-X3VmSN-YCWSd4-5mpVHZ-X7PRHw-YAhjsE-XzxMQm-WZsgkg-WZsgg8-WZsgeV-X1qQpw-WZsgoc-Y39iPN-XDQKyf-Y3LLyJ-XDXUeN-XDQKEC-X2zCEz-XZSuty-XZSutU-Y3vyxP-XZSVRs-X2zcp4-X6fNEP"><span>DSCF52321</span></a><span>” by Chabad Lubavitch is licensed under CC BY 2.0</span></p> <p>&nbsp;</p> <p><span>“</span><a href="https://thenounproject.com/search/?q=beacon&amp;i=757256"><span>Headlight</span></a><span>” icon by Identidea, from</span> <a href="https://thenounproject.com/"><span>the Noun Project</span></a></p> <p><span>“</span><a href="https://thenounproject.com/search/?q=network&amp;i=1334022"><span>Network</span></a><span>” icon by UNiCORN, from </span><a href="https://thenounproject.com/"><span>the Noun Project</span></a></p> <p><span>“</span><a href="https://thenounproject.com/search/?q=router&amp;i=1406112"><span>Router</span></a><span>” icon by Focus, from</span> <a href="https://thenounproject.com/"><span>the Noun Project</span></a></p> <p><span>“</span><a href="https://thenounproject.com/search/?q=verified&amp;i=1248910"><span>Verified</span></a><span>” icon by Bestdesignmarket, from</span> <a href="https://thenounproject.com/"><span>the Noun Project</span></a></p> https://guardianproject.info/2017/10/27/no-more-root-features-in-orbot-use-orfox-vpn-instead/ Fri, 27 Oct 2017 13:02:02 -0400 https://guardianproject.info/2017/10/27/no-more-root-features-in-orbot-use-orfox-vpn-instead/ <p>Since I first announced the available of Orbot: Tor for Android about <a href="https://nathan.freitas.net/2009/10/22/orbot-proxy/">8 years ago</a> (wow!), myself and others have been working on various methods in which to make the capabilities of Tor available through the operating system. This post is to announce that as of the next, imminent release, <a href="https://github.com/n8fr8/orbot/releases/tag/15.5.0-RC-1-multi-SDK16">Orbot v15.5,</a> we will no longer be supporting the Root-required “Transproxy” method. This is due to many reasons.</p> <p>First, it turns out that allowing applications to get “root” access on your device seems like a good idea, it can also be seen as huge security hole. I am on the fence myself, but considering that the ability to access root features hasn’t been standardized as part of Android, which 8 years ago I hoped it would, it means there are a whole variety of ways that this capability is managed and safeguarded (or not, in most cases). At this point in time, given the sophistication we are seeing mobile malware and rootkits, it seems like a capability that we did not want to focus time and energy on promoting.</p> <p>Second, for those who do want to use root features, and know what they are doing, there are a bunch of other apps that do that job better than Orbot did. I admit, we let our code in that area degrade a bit, as the dev team themselves moved away from phones with root features. So, instead, if you really want to do cool things with iptables rules, you can use AFWall+, available on <a href="https://f-droid.org/packages/dev.ukanth.ufirewall/">F-Droid</a> and <a href="https://play.google.com/store/apps/details?id=dev.ukanth.ufirewall">Google Play</a>.</p> <p><img class="alignnone " src="https://raw.githubusercontent.com/ukanth/afwall/0502e6f17ceda08069720ff2f260902690e65e9b/screenshots/Main_2.0.png" width="240" height="384" /></p> <p>In order to make AFWall+ work with Orbot, you can follow Mike Perry’s excellent <a href="https://blog.torproject.org/mission-impossible-hardening-android-security-and-privacy">“Mission Impossible Android”</a> guide in which he provides “DroidWall Scripts” necessary to enable automatic Tor routing on boot. You can also check out the sadly no longer maintained, but useful, <a href="https://orwall.org/">Orwall app</a> which was meant to take on all the root features of Orbot.</p> <p>Third, we really, really think it is a bad idea to just send all of the traffic of your device through the Tor network. While it sounds like a great idea in theory, much like many “magical” Tor router kickstarter projects, it turns out that unless you can be assured an app is using TLS properly, then there is a chance that bad things could happen to your traffic as it exits the Tor network. Rather than promote some kind of auto-magical “enable Tor for my whole device”, we want to focus on ways to enable specific apps to go through Tor, in a way we can ensure is as safe as possible.</p> <p>For instance, we now have an excellent browser app, <a href="https://guardianproject.info/apps/orfox">Orfox</a>, that is based on Tor Browser, and works perfectly with Orbot. If you just want to access the web and onion services, like the <a href="https://open.nytimes.com/https-open-nytimes-com-the-new-york-times-as-a-tor-onion-service-e0d0b67b7482">new New York Times onion</a> at <a href="https://www.nytimes3xbfgragh.onion/">https://www.nytimes3xbfgragh.onion/</a>, then just use <a href="https://guardianproject.info/apps/orfox">Orfox</a>. There is no need for any fancy rooting or transproxying. There are also many others that supporting routing through Orbot directly, such as Conversations.im, Facebook for Android, DuckDuckGo, F-Droid, OpenArchive and many more to come! If you are interested in enabling your app to work with Orbot, check out our <a href="https://github.com/guardianproject/netcipher">NetCipher SDK</a>, which makes it easy to do just that.</p> <p>Fourth, Orbot has for some time supported use of Android’s VPN features as a way to tunnel traffic through Tor. You just open the left-side menu, and tap “Apps VPN Mode” or tap on “Apps…” on the main screen. Choose the apps you want to run through Tor, press the back button, and then the VPN will start up, rerouting outbound traffic back through the local Tor port. This method is 100% support by Android, and requires no vulnerabilities or exploits of your device to gain root access.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn3.png"><img class="alignnone size-medium wp-image-13829" src="https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn3-169x300.png" alt="" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn3-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn3-768x1365.png 768w, https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn3-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn3.png 1080w" sizes="(max-width: 169px) 100vw, 169px" /></a> <a href="https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn2.png"><img class="alignnone size-medium wp-image-13830" src="https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn2-169x300.png" alt="" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn2-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn2-768x1365.png 768w, https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn2-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn2.png 1080w" sizes="(max-width: 169px) 100vw, 169px" /></a> <a href="https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn1.png"><img class="alignnone size-medium wp-image-13831" src="https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn1-169x300.png" alt="" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn1-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn1-768x1365.png 768w, https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn1-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2017/10/orbotvpn1.png 1080w" sizes="(max-width: 169px) 100vw, 169px" /><br /> Orbot Apps VPN view, home screen with Apps… button, and VPN sidebar</a></p> <p>I know that even with all of these justifications, some users will be disappointed with the fact we have removed root features from Orbot. Perhaps that will motivate some to reignite development of Orwall, or maybe help us make the VPN features in Orbot work even better. Another route is to support the <a href="https://blog.torproject.org/mission-impossible-hardening-android-security-and-privacy">Tor’s Android phone prototype</a> or perhaps integrate Tor “root” features directly into a community Android OS project like Copperhead or Legacy. We would be happy to see all of these happen.</p> <p>For us, though, removing root means we can focus on making Orbot more streamlined, more stable, and more compatible with Android, for our 2 million+ active users, who are mostly focused on finding an easy solution for unblocking sites and apps, and allowing them to communicate and browse freely without fear of reprisal.</p> <p> </p> <p> </p> https://guardianproject.info/2017/08/10/ostel.co-is-permanently-offline/ Thu, 10 Aug 2017 17:16:51 -0400 https://guardianproject.info/2017/08/10/ostel.co-is-permanently-offline/ <p>We are sad to announce that the <a href="https://guardianproject.info/apps/ostel/">Ostel service</a> is officially discontinued and permanently offline. While Guardian Project had a hand <a href="https://dev.guardianproject.info/projects/ostel/wiki">in its conception and initial implementation</a>, the actual operation of the service was <a href="https://guardianproject.info/2013/12/03/ostel-co-secure-voip-network-partners-with-open-hosting/">spun out long ago</a> to be run by a new venture a member of our original team. They have kept Ostel running free of charge for many years of reliable service, but at this point it seems, they have decided they can no longer do so.</p> <p>In recent months, we had discussed with them a gentle transition period to a new platform or service. Unfortunately, it seems like they decided to just pull the plug. Our apologies for the abruptness of this closure.</p> <p>The good news is that since the server has no user data, logs, or other sensitive content, you have lost nothing, and have nothing to fear related to your personal information. The even better news is that encrypted video and voice calling over the Internet, is easier than ever, with Signal, Wire, JitsiMeet, Matrix, Riot, Linphone and many, many other options.</p> <p> </p> <p> </p> <p> </p> https://guardianproject.info/2017/06/29/repomaker-usability-trainers-worldwide-june-2017/ Thu, 29 Jun 2017 08:13:04 -0400 https://guardianproject.info/2017/06/29/repomaker-usability-trainers-worldwide-june-2017/ <h1 id="repomaker-usability-trainers-worldwide-study-p">Repomaker Usability, Trainers Worldwide Study</p></h1> <p>Prepared by Carrie Winfrey and Tiffany Robertson, Okthanks, in partnership with F-Droid and Guardian Project</p> <div id="attachment_13844" style="width: 310px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2017/06/okt-gp.png"><img aria-describedby="caption-attachment-13844" src="https://guardianproject.info/wp-content/uploads/2017/06/okt-gp-300x72.png" alt="" width="300" height="72" class="size-medium wp-image-13844" srcset="https://guardianproject.info/wp-content/uploads/2017/06/okt-gp-300x72.png 300w, https://guardianproject.info/wp-content/uploads/2017/06/okt-gp-768x184.png 768w, https://guardianproject.info/wp-content/uploads/2017/06/okt-gp-1024x246.png 1024w" sizes="(max-width: 300px) 100vw, 300px" /></a> <p id="caption-attachment-13844" class="wp-caption-text"> OK Thanks – Guardian Project </p> </div> <p>For more information, contact ca&#x72;&#x72;&#x69;e@o&#x6b;&#x74;han&#x6b;&#x73;.co&#x6d;.</p> <h1 id="purpose">Purpose</h1> <p>The purpose of this study was to understand the following things.</p> <ul> <li>Are users able to complete basic tasks including, creating a repo, adding apps from other repos, removing apps, editing app details, and creating a second repo?</li> <li>Do participants understand how to get the apps from a repo installed on an Android phone?</li> <li>Word choice—Do people understand the word repo?</li> <li>Is repomaker a useful tool to participants?</p></li> </ul> <h1 id="methodology">Methodology</h1> <p>The study was hosted via video calls with potential users within our target audience. It was focused on the trainer use case. The narrative below describes the target use case.</p></p> <p><strong>Narrative.</strong> You live or teach people in a location with poor internet quality. Your wifi and data connection are not reliable, and rarely can you use Google Play to get apps and app updates on your phone. This makes it difficult to do your job. As an instructor, your job is to train journalists how to stay safe while using their phones. You teach them ways to keep their communications and media private.</p></p> <p>The study consisted of 3 parts.</p> <ol> <li><strong>Usability study.</strong> Participants were asked to use Repomaker to complete tasks as we prompted them to do so. After completing the tasks, participants were asked to rate its level of difficulty.</li> </ol> <h4 id="task-list">Task List:</h4> <ol> <li>Login to the app. Create a repo and add three apps that are useful for the journalists you train.</li> <li>Add the Twitter app.</li> <li>Add the Courier app from the Guardian Project’s repo.</li> <li>Add a description to the Courier app.</li> <li>Remove an app from your repo.</li> <li>Create a second repo. You don’t need to add any apps.</li> <li>Reopen your first repo.</li> <li>Share your first repo with your journalists.</li> <li>Open the page you just shared.</li> <li><p>Talk through how your journalists would add this repo to their android phone.</p> <ol> <li><p><strong>Debrief.</strong> The following questions were discussed. <ol type="a"> <li> Would the individuals you train feel comfortable downloading F-Droid in order to get access to the apps in a repo? (Note: F-droid cannot be downloaded from the Google Play store. It can be downloaded directly from the fdroid.org website or received over bluetooth from someone in the same room. Also, downloading F-Droid requires you to enable unknown sources on your phone.) </li> <li> Please tell me how Repomaker would be useful for you? </li> </ol></p></li> <li><p><strong>Survey.</strong> Users were asked to complete the survey immediately after the video call:<a href="https://goo.gl/forms/Acq4zYB3KOtQPxBa2">https://goo.gl/forms/Acq4zYB3KOtQPxBa2</a></li> </ol></p></li> </ol> <h4 id="what-was-tested-link-to-youtube-video-https-youtu-be-do9bxqsex4g-p">What was tested: <a href="https://youtu.be/do9bxqSeX4g">Link to youtube video</a>. </p></h4> <h1 id="participants">Participants</h1> <p>9 people participated in the study from countries including Guyana, India, Pakistan, United States and Zimbabwe. 50% of have experience training. View Demographic stats</p></p> <p>Participants were thanked with a $20 gift card to Amazon or Google Play.</p></p> <h1 id="main-takeaways">Main Takeaways</h1> <p>In general, people are excited about this tool. A majority of the participants feel that the interface is straight-forward and easy to use. 8 of 9 participants felt that Repomaker is a useful tool and would use it. It is most useful for distributing apps in cases where there is no internet connection. See notable survey results <a href="#heading=h.paz3gb4hmvya">Biggest Challenge</a>.</p></p> <ol> <li>Users need a core understanding of F-Droid and how it works</li> <li><p>The majority of participants felt that they would need to understand F-Droid first before using Repomaker. More info in task 10</li> </ul></p> <h4 id="suggested-improvements">Suggested Improvements:</h4> <ul> <li>We need to talk about F-Droid in a way that is familiar to non-technical users. <ul> <li>For example: F-Droid is an independent, community-sourced app store. You can customize it by adding repos, collections of apps shared by sources you trust.</li> </ul></li> <li>Make a strong brand connection between Repomaker and F-Droid. Users need to understand that Repomaker is part of F-Droid.</li> <li>Provide step-by-step instructions for installing F-Droid and installing apps from a repo on an Android phone.</li> <li>Consider the touchpoints for a first time user— <ul> <li>Goes to the F-Droid website</li> <li>Views Repomaker page (on the F-Droid website)</li> <li>Launches Repomaker</li> <li>Opens in a new tab to Login/Signup view.</li> <li>Select Sign Up. Enter info. Action button says “Create my first repo”</li> <li>New repo view</li> <li>Single repo empty view <br /></li> </ul></li> </ul> <h2 id="p"></p></h2> <h2 id="2-repo-is-an-abstract-concept">2. Repo is an abstract concept</h2> <ul> <li>Most participants understood this after they started using the app. Link to survey result</li> <li><p>Though, upon first use, many participants tapped the ‘Add’ button instead of ‘Add from repos’ because they were unsure what ‘Add from repos’ meant. More info in task 1</li> </ul></p> <h4 id="suggested-improvements-1">Suggested Improvements:</h4> <ul> <li>Use the wording “Browse gallery” instead of “Add from repos”.</li> <li>Indicate how much stuff is there (2,000 apps, …)</li> <li><p>Use less words in the single repo empty state view. **TICKET #120</li></p> <ul> <li>Provide blurbs about what a repo and and what they can be used for.</ul> <br /></li> </ul> <h2 id="3-participants-had-questions-and-concerns-about-editing">3. Participants had questions and concerns about editing</h2> <ul> <li>Many participants were surprised they could edit apps from other people and commented that they wouldn’t have known they could do it if we hadn’t asked them to do so.</li> <li>One participant was unsure if the editing function worked like a Wiki and would update everywhere, or if it would only appear in her repo.</li> <li>One participant commented that liked that she could add her own translations.</li> <li>Some participants expressed their concern about the security of this feature.</li> <li>UI for editing is confusing. Description box takes a long time to load and requires scrolling to see.</li> <li><a href="#heading=h.om0y9gk1w74z">More info in task 4</a> <br /></li> </ul> <h4 id="suggested-improvements-2">Suggested Improvements:</h4> <ul> <li>Address questions and concerns in a FAQ page</li> <li>Show bar on editing page, when editing a file from another repo. Ticket ..</li> <li>Allow the name and developer to be entered only when the first version of a file is added. Do not allow this to be changed afterward.</li> <li><p>Add hints to summary and description field. **TICKET #103</li></p> <ul> <li>Provide ‘save’ buttons under text sections rather than one ‘done’ button for the entire page.</li> <li><p>Offer translation option within Repomaker **TICKET #58</li></p> <ul> <li>If it comes from a remote repository AND there is text in the field, then make it read-only.</li> <li>Hook into FAQ about why you can edit things.</ul> <br /></li> </ul> <h2 id="4-people-have-concerns-about-the-security-of-repomaker">4. People have concerns about the security of Repomaker</h2> <ul> <li>Some participants shared concern about people being able to masquerade an app with the editing feature.</li> <li>One participant was unsure how public the repo was when she was creating it, and was hesitant about how she named it.</li> <li>One participant commented that she didn’t want to be responsible for sharing non-secure apps. <br /></li> </ul> <h4 id="suggested-improvements-3">Suggested Improvements:</h4> <ul> <li>Allow the name and developer to be entered only when the first version of a file is added. Do not allow this to be changed afterward.</li> <li>Provide clear information when a repo is created about who has access to the repo.</li> <li>Provide a clear ‘publish’ step, so that users know when I repo is made visible to others.</li> <li>Address concerns in a FAQ. <br /></li> </ul> <h2 id="5-ui-for-search-and-filters-in-the-other-repo-browse-view-is-unclear">5. UI for search and filters in the ‘Other Repo/Browse’ view is unclear</h2> <ul> <li>It’s unclear that you’re searching within a category if you have one selected.</li> <li>Most participants commented that they wanted a clear way to go back from this view. Some would tap back in the browser and changes wouldn’t be saved.</li> <li><a href="#heading=h.iximbencraon">More info in task 2</a> <br /></li> </ul> <h4 id="suggested-improvements-4">Suggested Improvements:</h4> <ul> <li><p>Redesign how search and filters work together in the UI **TICKET #119</li></p> <ul> <li>Add apps immediately once selected. Offer the option to remove rather than being able to ‘uncheck’.</li> <li>Count apps when added.</ul> <br /></li> </ul> <p>****</p> </p></p> <h1 id="page-break-pagebreak">PAGE_BREAK: PageBreak</h1> <h1 id="usability-metrics">Usability Metrics</h1> <p>Usability metrics refers to participant performance when completing the assigned tasks. This is includes completion success rates, error rates, time to task completion and subjective evaluations/interviews. </p></p> <ul> <li><strong>Critical Errors</strong>: Critical errors are reported as errors that result in failure to complete the task. Participants may or may not be aware that the task goal is incorrect or incomplete. Independent completion of the task is the goal; help from the test facilitator or others is to be marked as a critical error.</li> <li><strong>Non-critical Errors</strong>: Non-critical errors are errors that the participant recovers from alone and are not such that the participant can no longer complete the task. They can include errors such as excessive steps taken to complete a task or initially using an incorrect function but recovering from that incorrect step.</li> <li><strong>No Problem</strong>: A qualitative analysis of users ability to complete the task with seemingly ‘no problems’. However, this does not mean that non-critical errors were <em>not</em> made while completing the task. </p> <br /></li> </ul> <p><strong>Level of Difficulty:</strong></p> <p>The participants were asked to rate the level of difficulty per task as they completed them.</p> </p></p> <p style="text-align:center;"> <img src="https://guardianproject.info/wp-content/uploads/2017/06/null2.png" width="624" height="393" alt="" title="" /> </p> <ul> <li>Task 1: Create a repo and add 3 apps. <ul> <li>Users becoming familiar with interface also many believed once they hit ‘add’ and saw the blue button their app had been added or saved to their repo.</li> </ul></li> <li>Task 3: Add the Courier app from the Guardian Project’s repo. <ul> <li>Rated lowest level of difficulty because users have become familiar with the interface.</li> </ul></li> <li>Task 5: Remove an app. <ul> <li>Rated highest level of difficulty because users felt there were too many steps involved and most expected to be able to remove an app from the repos view.</li> </ul></li> <li>Task 6: Create a second repo.</li> <li>Task 8: Share your first repo with the journalist you train. <br /></li> </ul> <hr /> <hr /> <p><strong>Average Critical Error Rate:</strong></p> <p>Critical errors are reported as errors that result in failure to complete the task. Participants may or may not be aware that the task goal is incorrect or incomplete. Independent completion of the task is the goal. Help from the test facilitator or others is to be marked as a critical error. </p></p> <p style="text-align:center;"> <img src="https://guardianproject.info/wp-content/uploads/2017/06/null3.png" width="624" height="390" alt="" title="" /> </p> <p style="text-align:center;"> <p style="text-align:center;"> <ul> <li> Task 1: One participant unable to complete the task without help from the facilitator. <ul> <li> Participant thought she could add anything from her applications folder on her computer. </li> </ul> </li> <li> Task 3: One participant unable to compete the task without her from the facilitator. <ul> <li> The Courier app was already in their repo and they didn’t see the error so when clicking the ‘done’ button they were not brought back to their repo. </li> </ul> </li> <li> Task 4: Two participants unable to complete the task. <ul> <li> Added the description to the summary field only (instead of the correct text box). </li> </ul> </li> <li> Task 5: One participant unable to complete the task. <ul> <li> Opened and closed app index and app details twice. </li> <li> Couldn’t figure it out from the repo view and didn’t choose ‘edit’ in the app details view because they weren’t making edits to the app just the repo. </li> </ul> </li> <li> Task 8: One person was unable to complete the task. <ul> <li> They tried to get the repo added to their phone first, but was technically unable to do so because of storage limitations. </li> </ul> </li> </ul> <p> <b></b> </p> <pre><code>&lt;p&gt; &lt;b&gt;Average Non-critical Error Rate:&lt;/b&gt; &lt;/p&gt; &lt;p&gt; Non-critical errors are errors that the participant recovers from alone and are not such that the participant can no longer complete the task. They can include errors such as excessive steps taken to complete a task or initially using an incorrect function but recovering from that incorrect step. &lt;/p&gt; </code></pre> <p></p></p> <p><p style="text-align:center;"> <img src="https://guardianproject.info/wp-content/uploads/2017/06/null4.png" width="612" height="354" alt="" title="" /> </p> </p></p> <ul> <li>Task 1 &amp; 2: Participants learning the interface and multiple steps required to complete the task. <ul> <li>Unfamiliar with the word repo.</li> <li>Were distracted by the ‘add’ button on repo page.</li> <li>Issues with adding from other repos-See details in tasks 1 &amp; 2.</li> <li>Blue check didn’t conform to their expectations.</li> </ul></li> <li>Task 5: Too many steps involved. Many thought this action would be found within the repo view.</li> <li>Task 8: Participants tapped the ‘copy link’ button and after seeing the blue check thought they were finished, but not confident in what just happened. Afterwards, copying and pasting the link in a new tab.</p> <br /></li> </ul> <h1 id="page-break-pagebreak-1">PAGE_BREAK: PageBreak</h1> <h1 id="task-specific-findings-p">Task Specific Findings</p></h1> <h2 id="task-1-login-to-the-app-create-a-repo-and-add-three-apps-that-are-useful-for-the-journalists-you-train">Task 1: Login to the app. Create a repo and add three apps that are useful for the journalists you train.</h2> <ul> <li><strong>Average Difficulty</strong>: 1.83</li> <li><strong>Number of Participants with Critical Errors</strong>: 1</li> <li><strong>No problem</strong> – <sup>4</sup>&frasl;<sub>9</sub> (44%)<img src="https://guardianproject.info/wp-content/uploads/2017/06/image.png" width="693" height="381" alt="" title="" /> <br /></li> </ul> <p>__</p> <p>__</p> <p style="text-align:center;"> <i>“I wouldn’t actually put the country name, because I’m not sure how public this is.” (Participant 9)</i> </p> <p style="text-align:center;"> <i></i> </p> <p style="text-align:center;"> <i>“I don’t want to be responsible for sending out non-secure apps.” </i> </p> <p style="text-align:center;"> (Participant 5) </p> <h4 id="observations">Observations:</h4> <p>Apps Index View – Before Apps are Added</p> <ul> <li>Clicked ‘add’ first – <sup>4</sup>&frasl;<sub>9</sub> (44%)</li> <li>Thought the ‘+’ in the nav bar was to add apps – <sup>2</sup>&frasl;<sub>9</sub> (22%)</li> <li>Unclear that this was only for Android apps; Was confused about which apps could be added; thought she could add things from her applications folder on her computer – <sup>1</sup>&frasl;<sub>9</sub> (11%)</li> <li>Confused about adding .apk files – <sup>1</sup>&frasl;<sub>9</sub> (11%)</p> <br /></li> </ul> <p>Add from Repos View</p> <ul> <li>Thought when they tapped ‘add’ it would add the app, but it didn’t until they tapped done</li> <li>The problem was that people went to the next page or changed the filter and their selections were cleared- <sup>3</sup>&frasl;<sub>9</sub> (33%)</li> <li>Users noticed that some apps showed up multiple times – <sup>2</sup>&frasl;<sub>9</sub> (22%)</li> <li>Some left the page without hitting done (ie. used the back button in the browser) – <sup>1</sup>&frasl;<sub>9</sub> (11%) <br /></li> </ul> <h4 id="participant-feedback">Participant Feedback:</h4> <ul> <li>Wanted to sign up using a google account – <sup>1</sup>&frasl;<sub>9</sub> (11%)</li> <li>Participants glad to see the apps they wanted are available</li> <li>Be specific about what file types can be added</li> <li><em>“Can I add my own files?” (Participant 9)</em></li> <li>Create buttons appears to ‘lag’ – <sup>7</sup>&frasl;<sub>9</sub> or (77%)</li> <li>How do I ensure my repo is private?</p> <br /></li> </ul> <h2 id="task-2-add-the-twitter-app">Task 2: Add the Twitter app.</h2> <ul> <li><strong>Average Difficulty</strong>: 1.55</li> <li><strong>Number of Participants with Critical Errors</strong>: 0</li> <li><strong>No problem</strong> – <sup>4</sup>&frasl;<sub>9</sub> (44%) <br /></li> </ul></li> </ul></li> </ul></li> </ul></li> </ul></li> </ul></li> </ol></li> </ol> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/image1.png" width="702" height="356" alt="" title="" /> </p></p> <pre><code> &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;“I don’t know what ‘other repos’ means.” &lt;/i&gt; &lt;/p&gt; &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;(Participant 9)&lt;/i&gt; &lt;/p&gt; &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;&lt;/i&gt; &lt;/p&gt; #### Observations: Apps Index View – After (task 2) * Big shiny add button was distracting; thought they would click there to add more apps – 2/9 (22%) * Were confused or didn’t like that the initial action cards merged – 4/9 (44%) #### Participant Feedback: * ‘Add from repos’ button needs to be more visual and bigger * Thought the explore icon looked like an eyeball &lt;p style=&quot;text-align:center;&quot;&gt; &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;“I wasn’t sure how to get back to the page I was on.” &lt;/i&gt; &lt;/p&gt; &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;(22% of Participants)&lt;/i&gt; &lt;/p&gt; &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;&lt;/i&gt; &lt;/p&gt; &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;&lt;/i&gt; &lt;/p&gt; &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;&lt;/i&gt; &lt;/p&gt; &lt;/p&gt; Add from Repos View * Need better categories (ex: ‘internet’ category is a little abstract – includes browser’s, privacy twitter and facebook) A social media category would be more relevant __– 2/9 (22%) * It’s not immediately clear that categories filter – 2/9 (22%) * Participant chose a category filter, then searched. The app didn’t show up, because it was searching within the category. * Search was not easy to find- 1/9 (11%) #### Participant Feedback: * “Categories aren’t specifically clear.” (Participant 1) * _“I’m used to finding search on the right side.” (Participant 7)_ #### Bugs: * Bug filed for adding an app that is already in your repo #108 &lt;/p&gt; ## ## PAGE_BREAK: PageBreak ## Task 3: Add the Courier app from the Guardian Project’s repo. * **Average Difficulty**: 1.22 * **Number of Participants with Critical Errors**: 1 * **No problem** – 8/9 (88%) </code></pre> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/image2.png" width="714" height="340" alt="" title="" /> </p></p> <pre><code> #### Observations: * Participants familiar enough with interface to easily complete task #### Participant Feedback: * One participant made 7 redundant taps on the ‘done’ button during this task. They assumed the page was stalling or the internet connection was unreliable. When in fact, they already had the app in their repo and didn’t see the error/warning message at the top of the page. Wasn’t able to get out of this view unless they reloaded the page or unchecked the blue check mark. &lt;/p&gt; ## ## PAGE_BREAK: PageBreak ## Task 4: Add a description to the Courier app. * **Average Difficulty**: 1.5 * **Number of Participants with Critical Errors**: 2 * **No problem**– 5/9 (55%) </code></pre> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/image3.png" width="692" height="348" alt="" title="" /> </p></p> <pre><code> &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;“It seems really strange to be able to edit someone else’s app. I’m really concerned about the security feature of publishing repos. People putting out virtually similar apps, but changing just slightly. Because I can edit almost everything except for the icon. I can upload my own app file but still use their icon. Suggest ways to have warnings about masquerading.” &lt;/i&gt; &lt;/p&gt; &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;(Participant 1) &lt;/i&gt; &lt;/p&gt; &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;&lt;/i&gt; &lt;/p&gt; &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;“Does it work like a wiki when I make changes, or does it only change it in my repo?” &lt;/i&gt; &lt;/p&gt; &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;(Participant 5)&lt;/i&gt; &lt;/p&gt; &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;&lt;/i&gt; &lt;/p&gt; #### Observations: * Added description to the summary field – 3/9 (33%) * Commented that they wouldn’t have known they could edit an app, unless we asked them to do it – 3/9 (33%) * Description view takes too long to load – 2/9 (22%) * No indication in the description text box that this is where you add a description – 2/9 (22%) * Want a ‘save’ button with the description box – 2/9 (22%) * Want a back button on this page (wants it to say ‘back to repo’) – 2/9 (22%) __ #### Participant Feedback: * If you tap back in the browser, your changes are not saved. * Attach save buttons to sections that are edited, rather than having 1 ‘done’ button * Talk about editing in the FAQ or overview of the app * Simplify edit view&lt;/p&gt; ## Task 5: Remove an app from your repo. * **Average Difficulty**: 2.16 * **Number of Participants with Critical Errors**: 1 * **No problem** – 4/9 (44%) </code></pre> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/image4.png" width="713" height="328" alt="" title="" /> </p></p> <pre><code> &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;“Edit makes me think that I would edit something within it, rather than removing it.” &lt;/i&gt; &lt;/p&gt; &lt;p style=&quot;text-align:center;&quot;&gt; (Participant 3) &lt;/p&gt; #### Observations * Expected to be able to remove apps from the main apps index view – 7/9 (77%) * Most people searched main page, but remembered that they had seen something in the edit view previously. * _I’m not making any changes to the app._ * _Wasn’t immediately apparent_ * _Not difficult, just requires a lot of clicks_ * I would expect to hover over or long press an app and get the option to remove * I want a ‘remove app’ button on the app page * Likes confirmation to remove the app – 1/9 (11%)&lt;/p&gt; ## Task 6: Create a second repo. You don’t need to add any apps. * **Average Difficulty**: 1.72 * **Number of Participants with Critical Errors**: 0 * **No problem**– 6/9 (66%) ####&lt;img src=&quot;https://guardianproject.info/wp-content/uploads/2017/06/image5.png&quot; width=&quot;740&quot; height=&quot;333&quot; alt=&quot;&quot; title=&quot;&quot; /&gt; #### Observations: * Not completely clear, but figured it out – 3/9 (33%) * Trying to find empty state of My Repo view – 2/9 (22%) * Many had tapped + by mistake already (thought it was to add apps)- 2/9 (22%) * Wanted to tap on the name of the repo or near it – 1/9 (11%) Participant Feedback: * Would help to have the option in the My Repos home view * Hover label for new repo (near +) * “Add button says it all.” (Participant 4) * Would like a visual notification that the first repo was saved ## ## Task 7: Reopen your first repo. * **Average Difficulty**: 1.44 * **Number of Participants with Critical Errors**: 0 * **No problem** – 8/9 (88%) </code></pre> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/image6.png" width="709" height="324" alt="" title="" /> </p></p> <pre><code> &lt;p style=&quot;text-align:center;&quot;&gt; &lt;i&gt;“Home conformed to my expectations.” &lt;/i&gt; &lt;/p&gt; &lt;p style=&quot;text-align:center;&quot;&gt; (Paricipant 5) &lt;/p&gt; #### Observations: * Had figured out how to do it in a previous task – 1/9 (11%) * Tapped back in browser – 1/9 (11%) #### Bug: * Bug with duplicate repos appearing in home screen 1/9 (11%)&lt;/p&gt; ## ## Task 8: Share your first repo with your journalists. * **Average Difficulty**: 1.72 * **Number of Participants with Critical Errors**: 1 * **No problem**– 3/9 (33%)&lt;img src=&quot;https://guardianproject.info/wp-content/uploads/2017/06/image7.png&quot; width=&quot;716&quot; height=&quot;305&quot; alt=&quot;&quot; title=&quot;&quot; /&gt; #### #### Observations: * Copy and pasted the link in a new tab (without prompting) – 4/9 (44%) * Went to share right away – most everyone * Participants tapped ‘copy link,’ saw a blue check and did nothing else – 2/9 (22%) * Used Facebook – 1/9 (11%) * Used Twitter – 1/9 (11%) * Opened the public link right away. Was going to add it to F-Droid then share with people from there 1/9 (11%) * Not clear how to publish the repo – 1/9 (11%) #### Participant Feedback: * Wants to make sure the link is secure * Don’t want to make it public (Password protection, unlisted?) * Check doesn’t go away after copying link * _“Sending a QR or link doesn’t do anything.” (Participant 1)_ * “What does the blue check mean?” (22% of Participants) * Would be nice to be able to email from this page, maybe linkedin * Like the QR code, because very familiar using these * Steps aren’t extremely clear * Likes that it shows how many apps are in your repo * Step by step — this is how you share it with journalists (3 step process) * Having the QR code and link on the same page is helpful * Would like to see a reminder about F-Droid on the share screen * Need to have a clear understanding about F-Droid and how it works ## ## Task 9: Open the page you just shared. * **Average Difficulty**: 1 * **Number of Participants with Critical Errors**: 0 * **No problem**– 9/9 (100%)&lt;img src=&quot;https://guardianproject.info/wp-content/uploads/2017/06/image8.png&quot; width=&quot;704&quot; height=&quot;320&quot; alt=&quot;&quot; title=&quot;&quot; /&gt; #### Observations: * Everyone highlighted link, copied and pasted it in a new tab to view &lt;/p&gt; ## ## PAGE_BREAK: PageBreak ## Task 10: Talk through how your journalists would add this repo to their android phone. #### Main Takeaways:&lt;/p&gt; 1. **The majority of participants felt that they needed a core understanding of F-Droid first** __ _“Most people wouldn’t have a problem installing F-Droid. The biggest challenge is knowing how F-Droid works.” (Participant 3)_ __ _“The concept of a repo is very abstract – the hardest part would be understanding what it is.” (Participant 6)_ __ * First need to understand F-Droid in order to install a repo * Understood that you need F-Droid first, but believe you would need to spend time explaining FDroid to someone before setting up a repo * Relationship between F-Droid and repomaker is unclear * Might be a challenge if F-Droid is not already adopted into their workflow * People need to be comfortable and familiar with F-Droid first in trainings * If they are educated about F-Droid and info comes from a trusted source, they will be likely to use it * How do I get it if I only have one device 1. **Step-by-step instructions needed (beginning with F-Droid installation)** __ “Most of the journalists I work with are lazy. They would need step by step instructions.” (Participant 8)&lt;/p&gt; * Step-by- step instructions would help * If I share it on Facebook, they will have it on their phone. * Provide info up front that you need F-Droid for it to work * QR code scanner in F-Droid would be helpful. Participant didn’t have a QR code scanner or room to download it * The Pakistani testers liked QR code option for sharing * Wants to make sure the link is secure &lt;/p&gt; # # PAGE_BREAK: PageBreak # Is it Useful? &lt;p style=&quot;text-align:center;&quot;&gt; 8 out of 9 participants agreed Repomaker is a useful tool and would utilize it &lt;/p&gt; ##### YES * Yes! Participant does multiple trainings in rural areas with students who couldn’t download apps prior to trainings, making talking about the specific apps during the actual trainings too abstract. * Repomaker is a great idea! Very, very useful! * See this being a very useful tool for trainings. Easily send a link to trainees prior to the training/conference ask them to install FDroid and download this repo with all the materials needed for our training. * In a context where people don’t have Google Play, F-Droid makes a lot of sense. * Yes, because when teaching labs (at university) we must download a few network simulators and apps, but because of the proxies network (restrictions on the internet, sites or apps being blocked) we aren’t able to use wifi in this way, making it difficult or impossible to get the needed materials for lab. Therefore, we could utilize Repomaker in these instances (Nearby tool or bluetooth) * Some people would find it very useful! * Very useful to host trainings, give people a landing page with a customized repo! * If there is some prior education about FDroid and Repomaker and this education/introduction comes from a trusted source, believes many people would not hesitate to use the tool. * Participant is really struggling with the problem of unreliable internet connectivity, so they are very interested in this app specifically for training purposes and the ability to share repos with people whenever needed. ##### NO OR MAYBE * Not sure, I’m not an Android user. * How does this make my use case easier? * Want to know more about F-Droid ##### COUNTRY-SPECIFIC POINTS #### Pakistan * In Pakistan everyone uses Android. * In Pakistan mobile data is expensive and not all areas have good coverage, however, about 70-90% of people have mobile phones with airdrop being a very familiar sharing tool. * In big cities within Pakistan people are very familiar and comfortable using QR scanners and codes, however, within the smaller, rural areas people are skeptical. * Access to mobile phones ubiquitous, so mobile platforms really useful. #### Sri Lanka * In Sri Lanka, physical and device checks (army checkpoints) are very common. The guards will check your phone apps and photos, but people would be storing these repos in F-Droid, so apps wouldn’t appear on their home screen. * F-Droid doesn’t look attractive, so it won’t attract officials attention. * The galaxy y doesn’t have very much capacity. Storage space is an issue. * If there’s patchy network, people use bluetooth, to save data, because data is money and also to save data. * Most people are using phones that are given by organizations—like World Vision. Some organizations feel that it can be used as a personal device, so they block things so they won’t use data (ex: some block facebook or IMO apps). Sometimes they come with their own apps (like World Nation); blocking other apps. #### Zimbabwe * Challenge of internet very real in Zimbabwe. Repomaker is very practical and useful. Being able to store apps all in one location. * Too many people using Google Play at once. #### Participant Feedback: * Could offer a FAQ’s section * On home screen have a few quick questions and answers regarding Repomaker– _What’s a repo? What would I use repomaker for? Learn more here.&lt;/li&gt; * Additional verification step? * How much will it cost to run the apps? * How much data will repomaker require? * What about storage? Will repos be able to store on external storage devices?&lt;/ul&gt; &lt;/p&gt; # # PAGE_BREAK: PageBreak # Survey Results&lt;/p&gt; ## Follow-Up </code></pre> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null5.png" width="624" height="316" alt="" title="" /> </p></p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null6.png" width="624" height="357" alt="" title="" /></p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null7.png" width="624" height="356" alt="" title="" /><img src="https://guardianproject.info/wp-content/uploads/2017/06/null8.png" width="624" height="404" alt="" title="" /></p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null9.png" width="624" height="312" alt="" title="" /></p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null10.png" width="624" height="410" alt="" title="" /> </p></p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null11.png" width="624" height="404" alt="" title="" /><img src="https://guardianproject.info/wp-content/uploads/2017/06/null12.png" width="624" height="310" alt="" title="" /> </p></p> <pre><code> ## ## PAGE_BREAK: PageBreak ## App Distribution&lt;/p&gt; </code></pre> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null13.png" width="624" height="309" alt="" title="" /><img src="https://guardianproject.info/wp-content/uploads/2017/06/null14.png" width="624" height="469" alt="" title="" /></p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null15.png" width="624" height="300" alt="" title="" /> </p></p> <pre><code> #### Notable: How many app? From our responses, a majority of trainers share 2-5 apps during trainings.&lt;/p&gt; </code></pre> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null16.png" width="624" height="345" alt="" title="" /><img src="https://guardianproject.info/wp-content/uploads/2017/06/null17.png" width="624" height="330" alt="" title="" /> </p></p> <pre><code> ####&lt;img src=&quot;https://guardianproject.info/wp-content/uploads/2017/06/null18.png&quot; width=&quot;624&quot; height=&quot;340&quot; alt=&quot;&quot; title=&quot;&quot; /&gt; #### Notable: Biggest challenge? _**The biggest challenge this set of trainers face is that ‘Participants can’t connect to the internet during a training (75%).&lt;/i&gt;**&lt;/p&gt; _**Second to that (50%), ‘Participants can’t connect to the internet before the training’ and ‘Sharing an app requires unknown sources to be turned on in the phone settings’.&lt;/i&gt;**&lt;/p&gt; _**&lt;/i&gt;**&lt;/p&gt; </code></pre> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null19.png" width="624" height="313" alt="" title="" /></p> <pre><code> ## ## PAGE_BREAK: PageBreak ## Basic Info&lt;/p&gt; </code></pre> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null20.png" width="624" height="304" alt="" title="" /><img src="https://guardianproject.info/wp-content/uploads/2017/06/null21.png" width="624" height="294" alt="" title="" /><img src="https://guardianproject.info/wp-content/uploads/2017/06/null22.png" width="624" height="313" alt="" title="" /><img src="https://guardianproject.info/wp-content/uploads/2017/06/null23.png" width="624" height="352" alt="" title="" /><img src="https://guardianproject.info/wp-content/uploads/2017/06/null24.png" width="624" height="317" alt="" title="" /><img src="https://guardianproject.info/wp-content/uploads/2017/06/null25.png" width="624" height="325" alt="" title="" /><img src="https://guardianproject.info/wp-content/uploads/2017/06/null26.png" width="613" height="329" alt="" title="" /><img src="https://guardianproject.info/wp-content/uploads/2017/06/null27.png" width="624" height="422" alt="" title="" /></p> <pre><code> ## ## PAGE_BREAK: PageBreak ## Would you do it again?&lt;img src=&quot;https://guardianproject.info/wp-content/uploads/2017/06/null28.png&quot; width=&quot;624&quot; height=&quot;324&quot; alt=&quot;&quot; title=&quot;&quot; /&gt; ###&lt;img src=&quot;https://guardianproject.info/wp-content/uploads/2017/06/null29.png&quot; width=&quot;624&quot; height=&quot;278&quot; alt=&quot;&quot; title=&quot;&quot; /&gt; PAGE_BREAK: PageBreak # Possible FQA’s&lt;/p&gt; How much data will repomaker require? How much data is required to install F-Droid? How much storage needed? Will repos be able to store on external storage devices? What is F-Droid? What is a repo? What files can I add to my repo? Can apps be downloaded directly from the public repo view? Why do I need F-droid? Can I edit any app? Can others edit my apps? Can others edit my personal repo? How can I customize to a specific training? How public is my repo? Who has access to my repo? How secure is my repo? How do I verify the apps I’m adding to my repo? How do I know apps are coming from the original source? How do I guard against malware? If there are two of the same app, how do I know which one to trust? Can other people masquerade my apps? Is it safe to enable unknown sources? How do I install apps from my repo? Is this a secure tool? Is it safe to use? How much storage will Repomaker and F-Droid need? Can the apps from my repo be downloaded onto an external storage device?&lt;/p&gt; **How to use F-Droid Repos** – how to add one / how to get a repo on your phone – how to get a repo from the desktop computer to your phone – how to share a repo link – how to share a repo from F-Droid when there’s no internet; how to share one offline / how to share apps with peers when there’s no internet. – how to remove one – how do I update files and apps I add? </code></pre> https://guardianproject.info/2017/06/08/tracking-usage-without-tracking-people/ Thu, 08 Jun 2017 10:58:53 -0400 https://guardianproject.info/2017/06/08/tracking-usage-without-tracking-people/ <p>One thing that has become very clear over the past years is that there is a lot of value in data about people. Of course, the most well known examples these days are advertising and spy agencies, but tracking data is useful for many more things. For example, when trying to build software that is intuitive and easy to use, having real data about how people are using the software can make a massive difference when developers and designers are working on improving their software. Even in the case of advertisers, they mostly do not care exactly who you are, they want to know what you are interested in so that they can more effectively promote things to you.</p> <p>From the beginning Guardian Project has focused on privacy, and worked to practice what we preach in our own software. For example, we have entirely disabled Apache web logs on our website for the past couple of years, so that we would not even have access to that rich data. We felt that we could not even store that data without fear of violating people’s privacy, let alone working with it.</p> <p>Things have changed in the past few years, and there are now a number of well tested techniques for tracking how people are using software without actually tracking who they are. It is now possible to keep some usage data while feeling safe that no one who might get that data could use it to identify individuals. One good example of this is the <a href="https://metrics.torproject.org/" target="_blank">Tor Project’s tracking data</a>. They provide a wide variety of tracking data to follow how Tor is being used, and how well the Tor network is operating.</p> <p>So we believe that it is now possible to responsibly track usage without violating anyone’s privacy. One piece of work along these lines is the new <a href="https://github.com/cleaninsights/cleaninsights-android-sdk" target="_blank">Clean Insights Android SDK</a>. Nathan is leading the development of that effort. And this blog post announces another new development that we are starting: tracking usage data from F-Droid app repositories.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2017/06/bycountry.png"><img src="https://guardianproject.info/wp-content/uploads/2017/06/bycountry-300x133.png" alt="tracking by country" width="300" height="133" class="aligncenter size-medium wp-image-13632" srcset="https://guardianproject.info/wp-content/uploads/2017/06/bycountry-300x133.png 300w, https://guardianproject.info/wp-content/uploads/2017/06/bycountry.png 747w" sizes="(max-width: 300px) 100vw, 300px" /></a></p> <p>To start with, the Apache web logs for this site will be configured to store, but only information that is not fine-grained enough to identify people:</p> <ul> <li>only the date is stored, not the time or time zone</li> <li>Referer, IP Addresses, User Agent are never stored</li> <li>country is stored by looking up the IP Address in the <em>geoip</em> database</li> </ul> <p>Normally, a log entries look like:</p> <pre>189.4.73.81 testy.at.or.at - [08/Jun/2017:13:55:46 +0200] "GET /fdroid/repo/index-v1.jar HTTP/1.1" 200 147950 "-" "F-Droid" 119.29.81.134 199.119.112.126 - [08/Jun/2017:14:46:48 -0400] "GET /fdroid/repo/index-v1.jar HTTP/1.1" 200 147950 "http://testy.at.or.at/fdroid/repo/index-v1.jar" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)" </pre> <p>This stripped version looks like:</p> <pre>0.0.0.0 - - [08/Jun/2017:00:00:00 +0000] "GET /fdroid/repo/index-v1.jar HTTP/1.1" 200 147950 "-" "-" AT 0.0.0.0 - - [08/Jun/2017:00:00:00 +0000] "GET /fdroid/repo/index-v1.jar HTTP/1.1" 200 147950 "-" "-" ZH </pre> <p>Since the raw data is processed by the webserver, the extra information will be discarded and never written to disk. Only the sanitized usage tracking information is ever stored. This is based on Tor Project’s <a href="https://gitweb.torproject.org/webstats.git/tree/src/sanitize.py" target="_blank">web tracking</a>. It is possible to do this with <em>Apache</em>, <em>lighttpd</em>, <em>nginx</em>, and probably other webservers. For <em>Apache</em>, <a href="https://github.com/maxmind/geoip-api-mod_geoip2/blob/master/INSTALL.md#configuration"><i>mod_geoip</i></a> needs to be installed, then only a single line is needed to configure this private logging mode:</p> <pre>LogFormat "0.0.0.0 - %u %{[%d/%b/%Y:00:00:00 %z]}t \"%r\" %>s %b \"%{Referer}i\" \"-\" %{GEOIP_COUNTRY_CODE}e" privacy+geo CustomLog ${APACHE_LOG_DIR}/access.log privacy+geo </pre> <p>Now, we hope that we can work towards providing value from tracking data, without violating anyone’s privacy. Indeed, we are still prioritizing privacy over any value derived from tracking data. So anyone else who also wants to go follow this route needs to be fully aware that any tracking must be very carefully done, since it can easily result in inadvertent leaks. Do not take this as a stamp of approval on any tracking activity!</p> https://guardianproject.info/2017/06/01/fdroidserver-ux-testing-report/ Thu, 01 Jun 2017 04:36:14 -0400 https://guardianproject.info/2017/06/01/fdroidserver-ux-testing-report/ <p>We ran user tests of <a href="https://gitlab.com/fdroid/fdroidserver" target="_blank"><em>fdroidserver</em></a>, the tools for developers to create and manage F-Droid repositories of apps and media. This test was set up to gather usability feedback about the tools themselves and the related documentation. These tests were put together and run by Seamus Tuohy/Prudent Innovation.</p> <h1 id="methodology">Methodology</h1> <p>Participants completed a pretest demographic/background information questionnaire. The facilitator then explained that the amount of time taken to complete the test task will be measured and that exploratory behavior within the app should take place after the tasks are completed. </p></p> <p>The participant was then provided a laptop with a browser window open to the F-Droid documentation. The facilitator let the participant know that if they felt they need anything external that they could ask the facilitator for that. </p></p> <p>At the start of each task, the participant was provided the task, and shown the resources that were available for them to use on a USB stick provided by the facilitator. The participant was then instructed to read the task description from the printed copy and begin the task. Time-on-task measurement began when the participant started the task. </p></p> <p>The facilitator instructed the participant to ‘think aloud’ so that they could capture their otherwise internal thoughts about interactions with the F-Droid server software. The facilitator observed and entered participant behavior, participant comments, and system actions into their record of the event. </p></p> <p>After each task, the participant spoke with the facilitator about the task. After all task scenarios were attempted, the participant completed a post-test satisfaction questionnaire.</p></p> <h1 id="task-completion-p">Task Completion</p></h1> <p>Each participant was asked to complete six specific tasks. At the start of each task, the participant was read the task, and shown the resources that are available for them to use. The participant was then instructed to read the task description from the printed copy and begin the task. </p></p> <h2 id="tasks">Tasks</h2> <ol> <li>Set Up an F-Droid application repository with the applications on this USB Drive.</li> <li>Connect to that repository using the F-Droid client.</li> <li>Group the applications under your repositories name in the F-Droid interface.</li> <li>Download the barcode scanner application using the F-Droid client.</li> <li>Update your F-Droid repository with an update to the barcode scanner app.</li> <li>Download the update using the phone.</li> </ol> <p>Tasks are marked as “complete” after the participant says they have completed the task or after the test facilitator has enough evidence that the task has been completed. Tasks are marked as “uncompleted” after the participant says they cannot complete the task and requests assistance.</p> <p><img src="https://annoyingtechnicaldetails.files.wordpress.com/2017/06/null2.png" width="574" height="353" alt="" title="" /></p> <h1 id="task-completion-time">Task Completion Time</h1> <p>Test time will begin after the participant says they have understood the task and will begin. Testing time will end after the participant says they have completed the task or after the test facilitator has enough evidence that the task has been completed. In the case of a critical error, test time will stop after the participant says they cannot complete the task and request assistance.</p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null3.png" width="577" height="356" alt="" title="" /></p> <h2 id="usability-metrics">Usability Metrics</h2> <p>Usability metrics refers to participant performance when completing the assigned tasks. This is includes completion success rates, error rates, time to task completion and subjective evaluations/interviews. </p></p> <ul> <li><strong>Critical Errors</strong>: Critical errors are reported as errors that result in failure to complete the task. Participants may or may not be aware that the task goal is incorrect or incomplete. Independent completion of the task is the goal; help from the test facilitator or others is to be marked as a critical error.</li> <li><strong>Non-critical Errors</strong>: Non-critical errors are errors that the participant recovers from alone and are not such that the participant can no longer complete the task. They can include errors such as excessive steps taken to complete a task or initially using an incorrect function but recovering from that incorrect step.</li> <li><strong>Exploratory Behavior</strong>: Errors that are off task from the main task attempting to be completed will be marked as exploratory behavior.</li> </ul> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null4.png" width="600" height="370" alt="" title="" /></p> <p>It should be noted that many of the errors that were encountered in tasks two, four, and six were the result of configuration decisions and non-critical errors in tasks one and five. More information about why this is the case can be found in the “Task Specific Findings.”</p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null5.png" width="600" height="370" alt="" title="" /> </p></p> <h1 id="task-specific-findings-p">Task Specific Findings</p></h1> <h2 id="task-1-set-up-an-f-droid-application-repository-with-the-applications-on-this-usb-drive">Task 1: Set Up an F-Droid application repository with the applications on this USB Drive.</h2> <ul> <li><strong>Average Time</strong>: 53 Minutes</li> <li><strong>Number of Participants with Critical Errors</strong>: 1</li> </ul> <h3 id="docs-needed-for-configuring-the-remote-server">Docs needed for configuring the remote server</h3> <p>The participants were provided a remote server that was pre-configured to host F-Droid applications. The research team did this because setting up a web-server to host an F-Droid repository seemed out of scope, and it would increase the length of the UX session to an unacceptable length.</p></p> <p>During this activity the participants were consistently confused by the documentation related to setting up the F-Droid host server (even though the server was pre-configured for them.) Documentation around file permissions on the remote server were especially troublesome.FOOTNOTE: Footnote</p> <h4 id="feedback">Feedback:</h4> <ul> <li>The participant was confused about where the documentation begins to start deploying the server.</li> <li>The participant stated that there is not enough information on how to configure the remote server.</li> <li>It is missing in the documentation that before doing “fdroid server update” the permissions of the files to be served can be changed locally since they are transmitted to the remote server with the same local permissions.</li> <li>In the documentation, the information about the file permissions and configuration of the server at Fdroid level is missing. The documentation should say what permissions contain the generated files, (or what permissions they should contain).</li> <li>It is missing in the documentation that before doing “fdroid server update” the permissions of the files to be served can be changed locally since they are transmitted to the remote server with the same local permissions.</li> <li>The participant did not use the command fdroid server update to push the apps to the remote server, instead of that, he used the command SCP to send the data of manually.</li> <li>The participant was confused about the location of the files hosted on the web server. Doubt resolved after reviewing the documentation.</li> </ul> <h3 id="confusing-ordering-of-documentation">Confusing ordering of documentation</h3> <p>The participants felt that the documentation was confusingly ordered. While a few noted that the individual pieces of documentation were correct, and even clear once a participant is familiar with themFOOTNOTE: Footnote, the overall organization and ordering of documentation made it made it difficult to use.</p> <h4 id="feedback-1">Feedback:</h4> <ul> <li>There were many doubts regarding the order of the steps, there was also a sensation of ordered list of steps when in practice the information were related to different activities (eg. Local Demo and Real World setup)</li> <li>The documentation is not understandable, not in terms of language but in the way of explaining, it should be more detailed. It feels difficult to understand for entry level people.</li> <li>The way information is presented and how it is structured seems to be disconcerting and overloaded.</li> <li>In outlines, poorly structured, getting started should have the section “set repo” and “install”, should not make emphasis on FAQs.</li> <li>The participant considers that documentation is confusing as to the step by step, he ends up diverting from the task received.</li> <li>The participant said that the content of the list in the overview section is not detailed in subsequent sections in the Setup an Fdroid App Repo page.</li> <li>It seems more logical for him if in the main page of the documentation are placed first the tutorials and in the end the FAQs.</li> <li>The participant had to use the Ctrl + F function several times to find keywords in the index file of the documentation. It seemed unclear and messy to him.</li> </ul> <h3 id="metadata">MetaData</h3> <p>All but one of the participants left their app and repository metadata empty during this task. There is a possibility that this is because it was not explicitly stated in the tasks requirements, because it is not clearly marked in the instructions, or because the overall difficulty of the other components of this task distracted them from this component of the task.</p> <h4 id="feedback-2">Feedback:</h4> <ul> <li>The participant did not complete the repository or application metadata.</li> <li>The metadata of the apps and the server was not configured, however the server was running with the given applications.</li> <li>The participant did not place the metadata of applications or repository.</li> <li>The participant generated the skeleton metadata and did not update the information.</li> <li>The participant modifies the metadata files in the visual environment of the local machine (Nautilus and Gedit) because it was more comfortable.</li> </ul> <h3 id="docs-to-help-address-errors">Docs to help address errors</h3> <p>When participants did encounter errors there was little assistance to be found in the existing documentation. The current documentation assumes success. Participants who encountered errors desired that the documentation also included guidance about what could have gone wrong when they encounter errors.</p> <h4 id="feedback-3">Feedback</h4> <ul> <li>The participant felt frustrated because he did not find a place in the documentation where he could consult errors.In many times, he wanted to use Google to help with the debug process but would not find relevant information there either. The participant wanted a section in the documentation showing how to validate the steps of the process and again a section with common problems in the implementation and configuration.</li> <li>Documentation should have a guide of error messages which can be received, e.g. those related to the metadata.</li> <li>The participant says that it could be useful a section in the documentation for Troubleshooting</li> </ul> <h3 id="android-dependencies">Android Dependencies</h3> <p>Multiple participants were unclear about what android related dependencies were required and how to obtain them.</p> <h4 id="feedback-4">Feedback:</h4> <ul> <li>The participant seeks for information on how to download Android Studio</li> <li>The participant was confused about the need to install the dependencies related to Android in order to complete the task. After reviewing the documentation, the participant decided not to install these dependencies.</li> <li>Documentation should be more evident regarding to dependency management. e.g. If the binary installation includes Android dependencies.</li> <li>The participant doubts whether to do the setup to create app builds, and if the installation of the corresponding dependencies is covered with the installation itself of Fdroid server.</li> </ul> <h2 id="task-2-connect-to-that-repository-using-the-f-droid-client">Task 2: Connect to that repository using the F-Droid client.</h2> <ul> <li><strong>Average Time</strong>: 13 Minutes</li> <li><strong>Number of Participants with Critical Errors</strong>: 2</li> </ul> <h3 id="https-defaults-on-repository-address">HTTPS Defaults on Repository Address</h3> <p>Even though the developers thought the client was relatively easy to use some encountered issues related to the assumptions that F-Droid makes around the security of a repository. </p></p> <p>When adding a new repository to the client application if the participant leaves the protocol blank (e.g. no HTTP or HTTPS) the client defaults to using HTTPS. If the server does not support HTTPS the repository will fail to set up. A repository that does not support HTTPS is clearly undesirable. But, even so, F-Droid’s implicit assumption, without accompanying documentation and/or errors to alert the developer and participant, caused issues for participants.</p> <h4 id="feedback-5">Feedback:</h4> <ul> <li>The error the participant was experiencing was that the client by default adds the HTTPS protocol to URLs that don’t explicitly state HTTP(s), and the server used for the task did not support HTTPS.</li> <li>It should have had documentation on how to input the URL of the repository to be properly recognized.</li> <li>The participant received errors when setting the repository address incorrectly with HTTPS as was suggested by default on the client application on the android phone. Then the participant noticed the situation and changed the address to HTTP.</li> <li>The client is intuitive to use.</li> <li>The solution to the issue presented does not seem complex to the participant but is not documented and is liable to make mistakes.</li> </ul> <h3 id="interconnected-documentation-needed">Interconnected Documentation Needed</h3> <p>When switching from building a repository to using the repository the participants had to search for client documentation in other parts of the F-Droid website and online. Multiple participants suggested that client documentation related to the use of the F-Droid server being set up should be more easily accessed from the server setup documentation. </p></p> <p>It should be noted that the participants were using a development build of the new documentation, and, as such it was not directly linked to the F-Droid website where the client documentation is available.</p> <h4 id="feedback-6">Feedback:</h4> <ul> <li>In the documentation, there was no information about how setup the client’s app.</li> <li>The client documentation should be accessible in the server-setup documentation. For example, including how to install and setup the client.</li> <li>The participant claimed the task was completed, however the connection was not successful because he wrongly placed the URL repository in the Android client (root@1xx.1xx.1xx.1xx:/var/www/html /). The participant was then assisted to move on to the next activity.He explains that in the client FAQ does not appear how to fill the URL of new repositories in the client</li> <li>Very confused about how to get started.</li> <li>Within the app was easy to complete the task, since it is an intuitive application. It becomes necessary to have a step-by-step list of how to set the repositories in the client, especially the URLs.</li> <li>A link to home of fdroid.org could be placed in the documentation.</li> </ul> <h2 id="task-3-group-the-applications-under-your-repositories-name-in-the-f-droid-interface">Task 3: Group the applications under your repositories name in the F-Droid interface.</h2> <ul> <li><strong>Average Time</strong>: 1 Minute</li> <li><strong>Number of Participants with Critical Errors</strong>: 0</li> </ul> <h3 id="metadata-1">MetaData</h3> <p>Participants had quick success and no critical errors during this task. But, the participants achieved this by circumventing the aim of the test. Instead of appropriately setting the metadata of their app, and searching for it within the Client, they disabled all other repositories to make it so that only their apps showed in the client. This rapid and common adoption of this specific method of circumventing the need to set, and use, metadata is specifically troubling.</p> <h4 id="feedback-7">Feedback:</h4> <ul> <li>The participant felt confused about what was expected in the task. However, he thought that disabling other repositories on the client list could be enough.</li> <li>There should be an option to disable all repositories included in the software.</li> <li>At the beginning, it was confusing to understand which switches had to be disabled and which ones to enabled in order to see the applications of the own repository. It was simple a few seconds later but it should be specified in the documentation.</li> <li>There should be in the documentation an instructive manual on the use of the client to manage repositories.</li> <li>The participant found very easy to disable other repositories in order to see only the applications of the server used</p></li> </ul> <h2 id="task-4-download-the-barcode-scanner-application-using-the-f-droid-client">Task 4: Download the barcode scanner application using the F-Droid client.</h2> <ul> <li><strong>Average Time</strong>: 15 Minutes</li> <li><strong>Number of Participants with Critical Errors</strong>: 2</li> </ul> <p>The issues that the participants faced in this task were actually related to earlier tasks with “critical issues” that were undetectable until this point. Without the file permission issues, described below, downloading apps was seen as a very easy task. This highlights the overall feeling by the developer participants that the client is generally easy and intuitive to use.</p></p> <h3 id="server-permissions">Server Permissions</h3> <p>The participants encountered multiple difficult to diagnose issues related to file permissions on the remote server. These issues only appear once a participant is attempting to download an application from a F-Droid repository. As such, permission issues can easily slip past a repo maker who merely updates their repository and checks to ensure that it can be connected to.</p> <h4 id="feedback-8">Feedback:</h4> <ul> <li>The participant received in the Android client the error “Unsuccessful Non-critical error download”, understood at the time as a permissions error on the (min 1) remote server, which he modified directly at the time by accessing through SSH before re-testing the download.</li> <li>Extremely comfortable and fast if the operation of permissions on the Subjective remote server is known. The participant works with this permissions evaluation management every day and says that’s why it became so easy, but perhaps for another person without such familiarity on web servers could be more complicated.</li> <li>“It’s easy once you know how to configure file permissions.”</li> <li>The participant did not locate any documentation about remote server configuration, especially related to file permissions on the web server. The participant suggests that for many people this would be necessary.</li> <li>In the documentation, the information about the file permissions and configuration of the server at Fdroid level is missing. The documentation should say what permissions contain the generated files, (or what permissions they should contain).</li> <li>The participant understood how to resolve the permissions problem on the remote server and corrected it by placing 775 permissions on the remote server’s files. However other actions meant that the activity could not be completed successfully.</li> <li>The client displayed the error “Connection refused”, the participant concluded that it was due to a problem of permissions on the remote server, however decided to address it by modifying the nginx configuration file, resulting in the inability to read and download files from the remote server.</p></li> </ul> <h2 id="task-5-update-the-f-droid-repository-with-an-update-to-the-barcode-scanner-app">Task 5: Update the F-Droid repository with an update to the barcode scanner app.</h2> <ul> <li><strong>Average Time</strong>: 9 Minutes</li> <li><strong>Number of Participants with Critical Errors</strong>: 0</li> </ul> <h3 id="updating-the-server">Updating the Server</h3> <p>Some participants had continued difficulty working with the server during updates. While some of this was related to difficulty differentiating tasks that should be conducted on the client vs. those that should be conducted on the server when reading the documentation, others were related to the behavior of the software.</p> <h4 id="feedback-9">Feedback:</h4> <ul> <li>The upgrade process is better documented compared to other parts of the documentation, but still could be more detailed.</li> <li>The terminal was giving an error on the local machine when running the update command saying “CRITICAL: Failed to get repo pubkey!”, later the participant discovered that the update was pushed anyway to the server saying that the task was completed.</li> <li>The participant felt confused about which commands must be executed in the local machine and which commands in the remote evaluation server. The participant says that if he needs to configure an exclusively local instance he would not know how to do it. The participant says that it could be useful a section in the documentation for Troubleshooting</li> <li>The participant does not know exactly where to place the update files.</li> <li>The participant is not clear whether it is necessary to run the command fdroid update and then fdroid server update, or just by running fdroid server update would both of the commands run automatically.</li> <li>The participant cannot read the update from the client and doubts whether to run a command on the remote server as part of the update process, then he solves by doing update of the local repository before pushing the remote server.</li> <li>The participant was not clear if Fdroid update, actually updates the remote server, then after running it he was able to access via SSH to the remote server in order to check if the updated application was present, when seeing that it was not updated, the participant understood that he also had to run Fdroid server update</li> </ul> <h3 id="documentation-is-intuitive-once-understood">Documentation is Intuitive Once Understood</h3> <p>Once participants got comfortable with the documentation, server setup, and/or updating process they felt that it was relatively easy to use.</p> <h4 id="feedback-10">Feedback:</h4> <ul> <li>Very well designed software to handle the updates, it ends up being very easy to use.</li> <li>The task was easy once you understand the file structure in the repository.</li> <li>The task was very pleasant to complete at the software level.</li> <li>Documentation is clear but yet confusing at first reading.</li> <li>The upgrade process is better documented compared to other parts of the documentation, but still could be more detailed.</p></li> </ul> <h2 id="task-6-download-the-update-using-the-phone">Task 6: Download the update using the phone.</h2> <ul> <li><strong>Average Time</strong>: 7 Minutes</li> <li><strong>Number of Participants with Critical Errors</strong>: 1</li> </ul> <h3 id="permissions-cont">Permissions Cont.</h3> <p>Permissions issues that went unaddressed in task 5 caused issues during the, otherwise very easy task, of downloading updates to an application.</p> <h4 id="feedback-11">Feedback:</h4> <ul> <li>Once understood the issue of file permissions on the remote server, is easy to address the download of the update.</li> <li>It’s easy once you know how to configure file permissions.</li> <li>Replaying of the same issue of permissions and the error “Download unsuccessful”, then resolved by knowing how permissions are handled on the remote server.</li> <li>It is missing in the documentation that before doing “fdroid server update” the permissions of the files to be served can be changed locally since they are transmitted to the remote server with the same local permissions.</li> <li>Very pleasant on the Android client side, but it should be documented the type of permissions that the files on the remote server should contain.</li> <li>The update is loaded in the remote repo but it does not show on the</li> <li>Fdroid client, then the participant suspects it is because of the file permissions. After 12 minutes the participant says that he does not know how to fix the issue and stopped the task. The participant suspects before notifying the failure in the task completion that the issue could be related to some commands and files created as root that creating conflicts with the tasks triggered by the server update command.</p></li> </ul> <h2 id="miscellaneous-feedback-and-requests">Miscellaneous Feedback and Requests</h2> <h3 id="complexity-of-language-in-the-documentation">Complexity of Language in the Documentation</h3> <ul> <li>One participant used Google Translator for a better understanding of some terms within the documentation. This participant was also the only participant who speaks English as their primary language. All other participants speak Spanish as their primary language.</li> </ul> <h3 id="documentation-requests">Documentation requests</h3> <ul> <li>One participant wanted example configuration files in the Gitlab repository of F-Droid-server.</li> </ul> <h3 id="more-explicit-documentation">More explicit documentation</h3> <ul> <li>The documentation must specify that a set of files has been created when fdroid init runs</li> <li>It should have specified that commands with Fdroid should be executed in the main directory of the repository (e.g. ~/fdroid) and not in other directories within it (e.g. ~/fdroid /repo).</p></li> </ul> https://guardianproject.info/2017/05/31/announcing-new-libraries-f-droid-update-channels/ Wed, 31 May 2017 11:40:27 -0400 https://guardianproject.info/2017/05/31/announcing-new-libraries-f-droid-update-channels/ <p><a href="https://guardianproject.info/wp-content/uploads/2017/05/refresh-525698_640.png"><img src="https://guardianproject.info/wp-content/uploads/2017/05/refresh-525698_640-150x150.png" alt="" width="150" height="150" class="alignleft size-thumbnail wp-image-13626" srcset="https://guardianproject.info/wp-content/uploads/2017/05/refresh-525698_640-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2017/05/refresh-525698_640-300x297.png 300w" sizes="(max-width: 150px) 100vw, 150px" /></a><br /> In many places in the world, it is very common to find Android apps via a multitude of sources: third party app stores, Bluetooth transfers, swapping SD cards, or directly downloaded from websites. As developers, we want to make sure that our users get secure and timely update no matter how they got our apps. We still recommend that people get apps from trusted sources like F-Droid or Google Play.</p> <p>Building upon the F-Droid distribution ecosystem, there is a new suite of libraries: “<a href="https://gitlab.com/fdroid/update-channels/" target="_blank">F-Droid Update Channels</a>“. It is a suite of libraries for making sure your that your app can always find updates, no matter where someone got it from. Currently, there are two specific libraries: “Get F-Droid” and “App Updater”.</p> <h4 id="get-f-droid-aka-org-fdroid-getfdroid">“Get F-Droid” aka <code>org.fdroid.getfdroid</code></h4> <p>Checks whether F-Droid is installed. If not, it will help the user to download and install F-Droid. F-Droid then provides the update channel. This is the preferred method of getting updates since F-Droid provides strong privacy protection and lets the user control when and where updates happen. Also, if F-Droid came pre-installed on the device or was “flashed” onto it as part of a custom Android ROM, then F-Droid does not need “Unknown Sources” enabled.</p> <h4 id="app-updater-aka-org-fdroid-appupdater">“App Updater” aka <code>org.fdroid.appupdater</code></h4> <p>Keeps the app current by checking the hard-coded app repository set up by the developer. This is similar to the popular “App Updater” library, but is secure due to the F-Droid signed metadata. The _<a href="https://gitlab.com/fdroid/fdroidserver" target="_blank">fdroidserver</a>_ tools handle the creation and maintenance of the app repository.</p> <p>Both of these libraries also check whether Google Play is installed, if so, will disable itself. This allows apps to include this library in APKs that are uploaded to Google Play since it will not violate the Google Play Terms of Service.</p> https://guardianproject.info/2017/05/15/new-research-report-on-the-challenges-developers-face/ Mon, 15 May 2017 05:07:17 -0400 https://guardianproject.info/2017/05/15/new-research-report-on-the-challenges-developers-face/ <p><a href="https://guardianproject.info/wp-content/uploads/2017/06/tccw.png"><img class="aligncenter size-full wp-image-13792" src="https://guardianproject.info/wp-content/uploads/2017/06/tccw.png" alt="" width="845" height="375" srcset="https://guardianproject.info/wp-content/uploads/2017/06/tccw.png 845w, https://guardianproject.info/wp-content/uploads/2017/06/tccw-300x133.png 300w, https://guardianproject.info/wp-content/uploads/2017/06/tccw-768x341.png 768w" sizes="(max-width: 845px) 100vw, 845px" /></a></p> <p>The Guardian Project has been working with the <a href="https://f-droid.org" target="_blank" rel="noopener noreferrer">F-Droid</a> community to make it a secure, streamlined, and verifiable app distribution channel for high-risk environments. While doing this we have started to become more aware of the challenges and risks facing software developers who build software in closed and closing spaces around the world.</p> <p>There are a wealth of resources available on how to support and collaborate with high-risk users. Surprisingly, we could not find any guidance on how to support and collaborate with developers where the internet is heavily monitored and/or filtered, let alone developers who might be at risk because of the software they develop.</p> <p>This report explores some key challenges that developers in closed and closing spaces face when collaborating with international groups who support Human Rights and freedom (IHRFG). These groups include privacy and security software projects, civil society focused donors, and non-governmental organizations (NGOs).</p> <p>IHRFG can benefit greatly from collaborations with local developers. IHRFGs who are trying to design or localize software for a specific region often have difficulty</p> <ul> <li>understanding the types of technologies that are needed to address the problems IHRDGs are trying to solve,</li> <li>addressing the local economic, social, infrastructural, and/or legal challenges that software of its type often faces in the local context,</li> <li>identifying the interaction and design patterns that will drive initial adoption,</li> <li>evaluating the quality of the translations of software into the local language,</li> <li>finding local individuals for focus groups, and testing, and</li> <li>conducting testing and troubleshooting to identify and address issues caused by the speed, availability, and/or censoring of local fixed or mobile networks.</li> </ul> <p>Local developers, on the other hand, are often more than able to accomplish these tasks.</p> <p>Beyond identifying these challenges this report provides guidance on how to take these challenges into account when IHRFGs collaborate with local developers. To do this the report also contains a set of developer user-personas. These personas can be used by IHRFGs as an aid when they are designing collaborating with local developers.</p> <p>We hope that the results of this research will help international privacy and security focused software projects and NGOs better understand and respond to the unique needs of different international developer communities so that their collaborations with these developers will be safer, more strategic, and sustainable.</p> <h2 id="research-methodology">Research Methodology</h2> <p>This report is the result of two interconnected streams of research. The initial themes were identified in a series of in-depth interviews. These themes were further explored in an online “developer challenges survey.” The challenges and user personas found in this report were refined from the combined results of these research efforts.</p> <p><strong>Interviews</strong>: interviews with 14 developers, technologists, and digital defenders from 11 different countries where the internet is heavily monitored and filtered as well as 5 interviews with IHRFGs who work in similar regions.</p> <p><strong>Surveys</strong>: an <a href="https://challenges.tech/">online developer survey</a> in Chinese, Spanish, Farsi, Russian, French, and English that received 118 responses from developers in 28 countries around the world.</p> <h2 id="user-personas">User Personas</h2> <p>The user personas created for this report were developed to allow readers to think more concretely about the motivations and challenges that were identified during this project. In an effort to combat the inclusion of possible implicit biases the author might hold based upon the nationality, race, or gender of the personas the nationality, names, genders, and photos used for all the personas were generated at random.</p> <p>The <a href="https://github.com/seamustuohy/user_profile_randomizer">source code of the <strong>User Profile Randomizer</strong></a> is available and permissively licensed under the <a href="https://github.com/seamustuohy/user_profile_randomizer/blob/master/LICENSE">GNU Lesser General Public License v3.0</a>. It randomizes the gender pronoun, name (chosen from a random language family), and photo on a set of markdown based user personas.</p> <h3 id="the-full-report">The Full Report</h3> <p>Download the full report, including developer profiles, here:</p> <ul> <li><a href="https://guardianproject.info/wp-content/uploads/2017/06/Technological-Collaboration-in-a-Closing-World-1.pdf">Technological Collaboration in a Closing World.pdf</a></li> </ul> https://guardianproject.info/2017/05/01/f-droid-user-testing-round-2/ Mon, 01 May 2017 04:51:24 -0400 https://guardianproject.info/2017/05/01/f-droid-user-testing-round-2/ <p>#<img src="https://guardianproject.info/wp-content/uploads/2017/06/null14.png" width="624" height="164" alt="" title="" /></p> <p>by Hailey Still and Carrie Winfrey</p></p> <h1 id="toc_0">****</h1> <p>Here we outline the User Testing process and plan for the <a href="https://f-droid.org" target="_blank">F-Droid</a> app store for Android. The key aims of F-Droid are to provide users with a) a comprehensive catalogue of open-source apps, as well as b) provide users with the the ability to transfer any app from their phone to someone in close physical proximity. With this User Test, we are hoping to gain insights into where the product design is successful and what aspects need to be further improved. Main goals are obtaining a baseline user performance and identifying potential design concerns regarding ease of use. An additional goal is to promote F-Droid as an alternative to the Google Play app store.</p></p> <p>The usability test objectives are to determine usability problem areas within the user interface and content areas. Key focus points include:</p> <ul> <li>App navigation: failure to locate functions, excessive clicks to complete a task or failure to complete task</li> <li>Presentation errors: selection errors due to labeling ambiguities</li> </ul> <p>The usability test also aims to gain a deeper understanding of our users, what needs they are hoping to meet by using F-Droid, and a basic user-satisfaction level. Our participants for this round of testing will represent a range of ages, backgrounds and technological literacy levels. All tests will be performed with guidance and support of a test facilitator.</p> <hr /> <h2 id="methodology">Methodology</h2> <p>Users will be tested with the assistance of screen and audio recordings, which are to be analyzed post-test. A pre-test questionnaire will record basic demographic data and a post-test survey will gather insight on overall usability experience. The test will include a standard task completion portion as well as a desirability card sorting (to capture qualitative data on user experience).</p> <p>Participants will be asked to fill out a demographic and background information survey. The facilitator will explain that the amount of time taken to complete the task will be measured and that they should remain focused on the task. The participant will read the task description, ask any questions they may have and begin the task. Measurement begins when the participant begins the task.</p></p> <p>Participants will be encouraged to think aloud. The facilitator will minimally assist the participants during task completion. The facilitator will observe and enter user behavior, comments, and actions.</p></p> <p>After all task scenarios are attempted, the participant will complete the post-test desirability card activity and survey. This activity will comprise of asking participants to choose 5 cards they feel reflect their overall experience and elaborate on their choices. </p></p> <p><strong>Usability Tasks:</strong></p> <p>The tasks were randomly administered, with the exception of the “Last Task” which was always administered last.</p> <p>TASK A. Search for an app that you would like to download. Install the app you have selected.</p> <p>TASK B. There is an app that needs to be updated. Find the app and install the update.</p> <p>TASK C. Find a game app that looks interesting to you. Install the app.</p> <p>TASK D. Search for a crossword puzzle app within the games category.</p> <p>TASK E. If you had no internet, how would you download an app?</p> <p>TASK F. Your friend emails you a link to a collection of their favorite apps. Open gmail and click on the link they have sent you. Add the collection of apps that your friend emailed to you to F-Droid. Locate an app called Habitica from the collection you just downloaded.</p> <p>LAST TASK. Add the collection of apps displayed on the computer to F-Droid.</p></p> <p><strong>Desirability Cards:</strong></p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null15.png" width="624" height="213" alt="" title="" /> </p></p> <p>Metrics</p> <p>Tests hosted in two locations, Vienna, Austria and Lubbock, Texas. These charts represent the combined metrics for all tests at both locations.</p></p> <p><strong>Level of Difficulty:</strong></p> <p>The participants were asked to rate the level of difficulty per task as they completed them.</p></p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null16.png" width="624" height="457" alt="" title="" /> </p></p> <p><strong>Average Critical Error Rate:</strong></p> <p>Critical errors are reported as errors that result in failure to complete the task. Participants may or may not be aware that the task goal is incorrect or incomplete. Independent completion of the task is the goal. Help from the test facilitator or others is to be marked as a critical error. </p></p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null17.png" width="624" height="420" alt="" title="" /> </p></p> <p><strong>Average Non-critical Error Rate:</strong></p> <p>Non-critical errors are errors that the participant recovers from alone and are not such that the participant can no longer complete the task. They can include errors such as excessive steps taken to complete a task or initially using an incorrect function but recovering from that incorrect step. </p></p> <p>Non-critical errors do not include exploratory behavior. Exploratory behavior includes errors that are</p> <p>off task from the main task attempting to be completed.</p></p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null18.png" width="624" height="440" alt="" title="" /> </p> </p> </p> </p> </p> </p></p> <p><strong>Desirability Toolkit Responses</strong></p> <hr /> <p>Vienna:</p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null19.png" width="624" height="194" alt="" title="" /> </p></p> <p>Lubbock:</p> <p><img src="https://guardianproject.info/wp-content/uploads/2017/06/null20.png" width="624" height="160" alt="" title="" /></p> <hr /> <h3 id="detailed-testing-reports">Detailed Testing Reports</h3> <ul> <li><a href="https://docs.google.com/document/d/1Y7AV3N8cmqm7yMPFuK6_qbyO86IXYoAJuTuhwCHmnK4/?ts=5905d383#heading=h.sz9pxldla478" target="_blank">Detailed Report from Vienna</a></li> <li><a href="https://docs.google.com/document/d/1Wavy1Kce7WAmrM277e6QV6ziTvM05uMCsvGSdzi-Uzg" target="_blank">Detailed Report from Lubbock</a></li> <li><a href="https://docs.google.com/forms/d/1wbAoganpj9KpE00qQj0uOAPETkV9xodV4ubA2UZxbn8/#responses" target="_blank">Demographic Survey Results</a></li> <li><a href="https://docs.google.com/forms/d/1jflue3U1mV-ht55gfkdHPYvOjVernCmdbUdXn26DikU#responses" target="_blank">Follow-up Survey Results</a></li> </ul> https://guardianproject.info/2017/04/17/f-droid-a-new-ux-6-years-in-the-making/ Mon, 17 Apr 2017 10:19:19 -0400 https://guardianproject.info/2017/04/17/f-droid-a-new-ux-6-years-in-the-making/ <p>_(post by <a href="http://peter.serwylo.com/" target="_blank">Peter Serwylo</a>)_</p> <p>F-Droid has been a part of the Android ecosystem for over 6 years now.<br /> Since then, over 2000 apps have been built for the main repository,<br /> many <a href="https://gitlab.com/fdroid/fdroidclient/blob/master/CHANGELOG.md" target="_blank">great features have been added</a>, the client has been translated into over 40 different languages, and much more.</p> <p>However, the F-Droid UX has never changed much from <a href="https://f-droid.org/posts/f-droid-repository-alpha" target="_blank">the original three tab layout</a>:</p> <p><a href="https://guardianproject.info/wp-content/uploads/2017/04/0.11.png"><img src="https://guardianproject.info/wp-content/uploads/2017/04/0.11.png" alt="" width="320" height="427" class="size-full wp-image-13585" srcset="https://guardianproject.info/wp-content/uploads/2017/04/0.11.png 320w, https://guardianproject.info/wp-content/uploads/2017/04/0.11-225x300.png 225w" sizes="(max-width: 320px) 100vw, 320px" /></a><a href="https://guardianproject.info/wp-content/uploads/2017/04/0.102.png"><img src="https://guardianproject.info/wp-content/uploads/2017/04/0.102.png" alt="" width="323" height="427" class="size-full wp-image-13584" srcset="https://guardianproject.info/wp-content/uploads/2017/04/0.102.png 323w, https://guardianproject.info/wp-content/uploads/2017/04/0.102-227x300.png 227w" sizes="(max-width: 323px) 100vw, 323px" /></a></p> <p>This will change with the coming release of F-Droid client v0.103.</p> <p>Over the past 6 months, the F-Droid team has been busy redesigning a modern UX which will help bring F-Droid into the present.<br /> Some of the big ticket items include:</p> <ul> <li>Screenshots and feature graphics<br /></li> <li>Bulk download and install<br /></li> <li>Offline “queue for download”<br /></li> <li>Ability to translate apps metadata<br /></li> <li>Improved notifications for downloads and pending updates</li> </ul> <p><a href="https://guardianproject.info/wp-content/uploads/2017/04/appdetails-b.png"><img src="https://guardianproject.info/wp-content/uploads/2017/04/appdetails-b.png" alt="" width="318" height="570" class="size-full wp-image-13593" srcset="https://guardianproject.info/wp-content/uploads/2017/04/appdetails-b.png 318w, https://guardianproject.info/wp-content/uploads/2017/04/appdetails-b-167x300.png 167w" sizes="(max-width: 318px) 100vw, 318px" /></a><a href="https://guardianproject.info/wp-content/uploads/2017/04/appdetails-a.png"><img src="https://guardianproject.info/wp-content/uploads/2017/04/appdetails-a.png" alt="" width="318" height="570" class="size-full wp-image-13594" srcset="https://guardianproject.info/wp-content/uploads/2017/04/appdetails-a.png 318w, https://guardianproject.info/wp-content/uploads/2017/04/appdetails-a-167x300.png 167w" sizes="(max-width: 318px) 100vw, 318px" /></a><a href="https://guardianproject.info/wp-content/uploads/2017/04/updates.png"><img src="https://guardianproject.info/wp-content/uploads/2017/04/updates.png" alt="" width="318" height="570" class="size-full wp-image-13595" srcset="https://guardianproject.info/wp-content/uploads/2017/04/updates.png 318w, https://guardianproject.info/wp-content/uploads/2017/04/updates-167x300.png 167w" sizes="(max-width: 318px) 100vw, 318px" /></a><a href="https://guardianproject.info/wp-content/uploads/2017/04/nearby.png"><img src="https://guardianproject.info/wp-content/uploads/2017/04/nearby.png" alt="" width="318" height="570" class="size-full wp-image-13596" srcset="https://guardianproject.info/wp-content/uploads/2017/04/nearby.png 318w, https://guardianproject.info/wp-content/uploads/2017/04/nearby-167x300.png 167w" sizes="(max-width: 318px) 100vw, 318px" /></a><a href="https://guardianproject.info/wp-content/uploads/2017/04/categories.png"><img src="https://guardianproject.info/wp-content/uploads/2017/04/categories.png" alt="" width="318" height="570" class="size-full wp-image-13597" srcset="https://guardianproject.info/wp-content/uploads/2017/04/categories.png 318w, https://guardianproject.info/wp-content/uploads/2017/04/categories-167x300.png 167w" sizes="(max-width: 318px) 100vw, 318px" /></a><a href="https://guardianproject.info/wp-content/uploads/2017/04/latest.png"><img src="https://guardianproject.info/wp-content/uploads/2017/04/latest.png" alt="" width="318" height="570" class="size-full wp-image-13598" srcset="https://guardianproject.info/wp-content/uploads/2017/04/latest.png 318w, https://guardianproject.info/wp-content/uploads/2017/04/latest-167x300.png 167w" sizes="(max-width: 318px) 100vw, 318px" /></a></p> <p>In addition, we have been redesigning some of the smaller, but equally as important parts of the app, such as better support for visually impaired users who make use of tools such as Talkback, and better support for donating to open source app developers.</p> <p>This has involved extensive design input from UX designers and the community.<br /> In addition to the user tests that were conducted early on in the design process, further field tests are currently being conducted to ensure that usability issues with the new design are identified and resolved.</p> <p>Over the coming weeks you will see alpha releases for v0.103. We encourage your feedback and suggestions about how to continually improve the F-Droid client. This is one of the many improvements happening to the broader F-Droid ecosystem in 2017, so keep an eye out for more!</p> https://guardianproject.info/2017/04/17/f-droid-lubbock-report-what-we-want-to-know/ Mon, 17 Apr 2017 08:07:47 -0400 https://guardianproject.info/2017/04/17/f-droid-lubbock-report-what-we-want-to-know/ <hr /> <h1 id="f-droid-lbk-usability-study-report-what-we-want-to-know-p">F-Droid LBK Usability Study Report – What We Want to Know</p></h1> <p>Prepared by Carrie Winfrey</p> <p><em>Preliminary Version – April 17, 2017</em></p></p> <h2 id="introduction">Introduction</h2> <p>When planning this user test, the team outlined features and flows within the app on which we wanted feedback. From there, we created tasks for participants to complete that would access these areas, and produce insights related to our inquires.</p></p> <p>This document is organized by the tasks participants completed. Initial inquiry questions are outlined under each task, followed by the feedback and observations gained from the test. Last, within each section, I’ve listed suggestions for improvement related to the task.</p></p> <p>In the Lubbock sessions, 11 people participated in this focused usability study. More information on participant demographics, test methodology, metrics, and follow-up activities and insights will be provided soon.</p></p> <hr /> <hr /> <p><strong>PAGE_BREAK: PageBreak</strong></p> <h1 id="task-a-search-for-an-app-that-you-would-like-to-download-install-the-app-you-have-selected">TASK A – Search for an app that you would like to download. Install the app you have selected.</h1> <p>Average difficulty: 1.9</p> <p>Number of participants with critical errors: 0</p></p> <p>PARTICIPANT QUOTES</p> <p><em>“App won’t install. Found the game easily, though.”</em></p> <p>__</p> <p>__</p> <p><u>What we want feedback on</u></p> <ol> <li>Are users able to locate the search button? <ul> <li>Yes. Most users found the search button right away.</li> <li>Some (3 out of 10) browsed through the latest or category view to find an app instead of using search.</li> <li>One participant said he never saw the search button.</li> </ul></li> <li>Are they able to effectively use search? <ul> <li>Yes.</li> </ul></li> <li>Are they able to find what they’re looking for? <ul> <li>Not always. Searching for mainstream apps like Gmail, ESPN, Facebook and Twitter returns no relevant results.</li> <li>“It took about 10 tries to find an app I searched for. It might be difficult for users to find the app they have an interest in.”</li> <li>One participant searched for recipes, but misspelled it, so no relevant results were displayed.</li> </ul></li> <li>Other insights:</li> <li>Many users expressed that it was difficult to know if and app had installed. <ul> <li>“I found it difficult to figure out if the apps had installed. No notification?”</li> <li>Some participants searched on the home screen of the phone, then in the apps on their phone to see if the app had installed.</li> </ul></li> <li>4 participants were unable to install apps all together due to a bug in the app version being tested.</ul></li> </ol> <p><u>Suggestions for improvement:</u></p> <ul> <li><strong>Location of search</strong> <ul> <li>Though most people didn’t have trouble locating search, a majority are most familiar with finding it at the top of the screen.</li> </ul></li> <li><strong>Search results</strong> <ul> <li>Display more relevant search results. Ex: If someone searches for Gmail and we don’t have it, offer alternative email apps.</li> <li>Use suggestive results to help users avoid spelling errors and to make the action of searching quicker.</li> </ul></li> <li><strong>Feedback once installed</strong> <ul> <li>Provide better feedback once an app is installed for views within the app (installed from list view, app details and updates views).</li> <li>Show a system notification when an app is installed.</li> <li>Give the option to add installed apps to the home screen of the phone.</li> </ul></li> <li><strong>Fix bugs</strong> Fix bugs with installing apps.</p></li> </ul> <hr /> <p><strong>PAGE_BREAK: PageBreak</strong></p> <h1 id="task-b-there-is-an-app-that-needs-to-be-updated-find-the-app-and-install-the-update">TASK B – There is an app that needs to be updated. Find the app and install the update.</h1> <p>Average difficulty: 2.3</p> <p>Number of participants with critical errors: 0</p></p> <p>PARTICIPANT QUOTES</p> <p><em>“The update icon at the bottom with red number notifications was easy to find.”</em></p> <p><em>“It took me multiple attempts to update the applications.”</em></p> <p>__</p> <p>__</p> <p><u>What we want feedback on</u></p> <ol> <li>Is it clear where to go to find updates? <ul> <li>Yes. Every participant easily located the updates tab.</li> <li>“It was very easy to spot apps that need updating.”</li> </ul></li> <li>Can users successfully update an app? <ul> <li>No.</li> <li>The difference in word choice on app details than in updates view confused multiple users. <ul> <li>“The update icon at the bottom with red number notifications was easy to find. Once I clicked on the specific app to update it gave the option to uninstall or upgrade. I wasn’t sure if upgrade was the same as update or not – it sounded like something I’d have to pay for.”</li> </ul></li> <li>Every participant that tried to update an app from the updates view had problems. <ul> <li>“Took me multiple attempts to update the applications. Not positive the update occurred. There was no indication of completion.”</li> </ul></li> <li>It was unclear if an app had successfully updated. Participants were not confident that they had updated the app.</li> <li>We need to provide better feedback once an update is complete and successful.</ul></li> </ul></li> </ol> <p><u>Suggestions for improvement:</u></p> <ul> <li><strong>Word Choice</strong> <ul> <li>Change ‘upgrade’ to updates in app details.</li> </ul></li> <li><strong>Feedback</strong> <ul> <li>Provide better feedback once an update is complete and successful within the updates view.</li> <li>Give a system notification when an update is successful.</li> </ul></li> <li><strong>Fix bugs</strong> <ul> <li>I’ve shared a screen record that reveals the problems.</li> <li>For some users, the red badge indicator didn’t change after they updated the app. This behavior needs to be tested internally.</li> </ul></li> </ul> <p>PAGE_BREAK: PageBreak</p> <h1 id="task-c-find-a-game-app-that-looks-interesting-to-you-install-the-app">TASK C – Find a game app that looks interesting to you. Install the app.</h1> <p>Average difficulty: 1.7</p> <p>Number of participants with critical errors: 0</p></p> <p><u>What we want feedback on</u></p> <ol> <li>How do users browse when looking for a specific kind of app, like a game? Do they search, look in categories, browse, etc. <ul> <li>Most participants looked through the games category. Some browsed latest. Some used search.</li> <li>Many people found the categories view appealing, and spent more time there than on the latest view, when looking for apps. One participant compared it to the iTunes Store, but commented that it was even easier.</ul> </p></li> </ul></li> </ol> <h1 id="task-d-search-for-a-crossword-puzzle-app-within-the-games-category">TASK D – Search for a crossword puzzle app within the games category.</h1> <p>Average difficulty: 1.1</p> <p>Number of participants with critical errors: 0</p></p> <p><u>What we want feedback on</u></p> <ol> <li>Are users able to effectively search within categories? <ul> <li>We saw a variety of behaviors with this task. But, overall, people were able to do this without problems. <ul> <li>4 participants searched in within categories</li> <li>2 participants searched from search</li> <li>2 participants browsed in horizontal view of the category</li> <li>2 participants opened category and scrolled down to find </ul></li> </ul></li> </ul></li> </ol> <p><u>Suggestions for improvement:</u></p> <ul> <li><strong>Easier use of chip</strong> Once you clear a chip, there’s no easy way to get it back if you want to search within that category.</p></li> </ul> <hr /> <p><strong>PAGE_BREAK: PageBreak</strong></p> <h1 id="task-e-if-you-had-no-internet-how-would-you-download-an-app">TASK E – If you had no internet, how would you download an app?</h1> <p>Average difficulty: 3.1</p> <p>Number of participants with critical errors: 7 of 10 that attempted the task were unable to identify the nearby feature as the place to download apps without internet.</p></p> <p>PARTICIPANT QUOTES</p> <p><em>“Nearby didn’t give me the idea of downloading while offline.”</em></p> <p>__</p> <p>__</p> <p><u>What we want feedback on</u></p> <ol> <li>Are users able to discover how to download apps offline? <ul> <li>A few. But not the majority.</li> </ul></li> <li>Is it clear that you use they nearby feature to do this? <ul> <li>No.</li> <li>70% of participants never identified the nearby feature as the means for doing this.</li> <li>“Nearby didn’t give me the idea of downloading while offline.”</li> <li>30% successfully identified nearby. Though, most after looking several other places?</li> </ul></li> <li>What other behaviors are observed? <ul> <li>Turning WiFi off to see if the interface changed</li> <li>Going into airplane mode</li> <li>Downloading an airplane mode app</li> <li>Opening settings and looking in WiFi options</li> <li>Searching google.</ul></li> </ul></li> </ol> <p><u>Additional Observations</u></p> <ul> <li>People did not make the connection between ‘nearby’ and downloading apps offline.</li> <li>Not one participant read the text on the Nearby view when they initially tapped on it.</li> <li>Multiple people compared nearby to Air Drop on iOS</li> <li>“It’s going to airdrop a virus to your phone.”</li> </ul> <p><u>Suggestions for improvement:</u></p> <ul> <li><strong>Word choice</strong> <ul> <li>Reconsider the word choice.</li> </ul></li> <li><strong>Offline mode</strong> <ul> <li>The experience of the app should be obviously different when there’s no internet connection.</li> <li>Guide users toward the nearby feature if there’s no connection.</li> <li>Consider providing info in settings</li> </ul></li> <li><strong>More engaging visuals</strong> <ul> <li>If we want people to pay attention to the Nearby view, it needs to be more engaging.</li> <li>If we keep the language about offline, consider using iconography that communicates that.</p></li> </ul></li> </ul> <hr /> <p><strong>PAGE_BREAK: PageBreak</strong></p> <h1 id="task-f-your-friend-emails-you-a-link-to-a-collection-of-their-favorite-apps-open-gmail-and-click-on-the-link-they-have-sent-you-add-the-collection-of-apps-that-your-friend-emailed-to-you-to-f-droid-locate-an-app-called-habitica-from-the-collection-you-just-downloaded">TASK F – Your friend emails you a link to a collection of their favorite apps. Open gmail and click on the link they have sent you. Add the collection of apps that your friend emailed to you to F-Droid. Locate an app called Habitica from the collection you just downloaded.</h1> <p>Average difficulty: 2.2</p> <p>Number of participants with critical errors: Every participant was able to add add the repo. 4 of 11 participants were unable to locate the Habitica app that was added from the repo.</p></p> <p>PARTICIPANT QUOTES</p> <p>“I was able to find the link the email and accept the apps, but have no idea where to find the collection from my friend in F-Droid.”</p> <p>__</p> <p>__</p> <p><u>What we want feedback on</u></p> <ol> <li>Are users able to add a repo from a link opened on mobile? <ul> <li>Yes. No one had problems with this.</li> </ul></li> <li>Is the webpage for adding a repo clear? <ul> <li>Yes.</li> </ul></li> <li>Are users able to find the apps from a repo they have added? <ul> <li>No. Participants were very confused.</li> <li>100% participants didn’t know if they had added the repo successfully after completing the steps.</li> <li>“I was able to find the link in the email and accept the apps, but I have no idea where to find the collection from my friend in F-Droid.”</li> <li>Some were able to find one app by searching for it.</li> <li>Average non-critical errors for finding the app—2 <ul> <li>5 users were able to locate the app; most after multiple attempts</li> </ul></li> <li>Average critical errors for finding the app—3.73 <ul> <li>3 users were unable to locate the app added from the repo</li> </ul></li> <li>Other places people looked <ul> <li>In categories thinking the latest apps added would be shown first</li> <li>In the latest view</li> <li>In settings &gt; Manage installed apps</li> </ul></li> </ul></li> <li>Do users understand that the apps added from a repo are only made available to them, and not auto-downloaded and installed? <ul> <li>Not really. It was hard to know for sure since the users never saw a list of those apps on the phone once they added the repo.</li> <li>It seemed that some participants were surprised to see that they still had to download the app Habitica after finding it via search.</li> <li>Many participants assumed the apps from a repo would download.</ul></li> </ul></li> </ol> <p><u>Suggestions for improvement:</u></p> <ul> <li><strong>Feedback</strong> <ul> <li>Currently, there’s no indication of completion.</li> <li>The experience of adding an app cannot end after they tap add. People are way too confused. Also, currently after tapping add, the app returns to the screen they were previously on within the app, which could be anything.</li> </ul></li> <li><strong>Make apps accessible</strong> <ul> <li>The user needs to immediately be able to see the apps they just added to their phone. Note: it should be clear that these are made available, but not downloaded automatically.</li> <li>The user needs to be able to access the apps within a repo later on.</li> </ul></li> <li><strong>Handle delay</strong> <ul> <li>Is there a delay in the repo updating? We noticed that some people tried to search for an app that was within a repo they added, but even then, it didn’t show up.</li> <li>Update only the repo that was added instead of all. Not sure what the current behavior is.</p> </p></li> </ul></li> </ul> <hr /> <p><strong>PAGE_BREAK: PageBreak</strong></p> <h1 id="task-g-last-task-add-the-collection-of-apps-displayed-on-the-computer-to-f-droid">TASK G (Last Task) – Add the collection of apps displayed on the computer to F-Droid.</h1> <p>Average difficulty: 2.6</p> <p>Number of participants with critical errors: 0</p></p> <p>PARTICIPANT QUOTES</p> <p>“I followed the steps on the computer but wasn’t sure where the code from the QR scanner went. I added a new repository and there was a link already in it so I just clicked add, but have no idea what it did.”</p> <p>__</p> <p>__</p> <p><u>What we want feedback on</u></p> <ol> <li>Are users able to add a repo from a collection they view on desktop? <ul> <li>Yes. Surprisingly, the majority of participants did not have trouble scanned the QR code and adding the repo.</li> <li>Same confusions as mentioned above about knowing if it worked and locating the repo.</li> <li>“I don’t know if it worked. How do I know if it worked?”</li> </ul></li> <li>Is the word choice clear? <ul> <li>Somewhat. It didn’t trip people up from completing the task.</li> <li>Multiple people commented that the word repository didn’t resonate with them. They preferred the word Collections.</ul> </p></li> </ul></li> </ol> <p><u>Suggestions for improvement:</u></p> <ul> <li><strong>Fix bugs</strong> F-Droid crashed a lot after people scanned the code, opened F-Droid and tapped add. I think this was due to the phone being in landscape then portrait mode.</li> <li><strong>Integrate QR code scanner</strong> within the add repo view.</li> <li><strong>Word choice</strong></li> </ul> <hr /> <hr /> <hr /> <hr /> <hr /> <hr /> <p><strong>PAGE_BREAK: PageBreak</strong></p> <h1 id="additional-observations">Additional Observations</h1> <ul> <li><strong>Concerns of Malware</strong> While most participants were not keen on security and the potential risk of downloading apps from a source other than Google Play, one participant was keenly aware. He made multiple comments about how the app is an open door for malware. <ul> <li>**We need to address the security risks, and what F-Droid does to mitigate those risks. We need to be open and transparent in our communications to build trust.</li> </ul></li> <li><strong>Tablet</strong> Optimize the latest view for tablet. Show more grid tiles horizontally (i.e. display 3 instead of 2 in portrait mode) and increase font size.</p></li> </ul> <h2 id="more-information-coming-soon">More information coming soon!</h2> <ul> <li>Methodology (Note: All tasks were completed in different orders by the participants with the exception of Task G, which was always completed last.)</li> <li>Participant demographic</li> <li>Desirability toolkit</li> <li>Follow-up survey results</li> <li>Usability metrics &amp; stats</li> </ul> https://guardianproject.info/2017/03/30/proofmode-critiques-and-progress/ Thu, 30 Mar 2017 09:53:22 -0400 https://guardianproject.info/2017/03/30/proofmode-critiques-and-progress/ <p>Bruce Schneier was kind enough to <a href="https://www.schneier.com/blog/archives/2017/03/proof_mode_for_.html?utm_source=dlvr.it&amp;utm_medium=twitter">post about our work on ProofMode</a> to his <a href="https://www.schneier.com">blog</a>. A decent set of comments ensued, which we have considered, measured and weighed. We posted the response below on the post, and now also here. We also received an excellent set of <a href="http://www.lieberbiber.de/2017/03/07/the-guardian-projects-proof-mode-app-for-activists-doesnt-work/">feedback from the Lieberbiber blog</a>. Below are responses to the various concerns raised, and links to work completed or in progress.</p> <hr /> <p>At a high level, securely dating files, digital notarization, easy capture of sensor metadata, among other things, are not solved problems. For every day activists around the world, who may only have a cheap smartphone as their only computing device, they have no easy way to do any of these things. Even for high-level war crimes investigators, they are often using consumer point and shoot digital cameras, and documenting everything on paper.</p> <p>ProofMode is a simplified version of a much more complex and thorough system and app that we have built, called CameraV. In that model, we use a built-in custom camera, encrypted internal storage and much more complex set of metadata to generate the evidence and proof. We also capture baseline images from the sensor, and require those to be shared with the key, so that we can later match evidence photos from the sensor itself. You can read more about some of this here:<br /> <a href="https://guardianproject.github.io/informacam-guide/en/InformacamGuide.html" rel="nofollow"><a href="https://guardianproject.github.io/informacam-guide/en/InformacamGuide.html">https://guardianproject.github.io/informacam-guide/en/InformacamGuide.html</a></a></p> <p>We loved CameraV, but it was too complicated. Many frontline activists looking for a means to timestamp, sign, and otherwise add extra verifiable metadata to photos and videos they were capturing, found CameraV to be too complicated and burdensome. They helped us to design ProofMode, to strip it down to its bare essentials. In this case, we are working within pre-existing communities, with a shared set of pre-existing trust. What the activists are looking for is richer metadata, in easy to parse formats, that has timestamping, and some kind of cryptographic verification around it.</p> <p>We know our approach is not bulletproof, and that smart people like this who comment on this blog can fool it six ways from Sunday. This ProofMode release was versioned “0.0.x” for a reason. We are not saying it is finished by any means, clearly. We are actively developing it, and have a roadmap that will address most of not all of the major concerns pointed out here, while ALSO keeping it simple, streamlined, focused and easy to use.</p> <p>For example, we have implemented the Google SafetyNet API (<a href="https://koz.io/inside-safetynet/">https://koz.io/inside-safetynet/</a>) for automatically signing the hashes of the media, checking that the app is running on an actual Android device that wasn’t tampered with, and verifying the hash of the APK app itself matches our officially released version. Google’s servers produced a signed blob of data that gets appending to our proof data, and that can be verified later on a desktop or server. This one feature counteracts most of the “hey I can just fake this by hand with GPG” comments:<br /> <a href="https://github.com/guardianproject/proofmode/issues/15" rel="nofollow"><a href="https://github.com/guardianproject/proofmode/issues/15">https://github.com/guardianproject/proofmode/issues/15</a></a></p> <p>We are integrating supporting for OpenTimestamps and other blockchain based notary systems like Stampery: <a href="https://github.com/guardianproject/proofmode/issues/8" rel="nofollow"><a href="https://github.com/guardianproject/proofmode/issues/8">https://github.com/guardianproject/proofmode/issues/8</a></a><br /> For now, the app makes it very easy to send out a tweet, SMS or even a Signal message of the media’s hash, as a way to notarize it to various kinds of end points. We are working with human rights organizations to setup Signal-based notaries for their own internal logging.</p> <p>The analysis on the <a href="http://www.lieberbiber.de/" rel="nofollow"><a href="http://www.lieberbiber.de">http://www.lieberbiber.de</a></a> site is a good one, and also brings up the method by which we monitor for the presence of new photos and videos. We’ve had some comments about directly launching and monitoring the camera, which are helpful, but since we want to run in the background, that won’t really work:<br /> <a href="https://github.com/guardianproject/proofmode/issues/7" rel="nofollow"><a href="https://github.com/guardianproject/proofmode/issues/7">https://github.com/guardianproject/proofmode/issues/7</a></a></p> <p>The real progress there is moving to a new method Android provides for monitoring media, and away from just watching it at the file system. This has been implemented for newer Android devices:<br /> <a href="https://github.com/guardianproject/proofmode/commit/0ea9c9d73d7e55de612c89c466ef87da3524b6f1" rel="nofollow"><a href="https://github.com/guardianproject/proofmode/commit/0ea9c9d73d7e55de612c89c466ef87da3524b6f1">https://github.com/guardianproject/proofmode/commit/0ea9c9d73d7e55de612c89c466ef87da3524b6f1</a></a></p> <p>We are also looking at how we generate and store the keys we generate in the app. We agree that we did the minimal amount of work necessary to store and secure the key, just relying on the Android app sandboxing for now. We never intended this key to be used for encryption or longterm identity. Our thinking was more focused on integrity through digital signatures, with a bit of lightweight, transient identity added on.</p> <p>That said, we will be moving the key and credentials into the Android Keystore, which is the most secure key management solution possible on Android today.<br /> <a href="https://github.com/guardianproject/proofmode/issues/16" rel="nofollow"><a href="https://github.com/guardianproject/proofmode/issues/16">https://github.com/guardianproject/proofmode/issues/16</a></a></p> <p>All in all, it has just been a few weeks, and have already released multiple updates, that address most of the concerns that been raised. Work continues, and we hope that in no time, we’ll have an HSM-backed, yubikey-powered, blockchain-enabled, double ratchet encrypted and PQCrypto-resistent service, that will *still* be easy to use, under 3 MB and run on $100 Android phones.</p> https://guardianproject.info/2017/03/21/announcing-the-developer-challenges-survey/ Tue, 21 Mar 2017 11:32:22 -0400 https://guardianproject.info/2017/03/21/announcing-the-developer-challenges-survey/ <p><span style="font-weight: 400">In the </span><a href="https://guardianproject.info/"><span style="font-weight: 400">Guardian Project</span></a><span style="font-weight: 400">‘s current work with the </span><a href="https://f-droid.org/"><span style="font-weight: 400">FDroid</span></a> <span style="font-weight: 400">community to make it a secure, streamlined, and verifiable app distribution channel for high-risk environments we have started to become more aware of the challenges and risks facing software developers who build software in around the world.</span></p> <p><span style="font-weight: 400">There are a wealth of resources available on how to support and collaborate with high-risk users. Surprisingly, we could not find any guidance on how to support and collaborate with developers where the internet is heavily monitored and/or filtered, let alone developers who might be at risk because of the software they develop.</span></p> <p><span style="font-weight: 400">We have started <a href="https://guardianproject.info/2017/01/26/imagining-the-challenges-of-developers-in-repressive-environments/">conducting research</a> on developers from a range of closed and closing spaces. We hope that the results of this research will help international software projects and organizations better understand and respond to the unique needs of different international developer communities.</span></p> <p><span style="font-weight: 400">Part of this user research was the development of the </span><strong><a href="https://challenges.tech/">challenges.tech survey</a></strong> <span style="font-weight: 400">which will be used to help us form a better understanding of the challenges international developers face, their motivations, and their priorities. With the help of the </span><a href="https://www.localizationlab.org/"><span style="font-weight: 400">Localization Lab</span></a> <span style="font-weight: 400">we have translated this survey into <a href="https://challenges.tech/?lang=zh">Chinese</a>, <a href="https://challenges.tech/?lang=es">Spanish</a>, <a href="https://challenges.tech/?lang=fa">Farsi</a>, <a href="https://challenges.tech/?lang=ru">Russian</a>, <a href="https://www.challenges.tech/?lang=fr">French</a>, and <a href="https://www.challenges.tech">English</a>.</span></p> <p> </p> <p><span style="font-weight: 400">We have two requests:</span></p> <p><li style="font-weight: 400"> <span style="font-weight: 400">If you are a developer take</span><span style="font-weight: 400"><strong><a href="https://www.challenges.tech/"> the survey</a></strong>.</span><span style="font-weight: 400"> (<em>It takes about 10 minutes.</em>)</span> </li> <li style="font-weight: 400"> <span style="font-weight: 400">Share the survey with your networks and encourage them to pass it along. We would like to get a diverse range of developers to take the survey.</span> </li></p> <p> </p> <p><span style="font-weight: 400">We will close down the survey in a month. We will then replace the challenges.tech website with the aggregated survey results. </span></p> <p><span style="font-weight: 400">We will also publicly share the overall results of our research on the </span><a href="https://guardianproject.info/"><span style="font-weight: 400">Guardian Project</span></a> <span style="font-weight: 400">website in a research report. We hope that this report will help international organizations and software development projects understand and respond to the unique needs of different international developer communities.</span></p> https://guardianproject.info/2017/03/13/build-android-apps-with-debian-apt-install-android-sdk/ Mon, 13 Mar 2017 10:03:30 -0400 https://guardianproject.info/2017/03/13/build-android-apps-with-debian-apt-install-android-sdk/ <p><a href="https://guardianproject.info/wp-content/uploads/2015/04/debian.jpg"><img src="https://guardianproject.info/wp-content/uploads/2015/04/debian-150x150.jpg" alt="" width="150" height="150" class="alignright size-thumbnail wp-image-12920" srcset="https://guardianproject.info/wp-content/uploads/2015/04/debian-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2015/04/debian-300x300.jpg 300w, https://guardianproject.info/wp-content/uploads/2015/04/debian-270x270.jpg 270w, https://guardianproject.info/wp-content/uploads/2015/04/debian-230x230.jpg 230w, https://guardianproject.info/wp-content/uploads/2015/04/debian.jpg 600w" sizes="(max-width: 150px) 100vw, 150px" /></a><br /> In Debian stretch, the upcoming new release, it is now possible to build Android apps using only packages from Debian. This will provide all of the tools needed to build an Android app targeting the “platform” <tt>android-23</tt> using the SDK <tt>build-tools</tt> 24.0.0. Those two are the only versions of “platform” and “build-tools” currently in Debian, but it is possible to use the Google binaries by installing them into <tt>/usr/lib/android-sdk</tt>.</p> <p>This doesn’t cover yet all of the libraries that are used in the app, like the Android Support libraries, or all of the other myriad libraries that are usually fetched from jCenter or Maven Central. One big question for us is whether and how libraries should be included in Debian. All the Java libraries in Debian can be used in an Android app, but including something like Android Support in Debian would be strange since they are only useful in an Android app, never for a Debian app.</p> <p><strong>Building apps with these packages</strong></p> <p>Here are the steps for building Android apps using Debian’s Android SDK on Stretch.</p> <ol> <li><code>sudo apt install android-sdk android-sdk-platform-23</code></li> <li><code>export ANDROID_HOME=/usr/lib/android-sdk</code></li> <li>In <em>build.gradle</em>, set <em>compileSdkVersion</em> to 23 and <em>buildToolsVersion</em> to 24.0.0</li> <li>run <code>gradle assembleDebug</code></li> </ol> <p>The Gradle Android Plugin is also packaged. Using the Debian package instead of the one from online Maven repositories requires a little configuration before running Gradle. In the <em>buildscript</em> block:</p> <ul> <li>add <tt>maven { url &lsquo;file:///usr/share/maven-repo&rsquo; }</tt> to repositories</li> <li>use <tt>compile &lsquo;com.android.tools.build:gradle:debian&rsquo;</tt> to load the plugin</li> </ul> <p>Currently there is only the target platform of API Level 23 packaged, so only apps targeted at <em>android-23</em> can be built with only Debian packages. We will add more API platform packages via backports. Only <em>build-tools</em> 24.0.0 is available, so in order to use the SDK, build scripts need to be modified. Beware that the Lint in this version of Gradle Android Plugin is still problematic, so running the :lint tasks might not work. They can be turned off with <tt>lintOptions.abortOnError</tt> in <em>build.gradle</em>. Google binaries can be combined with the Debian packages, for example to use a different version of the platform or build-tools.</p> <p><strong>Why include the Android SDK in Debian?</strong></p> <p>While Android developers could develop and ship apps right now using these Debian packages, this is not very flexible since only <tt>build-tools-24.0.0</tt> and <tt>android-23</tt> platform are available. Currently, we are not aiming to cover the most common use cases. Those are pretty well covered by Google’s binaries (except for the proprietary license on the Google binaries), and are probably the most work for the Debian Android Tools Team to cover. We are first working on use cases that are poorly covered by the Google binaries, for example, like where only specific parts of the whole SDK are used. Here are some we have in mind:</p> <ul> <li>tools for security researchers, forensics, reverse engineering, etc. which can then be included in live CDs and distros like Kali Linux</li> <li>a hardened APK signing server using <em>apksigner</em> that uses a standard, audited, public configuration of all reproducibly built packages</li> <li>Replicant is a 100% free software Android distribution, so of course <a href="http://blog.replicant.us/2017/02/replicant-6-0-development-updates/" target="_blank">they want to have a 100% free software SDK</a></li> <li>high security apps need a build environment that matches their level of security, the Debian Android Tools packages are <a href="https://reproducible-builds.org" target="_blank">reproducibly built</a> only from publicly available sources</li> <li>dead simple install with strong trust path with mirrors all over the world</li> </ul> <p>In the long run, the <a href="https://wiki.debian.org/AndroidTools" target="_blank">Debian Android Tools Team</a> aims to cover more use cases well, and also building the Android NDK. This all will happen more quickly if we have more contributors! Android is the most popular mobile OS, and can be 100% free software like Debian. Debian and its derivatives are one of the most popular platforms for Android development.</p> <p>Last but not least, we want feedback on how this should all work. For example, we need ideas for how to nicely integrate Debian’s Java libraries into the Android <em>gradle</em> workflow. And ideally, the Android Support libraries would also be reproducibly built and packaged somewhere that enforces only free software.</p> <p>For anyone interested in tools for working with Android apps and APKs, including for reverse engineering, inspection, auditing, etc. there are quite a few tools included now in Debian:</p> <ul> <li><code>apt install android-sdk androguard apktool diffoscope dummydroid enjarify gplaycli libsmali-java libscout repo</code></li> </ul> https://guardianproject.info/2017/02/24/combating-fake-news-with-a-smartphone-proof-mode/ Fri, 24 Feb 2017 02:10:47 -0400 https://guardianproject.info/2017/02/24/combating-fake-news-with-a-smartphone-proof-mode/ <p>We have been working for many years with our partners at <a href="https://witness.org">WITNESS</a>, a leading human rights media training and advocacy organization, to figure out how best to turn smartphone cameras into tools of empowerment for activists. While it is often enough to use the visual pixels you capture to create awareness or pressure on an issue, sometimes you want those pixels to actually be treated as evidence. This means, you want people to trust what they see, to know it hasn’t been tampered with, and to believe that it came from the time, place and person you say it came from.</p> <p>Enter, <a href="https://github.com/guardianproject/proofmode"><strong>ProofMode</strong></a>, a light, minimal “reboot” of our more heavyweight, verified media app, <a href="https://guardianproject.info/apps/camerav">CameraV</a>. Our aim was to create a lightweight (&lt; 3MB!), almost invisible utility (minimal battery impact!), that you can run all of the time on your phone (no annoying notifications or popups), that automatically adds extra digital proof data to all photos and videos you take. This data can then be easily shared, when you really need it, through a “Share Proof” share action, to anyone you choose over email or a messaging app, or uploaded to a cloud service or reporting platform.</p> <p> </p> <p><a href="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-173908.jpg"><img class="size-medium wp-image-13520 alignleft" src="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-173908-169x300.jpg" alt="" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-173908-169x300.jpg 169w, https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-173908.jpg 540w" sizes="(max-width: 169px) 100vw, 169px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174004.jpg"><img class="size-medium wp-image-13521 alignleft" src="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174004-169x300.jpg" alt="" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174004-169x300.jpg 169w, https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174004.jpg 540w" sizes="(max-width: 169px) 100vw, 169px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174056.jpg"><img class="size-medium wp-image-13522 alignnone" src="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174056-169x300.jpg" alt="" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174056-169x300.jpg 169w, https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174056.jpg 540w" sizes="(max-width: 169px) 100vw, 169px" /></a></p> <p> </p> <p>On the technical front, what the app is doing is automatically generating an OpenPGP key for this installed instance of the app itself, and using that to automatically sign all photos and videos at time of capture. A sha256 hash is also generated, and combined with a snapshot of all available device sensor data, such as GPS location, wifi and mobile networks, altitude,  device language, hardware type, and more. This is also signed, and stored with the media. All of this happens with no noticeable impact on battery life or performance, every time the user takes a photo or video. We have been running it for months on fairly old, low end phones, and you just forget it is happening.</p> <p> </p> <p><a href="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174146.jpg"><img class="alignnone size-medium wp-image-13542" src="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174146-169x300.jpg" alt="" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174146-169x300.jpg 169w, https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174146.jpg 540w" sizes="(max-width: 169px) 100vw, 169px" /></a>   <a href="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174156.jpg"><img class="alignnone size-medium wp-image-13544" src="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174156-169x300.jpg" alt="" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174156-169x300.jpg 169w, https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170222-174156.jpg 540w" sizes="(max-width: 169px) 100vw, 169px" /></a></p> <p><em>While we are very proud of the work we did with the CameraV and InformaCam projects, the end results was a complex application and novel data format that required a great deal of investment by any user or community that wished to adopt it.</em> Furthermore, CameraV is an app that you have to decide and remember to use, in a moment of crisis. With ProofMode, we both wanted to simplify the adoption of the tool, and make it nearly invisible to the end-user, while making it the adoption of the tool by organizations painless through simple formats like CSV and known formats like PGP signatures.</p> <p>The source and direct APK downloads are available on Github: <a href="https://github.com/guardianproject/proofmode">https://github.com/guardianproject/proofmode</a></p> <p>The beta release is also available today for Android phones on <a href="https://play.google.com/store/apps/details?id=org.witness.proofmode">Google Play</a>. We hope to have an iPhone version in beta in the next few months.</p> <p>We have also published a sample batch proof data set on Github here: <a href="https://github.com/guardianproject/proofmode/tree/master/samples/sample-proof-1">https://github.com/guardianproject/proofmode/tree/master/samples/sample-proof-1</a></p> <p> </p> <p><strong>Our design goals included the following:</strong></p> <ul> <li>Run all of the time in the background without noticeable battery, storage or network impact</li> <li>Provide a no-setup-required, automatic new user experience that works without requiring training</li> <li>Use strong cryptography for strong identity and verification features, but not encryption</li> <li>Produce “proof” sensor data formats that can be easily parse, imported by existing tools (CSV)</li> <li>Do not modify the original media files; all proof metadata storied in separate file</li> <li>Support chain of custody needs through automatic creation of sha256 hashes and PGP signatures</li> <li>Do not require a persistent identity or account generation</li> </ul> <p>We also were able to take advantage of the new Android “Quick Settings” developer API, to add a ProofMode toggle button right along side other system functions like Wifi, Location, Bluetooth and more. This fulfills a vision that WITNESS has had for a while in mainstreaming the concept of our prototype into mainstream adoption, giving every citizen journalist a quick mode to activate when their moment arrives.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170223-220633.png"><img class="alignnone wp-image-13532 size-large" src="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170223-220633-576x1024.png" width="576" height="1024" srcset="https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170223-220633-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170223-220633-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170223-220633-768x1365.png 768w, https://guardianproject.info/wp-content/uploads/2017/02/Screenshot_20170223-220633.png 1080w" sizes="(max-width: 576px) 100vw, 576px" /></a></p> <p> </p> <p>You can read a bit more in the project <a href="https://github.com/guardianproject/proofmode/blob/master/README.md">README</a> on the workflow we imagine being used for all of this. What we hope is that the ProofMode app is simple and low impact enough that potential users will install and forget that it is there. It will go along doing its business quietly without fuss, until the user realizes they have taken a photo or video that might have some value as digital evidence. Then, using the SHARE PROOF action, they can send their proof dataset off to an organization, journalist, lawyer, or other advocate that would be able to verify the chain of custody and integrity of the files and proof using off the shelf OpenPGP and CSV visualization tools. While we have a bit more work to do making the verification and visualization process easier, we already have many partners at human rights organizations and in newsrooms who are skilled and capable of working with this kind of data today.</p> <p>If you’d like to learn more about the <a href="https://guardianproject.info/apps/camerav">CameraV</a> app and our collaboration with <a href="https://witness.org">WITNESS</a> and <a href="https://www.facebook.com/ColetivoPapoReto/">Coletivo Papo Reto</a> video activist group in Brazil, please watch this video below from the <a href="http://www.aljazeera.com/programmes/rebelgeeks/2015/12/bigger-brother-151216102151145.html">Al Jazeera “Rebel Geeks” documentary</a>.</p> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe src="//www.youtube.com/embed/ssbezlRkxt8" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe> </div> <p> </p> https://guardianproject.info/2017/02/22/f-droid-now-supports-apk-expansion-files-aka-obb/ Wed, 22 Feb 2017 10:24:53 -0400 https://guardianproject.info/2017/02/22/f-droid-now-supports-apk-expansion-files-aka-obb/ <p>Many games, mapping, and other apps require a large amount of data to work. The APK file of an Android app is limited to 100MB in size, yet it is common for a single country map file to be well over 100MB. Also, in order to get users running as quickly as possible, they should not have to wait for huge amounts of data to download in order to just start the app for the first time.</p> <p>Google created OBB aka “<a href="https://developer.android.com/google/play/expansion-files.html" target="_blank">APK Expansion</a>” files to provide a flexible means of delivering large amounts of data. This arragement also saves lots of bandwidth since app updates since the APK file and the OBB file can be updated separately. For example, a game’s assets do not need to change often, so they can be shipped as an OBB. Then when the app itself is updated (i.e. the APK), it does not need to include all those assets that are in the OBB file.</p> <p>OBB files are used by lots of apps like games and MAPS.ME. F-Droid supports OBB by downloading and installing the OBB before the APK, so that once the APK is installed, the OBB files are already in place and ready to use. F-Droid also provides an <em>Intent</em> method for apps to fetch the OBB download URLs in case the app itself needs to handle the OBB download/update. That is similar to how it works in Google Play.</p> <p>In order to use the OBB support, users need at least F-Droid v0.102, and the repo must use <em>fdroidserver</em> v0.7.0 or newer. Adding OBB files to a repo is very easy: just copy them to the same folder where the APKs go, i.e. <em>/path/to/fdroid/repo/</em>.</p> <p><strong>Developer Usage</strong></p> <p>One of the details about using OBB files in apps is that OBB files are not guaranteed to be installed by the app store. That means the app could start, and the expected OBB files will not be there. In that case, the app must download and install the OBB file itself. Google Play recommends using their proprietary <a href="https://developer.android.com/google/play/licensing/index.html" target="_blank">Application Licensing</a> service for this, F-Droid provides a simple method that is all free software.</p> <p>To get the URL for the two possible OBB files, send an <code>Intent</code> to F-Droid using these <em>Actions</em>:</p> <ul> <li><code>org.fdroid.fdroid.action.GET_OBB_MAIN_URL</code><br /></li> <li><code>org.fdroid.fdroid.action.GET_OBB_PATCH_URL</code></li> </ul> <p>Then download that URL using your favorite method, and make sure that the file ultimately ends up in <em>Android/obb/&lt;packageName&gt;</em> on the device’s External Storage.</p> https://guardianproject.info/2017/02/22/build-your-own-app-store-android-media-distribution-for-everyone/ Wed, 22 Feb 2017 09:45:11 -0400 https://guardianproject.info/2017/02/22/build-your-own-app-store-android-media-distribution-for-everyone/ <p>Most people get their Android apps from Google Play. It is usually the simplest and most secure option for them. But there are also many people who do not have access to Google Play. This might be due to lack of a proper internet connection or simply because Google Play is blocked within their country.</p> <p>The <a href="https://f-droid.org/">F-Droid</a> project already offers <a href="https://guardianproject.info/2015/06/02/building-a-trustworthy-app-store-that-respects-privacy/">tools to create independent app distribution channels for Android apps</a>. These tools are ready for production, but require expert knowledge and the command-line to be used. Now, we want to build upon this foundation and develop curation tools that can also be used by people with little technical knowledge, thus making the app distribution technology more broadly available.</p> <h3 id="use-cases">Use-Cases</h3> <p>The primary use-case we want to address is to circumvent app store censorship and blocking. But there are other use-cases that benefit from easy-to-setup app stores as well.</p> <p>There are Android phones and tablets that do not have Google Play available, either because their manufacturer did not get a license from Google or because their owners prefer their phones Google-free.</p> <p>Similar to Apple’s app store, the terms of service of Google Play exclude certain apps from being distributed and these are being removed on a regular basis. Having alternative means for distribution of apps is often the only way to bring those apps to people.</p> <h3 id="features">Features</h3> <h4 id="core-features">Core Features</h4> <ul> <li>Create a new app repository</li> <li>Add new apps/media to the repository</li> <li>Update existing apps/media to the repository</li> <li>Update the description and metadata of apps/media</li> <li>Remove apps/media from the repository</li> <li>Automatic generation of repository website with QR Code (and instructions)</li> <li>Import apps directly from other repositories</li> </ul> <h4 id="optional-future-features">Optional Future Features</h4> <ul> <li>Archive apps/media to archive repository</li> <li>Remove installed apps/media from user’s devices</li> <li>Provide hosted web-app with user-management (Sign-Up, Lost Password) as a service</li> <li>Allow multiple curators to manage the same repository</li> <li>Import apps (and their description) from Google Play</li> <li>Check for updates from Google Play periodically and automatically import them</li> <li>Making the repository available through the Tor network</li> <li>Generate custom white-labelled repository app (based on F-Droid)</li> <li>App security scanner for vulnerable libraries and Virus Total (opt-in) upload</li> <li>App browsing and download on generated repository website</li> </ul> <h3 id="target-audience">Target Audience</h3> <p>The main audience for this work are activists and trainers with moderate technical knowledge who need to securely distribute apps and updates to their community. This is especially a concern in countries where the official app store is blocked. Organizations like Amnesty International for example still need to enable people in those countries to securely receive their apps and updates.</p> <p>The person maintaining the repository might use any operating system and in some cases might not even have a laptop/desktop computer available. They might be targeted by advanced attackers that can intercept and insert arbitrary traffic, but do not have the ability to compromise large service providers such as Amazon.</p> <p>Furthermore, this work might also be used by the following groups:</p> <ul> <li>service providers (who want own distribution and update mechanism for their apps)</li> <li>individual software developers (who want to distribute beta releases for e.g. user-testing)</li> <li>everybody else who needs full control of the entire distribution and update process</li> </ul> <h3 id="implementation-options">Implementation Options</h3> <p>There are roughly four different ways, the app store curation tool could be implemented. Each has their own pro and cons as well as different implications for the usability.</p> <h4 id="command-line-interface">Command-line interface</h4> <p>The current app repository tools are already used via the command-line, but they require some setup and several non-intuitive commands to be executed. The goal here would be to reduce the number of required commands as much as possible and make them easy to understand and remember. This would be similar to how Letsencrypt’s Certbot simplified SSL certificate management.</p> <p>Pros</p> <ul> <li>least amount of work building directly on existing tools</li> <li>signing key could be created and stored on local device</li> </ul> <p>Cons</p> <ul> <li>too difficult to use for people with no prior command-line experience</li> <li>off-putting and not inviting for potential non-expert curators</li> <li>adds little benefit to existing solution</li> </ul> <h4 id="cross-platform-desktop-application">Cross-Platform Desktop Application</h4> <p>A graphical user interface (GUI) could be added to the existing tools to make them easier to use. Existing UI toolkits such as Qt, Gtk or Tcl/Tk could be used for this.</p> <p>Pros</p> <ul> <li>can make use of existing python tools</li> <li>signing key could be created and stored on local device</li> </ul> <p>Cons</p> <ul> <li>requires a desktop computer and installation procedure (possibly of dependencies as well)</li> <li>need to maintain and support install packages for Windows and MacOS</li> </ul> <h4 id="android-app">Android App</h4> <p>The free software <a href="https://f-droid.org">F-Droid app</a> already includes repository functionality used for direct app swapping. This could be modified to publish repositories to remote servers and extended by curation functionality. Alternatively, a new app could be developed that is dedicated to repository curation and could contrary to F-Droid even be distributed via Google Play.</p> <p>Pros</p> <ul> <li>Simple installation</li> <li>No desktop computer required</li> </ul> <p>Cons</p> <ul> <li>Needs reimplementation of existing Python code in Java</li> <li>Signing key stored on potentially less secure mobile device</li> </ul> <h4 id="web-app">Web App</h4> <p>The user interface for repository curation could be implemented as a web application that is accessed through a web browser. Low-risk curators could use a hosted instance for maximum simplicity while others could also access the interface through a local (built-in) web-server. Powerful web frameworks such as Flask or Django might be a good choice for that job.</p> <p>Pros</p> <ul> <li>Very easy to use from every device</li> <li>Does not need installation (lower usage barrier)</li> <li>Can make use of existing python tools</li> <li>Makes multi-curator feature potentially easier to implement</li> </ul> <p>Cons</p> <ul> <li>In hosted mode: signing keys need to be stored permanently on a web server</li> </ul> <h3 id="security-considerations">Security Considerations</h3> <h4 id="repository-attacks">Repository Attacks</h4> <p>The technology used for app distribution needs to ensure the integrity and authenticity of apps provided in the repository. It can not prevent malicious apps from being <em>intentionally</em> distributed, but can offer a security scanner to reduce the risk of unintentional distribution. An attack is considered successful when the content provided by the curator of the repository can be altered so that the changes propagate to users’ devices.</p> <p>Malicious apps might compromise the targeted application or the entire phones (root exploit). There are two defenses against unintentional distribution of malicious apps:</p> <ol type="1"> <li> app package signatures: clients trust the provided app signature on first installation (TOFU) and refuse updates with a different signature. </li> <li> repository signature: clients check signature when repository is installed and with every update. They warn and refuse operations with the repository when the signature is invalid. </li> </ol> <p>The first defense is out of scope for this work, because app packages are signed when the app is built so that they are already signed when added to the repository. The repository curation should still not allow to publish an update that carries a different signature.</p> <p>The second defense needs to be provided automatically by the curation tools. A repository signing key needs to be created and securely stored. If this key is compromised, an attacker can modify app metadata and can inject modified apps for specific or all users when they install them for the first time. Malicious updates of already installed apps are prevented by above package signature.</p> <p>If the repository key is created and stored automatically by a service (see implementation option 4), the curator needs to trust the service and the hosting provider. Both need to be out of reach of attackers from the curators’ threat-model. For example, if the Guardian Project provides a repository service hosted in Amazon’s Cloud, this service should be out of reach of most attackers that have neither the ability to compromise the Guardian Project, nor Amazon. Advanced nation-state adversaries could compromise both and thus the repository. Recipients of apps need to trust their distributors/curators and their ability to keep their own system secure.</p> <p>However, we can generally not protect against attackers who has the ability to directly compromise the users’ devices. All that can be done is to prevent malicious applications from being installed <em>via the repository</em> (without knowledge of the curator). If the attacker can compromise users’ devices through other means, this defense does not matter anymore.</p> <h4 id="root-and-unknown-sources">Root and Unknown Sources</h4> <p>In order to get content from the provided repository onto a generic device, the user needs to install F-Droid which requires allowing the installation of apps from unknown sources. This can put the user at risk, because it makes installing malicious application very easy. Alternatively, super user privileges (root) can be used to install F-Droid’s system extension effectively trusting all apps installed via F-Droid. However, the security risks associated with super user privileges are even more severe as they can lead to compromise of the entire device.</p> <h4 id="lack-of-updates">Lack of Updates</h4> <p>If a repository is the user’s sole source for an application, any delay in providing updates might put the user at risk of an adversary exploiting a vulnerability in that application that would have otherwise been fixed by the missing update.</p> <h3 id="what-we-will-do">What We Will Do</h3> <p>The main goal of the curation tools is to make creating and maintaining repositories as easy as possible for our target audience.</p> <p>This rules out the command line and the desktop application, since today’s user experience expectations are no longer being fulfilled by these technologies. While a desktop application comes closer, the need for an installation procedure and for maintaining it for different operating systems makes it too difficult and error-prone compared to the two other remaining options.</p> <p>Implementing the curation tools within an Android application has its merits. It comes with an easy installation procedure, provides a familiar state-of-the-art user interface and allows apps to be added directly from the curators’ device. However, some existing functionality would need to be reimplemented in Java and maintained along-side the existing Python codebase. Also the curator needs to provide an external storage location for the repository which can be a barrier for many users and needs its own documentation.</p> <p>The easiest and most flexible solution is a web-application based on the existing Python tools. More advanced curators can use it on a local desktop computer with a built-in web-server just like a desktop application, only that the UI is in the browser. This usage scenario comes with the same pros and cons like the desktop application. The repository signing key for example is stored locally under the curator’s control.</p> <p>But it allows for other usage scenarios as well. If installed on a trusted web-server as a service, the curation tools can also be used by curators with little technical knowledge. The curators don’t need to install anything and can use them from any device. They can even switch devices without a data migration. However, they would need to give up control over the signing key.</p> <p>If time permits, the app store creator can be turned into a full repository service that allows user registrations and several repositories per user. A trusted organization such as the Guardian Project could host this as a service and provide it to an activist community. Software freedom would allow other organizations to host their own repository services as well. You can imagine the activist collective Riseup for example not only hosting its own repository of recommended apps, but also allowing its users to create and curate their own repositories.</p> <p>This becomes even more interesting when people fill their repositories not only with apps, but with all sorts of files such as books, music and photos.</p> https://guardianproject.info/2017/01/30/how-can-we-learn-without-watching/ Mon, 30 Jan 2017 14:40:05 -0400 https://guardianproject.info/2017/01/30/how-can-we-learn-without-watching/ <p>What kind of measurement, tracking or analytics do you use, and can you sleep at night with your decision?</p> <p>As part of the <a href="https://berkmankleinassembly.org/">Berkman-Klein Assembly</a> program at Harvard, I am working with a team to imagine a next-generation mobile and IoT analytics system that has privacy, confidentiality and anonymity at its core. The hope is we can find ways to learn what our users like and understand how our apps are performing without having to rely on proprietary cloud services, logging liability, network vulnerabilities, and invasive app permissions.</p> <p>With that in mind, we want to hear from you, as a developers and users interested in private, free and secure applications and devices, to understand the compromises you are making today. Please answer the questions below, and optionally provide your contact information, so we can get in touch with you for further help developing this new idea.</p> <p>(the survey is now closed, thanks!)</p> <p> </p> <p>Image By Dave Morice Uploaded by Mkacer at en.wikipedia (Author  Transferred from en.wikipedia by SreeBot) [CC BY-SA 3.0 (<a href="http://creativecommons.org/licenses/by-sa/3.0)">http://creativecommons.org/licenses/by-sa/3.0)</a>], via Wikimedia Commons</p> https://guardianproject.info/2017/01/26/imagining-the-challenges-of-developers-in-repressive-environments/ Thu, 26 Jan 2017 09:56:59 -0400 https://guardianproject.info/2017/01/26/imagining-the-challenges-of-developers-in-repressive-environments/ <p>The Guardian Project team spends a lot of time thinking about users. In our work we focus on easy-to-use applications for users in high-risk scenarios. Because of this we are very focused on security. In our current work with the FDroid community to make it a secure, streamlined, and verifiable app distribution channel for high-risk environments we have started to become <a href="https://guardianproject.info/2015/02/24/phishing-for-developers/">more aware</a> of the challenges and risks facing software developers who build software in high-risk environments.</p> <p>There are a wealth of resources available on how to support and collaborate with high-risk users. Unsurprisingly, we could not find any guidance on how to support and collaborate with developers in repressive environments, let alone developers who are put at high-risk because of the software they develop. So, we have started conducting “user research” with developers from a range of repressive environments.</p> <p>We started our user research by conducting surveys and interviews with Internet Freedom donors, developers, and CSOs about the challenges of being a, or working with, software developers in places where the internet is heavily monitored and filtered. We did this for two reasons. First, we want to make sure that the output produced is valuable to our target audience. Second, we wanted to see how this community viewed the challenges that these developers face. We are a little over ¾ done with our interviews and decided to share some initial thoughts from our interviews alongside that initial survey research.</p> <h3 id="how-to-read-the-survey-results">How to read the survey results</h3> <p>Each of the plots below shows how survey respondents ranked the level of challenge or negative impact specific factors had on the different phases of the development life-cycle. The survey split these rankings into categories that included the design (<strong>Des</strong>) and development (<strong>Dev</strong>) of software; deploying (<strong>Dep</strong>) and maintaining (<strong>Maint</strong>) software; and general threats (<strong>Thrt</strong>).</p> <p>Participants were also asked to provide some basic information about their relationship to developers in repressive environments. We did this to explore the ways that experience might impact how some groups evaluate the challenges faced by developers in repressive environments. Using their answers we split the results into six groups.</p> <p><strong>At Risk</strong>: The type of of software development they, or those they interact with, could put either of them at risk.<br /> <strong>Censor/Surv</strong>: They are based in a place where the internet is heavily monitored filtered.<br /> <strong>Not Censor/Surv</strong>: They are not based in a place where the internet is heavily monitored filtered.<br /> <strong>Collab</strong>: They collaborate, support, or work with developers who are based in a place where the internet is heavily monitored or filtered.<br /> <strong>Dev</strong>: They develop Software<br /> <strong>All</strong>: Everyone who was surveyed.</p> <p>The initial survey was not designed to create accurate comparisons between groups who were surveyed and the data visualizations do not reflect the number of participants who declined to answer specific questions. It is also important to note that we asked participants to fill out the survey based upon the regions that they work in. Because of the possible identifying nature of participants responses we did not ask them to identify what regions those were. This had led to a wide variation in many of the responses.</p> <h3 id="infrastructure">Infrastructure</h3> <p>Infrastructure plays a critical role in technological development. Software development, distribution, and use require an interconnected world of infrastructure. Only a small portion of this infrastructure is controlled and maintained by the developer. They also rely on a range of public and private infrastructure to provides power, connectivity, and financial support.</p> <p>To explore these topics we first asked about the challenge that barriers to Internet access played in the design (<strong>Des</strong>) and development (<strong>Dev</strong>) of software for developers in high-risk environments. Generally, respondents thought that it was a greater challenge for developers to design software for these environments than to conduct development in these environments.</p> <div id="attachment_13476" style="width: 1011px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2016/12/bandwidth.png"><img aria-describedby="caption-attachment-13476" class="wp-image-13476 size-full" src="https://guardianproject.info/wp-content/uploads/2016/12/bandwidth.png" width="1001" height="285" srcset="https://guardianproject.info/wp-content/uploads/2016/12/bandwidth.png 1001w, https://guardianproject.info/wp-content/uploads/2016/12/bandwidth-300x85.png 300w, https://guardianproject.info/wp-content/uploads/2016/12/bandwidth-768x219.png 768w" sizes="(max-width: 1001px) 100vw, 1001px" /></a> <p id="caption-attachment-13476" class="wp-caption-text"> Internet/data bandwidth, connectivity, and/or cost </p> </div> <p>In our interviews we have heard that barriers to internet access can make it difficult to learn how to develop software and to easily get the libraries, documentation, and support that make developing software easier. It is not a universal challenge. Access varies widely depending upon the developer’s region. When it is a barrier it is often one of the largest barriers that is faced. We were happy to find that the challenges of designing software for users in areas with barriers to Internet access is one area where there is <a href="https://developers.google.com/billions/">existing guidance</a> for developers in these regions.</p> <p>We also asked how a developer’s own infrastructure led to challenges when developing (<strong>Dev</strong>), deploying (<strong>Dep</strong>), and maintaining (<strong>Maint</strong>) software.</p> <div id="attachment_13477" style="width: 1011px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2016/12/dev_infra.png"><img aria-describedby="caption-attachment-13477" class="size-full wp-image-13477" src="https://guardianproject.info/wp-content/uploads/2016/12/dev_infra.png" alt="" width="1001" height="285" srcset="https://guardianproject.info/wp-content/uploads/2016/12/dev_infra.png 1001w, https://guardianproject.info/wp-content/uploads/2016/12/dev_infra-300x85.png 300w, https://guardianproject.info/wp-content/uploads/2016/12/dev_infra-768x219.png 768w" sizes="(max-width: 1001px) 100vw, 1001px" /></a> <p id="caption-attachment-13477" class="wp-caption-text"> Developer Infrastructure (e.g Hosting, setup, security, software) </p> </div> <p>This topic, like barriers to internet access, had widely varying responses in the Interviews depending on the region the developer was based in. Unlike internet access, where technology was the root of the challenges the responses to these questions showed that legal challenges were the root of hosting challenges. In regions where international sanctions were in place this was a greater concern in the everyday experience of developers. Data localization was another more recent legal concern that was brought up in the interviews.</p> <p>Financial infrastructure and other economic challenges can impact various stages of the software lifecycle. Even FOSS developers need to make a living. To look at financial infrastructure we asked if access to payment systems was a challenge when designing (<strong>Des</strong>) and developing (<strong>Dev</strong>) software. We also asked about general challenges to monetizing and earning revenue when maintaining software and supporting users (<strong>Maint</strong>).</p> <div id="attachment_13478" style="width: 1011px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2016/12/money.png"><img aria-describedby="caption-attachment-13478" class="size-full wp-image-13478" src="https://guardianproject.info/wp-content/uploads/2016/12/money.png" alt="" width="1001" height="285" srcset="https://guardianproject.info/wp-content/uploads/2016/12/money.png 1001w, https://guardianproject.info/wp-content/uploads/2016/12/money-300x85.png 300w, https://guardianproject.info/wp-content/uploads/2016/12/money-768x219.png 768w" sizes="(max-width: 1001px) 100vw, 1001px" /></a> <p id="caption-attachment-13478" class="wp-caption-text"> Economics (payment, monetizing, & earning revenue) </p> </div> <p>As with many of the other questions payment and monetization challenges vary widely by region. Interviewers from areas with economic sanctions spoke of monetization as a greater challenge than any other group of interviewees. Because economic challenges vary so widely, we will hold off on discussing them in more depth until we are done with our analysis.</p> <h3 id="localization">Localization</h3> <p>Many developers face challenges far before they have to worry about their infrastructure. Not only are a majority of programming languages in English, many of the textbooks used to teach software development are in English as well. We asked our survey participants if localized software libraries, platforms, or developer documentation were a challenge for developers in high-risk environments when they were designing (<strong>Des</strong>), developing (<strong>Dev</strong>), and deploying (<strong>Dep</strong>) software.</p> <div id="attachment_13479" style="width: 1011px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2016/12/localization.png"><img aria-describedby="caption-attachment-13479" class="size-full wp-image-13479" src="https://guardianproject.info/wp-content/uploads/2016/12/localization.png" alt="" width="1001" height="285" srcset="https://guardianproject.info/wp-content/uploads/2016/12/localization.png 1001w, https://guardianproject.info/wp-content/uploads/2016/12/localization-300x85.png 300w, https://guardianproject.info/wp-content/uploads/2016/12/localization-768x219.png 768w" sizes="(max-width: 1001px) 100vw, 1001px" /></a> <p id="caption-attachment-13479" class="wp-caption-text"> Localization of software libraries, platforms, or developer documentation </p> </div> <p>Access to localized content was seen as a primary concern in almost every interview we have had with developers. In multiple interviews basic English language skills were even described as a requirement for any software development. Even developers with basic technical English skills spoke about the challenges of finding the appropriate tools and libraries because the descriptive documentation was difficult to skim. The lack of multi-language books, blog-posts, and forums also impedes access to best-practices and developer guidance.</p> <h3 id="targeted-attacks">Targeted Attacks</h3> <p>Attacks that focus on compromising the user through counterfeit software pirated by a user are not new. But, increased secondary and local markets for apps increase the possible otherwise legitimate locations where a malicious counterfeits of apps can be uploaded. We asked questions about impact of possible malicious counterfeit versions of their software being produced on how developers their design (<strong>Des</strong>) and deploy (<strong>Dep</strong>) their software. Targeted attacks against developers can be used to compromise their otherwise legitimate software to to deliver malicious content. We also asked about the challenges related to possible backdoors in the software or developer tools they used (<strong>Thrt</strong>).</p> <div id="attachment_13480" style="width: 967px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2016/12/malicious.png"><img aria-describedby="caption-attachment-13480" class="size-full wp-image-13480" src="https://guardianproject.info/wp-content/uploads/2016/12/malicious.png" alt="" width="957" height="285" srcset="https://guardianproject.info/wp-content/uploads/2016/12/malicious.png 957w, https://guardianproject.info/wp-content/uploads/2016/12/malicious-300x89.png 300w, https://guardianproject.info/wp-content/uploads/2016/12/malicious-768x229.png 768w" sizes="(max-width: 957px) 100vw, 957px" /></a> <p id="caption-attachment-13480" class="wp-caption-text"> Malicious & Counterfeit Software </p> </div> <p>Only a couple of the developers we interviewed expressed concern about malicious counterfeit versions of their applications.</p> <p>While targeted attacks were acknowledged by some interviewees, most described the insertion of backdoors as less likely than targeted threats that aimed at stopping the developer from continuing development. The initial survey asked about the challenge of developer account shutdown and/or seizures during development (<strong>Dev</strong>) and take-down requests (<strong>Thrt</strong>) because of content restrictions, defamation laws, copyright claims, etc.</p> <div id="attachment_13481" style="width: 967px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2016/12/takedown.png"><img aria-describedby="caption-attachment-13481" class="size-full wp-image-13481" src="https://guardianproject.info/wp-content/uploads/2016/12/takedown.png" alt="" width="957" height="285" srcset="https://guardianproject.info/wp-content/uploads/2016/12/takedown.png 957w, https://guardianproject.info/wp-content/uploads/2016/12/takedown-300x89.png 300w, https://guardianproject.info/wp-content/uploads/2016/12/takedown-768x229.png 768w" sizes="(max-width: 957px) 100vw, 957px" /></a> <p id="caption-attachment-13481" class="wp-caption-text"> Account shutdown and/or seizures during development or software take-down requests </p> </div> <p>The in-platform censorship we surveyed for was seen as far less a challenge in the interviews. Interviewees were far more concerned about the possibility of real-world legal censorship or harassment. When asked how developers addressed their perceived threats many of the interviewees noted that developers go beyond technological measures to protect themselves. Many also rely heavily on the strategic use of pseudonyms and other operational security measures.</p> <h3 id="conclusion">Conclusion</h3> <p>With our interviews nearly complete it is interesting to look back at, what seemed like, wide disagreement at the time of the survey as an indicator of how important local context is to the challenges and threats faced by developers in repressive societies. Over the next couple of months we will be building user personas that synthesize and codify our findings. We hope these personas will help other individuals and organizations working on internet freedom issues to think about how they can structure their projects to support and collaborate with developers in repressive environments in safe and productive ways.</p> https://guardianproject.info/2017/01/19/new-partnership-with-circle-of-6-mobile-safety-app/ Thu, 19 Jan 2017 06:00:34 -0400 https://guardianproject.info/2017/01/19/new-partnership-with-circle-of-6-mobile-safety-app/ <p><strong>Circle of 6 Focuses on Security with Guardian Project Partnership</strong></p> <p><span style="font-weight: 400;">Safety App Will Get End-to-End Encryption and More To Support High-Risk Communities</span></p> <p><strong>New York, NY:</strong> <span style="font-weight: 400;">Two innovative organizations have partnered to bring increased digital security and privacy capabilities to users interested in improved safety for their mobile devices. Tech 4 Good, the developer of Circle of 6, a highly regarded mobile safety app developed to promote safety and health through networks of trust, has partnered with Guardian Project, a leader in mobile security and privacy technologies. The two organizations will work to upgrade the capabilities of the Circle of 6 app to provide users with secure messaging, private identities and improved physical security of device data.</span></p> <p> </p> <p><img class="alignnone wp-image-13488 size-large" src="https://guardianproject.info/wp-content/uploads/2017/01/Co6-Screens-1024x921.png" width="945" height="850" srcset="https://guardianproject.info/wp-content/uploads/2017/01/Co6-Screens-1024x921.png 1024w, https://guardianproject.info/wp-content/uploads/2017/01/Co6-Screens-300x270.png 300w, https://guardianproject.info/wp-content/uploads/2017/01/Co6-Screens-768x691.png 768w" sizes="(max-width: 945px) 100vw, 945px" /></p> <p><span style="font-weight: 400;">Circle of 6 is coordinating with a number of organizations interested in expanding the focus of the app beyond general safety and defense against sexual violence, to include other high risk communities. </span></p> <p><em><span style="font-weight: 400;">“Circle of 6 is excited to forge this partnership with Guardian Project to bring increased privacy and security to our existing users and to new communities. We’ve received much interest globally in expanding the ways that Circle of 6 and its safety and connectivity features can be used in multiple contexts. This a thrilling step forward.”</span></em> <em><span style="font-weight: 400;">– Nancy Schwartzman</span></em></p> <p><span style="font-weight: 400;">Guardian Project will integrate its free and open-source software libraries to provide support for <a href="https://guardianproject.info/2016/01/12/panickit-making-your-whole-phone-respond-to-a-panic-button/">multiple emergency hardware triggers</a>, more <a href="https://guardianproject.info/code/netcipher">secure network communication</a>, and defense against surveillance and censorship.</span></p> <p><span style="font-weight: 400;">Updated and new versions of the app will be available by May 1, 2017. </span></p> <p><strong>About Circle of 6:</strong></p> <p><span style="font-weight: 400;">Circle of 6 is a survivor-led and queer-led initiative, that takes a public health and harm-reduction approach to personal safety. Drawing from the experience of sexual assault survivors, youth health experts and LGBTQ users, Circle of 6 is designed to foster communities of support, encourage bystander intervention and provide inclusive and comprehensive resources. Circle of 6 was the winner of Vice President Biden’s “Apps Against Abuse” technology challenge and has 350,000 users in 36 countries.</span></p> <p><strong>About Guardian Project:</strong></p> <p><span style="font-weight: 400;">Guardian Project creates easy to use secure apps, open-source software libraries, and customized mobile dev</span><span style="font-weight: 400;">ices</span> <span style="font-weight: 400;">that can be used around the world by any person looking to protect their communications and personal data from unjust intrusion, interception and monitoring. With over 10 million users of its applications, and 100 million of its software libraries, Guardian Project has made a significant impact in improving the security and privacy of mobile users worldwide.</span></p> https://guardianproject.info/2016/12/02/orfox-1.2.1-released/ Fri, 02 Dec 2016 00:50:40 -0400 https://guardianproject.info/2016/12/02/orfox-1.2.1-released/ <p>We’ve released a new version of <a href="https://guardianproject.info/apps/orfox/">Orfox</a>, our Tor Browser for Android, that contains an an <a href="https://blog.mozilla.org/security/2016/11/30/fixing-an-svg-animation-vulnerability/" rel="nofollow">important security update to Firefox</a>.</p> <p>This update is based on the <a href="https://blog.torproject.org/blog/tor-browser-607-released">latest release of Tor Browser</a>, which was announced with this message:</p> <blockquote> <p>The security flaw responsible for this urgent release is already actively exploited on Windows systems. Even though there is currently, to the best of our knowledge, no similar exploit for OS X or Linux users available the underlying bug affects those platforms as well. Thus <strong>we strongly recommend that all users apply the update to their Tor Browser immediately.</strong></p> </blockquote> <p>The release has been <a href="https://github.com/guardianproject/Orfox/releases/tag/Fennec-45.5.1esr%2FTorBrowser-6.5-1%2FOrfox-1.2.1">tagged on Github</a> and you can find the signed, release APKs there. The update has also been pushed to <a href="https://play.google.com/store/apps/details?id=info.guardianproject.orfox">Google Play</a>, and should be rolling out over the next few hours. We will also be updating our <a href="https://guardianproject.info/fdroid">F-Droid repo</a> in the next 24 hours.</p> <p>Finally, this marks the first time we have released an update of Orfox within 24 hours of a release of Tor Browser. We will continue to aim for this goal moving forward for both ongoing releases and critical updates.</p> https://guardianproject.info/services/ Mon, 14 Nov 2016 23:58:19 -0400 https://guardianproject.info/services/ <p>We offer services for-hire for a variety of work related to our mission, projects and code-base.</p> <p>We have deployed fully secure service infrastructures for mobile devices, from client to server, using open protocols and standards, such as XMPP+OMEMO and SIP+ZRTP. We utilize and promote the adoption of public, transparent collaborative development processes, built on Git (Gitlab, Github), Continuous Integration (Travis, Gitlab-CI), test driven development practices, and public communications channels like mailing lists and secure group messaging.</p> <p>We build software with modularity in mind, utilizing Gradle (Android), CocoaPods (iOS), NPM and other systems, to build upon, or create if needed, reusable, testable, reproducible code libraries. Finally, we offer usability testing, quality assurance, and release acceptance processes, to ensure we are effectively delivering upon the desired enhancements and product roadmap.</p> <h2 id="engagement-team">Engagement Team</h2> <p>Our team is made of product leads, software developers, user experience designers, and user advocates who have been working in mobile application and platform development for over twenty years. For the past nine years, as Guardian Project, we have focused equally on developing our own technology, while fostering deep partnerships with human rights and activists organizations in need of our services. This includes engaging deeply with partners’ staff to uplift their knowledge and skill set to be able to support their technical programs long term. We have also worked to incubate mobile support for keyprivacy technologies such as Tor, GnuPG, OTR, SQLCipher and Debian, where interest in emerging platforms directly within the communities themselves was nascent.</p> <ul> <li>Engagement Manager: Works with client to define needs, scope, milestones and schedule<br /> Solution Architect: Works with all parties to design the solution specification and specific tickets</li> <li>Mobile Developer: Implementations features, enhancements, bug fixes for mobile software, working in concert and constant review with client and entire team</li> <li>Systems Developer (SysAdmin, DevOps): Implementations server/infrastructure features, configurations, images, scripts, as well as security controls, access protocol, etc.</li> <li>Quality Assurance / Testing: Tracks progress by development teams, provide QA feedback, and handles acceptance testing for all features, enhancements, bug fixes</li> </ul> <h2 id="menu-of-services">Menu of Services</h2> <p>Some examples of work we do for hire include:</p> <p><strong>Integration of secure data and media storage into a mobile app</strong></p> <p>Assist the application’s development team to define (architect) how application data and media can be stored safely.  Two mechanisms exist: SQL database storage (using API that closely mimics SQL) and file system (using API that matches the existing file system API).  Development team will require assistance with acquiring the libraries and integrating them into their build environment. Development team will likely need assistance with debug methodologies, management of encryption keys, safe error logging and reporting.</p> <p><strong>Integration of Secure Messaging features into mobile app</strong></p> <p>Integrate secure messaging and notification features into a mobile app, using Signal protocol through OMEMO, XMPP open protocol messaging, and XMPP Cloud Notify (ChatSecure Push). Implement system for adding and communicating with contacts through a pseudonymous identity, not tied to real names, phone number or email. Optionally implement communication through censorship and surveillance resistant transports such as Tor or Pluggable Transports.</p> <p><strong>Integration of PanicKit into an Android mobile app</strong></p> <p>Assist the application’s development team in handling “panic” signals from a Panic trigger application, thus allowing the developer’s app to support emergency data delete, app hiding, SOS message alerts. Also, optionally, integrate Panic trigger capabilities into their app, to support unique methods for trigger (hardware, location, motion).  Development team will require assistance with acquiring the libraries and integrating them into their build environment.</p> <p><strong>Kit-out a set of Android phones for delivery to a project team</strong></p> <p>The task here is to define a special configuration of security and operational software to be delivered on a specific type of Android device likely based on Copperhead (or other secure OS) such that all team members have a unified base experience and secure environment.  These devices would all be “backed” by a unique (predefined) custom F-Droid software distribution that would, in daily operation, keep the on-board software up to date.</p> <p><strong>Set up a secure and private XMPP communication endpoint for an organization or project team</strong></p> <p>The task here is to set up a secure, XMPP Infrastructure, Ansible-scripted for maintenance and upgrade, with minimal logging, for production use by the organization or team.  The configuration would be production tested, scalable and distributable (to multiple geographics, IP ranges, or domains) depending on organization size and needs.</p> <p><strong>Establish a Pluggable Transport service for a defined user group on behalf of a single organization</strong></p> <p>The task here is to setup, configure and provide maintenance for a defined and specific circumvention service (e.g., Meek, ShadowSocks, Wireguard) to be offered by an organization for a specific community of users.   The configuration would be production tested and scalable.</p> <p><strong>Mobile application and system threat modeling</strong></p> <p>The task here is to work with an application (or system/service) development team to understand the types of internal and external threats that could impact them, then architect solutions for combating those threats (to be ultimately implemented in software, procedures or training) by the application or system team.</p> https://guardianproject.info/services/ Mon, 14 Nov 2016 23:58:19 -0400 https://guardianproject.info/services/ <p>We offer services for-hire for a variety of work related to our mission, projects and code-base.</p> <p>We have deployed fully secure service infrastructures for mobile devices, from client to server, using open protocols and standards, such as XMPP+OMEMO and SIP+ZRTP. We utilize and promote the adoption of public, transparent collaborative development processes, built on Git (Gitlab, Github), Continuous Integration (Travis, Gitlab-CI), test driven development practices, and public communications channels like mailing lists and secure group messaging.</p> <p>We build software with modularity in mind, utilizing Gradle (Android), CocoaPods (iOS), NPM and other systems, to build upon, or create if needed, reusable, testable, reproducible code libraries. Finally, we offer usability testing, quality assurance, and release acceptance processes, to ensure we are effectively delivering upon the desired enhancements and product roadmap.</p> <h2 id="engagement-team">Engagement Team</h2> <p>Our team is made of product leads, software developers, user experience designers, and user advocates who have been working in mobile application and platform development for over twenty years. For the past nine years, as Guardian Project, we have focused equally on developing our own technology, while fostering deep partnerships with human rights and activists organizations in need of our services. This includes engaging deeply with partners’ staff to uplift their knowledge and skill set to be able to support their technical programs long term. We have also worked to incubate mobile support for keyprivacy technologies such as Tor, GnuPG, OTR, SQLCipher and Debian, where interest in emerging platforms directly within the communities themselves was nascent.</p> <ul> <li>Engagement Manager: Works with client to define needs, scope, milestones and schedule<br /> Solution Architect: Works with all parties to design the solution specification and specific tickets</li> <li>Mobile Developer: Implementations features, enhancements, bug fixes for mobile software, working in concert and constant review with client and entire team</li> <li>Systems Developer (SysAdmin, DevOps): Implementations server/infrastructure features, configurations, images, scripts, as well as security controls, access protocol, etc.</li> <li>Quality Assurance / Testing: Tracks progress by development teams, provide QA feedback, and handles acceptance testing for all features, enhancements, bug fixes</li> </ul> <h2 id="menu-of-services">Menu of Services</h2> <p>Some examples of work we do for hire include:</p> <p><strong>Integration of secure data and media storage into a mobile app</strong></p> <p>Assist the application’s development team to define (architect) how application data and media can be stored safely.  Two mechanisms exist: SQL database storage (using API that closely mimics SQL) and file system (using API that matches the existing file system API).  Development team will require assistance with acquiring the libraries and integrating them into their build environment. Development team will likely need assistance with debug methodologies, management of encryption keys, safe error logging and reporting.</p> <p><strong>Integration of Secure Messaging features into mobile app</strong></p> <p>Integrate secure messaging and notification features into a mobile app, using Signal protocol through OMEMO, XMPP open protocol messaging, and XMPP Cloud Notify (ChatSecure Push). Implement system for adding and communicating with contacts through a pseudonymous identity, not tied to real names, phone number or email. Optionally implement communication through censorship and surveillance resistant transports such as Tor or Pluggable Transports.</p> <p><strong>Integration of PanicKit into an Android mobile app</strong></p> <p>Assist the application’s development team in handling “panic” signals from a Panic trigger application, thus allowing the developer’s app to support emergency data delete, app hiding, SOS message alerts. Also, optionally, integrate Panic trigger capabilities into their app, to support unique methods for trigger (hardware, location, motion).  Development team will require assistance with acquiring the libraries and integrating them into their build environment.</p> <p><strong>Kit-out a set of Android phones for delivery to a project team</strong></p> <p>The task here is to define a special configuration of security and operational software to be delivered on a specific type of Android device likely based on Copperhead (or other secure OS) such that all team members have a unified base experience and secure environment.  These devices would all be “backed” by a unique (predefined) custom F-Droid software distribution that would, in daily operation, keep the on-board software up to date.</p> <p><strong>Set up a secure and private XMPP communication endpoint for an organization or project team</strong></p> <p>The task here is to set up a secure, XMPP Infrastructure, Ansible-scripted for maintenance and upgrade, with minimal logging, for production use by the organization or team.  The configuration would be production tested, scalable and distributable (to multiple geographics, IP ranges, or domains) depending on organization size and needs.</p> <p><strong>Establish a Pluggable Transport service for a defined user group on behalf of a single organization</strong></p> <p>The task here is to setup, configure and provide maintenance for a defined and specific circumvention service (e.g., Meek, ShadowSocks, Wireguard) to be offered by an organization for a specific community of users.   The configuration would be production tested and scalable.</p> <p><strong>Mobile application and system threat modeling</strong></p> <p>The task here is to work with an application (or system/service) development team to understand the types of internal and external threats that could impact them, then architect solutions for combating those threats (to be ultimately implemented in software, procedures or training) by the application or system team.</p> https://guardianproject.info/2016/10/17/if-this-then-panic-sample-code-for-triggering-emergency-alerts/ Mon, 17 Oct 2016 09:55:22 -0400 https://guardianproject.info/2016/10/17/if-this-then-panic-sample-code-for-triggering-emergency-alerts/ <p>Earlier this year, we announced the <a href="https://guardianproject.info/2016/01/12/panickit-making-your-whole-phone-respond-to-a-panic-button/">PanicKit Library for Android</a> and <a href="https://dev.guardianproject.info/news/257">Ripple</a>, our basic app for alerts any compatible app that you are in an emergency situation. Rather than build a solitary, enclosed “panic button” app that only can provide a specific set of functionality, we decided, as we often do, to build a framework, and encourage others to participate. Since then, we’ve had <a href="https://dev.guardianproject.info/projects/panic/news">over 10 different apps implement PanicKit r</a>esponder functionality, including Signal, OpenKeyChain, Umbrella app, StoryMaker and Zom.</p> <p>It is great to have so many apps implement helpful features for users to react during an emergency situation. This might include sending an emergency message, putting sensitive data behind a password, hiding the app icon, or even wiping data. All of this can be triggered by a simple tap and swipe on the Ripple’s app user interface.</p> <p>However, we would like to promote PanicKit trigger functionality that goes beyond something a user has to actively do, or at least obviously do. In many emergency scenarios, the user might be unable to actively trigger a panic, because they are unconscious, detained or have had their device taken away. In some cases, the activation may need to be subtle, such typing an incorrect phone number. In others, rapidly pressing a button or shaking the phone, may be safer and easier than unlocking your device and using an app.</p> <p><img class="alignnone size-thumbnail" src="https://media.giphy.com/media/K673Q5D4KGWAg/giphy.gif" alt="" width="738" height="415" /></p> <p><em>a truly panic-inducing situation</em></p> <p>PanicKit works by connecting trigger apps with receiver apps. Triggers are what create the alert that there is an emergency or panic situation. Responders receive the alert, and take an appropriate, user configured or default action.</p> <p>The new <a href="https://github.com/n8fr8/PanicKitSamples">PanicKitSamples project</a> demonstrates new possible triggers that could be implemented in an app like Ripple, or any app that wishes to do so. In the <a href="https://github.com/n8fr8/PanicKitSamples/tree/master/app/src/main/java/info/guardianproject/fakepanicbutton/triggers">“info.guardianproject.fakepanicbutton.triggers”</a> package, you will find the following classes:</p> <p><a href="https://github.com/n8fr8/PanicKitSamples/blob/master/app/src/main/java/info/guardianproject/fakepanicbutton/triggers/BaseTrigger.java#L40">BaseTrigger</a>: a base class that handles launching of the “panic intent” from a set of stored preferences to trigger the responders</p> <pre>public static void launchPanicIntent (Context context) { final SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(context.getApplicationContext()); String email = prefs.getString("email",null); String phone = prefs.getString("phone",null); String subject = prefs.getString("subject","panic message"); String message = prefs.getString("message","i triggered a panic!"); launchIntent(context, email, phone, subject, message); } public static void launchIntent (Context context, String emailAddress, String phoneNumber, String subject, String message) { final PackageManager pm = context.getPackageManager(); final Set<String> receiverPackageNames = PanicTrigger.getResponderActivities(context); Intent intent = new Intent(Panic.ACTION_TRIGGER);</pre> <p> </p> <p><a href="https://github.com/n8fr8/PanicKitSamples/blob/master/app/src/main/java/info/guardianproject/fakepanicbutton/triggers/GeoTrigger.java">GeoTrigger</a>: Using the awesome “LOST” open-source geofencing library, this trigger sends a panic if the device moves outside of a pre-defined area (in this sample, it is Times Square NYC)</p> <pre>private void setupGeoFence () { //setup geofence for Times Square area String requestId = "geof1-timesSquare"; double latitude = 40.758896; double longitude = -73.985130; float radius = 0.0001f; Geofence geofence = new Geofence.Builder() .setRequestId(requestId) .setCircularRegion(latitude, longitude, radius) .setExpirationDuration(Geofence.NEVER_EXPIRE) .build(); GeofencingRequest request = new GeofencingRequest.Builder() .addGeofence(geofence) .build();</pre> <p> </p> <p><a href="https://github.com/n8fr8/PanicKitSamples/blob/master/app/src/main/java/info/guardianproject/fakepanicbutton/triggers/MediaButtonTrigger.java">MediaButtonTrigger</a>: This trigger will notice multiple rapid pushes of a headset mic button or a bluetooth mic call button, and send a trigger.</p> <pre>public class MediaButtonTrigger extends BaseTrigger { private static int mTriggerCount = 0; private final static int TRIGGER_THRESHOLD = 3; private static long mLastTriggerTime = -1; public MediaButtonTrigger(Activity context) { super (context); } @Override public void activateTrigger() { //if a headset button or a bluetooth "call" button is pressed, trigger this IntentFilter filter = new IntentFilter(Intent.ACTION_MEDIA_BUTTON); MediaButtonIntentReceiver r = new MediaButtonIntentReceiver(); getContext().registerReceiver(r, filter); } public class MediaButtonIntentReceiver extends BroadcastReceiver { public MediaButtonIntentReceiver() { super(); } @Override public void onReceive(Context context, Intent intent) { KeyEvent event = (KeyEvent)intent.getParcelableExtra(Intent.EXTRA_KEY_EVENT); if (event == null) { return; } int action = event.getAction(); if (action == KeyEvent.ACTION_DOWN) { //check for 3 rapidly pressed key events long triggerTime = new Date().getTime(); //if the trigger is the first one, or happened with a second of the last one, then count it if (mLastTriggerTime == -1 || ((triggerTime - mLastTriggerTime)<1000)) mTriggerCount++; mLastTriggerTime = triggerTime; if (mTriggerCount > TRIGGER_THRESHOLD) { launchPanicIntent(context); mTriggerCount = 0; } } abortBroadcast(); } } }</pre> <p><a href="https://github.com/n8fr8/PanicKitSamples/blob/master/app/src/main/java/info/guardianproject/fakepanicbutton/triggers/PhoneNumberTrigger.java">PhoneNumberTrigger</a> (OutgoingCallReceiver): This trigger monitors phone calls, looking for a pre-defined fake “panic number”.</p> <pre>public class OutgoingCallReceiver extends BroadcastReceiver { @Override public void onReceive(Context context, Intent intent) { String phoneNumber = intent.getStringExtra(Intent.EXTRA_PHONE_NUMBER); if (phoneNumber != null && phoneNumber.equals(PhoneNumberTrigger.PHONE_NUMBER_TRIGGER)) { PhoneNumberTrigger.launchPanicIntent(context); } } }</pre> <p><a href="https://github.com/n8fr8/PanicKitSamples/blob/master/app/src/main/java/info/guardianproject/fakepanicbutton/triggers/SuperShakeTrigger.java">SuperShakeTrigger</a>: This trigger looks for the phone being rapidly shaken. It could be expanded to wait for a series of shakes within a certain time window to avoid false positives.</p> <pre>//setup shake detection using ShakeDetector library SensorManager sensorManager = (SensorManager) getContext().getSystemService(Context.SENSOR_SERVICE); ShakeDetector sd = new ShakeDetector(new ShakeDetector.Listener() { public void hearShake() { //you shook me! launchPanicIntent(getContext()); } }); sd.start(sensorManager);</pre> <p><a href="https://github.com/n8fr8/PanicKitSamples/blob/master/app/src/main/java/info/guardianproject/fakepanicbutton/triggers/WifiTrigger.java">WifiTrigger</a>: This triggers waits for the user to connect to a specific wifi network (in this sample “Starbucks”). It could also be set to trigger if the devices leaves the wifi network.</p> <pre>NetworkInfo netInfo = intent.getParcelableExtra (WifiManager.EXTRA_NETWORK_INFO); if (ConnectivityManager.TYPE_WIFI == netInfo.getType () && netInfo.isConnected()) { WifiManager wifiManager = (WifiManager) context.getSystemService(Context.WIFI_SERVICE); WifiInfo info = wifiManager.getConnectionInfo(); String ssid = info.getSSID(); //Check if I am connected to the "trigger" SSID, and if so send an alert! if (!TextUtils.isEmpty(ssid) && ssid.equals(WIFI_SSID_TRIGGER)) { launchPanicIntent(getContext()); } }</pre> <p> </p> <p>All of these samples are configured to work with the FakePanicButton sample app, which allows you to choose a contact to alert, and set a panic message. That said, these are meant to point in a direction of functionality, and have not been fully debugged or tested on all devices and OS versions.</p> <p>If you have more ideas on other panic triggers that could be implemented, please share them here. We are also happy to take pull requests or fixes to our sample project, in order to improve on the ideas we have. Finally, we will announce more Panic responder and trigger apps, as they are available in the coming months. We looking forward to the continued growth of our PanicKit ecosystem, though of course, we hope even more for a world where there are less reasons to panic.</p> <p> </p> https://guardianproject.info/2016/09/25/orfox-1.2-an-overdue-update-to-our-privacy-focused-browser/ Sun, 25 Sep 2016 00:43:54 -0400 https://guardianproject.info/2016/09/25/orfox-1.2-an-overdue-update-to-our-privacy-focused-browser/ <div class="markdown-body"> <p> Primarily this release is the first in a long while after improving our ability to stay up-to-date with core Tor Browser development. In addition, as Mozilla adds more and more features to the core Firefox, we must review them for any issues related to increased permission request, access to data, and privacy and network leaks. This is a slow, tedious job, so thank you for your patience. We expect to have more frequent, regular releases moving forward. </p> </div> <div class="markdown-body"> <p> Orfox specific highlights include: </p> <ul> <li> improved integration with Orbot </li> <li> removal of more unnecessary Android permissions / features (chromecast, account access) </li> <li> new icon and branding! </li> </ul> <p> A big thanks to <a href="https://github.com/amoghbl1">Amogh Pradeep</a>, Orfox lead developer and GSoC student extraordinaire, along with the entire Tor Browser and Mozilla Firefox teams, for their tireless work, building this great open-source web browser ecosystem. </p> <p> Updates to the core Tor Browser releases that Orfox is based on can be reviewed here:<br /> <a href="https://blog.torproject.org/blog/tor-browser-65a3-hardened-released">https://blog.torproject.org/blog/tor-browser-65a3-hardened-released</a><br /> <a href="https://blog.torproject.org/blog/tor-browser-605-released">https://blog.torproject.org/blog/tor-browser-605-released</a> </p> </div> <p class="release-downloads-header"> <strong>Downloads</strong> </p> <ul class="release-downloads"> <li> <a href="https://play.google.com/store/apps/details?id=info.guardianproject.orfox">Install from Google Play</a> </li> <li> APK: <a href="https://github.com/guardianproject/Orfox/releases/download/Fennec-45.4.0esr%2FTorBrowser-6.5-1%2FOrfox-1.2/Orfox-1.2-TorBrowser-6.5-Fennec45.4.0.apk" rel="nofollow"><small class="text-gray float-right">33.6 MB </small><strong>Orfox-1.2-TorBrowser-6.5-Fennec45.4.0.apk</strong></a> (<a href="https://github.com/guardianproject/Orfox/releases/download/Fennec-45.4.0esr%2FTorBrowser-6.5-1%2FOrfox-1.2/Orfox-1.2-TorBrowser-6.5-Fennec45.4.0.apk">gpg sig</a>) </li> <li> <a href="https://guardianproject.info/fdroid">Guardian Project F-Droid Repo</a> (update coming soon!) </li> </ul> <p><strong>Source Code</strong></p> <ul> <li><a href="https://github.com/guardianproject/Orfox/commits/Fennec-45.4.0esr/TorBrowser-6.5-1/Orfox-1.2">Orfox build repo</a>:</li> <li>Orfox’s <a href="https://github.com/guardianproject/orfox">Tor Browser repo</a></li> </ul> <p> </p> https://guardianproject.info/2016/07/31/howto-get-all-your-debian-packages-via-tor-onion-services/ Sun, 31 Jul 2016 17:28:57 -0400 https://guardianproject.info/2016/07/31/howto-get-all-your-debian-packages-via-tor-onion-services/ <p><a href="https://guardianproject.info/wp-content/uploads/2014/10/leakage.png"><img src="https://guardianproject.info/wp-content/uploads/2014/10/leakage-300x199.png" alt="leakage" width="300" height="199" class="alignright size-medium wp-image-12699" srcset="https://guardianproject.info/wp-content/uploads/2014/10/leakage-300x199.png 300w, https://guardianproject.info/wp-content/uploads/2014/10/leakage-100x66.png 100w, https://guardianproject.info/wp-content/uploads/2014/10/leakage-150x99.png 150w, https://guardianproject.info/wp-content/uploads/2014/10/leakage-200x132.png 200w, https://guardianproject.info/wp-content/uploads/2014/10/leakage.png 410w" sizes="(max-width: 300px) 100vw, 300px" /></a>Following up on <a href="https://guardianproject.info/2014/10/16/reducing-metadata-leakage-from-software-updates/" target="_blank">some privacy leaks that we looked into a while back</a>, there are now official Debian <a href="https://onion.debian.org" target="_blank">Tor Onion Services</a> for getting software packages and security updates, thanks to the Debian Sys Admin team. This is important for high risk use cases like TAILS covers, but also it is useful to make it more difficult to do some kinds of targeted attacks against high-security servers. The default Debian and Ubuntu package servers use plain HTTP with unencrypted connections. That means anyone with access to the network streams could both monitor and fingerprint traffic. When an request for a security update is spotted, an attacker knows that machine is vulnerable to an exploit, and could reliably exploit it before the security update is applied.</p> <p>Using <a href="https://labs.riseup.net/code/issues/8143" target="_blank">HTTPS to get security updates</a> improves this situation a lot, but by measuring the size of data transfers, it is still possible to <a href="http://www0.cs.ucl.ac.uk/staff/G.Danezis/papers/TLSanon.pdf" target="_blank">track which files are being downloaded</a>. A Tor Onion Service provides end-to-end encryption like the HTTPS connection. It also mixes up the traffic with lots of other traffic, so its not easy to see what traffic goes together. That makes it a lot harder for a network observer to tell when a security update is being downloaded. Additionally, using a Tor Onion Service forces the traffic over Tor, so that the Debian mirror server cannot see which server is requesting the updates. That helps prevent targeted attacks.</p> <p>There are other benefits as well, besides just for the person running the high security server in this example, especially if all of the traffic is coming over Tor. When updates are delivered over Tor, then that means the Debian mirror operators have less to worry about because they are handling less metadata that might have privacy concerns. It means that when law enforcement requests logs from the mirror operators, the mirror operators can more easily hand over anything they have since the mirror operator knows that there is not private information in the logs. Reducing the legal risks and privacy concerns makes it easier to run mirrors, and that helps internet services work better.</p> <p>One disadvantage of this approach as it now stands is that your server will get updates from the same mirror every time. There is only a single Tor Onion Service for the main archive. An alternate approach using the combination of Tor and <a href="http://httpredir.debian.org/">http://httpredir.debian.org/</a> as the package source means that your server will get updates from a different mirror each time Tor changes its exit node (I believe that’s every 10 minutes or so).</p> <p><strong>How can you set up your Debian machine to get updates over Tor?</strong></p> <p><a href="https://guardianproject.info/wp-content/uploads/2016/07/tor-logo-2011_11.jpg"><img src="https://guardianproject.info/wp-content/uploads/2016/07/tor-logo-2011_11-300x173.jpg" alt="debian and tor" width="300" height="173" class="alignright size-medium wp-image-13395" srcset="https://guardianproject.info/wp-content/uploads/2016/07/tor-logo-2011_11-300x173.jpg 300w, https://guardianproject.info/wp-content/uploads/2016/07/tor-logo-2011_11-768x444.jpg 768w, https://guardianproject.info/wp-content/uploads/2016/07/tor-logo-2011_11.jpg 800w" sizes="(max-width: 300px) 100vw, 300px" /></a>Right now, the best way to set up a Debian machine to force traffic over Tor is to use <a href="https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy" target="_blank">transparent proxying</a> via <em>iptables</em> rules. If you have that setup, then you can add the onion addresses as Debian apt sources as if they are any other HTTP Debian mirror. Another option is to install <em>apt-transport-tor</em> like TAILS does, then you can use <a href="http://people.skolelinux.org/pere/blog/Always_download_Debian_packages_using_Tor___the_simple_recipe.html" target="_blank">special syntax to add the Tor Onion Services</a>. And another way is to install an HTTP proxy like <em>privoxy</em> and enable apt HTTP proxy support as <a href="https://guardianproject.info/2014/10/16/reducing-metadata-leakage-from-software-updates/" target="_blank">I described before</a>. The <em>apt-transport-tor</em> and <em>privoxy</em> approaches both have the downside of having to trust an added piece of software, whereas the transparent proxy technique uses what is already present in the Linux kernel. I’ve been using the <em>privoxy</em> method since that is what I got working in 2014 and it has been working reliably on multiple servers since then. Also, I need <em>privoxy</em> installed for another application anyway.</p> <p>Here’s how to set up the apt sources to get packages and updates via Tor Onion Services without delaying security updates. First, remove <em>/etc/apt/sources.list</em> and <em>/etc/apt/sources.list.d/*.list</em> to start with a clean slate. Next add <em>/etc/apt/sources.list.d/00.vwakviie2ienjx6t.onion.list</em> to get the main Debian repositories:</p> <pre><code>deb http://vwakviie2ienjx6t.onion/debian/ jessie main deb-src http://vwakviie2ienjx6t.onion/debian/ jessie main # aka volatile deb http://vwakviie2ienjx6t.onion/debian/ jessie-updates main deb-src http://vwakviie2ienjx6t.onion/debian/ jessie-updates main deb http://vwakviie2ienjx6t.onion/debian jessie-backports main deb-src http://vwakviie2ienjx6t.onion/debian/ jessie-backports main </code></pre> <p>Next add the new Tor Onion Service for the security update repository at <em>/etc/apt/sources.list.d/00.sgvtcaew4bxjd7ln.onion.list</em>:</p> <pre><code>deb http://sgvtcaew4bxjd7ln.onion/ jessie/updates main </code></pre> <p>Then last, include the normal HTTP security.debian.org archive to ensure that your server gets the latest security updates, even if the <a href="https://onion.debian.org/" target="_blank">Onion Service mirror</a> is behind or there is some other issue related to Tor. This goes in <em>/etc/apt/sources.list.d/99.security.debian.org.list</em> to ensure that it is always the last repository that is tried, and apt loads files from /etc/apt/source.list.d/ in alphabetical order, so it’ll always try to get the security updates from the Onion Service before falling back to the HTTP source as a last resort.</p> <pre><code>deb http://security.debian.org/ jessie/updates main </code></pre> <p>I also run an unofficial mirror of the security updates on <a href="http://dju2peblv7upfz3q.onion/debian">http://dju2peblv7upfz3q.onion/debian</a> if you want to add another backup, i.e. <em>/etc/apt/sources.list.d/00.dju2peblv7upfz3q.onion.list</em>:</p> <pre><code>deb http://dju2peblv7upfz3q.onion/debian-security/ jessie/updates main </code></pre> https://guardianproject.info/2016/06/07/openarchive-free-secure-mobile-media-sharing-#dwebsummit/ Tue, 07 Jun 2016 15:37:03 -0400 https://guardianproject.info/2016/06/07/openarchive-free-secure-mobile-media-sharing-#dwebsummit/ <p>I am excited to share another new “mini app” effort we have joined up with, as part of work we are doing to create simple, focused tools that solve a single issue. We also are aiming to builds apps that are 1 to 3MB in size, and work on Android phones back to version 2.3, in order to maximize accessibility for a global audience.  <a href="https://open-archive.net"><span class="il">OpenArchive</span></a> is one of these efforts. It is a project led by <a href="https://www.aaronswartzday.org/openarchive/">Natalie Cadranel</a>, who received a <a href="https://www.knightfoundation.org/grants/201448513/">Knight Foundation prototype grant in 2014</a>. The initial work was done by our partners at <a href="https://www.scal.io/">Scal.io</a>, and continued now by the core Guardian Project team. The app is now in <a href="https://play.google.com/store/apps/details?id=net.opendasharchive.openarchive.release">stable beta</a> and ready for <a href="https://github.com/OpenArchive/openarchive/issues">wider testing</a>.</p> <div> </div> <div> Here is a brief description from the site at <a href="https://open-archive.net">open-archive.net</a>: </div> <blockquote> <div> <span class="il">OpenArchive</span> is a free, <span class="il">open</span>-source mobile application, currently for Android, dedicated to maintaining the privacy, provenance, and preservation of your media. It enables you to add metadata and Creative Commons licensing to your audiovisual media and then send it to the Internet <span class="il">Archive</span> over Tor; offering more agency over your media, while protecting civil liberties, and increasing interoperability for those who want to find and reuse/remix it in the future. </div> </blockquote> <div id='gallery-12' class='gallery galleryid-13356 gallery-columns-3 gallery-size-thumbnail'> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2016/06/device-2016-05-26-105614.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2016/06/device-2016-05-26-105614-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2016/06/device-2016-05-26-160805.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2016/06/device-2016-05-26-160805-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2016/06/device-2016-05-26-160818.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2016/06/device-2016-05-26-160818-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2016/06/device-2016-05-26-160829.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2016/06/device-2016-05-26-160829-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2016/06/device-2016-05-26-160837.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2016/06/device-2016-05-26-160837-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2016/06/device-2016-05-26-160912.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2016/06/device-2016-05-26-160912-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> </div> <p>For now, we aim for the app to be the easiest and most secure way to publish photos, video and audio to the Internet <span class="il">Archive from your Android device, be it a phone, tablet and soon a Chromebook. It will even login and upload </span>over the <a href="https://torproject.org">Tor network</a> if you have <a href="https://guardianproject.info/apps/orbot">Orbot</a> installed.</p> <p>We see this as a first step towards a more distributed, decentralized way of managing and sharing your personal media, and publishing it and synchronizing it to different places and people, in different ways. This includes distributing media through nearby non-Internet networks such <a href="https://github.com/n8fr8/talks/blob/master/wind_update_2015/Wind%20Update%20-%20October%202015.pdf">Wind</a>, becoming a a <a href="http://librarybox.us">LibraryBox</a> node, publishing through <a href="https://onionshare.org/">OnionShare</a>, notarizing hrough <a href="https://stamp.io">Stamp.io</a>‘s Blockchain-based API, and intergalactic sharing via <a href="https://ipfs.io/">IPFS</a>. This vision is why we are excited about the <a href="http://www.decentralizedweb.net/">#DWebSummit</a> going on this week, and future gatherings related to building less centralized online ecosystems.</p> <div>  The <a href="https://www.aaronswartzday.org/openarchive/">benefits of this work are manyfold</a>, one of which is that if anyone needs a freely licensed video of <a href="https://archive.org/details/robot-fish-----------------r6v6">cute kids watching robot fish swim</a>, you can now have easy access to one: </div> <div> </div> <div> <div class="arve-wrapper" data-mode="normal" data-provider="archiveorg" id="arve-robot-fish-----------------r6v6" style="max-width:945px;" itemscope itemtype="http://schema.org/VideoObject"> <div class="arve-embed-container" style="padding-bottom:56.250000%"> </div> </div> </div> <div> </div> <div> As all of this work is open-source and freely licensed, all help is welcome with testing, feedback, design, code, and if you love it, then sharing with others and spreading the word: </div> <div> </div> <ul> <li>Github: <a href="https://github.com/OpenArchive/openarchive" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?hl=en&q=https://github.com/OpenArchive/openarchive&source=gmail&ust=1465411952609000&usg=AFQjCNEz3C4AlQlkbvaltKWanhjosLQdhg"><a href="https://github.com/">https://github.com/</a><wbr /><span class="il">OpenArchive</span>/<span class="il">openarchive</span></a></li> <li>Signed release APKs: <a href="https://github.com/OpenArchive/openarchive/releases/" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?hl=en&q=https://github.com/OpenArchive/openarchive/releases/tag/0.0.9-APK-release&source=gmail&ust=1465411952609000&usg=AFQjCNFTspI29-f7KT4gNUbNogeo4n_zEQ"><a href="https://github.com/">https://github.com/</a><wbr /><span class="il">OpenArchive</span>/<span class="il">openarchive</span>/<wbr />releases/</a></li> <li>Google Play: <a href="https://play.google.com/store/apps/details?id=net.opendasharchive.openarchive.release" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?hl=en&q=https://play.google.com/store/apps/details?id%3Dnet.opendasharchive.openarchive.release&source=gmail&ust=1465411952609000&usg=AFQjCNHw6u_fEXblnlZa-G30124MAbfPRw"><a href="https://play.google.com/store/">https://play.google.com/store/</a><wbr />apps/details?id=net.<wbr />opendasharchive.<span class="il">openarchive</span>.<wbr />release</a></li> <li>Twitter: <a href="https://twitter.com/open_archive">@open_archive</a></li> </ul> <div> </div> https://guardianproject.info/2016/06/02/building-the-most-private-app-store/ Thu, 02 Jun 2016 11:08:52 -0400 https://guardianproject.info/2016/06/02/building-the-most-private-app-store/ <p><em>App stores can work well without any tracking at all</em></p> <p><a href="https://guardianproject.info/wp-content/uploads/2016/06/whichdoor.jpg"><img src="https://guardianproject.info/wp-content/uploads/2016/06/whichdoor-150x150.jpg" alt="whichdoor" width="150" height="150" class="alignright size-thumbnail wp-image-13337" /></a></p> <p>Attackers are increasingly seeing app stores as a prime <a href="https://guardianproject.info/2015/02/24/phishing-for-developers/" target="_blank">attack</a> vector, whether it is aimed at the masses like <a href="http://researchcenter.paloaltonetworks.com/2015/09/more-details-on-the-xcodeghost-malware-and-affected-ios-apps/">XCodeGhost</a> or very targeted like in FBI vs Apple. When we install software from an app store, we are placing a lot of trust in a lot of different parties involved in getting the source code from the original developer delivered to our device in a useful form. Most people are entirely unaware of how much trust they are putting into this system, which they are entrusting with their personal data. Even for people who do understand the technical details involved, figuring out whether the people and the system itself is trustworthy is difficult to do.</p> <p>We are building an app store that requires the bare minimum of trust: only the software developers themselves and the code they produce. We consider the app store operators and servers a threat. Building an ecosystem that enables automated, effective auditing lets the computers verify to make trust decisions easier. Effective external auditing requires an ecosystem that cannot deliver targeted content to just the auditing system, while feeding users something else (aka “binary transparency”).</p> <p><strong>Most app stores track as much as possible</strong></p> <p>The vast majority of apps stores track their users actions in detail. Some is necessary when using the business model of the app store operator taking a percentage of sales, but none of the tracking is inherent to running an app store. For example, payment verification can be handled in the app itself like shareware. A software delivery system that tracks its users makes it simple to hide malware delivery since it can target any auditing system. Most app stores know a lot about their users:</p> <ul> <li>account name</li> <li>identity</li> <li>payment methods</li> <li>everything you search for in the app store</li> <li>everything you look at in the app store</li> <li>everything you download, install, uninstall</li> <li>which apps you actually run</li> <li>where you are, based on IP, declared preference, etc.</li> <li>your preferred language</li> <li>and more…</li> </ul> <p>Apps stores need to know very little in order to function: how to give you the files you request. That means indexes, descriptions, icons, apps, and install/delete requests (for “push” install/delete). Given that information, the client can do everything needed to provide a full app store user experience. For this work, we chose to build upon <a href="https://f-droid.org" target="_blank">F-Droid</a>, a community-run Android app store that distributes verified Free Software. The community has had an interest in privacy all along, and has always worked to avoid tracking. The security architecture is based on models proven by <a href="https://wiki.debian.org/SecureApt" target="_blank">Debian</a>, <a href="https://github.com/theupdateframework/tuf/blob/develop/docs/tuf-spec.txt" target="_blank">The Update Framework</a> , and others:</p> <ul> <li>HTTPS connections by default</li> <li>pinned TLS certificate built into the client app</li> <li>updates verified based on the signature on the app itself</li> <li>file integrity protected by signed metadata</li> <li>signed metadata includes hashes of the app and its signing key</li> <li>signed metadata generated on a separate machine, which can be fully offline</li> <li>public key for verifying metadata signatures built into F-Droid client app</li> <li>signed metadata includes timestamp and expiry</li> </ul> <p>While the current setup is already a solid platform, we are implementing a number of improvements. The signed metadata will include list of official mirrors, then the client chooses mirrors based on availability and freshness based on local criteria like whether Tor is in use, closest on the internet, etc. We are also moving the standard HTTP “etag” cache check from the server to the client so it cannot be abused to track users.</p> <p>In order to defend against an attacker that holds the signing keys for the app repository, there must be a trustworthy source of information to compare against. Reproducible builds means that anyone with the same source code will produce the exact same binary. When paired with an auditing system, it is easy to catch malware inserted in the build process, rather than the source code, like XCodeGhost. Reproducible builds also makes it possible to have all builds of a release binary have the exact same hash. Then any app repository can build apps only from source code, and have a source of verification data from any other app repository building the same app. Building software from source has become cheap enough that many companies like gitlab.com and Travis CI are offering free, automated build services in the cloud. Since the whole F-Droid toolset is free software and designed to be easy to setup, the barriers to setting up automatic auditing are quite low. People in separate areas of the world with different risk profiles can run verification servers to provide more trustworthy information.</p> <p>Another key aspect of the F-Droid project is to provide the complete toolset needed to run an app store. This enables a more decentralized ecosystem. Therefore, one key goal is to lower the risks of running the services, so that more people can run their own app stores. If the app store does not track its users, then that removes the hassle of protecting personal data from any attacker. These services can be run without fear of responding to secret orders for personal information. It also means that the server setup is a lot simpler because it does not need dynamic content. The app store serve only needs to serve files (e.g. indexes, apps, etc.). The app repository is generated on a secure machine, or even a fully offline machine, and posted to the server. The main server is purely a mirror of the offline machine where the signed repository is generated. Mirrors just shuffle bits from place to place, they are no longer an attack vector.</p> <p>Putting all these pieces together provides a system where users need only audit the source code in order to verify a trustworthy app delivery. The file pipeline provides redundantly secure data transmission, the apps can be reproducibly from source code, the app repositories can be automatically audited. Of course, this system relies not only on the power of cryptography, but also the power of transparency. Debian provides a great example of the power of transparency: Debian gives a thousand volunteers root access to every Debian install (by virtue of their ability to upload signed packages that get installed as root). Yet this system has been proven over the past 20+ years to provide solid security. Ultimately we hope that this will de-emphasize the signing key as the sole protection against abuse. If malware has a decent change of being spotted, it makes it much less likely to be used since malware authors either rigorously defend their exploits, or use well known exploits that are not difficult to automatically detect.</p> <p><strong>Future Work</strong></p> <p>One attack vector that is not well covered is malware that installable by everyone, that then uses data on the local device to target specific users. That would be a way to target individuals using an app store that does not track its users. We are starting to implement automated dynamic analysis of every app using tools like <a href="https://labs.mwrinfosecurity.com/tools/drozer" target="_blank">Drozer</a>.</p> <p>We are also working towards making as many apps as possible build reproducibly. Some of our quick checks show that a large number of the apps in f-droid.org already will build reproducibly, given the right build environment. We are working on making the process of setting up that build environment as automated as possible.</p> <p>The F-Droid “verification server” has been prototyped, and it will be further developed with the aim of making it dead simple to run in common cloud services.</p> <p>We already have the infrastructure in place to do verified double-signing, where the developer first signs the release bulid, then once f-droid.org reproduces that build, it adds its signature. Then Android would enforce that both signatures need to be present in order for it to be a valid update.</p> <p>As the full localization support is built out, the language that a user is using will not be reported to the server. While speaking Spanish in Spain does not provide much information, speaking Quechua in Uzbekistan can narrow it down to a single user. Instead of dividing the index metadata by language, it will instead be grouped by app. We will then group apps so that it is difficult to tell which app in the group is the one people are interested in. For example, if one very popular app is only grouped with apps that are rarely downloaded, then it is an easy assumption that someone getting info about that block of apps is most likely looking for that popular app.</p> https://guardianproject.info/2016/05/04/data-usage-and-protection-policies/ Wed, 04 May 2016 00:00:00 +0000 https://guardianproject.info/2016/05/04/data-usage-and-protection-policies/ <p>At a high level, it is easy say that &ldquo;we know nothing&rdquo;. We do not log data or include analytics in our websites or applications. When we do operate servers to support our applications, they are configured to store as minimal data as possible, usually just a username and password, if that is required. We also only recommend third party services, such as <a href="https://www.otr.im/chat.html">XMPP services</a>, <a href="https://ostel.co">VoIP services</a>, or <a href="https://torproject.org">Proxy and VPN providers</a>, who abide by these same policies.</p> <p>In some cases, when we must distribute our applications through services like Google Play, our hands our tied and you are at the mercy of their <a href="https://play.google.com/about/play-terms.html">terms and policies</a>. In some cases, convenience trumps privacy, but that is a decision that is up to you. You can always get our apps from our no logging, non-tracking, free and open-source app store, <a href="https://guardianproject.info/fdroid">F-Droid</a>.</p> <p>Otherwise, you can read on below for our general purpose policy around data usage and protection policies.</p> <hr /> <p>This  policy discloses the practices for Guardian Project&rsquo;s website and all apps and projects we release. It will notify you of the following:</p> <ol> <li><div> What personally identifiable information is collected from you through the web site, our apps and services, and how it is used and with whom it may be shared. </div></li> <li><div> What choices are available to you regarding the use of your data. </div></li> <li><div> The security procedures in place to protect the misuse of your information. </div></li> <li><div> How you can correct any inaccuracies in the information. </div></li> </ol> <p><strong>Information Collection, Use, and Sharing</strong><br /> We are the sole owners of the information collected on this site and our apps. We only have access to/collect information that you voluntarily give us via email, app registration or other direct contact from you. We will not sell or rent this information to anyone.</p> <p>We will use your information to respond to you, regarding the reason you contacted us. We will not share your information with any third party outside of our organization, other than as necessary to fulfill your request.</p> <p>Unless you ask us not to, we may contact you via email in the future to tell you about specials, new products or services, or changes to this privacy policy.</p> <p><strong>Your Access to and Control Over Information</strong><br /> You may opt out of any future contacts from us at any time. You can do the following at any time by contacting us via the email address or phone number given on our website:</p> <p>• See what data we have about you, if any.</p> <p>• Change/correct any data we have about you.</p> <p>• Have us delete any data we have about you.</p> <p>• Express any concern you have about our use of your data.</p> <p><strong>Security</strong><br /> We take precautions to protect your information. When you submit sensitive information via the website, your information is protected both online and offline.</p> <p>Wherever we collect sensitive information (such as credit card data), that information is encrypted and transmitted to us in a secure way. You can verify this by looking for a closed lock icon at the bottom of your web browser, or looking for &ldquo;https&rdquo; at the beginning of the address of the web page.</p> <p>While we use encryption to protect sensitive information transmitted online, we also protect your information offline. Only employees who need the information to perform a specific job (for example, billing or customer service) are granted access to personally identifiable information. The computers/servers in which we store personally identifiable information are kept in a secure environment.</p> <p><strong>Updates</strong></p> <p>This policy may change from time to time and all updates will be posted on this page.</p> <p>&nbsp;</p> https://guardianproject.info/2016/03/28/copperhead-guardian-project-and-f-droid-partner-to-build-open-verifiably-secure-mobile-ecosystem/ Mon, 28 Mar 2016 13:42:36 -0400 https://guardianproject.info/2016/03/28/copperhead-guardian-project-and-f-droid-partner-to-build-open-verifiably-secure-mobile-ecosystem/ <p>Three open-source projects haved joined together to announce a new partnership to create an open, verifiably secure mobile ecosystem of software, services and hardware. Led by the work of the Toronto-based <a href="https://copperhead.co/android/">CopperheadOS</a> team on securing the core Android OS, <a href="https://guardianproject.info">Guardian Project</a> and <a href="https://f-droid.org">F-Droid</a> have joined in to partner on envisioning and developing a full mobile ecosystem. The goal is to create a solution that can be verifiably trusted from the operating system,  through the network and network services, all the way up to the app stores and apps themselves. Through a future planned crowdfunded and commercial offering, the partnership will provide affordable off-the-shelf solutions, including device hardware and self-hosted app and update distribution servers, for any individual and organizations looking for complete mobile stacks they can trust.</p> <p><strong>Update 30 March 2016: Copperhead has announced their <a href="https://copperhead.co/blog/2016/03/29/crowdfunding-partnership-announced">crowdfunding plans here</a>.</strong></p> <p><a href="https://copperhead.co/android/">CopperheadOS</a> is a hardened open-source Android based on AOSP, that is available for download and installation on many Nexus devices. The Guardian Project develops popular free and open-source privacy-enhancing apps like Orbot (Tor for Android), ChatSecure, and ObscuraCam, and software libraries like NetCipher, SQLCipher and PanicKit, for developers who want to enable similar features in their own apps. F-Droid is an installable catalogue of free and open source Android software, that is built into CopperheadOS, as the default app store. It enables decentralized and verifiably secure app distribution by any individual or organization.</p> <p><a href="https://copperhead.co/android/" target="_blank"><img class="alignnone wp-image-13280 size-large" src="https://guardianproject.info/wp-content/uploads/2016/03/copperheados-1024x520.jpg" alt="copperheados" width="780" height="396" srcset="https://guardianproject.info/wp-content/uploads/2016/03/copperheados-1024x520.jpg 1024w, https://guardianproject.info/wp-content/uploads/2016/03/copperheados-300x152.jpg 300w, https://guardianproject.info/wp-content/uploads/2016/03/copperheados-768x390.jpg 768w, https://guardianproject.info/wp-content/uploads/2016/03/copperheados.jpg 1311w" sizes="(max-width: 780px) 100vw, 780px" /></a></p> <p> </p> <p><a href="https://guardianproject.info/wp-content/uploads/2016/03/IMG_0466.jpg"><img class="alignleft wp-image-13310 size-medium" src="https://guardianproject.info/wp-content/uploads/2016/03/IMG_0466-224x300.jpg" alt="IMG_0466" width="224" height="300" srcset="https://guardianproject.info/wp-content/uploads/2016/03/IMG_0466-224x300.jpg 224w, https://guardianproject.info/wp-content/uploads/2016/03/IMG_0466-768x1028.jpg 768w, https://guardianproject.info/wp-content/uploads/2016/03/IMG_0466-765x1024.jpg 765w, https://guardianproject.info/wp-content/uploads/2016/03/IMG_0466.jpg 1446w" sizes="(max-width: 224px) 100vw, 224px" /></a></p> <p>“I have been a happy CopperheadOS user since the first moment I installed it”, says Nathan Freitas, Founder and Director of Guardian Project, ” even with running it on a two-generation old, very inexpensive Nexus 5 device. I know I will always have the latest security updates immediately, and that everything on my device is under my control.”</p> <p>“My Copperhead Nexus is the go-to device in my bag, ” says Freitas, “when I am handling sensitive information, find myself on a network I don’t trust, or am otherwise wary about my communication being tracked, intercepted or tampered with.”</p> <p> </p> <p> </p> <p>Hans-Christoph Steiner who leads the Guardian Project’s developer platform says “Copperhead with F-Droid and Orbot provides all of the benefits of a smartphone, without the security and privacy downsides introduced by the major vendors, carriers and closed app stores. By building in F-Droid, Copperhead guarantees its users have direct access to the best free and open software, built directly from source-code in a trusthworthy, verifiable way”. Mr. Steiner presented on his work with F-Droid and building <a href="https://fosdem.org/2016/schedule/event/fdroidappstore/" target="_blank">“private, unblockable app stores”</a> at <a href="https://fosdem.org/2016/schedule/event/fdroidappstore/" target="_blank">FOSDEM 2016</a> in January.</p> <p><a href="https://fosdem.org/2016/schedule/event/fdroidappstore/" target="_blank"><img class="alignnone wp-image-13306 size-large" src="https://guardianproject.info/wp-content/uploads/2016/03/handsatfosdem-1024x572.jpg" alt="handsatfosdem" width="945" height="528" srcset="https://guardianproject.info/wp-content/uploads/2016/03/handsatfosdem-1024x572.jpg 1024w, https://guardianproject.info/wp-content/uploads/2016/03/handsatfosdem-300x168.jpg 300w, https://guardianproject.info/wp-content/uploads/2016/03/handsatfosdem-768x429.jpg 768w, https://guardianproject.info/wp-content/uploads/2016/03/handsatfosdem-360x200.jpg 360w, https://guardianproject.info/wp-content/uploads/2016/03/handsatfosdem.jpg 1274w" sizes="(max-width: 945px) 100vw, 945px" /></a><br /> _Learn more about <a href="https://fosdem.org/2016/schedule/event/fdroidappstore/">F-Droid</a> from this <a href="https://fosdem.org/2016/schedule/event/fdroidappstore/">FOSDEM 2016 talk</a> (watch the <a href="http://video.fosdem.org/2016/h1309/f-droid-building-the-private-unblockable-app-store.mp4" target="_blank">video here</a>)_</p> <p>Collectively, this partnership creates a global team of information security researchers, forensic analysts, software developers, designers and engaged users, looking to move the state of the art forward for open, verifiably secure and privacy-enhancing mobile technology. The groups hope to expand the effort to include other mobile OS teams, application developers and even hardware developers interested in having the same kind of impact on the privacy and security of mobile computing.</p> <p>James Donaldson of Copperhead says “It’s important for Android users to have a privacy minded viable alternative to closed-source solutions when contemplating mobile security. Teaming up with great partners like F-Droid and Guardian Project allows us to offer our users both security and a great experience with all of the core features they need.”</p> <p><a href="https://guardianproject.info">Guardian Project</a> is an open-source effort based in New York, with a global community of contributors and partners. <a href="https://copperhead.co">Copperhead</a> is an information security firm located in Toronto, Canada, specializing in protecting data and devices from unauthorized access. <a href="https://f-droid.org">F-Droid</a> is a non-profit volunteer project, and is operated by F-Droid Limited, a non-profit organisation registered in England (no. 8420676).</p> <p>Contact:</p> <p>Nathan Freitas / +1 718 569 7272<br /> <a href="&amp;#x6d;&amp;#x61;ilt&amp;#x6f;&amp;#x3a;&amp;#x6e;ath&amp;#x61;&amp;#x6e;&amp;#x40;gua&amp;#x72;&amp;#x64;&amp;#x69;anp&amp;#x72;&amp;#x6f;&amp;#x6a;ect&amp;#x2e;&amp;#x69;&amp;#x6e;fo">nathan@&#x67;&#x75;&#x61;&#x72;&#x64;&#x69;&#x61;nproject&#x2e;&#x69;&#x6e;&#x66;&#x6f;</a> (XMPP-OTR, OpenPGP: <a href="https://pgp.mit.edu/pks/lookup?search=0xA801183E69B37AA9&op=index" target="_blank">0x69B37AA9</a>  / <a href="https://keybase.io/n8fr8" target="_blank"><a href="https://keybase.io/n8fr8">https://keybase.io/n8fr8</a></a>)</p> <p>James Donaldson / Copperhead<br /> <a href="mailto:media@&amp;#x63;&amp;#x6f;&amp;#x70;&amp;#x70;&amp;#x65;&amp;#x72;&amp;#x68;&amp;#x65;&amp;#x61;&amp;#x64;&amp;#x2e;&amp;#x63;o">m&#x65;di&#x61;@&#x63;&#x6f;p&#x70;er&#x68;ea&#x64;.&#x63;o</a> (OpenPGP: <a href="https://pgp.mit.edu/pks/lookup?search=0xDC1DEA5E&amp;op=index">0xDC1DEA5E</a><a href="https://pgp.mit.edu/pks/lookup?op=get&amp;search=0x2621AB13DC1DEA5E"> </a>)</p> https://guardianproject.info/archive/orfox/ Thu, 21 Jan 2016 11:09:09 -0400 https://guardianproject.info/archive/orfox/ <p><strong>September 2018 Update!</strong><br /> Since 2015, Orfox has been the only mobile app recommended by the Tor Project to utilize the privacy protections of Tor on Android. The Tor Project has launched an official browser, Tor Browser for Android, now in its alpha release. Orfox will be sunsetted by early 2019 when the stable Tor Browser for Android comes out. To experience real private browsing without tracking, surveillance, or censorship, download Tor Browser for Android from Google Play here: <a href="https://play.google.com/store/apps/details?id=org.torproject.torbrowser_alpha" rel="nofollow"><a href="https://play.google.com/store/apps/details?id=org.torproject.torbrowser_alpha">https://play.google.com/store/apps/details?id=org.torproject.torbrowser_alpha</a></a>.</p> <p>You will still be able to use Orbot to route the traffic of all your other apps on Android over Tor.</p> <p><strong>About Orfox</strong></p> <p>Orfox is built from the same source code as Tor Browser (which is built upon Firefox), but with a few minor modifications to the privacy enhancing features to make them compatible with Firefox for Android and the Android operating system.</p> <p><img class="alignleft size-full wp-image-13402" src="https://guardianproject.info/wp-content/uploads/2016/01/orfox64.png" alt="orfox64" width="64" height="64" /><br /> <strong>Install now from <a href="https://play.google.com/store/apps/details?id=info.guardianproject.orfox" target="_blank" rel="noopener">Google Play</a> or <a href="https://guardianproject.info/fdroid">F-Droid</a>.</strong></p> <p>&nbsp;</p> <p>&nbsp;</p> <div id='gallery-15' class='gallery galleryid-13260 gallery-columns-3 gallery-size-medium'> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130-169x300.png" class="attachment-medium size-medium" alt="" aria-describedby="gallery-15-13004" srcset="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-15-13004'> Tor-relevant default sites </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152-169x300.png" class="attachment-medium size-medium" alt="" aria-describedby="gallery-15-13003" srcset="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-15-13003'> Recognized as Tor Browser </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414-169x300.png" class="attachment-medium size-medium" alt="" aria-describedby="gallery-15-13001" srcset="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-15-13001'> Easy access to onion sites! </dd> </dl> <br style="clear: both" /> </div> <p>In as many ways as possible, we adhere to the design goals of Tor Browser (<a href="https://www.google.com/url?q=https://www.google.com/url?q%3Dhttps://www.torproject.org/projects/torbrowser/design/%26sa%3DD%26usg%3DAFQjCNGgjQqgDl08Yq1yDT7TRTKh4-8GQA&sa=D&usg=AFQjCNFc5qxj8HcVEo4QHbB4SGLX79PDSg" target="_blank" rel="noopener"><a href="https://www.torproject.org/projects/torbrowser/design/">https://www.torproject.org/projects/torbrowser/design/</a></a>), by supporting as much of their actual code as possible, and extending their work into the additional Android components of Firefox for Android.</p> <p>The Tor software protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, it prevents the sites you visit from learning your physical location, and it lets you access sites which are blocked.</p> <p><strong>Where can I find all the relevant Orfox project pieces?</strong></p> <ul> <li>The Orfox project tracker roadmap is here: <a href="https://dev.guardianproject.info/projects/orfox-private-browser/roadmap">https://dev.guardianproject.info/projects/orfox-private-browser/roadmap</a>{.external}</li> <li>The Orfox branch of the Tor Browser repository is here: <a href="https://github.com/guardianproject/tor-browser">https://github.com/guardianproject/tor-browser</a>{.external}</li> <li>The Orfox build project is here: <a href="https://github.com/guardianproject/orfoxfennec">https://github.com/guardianproject/orfoxfennec</a>{.external}</li> <li>The primary Tor Browser repository is here: <a href="https://gitweb.torproject.org/tor-browser.git/">https://gitweb.torproject.org/tor-browser.git/</a>{.external}</li> <li>Automated debug builds of Orfox alpha are available via F-Droid here (install F-Droid on your phone, then copy/paste or open the link to add the repo):<a href="https://dev.guardianproject.info/debug/info.guardianproject.orfox/fdroid/repo">https://dev.guardianproject.info/debug/info.guardianproject.orfox/fdroid/repo</a>{.external}</li> </ul> <p><strong>How is Orfox different than Tor Browser for desktop?</strong></p> <p>Orfox is built from the same source code as Tor Browser (which is built upon Firefox), but with a few minor modifications to the privacy enhancing features to make them compatible with Firefox for Android and the Android operating system. In as many ways as possible, we will adhere to the design goals of Tor Browser (<a href="https://www.torproject.org/projects/torbrowser/design/">https://www.torproject.org/projects/torbrowser/design/</a>{.external}), by supporting as much of their actual code as possible, and extending their work into the additional AF-Droid appndroid components of Firefox for Android.</p> <ul> <li><p>The Orfox code repository is at <a href="https://github.com/guardianproject/tor-browser">https://github.com/guardianproject/tor-browser</a>{.external} and the Tor Browser repository is here:<a href="https://gitweb.torproject.org/tor-browser.git/">https://gitweb.torproject.org/tor-browser.git/</a>{.external}. The Orfox repository is a fork of the Tor Browser repository with the necessary modification and Android-specific code as patches on top of the Tor Browser work. We will keep our repository in sync with updates and release of Tor Browser.</p></li> <li><p>Orfox is built from the Tor Browser repo based on ESR38 (<a href="https://dev.guardianproject.info/issues/5146">https://dev.guardianproject.info/issues/5146</a>{.external}<a href="https://dev.guardianproject.info/news/221">https://dev.guardianproject.info/news/221</a>{.external}) and has only two modified patches that were not relevant or necessary for Android</p></li> <li><p>Orfox does not currently include the mobile versions of HTTPS Everywhere, No Script and the Tor Browser Button, but these we will be added shortly, now that we have discovered how to properly support automatic installation of extensions on Android (<a href="https://dev.guardianproject.info/issues/5360">https://dev.guardianproject.info/issues/5360</a>{.external})</p></li> <li><p>Orfox includes a “Request Mobile Site” option that allows you to change the user-agent from the standard Tor Browser agent to a modified Android specific one: “Mozilla/5.0 (Android; Mobile; rv:31.0) Gecko/20100101 Firefox/31.0”. (<a href="https://dev.guardianproject.info/issues/5404">https://dev.guardianproject.info/issues/5404</a>{.external}). This is useful for being able to see the mobile version of a website, but does reduce the amount your browser blends in with other browsers.</p></li> <li><p>Orfox currently allows for users to bookmark sites, and may have additional data written to disk beyond what the core gecko browser component does. We are still auditing all disk write code, and determining how to appropriately disable or harden it. (<a href="https://dev.guardianproject.info/issues/5437">https://dev.guardianproject.info/issues/5437</a>{.external})</p></li> <li><p>Orfox cannot yet be built deterministically, but based on work with the FDroid project, we are aiming for this to be possible in the next year (<a href="https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise">https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise</a>{.external} <a href="https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds">https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds</a>{.external})</p></li> </ul> <p><strong>How is Orfox different than Firefox for Android?</strong></p> <p>Beyond the core Tor Browser components, Orfox also must ensure all Android-specific code is properly routed through the Tor proxy, and otherwise hardened to protect against data and privacy leaks.</p> <ul> <li><p>Orfox adds patches at the Android Java code layer to enable proxying of all Java network HTTP communications through the local Orbot HTTP proxy (HTTP localhost:8118 for now, but moving to SOCKS). (<a href="https://dev.guardianproject.info/issues/5235">https://dev.guardianproject.info/issues/5235</a>{.external} <a href="https://dev.guardianproject.info/issues/5317">https://dev.guardianproject.info/issues/5317</a>{.external})</p></li> <li><p>Orfox removes the Android permissions for Contacts, Camera, Microphone, Location and NFC (<a href="https://dev.guardianproject.info/issues/3822">https://dev.guardianproject.info/issues/3822</a>{.external}) since the capability of using these features are not in line with the spirit of Tor Browser</p></li> <li><p>Orfox removes features like WebRTC and support for interaction with Chromecasts or Roku devices, since this type of communication is not compatibility with proxying communication through a TCP-based network like Tor (<a href="https://dev.guardianproject.info/issues/5358">https://dev.guardianproject.info/issues/5358</a>{.external}<a href="https://dev.guardianproject.info/issues/5357">https://dev.guardianproject.info/issues/5357</a>{.external})</p></li> </ul> <p><strong>How is Orfox different than Orweb?</strong></p> <ul> <li><p>Orweb is our current default browser for Orbot/Tor mobile users (<a href="https://guardianproject.info/apps/orweb">https://guardianproject.info/apps/orweb</a>{.external}) that has been downloaded over 2 million times. It is VERY VERY SIMPLE, as it only has one tab, no bookmark capability, and an extremely minimal user experience.</p></li> <li><p>Orweb is built upon the bundled WebView (Webkit) browser component inside of the Android operating system. This has proven to be problematic because we cannot control the version of that component, and cannot upgrade it directly when bugs are found. In addition, Google has made it very difficult to effectively control the network proxy settings of all aspects of this component, making it difficult to guarantee that traffic will not leak on all devices and OS versions.</p></li> <li><p>Orweb also only provides a very limited amount of capability of Tor Browser, primarily related to reducing browser fingerprinting, minimizing disk writes, and cookie and history management. It trys to mimic some of the settings of Tor Browser, but doesn’t actually use any of the actual code written for Tor Browser security hardening.</p></li> <li><p>Orweb does have an advantage which is that it less than 2MB while Orfox is in the 25-30MB range. This is primarily because Orweb relies on many components built into Android, so it does not need to bundle them. Orfox contains the full stack of code necessary for a complete browser, and thus is more secure and dependable, but also larger. The Mozilla Mobile team is working on reducing the size of their binaries, and the Orfox team is focused on this, as well, since we are disabling some of the components that have contributed the browser bloat.</p></li> </ul> https://guardianproject.info/archive/orfox/ Thu, 21 Jan 2016 11:09:09 -0400 https://guardianproject.info/archive/orfox/ <p><strong>September 2018 Update!</strong><br /> Since 2015, Orfox has been the only mobile app recommended by the Tor Project to utilize the privacy protections of Tor on Android. The Tor Project has launched an official browser, Tor Browser for Android, now in its alpha release. Orfox will be sunsetted by early 2019 when the stable Tor Browser for Android comes out. To experience real private browsing without tracking, surveillance, or censorship, download Tor Browser for Android from Google Play here: <a href="https://play.google.com/store/apps/details?id=org.torproject.torbrowser_alpha" rel="nofollow"><a href="https://play.google.com/store/apps/details?id=org.torproject.torbrowser_alpha">https://play.google.com/store/apps/details?id=org.torproject.torbrowser_alpha</a></a>.</p> <p>You will still be able to use Orbot to route the traffic of all your other apps on Android over Tor.</p> <p><strong>About Orfox</strong></p> <p>Orfox is built from the same source code as Tor Browser (which is built upon Firefox), but with a few minor modifications to the privacy enhancing features to make them compatible with Firefox for Android and the Android operating system.</p> <p><img class="alignleft size-full wp-image-13402" src="https://guardianproject.info/wp-content/uploads/2016/01/orfox64.png" alt="orfox64" width="64" height="64" /><br /> <strong>Install now from <a href="https://play.google.com/store/apps/details?id=info.guardianproject.orfox" target="_blank" rel="noopener">Google Play</a> or <a href="https://guardianproject.info/fdroid">F-Droid</a>.</strong></p> <p>&nbsp;</p> <p>&nbsp;</p> <div id='gallery-15' class='gallery galleryid-13260 gallery-columns-3 gallery-size-medium'> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130-169x300.png" class="attachment-medium size-medium" alt="" aria-describedby="gallery-15-13004" srcset="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-15-13004'> Tor-relevant default sites </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152-169x300.png" class="attachment-medium size-medium" alt="" aria-describedby="gallery-15-13003" srcset="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-15-13003'> Recognized as Tor Browser </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414-169x300.png" class="attachment-medium size-medium" alt="" aria-describedby="gallery-15-13001" srcset="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-15-13001'> Easy access to onion sites! </dd> </dl> <br style="clear: both" /> </div> <p>In as many ways as possible, we adhere to the design goals of Tor Browser (<a href="https://www.google.com/url?q=https://www.google.com/url?q%3Dhttps://www.torproject.org/projects/torbrowser/design/%26sa%3DD%26usg%3DAFQjCNGgjQqgDl08Yq1yDT7TRTKh4-8GQA&sa=D&usg=AFQjCNFc5qxj8HcVEo4QHbB4SGLX79PDSg" target="_blank" rel="noopener"><a href="https://www.torproject.org/projects/torbrowser/design/">https://www.torproject.org/projects/torbrowser/design/</a></a>), by supporting as much of their actual code as possible, and extending their work into the additional Android components of Firefox for Android.</p> <p>The Tor software protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, it prevents the sites you visit from learning your physical location, and it lets you access sites which are blocked.</p> <p><strong>Where can I find all the relevant Orfox project pieces?</strong></p> <ul> <li>The Orfox project tracker roadmap is here: <a href="https://dev.guardianproject.info/projects/orfox-private-browser/roadmap">https://dev.guardianproject.info/projects/orfox-private-browser/roadmap</a>{.external}</li> <li>The Orfox branch of the Tor Browser repository is here: <a href="https://github.com/guardianproject/tor-browser">https://github.com/guardianproject/tor-browser</a>{.external}</li> <li>The Orfox build project is here: <a href="https://github.com/guardianproject/orfoxfennec">https://github.com/guardianproject/orfoxfennec</a>{.external}</li> <li>The primary Tor Browser repository is here: <a href="https://gitweb.torproject.org/tor-browser.git/">https://gitweb.torproject.org/tor-browser.git/</a>{.external}</li> <li>Automated debug builds of Orfox alpha are available via F-Droid here (install F-Droid on your phone, then copy/paste or open the link to add the repo):<a href="https://dev.guardianproject.info/debug/info.guardianproject.orfox/fdroid/repo">https://dev.guardianproject.info/debug/info.guardianproject.orfox/fdroid/repo</a>{.external}</li> </ul> <p><strong>How is Orfox different than Tor Browser for desktop?</strong></p> <p>Orfox is built from the same source code as Tor Browser (which is built upon Firefox), but with a few minor modifications to the privacy enhancing features to make them compatible with Firefox for Android and the Android operating system. In as many ways as possible, we will adhere to the design goals of Tor Browser (<a href="https://www.torproject.org/projects/torbrowser/design/">https://www.torproject.org/projects/torbrowser/design/</a>{.external}), by supporting as much of their actual code as possible, and extending their work into the additional AF-Droid appndroid components of Firefox for Android.</p> <ul> <li><p>The Orfox code repository is at <a href="https://github.com/guardianproject/tor-browser">https://github.com/guardianproject/tor-browser</a>{.external} and the Tor Browser repository is here:<a href="https://gitweb.torproject.org/tor-browser.git/">https://gitweb.torproject.org/tor-browser.git/</a>{.external}. The Orfox repository is a fork of the Tor Browser repository with the necessary modification and Android-specific code as patches on top of the Tor Browser work. We will keep our repository in sync with updates and release of Tor Browser.</p></li> <li><p>Orfox is built from the Tor Browser repo based on ESR38 (<a href="https://dev.guardianproject.info/issues/5146">https://dev.guardianproject.info/issues/5146</a>{.external}<a href="https://dev.guardianproject.info/news/221">https://dev.guardianproject.info/news/221</a>{.external}) and has only two modified patches that were not relevant or necessary for Android</p></li> <li><p>Orfox does not currently include the mobile versions of HTTPS Everywhere, No Script and the Tor Browser Button, but these we will be added shortly, now that we have discovered how to properly support automatic installation of extensions on Android (<a href="https://dev.guardianproject.info/issues/5360">https://dev.guardianproject.info/issues/5360</a>{.external})</p></li> <li><p>Orfox includes a “Request Mobile Site” option that allows you to change the user-agent from the standard Tor Browser agent to a modified Android specific one: “Mozilla/5.0 (Android; Mobile; rv:31.0) Gecko/20100101 Firefox/31.0”. (<a href="https://dev.guardianproject.info/issues/5404">https://dev.guardianproject.info/issues/5404</a>{.external}). This is useful for being able to see the mobile version of a website, but does reduce the amount your browser blends in with other browsers.</p></li> <li><p>Orfox currently allows for users to bookmark sites, and may have additional data written to disk beyond what the core gecko browser component does. We are still auditing all disk write code, and determining how to appropriately disable or harden it. (<a href="https://dev.guardianproject.info/issues/5437">https://dev.guardianproject.info/issues/5437</a>{.external})</p></li> <li><p>Orfox cannot yet be built deterministically, but based on work with the FDroid project, we are aiming for this to be possible in the next year (<a href="https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise">https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise</a>{.external} <a href="https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds">https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds</a>{.external})</p></li> </ul> <p><strong>How is Orfox different than Firefox for Android?</strong></p> <p>Beyond the core Tor Browser components, Orfox also must ensure all Android-specific code is properly routed through the Tor proxy, and otherwise hardened to protect against data and privacy leaks.</p> <ul> <li><p>Orfox adds patches at the Android Java code layer to enable proxying of all Java network HTTP communications through the local Orbot HTTP proxy (HTTP localhost:8118 for now, but moving to SOCKS). (<a href="https://dev.guardianproject.info/issues/5235">https://dev.guardianproject.info/issues/5235</a>{.external} <a href="https://dev.guardianproject.info/issues/5317">https://dev.guardianproject.info/issues/5317</a>{.external})</p></li> <li><p>Orfox removes the Android permissions for Contacts, Camera, Microphone, Location and NFC (<a href="https://dev.guardianproject.info/issues/3822">https://dev.guardianproject.info/issues/3822</a>{.external}) since the capability of using these features are not in line with the spirit of Tor Browser</p></li> <li><p>Orfox removes features like WebRTC and support for interaction with Chromecasts or Roku devices, since this type of communication is not compatibility with proxying communication through a TCP-based network like Tor (<a href="https://dev.guardianproject.info/issues/5358">https://dev.guardianproject.info/issues/5358</a>{.external}<a href="https://dev.guardianproject.info/issues/5357">https://dev.guardianproject.info/issues/5357</a>{.external})</p></li> </ul> <p><strong>How is Orfox different than Orweb?</strong></p> <ul> <li><p>Orweb is our current default browser for Orbot/Tor mobile users (<a href="https://guardianproject.info/apps/orweb">https://guardianproject.info/apps/orweb</a>{.external}) that has been downloaded over 2 million times. It is VERY VERY SIMPLE, as it only has one tab, no bookmark capability, and an extremely minimal user experience.</p></li> <li><p>Orweb is built upon the bundled WebView (Webkit) browser component inside of the Android operating system. This has proven to be problematic because we cannot control the version of that component, and cannot upgrade it directly when bugs are found. In addition, Google has made it very difficult to effectively control the network proxy settings of all aspects of this component, making it difficult to guarantee that traffic will not leak on all devices and OS versions.</p></li> <li><p>Orweb also only provides a very limited amount of capability of Tor Browser, primarily related to reducing browser fingerprinting, minimizing disk writes, and cookie and history management. It trys to mimic some of the settings of Tor Browser, but doesn’t actually use any of the actual code written for Tor Browser security hardening.</p></li> <li><p>Orweb does have an advantage which is that it less than 2MB while Orfox is in the 25-30MB range. This is primarily because Orweb relies on many components built into Android, so it does not need to bundle them. Orfox contains the full stack of code necessary for a complete browser, and thus is more secure and dependable, but also larger. The Mozilla Mobile team is working on reducing the size of their binaries, and the Orfox team is focused on this, as well, since we are disabling some of the components that have contributed the browser bloat.</p></li> </ul> https://guardianproject.info/2016/01/12/panickit-making-your-whole-phone-respond-to-a-panic-button/ Tue, 12 Jan 2016 08:59:41 -0400 https://guardianproject.info/2016/01/12/panickit-making-your-whole-phone-respond-to-a-panic-button/ <p><a href="https://guardianproject.info/wp-content/uploads/2016/01/round-button-hazard.png" rel="attachment wp-att-13221"><img src="https://guardianproject.info/wp-content/uploads/2016/01/round-button-hazard-150x150.png" alt="round hazard button" width="150" height="150" class="alignright size-thumbnail wp-image-13221" srcset="https://guardianproject.info/wp-content/uploads/2016/01/round-button-hazard-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2016/01/round-button-hazard-300x300.png 300w, https://guardianproject.info/wp-content/uploads/2016/01/round-button-hazard-200x200.png 200w, https://guardianproject.info/wp-content/uploads/2016/01/round-button-hazard.png 512w" sizes="(max-width: 150px) 100vw, 150px" /></a>Our mobile devices do so many things for us, making it easy to communicate with people in all manners while giving us access to all sorts of information wherever we are. But in times of anxiety and panic, it is difficult to quickly use them. Will you be too shaky to type in your PIN or lock pattern? Will you have enough time to find your trusted contacts and send them a message? On top of that, our mobile devices carry massive amounts of private information in them: banking details, pictures, all of our messages and call logs.</p> <p>The kinds of data that we worry about vary widely based on where we are. In many places in the world, the stuff you are reading or the music you are listening to can get you arrested, or the people you are communicating with is enough to send you to jail. We have been adding “panic buttons” to our apps for 5 years now, and now we want to create an ecosystem of apps to create flexible and system-wide responses when we are unfortunate enough to require pressing the personal panic button.</p> <p>This work seeks to establish a new level of awareness, understanding and capability for providing specific mobile software features for users who are in a “panic” situations. We define “panic” as at risk of having their mobile device physically compromised or removed from their body, being physically detained themselves, or facing an immediate threat of violence, injury, kidnapping or death. This is not to say we are are building a global “911” system. We seek to explore how software that is explicitly designed for these situations, can provide some amount of assistance to the user, by either protecting their privacy, ensuring that sensitive data is hidden or unrecoverable, or that their support networks are notified of the panic event, and provided with the necessary information to take action.</p> <p>Over the past year, we have developed user experience design patterns, an Android library, a new panic button app, and example projects to communicate how a system-wide panic should look. For a quick introduction, check out this video demonstrating a very simple panic setup of <a href="https://play.google.com/store/apps/details?id=info.guardianproject.ripple" target="_blank">Ripple</a>, a panic button, triggering <a href="https://play.google.com/store/apps/details?id=info.guardianproject.browser" target="_blank">Orweb</a>, a private browser:</p> <h2 id="make-your-app-respond-in-times-of-panic">Make your app respond in times of panic</h2> <p>The ultimate goal of PanicKit is of course to make apps respond with actions that help protect the user. This can be as simple as locking the app when it has a passphrase, or the response can combine a number of actions into a coherent response: a messaging app locks its data and disguises itself as a game while sending out the panic message that includes the user’s location. There is a lot of complexity in all this, especially with many apps involved, so it is essential to always simplify the experience as much as possible. Thinking about panic situations is stressful, setting up the panic response should not add to that stress. Towards that end, it is better to sacrifice some flexibility if that means solid gains in simplicity.</p> <p>The first key design pattern is the default, non-destructive response. If all apps that support PanicKit include sensible defaults, then pressing the panic button can have a useful response without the user having to setup anything at all. In order to achieve this, we divide possible responses into two categories: non-destructive vs destructive. An app that has a PIN lock can be locked without destroying anything, the user just needs to unlock it. A browser that wipes the cache can always just download the files again next time the user goes to that website. If an app only has a default, non-destructive response, then there is no need to have a configuration interface; it can be represented purely in the trigger app’s list of responders, where it will be marked “App hides when triggered”.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2016/01/02.0.png" rel="attachment wp-att-13212"><img src="https://guardianproject.info/wp-content/uploads/2016/01/02.0-939x1024.png" alt="panic responder setup" width="780" height="851" class="alignnone size-large wp-image-13212" srcset="https://guardianproject.info/wp-content/uploads/2016/01/02.0-939x1024.png 939w, https://guardianproject.info/wp-content/uploads/2016/01/02.0-275x300.png 275w, https://guardianproject.info/wp-content/uploads/2016/01/02.0-768x838.png 768w" sizes="(max-width: 780px) 100vw, 780px" /></a></p> <p>Many of the most valuable panic responses require doing something that can not be undone, so we classify these as destructive. Deleting data is exactly what is needed in a panic situation, but the user must opt-in to enable this kind of response in order to prevent data from being mistakenly deleted. Sending a message can also be a very valuable panic response. But sending a message to the wrong person can cause harm, sending it at the wrong time can destroy people’s expectations: if you cry wolf too often, then people will stop hearing it. Disguising an app can also save people a lot of trouble. But if the user does not know this is going to happen, their experience will be that the app was deleted. So these are all destructive responses and require the user to enable them via a panic setup screen.</p> <p>For apps that offer configurable responses, it is essential to present those options clearly with as little clutter as possible. The panic setup should be on a devoted screen, not mixed in with other settings, and takes up the full screen. Panic is a time of stress, the panic response should strive to avoid adding any stress on top of that. When an app offers a few options for responses, then even the devoted screen can quickly get complicated: a list of possibilities, a text field for a message, and a way to manage the contacts to send to. It is important that the entire response is easily visible in one screen so that the user can quickly and easily tell how that app will respond. The entire panic setup should be on a single screen with as little scrolling as possible. Large widgets like a message text field should be placed at the bottom, and be collapsed if not active.</p> <p>To get started, add the PanicKit library to your <em>build.gradle</em>: <code>info.guardianproject.panic:panic:0.5</code>, then check out the FakePanicResponder example app, as well as how it is implemented in real apps:</p> <ul> <li><a href="https://github.com/SMSSecure/SMSSecure/blob/8b2d61161716dcae33c7ae2fd9540931b632030a/src/org/smssecure/smssecure/PanicResponderActivity.java" target="_blank">SMSSecure lock as default response</a></li> <li><a href="https://github.com/theScrabi/NewPipe/pull/133" target="_blank">NewPipe clear search history as default response</a></li> <li><a href="https://github.com/zom/Zom-Android/blob/master/app/src/main/java/org/awesomeapp/messenger/ui/PanicSetupActivity.java" target="_blank">Zom with multiple destructive responses and a default lock response</a></li> </ul> <h2 id="make-your-own-panic-button-app">Make your own panic button app</h2> <p>One key reason why we took on this project is to spur more innovation in what a “panic button” can look like. There are currently two solid panic trigger apps that use PanicKit: <a href="https://panicbutton.io" target="_blank">PanicButton</a> and <a href="https://play.google.com/store/apps/details?id=info.guardianproject.ripple" target="_blank">Ripple</a>.</p> <p>There are many ideas for what a panic button can look like, now it is easy to make one that will actually trigger real things. A custom panic button app only needs to send the trigger message (technically an <code>ACTION_TRIGGER Intent</code>), which will make apps lock, hide, delete private data, send a message, etc. Here are some ideas for panic button apps that we would love to see:</p> <ul> <li>a “<a href="https://en.wikipedia.org/wiki/Dead_man%27s_switch" target="_blank">dead man’s switch</a>” that triggers if the user has not checked in within the last hour</li> <li>a “geo-fence” that triggers if the device comes too close to a known detention center</li> <li>a sensor monitor that triggers on absence of movement</li> <li>a custom Bluetooth button that looks like a belt buckle, <a href="http://news.discovery.com/tech/gear-and-gadgets/sleek-jewelry-hides-a-panic-button-140220.htm" target="_blank">brooch</a>, or other innocuous object</li> </ul> <p><a href="https://guardianproject.info/wp-content/uploads/2016/01/01.3.png" rel="attachment wp-att-13207"><img src="https://guardianproject.info/wp-content/uploads/2016/01/01.3-149x300.png" alt="Ripple's responders" width="149" height="300" class="alignright size-medium wp-image-13207" srcset="https://guardianproject.info/wp-content/uploads/2016/01/01.3-149x300.png 149w, https://guardianproject.info/wp-content/uploads/2016/01/01.3-768x1544.png 768w, https://guardianproject.info/wp-content/uploads/2016/01/01.3-509x1024.png 509w, https://guardianproject.info/wp-content/uploads/2016/01/01.3.png 1006w" sizes="(max-width: 149px) 100vw, 149px" /></a></p> <p>An important part of the user experience of the panic button app is how it represents what the trigger will do. For that, we paid careful attention to the design of the list of “panic responder” apps. It should quickly and clearly show which apps are enabled. In our pattern, enabled apps should be sorted to the top of the list and disabled apps should be greyed out including the app icon. There should also be a standard switch to both allow the user to enable/disable an app as well as provide extra feedback on whether an app is enabled or not. That provides three visual channels that communicate what will respond (top of the list, in full color, and with the shape of a switch that is turned on). For a thorough overview of design patterns, see <a href="https://dev.guardianproject.info/boards/21/topics/390" target="_blank">Panic Design Patterns</a>.</p> <p>Panic responders can have both non-destructive and destructive responses, and some are only appropriate for a full on panic. If you are just feeling anxious, and are worried that the situation is getting dangerous, then deleting files is not appropriate but locking and hiding is. An app could instead be an “anxious trigger” app, and be limited to only non-destructive responses. A trigger app can only send one kind of trigger message (the <code>ACTION_TRIGGER Intent</code>), to keep the inter-app interaction simple. So the anxious trigger app would instead not offer the “EDIT” option (implemented with an <code>ACTION_CONNECT Intent</code>), and that limits the responses to the default, non-destructive responses in all the apps that receive a trigger from the anxious trigger app.</p> <p>To get started, add the panickit library to your build.gradle <code>info.guardianproject.panic:panic:0.5</code>, then check out the <code>PanicTrigger</code> class. You can see how it is implemented in these example apps:</p> <ul> <li><a href="https://github.com/guardianproject/Ripple" target="_blank">Ripple</a> – <em>a real panic button that is simple enough to be an example</em></li> <li><a href="https://github.com/guardianproject/FakePanicButton" target="_blank">FakePanicButton</a> – <em>a fake app that is only meant to be an example</em></li> </ul> <h2 id="more-work-and-open-questions">More work and open questions</h2> <p>There is a lot of potential for making our mobile devices help us in anxious and panicked moments. PanicKit has established that a system-wide panic response can be simple, approachable, and effective. But there is definitely much work to be done. There is an organization forming around this work, The <a href="https://github.com/PanicInitiative" target="_blank">Panic Initiative</a>, that will build upon the work done by Amnesty International, <a href="https://iilab.org/" target="_blank">iilab</a>, and our PanicKit work.</p> <p>There are of course still many open questions that we are very interested in, and hope to see more people working on this:</p> <ul> <li>Should this be handled on the system level?</li> <li>How the trigger app query the responder for its action without leaking private data like contacts or location?</li> <li>How can panic and anxiety be represented graphically, using colors, iconography, UI, etc.?</li> </ul> <p>For more discussion and resources, check out the <a href="https://dev.guardianproject.info/projects/panic/wiki" target="_blank">PanicKit wiki</a>.</p> https://guardianproject.info/2015/12/29/how-to-migrate-your-android-apps-signing-key/ Tue, 29 Dec 2015 12:03:54 -0400 https://guardianproject.info/2015/12/29/how-to-migrate-your-android-apps-signing-key/ <p><strong>It is time to update to a stronger signing key for your Android app! The old default RSA 1024-bit key is weak and officially deprecated.</strong></p> <h2 id="what">What?</h2> <p>The Android OS requires that every application installed be signed by a digital key. The purpose behind this signature is to identify the author of the application, allow this author and this author alone to make updates to the app, as well as provide a mechanism to establish inter-application trust. The Android security model defines an app by two things: the package name (aka <a href="https://developer.android.com/reference/android/content/Context.html#getPackageName%28%29" target="_blank"><code>packageName</code></a>, <a href="https://sites.google.com/a/android.com/tools/tech-docs/new-build-system/applicationid-vs-packagename" target="_blank"><code>ApplicationID</code></a>, <a href="https://developer.android.com/guide/topics/manifest/manifest-element.html#package" target="_blank"><code>package</code></a>) and the signing key. If either of those are different, then Android considers it a different app. When the package name and signing key of one APK match an installed app, then the APK is considered an update and Android will replace the installed app with the APK. If the APK is signed by a different key, then Android will prevent installing and updating.</p> <p>First thing is to see what the current signing key is. Check any app’s signing key using our free utility app <a href="https://play.google.com/store/apps/details?id=info.guardianproject.checkey" target="_blank">Checkey</a>:</p> <div id="attachment_13170" style="width: 790px" class="wp-caption alignnone"> <a href="https://guardianproject.info/wp-content/uploads/2015/12/checkey-1.png" rel="attachment wp-att-13170"><img aria-describedby="caption-attachment-13170" src="https://guardianproject.info/wp-content/uploads/2015/12/checkey-1-1024x576.png" alt="Lookout needs to generate a new key!" width="780" height="439" class="size-large wp-image-13170" srcset="https://guardianproject.info/wp-content/uploads/2015/12/checkey-1-1024x576.png 1024w, https://guardianproject.info/wp-content/uploads/2015/12/checkey-1-300x169.png 300w, https://guardianproject.info/wp-content/uploads/2015/12/checkey-1-768x432.png 768w, https://guardianproject.info/wp-content/uploads/2015/12/checkey-1-350x197.png 350w, https://guardianproject.info/wp-content/uploads/2015/12/checkey-1-860x484.png 860w, https://guardianproject.info/wp-content/uploads/2015/12/checkey-1.png 1280w" sizes="(max-width: 780px) 100vw, 780px" /></a> <p id="caption-attachment-13170" class="wp-caption-text"> Lookout needs to generate a new key! </p> </div> <p>The official Android docs have tons of useful information about what the signing keys are good for, how to generate them, and how to use them. Unfortunately, it doesn’t provide any instructions for migrating, and for many years, 1024-bit RSA was the default. But first, why would you want or need to migrate?</p> <h2 id="why">Why?</h2> <p>Depending on when you created your signing key, you might have a particularly weak key. The primary danger of a weak key is that an adversary could break your key in order to generate fake APK signatures. Then those malicious APKs can be installed as updates to your app. There are other nefarious purposes depending on how you use the signing key in your apps. Or if you are unfortunate enough to have suffered a loss of your private key material, then it is definitely time for a new signing key.</p> <p>According to our friends at the <a href="https://androidobservatory.org/stats" title="Android Observatory">Android Observatory</a>, over 64% of Android apps in their data store use 1024-bit signing keys (RSA or DSA).</p> <div id="visualization" style="width: 600px; height: 400px;"> </div> <p>There are several good reasons to migrate off of 1024-bit RSA keys, even though there is no <em>public</em> proof of a 1024 prime factorization required to generate any 1024-bit key at will. The evidence has been mounting for a decade.</p> <p>NIST’s <a href="http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_part1_rev3_general.pdf">official guidelines</a> (PDF, page 64 and 67) deprecated 1024-bit RSA keys at the end of 2013. This deprecation by NIST isn’t an indication that 1024-bit RSA is compromised, instead it is a preemptive move to stay ahead of attacks. Confidence in NIST might be shaken in light of <a href="http://blog.cryptographyengineering.com/2013/09/on-nsa.html">recent revelations</a>, but in this case increasing the RSA key size is unlikely to trigger any secret NSA backdoors. If anything, the deprecation year could have been extended slightly to allow the NSA a window where they had the capacity to factor 1024-bit keys and everyone was still using them. So, it’s time to move on.</p> <p>For an example, a decade ago the cost of building special purpose hardware capable of breaking a single 1024-bit RSA key in one year was estimated at $10 million (<a href="http://tau.ac.il/~tromer/papers/cbtwirl.pdf">Adi Shamir, Eran Tromer, On the cost of factoring RSA-1024</a>, 2003). Presumably the techniques have improved by orders of magnatude, and the hardware value depreciated. It is conceivable the cost has fallen enough to be affordable not only by nation-state actors, but by large criminal enterprises too.</p> <p>For a comprehensive talk on the state of the art (as of December 2012) when it comes to breaking 1024-bit RSA, check out the 29C3 talk <a href="http://events.ccc.de/congress/2012/Fahrplan/events/5275.en.html" title="FactHacks: RSA factorization in the real world">FactHacks: RSA factorization in the real world</a> with the cryptographers Daniel J. Bernstein, Nadia Heninger, and Tanja Lange (<a href="http://events.ccc.de/congress/2012/wiki/Documentation#Recordings" title="29C3 Recordings">watch recording</a>)</p> <h2 id="how">How?</h2> <p>Migrating to a strong key for an Android app is, unfortunately, not so simple. If you are publishing a <em>new</em> app to the app store, then simply generate a new strong signing key and you’re done. Congratulations! However, there exists no easy way to update your signing key for an existing application, because an installed application can only take updates from an APK signed with <em>the same</em> key.</p> <p>Here we outline a basic method with which you can use to fake an update to your signing key. This is not as user friendly as we would like. Some of the hard facts of performing this process is that for most app stores including Google Play, you will lose ratings and reviews since the app will show up with a new package name, and the app store will treat it like an entirely new app. Also, the user will have to manually uninstall the original app once they finish the procedure. Here is a rough outline of the process:</p> <ol> <li>generate the new signing key, <em>RSA 4096</em></li> <li>Update the first app, <em>App1</em>, with a mechanism for exporting private data, using <a href="https://github.com/guardianproject/TrustedIntents" target="_blank">TrustedIntents</a> with a signature pin of the new key, <em>RSA 4096</em>, which <a href="https://guardianproject.info/2014/07/30/introducing-trustedintents-for-android/" target="_blank">Checkey will generate for you</a></li> <li>Create a new version of the app with a different package name, <em>App2</em></li> <li>sign <em>App2</em> with new key, <em>RSA 4096</em></li> <li>Add method to <em>App2</em> for receiving user data from <em>App1</em>, including a signature pin of the old signing key, <em>RSA 1024</em>, for use with TrustedIntents</li> <li>Publish <em>App2</em> to the app stores</li> <li>From <em>App1</em>, prompt user to install <em>App2</em></li> <li>runs and imports data from <em>App1</em></li> <li><em>App2</em> prompts user to uninstall <em>App1</em></li> </ol> <p>For <a href="https://f-droid.org" target="_blank">F-Droid</a>, there will be some easier tools for handling this. The F-Droid system is already used to multiple signing keys per app since F-Droid uses its own signing key for many of the apps it releases, and that F-Droid signing key is different from the signing key that the original developer used in their Google Play uploads. F-Droid will likely be able to support APKs with the same package name but with multiple signing keys.</p> <h3 id="a-note-on-compatibility">A Note on Compatibility</h3> <p>There is security vs compatibility trade off a few might be interested in. Pre-4.3, Android did not support any signature algorithms except SHA1. With Android &gt;= 4.3, SHA256 support was fixed, and SHA384, SHA512, and ECDSA were added (<a href="https://code.google.com/p/android/issues/detail?id=38321">source</a>). There are still android 2.3.3 (<code>android-10</code>) devices being sold, so anyone interested in backwards compatibility will have to heed this.</p> <p>Also, the larger the keysize and hashsize used, the longer it takes to install and update the application. So extremely large values might be unsuitable for slower hardware. The following probably doesn’t buy you a tremendous amount of additional security but cranks the paranoia to 11. It does so at the cost of compatibility and performance.<br /> <code>&lt;br /&gt; Gen with:&lt;br /&gt; keytool -genkey -v -keystore test.keystore -alias testkey -keyalg RSA -keysize 4096 -sigalg SHA512withRSA -dname &quot;cn=Test,ou=Test,c=CA&quot; -validity 10000&lt;/p&gt; &lt;p&gt;Sign with:&lt;br /&gt; jarsigner -verbose -sigalg SHA512withRSA -digestalg SHA512 -keystore test.keystore test.apk testkey&lt;br /&gt; </code></p> <p>We have some scripts that we use to generate keys in our <a href="https://github.com/guardianproject/smartcard-apk-signing" target="_blank">smartcard-apk-signing</a> repo. It is also possible to generate an Android signing key using openssl or other libraries. It is often wise to use different software than standard for doing things like generating keys. Since the Java <code>keytool</code> approach that is the standard, recommended method for Android, that makes it a target for adversaries that are interested in breaking keys. If a key was generated using <code>openssl</code> or GNU TLS instead, for example, then that key would not be affected if <code>keytool</code> had <a href="https://freedom-to-tinker.com/blog/kroll/software-transparency-debian-openssl-bug/" target="_blank">a bug like Debian’s</a> <a href="https://security-tracker.debian.org/tracker/CVE-2008-0166" target="_blank">CVE-2008-0166</a>.</p> https://guardianproject.info/2015/12/09/good-translations-are-essential-to-usability/ Wed, 09 Dec 2015 17:20:15 -0400 https://guardianproject.info/2015/12/09/good-translations-are-essential-to-usability/ <p><a href="https://guardianproject.info/wp-content/uploads/2015/12/Rosetta-Stone.jpg"><img src="https://guardianproject.info/wp-content/uploads/2015/12/Rosetta-Stone-230x300.jpg" alt="Rosetta Stone" width="230" height="300" class="alignright size-medium wp-image-13155" srcset="https://guardianproject.info/wp-content/uploads/2015/12/Rosetta-Stone-230x300.jpg 230w, https://guardianproject.info/wp-content/uploads/2015/12/Rosetta-Stone-786x1024.jpg 786w, https://guardianproject.info/wp-content/uploads/2015/12/Rosetta-Stone.jpg 1164w" sizes="(max-width: 230px) 100vw, 230px" /></a>All too often, translation of an app are treated as an afterthought. It is not something that the app developers see, since they create the software in languages that work best for them. So the software looks complete to the developers. But for anyone using the software in a different language, translation is essential in order for the app to be useful. If you can’t understand the words that you see in the app’s interface, it is going to be difficult or impossible to use that app.</p> <p>The part of this question that is still open is how best to manage translating software. From the point of view of the app’s developer, it is not possible to check all of the translations since no one speaks <a href="https://www.transifex.com/otf/orbot/" target="_blank">that many languages</a> fluently. Many of our apps are translated into 30 or more languages, represented by both pictograms and more than 10 alphabets. No one could read all of those writing systems, let alone understand all the words written in them. So inevitably, developers must trust many other people to do accurate translations, and to not slip in false or misleading information.</p> <p>We receive substantial translations from random internet users who come along and contribute their time into translating our apps. We aim to make that process as easy as possible by posting clean source files to Transifex, the web service we currently use. We also work a lot with the <a href="https://www.transifex.com/otf" target="_blank">OTF Translation Hub</a>, which organizes the chaos of all those apps and contributors into regular events and completed translations. Organized community contributions work very well for building up baseline translations and keeping polished translations updated when the software changes. It is both a valuable and cost-effective resource, and I think its a model that can be emulated for other collections of software.</p> <p>Nevertheless, for certain target languages like Tibetan or Belarusian, community contributions are rare. We get lots of contributions for many languages, like French, German, and Spanish, but other languages, like Arabic, Chinese, Persian, and Burmese get very few contributions from volunteers. Also, in order to get completed, polished translations, it is necessary to pay translators so they can devote a solid, concentrated chunk of time on making sure the whole translation works. This person can then spend time thinking about the finer points which can have a large impact on the user experience: the tone and feeling of the language, whether it is funny, serious, cute, matter of fact, etc.</p> <p>So really, in order to deliver software that is translated into many languages, opening up the source files to get as many contributions as possible will get a lot of work done. But cultivating relationships with translators to oversee the whole process is essential in order to have the translations match the quality of the software.</p> https://guardianproject.info/2015/12/09/first-reproducible-builds-summit/ Wed, 09 Dec 2015 05:02:48 -0400 https://guardianproject.info/2015/12/09/first-reproducible-builds-summit/ <p>I was just in Athens for the “<a href="https://reproducible-builds.org/events/athens2015/">Reproducible Builds Summit</a>“, an <a href="https://aspirationtech.org/" target="_blank">Aspiration</a>-run meeting focused on the issues of getting all software builds to be reproducible. This means that anyone starting with the same source code can build the <em>exact</em> same binary, bit-for-bit. At first glance, it sounds like this horrible, arcane detail, which it is really. But it provides tons on real benefits that can save lots of time. And in terms of programming, it can actually be quite fun, like doing a puzzle or sudoku, since there is a very clear point where you have “won”.</p> <p>Here are some examples of real benefits:</p> <ul> <li>makes it easy to ensure no malware was inserted into software during the build process (e.g. the <a href="https://en.wikipedia.org/wiki/XcodeGhost" target="_blank">XCodeGhost</a> malware we just saw)</li> <li>provides a QA tool to make sure that changes in the source code of a project produce only the expected results</li> <li>allows F-Droid to use the developer’s APK signature while still verifying that apps build from 100% free software</li> <li>make it possible to optimize and profile build processes while guaranteeing the results are exactly the same</li> <li>for large projects, it can greatly speed up the build process (think rebuilding Gmail)</li> </ul> <p>Represented there was: <a href="http://https//www.debian.org" target="_blank">Debian</a>, Google, <a href="https://www.freebsd.org/" target="_blank">FreeBSD</a>, <a href="https://getfedora.org/" target="_blank">Fedora</a>, <a href="https://f-droid.org" target="_blank">F-Droid</a>,<br /> <a href="http://brew.sh/" target="_blank">Homebrew</a>, <a href="https://www.macports.org/" target="_blank">MacPorts</a>, <a href="https://www.netbsd.org/" target="_blank">NetBSD</a>, <a href="https://www.archlinux.org/" target="_blank">Arch Linux</a>, <a href="https://www.coreboot.org/" target="_blank">Coreboot</a>, <a href="https://openwrt.org/" target="_blank">OpenWRT</a>, and a bunch of other<br /> projects like an automotive Linux distro called <a href="https://wiki.baserock.org/" target="_blank">Baserock</a>, the <a href="https://www.gnu.org/software/guix/" target="_blank">Guix</a> package manager, a Linux distro called <a href="https://nixos.org/" target="_blank">NixOS</a>, <a href="https://www.haskell.org/" target="_blank">Haskell</a> hackers, etc.</p> <p>The organizers are already planning a second meeting, probably in April in Western Europe, and are looking to get more projects involved. Lots of people were talking about how it would be great to get some Android ROM developers involved. So if you are a contributor to CyanogenMod, Copperhead, <a href="https://omnirom.org/" target="_blank">OmniROM</a>, <a href="http://www.replicant.us/" target="_blank">Replicant</a>, Blackphone, etc. and would be interested in attending, please let us know!</p> https://guardianproject.info/2015/09/21/cipherkit-reproducible-builds/ Mon, 21 Sep 2015 10:54:05 -0400 https://guardianproject.info/2015/09/21/cipherkit-reproducible-builds/ <p><a href="https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk.jpg"><img src="https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk-150x150.jpg" alt="alberti cipher disk" width="150" height="150" class="alignright size-thumbnail wp-image-3079" srcset="https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk.jpg 245w" sizes="(max-width: 150px) 100vw, 150px" /></a></p> <p>We have been on a kick recently with making our build process support “reproducible builds” aka “deterministic builds”. What is this reproducible thing? Basically, what that means is that you can run a script and end up with the <em>exact</em> same binary file as our official releases, be it a APK, JAR, AAR, whatever. That lets anyone verify that our releases are produced only from the source in git, without including anything else, whether deliberately or accidentally (like malware).</p> <p>Our core CipherKit libraries are the more sensitive areas, so that’s where we’ve started. We generally work on Debian and Ubuntu and recommend that platform, but we recognized that OSX is a popular platform for Android developers also. So this process will work on OSX too, using your favorite package manager (e.g. Fink, MacPorts, or Homebrew).</p> <p>Then you will end up with <code>IOCipher-v0.3.zip</code>, which includes the .jar and .so files. If your setup is close enough to our release build setup, the contents of that ZIP file will be the same as the official release. Right now, it is difficult to get the exact same binary file (e.g. the same sha256 sum) because of the timestamps in the .zip and varitions caused by using different versions of Java, and Android SDK and NDK. To check the contents of your build versus the official release:</p> <pre>sudo apt-get install faketime unzip wget meld cd /tmp wget https://guardianproject.info/releases/IOCipher-v0.3.zip wget https://guardianproject.info/releases/IOCipher-v0.3.zip.sig gpg --verify IOCipher-v0.3.zip.sig git clone https://github.com/guardianproject/IOCipher cd IOCipher git checkout v0.3 ./make-release-build ./compare-to-official-release IOCipher-v0.3.zip /tmp/IOCipher-v0.3.zip </pre> <h3 id="what-is-happening-here">What is happening here?</h3> <p><em>meld</em> (<em>FileMerge</em> on OSX) will show a listing of all files listed, and which ones are different. You can see that the contents of the <em>.class</em> files and <em>.so</em> files all match, but there will be inevitable differences in some of the metadata. Native builds are much more sensitive to changes in the toolchain. The Java <em>.class</em> files are usually reproducible even when using different versions of Java and the Android SDK. Native builds are almost never reproducible if the NDK version is at all different. Sometimes even the host platform where the NDK is running (e.g. Ubuntu vs OSX, or 64-bit vs 32-bit) will cause differences in the final binaries.</p> <div id="attachment_13105" style="width: 883px" class="wp-caption alignnone"> <a href="https://guardianproject.info/wp-content/uploads/2015/09/Screenshot-.-IOCipher-v0.3-MANIFEST.MF-_tmp-IOCipher-v0.3-MANIFEST.MF-Meld.png"><img aria-describedby="caption-attachment-13105" src="https://guardianproject.info/wp-content/uploads/2015/09/Screenshot-.-IOCipher-v0.3-MANIFEST.MF-_tmp-IOCipher-v0.3-MANIFEST.MF-Meld.png" alt="The NDK version and build platform are listed in the manifest." width="873" height="591" class="size-full wp-image-13105" srcset="https://guardianproject.info/wp-content/uploads/2015/09/Screenshot-.-IOCipher-v0.3-MANIFEST.MF-_tmp-IOCipher-v0.3-MANIFEST.MF-Meld.png 873w, https://guardianproject.info/wp-content/uploads/2015/09/Screenshot-.-IOCipher-v0.3-MANIFEST.MF-_tmp-IOCipher-v0.3-MANIFEST.MF-Meld-300x203.png 300w" sizes="(max-width: 873px) 100vw, 873px" /></a> <p id="caption-attachment-13105" class="wp-caption-text"> The NDK version and build platform are listed in the manifest. </p> </div> <div id="attachment_13104" style="width: 883px" class="wp-caption alignnone"> <a href="https://guardianproject.info/wp-content/uploads/2015/09/Screenshot-.-IOCipher-v0.3-_tmp-IOCipher-v0.3-Meld.png"><img aria-describedby="caption-attachment-13104" src="https://guardianproject.info/wp-content/uploads/2015/09/Screenshot-.-IOCipher-v0.3-_tmp-IOCipher-v0.3-Meld.png" alt="The Java .class files are exactly the same, but the native .so files are not." width="873" height="591" class="size-full wp-image-13104" srcset="https://guardianproject.info/wp-content/uploads/2015/09/Screenshot-.-IOCipher-v0.3-_tmp-IOCipher-v0.3-Meld.png 873w, https://guardianproject.info/wp-content/uploads/2015/09/Screenshot-.-IOCipher-v0.3-_tmp-IOCipher-v0.3-Meld-300x203.png 300w" sizes="(max-width: 873px) 100vw, 873px" /></a> <p id="caption-attachment-13104" class="wp-caption-text"> The Java .class files are exactly the same, but the native .so files are not. </p> </div> <p><a href="https://guardianproject.info/wp-content/uploads/2015/09/1024px-End_CEST.svg_.png"><img src="https://guardianproject.info/wp-content/uploads/2015/09/1024px-End_CEST.svg_-150x150.png" alt="faketime" width="150" height="150" class="alignright size-thumbnail wp-image-13098" srcset="https://guardianproject.info/wp-content/uploads/2015/09/1024px-End_CEST.svg_-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2015/09/1024px-End_CEST.svg_-300x300.png 300w, https://guardianproject.info/wp-content/uploads/2015/09/1024px-End_CEST.svg_-200x200.png 200w, https://guardianproject.info/wp-content/uploads/2015/09/1024px-End_CEST.svg_.png 1024w" sizes="(max-width: 150px) 100vw, 150px" /></a></p> <p>Timestamps are a very common issue when trying to reproduce a build. The release build process uses <a href="https://github.com/wolfcw/libfaketime" target="_blank"><code>faketime</code></a> to provide consistent timestamps, which are picked from the git commit. <code>faketime</code> freezes the clock entirely for native builds, so any timestamps from that process will always be exactly the same. Unfortunately, some parts of the <code>ant</code> Java build rely on the clock moving forward, so freezing clock makes the build freeze forever. Instead, <code>faketime</code> sets the clock using the time from the git commit, then moves time forward at 5% of the normal speed. That makes it much more likely that the timestamps will be the same, but usually what seems to happen is that the timestamps are 2 seconds off, which is the time resolution of the ZIP format. A better solution is needed here for JARs, they are easiest to verify using a sha256 sum. JAR signatures mostly seem not worth the pain they introduce. APKs signatures do not sign the whole APK, only the contents, so the varying timestamps do not matter when verifying using a APK signature. Another example of a difference: if comparing a debug build to a release build, then <code>BuildConfig.class</code> will be difference because of the debug stuff. The sort order of the metadata in the jar MANIFEST.MF might also be different.</p> <h3 id="the-end-goal">The end goal</h3> <p>Reproducing builds is an arcane process, for sure. It is a means to an end. The goal is to get to the point where well known binaries, published in places like MavenCentral or jCenter, can easily be verified by anyone who cares to try. Or people could even set up <a href="https://f-droid.org/wiki/page/Verification_Server" target="_blank">servers that automatically try</a> to reproduce any JAR used in a project.</p> <p>Then people can verify those JARs in a fully decentralized manner, and publish certifications in their preferred format (GPG signatures, SHA256 sums for gradle-witness, etc). Then we can feel safe getting the release from anywhere on the internet, no matter the level of security or malware infestation.</p> <p>Towards that goal, we have been getting our libraries all nicely packaged up and submitted to jCenter (the default gradle repository for Android). Here are the relevant bits to include in your build.gradle:</p> <pre>compile 'info.guardianproject.cacheword:cachewordlib:0.1' compile 'info.guardianproject.iocipher:IOCipher:0.3' compile 'info.guardianproject.netcipher:netcipher:1.2' compile 'info.guardianproject.trustedintents:trustedintents:0.0' compile 'net.freehaven.tor.control:jtorctl:0.2' </pre> <p>SQLCipher-for-Android is coming soon:<br /> <a href="https://github.com/sqlcipher/android-database-sqlcipher/pull/197" target="_blank"><a href="https://github.com/sqlcipher/android-database-sqlcipher/pull/197">https://github.com/sqlcipher/android-database-sqlcipher/pull/197</a></a><br /> I hope to also get them up on MavenCentral as well, since that one is also quite common on Android, and is a community run resource versus Bintray’s jCenter, which is purely a for-profit company.</p> https://guardianproject.info/archive/camerav/ Tue, 28 Jul 2015 03:07:37 -0400 https://guardianproject.info/archive/camerav/ <p>THIS PROJECT IS NO LONGER ACTIVE - Please visit [ProofMode.org][<a href="https://proofmode.org">https://proofmode.org</a>] for our latest work in verifiable media capture.</p> <p>CameraV is the easiest way to capture and share verifiable photos and video proof on a smartphone or tablet, all the while keeping it entirely secure and private. <em>This is the official app from the <a href="https://blog.witness.org/2013/01/how-informacam-improves-verification-of-mobile-media-files/">InformaCam</a> project, a partnership between the Guardian Project and <a href="https://witness.org">WITNESS</a>.</em></p> <p>CameraV is easy to learn and simple to use (and insanely secure &amp; powerful under the covers&hellip;). All photos and videos you take are password-protected and 100% encrypted on your device. You can also add private notes and tags to any photo or video, and choose who you share them with. CameraV also privately stores data from your device sensors and provides built-in tools to see and share it. Finally, it has a built-in secure camera that is simple, streamlined and even supports selfies.</p> <ul> <li>READ THE USER GUIDE: <a href="https://guardianproject.github.io/informacam-guide/en/InformacamGuide.html">https://guardianproject.github.io/informacam-guide/en/InformacamGuide.html</a></li> </ul> <p>CameraV is based on the InformaCam platform, and was developed for use by activists, journalists, advocates and others, working in very difficult and high-risk situations, to capture and gather visual evidence and proof of abuse and rights violations. It can also be used in your daily life to capture any moment, and keep them safe and private. You can also use it for documenting your own evidence, after accidents, for real estate needs, or any where you need &ldquo;proof&rdquo;.</p> <ul> <li>OPEN-SOURCE AND FREE: <a href="https://github.com/guardianproject/camerav">https://github.com/guardianproject/camerav</a><br /></li> <li>JOIN THE COMMUNITY: <a href="https://www.google.com/url?q=https://www.google.com/url?q%3Dhttps://talk.developersquare.net/c/developers-corner/smart-cameras%26sa%3DD%26usg%3DAFQjCNFW0w07DleKn7DRLuRNjZltQI2psA&sa=D&usg=AFQjCNFwa9nMjOqpGMyPqs2uzG1BoY8Qhw" target="_blank"><a href="https://talk.developersquare.net/c/developers-corner/smart-cameras">https://talk.developersquare.net/c/developers-corner/smart-cameras</a></a></li> </ul> <hr /> <div id="watch-uploader-info"> <p> <em>"Citizen-generated data around conflict continues to grow exponentially, but when it gets to newsrooms, human rights orgs, and courts of law, it is often impossible to verify. InformaCam provides a tool to address this shortcoming. Harlo demonstrates its power."</em> </p> <p> <strong>Harlo Holmes, Research Fellow and Metadata Head, The Guardian Project</strong> </p> </div> <div id="watch-description-text" class=""> </div> <p>&nbsp;</p> <hr /> <p>&nbsp;</p> <p><em>The CameraV and InformaCam projects are generously supported by:</em></p> <p>&nbsp;</p> <p><a href="https://witness.org"><img class="alignnone size-full wp-image-722" src="https://guardianproject.info/wp-content/uploads/2010/02/witness-logo.gif" alt="witness-logo" width="172" height="87" /></a>  <a href="http://benetech.org/"><img class="width:100px; alignnone wp-image-13051 " src="https://guardianproject.info/wp-content/uploads/2015/07/Benetechr_logo_400_px_fair_use-300x136.jpg" alt="Print" width="194" height="88" srcset="https://guardianproject.info/wp-content/uploads/2015/07/Benetechr_logo_400_px_fair_use-300x136.jpg 300w, https://guardianproject.info/wp-content/uploads/2015/07/Benetechr_logo_400_px_fair_use.jpg 400w" sizes="(max-width: 194px) 100vw, 194px" /></a></p> <p>&nbsp;</p> <p><img class="alignnone size-full wp-image-3267" src="https://guardianproject.info/wp-content/uploads/2012/03/knight-logo-300.jpg" alt="knight-logo-300" width="300" height="50" /> <a href="https://www.macfound.org/"><img class="alignnone wp-image-13055" src="https://guardianproject.info/wp-content/uploads/2015/07/mcarthur-foundation-300x106.png" alt="mcarthur-foundation" width="164" height="58" srcset="https://guardianproject.info/wp-content/uploads/2015/07/mcarthur-foundation-300x106.png 300w, https://guardianproject.info/wp-content/uploads/2015/07/mcarthur-foundation.png 500w" sizes="(max-width: 164px) 100vw, 164px" /></a></p> <p>&nbsp;</p> https://guardianproject.info/archive/camerav/ Tue, 28 Jul 2015 03:07:37 -0400 https://guardianproject.info/archive/camerav/ <p>THIS PROJECT IS NO LONGER ACTIVE - Please visit [ProofMode.org][<a href="https://proofmode.org">https://proofmode.org</a>] for our latest work in verifiable media capture.</p> <p>CameraV is the easiest way to capture and share verifiable photos and video proof on a smartphone or tablet, all the while keeping it entirely secure and private. <em>This is the official app from the <a href="https://blog.witness.org/2013/01/how-informacam-improves-verification-of-mobile-media-files/">InformaCam</a> project, a partnership between the Guardian Project and <a href="https://witness.org">WITNESS</a>.</em></p> <p>CameraV is easy to learn and simple to use (and insanely secure &amp; powerful under the covers&hellip;). All photos and videos you take are password-protected and 100% encrypted on your device. You can also add private notes and tags to any photo or video, and choose who you share them with. CameraV also privately stores data from your device sensors and provides built-in tools to see and share it. Finally, it has a built-in secure camera that is simple, streamlined and even supports selfies.</p> <ul> <li>READ THE USER GUIDE: <a href="https://guardianproject.github.io/informacam-guide/en/InformacamGuide.html">https://guardianproject.github.io/informacam-guide/en/InformacamGuide.html</a></li> </ul> <p>CameraV is based on the InformaCam platform, and was developed for use by activists, journalists, advocates and others, working in very difficult and high-risk situations, to capture and gather visual evidence and proof of abuse and rights violations. It can also be used in your daily life to capture any moment, and keep them safe and private. You can also use it for documenting your own evidence, after accidents, for real estate needs, or any where you need &ldquo;proof&rdquo;.</p> <ul> <li>OPEN-SOURCE AND FREE: <a href="https://github.com/guardianproject/camerav">https://github.com/guardianproject/camerav</a><br /></li> <li>JOIN THE COMMUNITY: <a href="https://www.google.com/url?q=https://www.google.com/url?q%3Dhttps://talk.developersquare.net/c/developers-corner/smart-cameras%26sa%3DD%26usg%3DAFQjCNFW0w07DleKn7DRLuRNjZltQI2psA&sa=D&usg=AFQjCNFwa9nMjOqpGMyPqs2uzG1BoY8Qhw" target="_blank"><a href="https://talk.developersquare.net/c/developers-corner/smart-cameras">https://talk.developersquare.net/c/developers-corner/smart-cameras</a></a></li> </ul> <hr /> <div id="watch-uploader-info"> <p> <em>"Citizen-generated data around conflict continues to grow exponentially, but when it gets to newsrooms, human rights orgs, and courts of law, it is often impossible to verify. InformaCam provides a tool to address this shortcoming. Harlo demonstrates its power."</em> </p> <p> <strong>Harlo Holmes, Research Fellow and Metadata Head, The Guardian Project</strong> </p> </div> <div id="watch-description-text" class=""> </div> <p>&nbsp;</p> <hr /> <p>&nbsp;</p> <p><em>The CameraV and InformaCam projects are generously supported by:</em></p> <p>&nbsp;</p> <p><a href="https://witness.org"><img class="alignnone size-full wp-image-722" src="https://guardianproject.info/wp-content/uploads/2010/02/witness-logo.gif" alt="witness-logo" width="172" height="87" /></a>  <a href="http://benetech.org/"><img class="width:100px; alignnone wp-image-13051 " src="https://guardianproject.info/wp-content/uploads/2015/07/Benetechr_logo_400_px_fair_use-300x136.jpg" alt="Print" width="194" height="88" srcset="https://guardianproject.info/wp-content/uploads/2015/07/Benetechr_logo_400_px_fair_use-300x136.jpg 300w, https://guardianproject.info/wp-content/uploads/2015/07/Benetechr_logo_400_px_fair_use.jpg 400w" sizes="(max-width: 194px) 100vw, 194px" /></a></p> <p>&nbsp;</p> <p><img class="alignnone size-full wp-image-3267" src="https://guardianproject.info/wp-content/uploads/2012/03/knight-logo-300.jpg" alt="knight-logo-300" width="300" height="50" /> <a href="https://www.macfound.org/"><img class="alignnone wp-image-13055" src="https://guardianproject.info/wp-content/uploads/2015/07/mcarthur-foundation-300x106.png" alt="mcarthur-foundation" width="164" height="58" srcset="https://guardianproject.info/wp-content/uploads/2015/07/mcarthur-foundation-300x106.png 300w, https://guardianproject.info/wp-content/uploads/2015/07/mcarthur-foundation.png 500w" sizes="(max-width: 164px) 100vw, 164px" /></a></p> <p>&nbsp;</p> https://guardianproject.info/2015/06/30/orfox-aspiring-to-bring-tor-browser-to-android/ Tue, 30 Jun 2015 15:32:16 -0400 https://guardianproject.info/2015/06/30/orfox-aspiring-to-bring-tor-browser-to-android/ <p><strong>Update 24 September, 2015: Orfox BETA is now on Google Play: <a href="https://play.google.com/store/apps/details?id=info.guardianproject.orfox">https://play.google.com/store/apps/details?id=info.guardianproject.orfox</a></strong></p> <hr /> <p> </p> <p>In the summer of 2014 (<a href="https://lists.mayfirst.org/pipermail/guardian-dev/2014-August/003717.html">https://lists.mayfirst.org/pipermail/guardian-dev/2014-August/003717.html</a>{.external}), we announced that the results of work by Amogh Pradeep (<a href="https://github.com/amoghbl1">https://github.com/amoghbl1</a>{.external}), our 2014 Google Summer of Code student, has proven we could build Firefox for Android with some of the settings and configurations from the Tor Browser desktop software. We called this app Orfox, in homage to Orbot and our current Orweb browser. This was a good first step, but we were doing the build on Mozilla’s Firefox code repository, and then retrofitting pieces from Tor Browser’s code, which wasn’t the right way to do things, honestly.</p> <p>This summer (2015!), with fantastic continued effort by Amogh, we have switched to building the Orfox mobile app directly from the Tor Browser code repository, successfully working through any mobile OS incompatibilities in the security hardening patches added by the Tor Browser team. We also had the additional task of reviewing the Android application code in Firefox, that is not part of Tor Browser, in order to modify and patch it to work inline with the <a href="https://www.torproject.org/projects/torbrowser/design/">Tor Browser requirements and design document</a>.</p> <p>As of today, we have a stable alpha release ready for testing, and are rapidly moving towards a public beta in a few weeks. Our plan is to actively encourage users to move from Orweb to Orfox, and stop active development of Orweb, even removing to from the Google Play Store. If users really want to continue using a WebView-based solution and do not need all of the capabilities that Orfox/Tor Browser provides, they can use Lightning Browser (<a href="https://github.com/anthonycr/Lightning-Browser">https://github.com/anthonycr/Lightning-Browser</a>{.external}), a lightweight, open-source app that offers automatic Orbot (SOCKS) proxying on start-up.</p> <p>Below you will find screenshots and our current set of <a href="https://dev.guardianproject.info/projects/orfox-private-browser/wiki/Orfox_vs_Tor_Browser_FAQ">Orfox Frequently Asked Questions</a> from the <a href="https://dev.guardianproject.info/projects/orfox-private-browser/wiki">project wiki</a>.</p> <p>You can access the current Orfox release by installing the <a href="https://f-droid.org/">F-Droid app</a> and subscribing to our F-Droid Alpha Channel at by clicking on the following link on your phone: <a href="https://dev.guardianproject.info/debug/info.guardianproject.orfox/fdroid/repo">https://dev.guardianproject.info/debug/info.guardianproject.orfox/fdroid/repo<br /> </a></p> <p> </p> <div id='gallery-11' class='gallery galleryid-12999 gallery-columns-3 gallery-size-medium'> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152-169x300.png" class="attachment-medium size-medium" alt="" aria-describedby="gallery-11-13003" srcset="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133152.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-11-13003'> Recognized as Tor Browser </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133103.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133103-169x300.png" class="attachment-medium size-medium" alt="" aria-describedby="gallery-11-13005" srcset="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133103-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133103-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133103.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-11-13005'> A match made by onions! </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133624.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133624-169x300.png" class="attachment-medium size-medium" alt="" aria-describedby="gallery-11-13000" srcset="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133624-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133624-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133624.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-11-13000'> Bookmark support! </dd> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414-169x300.png" class="attachment-medium size-medium" alt="" aria-describedby="gallery-11-13001" srcset="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133414.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-11-13001'> Easy access to onion sites! </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133223.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133223-169x300.png" class="attachment-medium size-medium" alt="" aria-describedby="gallery-11-13002" srcset="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133223-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133223-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133223.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-11-13002'> Tabs! </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130.png'><img width="169" height="300" src="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130-169x300.png" class="attachment-medium size-medium" alt="" aria-describedby="gallery-11-13004" srcset="https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/06/device-2015-06-30-133130.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-11-13004'> Tor-relevant default sites </dd> </dl> <br style="clear: both" /> </div> <p><strong>Where can I find all the relevant Orfox project pieces?</strong></p> <ul> <li>The Orfox project tracker roadmap is here: <a href="https://dev.guardianproject.info/projects/orfox-private-browser/roadmap">https://dev.guardianproject.info/projects/orfox-private-browser/roadmap</a>{.external}</li> <li>The Orfox branch of the Tor Browser repository is here: <a href="https://github.com/guardianproject/tor-browser">https://github.com/guardianproject/tor-browser</a>{.external}</li> <li>The Orfox build project is here: <a href="https://github.com/guardianproject/orfoxfennec">https://github.com/guardianproject/orfoxfennec</a>{.external}</li> <li>The primary Tor Browser repository is here: <a href="https://gitweb.torproject.org/tor-browser.git/">https://gitweb.torproject.org/tor-browser.git/</a>{.external}</li> <li>Automated debug builds of Orfox alpha are available via F-Droid here (install F-Droid on your phone, then copy/paste or open the link to add the repo): <a href="https://dev.guardianproject.info/debug/info.guardianproject.orfox/fdroid/repo">https://dev.guardianproject.info/debug/info.guardianproject.orfox/fdroid/repo</a>{.external}</li> </ul> <p><strong>How is Orfox different than Tor Browser for desktop?</strong></p> <p>Orfox is built from the same source code as Tor Browser (which is built upon Firefox), but with a few minor modifications to the privacy enhancing features to make them compatible with Firefox for Android and the Android operating system. In as many ways as possible, we will adhere to the design goals of Tor Browser (<a href="https://www.torproject.org/projects/torbrowser/design/">https://www.torproject.org/projects/torbrowser/design/</a>{.external}), by supporting as much of their actual code as possible, and extending their work into the additional AF-Droid appndroid components of Firefox for Android.</p> <ul> <li><p>The Orfox code repository is at <a href="https://github.com/guardianproject/tor-browser">https://github.com/guardianproject/tor-browser</a>{.external} and the Tor Browser repository is here:<a href="https://gitweb.torproject.org/tor-browser.git/">https://gitweb.torproject.org/tor-browser.git/</a>{.external}. The Orfox repository is a fork of the Tor Browser repository with the necessary modification and Android-specific code as patches on top of the Tor Browser work. We will keep our repository in sync with updates and release of Tor Browser.</p></li> <li><p>Orfox is built from the Tor Browser repo based on ESR38 (<a href="https://dev.guardianproject.info/issues/5146">https://dev.guardianproject.info/issues/5146</a>{.external}<a href="https://dev.guardianproject.info/news/221">https://dev.guardianproject.info/news/221</a>{.external}) and has only two modified patches that were not relevant or necessary for Android</p></li> <li><p>Orfox does not currently include the mobile versions of HTTPS Everywhere, No Script and the Tor Browser Button, but these we will be added shortly, now that we have discovered how to properly support automatic installation of extensions on Android (<a href="https://dev.guardianproject.info/issues/5360">https://dev.guardianproject.info/issues/5360</a>{.external})</p></li> <li><p>Orfox includes a “Request Mobile Site” option that allows you to change the user-agent from the standard Tor Browser agent to a modified Android specific one: “Mozilla/5.0 (Android; Mobile; rv:31.0) Gecko/20100101 Firefox/31.0”. (<a href="https://dev.guardianproject.info/issues/5404">https://dev.guardianproject.info/issues/5404</a>{.external}). This is useful for being able to see the mobile version of a website, but does reduce the amount your browser blends in with other browsers.</p></li> <li><p>Orfox currently allows for users to bookmark sites, and may have additional data written to disk beyond what the core gecko browser component does. We are still auditing all disk write code, and determining how to appropriately disable or harden it. (<a href="https://dev.guardianproject.info/issues/5437">https://dev.guardianproject.info/issues/5437</a>{.external})</p></li> <li><p>Orfox cannot yet be built deterministically, but based on work with the FDroid project, we are aiming for this to be possible in the next year (<a href="https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise">https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise</a>{.external} <a href="https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds">https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds</a>{.external})</p></li> </ul> <p><strong>How is Orfox different than Firefox for Android?</strong></p> <p>Beyond the core Tor Browser components, Orfox also must ensure all Android-specific code is properly routed through the Tor proxy, and otherwise hardened to protect against data and privacy leaks.</p> <ul> <li><p>Orfox adds patches at the Android Java code layer to enable proxying of all Java network HTTP communications through the local Orbot HTTP proxy (HTTP localhost:8118 for now, but moving to SOCKS). (<a href="https://dev.guardianproject.info/issues/5235">https://dev.guardianproject.info/issues/5235</a>{.external} <a href="https://dev.guardianproject.info/issues/5317">https://dev.guardianproject.info/issues/5317</a>{.external})</p></li> <li><p>Orfox removes the Android permissions for Contacts, Camera, Microphone, Location and NFC (<a href="https://dev.guardianproject.info/issues/3822">https://dev.guardianproject.info/issues/3822</a>{.external}) since the capability of using these features are not in line with the spirit of Tor Browser</p></li> <li><p>Orfox removes features like WebRTC and support for interaction with Chromecasts or Roku devices, since this type of communication is not compatibility with proxying communication through a TCP-based network like Tor (<a href="https://dev.guardianproject.info/issues/5358">https://dev.guardianproject.info/issues/5358</a>{.external} <a href="https://dev.guardianproject.info/issues/5357">https://dev.guardianproject.info/issues/5357</a>{.external})</p></li> </ul> <p><strong>How is Orfox different than Orweb?</strong></p> <ul> <li><p>Orweb is our current default browser for Orbot/Tor mobile users (<a href="https://guardianproject.info/apps/orweb">https://guardianproject.info/apps/orweb</a>{.external}) that has been downloaded over 2 million times. It is VERY VERY SIMPLE, as it only has one tab, no bookmark capability, and an extremely minimal user experience.</p></li> <li><p>Orweb is built upon the bundled WebView (Webkit) browser component inside of the Android operating system. This has proven to be problematic because we cannot control the version of that component, and cannot upgrade it directly when bugs are found. In addition, Google has made it very difficult to effectively control the network proxy settings of all aspects of this component, making it difficult to guarantee that traffic will not leak on all devices and OS versions.</p></li> <li><p>Orweb also only provides a very limited amount of capability of Tor Browser, primarily related to reducing browser fingerprinting, minimizing disk writes, and cookie and history management. It trys to mimic some of the settings of Tor Browser, but doesn’t actually use any of the actual code written for Tor Browser security hardening.</p></li> <li><p>Orweb does have an advantage which is that it less than 2MB while Orfox is in the 25-30MB range. This is primarily because Orweb relies on many components built into Android, so it does not need to bundle them. Orfox contains the full stack of code necessary for a complete browser, and thus is more secure and dependable, but also larger. The Mozilla Mobile team is working on reducing the size of their binaries, and the Orfox team is focused on this, as well, since we are disabling some of the components that have contributed the browser bloat.</p></li> </ul> https://guardianproject.info/code/panickit/ Thu, 11 Jun 2015 00:00:00 +0000 https://guardianproject.info/code/panickit/ <p><img src="https://guardianproject.info/wp-content/uploads/2016/01/round-button-hazard-150x150.png" alt="round hazard button" width="150" height="150" class="alignright size-thumbnail wp-image-13221" srcset="https://guardianproject.info/wp-content/uploads/2016/01/round-button-hazard-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2016/01/round-button-hazard-300x300.png 300w, https://guardianproject.info/wp-content/uploads/2016/01/round-button-hazard-200x200.png 200w, https://guardianproject.info/wp-content/uploads/2016/01/round-button-hazard.png 512w" sizes="(max-width: 150px) 100vw, 150px" /></p> <div class="source-code" style="text-align: center;"> <a href="https://gitlab.com/guardianproject/PanicKit" target="_blank" title="PanicKit on Gitlab"> <i class="fa fa-gitlab"></i> GitLab </a> - <a href="https://github.com/guardianproject/PanicKit" target="_blank" title="PanicKit on Github"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.github.io/PanicKit" target="_blank" title="PanicKit javadoc"> Javadoc </a> - <a href="https://guardianproject.info/tags/panickit" target="_blank" title="PanicKit blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /> <p>PanicKit is a collection of tools for creating &ldquo;panic buttons&rdquo; that can trigger a system-wide response when the user is in an anxious or dangerous situation. It enables trigger apps and responder apps to safely and easily connect to each other. The user engages with the trigger app when in a panic situation. The responder apps receive that trigger signal, and individually execute the steps that they were configured to do. The connections between trigger and responder can be strictly enforced based on <em>Application ID</em> and APK signing certificate. There are two general categories of response:</p> <ul> <li>default, non-destructive</li> <li>opt-in, destructive</li> </ul> <h2 id="screenshots">Screenshots</h2> <link rel="stylesheet" href="https://guardianproject.info/css/jquery.fancybox-3.4.0.min.css" /> <script src="https://guardianproject.info/js/jquery-3.3.1.min.js"></script> <script src="https://guardianproject.info/js/jquery.fancybox.min.js"></script> <div class="gallery"> <a data-fancybox="gallery" href="https://guardianproject.info/code/panickit/01.3.png"> <img src="https://guardianproject.info/code/panickit/01.3.png"> <br/> </a> <a data-fancybox="gallery" href="https://guardianproject.info/code/panickit/02.0.png"> <img src="https://guardianproject.info/code/panickit/02.0.png"> <br/> </a> <a data-fancybox="gallery" href="https://guardianproject.info/code/panickit/screenshot_fdroid_destructive0.png"> <img src="https://guardianproject.info/code/panickit/screenshot_fdroid_destructive0.png"> <br/> </a> <a data-fancybox="gallery" href="https://guardianproject.info/code/panickit/screenshot_fdroid_destructive1.png.png"> <img src="https://guardianproject.info/code/panickit/screenshot_fdroid_destructive1.png.png"> <br/> </a> <a data-fancybox="gallery" href="https://guardianproject.info/code/panickit/screenshot_ripple.png"> <img src="https://guardianproject.info/code/panickit/screenshot_ripple.png"> <br/> </a> </div> <h1 id="building-apps-with-panic-support">Building apps with panic support</h1> <h3 id="examples">Examples</h3> <ul> <li><a href="https://projects.invisionapp.com/share/W73E3D6VE#/screens">PanicButton PanicKit/Zom integration sketch</a></li> <li><a href="https://github.com/guardianproject/FakePanicButton">FakePanicButton</a></li> <li><a href="https://github.com/guardianproject/FakePanicResponder">FakePanicResponder</a></li> </ul> <h3 id="real-world-apps">Real world apps</h3> <ul> <li><a href="https://github.com/guardianproject/ripple">Ripple trigger app</a></li> <li><a href="https://gitlab.com/fdroid/fdroidclient/merge_requests/629">F-Droid&rsquo;s app hiding</a></li> <li><a href="https://github.com/SMSSecure/SMSSecure/blob/8b2d61161716dcae33c7ae2fd9540931b632030a/src/org/smssecure/smssecure/PanicResponderActivity.java" target="_blank">SMSSecure lock as default response</a></li> <li><a href="https://github.com/theScrabi/NewPipe/pull/133" target="_blank">NewPipe clear search history as default response</a></li> <li><a href="https://github.com/zom/Zom-Android/blob/master/app/src/main/java/org/awesomeapp/messenger/ui/PanicSetupActivity.java" target="_blank">Zom with multiple destructive responses and a default lock response</a></li> </ul> <h2 id="downloads">Downloads</h2> <div class="gradle-line"> <p> The binary jar, source jar, and javadoc jar are all available on jcenter. To include them using gradle, add this line to your <i>build.gradle</i>: </p> <pre style="text-align: center;">implementation &#39;info.guardianproject.panic:panic:1.0&#39;</pre> <p>Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:</p> <ul> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/panic/panic/1.0/panic-1.0.jar">panic-1.0.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/panic/panic/1.0/panic-1.0.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/panic/panic/1.0/panic-1.0-sources.jar">panic-1.0-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/panic/panic/1.0/panic-1.0-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/panic/panic/1.0/panic-1.0-javadoc.jar">panic-1.0-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/panic/panic/1.0/panic-1.0-javadoc.jar.asc"><i>PGP signature</i></a>)</li> </ul> </div> <h1 id="core-concepts">Core Concepts</h1> <ul> <li>non-destructive vs destructive responses</li> <li>responders should have a default response</li> <li>default responses should be non-destructive</li> <li>users send the panic with a trigger app</li> <li>responder apps receive the trigger message and do something in response</li> <li>the user must opt in to destructive responses via &ldquo;connecting&rdquo; a trigger and response app</li> <li>the trigger method can include things like a text message, email addresses, phone numbers, etc. which a panic responder app can use to send the message.</li> <li>responder apps should do something without any configuration, but that default response can be limited to trusted trigger apps</li> <li>the trigger app can ignore any given responder</li> <li>a responder app can ignore all triggers</li> </ul> <p>Since this is an Android-specific framework, it builds upon core ideas to Android OS, like <em>Intent</em>, <em>Activity</em>, and <em>Service</em>. The panic trigger message is an <em>Intent</em> that can be received by <em>Activitys</em> or <em>Services</em>. The <em>Service</em> must be an <em>IntentService</em> or started with <code>startService(Intent)</code> in order to receive the panic trigger <em>Intent</em>.</p> <h2 id="implementing-a-panic-ux">Implementing a panic UX</h2> <p>These are all of the core behaviors that are required by a good PanicKit user experience:</p> <ul> <li>every panic responder must accept <em>ACTION_TRIGGER</em> <em>Intents</em> as the trigger</li> <li>each app has only one <em>Activity</em> that receives <em>ACTION_TRIGGER</em></li> <li>each app has only one <em>Activity</em> that receives <em>ACTION_CONNECT</em></li> <li>each app has only one <em>Activity</em> that receives <em>ACTION_DISCONNECT</em></li> <li>the trigger app sends <em>ACTION_CONNECT</em>, <em>ACTION_DISCONNECT</em>, and <em>ACTION_TRIGGER</em> to the responder</li> <li>the responder app sends <em>ACTION_CONNECT</em> and <em>ACTION_DISCONNECT</em> to the trigger</li> <li>only the user can trigger <em>ACTION_CONNECT</em> to be sent, they should <strong>never</strong> be automated</li> <li>the <em>Activity</em> that accepts <em>ACTION_CONNECT</em> will TOFU-trust the app that sent the <em>Intent</em> after the user opts in</li> <li>the <em>Activity</em> that sends <em>ACTION_CONNECT</em> will TOFU-trust the receiver, if it replies with <em>Activity.RESULT_OK</em></li> <li><em>ACTION_TRIGGER</em> will only trigger destructive responses after it has been verified that they came from a trusted sender (either pinned or TOFUed)</li> <li>either trigger or responder can send <em>ACTION_DISCONNECT</em> at any time</li> <li>receiving <em>ACTION_DISCONNECT</em> does not result in user interaction, the disconnect is immediate</li> <li>a trigger app can send <em>ACTION_TRIGGER</em> to zero or more apps</li> <li>a responder app can receive <em>ACTION_TRIGGER</em> from a single app</li> <li>one user panic button press can send multiple trigger events</li> </ul> <h3 id="configuration">Configuration</h3> <ul> <li>the config screen has two final actions: 1) cancel changes 2) confirm changes</li> <li>when disconnected, clicking confirm creates the connection</li> <li>when disconnected, clicking cancel makes no connection</li> <li>when already connected, clicking confirm will change the settings and keep the connection</li> <li>when already connected, clicking cancel will discard changes to the settings but keep the connection</li> </ul> <h2 id="panickit-in-action">PanicKit in Action</h2> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe src="//www.youtube.com/embed/mS1gstS6YS8" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe> </div> <h1 id="trust-modes">Trust modes</h1> <p>It is possible to require strict checking of panic senders and receivers. For example, a panic trigger message might include a private message, the location, and a list of trusted contacts. This is sensitive information, so the trigger app should only send it to apps that the user has allowed to receive it. Also, many panic responses include destroying data or sending messages to trusted contacts. These actions must require the user to opt-in, granting a specific trigger app the privilege to trigger those sensitive responses.</p> <p>The enhanced trust relationship between trigger and responder can take two forms:</p> <h2 id="trust-on-first-use-tofu-app">Trust-On-First-Use (TOFU) App</h2> <p>A user goes into the settings of either a panic trigger or receiver, and configures which apps to connect to. In this process, the apps remember the other apps they are each connected to, and base their trusted sending on that initial connection.</p> <h2 id="pinned-trusted-app">Pinned Trusted App</h2> <p>Using trusted pinning methods like APK signing key, a panic trigger and panic receiver can automatically configure themselves to connect to all installed apps that are signed by a given key. This gives a panic setup with zero configuration. For example, <em>Courier Reader</em> could automatically connect to <em>Amnesty Panic Button</em> based on signing key.</p> https://guardianproject.info/2015/06/02/building-a-trustworthy-app-store-that-respects-privacy/ Tue, 02 Jun 2015 16:38:03 -0400 https://guardianproject.info/2015/06/02/building-a-trustworthy-app-store-that-respects-privacy/ <p>One core piece of our approach is thinking about very high risk situations, like Ai Weiwei or Edward Snowden, then making the tools for operating under that pressure as easy to use as possible. That means that we might occasionally come across as a little paranoid. It is important to dive into the depths of what might be possible. That is an essential step in evaluating what the risks and defenses are, and how to prioritize them. Making usable software is not just making things easy, but rather making tools for real world situations that are a simple as possible.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2015/06/hrome-crash.png"><img src="https://guardianproject.info/wp-content/uploads/2015/06/hrome-crash.png" alt="chrome crash" width="150" height="150" class="alignright size-full wp-image-12966" /></a></p> <p>We recently received some vindication of our paranoia: we have been resistant to putting all of our trust into the Google Play app store, despite many obvious advantages. Even though Google Play is probably the most secure of the big app stores, its security approach is rather thin, <a href="https://jon.oberheide.org/blog/2010/06/28/a-peek-inside-the-gtalkservice-connection/" target="_blank">relying mainly on HTTPS with no signature for verification</a>, and the Five Eyes partnership (NSA, GCHQ, etc) noticed this, and <a href="https://firstlook.org/theintercept/2015/05/21/nsa-five-eyes-google-samsung-app-stores-spyware" target="_blank">worked to exploit it</a>.</p> <p>The Android/Google Play security model is relatively simple, and that is mostly a good thing. There are two essential pieces: the signature on the APK file itself and the TLS connection to Google that provides the APK file. Once an app is installed, all APK files used to update an app must have a matching signing key. That provides a reasonably strong mechanism to defend against malware that wants to install over existing apps.</p> <p>Unlike package systems like Debian, there is no path to verify that the APK signing key. That means Google Play relies heavily on the TLS transport encryption to protect the APK files for when installing an Android apps for the first time. The first time an app is installed, the signing key in that app’s APK file is blindly trusted (this is called “Trust On First Use” or TOFU). It turns out that TOFU has a solid track record for security in the real world. One key aspect of implementing a good TOFU system is to make the first use indistinguishable from any other use, so that it is difficult to target only first uses while ignoring repeat uses. Intercepting repeat uses is very likely to trigger a warning and alert the user that something is wrong.</p> <p>Now let’s put together the pieces based on what the Chinese government can do. A few TLS certificate authorities have been caught <a href="https://arstechnica.com//security/2010/03/govts-certificate-authorities-conspire-to-spy-on-ssl-users/" target="_blank">issuing </a><a href="https://arstechnica.com//security/2011/08/earlier-this-year-an-iranian/" target="_blank">fake</a> <a href="https://arstechnica.com//business/2012/02/critics-slam-ssl-authority-for-minting-cert-used-to-impersonate-sites/" target="_blank">certificates</a>. A company affiliated with CNNIC <a href="https://arstechnica.com/security/2015/04/google-chrome-will-banish-chinese-certificate-authority-for-breach-of-trust/" target="_blank">was caught issuing certificates for Google domains</a>. A trusted certificate authority can issue usable certificates for any domain, so any computer that trusts CNNIC would trust their fake certificates for Google. That lets the Chinese government transparently Man-in-the-Middle traffic to Google servers. China could then use the Great Firewall to generate targeted malware on the fly, seeing the user credentials that Google Play requires, seeing the list of apps that each user has installed, etc. Then when the targeted user goes to install a new app, the APK file is intercepted, malware is added, then it is re-signed and transparently sent off to the user.</p> <p>This targeted malware can be designed to avoid the malware scanners in Google Play, Lookout, etc. since it would be direct addition of code rather than via an exploit. It would be just adding Java classes to the APK. Or alternatively, in combination with some of the signing exploits that have been discovered in Android, like <a href="http://www.saurik.com/id/19" target="_blank">Master Key</a>, the Great Firewall is able to inject malware into the real APK itself without changing the signature.</p> <p>Of course, when Google Play’s TLS connection includes X.509 <a href="https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning" target="_blank">certificate pinning</a>, then the above attack would not be possible since the client would have a whitelist of certificate authorities that it trusts for play.google.com, and CNNIC would probably not be on that whitelist. This highlights the importance of pinning certificate authorities in apps that need good security over TLS or HTTPS. All TLS connections <a href="http://nelenkov.blogspot.com/2012/12/certificate-pinning-in-android-42.html" target="_blank">support pinning at the system level</a> starting in Android 4.2. We are crazy enough to support down to Android 2.3 since there are lots of older Android devices in use, and even <a href="https://arstechnica.com/gadgets/2014/12/android-2-3-gingerbread-four-years-later-the-os-just-wont-die/" target="_blank">new devices being sold with Android 2.3.3</a>. That means we think about making apps self-contained in terms of security improvements like pinning.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2015/06/sadballs.png"><img src="https://guardianproject.info/wp-content/uploads/2015/06/sadballs-150x300.png" alt="sad balls" width="150" height="300" class="alignright size-medium wp-image-12969" srcset="https://guardianproject.info/wp-content/uploads/2015/06/sadballs-150x300.png 150w, https://guardianproject.info/wp-content/uploads/2015/06/sadballs.png 400w" sizes="(max-width: 150px) 100vw, 150px" /></a></p> <p><strong>It gets worse</strong></p> <p>Many indigenous app stores like <a href="http://cafebazaar.ir" target="_blank">Cafe Bazaar</a> and Xiaomi’s <a href="http://app.mi.com" target="_blank">MiMarket</a> lack basic protections like TLS, making targeted attacks trivial for governments, or even anyone who gains control of a piece of the network path. These days that is actually easy to do by exploiting home routers, which are <a href="https://arstechnica.com/security/2015/05/researchers-uncover-self-sustaining-botnets-of-poorly-secured-routers/" target="_blank">generally</a> <a href="https://arstechnica.com/security/2015/04/no-patch-for-remote-code-execution-bug-in-d-link-and-trendnet-routers/" target="_blank">easy</a> to <a href="https://arstechnica.com/security/2015/05/the-moose-is-loose-linux-based-worm-turns-routers-into-social-network-bots/" target="_blank">exploit</a>. One of those botnets would easily start looking for app installs in the network traffic, then add exploits accordingly. As long as the first install is easy to detect and the user easy to track, then the malware can transparently inject malware designed to be difficult to detect by malware scanners and people alike.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2013/11/fdroidheader3.png"><img src="https://guardianproject.info/wp-content/uploads/2013/11/fdroidheader3.png" alt="fdroidheader3" width="720" height="180" class="alignnone size-full wp-image-11906" srcset="https://guardianproject.info/wp-content/uploads/2013/11/fdroidheader3.png 720w, https://guardianproject.info/wp-content/uploads/2013/11/fdroidheader3-300x75.png 300w" sizes="(max-width: 720px) 100vw, 720px" /></a><br /> <strong>The Alternative</strong></p> <p><a href="https://f-droid.org" target="_blank">FDroid</a> also has the key advantage of being designed from the beginning to avoid tracking users, and to use proven methods of delivering software, following the signed repository model of Debian, Ubuntu, etc. but then served over a solid HTTPS channel for increased privacy and a backup layer of security. It is also possible to use privacy proxies like Tor or I2P via the proxy settings. There is no user credentials needed, it is all free software, so FDroid users can even hide themselves from the server delivering the apps, as well as any network observers. Since all APKs are delivered via signed metadata that is verified using a key built into the FDroid client app, there is no risk of getting served malware even if the HTTPS connection is completely and transparently broken.</p> <p>As part of our <a href="https://dev.guardianproject.info/project/bazaar/wiki" target="_blank">Bazaar Project</a>, we have been putting more and more efforts into the FDroid project, and working to make it much easier to use. All Guardian Project apps are available in FDroid, as well as all the core apps that you might need like Firefox, a Twitter client, K-9 email, etc. Tech journalist <a href="https://medium.com/backchannel/why-i-m-saying-goodbye-to-apple-google-and-microsoft-78af12071bd" target="_blank">Dan Gillmor agrees</a>: free software that respects privacy is not only for the über-geek anymore.</p> https://guardianproject.info/2015/05/07/hiding-apps-in-plain-sight/ Thu, 07 May 2015 09:25:10 -0400 https://guardianproject.info/2015/05/07/hiding-apps-in-plain-sight/ <p>Beyond just thinking about encryption of data over the wire, or at rest on your mobile device, we also consider physical access to your mobile device, as one of the possible things we need to defend against. Some of our apps, such as Courier, our secure news reader, include a Panic feature, enabling a user to quickly delete data or remove the app, if they fear their device will be taken from them, whether by a friend, family member, criminal or an authority figure. Most recently, with our work on CameraV, our <a href="https://guardianproject.github.io/informacam-guide/en/InformacamGuide.html">secure evidence camera app</a>, we have implemented a few more features that help hide the app and its data, in order to block an unintended person from seeing the photos and videos captured by it.</p> <p>First, it should be said that the app utilizes <a href="https://guardianproject.info/code/iocipher">IOCipher</a>, <a href="https://github.com/guardianproject/cacheword">CacheWord</a> and the <a href="https://github.com/n8fr8/CameraCipher">CameraCipher Library</a> to store all media files it captures in an encrypted format, managed with a well-implemented service that handles key generation and life-cycle properly. This means that no photos and videos show in the device’s built-in gallery or photos app, and no pixels are ever written in plain-text to any storage space, internal or external. This helps a great deal in hiding that they exist, since often physical inspection of a device often starts with looking through any of the default apps, like messaging, gallery, contacts apps, and so on. <a href="https://guardianproject.info/apps/chatsecure/">ChatSecure</a> also does this, be keeping your contacts, messages and media out of the shared, unencrypted default location.</p> <p>As of this week, we have had three new features to CameraV that all fall under what could be called “Stealth Mode” (though this has also been called “Boss Mode” since the days of MS-DOS when games included a quick button to change to something that looked like a spreadsheet for when your boss walked by). We took our inspiration from a few other apps, like Amnesty International’s <a href="https://panicbutton.io/">Panic Button</a> which hides itself as a calculator, ChainFire’s <a href="https://play.google.com/store/apps/details?id=eu.chainfire.supersu&amp;hl=en">SuperSU</a>, which allows users to <a href="http://www.chainfire.eu/articles/133/_TUT_Supporting_multiple_icons_in_your_app/">switch the app icon</a> between a few options, <a href="https://guardianproject.info/apps/courier/">Courier</a>, which blocks users and other apps from taking screenshots of the news it is display, and <a href="https://guardianproject.info/apps/orbot">Orbot</a>, which actively removes itself from the “Recent Apps” listing provided by Android. All of these features combined dramatically reduce the visual footprint that an app leaves on the device, reducing the chance that someone will discover it, even if they are looking for it.</p> <div id="attachment_12938" style="width: 179px" class="wp-caption alignleft"> <a href="https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-14-24-36.png"><img aria-describedby="caption-attachment-12938" class="wp-image-12938 size-medium" src="https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-14-24-36-169x300.png" alt="CameraV settings for stealth mode" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-14-24-36-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-14-24-36-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-14-24-36.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> <p id="caption-attachment-12938" class="wp-caption-text"> CameraV settings for stealth mode </p> </div> <div id="attachment_12939" style="width: 179px" class="wp-caption alignleft"> <a href="https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-14-25-44.png"><img aria-describedby="caption-attachment-12939" class="wp-image-12939 size-medium" src="https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-14-25-44-169x300.png" alt="CameraV marinading as CV Settings" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-14-25-44-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-14-25-44-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-14-25-44.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> <p id="caption-attachment-12939" class="wp-caption-text"> CameraV masquerading as “CV Settings” </p> </div> <div id="attachment_12940" style="width: 179px" class="wp-caption alignleft"> <a href="https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-11-02-46.png"><img aria-describedby="caption-attachment-12940" class="wp-image-12940 size-medium" src="https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-11-02-46-169x300.png" alt="CameraV blocking screenshots in recent apps" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-11-02-46-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-11-02-46-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2015/05/Screenshot_2015-05-06-11-02-46.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></a> <p id="caption-attachment-12940" class="wp-caption-text"> CameraV blocking screenshots in recent apps </p> </div> <p><br style="clear:both;" /></p> <p>CameraV (you can get <a href="https://rink.hockeyapp.net/apps/dafbc649fcf585d7867866d5375b6495">beta access here</a> and find the <a href="https://github.com/guardianproject/InformaApp">source here</a>), incorporates all of these as options for the user to activate. You can switch the default icon and app name to a more generic settings icon and “CV Settings” app name. We plan to enhance that feature to allow the user to define the icon and name, making the app able to act like a chameleon and blend in more completely. The app can be set to now allow screenshots to be taken of it, which also causes a black screen to show up in the recent apps list, stopping a casual inspection from identifying it as a photos-type app. It can also be set to not show up in the recent apps list at all, which is a more complete solution to that problem. The last piece, again taken from the aforementioned PanicButton app, is to, when the stealth icon is activated, to change the default home screen of the app to something innocuous like a calculator, so that even when the app is opened, it does not reveal its true nature. It is even possible to completely hide the app in the launcher, until a system event like a phone call to a specific number or a certain wifi network is connected, to make the app reveal itself again.</p> <p>You can learn how to dynamically switch your app’s icon on the <a href="http://www.chainfire.eu/articles/133/_TUT_Supporting_multiple_icons_in_your_app/">Chainfire blog</a> and see the code in action on the <a href="https://github.com/guardianproject/InformaApp/commit/98d8c545c1901d03d9d238204bb45d502a623e59#diff-7ab4bf3d594a968a90e0250af33fcb9bR399">CameraV repo here</a>. To block screenshots of your app, you can set the <a href="https://github.com/guardianproject/InformaApp/commit/4c153ebd8d0a6e99660a9391e99c7dd6658a0efc#diff-f9e0f2937f7b2e3f755c53e7ec2e3909R64">FLAG_SECURE feature in any Activity</a>. To complete <a href="https://github.com/guardianproject/InformaApp/blob/master/app/AndroidManifest.xml#L87">stop your app from showing up in the recent app list</a>, just set <a href="https://github.com/guardianproject/InformaApp/blob/master/app/AndroidManifest.xml#L87">‘<span class="pl-e">android</span><span class="pl-e">:</span><span class="pl-e">excludeFromRecents</span>=</a><span class="pl-s"><a href="https://github.com/guardianproject/InformaApp/blob/master/app/AndroidManifest.xml#L87"><span class="pl-pds">“</span>true</a><span class="pl-pds"><a href="https://github.com/guardianproject/InformaApp/blob/master/app/AndroidManifest.xml#L87">“‘</a> in the Activity entry in the manifest. </span></span></p> <p>These are just some of the initial ideas and techniques we have gathered and implemented. We plan to provide this set of capabilities in all of the apps we offer, and hope to spread them as standard features that any app that contains sensitive data or is meant for use by people in high-risk situations, should offer. I would love to hear your thoughts on other techniques that could be used, see code snippets you might have to achieve those, or discuss how and when this whole concept may or may not be effective.</p> <p>For now, stay safe out there, and that goes for your data and apps, too!</p> <p>_<a href="https://commons.wikimedia.org/wiki/File:Tanzania_0607_cropped_Nevit.jpg#/media/File:Tanzania_0607_cropped_Nevit.jpg">“Tanzania 0607 cropped Nevit”</a> by Nevit Dilmen (talk) – Own work. Licensed under CC BY-SA 3.0 via Wikimedia Commons_</p> <p> </p> https://guardianproject.info/2015/04/30/getting-android-tools-into-debian/ Thu, 30 Apr 2015 11:13:26 -0400 https://guardianproject.info/2015/04/30/getting-android-tools-into-debian/ <p><a href="https://guardianproject.info/wp-content/uploads/2015/04/debian.jpg"><img src="https://guardianproject.info/wp-content/uploads/2015/04/debian-150x150.jpg" alt="debian" width="150" height="150" class="alignright size-thumbnail wp-image-12920" srcset="https://guardianproject.info/wp-content/uploads/2015/04/debian-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2015/04/debian-300x300.jpg 300w, https://guardianproject.info/wp-content/uploads/2015/04/debian-270x270.jpg 270w, https://guardianproject.info/wp-content/uploads/2015/04/debian-230x230.jpg 230w, https://guardianproject.info/wp-content/uploads/2015/04/debian.jpg 600w" sizes="(max-width: 150px) 100vw, 150px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2015/04/android.png"><img src="https://guardianproject.info/wp-content/uploads/2015/04/android-150x150.png" alt="android" width="150" height="150" class="alignright size-thumbnail wp-image-12919" srcset="https://guardianproject.info/wp-content/uploads/2015/04/android-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2015/04/android-270x270.png 270w, https://guardianproject.info/wp-content/uploads/2015/04/android-230x230.png 230w" sizes="(max-width: 150px) 100vw, 150px" /></a></p> <p>As part of Debian’s project in Google <a href="https://wiki.debian.org/SummerOfCode2015" target="_blank">Summer of Code</a>, I’ll be working with two students, Kai-Chung Yan and Komal Sukhani, and another mentor from the <a href="https://wiki.debian.org/Teams/JavaPackaging" target="_blank">Debian Java Team</a> team, <a href="https://&#x71;a&#x2e;d&#x65;b&#x69;a&#x6e;.&#x6f;r&#x67;/dev&#x65;l&#x6f;p&#x65;r&#x2e;p&#x68;p&#x3f;l&#x6f;gin=&#x61;p&#x6f;@&#x67;a&#x6d;b&#x61;r&#x75;.&#x64;e" target="_blank">Markus Koschany</a>. We are going to be working on getting the Android SDK and tools into Debian, as part of the Debian <a href="https://wiki.debian.org/AndroidTools" target="_blank">Android Tools</a> team, building upon the existing work already included from the Java and <a href="https://wiki.debian.org/Teams/AndroidTools" target="_blank">Android Tools</a> teams. This project is in conjunction with the Java team since there is overlap between Android and Java tools, like <code>gradle</code>, <code>maven</code>, etc. Since this work is in Debian, all of the Debian-derivatives will automatically inherit this work. That includes: Ubuntu, Mint, Elementary, and many more.</p> <p>The first question a lot of Android developers are probably asking is: why would we want to put the Android tools into Debian when there is already an official distribution from Google with it’s own update tools? It turns out there are many reasons, mostly centered around making things much easier to use, as well as addressing some key security concerns. For example:</p> <ul> <li>automatic trustworthy downloads, no need to verify hash sums or think about HTTPS</li> <li>eliminate need for insecure wrapper scripts, like <code>./gradlew</code></li> <li>easy install and update channel that all Debian users already know</li> <li>trivial install for specific tools, like <code>adb</code>, <code>fastboot</code>, etc.</li> <li>setting up a Debian/Ubuntu/etc box for Android development is easier when everything is included</li> </ul> <p><a href="https://guardianproject.info/wp-content/uploads/2015/02/320px-Trawling_Drawing.jpg"><img src="https://guardianproject.info/wp-content/uploads/2015/02/320px-Trawling_Drawing-150x150.jpg" alt="320px-Trawling_Drawing" width="150" height="150" class="alignright size-thumbnail wp-image-12873" srcset="https://guardianproject.info/wp-content/uploads/2015/02/320px-Trawling_Drawing-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2015/02/320px-Trawling_Drawing-230x230.jpg 230w" sizes="(max-width: 150px) 100vw, 150px" /></a></p> <p>The most glaring issue from my point of view is the security issues in <code>gradle</code>. It will happily download and execute code without any kind of verification whatsoever. It inherits this terrible practice from maven, which has been shown to be an <a href="http://blog.ontoillogical.com/blog/2014/07/28/how-to-take-over-any-java-developer/" target="_blank">easy path to exploit anyone using it</a>. This is especially concerning considering that developers are more and more <a href="https://guardianproject.info/2015/02/24/phishing-for-developers/" target="_blank">being directly targeted</a>. At least it is more common for <code>gradle</code> configs to use HTTPS, but it is still quite easy mess up a config and force users to use HTTP instead. Fragile configs are really bad for security. Even if <a href="https://github.com/WhisperSystems/gradle-witness" target="_blank">gradle-witness</a> is used to pin the hash for the jars used in the project, <code>gradle-wrapper</code> might still downloading insecure code an executing it immediately, giving attackers potential full user access to that machine. That is because <code>gradle-wrapper</code> will download versions of <code>gradle</code> that it needs, and <code>gradle-witness</code> can not be used to pin the hash of the <code>gradle</code> files. And the repositories that <code>gradle</code> uses only provide methods to protect against network-based attacks. If the server that holds the jars is exploited, the attacker can replace the jars and the sum files at the same time. There is <a href="https://github.com/gradle/gradle/pull/448" target="_blank">a pull request open for <code>gradle</code></a> to allow pinning of the <code>gradle</code> executables themselves, which will help this situation.</p> <p>On a different note, many people who are not developers at all want to use tools like <code>adb</code> and <code>fastboot</code> to access their Android device, or even root it. Having them in Debian means they are trivial for people to install, vastly easier than trying to figure out how to download and install the Android SDK. What lots of people end up doing instead is downloading random binaries from insecure internet forums and using those. For many devices, it is already possible to use only tools in Debian to root the device. As we get more of the Android tools packaged and updated in Debian, that will become the norm.</p> <p><strong>Updates when you need them, built upon a stable base</strong></p> <p>One common complaint about packages in Debian is that they are old and outdated. It is part of the core mission of Debian/stable to provide an operating system that changes as little as possible. That mission is contrary to what most developers need from their SDKs and sometimes even the development tools. But stability is also important for developers as well. For example, tools like <code>make</code>, used to build native code using the Android NDK (<code>ndk-build</code> is a <code>make</code> script) and even Android itself, has been around a long time and is used in so many projects. That is a tool that almost every developer wants to have very stable.</p> <p>For the packages that developers need to have completely up-to-date, like the Android SDK itself, there are many options for distribution. Ubuntu Personal Package Archives (PPA) have proven easy and useful for exactly this kind of thing, and Debian is working on adding support for PPAs. Official repositories for <a href="http://backports.debian.org/" target="_blank">backports</a> are another avenue for timely updates.</p> <p><strong>Help us figure this out</strong></p> <p>We want lots of feedback on how to do this right! A great example is how to best support the various versions of <code>gradle</code>. It seems to me that <code>gradle</code> is starting to stabilize, and it is no longer necessary to track very specific releases of <code>gradle</code>. For example, <code>gradle</code> v2.2.1 will work well with projects that were setup with just about any v2.x version. And projects still using 1.x, they mostly seem to work using v1.12. So if this is the case, then this fits into a common pattern with build tools in Debian:</p> <ul> <li>GNU Compiler Collection is packaged as <code>gcc4.8</code>, <code>gcc4.7</code>, etc.</li> <li>Apache Maven is packaged as <code>maven</code> and <code>maven2</code></li> <li>GNU automake is packaged as <code>automake1.14</code>, <code>automake1.13</code>, etc.</li> </ul> <p>I’m currently thinking that the best solution for gradle is like Maven, with the package called <code>gradle</code> (v2.3) being the most up-to-date in conjunction with specific packages to support older versions, like <code>gradle1</code> (v1.12). But maybe it makes sense to do something like gcc, with a gcc meta-package to install the currently best supported version, then all versions packaged with name that includes that version, i.e. a gradle meta-package with <code>gradle1</code>, <code>gradle2</code>, <code>gradle3</code>, etc.</p> <p>Other issues that we will have to grapple with include:</p> <ul> <li>how to package various NDK versions?</li> <li>How do we best work with the upstream Android team?</li> <li>is packaging Android Studio feasible?</li> </ul> <p>We also hope to provide an example that any other packaging systems can learn from and build upon. GNU/Linux distros like Arch and Fedora are the obvious ones, but also projects like Homebrew, MacPorts, and Cygwin could also use this work to include Android tools as packages in their system. Indeed, some of the work already included in Debian was derived from <a href="https://wiki.archlinux.org/index.php/Android#Android_SDK_core_components" target="_blank">some Arch packages</a>.</p> https://guardianproject.info/2015/02/24/phishing-for-developers/ Tue, 24 Feb 2015 04:41:29 -0400 https://guardianproject.info/2015/02/24/phishing-for-developers/ <p>I recently received a very interesting phishing email directed at developers with apps in Google Play. One open question is, how targeted it was: did anyone else get this?</p> <p><a href="https://en.wikipedia.org/wiki/File:Trawling_Drawing.jpg"><img src="https://guardianproject.info/wp-content/uploads/2015/02/320px-Trawling_Drawing.jpg" alt="320px-Trawling_Drawing" width="320" height="240" class="alignright size-full wp-image-12873" srcset="https://guardianproject.info/wp-content/uploads/2015/02/320px-Trawling_Drawing.jpg 320w, https://guardianproject.info/wp-content/uploads/2015/02/320px-Trawling_Drawing-300x225.jpg 300w" sizes="(max-width: 320px) 100vw, 320px" /></a><br /> It turns out that Google has been recently stepping up enforcement of certain terms, so it looks like some people are taking advantage of that. It is a pretty sophisticated or manually targeted phishing email since they got the name of the app, email address, and project name all correct. The one detail that gives it away is that the <code>From:</code> address uses the fake domain, even though it would have been possible to send the email using the actual Google account in the <code>From:</code> field. But this likely would have triggered spam and malware detection algorithms. So they took a subtly different approach by using a real Google address in the <code>Reply-To:</code>. But they were clever enough to use the same sub-domain, <code>gooogle.com.de</code>, in the From: address as in the phishing link <code>accounts.gooogle.com.de</code>, following a Google pattern of subdomains. They also included other real Google links for support and as a “follow up” URL.</p> <p>When I received this, I didn’t notice the clickable link in the email since I never view HTML email. I forwarded it on to our internal email list where others figured out it was fake. In the HTML version of the email, it has this link from the fake domain <code>accounts.gooogle.com.de</code>:</p> <pre><p><b>Your application will be removed</b> if you do not sign in to the <a href="http://accounts.gooogle.com.de/ServiceLogin?service=androiddeveloper&passive=1209600&continue=https://play.google.com/apps/publish/&followup=https://play.google.com/apps/publish/&type=3days&pkg=org.torproject.android">Developer Console</a> </pre> <p>This attacker might have been targeting anyone who would fall for the trick, without really caring what kind of app it was. For any accounts that the attacker got access to, they would be able to change the description text, home page, email address, etc. transparently without raising any particular warning signs. The attacker could place a recommendation in the app descriptions to also install another app, and that app would be the attacker’s malware.</p> <p>The attacker could not upload their own updates to an existing app, because Google Play checks uploaded APKs to make sure that the signing keys match the APKs that are already there. The attacker could create a whole new app in that developer’s account, and hope to gain installs since it would be related. Google Play has a standard view to show users apps by the same developer, for example.</p> <p><strong>Two-factor authentication and beyond</strong></p> <p>If a developer fell for this phishing attack, but had the forethought to have set up <a href="https://support.google.com/accounts/answer/180744" target="_blank">Google 2-Step Verification</a>, then even if the phisher got the username and password, they would be unable to log into that account since they would not have access to the two-factor SMS or <a href="https://support.google.com/accounts/answer/1066447" target="_blank">Google Authenticator</a> message. All developer accounts on Google Play should be required to use Google 2-Step Verification. Set it up <strong>now</strong>, if you have not already!</p> <p>We also need to consider the kinds of sophisticated attacks from large state actors that are leaking out to the public. Indeed, many of these attacks are also available for any government to <a href="https://netzpolitik.org/2014/gamma-finfisher-hacked-40-gb-of-internal-documents-and-source-code-of-government-malware-published/" target="_blank">purchase from companies like Finfisher</a>. And it is only a matter of time before these techniques are widespread and easier, following the rule of “attacks never get worse; they only get better”. This phishing website could also contain malicious Javascript that installs malware that can both log all key strokes in search of passwords, as well as search for known secret caches like Java keystores for Android signing keys, and browser cookies that allow the user to skip two-factor authentication, like the <a href="https://support.google.com/accounts/answer/2544838" target="_blank">cookie from Google’s two-step authentication</a>.</p> <p>One takeaway here: developers should <strong>never</strong> keep or use their APK signing keys on a machine that they also use to read email and browse the web.</p> <p><strong>Full source of the email</strong></p> <p>Here is the full source of the original email that I received, for those who might be interested in digging deeper. Another detail you can see there is that the email was not sent using Google infrastructure at all.</p> <pre>Return-Path: <n&#x6f;&#x72;e&#x70;&#x6c;y&#x2d;&#x64;e&#x76;&#x65;l&#x6f;&#x70;e&#x72;&#x2d;g&#x6f;&#x6f;g&#x6c;&#x65;p&#x6c;&#x61;y&#x40;&#x67;o&#x6f;&#x6f;gl&#x65;.c&#x6f;m.&#x64;e> X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on rodolpho.mayfirst.org X-Spam-Level: * X-Spam-Status: No, score=1.3 required=5.0 tests=HTML_MESSAGE,RDNS_NONE autolearn=disabled version=3.3.2 X-Original-To: s&#x75;p&#x70;o&#x72;t&#x40;gu&#x61;r&#x64;i&#x61;n&#x70;ro&#x6a;e&#x63;t&#x2e;i&#x6e;f&#x6f; Delivered-To: gphan&#x73;&#x40;&#x72;&#x6f;&#x64;olpho&#x2e;&#x6d;&#x61;&#x79;&#x66;irst.&#x6f;&#x72;&#x67; Received: from rodolpho.mayfirst.org (localhost [127.0.0.1]) by rodolpho.mayfirst.org (Postfix) with ESMTP id 4CFCD5E3D for <&#x73;&#x75;&#x70;port@&#x67;&#x75;&#x61;&#x72;dian&#x70;&#x72;&#x6f;&#x6a;ect.&#x69;&#x6e;&#x66;&#x6f;>; Fri, 20 Feb 2015 04:30:50 -0500 (EST) X-Greylist: delayed 543 seconds by postgrey-1.34 at rodolpho; Fri, 20 Feb 2015 04:30:49 EST Received: from astra1695.startdedicated.com (unknown [85.25.194.40]) by rodolpho.mayfirst.org (Postfix) with ESMTP id D74C83CD84 for <sup&#x70;&#x6f;&#x72;t@g&#x75;&#x61;&#x72;dia&#x6e;&#x70;&#x72;ojec&#x74;&#x2e;&#x69;nfo>; Fri, 20 Feb 2015 04:30:48 -0500 (EST) Received: from gooogle.com.de (astra1695 [85.25.194.40]) by astra1695.startdedicated.com (Postfix) with ESMTPA id 209D57C0918 for <su&#x70;&#x70;or&#x74;&#x40;gua&#x72;&#x64;ia&#x6e;&#x70;ro&#x6a;&#x65;ct.&#x69;&#x6e;fo>; Fri, 20 Feb 2015 10:21:32 +0100 (CET) Date: Fri, 20 Feb 2015 09:21:32 +0000 To: The Tor Project <&#x73;u&#x70;p&#x6f;rt&#x40;g&#x75;ar&#x64;i&#x61;np&#x72;o&#x6a;e&#x63;&#x74;.&#x69;n&#x66;o> From: Google Play Developer Support <n&#x6f;r&#x65;p&#x6c;y&#x2d;de&#x76;e&#x6c;o&#x70;e&#x72;-g&#x6f;o&#x67;l&#x65;p&#x6c;a&#x79;@g&#x6f;o&#x6f;g&#x6c;e&#x2e;co&#x6d;.&#x64;e> Reply-To: Google Play Developer Support <norepl&#x79;&#x2d;&#x64;&#x65;&#x76;&#x65;loper-g&#x6f;&#x6f;&#x67;&#x6c;&#x65;&#x70;lay@go&#x6f;&#x67;&#x6c;&#x65;&#x2e;&#x63;om> Subject: 7-Day Notification of Google Play Developer Term Violation Message-ID: <7f7&#x32;&#x35;&#x34;&#x30;087c&#x38;&#x31;&#x66;fe2e&#x61;&#x64;&#x35;6042&#x35;&#x64;&#x30;d477&#x40;&#x67;&#x6f;oogl&#x65;&#x2e;&#x63;om.d&#x65;> X-Priority: 3 X-Mailer: PHPMailer 5.2.9 (https://github.com/PHPMailer/PHPMailer/) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b1_7f72540087c81ffe2ead560425d0d477" Content-Transfer-Encoding: 8bit X-Virus-Scanned: ClamAV using ClamSMTP --b1_7f72540087c81ffe2ead560425d0d477 Content-Type: text/plain; charset=us-ascii Hello Google Play Developer, This is a notification that your application, Orbot: Proxy with Tor, with package ID org.torproject.android, is currently in violation of our developer terms. REASON FOR WARNING: Violation of the spam provisions of the Content Policy. Please refer to the spam policy help article for more information. Do not use irrelevant, misleading, or excessive keywords in apps descriptions, titles, or metadata. Please refer to the keyword spam policy help article for more information. Your application will be removed if you do not sign in to the Developer Console and make modifications to your application's description to bring it into compliance within 7 days of the issuance of this notification.If you have additional applications in your catalog, please also review them for compliance. Note that any remaining applications found to be in violation will be removed from the Google Play Store. Please also consult the Policy and Best Practices and the Developer Distribution Agreement as you bring your applications into compliance. You can also review this Google Play Help Center article for more information on this warning. All violations are tracked. Serious or repeated violations of any nature will result in the termination of your developer account, and investigation and possible termination of related Google accounts. Regards, Google Play Team 1600 Amphitheatre Parkway Mountain View, CA 94043 --b1_7f72540087c81ffe2ead560425d0d477 Content-Type: text/html; charset=us-ascii <p>Hello Google Play Developer,</p> <p>This is a notification that your application, <b>Orbot: Proxy with Tor</b>, with package ID <b>org.torproject.android</b>, is currently in violation of our developer terms.<br /> <b>REASON FOR WARNING</b>: Violation of the spam provisions of the Content Policy. Please refer to the spam policy help article for more information.</p> <p>Do not use irrelevant, misleading, or excessive keywords in apps descriptions, titles, or metadata.<br /> Please refer to the keyword spam policy help article for more information.</p> <p><b>Your application will be removed</b> if you do not sign in to the <a href="http://accounts.gooogle.com.de/ServiceLogin?service=androiddeveloper&passive=1209600&continue=https://play.google.com/apps/publish/&followup=https://play.google.com/apps/publish/&type=3days&pkg=org.torproject.android">Developer Console</a> and make modifications to your application&#x27;s description to bring it into compliance within <b>7 days</b> of the issuance of this notification.<br>If you have additional applications in your catalog, please also review them for compliance. Note that any remaining applications found to be in violation will be removed from the Google Play Store.</p> <p>Please also consult the <a href="https://support.google.com/googleplay/android-developer/#topic=2364761">Policy and Best Practices</a> and the <a href="https://play.google.com/about/developer-distribution-agreement.html">Developer Distribution Agreement</a> as you bring your applications into compliance. You can also review this Google Play Help Center article for more information on this warning.<br /> All violations are tracked. Serious or repeated violations of any nature will result in the termination of your developer account, and investigation and possible termination of related Google accounts.</p> <p>Regards,<br> Google Play Team<br> 1600 Amphitheatre Parkway<br> Mountain View, CA 94043</p> --b1_7f72540087c81ffe2ead560425d0d477-- </pre> https://guardianproject.info/2015/02/11/complete-reproducible-app-distribution-achieved/ Wed, 11 Feb 2015 14:51:22 -0400 https://guardianproject.info/2015/02/11/complete-reproducible-app-distribution-achieved/ <p>With <a href="https://f-droid.org" target="_blank">F-Droid</a>, we have been working towards getting a complete app distribution channel that is able to reproducibly build each Android app from source. while this may sound like a mundane detail, it does provide lots of tangible benefits. First, it means that anyone can verify that the app that they are using is 100% built from the source code, with nothing else added. That verifies that the app is indeed 100% free, open source software.</p> <p>It also verifies that there have not been any malicious bits of code added into the app during the build process. As has been <a href="https://www.youtube.com/watch?v=5pAen7beYNc" target="_blank">demonstrated</a> in the <a href="http://events.ccc.de/congress/2014/Fahrplan/events/6240.html" target="_blank">31c3 Reproducible Builds talk</a>, just flipping a single bit is enough to create a usable exploit in an app.</p> <p>The F-Droid project is leading the way with its system for publishing verified builds. We know have our first full example, building upon our previous work with making <a href="https://guardianproject.info/2014/06/09/our-first-deterministic-build-lil-debi-0-4-7/" target="_blank">Lil’ Debi build reproducibly</a>. We started with our simple little utility app <a href="https://github.com/guardianproject/checkey" target="_blank">Checkey</a> since it has few moving parts (first get one working, then the rest).</p> <p style="float: left" > <a href="https://guardianproject.info/releases/Checkey-0.1.1.apk"><img src="https://guardianproject.info/wp-content/uploads/2015/02/ic_launcher-web.png" alt="Checkey" width="128" height="128" /></a> </p> <p style="float: left; text-align: center; line-height: 128px; font-size: 1000%" > = </p> <p style="float: left" > <a href="https://f-droid.org/repo/info.guardianproject.checkey_101.apk"><img src="https://guardianproject.info/wp-content/uploads/2015/02/ic_launcher-web.png" alt="Checkey" width="128" height="128" style="float: right" /></a> </p> <p style="clear: both;"> <p> When you download Checkey from f-droid.org, you will get an APK that was signed using the official Guardian Project offline signing key that was built by f-droid.org. No, we did not give them a copy of our key, instead, the fdroid publish process now looks for the Binaries: tag in the build recipe. If it sees that, it downloads that APK, then builds the app from source, then checks to make sure that they match using a simple diff of the APK contents and by checking that the signature on the official APK also validates on the APK that f-droid.org built. </p> <p><p> Now that we have our little Checkey working, we can work towards getting all of our apps verifying in the same way, eliminating a whole field of exploits that we have to worry about. You can follow the progress of this work on the F-Droid wiki <a href="https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds" target="_blank">Reproducible Builds</a> page, and learn about a future application of it on the <a href="https://f-droid.org/wiki/page/Verification_Server" target="_blank">Verification Server</a> page. </p></p> <p><p> The next two apps that are in the reproducible pipeline are <a href="https://leap.se/" target="_blank">LEAP</a>‘s <a href="https://gitlab.com/fdroid/fdroiddata/tree/master/metadata/se.leap.bitmaskclient.txt" target="_blank">Bitmask</a> and our <a href="https://gitlab.com/fdroid/fdroiddata/blob/master/metadata/info.guardianproject.locationprivacy.txt" target="_blank">LocationPrivacy</a>. </p></p> https://guardianproject.info/2015/01/29/experimental-app-to-improve-privacy-in-location-sharing/ Thu, 29 Jan 2015 07:36:58 -0400 https://guardianproject.info/2015/01/29/experimental-app-to-improve-privacy-in-location-sharing/ <p><a href="https://guardianproject.info/wp-content/uploads/2015/01/ic_launcher-web.png"><img src="https://guardianproject.info/wp-content/uploads/2015/01/ic_launcher-web-300x300.png" alt="ic_launcher-web" width="300" height="300" class="alignright size-medium wp-image-12835" srcset="https://guardianproject.info/wp-content/uploads/2015/01/ic_launcher-web-300x300.png 300w, https://guardianproject.info/wp-content/uploads/2015/01/ic_launcher-web-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2015/01/ic_launcher-web-270x270.png 270w, https://guardianproject.info/wp-content/uploads/2015/01/ic_launcher-web-230x230.png 230w, https://guardianproject.info/wp-content/uploads/2015/01/ic_launcher-web.png 512w" sizes="(max-width: 300px) 100vw, 300px" /></a>As part of the T2 Panic effort, I’ve recently been diving deep into the issues of sharing location. It is unfortunately looking really bad, with many services, including Google, frequently sharing location as plain text over the network. I’ve started to write up some of the issues <a href="https://guardianproject.info/tag/panic">on this blog</a>.</p> <p>As part of this, I’ve put together an experimental Android app that aims to act as a privacy filter for all ways of sharing location. Mostly, that means it accepts all sorts of URLs from location services, and tries to parse the location from the URL, then rewrites it into a <a href="http://geouri.org" target="_blank"><code>geo:</code> URI</a>, which is the standard way to share location in Android (and hopefully soon all others). As of ChatSecure v14.1.0, these <code>geo:</code> URLs are also clickable.</p> <p>Many URLs are not parsable, like <code>http://goo.gl/maps/Cji0V</code>. LocationPrivacy then goes online and to try to fetch the location. This should happen over Tor, but it does not yet. You have been warned! Otherwise, it changes the URL to <code>HTTPS</code> on services that support it.</p> <p>You can get LocationPrivacy from all the usual channels, including on FDroid in the Guardian Project repo:<br /> <a href="https://f-droid.org" target="_blank"><a href="https://f-droid.org">https://f-droid.org</a></a><br /> <a href="https://guardianproject.info/fdroid" target="_blank"><a href="https://guardianproject.info/fdroid">https://guardianproject.info/fdroid</a></a></p> <p>Or from Google Play:<br /> <a href="https://play.google.com/store/apps/details?id=info.guardianproject.locationprivacy" target="_blank"><a href="https://play.google.com/store/apps/details?id=info.guardianproject.locationprivacy">https://play.google.com/store/apps/details?id=info.guardianproject.locationprivacy</a></a></p> <p>Source code:<br /> <a href="https://github.com/guardianproject/LocationPrivacy" target="_blank"><a href="https://github.com/guardianproject/LocationPrivacy">https://github.com/guardianproject/LocationPrivacy</a></a></p> <p>Report issues here:<br /> <a href="https://dev.guardianproject.info/projects/panic/issues" target="_blank"><a href="https://dev.guardianproject.info/projects/panic/issues">https://dev.guardianproject.info/projects/panic/issues</a></a></p> <p>Please do not rely on this app for strong privacy, it is still very much a new, beta app.</p> https://guardianproject.info/apps/info.guardianproject.checkey/ Wed, 28 Jan 2015 00:00:00 +0000 https://guardianproject.info/apps/info.guardianproject.checkey/ https://guardianproject.info/2015/01/26/first-working-test-of-iocipher-for-obj-c/ Mon, 26 Jan 2015 04:32:29 -0400 https://guardianproject.info/2015/01/26/first-working-test-of-iocipher-for-obj-c/ <p><a href="https://guardianproject.info/code/iocipher"><img src="https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk-150x150.jpg" alt="alberti cipher disk" width="150" height="150" class="alignright size-thumbnail wp-image-3079" srcset="https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk.jpg 245w" sizes="(max-width: 150px) 100vw, 150px" /></a>Every so often, we revisit our core libraries in the process of improving our existing apps, and creating new ones. IOCipher has become a standard part of our apps since it provides a really easy way to include encrypted file storage in Android apps. And we are now working on spreading it to iOS as well, headed up by Chris Ballinger, with the first preliminary tests of <a href="https://github.com/ChatSecure/IOCipher-ObjC" target="_blank">IOCipher for Obj-C</a>. Testing and contributions are most welcome! Find us in our <a href="https://guardianproject.info/contact/" target="_blank">chat room or mailing list</a> for questions, or just post a comment below! Since the iOS version is based on the exact same core library, libsqlfs, the container files they produce will also be fully compatible with each other.</p> <p>Now that iOS 8 has full disk encryption by default and a <a href="https://www.blackbagtech.com/blog/2014/09/24/ios-8-and-its-impact-on-investigations" title="iOS 8 and its Impact on Investigations" target="_blank">host of other security improvements</a>, you might be wondering why you would bother with app-specific encryption. The problem with full disk encryption is that the disk is only locked when your iPhone is fully turned off. Using IOCipher adds protection for sensitive data that helps in a few different scenarios.</p> <p>First, full disk encryption does not protect the data at all if malware is able to get root on the device. That malware will be free to read all files on the device. Second, for people who have not set up a strong passphrase on their iOS device, using app-specific encrypted storage make it harder to access that app’s data on devices with no passcode set, especially if any additional passphrase is stored in the keychain and disallowed from backup, or if it’s just stored in your own memory.</p> <p>Third is for added protetion from forensic acquisition systems, which often work using root exploits in order to read the entire filesystem without unlocking the screen<a href="https://www.elcomsoft.com/news/591.html" target="_blank">[1]</a><a href="https://www.elcomsoft.com/news/586.html" target="_blank">[2]</a><a href="http://www.htcia.org/2013/12/iphone-forensics-what-you-need-to-know/" target="_blank">[3]</a>. By having an app-specific encrypted file container that is not mounted like a filesystem, then even root cannot directly access the files in the container. Even root needs to get the key in order to unlock the IOCipher container, whether it is in use or not, and getting that key means either a key logger, which means planning ahead, or reading they key from memory if the container is unlocked, which is a more elaborate and targeted attack that full disk acquisition after rooting.</p> <p>Now consider that there is a large market 0days, i.e. unpublished exploits, and companies like <a href="https://netzpolitik.org/2014/gamma-finfisher-hacked-40-gb-of-internal-documents-and-source-code-of-government-malware-published/" target="_blank">VUPEN, FinFisher</a>, and <a href="https://citizenlab.org/2014/06/backdoor-hacking-teams-tradecraft-android-implant/" target="_blank">Hacking Team</a> making it easy to purchase them, even providing guarantees that one of their exploits will work within 30 days, it seems quite likely that customers of such companies have access to secret root exploits to even iOS 8. While there are ethical and lawful reasons to use software like this, many governments are also using them for <a href="https://www.eff.org/deeplinks/2012/02/spy-tech-companies-their-authoritarian-customers-part-i-finfisher-and-amesys" target="_blank">illegal</a> <a href="http://www.economist.com/blogs/pomegranate/2014/07/internet-monitoring-gulf" target="_blank">and</a> <a href="http://www.theguardian.com/technology/2014/sep/16/wikileaks-finfisher-files-malware-surveillance" target="_blank">unethical</a> <a href="https://citizenlab.org/2013/03/you-only-click-twice-finfishers-global-proliferation-2/" target="_blank">things</a>. Since we believe that everyone has a right to privacy, to speak freely, and to peaceably protest, it is important to provide protection to people who are unfairly targeted.</p> <p><a href="https://www.zetetic.net/sqlcipher/open-source/"><img src="https://guardianproject.info/wp-content/uploads/2010/05/skitch.png" alt="SQLCipher" width="64" height="72" class="alignleft size-full wp-image-3613" /></a>There is also another key advantage of the IOCipher approach when it comes to mobile devices. IOCipher is ultimately based on SQLite transactions in <a href="https://www.zetetic.net/sqlcipher/" target="_blank">SQLCipher</a>, which means that it does not require being mounted in the normal sense. There is no open state once a transaction is complete. Each read or write operation is a self-contained SQLite transaction, so if the file system is forcably quit, SQLite’s transactions prevent the whole file system from being corrupted. This is important in mobile operating systems like Android and iOS since any app or process can be killed at any moment without warning. That means that the worst that can happen to an IOCipher volume is a single write command does not get written. The whole file system will not be corrupted if the process is killed.</p> <p><strong>Coming Soon</strong></p> <p>When IOCipher is used in conjunction with our <a href="https://github.com/guardianproject/CacheWord" target="_blank">CacheWord</a> library, it is possible for an app to provide protection even against the <a href="https://xkcd.com/538/" target="_blank">$5 wrench attack</a>. CacheWord generates a strong passphrase and manages feeding it to IOCipher and SQLCipher. The user provides their own password for encrypting that strong passphrase. That CacheWord file is tiny, and can be rapidly deleted. Once it is gone, the actual passphrase that unlocks the IOCipher encryption is gone, the user’s passphrase will not unlock IOCipher directly. This is something we are working to add in all of our apps, and to also hook it up to panic button triggers. We would be quite happy to see you beat us to it by adding this feature to your app!</p> <p>IOCipher with a hardware security module (HSM) aka smartcard would be really nice, since it would provide some measure of added protection without the user setting an app-specific passphrase. HSMs provide write-only private key storage locked by pin code, so even if some was able to get the encrypted file and the pincode, they would not be able to retrieve the key to unlock the encrypted file. The only way to unlock the file would be with the physical device itself, or by finding the key backup, if that existed. This is possible now using an external <a href="http://www.smartcard-hsm.com/features.html" target="_blank">microSD</a> <a href="http://www.go-trust.com/nist-adds-go-trusts-sdencrypter-microsd-hsm-to-the-in-process-fips-140-2-module-validation-list/" target="_blank">HSM</a></p> https://guardianproject.info/2015/01/23/sharing-your-location-privately/ Fri, 23 Jan 2015 15:00:10 -0400 https://guardianproject.info/2015/01/23/sharing-your-location-privately/ <div id="attachment_12774" style="width: 298px" class="wp-caption alignright"> <a href="https://guardianproject.info/wp-content/uploads/2015/01/facebook-messenger-shared-location.png"><img aria-describedby="caption-attachment-12774" src="https://guardianproject.info/wp-content/uploads/2015/01/facebook-messenger-shared-location-576x1024.png" alt="Facebook location sharing embeds the location in every single message, providing a detailed log to the recipient, Facebook, and anyone Facebook shares that data with" width="288" height="512" class="size-large wp-image-12774" srcset="https://guardianproject.info/wp-content/uploads/2015/01/facebook-messenger-shared-location.png 576w, https://guardianproject.info/wp-content/uploads/2015/01/facebook-messenger-shared-location-169x300.png 169w" sizes="(max-width: 288px) 100vw, 288px" /></a> <p id="caption-attachment-12774" class="wp-caption-text"> Facebook location sharing embeds the location in every single message, providing a detailed log to the recipient, Facebook, and anyone Facebook shares that data with </p> </div> <p>One handy feature that many smartphones give us is the ability to easily share our exact position with other people. You can see this feature in a lot of apps. Google Maps lets you click “Share” and send a URL via any method you have available. In Facebook Messenger, you can click a button and the people on the other side of the chat will receive a little embedded map showing the received location. Of course, the question we always ask is: how can we do this in a privacy-preserving way? And the follow up question: what kinds of information are apps leaking, storing, using, etc? Location is especially valuable and sensitive metadata, especially when there is a lot of it, because it can be used to derive so much information about a person. Most people do not want to publicly post their phone number or home address on the internet, yet are unwittingly giving away far more detailed information by using the various location-based services that are available. There is a lot of specific location information that people do not want to publicize that they visit: a cancer specialist, an abortion clinic, a criminal court, a mistress’ house, or any location information to an abusive spouse. For a great illustration of the power of location metadata, you can watch <a href="http://www.zeit.de/datenschutz/malte-spitz-data-retention" target="_blank">an animation of German politician Malte Spitz’s life, based on his telephone metadata that his telecom had stored</a>.</p> <p>Google, Facebook, and so many others make money by collecting as much data on their users as possible, then selling access to that data to their customers. So both those companies have incentives to make sure that you will always share your location information with them as well. The question is: are they treating this information as carefully as you would? In China, the indigenous services are much more popular than most foreign alternatives. The Chinese companies are good at making products that are popular with Chinese users, and since they collaborate with the government censorship and tracking, it is easier for them to do business in China. This combination often means that Chinese companies put security and privacy at a very low priority, even though they could comply with the Chinese law while improving their security. A good example of this is the fact that none of the major map providers in China (Baidu, Amap, or QQ) provide even an optional HTTPS interface. They only have unencrypted communications, which allows lots of people easy access to snooping, including anyone who is on the same wifi network as you are.</p> <p>The tools for tracking people via location data are getting better, cheaper, and more available. One funny example is <a href="https://iknowwhereyourcatlives.com/" target="_blank">I Know Where Your Cat Lives</a>, which shows the locations of cat pictures found on the public internet via the geo location included in the EXIF image data.</p> <div id="attachment_12793" style="width: 310px" class="wp-caption alignright"> <a href="https://iknowwhereyourcatlives.com"><img aria-describedby="caption-attachment-12793" src="https://guardianproject.info/wp-content/uploads/2015/01/i-know-where-your-cat-lives-300x188.jpg" alt="I know where your cat lives!" width="300" height="188" class="size-medium wp-image-12793" srcset="https://guardianproject.info/wp-content/uploads/2015/01/i-know-where-your-cat-lives-300x188.jpg 300w, https://guardianproject.info/wp-content/uploads/2015/01/i-know-where-your-cat-lives.jpg 768w" sizes="(max-width: 300px) 100vw, 300px" /></a> <p id="caption-attachment-12793" class="wp-caption-text"> I know where your cat lives! </p> </div> <p><strong>Location and Panic</strong></p> <p>One use that we are particularly interested in is sending location to trusted contacts when a panic button is pressed. When thinking about panic button features, privacy must be a central concern. When someone triggers their panic button, it is clearly a sensitive situation. That means that leaking more location information could exacerabate the situation. Since sending location is a useful and popular feature, it is important to consider the whole picture of where that location information might go. To start with, the panic message needs to be sent using a method that will reliably reach its intended destination. Unfortunately, that often means using insecure communications like SMS, or an app that is fully tapped by the same government that is detaining the user, like WeChat. Part of this T2 Panic research and development effort is focused on how to make a complete, secure panic solution. So we will also focus on making ChatSecure and other secure communications an available channel for sending panic messages.</p> <p><a href="https://panicbutton.io"><img src="https://guardianproject.info/wp-content/uploads/2015/01/activate1-150x150.jpg" alt="activate1" width="150" height="150" class="alignleft size-thumbnail wp-image-12805" srcset="https://guardianproject.info/wp-content/uploads/2015/01/activate1-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2015/01/activate1-270x270.jpg 270w, https://guardianproject.info/wp-content/uploads/2015/01/activate1-230x230.jpg 230w" sizes="(max-width: 150px) 100vw, 150px" /></a>The next step is to break down the entire path of where that location information might be intercepted. The first place is on the sending device itself. The panic message will stored with the sent messages with most communications apps, and that can recovered by whoever is detaining the user. Even if the device is encrypted, it is very likely the user can be compelled to unlock the device. So the panic message should be designed with that in mind.</p> <p>So if we consider a fully anonymous method of communication, like ChatSecure’s “Secret Identity”, then protecting the location information becomes important even if all of the messages and their recipients are recovered from the sending device. The full “Secret Identity” procedure of creating an account per person you want to chat with, and only using that single account to communicate with that other person. It has been outlined by many people, including Laura Poitras when describing how she communicates with Edward Snowden. In this case, even if someone recovers the recipient address, all they will have is an anonymously created account with no other links to other accounts. Then location URL then becomes a way to deanonymize the recipient. First, if the URL takes the recipient to an unencrypted connection, then that it is easy to track. Even with an encrypted connection, if the server providing the map service is providing information to the government, then the encrypted connection will not help. Making this connection over Tor will also help since the map service will not be able to see the IP address of the device where the user clicked on this URL. Now consider a location URL using Google Maps, or any similar service where users frequently login. If the original panic message was sent using such a URL, and the recipient was a regular user of a service that used logins, then that login information would deanonymize the recipient if they viewed the location URL in a browser where they were also logged in with their normal Google account.</p> <p><strong>User Stories</strong></p> <p>This can perhaps be better illustrated using some quick user stories:</p> <ol> <li>A journalist and a source set up Secret Identities in ChatSecure devoted to each other when they met up in person. Each have panic buttons set up to contact the other in case of emergency. The journalist uses <a href="https://openstreetmap.org" target="_blank"><code>http<strong>s</strong>://openstreetmap.org</code></a> to generate a shortlink that points to the chosen meeting location, then sends it to the source using the Secret Identity, <a href="http://osm.org/go/0ju_SMlBn" target="_blank"><code><a href="http://osm.org/go/0ju_SMlBn">http://osm.org/go/0ju_SMlBn</a></code></a>. The source clicks the link, and chooses to open the link in Firefox. Therefore, the website is shown using an unencrypted, direct connection, which is easily observed. Even though the recipient has HTTPS Everywhere set up in his browser to force HTTPS for openstreetmap.org, the osm.org shortlink does not currently have working HTTPS so it is an HTTP link. This shortlink is now a unique ID that links the journalist and source’s real IP address. If the source was using a cellular internet connection, then this will also link the IP address to the devices IMEI unique ID. The IMEI is then quite easy to link to a real identity information.</li> <li>A circle of activists all set each other up with a panic button app on burner Android phones. They only use these burner phones to communicate with each other. They prepare in advance to discard all the phones in case someone triggers the panic. One activitist gets detained by the secret police and triggers the panic. The secret police get the panic message and all the other phone numbers from the detainee’s phone, but the activists are no longer using those phones so they cannot be tracked by them. The activists manually copy the Google Maps shortlink <a href="https://goo.gl/maps/Cji0V" target="_blank"><code><a href="https://goo.gl/maps/Cji0V">https://goo.gl/maps/Cji0V</a></code></a> to their computer to find out where the detainee is. They type the map link into Internet Explorer, making sure to type HTTPS, and then again confirm that the webpage is still using an HTTPS link. What they did not see is that the shortlink first redirected to a HTTP link <a href="http://maps.google.com/?q=28.118860,98.008069&hl=en&gl=us" target="_blank"><code><a href="http://maps.google.com/?q=28.118860,98.008069&amp;hl=en&amp;gl=us">http://maps.google.com/?q=28.118860,98.008069&amp;hl=en&amp;gl=us</a></code></a>, which leaked the location in plain text. Since this URL describes a very specific point, the secret police use this as a data point to search for the IP address of all devices that have accessed that URL. Those IP addresses divulge the locations of all the activists who viewed the map URL, and provide the secret police a method for tracking them all.</li> </ol> <p>I did not cover other more common use cases here because there are so many leaks that the protections presented are moot. All is not lost, there is still a lot that you can do to improve things. First off, we recommend using map apps that can work fully offline. For Android, <a href="https://play.google.com/store/apps/details?id=net.osmand" target="_blank">Osmand</a> is the best one out there, it uses OpenStreetMap data which can be freely downloaded. It is also important to encourage developers to improve the privacy of their apps. Since we are software developers, we file bug reports and make pull requests to nag location-related projects to improve their security. Here are some recent examples of what we have contributed:</p> <p>OpenStreetMap</p> <ul> <li>Issue #799: <a href="https://github.com/openstreetmap/openstreetmap-website/issues/799" target="_blank">Implement <code>geo:</code> URLs for sharing</a></li> <li>Issue #870: <a href="https://github.com/openstreetmap/openstreetmap-website/issues/870" target="_blank">share makes HTTP url even when connecting via HTTPS</a></li> <li>Issue #862: <a href="https://github.com/openstreetmap/openstreetmap-website/issues/862" target="_blank">support osm.org in HTTPS certificate</a></li> </ul> <p>Osmand</p> <ul> <li>Pull #1033: <a href="https://github.com/osmandapp/Osmand/pull/1033" target="_blank">modernize location sharing</a></li> <li>Pull #1043: <a href="https://github.com/osmandapp/Osmand/pull/1043" target="_blank">add support for a proxy and use more HTTPS</a></li> <li>Pull #1045: <a href="https://github.com/osmandapp/Osmand/pull/1045" target="_blank">update URL parsing</a></li> </ul> <p>We will be following up with further posts on this topic with more detail, including research into what is possible to derive from location data, technical details of issues, and possible solutions and work that can be done to improve things.</p> https://guardianproject.info/2015/01/02/2015-is-the-year-of-bore-sec/ Fri, 02 Jan 2015 12:35:41 -0400 https://guardianproject.info/2015/01/02/2015-is-the-year-of-bore-sec/ <p>Over the last few months, the Guardian Project team has been thinking about how to approach the next five years of our work. An idea of “security so easy and seamless, that it is boring” came to the surface through some discussions. This led us to look for inspiration in important inventions and innovations of the past, that provide safety and security to all on a day-to-day basis, without the users of these technologies hardly thinking about them. This is no longer about James Bond super-spy technologies, it is about having as little impact on your day-to-day use of mobile technology while still providing the maximum protection to your data and communications, as possible.</p> <p><em>Here then, as inspiration and our guiding lights, is our list of safety inventions of the past that we aim to be “Boring Like….”</em></p> <p><a href="http://blog.esurance.com/seat-belt-history/"><img class="alignnone size-full wp-image-12756" src="https://guardianproject.info/wp-content/uploads/2015/01/Old-seatbelt-image.jpg" alt="Old-seatbelt-image" width="959" height="380" srcset="https://guardianproject.info/wp-content/uploads/2015/01/Old-seatbelt-image.jpg 959w, https://guardianproject.info/wp-content/uploads/2015/01/Old-seatbelt-image-300x119.jpg 300w" sizes="(max-width: 959px) 100vw, 959px" /></a></p> <p> </p> <p>Boring Like <a href="http://blog.esurance.com/seat-belt-history/">Seat Belts</a> (buckle up!)</p> <p><a href="https://en.wikipedia.org/wiki/Pasteurization"><img class="alignnone size-full wp-image-12757" src="https://guardianproject.info/wp-content/uploads/2015/01/StateLibQld_1_212036_Cream_pasteurising_and_cooling_coils_at_Murgon_Butter_Factory_1939.jpg" alt="StateLibQld_1_212036_Cream_pasteurising_and_cooling_coils_at_Murgon_Butter_Factory,_1939" width="1000" height="722" srcset="https://guardianproject.info/wp-content/uploads/2015/01/StateLibQld_1_212036_Cream_pasteurising_and_cooling_coils_at_Murgon_Butter_Factory_1939.jpg 1000w, https://guardianproject.info/wp-content/uploads/2015/01/StateLibQld_1_212036_Cream_pasteurising_and_cooling_coils_at_Murgon_Butter_Factory_1939-300x217.jpg 300w" sizes="(max-width: 1000px) 100vw, 1000px" /><br /> </a> Boring Like <a href="https://en.wikipedia.org/wiki/Pasteurization">Pasteurized Milk</a> (though of course, we do respect your raw dairy folks out there…)</p> <p> </p> <p><a href="https://guardianproject.info/wp-content/uploads/2015/01/versagate3.jpg"><img class="alignnone size-full wp-image-12758" src="https://guardianproject.info/wp-content/uploads/2015/01/versagate3.jpg" alt="versagate3" width="640" height="427" srcset="https://guardianproject.info/wp-content/uploads/2015/01/versagate3.jpg 640w, https://guardianproject.info/wp-content/uploads/2015/01/versagate3-300x200.jpg 300w" sizes="(max-width: 640px) 100vw, 640px" /><br /> </a> Boring Like <a href="https://www.google.com/search?q=baby+gates&amp;source=lnms&amp;tbm=isch&amp;sa=X&amp;ei=htKmVJm_GZPmgwSNn4HYBg&amp;ved=0CAkQ_AUoAg&amp;biw=1701&amp;bih=839">Baby Gates</a> (kids and dogs hate ’em, but they are a necessary fun killer for any household)</p> <p><a href="https://guardianproject.info/wp-content/uploads/2015/01/smokealarm.jpg"><img class="alignnone size-full wp-image-12759" src="https://guardianproject.info/wp-content/uploads/2015/01/smokealarm.jpg" alt="smokealarm" width="410" height="602" srcset="https://guardianproject.info/wp-content/uploads/2015/01/smokealarm.jpg 410w, https://guardianproject.info/wp-content/uploads/2015/01/smokealarm-204x300.jpg 204w" sizes="(max-width: 410px) 100vw, 410px" /></a><br /> Boring Like <a href="http://thesmokedetector.umwblogs.org/antecedents-the-evolution/">Smoke Detectors</a> (though our friends at <a href="http://getbirdi.com/">Birdi</a> are aiming to make them exciting again…)</p> <p><a href="http://mentalfloss.com/article/54410/surprising-origins-child-proof-lids"><img class="alignnone size-full wp-image-12760" src="https://guardianproject.info/wp-content/uploads/2015/01/childlids.jpg" alt="childlids" width="640" height="430" srcset="https://guardianproject.info/wp-content/uploads/2015/01/childlids.jpg 640w, https://guardianproject.info/wp-content/uploads/2015/01/childlids-300x202.jpg 300w" sizes="(max-width: 640px) 100vw, 640px" /></a><br /> Boring Like <a href="http://mentalfloss.com/article/54410/surprising-origins-child-proof-lids">Childproof Lids</a> (again, for the parents out there, a literal life saver)</p> <p><a href="http://www.toyota-global.com/innovation/safety_technology/safety_technology/technology_file/active/"><img class="alignnone size-full wp-image-12761" src="https://guardianproject.info/wp-content/uploads/2015/01/sft_08_01.jpg" alt="sft_08_01" width="340" height="220" srcset="https://guardianproject.info/wp-content/uploads/2015/01/sft_08_01.jpg 340w, https://guardianproject.info/wp-content/uploads/2015/01/sft_08_01-300x194.jpg 300w" sizes="(max-width: 340px) 100vw, 340px" /></a><br /> Boring Like <a href="http://www.toyota-global.com/innovation/safety_technology/safety_technology/technology_file/active/">Anti-Lock Brakes</a> (the modern automobile is one of the best examples of bore-sec!)</p> <p><a href="https://guardianproject.info/wp-content/uploads/2015/01/bg_SurgeProtectorBuyingGuide_hero_image.jpg"><img class="alignnone size-full wp-image-12762" src="https://guardianproject.info/wp-content/uploads/2015/01/bg_SurgeProtectorBuyingGuide_hero_image.jpg" alt="bg_SurgeProtectorBuyingGuide_hero_image" width="650" height="294" srcset="https://guardianproject.info/wp-content/uploads/2015/01/bg_SurgeProtectorBuyingGuide_hero_image.jpg 650w, https://guardianproject.info/wp-content/uploads/2015/01/bg_SurgeProtectorBuyingGuide_hero_image-300x136.jpg 300w" sizes="(max-width: 650px) 100vw, 650px" /></a><br /> Boring Like <a href="http://www.lowes.com/cd_Surge+Protector+Buying+Guide_754129873_Learn">Surge Protectors</a> (wouldn’t you rather lose your $2 power strip then your $1000 computer?)</p> <p><a href="http://msdh.ms.gov/msdhsite/_static/30,5314,77,333.html"><img class="alignnone size-full wp-image-12763" src="https://guardianproject.info/wp-content/uploads/2015/01/RestaurantInspectionGradeA.jpg" alt="RestaurantInspectionGradeA" width="568" height="727" srcset="https://guardianproject.info/wp-content/uploads/2015/01/RestaurantInspectionGradeA.jpg 568w, https://guardianproject.info/wp-content/uploads/2015/01/RestaurantInspectionGradeA-234x300.jpg 234w" sizes="(max-width: 568px) 100vw, 568px" /></a><br /> Boring Like <a href="http://msdh.ms.gov/msdhsite/_static/30,5314,77,333.html">Restaurant Inspections</a> (peace of mind from a single letter rating when you go out to eat…)</p> <p><a href="https://americandogblog.wordpress.com/tag/dog-life-vest/"><img class="alignnone size-full wp-image-12764" src="https://guardianproject.info/wp-content/uploads/2015/01/dougie_2008_in_his_outwardhound_dog_life_jacket.jpg" alt="dougie_2008_in_his_outwardhound_dog_life_jacket" width="360" height="269" srcset="https://guardianproject.info/wp-content/uploads/2015/01/dougie_2008_in_his_outwardhound_dog_life_jacket.jpg 360w, https://guardianproject.info/wp-content/uploads/2015/01/dougie_2008_in_his_outwardhound_dog_life_jacket-300x224.jpg 300w" sizes="(max-width: 360px) 100vw, 360px" /></a><br /> Boring Like <a href="https://americandogblog.wordpress.com/tag/dog-life-vest/">Life Vests</a> (even dogs love ’em!)</p> <p><em>Have some ideas of other great “Bore-Sec” tech? Add them in the comments!</em></p> <p>With our work on critical security and privacy enhancements for mobile devices and apps, we aim to bore. The best security is the kind you don’t have to worry about, until you need it (and then you won’t know how you ever lived without it…)</p> <p><strong>Here’s to breaking new “Bore-Sec” ground in 2015! Happy New Year!</strong></p> https://guardianproject.info/2014/10/16/reducing-metadata-leakage-from-software-updates/ Thu, 16 Oct 2014 12:48:04 -0400 https://guardianproject.info/2014/10/16/reducing-metadata-leakage-from-software-updates/ <p><strong>Update</strong>: now you can <a href="https://guardianproject.info/2016/07/31/howto-get-all-your-debian-packages-via-tor-onion-services/">do this with Tor Onion Services</a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/10/leakage.png"><img src="https://guardianproject.info/wp-content/uploads/2014/10/leakage-300x199.png" alt="leakage" width="300" height="199" class="alignright size-medium wp-image-12699" srcset="https://guardianproject.info/wp-content/uploads/2014/10/leakage-300x199.png 300w, https://guardianproject.info/wp-content/uploads/2014/10/leakage-100x66.png 100w, https://guardianproject.info/wp-content/uploads/2014/10/leakage-150x99.png 150w, https://guardianproject.info/wp-content/uploads/2014/10/leakage-200x132.png 200w, https://guardianproject.info/wp-content/uploads/2014/10/leakage.png 410w" sizes="(max-width: 300px) 100vw, 300px" /></a>Many software update systems use code signing to ensure that only the correct software is downloaded and installed, and to prevent the code from being altered. This is an effective way to prevent the code from being modified, and because of that, software update systems often use plain, unencrypted HTTP connections for downloading code updates. That means that the metadata of what packages a machine has installed is available in plain text for any network observer, from someone sitting on the same public WiFi as you, to state actors with full network observation capabilities.</p> <p>That means that potentially private information is leaking. That private information could be which packages you have installed and which versions. That information can help an attacker figure out the best way to break into the target machine. Also, a unique fingerprint can be generated based on which packages a machine has installed, and that could help de-anonymize traffic that goes over Tor or other anonymity tool.</p> <p>For people who use <code>apt-get</code> in Debian, Ubuntu or any related GNU/Linux distro, there is a lot of metadata leaked to the internet when <code>apt-get</code> contacts Debian repositories using a standard configuration. Mostly, that is because by default, the connections are unencrypted (http, ftp, rsync). The integrity of the package itself is not reason enough to use HTTPS since the GPG signing is much more reliable for that task. Here is how I break it down:</p> <ol> <li>package authenticity<br /> (<em>software can be modified while being downloaded</em>)</li> <li>repo availability<br /> ( <em>whole sites or specific URL paths can be selectively blocked by governments and companies</em>)</li> <li>package availability<br /> (<em>software security updates can be individually blocked</em>)</li> <li>who’s downloading what package (<em>currently visible to anyone who can see the<br /> network traffic, including open wifi, etc.</em>)</li> </ol> <p>The current apt model covers #1 well, but only covers #2 and #3 with a two week window (the expiration date on the repo metadata). And it does not cover #4 at all. Using HTTPS for apt repos is a simple way to improve the security of all 4. It adds a weak backup security layer for #1, it makes it much more difficult for a portion of a large internet mirror to be seletively blocked (e.g. #2 and #3). For example, if you use HTTPS to mirrors.kernel.org, everything has to be blocked to block Debian repos or packages. And pipelining downloads through a reused HTTPS connection makes it very difficult for the network observer to track metadata about packages, #4).<a href="https://guardianproject.info/wp-content/uploads/2014/10/leakage-control.jpg"><img src="https://guardianproject.info/wp-content/uploads/2014/10/leakage-control-150x150.jpg" alt="leakage control" width="150" height="150" class="alignright size-thumbnail wp-image-12701" srcset="https://guardianproject.info/wp-content/uploads/2014/10/leakage-control-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2014/10/leakage-control-100x100.jpg 100w, https://guardianproject.info/wp-content/uploads/2014/10/leakage-control-200x200.jpg 200w, https://guardianproject.info/wp-content/uploads/2014/10/leakage-control.jpg 300w" sizes="(max-width: 150px) 100vw, 150px" /></a></p> <p>Luckily, there are some relatively easy steps that greatly reduce the amount of metadata that is leaked: using HTTPS connections to the mirrors and running those connections through Tor. Setting <code>apt-get</code> to pipeline as many transactions into a given HTTPS session is also useful, but currently only supported for HTTP and not HTTPS. Even though HTTPS/TLS has security weaknesses, it is a lot better than nothing, and can help provide real world protection. The downside is that it is not common for Debian machines to connect to apt mirrors using HTTPS, so that potentially marks the install as a machine worth targeting. There are more and more HTTPS mirrors, and more interest in using them, so I think in time, that will only lessen as a concern. Here are the HTTPS mirrors that I have had good luck with:</p> <ul> <li>mirrors.ece.ubc.ca</li> <li>mirrors.kernel.org</li> <li>mirror.cse.unsw.edu.au</li> <li>spout.ussg.indiana.edu</li> </ul> <p>On that note, here is the config that I have been using on a number of Debian-deriv machines, and it has been working well. It requires <code>apt-transport-https</code>, and <a href="http://ubuntuguide.org/wiki/Tor#Privoxy" target="_blank"><code>privoxy</code> setup as an HTTP proxy for Tor</a>.</p> <pre>$ cat /etc/apt/apt.conf.d/99force-tor # force everything through privoxy HTTP proxy to tor Acquire::ftp::Proxy "http://127.0.0.1:8118"; Acquire::http::Proxy "http://127.0.0.1:8118"; Acquire::https::Proxy "http://127.0.0.1:8118"; # don't use SSL, its insecure, only use TLS Acquire::https::SslForceVersion "TLSv1"; </pre> <p>I have found about 10 official Debian mirrors that have reliable HTTPS. Then I have a <a href="https://gist.github.com/eighthave/7285154" target="_blank">script that finds all of them</a>, but many have self-signed certs and other issues. A number of the HTTPS mirrors also mirror the “security” archive, but I recommend that the <code>http</code> URL to the official <code>security.debian.org</code> repo is still included to make sure that security updates are promptly available.</p> <p>I also have a test security repo running that is only available via an .onion address. I hope to encourage people to run official mirrors on a Tor Hidden Service, then HTTPS is not needed. Note that <code>apt-transport-tor</code> is not required if a tor proxy is setup. To try mine, add it to your <code>sources.list</code> (and make sure <code>apt-get</code> is somehow using Tor). The order is important, that determines the priority of where <code>apt-get</code> will get the package from is all other variables are the same.</p> <pre>deb http://dju2peblv7upfz3q.onion/debian-security/ wheezy/updates main deb http://security.debian.org/ wheezy/updates main </pre> <p><strong>Update</strong>: Use the official <a href="https://onion.debian.org/" target="_blank">Debian Tor Onion Services</a> now, <tt>dju2peblv7upfz3q.onion</tt> is deprecated and will be shut down!</p> <h3 id="a-specific-example-tails">A specific example: TAILS</h3> <p><a href="https://tails.boum.org/"><img src="https://guardianproject.info/wp-content/uploads/2014/10/Tails-150x150.png" alt="Tails" width="150" height="150" class="alignleft size-thumbnail wp-image-12711" srcset="https://guardianproject.info/wp-content/uploads/2014/10/Tails-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2014/10/Tails-100x100.png 100w, https://guardianproject.info/wp-content/uploads/2014/10/Tails-200x200.png 200w, https://guardianproject.info/wp-content/uploads/2014/10/Tails.png 256w" sizes="(max-width: 150px) 100vw, 150px" /></a><a href="https://tails.boum.org/" target="_blank">TAILS</a> is an operating system that aims to be as private and anonymous as possible to enable, and has allowed <a href="https://freedom.press/blog/2014/04/help-support-little-known-privacy-tool-has-been-critical-journalists-reporting-nsa" target="_blank">journalists</a> like <a href="https://www.wired.com/2014/10/laura-poitras-crypto-tools-made-snowden-film-possible/" target="_blank">Laura Poitras</a> to work without leaking information despite being targeted by some very skilled and highly resourced organizations. TAILS mostly works as a “live CD”, meaning the whole operating system is downloaded as a single “image” file, then either burned to a CD/DVD, or to a USB thumb drive. Updates work the same way. But TAILS has an optional feature to use the Debian package system to install and persist packages that are not included by default. TAILS does not use the default set of mirrors that a standard Debian install uses, it is set up by default with a range of possible Debian package sources, including the current stable version (called wheezy), the versions in testing, and packages backported to the stable version. That means that when this feature is used, TAILS fetches the metadata for all of those sections of Debian (stable/wheezy, testing, wheezy-backports, unstable).</p> <p>Given all of the proven fingerprinting approaches, like using the font list from the browser, I think its a safe assumption that the apt-get metadata will also provide similar fingerprinting opportunities. For basic TAILS use, this is all avoided since updates are done via ISO images. But once a user installs packages via <code>apt-get</code>, that changes since TAILS then goes out onto the internet to fetch all of the repo metadata. That goes over Tor since TAILS forces all network traffic over Tor, so that helps break the link between the machine downloading the updates and those that can see that machines internet traffic.</p> <p>It seems quite likely that the set of mirrors and the order in which they are run will provide a way to identify the system as TAILS. As for identifying individual machines, <code>apt-get</code> sends a lot of metadata, like language that the system is using, which packages need updates, etc. On top of the set of mirrors used, there is potentially enough metadata there to fingerprint the individual machine.</p> <p>One open question is how the <code>apt-get</code> downloads map to different Tor circuits. If all of the traffic from a given <code>apt-get</code> session goes over a single Tor circuit, then the exit node, the mirror server, and any network observer that can see the traffic between those two can use that as the fingerprint.</p> <p>To expand on this, if TAILS fetched all of its apt sources (wheezy, backports, testing, etc) via HTTPS from the same mirror (e.g. mirrors.kernel.org), then the exit node and network observer could not really distinguish the distro the machine making the connection was running since mirrors.kernel.org hosts many distro mirrors. There are two key parts here: using HTTPS to encrypt the data, and using HTTP pipelining so that network connections are reused for multiple downloads, rather than the default behavior of making a new HTTPS for each individual download. This setup would also prevent the custom pattern of apt sources from being distinguished since it would just show as downloading some series of files, and those files could be packages, package metadata, perl modules, source tarballs, etc.</p> https://guardianproject.info/code/cacheword/ Fri, 26 Sep 2014 21:44:19 -0400 https://guardianproject.info/code/cacheword/ <div class="source-code" style="text-align: center;"> <a href="https://gitlab.com/guardianproject/CacheWord" target="_blank" title="CacheWord on Gitlab"> <i class="fa fa-gitlab"></i> GitLab </a> - <a href="https://github.com/guardianproject/CacheWord" target="_blank" title="CacheWord on Github"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.github.io/CacheWord" target="_blank" title="CacheWord javadoc"> Javadoc </a> - <a href="https://guardianproject.info/tags/cacheword" target="_blank" title="CacheWord blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /> <p>CacheWord is an Android library project for passphrase caching and management.<br /> It helps app developers securely generate, store, and access secrets derived<br /> from a user&rsquo;s passphrase. It is designed to work easily with <a href="https://guardianproject.info/code/iocipher">IOCipher</a> and <a href="https://www.zetetic.net/sqlcipher/open-source" target="_blank">SQLCipher-for-Android</a>, but it can be used any time an app needs to manage a password. Broadly speaking this library assists developers with two related problems:</p> <ol> <li>Secrets Management: how the secret key material for your app is generated, stored, and accessed</li> <li>Passphrase Caching: store the passphrase in memory to avoid constantly prompting the user</li> </ol> <p>CacheWord manages key derivation, verification, persistence, passphrase resetting, and caching secret key material in memory.</p> <h3 id="features">Features</h3> <ul> <li>Strong key derivation (PBKDF2)</li> <li>Dynamic KDF iteration count based on CPU speed</li> <li>Secure secret storage (AES-256 GCM)</li> <li>Persistent notification: informs the user the app data is unlocked</li> <li>Configurable timeout: after a specified time of inactivity the app locks itself</li> <li>Manual clearing: the user can forcibly lock the application</li> </ul> <h2 id="source-code-repository">Source Code Repository</h2> <ul> <li>library, helpers, tests, and sample project: <a href="https://github.com/guardianproject/cacheword">https://github.com/guardianproject/cacheword</a></ul></li> </ul> <h2 id="downloads">Downloads</h2> <div class="gradle-line"> <p> The binary jar, source jar, and javadoc jar are all available on jcenter. To include them using gradle, add this line to your <i>build.gradle</i>: </p> <pre style="text-align: center;">implementation &#39;info.guardianproject.cacheword:cachewordlib:0.1.1&#39;</pre> <p>Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:</p> <ul> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/cacheword/cachewordlib/0.1.1/cachewordlib-0.1.1.jar">cachewordlib-0.1.1.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/cacheword/cachewordlib/0.1.1/cachewordlib-0.1.1.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/cacheword/cachewordlib/0.1.1/cachewordlib-0.1.1-sources.jar">cachewordlib-0.1.1-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/cacheword/cachewordlib/0.1.1/cachewordlib-0.1.1-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/cacheword/cachewordlib/0.1.1/cachewordlib-0.1.1-javadoc.jar">cachewordlib-0.1.1-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/cacheword/cachewordlib/0.1.1/cachewordlib-0.1.1-javadoc.jar.asc"><i>PGP signature</i></a>)</li> </ul> </div> https://guardianproject.info/code/cacheword/ Fri, 26 Sep 2014 21:44:19 -0400 https://guardianproject.info/code/cacheword/ <div class="source-code" style="text-align: center;"> <a href="https://gitlab.com/guardianproject/CacheWord" target="_blank" title="CacheWord on Gitlab"> <i class="fa fa-gitlab"></i> GitLab </a> - <a href="https://github.com/guardianproject/CacheWord" target="_blank" title="CacheWord on Github"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.github.io/CacheWord" target="_blank" title="CacheWord javadoc"> Javadoc </a> - <a href="https://guardianproject.info/tags/cacheword" target="_blank" title="CacheWord blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /> <p>CacheWord is an Android library project for passphrase caching and management.<br /> It helps app developers securely generate, store, and access secrets derived<br /> from a user&rsquo;s passphrase. It is designed to work easily with <a href="https://guardianproject.info/code/iocipher">IOCipher</a> and <a href="https://www.zetetic.net/sqlcipher/open-source" target="_blank">SQLCipher-for-Android</a>, but it can be used any time an app needs to manage a password. Broadly speaking this library assists developers with two related problems:</p> <ol> <li>Secrets Management: how the secret key material for your app is generated, stored, and accessed</li> <li>Passphrase Caching: store the passphrase in memory to avoid constantly prompting the user</li> </ol> <p>CacheWord manages key derivation, verification, persistence, passphrase resetting, and caching secret key material in memory.</p> <h3 id="features">Features</h3> <ul> <li>Strong key derivation (PBKDF2)</li> <li>Dynamic KDF iteration count based on CPU speed</li> <li>Secure secret storage (AES-256 GCM)</li> <li>Persistent notification: informs the user the app data is unlocked</li> <li>Configurable timeout: after a specified time of inactivity the app locks itself</li> <li>Manual clearing: the user can forcibly lock the application</li> </ul> <h2 id="source-code-repository">Source Code Repository</h2> <ul> <li>library, helpers, tests, and sample project: <a href="https://github.com/guardianproject/cacheword">https://github.com/guardianproject/cacheword</a></ul></li> </ul> <h2 id="downloads">Downloads</h2> <div class="gradle-line"> <p> The binary jar, source jar, and javadoc jar are all available on jcenter. To include them using gradle, add this line to your <i>build.gradle</i>: </p> <pre style="text-align: center;">implementation &#39;info.guardianproject.cacheword:cachewordlib:0.1.1&#39;</pre> <p>Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:</p> <ul> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/cacheword/cachewordlib/0.1.1/cachewordlib-0.1.1.jar">cachewordlib-0.1.1.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/cacheword/cachewordlib/0.1.1/cachewordlib-0.1.1.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/cacheword/cachewordlib/0.1.1/cachewordlib-0.1.1-sources.jar">cachewordlib-0.1.1-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/cacheword/cachewordlib/0.1.1/cachewordlib-0.1.1-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/cacheword/cachewordlib/0.1.1/cachewordlib-0.1.1-javadoc.jar">cachewordlib-0.1.1-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/cacheword/cachewordlib/0.1.1/cachewordlib-0.1.1-javadoc.jar.asc"><i>PGP signature</i></a>)</li> </ul> </div> https://guardianproject.info/2014/09/26/cipherkit-updates-iocipher-and-cacheword/ Fri, 26 Sep 2014 21:39:54 -0400 https://guardianproject.info/2014/09/26/cipherkit-updates-iocipher-and-cacheword/ <p>We’ve been on a big kick recently, updating the newest members of our CipherKit family of frameworks: <a href="https://guardianproject.info/code/iocipher">IOCipher</a> and <a href="https://github.com/guardianproject/cacheword" target="_blank">CacheWord</a>. There also are is a little news about the original CipherKit framework: <a href="https://www.zetetic.net/sqlcipher/open-source" title="SQLCipher for Android" target="_blank">SQLCipher-for-Android</a>.</p> <h2 id="iocipher-v0-2">IOCipher v0.2</h2> <p><a href="https://guardianproject.info/code/iocipher"><img src="https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk-150x150.jpg" alt="alberti cipher disk" width="150" height="150" class="alignright size-thumbnail wp-image-3079" srcset="https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk.jpg 245w" sizes="(max-width: 150px) 100vw, 150px" /></a>IOCipher is a library for storing files in an encrypted virtual disk. It’s API is the exact same as <code>java.io</code> for working with files, and it does not need root access. That makes it the sibling of SQLCipher-for-Android, both are native Android APIs that wrap the SQLCipher database.</p> <p>This round of work focused on making IOCipher more reliable and secure, and easy to integrate with CacheWord. It can now handle files up to 4GB in size, the same as FAT filesystems, and it has much improved performance, especially under concurrent load. There is now also an <code>unmount()</code> method to lock the database and wipe the key from memory. The central <code>VirtualFileSystem</code> class is now a singleton, since you can only have a single virtual disk open at a time. Lastly, the IOCipher release now includes binaries for <code>armeabi</code>, <code>armeabi-v7a</code>, and <code>x86</code>. IOCipher v0.2 was built against SQLCipher-for-Android v3.1.0, and that is the minimum recommended version to use.</p> <p>Find downloads, example projects, test suites, and more on <a href="https://guardianproject.info/code/iocipher">the IOCipher page</a>. Follow the development on the <a href="https://dev.guardianproject.info/projects/iocipher" target="_blank">IOCipher project page</a>.</p> <h2 id="cacheword-v0-1">CacheWord v0.1</h2> <p>Once you are using SQLCipher and IOCipher, then you’ll definitely need to do some password management, and password caching too, since no one wants to type their password again every time they come to an app. That is where CacheWord comes in: it is a library for managing passwords, and it is designed easily feed directly into SQLCipher and IOCipher, or really anything that needs secure password caching.</p> <p>Most of this update was about making CacheWord ready to deploy. That means fixing bugs and drastically simplifying it’s dependencies. CacheWord now can be used as a plain jar file or an Android Library Project, and it only depends on <code>android-support-v4.jar</code>.</p> <p>Part of the process of simplifying CacheWord also involved stripping down the API to only want CacheWord should really handle. The standard API is all in the CacheWordHandler class. So that means that your app has to handle any Notification, and pass it to CacheWord if you want CacheWordService to run in the foreground.</p> <p>CacheWord also now dynamically chooses how many iterations of the key derivation function based on the CPU type. That means that new, fast devices, the derived key will be a lot stronger, while on slow, old devices, it won’t take a minute to unlock your app.</p> <p>Find downloads, example projects, and more on <a href="https://guardianproject.info/code/cacheword">the CacheWord page</a>. Follow the development on the <a href="https://dev.guardianproject.info/projects/cacheword" target="_blank">CacheWord project page</a>.</p> <h2 id="sqlcipher">SQLCipher</h2> <p><a href="https://www.zetetic.net/sqlcipher/"><img src="https://guardianproject.info/wp-content/uploads/2010/05/skitch.png" alt="SQLCipher" width="64" height="72" class="alignright size-full wp-image-3613" /></a>The upcoming release of SQLCipher-for-Android also has been simplified. It will no longer depend on commons-codec.jar or guava-r09.jar (thanks to Jeff Campbell for submitting those commits!), remove ~8000 methods for those who fear running into the 65k method limit of the classes.dex file. We’ve been working on making the build process be reproducible, so that anyone can verify that the official releases are built only from the source in the git repo, and nothing else has been added. We’re also working on moving the password format conversion code out of CacheWord and into SQLCipher, where it belongs.</p> https://guardianproject.info/2014/09/18/question-central-server-federated-or-p2p-answer-all/ Thu, 18 Sep 2014 00:30:57 -0400 https://guardianproject.info/2014/09/18/question-central-server-federated-or-p2p-answer-all/ <p>There are many ideas of core architectures for providing digital services, each with their own advantages and disadvantages. I break it down along the lines of central servers, federated servers, and peer-to-peer, serverless systems.</p> <div id="attachment_12631" style="width: 210px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2014/09/200px-Server-based-network.svg_.png"><img aria-describedby="caption-attachment-12631" src="https://guardianproject.info/wp-content/uploads/2014/09/200px-Server-based-network.svg_.png" alt="a central service with clients connecting to it" width="200" height="207" class="size-full wp-image-12631" srcset="https://guardianproject.info/wp-content/uploads/2014/09/200px-Server-based-network.svg_.png 200w, https://guardianproject.info/wp-content/uploads/2014/09/200px-Server-based-network.svg_-100x103.png 100w, https://guardianproject.info/wp-content/uploads/2014/09/200px-Server-based-network.svg_-150x155.png 150w" sizes="(max-width: 200px) 100vw, 200px" /></a> <p id="caption-attachment-12631" class="wp-caption-text"> a central service with clients connecting to it </p> </div> <p>Most big internet companies operate in effect as a central server (even though they are implemented differently). There is only facebook.com, there are no other services that can inter-operate with facebook.com. Have a single, central repo makes problems of finding the service and finding people within the service a lot easier. Once you are in Facebook, you just need to know the name of the person you want to contact and you are connected. The Facebook apps just need to talk to facebook.com, so the user does not need to know which service they are using in order to configure the app.</p> <div id="attachment_12633" style="width: 310px" class="wp-caption aligncenter"> <a href="http://www.bendevane.com/RDC2012/ians/2012/10/09/campsiteofthefutur/"><img aria-describedby="caption-attachment-12633" src="https://guardianproject.info/wp-content/uploads/2014/09/Federated-01-1024x582-300x170.png" alt="email as federated service" width="300" height="170" class="size-medium wp-image-12633" srcset="https://guardianproject.info/wp-content/uploads/2014/09/Federated-01-1024x582-300x170.png 300w, https://guardianproject.info/wp-content/uploads/2014/09/Federated-01-1024x582-100x56.png 100w, https://guardianproject.info/wp-content/uploads/2014/09/Federated-01-1024x582-150x85.png 150w, https://guardianproject.info/wp-content/uploads/2014/09/Federated-01-1024x582-200x113.png 200w, https://guardianproject.info/wp-content/uploads/2014/09/Federated-01-1024x582-450x255.png 450w, https://guardianproject.info/wp-content/uploads/2014/09/Federated-01-1024x582-600x341.png 600w, https://guardianproject.info/wp-content/uploads/2014/09/Federated-01-1024x582-900x511.png 900w, https://guardianproject.info/wp-content/uploads/2014/09/Federated-01-1024x582.png 1024w" sizes="(max-width: 300px) 100vw, 300px" /></a> <p id="caption-attachment-12633" class="wp-caption-text"> email as federated service </p> </div> <p>Email is a great example of a federated system. Each email provider acts like a central server, but then each of those central servers can easily talk to each other and exchange data. So fastmail.fm and gmail.com are both centralized services, but users do not need to know any extra information in order to exchange emails between the two services, or any other of the millions of email servers out there. A federated system provides a lot of the benefits of a centralized server with more flexibility. The downside is that federated services generally require more configuration to use them (though webmail makes that much less of an issue).</p> <div id="attachment_12632" style="width: 310px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2014/09/300px-Unstructured_peer-to-peer_network_diagram.png"><img aria-describedby="caption-attachment-12632" src="https://guardianproject.info/wp-content/uploads/2014/09/300px-Unstructured_peer-to-peer_network_diagram.png" alt="a peer-to-peer network" width="300" height="245" class="size-full wp-image-12632" srcset="https://guardianproject.info/wp-content/uploads/2014/09/300px-Unstructured_peer-to-peer_network_diagram.png 300w, https://guardianproject.info/wp-content/uploads/2014/09/300px-Unstructured_peer-to-peer_network_diagram-100x81.png 100w, https://guardianproject.info/wp-content/uploads/2014/09/300px-Unstructured_peer-to-peer_network_diagram-150x122.png 150w, https://guardianproject.info/wp-content/uploads/2014/09/300px-Unstructured_peer-to-peer_network_diagram-200x163.png 200w" sizes="(max-width: 300px) 100vw, 300px" /></a> <p id="caption-attachment-12632" class="wp-caption-text"> a peer-to-peer network </p> </div> <p>Peer-to-peer systems can provide unique benefits of bandwidth efficiency as well as working around blockages in the internet. Sharing large files with thousands of people is quite expensive when using a central server, but with bittorrent, anyone can share large files to many many people using only a basic broadband connection.</p> <p>Over the past year and a half of our Bazaar project, we have been thinking a lot about how to distribute apps to people who face a number of challenges. Each of these systems offers distinct advantages and disadvantages, so it is quite difficult to choose only one. Instead, we thought why not try to make a system that combines all three? Android’s APK app package format is a good format to work in this model because they are self-contained and containing a form of embedded identity in the app signature. So if you already have an Android app installed, then Android will enforce that only APKs signed by the same key as the installed app can be installed over it.</p> <p>That means in theory, it does not matter where the APK came from as long as it has a valid signature. There are some details where it does matter, mostly related to exploits like “Master Key” that can inject code into an existing APK. The FDroid app repository signature has a similar property: once you trust the repository signing key, it does not matter how you got the repository files as long as the signature validates. This is a model proven by GNU/Linux distros like Debian. The repository metadata also provides a way to validate APKs have not been modified since they were added to the signed repository. Since both of these do not rely on the method of transport to prove their authenticity, this combination provides a great testbed for this idea of combining a central service, with decentralized servers and peer-to-peer distribution.</p> <p>This work was all incorporated in the <a href="https://f-droid.org" target="_blank">FDroid</a> app store for Android. The central f-droid.org app repository means that FDroid can deliver well over one thousand apps without any configuration on the part of the user. The “fdroidserver” developer tools means that anyone can set up their own repository of apps, and users can easily add that repository to FDroid. It is not quite zero configuration, but the process is not too difficult, and there is more we are planning to do to smooth out that process even more. This also provides a channel for users to get apps via “collateral freedom” techniques like using Amazon S3, Akamai, etc. to distribute files where many such services are filtered or blocked. Lastly, we made it possible to have the FDroid app itself act as an app repository, and other devices can connect to that repository using local WiFi, mesh, Bluetooth, and removable media.</p> <p>This stuff is all implemented and included in the FDroid app and fdroidserver developer tools. The big remaining challenge is combining them all into a usable experience for people who do not know the technical details. This has been tested, discussed, sketched out, and there is a prototype implementation in the works. So I can end with a quick overview of some positive and negative observations about the various peer-to-peer connections that we experimented with:</p> <ul style="list-style-type: none;"> <li> <strong>+</strong> Bluetooth is ubiquitous </li> <li> <strong>–</strong> very slow data rate </li> <li> <strong>–</strong> pairing is difficult </li> </ul> <ul style="list-style-type: none;"> <li> <strong>+</strong> WiFi is very widespread </li> <li> <strong>+</strong> local connections are very fast </li> <li> <strong>–</strong> access points and proxies can block host-to-host connections </li> <li> <strong>–</strong> running access points on a device is not common nor easy </li> </ul> <ul style="list-style-type: none;"> <li> <strong>+</strong> NFC makes Bluetooth very easy to use </li> <li> <strong>–</strong> NFC is not commonly used or available </li> <li> <strong>–</strong> NFC is far to slow and fiddly to be used as the data transmission medium </li> </ul> <ul style="list-style-type: none;"> <li> <strong>+</strong> SD cards can move lots of data securely </li> <li> <strong>–</strong> not all devices have removable SD cards </li> <li> <strong>–</strong> swapping SD cards can be a fiddly process </li> <li> <strong>–</strong> swapping SD cards can not be automatic </li> </ul> <ul style="list-style-type: none;"> <li> <strong>+</strong> USB thumb drives can move lots of data securely </li> <li> <strong>+</strong> they can be easily swapped between devices </li> <li> <strong>–</strong> swapping SD cards can not be automatic </li> <li> <strong>–</strong> not all devices support USB-OTG i.e. attached devices </li> <li> <strong>–</strong> USB-OTG is not widely used </li> </ul> https://guardianproject.info/2014/09/10/chatsecure-for-android-v14-is-finally-here/ Wed, 10 Sep 2014 08:35:39 -0400 https://guardianproject.info/2014/09/10/chatsecure-for-android-v14-is-finally-here/ <p>I am so happy to announce that <strong>ChatSecure for Android v14 IS FINALLY HERE!</strong></p> <p>BUT This is our first “release candidate” of v14 for public use, and while we love it dearly, you may want to wait for 14.0.1 for us to work out any hiccups.</p> <p>The update should be out on Google Play shortly, and FDroid in the next few days. Otherwise, you can always download the APK direct from us:</p> <pre style="color: #000000;">APK: <a href="https://guardianproject.info/releases/ChatSecure-v14.0.0.apk">https://guardianproject.info/releases/ChatSecure-v14.0.0.apk</a> Sig: <a href="https://guardianproject.info/releases/ChatSecure-v14.0.0.apk.asc">https://guardianproject.info/releases/ChatSecure-v14.0.0.apk.asc </a><a href="https://guardianproject.info/wp-content/uploads/2014/09/chatsecurev14.png"><img class="margin:6px; alignleft wp-image-12622 size-medium" src="https://guardianproject.info/wp-content/uploads/2014/09/chatsecurev14-168x300.png" alt="chatsecurev14" width="168" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/09/chatsecurev14-168x300.png 168w, https://guardianproject.info/wp-content/uploads/2014/09/chatsecurev14-450x800.png 450w, https://guardianproject.info/wp-content/uploads/2014/09/chatsecurev14.png 540w" sizes="(max-width: 168px) 100vw, 168px" /></a><a href="https://guardianproject.info/releases/ChatSecure-v14.0.0.apk.asc"> </a></pre> <ul> <li>Major UI update for fun and enjoyment!<br /></li> <li>Easy to add and verify new contacts with QR codes<br /></li> <li>Improved encrypted file sharing!<br /></li> <li>Updated SSL/TLS settings and secure code libraries<br /></li> <li>20% reduction in size!</li> </ul> <p>PLEASE CONTACT US with any upgrade problems!</p> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> <p>Source tag: <a href="https://github.com/guardianproject/ChatSecureAndroid/releases/tag/14.0.0">https://github.com/guardianproject/ChatSecureAndroid/releases/tag/14.0.0</a></p> <p>Full changelog for all the v13/v14 work is here: <a href="https://github.com/guardianproject/ChatSecureAndroid/blob/master/CHANGELOG">https://github.com/guardianproject/ChatSecureAndroid/blob/master/CHANGELOG</a></p> <p> </p> https://guardianproject.info/2014/08/05/chatsecure-13.2-important-beta/ Tue, 05 Aug 2014 11:35:54 -0400 https://guardianproject.info/2014/08/05/chatsecure-13.2-important-beta/ <p>Today is the first public beta of ChatSecure v13.2, an important update of the user interface, networking code, and overall stability. We’ve spent the last six months tracking down crashes, memory leaks and performance issues, and have reached a stable, functional point which we want to share for public use. Reliability and simplicity our the goals, as we move towards v14 in the next few months.</p> <p>This beta also features a new account setup wizard that we are eager for feedback on. Our goal is to enable new users to have a much simpler experience in setting up ChatSecure to connect to existing or create new accounts. We have also provided a “one-click burner” option to quickly create throwaway accounts, that require Tor and OTR encryption always, for chatting with a single contact or even just a single conversation.</p> <div id='gallery-10' class='gallery galleryid-12577 gallery-columns-3 gallery-size-thumbnail'> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2014/08/device-2014-08-05-122247.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2014/08/device-2014-08-05-122247-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2014/08/device-2014-08-05-122226.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2014/08/device-2014-08-05-122226-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2014/08/device-2014-08-05-122048.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2014/08/device-2014-08-05-122048-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2014/08/device-2014-08-05-122039.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2014/08/device-2014-08-05-122039-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2014/08/device-2014-08-05-121908.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2014/08/device-2014-08-05-121908-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2014/08/sidebar.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2014/08/sidebar-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2014/08/device-2014-08-05-121532.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2014/08/device-2014-08-05-121532-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style='clear: both' /> </div> <p>We have also removed some features (for now), with the goal of focus on stripping down the experience, and then building it back up again. For example, there is now ONE contact list, that merges all contacts from all accounts together. It can be easily searched, and you don’t have to worry about which account is active – you just selected the person you want to communicate with, and we know which account they are associated with.</p> <p>We have also removed the ability to manually set presence and status (for now), while we re-think how they should work in a mobile context a bit more. The vast majority of our users do not change either value anyhow, but we do know that smartly managing online vs away, especially if you are logged in from multiple locations to the same account, is important. Expect an update here shortly, and we’d love to have your feedback and fresh ideas on mobile presence.</p> <p>You can currently access the beta directly via APK download (below),  through our <a href="https://guardianproject.info/2014/06/06/automatic-private-distribution-of-our-test-builds/">F-Droid Test Build “Nightlies” Repo</a>, or through our <a href="https://plus.google.com/communities/108480576214602821006">Google+ Community Beta Access</a>. We will roll out to our release repos and Google Play public once we get through our initial feedback on the beta.</p> <p><strong>Download ChatSecure v13.2 Beta 1 Now</strong></p> <p><img class="alignleft size-full wp-image-12579" src="https://guardianproject.info/wp-content/uploads/2014/08/chatsecure-latest-qr.png" alt="chatsecure-latest-qr" width="123" height="123" srcset="https://guardianproject.info/wp-content/uploads/2014/08/chatsecure-latest-qr.png 123w, https://guardianproject.info/wp-content/uploads/2014/08/chatsecure-latest-qr-100x100.png 100w" sizes="(max-width: 123px) 100vw, 123px" /><br /> APK: <a href="https://guardianproject.info/releases/ChatSecure-v13.2.0-BETA-1.apk">https://guardianproject.info/releases/ChatSecure-v13.2.0-BETA-1.apk<br /> </a><br /> PGP Sig: <a href="https://guardianproject.info/releases/ChatSecure-v13.2.0-alpha-10.apk.asc">https://guardianproject.info/releases/ChatSecure-v13.2.0-alpha-10.apk.asc</a></p> <p> </p> <p> </p> <p>The source is tagged here: <a href="https://github.com/guardianproject/ChatSecureAndroid/releases/tag/13.2.0-beta-1">https://github.com/guardianproject/ChatSecureAndroid/releases/tag/13.2.0-beta-1</a></p> <p>The release includes fixes from our completed <a href="https://dev.guardianproject.info/projects/gibberbot/issues?utf8=%E2%9C%93&amp;set_filter=1&amp;f%5B%5D=fixed_version_id&amp;op%5Bfixed_version_id%5D=%3D&amp;v%5Bfixed_version_id%5D%5B%5D=102&amp;f%5B%5D=&amp;c%5B%5D=tracker&amp;c%5B%5D=status&amp;c%5B%5D=priority&amp;c%5B%5D=subject&amp;c%5B%5D=assigned_to&amp;c%5B%5D=updated_on&amp;c%5B%5D=due_date&amp;group_by=">v13 milestone</a>, and our <a href="https://dev.guardianproject.info/versions/121">v14 milestone “Armadillo’s Agram”</a>, which you can view on our project tracker (<a href="https://dev.guardianproject.info/projects/gibberbot/">https://dev.guardianproject.info/projects/gibberbot/</a>).</p> <p> </p> <p> </p> https://guardianproject.info/2014/07/30/introducing-trustedintents-for-android/ Wed, 30 Jul 2014 23:29:23 -0400 https://guardianproject.info/2014/07/30/introducing-trustedintents-for-android/ <p>Following up on <a href="https://guardianproject.info/2014/01/21/improving-trust-and-flexibility-in-interactions-between-android-apps/">our research on secure Intent interactions</a>, we are now announcing the first working version of the <a href="https://github.com/guardianproject/TrustedIntents" target="_blank"><em>TrustedIntents</em></a> library for Android. It provides methods for checking any Intent for whether the sending and receiving app matches a specified set of trusted app providers. It does this by “pinning” to the signing certificate of the APKs. The developer includes this “pin” in the app, which includes the signing certificate to trust, then <em>TrustedIntents</em> checks <code>Intent</code>s against the configured certificate pins. The library includes pins for the Guardian Project and Tor Project signing certificates. It is also easy to generate the pin using our new utility <a href="https://github.com/guardianproject/checkey" target="_blank">Checkey</a> (available in <a href="https://guardianproject.info/2014/06/30/new-official-guardian-project-app-repo-for-fdroid/" target="_blank">our FDroid repo</a> and in <a href="https://play.google.com/store/apps/details?id=info.guardianproject.checkey" target="_blank">Google Play</a>).</p> <div id="attachment_12560" style="width: 310px" class="wp-caption alignright"> <a href="https://guardianproject.info/wp-content/uploads/2014/07/checkey-phone.png"><img aria-describedby="caption-attachment-12560" src="https://guardianproject.info/wp-content/uploads/2014/07/checkey-phone-300x168.png" alt="Checkey displaying the signing certificate of ChatSecure" width="300" height="168" class="size-medium wp-image-12560" srcset="https://guardianproject.info/wp-content/uploads/2014/07/checkey-phone-300x168.png 300w, https://guardianproject.info/wp-content/uploads/2014/07/checkey-phone-1024x576.png 1024w, https://guardianproject.info/wp-content/uploads/2014/07/checkey-phone-100x56.png 100w, https://guardianproject.info/wp-content/uploads/2014/07/checkey-phone-150x84.png 150w, https://guardianproject.info/wp-content/uploads/2014/07/checkey-phone-200x112.png 200w, https://guardianproject.info/wp-content/uploads/2014/07/checkey-phone-450x253.png 450w, https://guardianproject.info/wp-content/uploads/2014/07/checkey-phone-600x337.png 600w, https://guardianproject.info/wp-content/uploads/2014/07/checkey-phone-900x506.png 900w, https://guardianproject.info/wp-content/uploads/2014/07/checkey-phone.png 1280w" sizes="(max-width: 300px) 100vw, 300px" /></a> <p id="caption-attachment-12560" class="wp-caption-text"> Checkey displaying the signing certificate of ChatSecure </p> </div> <p>We hope to make this process as dead simple as possible by providing developers with this library. <em>TrustedIntents</em> is currently set up as an “Android Library Project” but it could easily be a jar too, the code is currently quite simple, the plan is to add more convenience methods and also support for TOFU/POP in addition to pinning. For usage examples, check out <a href="https://github.com/guardianproject/TrustedIntentsExample" target="_blank"><em>TrustedIntentsExample</em></a> and the test project under the test/ subdir of the <em>TrustedIntents</em> library source repo.</p> <ul> <li><em>TrustedIntents</em> source: <a href="https://github.com/guardianproject/TrustedIntents" target="_blank"><a href="https://github.com/guardianproject/TrustedIntents">https://github.com/guardianproject/TrustedIntents</a></a></li> <li>example project: <a href="https://github.com/guardianproject/TrustedIntentsExample" target="_blank"><a href="https://github.com/guardianproject/TrustedIntentsExample">https://github.com/guardianproject/TrustedIntentsExample</a></a></li> <li>wiki, issue tracker, etc: <a href="https://dev.guardianproject.info/projects/trustedintents/wiki" target="_blank"><a href="https://dev.guardianproject.info/projects/trustedintents/wiki">https://dev.guardianproject.info/projects/trustedintents/wiki</a></a></li> <li><em>Checkey</em> source: <a href="https://github.com/guardianproject/Checkey" target="_blank"><a href="https://github.com/guardianproject/Checkey">https://github.com/guardianproject/Checkey</a></a></li> </ul> <p><em>Checkey</em> includes a simple method for generating the certificate pins. The pin is in the format of Java subclass of <code>ApkSignaturePin</code>, which provides all needed utility functions. The create the pin file, first install the app whose certificate you want to trust. Be sure to get it from a trusted source since you are going to be trusting the signing certificate of the APK that you have installed. Launch <em>Checkey</em> and select that app in the list, you will see the certificate details show up on the top. To generate the .java file for pinning Intents, select <strong>Generate Pin</strong> from the menu and send the resulting file to yourself. That file is the pin, include it in your project, then load it into TrustedIntents by doing in <code>onCreate()</code> or wherever is appropriate:<br /> <code>&lt;br /&gt; TrustedIntents ti = TrustedIntents.get(context);&lt;br /&gt; ti.isTrustedSigner(MySigningCertificatePin.class);&lt;br /&gt; </code></p> <div id="attachment_12565" style="width: 610px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2014/07/checkey-generate-pin.png"><img aria-describedby="caption-attachment-12565" src="https://guardianproject.info/wp-content/uploads/2014/07/checkey-generate-pin.png" alt="How to generate a pin file with Checkey" width="600" height="444" class="size-medium wp-image-12565" srcset="https://guardianproject.info/wp-content/uploads/2014/07/checkey-generate-pin-300x222.png 300w, https://guardianproject.info/wp-content/uploads/2014/07/checkey-generate-pin-100x74.png 100w, https://guardianproject.info/wp-content/uploads/2014/07/checkey-generate-pin-150x111.png 150w, https://guardianproject.info/wp-content/uploads/2014/07/checkey-generate-pin-200x148.png 200w, https://guardianproject.info/wp-content/uploads/2014/07/checkey-generate-pin-450x334.png 450w, https://guardianproject.info/wp-content/uploads/2014/07/checkey-generate-pin-600x445.png 600w" sizes="(max-width: 600px) 100vw, 600px" /></a> <p id="caption-attachment-12565" class="wp-caption-text"> How to generate a pin file with Checkey </p> </div> <h3 id="gathering-all-the-edge-cases">Gathering all the edge cases</h3> <p>One of the things I’ve focused on in the <em>TrustedIntents</em> library is thinking about all the possible edge cases and how to check for them. It is rare that the main part of a security check algorithm fails, its almost always the edge cases that are the gotcha.</p> <p>One example: <em>TrustedIntents</em> should properly check all signing certificates on an APK. From what I’ve seen, it is rare that APKs are signed by more than one certificate, but the spec allows for that. There might be exploits related to not handling that.</p> <p>Another thing is that <em>TrustedIntents</em> uses the method that the Android code uses for comparing signatures: it does a byte-by-byte comparison of the signature byte arrays. Some apps area already doing something similar based on the hash of the signing certificate (i.e. the “fingerprint”). The Android technique will also be faster than hashing since the hash algorithm has to read the whole signature byte array anyway.</p> <p>We’d love to have feedback, flames, comments, etc on any and all of this. <a href="https://guardianproject.info/contact/">Let us know</a> how it works for you!</p> https://guardianproject.info/2014/06/30/new-official-guardian-project-app-repo-for-fdroid/ Mon, 30 Jun 2014 20:26:39 -0400 https://guardianproject.info/2014/06/30/new-official-guardian-project-app-repo-for-fdroid/ <p>We now have an official <a href="https://f-droid.org" target="_blank">FDroid</a> app repository that is available via three separate methods, to guarantee access to a trusted distribution channel throughout the world! To start with, you must have FDroid installed. Right now, I recommend using the latest test release since it has support for Tor and .onion addresses (earlier versions should work for non-onion addresses):</p> <p><a href="https://f-droid.org/repo/org.fdroid.fdroid_710.apk">https://f-droid.org/repo/org.fdroid.fdroid_710.apk</a></p> <p>In order to add this repo to your FDroid config, you can either click directly on these links on your devices and FDroid will recognize them, or you can click on them on your desktop, and you will be presented with a QR Code to scan. Here are your options:</p> <ul> <li>HTTPS: <a href="https://guardianproject.info/fdroid/repo?fingerprint=B7C2EEFD8DAC7806AF67DFCD92EB18126BC08312A7F2D6F3862E46013C7A6135">https://guardianproject.info/fdroid/repo</a></li> <li>Tor Hidden Service aka onion address: <a href="http://bdf2wcxujkg6qqff.onion/fdroid/repo?fingerprint=B7C2EEFD8DAC7806AF67DFCD92EB18126BC08312A7F2D6F3862E46013C7A6135">http://bdf2wcxujkg6qqff.onion/fdroid/repo</a></li> <li>Amazon AWS S3 Bucket (<em>this does not show up in a browser</em>): <a href="https://s3.amazonaws.com/guardianproject/fdroid/repo?fingerprint=B7C2EEFD8DAC7806AF67DFCD92EB18126BC08312A7F2D6F3862E46013C7A6135">https://s3.amazonaws.com/guardianproject/fdroid/repo</a></li> </ul> <p>From here on out, our old FDroid repo (<a href="https://guardianproject.info/repo">https://guardianproject.info/repo</a>) is considered deprecated and will no longer be updated. It will eventually be removed. Update to the new one!</p> <p>Also, if you missed it before, all of our test builds are also <a href="https://guardianproject.info/2014/06/06/automatic-private-distribution-of-our-test-builds/">available for testing only via FDroid</a>. Just remember, the builds in the test repo are only debug builds, not fully trusted builds, so use them for testing only.</p> <h3 id="automate-it-all">Automate it all!</h3> <p>This setup has three distribution channels that are all mirrors of a repo that is generated on a fully offline machine. This is only manageable because of lots of new automation features in the <a href="https://gitlab.com/fdroid/fdroidserver" target="_blank">fdroidserver</a> tools for building and managing app repos. You can now set up a USB thumb drive as the automatic courier for shuffling the repo from the offline machine to an online machine. The repo is generated, updated, and signed using <code>fdroid update</code>, then those signed files are synced to the USB thumb drive using <code>fdroid server update</code>. Then the online machine syncs the signed files from that USB thumb drive to multiple servers via SSH and Amazon S3 with a single command: <code>fdroid server update</code>. The magic is in setting up the config options and letting the tools do the rest.</p> <h3 id="new-repo-signing-key">New Repo Signing Key</h3> <p>For part of this, I’ve completed the process of generating a new, fully offline fdroid <a href="https://guardianproject.info/home/signing-keys/">signing key</a>. So that means there is a new signing key for the FDroid repo, and the old repo signing key is being retired.</p> <ul> <li><a href="https://guardianproject.info/releases/guardianproject-rsa4096-fdroid-repo-signing-key.pem">guardianproject-rsa4096-fdroid-repo-signing-key.pem</a></li> <li><a href="https://guardianproject.info/releases/guardianproject-rsa4096-fdroid-repo-signing-key.pem.sig">guardianproject-rsa4096-fdroid-repo-signing-key.pem.sig</a></li> </ul> <p>The fingerprints for this signing key are:</p> <pre>Owner: EMAILADDRESS=root@guardianp&#x72;&#x6f;&#x6a;&#x65;&#x63;&#x74;&#x2e;&#x69;&#x6e;&#x66;&#x6f;, CN=guardianproject.info, O=Guardian Project, OU=FDroid Repo, L=New York, ST=New York, C=US Issuer: &#x45;&#x4d;&#x41;ILADD&#x52;&#x45;&#x53;&#x53;=roo&#x74;&#x40;&#x67;&#x75;ardi&#x61;&#x6e;&#x70;&#x72;oject&#x2e;&#x69;&#x6e;&#x66;o, CN=guardianproject.info, O=Guardian Project, OU=FDroid Repo, L=New York, ST=New York, C=US Serial number: a397b4da7ecda034 Valid from: Thu Jun 26 15:39:18 EDT 2014 until: Sun Nov 10 14:39:18 EST 2041 Certificate fingerprints: MD5: 8C:BE:60:6F:D7:7E:0D:2D:B8:06:B5:B9:AD:82:F5:5D SHA1: 63:9F:F1:76:2B:3E:28:EC:CE:DB:9E:01:7D:93:21:BE:90:89:CD:AD SHA256: B7:C2:EE:FD:8D:AC:78:06:AF:67:DF:CD:92:EB:18:12:6B:C0:83:12:A7:F2:D6:F3:86:2E:46:01:3C:7A:61:35 Signature algorithm name: SHA1withRSA Version: 1 </pre> https://guardianproject.info/2014/06/30/recent-news-on-orweb-flaws/ Mon, 30 Jun 2014 12:43:51 -0400 https://guardianproject.info/2014/06/30/recent-news-on-orweb-flaws/ <p><strong>August 2014: New browser development news here, including Orfox, our Firefox-based browser solution: <a href="https://lists.mayfirst.org/pipermail/guardian-dev/2014-August/003717.html">https://lists.mayfirst.org/pipermail/guardian-dev/2014-August/003717.html</a></strong></p> <p> </p> <p>On Saturday, a new post was relased by Xordern entitled <a href="http://xordern.net/ip-leakage-of-mobile-tor-browsers.html">IP Leakage of Mobile Tor Browsers</a>. As the title says, the post documents flaws in mobile browser apps, such as <a href="https://guardianproject.info/apps/orweb">Orweb</a> and <a href="https://mike.tig.as/onionbrowser/">Onion Browser</a>, both which automatically route communication traffic over Tor. While we appreciate the care the author has taken, he does make the mistake of using the term “security” to lump together the need for total anonymity up with the needs of anti-censorship, anti-surveillance, circumvention and local device privacy. We do understand the seriousness of this bug, but at the same time, it is not an issue encountered regularly in the wild.</p> <p>Here are thoughts on the three specific issues covered:</p> <p>1) HTML5 Multimedia: This is a <a href="https://guardianproject.info/2013/08/21/orweb-security-advisory-possible-ip-leakage-with-html5-videoaudio/">known issue</a> which is not present on 100% of Android devices, but is definitely something to be concerned about, if you access sites with HTML5 media player content on them. To us, it is a bug in Android, and not in Orweb, since all of the appropriate APIs are called when the browser is configured to proxy. However, it is a problem, and our solution remains to either use transparent proxying feature of Orbot, or to use the Firefix Privacy configuration we provide here: <a href="https://guardianproject.info/apps/firefoxprivacy">https://guardianproject.info/apps/firefoxprivacy</a></p> <p>2) Downloads leak: This is a new issue and one we are trying to reproduce on our end. If our proxied download indeed is not working, we will issue a fix shortly. Again, using Firefox configured in the manner we prescribe, the downloads would be proxied properly.</p> <p>3) Unique Headers: The inclusion of a unique HTTP header issue in this list is confusing, because it has nothing to do with IP leakage. We have never claimed that a mobile browser can be 100% anonymous, and defending against full fingerprinting of browsers based on headers is something beyond what we are attempting to do at this point.</p> <p>At this point, we still recommend <a href="https://guardianproject.info/apps/orweb">Orweb</a> for most people who want a very simple solution for a browser that is proxied through Tor. This will defeat mass traffic surveillance, network censorship, filtering by your mobile operator, work or school, and more. Orweb also keeps little data cached on the local system, and so protects against physical inspection and analysis of your device, to retrieve your browser history. HOWEVER if you do seem to visit sites that have HTML5 media players in the them, then we recommend you do not use Orweb, and again, that you use <a href="https://guardianproject.info/apps/firefoxprivacy">Firefox with our Privacy-Enhanced Configuration</a>.</p> <p>If you are truly worried about IP leakage, then you MUST root your phone, and use Orbot’s Transparent Proxying feature. This provides the best defense against leaking of your real IP. Even further, if you require even more assurance than that, you should follow Mike Perry’s <a href="https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy">Android Hardening Guide</a>, which uses AFWall firewall in combination with Orbot, to block traffic to apps, and even stops Google Play from updating apps without your permission.</p> <p>Finally, the best news is that we are making great progress in a fully privacy-by-default version of Firefox, under the project named “Orfox”. This is being done in partnership with the Tor Project, as a <a href="https://www.google-melange.com/gsoc/proposal/public/google/gsoc2014/amoghbl1/5629499534213120">Google Summer of Code</a> effort, along with the Orweb team. We aim to use as much of the same code that Tor Browser does to harden Firefox in our browser, and are getting close to an alpha release. If you are interested in a testing the first prototype build, which address the HTML5 and Download leak issues, you can find it here: <a href="https://guardianproject.info/releases/FennecForTor_GSoC_prototype.apk">https://guardianproject.info/releases/FennecForTor_GSoC_prototype.apk</a> and track the project here: <a href="https://github.com/guardianproject/orfox">https://github.com/guardianproject/orfox</a></p> <p> </p> <p> </p> <p> </p> <p> </p> https://guardianproject.info/code/trustedintents/ Mon, 23 Jun 2014 00:00:00 +0000 https://guardianproject.info/code/trustedintents/ <p><img style="margin: 0 auto;" title="icon" src="https://guardianproject.info/wp-content/uploads/2010/05/trustedintents-150x150.png" /></p> <div class="source-code" style="text-align: center;"> <a href="https://gitlab.com/guardianproject/TrustedIntents" target="_blank" title="TrustedIntents on Gitlab"> <i class="fa fa-gitlab"></i> GitLab </a> - <a href="https://github.com/guardianproject/TrustedIntents" target="_blank" title="TrustedIntents on Github"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/trustedintents" target="_blank" title="TrustedIntents blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /> <p>TrustedIntents is a library for flexible trusted interactions between Android apps. It is modeled after Android’s signature protection level for permissions. The key difference is that the framework allows the trusted signature to be set, rather than requiring to match the current app’s signature.</p> <p>For more info:</p> <ul> <li><a href="https://dev.guardianproject.info/projects/trustedintents/wiki/Wiki/">https://dev.guardianproject.info/projects/trustedintents/wiki/Wiki/</a></li> <li><a href="https://guardianproject.info/2014/01/21/improving-trust-and-flexibility-in-interactions-between-android-apps/">https://guardianproject.info/2014/01/21/improving-trust-and-flexibility-in-interactions-between-android-apps/</a></li> <li><a href="https://developer.android.com/guide/topics/manifest/permission-element.html#plevel">https://developer.android.com/guide/topics/manifest/permission-element.html#plevel</a></li> </ul> <h2 id="downloads">Downloads</h2> <div class="gradle-line"> <p> The binary jar, source jar, and javadoc jar are all available on jcenter. To include them using gradle, add this line to your <i>build.gradle</i>: </p> <pre style="text-align: center;">implementation &#39;info.guardianproject.trustedintents:trustedintents:%!s(&lt;nil&gt;)&#39;</pre> <p>Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:</p> <ul> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/trustedintents/trustedintents/%25!s%28%3cnil%3e%29/trustedintents-%25!s%28%3cnil%3e%29.jar">trustedintents-%!s(&lt;nil&gt;).jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/trustedintents/trustedintents/%25!s%28%3cnil%3e%29/trustedintents-%25!s%28%3cnil%3e%29.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/trustedintents/trustedintents/%25!s%28%3cnil%3e%29/trustedintents-%25!s%28%3cnil%3e%29-sources.jar">trustedintents-%!s(&lt;nil&gt;)-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/trustedintents/trustedintents/%25!s%28%3cnil%3e%29/trustedintents-%25!s%28%3cnil%3e%29-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/trustedintents/trustedintents/%25!s%28%3cnil%3e%29/trustedintents-%25!s%28%3cnil%3e%29-javadoc.jar">trustedintents-%!s(&lt;nil&gt;)-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/trustedintents/trustedintents/%25!s%28%3cnil%3e%29/trustedintents-%25!s%28%3cnil%3e%29-javadoc.jar.asc"><i>PGP signature</i></a>)</li> </ul> </div> <h2 id="license">License</h2> <p>This library is licensed under the LGPLv2.1. We believe this is compatible with all reasonable uses, including proprietary software, but let us know if it provides difficulties for you. For more info on how that works with Java, see:</p> <p><a href="https://www.gnu.org/licenses/lgpl-java.en.html">https://www.gnu.org/licenses/lgpl-java.en.html</a></p> https://guardianproject.info/code/trustedintents/ Mon, 23 Jun 2014 00:00:00 +0000 https://guardianproject.info/code/trustedintents/ <p><img style="margin: 0 auto;" title="icon" src="https://guardianproject.info/wp-content/uploads/2010/05/trustedintents-150x150.png" /></p> <div class="source-code" style="text-align: center;"> <a href="https://gitlab.com/guardianproject/TrustedIntents" target="_blank" title="TrustedIntents on Gitlab"> <i class="fa fa-gitlab"></i> GitLab </a> - <a href="https://github.com/guardianproject/TrustedIntents" target="_blank" title="TrustedIntents on Github"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/trustedintents" target="_blank" title="TrustedIntents blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /> <p>TrustedIntents is a library for flexible trusted interactions between Android apps. It is modeled after Android’s signature protection level for permissions. The key difference is that the framework allows the trusted signature to be set, rather than requiring to match the current app’s signature.</p> <p>For more info:</p> <ul> <li><a href="https://dev.guardianproject.info/projects/trustedintents/wiki/Wiki/">https://dev.guardianproject.info/projects/trustedintents/wiki/Wiki/</a></li> <li><a href="https://guardianproject.info/2014/01/21/improving-trust-and-flexibility-in-interactions-between-android-apps/">https://guardianproject.info/2014/01/21/improving-trust-and-flexibility-in-interactions-between-android-apps/</a></li> <li><a href="https://developer.android.com/guide/topics/manifest/permission-element.html#plevel">https://developer.android.com/guide/topics/manifest/permission-element.html#plevel</a></li> </ul> <h2 id="downloads">Downloads</h2> <div class="gradle-line"> <p> The binary jar, source jar, and javadoc jar are all available on jcenter. To include them using gradle, add this line to your <i>build.gradle</i>: </p> <pre style="text-align: center;">implementation &#39;info.guardianproject.trustedintents:trustedintents:%!s(&lt;nil&gt;)&#39;</pre> <p>Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:</p> <ul> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/trustedintents/trustedintents/%25!s%28%3cnil%3e%29/trustedintents-%25!s%28%3cnil%3e%29.jar">trustedintents-%!s(&lt;nil&gt;).jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/trustedintents/trustedintents/%25!s%28%3cnil%3e%29/trustedintents-%25!s%28%3cnil%3e%29.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/trustedintents/trustedintents/%25!s%28%3cnil%3e%29/trustedintents-%25!s%28%3cnil%3e%29-sources.jar">trustedintents-%!s(&lt;nil&gt;)-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/trustedintents/trustedintents/%25!s%28%3cnil%3e%29/trustedintents-%25!s%28%3cnil%3e%29-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/trustedintents/trustedintents/%25!s%28%3cnil%3e%29/trustedintents-%25!s%28%3cnil%3e%29-javadoc.jar">trustedintents-%!s(&lt;nil&gt;)-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/trustedintents/trustedintents/%25!s%28%3cnil%3e%29/trustedintents-%25!s%28%3cnil%3e%29-javadoc.jar.asc"><i>PGP signature</i></a>)</li> </ul> </div> <h2 id="license">License</h2> <p>This library is licensed under the LGPLv2.1. We believe this is compatible with all reasonable uses, including proprietary software, but let us know if it provides difficulties for you. For more info on how that works with Java, see:</p> <p><a href="https://www.gnu.org/licenses/lgpl-java.en.html">https://www.gnu.org/licenses/lgpl-java.en.html</a></p> https://guardianproject.info/2014/06/09/our-first-deterministic-build-lil-debi-0.4.7/ Mon, 09 Jun 2014 16:41:34 -0400 https://guardianproject.info/2014/06/09/our-first-deterministic-build-lil-debi-0.4.7/ <p><a href="http://abyss.uoregon.edu/~js/ast123/lectures/lec05.html"><img src="https://guardianproject.info/wp-content/uploads/2014/06/determinism.gif" alt="determinism" width="206" height="138" class="alignright size-thumbnail wp-image-12493" /></a></p> <p>We just released Lil’ Debi 0.4.7 into the <a href="https://play.google.com/store/apps/details?id=info.guardianproject.lildebi" target="_blank">Play Store</a> and <a href="https://f-droid.org/repository/browse/?fdid=info.guardianproject.lildebi" target="_blank">f-droid.org</a>. It is not really different than the 0.4.6 release except in has a new, important property: the APK contents can be reproduced on other machines to the extent that the APK signature can be swapped between the official build and builds that other people have made from source, and this will still be installable. This is known as a “deterministic build” or “reproducible build”: the build process is deterministic, meaning it runs the same way each time, and that results in an APK that is reproducible by others using only the source code. There are some limitations to this, like it has to be built using similar versions of the OpenJDK 1.7 and other build tools, for example. But this process should work on any recent version of Debian or Ubuntu. Please try the process yourself, and let us know if you can verify or not:</p> <ul> <li><a href="https://github.com/guardianproject/lildebi/wiki/Deterministic-Builds" target="_blank"><a href="https://github.com/guardianproject/lildebi/wiki/Deterministic-Builds">https://github.com/guardianproject/lildebi/wiki/Deterministic-Builds</a></a></li> </ul> <p>The ultimate goal here is to make a process that reproduces the APK exactly, bit-for-bit, so that the anyone who runs the process will end up with an APK that has the exact same hash sum. As far as I can tell, the only thing that needs to be fixed in Lil’ Debi’s process is the timestamps in the ZIP format that is the APK container.</p> <p>There are a number of other parallel efforts. The Tor Project has written a lot about <a href="https://blog.torproject.org/category/tags/deterministic-builds" target="_blank">their process for reproducible builds for the Tor Browser Bundle</a>. Debian has made some progress in <a href="https://wiki.debian.org/ReproducibleBuilds" target="_blank">fixing the package builders to make the process deterministic</a>.</p> https://guardianproject.info/2014/06/07/orbot-now-at-v14.0.0-build-100/ Sat, 07 Jun 2014 23:45:17 -0400 https://guardianproject.info/2014/06/07/orbot-now-at-v14.0.0-build-100/ <p>The latest Orbot is out soon on Google Play, and by direct download from the link below:<br /> Android APK: <a href="https://guardianproject.info/releases/orbot-latest.apk">https://guardianproject.info/releases/orbot-latest.apk</a><br /> (<a href="https://guardianproject.info/releases/orbot-latest.apk.asc">PGP Sig</a>)</p> <p>The major improvements for this release are:</p> <ul> <li>Uses the latest Tor 0.2.42.22 stable version</li> <li>Fix for recent OpenSSL vulnerabilities</li> <li>Addition of Obfuscated Bridges 3 (Obfs3) support</li> <li>Switch from Privoxy to Polipo (semi-experimental)</li> </ul> <p>and much more… see the CHANGELOG link below for all the details.</ul></p> <p>The tag commit message was “updating to 14.0.0 build 100!”<br /> <a href="https://gitweb.torproject.org/orbot.git/commit/81bd61764c2c300bd1ba1e4de5b03350455470c1">https://gitweb.torproject.org/orbot.git/commit/81bd61764c2c300bd1ba1e4de5b03350455470c1<br /> </a><br /> and the full CHANGELOG is here: <a href="https://gitweb.torproject.org/orbot.git/blob_plain/81bd61764c2c300bd1ba1e4de5b03350455470c1:/CHANGELOG">https://gitweb.torproject.org/orbot.git/blob_plain/81bd61764c2c300bd1ba1e4de5b03350455470c1:/CHANGELOG</a></p> https://guardianproject.info/2014/06/06/automatic-private-distribution-of-our-test-builds/ Fri, 06 Jun 2014 17:17:01 -0400 https://guardianproject.info/2014/06/06/automatic-private-distribution-of-our-test-builds/ <p>One thing we are very lucky to have is a good community of people willing to test out unfinished builds of our software. That is a very valuable contribution to the process of developing usable, secure apps. So we want to make this process as easy as possible while keeping it as secure and private as possible. To that end, we have set up an <a href="https://f-droid.org" target="_blank">FDroid</a> repository of apps generated from the test builds that our build server generates automatically every time we publish new code.</p> <p>After this big burst of development focused on FDroid, it has become clear that FDroid has lots of promise for becoming a complete solution for the whole process of delivering software from developers to users. We have tried other ways of delivering test builds like HockeyApp and Google Play’s Alpha and Beta channels and have found them lacking. The process did not seem as easy as it should be. And of course, both of them leave a lot to be desired when it comes to privacy of the users. So this is the first step in hopefully a much bigger project.</p> <p>To use our new test build service, first install FDroid by downloading it from the official source: <a href="https://f-droid.org">https://f-droid.org</a>. Then using a QR Code scanner like <a href="https://play.google.com/store/apps/details?id=com.google.zxing.client.android" target="_blank">Barcode Scanner</a>, just scan the QR Code below, and send it to FDroid <strong>Repositories</strong>. You can also browse to this page on your Android device, and click the link below to add it to FDroid:</p> <ul> <li><a href="https://dev.guardianproject.info/fdroid/repo?fingerprint=F8ED4C73C125E7A67F99DB269480DAF50BE1758952E07EE5ABF116FE4B2DB1E8">https://dev.guardianproject.info/fdroid/repo</a></li> </ul> <p><a href="https://dev.guardianproject.info/fdroid/repo?fingerprint=F8ED4C73C125E7A67F99DB269480DAF50BE1758952E07EE5ABF116FE4B2DB1E8"><img src="https://guardianproject.info/wp-content/uploads/2014/06/dev.guardianproject.info-QR-e1402010770323.png" alt="dev.guardianproject.info" width="245" height="245" class="aligncenter size-full wp-image-12462" /></a></p> <p>You can also use our test repo via an anonymized connection using the Tor Hidden Service (as of this moment, that means downloading an <a href="https://f-droid.org/repo/org.fdroid.fdroid_710.apk">official FDroid v0.71 build</a>). Just get <a href="https://play.google.com/store/apps/details?id=org.torproject.android" target="_blank">Orbot</a> and turn it on, and the following .onion address will automatically work in FDroid, as long as you have a new enough version (0.69 or later).</p> <ul> <li><a href="http://k6e4p7yji2rioxbm.onion/fdroid/repo?fingerprint=F8ED4C73C125E7A67F99DB269480DAF50BE1758952E07EE5ABF116FE4B2DB1E8">http://k6e4p7yji2rioxbm.onion/fdroid/repo</a></li> </ul> <p><a href="http://k6e4p7yji2rioxbm.onion/fdroid/repo?fingerprint=F8ED4C73C125E7A67F99DB269480DAF50BE1758952E07EE5ABF116FE4B2DB1E8"><img src="https://guardianproject.info/wp-content/uploads/2014/06/k6e4p7yji2rioxbm.onion-QR-e1402010779963.png" alt="k6e4p7yji2rioxbm.onion" width="245" height="245" class="aligncenter size-full wp-image-12463" /></a></p> https://guardianproject.info/2014/06/04/reset-the-net/ Wed, 04 Jun 2014 19:07:14 -0400 https://guardianproject.info/2014/06/04/reset-the-net/ <p>We’re making the Internet more secure, by taking part in #ResetTheNet <a href="https://resetthenet.org">https://resetthenet.org</a></p> https://guardianproject.info/archive/courier/ Mon, 12 May 2014 09:59:18 -0400 https://guardianproject.info/archive/courier/ <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/feature.jpg"><img class="alignnone wp-image-12379 size-full" src="https://guardianproject.info/wp-content/uploads/2014/05/feature.jpg" alt="feature" width="1024" height="500" srcset="https://guardianproject.info/wp-content/uploads/2014/05/feature.jpg 1024w, https://guardianproject.info/wp-content/uploads/2014/05/feature-300x146.jpg 300w, https://guardianproject.info/wp-content/uploads/2014/05/feature-100x48.jpg 100w, https://guardianproject.info/wp-content/uploads/2014/05/feature-150x73.jpg 150w, https://guardianproject.info/wp-content/uploads/2014/05/feature-200x97.jpg 200w, https://guardianproject.info/wp-content/uploads/2014/05/feature-450x219.jpg 450w, https://guardianproject.info/wp-content/uploads/2014/05/feature-600x292.jpg 600w, https://guardianproject.info/wp-content/uploads/2014/05/feature-900x439.jpg 900w" sizes="(max-width: 1024px) 100vw, 1024px" /></a></p> <p>★★★ BETA: THIS IS A BETA RELEASE&hellip;. PLEASE <a href="https://dev.guardianproject.info/projects/secure-reader/issues">REPORT BUGS HERE</a> or <a href="https://okthanks.typeform.com/to/tXYKpF">GIVE US SOME FEEDBACK</a>★★★</p> <p>**Courier is a mobile news reader with enhanced security features, offline reading and device-to-device sharing capability.  We&rsquo;ve designed it to be fast and light on slow networks and secured from device and network monitoring.<br /> **</p> <div style="padding: 3px; background: #eeeeee;"> <strong> Download: <a href="https://guardianproject.info/releases/courier-latest.apk">Direct APK File</a> or <a href="https://play.google.com/store/apps/details?id=info.guardianproject.courier">Google Play</a><br /> Source Code: <a href="https://github.com/guardianproject/securereader">Courier App</a> or <a href="https://github.com/guardianproject/securereaderlibrary">Secure Reader Library (Make Your Own Reader!)</a><br /> Bug Reports: <a href="https://dev.guardianproject.info/projects/secure-reader/">Secure Reader Project</a> or <a href="https://github.com/guardianproject/securereader/issues">Github Issues</a><br />User Feedback Survey: <a href="https://okthanks.typeform.com/to/tXYKpF">https://okthanks.typeform.com/to/tXYKpF</a></strong> </div> <p>FEATURES:</p> <p>★ SECURE: Courier works with <a href="https://guardianproject.info/apps/orbot">Orbot, Tor for Android</a> to defend against network surveillance and protect your privacy<br /> ★ ENCRYPTED: Courier encrypts your stored news - and personal information - to protect your privacy<br /> ★ PANIC: Courier&rsquo;s configurable &ldquo;panic&rdquo; action will remove your news, your personal data and optionally the app itself with one swipe<br /> ★ SAFE: Courier securely caches your password with a configurable timeout. You can configure for repeated password entry failures to trigger data (and app!) deletion.  And you can set a special &ldquo;kill password&rdquo;.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1.png"><img class="alignleft size-medium wp-image-12422" src="https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-177x300.png" alt="05_p_tor" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed.png"><img class="alignleft size-medium wp-image-12423" src="https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-177x300.png" alt="06_p_feed" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic.png"><img class="alignleft size-medium wp-image-12424" src="https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-177x300.png" alt="07_p_panic" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1.png"><img class="size-medium wp-image-12425" src="https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-177x300.png" alt="08_p_stories_received" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p>&nbsp;</p> <p>★ AUTOMATIC: Courier quietly synchronizes your feeds in the background (manual mode available, too!)<br /> ★ CONTENT SHARE: secure, off-network, sharing of news articles with other users of Courier via Bluetooth (unsecure share available, too!)<br /> ★ PEER-TO-PEER APP SHARING: Get your friends set up with Courier by sharing the app over a common WiFi network or hotspot.<br /> ★ LIGHTWEIGHT: configure Courier to minimize network data use on low-speed networks or sync only on wi-fi</p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/01_p_story.png"><img class="alignleft size-medium wp-image-12409" src="https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-177x300.png" alt="01_p_story" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/02_story_r.png"><img class="alignleft size-medium wp-image-12410" src="https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-177x300.png" alt="02_story_r" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/03_story_t.png"><img class="alignleft size-medium wp-image-12411" src="https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-177x300.png" alt="03_story_t" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2.png"><img class="size-medium wp-image-12412" src="https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-177x300.png" alt="04_p_menu" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p>&nbsp;</p> <p>★ FAVORITES: mark articles as easily-retrieved favorites<br /> ★ PRE-CONFIGURED: Courier ships with desirable international news feeds, and it&rsquo;s easy to add your own<br /> ★ LANGUAGES: English, Chinese (中國的), Tibetan (བོད་ཡིག), Ukrainian (Український), Russian (русский)<br /> ★ AD-FREE: Courier is an ad-free, open-source application</p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l.png"><img class="alignleft size-medium wp-image-12386" src="https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-300x199.png" alt="10_tablet_story-l" width="300" height="199" srcset="https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-300x199.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-1024x682.png 1024w, https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-100x66.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-150x99.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-200x133.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-450x299.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-600x399.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-900x599.png 900w" sizes="(max-width: 300px) 100vw, 300px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed.png"><img class="alignleft size-medium wp-image-12387" src="https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-300x199.png" alt="11_tablet_feed" width="300" height="199" srcset="https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-300x199.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-1024x682.png 1024w, https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-100x66.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-150x99.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-200x133.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-450x299.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-600x399.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-900x599.png 900w" sizes="(max-width: 300px) 100vw, 300px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w.jpg"><img class="alignleft size-full wp-image-12435" src="https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w.jpg" alt="infographic-4_900w" width="900" height="2231" srcset="https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w.jpg 900w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-121x300.jpg 121w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-413x1024.jpg 413w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-100x247.jpg 100w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-150x371.jpg 150w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-200x495.jpg 200w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-300x743.jpg 300w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-450x1115.jpg 450w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-600x1487.jpg 600w" sizes="(max-width: 900px) 100vw, 900px" /></a></p> https://guardianproject.info/archive/courier/ Mon, 12 May 2014 09:59:18 -0400 https://guardianproject.info/archive/courier/ <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/feature.jpg"><img class="alignnone wp-image-12379 size-full" src="https://guardianproject.info/wp-content/uploads/2014/05/feature.jpg" alt="feature" width="1024" height="500" srcset="https://guardianproject.info/wp-content/uploads/2014/05/feature.jpg 1024w, https://guardianproject.info/wp-content/uploads/2014/05/feature-300x146.jpg 300w, https://guardianproject.info/wp-content/uploads/2014/05/feature-100x48.jpg 100w, https://guardianproject.info/wp-content/uploads/2014/05/feature-150x73.jpg 150w, https://guardianproject.info/wp-content/uploads/2014/05/feature-200x97.jpg 200w, https://guardianproject.info/wp-content/uploads/2014/05/feature-450x219.jpg 450w, https://guardianproject.info/wp-content/uploads/2014/05/feature-600x292.jpg 600w, https://guardianproject.info/wp-content/uploads/2014/05/feature-900x439.jpg 900w" sizes="(max-width: 1024px) 100vw, 1024px" /></a></p> <p>★★★ BETA: THIS IS A BETA RELEASE&hellip;. PLEASE <a href="https://dev.guardianproject.info/projects/secure-reader/issues">REPORT BUGS HERE</a> or <a href="https://okthanks.typeform.com/to/tXYKpF">GIVE US SOME FEEDBACK</a>★★★</p> <p>**Courier is a mobile news reader with enhanced security features, offline reading and device-to-device sharing capability.  We&rsquo;ve designed it to be fast and light on slow networks and secured from device and network monitoring.<br /> **</p> <div style="padding: 3px; background: #eeeeee;"> <strong> Download: <a href="https://guardianproject.info/releases/courier-latest.apk">Direct APK File</a> or <a href="https://play.google.com/store/apps/details?id=info.guardianproject.courier">Google Play</a><br /> Source Code: <a href="https://github.com/guardianproject/securereader">Courier App</a> or <a href="https://github.com/guardianproject/securereaderlibrary">Secure Reader Library (Make Your Own Reader!)</a><br /> Bug Reports: <a href="https://dev.guardianproject.info/projects/secure-reader/">Secure Reader Project</a> or <a href="https://github.com/guardianproject/securereader/issues">Github Issues</a><br />User Feedback Survey: <a href="https://okthanks.typeform.com/to/tXYKpF">https://okthanks.typeform.com/to/tXYKpF</a></strong> </div> <p>FEATURES:</p> <p>★ SECURE: Courier works with <a href="https://guardianproject.info/apps/orbot">Orbot, Tor for Android</a> to defend against network surveillance and protect your privacy<br /> ★ ENCRYPTED: Courier encrypts your stored news - and personal information - to protect your privacy<br /> ★ PANIC: Courier&rsquo;s configurable &ldquo;panic&rdquo; action will remove your news, your personal data and optionally the app itself with one swipe<br /> ★ SAFE: Courier securely caches your password with a configurable timeout. You can configure for repeated password entry failures to trigger data (and app!) deletion.  And you can set a special &ldquo;kill password&rdquo;.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1.png"><img class="alignleft size-medium wp-image-12422" src="https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-177x300.png" alt="05_p_tor" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/05_p_tor1.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed.png"><img class="alignleft size-medium wp-image-12423" src="https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-177x300.png" alt="06_p_feed" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/06_p_feed.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic.png"><img class="alignleft size-medium wp-image-12424" src="https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-177x300.png" alt="07_p_panic" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/07_p_panic.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1.png"><img class="size-medium wp-image-12425" src="https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-177x300.png" alt="08_p_stories_received" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/08_p_stories_received1.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p>&nbsp;</p> <p>★ AUTOMATIC: Courier quietly synchronizes your feeds in the background (manual mode available, too!)<br /> ★ CONTENT SHARE: secure, off-network, sharing of news articles with other users of Courier via Bluetooth (unsecure share available, too!)<br /> ★ PEER-TO-PEER APP SHARING: Get your friends set up with Courier by sharing the app over a common WiFi network or hotspot.<br /> ★ LIGHTWEIGHT: configure Courier to minimize network data use on low-speed networks or sync only on wi-fi</p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/01_p_story.png"><img class="alignleft size-medium wp-image-12409" src="https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-177x300.png" alt="01_p_story" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/01_p_story.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/02_story_r.png"><img class="alignleft size-medium wp-image-12410" src="https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-177x300.png" alt="02_story_r" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/02_story_r.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/03_story_t.png"><img class="alignleft size-medium wp-image-12411" src="https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-177x300.png" alt="03_story_t" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/03_story_t.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2.png"><img class="size-medium wp-image-12412" src="https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-177x300.png" alt="04_p_menu" width="177" height="300" srcset="https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-177x300.png 177w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-605x1024.png 605w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-100x169.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-150x253.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-200x338.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-300x507.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-450x761.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2-600x1014.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/04_p_menu2.png 845w" sizes="(max-width: 177px) 100vw, 177px" /></a></p> <p>&nbsp;</p> <p>★ FAVORITES: mark articles as easily-retrieved favorites<br /> ★ PRE-CONFIGURED: Courier ships with desirable international news feeds, and it&rsquo;s easy to add your own<br /> ★ LANGUAGES: English, Chinese (中國的), Tibetan (བོད་ཡིག), Ukrainian (Український), Russian (русский)<br /> ★ AD-FREE: Courier is an ad-free, open-source application</p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l.png"><img class="alignleft size-medium wp-image-12386" src="https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-300x199.png" alt="10_tablet_story-l" width="300" height="199" srcset="https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-300x199.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-1024x682.png 1024w, https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-100x66.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-150x99.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-200x133.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-450x299.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-600x399.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/10_tablet_story-l-900x599.png 900w" sizes="(max-width: 300px) 100vw, 300px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed.png"><img class="alignleft size-medium wp-image-12387" src="https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-300x199.png" alt="11_tablet_feed" width="300" height="199" srcset="https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-300x199.png 300w, https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-1024x682.png 1024w, https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-100x66.png 100w, https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-150x99.png 150w, https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-200x133.png 200w, https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-450x299.png 450w, https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-600x399.png 600w, https://guardianproject.info/wp-content/uploads/2014/05/11_tablet_feed-900x599.png 900w" sizes="(max-width: 300px) 100vw, 300px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w.jpg"><img class="alignleft size-full wp-image-12435" src="https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w.jpg" alt="infographic-4_900w" width="900" height="2231" srcset="https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w.jpg 900w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-121x300.jpg 121w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-413x1024.jpg 413w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-100x247.jpg 100w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-150x371.jpg 150w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-200x495.jpg 200w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-300x743.jpg 300w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-450x1115.jpg 450w, https://guardianproject.info/wp-content/uploads/2014/05/infographic-4_900w-600x1487.jpg 600w" sizes="(max-width: 900px) 100vw, 900px" /></a></p> https://guardianproject.info/2014/03/28/security-in-a-thumb-drive-the-promise-and-pain-of-hardware-security-modules-take-one/ Fri, 28 Mar 2014 16:54:39 -0400 https://guardianproject.info/2014/03/28/security-in-a-thumb-drive-the-promise-and-pain-of-hardware-security-modules-take-one/ <p><a href="https://guardianproject.info/wp-content/uploads/2014/03/cryptostick-usb-flash-drive-security-software.jpg"><img src="https://guardianproject.info/wp-content/uploads/2014/03/cryptostick-usb-flash-drive-security-software.jpg" alt="security in a thumb drive" width="219" height="119" class="alignleft size-full wp-image-12311" srcset="https://guardianproject.info/wp-content/uploads/2014/03/cryptostick-usb-flash-drive-security-software.jpg 219w, https://guardianproject.info/wp-content/uploads/2014/03/cryptostick-usb-flash-drive-security-software-100x54.jpg 100w, https://guardianproject.info/wp-content/uploads/2014/03/cryptostick-usb-flash-drive-security-software-150x81.jpg 150w, https://guardianproject.info/wp-content/uploads/2014/03/cryptostick-usb-flash-drive-security-software-200x108.jpg 200w" sizes="(max-width: 219px) 100vw, 219px" /></a>Hardware Security Modules (aka Smartcards, chipcards, etc) provide a secure way to store and use cryptographic keys, while actually making the whole process a bit easier. In theory, one USB thumb drive like thing could manage all of the crypto keys you use in a way that makes them much harder to steal. That is the promise. The reality is that the world of Hardware Security Modules (HSMs) is a massive, scary minefield of endless technical gotchas, byzantine standards (PKCS#11!), technobabble, and incompatibilities. Before I dive too much into ranting about the days of my life wasted trying to find a clear path through this minefield, I’m going to tell you about one path I did find through to solve a key piece of the puzzle: Android and Java package signing.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/03/moreinfo_acr38t_ibs.jpg"><img src="https://guardianproject.info/wp-content/uploads/2014/03/moreinfo_acr38t_ibs.jpg" alt="ACS ACR38-T-IBS" width="320" height="248" class="alignright size-full wp-image-12313" srcset="https://guardianproject.info/wp-content/uploads/2014/03/moreinfo_acr38t_ibs.jpg 320w, https://guardianproject.info/wp-content/uploads/2014/03/moreinfo_acr38t_ibs-300x232.jpg 300w, https://guardianproject.info/wp-content/uploads/2014/03/moreinfo_acr38t_ibs-100x77.jpg 100w, https://guardianproject.info/wp-content/uploads/2014/03/moreinfo_acr38t_ibs-150x116.jpg 150w, https://guardianproject.info/wp-content/uploads/2014/03/moreinfo_acr38t_ibs-200x155.jpg 200w" sizes="(max-width: 320px) 100vw, 320px" /></a>For this round, I am covering the <a href="http://www.aventra.fi/English/products_MyEID_E.html" target="_blank">Aventra MyEID PKI Card</a>. I bought a SIM-sized version to fit into an <a href="http://www.smartcardfocus.com/ilp/id~99/ACR38T_IBS/p/readers.shtml" target="_blank">ACS ACR38T-IBS-R</a> smartcard reader (it is apparently no longer made, and the <a href="http://acs.com.hk/en/products/1/acr38t-d1-plug-in-sim-sized-card-reader/" target="_blank">ACT38T-D1</a> is meant to replace it). Why such specificity you may ask? Because you have to be sure that your smartcard will work with your reader, and that your reader will have a working driver for you system, and that your smartcard will have a working PKCS#11 driver so that software can talk to the smartcard. Thankfully there is the <a href="https://github.com/OpenSC/OpenSC/wiki" target="_blank">OpenSC</a> project to cover the PKCS#11 part, it implements the PKCS#11 communications standard for many smartcards. On my Ubuntu/precise system, I had to install an extra driver, <code>libacr38u</code>, to get the ACR38T reader to show up on my system.</p> <p>So let’s start there and get this thing to show up! First we need some packages. The OpenSC packages are out-of-date in a lot of releases, you need version 0.13.0-4 or newer, so you have to add our PPA (Personal Package Archive) to get current versions, which include a <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742089" target="_blank">specific fix for the Aventra MyEID</a>: (fingerprint: <code>F50E ADDD 2234 F563</code>):</p> <pre><code>sudo add-apt-repository ppa:guardianproject/ppa sudo apt-get update sudo apt-get install opensc libacr38u libacsccid1 pcsc-tools usbutils </code></pre> <p>First thing, I use <code>lsusb</code> in the terminal to see what USB devices the Linux kernel sees, and thankfully it sees my reader:</p> <pre><code class="language-console">$ lsusb Bus 005 Device 013: ID 072f:9000 Advanced Card Systems, Ltd ACR38 AC1038-based Smart Card Reader </code></pre> <p>Next, its time to try <code>pcsc_scan</code> to see if the system can see the smartcard installed in the reader. If everything is installed and in order, then <code>pcsc_scan</code> will report this:</p> <pre><code class="language-console">$ pcsc_scan PC/SC device scanner V 1.4.18 (c) 2001-2011, Ludovic Rousseau &lt;&amp;#x6c;u&amp;#x64;ov&amp;#x69;c.&amp;#x72;o&amp;#x75;&amp;#x73;s&amp;#x65;au&amp;#x40;f&amp;#x72;&amp;#x65;e&amp;#x2e;fr&gt; Compiled with PC/SC lite version: 1.7.4 Using reader plug'n play mechanism Scanning present readers... 0: ACS ACR38U 00 00 Thu Mar 27 14:38:36 2014 Reader 0: ACS ACR38U 00 00 Card state: Card inserted, ATR: 3B F5 18 00 00 81 31 FE 45 4D 79 45 49 44 9A [snip] </code></pre> <p>If <code>pcsc_scan</code> cannot see the card, then things will not work. Try re-seating the smardcard in the reader, make sure you have all the right packages installed, and if you can see the reader in <code>lsusb</code>. If your smartcard or reader cannot be read, then <code>pcsc_scan</code> will report something like this:</p> <pre><code class="language-console">$ pcsc_scan PC/SC device scanner V 1.4.18 (c) 2001-2011, Ludovic Rousseau &lt;&amp;#x6c;&amp;#x75;&amp;#x64;&amp;#x6f;&amp;#x76;&amp;#x69;c.rousse&amp;#x61;&amp;#x75;&amp;#x40;&amp;#x66;&amp;#x72;&amp;#x65;e.fr&gt; Compiled with PC/SC lite version: 1.7.4 Using reader plug'n play mechanism Scanning present readers... Waiting for the first reader... </code></pre> <p>Moving right along… now <code>pcscd</code> can see the smartcard, so we can start playing with using the OpenSC tools. These are needed to setup the card, put PINs on it for access control, and upload keys and certificates to it. The last annoying little preparation tasks are finding where <code>opensc-pkcs11.so</code> is installed and the “slot” for the signing key in the card. These will go into a config file which <code>keytool</code> and <code>jarsigner</code> need. To get this info on Debian/Ubuntu/etc, run these:</p> <pre><code class="language-console">$ dpkg -S opensc-pkcs11.so opensc: /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so $ pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so \ &gt; --list-slots Available slots: Slot 0 (0xffffffffffffffff): Virtual hotplug slot (empty) Slot 1 (0x1): ACS ACR38U 00 00 token label : MyEID (signing) token manufacturer : Aventra Ltd. token model : PKCS#15 token flags : rng, login required, PIN initialized, token initialized hardware version : 0.0 firmware version : 0.0 serial num : 0106004065952228 </code></pre> <p>This is the info needed to put into a <code>opensc-java.cfg</code>, which <code>keytool</code> and <code>jarsigner</code> <a href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/p11guide.html" target="_blank">need in order to talk</a> to the Aventra HSM. The name, library, and slot fields are essential, and the description is helpful. Here is how the <code>opensc-java.cfg</code> using the above information looks:</p> <pre><code class="language-console">name = OpenSC description = SunPKCS11 w/ OpenSC Smart card Framework library = /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so slot = 1 </code></pre> <p>Now everything should be ready for initializing the HSM, generating a new key, and uploading that key to the HSM. This process generates the key and certificate, puts them into files, then uploads them to the HSM. That means you should only run this process on a trusted machine, certainly with some kind of disk encryption, and preferably on a machine that is not connected to a network, running an OS that has never been connected to the internet. A live CD is one good example, I recommend <a href="https://tails.boum.org/download/index.en.html#index4h1" target="_blank">Tails on a USB thumb drive</a> running with the <a href="https://tails.boum.org/doc/first_steps/persistence/index.en.html" target="_blank">secure persistent store</a> on it (we have been working here and there on making a TAILS-based distro specifically for managing keys, we call it <a href="https://dev.guardianproject.info/projects/psst/wiki/CleanRoom" target="_blank">CleanRoom</a>).</p> <div id="attachment_12321" style="width: 560px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2014/03/cstick2.jpg"><img aria-describedby="caption-attachment-12321" src="https://guardianproject.info/wp-content/uploads/2014/03/cstick2-1024x805.jpg" alt="HSM plugged into a laptop" width="550" height="432" class="size-large wp-image-12321" srcset="https://guardianproject.info/wp-content/uploads/2014/03/cstick2-1024x805.jpg 1024w, https://guardianproject.info/wp-content/uploads/2014/03/cstick2-300x235.jpg 300w, https://guardianproject.info/wp-content/uploads/2014/03/cstick2-100x78.jpg 100w, https://guardianproject.info/wp-content/uploads/2014/03/cstick2-150x117.jpg 150w, https://guardianproject.info/wp-content/uploads/2014/03/cstick2-200x157.jpg 200w, https://guardianproject.info/wp-content/uploads/2014/03/cstick2-450x353.jpg 450w, https://guardianproject.info/wp-content/uploads/2014/03/cstick2-600x471.jpg 600w, https://guardianproject.info/wp-content/uploads/2014/03/cstick2-900x707.jpg 900w, https://guardianproject.info/wp-content/uploads/2014/03/cstick2.jpg 1600w" sizes="(max-width: 550px) 100vw, 550px" /></a> <p id="caption-attachment-12321" class="wp-caption-text"> HSM plugged into a laptop </p> </div> <p>First off, the HSM needs to be initialized, then set up with a signing PIN and a “Security Officer” PIN (which means basically an “admin” or “root” PIN). The signing PIN is the one you will use for signing APKs, the “Security Officer PIN” (SO-PIN) is used for modifying the HSM setup, like uploading new keys, etc. Because there are so many steps in the process, I’ve written up scripts to run thru all of the steps. If you want to see the details, <a href="https://github.com/guardianproject/smartcard-apk-signing/blob/master/Aventra_MyEID_Setup/setup.sh" target="_blank">read</a> <a href="https://github.com/guardianproject/smartcard-apk-signing/blob/master/openssl-gen/gen.sh" target="_blank">the</a> <a href="https://github.com/guardianproject/smartcard-apk-signing/blob/master/Aventra_MyEID_Setup/finalize.sh" target="_blank">scripts</a>. The next step is to generate the key using <code>openssl</code> and upload it to the HSM. Then the HSM needs to be “finalized”, which means the PINs are activated, and keys cannot be uploaded. Don’t worry, as long as you have the SO-PIN, you can erase the HSM and re-initialize it. But be careful! Many HSMs will permanently self-destruct if you enter in the wrong PIN too many times, some will do that after only three wrong PINs! As long as you have not finalized the HSM, any PIN will work, so play around a lot with it before finalizing it. Run the init and key upload procedure a few times, try signing an APK, etc. Take note: the script will generate a random password for the secret files, then echo that password when it completes, so make sure no one can see your screen when you generate the real key. Alright, here goes!</p> <pre><code class="language-console">code $ git clone https://github.com/guardianproject/smartcard-apk-signing code $ cd smartcard-apk-signing/Aventra_MyEID_Setup Aventra_MyEID_Setup $ ./setup.sh Edit pkcs15-init-options-file-pins to put in the PINs you want to set: Aventra_MyEID_Setup $ emacs pkcs15-init-options-file-pins Aventra_MyEID_Setup $ ./setup.sh Using reader with a card: ACS ACR38U 00 00 Connecting to card in reader ACS ACR38U 00 00... Using card driver MyEID cards with PKCS#15 applet. About to erase card. PIN [Security Officer PIN] required. Please enter PIN [Security Officer PIN]: Using reader with a card: ACS ACR38U 00 00 Connecting to card in reader ACS ACR38U 00 00... Using card driver MyEID cards with PKCS#15 applet. About to create PKCS #15 meta structure. Using reader with a card: ACS ACR38U 00 00 Connecting to card in reader ACS ACR38U 00 00... Using card driver MyEID cards with PKCS#15 applet. Found MyEID About to generate key. Using reader with a card: ACS ACR38U 00 00 Connecting to card in reader ACS ACR38U 00 00... Using card driver MyEID cards with PKCS#15 applet. Found MyEID About to generate key. next generate a key with ./gen.sh then ./finalize.sh Aventra_MyEID_Setup $ cd ../openssl-gen/ openssl-gen $ ./gen.sh Usage: ./gen.sh &quot;CertDName&quot; [4096] for example: &quot;/C=US/ST=New York/O=Guardian Project &amp;#x54;e&amp;#x73;&amp;#x74;/&amp;#x43;N=&amp;#x74;es&amp;#x74;.&amp;#x67;&amp;#x75;a&amp;#x72;di&amp;#x61;np&amp;#x72;o&amp;#x6a;&amp;#x65;c&amp;#x74;&amp;#x2e;i&amp;#x6e;fo&amp;#x2f;em&amp;#x61;i&amp;#x6c;&amp;#x41;d&amp;#x64;re&amp;#x73;s=&amp;#x74;e&amp;#x73;&amp;#x74;@&amp;#x67;&amp;#x75;a&amp;#x72;di&amp;#x61;np&amp;#x72;o&amp;#x6a;&amp;#x65;c&amp;#x74;.i&amp;#x6e;fo&quot; openssl-gen $ ./gen.sh &quot;/C=US/ST=New York/O=Guardian Project Te&amp;#x73;t&amp;#x2f;C&amp;#x4e;=&amp;#x74;e&amp;#x73;t&amp;#x2e;g&amp;#x75;ardi&amp;#x61;n&amp;#x70;r&amp;#x6f;j&amp;#x65;c&amp;#x74;.&amp;#x69;n&amp;#x66;o/em&amp;#x61;i&amp;#x6c;A&amp;#x64;d&amp;#x72;e&amp;#x73;s&amp;#x3d;t&amp;#x65;st&amp;#x40;g&amp;#x75;a&amp;#x72;d&amp;#x69;a&amp;#x6e;p&amp;#x72;o&amp;#x6a;e&amp;#x63;t.&amp;#x69;n&amp;#x66;o&quot; Generating key, be patient... 2048 semi-random bytes loaded Generating RSA private key, 2048 bit long modulus .......................................+++ ..................................................+++ e is 65537 (0x10001) Signature ok subject=/C=US/ST=New York/O=Guardian Project Test/&amp;#x43;&amp;#x4e;&amp;#x3d;&amp;#x74;&amp;#x65;st.gu&amp;#x61;&amp;#x72;&amp;#x64;&amp;#x69;&amp;#x61;nproj&amp;#x65;&amp;#x63;&amp;#x74;&amp;#x2e;&amp;#x69;nfo/e&amp;#x6d;&amp;#x61;&amp;#x69;&amp;#x6c;&amp;#x41;ddres&amp;#x73;&amp;#x3d;&amp;#x74;&amp;#x65;&amp;#x73;t@gua&amp;#x72;&amp;#x64;&amp;#x69;&amp;#x61;&amp;#x6e;proje&amp;#x63;&amp;#x74;&amp;#x2e;&amp;#x69;&amp;#x6e;fo Getting Private key writing RSA key Your HSM will prompt you for 'Security Officer' aka admin PIN, wait for it! Enter destination keystore password: Entry for alias 1 successfully imported. Import command completed: 1 entries successfully imported, 0 entries failed or cancelled [Storing keystore] Key fingerprints for reference: MD5 Fingerprint=90:24:68:F3:F3:22:7D:13:8C:81:11:C3:A4:B6:9A:2F SHA1 Fingerprint=3D:9D:01:C9:28:BD:1F:F4:10:80:FC:02:95:51:39:F4:7D:E7:A9:B1 SHA256 Fingerprint=C6:3A:ED:1A:C7:9D:37:C7:B0:47:44:72:AC:6E:FA:6C:3A:B2:B1:1A:76:7A:4F:42:CF:36:0F:A5:49:6E:3C:50 The public files are: certificate.pem publickey.pem request.pem The secret files are: secretkey.pem certificate.p12 certificate.jkr The passphrase for the secret files is: fTQ*he-[:y+69RS+W&amp;+!*0O5i%n openssl-gen $ cd ../Aventra_MyEID_Setup/ Aventra_MyEID_Setup $ ./finalize.sh Using reader with a card: ACS ACR38U 00 00 Connecting to card in reader ACS ACR38U 00 00... Using card driver MyEID cards with PKCS#15 applet. Found MyEID About to delete object(s). Your HSM is ready for use! Put the secret key files someplace encrypted and safe! </code></pre> <p>Now your HSM should be ready for use for signing. You can try it out with <code>keytool</code> to see what is on it, using the signing PIN not the Security Officer PIN:</p> <pre><code>smartcard-apk-signing $ /usr/bin/keytool -v \ &gt; -providerClass sun.security.pkcs11.SunPKCS11 \ &gt; -providerArg opensc-java.cfg \ &gt; -providerName SunPKCS11-OpenSC -keystore NONE -storetype PKCS11 \ &gt; -list Enter keystore password: Keystore type: PKCS11 Keystore provider: SunPKCS11-OpenSC Your keystore contains 1 entry Alias name: 1 Entry type: PrivateKeyEntry Certificate chain length: 1 Certificate[1]: Owner: &amp;#x45;&amp;#x4d;&amp;#x41;&amp;#x49;&amp;#x4c;&amp;#x41;&amp;#x44;&amp;#x44;RESS=test@g&amp;#x75;&amp;#x61;&amp;#x72;&amp;#x64;&amp;#x69;&amp;#x61;&amp;#x6e;&amp;#x70;&amp;#x72;oject.info, CN=test.guardianproject.info, O=Guardian Project Test, ST=New York, C=US Issuer: E&amp;#x4d;A&amp;#x49;LA&amp;#x44;D&amp;#x52;ES&amp;#x53;=&amp;#x74;e&amp;#x73;&amp;#x74;@&amp;#x67;u&amp;#x61;rd&amp;#x69;a&amp;#x6e;pr&amp;#x6f;j&amp;#x65;ct&amp;#x2e;i&amp;#x6e;f&amp;#x6f;, CN=test.guardianproject.info, O=Guardian Project Test, ST=New York, C=US Serial number: aa6887be1ec84bde Valid from: Fri Mar 28 16:41:26 EDT 2014 until: Mon Aug 12 16:41:26 EDT 2041 Certificate fingerprints: MD5: 90:24:68:F3:F3:22:7D:13:8C:81:11:C3:A4:B6:9A:2F SHA1: 3D:9D:01:C9:28:BD:1F:F4:10:80:FC:02:95:51:39:F4:7D:E7:A9:B1 SHA256: C6:3A:ED:1A:C7:9D:37:C7:B0:47:44:72:AC:6E:FA:6C:3A:B2:B1:1A:76:7A:4F:42:CF:36:0F:A5:49:6E:3C:50 Signature algorithm name: SHA1withRSA Version: 1 ******************************************* ******************************************* </code></pre> <p>And let’s try signing an actual APK using the <a href="https://developer.android.com/tools/publishing/app-signing.html" target="_blank">arguments that Google recommends</a>, again, using the signing PIN:</p> <pre><code class="language-console">smartcard-apk-signing $ /usr/bin/jarsigner -verbose \ &gt; -providerClass sun.security.pkcs11.SunPKCS11 \ &gt; -providerArg opensc-java.cfg -providerName SunPKCS11-OpenSC \ &gt; -keystore NONE -storetype PKCS11 \ &gt; -sigalg SHA1withRSA -digestalg SHA1 \ &gt; bin/LilDebi-release-unsigned.apk 1 Enter Passphrase for keystore: adding: META-INF/1.SF adding: META-INF/1.RSA signing: assets/busybox signing: assets/complete-debian-setup.sh signing: assets/configure-downloaded-image.sh signing: assets/create-debian-setup.sh signing: assets/debian-archive-keyring.gpg signing: assets/debootstrap.tar.bz2 signing: assets/e2fsck.static signing: assets/gpgv signing: assets/lildebi-common [snip] </code></pre> <p>Now we have a working, but elaborate, process for setting up a Hardware Security Module for signing APKs. Once the HSM is setup, using it should be quite straightforward. Next steps are to work out as many kinks in this process as possible so this will be the default way to sign APKs. That means things like figuring out how <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742831" target="_blank">Java can be pre-configured to use OpenSC in the Debian package</a>, as well as including all <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742089" target="_blank">relevant fixes</a> in the <code>pcscd</code> and <code>opensc</code> packages. Then the ultimate is to add support for using HSMs in Android’s generated build files like the <code>build.xml</code> for <code>ant</code> that is generated by <code>android update project</code>. Then people could just plug in the HSM and run <code>ant release</code> and have a signed APK!</p> https://guardianproject.info/2014/03/10/eric-schmidt-awards-guardian-project-a-new-digital-age-grant/ Mon, 10 Mar 2014 12:22:34 -0400 https://guardianproject.info/2014/03/10/eric-schmidt-awards-guardian-project-a-new-digital-age-grant/ <p>An interesting turn of events (which we are very grateful for!)</p> <p>*<strong>*</strong></p> <p>FOR IMMEDIATE RELEASE<br /> Diana Del Olmo, <a href="mailto&amp;#x3a;d&amp;#x69;a&amp;#x6e;a&amp;#x40;g&amp;#x75;a&amp;#x72;d&amp;#x69;a&amp;#x6e;p&amp;#x72;o&amp;#x6a;e&amp;#x63;t&amp;#x2e;i&amp;#x6e;f&amp;#x6f;">&#x64;ia&#x6e;&#x61;@g&#x75;&#x61;rd&#x69;&#x61;np&#x72;&#x6f;je&#x63;&#x74;.i&#x6e;&#x66;o</a><br /> Nathan Freitas (in Austin / SXSW) +1.718.569.7272<br /> <a href="m&amp;#x61;i&amp;#x6c;&amp;#x74;o&amp;#x3a;n&amp;#x61;&amp;#x74;h&amp;#x61;n&amp;#x40;&amp;#x67;u&amp;#x61;r&amp;#x64;&amp;#x69;a&amp;#x6e;p&amp;#x72;&amp;#x6f;j&amp;#x65;c&amp;#x74;&amp;#x2e;i&amp;#x6e;f&amp;#x6f;">nat&#x68;&#x61;&#x6e;@gua&#x72;&#x64;&#x69;anpr&#x6f;&#x6a;&#x65;ct.&#x69;&#x6e;&#x66;o</a></p> <p>Get press kit and more at: <a href="https://guardianproject.info/press">https://guardianproject.info/press</a></p> <p>Permalink:<br /> <a href="https://docs.google.com/document/d/1kI6dV6nPSd1z3MkxSTMRT8P9DcFQ9uOiNFcUlGTjjXA/edit?usp=sharing">https://docs.google.com/document/d/1kI6dV6nPSd1z3MkxSTMRT8P9DcFQ9uOiNFcUlGTjjXA/edit?usp=sharing</a></p> <p>GOOGLE EXECUTIVE CHAIRMAN ERIC SCHMIDT AWARDS GUARDIAN PROJECT A “NEW DIGITAL AGE” GRANT</p> <p>The Guardian Project is amongst the 10 chosen grantee organizations to be awarded a $100,000 digital age grant due to its extensive work creating open source software to help citizens overcome government-sponsored censorship.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2014/03/eric-schmidt-portr_2546680b.jpg"><img class="size-full wp-image-12288 alignnone" alt="eric-schmidt-portr_2546680b" src="https://guardianproject.info/wp-content/uploads/2014/03/eric-schmidt-portr_2546680b.jpg" width="620" height="387" srcset="https://guardianproject.info/wp-content/uploads/2014/03/eric-schmidt-portr_2546680b.jpg 620w, https://guardianproject.info/wp-content/uploads/2014/03/eric-schmidt-portr_2546680b-300x187.jpg 300w, https://guardianproject.info/wp-content/uploads/2014/03/eric-schmidt-portr_2546680b-100x62.jpg 100w, https://guardianproject.info/wp-content/uploads/2014/03/eric-schmidt-portr_2546680b-150x93.jpg 150w, https://guardianproject.info/wp-content/uploads/2014/03/eric-schmidt-portr_2546680b-200x124.jpg 200w, https://guardianproject.info/wp-content/uploads/2014/03/eric-schmidt-portr_2546680b-450x280.jpg 450w, https://guardianproject.info/wp-content/uploads/2014/03/eric-schmidt-portr_2546680b-600x374.jpg 600w" sizes="(max-width: 620px) 100vw, 620px" /></a><br /> <em><a href="http://www.telegraph.co.uk/technology/internet/10018193/The-New-Digital-Age-by-Eric-Schmidt-and-Jared-Cohen-review.html">image courtesy of the telegraph.co.ok</a></em></p> <p>NEW YORK, NY (March 10, 2014)—Ten non-profits in the U.S. and abroad<br /> have been named recipients of New Digital Age Grants, funded through a<br /> $1 million donation by Google executive chairman Eric Schmidt. The<br /> Guardian Project is one of two New York City-based groups receiving an<br /> award.</pre></p> <p>The New Digital Age Grants were established to highlight organizations<br /> that use technology to counter the global challenges Schmidt and<br /> Google Ideas Director Jared Cohen write about in their book THE NEW<br /> DIGITAL AGE, including government-sponsored censorship, disaster<br /> relief and crime fighting. The book was released in paperback on March 4.</p> <p>“The recipients chosen for the New Digital Age Grants are doing some<br /> very innovative and unique work, and I’m proud to offer them this<br /> encouragement,” said Schmidt. “Five billion people will encounter the<br /> Internet for the first time in the next decade. With this surge in the<br /> use of technology around the world—much of which we in the West take<br /> for granted—I felt it was important to encourage organizations that<br /> are using it to solve some of our most pressing problems.”</p> <p>Guardian Project founder, Nathan Freitas, created the project based on<br /> his first-hand experience working with Tibetan human rights and<br /> independence activists for over ten years. Today, March 10th, is the<br /> 55th anniversary of the Tibetan Uprising Day against Chinese<br /> occupation. “I have seen first hand the toll that online censorship,<br /> mobile surveillance and digital persecution can take on a culture,<br /> people and movement,” said Freitas. “I am elated to know Mr. Schmidt<br /> supports our effort to fight back against these unjust global trends<br /> through the development of free, open-source mobile security<br /> capabilities.”</p> <p>Many of the NDA grantees, such as Aspiration, Citizen Lab and OTI,<br /> already work with the Guardian Project on defending digital rights,<br /> training high-risk user groups and doing core research and development<br /> of anti-censorship and surveillance defense tools and training.</p> <p>The New Digital Age Grants are being funded through a private donation<br /> by Eric and Wendy Schmidt.</p> <p>About the Guardian Project</p> <p>The Guardian Project is a global collective of software developers<br /> (hackers!), designers, advocates, activists and trainers who develop<br /> open source mobile security software and operating system<br /> enhancements. They also create customized mobile devices to help<br /> individuals communicate more freely and protect themselves from<br /> intrusion and monitoring. The effort specifically focuses on users who<br /> live or work in high-risk situations, and who often face constant<br /> surveillance and intrusion attempts into their mobile devices and<br /> communication streams.</p> <p>Since it was founded in 2009, the Guardian Project has developed more<br /> than a dozen mobile apps for Android and iOS with over two million<br /> downloads and hundreds of thousands of active users. In the last five<br /> years the Guardian Project has partnered with prominent open source<br /> software projects, activists groups, NGOs, commercial partners and<br /> news organizations to support their mobile security software<br /> capabilities. This work has been made possible with funding from<br /> Google, UC Berkeley with the MacArthur Foundation, Avaaz, Internews,<br /> Open Technology Fund, WITNESS, the Knight Foundation, Benetech, and<br /> Free Press Unlimited. Through work on partner projects like The Tor<br /> Project, Commotion mesh and StoryMaker, we have received indirect<br /> funding from both the US State Department through the Bureau of<br /> Democracy, Human Rights and Labor Internet Freedom program, and the<br /> Dutch Ministry of Foreign Affairs through HIVOS.</p> <p>The Guardian Project is very grateful for this personal donation and<br /> is happy to have its work recognized by Mr Schmidt. This grant will<br /> allow us to continue our work on ensuring users around the world have<br /> access to secure, open and trustworthy mobile messaging services. We<br /> will continue to improve reliability and security of ChatSecure for<br /> Android and iOS and integrate the OStel voice and video calling<br /> services into the app for a complete secure communications solution.<br /> We will support the work of the new I.M.AWESOME (Instant Messaging<br /> Always Secure Messaging) Coalition focused on open-standards,<br /> decentralized secure mobile messaging, and voice and video<br /> communications. Last, but not least, we will improve device testing,<br /> support and outreach to global human rights defenders, activists and<br /> journalists, bringing the technology that the Guardian Project has<br /> developed to the people that need it most.</p> <p>About the NDA Recipients</p> <p>Aspiration in San Francisco, CA, provides deep mentorship to build<br /> tech capacity supporting Africa, Asia and beyond. Their NDA grant will<br /> grow their capacity-building programs for the Global South, increasing<br /> technical capacity to meet local challenges.</p> <p>C4ADS, a nonprofit research team in Washington, DC, is at the cutting<br /> edge of unmasking Somali pirate networks, Russian arms-smuggling<br /> rings, and other illicit actors entirely through public records. Their<br /> data-driven approach and reliance on public documents has enormous<br /> potential impact, and the grant will help with their next big project.</p> <p>The Citizen Integration Center in Monterrey, Mexico has developed an<br /> innovative public safety broadcast and tipline system on social media.<br /> Users help their neighbors—and the city—by posting incidents and<br /> receiving alerts when violence is occurring in their communities. The<br /> grant will help them broaden their reach.</p> <p>The Citizen Lab at the Munk School of Global Affairs at the University<br /> of Toronto, Canada, is a leading interdisciplinary laboratory<br /> researching and exposing censorship and surveillance. The grant will<br /> support their technical reconnaissance and analysis, which uniquely<br /> combines experts and techniques from computer science and the social<br /> sciences.</p> <p>The Guardian Project, based in New York City, develops open-source<br /> secure communication tools for mobile devices. ChatSecure and OSTel,<br /> their open standards-based encrypted messaging, voice and video<br /> communication services, which are both built on open standards, have<br /> earned the trust of tens of thousands of users in<br /> repressively-censored environments, and the grant will advance their<br /> technical development.</p> <p>The Igarapé Institute in Rio de Janeiro, Brazil, focuses on violence<br /> prevention and reduction through technology. Their nonprofit work on<br /> anti-crime projects combines the thoughtfulness of a think tank with<br /> the innovative experimentation of a technology design shop. The grant<br /> will support their research and development work.</p> <p>KoBo Toolbox in Cambridge, MA, allows fieldworkers in far-flung<br /> conflict and disaster zones to easily gather information without<br /> active Internet connections. The grant will help them revamp their<br /> platform to make it easier and faster to deploy.</p> <p>The New Media Advocacy Project in New York, NY, is nonprofit<br /> organization developing mobile tools to map violence and<br /> disappearances in challenging environments. The grant will allow them<br /> to refine their novel, interactive, video-based interfaces.</p> <p>The Open Technology Institute at the New America Foundation in<br /> Washington, DC, advances open architectures and open-source<br /> innovations for a free and open Internet. The grant will assist their<br /> work with the Measurement Lab project to objectively measure and<br /> report Internet interference from repressive governments.</p> <p>Portland State University in Portland, OR, is leading ground-breaking<br /> research on network traffic obfuscation techniques, which improve<br /> Internet accessibility for residents of repressively-censored<br /> environments. The grant will support the research of Professor Tom<br /> Shrimpton and his lab, who—with partners at the University of<br /> Wisconsin and beyond—continue to push the boundaries with new<br /> techniques like Format Transforming Encryption.</p> https://guardianproject.info/2014/02/12/tweaking-https-for-better-security/ Wed, 12 Feb 2014 19:14:59 -0400 https://guardianproject.info/2014/02/12/tweaking-https-for-better-security/ <p>The HTTPS protocol is based on TLS and SSL, which are standard ways to negotiate encrypted connections. There is a lot of complexity in the protocols and lots of config options, but luckily most of the config options can be ignored since the defaults are fine. But there are some things worth tweaking to ensure that as many connections as possible are using reliable encryption ciphers while providing <a href="https://en.wikipedia.org/wiki/Forward_secrecy">forward secrecy</a>. A connection with forward secrecy provides protection to past transactions even if the server’s HTTPS private key/certificate is stolen or compromised. This protects your users from large scale network observers that can store all traffic for later decryption, like governments, ISPs, telecoms, etc. From the server operator’s point of view, it means less risk of leaking users’ data, since even if the server is compromised, past network traffic will probably not be able to be encrypted.</p> <p>In my situation, I was using our development site, <a href="https://dev.guardianproject.info" target="_blank"><a href="https://dev.guardianproject.info">https://dev.guardianproject.info</a></a>, as my test bed, it is Apache 2.2 and openssl 1.0.1 running on Ubuntu/precise 12.04 Long-Term Support, so that means that some of the options are more limited since this is an older release. On Debian, Ubuntu and other Debian-derivatives, you’ll only need to edit <code>/etc/apache2/mods-available/ssl.conf</code>. There are more paranoid resources <a href="https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy" target="_blank">for perfectly configuring your TLS</a>, but we’re not ready to drop support for old browsers that only support SSLv3, and not TLS at all. So I went with this line to enable SSLv3 and TLSv1.0 and newer:<br /> <code>&lt;br /&gt; SSLProtocol all -SSLv2&lt;br /&gt; </code></p> <p>With TLS connections, the client and the server each present a list of encryption ciphers that represent the ciphers they each support in order of preference. This enables the client and server to choose a cipher that both support. Normally, the client’s list takes precedence over the server’s, but with many browsers that can be changed. Unfortunately it seems that Microsoft Internet Explorer (IE) ignores this and always uses the client’s preference first. Here’s how to make Apache request that the server preferences are preferred:<br /> <code>&lt;br /&gt; SSLHonorCipherOrder on&lt;br /&gt; </code></p> <p>Next up is tweaking the server’s preference list to put ciphers that enable forward secrecy first (don’t worry if you don’t understand the next stuff about my rationale, my aim is to walk thru the process). This is done in most web servers using openssl-style cipher lists. I started out with <a href="https://wiki.mozilla.org/Security/Server_Side_TLS" target="_blank">what Mozilla recommends</a>, then pared down the list to remove AES-256 ciphers, since AES-128 is widely regarded to be faster, quite strong, and perhaps <a href="https://wiki.mozilla.org/Security/Server_Side_TLS#Prioritization_logic" target="_blank">more resistant to timing attacks than AES-256</a>. I also chose to remove RC4-based ciphers, since <a href="https://wiki.mozilla.org/Security/Server_Side_TLS#RC4_weaknesses" target="_blank">RC4 might already be broken</a>, and will only get worse with time. RC4 has historically been used to mitigate the “BEAST” attack, but that is <a href="https://community.qualys.com/blogs/securitylabs/2013/09/10/is-beast-still-a-threat" target="_blank">mostly happening in the clients now</a>. So with that I ended up with this cipher list (should be all one line in your config file):<br /> <code>&lt;br /&gt; SSLCipherSuite &quot;ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:CAMELLIA128-SHA:DES-CBC3-SHA&quot;&lt;br /&gt; </code></p> <p>One thing to make sure is that all of these ciphers are supported on your system. You can get the list of supported ciphers from <code>openssl ciphers</code>. I used this command line to get them in a nice, alphabetized list:<br /> <code>&lt;br /&gt; openssl ciphers | sed 's,:,\n,g' | sort&lt;br /&gt; </code></p> <p>Lastly, we want to set the <a href="https://www.owasp.org/index.php/HTTP_Strict_Transport_Security" target="_blank">HSTS</a> header to tell the browser to always use HTTPS. To enforce this, a header is added to the collection of HTTP headers delivered when connecting to the HTTPS site. This header tells the client browser to always connect to the current domain using HTTPS. It includes an expiration date (aka <code>max-age</code>) after which, the client browser will again allow HTTP connections to that domain. The server might then again redirect the HTTP connection to HTTPS, and again the client will get the HSTS header, and use only HTTPS until the expiration date comes again. To include this header in your Apache server, add this line:<br /> <code>&lt;br /&gt; Header add Strict-Transport-Security &quot;max-age=15768000;includeSubDomains&quot;&lt;br /&gt; </code></p> <p>Now you can check the results of your work with Qualys’ handy SSL Test. You can see the result of my efforts here: <a href="https://www.ssllabs.com/ssltest/analyze.html?d=dev.guardianproject.info" target="_blank"><a href="https://www.ssllabs.com/ssltest/analyze.html?d=dev.guardianproject.info">https://www.ssllabs.com/ssltest/analyze.html?d=dev.guardianproject.info</a></a>. <strong>A-</strong> is not bad. I tried for a good long while to get IE to use FS (Forward Secrecy) ciphers, but failed. IE does not respect the server-side cipher preferences. My guess is that the only way to get IE to use FS ciphers is to make a custom cipher list that does not include anything but FS ciphers and serve that only to IE. I know it is possible to do because <a href="https://www.ssllabs.com/ssltest/analyze.html?d=bitbucket.com&s=131.103.20.172" target="_blank">bitbucket.com got an <strong>A+</strong> for doing it</a>. For a quick way to check out the cipher lists and HSTS header, look at <a href="https://github.com/iSECPartners/sslyze" target="_blank">iSEC Partner’s sslyze</a>.</p> <p>This is only a quick overview of the process to outline the general concepts. To find out more I recommend reading the source articles for this post, including specific directions for nginx and lighttpd:</p> <ul> <li>Mozilla’s <a href="https://wiki.mozilla.org/Security/Server_Side_TLS" target="_blank">Server-side TLS</a></li> <li>Qualys’ <a href="https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy" target="_blank">Configuring Apache, Nginx, and OpenSSL for Forward Secrecy</a></li> <li>Qualys’ <a href="https://community.qualys.com/blogs/securitylabs/2013/09/10/is-beast-still-a-threat" target="_blank">Is BEAST Still a Threat?</a></li> <li><a href="https://www.owasp.org/index.php/HTTP_Strict_Transport_Security" target="_blank">HTTP Strict Transport Security</a></li> </ul> https://guardianproject.info/2014/01/21/improving-trust-and-flexibility-in-interactions-between-android-apps/ Tue, 21 Jan 2014 13:51:57 -0400 https://guardianproject.info/2014/01/21/improving-trust-and-flexibility-in-interactions-between-android-apps/ <div id="attachment_12240" style="width: 310px" class="wp-caption alignright"> <a href="https://guardianproject.info/wp-content/uploads/2014/01/Android-Intents.png"><img aria-describedby="caption-attachment-12240" src="https://guardianproject.info/wp-content/uploads/2014/01/Android-Intents-300x61.png" alt="Activity1 sending an Intent that either Activity2 or Activity3 can handle." width="300" height="61" class="size-medium wp-image-12240" srcset="https://guardianproject.info/wp-content/uploads/2014/01/Android-Intents-300x61.png 300w, https://guardianproject.info/wp-content/uploads/2014/01/Android-Intents.png 600w" sizes="(max-width: 300px) 100vw, 300px" /></a> <p id="caption-attachment-12240" class="wp-caption-text"> <code>Activity1</code> sending an <code>Intent</code> that either <code>Activity2</code> or <code>Activity3</code> can handle. </p> </div>Android provides a flexible system of messaging between apps in the form of `<a href="https://developer.android.com/guide/components/intents-filters.html" target="_blank">Intent</a>`s. It also provides the framework for reusing large chunks of apps based on the `<a href="https://developer.android.com/reference/android/app/Activity.html" target="_blank">Activity</a>` class. `Intent`s are the messages that make the requests, and `Activity`s are the basic chunk of functionality in an app, including its interface. This combination allows apps to reuse large chunks of functionality while keeping the user experience seamless and fluent. For example, an app can send an Intent to request a camera `Activity` to prompt the user to take a picture, and that process can feel integrated into the original app that made the request. Another common use of this paradigm is choosing account information from the contacts database (aka the _People_ app). When a user is composing an new email, they will want to select who the message gets sent to. Android provides both the contacts database, and a nice overlay screen for finding and selecting the person to send to. This combination is an `Activity` provided by Android. The message that the email program sends in order to trigger that `Activity` is an `Intent`. As usual, one of the downsides of flexibility is increased security risk. This is compounded in the Android system by rules that will automatically export an Activity to receive Intents from any app, <a href="https://www.eecs.berkeley.edu/~emc/papers/spsm4027-kantola.pdf" title="Reducing Attack Surfaces for Intra-Application Communication in Android" target="_blank">when certain conditions are met</a>. If an `Activity` is exported for any app to call, <a href="https://www.eecs.berkeley.edu/~emc/papers/mobi168-chin.pdf" title="Analyzing Inter-Application Communication in Android" target="_blank">it is possible for apps to send malicious <code>Intent</code>s</a> to that `Activity`. Many `Intents` are meant to be public and others are exported as a side effect. Either way, at the very least, it is necessary to <a href="http://blog.palominolabs.com/2013/05/13/android-security/" title="Intent Spoofing on Android" target="_blank">sanitize the input</a> that an `Activity` receives. On the other side of the issue, if an app is trusting another app to provide a sensitive service for it, then malware can pose as the trusted app and receive sensitive data from the trusting app. <a href="http://dwaterson.com/2013/06/24/data-harvesting-by-malicious-android-apps/" target="_blank">An app does not need to request any permissions in order to set itself up as a receiver of <code>Intent</code>s</a>. <div id="attachment_12117" style="width: 361px" class="wp-caption aligncenter"> <a href="https://www.eecs.berkeley.edu/~emc/papers/spsm4027-kantola.pdf"><img aria-describedby="caption-attachment-12117" src="https://guardianproject.info/wp-content/uploads/2014/01/activity-service-hijacking.png" alt="Activity/Service hijacking: watch out for the little devil in the system" width="351" height="153" class="size-full wp-image-12117" srcset="https://guardianproject.info/wp-content/uploads/2014/01/activity-service-hijacking.png 351w, https://guardianproject.info/wp-content/uploads/2014/01/activity-service-hijacking-300x130.png 300w" sizes="(max-width: 351px) 100vw, 351px" /></a> <p id="caption-attachment-12117" class="wp-caption-text"> Activity/Service hijacking: watch out for the little devil in the system </p> </div> <p>Android, of course, does provide some added protections for cases like this. For very sensitive situations, an <code>Activity</code> can be setup to only receive <code>Intent</code>s from apps that meet certain criteria. <a href="https://www.isecpartners.com/media/11991/isec_securing_android_apps.pdf" target="_blank">Android permissions can restrict other apps</a> from sending <code>Intent</code>s to any given exported <code>Activity</code>. If a separate app wants to send an <code>Intent</code> to an <code>Activity</code> that has be set with a permission, then that app must include that permission in its manifest, thereby publishing that it is using that permission. This provides a good way publish an API for getting permission, but leaving it relatively open for other apps to use. Other kinds of controls can be based on two aspects of an app that the Android system enforces to remain the same: <a href="http://android-developers.blogspot.com/2011/06/things-that-cannot-change.html" target="_blank">the package name and the signing key</a>. If either of those change, then Android considers it a different app altogether. The strictest control is handled by the “protection level”, which can be set to only allow either the system or apps signed by the same key to send <code>Intent</code>s to a given <code>Activity</code>. These security tools are useful in many situations, but leave lots of privacy-oriented use cases uncovered.</p> <p>There are some situations that need more flexibility without opening things up entirely. The first simple example is provided by our app <a href="https://guardianproject.info/apps/pixelknot/" target="_blank">Pixelknot</a>: it needs to send pictures through services that will not mess up the hidden data in the images. It has a trusted list of apps it will send to, based on apps that have proven to pass the images through unchanged. When the user goes to share the image from Pixelknot to an cloud storage app, the user will be prompted to choose from a list of installed apps that match the whitelist in Pixelknot. We could have implemented a permission and asked lots of app providers to implement it, but it seems a mammoth task to get lots of large companies like Dropbox and Google to include our specific permission.</p> <p>There are other situations that require even tighter restrictions that are available. The first example here comes from our OpenPGP app for Android. <a href="https://guardianproject.info/code/gnupg/" target="_blank">Gnu Privacy Guard (GPG)</a> provides cryptographic services to any app that requests it. When the app sends data to GPG to be encrypted, it needs to be sure that the data is actually going to GPG and not to some malware. For very sensitive situations, the Android-provided package name and signing key might not be enough to ensure that the correct app is receiving the unencrypted data. Many Android devices are still unpatched to protect against <a href="https://threatpost.com/second-android-master-key-attack-surfaces/101297" target="_blank">master key bugs</a>, and for people using Android in China, Iran, etc. where the Play Store is not allowed, they don’t get the exploit scanning provided by Google. Telecoms around the world have proved to be <a href="https://arstechnica.com/gadgets/2012/12/the-checkered-slow-history-of-android-handset-updates/" target="_blank">bad at updating the software</a> for the devices that they sell, <a href="https://arstechnica.com/security/2013/04/wireless-carriers-deceptive-and-unfair" target="_blank">leaving many security problems unfixed</a>. Alternative Android app stores are a very popular way to get apps. So far, the ones that we have seen provide minimal security and no malware scanning. <a href="http://www.telecoms.com/57581/china-crucial-to-android/" target="_blank">In China</a>, <a href="http://www.insidemobileapps.com/2011/09/02/china-chinese-smartphone-ios-android-market/" target="_blank">Android is very popular</a>, so this represents a lot of Android users.</p> <p>Another potential use case revolves around a media reporting app that relies on other apps to provide images and video as part of regular reports. This could be something like a citizen journalist editing app or a human rights reporting app. The Guardian Project develops a handful of apps designed to create media in these situations: <a href="https://guardianproject.info/apps/obscuracam/" target="_blank">ObscuraCam</a>, InformaCam, and an new secure camera app in the works that we are contributing to. We want InformaCam to work as a provider of verifiable media to any app. It generates a package of data that includes a cryptographic signature so that its authenticity can be verified. That means that the apps that transport the InformaCam data do not need to be trusted in order to guarantee the integrity of the uploaded InformaCam data. Therefore it does not make sense in this case for InformaCam to grant itself permissions to access other apps’ secured <code>Activity</code>s. It would add to the maintenance load of the app without furthering the goals of the InformaCam project. Luckily there are other ways to address that need.</p> <p>The inverse of this situation is not true. The reporting app that gathers media and sends it to trusted destinations has higher requirements for validating the data it receives via <code>Intent</code>s. If verifiable media is required, then this reporter app will want to only accept incoming media from InformaCam. Well-known human rights activists are often the target of custom malware designed to get information from their phones. For this example, a malware version of InformaCam could be designed to track all of the media that the user is sending to the human rights reporting app. To prevent this, the reporter app will want to only accept data from a list of trusted apps. When the user tries to feed media from the malware app to the reporting app, it would be rejected, alerting the user that something is amiss. If an reporting app wants to receive data only from InformaCam, it needs to have some checks setup to enforce that. The easiest way for the reporting app to implement those checks would be to add an Android permission to the receiving <code>Activity</code>. But that requires the sending app, in the example above that is InformaCam, to implement the reporting app’s permission. Using permissions works for tailored interactions. InformaCam aims to bring tighter secure to all relevant interactions, so we need a different approach. While InformaCam could include some specific permissions, the aim is to have a single method that supports all the desired interactions. Having a single method here means less code to audit, less complexity, and fewer places for security bugs.</p> <p>We have started auditing the security of communication via <code>Intent</code>s, while also working on various ideas to address the issues laid out so far. This will include laying out best-practices and defining gaps in the Android architecture. We plan on building the techniques that we find useful into reusable libraries to make it easy for others to also have more flexible and trusted interactions. When are the standard checks not enough? If the user has a malware version of an app that exploits master key bugs, then the signature on the app will be valid. If a check is based only on a package name, malware could use any given package name. Android enforces that only one app can be installed with a given package name, but if there are multiple apps with the same package name, Android will not prevent you from installing the malware version.</p> <p><div id="attachment_12120" style="width: 160px" class="wp-caption alignleft"> <a href="http://www.pregnancyandbaby.com/the-hatch-blog/articles/935057/classic-vanilla-tofu-ice-pops-for-babies-from-ice-pop-joy"><img aria-describedby="caption-attachment-12120" src="https://guardianproject.info/wp-content/uploads/2014/01/IcePopJoy-ClassicVanillaTofu-300x300.jpg" alt="TOFU/POP: delicious vegan treat and clever software interaction!" width="150" height="150" class="size-medium wp-image-12120" srcset="https://guardianproject.info/wp-content/uploads/2014/01/IcePopJoy-ClassicVanillaTofu-300x300.jpg 300w, https://guardianproject.info/wp-content/uploads/2014/01/IcePopJoy-ClassicVanillaTofu-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2014/01/IcePopJoy-ClassicVanillaTofu.jpg 450w" sizes="(max-width: 150px) 100vw, 150px" /></a></p> <p><p id="caption-attachment-12120" class="wp-caption-text"> TOFU/POP: delicious vegan treat and clever software interaction! </p> </div>The strictest possible checks can be based on the hash of the whole APK, while tracking the signing key of a given APK is also often useful. These two data points are the most reliable ways to verify a given app. They can be tracked in two different ways: pinning and trust-on-first-use (TOFU/POP). Pinning means that a verified hash or signing key for the apps that need to be trusted is included in the app that must trust them. Then the trusting app can verify what it is sending or receiving</p> <p><code>Intent</code>s from, the installed app is then compared to the pre-stored pinned value. This kind of pinning allows for checks like the <code>Signature</code> permission level but based on a key that the app developer can select and include in the app. The built-in <code>Signature</code> permissions are fixed on the signing key of the currently running app.</p> <p>TOFU/POP means Trust-On-First-Use/Persistence Of Pseudonym. In this model, popularized by SSH, the user marks a given hash or signing key as trusted the first time they use the app, without extended checks about that apps validity. That mark then describes a “pseudonym” for that app, since there is no verification process, and that pseudonym is remembered for comparing in future interactions. One big advantage of TOFU/POP is that the user has control over which apps to trust, and that trust relationship is created at the moment the user takes an action to start using the app that needs to be trusted. That makes it much easier to manage than using Android permissions, which must be managed by the app’s developer. A disadvantage is that the initial trust is basically a guess, and that leaves open a method to get malware in there. The problem of installing good software, and avoiding malware, is outside of the scope of securing inter-app communication. Secure app installation is best handled by the process that is actually installing the software, like the Google Play Store or <a href="https://f-droid.org" target="_blank">F-Droid</a> does.</p> <p>To build on the InformaCam example, in order to setup a trusted data flow between InformaCam and the reporting app, custom checks must be implemented on both the sender and the receiver. For the sender, InformaCam, it should be able to send to any app, but it should then remember the app that it is configured to send to and make sure its really only sending to that app. It would then use TOFU/POP with the hash as the data point. For the receiver, the reporting app, it should only accept incoming data from apps that it trusts. The receiver then includes a pin for the signing key, or if the app is being deployed to unupdated devices the pin can be based on the hash to work around master key exploits. From there on out, the receiving app checks against the stored app hashes or signing keys. For less security-sensitive situations, the received can rely on TOFU/POP on the first time that an app sends media.</p> <p>There are various versions of these ideas floating around in various apps, and we have some in the works. We are working now to hammer out which of these ideas are the most useful, then we will be focusing our development efforts there. We would love to hear about any related effort or libraries that are out there. And we are also interested to hear about entirely different approaches than what has been outlined here.</p> https://guardianproject.info/2014/01/06/four-ways-informacam-powers-mobile-media-verification/ Mon, 06 Jan 2014 15:14:16 -0400 https://guardianproject.info/2014/01/06/four-ways-informacam-powers-mobile-media-verification/ <p><em>Note: A big discussion topic of 2013 was about how hard cryptography and security is for average people, journalists and others. With that in mind, we’d like to sub-title this post “Making Mobile Crypto Easy for Eyewitnesses”, as the InformaCam software and process described below includes the full gamut of security and cryptography tools all behind a streamlined, and even attractive application user experience we are quite proud of…. </em></p> <p>One of the primary goals of the <a href="https://guardianproject.info/informa">InformaCam</a> project (now in <a href="https://guardianproject.info/informa">public beta!</a>) is to create an environment where, when it comes to photos and video captured on smartphones, people and organizations can trust what they see. Faked photos and videos, whether intended to be humorous or malicious, are all too common online, especially in times of crisis. Thus, the software that been developed works to ensure the full, complete original photo or video captured of an event, can safely reach the people who need to see it, without it first being filtered, modified, cropped, trimmed or otherwise manipulated.</p> <p>There are four ways this is achieved:</p> <ol> <li>At point of capture, secure storage and analysis of the media file itself to begin a chain of custody, create a means of verifying media pixel values directly, and defend against tampering by malicious apps.</li> <li>Gather corroborating metadata points using the device’s built-in sensors to establish an environmental context.</li> <li>Use a secure method of transmission to a secure repository to continue chain of custody, and to defend against network surveillance, intrusion and filtering.</li> <li>Provide a means, using open tools, to verify media was not tampered with and to view and analyze corroborating metadata.</li> </ol> <p>Let’s dig deeper into each of these links of the verification chain.</p> <p><strong style="line-height: 1.5em;">Secure Storage and Analysis</strong></p> <p>When InformaCam is activated, it begins to actively monitor the device for any new photos or videos captured by the built-in camera software. InformaCam does not support importing already captured photos or videos. It must actively detect a new photo or video is captured by the active camera software on the device. As soon as it detects a new capture, it begins the following ingest process:</p> <ol> <li>Import the media file into an encrypted storage system, on the device, but only accessible by the InformaCam app. This ensures the file is not modified by any other application on the device.</li> <li>Generate and securely store a cryptographic hash value, or checksum, of the pixels of the media file, either the single photo or collectively for all the frames of the video. Any change to the pixels of the media files (“photoshopping”, removal of frames, editing, or other modifications) would result in a change to the hash value.</li> <li>Delete the source photo or video from its original location on the device’s shared storage, to keep it hidden from plain view in high-risk situations. Since it has been imported to encrypted storage, this version is no longer needed, and not trustworthy, ultimately.</li> </ol> <p>With this three step process we have, as near as possible to the time and place of capture, ensured we have the media file in a secure storage location, and have generated a unique hash value to verify the file against later.</p> <p>The hash value, which is just a short series of hexadecimal characters, can also be immediately shared to a third-party using email, text messaging, Twitter or other public notary system. The sooner it can be in the “public record” the better, to establish that the media file existed in this exact state at this time. This concept of a notary is important, and one we seek to develop more, to ensure the notary is also a trusted, tamper-proof service.</p> <p><strong>Corroborating Sensor Metadata</strong></p> <p>In addition to the media file itself and the cryptographic hash, an enormous amount of additional metadata is also captured during the window of time that InformaCam is activated and monitoring for the digital media creation events. We don’t discuss all of them here, but in short, InformaCam uses <a href="http://developer.android.com/guide/topics/sensors/sensors_overview.html">all available network, radio, motion and environmental sensors built into modern smartphones</a> to gather corroborating data points that can be used to establish credibility. This bundle of metadata is known as J3M, or <a href="https://dev.guardianproject.info/projects/informacam/wiki/JSON_Mobile_Media_Metadata_(J3M)">JSON Evidentiary Mobile Media Metadata</a>, with JSON (Javascript Object Notation) being the technical format it is stored in. When the media file is exported for verification, this data is bundled into the media file itself, and cryptographically signed and encrypted to ensure it cannot be modified or otherwise used by unauthorized third-parties.</p> <p><strong>Secure Repository Submission</strong></p> <p><span style="line-height: 1.5em;">When the owner of the device running InformaCam with the media file on it decides to share it with an organization for verification and use, they can send it using InformaCam’s built-in Secure Share mechanism. This enables the media file and embedded metadata to be d</span>irectly sent to an <a href="https://github.com/guardianproject/InformaRepo">InformaCam Repository</a> over a secure connection. While the connection uses the public internet, it is sent directly between the device and the repository inside of a secure, tamper proof tunnel powered by software known as <a href="https://torproject.org">Tor</a>. This connection is configured using an <a href="https://dev.guardianproject.info/projects/informacam/wiki/InformaCam_Trusted_Destination_(ICTD)">InformaCam Trusted Definition configuration file</a> which contains the necessary network addresses and credentials.</p> <p>The secure repository is expected to be run on a Linux server that is properly secured with strong access controls, firewalls, encrypted disk storage, and all other available mechanisms well known for securing desktop or server systems. It should not be placed on the public Internet, but only exposed through the Tor network connection. It should be hosted in a location that can be physically secured by the organization, as much as possible, and that could not be accessed without the organization being aware. This means that third party data centers should not be used, as access to these machines by law enforcement or malicious hackers can be accomplished without notice to the customers.</p> <p>However, as long as the media hash value itself is maintained in a secure manner, possibly even printed out and stored in an offline physically secure system, the state of the media file itself can be easily verified using common tools.</p> <p><strong style="line-height: 1.5em;">Open Verification and Analysis Tools</strong></p> <p>Once the media and metadata have been received in the secure repository, the organization managing it can used the <a href="https://guardianproject.info/informa">InformaCam Analyzer and Dashboard</a> software to process and verify the media file. All of the steps below are automatically done by the software, but can also be manually done by a competent, trained technician. These are the steps taken:</p> <ol> <li>Export the J3M corroborating metadata from the media file. It will be encrypted to the organization’s public cryptographic key, so it will first need to be decrypted, and also the signature of the data verified against the sender’s public key, which the organization previously obtained. This step is accomplished using the free and open-source <a href="http://gnupg.org">GnuPG software tools</a>.</li> <li>Run the media verification process on the photo or video file. This is accomplished using a tool in the InformaCam Analyzer software, which also includes the free and open-source <a href="http://www.ffmpeg.org/">FFMPEG media engine</a> software. The cryptographic hash function is run again, this time on the server-side on not on the device, and the resulting hash value from the pixel values is displayed. This must match the hash value generated on the device, which should have been shared via private or public notary (SMS, email, Twitter, etc), and is also stored in the J3M metadata obtained in step #1.</li> <li>View the J3M metadata directly or import into the <a href="https://j3m.info/submission/1110ca88837d710d9c43d49f48afce0b/">InformaCam Dashboard system</a> for verification. The metadata will include information such as GPS location, cellular network location, nearby bluetooth and wifi devices, compass headings, altitude, temperature and more. This data can be used to match against the time and place the media claims to be from.</li> </ol> <p><strong>Four Ways, In Summary</strong></p> <p>Through the four ways described above, the InformCam system works to capture and safeguard both media and metadata at all points along the way, between the device and the repository. Cryptographic functions and features provide much of the power behind this, but relying on mathematics alone does not tell the whole store. By combining the corroborating metadata and open tools for analysis, we ensure that the context of the photo or video, and the means to verify the entire package are also readily available as part of the verification process.</p> https://guardianproject.info/2013/12/28/integrating-crypto-identities-with-android/ Sat, 28 Dec 2013 19:42:56 -0400 https://guardianproject.info/2013/12/28/integrating-crypto-identities-with-android/ <p><a href="https://en.wikipedia.org/wiki/Alberti_cipher_disk"><img src="https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk-150x150.jpg" alt="alberti cipher disk" width="50" height="50" class="alignleft size-thumbnail wp-image-3079" srcset="https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk.jpg 245w" sizes="(max-width: 50px) 100vw, 50px" /></a>ver the past couple of years, Android has included a central database for managing information about people, it is known as the <a href="https://developer.android.com/reference/android/provider/ContactsContract.html" target="_blank"><code>ContactsContract</code></a> (that’s a mouthful). Android then provides the <em>People</em> app and reusable interface chunks to choose contacts that work with all the information in the <code>ContactsContract</code> database. Any time that you are adding an account in the <em>Settings</em> app, you are setting up this integration. You can see it with Google services, <em>Skype</em>, <em>Facebook</em>, and many more. This system has a lot of advantages, including:</p> <ul> <li>a unified user experience for finding and managing data about people</li> <li>apps can launch common interface dialogs and screens for working with that database without having to write custom versions (launching <code>Activity</code>s via <code>Intent</code>s</li> <li>streamlined methods for building custom UIs based on the contacts database</li> </ul> <p>With our work porting <a href="https://www.gnupg.org/" target="_blank">GnuPG</a> to Android, we want <a href="https://guardianproject.info/code/gnupg/" target="_blank"><em>Gnu Privacy Guard</em></a> for Android to be fully integrated into the Android experience. <em>Gnu Privacy Guard</em> registers itself as a handler for all OpenPGP file and data types in Android, so users can work with these files using standard Android methods like Share/Send buttons. Or users can start by finding the person to encrypt to in the <em>People</em> app, then choosing the file. These flows make it intuitive to Android users, and means we have to write less code because it taps into existing Android systems. With the past release, v0.2, we laid the foundations for having the GnuPG keyring integrated into this contacts database. The next release, v0.3 will improve contacts integration a lot.</p> <div id="attachment_12225" style="width: 560px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2013/12/gpg-contacts-integration.png"><img aria-describedby="caption-attachment-12225" src="https://guardianproject.info/wp-content/uploads/2013/12/gpg-contacts-integration-1024x640.png" alt="All of these contacts come from the GnuPG keyring being synced to the ContactsContract. Nathan's contact is made up of combined info from Gnu Privacy Guard and Google. To encrypt a file to the author, select Encrypt File to... on his contact page." width="550" height="343" class="size-large wp-image-12225" srcset="https://guardianproject.info/wp-content/uploads/2013/12/gpg-contacts-integration-1024x640.png 1024w, https://guardianproject.info/wp-content/uploads/2013/12/gpg-contacts-integration-300x187.png 300w" sizes="(max-width: 550px) 100vw, 550px" /></a> <p id="caption-attachment-12225" class="wp-caption-text"> All of these contacts come from the GnuPG keyring being synced to the <code>ContactsContract</code>. Nathan’s contact is made up of combined info from <em>Gnu Privacy Guard</em> and Google. To encrypt a file to the author, select <strong>Encrypt file to…</strong> on his contact page. </p> </div> <p>One of the concerns that has been voiced about integrating with the <code>ContactsContract</code> database is that all the data put there will be then uploaded to the other accounts, like the Google account of the phone, or other accounts. As far as we can tell, there is no automatic syncing of data between accounts in the <code>ContactsContract</code>, instead it is a system of individual, local databases. We have not confirmed this with a code audit whether there is any data leakage from <code>ContactsContract</code>, and would love to hear more information on that. There is a layer of matching rules for locally merging those local databases into a single, unified view of that data. A good example of this unified data view in action is the built-in <em>People</em> app. It will show data from all of the local databases, and it will link profiles together in a single view based on programmatic rules that look at email addresses, names, etc. In any case, <em>Gnu Privacy Guard</em> only syncs one way. It treats the GnuPG keyring as canonical and clones the GnuPG keyring contacts to the <code>ContactsContract</code> whenever a sync is run. The sync process never reads from the <code>ContactsContract</code>, and currently no data is ever imported from it. So at the very least, the ContactsContract should not serve as a point to inject data into the GnuPG keyring.</p> <div id="attachment_12211" style="width: 330px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2013/12/ContactsContract.png"><img aria-describedby="caption-attachment-12211" src="https://guardianproject.info/wp-content/uploads/2013/12/ContactsContract.png" alt="The ContactsContract builds up the complete view of all contacts based on RawContacts provided by each account type, which are in turn built up of standard data types like name, email, phone number, etc." width="320" height="189" class="size-full wp-image-12211" srcset="https://guardianproject.info/wp-content/uploads/2013/12/ContactsContract.png 320w, https://guardianproject.info/wp-content/uploads/2013/12/ContactsContract-300x177.png 300w" sizes="(max-width: 320px) 100vw, 320px" /></a> <p id="caption-attachment-12211" class="wp-caption-text"> The <code>ContactsContract</code> builds up the complete view of all contacts based on <code>RawContacts</code> provided by each account type, which are in turn built up of standard data types like name, email, phone number, etc. </p> </div> <p>One unexplored idea is for apps that need to use crypto to use only the standard Android contacts API to fetch crypto identity information like public keys and fingerprints. For example, PGP email app <a href="https://play.google.com/store/apps/details?id=com.fsck.k9" target="_blank"><em>K-9</em></a> could look up OpenPGP info at the same time it is looking in the contacts database for email addresses. It probably even makes sense for <em>K-9</em> to offload even more to an OpenPGP provider, and have <em>K-9</em> just query the PGP provider whether there is a signing key available, whether the receiver has a PGP key, etc.</p> <p>It is also tempting to think about using a similar technique for storing other types of keys like OTR keys for secure chat. The hard part is that OTR has no method built-in to the key for verifying whether that key is trusted. OpenPGP has key signing and the Web-of-Trust, with all of its issues, but the OpenPGP security model is designed around untrusted methods of moving public key data around. Using the contacts database for moving around public key material for later verification will work equally well for OTR, OpenPGP, etc.</p> <p>On a similar note, we are also working with Dominik Schürmann and the <em>K-9</em> devs to create <a href="https://dev.guardianproject.info/projects/gpgandroid/wiki/API_Sketch" target="_blank">a common Android API for a generic OpenPGP provider</a>. This is similar to the contacts system in recent versions of Android in that there is a single, central contacts system that any app can tap into for managing data related to people.</p> <p>We have decided to go with Dominik Schürmann’s approach of using an AIDL API to an Android Service. AIDL does have some downsides mostly around it being overcomplicated. But AIDL is the main Android method for inter-process communication with <code>Service</code>s, so we are stuck with it, more or less. The beautiful thing is that this arrangement will make it possible for apps to fully offload the crypto handling to the <code>Service</code>, including all the required GUI bits like passphrase prompting, progress dialog overlays, key selection, etc.</p> <p><a href="http://csunplugged.org/public-key-encryption"><img src="https://guardianproject.info/wp-content/uploads/2013/12/public-key-encryption-cartoon-300x292.jpg" alt="contacts with keys" width="300" height="292" class="alignright size-medium wp-image-12212" srcset="https://guardianproject.info/wp-content/uploads/2013/12/public-key-encryption-cartoon-300x292.jpg 300w, https://guardianproject.info/wp-content/uploads/2013/12/public-key-encryption-cartoon.jpg 414w" sizes="(max-width: 300px) 100vw, 300px" /></a>For example of how this idea would work, we can look at <em>K-9</em> email again. If an incoming email includes a public key or fingerprint, either of these can be sent to the OpenPGP provider for importing. An <code>OPENPGP4FPR:</code> URI will trigger downloading the public key from a keyserver. A public key contained in an attached file will be received by the OpenPGP provider via the Android file associations, which will then prompts the user to import it. When <em>K-9</em> goes to send a OpenPGP-encrypted email to that new key, it checks the ContactsContract to see whether the recipient has a OpenPGP key. If so, it sends the email to the OpenPGP provider to be encrypted. The OpenPGP provider can then look up which key to use in it’s local keyring by using the recipient’s email address. If there are multiple keys for that email address, it prompts the user to choose. It could also base it’s choice on the OpenPGP trust level for that key.</p> <p>These are currently all ideas for how GnuPG can be integrated into Android. Some of these are implemented and ready for you to try out on your device. The common OpenPGP provider idea is still very much a work in progress.</p> https://guardianproject.info/signing-keys/ Mon, 16 Dec 2013 14:01:41 -0400 https://guardianproject.info/signing-keys/ <p>We have a number of signing keys used for signing software releases. There are a number of different keys because there are a number of different ways of signing software. This list aims to be the comprehensive list of all the release signing keys that we use.</p> <h2 id="openpgp">OpenPGP</h2> <p>We sign all of our releases using OpenPGP detached binary signatures in a <code>.sig</code> file.</p> <h4 id="people-signing-official-releases">People signing official releases</h4> <ul> <li><a href="https://keys.openpgp.org/search?q=0xE9E28DEA00AA5556" target="_blank">Hans-Christoph Steiner &lt;&#104;&#x61;&#110;&#x73;&#64;&#x67;&#117;&#x61;&#114;&#x64;&#105;&#x61;&#110;&#x70;&#114;&#x6f;&#106;&#x65;&#99;&#x74;&#46;&#x69;&#110;&#x66;&#111;&gt;<br /><code>EE66 20C7 136B 0D2C 456C 0A4D E9E2 8DEA 00AA 5556</code></a></li> <li><a href="https://keys.openpgp.org/search?q=0x9F0FE587374bbe81" target="_blank">Hans-Christoph Steiner &lt;&#104;&#x61;&#110;&#x73;&#64;&#x67;&#117;&#x61;&#114;&#x64;&#105;&#x61;&#110;&#x70;&#114;&#x6f;&#106;&#x65;&#99;&#x74;&#46;&#x69;&#110;&#x66;&#111;&gt; (deprecated)<br /><code>5E61 C878 0F86 295C E17D 8677 9F0F E587 374B BE81</code></a></li> <li><a href="https://keys.openpgp.org/search?q=0xA801183E69B37AA9" target="_blank">Nathan Freitas &lt;&#x6e;a&#x74;&#x68;a&#x6e;&#64;g&#x75;&#97;r&#x64;i&#x61;&#x6e;p&#x72;&#111;j&#x65;&#99;t&#x2e;i&#x6e;&#x66;o&gt;<br /><code>BBE2 0FD6 DA48 A3DD 4CC7 DF41 A801 183E 69B3 7AA9</code></a></li> <li><a href="https://keys.openpgp.org/search?q=0x97d05003da731a17" target="_blank">Abel Luck &lt;&#x61;&#x62;&#101;l&#64;g&#x75;&#x61;&#x72;&#100;ia&#x6e;&#x70;&#x72;&#111;je&#x63;&#x74;&#x2e;&#105;nf&#x6f;&gt;<br /><code>1893 0780 A043 3A61 B8B2 17D6 97D0 5003 DA73 1A17</code></a></li> </ul> <h4 id="launchpad-ubuntu-package-archive-ppa">Launchpad Ubuntu Package Archive (PPA)</h4> <p>For easy installation on Ubuntu/Mint/etc. of our official releases, as well as backported software that we use, we have an Launchpad PPA with its own signing key provided by Launchpad:</p> <ul> <li><a href="https://keys.openpgp.org/search?q=0xF50EADDD2234F563" target="_blank">Launchpad PPA for Guardian Project<br /><code>6B80 A842 07B3 0AC9 DEE2 35FE F50E ADDD 2234 F563</code></a></li> </ul> <h2 id="android-apk">Android APK</h2> <p>We currently have two signing keys: a 4096-bit RSA key used for all new apps, and a 1024-bit RSA key that we use for all apps that we first released before 2014. You can download the whole public keys and verify it using the OpenPGP signature:</p> <p><strong>4096-bit RSA</strong></p> <ul> <li><a href="https://guardianproject.info/releases/guardianproject-rsa4096-signing-certificate.pem">guardianproject-rsa4096-signing-certificate.pem</a></li> <li><a href="https://guardianproject.info/releases/guardianproject-rsa4096-signing-certificate.pem.sig">guardianproject-rsa4096-signing-certificate.pem.sig</a></li> <li><a href="https://guardianproject.info/releases/guardianproject-rsa4096-signing-publickey.pem">guardianproject-rsa4096-signing-publickey.pem</a></li> <li><a href="https://guardianproject.info/releases/guardianproject-rsa4096-signing-publickey.pem.sig">guardianproject-rsa4096-signing-publickey.pem.sig</a></li> <li>You can see a survey of APKs signed by this key on Android Observatory:<br /> <a href="https://androidobservatory.org/cert/4CB3F539F63B32ACA13B4450638D605F531D4F4A" target="_blank"><a href="https://androidobservatory.org/cert/4CB3F539F63B32ACA13B4450638D605F531D4F4A">https://androidobservatory.org/cert/4CB3F539F63B32ACA13B4450638D605F531D4F4A</a></a></li> </ul> <p><strong>1024-bit RSA</strong></p> <ul> <li><a href="https://guardianproject.info/releases/guardianproject-rsa1024-signing-key.cer">guardianproject-rsa1024-signing-key.cer</a></li> <li><a href="https://guardianproject.info/releases/guardianproject-rsa1024-signing-key.cer.sig">guardianproject-rsa1024-signing-key.cer.sig</a></li> <li>You can see a survey of APKs signed by this key on Android Observatory:<br /> <a href="https://androidobservatory.org/cert/9F1960C9584FEE5E166419354985A2B5FE413570" target="_blank"><a href="https://androidobservatory.org/cert/9F1960C9584FEE5E166419354985A2B5FE413570">https://androidobservatory.org/cert/9F1960C9584FEE5E166419354985A2B5FE413570</a></a></li> </ul> <h2 id="fdroid-repo">FDroid Repo</h2> <p>Our official releases are also posted on our own FDroid repo, which is accessible at <a href="https://guardianproject.info/fdroid/repo">https://guardianproject.info/fdroid/repo</a>. The signing key for that repo is available here:</p> <ul> <li><a href="https://guardianproject.info/releases/guardianproject-rsa4096-fdroid-repo-signing-key.pem">guardianproject-rsa4096-fdroid-repo-signing-key.pem</a></li> <li><a href="https://guardianproject.info/releases/guardianproject-rsa4096-fdroid-repo-signing-key.pem.sig">guardianproject-rsa4096-fdroid-repo-signing-key.pem.sig</a></li> </ul> <p>The fingerprints for this signing key are:</p> <pre>Owner: &#69;&#x4d;&#65;&#x49;&#76;&#x41;D&#x44;R&#x45;S&#x53;=&#x72;o&#x6f;t&#x40;g&#x75;a&#x72;d&#105;&#x61;&#110;&#x70;&#114;&#x6f;&#106;&#x65;c&#x74;.&#x69;n&#x66;o, CN=guardianproject.info, O=Guardian Project, OU=FDroid Repo, L=New York, ST=New York, C=US Issuer: &#69;&#x4d;&#65;&#x49;L&#x41;D&#x44;R&#x45;S&#x53;=&#x72;o&#111;&#x74;&#64;&#x67;&#117;&#x61;r&#x64;i&#x61;n&#x70;r&#x6f;j&#x65;c&#116;&#x2e;&#105;&#x6e;f&#x6f;, CN=guardianproject.info, O=Guardian Project, OU=FDroid Repo, L=New York, ST=New York, C=US Serial number: a397b4da7ecda034 Valid from: Thu Jun 26 15:39:18 EDT 2014 until: Sun Nov 10 14:39:18 EST 2041 Certificate fingerprints: MD5: 8C:BE:60:6F:D7:7E:0D:2D:B8:06:B5:B9:AD:82:F5:5D SHA1: 63:9F:F1:76:2B:3E:28:EC:CE:DB:9E:01:7D:93:21:BE:90:89:CD:AD SHA256: B7:C2:EE:FD:8D:AC:78:06:AF:67:DF:CD:92:EB:18:12:6B:C0:83:12:A7:F2:D6:F3:86:2E:46:01:3C:7A:61:35 Signature algorithm name: SHA1withRSA Version: 1 </pre> https://guardianproject.info/signing-keys/ Mon, 16 Dec 2013 14:01:41 -0400 https://guardianproject.info/signing-keys/ <p>We have a number of signing keys used for signing software releases. There are a number of different keys because there are a number of different ways of signing software. This list aims to be the comprehensive list of all the release signing keys that we use.</p> <h2 id="openpgp">OpenPGP</h2> <p>We sign all of our releases using OpenPGP detached binary signatures in a <code>.sig</code> file.</p> <h4 id="people-signing-official-releases">People signing official releases</h4> <ul> <li><a href="https://keys.openpgp.org/search?q=0xE9E28DEA00AA5556" target="_blank">Hans-Christoph Steiner &lt;&#104;&#x61;&#110;&#x73;&#64;&#x67;&#117;&#x61;&#114;&#x64;&#105;&#x61;&#110;&#x70;&#114;&#x6f;&#106;&#x65;&#99;&#x74;&#46;&#x69;&#110;&#x66;&#111;&gt;<br /><code>EE66 20C7 136B 0D2C 456C 0A4D E9E2 8DEA 00AA 5556</code></a></li> <li><a href="https://keys.openpgp.org/search?q=0x9F0FE587374bbe81" target="_blank">Hans-Christoph Steiner &lt;&#104;&#x61;&#110;&#x73;&#64;&#x67;&#117;&#x61;&#114;&#x64;&#105;&#x61;&#110;&#x70;&#114;&#x6f;&#106;&#x65;&#99;&#x74;&#46;&#x69;&#110;&#x66;&#111;&gt; (deprecated)<br /><code>5E61 C878 0F86 295C E17D 8677 9F0F E587 374B BE81</code></a></li> <li><a href="https://keys.openpgp.org/search?q=0xA801183E69B37AA9" target="_blank">Nathan Freitas &lt;&#x6e;a&#x74;&#x68;a&#x6e;&#64;g&#x75;&#97;r&#x64;i&#x61;&#x6e;p&#x72;&#111;j&#x65;&#99;t&#x2e;i&#x6e;&#x66;o&gt;<br /><code>BBE2 0FD6 DA48 A3DD 4CC7 DF41 A801 183E 69B3 7AA9</code></a></li> <li><a href="https://keys.openpgp.org/search?q=0x97d05003da731a17" target="_blank">Abel Luck &lt;&#x61;&#x62;&#101;l&#64;g&#x75;&#x61;&#x72;&#100;ia&#x6e;&#x70;&#x72;&#111;je&#x63;&#x74;&#x2e;&#105;nf&#x6f;&gt;<br /><code>1893 0780 A043 3A61 B8B2 17D6 97D0 5003 DA73 1A17</code></a></li> </ul> <h4 id="launchpad-ubuntu-package-archive-ppa">Launchpad Ubuntu Package Archive (PPA)</h4> <p>For easy installation on Ubuntu/Mint/etc. of our official releases, as well as backported software that we use, we have an Launchpad PPA with its own signing key provided by Launchpad:</p> <ul> <li><a href="https://keys.openpgp.org/search?q=0xF50EADDD2234F563" target="_blank">Launchpad PPA for Guardian Project<br /><code>6B80 A842 07B3 0AC9 DEE2 35FE F50E ADDD 2234 F563</code></a></li> </ul> <h2 id="android-apk">Android APK</h2> <p>We currently have two signing keys: a 4096-bit RSA key used for all new apps, and a 1024-bit RSA key that we use for all apps that we first released before 2014. You can download the whole public keys and verify it using the OpenPGP signature:</p> <p><strong>4096-bit RSA</strong></p> <ul> <li><a href="https://guardianproject.info/releases/guardianproject-rsa4096-signing-certificate.pem">guardianproject-rsa4096-signing-certificate.pem</a></li> <li><a href="https://guardianproject.info/releases/guardianproject-rsa4096-signing-certificate.pem.sig">guardianproject-rsa4096-signing-certificate.pem.sig</a></li> <li><a href="https://guardianproject.info/releases/guardianproject-rsa4096-signing-publickey.pem">guardianproject-rsa4096-signing-publickey.pem</a></li> <li><a href="https://guardianproject.info/releases/guardianproject-rsa4096-signing-publickey.pem.sig">guardianproject-rsa4096-signing-publickey.pem.sig</a></li> <li>You can see a survey of APKs signed by this key on Android Observatory:<br /> <a href="https://androidobservatory.org/cert/4CB3F539F63B32ACA13B4450638D605F531D4F4A" target="_blank"><a href="https://androidobservatory.org/cert/4CB3F539F63B32ACA13B4450638D605F531D4F4A">https://androidobservatory.org/cert/4CB3F539F63B32ACA13B4450638D605F531D4F4A</a></a></li> </ul> <p><strong>1024-bit RSA</strong></p> <ul> <li><a href="https://guardianproject.info/releases/guardianproject-rsa1024-signing-key.cer">guardianproject-rsa1024-signing-key.cer</a></li> <li><a href="https://guardianproject.info/releases/guardianproject-rsa1024-signing-key.cer.sig">guardianproject-rsa1024-signing-key.cer.sig</a></li> <li>You can see a survey of APKs signed by this key on Android Observatory:<br /> <a href="https://androidobservatory.org/cert/9F1960C9584FEE5E166419354985A2B5FE413570" target="_blank"><a href="https://androidobservatory.org/cert/9F1960C9584FEE5E166419354985A2B5FE413570">https://androidobservatory.org/cert/9F1960C9584FEE5E166419354985A2B5FE413570</a></a></li> </ul> <h2 id="fdroid-repo">FDroid Repo</h2> <p>Our official releases are also posted on our own FDroid repo, which is accessible at <a href="https://guardianproject.info/fdroid/repo">https://guardianproject.info/fdroid/repo</a>. The signing key for that repo is available here:</p> <ul> <li><a href="https://guardianproject.info/releases/guardianproject-rsa4096-fdroid-repo-signing-key.pem">guardianproject-rsa4096-fdroid-repo-signing-key.pem</a></li> <li><a href="https://guardianproject.info/releases/guardianproject-rsa4096-fdroid-repo-signing-key.pem.sig">guardianproject-rsa4096-fdroid-repo-signing-key.pem.sig</a></li> </ul> <p>The fingerprints for this signing key are:</p> <pre>Owner: &#69;&#x4d;&#65;&#x49;&#76;&#x41;D&#x44;R&#x45;S&#x53;=&#x72;o&#x6f;t&#x40;g&#x75;a&#x72;d&#105;&#x61;&#110;&#x70;&#114;&#x6f;&#106;&#x65;c&#x74;.&#x69;n&#x66;o, CN=guardianproject.info, O=Guardian Project, OU=FDroid Repo, L=New York, ST=New York, C=US Issuer: &#69;&#x4d;&#65;&#x49;L&#x41;D&#x44;R&#x45;S&#x53;=&#x72;o&#111;&#x74;&#64;&#x67;&#117;&#x61;r&#x64;i&#x61;n&#x70;r&#x6f;j&#x65;c&#116;&#x2e;&#105;&#x6e;f&#x6f;, CN=guardianproject.info, O=Guardian Project, OU=FDroid Repo, L=New York, ST=New York, C=US Serial number: a397b4da7ecda034 Valid from: Thu Jun 26 15:39:18 EDT 2014 until: Sun Nov 10 14:39:18 EST 2041 Certificate fingerprints: MD5: 8C:BE:60:6F:D7:7E:0D:2D:B8:06:B5:B9:AD:82:F5:5D SHA1: 63:9F:F1:76:2B:3E:28:EC:CE:DB:9E:01:7D:93:21:BE:90:89:CD:AD SHA256: B7:C2:EE:FD:8D:AC:78:06:AF:67:DF:CD:92:EB:18:12:6B:C0:83:12:A7:F2:D6:F3:86:2E:46:01:3C:7A:61:35 Signature algorithm name: SHA1withRSA Version: 1 </pre> https://guardianproject.info/2013/12/12/keys-signatures-certificates-verifications-etc.-what-are-all-these-for/ Thu, 12 Dec 2013 13:20:09 -0400 https://guardianproject.info/2013/12/12/keys-signatures-certificates-verifications-etc.-what-are-all-these-for/ <p><a href="https://guardianproject.info/wp-content/uploads/2013/12/key.jpg"><img src="https://guardianproject.info/wp-content/uploads/2013/12/key-150x150.jpg" alt="portable shared security token" width="150" height="150" class="alignright size-thumbnail wp-image-12129" /></a>For the past two years, we have been thinking about how to make it easier for anyone to achieve private communications. One particular focus has been on the “security tokens” that are required to make private communications systems work. This research area is called internally <a href="https://dev.guardianproject.info/projects/psst/wiki/PSST" title="PSST Wiki" target="_blank">Portable Shared Security Tokens aka PSST</a>. All of the privacy tools that we are working on require “keys” and “signatures”, to use the language of cryptography, and these are the core of what “security tokens” are. One thing we learned a lot about is how to portray and discuss tools for private or anonymous communications to people who just want to communicate and are not interested in technical discussion. This is becoming a central issue among a lot of people working to make usable privacy tools.</p> <p>The widely established way of talking about privacy tools comes from the lingo of the underlying methods: cryptography, networking, etc. We talk about public and private keys, signing, validation, verification, key exchange, certificates, and fingerprints. In order for cryptography to work, keys need to be marked whether they are verified or not. <a href="https://guardianproject.info/wp-content/uploads/2013/12/public_key_cryptography_sm.png"><img src="https://guardianproject.info/wp-content/uploads/2013/12/public_key_cryptography_sm-300x190.png" alt="hide the guts of what is happening" width="300" height="190" class="alignleft size-medium wp-image-12135" srcset="https://guardianproject.info/wp-content/uploads/2013/12/public_key_cryptography_sm-300x190.png 300w, https://guardianproject.info/wp-content/uploads/2013/12/public_key_cryptography_sm.png 500w" sizes="(max-width: 300px) 100vw, 300px" /></a>Few computers users understand what these terms are referring to, even highly technical people who regularly use encryption do not know the meaning of all these things, nor should they. This is a low level detail that is not important to how the vast majority of users understand privacy in computers. Keys and verification are far too abstract to be generally understandable, and what other kind of key has a fingerprint? Even more so, few people can tell you the difference between validation and verification when it comes to keys, signatures and certificates. The software should not be exposing all this, but instead should be minimizing the complexity as much as possible, and providing as simple a user experience as possible.</p> <p><strong>Defining the Concepts that Define the Experience</strong></p> <p>A key part of defining that simple user experience is defining the core concepts that the software is organized around. In our discussions, we mostly talked about the ideas of identity and trust, while some discussion of verifying identity seemed unavoidable. Talking about identity and trust is a lot more relevant in day-to-day life, i.e. knowing that the message came from the person you think it did, and trusting that it was private. It is most direct to talk about establishing a trusted connection to another person, but that’s not something that crypto can ever promise because there is still the analog gap between the person and the device. These core ideas must represent what is technically possible, so we searched for widely understood concepts that map well to the technical limitations: “a private conversation”, “a trusted app”, “verifiable video”.</p> <p><div id="attachment_12128" style="width: 160px" class="wp-caption alignright"> <a href="https://guardianproject.info/wp-content/uploads/2013/12/ecc.jpg"><img aria-describedby="caption-attachment-12128" src="https://guardianproject.info/wp-content/uploads/2013/12/ecc-150x150.jpg" alt="create metaphors based on what users know" width="150" height="150" class="size-thumbnail wp-image-12128" srcset="https://guardianproject.info/wp-content/uploads/2013/12/ecc-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2013/12/ecc-300x300.jpg 300w, https://guardianproject.info/wp-content/uploads/2013/12/ecc.jpg 350w" sizes="(max-width: 150px) 100vw, 150px" /></a></p> <p><p id="caption-attachment-12128" class="wp-caption-text"> create metaphors based on what users know </p> </div>Diving in deeper, we concluded that the balance point between technical accuracy and widely understandable lingo was to talk about trusting the device, not the person. The technology can provide trusted connections between devices, and it is pretty close to how people experience digital communications. There is the laptop, the mobile phone, the net cafe, the friend’s computer, computer at work, etc. etc. When I look at my phone to see a message from a friend, it is easy to picture that friend typing that message out on that device, though it does take some conscious effort. The hard part here is that as we communicate more and more with our devices, there is less and less separation in our minds about whether we were talking in person, via voice, or by sending text. This is a point to focus on when thinking about designing the experience of private, secure communications software.</p> <p><strong>Let the Software Handle It!</strong></p> <p>There is a forming consensus in the world of usable security to focus on figuring out how to automate as much as possible then figure out how best tailor the experience of the essential parts that cannot be automated. The hard part will remain explaining the limitations of a given privacy tool.</p> <p>At Guardian Project, we work a lot on incremental progress, so many of our projects are focused on specific, narrow improvements. With <a href="https://guardianproject.info/apps/chatsecure/" target="_blank">ChatSecure</a> and <a href="https://guardianproject.info/apps/keysync/" target="_blank">Keysync</a> , we were able to automate one small part of the whole process, cryptography identity portability, which provides the foundation to provide private communications and verifiable media. Allowing users to sync their trust profiles between desktop and mobile makes it much more likely that users will have fully verified OTR conversations when chatting on their devices and laptops.</p> <p>With <a href="https://guardianproject.info/code/gnupg/" target="_blank">Gnu Privacy Guard for Android (GPGA)</a>, we have made it easy to import keys via QRCode as well as <code>openpgp4fpr:</code> URLs (a standard defined in conjuction with the <a href="http://web.monkeysphere.info/" title="Monkeysphere Home Page" target="_blank">Monkeysphere</a> project. We are also working on a common method of using NFC for OpenPGP key signing in conjuction with <a href="http://sufficientlysecure.org/index.php/openpgp-keychain/" title="OpenPGP Keychain home page" target="_blank">OpenPGP Keychain</a>. Even little things like optimizing support for standard file extensions can go a long way to make things easier, so GPGA automatically sets itself up to receive files with the <a href="https://tools.ietf.org/html/rfc2015" target="_blank">standard OpenPGP MIME types</a> (<code>application/pgp-keys</code>, <code>application/pgp-encrypted</code>, <code>application/pgp-signature</code>) as well as the corresponding file extensions (<code>.pkr</code>, <code>.skr</code>, <code>.key</code>, <code>.sig</code>, <code>.asc</code>, etc.). That makes it so a user can just click on one of these files, and GPGA will walk them through the whole process, doing as much as possible automatically.</p> <p>Another interesting idea that is a big step in this direction is “secure introductions”. The idea is to automatically share trusted identity information when securely communicating with multiple people. For example, whenever you send a signed, encrypted email to multiple people, the email program should include the key fingerprints of each recipient in that email. Then the email program of the people receiving that email should automatically mark those keys as verified if the sender’s key is trusted and the signature is valid. There is not a meaningful amount of detail leaked in this interaction, since the existence of all the people’s keys and email address is already present in a secure email. The tricky part is figuring out how to make it harder for someone to use this maliciously to spread false identity information while keeping things as automatic as possible. This is very much a long term research idea: there are no widespread implementations of it.</p> https://guardianproject.info/2013/12/10/sqlcipher-has-100m-mobile-users-thanks-to-wechat/ Tue, 10 Dec 2013 16:38:02 -0400 https://guardianproject.info/2013/12/10/sqlcipher-has-100m-mobile-users-thanks-to-wechat/ <p><em>(Note: Originally this post had a title claiming 300 Million WeChat users… that would have included iOS and Android, and we don’t know if the WeChat iOS app also includes SQLCipher encryption or not. That said, there are 50-100M Google Play downloads of WeChat for Android, which does not include all of the users inside China)</em></p> <p>Through some of our own recent sluething, <a href="http://citizenlab.org">Citizen Lab’s</a> research into <a href="https://citizenlab.org/2013/11/asia-chats-analyzing-information-controls-privacy-asian-messaging-applications/">“Asia Chats” security</a>, and now via this <a href="http://blog.emaze.net/2013/09/a-look-at-wechat-security.html">detailed look at WeChat security from Emaze.com</a>, it has been recently discovered that <a href="http://www.wechat.com/">WeChat for Android</a> uses <a href="https://www.zetetic.net/sqlcipher">SQLCipher</a> for local data encryption in its app. We co-developed SQLCipher for Android with <a href="http://zetetic.net/">Zetetic</a>, and have been working to promote its adoption among Android developers who need to protect data stored locally on a device. While many people would point to Android’s Full Disk Encryption feature as a solution for that, only a small percentage of users ever enable it, and even then, once a device is unlocked, then all data is accessible by someone looking to extract it. With SQLCipher, the application can ensure its own data is encrypted, and if the app is closed, then the data is secured.</p> <p>Now, as with most things WeChat, the actually implementation of SQLCipher is not that ideal, utilizing a short key, generated in part from the device’s ID, and some sort of server provided token. Still, at least they tried, and SQLCipher is considered stable enough to be used for the <em><strong>over 300 million WeChat users</strong></em> around the world. Who knows, though, maybe the devs are on our developer list or the SQLCipher list, and we can help them improve their implementation using <a href="https://github.com/guardianproject/cacheword">CacheWord</a>!</p> <p>The biggest irony of this, is that I gave a lightning talk at Google IO 2013, highlighting the concern I had with the rapid growth of WeChat, and their parent company’s and country’s poor record on human rights, free speech, and generally defending their users. With the growth of WeChat beyond the borders of China, it is the first major mobile service to be exported and adopted outside of the Great Firewall, by non-Chinese users.</p> <p><em>My part starts at about 17:00 in, and runs for about 5 minutes…</em></p> <p>So, for now, I raise a toast to the Android developers at Tencent/WeChat, who at least took a shot at providing local message encryption in their app, and may they continue to endeavor to defend their users privacy and security, as best as they can, considering their circumstances.</p> <p>More from the <a href="http://blog.emaze.net/2013/09/a-look-at-wechat-security.html">emaze-ing post</a> below…</p> <blockquote> <p>WeChat locally stores application data in an encrypted SQLite database<br /> named “EnMicroMsg.db”. This database is located in the “MicroMsg”<br /> subfolder inside the application’s data directory (typically something<br /> like “/data/data/com.tencent.mm”).</p> <p>The database is encrypted using SQLCipher, an open source extension for<br /> SQLite that provides full database encryption. The encryption password<br /> is derived from the “uin” parameter (see previous sections) combined<br /> with the device identifier through a custom function. More precisely,<br /> the key generation function leverages the mangle() function shown in the<br /> previous Python snippet. The actual database encryption key can be<br /> generated through the following pseudo-code:</p> <p>password = mangle(deviceid + uin)[:7]</p> <p>Here deviceid is the value returned by the Android API function<br /> TelephonyManager.getDeviceId(). Follows a sample SQLCipher console<br /> session that demonstrate how the EnMicroMsg.db database can be decrypted.</p> <p>$ sqlcipher EnMicroMsg.db<br /> sqlite&gt; PRAGMA key = ‘b60c8e4’;<br /> sqlite&gt; PRAGMA cipher_use_hmac = OFF;<br /> sqlite&gt; .schema<br /> CREATE TABLE conversation (unReadCount INTEGER, status INT, …<br /> CREATE TABLE bottleconversation (unReadCount INTEGER, status INT, …<br /> CREATE TABLE tcontact (username text PRIMARY KEY, extupdateseq long, …<br /> …</p> <p>It is also worth pointing out that, as the key generation algorithm<br /> truncates the password to 7 hex characters, it would be not so difficult<br /> for motivated attackers who are able to get the encrypted database to<br /> brute force the key, even without knowing the uin or the device identifier.</p> </blockquote> https://guardianproject.info/2013/12/06/getting-keys-into-your-keyring-with-gnu-privacy-guard-for-android/ Fri, 06 Dec 2013 15:11:53 -0400 https://guardianproject.info/2013/12/06/getting-keys-into-your-keyring-with-gnu-privacy-guard-for-android/ <p>Now that you can have a full <a href="https://www.gnupg.org" target="_blank"><em>GnuPG</em></a> on your Android device with <a href="https://play.google.com/store/apps/details?id=info.guardianproject.gpg" target="_blank"><em>Gnu Privacy Guard</em></a> for Android, the next step is getting keys you need onto your device and included in <em>Gnu Privacy Guard</em>. We have tried to make it as easy as possible without compromising privacy, and have implemented a few approaches, while working on others. There are a few ways to get this done right now.</p> <p><em>Gnu Privacy Guard</em> registered itself with Android as a handler of all the standard <a href="https://www.rfc-editor.org/rfc/rfc3156.txt" title="RFC3156: MIME Security with OpenPGP" target="_blank">OpenPGP MIME types</a> (<code>application/pgp-keys</code>, <code>application/pgp-encrypted</code>, <code>application/pgp-signature</code>), as well as all of the OpenPGP and GnuPG file extensions (<code>.pkr</code> <code>.skr</code> <code>.key</code> <code>.sig</code> <code>.asc</code> <code>.gpg</code> <code>.bin</code>). This means that users just have to share a file to <em>Gnu Privacy Guard</em> using any of the standard Android methods, these files can be launched from an email attachment, opened from the SD card using a file browser, clicked in the Downloads view, etc.</p> <p>So if you want to quickly send your whole public keyring from your laptop to your mobile device, you can just grab the database file directly from <em>GnuPG</em> and copy it to your SD card. Here is how:</p> <ol> <li>plug your device into your laptop via USB so you can copy files to the SD card</li> <li>find your <em>GnuPG</em> home folder (on GNU/Linux and Mac OS X, it will be in <code>~/.gnupg/pubring.gpg</code>, on Windows it is <code>%APPDATA%\gnupg</code>)</li> <li>In your <em>GnuPG</em> home folder, copy <strong>pubring.gpg</strong> to your device’s SD card</li> <li>unmount and unplug your device</li> <li>on your device, open your favorite file manager app (<a href="https://play.google.com/store/apps/details?id=org.openintents.filemanager" target="_blank"><em>OI File Manager</em></a>, <em>Astro</em>, etc)</li> <li>go to the SD card</li> <li>long-click on <strong>pubring.gpg</strong> and share it to <em>Gnu Privacy Guard</em></li> <li>click OK on the Import Keys dialog</li> </ol> <p>After that, <em>Gnu Privacy Guard</em> will do the rest. Give is some time to sync to the Contacts database, then you’ll see all of your keys from your desktop are now in your People app and are listed in <em>Gnu Privacy Guard</em> itself. You can now encrypt files to any of those keys, or verify files signed by any of those keys. Here are a couple screenshots to illustrate key points in the process, using <em>OI File Manager</em>:</p> <p align="center"> <div id="attachment_12155" style="width: 209px" class="wp-caption alignleft"> <a href="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-0.png"><img aria-describedby="caption-attachment-12155" src="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-0-199x300.png" alt="send your public keyring file" width="199" height="300" class="size-medium wp-image-12155" srcset="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-0-199x300.png 199w, https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-0.png 319w" sizes="(max-width: 199px) 100vw, 199px" /></a> <p id="caption-attachment-12155" class="wp-caption-text"> 1. send your public keyring file </p> </div> </p> <div id="attachment_12156" style="width: 209px" class="wp-caption alignright"> <a href="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-1.png"><img aria-describedby="caption-attachment-12156" src="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-1-199x300.png" alt="choose Gnu Privacy Guard to send the file to" width="199" height="300" class="size-medium wp-image-12156" srcset="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-1-199x300.png 199w, https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-1.png 319w" sizes="(max-width: 199px) 100vw, 199px" /></a> <p id="caption-attachment-12156" class="wp-caption-text"> 2. choose <em>Gnu Privacy Guard</em> to send the file to </p> </div> <div id="attachment_12157" style="width: 209px" class="wp-caption alignleft"> <a href="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-2.png"><img aria-describedby="caption-attachment-12157" src="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-2-199x300.png" alt="click OK to import the key file" width="199" height="300" class="size-medium wp-image-12157" srcset="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-2-199x300.png 199w, https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-2.png 319w" sizes="(max-width: 199px) 100vw, 199px" /></a> <p id="caption-attachment-12157" class="wp-caption-text"> 3. click OK to import the key file </p> </div> <div id="attachment_12158" style="width: 209px" class="wp-caption alignright"> <a href="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-3.png"><img aria-describedby="caption-attachment-12158" src="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-3-199x300.png" alt="now you can see the imported keys in Gnu Privacy Guard" width="199" height="300" class="size-medium wp-image-12158" srcset="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-3-199x300.png 199w, https://guardianproject.info/wp-content/uploads/2013/12/GPGA-import-key-file-3.png 319w" sizes="(max-width: 199px) 100vw, 199px" /></a> <p id="caption-attachment-12158" class="wp-caption-text"> 4. now you can see the imported keys in <em>Gnu Privacy Guard</em> </p> </div> <hr /> <p>There are many ways to get the keyring files like <strong>pubring.gpg</strong> to your device: you can also share the keyring files via email, chat, or even services like <em>Dropbox</em> or <em>Google Drive</em>. Then once the files are on your device, you can import them using the same procedure as above. But keep in mind that you are sending your whole collection of secure contacts to that service, which will have full access to read it. If you have any worries about leaking your keyring to anyone, then a good method is to copy it directly to the SD card.</p> <div id="attachment_12192" style="width: 209px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-search-keyserver.png"><img aria-describedby="caption-attachment-12192" src="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-search-keyserver-199x300.png" alt="search the keyserver for the author's key (I lost the key from 1998, so don't use that one...)" width="199" height="300" class="size-medium wp-image-12192" srcset="https://guardianproject.info/wp-content/uploads/2013/12/GPGA-search-keyserver-199x300.png 199w, https://guardianproject.info/wp-content/uploads/2013/12/GPGA-search-keyserver.png 319w" sizes="(max-width: 199px) 100vw, 199px" /></a> <p id="caption-attachment-12192" class="wp-caption-text"> search the keyserver for the author’s key (the key from 1998 is lost, don’t use that one…) </p> </div> <p>You can also search and download keys via the public pool of OpenPGP keyservers. If you already know someone’s keyid or fingerprint, you can search using that. Otherwise, you can search based on name or email address. But be careful! Downloading a key from a keyserver does not give you a key you can trust. Anyone can upload a key to the keyservers, and they can make that key have any name or email address. Downloading from the keyservers is a convenient way to download a key, but you must verify the key’s fingerprint with the person you are trying to find.</p> <p><div id="attachment_12184" style="width: 160px" class="wp-caption alignleft"> <a href="https://guardianproject.info/wp-content/uploads/2013/12/0x9F0FE587374BBE81-qr.png"><img aria-describedby="caption-attachment-12184" src="https://guardianproject.info/wp-content/uploads/2013/12/0x9F0FE587374BBE81-qr-150x150.png" alt="scan this QR Code to get the author's OpenPGP key" width="150" height="150" class="size-thumbnail wp-image-12184" srcset="https://guardianproject.info/wp-content/uploads/2013/12/0x9F0FE587374BBE81-qr-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2013/12/0x9F0FE587374BBE81-qr-300x300.png 300w, https://guardianproject.info/wp-content/uploads/2013/12/0x9F0FE587374BBE81-qr.png 330w" sizes="(max-width: 150px) 100vw, 150px" /></a></p> <p><p id="caption-attachment-12184" class="wp-caption-text"> scan this QR Code to get the author’s OpenPGP key </p> </div>In conjunction with the</p> <p><a href="http://web.monkeysphere.info/" target="_blank">Monkeysphere</a> project, we developed a standard URI scheme for sending OpenPGP key fingerprints. For example, you can find my key ID here: <a href="openpgp4fpr:9F0FE587374BBE81"><code>openpgp4fpr:9F0FE587374BBE81</code></a>. This provides a clickable way to get an OpenPGP key. On an Android device with <em>Gnu Privacy Guard</em> installed, you can click on this link to download my key from the keyservers. This URI scheme also works well in QR Codes. Scan this QR Code on your device with an app like <a href="https://play.google.com/store/apps/details?id=com.google.zxing.client.android" title="Barcode Scanner in the Google Play Store" target="_blank"><em>Barcode Scanner</em></a>, and click <strong>Open Browser</strong>, and Gnu Privacy Guard will download my key to your device.</p> <p>There are other ideas out there that we also want to support. For example, <a href="http://sufficientlysecure.org/index.php/openpgp-keychain/" target="_blank"><em>OpenPGP Keychain</em></a> includes a way to transmit the whole public key via <a href="https://en.wikipedia.org/wiki/Near_field_communication" title="Near Field Communication" target="_blank">NFC</a>. This allows people can swap keys directly from phone to phone without having internet access at all. But NFC is quite slow to transmit data so the devices need to be held together for a while until the whole key is received. NFC could be used to rapidly transmit an <code>openpgp4fpr:</code> URI, and then the whole public key would be fetched from a keyserver, but that then requires internet access and also leaks a bit of metadata to the internet. A better technique would be to transmit the entire public key over Bluetooth, using NFC to setup the Bluetooth session. We’re also looking at ways to do this via WiFi and <a href="https://en.wikipedia.org/wiki/Bonjour_(software)" target="_blank">Bonjour (mDNS)</a> local service advertisements.</p> https://guardianproject.info/2013/12/03/ostel.co-secure-voip-network-partners-with-open-hosting/ Tue, 03 Dec 2013 17:56:18 -0400 https://guardianproject.info/2013/12/03/ostel.co-secure-voip-network-partners-with-open-hosting/ <p>Ostel.co began as a R&amp;D effort sponsored by The Guardian Project. The question: Is a peer-to-peer secure voice and video call network possible to build with open Internet standards and Open Source software? After two years and tens of thousands of users later, the answer is a resounding YES!</p> <p>Two of the crucial components of any standards based VoIP service are infrastructure to route calls and a database to locate end users. <a href="http://openhosting.com/">Open Hosting’s</a> service was a perfect fit, so we’ve teamed up for ongoing support of ostel.co. Open Hosting has a high speed, low-latency network in the southern USA, which hosts the backend to route calls over the ostel.co domain. It also has a clearly defined, concise <a href="http://openhosting.com/about-us/legal/">Privacy Policy and Terms of Service</a>.</p> <p>The Guardian Project will continue to support the <a href="https://dev.guardianproject.info/projects/ostn/wiki">Open Secure Telephony Network</a>. This open source project aims to make it as simple as possible for anyone to stand up their own secure VoIP backend with a custom domain. OSTN is a <a href="https://dev.guardianproject.info/projects/ostel/wiki/Server_Documentation">best practices guide</a> to build your own application stack and a federated network of VoIP services. The more operators who host their own domain, the larger the global federated infrastructure becomes, freeing users from carrier control and ensuring call security. There are also ongoing automation projects to bring ease to hosting your own domain. For example, <a href="https://index.docker.io/u/guardianproject/">Docker repositories</a>, <a href="https://github.com/guardianproject/chef-twelvetone/tree/kamailio">Chef cookbooks</a> and even a <a href="https://dev.guardianproject.info/projects/ostn/wiki/Raspberry_Pi">guide for the Raspberry Pi</a>!</p> <p>If you would like to get started with free calls over <a href="https://ostel.co">ostel.co</a>, register for an account and use any of the supported client applications. If you would like support building your own secure VoIP backend, check out the <a href="https://dev.guardianproject.info/projects/ostel/wiki">docs</a>, hang out in the #guardian project IRC channel and email su&#x70;p&#x6f;r&#x74;@&#x67;u&#x61;r&#x64;i&#x61;npro&#x6a;e&#x63;t&#x2e;i&#x6e;f&#x6f; . We look forward to growing the network!</p> https://guardianproject.info/2013/11/21/voip-security-architecture-in-brief/ Thu, 21 Nov 2013 19:07:17 -0400 https://guardianproject.info/2013/11/21/voip-security-architecture-in-brief/ <p>Voice over IP (VoIP) has been around for a long time. It’s ubiquitous in homes, data centers and carrier networks. Despite this ubiquity, security is rarely a priority. With the combination of a handful of important standard protocols, it is possible to make untappable end to end encryption for an established VoIP call.</p> <p>TLS is the security protocol between the signaling endpoints of the session. It’s the same technology that exists for SSL web sites; ecommerce, secure webmail, Tor and many others use TLS for security. Unlike web sites, VoIP uses a different protocol called the Session Initiation Protocol (SIP) for signaling: actions like ringing an endpoint, answering a call and hanging up. This is the metadata of calls. SIP-TLS uses the standard Certificate Authorities for key agreement. This implies trust between the certificate issuer and the calling endpoints.</p> <div id="attachment_12006" style="width: 440px" class="wp-caption aligncenter"> <a href="http://www.siptutorial.net/SIP/relation.htm"><img aria-describedby="caption-attachment-12006" src="https://guardianproject.info/wp-content/uploads/2013/11/relation.gif" alt="SIP Dialog" width="430" height="322" class="size-full wp-image-12006" /></a> <p id="caption-attachment-12006" class="wp-caption-text"> An example of a SIP dialog </p> </div> <p>To add a little complexity, the content of calls has only a small relationship to SIP. The key agreement protocol for P2P VoIP content is called ZRTP. In a true P2P system, all the key agreement and encryption of a call’s content happens in the endpoint applications. An important distinction between VoIP and other networked communications is that all devices are both client and server at once, so we have only “endpoints” rather than “clients” or “servers”. Once the endpoints agree on a shared secret, the ZRTP session ends and the SRTP session begins. When established, all audio and video content going over the network is encrypted. Only the two peer endpoints who established a session with ZRTP can decrypt the media stream. This is the part of the conversation that cannot be wiretapped nor can metadata of sessions in progress be spied on.</p> <div id="attachment_12008" style="width: 560px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2013/11/zrtp_overview.png"><img aria-describedby="caption-attachment-12008" src="https://guardianproject.info/wp-content/uploads/2013/11/zrtp_overview-902x1024.png" alt="ZRTP Overview" width="550" height="624" class="size-large wp-image-12008" srcset="https://guardianproject.info/wp-content/uploads/2013/11/zrtp_overview-902x1024.png 902w, https://guardianproject.info/wp-content/uploads/2013/11/zrtp_overview-264x300.png 264w, https://guardianproject.info/wp-content/uploads/2013/11/zrtp_overview.png 986w" sizes="(max-width: 550px) 100vw, 550px" /></a> <p id="caption-attachment-12008" class="wp-caption-text"> An example ZRTP key exchange </p> </div> <p>To step back a little, let’s review some acronyms. First there is <a href="http://www.siptutorial.net/SIP/background.html">SIP</a> (Session Initialization Protocol). This protocol is encrypted with TLS. It contains the IP addresses of the endpoints who wish to communicate but it does not interact with the audio or video stream.</p> <p>Second, there is ZRTP. This protocol enters into the mix after a successful SIP dialog establishes a call session by locating the two endpoints. It transmits key agreement information over a unverified SRTP channel between the peers. The peers use their voices to speak a secret that verifies that the channel is secure between only the two peers.</p> <p>Third, enter SRTP. Only after the ZRTP key exchange succeeds is the call content encrypted with the Secure Real Time Protocol. From this point forward, all audio and video is secure and uniquely keyed to each individual session.</p> <p>This brief was inspired by the numerous discussions I’ve participated in online and offline during my ongoing operation of ostel.co, a secure VoIP service sponsored by The Guardian Project. I understand that VoIP is complex when compared to HTTP and the mainstream understanding of the securirty elements often omits the ZRTP/SRTP content, rather focusing on only the SIP-TLS signaling. While signaling is important, few calls would be useful without content.</p> https://guardianproject.info/2013/11/21/a-tag-team-git-workflow-that-incorporates-auditing/ Thu, 21 Nov 2013 14:03:22 -0400 https://guardianproject.info/2013/11/21/a-tag-team-git-workflow-that-incorporates-auditing/ <p>Git is as wonderful as it is terrible, it is immensly flexible but also far from intuitive. So to make our lives easier, we try to use git as it was originally intended, as a toolkit for building workflows.</p> <p><div id="attachment_11990" style="width: 310px" class="wp-caption alignright"> <a href="http://git-scm.com/book/en/Distributed-Git-Distributed-Workflows#Integration-Manager-Workflow"><img aria-describedby="caption-attachment-11990" src="https://guardianproject.info/wp-content/uploads/2013/11/integration_manager_workflow-300x121.png" alt="Integration-Manager Workflow" width="300" height="121" class="size-medium wp-image-11990" srcset="https://guardianproject.info/wp-content/uploads/2013/11/integration_manager_workflow-300x121.png 300w, https://guardianproject.info/wp-content/uploads/2013/11/integration_manager_workflow.png 500w" sizes="(max-width: 300px) 100vw, 300px" /></a></p> <p><p id="caption-attachment-11990" class="wp-caption-text"> Integration-Manager Workflow </p> </div>We use a simple version of the “</p> <p><a href="http://git-scm.com/book/en/Distributed-Git-Distributed-Workflows" target="_blank">Integration-Manager Workflow</a>“. One key difference is that we often have multiple contributors acting as the integration manager. This means that there is always someone else besides the original author reviewing each commit. For example: I make a commit and push it to my public developer’s repo. I ask Abel to review my commit, and if he agrees with it, he then pushes it to the official public “_upstream_” repo (aka “blessed repository”). And since git will tell us if a remote repo is different than our local repo, this process makes it harder for an attacker to slip a commit into our remote repo without us noticing.</p> <p>The key to this workflow is that all contributors must fork from the same git repo, and mark that one as the one <em>upstream</em> repo. We often end up <a href="http://git-scm.com/book/en/Git-Branching-Rebasing" target="_blank">rebasing</a> things to make sure each commit is based on the most up-to-date code. It also makes for a clean, readable history. That means each contributor’s public repo will be rebased from time to time, so you cannot rely on those repos as something to base your own work off of.</p> <p>At the very least, a contributor’s local repo should be set up to talk to two remote repos: the contributor’s own public repo and the <em>upstream</em> repo. I’ll use github as an example of how to get started in this workflow. Say you want to contribute to <a href="https://github.com/guardianproject/keysync">https://github.com/guardianproject/keysync</a>, start by making a fork via the github.com<img src="https://guardianproject.info/wp-content/uploads/2013/11/fork.png" alt="fork" width="65" height="19" /> button. Once that is setup, its time to clone it and configure the rest. I’m <strong>eighthave</strong> on github, so this example will use my public repo. I work with Abel Luck on KeySync, so we’ll add his repo as another contributor repo.</p> <pre><code>git clone https://github.com/eighthave/keysync cd keysync git remote add upstream https://github.com/guardianproject/keysync git fetch upstream git remote add abeluck https://github.com/abeluck/keysync git fetch abeluck </code></pre> <p>Now I can see all of the remotes in my local git repo, and work with them as branches:</p> <pre><code class="language-console">$ git remote -v abeluck https://github.com/abeluck/keysync (fetch) abeluck https://github.com/abeluck/keysync (push) origin https://github.com/eighthave/keysync (fetch) origin https://github.com/eighthave/keysync (push) upstream https://github.com/guardianproject/keysync (fetch) upstream https://github.com/guardianproject/keysync (push) $ git branch -va * master 1536fcf parse version number from setuptools remotes/abeluck/master 1536fcf parse version number from setuptools remotes/origin/HEAD -&gt; origin/master remotes/origin/master 1536fcf parse version number from setuptools remotes/upstream/master 1536fcf parse version number from setuptools </code></pre> <p>Now I do some work, and commit it to my local repo, and want to push them for Abel to review. In the meantime Abel has pushed some commits for me to review into his remote repo <code>abeluck</code>. So I need to fetch his new commits, then rebase my new local commits on top of of his new commits. When its all ready, I push it to my remote repo <code>origin</code>.</p> <pre><code>git checkout master git fetch abeluck (review the commits...) git rebase abeluck/master git push origin master </code></pre> <p>Now I’ve reviewed Abel’s new commits and incorporated them into my public repo. Abel is ready to review my new commits, which are rebased on top of his. If he agrees with them, he’ll push them to the official “blessed” repo <code>upstream</code>. Then his local repo will be in sync with the latest <em>upstream</em>.</p> <pre><code>git checkout master git fetch eighthave git merge eighthave/master (review the commits...) git push upstream master </code></pre> <p><strong>Review The Commits</strong></p> <p>You can also review the commits before rebasing or merging them into the local master. This is done by switching to the remote branch, which is kind of like a local branch, but not entirely. It works for checking out and viewing just fine though:</p> <pre><code>git checkout eighthave/master (review the commits...) git checkout master </code></pre> <p><strong>Undoing A Bad Rebase</strong></p> <p>Git doesn’t provide any undo, and it also will let you delete things, not a good situation for learning this stuff. Luckily it does give you the tools for making something like an undo function. I use a tag for this, and I always use the same name for that tag: <code>pre-rebase</code>. Before starting anything that involves rebasing, I first do:</p> <pre><code>git checkout master git tag pre-rebase </code></pre> <p>Then after the rebase is successfully deleted, I remove that tag:</p> <pre><code>git tag -d pre-rebase </code></pre> <p><strong>Switching Your Master When Things Have Diverged</strong></p> <p>It is often the case that in the process of merging and rebasing, the developers’ repos will be in separate branches of the original tree. Once the “integration manager” person has pulled in all the commits, rebased and merged everything, and pushed the approved commits to the upstream repo, the other developers will likely need to reset their repos to resync with the upstream:</p> <pre><code>git fetch upstream git checkout upstream/master git branch -D master git branch master git checkout master git push -f origin master </code></pre> <p>So <code>git branch -D master</code> does indeed mean force-delete your master branch. That is required before setting your master branch to a new branch. If you want, you can keep that old branch around by doing <code>git branch myfeaturedevbranch</code> before doing <code>git branch -D master</code>.</p> <p><strong>Keeping All The History</strong></p> <p>One addition to this process is for each contributor to mark their own tree with a labeled branch before rebasing, and then pushing those branches to the contributor’s public repo. This will then provide a complete history of the process, if that is desired. For example: I push some commits to my public repo, then Abel rebases my commits onto some of his work and pushes to the <em>upstream</em>. In this case, the history in my public repo will be different than what is in the <em>upstream</em> repo as well as Abel’s public repo.</p> https://guardianproject.info/2013/11/18/turn-your-device-into-an-app-store/ Mon, 18 Nov 2013 16:27:30 -0400 https://guardianproject.info/2013/11/18/turn-your-device-into-an-app-store/ <p>As we’ve touched upon in <a href="https://guardianproject.info/2013/11/05/setting-up-your-own-app-store-with-f-droid/">previous blog posts </a> the Google Play model of application distribution has some disadvantages. Google does not make the Play store universally available, instead limiting availability to a subset of countries. Using the Play store to install apps necessitates both sharing personal information with Google and enabling Google to remotely remove apps from your device (colloquially referred to as <a href="http://www.engadget.com/2008/10/16/google-implemented-an-android-kill-switch-those-rascals/">having a ‘kill switch’</a>). Using the Play store also requires a functional data connection (wifi or otherwise) to allow apps to be downloaded. Often there is a need to quickly bootstrap users during training sessions in countries with unreliable/restricted data connectivity, or in extreme cases, <a href="http://www.nytimes.com/2011/01/29/technology/internet/29cutoff.html?_r=0">no internet connectivity at all</a>.</p> <p><a href="https://f-droid.org/">F-Droid</a> addresses many of these concerns, but still requires a functional data connection in order to access the repository housing applications available for install. Wouldn’t it be great if there was an easy way for users to share applications amongst themselves, in absence of a reliable data connection? Today we would like to announce initial steps the Guardian Project is taking to enable this exact functionality. We’ve been working on a prototype application capable of building F-Droid repositories <strong>on-device</strong>, allowing users to share apps they already have installed to other users through F-Droid. In this way savvy users can quickly and securely share applications they already know and trust with friends and family without requiring a central market/repository or a reliable internet connection.</p> <p>To start, we’ve built a stand-alone prototype application we call “_<strong>Kerplapp</strong>_” (as in <em>Kerplop for Apps)</em>. Using Kerplapp an established user can select applications already installed on their phone that they wish to make available to other users. Using the selected applications Kerplapp builds a <a href="https://f-droid.org/manual/fdroid.html#Simple-Binary-Repository">simple binary F-Droid repostiory</a> on the user’s device. The local on-device repository is then made available over a WiFi connection to other users on the local area network. Kerplapp will even display a QR code with the information required to add the local Kerplapp repo as a source repository for an F-Droid client running on another device. We hope to eventually merge our work back into the official F-droid Android client, but while we work out the kinks the Kerplapp application operates side-by-side with the F-Droid client app.</p> <div id="attachment_11966" style="width: 190px" class="wp-caption alignright"> <a href="https://guardianproject.info/wp-content/uploads/2013/11/Screenshot_2013-11-18-16-02-48.png"><img aria-describedby="caption-attachment-11966" class="size-medium wp-image-11966" alt="Sharing access to a Kerplapp repo with a QR code." src="https://guardianproject.info/wp-content/uploads/2013/11/Screenshot_2013-11-18-16-02-48-180x300.png" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2013/11/Screenshot_2013-11-18-16-02-48-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2013/11/Screenshot_2013-11-18-16-02-48-614x1024.png 614w, https://guardianproject.info/wp-content/uploads/2013/11/Screenshot_2013-11-18-16-02-48.png 768w" sizes="(max-width: 180px) 100vw, 180px" /></a> <p id="caption-attachment-11966" class="wp-caption-text"> Sharing access to a Kerplapp repo with a QR code. </p> </div> <p>Building on top of F-Droid has a number of advantages. First, we can directly benefit from the tremendous effort and success of the F-Droid project! We’ve been actively contributing improvements <a href="https://gitorious.org/f-droid/fdroidclient/merge_requests/39">back to both the F-droid client</a> and <a href="https://gitorious.org/f-droid/fdroidserver/merge_requests/127">the F-droid server</a>, making it easier for everyone to set up new F-Droid repos and share connection details. Secondly, by using a binary F-Droid repository we can ensure that when users share apps between each other that the apps will continue to receive updates through other channels. That is, if I share an app with you through Kerplapp you will be able to install updates to the app from other F-Droid binary repos and other Kerplapp users – wherever the app and its updates are available with the same APK signature. The F-Droid client will do the hard work of determining what updates are available and compatible with your device</p> <p>There’s a lot of work left to be done! One of our short term goals include enabling Bonjour support so that the F-Droid client can find repositories on the local network without requiring them to be added manually. We’re interested in supporting device to device app transfer over a number of channels, starting with HTTPS and eventually adding support for bluetooth and NFC. Building on the success of ChatSecure we’re actively working on supporting F-Droid app transfer over <a href="https://dev.guardianproject.info/projects/gibberbot/wiki/OTRDATA_Specifications">OTR-Data</a>, the ChatSecure proposal for in-band OTR encrypted file transfers. With F-Droid as an OTR-DATA endpoint we can support peer to peer app transfer over a trusted, authenticated, and encrypted channel. We’re also exploring how we can use the OTR keys your contacts already trust to <a href="https://f-droid.org/manual/fdroid.html#Signing">sign the F-Droid repository metadata index</a>, providing greater trust in the accuracy of the metadata provided by peer to peer repositories.</p> <p>If you’re curious you can <a href="https://dev.guardianproject.info/projects/bazaar">follow Kerplapp’s development on our project tracker.</a> We’re also looking for adventurous users <a href="https://guardianproject.info/builds/Kerplapp/">to install the Kerplapp prototype application</a> to provide feedback and testing.</p> https://guardianproject.info/2013/11/12/your-own-private-dropbox-with-free-software/ Tue, 12 Nov 2013 12:50:23 -0400 https://guardianproject.info/2013/11/12/your-own-private-dropbox-with-free-software/ <p>There are lots of file storage and sharing software packages out there that make it easy for a group of people to share files. Dropbox is perhaps the most well known of the group, it provides an easy way for a group of people to share files. The downside of Dropbox is that it is not a private service, just like any cloud-based service. Dropbox has total access to your files that you store there. That means its likely that the NSA and its collaborators do too.</p> <p>Dropbox also knows where the computers are that are accessing their service because they can see the IP address of the incoming connections. To help with this, it is possible to use use Dropbox over Tor, thankfully they have provided proxy settings.</p> <p>For our shared files, we use <a href="http://sparkleshare.org/" target="_blank">SparkleShare</a>. It provides an experience very similar to Dropbox: you have a SparkleShare folder that is synced up with the service, and in turn any other users who are also linked up to it. Once its setup, it is as easy to use as Dropbox, but setting it up takes a bit more work than Dropbox. It builds upon two software packages well known for security and reliability: <code>git</code> and <code>ssh</code>, and works with Tor Hidden Services. It runs on Windows, Mac OS X, and GNU/Linux, and there is an <a href="https://github.com/NewProggie/SparkleShare-Android" target="_blank">Android client</a> in the works.<a href="https://guardianproject.info/wp-content/uploads/2013/11/sparkleshare-onion.png"><img src="https://guardianproject.info/wp-content/uploads/2013/11/sparkleshare-onion.png" alt="sparkleshare-onion" width="312" height="342" class="alignright size-full wp-image-11936" srcset="https://guardianproject.info/wp-content/uploads/2013/11/sparkleshare-onion.png 312w, https://guardianproject.info/wp-content/uploads/2013/11/sparkleshare-onion-273x300.png 273w" sizes="(max-width: 312px) 100vw, 312px" /></a></p> <p>You can use any git service as the server for SparkleShare, including github, bitbucket, <a href="https://gitorious.org/" target="_blank">gitorious</a>, etc. But these have the same issues as putting your files on Dropbox: that service has complete access to your files. For extra protection, SparkleShare <a href="https://github.com/hbons/SparkleShare/wiki/Client-Side-Encryption" target="_blank">can encrypt the files on the client-side</a>, have encrypted shared folders with SparkleShare, so that the server does not have access to the files. For the last piece of setting up a private SparkleShare, you need a computer that you can <code>ssh</code> to, and has <code>git</code> and Tor on it. This computer could even be an old Android device running <a href="https://guardianproject.info/code/lildebi/" target="_blank">Lil’ Debi</a>, it only needs enough disk space for your SparkleShare files and a steady network connection. Running it on your own computer means it can use a Tor Hidden Service, and that all of the metadata related to who is editing what files remains private.</p> <p>To start, setup a Tor Hidden Service to the sshd port. You can read all about that process in the <a href="https://www.torproject.org/docs/tor-hidden-service.html" target="_blank">Tor instructions</a>, but basically, you need to add something like this to the <code>torrc</code> configuration file:</p> <pre>HiddenServiceDir /var/lib/tor/ssh_hidden_service/ HiddenServicePort 22 127.0.0.1:22 </pre> <p>Then restart tor, and it will generate two files in <code>/var/lib/tor/ssh_hidden_service/</code>, open the file called <code>hostname</code> to see your new .onion address. We’re going to use <code>fakefakefakefake.onion</code> as our made-up one for this HOWTO. That is the address you will use in SparkleShare as the server address.</p> <p>Next <code>ssh</code> needs to be setup to use Tor to access the .onion address of the Tor Hidden Service. To do that we need the wonderful Netcat tool (<code>nc</code>). On Debian/Ubuntu, run <code>sudo apt-get install netcat-openbsd</code> to get it, its included with Mac OS X by default. Now edit your SSH config file, its usually in <code>~/.ssh/config</code>, and add this section:</p> <pre>Host *.onion Compression yes ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p </pre> <p>For Windows, you need to use <code>connect</code> proxy, which is thankfully included in SparkleShare. You can optionally use <code>connect</code> instead of Netcat/<code>nc</code> on Mac OS X (<code>fink install connect</code> or <code>brew install connect</code>) and GNU/Linux (e.g. <code>apt-get install connect-proxy</code> or <code>yum install connect-proxy</code>). Instead of the snippet above, use this snippet in <code>~/.ssh/config</code> to use <code>connect</code>:</p> <pre>Host *.onion Compression yes ProxyCommand connect -5 -S 127.0.0.1:9050 %h %p </pre> <p>Now its time to set up the git repo on the server that will be the conduit for sharing files between the different users. Basically, all you need to do is create a new folder, then make it a “bare” git repo (you can read <a href="http://git-scm.com/book/en/Git-on-the-Server-Setting-Up-the-Server" target="_blank">all about it in the git book</a>):</p> <pre>ssh g&#x69;t&#x40;&#x66;a&#x6b;e&#x66;&#x61;k&#x65;f&#x61;&#x6b;e&#x66;a&#x6b;&#x65;.&#x6f;n&#x69;&#x6f;n mkdir /home/git/MyPrivateShare cd /home/git/MyPrivateShare git init --bare </pre> <p>For sshing to the git, we set up a single account called <code>git</code>, then to grant access, we add the SSH key (SparkleShare calls this the <em>Client ID</em>) to the <code>git</code> account’s <code>~/.ssh/authorized_keys</code> file.</p> <p>Now everything should be ready to start adding clients! In SparkleShare, go to Add Hosted Project…, choose On my own server, then enter your username and .onion address (<em>ssh:&#x2f;&#x2f;&#x67;&#x69;t@fak&#x65;&#x66;&#x61;&#x6b;efake&#x66;&#x61;&#x6b;&#x65;.onio&#x6e;</em>) in <strong>Address</strong> and the path to the git repo (<em>/home/git/MyPrivateShare</em>) in <strong>Remote Path</strong>:</p> <p><a href="https://guardianproject.info/wp-content/uploads/2013/11/Screenshot-SparkleShare-Setup.png"><img src="https://guardianproject.info/wp-content/uploads/2013/11/Screenshot-SparkleShare-Setup.png" alt="SparkleShare Setup" width="686" height="427" class="alignnone size-full wp-image-11945" srcset="https://guardianproject.info/wp-content/uploads/2013/11/Screenshot-SparkleShare-Setup.png 686w, https://guardianproject.info/wp-content/uploads/2013/11/Screenshot-SparkleShare-Setup-300x186.png 300w" sizes="(max-width: 686px) 100vw, 686px" /></a></p> <p>Now the client will download the entire git repository from the server, and you’ll then have a working shared dropbox! If there are a lot of files in it, then the first sync can take a long time before any files show up. This is because git first downloads the entire history first, then it checks out the files. After that initial setup, then the new files show up quite quickly.</p> <p>So this SparkleShare setup keeps your files on computers that you control, it prevents information and metadata from being leaked to the network while people are using this SparkleShare setup. When using Client Side Encryption, even less data is leaked. The server cannot access the content of the files at all since they are encrypted. The the server in this case would only be able to see the network traffic, and which ssh key was used to access the server. If everyone accessing this setup used the same user account (i.e. <code>git</code>) and ssh key, then the server would not even know which user is making the changes. This is about as private as you could hope for in a shared dropbox folder.</p> <p>One last nice feature of this setup is that git server does not need a domain name, static IP or even a public IP, it just needs a working internet connection. As long as it can connect to Tor, then the Hidden Service will work. So if this private dropbox is for extra sensitive stuff, it could be stashed anywhere it can get power and wifi.</p> https://guardianproject.info/2013/11/05/setting-up-your-own-app-store-with-f-droid/ Tue, 05 Nov 2013 11:55:43 -0400 https://guardianproject.info/2013/11/05/setting-up-your-own-app-store-with-f-droid/ <p>(_This blog post as now been cooked into an <a href="https://f-droid.org/wiki/page/Setup_an_FDroid_App_Repo" target="_blank">updated HOWTO</a>_)</p> <p>The Google Play Store for Android is not available in all parts of the world, US law restricts its use in certain countries like Iran, and many countries block access to the Play Store, like China. Also, the Google Play Store tracks all user actions, reporting back to Google what apps have been installed and also run on the phone. Because of the NSA leaks, we’re seeing that governments are <a href="http://www.theguardian.com/technology/2013/oct/30/google-reports-nsa-secretly-intercepts-data-links" target="_blank">actively tapping</a> into <a href="http://www.nytimes.com/2013/10/31/technology/nsa-is-mining-google-and-yahoo-abroad.html" target="_blank">the raw data streams</a> of Google, Yahoo, and others. So that means the information the Google Play Store sends back to Google is also intercepted by the NSA (and probably other country’s agencies), and that information is shared with other governments. In other words, your activity on the Google Play Store is far from private. Lastly, the Google Play Store is not free software, unlike the core of Android itself. It is proprietary software that Google entirely controls.</p> <p><img src="https://guardianproject.info/wp-content/uploads/2013/11/your-own-app-store.png" alt="your-own-app-store" width="300" height="203" class="alignright size-full wp-image-11896" /> <a href="https://f-droid.org" title="F-Droid Home Page" target="_blank">F-Droid</a> is a wonderful, free app store for Android. It is modeled after the <a href="http://www.debian.org" title="Debian home page" target="_blank">Debian GNU/Linux</a> distro. It has its own package repositories (repos) and build servers for all the apps that are part of the official OS. Like Debian and Ubuntu, you can also setup your own repos for anyone to use. Any free software can be added to the official F-Droid repos, where they are built and signed by the F-Droid server. This can be annoying because it means that your apps in F-Droid are signed by a different key than your apps in the Google Play Store. If you host your own F-Droid repo, then people can use F-Droid to install your own builds signed by your own signing key.</p> <p>This is a quick HOWTO for how to setup such a repository on a Debian or Ubuntu box. It is somewhat technical, you will use the terminal, but you don’t need to be a terminal expert to follow along. First you need a the <code>fdroidserver</code> tools and a webserver. For the webserver, here we use <em>nginx</em> for the webserver since its lightweight, but any will do if you already have one running. The fdroidserver tools are not yet in the official Debian/Ubuntu/etc repos, so you have to add our PPA (Personal Package Archive) to get it (fingerprint: <tt>F50E ADDD 2234 F563</tt>):</p> <pre><code>sudo add-apt-repository ppa:guardianproject/ppa sudo apt-get update sudo apt-get install fdroidserver nginx </code></pre> <p>In the case of this HOWTO, we’re going to setup a “<a href="https://f-droid.org/manual/fdroid.html#Simple-Binary-Repository" target="_blank">Simple Binary Repository</a>” to host our official APKs. The repo will be set up in the recommended <code>fdroid/</code> subdirectory. This gives the <code>fdroid</code> tool its own directory to work in, and makes the repo URL clearly marked as an FDroid repo. Let’s give our normal user control over this subdirectory in the web root so that we don’t need to run the F-Droid tools as root (with <em>nginx</em>, the webroot is <code>/usr/share/nginx/www</code>, it is different for other webservers):</p> <pre><code>sudo mkdir /usr/share/nginx/www/fdroid sudo chown -R $USER /usr/share/nginx/www/fdroid cd /usr/share/nginx/www/fdroid fdroid init </code></pre> <p>Now put your APK files into <code>/usr/share/nginx/www/fdroid/repo</code> and you are ready to run the commands to build the repo (if <code>fdroid init</code> cannot find your Android SDK in <code>/opt/android-sdk</code> or <code>$ANDROID_HOME</code>, it will prompt you for the path):</p> <pre><code>cd /usr/share/nginx/www/fdroid cp /path/to/*.apk /usr/share/nginx/www/fdroid/repo/ fdroid update -c fdroid update </code></pre> <p><a href="https://f-droid.org"><img src="https://guardianproject.info/wp-content/uploads/2013/11/fdroidheader3-300x75.png" alt="fdroidheader3" width="300" height="75" class="alignleft size-medium wp-image-11906" srcset="https://guardianproject.info/wp-content/uploads/2013/11/fdroidheader3-300x75.png 300w, https://guardianproject.info/wp-content/uploads/2013/11/fdroidheader3.png 720w" sizes="(max-width: 300px) 100vw, 300px" /></a>Voila! Now you have a working F-Droid Repo! Add it to an F-Droid client on your Android device to test it out. That is done in the <strong>Manage Repos</strong> screen available from the menu. Your repo URL will be the hostname or IP address of your machine with <code>/fdroid/repo/</code> added to the end of it, i.e. <code>https://mysecureserver.com/fdroid/repo/</code> or <code>http://192.168.2.53/fdroid/repo/</code>. You can temporarily uncheck the official repos to easily see what F-Droid found in your new repo.</p> <h2 id="customization">Customization</h2> <p>You can also customize your repo by editing the config file. Be sure to use a programming text editor, like <code>editor /usr/share/nginx/www/fdroid/config.py</code>. In the config file, you can set the name of the repo, the description, the icon, paths to specific versions of the build tools, links to a related wiki, and whether to keep stats. Here’s the basic repo description block:</p> <pre><code>repo_url = &quot;https://guardianproject.info/fdroid/repo&quot; repo_name = &quot;My Local Repo&quot; repo_icon = &quot;GP_Logo_hires.png&quot; repo_description = &quot;&quot;&quot; This is a local test repository of Hans-Christoph Steiner &lt;&amp;#x68;a&amp;#x6e;s@&amp;#x67;ua&amp;#x72;d&amp;#x69;&amp;#x61;n&amp;#x70;ro&amp;#x6a;e&amp;#x63;&amp;#x74;.&amp;#x69;nf&amp;#x6f;&gt;. It is a repository of Guardian Project apps. &quot;&quot;&quot; </code></pre> <p>To put your icon into your repo, choose a PNG image to put in your repo. The PNG goes in <code>/usr/share/nginx/www/fdroid/</code>, the file can be named whatever you want (by default its <code>fdroid-icon.png</code>). If you change the name from the default, be sure to update <code>repo_icon</code> and <code>archive_icon</code> in <code>/usr/share/nginx/www/fdroid/config.py</code></p> <h2 id="more-security">More Security</h2> <p><a href="https://guardianproject.info/wp-content/uploads/2010/02/apg.png"><img src="https://guardianproject.info/wp-content/uploads/2010/02/apg-150x150.png" alt="apg" width="150" height="150" class="alignright size-thumbnail wp-image-1029" srcset="https://guardianproject.info/wp-content/uploads/2010/02/apg-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2010/02/apg.png 256w" sizes="(max-width: 150px) 100vw, 150px" /></a>Now that you have a working repo, its time to improve the security. Generating a repo in place is very easy, that is why this HOWTO started there, but it is not as secure as it should be if your repo is going to be your main distribution point. When generating the repo in place, make sure that <code>config.py</code> is not accessible via the web, since it contains passwords. If the file permissions are correct (e.g. <code>chmod 0600 config.py</code>), then <code>config.py</code> will not be readable by the webserver. But the signing keys will still be that public server. To improve this situation, generate the repo on a non-public machine like your laptop, keeping <code>config.py</code> and the keystore only on that machine, then use <code>fdroid server update</code> to publish the changes to your repo on a separate server. You just need to set <code>serverwebroot</code> in <code>config.py</code> properly, then <code>fdroid server update</code> will do the publishing via rsync over ssh. So both computers will have to have ssh and rsync installed and setup.</p> <p>You can also use your own existing signing key rather than the one generated by <code>fdroid init</code>, just edit <code>repo_keyalias</code>, <code>keystore</code>, <code>keystorepass</code>, <code>keypass</code>, and <code>keydname</code> in <code>/usr/share/nginx/www/fdroid/config.py</code></p> <p>Since we like Tor and its Hidden Services for providing privacy, we also want to setup an F-Droid repository that is accessible over a Tor Hidden Service aka onion address. This will be covered in a future HOWTO.</p> https://guardianproject.info/2013/10/31/issues-when-distributing-software/ Thu, 31 Oct 2013 15:51:19 -0400 https://guardianproject.info/2013/10/31/issues-when-distributing-software/ <p>There is currently a <a href="http://lists.debian.org/debian-security/2013/10/msg00027.html" target="_blank">discussion underway on the Debian-security list</a> about adding TLS and Tor functionality to the official repositories (repos) of Debian packages that is highlighting how we need to update how we think about the risks when distributing software. Mostly, we are used to thinking about making sure that the software that the user is installing is the same exact software that has been posted for distribution. This is generally handled by signing the software package, then verifying that signature on the user’s machine. This is how it works on Mac OS X, Windows, Debian, etc. etc.</p> <p>But the authenticity of a software package is not the only issue that needs to be addressed, especially these days where many companies and governments around the world are trying to track everything that anyone is doing on the internet. In order to understand why Tor and TLS would be useful here, it good to break down the various concerns (or threats if you prefer):</p> <ol> <li>package authenticity <em>(software can be modified while being downloaded)</em></li> <li>package availability <em>(software security updates can be individually blocked)</em></li> <li>repo availability <em>(internet services can be blocked by governments and companies)</em></li> <li>who’s downloading what package <em>(currently visible to anyone who can see the network traffic, including open wifi, etc.)</em></li> </ol> <p>Most people distributing software are used to thinking about #1 verifying packages when thinking about the security of software distribution. #2, #3, and #4 are also important, and currently not well addressed. This is where TLS and Tor come in. Both can help prevent Man-In-The-Middle manipulations as well as reduce the amount of information that is leaked to the network. Tor can also help with #3. Since Tor is difficult to block, it is often uses to circumvent censorship. In this case a software repo could be blocked entirely, and Tor could help with gaining access to it. The Update Framework has <a href="https://github.com/theupdateframework/tuf/blob/develop/README.md" title="TUF: The Update Framework - Security" target="_blank">a good overview of the possible attacks</a> against software repos.</p> <p>So having software repos available with both TLS and Tor available as options is a very good idea. As far as I have seen, there are not any Debian repos available via a Tor Hidden Service. There are a number of official mirrors that already support TLS/HTTPS. You can find them using <a href="https://gist.github.com/eighthave/7285154" title="the script in a gist paste" target="_blank">this script:</a></p> <pre><code class="language-python">#!/usr/bin/python import urllib2 import re import ssl import sys # # find generic mirrors mirrors = urllib2.urlopen('http://www.debian.org/mirror/list') https = [] for line in mirrors.readlines(): m = re.match('.*&lt;td valign=&quot;top&quot;&gt;&lt;a rel=&quot;nofollow&quot; href=&quot;http(.*)&quot;&gt;.*', line) if m: url = 'https' + m.group(1) print 'trying: ', print url, print '...', sys.stdout.flush() try: response=urllib2.urlopen(url, timeout=1) https.append(url) print 'success!' except urllib2.URLError as err: print 'fail!' except ssl.SSLError as err: print 'bad SSL!' # print 'HTTPS apt repos:' #for url in https: # print url # # find security mirrors mirrors = urllib2.urlopen('http://www.debian.org/mirror/list-full') securitys = [] for line in mirrors.readlines(): m = re.match('.*&lt;/tt&gt;&lt;br&gt;Security updates over HTTP: &lt;tt&gt;&lt;a rel=&quot;nofollow&quot; href=&quot;http(.*)&quot;&gt;.*/debian-security/&lt;/a&gt;.*', line) if m: url = 'https' + m.group(1) print 'trying: ', print url, print '...', sys.stdout.flush() try: response=urllib2.urlopen(url, timeout=1) securitys.append(url) print 'success!' except urllib2.URLError as err: print 'fail!' except ssl.SSLError as err: print 'bad SSL!' # print 'HTTPS security repos:' # for url in securitys: # print url # now find the backports mirrors mirrors = urllib2.urlopen('http://backports-master.debian.org/Mirrors/') backports = [] for line in mirrors.readlines(): #&lt;td&gt;&lt;a href=&quot;http://be.mirror.eurid.eu/debian-backports/&quot;&gt;/debian-backports/&lt;/a&gt; m = re.match('.*&lt;td&gt;&lt;a href=&quot;http(.*)&quot;&gt;.*/debian-backports/&lt;/a&gt;.*', line) if m: url = 'https' + m.group(1) print 'trying: ', print url, print '...', sys.stdout.flush() try: response=urllib2.urlopen(url, timeout=1) backports.append(url) print 'success!' except urllib2.URLError as err: print 'fail!' except ssl.SSLError as err: print 'bad SSL!' #print 'HTTPS backports repos:' #for url in backports: # print url # now find the CD image mirrors mirrors = urllib2.urlopen('http://www.debian.org/CD/http-ftp/') cds = [] for line in mirrors.readlines(): # &lt;a rel=&quot;nofollow&quot; href=&quot;http://mirror.easyspeedy.com/debian-cd/&quot;&gt;HTTP&lt;/a&gt;&lt;/li&gt; m = re.match('.*&lt;a rel=&quot;nofollow&quot; href=&quot;http(:.*)&quot;&gt;HTTP&lt;/a&gt;&lt;/li&gt;.*', line) if m: url = 'https' + m.group(1) print 'trying: ', print url, print '...', sys.stdout.flush() try: response=urllib2.urlopen(url, timeout=1) cds.append(url) print 'success!' except urllib2.URLError as err: print 'fail!' except ssl.SSLError as err: print 'bad SSL!' print 'HTTPS CD image repos:' for url in cds: print url # now write everything to a file f = open('/tmp/https-debian-archives.txt', 'w') f.write('HTTPS apt repos\n') f.write('---------------\n') for url in https: f.write(url + '\n') f.write('\n\nHTTPS security repos\n') f.write('---------------\n') for url in securitys: f.write(url + '\n') f.write('\n\nHTTPS backports repos\n') f.write('--------------------\n') for url in backports: f.write(url + '\n') f.write('\n\nHTTPS CD image repos\n') f.write('--------------------\n') for url in cds: f.write(url + '\n') f.close() </code></pre> https://guardianproject.info/2013/10/24/chatsecure-v12-provides-comprehensive-mobile-security-and-a-whole-new-look/ Thu, 24 Oct 2013 01:50:13 -0400 https://guardianproject.info/2013/10/24/chatsecure-v12-provides-comprehensive-mobile-security-and-a-whole-new-look/ <p dir="ltr"> <strong>ChatSecure v12 Provides Comprehensive Mobile Security and a Whole New Look</strong><strong><span style="font-size: 13px;"><br /> </span></strong> </p> <p dir="ltr"> <span style="font-size: 13px;">The Guardian Project’s award-winning open-source app “Gibberbot” for Android, has been rebranded to “ChatSecure” for its version 12 release, unifying the branding with the iPhone and iPad apps, while offering major updates in security from the device through the network.</span> </p> <p dir="ltr"> <em><strong>Download on <a href="https://play.google.com/store/apps/details?id=info.guardianproject.otr.app.im">Google Play</a> or <a href="https://guardianproject.info/releases/chatsecure-latest.apk">Direct Download</a> now.</strong></em> </p> <p dir="ltr"> <span style="font-size: 13px;">October 20, New York, NY – The Guardian Project, a New York-based open-source mobile security incubator, has launched version 12 of its well-regarded secure messaging app for Android, rebranding it to “ChatSecure” to unify branding with existing open-source iPhone and iPad apps. The new upgrade brings an entirely new fluid user interface, and unprecedented security features for users looking to protect their message content (what they are saying) and their metadata (who, why and where) from malicious adversaries and apps, hostile network operators, and dragnet surveillance. It is completely open-source, utilizes interoperable protocols, and has undergone third-party security audits and code reviews.</span> </p> <p dir="ltr"> <img class="alignnone" alt="" src="https://guardianproject.info/wp-content/uploads/2010/06/store_new.png" width="614" height="300" /> </p> <p dir="ltr"> “We believe you should not have to compromise on choice and usability, to have reliable, strong security”, said Guardian Project founder, Nathan Freitas. “Some companies want to limit you to their closed, proprietary services that are centrally hosted and easily blocked or monitored. We see that as fragile and unsustainable, and ultimately, hostile and unfriendly to users, who want choice, freedom and the ability to easily and safely communicate with their friends and family around the world”. </p> <p dir="ltr"> ChatSecure is compatible with thousands of instant messaging service providers around the world, including Google, Facebook, DuckDuckGo and Jabber.org. It also works with open-source server software, such as Prosody, enabling service providers, enterprise and other organizations to host their own servers. ChatSecure users also can communicate securely with anyone using a compatible app on Windows, Mac OS or Linux, such as Pidgin, Adium or Jitsi. The app also supports peer-to-peer wifi chat using Bonjour and Tor, allowing for secure messaging to happen even in places where there is no access to the internet or the internet is blocked. It also includes a quick access “Panic” feature to uninstall the app and wipe all local data. </p> <div id='gallery-9' class='gallery galleryid-11821 gallery-columns-3 gallery-size-thumbnail'> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/2013/10/24/chatsecure-v12-provides-comprehensive-security-and-a-whole-new-look/device-2013-10-24-013158/'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/10/device-2013-10-24-013158-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/2013/10/24/chatsecure-v12-provides-comprehensive-security-and-a-whole-new-look/device-2013-10-24-013343/'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/10/device-2013-10-24-013343-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/2013/10/24/chatsecure-v12-provides-comprehensive-security-and-a-whole-new-look/device-2013-10-24-013623/'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/10/device-2013-10-24-013623-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/2013/10/24/chatsecure-v12-provides-comprehensive-security-and-a-whole-new-look/device-2013-10-24-013652/'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/10/device-2013-10-24-013652-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/2013/10/24/chatsecure-v12-provides-comprehensive-security-and-a-whole-new-look/device-2013-10-24-014752/'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/10/device-2013-10-24-014752-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/2013/10/24/chatsecure-v12-provides-comprehensive-security-and-a-whole-new-look/device-2013-10-24-014836/'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/10/device-2013-10-24-014836-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> </div> <p dir="ltr"> The software ensures the most secure network channels are utilized, by enforcing Certificate Pinning, Perfect-Forward Secrecy and communicating via the Tor network. All conversations held through ChatSecure can be encrypted using an open-standards end-to-end encryption protocol known as “Off the Record Messaging”, pioneered and hardened over the last decade by security researchers. All account data, messages and contacts stored on the device are encrypted and password protected using strong encryption provided by SQLCipher database software, ensuring no leakage of personal data if the device is lost, stolen or compromised. </p> <p>Learn more and download at <a href="https://guardianproject.info/apps/chatsecure/">https://guardianproject.info/apps/chatsecure/</a> or on Google Play. Learn more about the versions for iPhone and iPad at <a href="https://chatsecure.org">https://chatsecure.org</a></p> https://guardianproject.info/2013/10/16/open-office-hours-every-friday-this-fall/ Wed, 16 Oct 2013 16:51:36 -0400 https://guardianproject.info/2013/10/16/open-office-hours-every-friday-this-fall/ <div> <strong>Fri, Oct 18, 1:00 PM EDT – 3:00 PM</strong></p> <div> </div> </div> <div> <div> <div> <div> <div> Members of the Guardian Project will be hosting <a href="https://plus.google.com/events/cumq8tucoc31ap55iqdn7pq9abs">weekly public hangouts</a> every Friday for the rest of year to answer questions about our apps (Orbot, Orweb, ChatSecure), building on our mobile security libraries (IOCipher, SQLCipher, NetCipher) and using services like OStel (including how to run your own secure phone service!).</p> <p> We will also be live in IRC on Freenode at <a href="https://plus.google.com/s/%23guardianproject">#guardianproject</a>  as always for those of you who don’t feel the need to be on camera. </p> <p> Sound fun? You betcha it will be. This will be the <b>first</b> event on Friday, so please come and join. <a href="https://guardianproject.info/" rel="nofollow">https://guardianproject.info</a> </p> </div> <pre><code> &lt;div&gt; For EU, Africa, Asia: We’ll have some early sessions in the coming weeks. This is just our first test run. Thanks for understanding! &lt;/div&gt; &lt;div&gt; &lt;/div&gt; &lt;div&gt; &lt;strong&gt;Fri, Oct 18, 1:00 PM EDT – 3:00 PM&lt;/strong&gt; &lt;/div&gt; &lt;div&gt; RSVP the Google+ Event today: &lt;a href=&quot;https://plus.google.com/events/cumq8tucoc31ap55iqdn7pq9abs&quot;&gt;https://plus.google.com/events/cumq8tucoc31ap55iqdn7pq9abs&lt;/a&gt; or we’ll just see you on IRC. &lt;/div&gt; &lt;/div&gt; &lt;/div&gt; </code></pre> <p></div> </div></p> https://guardianproject.info/2013/09/20/gibberbots-chatsecure-makeover-almost-done/ Fri, 20 Sep 2013 17:19:54 -0400 https://guardianproject.info/2013/09/20/gibberbots-chatsecure-makeover-almost-done/ <p>In a previous post with the mouthful of a title <a href="https://guardianproject.info/2013/07/16/modernizing-expectations-for-the-nouveau-secure-mobile-messaging-movement/">“Modernizing Expectations for the Nouveau Secure Mobile Messaging Movement”</a>, I spoke about all of the necessary security features a modern mobile messaging app should have. These include encrypted local storage, end-to-end verifiable encryption over the network, certificate pinning for server connections and a variety of other features. I am VERY happy to report that the latest v12 beta release of the project formerly known as Gibberbot, now called ChatSecure, has all of the features described in that post implemented. From a feature perspective, it is the most security mobile messaging app ever. We also hope that in reality, in practice, it also is, as we have spent a great deal of effort on security code audits, penetration testing, and responding to the outcomes of those effort, to further harden our app.</p> <p>NOW, moving on to a more lighthearted, but equally important topic – MAKEOVERS! Well, in truth, it is countless hours of study trying to understand how we could make our app not only secure, but also beautiful, efficient and fun. On top of that, countless more hours actually implementing it, debugging it across Android operating systems from 2.3 to 4.3, and making sure it works as well on a Nexus 7 tablet as it does a bargain basement ZTE device.</p> <p>Much of this effort was spent on features like themeing, emoji/emoticon support, swipe navigation and improved color schemes for various states of encryption. This may seem frivolous to some, especially while they are “real” problems out there like backdoored basebands and weakened random number generators. However, while we continue to do all we can to ensure our apps are fortresses, we also must make sure they are comfortable fortresses, as we hope and expect our users to spend many hours a day inside of them. If you eyes will be staring at something for that long, don’t you want smooth fonts, and cohesive color schemes? If you are going to be navigating between chats and buddies a hundred times a day, wouldn’t you expect us to make that as seamless an move as possible? Yes, yes, and so we did!</p> <p>In the end, we designed our software around people who have little patience or spare time, and every right to be that way – activists, human rights defenders, journalists – people on the front lines in conflict zones and change in their society around the world. Usability for them means they have more time to be in the real world, while still having our apps maximize the precious time they have to communicate digitally, and of course, ensure that the walls of our digital fortress around them are as high and hard as can be.</p> <p>You can get your hands on this fully functional beta right here on HockeyApp: <a href="https://rink.hockeyapp.net/apps/2fa3b9252319e47367f1f125bb3adcd1/">https://rink.hockeyapp.net/apps/2fa3b9252319e47367f1f125bb3adcd1/</a> or directly from our site – <a href="https://guardianproject.info/releases/ChatSecure-v12.4.0-beta4-release.apk">ChatSecure APK</a> and <a href="https://guardianproject.info/releases/ChatSecure-v12.4.0-beta4-release.apk.asc">signature ASC</a>.<br /> <strong>WARNING: The current beta does not supporting importing your existing account configurations, and you will need to setup the accounts again.</strong></p> <div id='gallery-8' class='gallery galleryid-11695 gallery-columns-3 gallery-size-thumbnail'> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/account-list-light.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/account-list-light-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/account-list-dark.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/account-list-dark-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/account-create-new.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/account-create-new-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/contact-grid-light.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/contact-grid-light-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/contact-grid-sidebar.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/contact-grid-sidebar-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/contact-grid-sidebar-dark.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/contact-grid-sidebar-dark-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/contact-profile-dark.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/contact-profile-dark-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/chat-dark-emoji.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/chat-dark-emoji-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/chat-light-sticker.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/chat-light-sticker-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/chat-profile-overlay.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/chat-profile-overlay-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/chat-with-sharebar.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/chat-with-sharebar-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/otr-file-xfer.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/otr-file-xfer-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/otr-file-xfer-notifications.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/otr-file-xfer-notifications-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/chat-with-wallpaper.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/chat-with-wallpaper-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/chat-MUC-join.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/chat-MUC-join-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/09/chat-muc-beer.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/09/chat-muc-beer-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style='clear: both' /> </div> https://guardianproject.info/archive/keysync/ Thu, 12 Sep 2013 15:50:07 -0400 https://guardianproject.info/archive/keysync/ <p><a href="https://guardianproject.info/wp-content/uploads/2013/09/keysync.png"><img src="https://guardianproject.info/wp-content/uploads/2013/09/keysync.png" alt="KeySync" width="196" height="196" class="alignright size-full wp-image-11797" srcset="https://guardianproject.info/wp-content/uploads/2013/09/keysync.png 256w, https://guardianproject.info/wp-content/uploads/2013/09/keysync-150x150.png 150w" sizes="(max-width: 196px) 100vw, 196px" /></a>Privacy and security software like OTR encryption for chat and GnuPG for email and files all create digital identities that we can mark as trusted through a verification process. When using this software, each app needs completely new security identities that are separate from any existing identities used by the other apps. Then again, mobile software needs it own versions of these identity files. When setting up ChatSecure on a mobile device, all of the trust information from existing chat apps like Adium or Pidgin also needs to be converted and transferred so that ChatSecure has the same trusted identities. Or when switching from Pidgin to Jitsi for instant messaging, the trust information needs to be converted and synced so the trust information is not lost.</p> <p>This is where KeySync comes in. KeySync reads and writes many different formats of OTR chat apps and converts between them. It also makes it easy to sync the trust information to your Android device for use with ChatSecure. There is also some exploratory support for syncing identities between OTR and OpenPGP via GnuPG support in KeySync.</p> <h2 id="how-to-sync-to-chatsecure">How To Sync To ChatSecure</h2> <p>To sync between ChatSecure and your desktop apps, First plug in your phone or device<br /> via USB. Start KeySync and it should automatically detect your device. If KeySync cannot find your device, it will save the file for you to manually copy the <strong>otr_keystore.ofcaes</strong> file over to your device&rsquo;s SD Card, where ChatSecure looks for it. Once the file is in place on your device, start ChatSecure. In ChatSecure, go to the <strong>Accounts</strong>, then select <strong>Activate KeySync</strong> from the menu. This will guide you to scan the QRCode that KeySync shows you in order to complete the sync.</p> <p>The <code>otr_keystore.ofcaes</code> file is encrypted to prevent your private information from leaking out. That QRCode is the password to your keystore, so do not share it with anyone. Also, the <code>otr_keystore.ofcaes</code> file is only intended for use in this sync procedure. Do not email it or send it anywhere over the internet!</p> <h2 id="warning">Warning!</h2> <p>This is beta software, do not rely on it for strong identity verification. It is unlikely to mess up so bad as to produce compromised private keys, but anything is possible. Also, keep in mind that program is handling your private OTR keys, so make sure that you don&rsquo;t copy, send or email the `otr_keystore.ofcaes` file somewhere nsafe. All that said, testing and feedback is greatly appreciated, so we can get it to the point where we can trust it.</p> <h2 id="reporting-bugs">Reporting Bugs</h2> <p>Please report any bugs or issues that you have with this app! We want to hear from you, no need to worry about technical details or language skills. Help us improve this software by filing bug reports about any problem that you encounter. Feature requests and patches are also welcome!</p> <ul> <li><p><a href="https://dev.guardianproject.info/projects/keysync/issues/new"><img src="https://guardianproject.info/wp-content/uploads/2011/02/reportbug-150x150.jpg" alt="report bug" width="150" height="150" class="size-thumbnail wp-image-12362" srcset="https://guardianproject.info/wp-content/uploads/2011/02/reportbug-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2011/02/reportbug-100x100.jpg 100w, https://guardianproject.info/wp-content/uploads/2011/02/reportbug-200x200.jpg 200w, https://guardianproject.info/wp-content/uploads/2011/02/reportbug.jpg 225w" sizes="(max-width: 150px) 100vw, 150px" /> <strong style="font-size: 200%">Report a Bug or Issue</strong></a></p></li> <li><p><a href="https://dev.guardianproject.info/projects/keysync/issues?query_id=27" title="Issue Tracker" target="_blank">List of all open issues</a></p></li> <li><p><a href="https://dev.guardianproject.info/projects/keysync/issues/new" title="New Issue Tracker" target="_blank">submit a new issue report</a></p></li> </ul> <p><a name="download"></a></p> <h2 id="download">Download</h2> <p>*<img src="https://guardianproject.info/builds/.icons/platform_windows.gif" alt="Windows" /> <strong>Windows</strong> executable * Download and install OpenSSL: <a href="https://slproweb.com/download/Win32OpenSSL_Light-1_0_1f.exe">Win32OpenSSL_Light-1_0_1f.exe</a> * When prompted install into the &ldquo;Windows system directory&rdquo; * Note: The prompt asking for a donation will go to the company that produces OpenSSL installers for Windows, not The Guardian Project. * If you get an error when trying to install OpenSSL, you probably need in stall the <a href="https://www.microsoft.com/downloads/details.aspx?familyid=9B2DA534-3E03-4391-8A4D-074B9F2BC1BF">Visual C++ 2008 Redistributables</a> from Microsoft. * Download KeySync - no installation required: <a href="https://guardianproject.info/releases/KeySync-0.2.exe">KeySync-0.2.exe</a> * <a href="https://guardianproject.info/releases/KeySync-0.2.exe.asc">detached gpg signature</a> * MD5: <code>1fb7a5ec050d03f59104a41494c559fd</code> * SHA256: <code>422fd0ddb6d85a6f509a1c9a868ce87437af7ac895ba8c4fa7f366d83114be07</code> *<img src="https://guardianproject.info/builds/.icons/platform_mac_os_x.gif" alt="Mac OS X" /> <strong>Mac OS X</strong> <em>(10.6 or newer, 64-bit only)</em>: <a href="https://guardianproject.info/releases/KeySync-0.2.app.zip">KeySync-0.2.app.zip</a> * <a href="https://guardianproject.info/releases/KeySync-0.2.app.zip.sig">detached gpg signature</a> * MD5: <code>f6a1744a783d1cc5dc3070e1a16d79fd</code> * SHA256: <code>429dc303fb1d2673b953a2543b0e168f0410ce1cd14d4167f0dbf888fdf162d0</code> *<img src="https://guardianproject.info/builds/.icons/platform_ubuntu_linux.gif" alt="Ubuntu" /> <strong>Ubuntu, Linux Mint, etc.</strong> Run this in the Terminal to add <a href="https://launchpad.net/~guardianproject/+archive/ppa/" title="Guardian Project PPA on Launchpad" target="_blank">our PPA</a> to your package sources. You only need to do this once, you&rsquo;ll get updated versions automatically once this is complete (fingerprint: <code>F50E ADDD 2234 F563</code>): <pre style="font-size: small;">sudo add-apt-repository ppa:guardianproject/ppa sudo apt-get update sudo apt-get install keysync </pre></p> <pre><code> * **Fedora 17, 18, 19**: Run this in your Terminal to add &lt;a href=&quot;https://build.opensuse.org/project/show/security:guardianproject&quot; target=&quot;_blank&quot;&gt;our repository&lt;/a&gt; to your package sources. You only need to do this once, you'll get updated versions automatically once this is complete (fingerprint: `AC38 BED1 E879 79EA FD54`): &lt;pre style=&quot;font-size: small;&quot;&gt;source /etc/os-release </code></pre> <p>sudo wget <a href="https://download.opensuse.org/repositories/security:guardianproject/Fedora_${VERSION_ID}/security:guardianproject.repo">https://download.opensuse.org/repositories/security:guardianproject/Fedora_${VERSION_ID}/security:guardianproject.repo</a> -O /etc/yum.repos.d/security:guardianproject.repo sudo yum install keysync </pre></p> <pre><code> * **Debian**: &lt;a href=&quot;https://packages.debian.org/search?keywords=keysync&quot; target=&quot;_blank&quot;&gt;included in the official repos&lt;/a&gt;. For wheezy, get it from backports: &lt;pre style=&quot;font-size: small;&quot;&gt;apt-get -t wheezy-backports install keysync </code></pre> <p></pre></p> <pre><code> * **Arch Linux**: &lt;a href=&quot;https://aur.archlinux.org/packages/keysync/&quot; target=&quot;_blank&quot;&gt;included in the AUR&lt;/a&gt;. Please vote for it so it can be included in the official community repository. * Any Platform with Python, install via &lt;a href=&quot;https://pypi.python.org/pypi/keysync&quot; target=&quot;_blank&quot;&gt;pypi&lt;/a&gt; (see the &lt;a href=&quot;https://github.com/guardianproject/keysync/blob/master/win32/README.md&quot; target=&quot;_blank&quot; title=&quot;Building KeySync on Windows&quot;&gt;special instructions for Windows&lt;/a&gt;) &lt;pre style=&quot;font-size: small;&quot;&gt;pip install keysync </code></pre> <p></pre></ul></p> <pre><code>&lt;a name=&quot;source&quot;&gt;&lt;/a&gt; ### Source * For more info on the code and installation, &lt;a href=&quot;https://github.com/guardianproject/keysync/blob/master/README.md&quot; target=&quot;_blank&quot;&gt;see the README&lt;/a&gt; * github: &lt;a href=&quot;https://github.com/guardianproject/keysync&quot; title=&quot;KeySync source repo&quot; target=&quot;_blank&quot;&gt;https://github.com/guardianproject/keysync&lt;/a&gt; * &lt;a href=&quot;https://github.com/guardianproject/keysync/releases&quot; title=&quot;KeySync source tarballs&quot; target=&quot;_blank&quot;&gt;downloadable tags on github&lt;/a&gt; ## Known Issues See the &lt;a href=&quot;https://dev.guardianproject.info/projects/keysync/roadmap&quot; title=&quot;KeySync Development Roadmap&quot; target=&quot;_blank&quot;&gt;KeySync Roadmap&lt;/a&gt; for our development plan. Here are some notable known issues: * does not handle multiple keys/fingerprints for a given account (&lt;a href=&quot;https://dev.guardianproject.info/issues/1868&quot; target=&quot;_blank&quot;&gt;#1868&lt;/a&gt;) * GUI only syncs to ChatSecure (full two-way sync is planned) (&lt;a href=&quot;https://dev.guardianproject.info/issues/1968&quot; target=&quot;_blank&quot;&gt;#1968&lt;/a&gt;) * no way to handle conflicting private keys for an account (&lt;a href=&quot;https://dev.guardianproject.info/issues/1963&quot; target=&quot;_blank&quot;&gt;#1963&lt;/a&gt;) * no translations, only in English (&lt;a href=&quot;https://dev.guardianproject.info/issues/2170&quot; target=&quot;_blank&quot;&gt;#2170&lt;/a&gt;) * &lt;a title=&quot;existing KeySync issues&quot; href=&quot;https://dev.guardianproject.info/projects/keysync/issues&quot; target=&quot;_blank&quot;&gt;View all open issues&lt;/a&gt; </code></pre> https://guardianproject.info/archive/keysync/ Thu, 12 Sep 2013 15:50:07 -0400 https://guardianproject.info/archive/keysync/ <p><a href="https://guardianproject.info/wp-content/uploads/2013/09/keysync.png"><img src="https://guardianproject.info/wp-content/uploads/2013/09/keysync.png" alt="KeySync" width="196" height="196" class="alignright size-full wp-image-11797" srcset="https://guardianproject.info/wp-content/uploads/2013/09/keysync.png 256w, https://guardianproject.info/wp-content/uploads/2013/09/keysync-150x150.png 150w" sizes="(max-width: 196px) 100vw, 196px" /></a>Privacy and security software like OTR encryption for chat and GnuPG for email and files all create digital identities that we can mark as trusted through a verification process. When using this software, each app needs completely new security identities that are separate from any existing identities used by the other apps. Then again, mobile software needs it own versions of these identity files. When setting up ChatSecure on a mobile device, all of the trust information from existing chat apps like Adium or Pidgin also needs to be converted and transferred so that ChatSecure has the same trusted identities. Or when switching from Pidgin to Jitsi for instant messaging, the trust information needs to be converted and synced so the trust information is not lost.</p> <p>This is where KeySync comes in. KeySync reads and writes many different formats of OTR chat apps and converts between them. It also makes it easy to sync the trust information to your Android device for use with ChatSecure. There is also some exploratory support for syncing identities between OTR and OpenPGP via GnuPG support in KeySync.</p> <h2 id="how-to-sync-to-chatsecure">How To Sync To ChatSecure</h2> <p>To sync between ChatSecure and your desktop apps, First plug in your phone or device<br /> via USB. Start KeySync and it should automatically detect your device. If KeySync cannot find your device, it will save the file for you to manually copy the <strong>otr_keystore.ofcaes</strong> file over to your device&rsquo;s SD Card, where ChatSecure looks for it. Once the file is in place on your device, start ChatSecure. In ChatSecure, go to the <strong>Accounts</strong>, then select <strong>Activate KeySync</strong> from the menu. This will guide you to scan the QRCode that KeySync shows you in order to complete the sync.</p> <p>The <code>otr_keystore.ofcaes</code> file is encrypted to prevent your private information from leaking out. That QRCode is the password to your keystore, so do not share it with anyone. Also, the <code>otr_keystore.ofcaes</code> file is only intended for use in this sync procedure. Do not email it or send it anywhere over the internet!</p> <h2 id="warning">Warning!</h2> <p>This is beta software, do not rely on it for strong identity verification. It is unlikely to mess up so bad as to produce compromised private keys, but anything is possible. Also, keep in mind that program is handling your private OTR keys, so make sure that you don&rsquo;t copy, send or email the `otr_keystore.ofcaes` file somewhere nsafe. All that said, testing and feedback is greatly appreciated, so we can get it to the point where we can trust it.</p> <h2 id="reporting-bugs">Reporting Bugs</h2> <p>Please report any bugs or issues that you have with this app! We want to hear from you, no need to worry about technical details or language skills. Help us improve this software by filing bug reports about any problem that you encounter. Feature requests and patches are also welcome!</p> <ul> <li><p><a href="https://dev.guardianproject.info/projects/keysync/issues/new"><img src="https://guardianproject.info/wp-content/uploads/2011/02/reportbug-150x150.jpg" alt="report bug" width="150" height="150" class="size-thumbnail wp-image-12362" srcset="https://guardianproject.info/wp-content/uploads/2011/02/reportbug-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2011/02/reportbug-100x100.jpg 100w, https://guardianproject.info/wp-content/uploads/2011/02/reportbug-200x200.jpg 200w, https://guardianproject.info/wp-content/uploads/2011/02/reportbug.jpg 225w" sizes="(max-width: 150px) 100vw, 150px" /> <strong style="font-size: 200%">Report a Bug or Issue</strong></a></p></li> <li><p><a href="https://dev.guardianproject.info/projects/keysync/issues?query_id=27" title="Issue Tracker" target="_blank">List of all open issues</a></p></li> <li><p><a href="https://dev.guardianproject.info/projects/keysync/issues/new" title="New Issue Tracker" target="_blank">submit a new issue report</a></p></li> </ul> <p><a name="download"></a></p> <h2 id="download">Download</h2> <p>*<img src="https://guardianproject.info/builds/.icons/platform_windows.gif" alt="Windows" /> <strong>Windows</strong> executable * Download and install OpenSSL: <a href="https://slproweb.com/download/Win32OpenSSL_Light-1_0_1f.exe">Win32OpenSSL_Light-1_0_1f.exe</a> * When prompted install into the &ldquo;Windows system directory&rdquo; * Note: The prompt asking for a donation will go to the company that produces OpenSSL installers for Windows, not The Guardian Project. * If you get an error when trying to install OpenSSL, you probably need in stall the <a href="https://www.microsoft.com/downloads/details.aspx?familyid=9B2DA534-3E03-4391-8A4D-074B9F2BC1BF">Visual C++ 2008 Redistributables</a> from Microsoft. * Download KeySync - no installation required: <a href="https://guardianproject.info/releases/KeySync-0.2.exe">KeySync-0.2.exe</a> * <a href="https://guardianproject.info/releases/KeySync-0.2.exe.asc">detached gpg signature</a> * MD5: <code>1fb7a5ec050d03f59104a41494c559fd</code> * SHA256: <code>422fd0ddb6d85a6f509a1c9a868ce87437af7ac895ba8c4fa7f366d83114be07</code> *<img src="https://guardianproject.info/builds/.icons/platform_mac_os_x.gif" alt="Mac OS X" /> <strong>Mac OS X</strong> <em>(10.6 or newer, 64-bit only)</em>: <a href="https://guardianproject.info/releases/KeySync-0.2.app.zip">KeySync-0.2.app.zip</a> * <a href="https://guardianproject.info/releases/KeySync-0.2.app.zip.sig">detached gpg signature</a> * MD5: <code>f6a1744a783d1cc5dc3070e1a16d79fd</code> * SHA256: <code>429dc303fb1d2673b953a2543b0e168f0410ce1cd14d4167f0dbf888fdf162d0</code> *<img src="https://guardianproject.info/builds/.icons/platform_ubuntu_linux.gif" alt="Ubuntu" /> <strong>Ubuntu, Linux Mint, etc.</strong> Run this in the Terminal to add <a href="https://launchpad.net/~guardianproject/+archive/ppa/" title="Guardian Project PPA on Launchpad" target="_blank">our PPA</a> to your package sources. You only need to do this once, you&rsquo;ll get updated versions automatically once this is complete (fingerprint: <code>F50E ADDD 2234 F563</code>): <pre style="font-size: small;">sudo add-apt-repository ppa:guardianproject/ppa sudo apt-get update sudo apt-get install keysync </pre></p> <pre><code> * **Fedora 17, 18, 19**: Run this in your Terminal to add &lt;a href=&quot;https://build.opensuse.org/project/show/security:guardianproject&quot; target=&quot;_blank&quot;&gt;our repository&lt;/a&gt; to your package sources. You only need to do this once, you'll get updated versions automatically once this is complete (fingerprint: `AC38 BED1 E879 79EA FD54`): &lt;pre style=&quot;font-size: small;&quot;&gt;source /etc/os-release </code></pre> <p>sudo wget <a href="https://download.opensuse.org/repositories/security:guardianproject/Fedora_${VERSION_ID}/security:guardianproject.repo">https://download.opensuse.org/repositories/security:guardianproject/Fedora_${VERSION_ID}/security:guardianproject.repo</a> -O /etc/yum.repos.d/security:guardianproject.repo sudo yum install keysync </pre></p> <pre><code> * **Debian**: &lt;a href=&quot;https://packages.debian.org/search?keywords=keysync&quot; target=&quot;_blank&quot;&gt;included in the official repos&lt;/a&gt;. For wheezy, get it from backports: &lt;pre style=&quot;font-size: small;&quot;&gt;apt-get -t wheezy-backports install keysync </code></pre> <p></pre></p> <pre><code> * **Arch Linux**: &lt;a href=&quot;https://aur.archlinux.org/packages/keysync/&quot; target=&quot;_blank&quot;&gt;included in the AUR&lt;/a&gt;. Please vote for it so it can be included in the official community repository. * Any Platform with Python, install via &lt;a href=&quot;https://pypi.python.org/pypi/keysync&quot; target=&quot;_blank&quot;&gt;pypi&lt;/a&gt; (see the &lt;a href=&quot;https://github.com/guardianproject/keysync/blob/master/win32/README.md&quot; target=&quot;_blank&quot; title=&quot;Building KeySync on Windows&quot;&gt;special instructions for Windows&lt;/a&gt;) &lt;pre style=&quot;font-size: small;&quot;&gt;pip install keysync </code></pre> <p></pre></ul></p> <pre><code>&lt;a name=&quot;source&quot;&gt;&lt;/a&gt; ### Source * For more info on the code and installation, &lt;a href=&quot;https://github.com/guardianproject/keysync/blob/master/README.md&quot; target=&quot;_blank&quot;&gt;see the README&lt;/a&gt; * github: &lt;a href=&quot;https://github.com/guardianproject/keysync&quot; title=&quot;KeySync source repo&quot; target=&quot;_blank&quot;&gt;https://github.com/guardianproject/keysync&lt;/a&gt; * &lt;a href=&quot;https://github.com/guardianproject/keysync/releases&quot; title=&quot;KeySync source tarballs&quot; target=&quot;_blank&quot;&gt;downloadable tags on github&lt;/a&gt; ## Known Issues See the &lt;a href=&quot;https://dev.guardianproject.info/projects/keysync/roadmap&quot; title=&quot;KeySync Development Roadmap&quot; target=&quot;_blank&quot;&gt;KeySync Roadmap&lt;/a&gt; for our development plan. Here are some notable known issues: * does not handle multiple keys/fingerprints for a given account (&lt;a href=&quot;https://dev.guardianproject.info/issues/1868&quot; target=&quot;_blank&quot;&gt;#1868&lt;/a&gt;) * GUI only syncs to ChatSecure (full two-way sync is planned) (&lt;a href=&quot;https://dev.guardianproject.info/issues/1968&quot; target=&quot;_blank&quot;&gt;#1968&lt;/a&gt;) * no way to handle conflicting private keys for an account (&lt;a href=&quot;https://dev.guardianproject.info/issues/1963&quot; target=&quot;_blank&quot;&gt;#1963&lt;/a&gt;) * no translations, only in English (&lt;a href=&quot;https://dev.guardianproject.info/issues/2170&quot; target=&quot;_blank&quot;&gt;#2170&lt;/a&gt;) * &lt;a title=&quot;existing KeySync issues&quot; href=&quot;https://dev.guardianproject.info/projects/keysync/issues&quot; target=&quot;_blank&quot;&gt;View all open issues&lt;/a&gt; </code></pre> https://guardianproject.info/press/ Thu, 12 Sep 2013 12:47:19 -0400 https://guardianproject.info/press/ <div style="text-align: center;"> <a href="https://www.nytimes.com/2013/07/18/technology/personaltech/digital-tools-to-help-curb-online-eavesdropping.html?pagewanted=all&_r=0"><img style="border: 0px none;" alt="The_New_York_Times_logo" src="https://guardianproject.info/wp-content/uploads/2013/09/The_New_York_Times_logo-300x44.png" width="373" height="52" /></a> <a href="https://www.nytimes.com/2012/04/18/nyregion/nadim-kobeissi-creator-of-a-secure-chat-program-has-freedom-in-mind.html" target="_blank">https://www.nytimes.com/2012/04/18/nyregion/nadim-kobeissi-creator-of-a-secure-chat-program-has-freedom-in-mind.html</a> <a href="https://www.nytimes.com/2013/07/18/technology/personaltech/digital-tools-to-help-curb-online-eavesdropping.html?pagewanted=all&_r=0" target="_blank">https://www.nytimes.com/2013/07/18/technology/personaltech/digital-tools-to-help-curb-online-eavesdropping.html</a> <a href="https://artsbeat.blogs.nytimes.com/2012/05/02/occupy-wall-street-from-the-streets-to-the-archives/" target="_blank">https://artsbeat.blogs.nytimes.com/2012/05/02/occupy-wall-street-from-the-streets-to-the-archives/</a></p> <a href="https://arstechnica.com/information-technology/2011/04/for-paranoid-androids-guardian-project-supplies-smartphone-security/" target="_blank"><img style="border: 0px none;" alt="ars-logo" src="https://guardianproject.info/wp-content/uploads/2013/09/ars-logo-300x300.png" width="77" height="77" /></a> <a href="https://arstechnica.com/information-technology/2011/04/for-paranoid-androids-guardian-project-supplies-smartphone-security/" target="_blank">https://arstechnica.com/information-technology/2011/04/for-paranoid-androids-guardian-project-supplies-smartphone-security/</a> <a href="https://www.economist.com/blogs/babbage/2012/01/technology-and-democracy" target="_blank"><img class="aligncenter" alt="economist-logo" src="https://guardianproject.info/wp-content/uploads/2013/09/274178_ekonomist_orig.jpg" width="146" height="73" /></a> <a href="https://www.economist.com/blogs/babbage/2012/01/technology-and-democracy" target="_blank">https://www.economist.com/blogs/babbage/2012/01/technology-and-democracy</a><br /> <a href="https://www.pbs.org/mediashift/2012/12/data-security-101-for-journalists341/" target="_blank"><img style="border: 0px none;" alt="pbs-logo" src="https://guardianproject.info/wp-content/uploads/2013/09/PBS_logo.png" width="148" height="57" /></a> <a href="https://www.pbs.org/idealab/tag/informacam" target="_blank">https://www.pbs.org/idealab/tag/informacam</a> <a href="https://www.pbs.org/mediashift/2012/12/data-security-101-for-journalists341/" target="_blank">https://www.pbs.org/mediashift/2012/12/data-security-101-for-journalists341/</a> <a href="https://techcrunch.com/2012/04/26/onion-browser-a-mobile-browser-for-the-truly-paranoid/" target="_blank"><img style="border: 0px none;" alt="TC-logo" src="https://guardianproject.info/wp-content/uploads/2013/09/tc-techcrunch_logo-620x240.png" width="340" height="60" /></a> <a href="https://techcrunch.com/2012/04/26/onion-browser-a-mobile-browser-for-the-truly-paranoid/" target="_blank">https://techcrunch.com/2012/04/26/onion-browser-a-mobile-browser-for-the-truly-paranoid/</a> <a href="https://guardianproject.info/wp-content/uploads/2013/09/propublica.jpg"><img class="size-medium wp-image-11681 alignnone" alt="propublica" src="https://guardianproject.info/wp-content/uploads/2013/09/propublica.jpg" width="250" height="124" /></a> <a href="https://www.propublica.org/article/a-buyers-guide-to-safer-communication" target="_blank">https://www.propublica.org/article/a-buyers-guide-to-safer-communication</a> <a href="https://guardianproject.info/wp-content/uploads/2013/09/businessweek.jpg"><img class="size-medium wp-image-11679" alt="businessweek" src="https://guardianproject.info/wp-content/uploads/2013/09/businessweek-300x63.jpg" width="300" height="63" srcset="https://guardianproject.info/wp-content/uploads/2013/09/businessweek-300x63.jpg 300w, https://guardianproject.info/wp-content/uploads/2013/09/businessweek.jpg 456w" sizes="(max-width: 300px) 100vw, 300px" /></a> <a href="https://www.businessweek.com/blogs/very-near-future/tag/Informacam" target="_blank">https://www.businessweek.com/blogs/very-near-future/tag/Informacam</a> <a href="https://guardianproject.info/wp-content/uploads/2013/09/TechPresident-logo.jpg"><img class="size-medium wp-image-11682 alignnone" alt="TechPresident-logo" src="https://guardianproject.info/wp-content/uploads/2013/09/TechPresident-logo-300x82.jpg" width="300" height="82" srcset="https://guardianproject.info/wp-content/uploads/2013/09/TechPresident-logo-300x82.jpg 300w, https://guardianproject.info/wp-content/uploads/2013/09/TechPresident-logo.jpg 320w" sizes="(max-width: 300px) 100vw, 300px" /></a> <a href="https://techpresident.com/blog-entry/guardian-project-building-mobile-security-dangerous-world" target="_blank">https://techpresident.com/blog-entry/guardian-project-building-mobile-security-dangerous-world</a> <a href="https://guardianproject.info/wp-content/uploads/2013/09/huffpo.jpeg"><img class="size-medium wp-image-11680 alignnone" alt="huffpo" src="https://guardianproject.info/wp-content/uploads/2013/09/huffpo-300x119.jpeg" width="300" height="119" srcset="https://guardianproject.info/wp-content/uploads/2013/09/huffpo-300x119.jpeg 300w, https://guardianproject.info/wp-content/uploads/2013/09/huffpo.jpeg 311w" sizes="(max-width: 300px) 100vw, 300px" /></a> <a href="https://www.huffingtonpost.com/2013/09/05/online-privacy-study_n_3870670.html" target="_blank">https://www.huffingtonpost.com/2013/09/05/online-privacy-study_n_3870670.html</a> </div> <h2 id="press-contacts">PRESS CONTACTS</h2> <p><span style="color: #000000;"><span style="font-family: Arial, serif;">Nathan Freitas, Project Founder<br /> </span></span><span style="color: #000000;"><span style="font-family: Arial, serif;">+1.718.569.7272<br /> </span></span><span style="color: #000000;"><span style="font-family: Arial, serif;"><a href="&#x6d;&#x61;&#105;lto&#x3a;&#x6e;&#x61;&#116;ha&#x6e;&#x40;&#x67;&#117;ar&#x64;&#x69;&#x61;&#110;pr&#x6f;&#x6a;&#x65;&#99;t.i&#x6e;&#x66;&#x6f;">n&#x61;&#x74;h&#x61;&#x6e;&#64;&#x67;&#x75;a&#114;&#x64;i&#97;&#x6e;p&#114;&#x6f;j&#101;&#x63;t.&#x69;&#x6e;f&#x6f;</a> (GPG: 0x69B37AA9)<br /></span></span></p> <h2 id="press-kit">PRESS KIT</h2> <ul> <li>Download our Press Kit for logos, screenshots, device photos, team photos and more: <a href="https://github.com/guardianproject/GuardianProjectPressKit/archive/master.zip">https://github.com/guardianproject/GuardianProjectPressKit/archive/master.zip</a></li> </ul> <h2 id="press-releases">PRESS RELEASES</h2> <ul> <li>March 10, 2014 <a href="https://docs.google.com/document/d/1kI6dV6nPSd1z3MkxSTMRT8P9DcFQ9uOiNFcUlGTjjXA/edit?usp=sharing">GOOGLE EXECUTIVE CHAIRMAN ERIC SCHMIDT AWARDS GUARDIAN PROJECT A “NEW DIGITAL AGE” GRANT</a> <br /></li> </ul> https://guardianproject.info/press/ Thu, 12 Sep 2013 12:47:19 -0400 https://guardianproject.info/press/ <div style="text-align: center;"> <a href="https://www.nytimes.com/2013/07/18/technology/personaltech/digital-tools-to-help-curb-online-eavesdropping.html?pagewanted=all&_r=0"><img style="border: 0px none;" alt="The_New_York_Times_logo" src="https://guardianproject.info/wp-content/uploads/2013/09/The_New_York_Times_logo-300x44.png" width="373" height="52" /></a> <a href="https://www.nytimes.com/2012/04/18/nyregion/nadim-kobeissi-creator-of-a-secure-chat-program-has-freedom-in-mind.html" target="_blank">https://www.nytimes.com/2012/04/18/nyregion/nadim-kobeissi-creator-of-a-secure-chat-program-has-freedom-in-mind.html</a> <a href="https://www.nytimes.com/2013/07/18/technology/personaltech/digital-tools-to-help-curb-online-eavesdropping.html?pagewanted=all&_r=0" target="_blank">https://www.nytimes.com/2013/07/18/technology/personaltech/digital-tools-to-help-curb-online-eavesdropping.html</a> <a href="https://artsbeat.blogs.nytimes.com/2012/05/02/occupy-wall-street-from-the-streets-to-the-archives/" target="_blank">https://artsbeat.blogs.nytimes.com/2012/05/02/occupy-wall-street-from-the-streets-to-the-archives/</a></p> <a href="https://arstechnica.com/information-technology/2011/04/for-paranoid-androids-guardian-project-supplies-smartphone-security/" target="_blank"><img style="border: 0px none;" alt="ars-logo" src="https://guardianproject.info/wp-content/uploads/2013/09/ars-logo-300x300.png" width="77" height="77" /></a> <a href="https://arstechnica.com/information-technology/2011/04/for-paranoid-androids-guardian-project-supplies-smartphone-security/" target="_blank">https://arstechnica.com/information-technology/2011/04/for-paranoid-androids-guardian-project-supplies-smartphone-security/</a> <a href="https://www.economist.com/blogs/babbage/2012/01/technology-and-democracy" target="_blank"><img class="aligncenter" alt="economist-logo" src="https://guardianproject.info/wp-content/uploads/2013/09/274178_ekonomist_orig.jpg" width="146" height="73" /></a> <a href="https://www.economist.com/blogs/babbage/2012/01/technology-and-democracy" target="_blank">https://www.economist.com/blogs/babbage/2012/01/technology-and-democracy</a><br /> <a href="https://www.pbs.org/mediashift/2012/12/data-security-101-for-journalists341/" target="_blank"><img style="border: 0px none;" alt="pbs-logo" src="https://guardianproject.info/wp-content/uploads/2013/09/PBS_logo.png" width="148" height="57" /></a> <a href="https://www.pbs.org/idealab/tag/informacam" target="_blank">https://www.pbs.org/idealab/tag/informacam</a> <a href="https://www.pbs.org/mediashift/2012/12/data-security-101-for-journalists341/" target="_blank">https://www.pbs.org/mediashift/2012/12/data-security-101-for-journalists341/</a> <a href="https://techcrunch.com/2012/04/26/onion-browser-a-mobile-browser-for-the-truly-paranoid/" target="_blank"><img style="border: 0px none;" alt="TC-logo" src="https://guardianproject.info/wp-content/uploads/2013/09/tc-techcrunch_logo-620x240.png" width="340" height="60" /></a> <a href="https://techcrunch.com/2012/04/26/onion-browser-a-mobile-browser-for-the-truly-paranoid/" target="_blank">https://techcrunch.com/2012/04/26/onion-browser-a-mobile-browser-for-the-truly-paranoid/</a> <a href="https://guardianproject.info/wp-content/uploads/2013/09/propublica.jpg"><img class="size-medium wp-image-11681 alignnone" alt="propublica" src="https://guardianproject.info/wp-content/uploads/2013/09/propublica.jpg" width="250" height="124" /></a> <a href="https://www.propublica.org/article/a-buyers-guide-to-safer-communication" target="_blank">https://www.propublica.org/article/a-buyers-guide-to-safer-communication</a> <a href="https://guardianproject.info/wp-content/uploads/2013/09/businessweek.jpg"><img class="size-medium wp-image-11679" alt="businessweek" src="https://guardianproject.info/wp-content/uploads/2013/09/businessweek-300x63.jpg" width="300" height="63" srcset="https://guardianproject.info/wp-content/uploads/2013/09/businessweek-300x63.jpg 300w, https://guardianproject.info/wp-content/uploads/2013/09/businessweek.jpg 456w" sizes="(max-width: 300px) 100vw, 300px" /></a> <a href="https://www.businessweek.com/blogs/very-near-future/tag/Informacam" target="_blank">https://www.businessweek.com/blogs/very-near-future/tag/Informacam</a> <a href="https://guardianproject.info/wp-content/uploads/2013/09/TechPresident-logo.jpg"><img class="size-medium wp-image-11682 alignnone" alt="TechPresident-logo" src="https://guardianproject.info/wp-content/uploads/2013/09/TechPresident-logo-300x82.jpg" width="300" height="82" srcset="https://guardianproject.info/wp-content/uploads/2013/09/TechPresident-logo-300x82.jpg 300w, https://guardianproject.info/wp-content/uploads/2013/09/TechPresident-logo.jpg 320w" sizes="(max-width: 300px) 100vw, 300px" /></a> <a href="https://techpresident.com/blog-entry/guardian-project-building-mobile-security-dangerous-world" target="_blank">https://techpresident.com/blog-entry/guardian-project-building-mobile-security-dangerous-world</a> <a href="https://guardianproject.info/wp-content/uploads/2013/09/huffpo.jpeg"><img class="size-medium wp-image-11680 alignnone" alt="huffpo" src="https://guardianproject.info/wp-content/uploads/2013/09/huffpo-300x119.jpeg" width="300" height="119" srcset="https://guardianproject.info/wp-content/uploads/2013/09/huffpo-300x119.jpeg 300w, https://guardianproject.info/wp-content/uploads/2013/09/huffpo.jpeg 311w" sizes="(max-width: 300px) 100vw, 300px" /></a> <a href="https://www.huffingtonpost.com/2013/09/05/online-privacy-study_n_3870670.html" target="_blank">https://www.huffingtonpost.com/2013/09/05/online-privacy-study_n_3870670.html</a> </div> <h2 id="press-contacts">PRESS CONTACTS</h2> <p><span style="color: #000000;"><span style="font-family: Arial, serif;">Nathan Freitas, Project Founder<br /> </span></span><span style="color: #000000;"><span style="font-family: Arial, serif;">+1.718.569.7272<br /> </span></span><span style="color: #000000;"><span style="font-family: Arial, serif;"><a href="&#x6d;&#x61;&#105;lto&#x3a;&#x6e;&#x61;&#116;ha&#x6e;&#x40;&#x67;&#117;ar&#x64;&#x69;&#x61;&#110;pr&#x6f;&#x6a;&#x65;&#99;t.i&#x6e;&#x66;&#x6f;">n&#x61;&#x74;h&#x61;&#x6e;&#64;&#x67;&#x75;a&#114;&#x64;i&#97;&#x6e;p&#114;&#x6f;j&#101;&#x63;t.&#x69;&#x6e;f&#x6f;</a> (GPG: 0x69B37AA9)<br /></span></span></p> <h2 id="press-kit">PRESS KIT</h2> <ul> <li>Download our Press Kit for logos, screenshots, device photos, team photos and more: <a href="https://github.com/guardianproject/GuardianProjectPressKit/archive/master.zip">https://github.com/guardianproject/GuardianProjectPressKit/archive/master.zip</a></li> </ul> <h2 id="press-releases">PRESS RELEASES</h2> <ul> <li>March 10, 2014 <a href="https://docs.google.com/document/d/1kI6dV6nPSd1z3MkxSTMRT8P9DcFQ9uOiNFcUlGTjjXA/edit?usp=sharing">GOOGLE EXECUTIVE CHAIRMAN ERIC SCHMIDT AWARDS GUARDIAN PROJECT A “NEW DIGITAL AGE” GRANT</a> <br /></li> </ul> https://guardianproject.info/trust/ Wed, 11 Sep 2013 16:08:14 -0400 https://guardianproject.info/trust/ <p style="text-align: center;"> <a href="https://guardianproject.info/wp-content/uploads/2013/09/207290-phone-security-lock.jpg"><img class="aligncenter size-medium wp-image-11649" style="border: 0px none;" alt="207290-phone-security-lock" src="https://guardianproject.info/wp-content/uploads/2013/09/207290-phone-security-lock-300x168.jpg" width="480" height="268" /></a> </p> <h2 id="span-style-color-c0c0c0-trusted-by-the-press-span"><span style="color: #c0c0c0;">TRUSTED BY THE PRESS</span></h2> <p style="text-align: center;"> <a href="https://guardianproject.info/wp-content/uploads/2013/09/The_New_York_Times_logo.png"><img style="border: 0px none;" alt="The_New_York_Times_logo" src="https://guardianproject.info/wp-content/uploads/2013/09/The_New_York_Times_logo-300x44.png" width="300" height="44" /></a><a href="https://arstechnica.com//information-technology/2011/04/for-paranoid-androids-guardian-project-supplies-smartphone-security/" target="_blank"><img style="border: 0px none;" alt="ars-logo" src="https://guardianproject.info/wp-content/uploads/2013/09/ars-logo-300x300.png" width="72" height="72" /></a> </p> <!--more--> <h2 id="span-style-color-c0c0c0-partners-everywhere-span"><span style="color: #c0c0c0;">PARTNERS EVERYWHERE</span></h2> <p style="text-align: center;"> <a href="https://guardianproject.info/wp-content/uploads/2013/09/USA-RFA-Logo-color.png"><img style="border: 0px none;" alt="USA RFA Logo (color)" src="https://guardianproject.info/wp-content/uploads/2013/09/USA-RFA-Logo-color-300x126.png" width="162" height="68" /></a> <a href="https://guardianproject.info/wp-content/uploads/2013/09/google-logo.jpeg"><img style="border: 0px none;" alt="google-logo" src="https://guardianproject.info/wp-content/uploads/2013/09/google-logo-300x150.jpeg" width="152" height="76" /></a><a href="https://guardianproject.info/wp-content/uploads/2013/09/internews_logo.png"><img style="border: 0px none;" alt="internews_logo" src="https://guardianproject.info/wp-content/uploads/2013/09/internews_logo.png" width="124" height="108" /></a><a href="https://guardianproject.info/wp-content/uploads/2013/09/Zetetic.png"><img style="border: 0px none;" alt="Zetetic" src="https://guardianproject.info/wp-content/uploads/2013/09/Zetetic.png" width="163" height="40" /></a> </p> <!--more--> <h2 id="span-style-color-c0c0c0-download-secure-apps-span"><span style="color: #c0c0c0;">DOWNLOAD SECURE APPS</span></h2> <p style="text-align: center;"> <a href="https://guardianproject.info/wp-content/uploads/2010/02/amazon.jpg"><img style="border: 0px none;" alt="amazon" src="https://guardianproject.info/wp-content/uploads/2010/02/amazon-300x300.jpg" width="61" height="61" /></a><a href="https://guardianproject.info/wp-content/uploads/2012/07/get_it_on_play_logo_large.png" target="_blank"><img style="border: 0px none;" alt="get_it_on_play_logo_large" src="https://guardianproject.info/wp-content/uploads/2012/07/get_it_on_play_logo_large.png" width="172" height="60" /></a> </p> <p>&nbsp;</p> https://guardianproject.info/trust/ Wed, 11 Sep 2013 16:08:14 -0400 https://guardianproject.info/trust/ <p style="text-align: center;"> <a href="https://guardianproject.info/wp-content/uploads/2013/09/207290-phone-security-lock.jpg"><img class="aligncenter size-medium wp-image-11649" style="border: 0px none;" alt="207290-phone-security-lock" src="https://guardianproject.info/wp-content/uploads/2013/09/207290-phone-security-lock-300x168.jpg" width="480" height="268" /></a> </p> <h2 id="span-style-color-c0c0c0-trusted-by-the-press-span"><span style="color: #c0c0c0;">TRUSTED BY THE PRESS</span></h2> <p style="text-align: center;"> <a href="https://guardianproject.info/wp-content/uploads/2013/09/The_New_York_Times_logo.png"><img style="border: 0px none;" alt="The_New_York_Times_logo" src="https://guardianproject.info/wp-content/uploads/2013/09/The_New_York_Times_logo-300x44.png" width="300" height="44" /></a><a href="https://arstechnica.com//information-technology/2011/04/for-paranoid-androids-guardian-project-supplies-smartphone-security/" target="_blank"><img style="border: 0px none;" alt="ars-logo" src="https://guardianproject.info/wp-content/uploads/2013/09/ars-logo-300x300.png" width="72" height="72" /></a> </p> <!--more--> <h2 id="span-style-color-c0c0c0-partners-everywhere-span"><span style="color: #c0c0c0;">PARTNERS EVERYWHERE</span></h2> <p style="text-align: center;"> <a href="https://guardianproject.info/wp-content/uploads/2013/09/USA-RFA-Logo-color.png"><img style="border: 0px none;" alt="USA RFA Logo (color)" src="https://guardianproject.info/wp-content/uploads/2013/09/USA-RFA-Logo-color-300x126.png" width="162" height="68" /></a> <a href="https://guardianproject.info/wp-content/uploads/2013/09/google-logo.jpeg"><img style="border: 0px none;" alt="google-logo" src="https://guardianproject.info/wp-content/uploads/2013/09/google-logo-300x150.jpeg" width="152" height="76" /></a><a href="https://guardianproject.info/wp-content/uploads/2013/09/internews_logo.png"><img style="border: 0px none;" alt="internews_logo" src="https://guardianproject.info/wp-content/uploads/2013/09/internews_logo.png" width="124" height="108" /></a><a href="https://guardianproject.info/wp-content/uploads/2013/09/Zetetic.png"><img style="border: 0px none;" alt="Zetetic" src="https://guardianproject.info/wp-content/uploads/2013/09/Zetetic.png" width="163" height="40" /></a> </p> <!--more--> <h2 id="span-style-color-c0c0c0-download-secure-apps-span"><span style="color: #c0c0c0;">DOWNLOAD SECURE APPS</span></h2> <p style="text-align: center;"> <a href="https://guardianproject.info/wp-content/uploads/2010/02/amazon.jpg"><img style="border: 0px none;" alt="amazon" src="https://guardianproject.info/wp-content/uploads/2010/02/amazon-300x300.jpg" width="61" height="61" /></a><a href="https://guardianproject.info/wp-content/uploads/2012/07/get_it_on_play_logo_large.png" target="_blank"><img style="border: 0px none;" alt="get_it_on_play_logo_large" src="https://guardianproject.info/wp-content/uploads/2012/07/get_it_on_play_logo_large.png" width="172" height="60" /></a> </p> <p>&nbsp;</p> https://guardianproject.info/2013/08/23/keeping-data-private-means-it-must-be-truly-deletable/ Fri, 23 Aug 2013 17:36:49 -0400 https://guardianproject.info/2013/08/23/keeping-data-private-means-it-must-be-truly-deletable/ <p><a href="https://guardianproject.info/wp-content/uploads/2013/08/erase-hard-drive.jpg"><img src="https://guardianproject.info/wp-content/uploads/2013/08/erase-hard-drive-150x150.jpg" alt="deleting data" width="150" height="150" class="alignright size-thumbnail wp-image-11598" /></a>There are lots of apps these days that promise to keep your data secure, and even some that promise to wipe away private information mere seconds or minutes after it has been received. It is one thing to keep data out of view from people you don’t want seeing it, it is also important to be able to truly delete information. Unfortunately computers make it very difficult to make data truly disappear. When we tell a computer to delete a file, it only deletes the reference to the data. The data itself remains on the disk unchanged. For any UNIX geek out there, you can easily see an example of that by greping a partition (e.g. <code>sudo grep password /dev/sda3</code>. To solve this problem, there are “secure delete” options. Secure deletion removes the reference like regular deletion, then wipes the data on the disk by overwriting it with random data. That’s much better, but not always good enough. It turns out that its possible to remove the hard disk and read magnetic residue and recover even wiped data.</p> <p>Mobile devices only make that problem worse because they almost always rely on flash memory for disk storage. Flash memory has wear-leveling programming built into it, so it is not possible to guarantee that a file will be wiped without overwriting the whole flash disk, then deleting it all and overwriting the whole thing again. Not only is it not practical to delete the whole disk just to remove one file, it also takes a long time.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2013/08/coldbootattack.jpg"><img src="https://guardianproject.info/wp-content/uploads/2013/08/coldbootattack-300x199.jpg" alt="" width="300" height="199" class="alignleft size-medium wp-image-11600" srcset="https://guardianproject.info/wp-content/uploads/2013/08/coldbootattack-300x199.jpg 300w, https://guardianproject.info/wp-content/uploads/2013/08/coldbootattack.jpg 1024w" sizes="(max-width: 300px) 100vw, 300px" /></a>So what can we do about this? Use encryption! [<a href="http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.225.6872" title="Secure Data Deletion for USB Flash Memory (2011)" target="_blank">1</a>] If the data is encrypted before its written to either a classic hard drive or flash memory disk, then the actual data is never on the disk itself. If the data is encrypted with a good passphrase, then just “forgetting” the key will make it basically impossible to recover the data. Additionally, encrypted data looks like random data, so it is easy to hide the deleted, encrypted data from the recovery techniques by adding random garbage to the disk. It turns out that with the right architecture, a key can be forgotten quite quickly, much quicker than even the most basic secure deletion.</p> <p>This logic is built into our new passphrase library <a href="https://github.com/guardianproject/cacheword" target="_blank">Cacheword</a>. Cacheword is a library for securely working with and caching passphrases. It plugs right into <a href="https://guardianproject.info/code/sqlcipher" target="_blank">SQLCipher for Android</a> and <a href="https://guardianproject.info/code/iocipher" target="_blank">IOCipher</a>. SQLCipher and IOCipher are both ways for easily storing data using strong AES-256 encryption. Cacheword then handles getting the passphrase from the user. Instead of feeding that passphrase directly to SQLCipher or IOCipher, it creates an encrypted file for storing a strong AES-256 key and that is what is used to lock SQLCipher and IOCipher. The user’s passphrase then just unlocks that encrypted key file.</p> <p>The means you can get rapid deletion of data stores of any size by just deleting the key file. The user never sees the actual key so they cannot divulge it. Since the user’s passphrase is not the key for the data but instead the key to the Cacheword key file, the secure deletion can first focus on that key file. The key file is small, so that can happen very quickly. Then even if the data files are recovered, the user does not has the passphrase to the data, its only locked away in the now deleted key file. The key was stored encrypted, so a standard deletion will provide decent protection: it will look like random data on the disk.</p> <p>To really ensure the key and the data is gone for good, an app can implement a full wiping procedure. Normal wiping procedures can follow as a background task, making it harder and harder to recover the data, no matter who the adversary is. The full wiping procedure would go something like this (with a rough timeframe for each step):</p> <ol> <li>Cacheword wipes the passphrase from memory (nanoseconds to milliseconds)</li> <li>the Cacheword key file is deleted (milliseconds)</li> <li>write random garbage to disk patterned after the key file to obscure the deleted key file (milliseconds to minutes)</li> <li>delete the SQLCipher/IOCipher data files (seconds to minutes)</li> <li>fill entire memory (RAM) with random garbage (minutes to hours)</li> <li>fill entire disk with random garbage (hours)</li> <li>power off device</li> </ol> <p>That’s the overview of the process. But of course, there are always annoying technical details, and I’ll continue on about some of them, for those who like such things.</p> <p>To start with, the user’s passphrase will most likely be stored in memory by code outside of Cacheword, SQLCipher, and IOCipher. For example, the Android text entry widget will have the passphrase pass thru it, and inevitably will store that data in memory. It is up to the garbage collection to remove that from memory, and the garbage collection might not zero out the memory before deallocating it. We’re still looking into ideas for how to trigger that, and would love to hear suggestions.</p> <p>To truly wipe the data from the disk, there would need to be multiple passes where the entire disk is filled up then the entire disk is deleted. That is rarely practical. So hiding the existence of the encrypted data stores is difficult to do in practice. The encrypted data will remain encrypted with AES-256 using a random, full length key, so it would be basically impossible to crack using publicly known technology and techniques.</p> <p>The best bet for preventing the most advanced adversary from getting the deleted data would involve a few cycles of rebooting, filling up the memory and disk with random garbage after doing the procedure outlined above. A more rapid version of that would be to delay filling the disk until after a reboot. That would ensure that the key to the data is thoroughly wiped as quickly as possible before starting in on the much less important and long lasting task of wiping the entire disk to hide the deleted data files.</p> https://guardianproject.info/2013/08/21/orweb-security-advisory-possible-ip-leakage-with-html5-video/audio/ Wed, 21 Aug 2013 16:15:36 -0400 https://guardianproject.info/2013/08/21/orweb-security-advisory-possible-ip-leakage-with-html5-video/audio/ <p>The <a href="https://guardianproject.info/apps/orweb">Orweb browser app</a> is vulnerable to <a href="https://dev.guardianproject.info/issues/1754">leak the actual IP of the device</a> it is on, if it loads a page with HTML5 video or audio tags on them, and those tags are set to auto-start or display a poster frame. On some versions of Android, the video and audio player start/load events happen without the user requesting anything, and the request to the URL for the media src or through image poster is made outside of the proxy settings.</p> <p>The Android WebView component upon which Orweb is built, does not <a href="https://github.com/guardianproject/OnionKit/blob/master/libonionkit/src/info/guardianproject/onionkit/web/WebkitProxy.java">pass on the proxy settings</a> for the web page to embedded media players it displays. Additionally, even though the <a href="http://developer.android.com/reference/android/webkit/WebSettings.PluginState.html">proper API calls are made</a> to turn off all plugins, apparently HTML5 video and audio players not considered plugins, and there is no way to disable them at an API level.</p> <p>We are currently working to determine which versions of Android these issues occur on. We have a fix implemented that filters all video and audio tag instances out of retrieved content, and on newer versions of Android, that requires a user gesture/tap before media players are loaded.</p> <p>We expect to have a fix out in the next 24 to 48 hours. In the meantime, if you are using Orweb with the goal of strong anonymity, and not just circumvention or proxying, we advise you to avoid all sites that may include HTML5 video or audio content embedded in the pages, or to just stop using the app all together. Alternatively, you can use <a href="https://www.mozilla.org/en-US/mobile/">Firefox for Android</a> with the <a href="https://guardianproject.info/apps/proxymob-firefox-add-on/">Proxy Mobile</a> add-on (load this XPI within Firefox: <a href="https://guardianproject.info/releases/proxymob-latest.xpi">https://guardianproject.info/releases/proxymob-latest.xpi</a>)</p> <p><em>This does NOT affect users who use the root mode with transparent proxying, as that handles proxying the entire traffic of the entire device or a particular app.</em></p> https://guardianproject.info/2013/07/24/orbot-v12-now-in-beta/ Wed, 24 Jul 2013 12:32:45 -0400 https://guardianproject.info/2013/07/24/orbot-v12-now-in-beta/ <p>After much too long, we’ve got a new build of Orbot out, and it is… a stable beta! Nothing radically new here, just many small changes to continue to improve the experience of our hundreds of thousands of active users out in the world. There will likely be one or two more “beta” releases to iron out small issues in v12, but for now, this one is good to go.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2013/07/mightyorbot.jpg"><img alt="mightyorbot" src="https://guardianproject.info/wp-content/uploads/2013/07/mightyorbot-225x300.jpg" width="225" height="300" /><br /> </a> <em>a very might orbot</em></p> <p>The really exciting aspect of this release is that we have ironed out some integration points with other apps, like our own Gibberbot, and third-party apps like DuckDuckGo. These apps can now tell if Orbot is installed, running, and if not, request it to start up. Once Orbot is started, it will return to the calling app, and let them know they can proceed with routing their traffic over Tor. We hope that through use of our <a href="https://github.com/guardianproject/OnionKit/blob/master/libonionkit/src/info/guardianproject/onionkit/ui/OrbotHelper.java">OrbotHelper utility</a> (part of the <a href="https://github.com/guardianproject/OnionKit">OnionKit/NetCipher library</a>), many more apps will choose to provide their users with better anonymity and privacy of their network traffic.</p> <p><span style="font-size: 13px;">Since we haven’t done a release in awhile, and we have some new build </span><span style="font-size: 13px;">tools, I mostly want to make sure I have not done something terribly </span><span style="font-size: 13px;">wrong in the build process. Please confirm back if you are able to </span><span style="font-size: 13px;">successfully use this release. You can report issues <a href="https://dev.guardianproject.info/projects/orbot/issues/new">on our bug tracker</a>.</span></p> <p>We’ve switched versioning styles to a simpler major.minor.bugfix “semantic” model, so this is now Orbot 12.0.1.</p> <p>Signed 12.0.1 beta release build is here:<br /> <a href="https://rink.hockeyapp.net/apps/92ace552aa5344d1a802decb71525897/">https://rink.hockeyapp.net/apps/92ace552aa5344d1a802decb71525897/</a></p> <p>Direct APK is here: <a href="https://guardianproject.info/releases/Orbot-release-12.0.1-beta-1.apk">https://guardianproject.info/releases/Orbot-release-12.0.1-beta-1.apk</a> (<a href="https://guardianproject.info/releases/Orbot-release-12.0.1-beta-1.apk.asc">gpg sig</a>)</p> <p>We also have automated “nightly” debug builds from the development branch:<br /> <a href="https://guardianproject.info/builds/Orbot/">https://guardianproject.info/builds/Orbot/</a></p> <p>Updates in 12.0.1:</p> <ul> <li><span style="font-size: 13px;">updated to Tor 0.2.4.15-RC</span></li> <li><span style="font-size: 13px;">flashy screen bug fixed</span></li> <li><span style="font-size: 13px;">now shows traffic stats in notification area</span></li> <li><span style="font-size: 13px;">better handling of preference settings changes</span></li> <li><span style="font-size: 13px;">added superuser permission for Cyanogen</span></li> <li>better support for “start” Intent, integration with other apps</li> </ul> <p>Tagged source is here:<br /> <a href="https://gitweb.torproject.org/n8fr8/orbot.git/log/refs/tags/12.0.1">https://gitweb.torproject.org/n8fr8/orbot.git/log/refs/tags/12.0.1</a></p> https://guardianproject.info/2013/07/22/jitsi-ostel.co-and-isp-censorship/ Mon, 22 Jul 2013 15:33:44 -0400 https://guardianproject.info/2013/07/22/jitsi-ostel.co-and-isp-censorship/ <p>Earlier last week n8fr8 suspected something changed on the ostel.co server, due to many users emailing support specifically about Jitsi connectivity to ostel.co. The common question was “why did it work a few weeks ago and now it doesn’t anymore?”</p> <p>The tl;dr follows, skip to keyword CONCLUSION to hear only the punch line.</p> <p>To support n8fr8’s hypothesis, there was a small change to the server but I wan’t convinced it effected anything since all my clients continued to work properly, including Jitsi. Obviously <em>something</em> had changed but none of us knew what it was. After some testing we discovered the problem was related to insecure connections from Jitsi to UDP port 5060 on ostel.co. Secure connections (on TCP port 5061) continued to work as expected.</p> <p>To make matters more confusing, I could register and make calls with two different clients (CSipSimple and Linphone) on the same network (my home ISP, Verizon FiOS) using an insecure connection to ostel.co on UDP port 5060.</p> <p>At this point I was like WTF?</p> <p>I went back to the server, diffed all the configs, checked server versions, connected with every client I could find that would run on any of my computers. The only change was a Kamailio upgrade from 4.0.1 to 4.0.2. A minor point release. The problem with Jitsi remained. What could the server be doing to this poor client?</p> <p>I did a packet trace on the ostel.co server’s public network interface, filtered to dump packets only on UDP port 5060 that match my SIP username. I opened Jitsi and things got interesting. For the curious, here’s the utility and options I used. If you are new to operating a SIP network, ngrep is an excellent tool for debugging.</p> <p><code>ngrep -d eth0 -t -p -W byline foo port 5060</code></p> <p>I’ll include an excerpt (I’ve included only the relevant headers for this issue) of the initial request from Jitsi. IP addresses and usernames have been changed to protect the innocent.</p> <p><code>U 2013/07/19 22:17:34.920749 0.0.0.0:5060 -&gt; 66.151.32.200:5060&lt;br /&gt; REGISTER sip:ostel.co SIP/2.0.&lt;br /&gt; CSeq: 1 REGISTER.&lt;br /&gt; From: &quot;foo&quot; &lt;sip:&amp;#x66;&amp;#x6f;&amp;#x6f;&amp;#x40;&amp;#x6f;&amp;#x73;&amp;#x74;&amp;#x65;&amp;#x6c;&amp;#x2e;&amp;#x63;&amp;#x6f;&gt;;tag=1eb3467e.&lt;br /&gt; To: &quot;foo&quot; &lt;sip:&amp;#x66;&amp;#x6f;&amp;#x6f;&amp;#x40;&amp;#x6f;&amp;#x73;&amp;#x74;&amp;#x65;l.co&gt;.&lt;br /&gt; Via: SIP/2.0/UDP 0.0.0.0:49152;branch=z9hG4bK-393535-2269e43afef0b312554eb419a8d0540e.&lt;br /&gt; User-Agent: Jitsi2.3.4752Linux.&lt;br /&gt; Contact: &quot;foo&quot; &lt;sip:foo@0.0.0.0:49152;transport=udp;registering_acc=ostel_co&gt;;expires=600.&lt;br /&gt; .</code></p> <p>U 2013/07/19 22:17:34.921155 66.151.32.200:5060 -&gt; 0.0.0.0:5060<br /> SIP/2.0 401 Unauthorized.<br /> CSeq: 1 REGISTER.<br /> From: “foo” <a href="sip:fo&amp;#x6f;@&amp;#x6f;s&amp;#x74;e&amp;#x6c;.&amp;#x63;o">sip:fo&amp;#x6f;@&amp;#x6f;s&amp;#x74;e&amp;#x6c;.&amp;#x63;o</a>;tag=1eb3467e.<br /> To: “foo” <a href="sip:foo@&amp;#x6f;&amp;#x73;&amp;#x74;&amp;#x65;l.co">sip:foo@&amp;#x6f;&amp;#x73;&amp;#x74;&amp;#x65;l.co</a>;tag=e01f0de2cdfebbeefc5ff0c8eabbb8b3.2f1f.<br /> Via: SIP/2.0/UDP 0.0.0.0:49152;branch=z9hG4bK-393535-2269e43afef0b312554eb419a8d0540e;rport=5060.<br /> WWW-Authenticate: Digest realm=”ostel.co”, nonce=”Uen0alHp8z4d6ePDl83RtMwARltAxzQu”, qop=”auth”.<br /> Server: kamailio (4.0.2 (x86_64/linux)).</p> <p>If you read the response, you’ll see Kamailio sent 401 Unauthorized. This is normal for SIP authentication. A second client request should follow it, which should contain an Authorization header with an md5 and a nonce. When Kamailio receives this request, checks the auth database and sends a 200 OK response, the client is authenticated.</p> <p>The SIP dialog looks good but Jitsi continues not to register. The dialog flow is cut off after the 401 Unauthorized response. It’s almost like something has blocked the response to the client.</p> <p>Since I could register Linphone using the same account, I did the same trace for that client. Here’s the excerpt.</p> <p><code>U 2013/07/19 22:33:18.372770 0.0.0.0:42680 -&gt; 66.151.32.200:5060&lt;br /&gt; REGISTER sip:ostel.co SIP/2.0.&lt;br /&gt; Via: SIP/2.0/UDP 0.0.0.0:49153;rport;branch=z9hG4bK359459505.&lt;br /&gt; From: &lt;sip:f&amp;#x6f;o&amp;#x40;&amp;#x6f;s&amp;#x74;e&amp;#x6c;&amp;#x2e;c&amp;#x6f;&gt;;tag=142131416.&lt;br /&gt; To: &lt;sip:fo&amp;#x6f;@&amp;#x6f;s&amp;#x74;e&amp;#x6c;.&amp;#x63;o&gt;.&lt;br /&gt; CSeq: 3 REGISTER.&lt;br /&gt; Contact: &lt;sip:foo@0.0.0.0:49153;line=65da8bffcabe8c4&gt;.&lt;br /&gt; User-Agent: LinphoneAndroid/2.1.2-1-g23b7fc0 (eXosip2/3.6.0).&lt;br /&gt; .</code></p> <p>U 2013/07/19 22:33:18.373112 66.151.32.200:5060 -&gt; 0.0.0.0:42680<br /> SIP/2.0 401 Unauthorized.<br /> Via: SIP/2.0/UDP 0.0.0.0:49153;rport=42680;branch=z9hG4bK359459505.<br /> From: <a href="sip:&amp;#x66;&amp;#x6f;&amp;#x6f;&amp;#x40;&amp;#x6f;&amp;#x73;&amp;#x74;&amp;#x65;&amp;#x6c;&amp;#x2e;&amp;#x63;&amp;#x6f;">sip:&amp;#x66;&amp;#x6f;&amp;#x6f;&amp;#x40;&amp;#x6f;&amp;#x73;&amp;#x74;&amp;#x65;&amp;#x6c;&amp;#x2e;&amp;#x63;&amp;#x6f;</a>;tag=142131416.<br /> To: <a href="sip:foo&amp;#x40;&amp;#x6f;&amp;#x73;&amp;#x74;el.c&amp;#x6f;">sip:foo&amp;#x40;&amp;#x6f;&amp;#x73;&amp;#x74;el.c&amp;#x6f;</a>;tag=e01f0de2cdfebbeefc5ff0c8eabbb8b3.4065.<br /> CSeq: 3 REGISTER.<br /> WWW-Authenticate: Digest realm=”ostel.co”, nonce=”Uen4GlHp9u4FwHNY/uE1iQQNCfGHJiob”, qop=”auth”.<br /> Server: kamailio (4.0.2 (x86_64/linux)).</p> <p>This 401 Unauthorized response was received by the client and the follow up request with the Authorization header was sent with the correct digest. Linphone registered. I made a call. Everything worked fine. Indeed WTF?</p> <p>I stared at these traces for a while to get a clue. Look again at the first line of the request from Jitsi. You’ll see a timestamp followed by two IP:port pairs. Notice the port on the first IP is 5060 and the port on the second IP is also 5060. This means that the <strong>source port</strong> used by Jitsi on my home network is UDP port 5060. In order for a response to come back to Jitsi, it must enter my network on the same port it exited. Now read the top line of the response from Kamailio. Indeed, the server sent the response to UDP port 5060.</p> <p>Now look at the same flow for Linphone. There is a very different source port in that dialog. In this case, Kamailio sent the response to UDP port 42680 and Linphone received it. Also notice the IP address used by Kamailio as the destination of the response is the same one in the dialog from Jitsi.</p> <p>The question remained, why can’t Jitsi get the same kind of SIP response on UDP port 5060? Why is Jitsi using a single source port for outgoing traffic anyway? That value can be dynamic. I configured Jitsi to use a different port for insecure SIP. It has an advanced configuration for SIP with the key “SIP client port”. I set this to 5062 (5061 is conventionally used for secure SIP traffic so I incremented by 2) and tried to register again.</p> <p>SUCCESSSSSSSSSSSS!</p> <p>To be thorough, I changed Jitsi’s SIP port again to a 5 digit number I randomly typed on my keyboard without looking.</p> <p>SUCCESSSSSSSSSSSS!</p> <p>So if Jitsi can register to Kamailio on any port other than UDP port 5060, WTF is going on? I had a suspicion. I tried one more test before I called it. I configured Jitsi to connect on TCP port 5060. It registered successfully. Now I know what’s going on. I have a sad 🙁</p> <p>CONCLUSION</p> <p>My ISP, Verizon FiOS, has a firewall running somewhere upstream (it could be on the router they provided, I haven’t checked yet) that blocks incoming UDP traffic to port 5060. This probably falls under their TOS section which forbids “running servers” since Verizon provides voice services for an additional fee on top of data service, despite both running over the same fiber connection to my house. It seems like Verizon doesn’t want their data-only customers to get in the way of that sweet cheddar delivery each month in exchange for “phone service”.</p> <p>This sucks on two levels.</p> <p>LEVEL 1</p> <p>Why is my ISP censoring my incoming traffic when I have 5 mbps of incoming bandwidth? I assume the answer is “because they can.” *desolate frowny face*</p> <p>LEVEL 2</p> <p>Why doesn’t Jitsi use a dynamic source port for SIP requests? I assume the answer is “Jitsi is open source, why don’t I change this and send a patch upstream?”</p> <p>Both levels are formidable challenges to overcome. Convincing Verizon to play nice on the Internet feels like a vanity project. I’m writing that off. To make a change to the SIP stack in Jitsi is well within the area of the GP team’s expertise, myself included but it’s not a trivial undertaking. Since this is a default configuration change there is probably a reason upstream devs made this choice so in addition to the programming work there’s the work to convince the developers this would be a change worth a new release.</p> <p>Since this is specific to Jitsi, I’m going to follow up with the developers and see if I missed anything. Stay tuned for part two.</p> <p>Thanks for listening. Stay safe!</p> https://guardianproject.info/2013/07/18/our-newest-app-pixelknot/ Thu, 18 Jul 2013 13:14:49 -0400 https://guardianproject.info/2013/07/18/our-newest-app-pixelknot/ <p>Have you ever hidden in plain sight? Worn camouflage in the woods or an invisibility cloak in a narrow crooked alley? It’s really hard to do properly. We’re hoping that all changes with PixelKnot.</p> <p>PixelKnot is an app for hiding secret messages in pictures.  Sort of like invisible ink on the back of a painting, updated to the present.  The ancient art known as steganography, now updated for the 21st century and requiring a more rigorous set of safety standards.</p> <p>The idea is to let anyone, anywhere share a secret with a friend. To most people, all they see is a picture. But to the right person, they know that someone has left them a message in that picture using PixelKnot. And they can find the message by opening that same picture in PixelKnot. Some people will even add a password to add another layer of protection to make sure that the message only ends up with the right person. And even if the message is detected, it’s also encrypted, making it that much harder to decode.</p> <p>While hiding in plain sight using the app is easy, the app itself isn’t.  To define it, we’ve established the Guardian Project steganography standard. The approach of using steganography has some known limitations, but to be secure and reliable, for us the steganographed image must:</p> <ol> <li>Have the original image appear, to the trained human eye, unedited.</li> <li>Have the bytes of the image appear, to a trained analyst, undistorted so much so as to arouse suspicion.</li> <li>Have the complete message be recoverable no matter how it is transmitted.</li> </ol> <p>As recent media stories have shown, large scale analysis is becoming a reality with increasing speed. Our standard seeks to ensure that our pictures, and the messages inside, can’t be plucked out like a needle in a haystack.  Another issue is that a lot of social media sites shrink and distort images that users upload.  This breaks our cipher since it’s technically a different image than what the User uploaded.  We’re fixing it so that it’s not a problem.  Already it works across Flickr, Tumblr and Google+,  with Facebook in the pipeline.</p> <p>To build the steganography into the app, we used the <a title="f5 steganography" href="https://code.google.com/p/f5-steganography/" target="_blank">F5 algorithm</a>, which is resistant to visual and statistical attacks. Yet it still offers a large steganographic capacity, by using matrix encoding to improve the efficiency of embedding. F5 uses permutative straddling to uniformly spread out the changes over the whole steganogram, which helps us maintain the standards mentioned above that keep the messages from being detected.</p> <p>How safe is safe, you might be wondering? We’ve been running tests on images created by PixelKnot using <a title="Stegdetect" href="http://www.outguess.org/detection.php" target="_blank">Stegdetect</a>, an automated tool for detecting steganographic content in images. It’s capable of detecting several different steganographic methods to embed hidden information in JPEG images. We trimmed it down to target f5 specifically. The results have been promising, though not 100%.</p> <p>One goal we had while building the app was to transform the user experience of security and to see how easy and fun we could make the sharing of hidden messages.  The app starts by deciphering an image if there is text hidden inside already. If not,  it chooses enciphering, asking whether to take a photo or use one from a gallery. Why add unnecessary prompts asking users what they want to do, when there’s only one thing to do? A user can only move forward through the flow of the experience. In this way, we’re trying to increase security through a guided experience. If done properly and transparently, giving the user less options for navigation mean less ways to fail.</p> <p>Is hiding messages in pictures the best way to spread secrets so that only the right person hears it? We don’t know.  At times in history, it’s been the only option, like between kings. At other times, it’s merely been used for fun, like scavenger hunts. For PixelKnot, we wanted to make something that could work in both scenarios o. But it’s up to users to decide.</p> <p>We hope to share stories of people using PixelKnot in fun new ways.  If you have a idea or experience, please share it with us. We’d also like to add more features to PixelKnot that make strides both in security and in design, so your feedback is important– what would you most like to see? Until then, happy knotting!</p> <p>Learn more about the app on <a href="https://guardianproject.info/apps/pixelknot/" title="pixelknot">our site</a>, or get it directly <a title="Pixelknot on Google Play" href="https://play.google.com/store/apps/details?id=info.guardianproject.pixelknot" target="_blank">from Google Play</a>.</p> https://guardianproject.info/2013/07/16/modernizing-expectations-for-the-nouveau-secure-mobile-messaging-movement/ Tue, 16 Jul 2013 00:52:31 -0400 https://guardianproject.info/2013/07/16/modernizing-expectations-for-the-nouveau-secure-mobile-messaging-movement/ <p><em>The tl;dr of this lengthy (tho entertaining and immensely important!) post is this: Stopping with “We support OTR” or “We support PGP” is not enough anymore. There are at <strong>least seven</strong>, if not more, very important security features that any app claiming to provide secure messaging must implement as soon as possible, to truly safeguard a user’s communication content, metadata and identity.</em></p> <p><em>Note: The names “Gibberbot” and “ChatSecure” are used interchangeabley below, as we are in the midst of an app rebrand. Apologies!</em></p> <p><span style="font-size: 13px; line-height: 19px;">There has been a great deal of activity recently around new apps and projects working towards the goal of end-to-end secure mobile messaging. This is both prompted by the overwhelming popularity of closed-source, insecure apps like WhatsApp, Viber, Line and WeChat, and by the recent revelations around government-sponsored surveillance in portions of the world that like to think of themselves as “free”.</span></p> <p><a href="http://pennwic.wordpress.com/2012/09/18/new-workshop-series-tools-not-toys/"><img alt="Too Many Apps" src="https://guardianproject.info/wp-content/uploads/2013/07/Too-Many-Apps.jpg" width="360" height="400" /></a></p> <p><span style="font-size: 13px; line-height: 19px;">Whether it be the effort by the <a href="https://plus.google.com/+CyanogenMod/posts/23vfN2qdZTu">CyanogenMOD team to build in a secure push messaging</a>, the arrival of new apps like <a href="http://gryphn.co/">Gryphn</a>, <a href="https://www.mywickr.com">Wickr</a>, <a href="http://threema.ch/">Threema</a> and <a href="https://www.surespot.me">SureSpot</a>, or the very succesful crowdsourced funding of <a href="https://heml.is/">Heml.is</a>, there is no question that there is both user and developer interest in this topic. I would also be remiss not to mention the continuing excellent work by Moxie and the <a href="https://whispersystems.org/">Open Whisper Systems</a> team on SMS-based secure messaging, Ge0rg and the <a href="http;//yaxim.org">Yaxim</a> app, our iOS sister project <a href="http://chatsecure.org">ChatSecure</a>, and of course, <a href="https://silentcircle.com/">Silent Circle</a> (<a href="http://issilentcircleopensourceyet.com/">are they open-source yet or what?</a>).</span></p> <p><strong>Protecting Content, Metadata and Identity</strong></p> <p>At the Guardian Project, we have been working on open-source, standards-based, secure messaging <a href="https://guardianproject.info/apps/gibber">for a few years now</a>, and are simultaneously both excited and concerned about all of this activity. We are seriously thrilled that so many talented developers are finally interested in empowering every day mobile users with powerful tools to keep their communications private. We are amazed at the creativity and quality of output seen so far, as well as the diverse approaches to solving this complex problem. Most of these apps are innovating way beyond the basic concepts of secure messaging established by systems like OpenPGP and OTR encryption, and actually thinking deeply about what it means to be secure in a mobile context. However, we also think that, in many cases, the security being implemented may not be going far enough. At the least, we feel that a new bar needs to be set, that is nost just “more secure than WhatsApp”. We need to establish norms to help the user better understand and parse through their options.</p> <p>In this context, the word “secure” should be taken to mean, that the contents of a message or conversation between one or more parties, should only be able to be viewed by those parties. This means that the application or service should ensure that message content, be it plain text or rich media, is both protected on the device and over the network, from extraction, interception, and decryption. In addition, “secure” should also extend to protect from network traffic surveillance, the fact that a conversation between one or more parties is even happening in the first place. Finally, as much as possible, the user should be able to control their identity within the messaging system, such that personal, real-world information (phone number, email, geolocation) is not exposed without their approval.</p> <p>This three-fold approach to mobile security (Content, Metadata, Identity) is a work in progress, but does capture our basic sentiment and approach to secure mobile messaging. From here, I would like to step one level down, and talk about the set of features in our next release of <a href="https://github.com/guardianproject/Gibberbot/tree/v12-alpha">Gibberbot</a>, currently in alpha, that we feel keep our solution to mobile messaging at the head of the pack.</p> <p><strong>1. Full Local Data Encryption</strong></p> <p>Many apps feel their job in protecting messages is done once it gets to the device. In the face of Android app malware that can vacuum up data from a device and forensic extraction software and hardware, this is obviously not the case. Full disk encryption only protects when a device is locked or powered off, and besides, most users do not enable it. It is up to apps themselves to provide full encryption of all data – account configuration, sensitive settings values, messages, logs – anything that might expose a user’s information to other apps on the system or to a extraction software must be protected. Yes, this also means your user will need to enter a password every time they use your app, but it is possible to make that process less painful.</p> <p><a style="margin: 3px;" href="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-053533.png"><img class="wp-image-11455 alignnone" alt="device-2013-07-12-053533" src="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-053533.png" width="259" height="461" srcset="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-053533.png 720w, https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-053533-168x300.png 168w, https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-053533-576x1024.png 576w" sizes="(max-width: 259px) 100vw, 259px" /></a></p> <p>We have been working on two developer libraries, <a href="https://guardianproject.info/code/sqlcipher">SQLCipher</a> and <a href="https://guardianproject.info/code/iocipher">IOCipher</a>, which provide a simple means to enable database and file encryption in any app. More recently, we have added the <a href="https://github.com/guardianproject/cacheword">CacheWord</a> library to that mix, to help safely manage the locking and unlocking of these data stores. Apps like Gryphn have already implemented all three of these libraries, and so will the next version of Gibberbot.</p> <p><strong>2. Certificate Pinning</strong></p> <p><a href="http://www.thoughtcrime.org/">Moxie</a> says it best in his post titled <a href="http://www.thoughtcrime.org/blog/authenticity-is-broken-in-ssl-but-your-app-ha/">Your app shouldn’t suffer SSL’s problems</a>: “If you have a mobile app that makes SSL connections to a service you control, there is really no reason to be validating your service’s certificate using CA signatures.” The <a href="https://github.com/moxie0/AndroidPinning">Android Pinning library</a> makes it quite simple to support this important feature in any app. For Gibberbot, we are pinning certificates of the most common known public XMPP services, such as Google (talk.google.com), Facebook, Jabber.org, Jabber.ccc.de, DuckDuckGo and few more. Beyond that, we offer manual verification (see #3 feature below for more on that). In summary, there is no reason anymore to trust the default CA’s for a messaging app.</p> <p><strong style="font-size: 13px; line-height: 19px;">3. TOFU/POP aka “Manual Certificate Verification”</strong></p> <p><a href="http://noncombatant.org/">Chris Palmer</a>, formerly of the Electronic Frontier Foundation and iSec Partners and now of Google, gave a great talk a few years ago entitled <a href="https://docs.google.com/presentation/d/1bieNRy4TU04PKhQ1i_J_kPZ_Tc2E6efNVbvJ295orBs/present#slide=id.i0">“It’s Time to Fix HTTPS”</a>. In it, he introduced, or perhaps just popularized, the phrase “Trust on First Use, Persistence of Pseudonym”, that is more happily expressed as TOFU/POP! What this means in user form is that when you connect to a new server for the first time over an SSL connection, instead of the SSL Certificate being verified by a built-in set of trusted root authorities (banks, corporations, governments), the certificate is presented to the user, in a human readable format, to be reviewed, accepted or declined. There are a number of useful pieces of information the user can look at to determine the validity – fingerprints, date generated, and so on. If you can safely verify it once, then you will only be notified or asked to verify again if the server’s certificate changes. At that point the user can be told “This site’s certificate changed, and it doesn’t look the same as it was yesterday. Maybe you should ask the admin or help system if it is still safe to use!”.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-054024.png"><img alt="device-2013-07-12-054024" src="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-054024.png" width="259" height="461" /></a></p> <p>The implementation of TOFU/POP that we use in Gibberbot is the <a href="https://github.com/ge0rg/MemorizingTrustManager/wiki">Memorizing Trust Manager</a> library, originally developed for the <a href="http://yaxim.org/">Yaxim messaging app</a>. It works very well, and again, is extremely simple to implement. Through the combination of features #2 and #3 we have removed the threat posed by the failure of the Root Certificate Authority system, and significantly reduced the success rate of Man-in-the-Middle attacks.</p> <p><strong>4. Proxy Support, ideally Tor</strong></p> <p>With all the talk of metadata recently, it should be clear how important traffic surveillance is. Knowing who is using what app when, or being able to see when two users connect peer-to-peer through a service is immensely valuable information. If it is possible to map a user’s social graph via your app based on analysis of packets coming in and out of your service, then you have failed in providing security to your users. Additionally, we have begun to see a new wave of Internet filtering around the world, as countries begin to block access to popular messaging app downloads and centralized servers.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-054331.png"><img class="alignnone wp-image-11460" alt="device-2013-07-12-054331" src="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-054331.png" width="259" height="461" srcset="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-054331.png 720w, https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-054331-168x300.png 168w, https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-054331-576x1024.png 576w" sizes="(max-width: 259px) 100vw, 259px" /></a></p> <p>This makes it critical that any messaging app a user will depend on to protect their messages, also works to protect their network of contacts (social graph), and ensures they will have access to the service no matter where they travel or live in the world. In order to achieve this, direct support for proxy servers should be built in to every secure messaging app. At a bare minimum HTTP proxies should be support, and ideally, HTTPS and SOCKS as well. Once you have support for those, you can easily tie into Orbot on Android, by setting the proxy to “localhost” and the appropriate port. If you want to avoid Tor Exit Node attacks or surveillance, you should then provide a Tor Hidden Service .ONION address for your servers, something that the <a href="https://twitter.com/jabbercccde/status/107850540842627072">CCC’s Jabber server has provided since 2011</a>.</p> <p>We have blogged in the past about <a href="https://guardianproject.info/2012/06/13/auditing-twitter-with-orbot/">Twitter’s support for proxying on Android</a> and our OnionKit library, now named <a href="https://guardianproject.info/code/netcipher/">NetCipher</a>. Gibberbot has supported proxying from nearly the beginning of its existence, and in v12 we are using the <a href="https://github.com/guardianproject/OnionKit/blob/master/sample/src/sample/onionkit/OnionKitSampleActivity.java#L96">OrbotHelper class</a> to add an automatic check if Orbot is installed and running, if a user selects to use it.</p> <p><strong>5. Verifiable Message Encryption</strong></p> <p>While we expect most nextgen secure messaing apps will support some form of public key encryption, OTR ideally and OpenPGP alternatively, that is not really the end of the message encryption problem. With OpenPGP, we know that most users of the software participate in key signing parties on a regular basis. The same is true for users of desktop OTR encryption in apps like Pidgin. People do not verify keys as often as they should. Since most messaging apps support in-band key exchange, it makes performing a MITM attack at the messaging layer quite trivial, if the SSL transport layer encryption is somehow intercepted.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-16-003940.png"><img class="alignnone wp-image-11479" alt="device-2013-07-16-003940" src="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-16-003940.png" width="259" height="461" srcset="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-16-003940.png 720w, https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-16-003940-168x300.png 168w, https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-16-003940-576x1024.png 576w" sizes="(max-width: 259px) 100vw, 259px" /></a> <a href="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-16-004035.png"><img class="alignnone wp-image-11480" alt="device-2013-07-16-004035" src="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-16-004035.png" width="259" height="461" srcset="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-16-004035.png 720w, https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-16-004035-168x300.png 168w, https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-16-004035-576x1024.png 576w" sizes="(max-width: 259px) 100vw, 259px" /></a></p> <p>What is needed are a variety of features, prods, pokes and motivational interventions to ensure that two people who are using an app to exchange encrypted messages know how fun and easy it can be to verify their keys. With Gibberbot, we were one of the first apps to support the display and scanning of OTR fingerprints as QR Codes. We will go beyond that in future releases with NFC support, as well. We also support shared secret and <a href="https://en.wikipedia.org/wiki/Socialist_millionaire">Socialist Millionaire Protocol</a>-based verification, which in short means, if you and your friend have a real world secret or question and answer ready, you can easily verify your cryptographic fingerprints without ever having to look at a long string of alphanumeric characters.</p> <p><strong>6. Key Management</strong></p> <p>This feature comes under the “a great problem to have” category. Once a user really commits to using their app, they will begin building up a network of verified contacts (if you have implemented #5 properly), and generally come to regard your app as a type of secure identity management tool. In fact, they may have created a whole unique identity for themselves that only exists within the confines of your apps, and its encrypted local storage (if you have implemented #1 above). At this point, you need to figure out a means for a user to backup this identity, and generally import and export the data in a variety of ways. If you are using OTR or OpenPGP, then the user may want to share existing keyrings to and from other apps, most likely on their desktop or laptop machines. All in all, the user needs to be empowered to have control of their identity, to move it between devices, to back it up in case a device is wiped or lost, and to keep total control of that information (i.e. not have it backed up automatically to a cloud).</p> <p><a href="https://guardianproject.info/wp-content/uploads/2013/07/keysync.jpg"><img class="alignnone size-full wp-image-11466" alt="keysync" src="https://guardianproject.info/wp-content/uploads/2013/07/keysync.jpg" width="758" height="548" srcset="https://guardianproject.info/wp-content/uploads/2013/07/keysync.jpg 758w, https://guardianproject.info/wp-content/uploads/2013/07/keysync-300x216.jpg 300w" sizes="(max-width: 758px) 100vw, 758px" /></a></p> <p>In our case, we have been working for quite a while on a desktop tool called <a href="https://github.com/guardianproject/otrfileconverter">OTR File Converter</a>, which is built upon more fundamental research into the many ways that <a href="https://github.com/guardianproject/otrfileconverter/blob/master/README.txt">different OTR-enabled apps store their public and private keys</a>. As of Gibberbot v12 alpha 3 (now called “ChatSecure” btw!), we now have working support for <a href="https://lists.mayfirst.org/pipermail/guardian-dev/2013-April/001537.html">importing an OTR key ring from the desktop</a>, in a manner that is secure and fairly simple. Our next stop is to add export from the client, and then automated sync between desktop and mobile on an ongoing basis. Beyond this capability, we also plan to expand the ability to manage keys within the Gibberbot app itself, so that a user can manually revoke, regenerate and update or remove trust of other users’ keys.</p> <p><strong>7. Panic as a feature!</strong></p> <p>Finally, we keep coming across this idea of a “Panic Button” being an important feature for addressing security issues in a mobile environment. A few years ago, we developed an app called <a href="https://github.com/guardianproject/InTheClear/">In The Clear</a> which attempted to provide data wipe and distress beacon functionality across your entire device, be it Android, Nokia or Blackberry. We quickly realized that there were many, many different definitions of what a “Panic Button” should do, and that one app may not be able to encompass all of these needs. Since then, we have thought more about “Panic!” as a feature for an app, and how each app we develop should incorporate the capability to assist users when they feel the data that the app holds may be at risk of being compromised or exposed.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-054429.png"><img class="alignnone wp-image-11461" alt="device-2013-07-12-054429" src="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-054429.png" width="259" height="461" srcset="https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-054429.png 720w, https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-054429-168x300.png 168w, https://guardianproject.info/wp-content/uploads/2013/07/device-2013-07-12-054429-576x1024.png 576w" sizes="(max-width: 259px) 100vw, 259px" /></a></p> <p>In Gibberbot v12, we have implemented Panic as a quick access sidedrawer button. The action can trigger a configurable set of actions, ranging from simply logging out, to deleting all configured accounts, to uninstall the app itself. In the future, we would like to also consider supporting a “turtle shell” type feature where the app can hide itself on your device as an encrypted anonymous blob, until you are ready for it to come back out again. Additionally, supporting false passwords at app unlock that trigger account data wipe or the display of false data is also something we think would be useful to support.</p> <p><strong>What Are You Prepared To Do?</strong></p> <p>We know the deep feeling of adrenaline and satisfaction you get when <del>code</del> ship software that can truly have an impact on a human’s basic freedoms. We are moved when we receive an email from a user in a part of the world where speech and expression is limited and filtered, and they tell us how important our software is to them, and how they do not know what they would without us. These emotions, both from within and shared by others, make it that more important to ensure any development of secure messaging tools is approached in a serious and diligent manner. Checking feature boxes is not enough. Using HTTPS is not enough. Even supporting basic OTR and PGP is no longer enough. We must provide deep and broad security both on the network and on the device, at all times.</p> <p>If you are not prepared to go the extra mile with your app’s security capabilities, then perhaps you are in the wrong line of work.</p> <p> </p> https://guardianproject.info/2013/07/05/building-securing-and-anonymizing-android-apps/ Fri, 05 Jul 2013 13:02:37 -0400 https://guardianproject.info/2013/07/05/building-securing-and-anonymizing-android-apps/ <div id="event-title" data-name="Building, Securing, and Anonymizing Android Apps"> <h1 itemprop="name"> Calling all Android devs: </h1> <p> <img class="aligncenter" alt="" src="break1.jpeg" width="600" height="450" /> </p> </div> <div id="event-content"> <ul> <ul> <li id="event-when"> <div> <div id="event-when-display"> Tuesday, July 9, 2013 - 12:30 PM to <time id="event-end-time">1:30 PM </time> </div> </div> </li> <li> <div> Live on the web: <a title="Livestream Pivotal" href="http://www.livestream.com/pivotallabs" target="_blank">livestream</a> </div> </li> <li id="event-where" data-id="1561918" data-name="Pivotal Labs" data-address="841 Broadway, 8th Floor, New York, NY"> <div> <div id="event-where-display" itemprop="location" itemscope="" itemtype="http://schema.org/Place"> Live in person (with <a title="Pivotal RSVP" href="m&#x61;&#x69;l&#116;&#x6f;:&#105;&#x6e;&#x66;o&#x40;&#x67;u&#97;&#x72;d&#105;&#x61;&#x6e;p&#x72;&#x6f;j&#101;&#x63;t&#46;&#x69;&#x6e;f&#x6f;" target="_blank">RSVP</a>) <a title="" href="http://maps.google.com/maps?q=841+Broadway%2C+8th+Floor%2C+New+York%2C+NY" target="_blank">Pivotal Labs </a>841 Broadway, 8th Floor, New York, NY (<a href="http://maps.google.com/maps?q=841+Broadway%2C+8th+Floor%2C+New+York%2C+NY" target="_blank">map</a>) </div> </div> </li> </ul> </ul> <div id="event-description-wrap" itemprop="description"> <p> Please join us for lunch and crypto-talk with Hans-Christoph Steiner of the Guardian Project. Hans will talk about the how and why of building secure mobile applications that keep the user's data encrypted and hidden from prying eyes. We'll have a few short presentations on tools like SQLCipher, IOCipher, and NetCipher and how they can be used in modern applications. We'll answer questions about general strategies and specific toolkits that we've created. </p> <p> <em><a href="http://www.eyebeam.org/people/hanschristoph-steiner">Hans-Christoph Steiner</a> spends his time making private communications software usable by everyone, designing interactive software with a focus on human perceptual capabilities, building networks with free software, and composing music with computers.</em> </p> <p style="text-align: center;"> <img alt="" src="https://media.getchute.com/media/B6VnNisdh/w/260" width="260" height="173" /> </p> <p> <img class="aligncenter" alt="260" src="https://media.getchute.com/media/B6Md5cmis/w/260" /> </p> </div> </div> https://guardianproject.info/2013/06/14/a-weather-report-on-security/ Fri, 14 Jun 2013 13:22:28 -0400 https://guardianproject.info/2013/06/14/a-weather-report-on-security/ <p>How’s the weather outside? Sunny with a chance of IP blocking.</p> <p>We recently launched a new initiative we’re calling: <a href="https://guardianproject.info/code/weatherrepo/" title="The Weather Repo">The Weather Repo</a>. The goal of the project is for organizations to have a more accurate method of understanding whether the apps they’re using are “safe”. It’s hard to know whether apps that claim to be secure really are. Have they been vetted by a third party? Are there existing case studies? Has a threat analysis been performed?</p> <p style="text-align: center;"> <a href="http://weatherrepo.com" target="_blank"><img class="aligncenter size-medium wp-image-4240" alt="weatherrepo1" src="https://guardianproject.info/wp-content/uploads/2013/06/weatherrepo1-300x300.png" width="300" height="300" srcset="https://guardianproject.info/wp-content/uploads/2013/06/weatherrepo1-300x300.png 300w, https://guardianproject.info/wp-content/uploads/2013/06/weatherrepo1-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2013/06/weatherrepo1.png 512w" sizes="(max-width: 300px) 100vw, 300px" /></a> </p> <p>We’ve been developing an app store recommendation engine for circumvention tools. One that is backed by better, more open metadata; and interfacing with better, more open repositories. The “better, more open metadata” endeavor is now being pursued by a coalition led by the <a title="open integrity initiative" href="https://openintegrity.org/" target="_blank">Open Integrity Initiative</a>. As founding members of the group supporting this initiative, we’ve been working closely to develop tools based on the research and metadata frameworks that they’re contributing. Metadata will be culled from other sources to supplement this approach and allow for a comprehensive scan of the entire app ecosystem.</p> <p>The success of the project mainly lays in the fact that the crucial groundwork has been laid for our goal of helping organizations make sense of whether the tools they’re using are “safe” or not. We’ve created an API allowing any organization to take our lessons as well as information and apply it. The growing number of efforts in the security and privacy space, as well as our own goal of a publicly facing “app bazaar” are not possible without groundwork such as this and we’re proud to have been able to produce it.</p> <p>Our finished API is now documented at <a href="http://weatherrepo.com/api/">http://weatherrepo.com/api</a> . We put up a blog to post about the project and updates of news and events, available at <a href="http://weatherrepo.com/report">http://blog.weatherrepo.com</a></p> <p>We’re extremely interested in the concept of human unit testing and want to make sure that our apps, and the greater set of tools that are out there helping the world, are both usable and that users have the digital literacy to understand how they’re being protected by them and how not. Now that our API is finished, we’re seeding our database with content according to our original set of research questions. And we’re asking for YOUR help. Please go to <a href="http://weatherrepo.com/report">http://weatherrepo.com/report</a> and add details about the tools that you use and/or make. Let’s populate this database together and make the world a more obviously and honestly secure place!</p> https://guardianproject.info/archive/weatherrepo/ Thu, 13 Jun 2013 13:52:02 -0400 https://guardianproject.info/archive/weatherrepo/ <div title="Page 1"> <div> <div> <div> <h1> The Weather Repo: A New Take On The Old App Store </h1> <div title="Page 1"> <div> <div> <div> <h2> 01 Why It’s Needed </h2> <p> Many groups ask whether the apps they're using are "safe". While it's hard for us to respond without knowing the specific context and doing a threat analysis, there are some short cuts. If the app is sending information in clear text, probably not. Who wants to send their data in the open? Unfortunately, most people don't know that companies like Yahoo broadcast all of their emails in the clear. And for smaller apps and companies, it's hard to know whether they do or not. Even further, it's hard to know whether apps that claim to be secure really are. Have they been vetted by a third party? Are there existing case studies? Has a threat analysis been performed? </p> <div title="Page 1"> <div> <div> <div> <h2> <a href="http://weatherrepo.com" target="_blank"><img class="aligncenter size-medium wp-image-4240" alt="weatherrepo1" src="https://guardianproject.info/wp-content/uploads/2013/06/weatherrepo1-300x300.png" width="300" height="300" srcset="https://guardianproject.info/wp-content/uploads/2013/06/weatherrepo1-300x300.png 300w, https://guardianproject.info/wp-content/uploads/2013/06/weatherrepo1-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2013/06/weatherrepo1.png 512w" sizes="(max-width: 300px) 100vw, 300px" /></a> </h2> <h2> 10 What We’re Building </h2> <p> How do we make good apps more discoverable? And what does a good app entail? For The Guardian Project, it's crucial that an app does what it says it does. In Android, that's a bit easier to see because they ask for certain permissions before a user can install them. This app transparency is a great start, but doesn't go far enough. We’re building a secure and federated app store for people around the world who need to know the real security behind the tools that they use and a system to find a more useful set of apps across every platform. </p> <div title="Page 1"> <div> <div> <div> <h2> Features </h2> <ul> <li> <strong>Integrated:</strong> There are a lot of stores filled with a lot of bad apps. Instead of sorting by platform (iPhone, Android, PC), why not sort by usefulness? </li> <li> <strong>Secure: </strong>Safety and privacy are important to users. We're making a way for apps to be vetted by the pros and transparent to users. </li> <li> <strong>Easy: </strong>If it's not simple, people won't use it. We aim for simplicity without sacrificing depth. </li> </ul> <h1> Visit the site: </h1> <p> Go to <a title="The Weather Repo" href="http://weatherrepo.com" target="_blank">weatherrepo.com</a> to learn more </p> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> https://guardianproject.info/archive/weatherrepo/ Thu, 13 Jun 2013 13:52:02 -0400 https://guardianproject.info/archive/weatherrepo/ <div title="Page 1"> <div> <div> <div> <h1> The Weather Repo: A New Take On The Old App Store </h1> <div title="Page 1"> <div> <div> <div> <h2> 01 Why It’s Needed </h2> <p> Many groups ask whether the apps they're using are "safe". While it's hard for us to respond without knowing the specific context and doing a threat analysis, there are some short cuts. If the app is sending information in clear text, probably not. Who wants to send their data in the open? Unfortunately, most people don't know that companies like Yahoo broadcast all of their emails in the clear. And for smaller apps and companies, it's hard to know whether they do or not. Even further, it's hard to know whether apps that claim to be secure really are. Have they been vetted by a third party? Are there existing case studies? Has a threat analysis been performed? </p> <div title="Page 1"> <div> <div> <div> <h2> <a href="http://weatherrepo.com" target="_blank"><img class="aligncenter size-medium wp-image-4240" alt="weatherrepo1" src="https://guardianproject.info/wp-content/uploads/2013/06/weatherrepo1-300x300.png" width="300" height="300" srcset="https://guardianproject.info/wp-content/uploads/2013/06/weatherrepo1-300x300.png 300w, https://guardianproject.info/wp-content/uploads/2013/06/weatherrepo1-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2013/06/weatherrepo1.png 512w" sizes="(max-width: 300px) 100vw, 300px" /></a> </h2> <h2> 10 What We’re Building </h2> <p> How do we make good apps more discoverable? And what does a good app entail? For The Guardian Project, it's crucial that an app does what it says it does. In Android, that's a bit easier to see because they ask for certain permissions before a user can install them. This app transparency is a great start, but doesn't go far enough. We’re building a secure and federated app store for people around the world who need to know the real security behind the tools that they use and a system to find a more useful set of apps across every platform. </p> <div title="Page 1"> <div> <div> <div> <h2> Features </h2> <ul> <li> <strong>Integrated:</strong> There are a lot of stores filled with a lot of bad apps. Instead of sorting by platform (iPhone, Android, PC), why not sort by usefulness? </li> <li> <strong>Secure: </strong>Safety and privacy are important to users. We're making a way for apps to be vetted by the pros and transparent to users. </li> <li> <strong>Easy: </strong>If it's not simple, people won't use it. We aim for simplicity without sacrificing depth. </li> </ul> <h1> Visit the site: </h1> <p> Go to <a title="The Weather Repo" href="http://weatherrepo.com" target="_blank">weatherrepo.com</a> to learn more </p> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> https://guardianproject.info/2013/06/12/carrier-grade-verizon-and-the-nsa/ Wed, 12 Jun 2013 06:38:46 -0400 https://guardianproject.info/2013/06/12/carrier-grade-verizon-and-the-nsa/ <p><a href="https://guardianproject.info/wp-content/uploads/2013/06/PHONE_BOLT.png"><img class="size-medium wp-image-4188 alignleft" alt="PHONE_BOLT" src="https://guardianproject.info/wp-content/uploads/2013/06/PHONE_BOLT-268x300.png" width="268" height="300" srcset="https://guardianproject.info/wp-content/uploads/2013/06/PHONE_BOLT-268x300.png 268w, https://guardianproject.info/wp-content/uploads/2013/06/PHONE_BOLT.png 514w" sizes="(max-width: 268px) 100vw, 268px" /></a></p> <p>Last week Glenn Greenwald at The Guardian broke the news that <a href="http://www.guardian.co.uk/world/2013/jun/06/nsa-phone-records-verizon-court-order">Verizon has been providing the NSA with metadata</a> about all of the calls over a subsidiary’s network. This subsidiary is called <a href="http://investing.businessweek.com/research/stocks/private/snapshot.asp?privcapId=4259068">Verizon Business Network Services</a>. It is a privately held company that “owns, operates, monitors, and maintains data and Internet networks in North America, Europe, Asia, Latin America, Australia, Japan, and Africa. The company provides converged communication solutions, such as local and long-distance voice, messaging, and Internet access services.” It is likely this company owns equipment that holds caller detail records for millions of customers. The order used <a href="http://www.aclu.org/free-speech-national-security-technology-and-liberty/reform-patriot-act-section-215">section 215 of The Patriot Act</a>, which allows the FBI to order any person or entity to turn over “any tangible things,” so long as the FBI “specif[ies]” that the order is “for an authorized investigation &hellip; to protect against international terrorism or clandestine intelligence activities.” The “tangible things” could have been the physical servers or hard disks that store the logged details.</p> <p><a href="https://guardianproject.info/">The Guardian Project</a> operates a voice service called <a href="https://ostel.co/">ostel.co</a>. This service offers secure calling and only logs metadata required for the service to operate, <a href="https://ostel.co/privacy">no more, no less</a>. We’ve redefined what carrier grade means. Our service offers the same reliability and quality as global carriers. It goes further by including security and privacy as core features. This is something Verizon does not offer you. Ostel.co runs a full stack composed of open source software, which gives you the choice to install and operate your own service.</p> <p>Metadata is information about information. Every call you make over a carrier’s network can carry metadata about your account ID, your caller ID, the duration of the call, the time it was placed and the caller ID of the person you called, even the location of your cellular radio. Information about your calls can be as important as the calls themselves. In many cases they are more important than the content of the calls since they don’t fall under laws requiring a warrant to intercept. Indexing and searching all customers metadata is much faster than tapping and listening in on the same customer’s calls.</p> <p>Jane Mayer at The New Yorker gives a good example of <a href="http://www.newyorker.com/online/blogs/newsdesk/2013/06/verizon-nsa-metadata-surveillance-problem.html?mbid=gnep">what a service provider can learn from your metadata</a>. “Personal phone calls can also reveal sensitive medical information: “You can see a call to a gynecologist, and then a call to an oncologist, and then a call to close family members.”” Metadata from one source can also be <a href="http://www.technologyreview.com/view/515811/correlation-is-main-concern-over-data-verizon-gives-nsa/">correlated with metadata from other sources</a>, like web searches and credit card purchases. Tom Simonite at the MIT Technology Review writes that Facebook “uses obfuscated versions of its members’ phone numbers and e-mail addresses to connect its data with information that data-broker Datalogix gathers from loyalty card schemes, with the result that it is now possible for companies to connect a person’s activity on Facebook, and the ads they see, with what they buy in physical stores.”</p> <p>Carriers operate servers that record metadata through a common software practice called logging. Each request your computer software makes to an online service can optionally log all the metadata the application can get its hands on. It is the carrier’s responsibility to define their logging policy, like what is recorded and how long it is retained. This information rarely leaves the privacy of the carrier’s internal operational documents so don’t expect to get many clear answers from them.</p> <p>While the NSA debacle proves that global telecommunications carriers log everything and keep it around for a very long time, what if you don’t want this information about your behavior logged? Unfortunately, no carrier offers any kind of “opt out” process at this low of a level. To be fair, this information has many purposes. Caller detail records are required to bill customers on per-minute calling plans. It’s unreasonable to expect a carrier to flat out disable logging, though carriers never state that they share your logs with law enforcement without probable cause of a crime. But that is exactly what Verizon did.</p> <p>In addition to <a href="https://ostel.co">ostel.co</a>, there are two other independent carriers that put your privacy first. <a href="https://www.whispersystems.org/">Whisper Systems operates a proprietary secure voice service</a> with an open source client called RedPhone. It integrates nicely with Android mobile devices, though it requires a SIM card with a phone number in select countries to sign up for an account. With a little luck in the wrong hands a phone number could disclose more information about you than your social security number. WhisperSys doesn’t publish their logging policy online.</p> <p><a href="https://silentcircle.com/">Silent Circle offers secure voice service</a> for iPhone and Android. They are a subscription service and all client and server software is proprietary. They publish <a href="https://silentcircle.com/web/privacy/">an exceptionally detailed logging policy on their website</a>, which includes how many law enforcement requests for information they have received twice a year.</p> <p>Ostel.co does not log personal call details to disk, and we can’t disclose information we don’t have. IP addresses, user IDs and referrers are common points of metadata that are used to find patterns about user behavior. When the ostel.co server software requires this information to be stored, it is stored only in memory. When the system is rebooted or shut down, the information is gone forever.</p> <p>Our service is under active development. It is currently in public beta status and new features like custom aliases, third party authentication services and federated calling are on the roadmap. The beta service will always be free.</p> <p>For the curious, what follows is a detailed description of the logging implementation of ostel.co.</p> <p>Caller Details Records are recorded with no identifying information. Attributes stored to disk include timestamp, duration, call state and bandwidth consumed. These pieces of metadata allow us to report on usage without identifying each user. When a monthly report is generated, the metadata is deleted.</p> <p>The SIP server logs IP addresses of online users. This is a requirement for the SIP protocol to locate each end of the call. The contact information is logged to RAM, including the username, source IP address and source port of the registered client application. When the server is shut down or restarted, this information is erased.</p> <p>The SIP server only logs debugging information to disk, which does not include any of the SIP information.</p> <p>Audio data is passed through the server to work around limitations in two-way audio connectivity for common home networks. After a ZRTP key agreement, this audio is encrypted. The server cannot decrypt a call between two users, nor does the server control any of the parameters of the call. This makes calls over ostel.co function in a peer-to-peer mode similar to Skype’s “supernode” feature but without any backdoors.</p> <p>No IP addresses are logged for any web requests. This is a simple configuration change for the reverse proxy and required a patch to the core source code of the application server framework.</p> <p>The server stores each user’s email address, SIP username, encrypted password and account management data like when the user profile was created/updated and password reset information if the user chooses to use that feature.</p> https://guardianproject.info/2013/05/16/the-only-way-to-visit-strongbox-on-a-phone/ Thu, 16 May 2013 17:43:06 -0400 https://guardianproject.info/2013/05/16/the-only-way-to-visit-strongbox-on-a-phone/ <p dir="ltr"> <em>The New Yorker</em> magazine just launched <a href="http://www.newyorker.com/online/blogs/closeread/2013/05/introducing-strongbox-anonymous-document-sharing-tool.html">Strongbox</a>, a whistleblower submission system that’s hosted on a hidden website. There’s only one way to access the hidden site on a phone or tablet, and that’s with our <a href="https://play.google.com/store/apps/details?id=info.guardianproject.browser&hl=en">Orweb app</a>. Here’s a simple breakdown of how to do securely and anonymously blow the whistle, explained in an interactive tutorial: </p> <p style="text-align: center;"> <a href="https://guardianproject.info/howto/strongbox" target="_blank"><img class="size-medium wp-image-3719 aligncenter" alt="galaxy19" src="https://guardianproject.info/wp-content/uploads/2013/05/galaxy19-199x300.png" width="199" height="300" srcset="https://guardianproject.info/wp-content/uploads/2013/05/galaxy19-199x300.png 199w, https://guardianproject.info/wp-content/uploads/2013/05/galaxy19.png 400w" sizes="(max-width: 199px) 100vw, 199px" /></a> </p> <p dir="ltr" style="text-align: center;"> <em>Visit <a title="strongbox tutorial" href="https://guardianproject.info/howto/strongbox" target="_blank">guardianproject.info/howto/strongbox</a> for an interactive tutorial on using Strongbox on your phone.</em> </p> <p dir="ltr"> The website exists as a hidden site on what is widely known as the darknet, since you are going there hidden or “in the dark.” Instead of a .com, .org, or .info address (like <a href="https://guardianproject.info/" target="_blank">guardianproject.info</a>) the sites like Strongbox show up with a .onion. And like you need a web browser to go to a .com web address, you need a darknet browser to go to a .onion darknet address. On a mobile, we make the most secure and anonymous darknet & web browser, Orweb. And if you want to get to strongbox on your phone, we’re the only way to do it. </p> <p dir="ltr"> To browse, you’ll need our <a title="orweb" href="https://guardianproject.info/apps/orweb" target="_blank">Orweb</a> app. It’s currently only available for Android and you can <a title="Orweb anonymous browser" href="https://play.google.com/store/apps/details?id=info.guardianproject.browser " target="_blank">get it here</a>. If you have another type of phone or tablet, unfortunately you’ll have to use a computer. </p> <p dir="ltr"> For Orweb to be anonymous and give you access to the darknet .onion addresses, you’ll need to enable onion routing with our <a title="orbot" href="https://guardianproject.info/apps/orbot" target="_blank">Orbot</a> plugin. This plugin gives Orweb and other compatible apps (like our <a href="https://play.google.com/store/apps/details?id=info.guardianproject.otr.app.im">Gibberbot secure chat</a>  for Facebook, Google, & Jabber) the ability to send web traffic through the darknet, thus avoiding tracking as well as blocking. You can <a title="Orbot on Android" href="https://play.google.com/store/apps/details?id=org.torproject.android " target="_blank">download Orbot here</a>. It’s the official app of the <a href="https://TorProject.org">Tor Project</a>, which develops the onion routing protocol, on Android. </p> <p dir="ltr"> Once both are installed, you just need to go to this hidden site: <a title="Strongbox Onion Site" href="http://tnysbtbxsf356hiy.onion/" target="_blank">http://tnysbtbxsf356hiy.onion</a> . Make sure that you’re using the Orweb browser and that Orbot is running. From there, you can easily submit messages to The New Yorker. Unfortunately you can’t yet submit files to them through the phone just yet. </p> <p dir="ltr"> Overall, this is an exciting step in the right direction. With an increase in tracking and crackdown on political dissidents and whistleblowers around the world, there need to be safe and trusted ways of sharing information that has the potential of saving lives and making the world a better place. <a title="the new yorker magazine" href="http://www.newyorker.com/" target="_blank">The New Yorker</a> is one of the most trusted journalistic outfits in the world and it will be interesting to follow how they understand and vet information that comes in from anonymous sources. It will be a lesson for the entire privacy community. </p> <p dir="ltr" style="text-align: center;"> <a href="http://instagram.com/p/PihUXCmJzW/" target="_blank"><img class="size-medium wp-image-3730 aligncenter" title="On the Internet, algorithms can infer you're a dog." alt="Dog Algorithm" src="https://guardianproject.info/wp-content/uploads/2013/05/Dog-Algorithm-300x300.jpg" width="300" height="300" srcset="https://guardianproject.info/wp-content/uploads/2013/05/Dog-Algorithm-300x300.jpg 300w, https://guardianproject.info/wp-content/uploads/2013/05/Dog-Algorithm-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2013/05/Dog-Algorithm.jpg 612w" sizes="(max-width: 300px) 100vw, 300px" /></a> </p> <p dir="ltr"> At the same time, it’s not yet a trusted technology. While the code is accessible and <a href="http://deaddrop.github.io/">open source</a> it is unclear whether it’s a full version of the DeadDrop code that it came from or a fork of it. It also hasn’t been audited yet. Already, we’re seeing issues popping up on <a href="https://github.com/deaddrop/deaddrop/issues">the code</a>. Hopefully it will be fully vetted as a solution and stand up to the ambitious and crucial claims that it is able “to provide you with a greater degree of anonymity and security than afforded by conventional e-mail.” </p> <p dir="ltr"> In the months before January, I worked a few seats down from Aaron Swartz in the ThoughtWorks offices. Since those shocking days, it’s been inspiring to continue to see his legacy. I spoke with him a bunch of times about using technology to introduce truly disruptive techniques for empowering people whose rights were otherwise being trampled. At the time, we were working on <a href="http://markbelinsky.com/crowdring/">Crowdring</a>, an intiative from <a href="http://www.therules.org/">/The Rules</a>. And we spoke about the power of leveraging telephony to give voice so widely, and the trade off of handing over personally identifiable information. He recognized the need for constantly evolving and shifting tactics and was expert at integrating that into both strategy and code. It’s an honor to continue to work with him now, and with the rest of the open source community as we all contribute code and ideas to make the world better. </p> <p dir="ltr"> Having just won the Knight News Challenge for our <a href="https://guardianproject.info/2013/01/27/informacam-wins-knight-news-challenge/">Informacam project</a>, we’re excited at the growing interest from the world of journalism in making sure that sources are kept truly secure and anonymous in the digital age. We’re working to build our whole <a href="https://play.google.com/store/apps/dev?id=6502754515281796553">suite of tools</a> to make it easier and better to do so. If you want to reach out to us, anonymously or otherwise, to <a title="Guardian Contact" href="https://guardianproject.info/contact/ ">let us know how we can help</a>, you can use Orbot and Tor to do so over any of these methods. We look forward to it! </p> https://guardianproject.info/2013/05/09/gnupg-for-android-progress-we-have-an-command-line-app/ Thu, 09 May 2013 10:48:52 -0400 https://guardianproject.info/2013/05/09/gnupg-for-android-progress-we-have-an-command-line-app/ <p><a href="https://guardianproject.info/wp-content/uploads/2013/05/icon.png"><img src="https://guardianproject.info/wp-content/uploads/2013/05/icon-150x150.png" alt="GnuPG for Android" width="150" height="150" class="alignleft size-thumbnail wp-image-3680" srcset="https://guardianproject.info/wp-content/uploads/2013/05/icon-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2013/05/icon-300x300.png 300w, https://guardianproject.info/wp-content/uploads/2013/05/icon.png 512w" sizes="(max-width: 150px) 100vw, 150px" /></a><br /> This alpha release of our command-line developer tool brings GnuPG to Android for the first time!</p> <p>GNU Privacy Guard Command-Line (gpgcli) gives you command line access to the entire <a href="http://gnupg.org" title="Gnu Privacy Guard home page" target="_blank">GnuPG</a> suite of encryption software. GPG is GNU’s tool for end-to-end secure communication and encrypted data storage. This trusted protocol is the free software alternative to PGP. GnuPG 2.1 is the new modularized version of GnuPG that now supports OpenPGP and S/MIME.</p> <p>You can get it from the Play Store:<br /> <a href="https://play.google.com/store/apps/details?id=info.guardianproject.gpg" target="_blank"><a href="https://play.google.com/store/apps/details?id=info.guardianproject.gpg">https://play.google.com/store/apps/details?id=info.guardianproject.gpg</a></a></p> <p>Or download the <code>.apk</code> from our nightly builds:<br /> <a href="https://guardianproject.info/builds/GnuPrivacyGuard/" target="_blank"><a href="https://guardianproject.info/builds/GnuPrivacyGuard/">https://guardianproject.info/builds/GnuPrivacyGuard/</a></a></p> <h2 id="setup">Setup</h2> <p>Before using gpgcli, be sure to launch the app and let it finish its installation process. Once it has completed, then you’re ready to use it. The easiest way to get started with gpgcli is to install <a href="https://play.google.com/store/apps/details?id=jackpal.androidterm" title="download Android Terminal emulator from the Google Play Store" target="_blank">Android Terminal Emulator</a>. gpgcli will automatically configure Android Terminal Emulator as long as you have the _Allow PATH extensions&lt;/em settings enabled.</p> <h2 id="features">Features</h2> <ul> <li>TRUSTED SECURITY: This technology already seamlessly integrates into Linux on Debian, Ubuntu, Fedora, Mac OSX (GPGtools), Windows (gpg4win)</li> <li>PUBLIC KEY ENCRYPTION: Full interoperable replacement of the proprietary Pretty Good Privacy (PGP) standard that uses a serial combination of hashing, data compression, symmetric-key cryptography and finally public-key cryptography; each step uses one of several supported algorithms.</li> <li>BROAD ALGORITHM LANDSCAPE: Supports 3DES, AES, Blowfish, CAST5, DSA, ElGamal, MD5, RSA, RIPDE-MD-160, SHA-1, TIGER, and Twofish.</li> <li>VERIFIABLE INTEGRITY AND AUTHENTICITY: Digital signatures create a trusted trail of ownership.</li> <li>CONFIRMED SECURITY: Italian Police, the FBI, and British police have been unable to crack its security and have resorted to demanding private keys. It’s been likened as “the closest you’re likely to get to military-grade encryption” by cryptographer Bruce Schneier.</li> <li>HELP SYSTEM: A quick help tool is built in.</li> <li>KEYSERVER SUPPORT: Integrated support for HKP and LDAP keyservers (keys.gnupg.net).</li> <li><p>OPEN STANDARD COMPLIANT: Full OpenPGP implementation. Learn more about standards <a href="http://tools.ietf.org/html/rfc2440" target="_blank">RFC2440</a> &amp; <a href="http://tools.ietf.org/html/rfc4880" target="_blank">RFC4880</a> </ul></p> <h2 id="please-report-bugs">Please Report Bugs</h2> <p>This is an early release of a big project, so there will inevitable be bugs. Help us improve this software by filing bug reports about any problem that you encounter. Feature requests are also welcome!</p> <p><a href="https://dev.guardianproject.info/projects/gpgandroid/issues" target="_blank"><a href="https://dev.guardianproject.info/projects/gpgandroid/issues">https://dev.guardianproject.info/projects/gpgandroid/issues</a></a></p> <h2 id="coming-soon">Coming Soon</h2> <ul> <li>SECURITY FOR APPS: We have an API in the works so that developers can<br /> easily embed this into any app to give it state of the art security features.</li> <li>GUI: We’re building a graphical user interface for easy key management.</li> <li>STAY UP TO DATE: Sign up for our low-traffic <a href="https://lists.mayfirst.org/mailman/listinfo/guardian-dev" title="subscribe to the guardian-dev mailing list" target="_blank">Guardian-Dev</a> mailing list to<br /> be notified when the API and GUI are released:<br /> <a href="https://lists.mayfirst.org/mailman/listinfo/guardian-dev" target="_blank"><a href="https://lists.mayfirst.org/mailman/listinfo/guardian-dev">https://lists.mayfirst.org/mailman/listinfo/guardian-dev</a></a></li> <li><p>Find us in IRC, we want feedback!</p> <ul> <li><a href="irc://irc.freenode.net/guardianproject">#guardianproject on freenode</a></li> <li><a href="irc://irc.oftc.net/guardianproject">#guardianproject on oftc</a> <br /></li> </ul> <p>.</li> </ul></p></li> </ul></li> </ul> https://guardianproject.info/code/netcipher/ Mon, 29 Apr 2013 11:00:55 -0400 https://guardianproject.info/code/netcipher/ <div class="source-code" style="text-align: center;"> <a href="https://gitlab.com/guardianproject/NetCipher" target="_blank" title="NetCipher on Gitlab"> <i class="fa fa-gitlab"></i> GitLab </a> - <a href="https://github.com/guardianproject/NetCipher" target="_blank" title="NetCipher on Github"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.github.io/NetCipher" target="_blank" title="NetCipher javadoc"> Javadoc </a> - <a href="https://guardianproject.info/tags/netcipher" target="_blank" title="NetCipher blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /> <p><strong>Better TLS and Tor App Integration</strong></p> <p>NetCipher is a library for Android that provides multiple means to improve network security in mobile applications. It provides best practices TLS settings using the standard Android <tt>HttpURLConnection</tt> methods, <a href="https://developer.android.com/reference/java/net/HttpURLConnection.html" target="_blank"><code>HttpURLConnection</code></a>, OkHTTP3, Volley, and <a href="https://hc.apache.org/httpcomponents-client-4.3.x/index.html" target="_blank">Apache HTTP Client</a>, provides simple Tor integration, makes it easy to configure proxies for HTTP connections and <code>WebView</code> instances.</p> <p>More specifically this library provides:</p> <ul> <li>Hardening of TLS protocol support and cipher suites, especially on older<br /> versions of Android</li> <li>Proxied Connection Support: HTTP and SOCKS proxy connection support for HTTP<br /> and HTTPS traffic through specific configuration</li> <li>OrbotHelper: a utility class to support application integration with Orbot<br /> (Tor for Android). Check if its installed, automatically start it, etc.</li> <li>Optional, custom certificate store based on the open Debian root CA trust<br /> store, which is built with Mozilla&rsquo;s CA collection.</li> </ul> <p>IT MUST BE NOTED, that you can use this library without using Orbot/Tor, but obviously we think using strong TLS/SSL connections over Tor is just about the best thing in the world.</p> <p><a title="onionkit" href="https://github.com/guardianproject/NetCipher" target="_blank"><a href="https://github.com/guardianproject/NetCipher">https://github.com/guardianproject/NetCipher</a></a></p> <p><em>This library was formerly named OnionKit</em></p> <h2 id="getting-started">Getting Started</h2> <p>For examples and more info on using NetCipher, see the <a href="https://github.com/guardianproject/NetCipher#readme" target="_blank">README</a> and included sample projects. Many apps include NetCipher, so they can also serve as examples of NetCipher in action:</p> <h3 id="sample-projects">Sample Projects</h3> <ul> <li><a href="https://github.com/guardianproject/NetCipher/tree/master/sample-hurl">Android HttpURLConnection</a></li> <li><a href="https://github.com/guardianproject/NetCipher/tree/master/sample-httpclient">Apache HTTP Client</a></li> <li><a href="https://github.com/guardianproject/NetCipher/tree/master/sample-chboye">chboye</a></li> <li><a href="https://github.com/guardianproject/NetCipher/tree/master/sample-okhttp3">OkHTTP3</a></li> <li><a href="https://github.com/guardianproject/NetCipher/tree/master/sample-volley">Volley</a></li> <li><a href="https://github.com/guardianproject/NetCipher/tree/master/sample-webkit">WebKit</a></li> <li><a href="https://github.com/guardianproject/NetCipher/tree/master/sample-webviewclient">WebViewClient</a></li> </ul> <h3 id="apps">Apps</h3> <ul> <li><a href="https://gitlab.com/fdroid/fdroidclient/commit/2c88703588a6192cbf3ffd7ccb8d01b65c693ed3" target="_blank">F-Droid</a></li> </ul> <h2 id="downloads">Downloads</h2> <div class="gradle-line"> <p> The binary jar, source jar, and javadoc jar are all available on jcenter. To include them using gradle, add this line to your <i>build.gradle</i>: </p> <pre style="text-align: center;">implementation &#39;info.guardianproject.netcipher:netcipher:2.2.0-alpha&#39;</pre> <p>Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:</p> <ul> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/netcipher/2.2.0-alpha/netcipher-2.2.0-alpha.jar">netcipher-2.2.0-alpha.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/netcipher/2.2.0-alpha/netcipher-2.2.0-alpha.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/netcipher/2.2.0-alpha/netcipher-2.2.0-alpha-sources.jar">netcipher-2.2.0-alpha-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/netcipher/2.2.0-alpha/netcipher-2.2.0-alpha-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/netcipher/2.2.0-alpha/netcipher-2.2.0-alpha-javadoc.jar">netcipher-2.2.0-alpha-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/netcipher/2.2.0-alpha/netcipher-2.2.0-alpha-javadoc.jar.asc"><i>PGP signature</i></a>)</li> </ul> </div> <div class="gradle-line"> <p>For working with popular HTTP libraries or <tt>android.webkit</tt>, use the specific NetCipher library that matches:</p> <pre> implementation &#39;info.guardianproject.netcipher:netcipher-webkit:2.2.0-alpha implementation &#39;info.guardianproject.netcipher:netcipher-okhttp3:2.2.0-alpha implementation &#39;info.guardianproject.netcipher:netcipher-httpclient:2.2.0-alpha implementation &#39;info.guardianproject.netcipher:netcipher-volley:2.2.0-alpha implementation &#39;info.guardianproject.netcipher:netcipher-chboye:2.2.0-alpha </pre> <p>These files can also be downloaded directly from jcenter, including the PGP signatures:</p> <ul> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-webkit-2.2.0-alpha.jar">netcipher-webkit-2.2.0-alpha.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-webkit-2.2.0-alpha.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-webkit-2.2.0-alpha-sources.jar">netcipher-webkit-2.2.0-alpha-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-webkit-2.2.0-alpha-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-webkit-2.2.0-alpha-javadoc.jar">netcipher-webkit-2.2.0-alpha-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-webkit-2.2.0-alpha-javadoc.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-okhttp3-2.2.0-alpha.jar">netcipher-okhttp3-2.2.0-alpha.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-okhttp3-2.2.0-alpha.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-okhttp3-2.2.0-alpha-sources.jar">netcipher-okhttp3-2.2.0-alpha-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-okhttp3-2.2.0-alpha-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-okhttp3-2.2.0-alpha-javadoc.jar">netcipher-okhttp3-2.2.0-alpha-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-okhttp3-2.2.0-alpha-javadoc.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-httpclient-2.2.0-alpha.jar">netcipher-httpclient-2.2.0-alpha.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-httpclient-2.2.0-alpha.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-httpclient-2.2.0-alpha-sources.jar">netcipher-httpclient-2.2.0-alpha-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-httpclient-2.2.0-alpha-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-httpclient-2.2.0-alpha-javadoc.jar">netcipher-httpclient-2.2.0-alpha-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-httpclient-2.2.0-alpha-javadoc.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-volley-2.2.0-alpha.jar">netcipher-volley-2.2.0-alpha.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-volley-2.2.0-alpha.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-volley-2.2.0-alpha-sources.jar">netcipher-volley-2.2.0-alpha-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-volley-2.2.0-alpha-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-volley-2.2.0-alpha-javadoc.jar">netcipher-volley-2.2.0-alpha-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-volley-2.2.0-alpha-javadoc.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-chboye-2.2.0-alpha.jar">netcipher-chboye-2.2.0-alpha.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-chboye-2.2.0-alpha.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-chboye-2.2.0-alpha-sources.jar">netcipher-chboye-2.2.0-alpha-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-chboye-2.2.0-alpha-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-chboye-2.2.0-alpha-javadoc.jar">netcipher-chboye-2.2.0-alpha-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-chboye-2.2.0-alpha-javadoc.jar.asc"><i>PGP signature</i></a>)</li> </ul> </div> https://guardianproject.info/code/netcipher/ Mon, 29 Apr 2013 11:00:55 -0400 https://guardianproject.info/code/netcipher/ <div class="source-code" style="text-align: center;"> <a href="https://gitlab.com/guardianproject/NetCipher" target="_blank" title="NetCipher on Gitlab"> <i class="fa fa-gitlab"></i> GitLab </a> - <a href="https://github.com/guardianproject/NetCipher" target="_blank" title="NetCipher on Github"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.github.io/NetCipher" target="_blank" title="NetCipher javadoc"> Javadoc </a> - <a href="https://guardianproject.info/tags/netcipher" target="_blank" title="NetCipher blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /> <p><strong>Better TLS and Tor App Integration</strong></p> <p>NetCipher is a library for Android that provides multiple means to improve network security in mobile applications. It provides best practices TLS settings using the standard Android <tt>HttpURLConnection</tt> methods, <a href="https://developer.android.com/reference/java/net/HttpURLConnection.html" target="_blank"><code>HttpURLConnection</code></a>, OkHTTP3, Volley, and <a href="https://hc.apache.org/httpcomponents-client-4.3.x/index.html" target="_blank">Apache HTTP Client</a>, provides simple Tor integration, makes it easy to configure proxies for HTTP connections and <code>WebView</code> instances.</p> <p>More specifically this library provides:</p> <ul> <li>Hardening of TLS protocol support and cipher suites, especially on older<br /> versions of Android</li> <li>Proxied Connection Support: HTTP and SOCKS proxy connection support for HTTP<br /> and HTTPS traffic through specific configuration</li> <li>OrbotHelper: a utility class to support application integration with Orbot<br /> (Tor for Android). Check if its installed, automatically start it, etc.</li> <li>Optional, custom certificate store based on the open Debian root CA trust<br /> store, which is built with Mozilla&rsquo;s CA collection.</li> </ul> <p>IT MUST BE NOTED, that you can use this library without using Orbot/Tor, but obviously we think using strong TLS/SSL connections over Tor is just about the best thing in the world.</p> <p><a title="onionkit" href="https://github.com/guardianproject/NetCipher" target="_blank"><a href="https://github.com/guardianproject/NetCipher">https://github.com/guardianproject/NetCipher</a></a></p> <p><em>This library was formerly named OnionKit</em></p> <h2 id="getting-started">Getting Started</h2> <p>For examples and more info on using NetCipher, see the <a href="https://github.com/guardianproject/NetCipher#readme" target="_blank">README</a> and included sample projects. Many apps include NetCipher, so they can also serve as examples of NetCipher in action:</p> <h3 id="sample-projects">Sample Projects</h3> <ul> <li><a href="https://github.com/guardianproject/NetCipher/tree/master/sample-hurl">Android HttpURLConnection</a></li> <li><a href="https://github.com/guardianproject/NetCipher/tree/master/sample-httpclient">Apache HTTP Client</a></li> <li><a href="https://github.com/guardianproject/NetCipher/tree/master/sample-chboye">chboye</a></li> <li><a href="https://github.com/guardianproject/NetCipher/tree/master/sample-okhttp3">OkHTTP3</a></li> <li><a href="https://github.com/guardianproject/NetCipher/tree/master/sample-volley">Volley</a></li> <li><a href="https://github.com/guardianproject/NetCipher/tree/master/sample-webkit">WebKit</a></li> <li><a href="https://github.com/guardianproject/NetCipher/tree/master/sample-webviewclient">WebViewClient</a></li> </ul> <h3 id="apps">Apps</h3> <ul> <li><a href="https://gitlab.com/fdroid/fdroidclient/commit/2c88703588a6192cbf3ffd7ccb8d01b65c693ed3" target="_blank">F-Droid</a></li> </ul> <h2 id="downloads">Downloads</h2> <div class="gradle-line"> <p> The binary jar, source jar, and javadoc jar are all available on jcenter. To include them using gradle, add this line to your <i>build.gradle</i>: </p> <pre style="text-align: center;">implementation &#39;info.guardianproject.netcipher:netcipher:2.2.0-alpha&#39;</pre> <p>Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:</p> <ul> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/netcipher/2.2.0-alpha/netcipher-2.2.0-alpha.jar">netcipher-2.2.0-alpha.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/netcipher/2.2.0-alpha/netcipher-2.2.0-alpha.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/netcipher/2.2.0-alpha/netcipher-2.2.0-alpha-sources.jar">netcipher-2.2.0-alpha-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/netcipher/2.2.0-alpha/netcipher-2.2.0-alpha-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/netcipher/2.2.0-alpha/netcipher-2.2.0-alpha-javadoc.jar">netcipher-2.2.0-alpha-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/netcipher/2.2.0-alpha/netcipher-2.2.0-alpha-javadoc.jar.asc"><i>PGP signature</i></a>)</li> </ul> </div> <div class="gradle-line"> <p>For working with popular HTTP libraries or <tt>android.webkit</tt>, use the specific NetCipher library that matches:</p> <pre> implementation &#39;info.guardianproject.netcipher:netcipher-webkit:2.2.0-alpha implementation &#39;info.guardianproject.netcipher:netcipher-okhttp3:2.2.0-alpha implementation &#39;info.guardianproject.netcipher:netcipher-httpclient:2.2.0-alpha implementation &#39;info.guardianproject.netcipher:netcipher-volley:2.2.0-alpha implementation &#39;info.guardianproject.netcipher:netcipher-chboye:2.2.0-alpha </pre> <p>These files can also be downloaded directly from jcenter, including the PGP signatures:</p> <ul> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-webkit-2.2.0-alpha.jar">netcipher-webkit-2.2.0-alpha.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-webkit-2.2.0-alpha.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-webkit-2.2.0-alpha-sources.jar">netcipher-webkit-2.2.0-alpha-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-webkit-2.2.0-alpha-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-webkit-2.2.0-alpha-javadoc.jar">netcipher-webkit-2.2.0-alpha-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-webkit-2.2.0-alpha-javadoc.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-okhttp3-2.2.0-alpha.jar">netcipher-okhttp3-2.2.0-alpha.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-okhttp3-2.2.0-alpha.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-okhttp3-2.2.0-alpha-sources.jar">netcipher-okhttp3-2.2.0-alpha-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-okhttp3-2.2.0-alpha-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-okhttp3-2.2.0-alpha-javadoc.jar">netcipher-okhttp3-2.2.0-alpha-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-okhttp3-2.2.0-alpha-javadoc.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-httpclient-2.2.0-alpha.jar">netcipher-httpclient-2.2.0-alpha.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-httpclient-2.2.0-alpha.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-httpclient-2.2.0-alpha-sources.jar">netcipher-httpclient-2.2.0-alpha-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-httpclient-2.2.0-alpha-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-httpclient-2.2.0-alpha-javadoc.jar">netcipher-httpclient-2.2.0-alpha-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-httpclient-2.2.0-alpha-javadoc.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-volley-2.2.0-alpha.jar">netcipher-volley-2.2.0-alpha.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-volley-2.2.0-alpha.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-volley-2.2.0-alpha-sources.jar">netcipher-volley-2.2.0-alpha-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-volley-2.2.0-alpha-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-volley-2.2.0-alpha-javadoc.jar">netcipher-volley-2.2.0-alpha-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-volley-2.2.0-alpha-javadoc.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-chboye-2.2.0-alpha.jar">netcipher-chboye-2.2.0-alpha.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-chboye-2.2.0-alpha.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-chboye-2.2.0-alpha-sources.jar">netcipher-chboye-2.2.0-alpha-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-chboye-2.2.0-alpha-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-chboye-2.2.0-alpha-javadoc.jar">netcipher-chboye-2.2.0-alpha-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/netcipher/2.2.0-alpha/netcipher-chboye-2.2.0-alpha-javadoc.jar.asc"><i>PGP signature</i></a>)</li> </ul> </div> https://guardianproject.info/2013/04/26/security-awareness-party/ Fri, 26 Apr 2013 09:05:36 -0400 https://guardianproject.info/2013/04/26/security-awareness-party/ <p>In the security world, there’s a pesky belief that a tool can either be secure or easy to use, but not both. Some experts also argue that training people to be safe online is too hard and doesn’t accomplish much (see Bruce Schneier’s recent post <a href="http://www.schneier.com/blog/archives/2013/03/security_awaren_1.html" target="_blank"><em>Security Awareness Training</em></a>). Without a thoughtful approach, that’s usually how it plays out. But it doesn’t have to be that way! We’re committed to making online security fun to learn and fun to use, and we’re launching a new series of interactive tutorials to make it happen. Consider this post an invitation to our festive Security Awareness Party. <a href="https://guardianproject.info/home/how-you-can-work-with-us/" target="_blank">Beer is encouraged</a>, especially if it comes from <a title="Android-powered beer kegerator" href="https://kegbot.org/" target="_blank">an Android-powered kegbot</a>.</p> <p>Here at Guardian, security is always our #1 priority. We owe that to our users who rely on us to keep them safe in places like Syria or Iran. But the time we spend on encryption is wasted if users don’t like using our tools, or can’t figure out how they work. We want to make security apps that are enjoyable and easy to use everyday, and don’t take a PHD to understand.</p> <p>Activists in Iran and Syria know firsthand how important technologies like Tor and VPNs are for staying safe online. Our friends and neighbors might not be living under a repressive dictatorship, but that doesn’t mean they couldn’t use a little digital security in their lives. Maybe your nephew wants to get past the block on Facebook at school, or your co-worker wants to watch March Madness at work (make sure she gets that decoy spreadsheet ready). Maybe your friend just wants to send his wife a few…private messages, and he’d rather not have them stored by Google or Verizon. These people might not be pros, but they’re curious and happy to poke around their technology. With a little fun and interactive guidance, they can be well on their way to becoming a power user. Everyone starts somewhere!</p> <p>We want to make life safer and easier for at-risk activists and everyday people alike. That’s why we make accessible and straightforward guides to help you quickly and easily get past censors, internet police, or the office IT department.</p> <h1 id="gibberbot-tutorial"><strong>Gibberbot Tutorial</strong></h1> <p>Our newest tutorial is for our secure chat app, <a href="https://play.google.com/store/apps/details?id=info.guardianproject.otr.app.im&feature=search_result" target="_blank">Gibberbot</a>. With your Android phone in one hand and the <a href="https://guardianproject.info/howto/chatsecurely/" target="_blank">Gibberbot Tutorial</a> in the other, you can be chatting securely on Google or Facebook chat in minutes! But Google and Facebook can’t even tell what you’re talking about. It’s also more convenient to have all of your chat apps rolled into one so that it doesn’t matter where your friends message you, it still goes to the same place. Gibberbot works even if someone is trying to monitor or block your phone’s communications. If you know another language and would like to contribute, <a title="Gibberbot Tutorial Transifex Translations" href="https://www.transifex.com/projects/p/gibberbot-tutorial/" target="_blank">we’d love your help translating the tutorial (we’ve got English and Tibetan covered)</a>.</p> <div id="attachment_3291" style="width: 251px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/howto/chatsecurely/" target="_blank"><img aria-describedby="caption-attachment-3291" class=" wp-image-3291" alt="galaxy5" src="https://guardianproject.info/wp-content/uploads/2013/02/galaxy5.png" width="241" height="361" /></a> <p id="caption-attachment-3291" class="wp-caption-text"> So you want to chat securely? </p> </div> <p style="text-align: center;"> <p>   </p> <p><h1> <strong>Orbot Tutorial</strong> </h1></p> <p><p> With our Android app Orbot, browsing the web securely and safely through Tor has been a piece of cake for a while now. But we just created <a title="How to Orbot Tutorial" href="https://guardianproject.info/howto/browsefreely" target="_blank">an interactive tutorial to get you started</a> and show how easy it is circumvent censorship, even if the Google Play Store is blocking direct access to our app. </p></p> <p><p> The tools themselves are getting smarter too. A new tool from <a title="Tor Project" href="https://www.torproject.org/" target="_blank">Tor</a>, called <a title="Tor Project Obfsproxy" href="http://www.torproject.org/projects/obfsproxy.html.en" target="_blank">Pluggable Transports</a>, hides your Tor traffic to look like regular Internet traffic, making it even easier for Tor users to stay ahead of surveillance and censorship. To use this new tool with Orbot, just follow the instructions on <a href="https://guardianproject.info/wp-content/uploads/2013/04/How-to-browse-freely-on-your-phone-if-your-internet-is-blocked.pdf" target="_blank">our new one-page guide</a> (and <a title="How to browse freely on your phone if your internet is blocked - Farsi" href="https://guardianproject.info/wp-content/uploads/2013/04/How-to-browse-freely-on-your-phone-if-your-internet-is-blocked-Farsi.pdf" target="_blank">in Farsi</a>) and you’re all set! For a more in-depth guide to using Orbot, watch our <a href="https://www.youtube.com/watch?v=Dcf5sh99ze0">video tutorial</a> (now in English and Arabic). </p></p> <p><div id="attachment_3585" style="width: 250px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/howto/browsefreely" target="_blank"><img aria-describedby="caption-attachment-3585" class=" wp-image-3585" alt="orbot galaxy s3" src="https://guardianproject.info/wp-content/uploads/2013/04/galaxy15.png" width="240" height="361" srcset="https://guardianproject.info/wp-content/uploads/2013/04/galaxy15.png 400w, https://guardianproject.info/wp-content/uploads/2013/04/galaxy15-199x300.png 199w" sizes="(max-width: 240px) 100vw, 240px" /></a></p> <pre><code>&lt;p id=&quot;caption-attachment-3585&quot; class=&quot;wp-caption-text&quot;&gt; So you want to escape censorship? &lt;/p&gt; </code></pre> <p></div></p> <p><p style="text-align: center;"> <p> As we continue to grow our team and create new tools, we need your feedback!  Please tell us what we can do to go from security awareness training to a full-on security awareness party. Feel free to leave a comment on this post or tell us how we can make things easier through our <a href="https://guardianproject.info/contact/">contact page</a>. You can also let us know about any upcoming parties that we should be attending. </p></p> <pre><code>&lt;p&gt; &lt;i&gt;This post is partially a response to Bruce Schneier’s recent piece: &lt;a title=&quot;Schneier Security Awareness Training&quot; href=&quot;https://www.schneier.com/blog/archives/2013/03/security_awaren_1.html&quot;&gt;Security Awareness Training&lt;/a&gt;&lt;/i&gt;. &lt;/p&gt; </code></pre> https://guardianproject.info/archive/pixelknot/ Wed, 10 Apr 2013 19:31:13 -0400 https://guardianproject.info/archive/pixelknot/ <h4 id="img-class-aligncenter-size-full-wp-image-11444-src-https-guardianproject-info-wp-content-uploads-2013-04-pixelknot-banner-002-png-alt-pixelknot-banner-hide-messages-width-1024-height-512-srcset-https-guardianproject-info-wp-content-uploads-2013-04-pixelknot-banner-002-png-1024w-https-guardianproject-info-wp-content-uploads-2013-04-pixelknot-banner-002-300x150-png-300w-sizes-max-width-1024px-100vw-1024px-https-guardianproject-info-releases-pixelknot-release-0-3-rc1-apk-what-is-pixelknot"><a href="https://guardianproject.info/releases/PixelKnot-release-0.3-RC1.apk"><img class="aligncenter size-full wp-image-11444" src="https://guardianproject.info/wp-content/uploads/2013/04/pixelknot_banner.002.png" alt="pixelknot banner hide messages" width="1024" height="512" srcset="https://guardianproject.info/wp-content/uploads/2013/04/pixelknot_banner.002.png 1024w, https://guardianproject.info/wp-content/uploads/2013/04/pixelknot_banner.002-300x150.png 300w" sizes="(max-width: 1024px) 100vw, 1024px" /></a>What is Pixelknot?</h4> <div id="attachment_11493" style="width: 123px" class="wp-caption alignright"> <a href="https://play.google.com/store/apps/details?id=info.guardianproject.pixelknot" target="_blank"><img aria-describedby="caption-attachment-11493" class="size-full wp-image-11493 " src="https://guardianproject.info/wp-content/uploads/2013/04/pixelknot-qr1.png" alt="pixelknot qr" width="113" height="113" /></a> <p id="caption-attachment-11493" class="wp-caption-text"> Play Store </p> </div> <p>Pixelknot is an Android application that allows users to hide short text-based messages in photographs and share them across trusted channels.</p> <p>Have a secret that you want to share? Why not hide it in a picture? With PixelKnot, only your friends with the secret password can unlock your special message. Everyone else just sees a pretty picture. It’s a fun and easy way to share hidden messages without anyone knowing. Take those pixels, twist them in a knot, and see for yourself!</p> <p>Pixelknot is now available on <a title="Pixelknot on Google Play" href="https://play.google.com/store/apps/details?id=info.guardianproject.pixelknot" target="_blank">Google Play</a> and also <a title="Pixelknot apk" href="https://guardianproject.info/releases/pixelknot-latest.apk" target="_blank">on our website</a> and verifiable <a title="Pixelknot asc" href="https://guardianproject.info/releases/pixelknot-latest.apk.asc" target="_blank">via the asc</a>.</p> <p>FREE AND OPEN-SOURCE: PixelKnot is free software. You can take a look at our source code, or join the community to help make it even better: <a href="https://github.com/guardianproject/pixelknot">https://github.com/guardianproject/pixelknot</a></p> <h4 id="screenshots">Screenshots</h4> <div id='gallery-14' class='gallery galleryid-3456 gallery-columns-4 gallery-size-thumbnail'> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091621_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091621_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091635_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091635_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091711_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091711_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091817_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091817_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091832_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091832_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-092806_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-092806_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-092833_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-092833_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-093114_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-093114_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> </div> <p>This image steganography application features:</p> <ul> <li>DISGUISE YOUR MESSAGES: Pictures are public, the text is hidden inside. Even a trained eye will think the image is unedited.</li> <li>FOR YOUR EYES ONLY: Put a password on the secret message to make sure that no one can read it except the person it’s meant for.</li> <li>MATHEMATICALLY SECURE: We use the steganography algorithm F5 which implements matrix encoding to improve the efficiency of embedding and employs permutative straddling to uniformly spread out the changes over the whole steganogram.</li> <li>ATTACK RESISTANT: We’ve tested discovery on images with messages hidden in them using a specialized version of stegdetect, an automated tool for detecting steganographic content in images.</li> <li>AD-FREE: We want your love, not your money.</li> <li>WE SPEAK YOUR LANGUAGE:  PixelKnot is available for friends who speak many languages.  Don’t see your language? Join us and help translate the app: <a href="https://www.transifex.com/projects/p/pixelknot/">https://www.transifex.com/projects/p/pixelknot/</a></li> </ul> <h4 id="what-is-steganography">What is Steganography?</h4> <p>The practice of embedding secret messages into a piece of media so that no one, apart from the sender and intended recipient, know that the secret message exists. The newly developed algorithm F5 withstands visual and statistical attacks, yet it still offers a large steganographic capacity. F5 implements matrix encoding to improve the efficiency of embedding. Thus it reduces the number of necessary changes. F5 employs permutative straddling to uniformly spread out the changes over the whole steganogram.</p> <div title="Page 4"> <div> <div> <div> <p> The Guardian steganography standard: we are working towards ensuring that the secret message in an image must: </p> <ol> <li> Have the original image appear, to the trained human eye, <strong>unedited</strong>. </li> <li> Have the bytes of the image appear, to a trained analyst, <strong>undistorted</strong> so much so as to arouse suspicion. </li> <li> Have the complete message be <strong>recoverable</strong> no matter how it is transmitted. </li> </ol> </div> </div> </div> </div> <p>&nbsp;</p> <p><span style="font-weight: 400;">The release of PixelKnot features an improved user experience:</span></p> <p><li style="font-weight: 400;"> <span style="font-weight: 400;">EASIER SHARING: It’s now easier to share PixelKnot images with the applications you and your friends commonly use.  Note that not all image sharing services can be used with PixelKnot because they modify your images before posting them to their platform.  PixelKnot suggests apps it knows will share properly, but you’re welcome to add your own.</span> </li> <li style="font-weight: 400;"> <span style="font-weight: 400;">SIMPLIFIED SENDING / RECEIVING: Want to send a message? Open the PixelKnot app directly, and PixelKnot will walk you through the process.  Receiving a shared stego image? Use your receiving app to share the image with PixelKnot - it’ll take care of the message extraction directly.</span> </li> <li style="font-weight: 400;"> <span style="font-weight: 400;">NEW IMAGE CHOOSER:  You can use the camera to take your photo or select from picture you’ve already taken. The new chooser supports all the common image directories and allows you to select a different galleries if needed (such a “private” gallery created by a unique camera application).</span> </li> <li style="font-weight: 400;"> <span style="font-weight: 400;">SEND QUEUE: PixelKnot allows you to queue up a list of images for processing, rather than forcing you to wait for the message encryption to complete (depending on the size of your image and length of your text, this might be time-consuming).</span> </li></p> <p><span style="font-weight: 400;">ABOUT US: Guardian Project is a group of developers that make secure mobile apps and open-source code for a better tomorrow.</span></p> <p><span style="font-weight: 400;">OUR WEBSITE: <a href="https://guardianproject.info">https://guardianproject.info</a></span></p> <p><span style="font-weight: 400;">ON TWITTER: <a href="https://twitter.com/guardianproject">https://twitter.com/guardianproject</a></span></p> <p>MESSAGE US: Are we missing your favorite feature? Found an annoying bug? Please tell us! We’d love to hear from you. Send us an email: s&#117;&#x70;&#x70;&#x6f;r&#116;&#x40;&#x67;&#x75;a&#114;&#x64;&#x69;&#x61;n&#112;&#x72;&#x6f;&#x6a;e&#99;&#x74;&#x2e;&#x69;n&#102;&#x6f;</p> <p>&nbsp;</p> https://guardianproject.info/archive/pixelknot/ Wed, 10 Apr 2013 19:31:13 -0400 https://guardianproject.info/archive/pixelknot/ <h4 id="img-class-aligncenter-size-full-wp-image-11444-src-https-guardianproject-info-wp-content-uploads-2013-04-pixelknot-banner-002-png-alt-pixelknot-banner-hide-messages-width-1024-height-512-srcset-https-guardianproject-info-wp-content-uploads-2013-04-pixelknot-banner-002-png-1024w-https-guardianproject-info-wp-content-uploads-2013-04-pixelknot-banner-002-300x150-png-300w-sizes-max-width-1024px-100vw-1024px-https-guardianproject-info-releases-pixelknot-release-0-3-rc1-apk-what-is-pixelknot"><a href="https://guardianproject.info/releases/PixelKnot-release-0.3-RC1.apk"><img class="aligncenter size-full wp-image-11444" src="https://guardianproject.info/wp-content/uploads/2013/04/pixelknot_banner.002.png" alt="pixelknot banner hide messages" width="1024" height="512" srcset="https://guardianproject.info/wp-content/uploads/2013/04/pixelknot_banner.002.png 1024w, https://guardianproject.info/wp-content/uploads/2013/04/pixelknot_banner.002-300x150.png 300w" sizes="(max-width: 1024px) 100vw, 1024px" /></a>What is Pixelknot?</h4> <div id="attachment_11493" style="width: 123px" class="wp-caption alignright"> <a href="https://play.google.com/store/apps/details?id=info.guardianproject.pixelknot" target="_blank"><img aria-describedby="caption-attachment-11493" class="size-full wp-image-11493 " src="https://guardianproject.info/wp-content/uploads/2013/04/pixelknot-qr1.png" alt="pixelknot qr" width="113" height="113" /></a> <p id="caption-attachment-11493" class="wp-caption-text"> Play Store </p> </div> <p>Pixelknot is an Android application that allows users to hide short text-based messages in photographs and share them across trusted channels.</p> <p>Have a secret that you want to share? Why not hide it in a picture? With PixelKnot, only your friends with the secret password can unlock your special message. Everyone else just sees a pretty picture. It’s a fun and easy way to share hidden messages without anyone knowing. Take those pixels, twist them in a knot, and see for yourself!</p> <p>Pixelknot is now available on <a title="Pixelknot on Google Play" href="https://play.google.com/store/apps/details?id=info.guardianproject.pixelknot" target="_blank">Google Play</a> and also <a title="Pixelknot apk" href="https://guardianproject.info/releases/pixelknot-latest.apk" target="_blank">on our website</a> and verifiable <a title="Pixelknot asc" href="https://guardianproject.info/releases/pixelknot-latest.apk.asc" target="_blank">via the asc</a>.</p> <p>FREE AND OPEN-SOURCE: PixelKnot is free software. You can take a look at our source code, or join the community to help make it even better: <a href="https://github.com/guardianproject/pixelknot">https://github.com/guardianproject/pixelknot</a></p> <h4 id="screenshots">Screenshots</h4> <div id='gallery-14' class='gallery galleryid-3456 gallery-columns-4 gallery-size-thumbnail'> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091621_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091621_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091635_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091635_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091711_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091711_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091817_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091817_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091832_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-091832_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-092806_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-092806_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-092833_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-092833_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-093114_s.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2013/04/Screenshot_20161025-093114_s-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> </div> <p>This image steganography application features:</p> <ul> <li>DISGUISE YOUR MESSAGES: Pictures are public, the text is hidden inside. Even a trained eye will think the image is unedited.</li> <li>FOR YOUR EYES ONLY: Put a password on the secret message to make sure that no one can read it except the person it’s meant for.</li> <li>MATHEMATICALLY SECURE: We use the steganography algorithm F5 which implements matrix encoding to improve the efficiency of embedding and employs permutative straddling to uniformly spread out the changes over the whole steganogram.</li> <li>ATTACK RESISTANT: We’ve tested discovery on images with messages hidden in them using a specialized version of stegdetect, an automated tool for detecting steganographic content in images.</li> <li>AD-FREE: We want your love, not your money.</li> <li>WE SPEAK YOUR LANGUAGE:  PixelKnot is available for friends who speak many languages.  Don’t see your language? Join us and help translate the app: <a href="https://www.transifex.com/projects/p/pixelknot/">https://www.transifex.com/projects/p/pixelknot/</a></li> </ul> <h4 id="what-is-steganography">What is Steganography?</h4> <p>The practice of embedding secret messages into a piece of media so that no one, apart from the sender and intended recipient, know that the secret message exists. The newly developed algorithm F5 withstands visual and statistical attacks, yet it still offers a large steganographic capacity. F5 implements matrix encoding to improve the efficiency of embedding. Thus it reduces the number of necessary changes. F5 employs permutative straddling to uniformly spread out the changes over the whole steganogram.</p> <div title="Page 4"> <div> <div> <div> <p> The Guardian steganography standard: we are working towards ensuring that the secret message in an image must: </p> <ol> <li> Have the original image appear, to the trained human eye, <strong>unedited</strong>. </li> <li> Have the bytes of the image appear, to a trained analyst, <strong>undistorted</strong> so much so as to arouse suspicion. </li> <li> Have the complete message be <strong>recoverable</strong> no matter how it is transmitted. </li> </ol> </div> </div> </div> </div> <p>&nbsp;</p> <p><span style="font-weight: 400;">The release of PixelKnot features an improved user experience:</span></p> <p><li style="font-weight: 400;"> <span style="font-weight: 400;">EASIER SHARING: It’s now easier to share PixelKnot images with the applications you and your friends commonly use.  Note that not all image sharing services can be used with PixelKnot because they modify your images before posting them to their platform.  PixelKnot suggests apps it knows will share properly, but you’re welcome to add your own.</span> </li> <li style="font-weight: 400;"> <span style="font-weight: 400;">SIMPLIFIED SENDING / RECEIVING: Want to send a message? Open the PixelKnot app directly, and PixelKnot will walk you through the process.  Receiving a shared stego image? Use your receiving app to share the image with PixelKnot - it’ll take care of the message extraction directly.</span> </li> <li style="font-weight: 400;"> <span style="font-weight: 400;">NEW IMAGE CHOOSER:  You can use the camera to take your photo or select from picture you’ve already taken. The new chooser supports all the common image directories and allows you to select a different galleries if needed (such a “private” gallery created by a unique camera application).</span> </li> <li style="font-weight: 400;"> <span style="font-weight: 400;">SEND QUEUE: PixelKnot allows you to queue up a list of images for processing, rather than forcing you to wait for the message encryption to complete (depending on the size of your image and length of your text, this might be time-consuming).</span> </li></p> <p><span style="font-weight: 400;">ABOUT US: Guardian Project is a group of developers that make secure mobile apps and open-source code for a better tomorrow.</span></p> <p><span style="font-weight: 400;">OUR WEBSITE: <a href="https://guardianproject.info">https://guardianproject.info</a></span></p> <p><span style="font-weight: 400;">ON TWITTER: <a href="https://twitter.com/guardianproject">https://twitter.com/guardianproject</a></span></p> <p>MESSAGE US: Are we missing your favorite feature? Found an annoying bug? Please tell us! We’d love to hear from you. Send us an email: s&#117;&#x70;&#x70;&#x6f;r&#116;&#x40;&#x67;&#x75;a&#114;&#x64;&#x69;&#x61;n&#112;&#x72;&#x6f;&#x6a;e&#99;&#x74;&#x2e;&#x69;n&#102;&#x6f;</p> <p>&nbsp;</p> https://guardianproject.info/2013/03/08/gibberbot-v11-is-not-just-secure-its-also-simple-snappy-and-super-fun/ Fri, 08 Mar 2013 12:54:50 -0400 https://guardianproject.info/2013/03/08/gibberbot-v11-is-not-just-secure-its-also-simple-snappy-and-super-fun/ <p><em>Gibberbot v11 is now final as of RC3 release: <a href="https://github.com/guardianproject/Gibberbot/tree/0.0.11-RC3">https://github.com/guardianproject/Gibberbot/tree/0.0.11-RC3</a>. From here, the only changes to v11 we will be making will be critical bug fixes. We are now focused on our v12 release, which you can track here: <a href="https://dev.guardianproject.info/versions/39">https://dev.guardianproject.info/versions/39</a></em></p> <p>_<strong>Please promote our new Gibberbot how-to interactive tutorial available here: <a href="https://guardianproject.info/howto/chatsecurely/" target="_blank"><a href="https://guardianproject.info/howto/chatsecurely/">https://guardianproject.info/howto/chatsecurely/</a></a></strong>_</p> <p>If you have been tracking our efforts here for the last few years, you will know that Gibberbot, our secure instant messaging app, started out as a big old mess of an app called “ORChat” as and then “OTRChat” and then “Gibber” (or “Jibber”?), and then finally settled down into the name and app it is known as now. Really it was a proof of concept, showing that you could indeed use the <a href="https://github.com/gpolitis/otr4j">OTR4J library</a> built for desktops app, on Android.</p> <p>Gibberbot was the first Android app, and perhaps real mobile app, that supported end-to-end encrypted chat using open standards like OTR and XMPP. In the early days, we were just so excited this was possible, and that we could also send the chat connections over Tor, that we didn’t think too much about how easy or fun it was to use the app itself. We were focused on our magic tricks, and not how it was to live and use the app on a daily basis.</p> <p>A few months ago, we realized that on Google Play, we had a lot of reviews that basically said “This is a great idea, but it doesn’t work for me”, or “I like these guys, but the app is kinda buggy”, and even “This app gives my device crazy flash seizures”. All of these reviews were true, and we swallowed the hard medicine, that if we didn’t spend more time focusing on how the core features of being a mobile instant messaging chat client worked, that nobody would care about how secure the app was, because there would be no one using it.</p> <p>We set about then not only continuing our focus on improving the core security and technical core of Gibberbot, but also focusing on a user interface update. We completed “stage 1” of that update, with another major round of effort planned for v12.</p> <p>Here a few new features and improvements along those lines, that were completed for v11:</p> <ul> <li><span style="line-height: 13px;"><span style="line-height: 13px;"><strong>Simplify setup of Google Gmail and Google Domain accounts…. DONE!</strong> We now support the built-in authentication system on your Android phone, so if you phone is already setup with a Google account, we can tap right into that. No extra password entry needed, no need to enter anthing really. Just choose “Google Account” from the account type list.</span></span> </li> <li><strong>Streamline Orbot integration to make Tor user easier… DONE! </strong>Using the new <a href="https://guardianproject.info/code/onionkit">OnionKit library</a>, Gibberbot can now tell if Orbot is installed and running, and if not, prompt the user to either install it, or ask if they want to start up and connect to the Tor network.</li> <li><strong>Make it easy for services using SSL certs not signed by the Root CA cartel to be easily verified and accepted by the user… DONE!</strong> Increasingly, it has become less and less valuable to have the TLS or SSL certificate you use with your website or XMPP server to be signed by a Root Certificate Authority, because as many point out, the SSL is broken, as long as trust this strange collection of hundreds of organizations we have no reason to really trust. Previously, Gibberbot would not handle non-Root CA certs very well, so you would just have to turn off verification. Now thanks to the concept of TOFU-POP (Trust on First Use, Persistence of Psuedonym) and the excellent <a href="https://github.com/ge0rg/MemorizingTrustManager/wiki">MemorizingTrustManager</a> library, user’s can now decided in an on-demand and interactive manner, whether or not they want to trust the TLS connection they are using. </li> <li><strong>Ensure Gibberbot only runs and signs in when the user wants it to… DONE! </strong>Previously, Gibberbot was a bit too aggresive about trying to stay connecting to your account, and starting up on device boot. Many users want to conserve battery, and some do not like apps that run without them asking them to first (imagine that?!). We have put Gibberbot now at the user’s beck and call, such that there are preferences to control starting on boot, and when you SIGN OUT, it really means do not every login again, until I login.</li> <li><strong>Improve the user interface to make app that is clean, fast, modern and customizable… DONE! </strong>Not only have we continued to focus on a clean, simple user interface that uses the latest interface conventions and guidelines from Google, we also wanted to start adding some fun user personalization options. One size does not fit all, and just because our app is secure, does not mean it has to be boring. As you can see below, Gibberbot now supports light and dark themes, as well as user configured app wallpaper.</li> </ul> <p>I am happy to say, that will all of these improvements, we are much happier users, and are receiving much better reviews on Google Play, such as:</p> <p><em>“Easy to set up and pretty stable and easy to use.” “Fixed on jelly bean and does exactly what it should do” and the best… “Perfect (but no ICQ Support*)” </em></p> <p><em id="__mceDel">*We may add ICQ support, just so we can be extra perfect for that one user who wants it! 🙂</em></p> <p>All in all, we hope you agree, and that our new found focus on usability can push us from 100,000+ downloads to over 500,000+ in the coming months. We have big ideas for the future of secure mobile messaging, and making Gibberbot the best it can be is a huge part of that plan.</p> <p>As always you can find the Gibberbot download (and <a href="https://guardianproject.info/apps">all of our apps</a>) in a variety of places:</p> <ul> <li><span style="line-height: 13px;">Through our direct APK download: <a href="https://guardianproject.info/releases/gibberbot-latest.apk">https://guardianproject.info/releases/gibberbot-latest.apk</a> (and <a href="https://guardianproject.info/releases/gibberbot-latest.apk.asc">gpg sig</a>)</span></li> <li>on <a href="https://play.google.com/store/apps/details?id=info.guardianproject.otr.app.im">Google Play</a></li> <li>or through our <a href="https://guardianproject.info/2012/03/15/our-new-f-droid-app-repository/">F-Droid Repo</a>, which you can <a href="https://guardianproject.info/2012/03/15/our-new-f-droid-app-repository/">learn how to use here</a>.</li> </ul> <p>You can also scan this QR code, which links to the direct APK download above:</p> <p><a href="https://guardianproject.info/wp-content/uploads/2013/03/gibberbotqr.png"><img class="alignnone size-full wp-image-3373" alt="gibberbotqr" src="https://guardianproject.info/wp-content/uploads/2013/03/gibberbotqr.png" width="123" height="123" /></a></p> <p> </p> <p><img class="alignnone" alt="" src="https://lh4.ggpht.com/TAtK2o9v79g1dVsAuii2XWQcdN1JdZgnRPAT0inGrQjDKkPLO_zLWLHlGdm6xxki6w" width="288" height="512" />  <a href="https://guardianproject.info/wp-content/uploads/2013/03/device-2013-02-20-021839.jpg"><img alt="device-2013-02-20-021839" src="https://guardianproject.info/wp-content/uploads/2013/03/device-2013-02-20-021839.jpg" width="288" height="512" /></a></p> <p><img class="alignnone" alt="" src="https://lh4.ggpht.com/ShD1S-pNv-1nUdK4e4C4d-GBNz4A1Vr7bS6_-uYMm2zjOZ2T88HL_Iogsn71ePBVmTWk" width="288" height="512" />   <img class="alignnone" alt="" src="https://lh4.ggpht.com/cLhiajC5VIk8SZ4iDq08PKAmhiZQMze62avh0h2JNArZFRHKR4LJgWdS0tfALe1uFeHg" width="288" height="512" /></p> <p><a href="https://guardianproject.info/wp-content/uploads/2013/03/device-2013-02-20-025148.png"><img class="alignnone wp-image-3375" alt="device-2013-02-20-025148" src="https://guardianproject.info/wp-content/uploads/2013/03/device-2013-02-20-025148.png" width="538" height="302" srcset="https://guardianproject.info/wp-content/uploads/2013/03/device-2013-02-20-025148.png 1280w, https://guardianproject.info/wp-content/uploads/2013/03/device-2013-02-20-025148-300x168.png 300w, https://guardianproject.info/wp-content/uploads/2013/03/device-2013-02-20-025148-1024x576.png 1024w" sizes="(max-width: 538px) 100vw, 538px" /></a></p> https://guardianproject.info/2013/02/22/lower-bounds-of-the-narrow-bands/ Fri, 22 Feb 2013 09:05:48 -0400 https://guardianproject.info/2013/02/22/lower-bounds-of-the-narrow-bands/ <p>Voice is becoming a standard feature of any messaging app on mobile phones, in various forms using many different protocols. There’s the old guard, whom I will refer to as “Skype”. Some <a href="https://www.privacyinternational.org/blog/skype-please-act-like-the-responsible-global-citizen-you-claim-to-be">tough</a> <a href="http://www.skypeopenletter.com/">questions</a> have been thrown their way by many groups who support a free Internet. There’s Google Voice, which is not really VoIP. Apple is playing around in the hedge maze inside their walled garden with iChat. There’s also Facebook, who is rolling out <a href="http://techcrunch.com/2013/01/16/facebook-rolls-out-voip-calling-to-u-s-ios-messenger-users/">voice calling in Canada and the USA</a> in their Messenger app on iOS.</p> <p>None of these offerings address the callers privacy, and few document the details of their calling systems for developers. Surprisingly, none of these global VoIP carriers interoperate with each other. Why? Like most complicated problems, there is a complicated answer. I’m going to focus on codecs, which is a research subject that has been very active in the last few years.</p> <p>Our friends at WhisperSystems recently did an <a href="http://whispersystems.org/blog/client-side-audio-quality/">in depth writeup</a> on some challenges they had with the Speex codec when building RedPhone. RedPhone is the client application for one of a small group of secure VoIP carriers that address the challenging privacy issues around VoIP.</p> <p>The Guardian Project is also one of these carriers, with a public service called <a href="https://ostel.me">OSTel</a>. We chose to leverage an existing open source client called <a href="https://code.google.com/p/csipsimple/">CSipSimple</a>. This client has a modular design, which provides a wide selection of codecs. I’m going to focus on one in particular, <a href="http://codec2.org/">named Codec2</a>.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2013/02/spectrogram.png"><img src="https://guardianproject.info/wp-content/uploads/2013/02/spectrogram-300x231.png" alt="spectrogram" width="300" height="231" class="aligncenter size-medium wp-image-3338" srcset="https://guardianproject.info/wp-content/uploads/2013/02/spectrogram-300x231.png 300w, https://guardianproject.info/wp-content/uploads/2013/02/spectrogram.png 560w" sizes="(max-width: 300px) 100vw, 300px" /></a></p> <p>Codec2 addresses a challenge in radio communications that has been around for longer than the Internet. Bandwidth. It might be appropriate to think of your cell phone as a radio to understand this example. When connected to a cellular data connection, the bandwidth is limited by the carrier’s packet switched radio technology. This may be GPRS, EDGE, 3G, 4G(LTE) to name a few lovely acronyms. If your VoIP call uses a codec that exceeds the upper bounds of this bandwidth, you start to hear side effects like dropouts or unintelligible transmission which probably will lead to a dropped call.</p> <p>One way to address this problem is to shoot for the bottom. The lower bounds of the bandwidth of cellular data connections start to look a lot like more traditional radio. Shortwave radio, or HAM is the community that’s the closest to the technology behind Codec2. If a codec can be used to transmit <a href="https://en.wikipedia.org/wiki/AMPRNet">digitally encoded data</a> over HAM, that means it is possible to “do VoIP” over a shortwave radio link. This opens up exciting new possibilities for secure voice over narrow bandwidth environments.</p> <p>While a small part of the world enjoys plentiful wide band data connections in urban areas, coverage in many rural areas is less common. In this case shooting for the bottom of the bandwidth spectrum helps us keep our calls from dropping and our voices heard.</p> <p>The <a href="https://play.google.com/store/apps/details?id=com.csipsimple.plugins.codecs.pack1&amp;feature=more_from_developer#?t=W251bGwsMSwyLDEwMiwiY29tLmNzaXBzaW1wbGUucGx1Z2lucy5jb2RlY3MucGFjazEiXQ..">CSipSimple Codec Pack</a> supports secure voice calls using Codec2 with the stable release on the <a href="https://play.google.com/store/apps/details?id=com.csipsimple&amp;feature=more_from_developer#?t=W251bGwsMSwyLDEwMiwiY29tLmNzaXBzaW1wbGUiXQ..">Google Play Store</a>.</p> https://guardianproject.info/archive/tutorials/ Thu, 21 Feb 2013 16:46:40 -0400 https://guardianproject.info/archive/tutorials/ <p>Security doesn&rsquo;t have to be hard. Here are a few videos that&rsquo;ll make using our apps easier (and more awesome).</p> <h1 id="interactive">Interactive</h1> <ul> <li><a href="https://guardianproject.info/howto/chatsecurely" target="_blank">How to Chat Securely</a></li> <li><a href="https://guardianproject.info/howto/browsefreely" target="_blank">How to Browse Freely</a></li> <li><a href="https://guardianproject.info/howto/callsecurely" target="_blank">How to Call Securely</a></li> </ul> <h1 id="span-style-font-size-20px-font-weight-bold-videos-span"><span style="font-size: 20px; font-weight: bold;">Videos</span></h1> <p>Orbot: Mobile Anonymity + Circumvention</p> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe src="//www.youtube.com/embed/Dcf5sh99ze0" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe> </div> <p>Gibberbot: Secure Instant Messaging</p> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe src="//www.youtube.com/embed/qz2dBvQb4gc" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe> </div> <p>Ostel: Encrypted Phone Calls</p> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe src="//www.youtube.com/embed/BrNC8Mk26Z8" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe> </div> https://guardianproject.info/archive/tutorials/ Thu, 21 Feb 2013 16:46:40 -0400 https://guardianproject.info/archive/tutorials/ <p>Security doesn&rsquo;t have to be hard. Here are a few videos that&rsquo;ll make using our apps easier (and more awesome).</p> <h1 id="interactive">Interactive</h1> <ul> <li><a href="https://guardianproject.info/howto/chatsecurely" target="_blank">How to Chat Securely</a></li> <li><a href="https://guardianproject.info/howto/browsefreely" target="_blank">How to Browse Freely</a></li> <li><a href="https://guardianproject.info/howto/callsecurely" target="_blank">How to Call Securely</a></li> </ul> <h1 id="span-style-font-size-20px-font-weight-bold-videos-span"><span style="font-size: 20px; font-weight: bold;">Videos</span></h1> <p>Orbot: Mobile Anonymity + Circumvention</p> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe src="//www.youtube.com/embed/Dcf5sh99ze0" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe> </div> <p>Gibberbot: Secure Instant Messaging</p> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe src="//www.youtube.com/embed/qz2dBvQb4gc" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe> </div> <p>Ostel: Encrypted Phone Calls</p> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe src="//www.youtube.com/embed/BrNC8Mk26Z8" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe> </div> https://guardianproject.info/2013/02/07/iocipher-beta-easy-encrypted-file-storage-for-your-android-app/ Thu, 07 Feb 2013 14:45:28 -0400 https://guardianproject.info/2013/02/07/iocipher-beta-easy-encrypted-file-storage-for-your-android-app/ <p>At long last, we are proud to announce the <a href="https://guardianproject.info/code/iocipher/">first beta release of IOCipher</a>, an easy framework for providing virtual encrypted disks for Android apps.</p> <ul> <li>does not require root or any special permissions at all</li> <li>the API is a drop-in replacement for the standard java.io.File API, so if you have ever worked with files in Java, you already know how to use IOCipher</li> <li>works easiest in an app that stores all files in IOCipher, but using standard java.io with IOCipher is possible</li> <li>supports android-7 v2.1 and above</li> <li>licensed under the LGPL v3+</li> </ul> <p>You can download it here:</p> <p><a href="https://guardianproject.info/code/iocipher/">https://guardianproject.info/code/iocipher/</a></p> <p>Adding IOCipher to our InformaCam and NoteCipher apps is already in the<br /> works. There is already one app in the Play Store built with IOCipher: <a title="Gryphn Secure Messaging in the Play Store" href="https://play.google.com/store/apps/details?id=com.Gryphn.mms&hl=en" target="_blank">Gryphn Secure Messaging</a></p> <p>We’ve recently done some heavy testing and bug fixing and this is ready for beta status. That means for many applications, it should be stable with reasonable performance. But its not done yet, and there are some known edge cases documented in our bug tracker which we aim to address in the next beta release:</p> <p><a href="https://dev.guardianproject.info/projects/iocipher/issues">https://dev.guardianproject.info/projects/iocipher/issues</a></p> <p>Some additional notes on usage:</p> <ul> <li>single thread/sequential access is the preferred way of using IOCipher</li> <li>multi-threaded access possible, but potentially unstable under very high load</li> <li>VFS now has beginTransaction and completeTransaction to optimize performance</li> <li>parts of java.io not currently supported: vectored I/O, memory-mapped files</li> </ul> <p> </p> <p><em>featured photo <a href="http://www.flickr.com/photos/pong/288491653/">“Safe” from Pong on Flickr</a></em></p> https://guardianproject.info/2013/01/31/report-on-iocipher-beta-dev-sprint/ Thu, 31 Jan 2013 19:45:44 -0400 https://guardianproject.info/2013/01/31/report-on-iocipher-beta-dev-sprint/ <p>We are just wrapping up an intensive dev sprint on <a href="https://guardianproject.info/code/iocipher/">IOCipher</a> in order to get the first real beta release out, and it has been a wonderfully productive session on many levels! Before we started this, we had a proof-of-concept project that was crashy and ridiculously slow. We’re talking crashes every 100 or so transactions and 9 minutes to write 2 megs. Abel and I were plodding thru the bugs, trying to find the motivation to dive into the hard problems in the guts of some of the more arcane parts of the code. Aaron Huttner of <a href="http://gryphn.co/" target="_blank">Gryphn</a> found IOCipher while developing their <a href="https://play.google.com/store/apps/details?id=com.Gryphn.mms&hl=en" title="Gryphn Secure Text Messaging in the Google Play store" target="_blank">Gryphn Secure Text Messaging</a> and thought it was a remarkable easy way to add encrypted storage of files, and it worked quickly for him, so he included it his app before we had even announced an alpha release (thanks again for the vote of confidence!).</p> <p>Aaron worked through a lot of the bugs with us, providing good bug reports and real, working test cases in code. What more could we ask for? We made progress on them slowly but surely. Gryphn then decided they needed IOCipher to work for them ASAP so they could put out a real release. They approached us about funding a development sprint and we thought it was a great idea. This also allowed us to bring in Stephen Lombardo and Nick Parker of <a href="http://zetetic.net/" target="_blank">Zetetic</a> to apply their <a href="https://www.zetetic.net/sqlcipher/" target="_blank">SQLCipher</a> and SQLite expertise. Our very own David Oliver put together the deal, and off we went. So we put our heads down and focused everything on getting IOCipher to be a real file system.</p> <p>To begin with, we focused on the core of IOCipher, <a href="https://github.com/guardianproject/libsqlfs" target="_blank">libsqlfs</a>, since we could run that on GNU/Linux, greatly speeding up the testing cycle. It started out with about 3 full days of Abel and I running <code>fsx</code> (File System eXersizer) tests of all shapes and sizes on libsqlfs mounts to try to pin down the crashes. It seemed like we were swimming in mountains of test results that vaguely pointed somewhere. We had some vague leads, but were excited to find that memory-mapped writes were far and away the most common crash. Since IOCipher does not use mapped writes at all, we could safely ignore those crashes for now. Turns out that using libsqlfs as a FUSE mount for our test platform has produced this one red herring.</p> <p>One thing we knew all along is that both reads and writes were really slow, so Zetetic started with that. We all had the idea that the block sizes should all be aligned, and that should likely speed things up. This means Java stream readers and writers, writes in our Posix-style JNI layer, and the page size of the SQLite database. Zetetic did some testing and found that using 8k block sizes throughout produces some dramatic speed increases, here are some ballpark figures for doing a 2MB write with no contention:</p> <ul> <li>~710 seconds: default 256 byte blocks and no buffering, one SQLite transaction per block</li> <li>~65 seconds: wrapping all the 8192 write calls for each 256 byte block in a single SQLite transaction</li> <li>~20 seconds: same as above with the IOCipher FileOutputStream wrapped in a BufferedOutputStream</li> <li>~5 seconds: increase internal IOCipher block size to 4k</li> <li>~10 seconds: 8k sqlfs block size, 8k sqlite page size, and 8k BufferedOutputStream buffer, one SQLite transaction per block</li> <li>~1 second: same as above, all blocks written in a single SQLite transaction</li> </ul> <p>Ok, now we had something you could actually use. Pretty slow still, but no longer ridiculous. Through much reading of code and testing, we figured out that there is one spot of the code that assumed it would always be able to read from the database. Under heavy load, this was not possible, especially when you have 9 minute blocking write operations. So the next step was to figure out all of the locking and make sure that was working right. The libsqlfs code from 2006 had the remnants of three separate locking mechanisms in it, SQLite locking, pthread locking, and a delay-retry timeout mechanism. Zetetic dove into updating libsqlfs to replace all that and use all of the modern SQLite tricks like <code>sqlite3_busy_timeout()</code> to replace the delay-retry logic, <a href="https://www.sqlite.org/lockingv3.html" target="_blank">v3.0 locks</a> and v3.7 <a href="https://www.sqlite.org/draft/wal.html" target="_blank">Write-Ahead-Logging</a> which gave libsqlfs a huge improvement in read/write concurrency, and putting libsqlfs and IOCipher reasonable performance in the realm of other encrypted file systems. I’ll let Stephen explain it:</p> <blockquote> <p>First, we changed the transaction command in begin_transaction to use “begin immediate”. This seeks an immediate reserved lock on the database, but does not exclusively lock it. This reduces unresolvable contention for write locks that would normally occur with deferred transactions, and is less restrictive than an exclusive lock, since it will continue to allow shared locks for reading.</p> <p>It is extremely important that we prevent write operations from failing to execute due to busy timeouts, even if another process/thread has the database locked. Even using WAL, it is still possible for a command to be blocked during attempted concurrent write operations. This causes the write operation to fail leading to corruption. While libsqlfs has some “delay()” code that provides rudimentary busy handling, it is only in use for a small number of operations leaving other critical calls unprotected. Therefore, our second change was to register SQLite’s internal busy handler with a relatively high timeout (currently 10 seconds, but open for discussion) via sqlite3_busy_timeout. This provides protection for all operations in libsqlfs, reducing the likelihood that a write operation would fail outright, though it may be delayed.</p> <p>Finally, we enabled WAL mode to speed up write operations and further improve concurrency between readers and writers. Note that WAL mode only fsync()s on checkpoint operations, so it may be possible to enable NORMAL synchronous mode with lower overhead than the standard journal mode (we didn’t change this yet).</p> <p>With these changes in place, three concurrent fsx processes running in parallel on a single fuse mount produced no errors in a 24hr test run. The tests also shows improved performance on read and writes. In light of these results, we’d like to get your feedback on these changes, and request that you run your own tests in the multi-threaded Android application to see if they resolve the problems that were reported.</p> </blockquote> <p>This was the final kicker. Who would of thought we could again get performance improvements of an order of magnitude twice in a single dev sprint. Now we have a encrypted filesystem that is stable and with reasonable performance that is really easy to use. And since that means that there is only very short chunks of time where everything is blocked (no more 9 minute writes), the crashes have basically vanished under real world loads. We have run super heavy file system tests over hundreds of thousands of operations without data corruption or crashes. We know that there is the theoretical potential for crashes in certain operations under super heavy load. We aim to address that in upcoming releases. And in conclusion, I’ll quote Aaron since he summarized what we are trying to achieve when we make developer tools:</p> <blockquote> <p>Between <a href="https://www.zetetic.net/sqlcipher/sqlcipher-for-android/" target="_blank">SQLCipher-for-Android</a> and <a href="https://guardianproject.info/code/iocipher/" target="_blank">IOCipher</a> I don’t think it could get any easier to implement cryptography on Android, hopefully people pick up on this.</p> </blockquote> <p>So grab the code now from git, if you’re ready to dive in! Or for the more patient, we’re developing tutorials to go along with the beta release that is coming any day now.</p> https://guardianproject.info/2013/01/31/mumble-and-the-bandwidth-anonymous-cb-radio-with-mumble-and-tor/ Thu, 31 Jan 2013 02:05:50 -0400 https://guardianproject.info/2013/01/31/mumble-and-the-bandwidth-anonymous-cb-radio-with-mumble-and-tor/ <p><a href="https://guardianproject.info/wp-content/uploads/2013/01/mumble-and-the-bandwidth.jpg"><img class="aligncenter size-full wp-image-3186" alt="mumble and the bandwidth" src="https://guardianproject.info/wp-content/uploads/2013/01/mumble-and-the-bandwidth.jpg" width="800" height="478" srcset="https://guardianproject.info/wp-content/uploads/2013/01/mumble-and-the-bandwidth.jpg 800w, https://guardianproject.info/wp-content/uploads/2013/01/mumble-and-the-bandwidth-300x179.jpg 300w" sizes="(max-width: 800px) 100vw, 800px" /></a></p> <p>The journey towards anonymous and secure voice communication is a long one. There’s lots of roadblocks to get your voice from point A to point B over the Internet if you need to prevent eavesdropping or censorship. There is the limited bandwidth of mobile data connections. There is the high latency of the TCP protocol. <a href="https://www.torproject.org/about/overview.html.en#whyweneedtor">To achieve anonymity via Tor</a>, there’s even more latency added to each packet.</p> <p><a href="http://mumble.sourceforge.net/">Mumble</a> is a non-standard protocol that was originally designed for realtime voice chat for video games. If you’ve ever played Halo or World of Warcraft, this should sound familiar. If not, think of it as a conference call you don’t have to ring. You simply connect to a Mumble server over the Internet and your voice will transmit to everyone else.</p> <p>Mumble clients are available for <a href="https://play.google.com/store/apps/details?id=com.morlunk.mumbleclient&amp;feature=nav_result#?t=W251bGwsMSwxLDMsImNvbS5tb3JsdW5rLm11bWJsZWNsaWVudCJd">Android</a> and <a href="https://itunes.apple.com/us/app/mumble/id443472808?ls=1&amp;mt=8">iOS</a>, as well as a cross-platform desktop client. The server software is also cross-platform. Guardian Project is focusing on the Android client named <a href="https://play.google.com/store/apps/details?id=com.morlunk.mumbleclient&amp;feature=nav_result#?t=W251bGwsMSwxLDMsImNvbS5tb3JsdW5rLm11bWJsZWNsaWVudCJd">Plumble</a> and the official server <a href="https://packages.debian.org/search?keywords=mumble&amp;searchon=names&amp;section=all&amp;suite=squeeze-backports">backported to Debian stable</a>.</p> <p>A cool feature of Mumble is a <a href="https://en.wikipedia.org/wiki/Push-to-talk">Push To Talk</a> (PTT) method to speak to the channel. Your voice is only transmitted when you press the PTT button in the user interface. Another lower level feature that’s important for our anonymity goal is TCP support. For any application to run over Tor, it must use the TCP protocol. This rules out most VoIP clients, since they use UDP. Here is a case where Mumble’s non-standard protocol works to our advantage.</p> <p>When Tor is running and your Mumble client is configured to use TCP, connecting to your local SOCKS5 proxy offered by Tor allows you to join a Mumble server anonymously. The big problem is as suspected, latency. The traffic passing through the Tor network must make <a href="https://www.torproject.org/about/overview.html.en#thesolution">an indeterminate number of proxy hops</a> to be anonymized successfully. Each hop adds more and more latency. This makes a typical syncronous voice call impossible since there’s no way to determine when one person has stopped talking and when the other can respond without interrupting.</p> <p>Latency in human speech transmision has deep psychological impact on a conversation. A <a href="https://sites.google.com/site/qurihara/top-english/speechjammer">Japanese research project called SpeechJammer</a> exploited this part of our senses by inventing a “shut up gun.” When pointed at a person it makes them immediately stop talking. Everyone who has used a cell phone knows the frustration of “echo” where you hear your own voice, slightly delayed. The delay is caused by the network latency of the cellular carrier.</p> <p>Another similar example is a <a href="https://en.wikipedia.org/wiki/Voip">VoIP</a> call on a congested network. The side effect of the latency is that one person accidently interrupts the other person because he thinks the other person has finished talking, when in reality the other person’s voice hasn’t yet arrived at the other end. Interruption ensues, no one is happy nor do they know anything new since the transmission was not understood. High latency makes <a href="https://en.wikipedia.org/wiki/Full-duplex#Full-duplex">full-duplex communication ineffective</a>.</p> <p>The contemporary telephone you are acustomed to allows both sides to talk and listen simultaneously. This is called full-duplex. Early radio telephones like walkie talkies, CB radio or aviation radio are half-duplex systems, meaning that for any given transmission, only one side can talk while the other side listens. Running Mumble over Tor takes a full-duplex technology and effectively reduces it to half-duplex. Even though the protocol is full-duplex, when run through a high latency network like Tor, the transmit and receive channels are so far out of sync there is no point in allowng both sides to talk at once. Again, interruption ensues.</p> <p>Then it hit me. Radio telephones have been around since the turn of the 20th century, when people figured out a reasonable way to do voice chat without the technology causing accidental interruptions in the conversation. In particular, the use of procedure words, or <a href="https://en.wikipedia.org/wiki/Procedure_word">prowords</a>, are essential for one speaker to acknowledge the transmission of the other (Roger), to signify that one party is finished speaking (Over), or indicate when one party has left the conversation (Out).</p> <p>Here in the USA, some prowords evolved into a coloquial language, complete with <a href="https://en.wikipedia.org/wiki/List_of_CB_slang">slang</a> thanks to the Citizen Band radio boom of the 1960s and the truck driving culture that used it to communicate while on the road. The 1977 film <a href="http://www.imdb.com/title/tt0076729/?ref_=sr_1">Smokey and the Bandit</a> is more than just a touching love story with world class actors, it is an amazing dramatization of an information culture that resembled pre-Internet <a href="https://en.wikipedia.org/wiki/Bulletin_board_system">BBS systems</a> and current day <a href="https://en.wikipedia.org/wiki/IRC">Internet Relay Chat (IRC)</a> networks around the globe. The truck drivers portrayed in that movie have a mobile, decentralized information sharing network that is anonymous. The users have pseudonyms and a language of their own. Many of them have never met their CB radio friends IRL. They are invisible companions on the lonely road of the US of A.</p> <p> </p> <p>Old ideas are worth bringing back if they have strong roots. CB and general purpose radio telephones have a long history, unlike the standard the standard of tody, VoIP. Perhaps these features are thought of as obsolete or not cutting-edge enough to model into a digital system. Regardless of the reason, if you are looking for a mobile and open source PTT solution to use on the Internet with anonymity and security, Mumble over Tor is currently the state of the art. All you have to do is throw in some prowords to keep the conversation flowing.</p> <p>The Guardian Project is operating a private Mumble server during a testing phase, and we have plans to open this to the public as part of the <a href="https://guardianproject.info/wiki/OSTN">OSTN research effort</a>. When that happens, I will post application-specific tutorials to install and configure the Plumble client. I will also publish a cookbook to build a Mumble server.</p> <p>Finally, an example transmission log with some prowords:</p> <p><em>Internet</em>: Guardian Project. I have a ping response from your server, over.<br /> <em>GP</em>: Roger Internet. Ping was sent, over.<br /> <em>Internet</em>: Guardian Project. Build anonymous PTT system with open source software, over.<br /> <em>GP</em>: Internet, build anonymous PTT system with open source software, wilco. Out.</p> https://guardianproject.info/2013/01/27/informacam-wins-knight-news-challenge/ Sun, 27 Jan 2013 08:11:56 -0400 https://guardianproject.info/2013/01/27/informacam-wins-knight-news-challenge/ <p>WITNESS and The Guardian Project, the mobile security and app development experts, have just been awarded a Knight News Challenge grant from the John S. and James L. Knight Foundation for <a href="http://salsa.democracyinaction.org/dia/track.jsp?v=2&amp;c=ysa75Vej32Gfc9Nv2xH%2BrBgxT3asKcEO"><strong>InformaCam</strong></a> – the first app seeking to address issues of authentication for digital media. In total, the funding was for ~$320,000 USD, with about one third of the funding going directly to software development and testing. The rest of the funding will be applied to deployment, partnerships, awareness building, and all the other necessary things you must do to turn a “great idea” into something with real adoption and use.</p> <p><img class="alignnone" alt="" src="https://blog.witness.org/wp-content/uploads/2013/01/SC20130104-165859-180x300.png" width="180" height="300" />   <img class="alignnone" alt="" src="https://blog.witness.org/wp-content/uploads/2013/01/SC20130104-170011-180x300.png" width="180" height="300" />  <img class="alignnone" alt="" src="https://blog.witness.org/wp-content/uploads/2013/01/SC20130104-170208-180x300.png" width="180" height="300" /></p> <p>The Knight News Challenge accelerates media innovation by funding breakthrough ideas in news and information. Our project, InformaCam, aims to make it easier for citizen media to be authenticated and used as evidence in a court of law. It allows users to incorporate key metadata in their video file and then to share the encrypted file with a trusted source. This award means we will be able to broaden the scope of people and groups who are using the app – from activists to media and journalists – ultimately making it safer for human rights defenders.</p> <p>Some more about InformaCam from a recent post titled <a href="https://blog.witness.org/2013/01/how-informacam-improves-verification-of-mobile-media-files/">“Is This For Real?”</a> on the WITNESS site:</p> <blockquote> <p>To address those needs we’ve been working on <a href="https://guardianproject.info/apps/informacam/">InformaCam</a>, a mobile app that allows Android devices to take images and videos, embed them with geotemporal and other metadata, sign them with a digital signature unique to the device’s camera censor, encrypt and then send those files to someone they trust who maintains a secure server. Among other elements, the process preserves the <a href="https://en.wikipedia.org/wiki/Chain_of_custody">chain of custody</a> of the media, making it more likely to be admissible in a court of law.</p> <p><img class="alignnone" alt="" src="https://blog.witness.org/wp-content/uploads/2013/01/InformaCam3-1024x504.png" width="614" height="302" /></p> <p>When a user runs InformaCam for the first time, a setup wizard goes through the steps to create a password for the application and how to generate an encryption key based on the unique properties of the camera sensor.  Since every camera has a unique pattern of sensor noise, it’s possible to create a “fingerprint” of the device’s camera.  This key will be used to verify that any piece of media captured using the app and uploaded to the secure server came from this specific camera.</p> </blockquote> <p>As you can see there is quite a bit of math going on, and we look forward to having the members of development community poke, prod, audit, review and ultimately, help us improve our work, and fulfill the promise of this very necessary effort.</p> <p>Please <a href="http://salsa.democracyinaction.org/dia/track.jsp?v=2&amp;c=aM8MVrS9FjrRkk6o0JzdkRgxT3asKcEO">read more about InformaCam on the WITNESS blog</a>, and stay tuned here, on our site, development lists, and all the usual places for more information.</p> https://guardianproject.info/archive/ffmpeg/ Wed, 02 Jan 2013 12:43:43 -0400 https://guardianproject.info/archive/ffmpeg/ <p><a title="ffmpeg" href="http://ffmpeg.org/" target="_blank">ffmpeg</a> is a popular, widespread framework for transcoding and filtering digital videos. On Android, it has a simple Java API. Our version includes filters for redaction and pixelization of video and audio, which we hope will become standard features for any app that supports on device video processing.</p> <p>It has been essential to our apps ObscuraCam, InformaCam, and Murrow/StoryMaker. We are working to make it dead simple for developers to build their own apps on it. We are also extending it to provide a full framework for audio and image redaction, metadata management, and encryption of sensitive parts of the media. This will make it easy for media app developers to build in privacy to their own apps.</p> <p>You can find our code at <a title="Android FFMPEG on Github" href="https://github.com/guardianproject/android-ffmpeg" target="_blank"><a href="https://github.com/guardianproject/android-ffmpeg">https://github.com/guardianproject/android-ffmpeg</a></a></p> https://guardianproject.info/archive/ffmpeg/ Wed, 02 Jan 2013 12:43:43 -0400 https://guardianproject.info/archive/ffmpeg/ <p><a title="ffmpeg" href="http://ffmpeg.org/" target="_blank">ffmpeg</a> is a popular, widespread framework for transcoding and filtering digital videos. On Android, it has a simple Java API. Our version includes filters for redaction and pixelization of video and audio, which we hope will become standard features for any app that supports on device video processing.</p> <p>It has been essential to our apps ObscuraCam, InformaCam, and Murrow/StoryMaker. We are working to make it dead simple for developers to build their own apps on it. We are also extending it to provide a full framework for audio and image redaction, metadata management, and encryption of sensitive parts of the media. This will make it easy for media app developers to build in privacy to their own apps.</p> <p>You can find our code at <a title="Android FFMPEG on Github" href="https://github.com/guardianproject/android-ffmpeg" target="_blank"><a href="https://github.com/guardianproject/android-ffmpeg">https://github.com/guardianproject/android-ffmpeg</a></a></p> https://guardianproject.info/2012/12/10/voice-over-tor/ Mon, 10 Dec 2012 11:00:03 -0400 https://guardianproject.info/2012/12/10/voice-over-tor/ <p><a href="https://guardianproject.info/wp-content/uploads/2012/12/onioncart.jpg"><img class=" wp-image-2968" title="onioncart" src="https://guardianproject.info/wp-content/uploads/2012/12/onioncart.jpg" alt="" width="100%" height="425" srcset="https://guardianproject.info/wp-content/uploads/2012/12/onioncart.jpg 700w, https://guardianproject.info/wp-content/uploads/2012/12/onioncart-300x182.jpg 300w" sizes="(max-width: 700px) 100vw, 700px" /></a></p> <p>Voice calls over <a title="Tor Project" href="https://www.torproject.org/" target="_blank">Tor</a> are supposed to be impossible. It seems this may no longer be the case.</p> <p>Without being able to do voice over IP (VOIP) conversations over the Tor network, people are prevented from being able to route  calls outside of censored networks. People ask us if there is any way they can route voice traffic through Tor to avoid blocks. To our surprise, we tested <a title="skype" href="http://skype.com/" target="_blank">Skype</a> and found that it can work acceptably over <a title="Orbot" href="https://guardianproject.info/apps/orbot/" target="_blank">Orbot</a>.</p> <p>There are two main reasons that it has been held that VOIP will not practically work over the Tor network.</p> <ol> <li>A technical problem with the transport layer that Tor supports.</li> <li>The network is too slow for the latency demands of a real-time voice conversation.</li> </ol> <p>However, it turns out Skype has some pretty robust signaling capabilities such that it works on a variety of network conditions. Also, in practice the latency is more usable then one would have thought. This is good news for the future of VOIP traffic over the Tor network, and not only over Skype.</p> <h1 id="problem-1-transport-protocol"><strong>Problem 1: Transport Protocol</strong></h1> <p>TCP is the most common transport protocol for the Internet. It guarantees reliable communication and is used for nearly everything you do in an Internet browser. UDP is a more relaxed protocol used for real-time communications because it reduces latency. The cost for this is that UDP is not reliable and will occasionally drop traffic. For this reason, it is useful for real-time applications that benefit from lower latency. While dropping packets is never ideal, in a real-time communications it usually doesn’t significant affect the quality and even then the time it would take to re-transmit lost packets with TCP might preclude the data being relevant to the stream anymore.</p> <p>The problem here is that Tor only supports TCP for its transport layer. Meanwhile, VOIP applications use UDP. So they’re not supposed to work over Tor and one of the main difficulties for VOIP users to apply strong anonymity to real-time voice communication.</p> <p>Even if you tunneled UDP traffic through Tor it would be encapsulated in TCP and lose any benefits that UDP provides for real-time traffic. The TCP mechanisms attempt to account for lost packets and hold delivery of future packets until a resend is complete.</p> <p>If you’re interested in learning more about networking, I would highly recommend <a title="Computer Networks by Peterson and Davie" href="http://books.google.com/books/about/Computer_networks.html?id=eftSAAAAMAAJ" target="_blank">Computer Networks by Peterson and Davie.</a> Its takes a practical approach to teaching the technology and avoids strict adherence to the layered model of the Internet. Beyond that, any TCP/IP or Internet technology introductory resource will get you far!</p> <p><strong>Solution: </strong>Here either Tor needs to support UDP or you need a VOIP client that supports TCP. It had been suggested that Skype will fallback to use TCP connections in instances in which the user has UDP traffic blocked. This is not a very uncommon network policy for some Internal networks and reflects Skype’s effort to make their application work in many hostile network conditions (NATs, firewalls, ect.).</p> <h1 id="problem-2-latency"><strong>Problem 2: Latency</strong></h1> <p>Second, Tor relays and mixes its traffic across multiple nodes which greatly increases latency. People generally have pretty high performance expectations for latency over a two-way phone conversation. Adding even a couple of  milliseconds of lag between conversations can be very noticeable to the user. It causes jerks and jumps in the conversation, making it hard to communicate. For this reason, it is likely that widespread routing of voice traffic through Tor is unlikely. However, people already cope with quite a bit of latency using VOIP internationally, and there are very real security and censorship demands that would require VOIP over Tor. In many situations latency will be quite usable. Let’s see how it actually feels over Tor.</p> <p><strong>Solution: </strong></p> <p>The solution here is just accepting the latency. The latency is not ideal but in practice, it is still quite usable. As Tor network performance increases (and one-day supports UDP), real-time communications will begin to have better performance.</p> <h1 id="skype-over-tor"><strong>Skype over Tor</strong></h1> <p>For testing, I used two Nexus One phones running Gingerbread and the latest Skype binary from the Android App Store. Orbot will transparently route traffic through Tor if you use its transproxy features. The transproxy will drop UDP traffic since it can’t be routed through Tor. It is this feature that causes Skype to fallback to TCP and work over Tor.</p> <p>First, I looked at normal Skype traffic leaving the phone. It uses some TCP connections to contact Microsoft servers and authenticate your account. Once you start a voice chat you will see lots of UDP traffic as expected. However, if you turn on Orbots transproxy you will see Skype being forced to start up a conversation using only TCP.</p> <p>Here is a Wireshark screenshot of failed UDP connections to Microsoft servers. I did this by letting the UDP traffic through, logging it, and then dropping it before it left my test environment. So you can see the UDP connections going one way to a variety of IP addresses:</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/12/croppedUDP.png"><img class="aligncenter size-full wp-image-2976" title="croppedUDP" src="https://guardianproject.info/wp-content/uploads/2012/12/croppedUDP.png" alt="" width="100%" srcset="https://guardianproject.info/wp-content/uploads/2012/12/croppedUDP.png 988w, https://guardianproject.info/wp-content/uploads/2012/12/croppedUDP-300x128.png 300w" sizes="(max-width: 988px) 100vw, 988px" /></a></p> <p>We set one of the phones to route through Tor by turning on the transproxy. Then logged into Skype on each phone and placed a call. Skype worked over Tor! We were having a conversation across two IPs from two different ISPs. The latency wasn’t great, but it was surprisingly usable. I’ve included two-packet captures. One should just look like Tor traffic and is a Skype conversation over Tor. The other is an actual log of the dropped UDP packets (I dropped them at an intermediary device rather than using the Transproxy to capture this). In the UDP log set you’ll see a bunch of UDP traffic originating form a single address (the phone) with no return traffic. They UDP traffic was being immediately dropped after the log.</p> <p>It turns out you can have a workable VOIP chat over Tor if you use Skype. The findings are interesting because they are relevant to the general problem of trying to use real-time communication through the Tor network. It may also be useful for VERY specific and limited threat models that involve censorship bypass in which there is little risk in being caught.</p> <p>Here’s to hoping for UDP over Tor in the future. Until then, Guardian Project is working on a design for high latency voice communications. The idea is that you could send quick voice messages with the click of a button similar to how you use an old hand-held radio. We’re toying with names like Push to Torlk and Onion Ringer. Stay tuned!</p> <blockquote> <p>Disclaimer: In my opinion, Skype is not a secure standard for VOIP communication. It uses non-standard closed source encryption and has likely become CALEA compliant upon <a href="http://www.forbes.com/sites/ericjackson/2012/07/22/its-terrifying-and-sickening-that-microsoft-can-now-listen-in-on-all-my-skype-calls/">acquisition</a> by Microsoft. That means that they have infrastructure in place to intercept communications and relay that information to law enforcement agencies around the world. It is unwise to assume that other state and non-state actors would not also have means to access that data.</p> </blockquote> https://guardianproject.info/2012/11/15/proposal-for-secure-connection-notification-on-android/ Thu, 15 Nov 2012 10:07:49 -0400 https://guardianproject.info/2012/11/15/proposal-for-secure-connection-notification-on-android/ <p>A major problem of mobile applications being increasingly used over web-based applications, is that there is no standard established for notifying the user of the state of security on the network connection. With a web browser, the evolution of the “lock” icon when an <a href="https://en.wikipedia.org/wiki/HTTP_Secure">HTTPS connection</a> is made, has been one that evolved originally out of Netscape’s first implementation, to an adhoc, defact industry-standard way of letting the user know if their connection is secure. Beyond just a binary on/off, the lock icon is also the entry point into viewing more information about the digital security tokens, keys and certificates that are powering the connection – who authorized them, who requested them, and so on. More recently, with browsers such as Chrome, there has been the user of color schemes (Green is good, Red is bad), verified domain display and other indicators to help ensure the user knows when to trust their connection, and when to be wary.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/11/Firefox_3_rc1_Extended_Validation_SSL_address_bar_and_certificate_detail.png"><img class="alignnone size-medium wp-image-2952" title="Firefox_3_rc1_Extended_Validation_SSL_address_bar_and_certificate_detail" src="https://guardianproject.info/wp-content/uploads/2012/11/Firefox_3_rc1_Extended_Validation_SSL_address_bar_and_certificate_detail-300x182.png" alt="" width="300" height="182" srcset="https://guardianproject.info/wp-content/uploads/2012/11/Firefox_3_rc1_Extended_Validation_SSL_address_bar_and_certificate_detail-300x182.png 300w, https://guardianproject.info/wp-content/uploads/2012/11/Firefox_3_rc1_Extended_Validation_SSL_address_bar_and_certificate_detail.png 429w" sizes="(max-width: 300px) 100vw, 300px" /><br /> </a> <em>Firefox’s HTTPS certificate display</em></p> <p>While many people claim that HTTPS/TLS/SSL are fundamentally broken, they are still an essential piece of basic frontline security on the web. In addition, when making a connection through a proxy network like Tor or a free VPN service, utilizing TLS/SSL is critical in making sure you network is not being intercepted along the way. The notification icon and related certificate viewing, is a critical component for the user, and one that is entirely missing in the mobile application space. The Android API does not provide a standardized method to share this information with the user, and the implementation on iOS is unclear, as well. Even worse, the proper implementation of a strong HTTP/S connection that properly handles verification of certificates, and provides an interactive option for users to accept or decline is entirely missing for the majority of mobile apps.</p> <p>With that in mind, we have added a Secure Connection Notification feature into our new <a href="https://github.com/guardianproject/OnionKit">OnionKit for Android</a> library. Build upon our previous work on <a href="https://github.com/guardianproject/cacert">implementing custom Root CA Certificate stores for Android</a>, this library not only provides a clear way to enable HTTP and SOCKS proxying for your network requests (to enable use with our app, <a href="https://guardianproject.info/apps/orbot/">Orbot: Tor for Android</a>), but it also includes a <a href="https://github.com/guardianproject/OnionKit/blob/master/library/src/info/guardianproject/onionkit/trust/StrongTrustManager.java">StrongTrustManager</a> and a <a href="https://github.com/guardianproject/OnionKit/blob/master/library/src/info/guardianproject/onionkit/trust/StrongHttpsClient.java">StrongHTTPSClient</a> implementation, that works to defend against man-in-the-middle attacks, and other means to intercept a TLS or SSL connection between a mobile app and a remote server. Part of the defense, is providing a clear indicator to the user when a secure connection is in use.</p> <p>We have provided a <a href="https://github.com/guardianproject/OnionKit/blob/master/sample/src/sample/onionkit/OnionKitSampleActivity.java">sample Android app</a> to demonstrate how simple it is to enable this capability. The screenshots below are from that app.</p> <p>In this first screenshot, the app has connected to <a href="https://check.torproject.org">https://check.torproject.org</a> and you can see in the Notification bar a “key” icon indicating there is a secure connection active.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/11/noTor.png"><img class="size-medium wp-image-2947 alignnone" title="noTor" src="https://guardianproject.info/wp-content/uploads/2012/11/noTor-254x300.png" alt="" width="254" height="300" srcset="https://guardianproject.info/wp-content/uploads/2012/11/noTor-254x300.png 254w, https://guardianproject.info/wp-content/uploads/2012/11/noTor.png 800w" sizes="(max-width: 254px) 100vw, 254px" /></a></p> <p>When you drag the notification bar down, you can see a more complete view of the Secure Connection Notification (SCN) message, which indicates the connection is Active and shows a summary of the secure certificate information. In a recent update to the OnionKit SCN code, it also allows for the application to include its name and icon in this notification.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/11/device-2012-11-08-204130.png"><img class="alignnone size-medium wp-image-2948" title="device-2012-11-08-204130" src="https://guardianproject.info/wp-content/uploads/2012/11/device-2012-11-08-204130-300x139.png" alt="" width="300" height="139" srcset="https://guardianproject.info/wp-content/uploads/2012/11/device-2012-11-08-204130-300x139.png 300w, https://guardianproject.info/wp-content/uploads/2012/11/device-2012-11-08-204130.png 800w" sizes="(max-width: 300px) 100vw, 300px" /></a></p> <p>Finally, you can tap on the SCN notification and bring up a larger pop-over view of the certificate information. We intend to develop this view further, to allow for better manual management of trust – meaning you may have the option to accept/decline or disable trust of this certificate or the certificate authority that provides it.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/11/device-2012-11-08-203216.png"><img class="alignnone size-medium wp-image-2949" title="device-2012-11-08-203216" src="https://guardianproject.info/wp-content/uploads/2012/11/device-2012-11-08-203216-300x222.png" alt="" width="300" height="222" srcset="https://guardianproject.info/wp-content/uploads/2012/11/device-2012-11-08-203216-300x222.png 300w, https://guardianproject.info/wp-content/uploads/2012/11/device-2012-11-08-203216.png 800w" sizes="(max-width: 300px) 100vw, 300px" /></a></p> <p>Beyond “Active” messages, the notification system will also warn or block connections that are deemed risky, invalid or otherwise unverifiable. You can use OnionKit in concert with the <a href="https://github.com/ge0rg/MemorizingTrustManager">MemorizingTrustManager</a> to manually override this verification process, if your application is expected to often connect to servers with unverifiable certificates. Finally, using our <a href="https://github.com/guardianproject/cacert">CACert project</a>, you can generate custom Root CA stores for use with OnionKit, that utilize your own certificate authorities, or a custom rolled set.</p> <p>Our goal is not to overwhelm the user, but instead to provide them a simple notification so they can understand which applications have their best interests in mind, and which do not. It is amazing how many popular mobile apps transmit personal information using HTTP completely in plain text, in the clear, allowing any number of parties along the network path between the device and server to passively vacuum up this data. Users generally are not aware or do not care about this issue. It is up to the mobile application developer, to adopt an approach like our Secure Connection Notification, or to directly utilize our OnionKit library itself.</p> <p>Finally, we would like to see Android and other mobile operating systems, adopt a system such as this device-wide, such that it becomes as standard as the desktop web browser HTTPS lock.</p> <p>If you are a developer, please check out OnionKit for Android today, and let us know what you think: <a href="https://github.com/guardianproject/OnionKit/">https://github.com/guardianproject/OnionKit/</a></p> https://guardianproject.info/2012/10/26/orbot-v11-is-out/ Fri, 26 Oct 2012 06:37:23 -0400 https://guardianproject.info/2012/10/26/orbot-v11-is-out/ <p>After previous fits and starts, we’ve stabilized Orbot v11 now with the RC6 release. Our core testers and public users via the Google Play distribution are back to happy and stable states of being.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/10/orbotv11.png"><img class="alignleft wp-image-2910" style="margin-left: 3px; margin-right: 3px;" title="orbotv11" src="https://guardianproject.info/wp-content/uploads/2012/10/orbotv11-168x300.png" alt="" width="131" height="234" srcset="https://guardianproject.info/wp-content/uploads/2012/10/orbotv11-168x300.png 168w, https://guardianproject.info/wp-content/uploads/2012/10/orbotv11-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2012/10/orbotv11.png 720w" sizes="(max-width: 131px) 100vw, 131px" /></a></p> <p>The latest version can be found:</p> <p>1) In Google Play:<br /> <a href="https://play.google.com/store/apps/details?id=org.torproject.android">https://play.google.com/store/apps/details?id=org.torproject.android</a></p> <p>2) In our F-Droid repo:<br /> <a href="https://guardianproject.info/2012/03/15/our-new-f-droid-app-repository/">https://guardianproject.info/2012/03/15/our-new-f-droid-app-repository/</a></p> <p>3) Our via direct APK here:<br /> <a href="https://guardianproject.info/releases/Orbot-release-0.2.3.23-rc-1.0.11-RC6.apk">https://guardianproject.info/releases/Orbot-release-0.2.3.23-rc-1.0.11-RC6.apk</a><br /> (.asc)</p> <p>As always you can file bugs on <a href="https://trac.torproject.org">trac.torproject.org</a> or the guardian<br /> tracker: <a href="https://dev.guardianproject.info/projects/orbot/issues/new">https://dev.guardianproject.info/projects/orbot/issues/new</a></p> <p>A few things I learned during this latest Orbot effort:</p> <p>– 0.2.4.<em>-alpha is not stable yet on Android, causing a variety of to-be-debugged issues. Based on that, we rolled back to 0.2.3.23-RC<br /> for this release. We may still do a final/stable v11 release once Tor 0.2.3.</em> is declared stable.</p> <p>– Android has a “Strict Mode” feature that can sometimes cause halts, exits at various points based on certain types of undesirable behaviour, like accessing the network on a main thread. The new up/down data stats inadvertently accessed the localhost Tor control port on the main thread. Most devices just have it set to log a warning to the debug output, but on a few devices it made things go boom.</p> <p>– We needed to rewrite our iptables rules quite a bit to use a separate user defined chain “ORBOT” with a jump point in OUTPUT chain. This allows us to easily flush all ORBOT rules. We realized this was necessary because as some devices switch between 3G and wifi connections, iptables rules are reapplied automatically causing multiple instances of the same rule. Only a flush can clear all of instances of these out easily. Second, we can’t do a global iptables –flush because it not only removes some rules set by other apps, it also appears to knock out internet connectivity/routing completely on some newer devices, based on some required default rules that are in place.</p> <p>– With the increasing bountiful diversity of Android devices, firmwares and operating system versions, it continues to be a burden to solve all issues for all people. However, most of the issues are related to our “root” and transproxy features, and not the core Orbot app features or bundled Tor binary. We are eager to move to a<br /> user-defined/soft VPN model to support transparent proxying in the v12 release, and move away from utilizing root in any manner.</p> <p>That’s all for now.</p> https://guardianproject.info/archive/ostel/ Thu, 04 Oct 2012 12:29:35 -0400 https://guardianproject.info/archive/ostel/ <p><span style="font-size: 15px; font-weight: bold; clear: left;"><a href="https://ostel.co"><img class="alignleft size-thumbnail wp-image-1013" style="margin-left: 3px; margin-right: 3px; border: 0px initial initial;" title="Ostel" src="https://guardianproject.info/wp-content/uploads/2010/02/ostn256x256.png" alt="" width="72" height="72" /></a><a href="https://ostel.co">Ostel</a>: Encrypted Phone Calls</span><br /> A tool for having end-to-end encrypted phone calls. This is a public testbed of the Open Secure Telephony Network (OSTN) project, with the goal of promoting the use of free, open protocols, standards and software, to power end-to-end secure voice communications on mobile devices, as well as with desktop computers.</p> <ul> <li><strong>August 2017: Ostel is permanently offline. Learn more here: <a href="https://guardianproject.info/2017/08/10/ostel.co-is-permanently-offline/">https://guardianproject.info/2017/08/10/ostel.co-is-permanently-offline/</a></strong></li> <li>**<a href="https://guardianproject.info/wiki/OSTN">Open Secure Telephony </a></li> <li><strong><a href="https://dev.guardianproject.info/projects/ostel/wiki">Find out more on our Wiki</a>.</strong></li> <li><strong><a href="https://ostel.co/about">Download a supported app (Android, iPhone, Blackberry, Nokia, Windows, Mac OS X, GNU/Linux)</a>.</strong></li> <li><strong><a href="https://guardianproject.info/wiki/Ostel">Setup your App</a>.</strong></li> <li><a href="https://github.com/guardianproject/OSTel">View the source code</a>.</li> </ul> https://guardianproject.info/archive/ostel/ Thu, 04 Oct 2012 12:29:35 -0400 https://guardianproject.info/archive/ostel/ <p><span style="font-size: 15px; font-weight: bold; clear: left;"><a href="https://ostel.co"><img class="alignleft size-thumbnail wp-image-1013" style="margin-left: 3px; margin-right: 3px; border: 0px initial initial;" title="Ostel" src="https://guardianproject.info/wp-content/uploads/2010/02/ostn256x256.png" alt="" width="72" height="72" /></a><a href="https://ostel.co">Ostel</a>: Encrypted Phone Calls</span><br /> A tool for having end-to-end encrypted phone calls. This is a public testbed of the Open Secure Telephony Network (OSTN) project, with the goal of promoting the use of free, open protocols, standards and software, to power end-to-end secure voice communications on mobile devices, as well as with desktop computers.</p> <ul> <li><strong>August 2017: Ostel is permanently offline. Learn more here: <a href="https://guardianproject.info/2017/08/10/ostel.co-is-permanently-offline/">https://guardianproject.info/2017/08/10/ostel.co-is-permanently-offline/</a></strong></li> <li>**<a href="https://guardianproject.info/wiki/OSTN">Open Secure Telephony </a></li> <li><strong><a href="https://dev.guardianproject.info/projects/ostel/wiki">Find out more on our Wiki</a>.</strong></li> <li><strong><a href="https://ostel.co/about">Download a supported app (Android, iPhone, Blackberry, Nokia, Windows, Mac OS X, GNU/Linux)</a>.</strong></li> <li><strong><a href="https://guardianproject.info/wiki/Ostel">Setup your App</a>.</strong></li> <li><a href="https://github.com/guardianproject/OSTel">View the source code</a>.</li> </ul> https://guardianproject.info/archive/developersquare/ Thu, 04 Oct 2012 00:42:29 -0400 https://guardianproject.info/archive/developersquare/ <h1 id="no-longer-maintained">NO LONGER MAINTAINED</h1> <p><br/></p> <div class="source-code" style="text-align: center;"> <a href="https://github.com//DevSqNet/DevSq" target="_blank" title="DevSq on Github"> <i class="fa fa-github"></i> GitHub </a> </div> <p><img class="alignnone" src="https://raw.githubusercontent.com/DevSqNet/DevSq/master/img/devsq_logo_sm.png" alt="" width="430" height="54" /></p> <p>Developer Square is our public community site for sharing, discussing, connect and learning. The main DevSq.net page offers an index of the content and resources we are promoting and sharing, while the “Talk” site (<a href="https://talk.developersquare.net">https://talk.developersquare.net</a>) is a full fledged community discussion site focused on open-source, mobile app development.</p> https://guardianproject.info/archive/developersquare/ Thu, 04 Oct 2012 00:42:29 -0400 https://guardianproject.info/archive/developersquare/ <h1 id="no-longer-maintained">NO LONGER MAINTAINED</h1> <p><br/></p> <div class="source-code" style="text-align: center;"> <a href="https://github.com//DevSqNet/DevSq" target="_blank" title="DevSq on Github"> <i class="fa fa-github"></i> GitHub </a> </div> <p><img class="alignnone" src="https://raw.githubusercontent.com/DevSqNet/DevSq/master/img/devsq_logo_sm.png" alt="" width="430" height="54" /></p> <p>Developer Square is our public community site for sharing, discussing, connect and learning. The main DevSq.net page offers an index of the content and resources we are promoting and sharing, while the “Talk” site (<a href="https://talk.developersquare.net">https://talk.developersquare.net</a>) is a full fledged community discussion site focused on open-source, mobile app development.</p> https://guardianproject.info/archive/gnupg/ Thu, 04 Oct 2012 00:42:29 -0400 https://guardianproject.info/archive/gnupg/ <h1 id="no-longer-maintained">NO LONGER MAINTAINED</h1> <p><br/><br/></p> <p>This project is <strong>UNMAINTAINED</strong>, we recommend <a href="https://www.openkeychain.org/">OpenKeychain</a> instead. The core porting work has all be included upstream in the official <a href="https://gnupg.org" target="_blank">GnuPG</a> source repositories. The Android app needs a new maintainer. This could be you! Email us at <a href="&#109;&#x61;&#105;&#x6c;t&#x6f;:&#x73;u&#x70;p&#x6f;r&#x74;&#64;&#103;&#x75;&#97;&#x72;&#100;&#x69;a&#x6e;p&#x72;o&#x6a;e&#x63;t&#x2e;i&#110;&#x66;&#111;" target="_blank">s&#117;&#x70;&#x70;o&#114;&#x74;&#x40;g&#117;&#x61;&#x72;d&#105;&#x61;&#x6e;p&#114;&#x6f;&#x6a;e&#99;&#x74;&#x2e;i&#110;&#x66;&#x6f;</a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2013/05/icon.png"><img src="https://guardianproject.info/wp-content/uploads/2013/05/icon-150x150.png" alt="GnuPG for Android" width="150" height="150" class="alignleft size-thumbnail wp-image-3680" srcset="https://guardianproject.info/wp-content/uploads/2013/05/icon-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2013/05/icon-300x300.png 300w, https://guardianproject.info/wp-content/uploads/2013/05/icon.png 512w" sizes="(max-width: 150px) 100vw, 150px" /></a>Gnu Privacy Guard (GnuPG) for Android brings the widespread standard in OpenPGP encryption to Android. GnuPG provides solid encryption for keeping emails and files private, and for verifying that emails and files are who you think they are. GnuPG is built-in to basically every GNU/Linux distro, in <a href="https://gpgtools.org/" target="_blank">GPGTools</a> for Mac OS X and Apple Mail, a <a href="https://gpg4win.org/" target="_blank">GPG4Win</a> for Windows and Outlook, <a href="https://www.enigmail.net/" target="_blank">Enigmail</a> for Thunderbird, etc. We are working to bring GnuPG to Android to make it the cornerstone of Android encryption like it is elsewhere.</p> <p>We are actively working on an API so that developers can easily embed this into any app to give it state of the art security features. We’re also building a graphical user interface for easy key management. You can <a href="https://dev.guardianproject.info/projects/gpgandroid/wiki/API_Sketch" target="_blank">follow our progress on our wiki</a>.</p> <h3 id="command-line-usage">Command Line Usage</h3> <p>If you want to use the command line, the easiest way to get started with GPG is to install Android Terminal Emulator. GPG will automatically configure Android Terminal Emulator as long as you have the &ldquo;<em>Allow PATH extensions</em>&rdquo; settings enabled. Get the <a href="https://play.google.com/store/apps/details?id=jackpal.androidterm" target="_blank">Android Terminal Emulator</a>.</p> <h3 id="source">Source</h3> <ul> <li>full source: <a href="https://github.com/guardianproject/gnupg-for-android" target="_blank"><a href="https://github.com/guardianproject/gnupg-for-android">https://github.com/guardianproject/gnupg-for-android</a></a></li> </ul> https://guardianproject.info/archive/gnupg/ Thu, 04 Oct 2012 00:42:29 -0400 https://guardianproject.info/archive/gnupg/ <h1 id="no-longer-maintained">NO LONGER MAINTAINED</h1> <p><br/><br/></p> <p>This project is <strong>UNMAINTAINED</strong>, we recommend <a href="https://www.openkeychain.org/">OpenKeychain</a> instead. The core porting work has all be included upstream in the official <a href="https://gnupg.org" target="_blank">GnuPG</a> source repositories. The Android app needs a new maintainer. This could be you! Email us at <a href="&#109;&#x61;&#105;&#x6c;t&#x6f;:&#x73;u&#x70;p&#x6f;r&#x74;&#64;&#103;&#x75;&#97;&#x72;&#100;&#x69;a&#x6e;p&#x72;o&#x6a;e&#x63;t&#x2e;i&#110;&#x66;&#111;" target="_blank">s&#117;&#x70;&#x70;o&#114;&#x74;&#x40;g&#117;&#x61;&#x72;d&#105;&#x61;&#x6e;p&#114;&#x6f;&#x6a;e&#99;&#x74;&#x2e;i&#110;&#x66;&#x6f;</a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2013/05/icon.png"><img src="https://guardianproject.info/wp-content/uploads/2013/05/icon-150x150.png" alt="GnuPG for Android" width="150" height="150" class="alignleft size-thumbnail wp-image-3680" srcset="https://guardianproject.info/wp-content/uploads/2013/05/icon-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2013/05/icon-300x300.png 300w, https://guardianproject.info/wp-content/uploads/2013/05/icon.png 512w" sizes="(max-width: 150px) 100vw, 150px" /></a>Gnu Privacy Guard (GnuPG) for Android brings the widespread standard in OpenPGP encryption to Android. GnuPG provides solid encryption for keeping emails and files private, and for verifying that emails and files are who you think they are. GnuPG is built-in to basically every GNU/Linux distro, in <a href="https://gpgtools.org/" target="_blank">GPGTools</a> for Mac OS X and Apple Mail, a <a href="https://gpg4win.org/" target="_blank">GPG4Win</a> for Windows and Outlook, <a href="https://www.enigmail.net/" target="_blank">Enigmail</a> for Thunderbird, etc. We are working to bring GnuPG to Android to make it the cornerstone of Android encryption like it is elsewhere.</p> <p>We are actively working on an API so that developers can easily embed this into any app to give it state of the art security features. We’re also building a graphical user interface for easy key management. You can <a href="https://dev.guardianproject.info/projects/gpgandroid/wiki/API_Sketch" target="_blank">follow our progress on our wiki</a>.</p> <h3 id="command-line-usage">Command Line Usage</h3> <p>If you want to use the command line, the easiest way to get started with GPG is to install Android Terminal Emulator. GPG will automatically configure Android Terminal Emulator as long as you have the &ldquo;<em>Allow PATH extensions</em>&rdquo; settings enabled. Get the <a href="https://play.google.com/store/apps/details?id=jackpal.androidterm" target="_blank">Android Terminal Emulator</a>.</p> <h3 id="source">Source</h3> <ul> <li>full source: <a href="https://github.com/guardianproject/gnupg-for-android" target="_blank"><a href="https://github.com/guardianproject/gnupg-for-android">https://github.com/guardianproject/gnupg-for-android</a></a></li> </ul> https://guardianproject.info/code/iocipher/ Thu, 04 Oct 2012 00:39:12 -0400 https://guardianproject.info/code/iocipher/ <p><img class="alignleft size-thumbnail wp-image-3079" alt="alberti cipher disk" src="https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk-150x150.jpg" width="150" height="150" srcset="https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk.jpg 245w" sizes="(max-width: 150px) 100vw, 150px" /></p> <div class="source-code" style="text-align: center;"> <a href="https://gitlab.com/guardianproject/IOCipher" target="_blank" title="IOCipher on Gitlab"> <i class="fa fa-gitlab"></i> GitLab </a> - <a href="https://github.com/guardianproject/IOCipher" target="_blank" title="IOCipher on Github"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.github.io/IOCipher" target="_blank" title="IOCipher javadoc"> Javadoc </a> - <a href="https://guardianproject.info/tags/iocipher" target="_blank" title="IOCipher blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /> <p>IOCipher provides a virtual encrypted disk for Android apps without requiring the device to be rooted. It uses a clone of the standard <code>java.io</code> API for working with files, so developers already know how to use it. Only password handling, and opening the virtual disk are what stand between the developer and working encrypted file storage. It is based on and <a href="https://www.zetetic.net/sqlcipher/" target="_blank">SQLCipher</a>, and designed to work with <a href="https://guardianproject.info/code/cacheword" target="_blank">CacheWord</a> for handling the keys and passwords.</p> <p>IOCipher is ultimately based on transactions in SQLite, which means that it does not require being mounted in the normal sense. There is no open state once a transaction is complete. Each read or write operation is a self-contained SQLite transaction, so if the file system is forcably quit, SQLite&rsquo;s transactions prevent the whole file system from being corrupted. This is important in Android since an <code>Activity</code> or <code>Service</code> can be killed at any moment without warning.</p> <p>IOCipher is a cousin to <a href="https://www.zetetic.net/sqlcipher/sqlcipher-for-android/" target="_blank">SQLCipher-for-Android</a> since it is also based on SQLCipher and uses the same approach of repurposing an API that developers already know well. It is built on top of <a title="libsqlfs git repo" href="https://github.com/guardianproject/libsqlfs" target="_blank">libsqlfs</a>, a filesystem implemented in SQL that exposes a FUSE API.</p> <h2 id="features">Features</h2> <ul> <li>Secure transparent app-level <strong>virtual encrypted disk</strong></li> <li><strong>No root</strong> required</li> <li>Only <strong>three new methods</strong> to learn: <code>VirtualFileSystem.get()</code>, <code>VirtualFileSystem.mount(dbFile, password)</code>, and <code>VirtualFileSystem.unmount()</code></li> <li>Supports Android versions <strong>2.3 and above</strong></li> <li>Licensed under the <strong>LGPL v3+</strong></li> </ul> <h2 id="adding-iocipher-to-your-app">Adding IOCipher to your App</h2> <p>Here are the things you need to do in your code to make it use IOCipher encrypted storage for all of your app&rsquo;s file storage:</p> <ol> <li>manage the password using Cacheword or whatever works for you</li> <li>get the VFS singleton using <code>VirtualFileSystem.get()</code></li> <li>on first run, create the container file with a password using <code>VirtualFileSystem.createNewContainer(dbFile, password)</code></li> <li>mount the container file with a password using <code>VirtualFileSystem.mount(dbFile, password)</code></li> <li>replace the relevant <code>java.io</code> import statements with <code>info.guardianproject.iocipher</code>, e.g.: <pre>import info.guardianproject.iocipher.File; import info.guardianproject.iocipher.FileOutputStream; import info.guardianproject.iocipher.FileReader; import info.guardianproject.iocipher.IOCipherFileChannel; import info.guardianproject.iocipher.VirtualFileSystem; import java.io.FileNotFoundException; import java.io.IOException; import java.io.InputStream; import java.nio.channels.Channels; import java.nio.channels.ReadableByteChannel; </pre></li> </ol> <p>For more detailed examples, see <a href="https://github.com/guardianproject/IOCipherExample" target="_blank">IOCipherExample</a>, <a href="https://github.com/guardianproject/IOCipherThreadTest" target="_blank">IOCipherThreadTest</a>, and <a href="https://github.com/guardianproject/IOCipherTests" target="_blank">IOCipherTests</a>. To start from scratch, follow <a href="https://www.zetetic.net/sqlcipher/sqlcipher-for-android/" title="SQLCipher for Android Application Integration" target="_blank">the instructions on starting with SQLCipher-for-Android</a>, then download IOCipher and add it to the <code>libs/</code> folder of that new project.</p> <h2 id="downloads">Downloads</h2> <div class="gradle-line"> <p> For gradle projects, use one of these lines. The quickest way to get started is to use the standalone package that includes SQLCipher in it. </p> <pre> implementation &#39;info.guardianproject.iocipher:IOCipherStandalone:0.5@aar&#39; </pre> <p> If your project already includes SQLCipher, then use the release that contains only IOCipher. </p> <pre> implementation &#39;info.guardianproject.iocipher:IOCipher:0.5@aar&#39; implementation 'net.zetetic:android-database-sqlcipher:4.2.0@aar' </pre> <p>Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:</p> <ul> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/iocipher/IOCipher/0.5/IOCipherStandalone-0.5.aar">IOCipherStandalone-0.5.aar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/iocipher/IOCipher/0.5/IOCipherStandalone-0.5.aar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/iocipher/IOCipher/0.5/IOCipher-0.5.aar">IOCipher-0.5.aar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/iocipher/IOCipher/0.5/IOCipher-0.5.aar.asc"><i>PGP signature</i></a>)</li> </ul> </div> <h2 id="source-code">Source Code</h2> <ul> <li>all you need for your project: <a href="https://github.com/guardianproject/IOCipher">https://github.com/guardianproject/IOCipher</a></li> </ul> <h3 id="optional">optional:</h3> <ul> <li>the test suite: <a href="https://github.com/guardianproject/IOCipherTests">https://github.com/guardianproject/IOCipherTests</a></li> <li>a simple example file manager app: <a href="https://github.com/guardianproject/IOCipherExample">https://github.com/guardianproject/IOCipherExample</a></li> <li>a very simple test app: <a href="https://github.com/guardianproject/IOCipherThreadTest">https://github.com/guardianproject/IOCipherThreadTest</a></li> <li>the core: <a href="https://github.com/guardianproject/libsqlfs">https://github.com/guardianproject/libsqlfs</a></li> </ul> <h2 id="usage-notes">Usage notes</h2> <ul> <li>only one active mount per-app is supported</li> <li>single thread/sequential access is the preferred way of using IOCipher</li> <li>multi-threaded access possible (<em>potentially unstable under extremely high write load</em>)</li> <li>VFS now has beginTransaction and completeTransaction to optimize performance</li> <li>parts of java.io not currently supported: vectored I/O, memory-mapped files</li> </ul> <h2 id="reporting-bugs">Reporting Bugs</h2> <p>Please report any bugs or issues that you have with this library! We want to hear from you. Help us improve this software by filing bug reports about any problem that you encounter. Feature requests and patches are also welcome!</p> <h2 id="known-issues">Known Issues</h2> <ul> <li>files cannot currently be larger than 4GB (<a href="https://dev.guardianproject.info/issues/3624" target="_blank">#3624</a>)</li> <li>no users, groups, or permissions implemented</li> <li>crashes possible under <em>extremely</em> heavy, concurrent load (<a href="https://dev.guardianproject.info/issues/522" target="_blank">#522</a>)</li> <li><a title="existing IOCipher issues" href="https://dev.guardianproject.info/projects/iocipher/issues" target="_blank">View all open issues</a></li> </ul> https://guardianproject.info/code/iocipher/ Thu, 04 Oct 2012 00:39:12 -0400 https://guardianproject.info/code/iocipher/ <p><img class="alignleft size-thumbnail wp-image-3079" alt="alberti cipher disk" src="https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk-150x150.jpg" width="150" height="150" srcset="https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2012/10/alberti_cipher_disk.jpg 245w" sizes="(max-width: 150px) 100vw, 150px" /></p> <div class="source-code" style="text-align: center;"> <a href="https://gitlab.com/guardianproject/IOCipher" target="_blank" title="IOCipher on Gitlab"> <i class="fa fa-gitlab"></i> GitLab </a> - <a href="https://github.com/guardianproject/IOCipher" target="_blank" title="IOCipher on Github"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.github.io/IOCipher" target="_blank" title="IOCipher javadoc"> Javadoc </a> - <a href="https://guardianproject.info/tags/iocipher" target="_blank" title="IOCipher blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /> <p>IOCipher provides a virtual encrypted disk for Android apps without requiring the device to be rooted. It uses a clone of the standard <code>java.io</code> API for working with files, so developers already know how to use it. Only password handling, and opening the virtual disk are what stand between the developer and working encrypted file storage. It is based on and <a href="https://www.zetetic.net/sqlcipher/" target="_blank">SQLCipher</a>, and designed to work with <a href="https://guardianproject.info/code/cacheword" target="_blank">CacheWord</a> for handling the keys and passwords.</p> <p>IOCipher is ultimately based on transactions in SQLite, which means that it does not require being mounted in the normal sense. There is no open state once a transaction is complete. Each read or write operation is a self-contained SQLite transaction, so if the file system is forcably quit, SQLite&rsquo;s transactions prevent the whole file system from being corrupted. This is important in Android since an <code>Activity</code> or <code>Service</code> can be killed at any moment without warning.</p> <p>IOCipher is a cousin to <a href="https://www.zetetic.net/sqlcipher/sqlcipher-for-android/" target="_blank">SQLCipher-for-Android</a> since it is also based on SQLCipher and uses the same approach of repurposing an API that developers already know well. It is built on top of <a title="libsqlfs git repo" href="https://github.com/guardianproject/libsqlfs" target="_blank">libsqlfs</a>, a filesystem implemented in SQL that exposes a FUSE API.</p> <h2 id="features">Features</h2> <ul> <li>Secure transparent app-level <strong>virtual encrypted disk</strong></li> <li><strong>No root</strong> required</li> <li>Only <strong>three new methods</strong> to learn: <code>VirtualFileSystem.get()</code>, <code>VirtualFileSystem.mount(dbFile, password)</code>, and <code>VirtualFileSystem.unmount()</code></li> <li>Supports Android versions <strong>2.3 and above</strong></li> <li>Licensed under the <strong>LGPL v3+</strong></li> </ul> <h2 id="adding-iocipher-to-your-app">Adding IOCipher to your App</h2> <p>Here are the things you need to do in your code to make it use IOCipher encrypted storage for all of your app&rsquo;s file storage:</p> <ol> <li>manage the password using Cacheword or whatever works for you</li> <li>get the VFS singleton using <code>VirtualFileSystem.get()</code></li> <li>on first run, create the container file with a password using <code>VirtualFileSystem.createNewContainer(dbFile, password)</code></li> <li>mount the container file with a password using <code>VirtualFileSystem.mount(dbFile, password)</code></li> <li>replace the relevant <code>java.io</code> import statements with <code>info.guardianproject.iocipher</code>, e.g.: <pre>import info.guardianproject.iocipher.File; import info.guardianproject.iocipher.FileOutputStream; import info.guardianproject.iocipher.FileReader; import info.guardianproject.iocipher.IOCipherFileChannel; import info.guardianproject.iocipher.VirtualFileSystem; import java.io.FileNotFoundException; import java.io.IOException; import java.io.InputStream; import java.nio.channels.Channels; import java.nio.channels.ReadableByteChannel; </pre></li> </ol> <p>For more detailed examples, see <a href="https://github.com/guardianproject/IOCipherExample" target="_blank">IOCipherExample</a>, <a href="https://github.com/guardianproject/IOCipherThreadTest" target="_blank">IOCipherThreadTest</a>, and <a href="https://github.com/guardianproject/IOCipherTests" target="_blank">IOCipherTests</a>. To start from scratch, follow <a href="https://www.zetetic.net/sqlcipher/sqlcipher-for-android/" title="SQLCipher for Android Application Integration" target="_blank">the instructions on starting with SQLCipher-for-Android</a>, then download IOCipher and add it to the <code>libs/</code> folder of that new project.</p> <h2 id="downloads">Downloads</h2> <div class="gradle-line"> <p> For gradle projects, use one of these lines. The quickest way to get started is to use the standalone package that includes SQLCipher in it. </p> <pre> implementation &#39;info.guardianproject.iocipher:IOCipherStandalone:0.5@aar&#39; </pre> <p> If your project already includes SQLCipher, then use the release that contains only IOCipher. </p> <pre> implementation &#39;info.guardianproject.iocipher:IOCipher:0.5@aar&#39; implementation 'net.zetetic:android-database-sqlcipher:4.2.0@aar' </pre> <p>Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:</p> <ul> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/iocipher/IOCipher/0.5/IOCipherStandalone-0.5.aar">IOCipherStandalone-0.5.aar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/iocipher/IOCipher/0.5/IOCipherStandalone-0.5.aar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/iocipher/IOCipher/0.5/IOCipher-0.5.aar">IOCipher-0.5.aar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/iocipher/IOCipher/0.5/IOCipher-0.5.aar.asc"><i>PGP signature</i></a>)</li> </ul> </div> <h2 id="source-code">Source Code</h2> <ul> <li>all you need for your project: <a href="https://github.com/guardianproject/IOCipher">https://github.com/guardianproject/IOCipher</a></li> </ul> <h3 id="optional">optional:</h3> <ul> <li>the test suite: <a href="https://github.com/guardianproject/IOCipherTests">https://github.com/guardianproject/IOCipherTests</a></li> <li>a simple example file manager app: <a href="https://github.com/guardianproject/IOCipherExample">https://github.com/guardianproject/IOCipherExample</a></li> <li>a very simple test app: <a href="https://github.com/guardianproject/IOCipherThreadTest">https://github.com/guardianproject/IOCipherThreadTest</a></li> <li>the core: <a href="https://github.com/guardianproject/libsqlfs">https://github.com/guardianproject/libsqlfs</a></li> </ul> <h2 id="usage-notes">Usage notes</h2> <ul> <li>only one active mount per-app is supported</li> <li>single thread/sequential access is the preferred way of using IOCipher</li> <li>multi-threaded access possible (<em>potentially unstable under extremely high write load</em>)</li> <li>VFS now has beginTransaction and completeTransaction to optimize performance</li> <li>parts of java.io not currently supported: vectored I/O, memory-mapped files</li> </ul> <h2 id="reporting-bugs">Reporting Bugs</h2> <p>Please report any bugs or issues that you have with this library! We want to hear from you. Help us improve this software by filing bug reports about any problem that you encounter. Feature requests and patches are also welcome!</p> <h2 id="known-issues">Known Issues</h2> <ul> <li>files cannot currently be larger than 4GB (<a href="https://dev.guardianproject.info/issues/3624" target="_blank">#3624</a>)</li> <li>no users, groups, or permissions implemented</li> <li>crashes possible under <em>extremely</em> heavy, concurrent load (<a href="https://dev.guardianproject.info/issues/522" target="_blank">#522</a>)</li> <li><a title="existing IOCipher issues" href="https://dev.guardianproject.info/projects/iocipher/issues" target="_blank">View all open issues</a></li> </ul> https://guardianproject.info/2012/09/20/tofu/pop-in-your-android-app-a.k.a.-extending-orlib-to-communicate-over-tor/ Thu, 20 Sep 2012 15:17:36 -0400 https://guardianproject.info/2012/09/20/tofu/pop-in-your-android-app-a.k.a.-extending-orlib-to-communicate-over-tor/ <p>In doing my research for InformaCam, I learned a couple of neat tricks for getting an app to communicate over Tor. Here’s a how-to for app developers to use depending on your threat model, and how you have your web server set-up. Enjoy, and please post your comments/questions/suggestions below…</p> <h2 id="before-we-begin">Before we begin…</h2> <p>You’re going to need some basic stuff up-and-running for this to work. Before you get coding, make sure you have the following:</p> <p><strong>Your Android device should have:</strong></p> <ul> <li>Orbot downloaded and running</li> <li>An encrypted data store to save keys, certificates, and addresses to, such as Guardian Project’s <a href="https://github.com/guardianproject/sqlcipher-android" target="_blank">SQLCipher</a> or <a href="https://github.com/guardianproject/IOCipher" target="_blank">IOCipher</a>. (SQLCipher is a database; if you want to have records for each hidden service such as “Onion Address,” “Certificate,” “Display Name,” etc. this is the model you can use. IOCipher is used like an encrypted java.io.File partition; you could easily store certificates in a java keystore with a .jks extension, and save a text file with a list of onion addresses. However you manage your backend is up to you.)</li> </ul> <p><strong>Your server should have:</strong></p> <ul> <li>A lightweight web server. According to the Tor documentation, smaller servers like LightTPD are preferred over Apache since there’s less of an opportunity to accidentally reveal your IP address in error logs or publicly-accessible config files.</li> <li>Tor set up and running a hidden service</li> <li>Your own self-signed SSL certificate for your server. (Directions can be found <a href="http://www.digicert.com/ssl-certificate-installation-lighttpd.htm" target="_blank">here</a>)</li> <li><em>For extra credit,</em> you can set yourself up your own certificate authority. This can be used to sign client authentication keys (how you distribute them to users is also up to you) and directions to do this can be found <a href="http://it.toolbox.com/blogs/securitymonkey/howto-securing-a-website-with-client-ssl-certificates-11500" target="_blank">here</a>.</li> </ul> <h2 id="ok-let-s-get-coding">Ok, let’s get coding!</h2> <ol> <li><p><strong>Use case: I don’t actually need Tor support, but I do want to add my custom SSL certificate to the app’s trust chain.</strong></p> What you need to do this is to create a custom Trust Manager, and use it when you instantiate your SSL connection.</p> <p>In this example, the trust manager loads (or creates, if it’s the first time use) your encrypted keystore. When your app makes a request to your web server, the Trust Manager will first check to see if the host name is in your “white list” (either in your SQLite database or in the encrypted flat file you created.) If that checks out, the Trust Manager will add the X509 certificate to your encrypted keystore (if it doesn’t exist there already.) I’ve omitted the part of the code where you load up your keystore, and where you save any changes to it; you can do that on your own, depending on how you have it set up.</p> <p>The following code I cribbed heavily from <a href="https://github.com/ge0rg/MemorizingTrustManager" target="_blank">ge0rg’s memorizing trust manager</a>. Please have a look at that, too, and thank the guy for his great work!</p> <p><pre style="font-size:0.8em;">public class MyTrustManager implements X509TrustManager { private KeyStore keyStore; private X509TrustManager defaultTrustManager; private X509TrustManager appTrustManager;</p> <p>byte[] keyStored = null; String pwd;</p> <p>public MyTrustManager() { loadKeyStore();</p> <pre><code>defaultTrustManager = getTrustManager(false); appTrustManager = getTrustManager(true); </code></pre> <p>}</p> <p>private X509TrustManager getTrustManager(boolean withKeystore) { try { TrustManagerFactory tmf = TrustManagerFactory.getInstance(&ldquo;X509&rdquo;); if(withKeystore) tmf.init(keyStore); else tmf.init((KeyStore) null); for(TrustManager t : tmf.getTrustManagers()) if(t instanceof X509TrustManager) return (X509TrustManager) t; } catch (KeyStoreException e) { Log.e(LOG, &ldquo;key store exception: &ldquo; + e.toString()); } catch (NoSuchAlgorithmException e) { Log.e(LOG, &ldquo;no such algo exception: &ldquo; + e.toString()); } return null; }</p> <p>private void loadKeyStore() { //TODO: this is where you load up your keystore and store the bytes into the keyStored field if neccessary. try { keyStore = KeyStore.getInstance(KeyStore.getDefaultType()); } catch(KeyStoreException e) { Log.e(LOG, &ldquo;key store exception: &ldquo; + e.toString()); }</p> <pre><code>try { keyStore.load(null, null); if(keyStored != null) keyStore.load(new ByteArrayInputStream(keyStored), pwd.toCharArray()); } catch(CertificateException e) { Log.e(LOG, &quot;certificate exception: &quot; + e.toString()); } catch (NoSuchAlgorithmException e) { Log.e(LOG, &quot;no such algo exception: &quot; + e.toString()); } catch (IOException e) { Log.e(LOG, &quot;IOException: &quot; + e.toString()); } </code></pre> <p>}</p> <p>private void storeCertificate(X509Certificate[] chain) { try { for(X509Certificate cert : chain) { keyStore.setCertificateEntry(cert.getSubjectDN().toString(), cert); } } catch(KeyStoreException e) { Log.e(LOG, &ldquo;keystore exception: &ldquo; + e.toString()); }</p> <pre><code>appTrustManager = getTrustManager(true); try { ByteArrayOutputStream baos = new ByteArrayOutputStream(); keyStore.store(baos, pwd.toCharArray()); updateKeyStore(baos.toByteArray()); Log.d(LOG, &quot;new key encountered! length: &quot; + baos.size()); } catch(KeyStoreException e) { Log.e(LOG, &quot;keystore exception: &quot; + e.toString()); } catch (NoSuchAlgorithmException e) { Log.e(LOG, &quot;no such algo exception: &quot; + e.toString()); } catch (IOException e) { Log.e(LOG, &quot;IOException: &quot; + e.toString()); } catch (CertificateException e) { Log.e(LOG, &quot;Certificate Exception: &quot; + e.toString()); } </code></pre> <p>}</p> <p>private void updateKeyStore(byte[] newKey) { // TODO: this is where YOU update your own keystore if you need to (ie, if it&rsquo;s in an SQLite database) }</p> <p>private boolean isCertKnown(X509Certificate cert) { try { return keyStore.getCertificateAlias(cert) != null; } catch(KeyStoreException e) { return false; } }</p> <p>private boolean isExpiredException(Throwable e) { do { if(e instanceof CertificateExpiredException) return true; e = e.getCause(); } while(e != null); return false; }</p> <p>private void checkCertificateTrusted(X509Certificate[] chain, String authType, boolean isServer) throws CertificateException { try { if(isServer) appTrustManager.checkServerTrusted(chain, authType); else appTrustManager.checkClientTrusted(chain, authType); } catch(CertificateException e) { if(isExpiredException(e)) return; if(isCertKnown(chain[0])) return;</p> <pre><code> try { if(isServer) defaultTrustManager.checkServerTrusted(chain, authType); else defaultTrustManager.checkClientTrusted(chain, authType); } catch(CertificateException ce) { storeCertificate(chain); } } </code></pre> <p>}</p> <p>@Override public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException { checkCertificateTrusted(chain, authType, false); }</p> <p>@Override public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException { checkCertificateTrusted(chain, authType, true); }</p> <p>@Override public X509Certificate[] getAcceptedIssuers() { return defaultTrustManager.getAcceptedIssuers(); }</p></li> </ol> <p>} </pre></p> <pre><code>Next, you want to initiate an Https request to use this custom Trust Manager. As most of you Android programmers know, you have to do any network stuff on another, non-UI thread. I like to use Future/Callables because it returns the contents of the web site you access into a variable that I can parse. Here’s how you do that for a standard POST request: &lt;pre style=&quot;font-size:0.8em;&quot;&gt;public static String executeHttpsPost(final String host, final Map&lt;String, Object&gt; postData, final String contentType) { ExecutorService ex = Executors.newFixedThreadPool(100); Future&lt;String&gt; future = ex.submit(new Callable&lt;String&gt;() { String result = &quot;FAIL&quot;; String HYPHENS = &quot;--&quot;; STRING LINE_END = &quot;\r\n&quot;; String BOUNDARY = &quot;***7hisIsMyBoUND4rY***&quot;; String hostname; URL url; HttpsURLConnection connection; HostnameVerifier hnv; DataOutputStream dos; SSLContext ssl; MyTrustManager itm; private void buildQuery() { Iterator&lt;Entry&lt;String, Object&gt;&gt; it = postData.entrySet().iterator(); connection.setRequestProperty(&quot;Content-Type&quot;, &quot;multipart/form-data; boundary=&quot; + BOUNDARY); StringBuffer sb = new StringBuffer(); try { dos = new DataOutputStream(connection.getOutputStream()); sb = new StringBuffer(); while(it.hasNext()) { sb = new StringBuffer(); Entry&lt;String, Object&gt; e = it.next(); sb.append(HYPHENS + BOUNDARY + LINE_END); sb.append(&quot;Content-Disposition: form-data; name=\&quot;&quot; + e.getKey() + &quot;\&quot;&quot; + LINE_END); sb.append(&quot;Content-Type: &quot; + contentType + &quot;; charset=UTF-8&quot; + LINE_END ); sb.append(&quot;Cache-Control: no-cache&quot; + LINE_END + LINE_END); sb.append(String.valueOf(e.getValue()) + LINE_END); dos.writeBytes(sb.toString()); } dos.writeBytes(HYPHENS + BOUNDARY + HYPHENS + LINE_END); dos.flush(); dos.close(); } catch (IOException e) { Log.e(LOG, e.toString()); e.printStackTrace(); } } @Override public String call() throws Exception { hostname = host.split(&quot;/&quot;)[0]; url = new URL(&quot;https://&quot; + host); hnv = new HostnameVerifier() { @Override public boolean verify(String hn, SSLSession session) { if(hn.equals(hostname)) return true; else return false; } }; itm = new MyTrustManager(); ssl = SSLContext.getInstance(&quot;TLS&quot;); ssl.init(null, new TrustManager[] {itm}, new SecureRandom()); HttpsURLConnection.setDefaultSSLSocketFactory(ssl.getSocketFactory()); HttpsURLConnection.setDefaultHostnameVerifier(hnv); connection = (HttpsURLConnection) url.openConnection(); connection.setRequestMethod(&quot;POST&quot;); connection.setRequestProperty(&quot;Connection&quot;, &quot;Keep-Alive&quot;); connection.setUseCaches(false); connection.setDoInput(true); connection.setDoOutput(true); buildQuery(); try { InputStream is = connection.getInputStream(); BufferedReader br = new BufferedReader(new InputStreamReader(is)); String line; StringBuffer sb = new StringBuffer(); while((line = br.readLine()) != null) sb.append(line); br.close(); connection.disconnect(); result = sb.toString(); } catch(NullPointerException e) { Log.e(LOG, e.toString()); e.printStackTrace(); } return result; } }); try { return future.get(); } catch (InterruptedException e) { Log.e(LOG, e.toString()); e.printStackTrace(); return null; } catch (ExecutionException e) { Log.e(LOG, e.toString()); e.printStackTrace(); return null; } } </code></pre> <p></pre></p> <ol> <li><p><strong>Use case: I have a web server set up with a hidden service running. How can my app access the web site?</strong></p> Simple! Just make some minor modifications to your SSLContext by adding a proxy! Take the executeHttpsPost method above, and add the following <em>after</em> the line “HttpsURLConnection.setDefaultHostnameVerifier(hnv);”</p> <pre style="font-size:0.8em;">Proxy proxy = new Proxy(Proxy.Type.HTTP, new InetSocketAddress("localhost", 8118)); </pre> <p>Then, change your declaration of connection to:</p> <pre style="font-size:0.8em;">connection = (HttpsURLConnection) url.openConnection(proxy); </pre> <p>So, as long as your device is also running Orbot (Tor) you can do the same POST over Tor! </li></p> <ul> <li><p><strong>Use case: I have a web server that requires client authentification. How can I add a client certificate to the SSL context?</strong></p> To do this, you’re going to need to add a KeyManager to your SSLContext. As I stated before, getting your client auth key to your app users is up to you (bluetooth, NFC, sneakernet???) but once it’s in there, and visible to your app, install it by adding your own custom KeyManager. In my testing, I added this method below to the MyTrustManager class, simply because it already had access to my encrypted keystore. But you can ostensibly place this anywhere:</p> <p><pre style="font-size:0.8em;">public X509KeyManager[] getKeyManagers(byte[] kBytes, String clientCertificatePassword, String keystorePassword) { KeyManagerFactory kmf = null; KeyManager[] km = null; X509KeyManager[] xkm = null;</p></li> </ul> <p>try { kmf = KeyManagerFactory.getInstance(&ldquo;X509&rdquo;);</p> <pre><code>KeyStore xks = KeyStore.getInstance(&quot;PKCS12&quot;); ByteArrayInputStream bais = new ByteArrayInputStream(kBytes); xks.load(bais, keystorePassword.toCharArray()); kmf.init(xks, clientCertificatePassword.toCharArray()); km = kmf.getKeyManagers(); xkm = new X509KeyManager[km.length]; for(int x=0;x&gt;km.length;x++) { X509KeyManager k = (X509KeyManager) km[x]; xkm[x] = k; } </code></pre> <p>} catch (NoSuchAlgorithmException e) { Log.e(LOG, e.toString()); e.printStackTrace(); } catch (UnrecoverableKeyException e) { Log.e(LOG, e.toString()); e.printStackTrace(); } catch (KeyStoreException e) { Log.e(LOG, e.toString()); e.printStackTrace(); } catch (IOException e) { Log.e(LOG, e.toString()); e.printStackTrace(); } catch (CertificateException e) { Log.e(LOG, e.toString()); e.printStackTrace(); } return xkm; } </pre></p> <pre><code>Finally, when you instantiate your SSLContext for your POST request, include the returned value of the getKeyManager method as the KeyManager parameter. So, replace this line: &lt;pre style=&quot;font-size:0.8em;&quot;&gt;ssl.init(null, new TrustManager[] {itm}, new SecureRandom()); </code></pre> <p></pre></p> <pre><code>with this: &lt;pre style=&quot;font-size:0.8em;&quot;&gt;X509KeyManager[] x509KeyManager = getKeyManager(kBytes, clientCertificatePassword, keystorePassword); </code></pre> <p>ssl.init(x509KeyManager, new TrustManager[] {itm}, new SecureRandom()); </pre></ol></p> <p>That’s it! Good luck hacking, hackers…</p></li> </ol> https://guardianproject.info/2012/08/27/sometimes-the-best-solution-is-a-library-not-an-app/ Mon, 27 Aug 2012 12:30:15 -0400 https://guardianproject.info/2012/08/27/sometimes-the-best-solution-is-a-library-not-an-app/ <p><a href="https://guardianproject.info/wp-content/uploads/2012/08/framework_wheel.png"><img src="https://guardianproject.info/wp-content/uploads/2012/08/framework_wheel-150x150.png" alt="" title="thinking about frameworks" width="150" height="150" class="alignleft size-thumbnail wp-image-2792" /></a>Our general approach to software development starts with surveying existing solutions that are available and in use, to see if there is already enough of an ecosystem or whether we need to seed that. When there is already an adundance of tools and apps out there, we work to find the good ones, provide feedback and auditing, and then build apps and tools to fill in any gaps. For example, this was our approach in the Open Secure Telephony Network.</p> <p>When there is not an ecosystem around a given problem, then we aim to make it as easy as possible for people writing software to address the issues. In this case, we focus on making developer tools. For example, most of the data on our phones is easily accessible to someone who has physical access to the device, be it the secret police or a thief. IOCipher and SQLCipher-for-Android both provide tools to easily encrypt data, using APIs that are very familiar to anyone doing Android development. We specifically aim to take complex technical challenges and bundle them up into packages that allow developers to add functionality in a matter of hours or days rather than weeks or months.</p> <p>With the developer tools that Guardian Project is creating, the impact is not as overt as in other software development since they are largely invisible to the users if we have done our jobs right.</p> <p>In order for our developer projects to have a good impact, there are many different aspects that need to be covered. After assessing the current available tools to determine the general approach, the technical approach is chosen. This will influence the development time, the efficiency, and ease of use. As soon as the project is developed to a basic usable state, it is time to get feedback from willing testers to validate the techical approach. After more development and feedback, next comes documentation and beta releases. Once the project gets to a point where the releases and documentation are good enough for most people to figure out what they need, then we start evangelizing the tool and lobby the developers of existing software to adopt the new tool. As part of that, we also offer meetups and workshops for people to see demos, discuss ideas with us, get started, and learn best practices.</p> <p><strong>Some Current Projects</strong></p> <p>We already have a couple well known developer tools out there, like SQLCipher-for-Android and Orlib. We have many more in development. Here’s a quick overview:</p> <ul> <li>Orlib is an Android library to make it very easy to include Orbot/Tor support in any app. Any app that uses orlib can transparently route all traffic through the Tor network without requiring that the device be rooted. It is a well established project that mostly needs more documentation, developer support, and evangelizing.</li> <li>SQLCipher is a custom version of the SQLite database that provides easy-to-use, flexible and robust encryption. Guardian Project created SQLCipher-for-Android, which mirrors the standard Android database API, so developers already know how to use it, and need only add support for handling the passwords.</li> <li>libsqlfs provides a complete virtual disk on top of a SQLCipher database. The virtual disk is encrypted and contained in a single file, which can be easily moved around, copied, shared, etc. It is a standard FUSE filesytem that can work on Android, GNU/Linux, and Mac OS X. libsqlfs is a pre-existing tool that was abandoned by its authors and has been adopted by the Guardian Project.</li> <li>IOCipher is a cousin to SQLCipher-for-Android: it provides virtual encrypted disks for Android apps without requiring the device to be rooted. It uses the standard Java API for working with files, so developers already know how to use it, and only need to handle the passwords and opening and closing the virtual disks. It is based on libsqlfs and SQLCipher.</li> <li>Gnu Privacy Guard (GnuPG) for Android brings the widespread standard in OpenPGP encryption to Android. GnuPG provides solid encryption for keeping emails and files private, and for verifying that emails and files are who you think they are. GnuPG is built-in to basically every GNU/Linux distro, in GPGTools for Mac OS X and Apple Mail, a plugin for Outlook and Thunderbird, etc. We are working to bring GnuPG to Android to make it the cornerstone of Android encryption like it is elsewhere.</li> <li>ffmpeg is a popular, widespread framework for transcoding and filtering digital videos. It has been essential to our apps ObscuraCam, InformaCam, and Murrow/StoryMaker. We want to now work to make it dead simple for developers to build their own apps on it. We are also extending it to provide a full framework for audio and image redaction, metadata management, and encryption of sensitive parts of the media. This will make it easy for media app developers to build in privacy to their own apps.</li> <li>Portable Shared Security Tokens (PSST) is our project to tackle the issues of digital identity and crypto key management. This is perhaps the most vexing issue facing deployment of secure mobile devices today. Public-key cryptography (HTTPS/SSL, OTR chat, PGP email, etc.) is a proven, powerful way to validate digital identity while keeping the contents private. Their cryptographic keys essentially become their proof of identity, and as such that identity must be portable across computing contexts (mobile devices, desktop environments, etc.). An interoperable standard and associated developer libraries needs to be developed to make possible a portable and secure solution for establishing one’s identity.</li> <li>Always Secure Messaging (“AweSoMe”) is a collaborative effort to build interoperable, open-source, secure messaging applications, that work from mobile to mobile, as well as mobile to web. In particular, the goal is to create an extremely usable and high quality experience, that simultaneously supports one-to-one and one-to-many (group) end-to-end secure messaging communications across multiple platforms.</li> <li>Bazaar provides the last piece of this puzzle: easy, secure and private distribution of software. Debian GNU/Linux has proven that decentralized software stores can work well. Google Play and the Apple App Store both provide excellent examples for how to make it easy to find and distribute apps, but are often blocked or not available in many parts of the world. Bazaar combines all of these ideas to provide a decentralized, peer-to-peer app store that makes it easy to find and distribute apps.</li> </ul> https://guardianproject.info/2012/07/19/from-#hope9-your-cell-phone-is-covered-in-spiders-practical-android-security/ Thu, 19 Jul 2012 14:53:21 -0400 https://guardianproject.info/2012/07/19/from-#hope9-your-cell-phone-is-covered-in-spiders-practical-android-security/ <p><a href="https://twitter.com/cooperq">Cooperq</a> gave a great talk on Android security late Saturday night at the recent <a href="http://www.hopenumbernine.net/">Hackers on Planet Earth Number 9 aka Hope9</a> gathering. You can find the <a href="https://github.com/cooperq/spiders">slides/src on Github</a> and <a href="http://vimeo.com/46044290">video up on Vimeo</a>. Cooper wrote some notes, as well:</p> <blockquote> <p>This talk was given at hope 9. Please feel free to give it yourself, repourpose it, add to it or do whatever you want. I release this talk to the public domain. I have included here some additional resources that are worth checking out.</p> <h2 id="additional-resources">Additional Resources</h2> <p><a href="https://guardianproject.org/">https://guardianproject.org</a> – Awsome android devs creating the best security tools for android.</p> <p><a href="https://encrypteverything.ca/index.php/Cell_phone_privacy_guide_%28Android%29">https://encrypteverything.ca/index.php/Cell_phone_privacy_guide_%28Android%29</a> – How to encrypt lots of things on android</p> <p><a href="http://forum.xda-developers.com/">http://forum.xda-developers.com/</a> – Very knowlegable android enthusiast and dev forum</p> <p><a href="http://developer.android.com/index.html">http://developer.android.com/index.html</a> – The Documentation</p> <p><a href="http://forensics.spreitzenbarth.de/">http://forensics.spreitzenbarth.de/</a> – Info on android malware</p> <p><a href="http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/">http://androidsecuritytest.com/features/logs-and-services/loggers/carrieriq/</a> – Info on carrier IQ</p> <p><a href="https://groups.google.com/forum/?fromgroups#!forum/android-security-discuss">https://groups.google.com/forum/?fromgroups#!forum/android-security-discuss</a> – Android security google group</p> </blockquote> <p> </p> <p>Thanks Cooper and <a href="http://hackbloc.org">Hackbloc</a> for all your support and feedback!</p> https://guardianproject.info/2012/07/10/threats-and-usability-of-secure-voice/ Tue, 10 Jul 2012 12:48:18 -0400 https://guardianproject.info/2012/07/10/threats-and-usability-of-secure-voice/ <p>In my <a href="https://guardianproject.info/2012/07/05/a-network-analysis-of-encrypted-voice-over-ostn/">previous post</a> I found that end-to-end encryption with OSTN is both effective and usable. There are two important things the user must be aware of when using OSTN. They must confirm with each phone call that the encryption icon is present and  they must correctly complete SAS verification dialog boxes. So on a basic level, encrypted voice just works. But, what does this all mean? This post looks at the threats to security and usability of encrypted ZRTP phone calls in CSipSimple.</p> <p><strong>Usable Security</strong><br /> Crypto wizards have created and refined algorithms that bring strong encryption to the everyday user. Yet, more often then not, security is compromised through user error. This is a usability problem. Information security is abstract and the practicalities of the real world demand that encryption software ‘just works’ for the average user. It is more dangerous for a user to be unaware of a loss of encryption then that they fail to get it working. Government P25 handheld radios were found to have such poor usability for encryption that a <a href="http://www.crypto.com/blog/p25">research team</a> found many government agents accidentally transmitting sensitive information in the clear. ZRTP and CSipSimple’s implementation fair much better however.</p> <div id="attachment_2606" style="width: 283px" class="wp-caption alignleft"> <a href="https://guardianproject.info/wp-content/uploads/2012/07/whitdiff.jpg"><img aria-describedby="caption-attachment-2606" class="wp-image-2606 " title="whitdiff" src="https://guardianproject.info/wp-content/uploads/2012/07/whitdiff-300x244.jpg" alt="Whit Diffie" width="273" height="222" srcset="https://guardianproject.info/wp-content/uploads/2012/07/whitdiff-300x244.jpg 300w, https://guardianproject.info/wp-content/uploads/2012/07/whitdiff.jpg 528w" sizes="(max-width: 273px) 100vw, 273px" /></a> <p id="caption-attachment-2606" class="wp-caption-text"> Whitfield Diffie is pioneer of modern cryptography </p> </div> <div id="attachment_2612" style="width: 250px" class="wp-caption alignright"> <a href="https://guardianproject.info/wp-content/uploads/2012/07/gandalf22.jpg"><img aria-describedby="caption-attachment-2612" class=" wp-image-2612" title="gandalf" src="https://guardianproject.info/wp-content/uploads/2012/07/gandalf22-300x283.jpg" alt="Gandalf" width="240" height="226" srcset="https://guardianproject.info/wp-content/uploads/2012/07/gandalf22-300x283.jpg 300w, https://guardianproject.info/wp-content/uploads/2012/07/gandalf22.jpg 546w" sizes="(max-width: 240px) 100vw, 240px" /></a> <p id="caption-attachment-2612" class="wp-caption-text"> Whit and Gandalf fight evil with magic abilities gained by pouring through dusty tomes full of obscure symbols. (Borrowed from this excellent <a href="http://www.subspacefield.org/security/math_rules_cyberspace_20120421/math_rules_cyberspace_20120421.pdf">Math Rules Cyberspace</a> presentation) </p> </div> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> <p>Although not required for the average user, its good to have a basic background of cryptography. This is not an full introduction, but it will provide some background on ZRTP and the importance of authentication.</p> <p><strong>ZRTP, Authentication, PKI</strong><br /> Most usability issues with encrypted communications deals with Public-Key-Infrastructure or PKI. Public Key Infrastructure is how we verify the identity of each participant in a communication channel. Verifying the identity of the other party is important to prevent <a href="https://en.wikipedia.org/wiki/Man-in-the-middle_attack">Man-In-The-Middle-Attacks</a>. These attacks allow an attacker the opportunity to eavesdrop. PKI is a crucial point to understand in almost all encryption schemes. It inherently effects how the encrypted communication medium will be used.</p> <p>Basically, to use encryption, both users must exchange secret keys without transmitting them in the clear. This is a bootstrapping problem, exchanging keys safely requires both users to already have exchanged keys! Public key cryptography has solved the problem of needing to secretly exchange keys in advance. Rather, a user can exchange public keys that don’t require secrecy. These keys can be published to the world. The issue is then whether or not the public key is <strong>authentic</strong>. How does one user know that they received the right public key and not the public key of an attacker attempting a MITM attack?</p> <p>Different communities have different approaches to PKI. Smaller distributed technical communities have long relied on the web-of-trust model supported by <a href="https://en.wikipedia.org/wiki/Pretty_Good_Privacy">PGP</a>. This was the first widely available open-source software that provided strong cryptography to everyone. It was created by Phil Zimmerman who also created ZRTP to encrypt voice.  Its work flow, while fine for some, has precluded its widespread adoption outside of the tech community.</p> <p>Websites rely on a Certificate Authorities to make encryption transparent for the user.  It does not require the user to make manual trust decisions and ‘just works’. However, it never obtained the goal of strong end-to-end encryption the way PGP has because it relies on the trust of centralized authorities that have proven time and time again to not be trustworthy. The future of SSL is a heavily researched area. For some approaches to this issue I’d personally suggest looking into <a href="https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions">DNSSEC</a>, <a href="http://blog.thoughtcrime.org/ssl-and-the-future-of-authenticity">Convergence</a>, and this <a href="http://events.ccc.de/congress/2010/Fahrplan/events/4295.en.html">talk</a> from Dan J. Bernstein, a cryptographer and professor at the University of Illinois. <a href="https://www.youtube.com/watch?feature=player_embedded&amp;v=Z7Wl2FW2TcA">This talk</a> by Moxie Marlinspike at Blackhat 2011 is great, it introduces Convergence and provides an interesting dialogue on the SSL issue.</p> <p>Modern cryptographic protocols such as OTR(instant messaging) and ZRTP(voice) have come a long way in providing easy to use end-to-end encryption. They are open standards that strike a great balance between usability and security. They both have adopted to the TOFU POP model (Trust on First Use- Persistence of Pseudonym).  This is similar to what SSH does: when you first connect to the server you are asked if you want to save and trust the server’s public key. ZRTP takes it a step farther and <strong>verifies</strong> the other party’s identity on first use.  A commitment protocol is used that requires the users to discuss whether they both are viewing the same string of text in a dialog box. This guarantees that the person you hear on the other end of the phone is the actual person your talking to.</p> <p>This is great because by saving the public key and trusting it an attacker can no longer pretend to represent someone else’s key. This relies on the first conversation not being actively attacked. The commitment protocol strengthens this by making sure that the first time you trust a key, you actually have a way to verify it. This solves the issue of MITM attacks!</p> <p>If all this doesn’t make sense, that is OK, you don’t actually have to understand cryptography to use OSTN. You just need to understand what it provides you (Confidentiality!). More information about authentication and verification was written in a great <a href="https://guardianproject.info/2012/03/19/on-verifying-identity-using-cryptography/">post by Hans</a>. Guardian also has a great research project called <a href="https://guardianproject.info/wiki/PSST">PSST</a> that is actively solving verification problems like this across multiple platforms and communication schemes.</p> <p>Below are the threats to the current ZRTP implementation in CSipSimple from both the user’s perspective and attacker’s perspective.</p> <p><strong>User Threats</strong><br /> ZRTP is great in this regard. It is one of the most user friendly ways to enable verified end-to-end encryption. This said, there are two concepts that a user should understand:</p> <ul> <li><strong>Verification:</strong> The first time you call someone with ZRTP a dialog box is displayed that asks both users to confirm that they see the same SAS (Short Authentication String). Once confirmed this identity will persist within your OSTN account and when you call the same person this dialog will not appear. If your conversation is not verified it is possible that the call is susceptible to a certain kind of attack (MITM) that allows someone to listen to your phone call. As seen in the pictures above it is easy to tell if your phone call is encrypted but not if it is verified. It is up to the user to make sure they pay attention to the SAS dialog at the beginning of a conversation. Key’s are remembered after first verification so lack of a SAS box indicates the user’s have both hit OK on a previous SAS box.</li> <li><strong>Opportunistic Encryption: </strong>This means that encryption is only attempted, but not forced. If you have encryption on, but you happen to talk to a friend who has managed to turn it off, then your call will silently remain unencrypted.  Since encryption can not be forced, a user must not  expect to be encrypted but rather check their phone at the beginning of every call to be sure. This is how opportunistic encryption should work, but it would be easy for a user to assume otherwise. Don’t do it!</li> </ul> <p><strong>Adversarial Threats</strong><br /> Currently, I see two opportunities for attackers that are related to the same two usability concerns listed above.</p> <ul> <li><strong>MITM: </strong>I mentioned before that unverified conversations are susceptible to eavesdropping. This is solved by verifying each conversation by sharing a 4 letter code before starting a conversation. You must actually cancel or ignore the SAS dialog for this to happen. Don’t!</li> <li><strong>Force clear-voice communication:</strong> Opportunistic encryption presents a more interesting problem. It is possible for someone to selectively block a ZRTP negotiation packets. This would force two users to start a conversation in clear-voice despite both setting their accounts to use ZRTP. It would be obvious to the user if they check for the lock icon, but friends who frequently communicate with OSTN might forget to check each time. This could be prevented by having a setting to force encryption. In this case the call would simply fail. In Wireshark, I was clearly able to distinguish the ZRTP negotiation packets. An attacker who can filter your traffic on the application layer can perform this attack. ISPs, Governments, and adversaries on your LAN may reasonably be in a position to do this.</li> </ul> <p>The MITM attack can be mitigated with verification. The selective blocking of ZRTP packets can not be avoided (because ZRTP can’t stop censorship) but the consequences can be mitigated by paying attention to when your calls are encrypted.</p> <p>**Improving ZRTP usability<br /> **<br /> Given the threats listed above, I see a couple things that would increase usability and prevent accidental misunderstandings by the user.</p> <ul> <li><strong>Forced ZRTP Encryption</strong>: ZRTP in CSipSimple has two modes: off or opportunistic. I would propose changing these options to <strong>ZRTP Off, Attempt ZRTP</strong>, and <strong>Force ZRTP</strong>. Force ZRTP would provide a huge security benefit to accounts in CSipSimple that you would always expect to use encryption with.OSTN would of course be the ideal example here.</li> </ul> <div id="attachment_2621" style="width: 310px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2012/07/zrtpoptions.png"><img aria-describedby="caption-attachment-2621" class="size-medium wp-image-2621" title="zrtpoptions" src="https://guardianproject.info/wp-content/uploads/2012/07/zrtpoptions-300x240.png" alt="" width="300" height="240" srcset="https://guardianproject.info/wp-content/uploads/2012/07/zrtpoptions-300x240.png 300w, https://guardianproject.info/wp-content/uploads/2012/07/zrtpoptions.png 447w" sizes="(max-width: 300px) 100vw, 300px" /></a> <p id="caption-attachment-2621" class="wp-caption-text"> Current ZRTP options in CSipSimple </p> </div> <ul> <li><strong>Verification Status:</strong> Currently you can tell when your conversation is ZRTP encrypted by the lock icon. This is great because this allows the user to avoid problems with opportunistic encryption or a downgrade attack. It would make sense to allow the user to see whether their call has also been authenticated correctly. Feedback might encourage users to continue to correctly use the SAS function.</li> </ul> <div id="attachment_2622" style="width: 310px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2012/07/lockicon.png"><img aria-describedby="caption-attachment-2622" class="size-medium wp-image-2622" title="lockicon" src="https://guardianproject.info/wp-content/uploads/2012/07/lockicon-300x298.png" alt="" width="300" height="298" srcset="https://guardianproject.info/wp-content/uploads/2012/07/lockicon-300x298.png 300w, https://guardianproject.info/wp-content/uploads/2012/07/lockicon-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2012/07/lockicon.png 350w" sizes="(max-width: 300px) 100vw, 300px" /></a> <p id="caption-attachment-2622" class="wp-caption-text"> This means your OSTN call is encrypted. It would be useful if it displayed the verification status of the caller as well. </p> </div> <ul> <li><strong>Verification Options: </strong>Currently when verifying an identity the user is displayed with the SAS. They have the option to press ‘OK’ or ‘Cancel’. Cancel effectively ignores this step, OK means that the SAS has been verified. This is non-intuitive. I would propose simply having three options: <strong>Verify, Ignore, Reject. </strong>The current function of OK is mapped to Verify, Cancel is mapped to Ignore, and Reject ends the phone conversation in situations in which the SAS doesn’t match.</li> </ul> <div id="attachment_2623" style="width: 310px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2012/07/sasbox.png"><img aria-describedby="caption-attachment-2623" class="size-medium wp-image-2623" title="sasbox" src="https://guardianproject.info/wp-content/uploads/2012/07/sasbox-300x199.png" alt="" width="300" height="199" srcset="https://guardianproject.info/wp-content/uploads/2012/07/sasbox-300x199.png 300w, https://guardianproject.info/wp-content/uploads/2012/07/sasbox.png 447w" sizes="(max-width: 300px) 100vw, 300px" /></a> <p id="caption-attachment-2623" class="wp-caption-text"> Suggested improvement would present “Verify, Ignore, and Reject” as options to the user </p> </div> <p><strong>Wrapping up</strong><br /> It should be noted that I pick on CSipSimple over the other clients because it is both great software and the recommended client to use with OSTN. It is still considered experimental software and requires the nightly release for OSTN support. Other clients may suffer from these ZRTP usability issues as well. The good thing is that by simply implementing a working ZRTP client you should have most of the protocol benefits thanks to its simple and elegant design. The recommendations I make here should applicable across all ZRTP implementations. A future comparison of of these implementations may be in order.</p> <p> </p> <p> </p> https://guardianproject.info/2012/07/05/a-network-analysis-of-encrypted-voice-over-ostn/ Thu, 05 Jul 2012 14:23:50 -0400 https://guardianproject.info/2012/07/05/a-network-analysis-of-encrypted-voice-over-ostn/ <p><strong>Introduction to OSTN</strong></p> <p>The <a href="https://guardianproject.info/wiki/OSTN">OSTN</a> network stands for Open Source Telephony Network. It is a federated network standard for supporting Internet calling with end-to-end encryption ala ZRTP. Its very similar to e-mail in that VOIP calls can be routed to addresses such as &#x75;&#x73;&#x65;&#x72;@doma&#x69;&#x6e;&#x2e;&#x74;ld. Its a simple concept, but I believe it to be ground breaking implementation! Never before have I seen such an accessible solution to encrypted VOIP calls. OSTN is platform independent, is a federated network, and it is an open standard such that it is widely adoptable. There are two main components that are required to use OSTN with encryption: a VOIP client that supports ZRTP for end-to-end encryption and user account with an OSTN provider.</p> <ul> <li>OSTEL is the first working OSTN provider. Sign up for an account at <a href="https://ostel.me/" title="ostel.me">ostel.me</a>.</li> <li>CSipSimple is the recommended VOIP client for use with OSTN. It has a built in  profile for OSTN accounts and supports ZRTP. You must use the <a href="http://nightlies.csipsimple.com/trunk/">nightly build</a>! This is the latest version and requires that you allow outside applications on Android by checking the Settings&gt;Applications&gt;’Unknown sources’ box. Information on setting it up for your Android device can be found on <a href="https://guardianproject.info/wiki/Ostel" title="our wiki">our wiki</a>.</li> </ul> <p>While this post focuses on using OSTN with the recommended CSipSimple software, the concepts extend to all OSTN platforms. Check out <a href="https://guardianproject.info/wiki/OSTN">the project page</a> for more info on alternative clients.</p> <p><strong>Looking at Encrypted VOIP with Wireshark</strong></p> <p>Traffic dumps of an OSTN call and a ZRTP encrypted OSTN call were logged and analyzed in Wireshark for comparison. This is how someone between you and your caller would see your VOIP traffic. I was looking for three things in this audit</p> <ol> <li>Confirm encryption was working in conjunction with what a user would logically expect</li> <li>Demonstrate how easy it is to capture and view non-encrypted VOIP</li> <li>Identify threats what types of security ZRTP provides</li> </ol> <p>I can confirm that the encryption works as expected. The traffic logs of both phone calls can be found at the end of this post. First, here is a look at a normal non-encrypted phone call over OSTN with CSipSimple and secure call.</p> <div id="attachment_2466" style="width: 246px" class="wp-caption alignleft"> <a href="https://guardianproject.info/wp-content/uploads/2012/06/uncrypt.png"><img aria-describedby="caption-attachment-2466" class=" wp-image-2466" title="Non-secure VOIP" src="https://guardianproject.info/wp-content/uploads/2012/06/uncrypt.png" alt="" width="236" height="360" /></a> <p id="caption-attachment-2466" class="wp-caption-text"> Cleartext phone calls are noted by absence of ZRTP overlay. </p> </div> <div id="attachment_2467" style="width: 246px" class="wp-caption alignright"> <a href="https://guardianproject.info/wp-content/uploads/2012/06/ostncall-encrypted.png"><img aria-describedby="caption-attachment-2467" class=" wp-image-2467" title="Secure VOIP" src="https://guardianproject.info/wp-content/uploads/2012/06/ostncall-encrypted.png" alt="" width="236" height="360" /></a> <p id="caption-attachment-2467" class="wp-caption-text"> ZRTP Enabled phone calls are indicated by lock icon </p> </div> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> <p>It is quite clear to the user that ZTRP has been enabled by the lock icon that appears in both phones.  Traffic logging has also confirmed that when you see the lock icon, ZRTP has successfully been set up and is being used. So far, so good. Make sure you see the lock sign if you are expecting to be talking on a secure conversation.</p> <p>CSipSimple uses <strong>opportunistic</strong> ZRTP encryption that is enabled by default for OSTN accounts with CSipSimple. This means that all calls will begin without encryption and then send ‘ZRTP Hello’ packets to let each host know that a ZRTP conversation can begin. From here ZRTP negotiates a secure connection and then transfers the conversation to encrypted voice. Here are two pictures from Wireshark showing the very beginning of a (ZRTP enabled) OSTN phone call and where the encryption actually switches on. The SRTP protocol indicates that you are using encrypted voice. ZRTP simply defines the negotiation process for SRTP. This is not a minor thing however, it is because of this that ZRTP can provide end-to-end encryption. End-to-end encryption prevents a third-party from eavesdropping and possibly passing information on to higher authorities.</p> <div id="attachment_2474" style="width: 709px" class="wp-caption alignnone"> <a href="https://guardianproject.info/wp-content/uploads/2012/06/zrtpstart.png"><img aria-describedby="caption-attachment-2474" class="size-full wp-image-2474 " title="zrtpstart" src="https://guardianproject.info/wp-content/uploads/2012/06/zrtpstart.png" alt="" width="699" height="97" srcset="https://guardianproject.info/wp-content/uploads/2012/06/zrtpstart.png 699w, https://guardianproject.info/wp-content/uploads/2012/06/zrtpstart-300x41.png 300w" sizes="(max-width: 699px) 100vw, 699px" /></a> <p id="caption-attachment-2474" class="wp-caption-text"> First UDP packets of an ZRTP enabled phone call. ZTRP Hello is sent out at the same time as the first RTP packet. </p> </div> <div id="attachment_2475" style="width: 709px" class="wp-caption alignnone"> <a href="https://guardianproject.info/wp-content/uploads/2012/06/zrtpswitch.png"><img aria-describedby="caption-attachment-2475" class="size-full wp-image-2475 " title="zrtpswitch" src="https://guardianproject.info/wp-content/uploads/2012/06/zrtpswitch.png" alt="" width="699" height="82" srcset="https://guardianproject.info/wp-content/uploads/2012/06/zrtpswitch.png 699w, https://guardianproject.info/wp-content/uploads/2012/06/zrtpswitch-300x35.png 300w" sizes="(max-width: 699px) 100vw, 699px" /></a> <p id="caption-attachment-2475" class="wp-caption-text"> Successful ZRTP hand-off. Connection switches from normal RTP to encrypted RTP here. </p> </div> <p>The important part to notice here is that the hand-off is fast. Comparing the times of the first RTP packet to the first encrypted packet takes about 1.5 seconds. Multiple traffic logs confirmed that this is a consistent number. This means that if you immediately start talking during the start of an encrypted phone it is possible for some of your voice to be transmitted clear-text. I attempted to record this section by talking in the very beginning of a call and extracting voice. I wasn’t successful, but I wouldn’t discount that you will release some clear voice audio at the beginning of a conversation.</p> <p><strong>What ZRTP Guarantees</strong></p> <p>So, things look good with OSTN calls. ZRTP is enabled by default on all OSTN accounts with CSipSimple and it uses opportunistic encryption. Also, it is very easy for the user to tell that their call has been successfully encrypted. Great! What does this mean for the user? When correctly using ZRTP, a user can expect that their phone calls are fully <strong>confidential</strong>. No third party can intercept, listen, or mangle your phone call. This includes your OSTN provider of course.</p> <p><strong>What ZRTP Doesn’t Guarantee</strong></p> <p>ZRTP does not stop<strong> censorship </strong> or provide <strong>anonymity.  </strong>This is something Orbot might be able to help with one day. Currently, the latency of the Tor network prevents real-time protocols from working. The current best solution would be to use a VPN provider to tunnel ZRTP traffic. However, now that VOIP is illegal in many countries it is not recommended that anyone trust this solution until a tested and verified method is published.</p> <p><strong>Conclusion</strong></p> <p>Using end-to-end voice encryption has never been this easy! This analysis confirmed that OSTN works quite well in practice. There are two things the user should do to ensure secure communication: make sure to read and confirm the verification dialog boxes and check to make sure your calls have the lock icon when you are counting on them to be encrypted. Just like that, you too can be a <a href="https://en.wikipedia.org/wiki/Cypherpunk">cypherpunk</a> (or just someone with a reasonable expectation of privacy!). Like Phil Zimmerman, the creator of ZRTP,  has said: “[OSTN] lets you whisper in someone’s ear a thousand miles away” Check back for our upcoming post which will look in more detail at the threat model of an OSTN phone call.</p> <p>You can download the traffic log of a encrypted and unencrypted OSTN call <a href="https://guardianproject.info/wp-content/uploads/2012/07/ostnlogs.zip">here</a></p> https://guardianproject.info/2012/07/03/our-research/ Tue, 03 Jul 2012 11:48:40 -0400 https://guardianproject.info/2012/07/03/our-research/ <p>You can track our latest work on our public research wiki located at <a href="https://guardianproject.info/wiki">https://guardianproject.info/wiki</a> or through the links below.</p> <h2 id="events">EVENTS</h2> <p>Head to the <a href="https://guardianproject.info/wiki/Events" rel="nofollow">Events</a> page for a full list of past and future events that we&rsquo;ll be attending or featured at.</p> <h2 id="research-development">RESEARCH &amp; DEVELOPMENT</h2> <p>In addition to our open software development projects, we&rsquo;re actively engaged in a number of research projects focused on critical unsolved mobile security problems. Solving these problems with freely available, open source software has the potential to greatly benefit activists, human rights defenders and journalists worldwide.</p> <h3 id="network-circumvention-anonymity">NETWORK CIRCUMVENTION &amp; ANONYMITY</h3> <p>Work we are doing on libaries, engines, daemons, proxies and other mechanisms for doing useful, creative things to network traffic. <a href="https://guardianproject.info/wiki/orbot" rel="nofollow">Orbot Project Page</a></p> <h3 id="secure-mobile-messaging">SECURE MOBILE MESSAGING</h3> <p><a href="https://guardianproject.info/wiki/Secure_Mobile_Messaging" title="Secure Mobile Messaging">Secure Mobile Messaging</a> - defining the standards, protocols, and user expectations to provide true message communication security, safety and reliability</p> <h3 id="secure-smart-cam-ssc">SECURE SMART CAM (SSC)</h3> <p>We are developing a secure camera application named ObscuraCam in partnership with Witness.org, the leading human rights video advocacy and training organization. <a href="https://guardianproject.info/wiki/SSC" rel="nofollow">SSC Project Page</a> | <a href="https://github.com/guardianproject/SecureSmartCam/" rel="nofollow">Github Source Repo</a></p> <h3 id="portable-shared-security-tokens-psst">PORTABLE SHARED SECURITY TOKENS (PSST)</h3> <p>Goal: Research and deploy prototypes of &ldquo;portable shared security tokens&rdquo; permitting easily shared identities across mobile handsets and desktops. <a href="https://guardianproject.info/wiki/PSST" rel="nofollow">PSST Project Page</a></p> <h3 id="open-secure-telephony-network-ostn">OPEN SECURE TELEPHONY NETWORK (OSTN)</h3> <p>Goal: Research secure voice-over-IP (VoIP) solutions and develop an open source &ldquo;secure phone&rdquo; prototype, including handset backend server(s). <a href="https://guardianproject.info/wiki/OSTN" rel="nofollow">OSTN Project Page</a></p> <h3 id="commotion-olsr-mobile-mesh">COMMOTION OLSR MOBILE MESH</h3> <p>Goal: Build an simple app to enable OLSR mesh on Android devices and research how to make GUIs for other operating systems. <a href="https://guardianproject.info/wiki/OLSR-GUI" rel="nofollow">Commotion OLSR-GUI Project Page</a></p> <h3 id="application-auditing">APPLICATION AUDITING</h3> <p>Often we go back and audit our own and other applications to ensure proper functioning or provide statistics. This page enumerates those results. <a href="https://guardianproject.info/wiki/Application_Auditing" rel="nofollow">Application Auditing</a></p> <h3 id="community-dev-to-do-s">COMMUNITY DEV TO-DO&rsquo;S</h3> <p>Beyond our active development projects, there is an entire pantheon of ideas, dreams, visions, schemes, features and bugs to work on. This is where we track that list. If you have any questions, please find us on email, irc or Twitter. <a href="https://guardianproject.info/wiki/Dev_to-do" title="Dev to-do">dev to-do</a></p> <h2 id="tips-tricks-other-miscellaneous-documentation">TIPS, TRICKS &amp; OTHER MISCELLANEOUS DOCUMENTATION</h2> <p>The place where we try to share any and all information we&rsquo;ve learned while using and customizing our mobile devices for privacy and security. This includes topics as diverse as device rooting guides or battery saving techniques. We encourage suggestions or additions from the community - please contribute freely!</p> <ul> <li><p><a href="https://guardianproject.info/wiki/The_Big_List_of_Apps_and_Links" title="The Big List of Apps and Links">The Big List of Apps and Links</a></p></li> <li><p><a href="https://guardianproject.info/wiki/Android_Security_App_User_Guide" title="Android Security App User Guide">Android Security App User Guide</a></p></li> <li><p><a href="https://guardianproject.info/wiki/Tips_on_Maximizing_Battery_Life_on_Android_Phones_in_the_Field" title="Tips on Maximizing Battery Life on Android Phones in the Field">Tips on Maximizing Battery Life on Android Phones in the Field</a></p></li> <li><p><a href="https://guardianproject.info/wiki/Network_Proxying_on_Android" title="Network Proxying on Android">Network Proxying on Android</a></p></li> <li><p><a href="https://guardianproject.info/wiki/Device_Rooting_Guides" title="Device Rooting Guides">Device Rooting Guides</a></p></li> <li><p><a href="https://guardianproject.info/wiki/Safer_Mobile_Guide" title="Safer Mobile Guide">Safer Mobile Guide</a></p></li> <li><p><a href="https://guardianproject.info/wiki/Android_getprop_collection" title="Android getprop collection">Android getprop collection</a></p></li> <li><p><a href="https://guardianproject.info/wiki/Guardian_Overview_Slides" title="Guardian Overview Slides">Guardian Overview Slides</a></p></li> </ul> https://guardianproject.info/2012/06/28/freebird-flys-high/ Thu, 28 Jun 2012 11:59:38 -0400 https://guardianproject.info/2012/06/28/freebird-flys-high/ <div style="width: 620px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/events/freebird2012rio/index.php?cmd=image&sfpg=KmZyZWViaXJkZ3JvdXAuanBnKjk3NjQzMjVmMmJlZDAzMjliZDQ3MzhiY2Q0MzQyNjdi"><img src="https://guardianproject.info/events/freebird2012rio/index.php?cmd=image&sfpg=KmZyZWViaXJkZ3JvdXAuanBnKjk3NjQzMjVmMmJlZDAzMjliZDQ3MzhiY2Q0MzQyNjdi" alt="" width="610" height="458" /></a> <p class="wp-caption-text"> Freebird: Rio group picture via Obscuracam for Android </p> </div> <p style="text-align: center;"> <p style="text-align: left;"> What happens when you gather coders with privacy and security activists from around the world? <a title="freebird" href="https://guardianproject.info/freebird/" target="_blank">Freebird</a>! </p> <p><p style="text-align: left;"> We held a simultaneous event in NYC and Rio, a one-day <a title="barcamp" href="http://barcamp.org/" target="_blank">barcamp</a> aimed to empower users to be more informed and engaged around their use of mobile technology, while engaging with developers to promote interest in open-source tools, security and privacy. Freebird was a pre-event for <a title="rightscon" href="https://www.rightscon.org/" target="_blank">RightsCon:Rio</a>, which allowed us to continue and extend conversations and ideas into the larger context of information technologies and human rights. <strong> </strong> </p></p> <p><p style="text-align: left;"> The camp was roughly split into two tracks, USING and MAKING: </p></p> <p><ul> <li> USING:  involved expanding mobile users’ understanding of how their phone works, or is working against them, and enabling them to replace the built-in software with more open or secure versions. </li> <li> MAKING:  focused on creating new or porting existing security software to mobile platforms, discussion of mobile threat models, and use of mobile technology to assist rights defenders, journalists, and activists. </li> </ul></p> <p><div> <div style="width: 514px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/events/freebird2012rio/index.php?cmd=image&sfpg=KlAxMDMwNzUzLkpQRyo0OTQxMjMwODdjMDlhMmY2NTkwOGNkNGRlMTVjZDFjZQ"><img class="" src="https://guardianproject.info/events/freebird2012rio/index.php?cmd=image&sfpg=KlAxMDMwNzUzLkpQRyo0OTQxMjMwODdjMDlhMmY2NTkwOGNkNGRlMTVjZDFjZQ" alt="" width="504" height="360" /></a></p> <pre><code> &lt;p class=&quot;wp-caption-text&quot;&gt; Lee of Guardian walks through the design of the Open Secure Telephony Network &lt;/p&gt; &lt;/div&gt; </code></pre> <p></div></p> <p><p> It was a great event with some fantastic discussions and opportunities for new tech and collaborations. Want to re-live the magic? You can check out <a title="rio" href="https://guardianproject.info/events/freebird2012rio/" target="_blank">the pics from Rio </a>and the <a title="rio storify" href="https://storify.com/mbelinsky/freebird-rio" target="_blank">Storify from the event</a>, as well as the <a title="nyc storify" href="https://storify.com/mbelinsky/freebirdcamp" target="_blank">Storify from the NYC event</a>. Also, be sure to check out Brendon O’Brien’s post on the event, <a href="http://activized.wordpress.com/2012/06/20/making-privacy-issues-public/">Making Privacy Issues Public</a>. From the discussions, it seemed as if there’s still quite a bit of learning that the community has to do about how phones function and all the dangers and complications therein. At the same time, there was a lot of passion and creativity for how to combat invasive tools and better methods of disseminating this type of knowledge and conversation. </p></p> <p><div style="width: 299px" class="wp-caption alignnone"> <a href="https://guardianproject.info/events/freebird2012rio/index.php?cmd=image&sfpg=KlAxMDMwNzM3LkpQRypiOTQ4NzFlN2Q0ZTdjYTA0ODIwZmZmMjI4MTE2YTNiOQ"><img src="https://guardianproject.info/events/freebird2012rio/index.php?cmd=image&sfpg=KlAxMDMwNzM3LkpQRypiOTQ4NzFlN2Q0ZTdjYTA0ODIwZmZmMjI4MTE2YTNiOQ" alt="" width="289" height="432" /></a></p> <pre><code>&lt;p class=&quot;wp-caption-text&quot;&gt; &lt;a href=&quot;https://guardianproject.info/events/freebird2012rio/index.php?cmd=image&amp;sfpg=KlAxMDMwNzMzLkpQRyphMDliZThiNDdlMjk0ZjA3ZDliNDI5MzY2MjdkMzQ2OA&quot;&gt;&lt;img class=&quot;&quot; src=&quot;https://guardianproject.info/events/freebird2012rio/index.php?cmd=image&amp;sfpg=KlAxMDMwNzMzLkpQRyphMDliZThiNDdlMjk0ZjA3ZDliNDI5MzY2MjdkMzQ2OA&quot; alt=&quot;&quot; width=&quot;432&quot; height=&quot;289&quot; /&gt;&lt;/a&gt; The collaborative “mosh pit” brainstorm helped guide the discussions for the day &lt;/p&gt; </code></pre> <p></div></p> <p><p> None of this would have been possible without our partners: Freebird was funded by <a href="http://openitp.org/">OpenITP</a>, and facilitated by <a title="aspiration tech" href="http://aspirationtech.org/" target="_blank">Aspiration Tech</a>, noted open-source advocates and facilitators. Special guests  included developers from <a title="http://zetetic.net/" href="http://zetetic.net/" target="_blank">Zetetic</a> (SQLCipher), <a title="tor anonymity" href="https://www.torproject.org/" target="_blank">the Tor Project</a>, the <a href="http://oti.newamerica.net/commotion_wireless_0/" target="_blank">Commotion</a> project, and a number of prominent human rights and activists organizations. Thanks to all these great organizations and everyone else who attended. </p></p> <p><div style="width: 442px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/events/freebird2012rio/index.php?cmd=image&sfpg=KlAxMDMwNzY2LkpQRyo4ZGZkZjk5MDZkNTk0YzM1OWJjODMwMzYyOGMyMmZkMA"><img class="" src="https://guardianproject.info/events/freebird2012rio/index.php?cmd=image&sfpg=KlAxMDMwNzY2LkpQRyo4ZGZkZjk5MDZkNTk0YzM1OWJjODMwMzYyOGMyMmZkMA" alt="" width="432" height="289" /></a></p> <pre><code>&lt;p class=&quot;wp-caption-text&quot;&gt; Harlo of Guardian walks through the InformaCam sensor capture code and metadata formats &lt;/p&gt; </code></pre> <p></div></p> <p><p> Some of our favorite twitter coverage from the event: </p></p> <p><blockquote class="twitter-tweet"> <p> Encantada de conocer a desarrolladores de Thor, profesores universitarios, directivos del Free Bird project <a href="https://twitter.com/search/%2523freebird2012">#freebird2012</a> — Elaine Díaz(@elainediaz2003) <a href="https://twitter.com/elainediaz2003/status/207830610247548928">May 30, 2012</a> <em></em> <em>“Nice to meet Tor developers, academics, project managers ‪ Free Bird # freebird2012”</em> </p> </blockquote></p> <p><blockquote class="twitter-tweet tw-align-center"> <p> What’s the pyramid of mobile security?<a href="https://twitter.com/search/%2523FreebirdCamp">#FreebirdCamp</a>@ ITP <a title="http://instagr.am/p/LQyJuisGyl/" href="http://t.co/iYWX49z0">instagr.am/p/LQyJuisGyl/</a> — noel hidalgo, frsa (@noneck) <a href="https://twitter.com/noneck/status/207914569245523970">May 30, 2012</a> </p> </blockquote></p> <p><blockquote class="twitter-tweet tw-align-center"> <p> The Guardian Project’s Freebird event was absolutely awesome! <a title="https://guardianproject.info/freebird/" href="https://t.co/qq5SbVsy">guardianproject.info/freebird/</a> — Jacob Appelbaum (@ioerror) <a href="https://twitter.com/ioerror/status/207926015241093120">May 30, 2012</a> </p> </blockquote></p> <p><p> Together, our growing community will help develop the tools and ideas for a tomorrow that is free as a bird. </p></p> <p><p style="text-align: center;"> <a href="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1.jpg"><img class="aligncenter" src="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1.jpg" alt="" width="475" height="734" /></a> </p></p> https://guardianproject.info/2012/06/20/orbot-data-tax-updated/ Wed, 20 Jun 2012 13:05:53 -0400 https://guardianproject.info/2012/06/20/orbot-data-tax-updated/ <p><strong>Update (6/26/12): I Found Orbot to have lower idle usage then previously recorded. The post now reflects the new statistics. The previous stats were based on idle usage at 92 bytes/s</strong></p> <p>There have been many inquiries about the cost of Orbot’s data usage. I ran five different tests to record the types of data tax a user might encounter. Heavy usage of Orbot combined with a low monthly data allotment could be an issue.</p> <p>Below is the compiled data for 4 different use cases:</p> <table align="center"> <tr> <th colspan="2" align="center" valign="middle"> Test Scenario </th> <th> Data Usage </th> <th> Overhead </th> </tr> <tr> <th rowspan="4" valign="middle"> Web Traffic </th> </tr> <tr> <th> Without Orbot </th> <td> 2.35 MiB </td> <td> — </td> </tr> <tr> <th> With Orbot </th> <td> 3.44 MiB </td> <td> 46% </td> </tr> <tr> <th> Orweb </th> <td> 3.26 MiB </td> <td> 38% </td> </tr> <tr> <th rowspan="3" valign="middle"> Bulk Download </th> </tr> <tr> <th> With Orbot </th> <td> 17.82 MiB </td> <td> 15% </td> </tr> <tr> <th> Without Orbot </th> <td> 15.49 MiB </td> <td> — </td> </tr> <tr> <th rowspan="3" colspan="2" valign="middle"> Idle </th> <td> 65 Bytes/s </td> <td rowspan="3"> — </td> </tr> <tr> <td> 228 KiB/hour </td> </tr> <tr> <td> 160 MiB/month </td> </tr> <tr> <th colspan="2" valign="middle"> Client Start/Stop </th> <td> 37.8 KiB </td> <td> — </td> </tr> </table> <p><strong>Test Scenarios</strong></p> <p>The test cases were fairly straight forward. I used Droidwall to limit traffic on my phone to Orbot or the desired application and then recorded data.</p> <ul> <li><strong>Web Browsing:</strong> Browsed five common websites (guardianproject.info, boingboing.net, facebook.com, slashdot.org, twitter.com) with Orbot/Orweb and javascript OFF, the default browser with Orbot running as a transparent proxy, and just the default browser by itself</li> <li><strong>Idle:</strong> Started Orbot and began recording on Idle for ~10 minutes. The traffic graph clearly shows a small data spike approximately every minute.</li> <li><strong>Bulk Download:</strong> Downloaded a 5 MB file with the download manager 3 times both with Orbot’s transparent proxy and without</li> <li><strong>Client Stop/Start:</strong> Recorded traffic incurred by starting and stopping Orbot</li> </ul> <p><strong>Contextualizing the Data</strong></p> <p>This data suggests that Orbot could incur between  15 and 46 percent of additional data usage plus about 227 MiB of data a month for those that run Orbot ²⁴&frasl;₇. This tradeoff may significant to some, but it really depends on your data usage.</p> <p>I have calculated how much data you could use for 3 different plans if you used Orbot for ALL your traffic. This means running it ²⁴&frasl;₇ over your data network AND using the transparent proxy to enforce all your applications to go through Orbot. This table represents the most extreme use case.</p> <table align="center"> <tr> <th rowspan="3" align="center"> Monthly Plan </th> <th colspan="2" align="center"> Usable Data </th> <th colspan="2" align="center"> Orbot Data Tax </th> </tr> <tr> <th> At 15% </th> <th> At 46% </th> <th> At 15% </th> <th> At 46% </th> </tr> <tr> <th> 5 GiB </th> <td> 4.21 GiB </td> <td> 3.31 GiB </td> <td> 16% </td> <td> 34% </td> </tr> <tr> <th> 1 GiB </th> <td> 751 MiB </td> <td> 588 MiB </td> <td> 27% </td> <td> 43% </td> </tr> <tr> <th> 500 MiB </th> <td> 295 MiB </td> <td> 233 MiB </td> <td> 41% </td> <td> 53% </td> </tr> </table> <p><strong>Reducing Data Cost</strong></p> <p>These numbers may be high for some, but they represent very heavy usage of Orbot. If a user only wishes to use Orbot for a specific set of apps that have proxy support, there is no reason to leave Orbot running ²⁴&frasl;₇. Twitter is a great example of this because it caches its data asynchronously and would only need Orbot turned on to gather new tweets or search. If the application’s proxy is on but Orbot is off it will simply not be able to update rather then updating outside the Tor network.</p> <blockquote> <p><strong>Warning: </strong>Turning off Orbot to save data will also remove the transparent proxy rules. This means applications relying on the transparent proxy rules as opposed to proxy support (Twitter) will be free to broadcast data outside Orbot if you have not taken other precautions.</p> </blockquote> <p><strong>Note: </strong> (Updated 6/26/12) I previously mentioned that Droidwall may have some issues in blocking certain outbound data. I filed a bug with the author and it turned out to be my mistake in recording the traffic. So, ignore my previous statement, Droidwall would be great application to enforce outbound traffic rules during periods in which Orbot is turned off.</p> https://guardianproject.info/2012/06/13/auditing-twitter-with-orbot/ Wed, 13 Jun 2012 20:31:57 -0400 https://guardianproject.info/2012/06/13/auditing-twitter-with-orbot/ <p>Twitter’s new Android application provides a proxy option that supports Orbot. It is a great way to access Twitter, particularly if Twitter is blocked. Check out the <a href="https://guardianproject.info/2012/05/02/orbot-your-twitter/">Orbot Your Twitter</a> blog post! That post explains how to set up Orbot with Twitter, however, it came with an important disclaimer:</p> <blockquote> <p><strong>WARNING AND DISCLAIMER: Twitter for Android is proprietary, closed-source software. Details of the implementation of proxy support have not been publicly disclosed or audited by a third-party at this time. In particular, resolution of hostnames via DNS may not be properly routed through Tor (this is a common issue with proxied software). In addition, through other permissions that Twitter for Android may have you on your device, there may be a strong ability to correlate identity between your registered Google Account and your activities on Twitter.</strong></p> </blockquote> <p>****I decided to take on the challenge of auditing Twitter+Orbot to gain more insight (and hopefully trust) into their new support for proxying. I logged some traffic on my Nexus One using the proxied Twitter application to see what was going on. To eliminate excess traffic I used Droidwall to permit only traffic from Orbot and Twitter. This still allows the Twitter application the option to leak data while blocking other traffic we don’t wish to see.  I began logging with Orbot off and attempted to update my Twitter application. So far so good, it was not able to retrieve any tweets. Once Orbot was running the application worked great, I ran some searches and made a test tweet. Looking at the traffic, my phone contacted 3 IP addresses:</p> <ul> <li>83.241.211.6</li> <li>199.58.86.196</li> <li>149.9.0.60</li> </ul> <p><a href="https://metrics.torproject.org/">Tor Metrics</a> has a handy tool called <a href="https://metrics.torproject.org/exonerator.html">ExoneraTor</a> that confirmed that these addressed were indeed relays in the Tor network at the time of 2012-06-13 12:00.  One slightly concerning thing is that Twitter notifications will still show up when Twitter is proxied but Orbot is off! I logged more traffic this time not using Droidwall and making sure to trigger Twitter notifications with Orbot on and off.</p> <p style="text-align: center;"> <a href="https://guardianproject.info/wp-content/uploads/2012/06/twitterSYNC3.png"><img class="size-full wp-image-2345 aligncenter" style="margin-right: 5px; margin-left: 5px; border-style: initial; border-color: initial; border-image: initial; border-width: 0px;" title="twitterSYNC" src="https://guardianproject.info/wp-content/uploads/2012/06/twitterSYNC3.png" alt="" width="583" height="146" srcset="https://guardianproject.info/wp-content/uploads/2012/06/twitterSYNC3.png 583w, https://guardianproject.info/wp-content/uploads/2012/06/twitterSYNC3-300x75.png 300w" sizes="(max-width: 583px) 100vw, 583px" /></a> </p> <p>The traffic in green is making some HTTP requests to a Google server, but its not a result of the Twitter App or triggered notifications. The traffic going to and from 173.194.76.188 represents the notifications. A WHOIS reveals this to be encrypted traffic to a Google IP and doesn’t indicate a user is using Twitter. This is a result of Google’s Push Notifications and can be easily disabled on an Android phone under ‘Accounts &amp; sync’.</p> <blockquote> <p><strong>If you have  Google account set up with your phone, Google knows your IP address and your Twitter account through the Push Notifications. This should be turned OFF in either the Twitter application settings or ‘Accounts &amp; sync’ menu.</strong></p> </blockquote> <p>****<strong>What does it mean for Twitter+Orbot users?</strong></p> <ul> <li><strong>Stops Local Traffic Surveillance:</strong> It means that someone looking at your phone traffic will not be able to tell if you are using or accessing Twitter. They will see you accessing the Tor network, receiving push notifications from Google (if enabled), and they will see all your other normal traffic.</li> <li><strong>Stops Service Logging Surveillance:</strong> Twitter will only see a Tor Exit Node IP address and not be able to log your real IP address. The Tor Exit Node will only see an HTTPS connection to Twitter, and not know where you are connecting from, nor what your Twitter account is.</li> <li><strong>Defeats Network Filtering: </strong>The Twitter app will be able to connect to the Twitter service through the Tor network, even if it is blocked by the network or country you are connecting from.</li> </ul> <p>Unfortunately, this does <strong>not</strong> mean that what you publish to Twitter is automatically anonymous. For strong anonymity in tweeting, precautions beyond proxying should be taken, such setting up a new email address, using a new Android phone, etc, that go beyond what we can cover here. You can view <a href="http://advocacy.globalvoicesonline.org/projects/guide/">Global Voices Guide to Anonymous Blogging</a> and the EFF’s <a href="https://www.eff.org/wp/blog-safely">How to Blog Safely</a> for a more in depth discussion of this. In short, Twitter+Orbot defeats traffic surveillance and network filtering, but does not automatically provide strong anonymity. No DNS leaks were detected, but if one is trying to maintain a anonymous Twitter account  (i.e. an account not linked to your real identitity or other pseudonym) more precautions need to be taken. The traffic logs of both tests can be downloaded <a href="https://guardianproject.info/wp-content/uploads/2012/06/twittertraffic.zip">here</a>. 10.0.2.64 is the IP of the Nexus One running Twitter and Orbot.</p> <div id="attachment_2054" style="width: 298px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-170011.png"><img aria-describedby="caption-attachment-2054" class=" wp-image-2054 " style="border-image: initial; border-width: 1px; border-color: black; border-style: solid; margin: 1px;" title="Tweet Freely!" src="https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-170011.png" alt="" width="288" height="480" srcset="https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-170011.png 480w, https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-170011-180x300.png 180w" sizes="(max-width: 288px) 100vw, 288px" /></a> <p id="caption-attachment-2054" class="wp-caption-text"> You can use the app just the same as before, but now through Tor! </p> </div> https://guardianproject.info/2012/06/08/en-a-partnership-for-open-secure-mobile-messaging-between-ios-and-android/ Fri, 08 Jun 2012 12:05:34 -0400 https://guardianproject.info/2012/06/08/en-a-partnership-for-open-secure-mobile-messaging-between-ios-and-android/ <!--:en--> <p><strong>We believe in protocols, not products. We believe in partnerships, not proprietary fiefdoms. We believe in building a community of collaborators, not a cacophony of criticism and unnecessary competition. We believe in practical solutions to perilous problems. </strong></p> <p>With all of this in mind, we are very happy to announce our partnership and support of the <a href="https://chatsecure.org">ChatSecure for iOS</a> open-source free software project. Through our our two year history, we have been lucky to receive support from a variety of donors and funders, and we are now using what influence and opportunities we have to endorse other projects that we feel are compatible with our outlook and goals.</p> <p>Using ChatSecure on an iPhone or iPad, you can have an end-to-end encryption chat session with someone using the Guardian Project’s <a href="https://guardianproject.info/apps/gibber/">Gibberbot on Android</a> (or Pidgin, Jisti, or Adium on the desktop as well) through any  Jabber/XMPP compliant chat service such as GTalk, Jabber.org, or even Facebook (gasp!). You can also run your own server using something like <a href="http://www.igniterealtime.org/projects/openfire/">OpenFire</a> or <a href="http://prosody.im/">Prosody</a>.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/06/mza_7177507910624414963.320x480-75.jpg"><img title="mza_7177507910624414963.320x480-75" src="https://guardianproject.info/wp-content/uploads/2012/06/mza_7177507910624414963.320x480-75-200x300.jpg" alt="" width="200" height="300" /></a>  <a href="https://guardianproject.info/wp-content/uploads/2012/06/mza_2639493050739819523.320x480-75.jpg"><img title="mza_2639493050739819523.320x480-75" src="https://guardianproject.info/wp-content/uploads/2012/06/mza_2639493050739819523.320x480-75-200x300.jpg" alt="" width="200" height="300" /></a></p> <p>While we fundamentally believe that the more open platform and ecosystem of Android is a better choice for people at risk around the world, we know that the iPhone and iPad devices are very compelling and quite popular. This is especially true among some of our most closest, at-risk users – journalists and activists – people who praise the time saving usability of Apple products, while being frustrated they have no way to communicate as securely as they would like. Messaging apps like WhatsApp and Facebook Messenger are terribly insecure, and there is still no open-source cross-platform encrypted SMS solution.</p> <p><strong>Now using ChatSecure and Gibberbot, members of the same organization, friends, or colleagues can now easily communicate in a completely secure manner between Android and iOS devices.</strong></p> <p>A message below from the ChatSecure team…</p> <blockquote> <p><a href="https://guardianproject.info/wp-content/uploads/2012/06/chatsecure-banner.png"><img class="alignnone size-medium wp-image-2323" title="chatsecure-banner" src="https://guardianproject.info/wp-content/uploads/2012/06/chatsecure-banner-300x147.png" alt="" width="300" height="147" srcset="https://guardianproject.info/wp-content/uploads/2012/06/chatsecure-banner-300x147.png 300w, https://guardianproject.info/wp-content/uploads/2012/06/chatsecure-banner.png 700w" sizes="(max-width: 300px) 100vw, 300px" /></a></p> <p>I would like to announce a partnership with <a href="https://guardianproject.info/">The Guardian Project</a>, who develops the Android equivalent of ChatSecure called <a href="https://guardianproject.info/apps/gibber/">Gibberbot</a>, along with a whole suite of mobile security applications. It’s an exciting time for open-source secure mobile communications!</p> <p>Version 1.2 has been approved! This new version includes support for limited <strong>background messaging</strong>, the #1 most requested feature. Yay!</p> </blockquote> <p>Read more and learn about this great open-source effort on the ChatSecure blog: <a href="https://chatsecure.org/blog#2">https://chatsecure.org/blog#2</a></p> <p>If you are reading this on an iOS device, <a href="https://itunes.apple.com/us/app/chatsecure/id464200063?mt=8">go to the App Store and install ChatSecure now!</a><!--:--></p> <!--:pt--> <!--:--> <!--:es--> <!--:--> https://guardianproject.info/2012/05/26/en-ostn-secure-voip-wizard-now-built-into-csipsimple-for-android/ Sat, 26 May 2012 21:14:52 -0400 https://guardianproject.info/2012/05/26/en-ostn-secure-voip-wizard-now-built-into-csipsimple-for-android/ <p><!--:en-->If you saw our last post about how to</p> <p><a href="https://guardianproject.info/2012/05/17/build-your-own-open-secure-telephony-network-some-assembly-required/">setup your own secure voice-over-IP server instance</a>, then this news is for you.</p> <p>If you are an Android user looking for the <a href="https://code.google.com/p/csipsimple/">best open-source VoIP app</a>, and really need one that can support <a href="https://OSTel.co">secure communications</a>, then this post is ALSO for you.</p> <p><a href="https://code.google.com/p/csipsimple/">CSipSimple</a>, the previously mentioned “best VoIP app”, now includes a wizard for setting up an account configuration for any server which complies with our <a href="https://guardianproject.info/wiki/OSTN_Compliance_Specification">Open Secure Telephony Network specification</a>. In short, this means it uses TLS or SSL to secure the SIP signaling traffic, and supports proxying of the RTP media streams for the actual voice or video calls, without in any way interfering with the ZRTP encryption passing through it.</p> <p>There are currently two OSTN compliant public services, <a href="https://OSTel.co">OSTel</a> and <a href="https://intimi.ca:4242/">PillowTalk</a>, but we hope and expect there to be many more, both public and private, and are very happy that this secure by default wizard configuration is now included in the core CSipSimple project. In addition, by having this support in a multiple purpose client (as opposed to a single OStel-only app), you can simultaneously use multiple VoIP accounts. For example, you might setup a second account with Callcentric, that is less secure, but that would allow you to make calls over the standard telephone system.</p> <p>Below are screenshots of CSipSimple account setup running on an Android 4 ICS 7″ Tablet.</p> <p>First, select “Add account”, scroll down to Generic wizards, and select OSTN.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/05/Screenshot_2012-05-26-20-46-05.png"><img class="alignnone wp-image-2282" title="Screenshot_2012-05-26-20-46-05" src="https://guardianproject.info/wp-content/uploads/2012/05/Screenshot_2012-05-26-20-46-05.png" alt="" width="614" height="360" srcset="https://guardianproject.info/wp-content/uploads/2012/05/Screenshot_2012-05-26-20-46-05.png 1024w, https://guardianproject.info/wp-content/uploads/2012/05/Screenshot_2012-05-26-20-46-05-300x175.png 300w" sizes="(max-width: 614px) 100vw, 614px" /></a></p> <p>Then enter your username, password, and the OSTN compliant server you wish to connect to.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/05/Screenshot_2012-05-26-20-53-56.png"><img class="alignnone wp-image-2283" title="Screenshot_2012-05-26-20-53-56" src="https://guardianproject.info/wp-content/uploads/2012/05/Screenshot_2012-05-26-20-53-56.png" alt="" width="614" height="360" srcset="https://guardianproject.info/wp-content/uploads/2012/05/Screenshot_2012-05-26-20-53-56.png 1024w, https://guardianproject.info/wp-content/uploads/2012/05/Screenshot_2012-05-26-20-53-56-300x175.png 300w" sizes="(max-width: 614px) 100vw, 614px" /></a></p> <p>Once you hit “Save”, the account should be configured, attempt to register, and be ready to make calls.</p> <p>Learn more about the CSipSimple project: <a href="https://code.google.com/p/csipsimple/">https://code.google.com/p/csipsimple/</a></p> <p>Download the latest <a href="http://nightlies.csipsimple.com/trunk/">CSipSimple nightly trunk here.</a></p> <p>Many thanks to the brilliant Ooze and R3gis for their continued support.<!--:--></p> <!--:pt--> <!--:--> <!--:es--> <!--:--> https://guardianproject.info/2012/05/17/en-build-your-own-open-secure-telephony-network-some-assembly-required/ Thu, 17 May 2012 17:13:39 -0400 https://guardianproject.info/2012/05/17/en-build-your-own-open-secure-telephony-network-some-assembly-required/ <p><!--:en-->The Open Secure Telephony Network is a standard that defines how to configure a VoIP softswitch with the capability to have secure two-way VoIP conversations if both parties are using the same server. The system requires both backend and frontend components, which makes OSTN is a little different than some of the other Guardian apps. Unlike Gibberbot, there are few public SIP services that support secure signalling for a mobile app to connect with. Notably</p> <p><a href="https://tanstagi.net">Tanstagi.net</a> offers free accounts. But it’s more fun to run your own.</p> <p>Ready? Here’s the 12 step program.</p> <p>The core server system is what provides user registration and media proxying. The reference application I used is called Freeswitch. It has a plethora of configuration options, so I chose to use a configuration management system called Chef to get everything set correctly.</p> <ol> <li>Bootstrap a Debian server. Right now the only supported platform for an automated installation is Debian 6 “Squeeze”. The adventerous may try to run the cookbook on another platform and do some bug fixing</li> <li>Install sudo, curl and git if you don’t already have them. <code>apt-get install sudo curl git-core</code></li> <li>Get a static IP address. This is crucial! Your users will need a place to register from anywhere in the world</li> <li>Get a domain name. This is also crucial! Your users will prefer to register to a name rather than an IP address</li> <li>Configure a local hostname. This is a dependency for the cookbook to properly configure Freeswitch to serve your custom domain. Unfortunately, this process varies based on OS and has bizarre conventions that make no sense. Just <a href="http://serverfault.com/questions/331936/setting-the-hostname-fqdn-or-short-name">follow the instructions</a> and don’t ask questions. Remember to reboot after changing the hostname</li> <li>Install Chef from the <a href="http://www.opscode.com/chef/install/">opscode full stack</a>.</li> <li>Download the <a href="https://github.com/lazzarello/chef-twelvetone">freeswitch cookbook</a> and <a href="https://github.com/lazzarello/chef-twelvetone/tree/master/cookbooks/freeswitch">execute it</a> with chef-solo</li> <li>Walk away and have some coffee or a beer, depending on where the sun is relative to you</li> <li>When the Chef run is finished, Freeswitch will be up and running. Check with <code>netstat -lntp</code> you should see freeswitch listening on TCP port 5061</li> <li>Create users by running <code>/opt/chef/embedded/bin/ruby /usr/local/freeswitch/scripts/gen_users</code>. Without arguments, it will print the required parameters. Run it with an offset of 1000 and as many users as you like. Copy the XML files output by the script to <code>/usr/local/freeswitch/conf/directory/default/</code> The script will also output a file with plaintext passwords so you can provision user handsets. Put this file somewhere safe and encrypted</li> <li>Reload the XML into Freeswitch’s memory. <code>/usr/local/freeswitch/bin/fs_cli -x &quot;reloadxml&quot;</code></li> <li>Install <a href="http://nightlies.csipsimple.com/trunk/">CSipSimple</a> and configure it to connect to your domain name with the username/password pair</li> </ol> <p>If you make it through these steps, congratulations! You are now a Freeswitch operator. If you’re curious what is behind all of this and why it works, you should read about <a href="https://en.wikipedia.org/wiki/Session_Initiation_Protocol">SIP</a>, <a href="https://en.wikipedia.org/wiki/ZRTP">ZRTP</a> and <a href="https://en.wikipedia.org/wiki/Session_Description_Protocol">SDP</a>. It’s also worth noting that the Chef cookbook configures the server to act as an SSL <a href="https://en.wikipedia.org/wiki/Certificate_authority">Certificate Authority</a>. This is used for Secure SIP. The current landscape of using commercially signed certificates in Freeswitch is far more complicated than any HTTPS web server you may have worked with.</p> <p>If you’d like to get help from me or another Guardian Project hacker, you can create issues <a href="https://dev.guardianproject.info/projects/ostn">in our tracker</a> and message SteeleNivenson on Freenode or OFTC in channel #guardianproject. Oh yeah, and there’s Twitter @leeazzarello.<!--:--></p> https://guardianproject.info/2012/05/17/iocipher-lives-encrypted-virtual-file-system-for-android/ Thu, 17 May 2012 16:44:35 -0400 https://guardianproject.info/2012/05/17/iocipher-lives-encrypted-virtual-file-system-for-android/ <p>Nathan and I just got the first complete test of IOCipher working in the IOCipherServer/SpotSync app. We created a filesystem sqlite.db file, then mounted it and got all the files via HTTP. In the test suite, I have lots of operations all running fine and encrypting! The core idea here is a java.io API replacement that transparently writes to an encrypted store. So for the most part, just change your import statements from:</p> <pre>java.io.* ---> info.guardianproject.iocipher.*</pre> <p>Then in your code, make a <code>VirtualFileSystem</code> instance and mount it, and unmount it. That’s about it. Right now, you can have only a single filesystem per app, but you can unmount one and mount another. We hope to add support for multiple filesystems in the not-too-distant future.</p> <p>Its ready for people to try, some kind of early alpha. Here’s the framework itself:<br /> <a href="https://github.com/guardianproject/IOCipher" target="_blank"><a href="https://github.com/guardianproject/IOCipher">https://github.com/guardianproject/IOCipher</a></a></p> <p>THe easiest way to get started right now is probably the test suite:<br /> <a href="https://github.com/guardianproject/IOCipherTests" title="IOCipherTests" target="_blank"><a href="https://github.com/guardianproject/IOCipherTests">https://github.com/guardianproject/IOCipherTests</a></a></p> <p>Our first app using it is here:<br /> <a href="https://github.com/guardianproject/IOCipherServer" target="_blank"><a href="https://github.com/guardianproject/IOCipherServer">https://github.com/guardianproject/IOCipherServer</a></a></p> <p>Comments, feedback, criticism, welcome and wanted!</p> https://guardianproject.info/2012/05/16/en-bye-bye-bbm-facebook-allows-verifiable-encrypted-mobile-messaging-for-android-and-ios-mobile-revenue-threatened/ Wed, 16 May 2012 17:28:03 -0400 https://guardianproject.info/2012/05/16/en-bye-bye-bbm-facebook-allows-verifiable-encrypted-mobile-messaging-for-android-and-ios-mobile-revenue-threatened/ <p><!--:en-->Yes, yes, we are trying to get in on all of the Facebook pre-IPO buzz. Fortunately, the headline is true – through</p> <p><a href="https://developers.facebook.com/docs/chat/">Facebook’s support for open-standards messaging</a>, our secure mobile messaging app, <a href="https://guardianproject.info/apps/gibber">Gibberbot for Android</a>, can be used to communicate securely with any other friend on Facebook who is ALSO using a secure messaging app. Whether it is <a href="https://guardianproject.info/apps/gibber">Gibberbot</a>, <a href="http://chrisballinger.info/apps/chatsecure/">ChatSecure for iOS</a>, Adium (Mac), Pidgin (Windows/Linux), or one of the many secure messaging apps that support the <a href="http://www.cypherpunks.ca/otr/">Off-the-Record encryption capability</a>, Facebook allows encrypted messaging between mobile and desktops alike.</p> <p>This means that as opposed to the default Facebook Messenger apps that transmit and store their messages in plaintext, no one but you and the person you are messaging can read the contents of the communication. This goes far beyond the really unsafe designs of group messaging products like <a href="https://en.wikipedia.org/wiki/WhatsApp#Security_concerns">WhatsApp</a>, which have <a href="https://en.wikipedia.org/wiki/WhatsApp#Security_concerns">pretty much no security at all</a>, and are easily hijacked and monitored.</p> <p>You can even use Gibberbot over the <a href="https://torproject.org">Tor network</a>, to access Facebook messaging in places where it might be blocked or monitored, like your school, work, or your local authoritarian surveillance state.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/05/gibberface.jpg"><img class="wp-image-2170 alignnone" title="gibberface" src="https://guardianproject.info/wp-content/uploads/2012/05/gibberface.jpg" alt="" width="600" height="337" srcset="https://guardianproject.info/wp-content/uploads/2012/05/gibberface.jpg 1000w, https://guardianproject.info/wp-content/uploads/2012/05/gibberface-300x168.jpg 300w" sizes="(max-width: 600px) 100vw, 600px" /></a></p> <p>Now, it is very interesting to note, that while they allow it, they do *detect* that you are using encryption, and tag it as such in the web-based messaging interface (which does NOT support encryption). Only time will tell if this is simply a feature for tidying up the user interface (else you see a bunch of cypher text gobblyegook), or some sort of retro-future surveillance of who is using Facebook in non mainstream ways. After all, if Facebook cannot index my chats for keywords to advertise against, do they really want me using up their server computing time?</p> <p>Below is a screenshot of <a href="http://chrisballinger.info/apps/chatsecure/">ChatSecure</a>, the first open-source secure messenger for iOS devices. We are excited to be partnering this project to ensure full interoperability with Gibberbot.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/05/screenshot.png"><img class="alignnone size-full wp-image-2179" title="screenshot" src="https://guardianproject.info/wp-content/uploads/2012/05/screenshot.png" alt="" width="473" height="540" srcset="https://guardianproject.info/wp-content/uploads/2012/05/screenshot.png 473w, https://guardianproject.info/wp-content/uploads/2012/05/screenshot-262x300.png 262w" sizes="(max-width: 473px) 100vw, 473px" /></a></p> <p>Learn more about the entire Guardian Project suite of <a href="https://guardianproject.info/apps">open-source secure mobile apps</a>.<!--:--></p> <!--:pt--> <!--:--> <!--:es--> <!--:--> https://guardianproject.info/2012/05/04/cross-domain-calling-or-toll-free-long-distance-voip/ Fri, 04 May 2012 17:34:30 -0400 https://guardianproject.info/2012/05/04/cross-domain-calling-or-toll-free-long-distance-voip/ <p>In a standard <a href="https://guardianproject.info/wiki/OSTN_Compliance_Specification">OSTN configuration</a>, the Fully Qualified Domain Name (<a href="https://en.wikipedia.org/wiki/FQDN">FQDN</a>) of the server running Freeswitch is a core dependency to operate the service. For example, the domain ostel.me was first configured as a DNS record, a server was bootstrapped with ostel.me as the local hostname and a <a href="https://github.com/lazzarello/chef-twelvetone">Freeswitch cookbook</a> was run using the Chef automation system. Because the domain was configured both in DNS and locally, the cookbook has enough information to automatically build an operational OSTN node.</p> <p>Once the node is operational, accounts are provisioned on the node and users install the OSTel Android application on their mobile handsets. Users may place secure calls to other users within the domain ostel.me.</p> <p>This week I reached a milestone. I placed a call from a user at ostel.me to a user on a second private debugging domain. Both domains were configured as an OSTN node and two handsets were registered, one on each node. This kind of cross domain calling is something that is rare in the VoIP world when compared to other communications protocols on the Internet, for example email and XMPP. This is due in part to the complexity of the SIP protocol. I’m <a href="https://guardianproject.info/wiki/The_challenges_with_secure_cross-domain_calling">documenting the extended details</a> on the wiki.</p> <p>I configured both servers to register to each other, establishing a two way link between them. This is called <a href="https://en.wikipedia.org/wiki/Voice_peering">VoIP peering</a>. The more nodes in the network, the more peering relationships must exist. For example, this picture illustrates the relationships between a fully interconnected network with four nodes, named A, B, C and D.</p> <div id="attachment_2082" style="width: 287px" class="wp-caption alignnone"> <a href="https://guardianproject.info/wp-content/uploads/2012/05/full_mesh_network.png"><img aria-describedby="caption-attachment-2082" src="https://guardianproject.info/wp-content/uploads/2012/05/full_mesh_network-277x300.png" alt="Four Node Peering Network" width="277" height="300" class="size-medium wp-image-2082" srcset="https://guardianproject.info/wp-content/uploads/2012/05/full_mesh_network-277x300.png 277w, https://guardianproject.info/wp-content/uploads/2012/05/full_mesh_network.png 400w" sizes="(max-width: 277px) 100vw, 277px" /></a> <p id="caption-attachment-2082" class="wp-caption-text"> Four Node Peering Network </p> </div> <p>The implementation of this kind of peering network differs for each application. Once the peering configuration is completed by the operator of each node, they must also enable cross domain calling in the Freeswitch dialplan. In Freeswitch, the peers create a “gateway” to route calls to a non-local domain. When a non-local call is placed, Freeswitch will attempt to find a gateway to that domain. If it exists, it will route the call to the other server, which will in turn ring the handset belonging to the registered username.</p> <div id="attachment_2110" style="width: 610px" class="wp-caption aligncenter"> <a href="https://guardianproject.info/wp-content/uploads/2012/05/sip-peering-situation.png"><img aria-describedby="caption-attachment-2110" src="https://guardianproject.info/wp-content/uploads/2012/05/sip-peering-situation.png" alt="Protocol flow between two domains" width="600" height="188" class="size-full wp-image-2110" srcset="https://guardianproject.info/wp-content/uploads/2012/05/sip-peering-situation.png 600w, https://guardianproject.info/wp-content/uploads/2012/05/sip-peering-situation-300x94.png 300w" sizes="(max-width: 600px) 100vw, 600px" /></a> <p id="caption-attachment-2110" class="wp-caption-text"> Cross Domain SIP Call </p> </div> <p>The user interface to place this type of call in the OSTel app is experimental due to our security requirements. In my test, the non-local domain was debug.ostel.me. To place a call from &#x62;o&#x62;@o&#x73;t&#x65;l.&#x6d;e to alice@debug&#x2e;&#x6f;&#x73;&#x74;&#x65;&#x6c;&#x2e;&#x6d;&#x65; I had to type a fully qualified <a href="https://en.wikipedia.org/wiki/Uniform_resource_identifier">SIP URI</a> into the OSTel dialer interface. It looks like <code>sip:&amp;#x61;l&amp;#x69;ce&amp;#x40;de&amp;#x62;u&amp;#x67;&amp;#x2e;o&amp;#x73;te&amp;#x6c;.&amp;#x6d;&amp;#x65;;transport=tls</code>. The transport=tls attribute is due to the secure SIP requirement. Without that, the app will try and connect to debug.ostel.me over the insecure SIP port, which is not open on an OSTN node.</p> <p>This test proved that cross domain SIP calling is possible but as I’ve shown above, there are significant hurdles on both the user and operator side. Some of these hurdles may be overcome by using a <a href="http://www.opensips.org/">SIP application other than Freeswitch</a>, some may be solved on the client side, <a href="http://www.e164.org/">others with DNS</a>. It’s great to have a secure voice service with a network of trusted peers. I’m looking forward to future research and development to remove the hurdles to create these peering agreements. Eventually we’ll all have the ability to call our friends email addresses.</p> https://guardianproject.info/2012/05/02/orbot-your-twitter/ Wed, 02 May 2012 17:19:27 -0400 https://guardianproject.info/2012/05/02/orbot-your-twitter/ <p>In some ways, Twitter is the perfect application to run over the <a href="https://torproject.org">Tor network</a>. It works with small bits of data, it is asynchronous, works naturally in a “store and forward” queue model, and in general, has a decent amount of <a href="https://twitter.com/about/security">default security built-in</a> through HTTP/S support and OAuth. Compared to the problem-child of the open web, which often involves large websites, streaming video, flash embeds, and malicious javascript, Twitter is a nearly perfect candidate for use over a secure, anonymous (but sometimes high latency) network. Add to the fact that Twitter is often <a href="https://en.wikipedia.org/wiki/List_of_websites_blocked_in_the_People's_Republic_of_China">blocked or monitored in many countries</a>who do not care for free speech and human rights, and it becomes almost a necessity that you use it with a service like Tor.</p> <blockquote> <p><strong>WARNING AND DISCLAIMER: Twitter for Android is proprietary, closed-source software. Details of the implementation of proxy support have not been publicly disclosed or audited by a third-party at this time. In particular, resolution of hostnames via DNS may not be properly routed through Tor (this is a common issue with proxied software). In addition, through other permissions that Twitter for Android may have you on your device, there may be a strong ability to correlate identity between your registered Google Account and your activities on Twitter.</strong></p> </blockquote> <p>Until recently, in order to run <a href="https://play.google.com/store/apps/details?id=com.twitter.android&amp;hl=en">Twitter for Android</a> through Tor for Android, aka <a href="https://guardianproject.info/apps/orbot/">Orbot</a>, you would need to <a href="http://shortfuse.org/?page_id=2">root your device</a>, or deal with complex proxy settings. However, as of last week, Twitter became <em>one of the first and only major apps (aka 100M+ installs!)</em> to <a href="https://twitter.com/#!/moxie/status/195622774348324864">add direct proxy support into their app</a>, in a very easy to find and activate way.</p> <p><em><strong>UPDATE June 13, 2012: After a recent audit, we now recommend turning off the “Sync Data” option through Twitter’s Settings menu, under your registered Twitter account. This will stop push notifications from being sent, which are currently not handled by Orbot/Tor.</strong></em></p> <ol> <li>Install and activate Orbot, open Twitter, tap the gear icon on the home screen.</li> <li>Check the “proxy” box, enter ‘localhost’ and ‘8118’.</li> <li>Open your account settings, and disable the “Sync Data” option to stop push notifications which cannot be proxied through Orbot/Tor.</li> </ol> <p>See the screenshots below for a full walkthrough, and please spread the word to those in need.</p> <div id='gallery-7' class='gallery galleryid-2041 gallery-columns-3 gallery-size-thumbnail'> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-165201.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-165201-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-7-2047" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-7-2047'> Orbot and Twitter now work together easily, thanks to new simple proxy settings feature in Twitter for Android </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-164620.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-164620-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-7-2042" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-7-2042'> When you setup Orbot, your device does not need root or “superuser” access in order to work with Twitter, or with other apps like Gibberbot (Chat) or ORWeb (safe web access) </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-164656.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-164656-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-7-2043" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-7-2043'> Orbot by default provides an HTTP proxy server on “localhost” and port 8118 </dd> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-164743.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-164743-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-7-2044" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-7-2044'> In the Twitter app account sign in screen, click the small gear icon to open proxy settings </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-164753.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-164753-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-7-2045" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-7-2045'> Enable the proxy, set Proxy Host to ‘localhost’ and Proxy Port to ‘8118’ </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-164807.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-164807-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-7-2046" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-7-2046'> You can also modify Proxy settings in the app via Menu->Settings </dd> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-170011.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-170011-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-7-2054" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-7-2054'> You can use the app just the same as before, but now through Tor! </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-170043.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-170043-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-7-2055" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-7-2055'> With searches, you may need to try a few times for them to go through </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-170118.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/05/device-2012-05-02-170118-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-7-2056" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-7-2056'> #OrbotYourTwitter! </dd> </dl> <br style="clear: both" /> </div> <p> </p> <p>Learn more and install apps</p> <ul> <li>Twitter for Android: <a href="https://play.google.com/store/apps/details?id=com.twitter.android&amp;hl=en">Google Play</a></li> <li>Orbot: Tor for Android: <a href="https://play.google.com/store/apps/details?id=org.torproject.android&amp;">Google Play</a> or <a href="https://www.torproject.org/docs/android.html.en">direct download via TorProject.org</a></li> <li>Learn more about <a href="https://www.torproject.org/about/overview.html.en">how Tor works</a> or just watch the video below!</li> </ul> https://guardianproject.info/2012/05/02/mobile-mesh-in-a-real-world-test/ Wed, 02 May 2012 15:37:37 -0400 https://guardianproject.info/2012/05/02/mobile-mesh-in-a-real-world-test/ <p>Nathan, Mark, Lee, and I tried some OLSR mesh testing during the May Day protests and marches. We were able to get 4 devices to associate and mesh together, but not without some trials and travails. Two pairs of devices setup two separate BSSIDs, so were on separate networks. We turned them all off, then associated them one at a time, and then they all got onto the same BSSID and olsrd started doing its thing. This made us think that we should just use a hard-coded BSSID in the setup, with a preference to allow standard ad-hoc association to find a BSSID. <a href="https://guardianproject.info/wp-content/uploads/2012/05/526191_338865336181237_184749301592842_866151_1316470506_n.jpg"><img src="https://guardianproject.info/wp-content/uploads/2012/05/526191_338865336181237_184749301592842_866151_1316470506_n-300x225.jpg" alt="" width="300" height="225" class="alignright size-medium wp-image-2037" srcset="https://guardianproject.info/wp-content/uploads/2012/05/526191_338865336181237_184749301592842_866151_1316470506_n-300x225.jpg 300w, https://guardianproject.info/wp-content/uploads/2012/05/526191_338865336181237_184749301592842_866151_1316470506_n.jpg 600w" sizes="(max-width: 300px) 100vw, 300px" /></a></p> <p>Next we tried to use some services. We were going to try running a <a href="https://crypto.cat/" target="_blank">cryptocat</a> session, but the phone that was running cryptocat via a <a href="https://github.com/guardianproject/lildebi" target="_blank">Lil’ Debi</a> Debian install was having trouble staying connected to the mesh. Next we tried a serverless direct SIP call using <a href="https://code.google.com/p/csipsimple/" target="_blank">CSIPSimple</a>.</p> <p>CSIPSimple uses the Android Java API to determine if the device is online. The current approach to configuring the ad-hoc mode used by Android-Wifi-Tether-based apps including Serval and Barnacle-based apps including OLSR-Mesh-Tether disables the wifi via the Android Java API, then configures ad-hoc mode using command line tools. This means that Android believe that the wifi is off, and when apps query the network status via the normal Android API, Android will tell it what it believes: there is no network connection.</p> <p>This works in <a href="http://www.servalproject.org/" target="_blank">Serval</a> because Serval is a self-contained system with its own SIP client and server, etc. This does not work for situations where we want to provide generic IP service using OLSR mesh on Android phones. I’m going to try to see if I can get the ad-hoc setup to work while making Android believe that the wifi is an and associated with infrastructure-mode network.</p> <p>Also, in the process of setting up the mesh while mixing in a crowd and walking with a crowd down the street we realized two key things: 1) the setup process should be tolerant of frequent interruptions, and 2) it should be as easy as possible for people to give the mesh app itself from one phone to another. We’ll be working on #1 as part of our <a href="https://code.commotionwireless.net/projects" target="_blank">Commotion</a> work and we will focus on making a UI that clearly shows its status and lets the user continue where they left off. We will be working directly on #2 as part of a separate project, so we’ll try to keep everyone informed on our progress with that.</p> <p>Another idea we discussed was how to have a “strength meter” for mesh, like the GSM or wifi bars. We talked about taking a tally of how many first hop connections there are, the total connections, and the total willingness of all of the first hop connections.</p> https://guardianproject.info/freebird/help-us-promote/ Fri, 27 Apr 2012 15:01:57 -0400 https://guardianproject.info/freebird/help-us-promote/ <p><!--:en-->&nbsp;</p> <p>Please download, copy, share, rewteet, remix, mashup and otherwise use the graphics below, with a link to &ldquo;freebirdcamp.org&rdquo; to help us spread the word about our event.</p> <p><strong>Hashtag: #FreebirdRioNYC</strong></p> <p>&nbsp;</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png"><img class="alignnone size-full wp-image-1940" title="freebirdbadge" src="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png" alt="" width="468" height="463" srcset="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png 468w, https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1-300x296.png 300w" sizes="(max-width: 468px) 100vw, 468px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1.jpg"><img class="alignnone size-large wp-image-1980" title="freebirdposter" src="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-662x1024.jpg" alt="" width="640" height="989" srcset="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-662x1024.jpg 662w, https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-194x300.jpg 194w" sizes="(max-width: 640px) 100vw, 640px" /></a><!--:--></p> <!--:pt--> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png"><img class="alignnone size-full wp-image-1940" title="freebirdbadge" src="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png" alt="" width="468" height="463" srcset="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png 468w, https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1-300x296.png 300w" sizes="(max-width: 468px) 100vw, 468px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1.jpg"><img class="alignnone size-large wp-image-1980" title="freebirdposter" src="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-662x1024.jpg" alt="" width="640" height="989" srcset="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-662x1024.jpg 662w, https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-194x300.jpg 194w" sizes="(max-width: 640px) 100vw, 640px" /></a></p> <!--:--> <!--:es--> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png"><img class="alignnone size-full wp-image-1940" title="freebirdbadge" src="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png" alt="" width="468" height="463" srcset="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png 468w, https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1-300x296.png 300w" sizes="(max-width: 468px) 100vw, 468px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1.jpg"><img class="alignnone size-large wp-image-1980" title="freebirdposter" src="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-662x1024.jpg" alt="" width="640" height="989" srcset="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-662x1024.jpg 662w, https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-194x300.jpg 194w" sizes="(max-width: 640px) 100vw, 640px" /></a></p> <!--:--> https://guardianproject.info/freebird/help-us-promote/ Fri, 27 Apr 2012 15:01:57 -0400 https://guardianproject.info/freebird/help-us-promote/ <p><!--:en-->&nbsp;</p> <p>Please download, copy, share, rewteet, remix, mashup and otherwise use the graphics below, with a link to &ldquo;freebirdcamp.org&rdquo; to help us spread the word about our event.</p> <p><strong>Hashtag: #FreebirdRioNYC</strong></p> <p>&nbsp;</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png"><img class="alignnone size-full wp-image-1940" title="freebirdbadge" src="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png" alt="" width="468" height="463" srcset="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png 468w, https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1-300x296.png 300w" sizes="(max-width: 468px) 100vw, 468px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1.jpg"><img class="alignnone size-large wp-image-1980" title="freebirdposter" src="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-662x1024.jpg" alt="" width="640" height="989" srcset="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-662x1024.jpg 662w, https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-194x300.jpg 194w" sizes="(max-width: 640px) 100vw, 640px" /></a><!--:--></p> <!--:pt--> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png"><img class="alignnone size-full wp-image-1940" title="freebirdbadge" src="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png" alt="" width="468" height="463" srcset="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png 468w, https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1-300x296.png 300w" sizes="(max-width: 468px) 100vw, 468px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1.jpg"><img class="alignnone size-large wp-image-1980" title="freebirdposter" src="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-662x1024.jpg" alt="" width="640" height="989" srcset="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-662x1024.jpg 662w, https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-194x300.jpg 194w" sizes="(max-width: 640px) 100vw, 640px" /></a></p> <!--:--> <!--:es--> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png"><img class="alignnone size-full wp-image-1940" title="freebirdbadge" src="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png" alt="" width="468" height="463" srcset="https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1.png 468w, https://guardianproject.info/wp-content/uploads/2012/04/freebirdbadge1-300x296.png 300w" sizes="(max-width: 468px) 100vw, 468px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1.jpg"><img class="alignnone size-large wp-image-1980" title="freebirdposter" src="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-662x1024.jpg" alt="" width="640" height="989" srcset="https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-662x1024.jpg 662w, https://guardianproject.info/wp-content/uploads/2012/04/freebirdposter1-194x300.jpg 194w" sizes="(max-width: 640px) 100vw, 640px" /></a></p> <!--:--> https://guardianproject.info/freebird/venues/ Fri, 27 Apr 2012 13:20:47 -0400 https://guardianproject.info/freebird/venues/ <!--:en--> <h3 id="toc_0">[</h3> <p>Fundação Getulio Vargas’ Center for Technology &amp; Society](<a href="http://direitorio.fgv.br/cts/">http://direitorio.fgv.br/cts/</a>)</p> <p>Praia de Botafogo, 190, Rio de Janeiro, RJ Room 1333</p> <p><a href="http://direitorio.fgv.br/cts/">http://direitorio.fgv.br/cts/</a></p> <p>The CTS is the Center for Technology and Society Law School of the Getulio Vargas Foundation in Rio de Janeiro. Its mission is to study the legal implications, stemming from the social and cultural advancement of information technology, developing projects related to those areas.</p> <p>[osm_map lat=&ldquo;-22.94131&rdquo; long=&ldquo;-43.1803&rdquo; zoom=&ldquo;15&rdquo; width=&ldquo;600&rdquo; height=&ldquo;450&rdquo; marker=&ldquo;-22.94131,-43.1803&rdquo; marker_name=&ldquo;camping.png&rdquo; type=&ldquo;Mapnik&rdquo;]</p> <hr /> <h3 id="new-york-university-itp-tisch-school-of-the-arts-http-itp-nyu-edu"><a href="http://itp.nyu.edu">New York University - ITP - Tisch School of the Arts</a></h3> <p>721 Broadway, 4th Floor, New York, NY 10003</p> <p><a href="http://itp.nyu.edu">http://itp.nyu.edu</a></p> <p>ITP is a two-year graduate program located in the Tisch School of the Arts whose mission is to explore the imaginative use of communications technologies — how they might augment, improve, and bring delight and art into people&rsquo;s lives. Perhaps the best way to describe us is as a Center for the Recently Possible.</p> <p>[osm_map lat=&ldquo;40.729&rdquo; long=&ldquo;-73.994&rdquo; zoom=&ldquo;15&rdquo; width=&ldquo;600&rdquo; height=&ldquo;450&rdquo; marker=&ldquo;40.729,-73.994&rdquo; marker_name=&ldquo;camping.png&rdquo; type=&ldquo;Mapnik&rdquo;]</p> <div> </div> <!--:--> <p><!--:pt-->Fundação Getulio Vargas’ Center for Technology &amp; Society</p> <p>Praia de Botafogo, 190, Rio de Janeiro, RJ Room 1333</p> <p><a href="http://direitorio.fgv.br/cts/">http://direitorio.fgv.br/cts/</a></p> <p>O CTS é o Centro de Tecnologia e Sociedade da Escola de Direito da Fundação Getulio Vargas no Rio de Janeiro. Sua missão é estudar as implicações legais decorrentes do avanço social e cultural da tecnologia da informação, desenvolvendo projetos relacionados com tais áreas.</p> <p>[osm_map lat=&ldquo;-22.94131&rdquo; long=&ldquo;-43.1803&rdquo; zoom=&ldquo;15&rdquo; width=&ldquo;600&rdquo; height=&ldquo;450&rdquo; marker=&ldquo;-22.94131,-43.1803&rdquo; marker_name=&ldquo;camping.png&rdquo; type=&ldquo;Mapnik&rdquo;]</p> <hr /> <h3 id="new-york-university-itp-tisch-school-of-the-arts-http-itp-nyu-edu-1"><a href="http://itp.nyu.edu">New York University - ITP - Tisch School of the Arts</a></h3> <p>721 Broadway, 4th Floor, New York, NY 10003</p> <p><a href="http://itp.nyu.edu">http://itp.nyu.edu</a></p> <p lang="pt-BR"> ITP é um programa de pós-graduação de dois anos localizado na Escola de Artes Tisch cuja missão é explorar o uso imaginativo de tecnologias de comunicação — como elas poderiam aumentar, melhorar e trazer alegria e arte na vida das pessoas. Talvez a melhor maneira de nos descrever seja como um Centro para o Recentemente Possível. </p> <p>[osm_map lat=&ldquo;40.729&rdquo; long=&ldquo;-73.994&rdquo; zoom=&ldquo;15&rdquo; width=&ldquo;600&rdquo; height=&ldquo;450&rdquo; marker=&ldquo;40.729,-73.994&rdquo; marker_name=&ldquo;camping.png&rdquo; type=&ldquo;Mapnik&rdquo;]</p> <div> </div> <!--:--> <!--:es--> <h3 id="toc_3">[</h3> <p>Fundação Getulio Vargas’ Center for Technology &amp; Society](<a href="http://direitorio.fgv.br/cts/">http://direitorio.fgv.br/cts/</a>)</p> <p>Praia de Botafogo, 190, Rio de Janeiro, RJ Room 1333</p> <p><a href="http://direitorio.fgv.br/cts/">http://direitorio.fgv.br/cts/</a></p> <p>El CTS es el Centro de Tecnología y Sociedad de la Facultad de Derecho de la Fundación Getulio Vargas en Río de Janeiro. Su misión es la de estudiar las repercusiones legales que derivan del avance social y cultural del desarrollo de proyectos de tecnología informática relacionados a esas áreas.</p> <p>[osm_map lat=&ldquo;-22.94131&rdquo; long=&ldquo;-43.1803&rdquo; zoom=&ldquo;15&rdquo; width=&ldquo;600&rdquo; height=&ldquo;450&rdquo; marker=&ldquo;-22.94131,-43.1803&rdquo; marker_name=&ldquo;camping.png&rdquo; type=&ldquo;Mapnik&rdquo;]</p> <hr /> <h3 id="new-york-university-itp-tisch-school-of-the-arts-http-itp-nyu-edu-2"><a href="http://itp.nyu.edu">New York University - ITP - Tisch School of the Arts</a></h3> <p>721 Broadway, 4th Floor, New York, NY 10003</p> <p><a href="http://itp.nyu.edu">http://itp.nyu.edu</a></p> <p>El Programa de Telecomunicaciones Interactivas [ITP, por sus siglas en inglés] de la Tisch School of the Arts es un posgrado de dos años cuyo propósito es explorar el uso imaginario de las tecnologías de la comunicación: cómo se podría aumentar, mejorar y llevar placer y arte a la vida de la gente. Tal vez, la mejor manera de describir quiénes somos es considerarnos un &ldquo;Centro para posibilidades recientes&rdquo;.</p> <p>[osm_map lat=&ldquo;40.729&rdquo; long=&ldquo;-73.994&rdquo; zoom=&ldquo;15&rdquo; width=&ldquo;600&rdquo; height=&ldquo;450&rdquo; marker=&ldquo;40.729,-73.994&rdquo; marker_name=&ldquo;camping.png&rdquo; type=&ldquo;Mapnik&rdquo;]</p> <div> </div> <!--:--> https://guardianproject.info/freebird/venues/ Fri, 27 Apr 2012 13:20:47 -0400 https://guardianproject.info/freebird/venues/ <!--:en--> <h3 id="toc_0">[</h3> <p>Fundação Getulio Vargas’ Center for Technology &amp; Society](<a href="http://direitorio.fgv.br/cts/">http://direitorio.fgv.br/cts/</a>)</p> <p>Praia de Botafogo, 190, Rio de Janeiro, RJ Room 1333</p> <p><a href="http://direitorio.fgv.br/cts/">http://direitorio.fgv.br/cts/</a></p> <p>The CTS is the Center for Technology and Society Law School of the Getulio Vargas Foundation in Rio de Janeiro. Its mission is to study the legal implications, stemming from the social and cultural advancement of information technology, developing projects related to those areas.</p> <p>[osm_map lat=&ldquo;-22.94131&rdquo; long=&ldquo;-43.1803&rdquo; zoom=&ldquo;15&rdquo; width=&ldquo;600&rdquo; height=&ldquo;450&rdquo; marker=&ldquo;-22.94131,-43.1803&rdquo; marker_name=&ldquo;camping.png&rdquo; type=&ldquo;Mapnik&rdquo;]</p> <hr /> <h3 id="new-york-university-itp-tisch-school-of-the-arts-http-itp-nyu-edu"><a href="http://itp.nyu.edu">New York University - ITP - Tisch School of the Arts</a></h3> <p>721 Broadway, 4th Floor, New York, NY 10003</p> <p><a href="http://itp.nyu.edu">http://itp.nyu.edu</a></p> <p>ITP is a two-year graduate program located in the Tisch School of the Arts whose mission is to explore the imaginative use of communications technologies — how they might augment, improve, and bring delight and art into people&rsquo;s lives. Perhaps the best way to describe us is as a Center for the Recently Possible.</p> <p>[osm_map lat=&ldquo;40.729&rdquo; long=&ldquo;-73.994&rdquo; zoom=&ldquo;15&rdquo; width=&ldquo;600&rdquo; height=&ldquo;450&rdquo; marker=&ldquo;40.729,-73.994&rdquo; marker_name=&ldquo;camping.png&rdquo; type=&ldquo;Mapnik&rdquo;]</p> <div> </div> <!--:--> <p><!--:pt-->Fundação Getulio Vargas’ Center for Technology &amp; Society</p> <p>Praia de Botafogo, 190, Rio de Janeiro, RJ Room 1333</p> <p><a href="http://direitorio.fgv.br/cts/">http://direitorio.fgv.br/cts/</a></p> <p>O CTS é o Centro de Tecnologia e Sociedade da Escola de Direito da Fundação Getulio Vargas no Rio de Janeiro. Sua missão é estudar as implicações legais decorrentes do avanço social e cultural da tecnologia da informação, desenvolvendo projetos relacionados com tais áreas.</p> <p>[osm_map lat=&ldquo;-22.94131&rdquo; long=&ldquo;-43.1803&rdquo; zoom=&ldquo;15&rdquo; width=&ldquo;600&rdquo; height=&ldquo;450&rdquo; marker=&ldquo;-22.94131,-43.1803&rdquo; marker_name=&ldquo;camping.png&rdquo; type=&ldquo;Mapnik&rdquo;]</p> <hr /> <h3 id="new-york-university-itp-tisch-school-of-the-arts-http-itp-nyu-edu-1"><a href="http://itp.nyu.edu">New York University - ITP - Tisch School of the Arts</a></h3> <p>721 Broadway, 4th Floor, New York, NY 10003</p> <p><a href="http://itp.nyu.edu">http://itp.nyu.edu</a></p> <p lang="pt-BR"> ITP é um programa de pós-graduação de dois anos localizado na Escola de Artes Tisch cuja missão é explorar o uso imaginativo de tecnologias de comunicação — como elas poderiam aumentar, melhorar e trazer alegria e arte na vida das pessoas. Talvez a melhor maneira de nos descrever seja como um Centro para o Recentemente Possível. </p> <p>[osm_map lat=&ldquo;40.729&rdquo; long=&ldquo;-73.994&rdquo; zoom=&ldquo;15&rdquo; width=&ldquo;600&rdquo; height=&ldquo;450&rdquo; marker=&ldquo;40.729,-73.994&rdquo; marker_name=&ldquo;camping.png&rdquo; type=&ldquo;Mapnik&rdquo;]</p> <div> </div> <!--:--> <!--:es--> <h3 id="toc_3">[</h3> <p>Fundação Getulio Vargas’ Center for Technology &amp; Society](<a href="http://direitorio.fgv.br/cts/">http://direitorio.fgv.br/cts/</a>)</p> <p>Praia de Botafogo, 190, Rio de Janeiro, RJ Room 1333</p> <p><a href="http://direitorio.fgv.br/cts/">http://direitorio.fgv.br/cts/</a></p> <p>El CTS es el Centro de Tecnología y Sociedad de la Facultad de Derecho de la Fundación Getulio Vargas en Río de Janeiro. Su misión es la de estudiar las repercusiones legales que derivan del avance social y cultural del desarrollo de proyectos de tecnología informática relacionados a esas áreas.</p> <p>[osm_map lat=&ldquo;-22.94131&rdquo; long=&ldquo;-43.1803&rdquo; zoom=&ldquo;15&rdquo; width=&ldquo;600&rdquo; height=&ldquo;450&rdquo; marker=&ldquo;-22.94131,-43.1803&rdquo; marker_name=&ldquo;camping.png&rdquo; type=&ldquo;Mapnik&rdquo;]</p> <hr /> <h3 id="new-york-university-itp-tisch-school-of-the-arts-http-itp-nyu-edu-2"><a href="http://itp.nyu.edu">New York University - ITP - Tisch School of the Arts</a></h3> <p>721 Broadway, 4th Floor, New York, NY 10003</p> <p><a href="http://itp.nyu.edu">http://itp.nyu.edu</a></p> <p>El Programa de Telecomunicaciones Interactivas [ITP, por sus siglas en inglés] de la Tisch School of the Arts es un posgrado de dos años cuyo propósito es explorar el uso imaginario de las tecnologías de la comunicación: cómo se podría aumentar, mejorar y llevar placer y arte a la vida de la gente. Tal vez, la mejor manera de describir quiénes somos es considerarnos un &ldquo;Centro para posibilidades recientes&rdquo;.</p> <p>[osm_map lat=&ldquo;40.729&rdquo; long=&ldquo;-73.994&rdquo; zoom=&ldquo;15&rdquo; width=&ldquo;600&rdquo; height=&ldquo;450&rdquo; marker=&ldquo;40.729,-73.994&rdquo; marker_name=&ldquo;camping.png&rdquo; type=&ldquo;Mapnik&rdquo;]</p> <div> </div> <!--:--> https://guardianproject.info/freebird/plan/ Fri, 27 Apr 2012 13:17:22 -0400 https://guardianproject.info/freebird/plan/ <!--:en--> <h2 id="agenda-9am-to-5pm-may-30-2012">Agenda 9am to 5pm - May 30, 2012</h2> <p>The workshop will have time for all participants to join together, as well as breakout tracks for users and developers. This is a <a href="https://en.wikipedia.org/wiki/BarCamp">BARCAMP</a> type event, so come prepared to interact, share and participate.</p> <p>The USING track will involve expanding mobile users understanding of how their phone works, or is working against them, and enabling them to replace the built-in software with more open or secure versions.</p> <p>The BUILDING track will focus on creating new or porting existing security software to mobile platforms, discussion of mobile threat models, and use of mobile technology to assist rights defenders, journalists, and activists.</p> <p>As a participant, you will have the chance to</p> <ul> <li>Learn how to install and use privacy-enhancing mobile software</li> <li>Present, share and brainstorm your project</li> <li>Join in a USER-meets-DEVELOPER rapid prototyping activity</li> <li>Have a great time, meeting smart people who care about open mobility</li> </ul> <p>The Guardian Project team, along with their partner Zetetic, Inc. (creators of SQLCipher) will be showing their projects including:</p> <p><strong>ObscuraCam and InformaCam</strong> secure smart camera projects, with video and photo encryption and enhanced metadata capture: <a href="https://guardianproject.info/apps/obscuracam/">https://guardianproject.info/apps/obscuracam/</a><br /> **<br /> Open Source Telephony Network** - building an open-source, secure, standards based telephony system: <a href="https://guardianproject.info/wiki/OSTN">https://guardianproject.info/wiki/OSTN<br /> </a><br /> <strong>SQLCipher</strong> - an extension to the SQLite mobile database that provides transparent 256-bit AES encryption of database files created by apps on mobile phones - <a href="https://www.zetetic.net/sqlcipher/sqlcipher-for-android/">https://www.zetetic.net/sqlcipher/sqlcipher-for-android/</a></p> <p>Still not sure if Freebird is for you? <a href="https://guardianproject.info/freebird/who">See &ldquo;Who&rdquo; we think should attend&hellip;</a><!--:--></p> <!--:pt--> <h2 lang="es-AR"> Agenda 9 h às 17 h – 30 de Maio de 2012 </h2> <p><span style="font-family: Times, serif;">O workshop terá tempo para todos os participantes se juntarem, bem como faixas de novidades para usuários e desenvolvedores. Esse é um evento do tipo <span style="color: #0000ff;"><span style="text-decoration: underline;"><a href="https://en.wikipedia.org/wiki/BarCamp">BARCAMP</a></span></span>, então venha preparado para interagir, compartilhar e participar.</span></p> <p lang="pt-BR"> <span style="font-family: Times, serif;">A faixa USING envolverá expandir a compreensão dos usuários de celulares sobre o funcionamento de seu telefone, ou se está trabalhando contra eles e que possam substituir o software integrado com versões mais abertas ou seguras.</span> </p> <p lang="pt-BR"> <span style="font-family: Times, serif;">A faixa BUILDING incidirá sobre a criação de novo ou mover software de segurança existente para plataformas móveis, discussão de modelos de ameaças móveis e uso de tecnologia móvel para ajudar ativistas, jornalistas e defensores de direitos.</span> </p> <p lang="pt-BR"> <span style="font-family: Times, serif;">Como participante, você terá a oportunidade de</span> </p> <ul> <li><p lang="pt-BR"> Aprender a instalar e usar software móvel que aumenta a privacidade </p></li> <li><p lang="pt-BR"> Apresentar, compartilhar e debater seu projeto </p></li> <li><p lang="pt-BR"> Participar na atividade de criação rápida de protótipos USUÁRIO-encontra-DESENVOLVEDOR </p></li> <li><p lang="pt-BR"> Se divertir, conhecendo pessoas inteligentes que se preocupam com mobilidade aberta </p></li> </ul> <p><span style="font-family: Times, serif;">O time The Guardian Project, com sua parceira Zetetic, Inc. (criadores do SQLCipher) estará mostrando seus projetos, incluindo:</span></p> <p><span style="font-family: Times, serif;"><strong>Projetos de câmera inteligente e segura</strong><strong> ObscuraCam e InformaCam</strong>, com criptografia de vídeo e fotografia e captura de metadados reforçada: <span style="color: #0000ff;"><span style="text-decoration: underline;"><a href="https://guardianproject.info/apps/obscuracam/">https://guardianproject.info/apps/obscuracam/</a></span></span></p></p> <p> <strong></p> <p><p> </strong><strong>Open Source Telephony Network</strong> – construindo um sistema de telefonia aberto, seguro, com base em normas: <a href="https://guardianproject.info/wiki/OSTN"><span style="color: #0000ff;"><span style="text-decoration: underline;"><a href="https://guardianproject.info/wiki/OSTN">https://guardianproject.info/wiki/OSTN</a></span></span><span style="color: #0000ff;"><span style="text-decoration: underline;"></p></p> <pre><code>&lt;p&gt; &lt;/span&gt;&lt;/span&gt;&lt;/a&gt; &lt;/p&gt; &lt;p&gt; &lt;strong&gt;SQLCipher&lt;/strong&gt; – uma extensão para o banco de dados móvel de SQLite que fornece criptografia transparente AES de 256 bits dos arquivos de banco de dados criado por apps em telefones celulares- &lt;span style=&quot;color: #0000ff;&quot;&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;&lt;a href=&quot;https://www.zetetic.net/sqlcipher/sqlcipher-for-android/&quot;&gt;https://www.zetetic.net/sqlcipher/sqlcipher-for-android/&lt;/a&gt;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt; &lt;/p&gt; &lt;p lang=&quot;pt-BR&quot;&gt; &lt;span style=&quot;font-family: Times, serif;&quot;&gt;Ainda não tem certeza se o Freebird é para você? &lt;span style=&quot;color: #0000ff;&quot;&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;&lt;a href=&quot;https://guardianproject.info/freebird/who&quot;&gt;Veja &quot;Quem” que nós pensamos que deve comparecer…&lt;/a&gt;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt; &lt;/p&gt; &lt;p&gt; &lt;!--:--&gt; &lt;!--:es--&gt; &lt;/p&gt; &lt;h2 lang=&quot;es-ES&quot;&gt; ACTIVIDADES DEL DÍA &lt;/h2&gt; &lt;h2 lang=&quot;es-ES&quot;&gt; Programa: de 9 a. m. a 5 p. m. - 30 de mayo de 2012 &lt;/h2&gt; &lt;p lang=&quot;es-ES&quot;&gt; El taller permitirá que todos los participantes puedan reunirse y que se organicen grupos de debate entre usuarios y desarrolladores. Este evento es un &lt;span style=&quot;color: #0000ff;&quot;&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/BarCamp&quot;&gt;BARCAMP&lt;/a&gt;&lt;/span&gt;&lt;/span&gt;, entonces prepárese para relacionarse, compartir experiencias y participar. &lt;/p&gt; &lt;p lang=&quot;es-ES&quot;&gt; La sección UTILIZACIÓN consistirá en capacitar a los usuarios de telefonía móvil sobre cómo funcionan sus dispositivos o si funcionan en su contra, y les permitirá remplazar el software de fábrica por versiones más seguras o libres. &lt;/p&gt; &lt;p lang=&quot;es-ES&quot;&gt; La sección CREACIÓN se centrará en la creación de nuevos software de seguridad o la adaptación de los ya existentes a las plataformas móviles; se debatirá sobre los tipos de amenazas para la telefonía móvil y el uso de la tecnología móvil para asistir a los defensores de derechos, periodistas y activistas. &lt;/p&gt; &lt;p lang=&quot;es-ES&quot;&gt; Como asistente del evento, tendrá la oportunidad de: &lt;/p&gt; &lt;ul&gt; &lt;li&gt; &lt;p lang=&quot;es-ES&quot;&gt; aprender a instalar y utilizar los programas para mejorar la privacidad en la telefonía móvil &lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p lang=&quot;es-ES&quot;&gt; presentar, compartir, pensar y discutir sobre su proyecto &lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p lang=&quot;es-ES&quot;&gt; participar de una actividad de desarrollo rápido de prototipos en la que el USUARIO conoce al DESARROLLADOR &lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p lang=&quot;es-ES&quot;&gt; pasar un buen momento con gente inteligente interesada en la telefonía móvil abierta &lt;/p&gt; &lt;/li&gt; &lt;/ul&gt; &lt;p lang=&quot;es-ES&quot;&gt; El equipo de The Guardian Project junto a su socio Zetetic, Inc. (creadores de SQLCipher) expondrán sus proyectos, entre los que se incluyen: &lt;/p&gt; &lt;p&gt; &lt;strong&gt;ObscuraCam e InformaCam&lt;/strong&gt; – proyectos de uso seguro de cámaras con encriptación de vídeo y fotografía y captura mejorada de metadatos : &lt;span style=&quot;color: #0000ff;&quot;&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;&lt;a href=&quot;https://guardianproject.info/apps/obscuracam/&quot;&gt;https://guardianproject.info/apps/obscuracam/&lt;/a&gt;&lt;/span&gt;&lt;/span&gt; &lt;/p&gt; &lt;p&gt; &lt;strong&gt;Open Source Telephony Network [Red de Telefonía de Código Abierto]&lt;/strong&gt; – creación de un sistema de telefonía libre, seguro y basado en estándares: &lt;a href=&quot;https://guardianproject.info/wiki/OSTN&quot;&gt;&lt;span style=&quot;color: #0000ff;&quot;&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;https://guardianproject.info/wiki/OSTN&lt;/span&gt;&lt;/span&gt;&lt;br /&gt; &lt;/a&gt;&lt;br /&gt; &lt;strong&gt;SQLCipher&lt;/strong&gt; – una extensión de la base de datos móviles de SQLite que proporciona una encriptación AES de 256-bit de archivos de base de datos creados por las aplicaciones de teléfonos móviles - &lt;span style=&quot;color: #0000ff;&quot;&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;&lt;a href=&quot;https://www.zetetic.net/sqlcipher/sqlcipher-for-android/&quot;&gt;https://www.zetetic.net/sqlcipher/sqlcipher-for-android/&lt;/a&gt;&lt;/span&gt;&lt;/span&gt; &lt;/p&gt; &lt;p&gt; ¿Aún no está seguro si Freebird es adecuado para usted? &lt;span style=&quot;color: #0000ff;&quot;&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;&lt;a href=&quot;https://guardianproject.info/freebird/who&quot;&gt;Consulte la sección &quot;Quién debería asistir&quot; para saber quienes creemos que deberían asistir&lt;/a&gt;&lt;/span&gt;&lt;/span&gt; &lt;/p&gt; &lt;p&gt; &lt;!--:--&gt; &lt;/p&gt; </code></pre> https://guardianproject.info/freebird/plan/ Fri, 27 Apr 2012 13:17:22 -0400 https://guardianproject.info/freebird/plan/ <!--:en--> <h2 id="agenda-9am-to-5pm-may-30-2012">Agenda 9am to 5pm - May 30, 2012</h2> <p>The workshop will have time for all participants to join together, as well as breakout tracks for users and developers. This is a <a href="https://en.wikipedia.org/wiki/BarCamp">BARCAMP</a> type event, so come prepared to interact, share and participate.</p> <p>The USING track will involve expanding mobile users understanding of how their phone works, or is working against them, and enabling them to replace the built-in software with more open or secure versions.</p> <p>The BUILDING track will focus on creating new or porting existing security software to mobile platforms, discussion of mobile threat models, and use of mobile technology to assist rights defenders, journalists, and activists.</p> <p>As a participant, you will have the chance to</p> <ul> <li>Learn how to install and use privacy-enhancing mobile software</li> <li>Present, share and brainstorm your project</li> <li>Join in a USER-meets-DEVELOPER rapid prototyping activity</li> <li>Have a great time, meeting smart people who care about open mobility</li> </ul> <p>The Guardian Project team, along with their partner Zetetic, Inc. (creators of SQLCipher) will be showing their projects including:</p> <p><strong>ObscuraCam and InformaCam</strong> secure smart camera projects, with video and photo encryption and enhanced metadata capture: <a href="https://guardianproject.info/apps/obscuracam/">https://guardianproject.info/apps/obscuracam/</a><br /> **<br /> Open Source Telephony Network** - building an open-source, secure, standards based telephony system: <a href="https://guardianproject.info/wiki/OSTN">https://guardianproject.info/wiki/OSTN<br /> </a><br /> <strong>SQLCipher</strong> - an extension to the SQLite mobile database that provides transparent 256-bit AES encryption of database files created by apps on mobile phones - <a href="https://www.zetetic.net/sqlcipher/sqlcipher-for-android/">https://www.zetetic.net/sqlcipher/sqlcipher-for-android/</a></p> <p>Still not sure if Freebird is for you? <a href="https://guardianproject.info/freebird/who">See &ldquo;Who&rdquo; we think should attend&hellip;</a><!--:--></p> <!--:pt--> <h2 lang="es-AR"> Agenda 9 h às 17 h – 30 de Maio de 2012 </h2> <p><span style="font-family: Times, serif;">O workshop terá tempo para todos os participantes se juntarem, bem como faixas de novidades para usuários e desenvolvedores. Esse é um evento do tipo <span style="color: #0000ff;"><span style="text-decoration: underline;"><a href="https://en.wikipedia.org/wiki/BarCamp">BARCAMP</a></span></span>, então venha preparado para interagir, compartilhar e participar.</span></p> <p lang="pt-BR"> <span style="font-family: Times, serif;">A faixa USING envolverá expandir a compreensão dos usuários de celulares sobre o funcionamento de seu telefone, ou se está trabalhando contra eles e que possam substituir o software integrado com versões mais abertas ou seguras.</span> </p> <p lang="pt-BR"> <span style="font-family: Times, serif;">A faixa BUILDING incidirá sobre a criação de novo ou mover software de segurança existente para plataformas móveis, discussão de modelos de ameaças móveis e uso de tecnologia móvel para ajudar ativistas, jornalistas e defensores de direitos.</span> </p> <p lang="pt-BR"> <span style="font-family: Times, serif;">Como participante, você terá a oportunidade de</span> </p> <ul> <li><p lang="pt-BR"> Aprender a instalar e usar software móvel que aumenta a privacidade </p></li> <li><p lang="pt-BR"> Apresentar, compartilhar e debater seu projeto </p></li> <li><p lang="pt-BR"> Participar na atividade de criação rápida de protótipos USUÁRIO-encontra-DESENVOLVEDOR </p></li> <li><p lang="pt-BR"> Se divertir, conhecendo pessoas inteligentes que se preocupam com mobilidade aberta </p></li> </ul> <p><span style="font-family: Times, serif;">O time The Guardian Project, com sua parceira Zetetic, Inc. (criadores do SQLCipher) estará mostrando seus projetos, incluindo:</span></p> <p><span style="font-family: Times, serif;"><strong>Projetos de câmera inteligente e segura</strong><strong> ObscuraCam e InformaCam</strong>, com criptografia de vídeo e fotografia e captura de metadados reforçada: <span style="color: #0000ff;"><span style="text-decoration: underline;"><a href="https://guardianproject.info/apps/obscuracam/">https://guardianproject.info/apps/obscuracam/</a></span></span></p></p> <p> <strong></p> <p><p> </strong><strong>Open Source Telephony Network</strong> – construindo um sistema de telefonia aberto, seguro, com base em normas: <a href="https://guardianproject.info/wiki/OSTN"><span style="color: #0000ff;"><span style="text-decoration: underline;"><a href="https://guardianproject.info/wiki/OSTN">https://guardianproject.info/wiki/OSTN</a></span></span><span style="color: #0000ff;"><span style="text-decoration: underline;"></p></p> <pre><code>&lt;p&gt; &lt;/span&gt;&lt;/span&gt;&lt;/a&gt; &lt;/p&gt; &lt;p&gt; &lt;strong&gt;SQLCipher&lt;/strong&gt; – uma extensão para o banco de dados móvel de SQLite que fornece criptografia transparente AES de 256 bits dos arquivos de banco de dados criado por apps em telefones celulares- &lt;span style=&quot;color: #0000ff;&quot;&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;&lt;a href=&quot;https://www.zetetic.net/sqlcipher/sqlcipher-for-android/&quot;&gt;https://www.zetetic.net/sqlcipher/sqlcipher-for-android/&lt;/a&gt;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt; &lt;/p&gt; &lt;p lang=&quot;pt-BR&quot;&gt; &lt;span style=&quot;font-family: Times, serif;&quot;&gt;Ainda não tem certeza se o Freebird é para você? &lt;span style=&quot;color: #0000ff;&quot;&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;&lt;a href=&quot;https://guardianproject.info/freebird/who&quot;&gt;Veja &quot;Quem” que nós pensamos que deve comparecer…&lt;/a&gt;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt; &lt;/p&gt; &lt;p&gt; &lt;!--:--&gt; &lt;!--:es--&gt; &lt;/p&gt; &lt;h2 lang=&quot;es-ES&quot;&gt; ACTIVIDADES DEL DÍA &lt;/h2&gt; &lt;h2 lang=&quot;es-ES&quot;&gt; Programa: de 9 a. m. a 5 p. m. - 30 de mayo de 2012 &lt;/h2&gt; &lt;p lang=&quot;es-ES&quot;&gt; El taller permitirá que todos los participantes puedan reunirse y que se organicen grupos de debate entre usuarios y desarrolladores. Este evento es un &lt;span style=&quot;color: #0000ff;&quot;&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/BarCamp&quot;&gt;BARCAMP&lt;/a&gt;&lt;/span&gt;&lt;/span&gt;, entonces prepárese para relacionarse, compartir experiencias y participar. &lt;/p&gt; &lt;p lang=&quot;es-ES&quot;&gt; La sección UTILIZACIÓN consistirá en capacitar a los usuarios de telefonía móvil sobre cómo funcionan sus dispositivos o si funcionan en su contra, y les permitirá remplazar el software de fábrica por versiones más seguras o libres. &lt;/p&gt; &lt;p lang=&quot;es-ES&quot;&gt; La sección CREACIÓN se centrará en la creación de nuevos software de seguridad o la adaptación de los ya existentes a las plataformas móviles; se debatirá sobre los tipos de amenazas para la telefonía móvil y el uso de la tecnología móvil para asistir a los defensores de derechos, periodistas y activistas. &lt;/p&gt; &lt;p lang=&quot;es-ES&quot;&gt; Como asistente del evento, tendrá la oportunidad de: &lt;/p&gt; &lt;ul&gt; &lt;li&gt; &lt;p lang=&quot;es-ES&quot;&gt; aprender a instalar y utilizar los programas para mejorar la privacidad en la telefonía móvil &lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p lang=&quot;es-ES&quot;&gt; presentar, compartir, pensar y discutir sobre su proyecto &lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p lang=&quot;es-ES&quot;&gt; participar de una actividad de desarrollo rápido de prototipos en la que el USUARIO conoce al DESARROLLADOR &lt;/p&gt; &lt;/li&gt; &lt;li&gt; &lt;p lang=&quot;es-ES&quot;&gt; pasar un buen momento con gente inteligente interesada en la telefonía móvil abierta &lt;/p&gt; &lt;/li&gt; &lt;/ul&gt; &lt;p lang=&quot;es-ES&quot;&gt; El equipo de The Guardian Project junto a su socio Zetetic, Inc. (creadores de SQLCipher) expondrán sus proyectos, entre los que se incluyen: &lt;/p&gt; &lt;p&gt; &lt;strong&gt;ObscuraCam e InformaCam&lt;/strong&gt; – proyectos de uso seguro de cámaras con encriptación de vídeo y fotografía y captura mejorada de metadatos : &lt;span style=&quot;color: #0000ff;&quot;&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;&lt;a href=&quot;https://guardianproject.info/apps/obscuracam/&quot;&gt;https://guardianproject.info/apps/obscuracam/&lt;/a&gt;&lt;/span&gt;&lt;/span&gt; &lt;/p&gt; &lt;p&gt; &lt;strong&gt;Open Source Telephony Network [Red de Telefonía de Código Abierto]&lt;/strong&gt; – creación de un sistema de telefonía libre, seguro y basado en estándares: &lt;a href=&quot;https://guardianproject.info/wiki/OSTN&quot;&gt;&lt;span style=&quot;color: #0000ff;&quot;&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;https://guardianproject.info/wiki/OSTN&lt;/span&gt;&lt;/span&gt;&lt;br /&gt; &lt;/a&gt;&lt;br /&gt; &lt;strong&gt;SQLCipher&lt;/strong&gt; – una extensión de la base de datos móviles de SQLite que proporciona una encriptación AES de 256-bit de archivos de base de datos creados por las aplicaciones de teléfonos móviles - &lt;span style=&quot;color: #0000ff;&quot;&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;&lt;a href=&quot;https://www.zetetic.net/sqlcipher/sqlcipher-for-android/&quot;&gt;https://www.zetetic.net/sqlcipher/sqlcipher-for-android/&lt;/a&gt;&lt;/span&gt;&lt;/span&gt; &lt;/p&gt; &lt;p&gt; ¿Aún no está seguro si Freebird es adecuado para usted? &lt;span style=&quot;color: #0000ff;&quot;&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;&lt;a href=&quot;https://guardianproject.info/freebird/who&quot;&gt;Consulte la sección &quot;Quién debería asistir&quot; para saber quienes creemos que deberían asistir&lt;/a&gt;&lt;/span&gt;&lt;/span&gt; &lt;/p&gt; &lt;p&gt; &lt;!--:--&gt; &lt;/p&gt; </code></pre> https://guardianproject.info/freebird/who/ Fri, 27 Apr 2012 13:11:35 -0400 https://guardianproject.info/freebird/who/ <!--:en--> <h2 id="who-should-attend-freebird">WHO SHOULD ATTEND FREEBIRD?</h2> <h3 id="is-freebird-for-you-yes">Is Freebird for you? YES!</h3> <p>Have you ever worried about if your phone could talk, all the things it would know about your life?</p> <p><strong><em>Then Freebird is for you</em></strong></p> <p>Have you rooted, jailbroken or otherwise hacked your phone, in order to make it better somehow?</p> <p><em><strong>Then Freebird is for you</strong></em></p> <p>Have you ever built an app for a mobile phone that somehow enhances the privacy of its user, instead of exploiting it?</p> <p><em><strong>Then Freebird is for you</strong></em></p> <p>Are you tired of phone companies and mobile operators telling you what you can or cannot do with the personal mobile computer you just paid a whole lot of money for?</p> <p><em><strong>Then Freebird is for you</strong></em></p> <p>Do you use mobile phones for protests, activism or human rights, but are worried you may be doing more harm than good?</p> <p><em><strong>Then Freebird is for you</strong></em></p> <h2 id="the-growing-list-of-participants-include">THE GROWING LIST OF PARTICIPANTS INCLUDE&hellip;</h2> <p><a href="http://zetetic.net"><img title="project-zetetic-logo" src="https://guardianproject.info/wp-content/uploads/2012/04/project-zetetic-logo-300x136.png" alt="" width="210" height="95" /></a><a href="https://torproject.org"><img title="torproject" src="https://guardianproject.info/wp-content/uploads/2012/04/torproject.png" alt="" width="150" height="118" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2010/02/witness-logo.gif"><img title="witness-logo" src="https://guardianproject.info/wp-content/uploads/2010/02/witness-logo.gif" alt="" width="172" height="87" /></a></p> <p><em>&hellip; and more coming soon!</em><!--:--></p> <!--:pt--> <h3 lang="en-GB"> O Freebird é para você? SIM! </h3> <p>Alguma vez se preocupou se seu celular pudesse falar, todas as coisas que ele saberia sobre sua vida?</p> <p><em><strong>O Freebird é para você!</strong></em></p> <p>Já alguma vez fez o root, jailbreak ou hackeou seu celular de forma a torná-lo melhor?</p> <p><em><strong>O Freebird é para você!</strong></em></p> <p>Alguma vez você criou um app para um celular que de alguma forma aumenta a privacidade de seu utilizador, em vez de explorá-la?</p> <p><em><strong>O Freebird é para você!</strong></em></p> <p>Você está cansado de empresas de telefonia e operadoras de telefonia celular, lhe dizendo o que você pode ou não pode fazer com o computador portátil pessoal pelo qual você pagou muito dinheiro?</p> <p><em><strong>O Freebird é para você!</strong></em></p> <p lang="en-GB"> Você usa celulares para protestos, ativismo ou direitos humanos, mas está preocupado que pode estar fazendo mais mal do que bem? </p> <p><em><strong>O Freebird é para você!</strong></em></p> <h2 lang="pt-BR"> A LISTA CRESCENTE DE PARTICIPANTES INCLUI… </h2> <p lang="pt-BR"> <h2> <a href="http://zetetic.net"><img title="project-zetetic-logo" src="https://guardianproject.info/wp-content/uploads/2012/04/project-zetetic-logo-300x136.png" alt="" width="210" height="95" /></a><a href="https://torproject.org"><img title="torproject" src="https://guardianproject.info/wp-content/uploads/2012/04/torproject.png" alt="" width="150" height="118" /></a> </h2> <p> <a href="https://guardianproject.info/wp-content/uploads/2010/02/witness-logo.gif"><img title="witness-logo" src="https://guardianproject.info/wp-content/uploads/2010/02/witness-logo.gif" alt="" width="172" height="87" /></a> </p> <p><p> <em>&hellip; and more coming soon!</em> </p></p> <p><p> <!--:--></p> <pre><code>&lt;!--:es--&gt; &lt;span style=&quot;font-family: Times;&quot;&gt;¿Alguna vez se preguntó todo lo que su teléfono móvil podría saber sobre su vida&lt;br /&gt; si pudiera hablar?&lt;br /&gt; &lt;em&gt;&lt;strong&gt;Entonces Freebird es para usted.&lt;/strong&gt;&lt;/em&gt;&lt;/span&gt; </code></pre> <p></p></p> <p><p> <span style="font-family: Times;">¿Alguna vez &ldquo;rooteó&rdquo;, desbloqueó o &ldquo;hackeó&rdquo; su teléfono<br /> para mejorarlo de alguna manera?<br /> <em><strong>Entonces Freebird es para usted.</strong></em></span> </p></p> <p><p> <span style="font-family: Times;">¿Alguna vez creó una aplicación que mejora la privacidad del usuario del teléfono móvil<br /> , en lugar de explotarla?<br /> <em><strong>Entonces Freebird es para usted.</strong></em></span> </p></p> <p><p> <span style="font-family: Times;">¿Está cansado de que las compañías de telefonía móvil y los operadores le digan lo que puede y lo que no puede hacer<br /> con la computadora personal portátil por la que tanto pagó?<br /> <em><strong>Entonces Freebird es para usted.</strong></em></span> </p></p> <p><p> <span style="font-family: Times;">¿Usa teléfonos móviles para actividades de protesta o reclamo de los derechos humanos,<br /> pero le preocupa hacer más daño que bien?<br /> <em><strong>Entonces Freebird es para usted.</strong></em></span> </p></p> <p><h2> LA CRECIENTE LISTA DE PARTICIPANTES INCLUYE A </h2></p> <p><p> <a href="http://zetetic.net"><img class="alignnone wp-image-1993" title="project-zetetic-logo" src="https://guardianproject.info/wp-content/uploads/2012/04/project-zetetic-logo-300x136.png" alt="" width="210" height="95" srcset="https://guardianproject.info/wp-content/uploads/2012/04/project-zetetic-logo-300x136.png 300w, https://guardianproject.info/wp-content/uploads/2012/04/project-zetetic-logo.png 600w" sizes="(max-width: 210px) 100vw, 210px" /></a><a href="https://torproject.org"><img class="alignnone wp-image-1991" title="torproject" src="https://guardianproject.info/wp-content/uploads/2012/04/torproject.png" alt="" width="150" height="118" /></a> </p></p> <p><p> <a href="https://guardianproject.info/wp-content/uploads/2010/02/witness-logo.gif"><img class="alignnone size-full wp-image-722" title="witness-logo" src="https://guardianproject.info/wp-content/uploads/2010/02/witness-logo.gif" alt="" width="172" height="87" /></a> </p></p> <p><p> <em>&hellip; and more coming soon!</em><!--:--> </p></p> https://guardianproject.info/freebird/who/ Fri, 27 Apr 2012 13:11:35 -0400 https://guardianproject.info/freebird/who/ <!--:en--> <h2 id="who-should-attend-freebird">WHO SHOULD ATTEND FREEBIRD?</h2> <h3 id="is-freebird-for-you-yes">Is Freebird for you? YES!</h3> <p>Have you ever worried about if your phone could talk, all the things it would know about your life?</p> <p><strong><em>Then Freebird is for you</em></strong></p> <p>Have you rooted, jailbroken or otherwise hacked your phone, in order to make it better somehow?</p> <p><em><strong>Then Freebird is for you</strong></em></p> <p>Have you ever built an app for a mobile phone that somehow enhances the privacy of its user, instead of exploiting it?</p> <p><em><strong>Then Freebird is for you</strong></em></p> <p>Are you tired of phone companies and mobile operators telling you what you can or cannot do with the personal mobile computer you just paid a whole lot of money for?</p> <p><em><strong>Then Freebird is for you</strong></em></p> <p>Do you use mobile phones for protests, activism or human rights, but are worried you may be doing more harm than good?</p> <p><em><strong>Then Freebird is for you</strong></em></p> <h2 id="the-growing-list-of-participants-include">THE GROWING LIST OF PARTICIPANTS INCLUDE&hellip;</h2> <p><a href="http://zetetic.net"><img title="project-zetetic-logo" src="https://guardianproject.info/wp-content/uploads/2012/04/project-zetetic-logo-300x136.png" alt="" width="210" height="95" /></a><a href="https://torproject.org"><img title="torproject" src="https://guardianproject.info/wp-content/uploads/2012/04/torproject.png" alt="" width="150" height="118" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2010/02/witness-logo.gif"><img title="witness-logo" src="https://guardianproject.info/wp-content/uploads/2010/02/witness-logo.gif" alt="" width="172" height="87" /></a></p> <p><em>&hellip; and more coming soon!</em><!--:--></p> <!--:pt--> <h3 lang="en-GB"> O Freebird é para você? SIM! </h3> <p>Alguma vez se preocupou se seu celular pudesse falar, todas as coisas que ele saberia sobre sua vida?</p> <p><em><strong>O Freebird é para você!</strong></em></p> <p>Já alguma vez fez o root, jailbreak ou hackeou seu celular de forma a torná-lo melhor?</p> <p><em><strong>O Freebird é para você!</strong></em></p> <p>Alguma vez você criou um app para um celular que de alguma forma aumenta a privacidade de seu utilizador, em vez de explorá-la?</p> <p><em><strong>O Freebird é para você!</strong></em></p> <p>Você está cansado de empresas de telefonia e operadoras de telefonia celular, lhe dizendo o que você pode ou não pode fazer com o computador portátil pessoal pelo qual você pagou muito dinheiro?</p> <p><em><strong>O Freebird é para você!</strong></em></p> <p lang="en-GB"> Você usa celulares para protestos, ativismo ou direitos humanos, mas está preocupado que pode estar fazendo mais mal do que bem? </p> <p><em><strong>O Freebird é para você!</strong></em></p> <h2 lang="pt-BR"> A LISTA CRESCENTE DE PARTICIPANTES INCLUI… </h2> <p lang="pt-BR"> <h2> <a href="http://zetetic.net"><img title="project-zetetic-logo" src="https://guardianproject.info/wp-content/uploads/2012/04/project-zetetic-logo-300x136.png" alt="" width="210" height="95" /></a><a href="https://torproject.org"><img title="torproject" src="https://guardianproject.info/wp-content/uploads/2012/04/torproject.png" alt="" width="150" height="118" /></a> </h2> <p> <a href="https://guardianproject.info/wp-content/uploads/2010/02/witness-logo.gif"><img title="witness-logo" src="https://guardianproject.info/wp-content/uploads/2010/02/witness-logo.gif" alt="" width="172" height="87" /></a> </p> <p><p> <em>&hellip; and more coming soon!</em> </p></p> <p><p> <!--:--></p> <pre><code>&lt;!--:es--&gt; &lt;span style=&quot;font-family: Times;&quot;&gt;¿Alguna vez se preguntó todo lo que su teléfono móvil podría saber sobre su vida&lt;br /&gt; si pudiera hablar?&lt;br /&gt; &lt;em&gt;&lt;strong&gt;Entonces Freebird es para usted.&lt;/strong&gt;&lt;/em&gt;&lt;/span&gt; </code></pre> <p></p></p> <p><p> <span style="font-family: Times;">¿Alguna vez &ldquo;rooteó&rdquo;, desbloqueó o &ldquo;hackeó&rdquo; su teléfono<br /> para mejorarlo de alguna manera?<br /> <em><strong>Entonces Freebird es para usted.</strong></em></span> </p></p> <p><p> <span style="font-family: Times;">¿Alguna vez creó una aplicación que mejora la privacidad del usuario del teléfono móvil<br /> , en lugar de explotarla?<br /> <em><strong>Entonces Freebird es para usted.</strong></em></span> </p></p> <p><p> <span style="font-family: Times;">¿Está cansado de que las compañías de telefonía móvil y los operadores le digan lo que puede y lo que no puede hacer<br /> con la computadora personal portátil por la que tanto pagó?<br /> <em><strong>Entonces Freebird es para usted.</strong></em></span> </p></p> <p><p> <span style="font-family: Times;">¿Usa teléfonos móviles para actividades de protesta o reclamo de los derechos humanos,<br /> pero le preocupa hacer más daño que bien?<br /> <em><strong>Entonces Freebird es para usted.</strong></em></span> </p></p> <p><h2> LA CRECIENTE LISTA DE PARTICIPANTES INCLUYE A </h2></p> <p><p> <a href="http://zetetic.net"><img class="alignnone wp-image-1993" title="project-zetetic-logo" src="https://guardianproject.info/wp-content/uploads/2012/04/project-zetetic-logo-300x136.png" alt="" width="210" height="95" srcset="https://guardianproject.info/wp-content/uploads/2012/04/project-zetetic-logo-300x136.png 300w, https://guardianproject.info/wp-content/uploads/2012/04/project-zetetic-logo.png 600w" sizes="(max-width: 210px) 100vw, 210px" /></a><a href="https://torproject.org"><img class="alignnone wp-image-1991" title="torproject" src="https://guardianproject.info/wp-content/uploads/2012/04/torproject.png" alt="" width="150" height="118" /></a> </p></p> <p><p> <a href="https://guardianproject.info/wp-content/uploads/2010/02/witness-logo.gif"><img class="alignnone size-full wp-image-722" title="witness-logo" src="https://guardianproject.info/wp-content/uploads/2010/02/witness-logo.gif" alt="" width="172" height="87" /></a> </p></p> <p><p> <em>&hellip; and more coming soon!</em><!--:--> </p></p> https://guardianproject.info/freebird/signup/ Fri, 27 Apr 2012 12:24:47 -0400 https://guardianproject.info/freebird/signup/ <!--:en--> <p><strong>Freebird is full! Thank you for the interest. </strong></p> <p>Please visit the full <a href="https://guardianproject.info">Guardian Project website</a> to learn about other ways you can participate in working towards a more open, secure mobile world.<!--:--></p> <!--:pt--> <p><strong>Preencha a informações abaixo e responderemos em breve com mais informações.</strong></p> <p>[contact-form-7 id=&ldquo;1889&rdquo; title=&ldquo;Freebird: RioNYC&rdquo;]</p> <!--:--> <!--:es--> <p><strong>Please fill out the information below, and we will respond shortly with more information.</strong></p> <p>[contact-form-7 id=&ldquo;1889&rdquo; title=&ldquo;Freebird: Rio&lt;-&gt;NYC&rdquo;]</p> <!--:--> https://guardianproject.info/freebird/signup/ Fri, 27 Apr 2012 12:24:47 -0400 https://guardianproject.info/freebird/signup/ <!--:en--> <p><strong>Freebird is full! Thank you for the interest. </strong></p> <p>Please visit the full <a href="https://guardianproject.info">Guardian Project website</a> to learn about other ways you can participate in working towards a more open, secure mobile world.<!--:--></p> <!--:pt--> <p><strong>Preencha a informações abaixo e responderemos em breve com mais informações.</strong></p> <p>[contact-form-7 id=&ldquo;1889&rdquo; title=&ldquo;Freebird: RioNYC&rdquo;]</p> <!--:--> <!--:es--> <p><strong>Please fill out the information below, and we will respond shortly with more information.</strong></p> <p>[contact-form-7 id=&ldquo;1889&rdquo; title=&ldquo;Freebird: Rio&lt;-&gt;NYC&rdquo;]</p> <!--:--> https://guardianproject.info/2012/04/19/singing-and-dancing-for-encryption/ Thu, 19 Apr 2012 09:30:48 -0400 https://guardianproject.info/2012/04/19/singing-and-dancing-for-encryption/ <p style="text-align: center"> <span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"><a href="https://secure.flickr.com/photos/ksd-photography/4899157618/"><img class="aligncenter" src="https://farm5.staticflickr.com/4099/4899157618_b35f53be23_z.jpg" alt="【KSD Photography】 Capturing Life" width="640" height="343" /></a></span></span></span> </p> <p style="text-align: left"> <span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">If you see me dancing or signing with my phone in my hand, I may not just be having a great time, but also creating an encryption key. Part of the issue with security is that it can often be difficult to implement or an added step in what users want to be an easy and seamless process. What if we can make secure and private communications fun and easy?</span></span></span> </p> <p><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">This past weekend, a bunch of members of the Guardian Project team found ourselves at the <a title="wall-street-journal-data-transparency-weekend-day" href="http://blogs.wsj.com/digits/2012/04/16/the-winners-of-wsjs-data-transparency-weekend/" target="_blank">Wall Street Journal Data Transparency Hackathon</a>. The Journal put this together in order to “invite developers to help build free Web tools that promote data transparency and control.” The tracks were divided into:</span></span></span></p> <ul> <li><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"><strong>Scanning:</strong></span></span></span><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"> Enhancing technology that scans the Web to reveal tracking</span></span></span></li> <li><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"><strong>Education:</strong></span></span></span><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"> Helping people see how much information they share</span></span></span></li> <li><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"><strong>Control:</strong></span></span></span><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"> Improving software that helps people control sensitive information</span></span></span></li> </ul> <p><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">Tracks were led by </span></span></span><a title="ashkan soltani" href="http://ashkansoltani.org/" target="_blank"><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">Ashkan Soltani</span></span></span></a><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">, an independent researcher and technical adviser to the Journal; </span></span></span><a title="brian kennish" href="http://byoogle.com/" target="_blank"><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">Brian Kennish</span></span></span></a><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">, a Web developer and founder of Disconnect; and </span></span></span><a title="Jacob Appelbaum" href="https://twitter.com/#!/ioerror" target="_blank"><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">Jacob Appelbaum</span></span></span></a><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">, a security researcher at the Tor Project. Our teams went down the path of control, with the goal of making tools that are secure by default.</span></span></span></p> <p><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">We danced our way into winning in the control category by helping the victorious <a title="cryptocat" href="https://crypto.cat/about/" target="_blank">Cryptocat</a> team that has a tool for encrypted chat service right from the browser. This fantastic project blew through a number of innovations, porting into a Firefox web app, doing desktop notifications, and improved cryptographic primitives from within the browser. We helped by creating an Android app for the tool that converts dance moves into a random number generator for creating the encryption key. Just start the program, enter the name of the chat, enter your nickname, then DANCE. Starting a secure chat from a phone is now as easy as that. You can try it in your browser via their site </span></span></span><a href="https://crypto.cat/"><span style="color: #0025e5"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"><span style="text-decoration: underline">https://crypto.cat/</span></span></span></span></a><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"> or <a title="cryptocat android app" href="https://guardianproject.info/apps/cryptocat/" target="_blank">download our new Android app</a> (either with or without Tor compatibility)</span></span></span><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">. And congrats to <a title="nadim kobeissi" href="http://nadim.cc/" target="_blank">Nadim Kobeissi</a> for this well deserved win and the team Tobias Pulls, Jacob Appelbaum, <a title="david huerta" href="http://davidhuerta.me/" target="_blank">David Huerta</a>, <a title="joseph bonneau" href="http://www.jbonneau.com/" target="_blank">Joseph Bonneau</a>  and <a title="nathan freittas" href="http://openideals.com/" target="_blank">Nathan Freitas</a>.</span></span></span></p> <div style="width: 510px" class="wp-caption aligncenter"> <a href="https://secure.flickr.com/photos/aspirationtech/7077092229/sizes/m/in/photostream/"><img src="https://farm6.staticflickr.com/5071/7077092229_5e3f9ed867.jpg" alt="" width="500" height="333" /></a> <p class="wp-caption-text"> The Guardian Team & Friends Hacking Away </p> </div> <p><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">We sang our way into winning in a new category that the judges came up with, “soup cans and string” for <a title="Open Secure Telephony Network (OSTN) ostel" href="https://ostel.me" target="_blank">Ostel</a>, our encrypted VOIP solution. Launching an alpha version of our tool in front of some of the worlds leading experts in the security field was a risky move, but thankfully we managed to work out a number of bugs and generally received great feedback and support from the community. Over the weekend, we made progress in our alpha demo, identified additional clients that can receive calls on Mac, PC, Linux, iPhone, &amp; Blackberry and created a new user signup system that allows users to register and immediately be sent an email with a link to their credentials via SSL. To extend the project even further, we have started compiling information on VOIP laws in countries from every continent so that the tool can explicitly be supported on as many platforms, in as many countries and in as many languages as possible. In addition to singing praise, singing (and other voice signatures) might be used in the future for entropy as the random number generator for the encryption key exchange. <a title="privategsm" href="http://www.privatewave.com/products-services/private-gsm/product.html" target="_blank">PrivateGSM</a> is already doing this and it would be great to incorporate this feature into Ostel &amp; <a title="CSipSimple" href="https://code.google.com/p/csipsimple/" target="_blank">CSipSimple</a> later on. Thanks to Lee Azzarello, Luke Stark, Sean McIntyre and Zach Schwartz for being great members of the Ostel team. </span></span></span></p> <div style="width: 510px" class="wp-caption aligncenter"> <a href="https://secure.flickr.com/photos/aspirationtech/6935372190/sizes/m/in/photostream/"><img src="https://farm6.staticflickr.com/5327/6935372190_a576a30d16.jpg" alt="" width="500" height="333" /></a> <p class="wp-caption-text"> Lee accepts the "Soupcan & Strings Award" for Ostel </p> </div> <p>Dancing for encryption in Cryptocat, singing for encryption in Ostel. Let us know if you have other ideas for fun ways to generate keys. We’re always looking for inspiring ideas from the community.</p> <p><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">We’re even well on our way to seeing the world through encryption tinted glasses. Progress was made on making innovations in <a title="informacam" href="https://guardianproject.info/2012/01/20/introducing-informacam/" target="_blank">our Informacam project</a>. The goal is to be able to snap a picture, but protect the privacy of the people in the frame by blurring their faces and the metadata connected to the event. Whie this can be crucial in a sensitive scenario, it can also be important that a judge or trusted organization can “unblur” the image and so we’re working on a way to encrypt and send those pixels. Bugs were removed, code was written, and soon enough, hopefully we’ll be able to incorporate it into the <a title="google augmented reality goggles" href="https://arstechnica.com//gadgets/news/2012/04/google-unveils-project-glass-augmented-reality-glasses.ars" target="_blank">new Google Augmented reality goggles</a>.  </span></span></span></p> <table style="margin: 0px auto"> <tr> <td width="201"> <img class="alignnone size-full wp-image-1461" src="https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.21.07-PM.png" alt="InformaCam (2)" width="201" height="332" srcset="https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.21.07-PM.png 201w, https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.21.07-PM-181x300.png 181w" sizes="(max-width: 201px) 100vw, 201px" /> </td> <td width="197"> <img class="alignnone size-full wp-image-1462" src="https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.21.21-PM.png" alt="InformaCam (3)" width="197" height="330" srcset="https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.21.21-PM.png 197w, https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.21.21-PM-179x300.png 179w" sizes="(max-width: 197px) 100vw, 197px" /> </td> </tr> <tr> <td> <em>Using the InformaCam “Identify” filter.</em> </td> <td> <em>Select a Trusted Destination for your encrypted media.</em> </td> </tr> </table> <p><span><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">Being head down, singing and dancing encryption with our security glasses on while coding, it was easy to miss the other amazing projects in the room. I highly recommend checking out the other winners as well. They’re doing fantastic and necessary work:</span></span></span></p> <ul> <li><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">“Scanning” Track Winner:  </span></span></span><a href="http://www.hackerleague.org/hackathons/wsj-data-transparency-code-a-thon/hacks/tosback2"><span style="color: #0025e5"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"><span style="text-decoration: underline">TOSBack2</span></span></span></span></a><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"> – a living archive of all privacy policies</span></span></span></li> <li><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">“Education” Track Winner:   </span></span></span><a href="http://www.hackerleague.org/hackathons/wsj-data-transparency-code-a-thon/hacks/privacybucket"><span style="color: #0025e5"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"><span style="text-decoration: underline">PrivacyBucket</span></span></span></span></a><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"> – a Chrome extension that measures the extent to which individual third-party trackers can discover demographic information about the use</span></span></span></li> <li><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">Judges’ Choice Winner:   </span></span></span><a href="http://www.hackerleague.org/hackathons/wsj-data-transparency-code-a-thon/hacks/site-scoper"><span style="color: #0025e5"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"><span style="text-decoration: underline">Site Scoper</span></span></span></span></a></li> <li><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">“Ready for Primetime” Winner:   </span></span></span><a href="http://www.hackerleague.org/hackathons/wsj-data-transparency-code-a-thon/hacks/mobilescope"><span style="color: #0025e5"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"><span style="text-decoration: underline">MobileScope</span></span></span></span></a></li> <li><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">“Zuckerberg/Systrom Memorial Award for Opportunistic Optimism” Winner:   </span></span></span><a href="http://www.hackerleague.org/hackathons/wsj-data-transparency-code-a-thon/hacks/pestagram-its-pinterest-for-instagram"><span style="color: #0025e5"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"><span style="text-decoration: underline">Pestagram</span></span></span></span></a></li> <li><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">“Best Listener” Winner:   </span></span></span><a href="http://www.hackerleague.org/hackathons/wsj-data-transparency-code-a-thon/hacks/the-price-of-free"><span style="color: #0025e5"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"><span style="text-decoration: underline">The Price of Free</span></span></span></span></a><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small"> </span></span></span></li> </ul> <p><span style="color: #000000"><span style="font-family: ArialMT,sans-serif"><span style="font-size: small">Thanks to <a title="julia angwin" href="http://www.juliaangwin.com/" target="_blank">Julia Angwin</a> and the WSJ team for making this great event and the fantastic <a title="what they know" href="http://blogs.wsj.com/wtk/" target="_blank">What They Know blog</a> possible, to <a title="gunner aspiration" href="http://aspirationtech.org/blog/gunner" target="_blank">Gunner</a> for being such an inspiring facilitator, to judges Alessandro Acquisti, Sid Stamm, Dan Kaminsky, <a title="andrew mclaughlin" href="http://andrewmclaughlin.info/" target="_blank">Andrew McLaughlin</a> and to everyone else who made this possible.</span></span></span></p> https://guardianproject.info/2012/04/14/user-scenarios-to-guide-our-crypto-development/ Sat, 14 Apr 2012 20:16:03 -0400 https://guardianproject.info/2012/04/14/user-scenarios-to-guide-our-crypto-development/ <p>At Guardian Project, we find user-centered development to be essential to producing useful software that addresses real world needs. To drive this, we work with user stories and scenarios as part of the process of developing software. One particular development focus is the <a href="https://guardianproject.info/wiki/PSST" title="Portable Shared Security Token" target="_blank">Portable Shared Security Token (PSST)</a> project, which aims to make it easy to use encryption across both mobile and desktop computers, as well as keep the stores of cryptographic identities (i.e. trusted keys, certificates, etc) in sync between devices.</p> <p>This post outlines some initial user scenarios that PSST aims to address. We believe them to be common enough so that our solutions will be readily applicable to real world people now. They are a small subset of all of the types of users that we feel can ultimately benefit from the PSST core research, so these user stories provide a starting place for honing the tools for the needs of actual working organizations. These stories also discuss how the software could be used in these situations. The software as described mostly exists, but not all details are currently implemented or even fully vetted as secure practices.</p> <p>We are very eager for feedback, comments, and criticism on any aspect of these scenarios, from whether they are plausible to whether the user interactions described are built upon realistic expectations of actual members of organizations like the ones described here.</p> <p><strong>The Small Cabal</strong></p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/activists-meeting.jpg"><img src="https://guardianproject.info/wp-content/uploads/2012/04/activists-meeting.jpg" alt="" width="300" height="224" class="alignright size-full wp-image-1799" /></a>There is a small group of people that needs to communicate as securely and anonymously as possible. They all meet up in person. They generate keys, and individually sign each person’s key and get that person’s signature on their own key. These are local-only unpublishable signatures. No one uploads their keys to any other server or device. They each generate a revocation certificate and hook it up to their panic button app. Once the panic button is hit, the phone broadcasts the revocation certificate to the pre-determined list of people.</p> <p><strong>Diffuse Activist Organization</strong></p> <p>An activist organization has members spread out all over their country, with concentrations in certain areas, and a handful abroad. They are working in a country that aggressively tracks communications, but encryption is not banned nor aggressively tracked. Since there are many members and they are widely spread, very few of the members have met the whole membership. Many members often meet up in person at various places around the country, and some people also travel to regional and national meet-ups. The central forum for the whole group is on the internet, and there are many big group discussions and announcements that happen on internet forums.</p> <p>Each member has a cryptographic key that represents their online identity, which they post to the public keyservers. They generate and store a revocation certificate to upload to the keyservers in case of a compromised key or computer. They do not post any signatures to the key servers so that the social graph information remains private. Whenever they meet another person that they trust, they sign each others’ keys and swap all signature data using direct peer-to-peer communication.</p> <p>When interacting with members who they only know on the internet, they check whether they have a cryptographic trust path to each others’ keys, and if not, they establish the first step of trust via OTR by doing key verification via question/answer, shared secret or manual fingerprint validation over a trusted channel, like the phone. When they hit there panic button the post the revocation certificate to the keyserver. Each member’s computer/phone automatically checks the public keyservers for revocations hourly, and marks any revoked key as invalid as soon as it receives a revocation certificate.</p> <p><strong>Multinational Organization</strong></p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/orgmtg.jpg"><img src="https://guardianproject.info/wp-content/uploads/2012/04/orgmtg.jpg" alt="" width="300" height="158" class="alignleft size-full wp-image-1800" /></a>An organization has many members in a number of different countries. Some of the governments are supportive of the organization’s goals, while some of the governments are strongly hostile and are actively seeking out local members. Many members work in countries where there is little chance of active tracking and monitoring of their use of encryption, while others work in high risk environments from time to time. Certain local contacts and members work in aggressively monitored countries where use of encryption is a flag for the secret police.</p> <p>The public figures of the organization in safe countries have a public trust profile that is freely downloadable. They use the public OpenPGP infrastructure and publicly share all public signatures. These members also have private, unpublishable signatures related to the members in high risk situations. Operatives in high risk situations use only unpublishable local signatures and the whole collection of signatures is stored in an encrypted form. There devices only contact keyservers via anonymized connections like Tor or VPNs.</p> <p>When members are signing each other’s keys, the signatures are always sent to the key owner via encrypted email. The signer can then mark the signature as private or public, or their software can be set to always mark all keys as private and unpublishable. When the key owner receives the emailed signature, she can then decide how to manage the signatures: either privately import the signature to their keyring, where it will be stored in an unpublishable format; or publicly import the signature into their keyring and sync it via the public PGP servers. If the signer emailed a private signature to the key owner, then the key management software will automatically make it a private signature.</p> <p><strong>Improvised movement organized via social software</strong></p> <p><a href="https://en.wikipedia.org/wiki/File:Tahrir_Square_during_8_February_2011.jpg"><img src="https://guardianproject.info/wp-content/uploads/2012/04/Tahrir_Square_during_8_February_2011-300x225.jpg" alt="" width="300" height="225" class="alignright size-medium wp-image-1791" srcset="https://guardianproject.info/wp-content/uploads/2012/04/Tahrir_Square_during_8_February_2011-300x225.jpg 300w, https://guardianproject.info/wp-content/uploads/2012/04/Tahrir_Square_during_8_February_2011-1024x768.jpg 1024w, https://guardianproject.info/wp-content/uploads/2012/04/Tahrir_Square_during_8_February_2011.jpg 1600w" sizes="(max-width: 300px) 100vw, 300px" /></a>People from all over a region join a popular movement to help organize protests, distribute media, spread information, etc. Many join in groups of friends or family, but overall the group is not socially well connected together. The common cause is the central binding of the group. In their communications, they want to avoid keyword filtering and communications tracking, as well as try to hinder infiltration and the injection of misinformation. They need to communicate and exchange media with some level of trust. Since the group wants as many members as possible, the infrastructure must be relatively open and public.</p> <p>Users who do not have any shared history will trust each other’s keys on first contact, and rely on the continued validation against the initial mark of trust (known as TOFU/POP or Trust On First Use/Persistence of Pseudonym). Once users build up some context with each other, they can deepen the cryptographic trust by using OTR question/answer or shared secret authentication. Users publicly share their TOFU/POP and OTR marks of trust on public exchanges so that people can build up public trust in their cryptographic identity.</p> <p><strong>Foreign Journalist, Diplomat, Business Person, etc.</strong></p> <p>This user is working in a place with active monitoring, tracking and filtering. She has strong links to institutions outside of the country that can help in case of trouble. She has clear outsider status so is able to use encryption and anonymizing software without a large risk of persecution. She wants to keep her communications private in the face of active monitoring.</p> <p>Standard public cryptography tools cover most of this situation, but they must be made easier to use, and work on mobile devices. If this user needs encrypted exchanges with locals at high risk of monitoring, local unpublishable signatures can be used in those situations.</p> https://guardianproject.info/2012/04/10/how-we-help/ Tue, 10 Apr 2012 00:00:00 +0000 https://guardianproject.info/2012/04/10/how-we-help/ <p>While we think that a secure, privacy-enhanced mobile phone is a good thing for just about anybody going about their daily lives, we like to also consider the extreme cases, where this technology might change the course of someones life.</p> <p>The Economist covered our work with WITNESS on <a href="https://www.witness.org/cameras-everywhere/witness-labs">Secure Smart Cameras</a>, and the <a href="https://www.youtube.com/watch?v=lk2dTeDSHB8&amp;feature=player_embedded">&ldquo;Future of Protest Video&rdquo;</a>.</p> <p>Below are a few ideas of how Guardian phones might be used in the real world.</p> <h3 id="the-new-mobile-journalist">The New Mobile Journalist</h3> <blockquote> <div id="_mcePaste"> By convincing them of its ability to safeguard information on contacts, story notes and digital media, Guardian will become the new "reporter's notepad" for major news organizations like the New York Times, BBC, CNN and Al Jazeera. In addition the (soon to have) 12MP still camera and HD video / audio recording capabilities of new Android hardware meet the quality standards for broadcast, print and online production. In addition, emerging online citizen journalists organizations can afford to promote the use of and distribute Guardian phones to their contributors. </div> </blockquote> <h3 id="routing-around-censorship">Routing around Censorship</h3> <blockquote> <div id="_mcePaste"> Mobile phones in many countries face the same online censorship and monitoring that desktop web users do. Guardian, in collaboration with the Tor Project, provides tools for circumventing the blocking of sites, such as Google, YouTube, Facebook, CNN, Wikipedia and more, while also protecting the information the user is searching for, sharing or publishing, whether it be a chat with their friends, or their latest blog post. </div> </blockquote> <h3 id="advocating-for-human-rights">Advocating for Human Rights</h3> <blockquote> <div id="_mcePaste"> An undercover human rights researcher traveling through a remote region without mobile data service is able to use their Guardian phone to document local conditions (via camera phone or audio recording) while seeming to just be making phone calls or checking a text message. Data captures is stored encrypted on the device or a removable SD card. If the researcher is detained by a local militia force, they can easily wipe the device, or if unable to, be assured that all data is securely encrypted, and near impossible to crack without significant computing resources. In addition, the names and phone numbers of people they have been in contact with are not revealed to the local forces, safeguarding those who they intended to help in the first place. </div> </blockquote> <h3 id="verifying-the-media">Verifying the Media</h3> <blockquote> <div> Tech savvy citizen journalists and activists in the streets of a protest use Guardian phones to send updates, photos and videos to the Internet without interception by the local authorities, while also maintaining their anonymity. In addition, because Guardian utilizes cryptographic data signing, the media posted is trusted and reputable, and even includes GPS coordinates in its metadata. </div> </blockquote> <h3 id="mapping-a-crisis">Mapping a Crisis</h3> <blockquote> <div id="_mcePaste"> UN Election monitoring teams distribute low cost Guardian phones (tied into a crisis mapping platform such as Ushahidi) to community organizations to report on issues. Guardian assures reports are sent without being tampered with and provides the UN and the local groups an ability to securely communicate without local interception </div> </blockquote> https://guardianproject.info/2012/04/03/transparent-encrypted-virtual-disks-for-android-we-call-it-iocipher/ Tue, 03 Apr 2012 13:16:41 -0400 https://guardianproject.info/2012/04/03/transparent-encrypted-virtual-disks-for-android-we-call-it-iocipher/ <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/blog_sed.png"><img src="https://guardianproject.info/wp-content/uploads/2012/04/blog_sed.png" alt="" width="200" height="200" class="alignleft size-full wp-image-1764" srcset="https://guardianproject.info/wp-content/uploads/2012/04/blog_sed.png 200w, https://guardianproject.info/wp-content/uploads/2012/04/blog_sed-150x150.png 150w" sizes="(max-width: 200px) 100vw, 200px" /></a>When using phones, laptops, computers, etc. it feels like a private experience, as if our screen was the same as a piece of paper, and when that paper is gone, then no one can see it anymore. Digital media works very differently. While the user interface portrays the deletion of files as very final, for someone with the right tools, it is actually not hard to recover deleted files. Also, digital information takes up so little space, we now regularly carry vast amounts of information in our pockets. Our phones have become amazingly powerful computers, storing as many photos, videos, documents, etc. in our pockets as would have required a room not so long ago. So when you lose this phone, or it gets stolen, or accessed against your wishes, the lies of the interface are laid bare, and vast troves of your information is now in someone else’s hands. So how can we capitalize on all this power without giving up control of our information?</p> <p>Encryption provides the building blocks for making the experience no longer a lie. With properly encrypted data, it is possible to throw away the key and delete it, and then no one can get the data ever again. The problem now is how best to use encryption to make our private information actually private with as few complicated decisions or onerous interfaces as possible. Full disk encryption is one popular choice. It does a good job of providing a transparent experience, merely type in a password when you boot up your computer, and the rest is totally normal. But it also offers limited protection. When your full disk encryption is unlocked and your computer is running, that disk behaves no differently than an unencrypted disk. Someone with access to the computer has full access to the files, malware does too, undelete tools will still work, etc. You have to power off the computer to get the protection that full disk encryption provides.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/04/fde.jpg"><img src="https://guardianproject.info/wp-content/uploads/2012/04/fde.jpg" alt="" width="350" height="250" class="alignright size-full wp-image-1763" srcset="https://guardianproject.info/wp-content/uploads/2012/04/fde.jpg 350w, https://guardianproject.info/wp-content/uploads/2012/04/fde-300x214.jpg 300w" sizes="(max-width: 350px) 100vw, 350px" /></a>Another option is providing virtual encrypted disks like <a href="http://www.truecrypt.org/" target="_blank">TrueCrypt</a> or <a href="http://support.apple.com/kb/HT1578" target="_blank">Apple’s encrypted disk images</a>. Then you can decide on what needs to be in which compartment and what is always unlocked versus what is locked away behind a long, cryptic password with a short timeout. This provides good security and privacy when managed properly, but requires a fair amount of skill and time to setup and manage everything. These techniques also require root access since they mount these virtual disks as file systems. We focus a lot on Android, where most people do not have root access.</p> <p>A related approach is to have a software layer automatically encrypt each file. This is how the <a href="http://support.apple.com/kb/HT1578" target="_blank">EncFS FUSE module</a> and the <a href="https://mapl.certgate.com/" target="_blank">Certgate MAPL</a> file access work. This provides transparent encryption, but since each file is individually encrypted, a lot of information is still available without decrypting anything: the file size, modification and access times, etc.</p> <p>We’re working on another approach similar to the approach we took with <a href="https://guardianproject.info/code/sqlcipher/" target="_blank">SQLCipher for Android</a>. We’re calling it <a href="https://github.com/guardianproject/IOCipher" target="_blank">IOCipher</a>. In SQLCipher for Android, we took the code from Android’s core android.database.* classes used for working with the built-in SQLite and replaced the guts with the SQLCipher encrypted database. This allows Android app developers to use the familiar and well documented android.database.* API to build in encrypted storage into their apps. With IOCipher, we are again using SQLCipher as the core, but this time we are wrapping it with <a href="https://github.com/guardianproject/libsqlfs" target="_blank">libsqlfs</a> to make it behave like a filesystem, then grabbing the code to Android’s java.io.* API and replacing the guts with calls to libsqlfs on top of SQLCipher. libsqlfs is also a <a href="http://fuse.sourceforge.net/" target="_blank">FUSE</a><em>(Filesystem in Userspace)</em> module, so it provides an API very similar to the POSIX API for working with files and directories. So that makes it easy to take <code>java.io.File</code>, for example, and replace all the calls to <code>read()</code>, <code>open()</code>, <code>write()</code>, <code>stat()</code>, etc. with calls to <code>sqlfs_proc_read()</code>, <code>sqlfs_proc_open()</code>, <code>sqlfs_proc_write()</code>, <code>sqlfs_proc_stat()</code>, etc. Then all the Android developer needs to do is to java their <code>import java.io.*</code> to <code>import info.guardianproject.iocipher.*</code>, specify the database file to use, and the key to lock/unlock it, and the rest is normal Java programming.</p> <p>The beauty of using libsqlfs+SQLCipher is that its built of top of SQLite, which gives us a single, very portable file that is the whole filesystem, like a Mac OS X .dmg file or TrueCrypt .tc file. SQLite also allows multiple processes to access the same database file, so that means multiple apps can mount an IOCipher virtual disk, and can use Android permissions and native filesystem permissions to control access to the virtual filesystem. Lastly, libsqlfs is already a FUSE module. FUSE is already nicely integrated into most GNU/Linux distributions, and also available for Mac OS X and BSD. That means that the single file that represents a IOCipher file system could also be easily mounted on GNU/Linux, Mac OS X and BSD (we are already doing this on Debian and Ubuntu, Mac OS X will require some more work).</p> <p>All in all we think this approach will make filesystem encryption easier to include in Android apps, and also make it possible to have the encryption be trivial to setup and very transparent to the user. Its close to being usable, once it is, we’ll post instructions on how you can use it in your apps. For now, you can follow our progress here:</p> <p><a href="https://github.com/guardianproject/libsqlfs" target="_blank"><a href="https://github.com/guardianproject/libsqlfs">https://github.com/guardianproject/libsqlfs</a></a><br /> <a href="https://github.com/guardianproject/libsqlfs" target="_blank"><a href="https://github.com/guardianproject/IOCipher">https://github.com/guardianproject/IOCipher</a></a><br /> <a href="https://github.com/guardianproject/libsqlfs" target="_blank"><a href="https://guardianproject.info/wiki/Products_of_PSST_Work">https://guardianproject.info/wiki/Products_of_PSST_Work</a></a></p> https://guardianproject.info/2012/03/29/knight-news-funding-of-securesmartcam-a-#win-for-open-source-mobile-security/ Thu, 29 Mar 2012 12:07:47 -0400 https://guardianproject.info/2012/03/29/knight-news-funding-of-securesmartcam-a-#win-for-open-source-mobile-security/ <p>Along with our partner <a href="https://www.witness.org">WITNESS</a>, we’ve entered our <a href="http://newschallenge.tumblr.com/post/19436756887/securesmartcam-protecting-the-privacy-and-data-of">SecureSmartCam project</a> into the <a href="http://newschallenge.tumblr.com/">Knight News Challenge</a>, and we need your support to get to the next round.</p> <p>Here’s a bit more about the challenge:</p> <blockquote> <p>The Knight News Challenge, an international media innovation contest, is evolving – and will be offered three times, with three different topics. The first challenge will be centered on networks, and will accept applications Feb. 27 – March 17. The Networks challenge round seeks projects that use the best of existing software and platforms – those already integrated into people’s lives – to find new ways to convey news and information.</p> </blockquote> <p>Aside from the merits of SecureSmartCam itself, specifically the <a href="https://guardianproject.info/apps/ObscuraCam">ObscuraCam</a> and <a href="https://guardianproject.info/apps/InformaCam">InformaCam</a> sub-projects, our research and development over the last two years on this project have extended to support an entire range of completely open-source mobile technology for Android developments, the benefits of which extend far beyond our own project itself. There are already many other organizations, projects, and apps (both commercial and non) that have incorporated our technology into their own solutions, not to mention the hundreds of thousands of users out there who depend on our core apps like <a href="https://guardianproject.info/apps/orbot">Orbot (Tor for Android)</a> and <a href="https://guardianproject.info/apps/gibber">Gibberbot (Secure Chat)</a> to safeguard their day to day communication.</p> <p>The work so far was largely funded by a generous private non-governmental donor, and if you look at the list of projects below, we have put that funding to great use. If we receive this funding from Knight (a similarly generous private donor), we will continue our work in this modular, open manner, ensuring that the money will benefit projects and causes far beyond our own personal vision and endeavors.</p> <p><strong>SecureSmartCam-supported Open-Source Projects</strong></p> <ul> <li><a href="https://github.com/guardianproject/gnupg-for-android">GnuPG for Android</a>: OpenPGP Public/Private Key Infrastructure for Encryption and Verification of Communications and Data</li> <li><a href="https://github.com/sqlcipher/android-database-sqlcipher">SQLCipher for Android</a>: AES-256 Symmetric Encryption Layer for SQLite Mobile Database. <a href="https://www.zetetic.net/sqlcipher">SQLCipher</a> is also available for many other platforms.</li> <li><a href="https://github.com/guardianproject/iocipher">IOCipher for Android</a> (or any mobile platform): Encrypted filesystem built upon SQLCipher that works for any application without requiring root or custom device modification. This is an extension of our port of <a href="https://github.com/guardianproject/LUKS">LUKS for Android</a>, encrypted disk partition system.</li> <li><a href="https://github.com/guardianproject/android-ffmpeg">FFMPEG for Android</a> (with Video Redaction Filter): a build system and patches for compiling FFMPEG for Android, with support for custom features to enable video privacy controls</li> <li><a href="https://github.com/asenior/Jpeg-Redaction-Library">Jpeg Redaction Library</a>: a generic library for redacting visual and metadata information from JPEG images without needing to decode them. Very important for limited memory mobile devices!</li> <li><a href="https://github.com/guardianproject/notepadbot">NoteCipher for Android</a>: Simple secure text, photo and video storage app for Android, built upon SQLCipher</li> <li><a href="https://github.com/guardianproject/sscxfer/">SSCXfer for Android</a>: Anonymous, Proxied, Secure Video (or any file) Uploader (based on <a href="http://vidiom.mobi/">Vidiom</a> open-source project) over Tor to YouTube, VideoBin.org and other sites. By extension, this project also supports our core work on <a href="https://guardianproject.info/apps/orbot">Orbot, the Tor for Android</a> application with hundreds of thousands of users worldwide.</li> </ul> <p>In the end, the approximately $300,000 of grant support we are seeking, is nothing compared to the millions of dollars in funding poured into closed-source mobile startups, who not only by a large majority fail, but also rarely share the components of their work in a way that moves everyone forward.</p> <p>What we need you to do is, go to our <a href="http://newschallenge.tumblr.com/post/19436756887/securesmartcam-protecting-the-privacy-and-data-of">SecureSmartCam Proposal on the Knight News Challenge Tumblr</a>, and “like”, comment, reblog or otherwise show your support for it, in as a public and visible a manner as possible. If you have concerns or questions, please post them to the Tumblr, and our team will reply to you there. This is open-source research after all, and don’t claim to have all the answers, but we do need your support to get there.</p> https://guardianproject.info/2012/03/22/call-my-email/ Thu, 22 Mar 2012 16:31:45 -0400 https://guardianproject.info/2012/03/22/call-my-email/ <p><a href="https://commons.wikimedia.org/wiki/File:PFC_Gladys_Bellon,_Basile,_Louisiana,_one_of_the_27_WAC_switchboard_operators_flown_from_Paris_for_the_Potsdam..._-_NARA_-_199010.jpg"><img class="aligncenter" src="https://upload.wikimedia.org/wikipedia/commons/thumb/b/bc/PFC_Gladys_Bellon%2C_Basile%2C_Louisiana%2C_one_of_the_27_WAC_switchboard_operators_flown_from_Paris_for_the_Potsdam..._-_NARA_-_199010.jpg/764px-PFC_Gladys_Bellon%2C_Basile%2C_Louisiana%2C_one_of_the_27_WAC_switchboard_operators_flown_from_Paris_for_the_Potsdam..._-_NARA_-_199010.jpg" alt="PFC Gladys Bellon, Basile, Louisiana, one of the 27 WAC switchboard operators flown from Paris for the Potsdam Conference and Sgt. Robert Scott of Pittsburgh, Pennsylvania, test lines in the frame room of the Victory switchboard at U. S. headquarters at Babelsburg, Germany." width="600/" /></a></p> <p>What if you could call me directly through my email? No exchanging of phone numbers or searching for handles on Skype. Just plain and simple email. Now what if we can make that phone call as secure as it is easy. That’s the goal of what we’re doing here at <a title="Open Secure Telephony Network (OSTN) " href="https://guardianproject.info/wiki/OSTN" target="_blank">Open Secure Telephony Network (OSTN)</a>.</p> <p>The internet is already structured to be able to do this. That’s why I can have all of my emails point to one email box if I want to. Simply by changing the MX records. So why not be able to do that with phone numbers, routing them through my same email by changing the SIP records?</p> <p>Guardian Project is in the process of figuring out how to make your life better by doing just that. We’re currently in the early stages of research on how to make a stack for secure telephony standards so that anybody can participate, whether a novice user who wants easy access or a power user who wants to run their own stack.</p> <p>Email already handles configurable standards well for text. As a user, I can choose my service (Gmail, Hotmail, <a title="rise up" href="https://riseup.net/" target="_blank">RiseUp</a>, self-hosting, etc) and the client (Outlook, <a title="thunderbird" href="https://www.mozilla.org/thunderbird/" target="_blank">Thunderbird</a>, Mail, etc) on whatever platform works best for me (Windows, MacOS, Android, etc) and have my custom email (&#x6d;a&#x72;k&#x40;&#x66;u&#x6e;k&#x79;&#x6d;o&#x6e;k&#x65;&#x79;.&#x6e;e&#x74;, &#x6a;&#x65;&#x64;&#x69;&#x38;&#x33;&#x40;&#x72;&#x65;&#x62;&#x65;&#x6c;&#x61;&#x6c;liance.org, etc) point to whichever of these systems I trust the most and works best for me.</p> <p>We’re now bringing that ease and customization to voice communication. As a user, I’ll be able to choose my service. We’re currently alpha testing a service we built, <a title="Ostel.me" href="http://Ostel.me" target="_blank">Ostel.me</a>, but there are others like <a title="tanstagi" href="https://tanstagi.net/" target="_blank">Tanstagi</a>, <a title="intimi.ca" href="https://intimi.ca" target="_blank">Intimi.ca</a>. Our open protocol will make it easy for companies to host their own internal server for communication. Whatever platform works best for you (Windows, MacOS, Android, etc) has a tool that lets you make phone calls with the service. We’re working directly with open source tools like <a title="CSipSimple" href="https://guardianproject.info/wiki/CSipSimple" target="_blank">CSipSimple</a> on Android and Telephone on MacOS to improve them for best and most secure call quality. We’re also making it easy for people using other tools like <a title="Groundwire" href="https://guardianproject.info/wiki/Groundwire" target="_blank">Groundwire</a> on the iPhone to make calls using these tools.</p> <p>Our goal is to make a service that’s easier to use and more secure than <a title="skype" href="http://www.skype.com/" target="_blank">Skype</a> while cheaper and more reliable than a standard phone. This is just the start, but we’re excited by the progress we’ve already made. If you’d like to help, we’re always looking for smart and passionate people who can be testers, designers, translators, and supporters. Before you can call our email for updates, you can send us a message on it telling us how you’d like to participate, sign up to be an alpha tester on <a title="ostel website" href="https://ostel.me/" target="_blank">Ostel.me</a>, or follow us <a title="guardian twitter" href="https://twitter.com/#!/guardianproject" target="_blank">on Twitter</a>. Thanks for tuning in!</p> https://guardianproject.info/2012/03/21/acrobits-groundwire-ostn-supports-iphone/ Wed, 21 Mar 2012 09:09:21 -0400 https://guardianproject.info/2012/03/21/acrobits-groundwire-ostn-supports-iphone/ <p>The Guardian Project develops open source software primarily for the Android platform <a href="https://guardianproject.info/home/use-cases/">but we strive for security by design to be a part of all platforms</a>. With <a href="https://guardianproject.info/wiki/OSTN">OSTN</a>, there are two major components. The the first is the server, which operates as the primary user directory and call switch. The other is the client, which is the program you interact with to send and receive calls.</p> <p>While the Apple App Store <a href="http://michelf.com/weblog/2011/gpl-ios-app-store/">forbids distribution of GPL licensed software from their service</a>, the underlying protocols used by OSTN are open, so even iPhone developers may implement them in a proprietary client application without breaking any intellectual property laws.</p> <p>And Acrobits software, an iOS dev shop in Prague, Czech Republic did just that. The result is an excellent OSTN compilant app for iPhone called <a href="http://www.acrobits.cz/11/acrobits-groundwire-for-iphone">Groundwire</a>.</p> <p><img src="http://www.acrobits.cz/userfiles/images/groundwire_icon.png" alt="Groundwire logo" /></p> <p>Groundwire is not cheap when compared to competing apps for Android or desktop computers. They distribute it as a <a href="https://en.wikipedia.org/wiki/Crippleware">feature-limited</a> app for $9.99. Unfortunately, one of the limited features is required to bring the app up to <a href="https://guardianproject.info/wiki/OSTN_Compliance_Specification">OSTN spec</a>, namely ZRTP support. ZRTP is the key exchange protocol to securely authenticate two caller’s identities during a call. To enable this feature, the user must pay a $24.99 fee as an “in-app purchase.” This purchase is only required to enable <strong>outgoing</strong> ZRTP calls. If you don’t have a need for this, you must only pay the $9.99 purchase price to get up and running.</p> <p>The good news is that Groundwire is an excellent app. I’m testing it on an original iPhone with firmware 3.1.3. It supports push notifications to receive incoming calls even when the iPhone is asleep or Groundwire is in the background. This feature depends on Acrobits secure push servers, and a full security audit has not yet been performed to determine if this creates a risk.</p> <p>I expect Groundwire to be a very popular client for OSTel, due to the high number of iPhones in the field. If you’d like to sign up for our alpha tested, named OSTel.me, <a href="https://ostel.me/">fill out the form</a> and we’ll be in touch soon thereafter. You can also checkout another OSTN-compliant service at Tanstagi: <a href="https://tanstagi.net/">https://tanstagi.net/</a></p> https://guardianproject.info/archive/informacam/ Tue, 20 Mar 2012 01:17:29 -0400 https://guardianproject.info/archive/informacam/ <p>We&rsquo;ve launched <a href="https://guardianproject.info/apps/camerav">CameraV</a>, the first public InformaCam App! Click the image below to learn more and get the app&hellip;</p> <p><a href="https://guardianproject.info/apps/camerav"><img class="alignnone size-large wp-image-13035" src="https://guardianproject.info/wp-content/uploads/2015/07/feature-1024x500.png" alt="feature" width="780" height="381" srcset="https://guardianproject.info/wp-content/uploads/2015/07/feature.png 1024w, https://guardianproject.info/wp-content/uploads/2015/07/feature-300x146.png 300w" sizes="(max-width: 780px) 100vw, 780px" /></a></p> <hr /> <p>&nbsp;</p> <p>&nbsp;</p> <p><a href="https://www.knightfoundation.org/grants/20123674/"><br /> <img class="alignnone size-full wp-image-3267" src="https://guardianproject.info/wp-content/uploads/2012/03/knight-logo-300.jpg" alt="knight-logo-300" width="300" height="50" /></a> <a href="https://www.knightfoundation.org/grants/20123674/"><em>A project funded by the</em></a> <em><a href="https://guardianproject.info/2013/01/27/informacam-wins-knight-news-challenge/">Knight News Challen</a>ge</em></p> <p>There is currently a deluge of media coming from the world’s mobile devices for potential use as evidence or trusted sources for journalists. WITNESS and the Guardian Project seek to provide a mechanism through InformaCam to verify and authenticate this footage. Our approach is to create an app that leverages the sensors used in modern smartphones create a “snapshot” of the environment in which a piece of media is captured. This information is used, along with a digital “fingerprint” of the cameraphone sensor, to sign the video or image and ensure that the media hasn’t been tampered. It also verifies that it was captured by a specific device at a specific time and place.</p> <p>A clear and demonstrated need exists among journalists, human rights defenders and the legal community for a way to secure and verify the vast amounts of footage and images coming from areas of conflict and political unrest. Any effort addressing these issues needs to leverage mobile devices and the networks used to transfer and distribute this media. The mobile phone has become the de facto tool for documenting change.</p> <p><strong>More Information</strong></p> <p>InformaCam is a mobile application for Android that enables users to inflate image and video with extra points of data, or metadata. The metadata includes information like the user’s current GPS coordinates, altitude, compass bearing, light meter readings, the signatures of neighboring devices, cell towers, and wifi networks; and serves to shed light on the exact circumstances and contexts under which the digital image was taken. With InformaCam the app starts to behave almost like Adobe Photoshop or GIMP, supporting non-destructive, layer-based edits to media built on top of Obscuracam.</p> <p>For advanced users who are creating any sensitive image data and metadata, they can preserve and encrypt it to trusted entities, along with a redacted version that has its metadata stripped which can be easily shared to Facebook, Twitter, Flickr, or any public service the user wishes to use. InformaCam also supports delivery of media to a server through the Tor network, hosted as a Tor Hidden Service.</p> <h4 id="how-to-get-involved">How To Get Involved</h4> <p><em>Warning: This project is currently in Alpha release and not ready for critical, high-risk deployment.</em></p> <p>The official project tracker and wiki is located here: <a href="https://dev.guardianproject.info/projects/informacam">https://dev.guardianproject.info/projects/informacam</a></p> <p>The Github-hosted source code repository is here: <a href="https://github.com/guardianproject/informacam">https://github.com/guardianproject/informacam</a></p> <p><strong>Press</strong></p> <p><a href="http://www.niemanlab.org/2013/01/is-it-real-witness-builds-an-app-to-verify-user-submitted-content/"><img class=" wp-image-3274 alignleft" src="https://guardianproject.info/wp-content/uploads/2012/03/niemanlab_1334151410_600-150x150.jpeg" alt="niemanlab_1334151410_600" width="73" height="73" srcset="https://guardianproject.info/wp-content/uploads/2012/03/niemanlab_1334151410_600-150x150.jpeg 150w, https://guardianproject.info/wp-content/uploads/2012/03/niemanlab_1334151410_600-300x300.jpeg 300w, https://guardianproject.info/wp-content/uploads/2012/03/niemanlab_1334151410_600.jpeg 383w" sizes="(max-width: 73px) 100vw, 73px" /></a></p> <p><a href="http://www.spiegel.de/netzwelt/apps/informacam-app-soll-verifizierung-von-fotos-und-videos-erleichtern-a-880519.html"><img class="alignnone" src="https://upload.wikimedia.org/wikipedia/bar/3/3e/Logo-der_spiegel.svg" alt="" width="269" height="60" /></a><a href="http://betabeat.com/2013/01/wikimedia-new-york-organizations-share-in-knight-foundation-mobile-contest-riches/"><img class="alignleft size-medium wp-image-3272" src="https://guardianproject.info/wp-content/uploads/2012/03/logo-betabeat-300x90.png" alt="logo-betabeat" width="201" height="60" srcset="https://guardianproject.info/wp-content/uploads/2012/03/logo-betabeat-300x90.png 300w, https://guardianproject.info/wp-content/uploads/2012/03/logo-betabeat.png 333w" sizes="(max-width: 201px) 100vw, 201px" /></a></p> <p><a href="http://www.slate.com/blogs/future_tense/2013/01/22/knight_news_challenge_media_s_winning_apps.html"><img class="alignleft size-medium wp-image-3271" src="https://guardianproject.info/wp-content/uploads/2012/03/Slate_logo-300x123.png" alt="Slate_logo" width="200" height="82" srcset="https://guardianproject.info/wp-content/uploads/2012/03/Slate_logo-300x123.png 300w, https://guardianproject.info/wp-content/uploads/2012/03/Slate_logo.png 325w" sizes="(max-width: 200px) 100vw, 200px" /></a><a href="http://www.worldphoto.org/news-and-events/wpo-news/informacam-the-latest-in-citizen-photojournalism/"><img class="alignnone" src="https://www.worldphoto.org/_assets/images/WPO_Logo_-BLACK_MASTER(63).jpg" alt="" width="126" height="76" /></a><a href="http://www.businessweek.com/articles/2013-01-29/for-activists-and-manti-teo-new-protection-against-internet-fakes#r=blg-s"><img class="alignnone" src="https://www.csg-pr.com/wp-content/uploads/BusinessWeek-Logo.jpg" alt="" width="214" height="45" /></a></p> <p><strong> </strong></p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> https://guardianproject.info/archive/informacam/ Tue, 20 Mar 2012 01:17:29 -0400 https://guardianproject.info/archive/informacam/ <p>We&rsquo;ve launched <a href="https://guardianproject.info/apps/camerav">CameraV</a>, the first public InformaCam App! Click the image below to learn more and get the app&hellip;</p> <p><a href="https://guardianproject.info/apps/camerav"><img class="alignnone size-large wp-image-13035" src="https://guardianproject.info/wp-content/uploads/2015/07/feature-1024x500.png" alt="feature" width="780" height="381" srcset="https://guardianproject.info/wp-content/uploads/2015/07/feature.png 1024w, https://guardianproject.info/wp-content/uploads/2015/07/feature-300x146.png 300w" sizes="(max-width: 780px) 100vw, 780px" /></a></p> <hr /> <p>&nbsp;</p> <p>&nbsp;</p> <p><a href="https://www.knightfoundation.org/grants/20123674/"><br /> <img class="alignnone size-full wp-image-3267" src="https://guardianproject.info/wp-content/uploads/2012/03/knight-logo-300.jpg" alt="knight-logo-300" width="300" height="50" /></a> <a href="https://www.knightfoundation.org/grants/20123674/"><em>A project funded by the</em></a> <em><a href="https://guardianproject.info/2013/01/27/informacam-wins-knight-news-challenge/">Knight News Challen</a>ge</em></p> <p>There is currently a deluge of media coming from the world’s mobile devices for potential use as evidence or trusted sources for journalists. WITNESS and the Guardian Project seek to provide a mechanism through InformaCam to verify and authenticate this footage. Our approach is to create an app that leverages the sensors used in modern smartphones create a “snapshot” of the environment in which a piece of media is captured. This information is used, along with a digital “fingerprint” of the cameraphone sensor, to sign the video or image and ensure that the media hasn’t been tampered. It also verifies that it was captured by a specific device at a specific time and place.</p> <p>A clear and demonstrated need exists among journalists, human rights defenders and the legal community for a way to secure and verify the vast amounts of footage and images coming from areas of conflict and political unrest. Any effort addressing these issues needs to leverage mobile devices and the networks used to transfer and distribute this media. The mobile phone has become the de facto tool for documenting change.</p> <p><strong>More Information</strong></p> <p>InformaCam is a mobile application for Android that enables users to inflate image and video with extra points of data, or metadata. The metadata includes information like the user’s current GPS coordinates, altitude, compass bearing, light meter readings, the signatures of neighboring devices, cell towers, and wifi networks; and serves to shed light on the exact circumstances and contexts under which the digital image was taken. With InformaCam the app starts to behave almost like Adobe Photoshop or GIMP, supporting non-destructive, layer-based edits to media built on top of Obscuracam.</p> <p>For advanced users who are creating any sensitive image data and metadata, they can preserve and encrypt it to trusted entities, along with a redacted version that has its metadata stripped which can be easily shared to Facebook, Twitter, Flickr, or any public service the user wishes to use. InformaCam also supports delivery of media to a server through the Tor network, hosted as a Tor Hidden Service.</p> <h4 id="how-to-get-involved">How To Get Involved</h4> <p><em>Warning: This project is currently in Alpha release and not ready for critical, high-risk deployment.</em></p> <p>The official project tracker and wiki is located here: <a href="https://dev.guardianproject.info/projects/informacam">https://dev.guardianproject.info/projects/informacam</a></p> <p>The Github-hosted source code repository is here: <a href="https://github.com/guardianproject/informacam">https://github.com/guardianproject/informacam</a></p> <p><strong>Press</strong></p> <p><a href="http://www.niemanlab.org/2013/01/is-it-real-witness-builds-an-app-to-verify-user-submitted-content/"><img class=" wp-image-3274 alignleft" src="https://guardianproject.info/wp-content/uploads/2012/03/niemanlab_1334151410_600-150x150.jpeg" alt="niemanlab_1334151410_600" width="73" height="73" srcset="https://guardianproject.info/wp-content/uploads/2012/03/niemanlab_1334151410_600-150x150.jpeg 150w, https://guardianproject.info/wp-content/uploads/2012/03/niemanlab_1334151410_600-300x300.jpeg 300w, https://guardianproject.info/wp-content/uploads/2012/03/niemanlab_1334151410_600.jpeg 383w" sizes="(max-width: 73px) 100vw, 73px" /></a></p> <p><a href="http://www.spiegel.de/netzwelt/apps/informacam-app-soll-verifizierung-von-fotos-und-videos-erleichtern-a-880519.html"><img class="alignnone" src="https://upload.wikimedia.org/wikipedia/bar/3/3e/Logo-der_spiegel.svg" alt="" width="269" height="60" /></a><a href="http://betabeat.com/2013/01/wikimedia-new-york-organizations-share-in-knight-foundation-mobile-contest-riches/"><img class="alignleft size-medium wp-image-3272" src="https://guardianproject.info/wp-content/uploads/2012/03/logo-betabeat-300x90.png" alt="logo-betabeat" width="201" height="60" srcset="https://guardianproject.info/wp-content/uploads/2012/03/logo-betabeat-300x90.png 300w, https://guardianproject.info/wp-content/uploads/2012/03/logo-betabeat.png 333w" sizes="(max-width: 201px) 100vw, 201px" /></a></p> <p><a href="http://www.slate.com/blogs/future_tense/2013/01/22/knight_news_challenge_media_s_winning_apps.html"><img class="alignleft size-medium wp-image-3271" src="https://guardianproject.info/wp-content/uploads/2012/03/Slate_logo-300x123.png" alt="Slate_logo" width="200" height="82" srcset="https://guardianproject.info/wp-content/uploads/2012/03/Slate_logo-300x123.png 300w, https://guardianproject.info/wp-content/uploads/2012/03/Slate_logo.png 325w" sizes="(max-width: 200px) 100vw, 200px" /></a><a href="http://www.worldphoto.org/news-and-events/wpo-news/informacam-the-latest-in-citizen-photojournalism/"><img class="alignnone" src="https://www.worldphoto.org/_assets/images/WPO_Logo_-BLACK_MASTER(63).jpg" alt="" width="126" height="76" /></a><a href="http://www.businessweek.com/articles/2013-01-29/for-activists-and-manti-teo-new-protection-against-internet-fakes#r=blg-s"><img class="alignnone" src="https://www.csg-pr.com/wp-content/uploads/BusinessWeek-Logo.jpg" alt="" width="214" height="45" /></a></p> <p><strong> </strong></p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> https://guardianproject.info/2012/03/19/on-verifying-identity-using-cryptography/ Mon, 19 Mar 2012 11:27:51 -0400 https://guardianproject.info/2012/03/19/on-verifying-identity-using-cryptography/ <p><a href="https://guardianproject.info/wp-content/uploads/2012/03/identity.gif"><img src="https://guardianproject.info/wp-content/uploads/2012/03/identity-150x150.gif" alt="" width="150" height="150" class="alignleft size-thumbnail wp-image-1684" /></a>One of the most important uses of cryptography these days is verifying the identity of the other side of a digital conversation. That conversation could be between two people using OTR-encrypted IM, a web browser showing a bank website, a Debian Developer uploading a package to the Debian build server, an ssh client logging into an ssh server, and on and on. In all of these cases, cryptography is used to ensure that the software is indeed receiving replies from the expected entity. This happens by checking the current cryptographic key against one that is known to be correct. That is essential to the whole process. If you see the key for the first time, you have no way of knowing whether that is indeed the key you are expecting because there is no point of reference.</p> <p>In order for this validation of identity to work, there needs to be a method of verifying any given key and making it a reference. There are many ideas about how to do this:</p> <ul> <li>a trusted list of central certificate authorities like in HTTPS</li> <li>key-signing parties where people validate and sign each other’s keys in person, like used with the OpenPGP Web of Trust</li> <li>“trust on first use” (aka “Persistence of Pseudonym”), where you save the key the first time you see it, and then use that as a reference (this is the way most people use SSH)</li> <li>fingerprint verification, where the two people wanting to communicate cryptographically use another channel to manually check each other’s key fingerprints, like a phone call (this is used a lot in OTR and OpenPGP)</li> <li>the Socialist Millionaires’ Protocol (SMP), which is a combination of user-generated question/answer pairs with a cryptographic technique that lets each side confirm whether the other answered the question correctly without divulging any information (this was recently added to OTR and is implemented in Pidgin, Gibberbot, and maybe a couple other programs)</li> <li>a manually confirmed shared secret like a short password (ZRTP uses this when starting secure phone calls)</li> <li>whitelists of fingerprints of widely used keys (aka <a href="http://www.imperialviolet.org/2011/05/04/pinning.html" target="_blank">public key pinning</a>) (this was recently added to Chrome in the wake of the HTTPS certificate authority failures)</li> </ul> <p><a href="https://guardianproject.info/wp-content/uploads/2012/03/fingerprint.jpg"><img src="https://guardianproject.info/wp-content/uploads/2012/03/fingerprint-150x150.jpg" alt="" width="150" height="150" class="alignright size-thumbnail wp-image-1686" /></a>Each of these techniques has its advantages and disadvantages, but generally the higher level of verification provided means the more work to do the process. Most people don’t need the high level of verification provided by OpenPGP key signing parties, but maybe if it was fun and much easier to do, then a lot more people would do it. “Trust on first use” is really easy to use and implement, and has been working pretty well for a lot of people who use SSH and OTR. But it has big shortcomings in environments where the state or other central authority that provides the internet infrastructure wants to spy on its users. HTTPS has proven to be quite easy to use, but it has also <a href="https://www.eff.org/deeplinks/2011/08/iranian-man-middle-attack-against-google" target="_blank">proven</a> to be <a href="http://www.theregister.co.uk/2011/08/29/fraudulent_google_ssl_certificate/" target="_blank">quite</a> <a href="https://arstechnica.com//security/news/2011/03/how-the-comodo-certificate-fraud-calls-ca-trust-into-question.ars" title="How the Comodo certificate fraud calls CA trust into question" target="_blank">breakable</a>.</p> <p>Currently, each of these techniques described above is used as the sole means of verification, then the level of verification is represented as “verified” or “not verified”. This is definitely the way that HTTPS and SSH handle it. OTR is a bit different, it has 3 states of verification: “new key”, “unverified key” i.e. trusted on first use, or “verified”, and good OTR chat apps will represent these three states in the UI. Then OpenPGP is perhaps the opposite extreme: it provides both chains of verification signatures via the Web of Trust but also user-set “trust levels” from 0 to 255 for any given key.</p> <p>Perhaps an answer is to cryptographically link up these different ways of verification and represent key verification as a continuum. Then when the possibility of linking in “trust on first use” and other techniques was there, people could gradually build up cryptographic trust as they needed it. Starting with “I have seen this key before”, then on to “I have gotten them to verify their OTR key with an SMP question/answer”, then to “I have an OpenPGP trust path to them”, to “I have met them in person and manually verified their key and identity”.</p> <p>To go into technical detail as an example, GnuPG supports RSA, DSA, ECDSA, El Gamal, and other key types as subkeys for an OpenPGP key. Those core algorithms core basically all of the most common uses of cryptography, including HTTPS, SSH, OTR, and OpenPGP. The link between an OpenPGP key and its subkeys is perhaps the strongest link for verification that exists, so if a given person includes their OTR key, for example, into their OpenPGP key, that provides a strong cryptographic link between them, and one that is easily publicly sharable via the OpenPGP public keyservers. When two people verify their OTR keys using the SMP question/answer, this verification could then extend to their OpenPGP keys if their OTR keys were subkeys. (<a href="http://web.monkeysphere.info" target="_blank">The Monkeysphere Project</a> is one such implementation of this idea, using OpenPGP keys for SSH and HTTPS).</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/03/verified.jpg"><img src="https://guardianproject.info/wp-content/uploads/2012/03/verified-150x150.jpg" alt="" width="150" height="150" class="alignleft size-thumbnail wp-image-1685" /></a>Then the last piece of this puzzle is how to represent all of this complexity to the users. The essential part is to stop representing trust as binary yes/no. A one-dimensional continuum provides a lot more info and is a very commonly understood concept in computers (think progress bars). The hard part of this question is ranking the various techniques in how much progress they provide towards the goal of solid identity verification.</p> <p>For this round of the <a href="https://guardianproject.info/wiki/PSST" title="Portable Shared Security Tokens" target="_blank">PSST Project</a>, we have focused on first allowing people to easily move around their OTR identities, then worked on testing out the idea of linking in all identity keys into an OpenPGP key. From what we have seen so far, we believe this is not only feasible but will provide a solid platform for linking together all these verification techniques and identity keys. And on top of that, with diligent attention to user experience and testing, it should be possible to create user interfaces that make navigating all of this a common, daily task for most computer users.</p> https://guardianproject.info/2012/03/15/adventures-in-porting-gnupg-2.1.x-to-android/ Thu, 15 Mar 2012 13:00:30 -0400 https://guardianproject.info/2012/03/15/adventures-in-porting-gnupg-2.1.x-to-android/ <p>PGP started with Phil Zimmerman’s Pretty Good Privacy, which is now turned into an open IETF standard known as OpenPGP. These days, the reference OpenPGP platform seems to be <a href="http://gnupg.org/">GnuPG</a>: its used by Debian and all its derivatives in the OS itself for verifying packages and more. It is also at the core of all Debian development work, allowing the very diffuse body of Debian, Ubuntu, etc developers to communicate and share work effectively while maintaining a high level of security. It is also used for email encryption in Thunderbird + Enigmail, Apple Mail + GPGMail, GNOME Evolution, KDE KMail, Microsoft Outlook + Gpg4win.</p> <div id="attachment_1651" style="width: 160px" class="wp-caption alignleft"> <a href="https://guardianproject.info/wp-content/uploads/2012/03/Encryption.jpg"><img aria-describedby="caption-attachment-1651" src="https://guardianproject.info/wp-content/uploads/2012/03/Encryption-150x150.jpg" alt="lots of one and zeros" width="150" height="150" class="size-thumbnail wp-image-1651" /></a> <p id="caption-attachment-1651" class="wp-caption-text"> Yes, encryption means lots of ones and zeros that you can't read! </p> </div> <p>After actively using GnuPG for a few years, I thought it would be a good idea and not too difficult to port it to Android. I dove in and started with the code from git since I was hoping to involve the GnuPG developers. I had recently seen that they were stopping development on the 1.4.x branch, so the 2.1.x branch seemed like the logical choice to give us a reasonably complete OpenPGP implementation. Now I am happy to say we have it working on Android, with a couple of loose ends to tie up in order to get everything working.</p> <p>One thing I do have to say is that GnuPG has evolved into a large and elaborate project that not only covers OpenPGP, but also PGP/MIME and things that have nothing to do with PGP like AES symmetric encryption and S/MIME email cryptography. That means it know is made up of many moving parts. It uses many libraries: libassuan, libgpg-error, libksba, npth, openldap, pinentry, and more if you want. It is also made up of a handful of programs to handle different aspects: <code>gpg</code> is the command line interface, <code>gpg-agent</code> seems to be the central key handler and task broker, <code>dirmngr</code> manages connections with directories like OpenPGP keyservers, <code>pinentry</code> handles getting passphrases from the user, etc.</p> <p>The complexity does not stop there for our purposes: we need a Java API so we can make an Android app. So next up we built the <a href="http://www.gnupg.org/related_software/gpgme/" target="_blank">GPGME</a> (Gnu Privacy Guard Made Easy) library to provide a C/C++ API which is then wrapped in <a href="https://github.com/smartrevolution/gnupg-for-java" target="_blank">gpgme-for-java</a>, a JNI library to make the GPGME functions available in Java. And just to heap on the layers, we are making a GUI on top of all that so that when you use it, you have no idea that all these little pieces that I have just described are even there at all.</p> <p>You can follow our progress on this work on our <a href="https://guardianproject.info/wiki/PSST" target="_blank">PSST wiki: <a href="https://guardianproject.info/wiki/PSST">https://guardianproject.info/wiki/PSST</a></a></p> <p>_(coming soon: sketching a mobile UI for OpenPGP, follow our notes here: <a href="https://guardianproject.info/wiki/GnuPrivacyGuard_for_Android" target="_blank"><a href="https://guardianproject.info/wiki/GnuPrivacyGuard_for_Android">https://guardianproject.info/wiki/GnuPrivacyGuard_for_Android</a></a>)_</p> https://guardianproject.info/2012/03/15/our-new-f-droid-app-repository-out-of-date/ Thu, 15 Mar 2012 01:27:43 -0400 https://guardianproject.info/2012/03/15/our-new-f-droid-app-repository-out-of-date/ <blockquote> <p><strong>Update</strong>: this blog post has been changed to reference our new FDroid repository at <a href="https://guardianproject.info/fdroid" target="_blank"><a href="https://guardianproject.info/fdroid">https://guardianproject.info/fdroid</a></a>. If you are still using the old one originally described here which has the URL <a href="https://guardianproject.info/repo">https://guardianproject.info/repo</a>, you should switch to the new repo as soon as possible!</p> </blockquote> <p>For all of you out there looking for a safe way to find and download apps outside of the Play Store (aka Android Market) or random, sketchy third-party app stores and file sharing sites, then your wait is over:</p> <blockquote> <p>The <a href="http://f-droid.org">FDroid Repository</a> is an easily-installable catalogue of FOSS applications for the Android platform. The server contains the details of multiple versions of each application, and the Android client makes it easy to browse, install them onto your device, and keep track of updates.</p> </blockquote> <p>In other words, F-Droid is like an app store for open-source. More importantly, there is not just one “store”. Anyone can deploy their own repositories of apps, or Repos, much like the way the Debian repo model works.</p> <p>We’ve now begun creating our own hosted F-Droid compliant repo where we can easily provide the latest greatest versions of all our apps. As we update the apps, F-Droid should notify you and allow you to update quickly and without hassle.</p> <p><strong>Quick Steps for using F-Droid with Guardian Project Repo</strong></p> <p>1) Install the F-Droid Client app. You can get it here: <a href="https://f-droid.org/FDroid.apk">https://f-droid.org/FDroid.apk</a></p> <p>2) Run the app and go to Menu &gt; Manage Repos</p> <p>3) Turn on the “Guardian Project Official Releases” repo</p> <p>3) <del datetime="2015-02-24T16:10:07+00:00">Enter: <a href="https://guardianproject.info/repo/">https://guardianproject.info/repo/</a></del></p> <p>4) Optionally, disable the default repo if you just want GP apps</p> <p>5) Return to the main screen, and Menu &gt; Update</p> <p><del datetime="2015-02-24T16:10:07+00:00">6) Verify the repo fingerprint by clicking on the repo to see the repo details view. The fingerprint you see there should match this: <code>59050C8155DCA377F23D5A15B77D3713400CDBD8B42FBFBE0E3F38096E68CECE</code>. </del></p> <p>From here you will see the “Available” tab for apps you don’t have the “Installed” tab for apps you have the latest version of, and the “Updates” tab for apps you have, but that are not up to date.</p> <p>You can open each app by browsing and selecting them, and then via Menu options, choose to install them, or access their websites, source code links, or issue tracking pages.</p> <div id='gallery-6' class='gallery galleryid-1632 gallery-columns-3 gallery-size-thumbnail'> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/cats.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/cats-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-15-110254.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-15-110254-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-15-110305.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-15-110305-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-15-110320.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-15-110320-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-15-110341.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-15-110341-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-15-110351.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-15-110351-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-15-110404.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-15-110404-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-15-110434.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-15-110434-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style='clear: both' /> </div> https://guardianproject.info/2012/03/07/voip-survey-results-of-ngos-human-rights-groups-and-activists/ Wed, 07 Mar 2012 18:58:29 -0400 https://guardianproject.info/2012/03/07/voip-survey-results-of-ngos-human-rights-groups-and-activists/ <p>In November 2011, 25 individuals were surveyed using an online form, representing typical end-users, global journalists, activist and human rights organization perspectives (Thank you to all the participants!). The goal of the survey was to establish a baseline understanding of the types of tools and expectations our target user community has around making “telephone calls” over the internet, otherwise known as Voice over Internet Protocol (VoIP).</p> <p>This survey is part of our work on the <a href="https://guardianproject.info/wiki/OSTN">Open Secure Telephony Net (OSTN)</a>. In summary, we believe there is too great a reliance upon closed systems, proprietary protocols, and expensive commercial solutions, among the very people and groups who need a verifiable secure system based on free software. While using GPG for email, or OTR-encryption for chat have become somewhat standards go-tos for these groups, there has not been the same progress made on the secure voice front. OSTN aims to change that, but before we can, we need to understand where our target user community stand today.</p> <p>Below you will find the questions and results from our small survey. We don’t claim to be big data scientists, but this is our starting point.</p> <p><img src="https://docs.google.com/document/pubimage?id=12bEHuMBXDqw4CG2R8nn2PbDJTa4HU8lh-rZRR22nSQA&image_id=1Kj2xqnnxxbJxOP2myEMoDgd7uV_Z7S4" alt="" width="584" height="269" /></p> <p>As expected, it was Skype, Skype, Skype, with a little Google Talk and Cisco thrown in here and there. Everyone knows Skypes, it works very well, and is even quite good at getting around firewalls.</p> <div>  The other in this survey was “Cisco”, which could either be a corporate or small business product. In some cases, these products are actually more standards compliant than something like Skype. One aspect of our research is to audit the compliance of existing commercial products with security standards such as TLS, SSL, SRTP and ZRTP. </div> <div> </div> <p><img src="https://docs.google.com/document/pubimage?id=12bEHuMBXDqw4CG2R8nn2PbDJTa4HU8lh-rZRR22nSQA&image_id=1pVfXla66rcmmbst2uvDF_i08-f9ANKw" alt="" width="585" height="277" /></p> <p>It was interesting to see that Google Talk was a strong second to Skype. Other services like Facebook video calling or Apple Facetime are newer, and may not have had time for full adoption. Others included ippi.fr, a “free” SIP service that works with mobile phones. Not included in this list are Google+ Hangouts, which seem like a growing tool for group communications.</p> <p> </p> <p><img src="https://docs.google.com/document/pubimage?id=12bEHuMBXDqw4CG2R8nn2PbDJTa4HU8lh-rZRR22nSQA&image_id=1neY0xPavF3sh91mvSelfIwzCMV21qJM" alt="" width="585" height="479" /></p> <p>We hoped to understand how personal communications behavior might affect their use of VoIP systems in more professional settings. It seems like Skype again rules here.</p> <p> </p> <p><img src="https://docs.google.com/document/pubimage?id=12bEHuMBXDqw4CG2R8nn2PbDJTa4HU8lh-rZRR22nSQA&image_id=1haSfmhdxc9zT7oghdyBQMFC8ZYv6m_Y" alt="" width="584" height="475" /></p> <p>The most troubling issue is that most people likely utilize the same account for both personal and professional communication. Skype does not make it easy to switch accounts or have multiple accounts open at once, unlike email programs or instant messaging programs. You must have one identity. This creates a huge amount of opportunity for social engineering type attacks, though analysis of that was beyond the scope of this survey.</p> <p> </p> <p><img src="https://docs.google.com/document/pubimage?id=12bEHuMBXDqw4CG2R8nn2PbDJTa4HU8lh-rZRR22nSQA&image_id=1S3EGlInCGdh8Pj7IOefWvfLI1Ikw4gs" alt="" width="559" height="147" /></p> <p>We were glad to see that the majority of people surveyed were concerned about the privacy of their conversations, but it was a slim majority.</p> <p>The possibilities of the “no” group may be that they feel the solutions they are using (Skype) are secure enough, as they have been told that by the providers. In addition, many NGO groups who fear foreign or remote threats, often feel no sense of privacy risk when operating in their home country. They only consider security issues when they engage in field work, but have very lax practices on a day to day basis. That perception of threat is a outdated in the age of a fully connected global network, through which physical locations and borders matter little.</p> <p>In the end, the challenge is, as most everyone knows, to build a system that is as easy to use as Skype, but more secure. We realize that we are just a small open-source effort, and that ultimately we can’t compete with the likes of a Microsoft or even Google for that matter. Our goal is to help people and organizations who need to communicate sensitive information securely and safely, to have better options than they do now for both hosting their own servers and using simple client applications. Keep your eyes on the <a href="https://guardianproject.info/wiki/OSTN">OSTN Wiki</a> and this blog, as we progress over the coming weeks and months.</p> https://guardianproject.info/2012/03/02/obscuracam-v2-alpha-with-video/ Fri, 02 Mar 2012 12:20:34 -0400 https://guardianproject.info/2012/03/02/obscuracam-v2-alpha-with-video/ <p>We’ve been making exciting progress with our work on <a href="https://guardianproject.info/apps/securecam/">ObscuraCam</a>, part of the SecureSmartCam project with our partner <a href="https://www.witness.org">WITNESS</a>. The biggest jump forward is the addition of video support, including automated face detection, pixelization and redaction.</p> <p>Screenshots below, and soon a video below (also at: <a href="http://youtu.be/9hi4c_DCrkw">http://youtu.be/9hi4c_DCrkw</a>)</p> <p>Source code branch is here: <a href="https://github.com/guardianproject/securesmartcam/tree/obscurav2">https://github.com/guardianproject/securesmartcam/tree/obscurav2</a></p> <p>Latest ALPHA test build at: <a href="https://github.com/guardianproject/SecureSmartCam/ObscuraCam-2.0-Alpha-2.apk/qr_code">https://github.com/guardianproject/SecureSmartCam/ObscuraCam-2.0-Alpha-2.apk/qr_cod</a>e</p> <div id='gallery-5' class='gallery galleryid-1590 gallery-columns-3 gallery-size-thumbnail'> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-02-120646.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-02-120646-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-02-120717.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-02-120717-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-02-120826.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-02-120826-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-02-121031.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-02-121031-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-02-121111.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-02-121111-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-02-121126.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-02-121126-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-02-121143.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2012/03/device-2012-03-02-121143-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style='clear: both' /> </div> https://guardianproject.info/2012/02/23/how-many-ways-to-store-5-numbers/ Thu, 23 Feb 2012 12:29:49 -0400 https://guardianproject.info/2012/02/23/how-many-ways-to-store-5-numbers/ <p>At the core of all software that aims to be secure, private and anonymous is encryption, or as I think of it, amazing math tricks with really large numbers. These really large numbers can serve as a token of identity or the key to information locked away behind the encryption math. There are a number of different encryption methods commonly used based on different mathematical ideas, but they all rely on people managing sets of really large numbers, usually known as keys.</p> <p><a href="http://www.flickr.com/photos/stevendepolo/3378152784/" title="Skeleton Keys IMG_0774 by stevendepolo, on Flickr"><img src="https://farm4.staticflickr.com/3589/3378152784_2be2969ae6.jpg" alt="Skeleton Keys IMG_0774" width="500" height="333" /></a></p> <p>It turns out that managing these sets of really large numbers can be tricky to do well, so there are all manner of key management apps and approaches. On top of that, there seems to be decades of people wanting to make their own formats for these sets of really large numbers. So if you want to work directly with the keys themselves, you not only have to sort out the difference between the kinds of numbers used in DSA, RSA, Elliptical Curve, etc., but you will also have to figure out which of the many many formats those numbers are stored in. There are base64 formats, hex formats, standardized binary formats with names like PKCS#8/DER and X.509, old formats like S-Expressions (sexp) as well as non-standard formats like keyczar’s JSON format that uses web-safe base64. Then, there are different ways of reading and writing those different formats into a file.</p> <p>We started out working on the particular problem of translating the 5 numbers (x, y, p, q, g) used in DSA keys. DSA keys are used for OTR encryption, and we want to make it possible to translate the DSA key information stored by one OTR messaging app into the format used by others. Here are three examples of storing DSA keys:</p> <p><em>(In general, its a very bad idea to post private keys anywhere at all public. These three are private keys that have been generated for test purposes)</em></p> <p>libotr private key from Pidgin (sexp with hex numbers):</p> <blockquote> <p>(account<br /> (name “&#x67;p&#x74;&#x65;s&#x74;@j&#x61;bb&#x65;r.&#x6f;rg/”)<br /> (protocol prpl-jabber)<br /> (private-key<br /> (dsa<br /> (p<br /> #00CD96479A2F404FB600F9C85EE3DCD69FDF93F217AEE54A1286069983BA7731D0C73C7CB3B8CFA482A0AF6FF906E470EB4EF7F4D201D087AEDBF0086710F3039CBF42358C1BFA7D86A36332E21D32BE31538571CBC8D4F281DDD1076BA2B29B549ED29B3C19C341AEF83C80157E87FF2930B5E15C84A09AFCE28A06E06A62BCEF#)<br /> (q #00D5B4647E688974D1B6B199E1A59AB2F985DBCE01#)<br /> (g<br /> #0093E333135FCBCE68FC6E410B304482F2F95D82BF53534C3636EADB0C22241CF35BD294B096070DC08138EFE73B03C88FD444595974E9455274F695147AF9D46B85286B4CFEF3D00BCA1D3BEB8C7EFFBA08132E1A1E4D9F115B863C52C72971F4695758354FC3BE3C4A45AF6A47747B59733905C33EE86ED68D9D90494877AE33#)<br /> (y<br /> #362C06B9CDD67FC4E7A7A62289D6C1E8BA061A024946A5ACC1A7DC70F6B03D99A1D3B3215D20BC4F8458EEC3F31E1391E9B519FDCDCC3CF0FBA38F8A7213551B32D59DE655F506633FB6B0EA94C4174D227DB614EF6723AB057B40CF36E2A414D0A8DCF223EE7EDD851793C4DC92282C79503030045D49A0ABCC3C6CC4080909#)<br /> (x #24FE542B1C7DC8337F6F8030C7D639B7BF091B40#)<br /> )<br /> )</p> </blockquote> <p>otr4j private key from Gibberbot (PKCS#8 DER with ASCII armor, escaped for Java Properties):</p> <blockquote> <p>&#x67;p&#x74;es&#x74;@&#x6a;ab&#x62;e&#x72;.o&#x72;g&#x2e;&#x70;r&#x69;va&#x74;e&#x4b;ey=MIIBSgIBADCCASsGByqGSM44BAEwggEeAoGBAMtPbcgvf2CAHN4djUb+gCPw/e8Xpeyc9GknS9zs\nJjSCg9vgiKBVlQBceiKAkK8SVVEaA671SS0XO575OK/sAc4j0n2t9QJP1wyGCOhV79WbwhPPEVhs\ncpAHakr9IAW6WdSnwhL/seZLYRKiVGpxXJffwN+sYjH00PulKNxmz2+DAhUAxh9yFSC1uuGk6IR0\ntnVAfsPUt7cCgYBGfHU40n0HgKIkVe3XtX0G3CbiGbR++qaEjNqnfWynggqeeVkYliLaDlVrR4B0\nnLrHZLEcUMO38YKmrwug02acp9P65IcjZ2yaioPBSmV7R6pMGOdJFR3V7Pd5R2+NcUdJd2xSffLf\nrChM82SKqa7b3DOPHkSoIdp/vJiRgikZrwQWAhRE5snYBaoR84hWVdxlumAYkBRUEA\=\=</p> </blockquote> <p>private key from keyczar (JSON with websafe base64):</p> <blockquote> <p>{<br /> “publicKey”: {<br /> “q”: “AJJfsQZrhUV8p6TmpPqa084JwX9j”,<br /> “p”: “AIAAAAAAAAXxHhQxJRZ-PPj2BDrHHLV8c8pX6nyOLAW3Bc7CX_SfBiGH2VyImoz6JlAOZi6x_XspxdUvpTjV7J9uO9hwnF31m3SQjdkZW2DQDb5OS1rW_4MGrTJCktKtlZz7f8_5AoO8yHSY2XWNDqrpBEiNvaTX1ttQ59nREiR1”,<br /> “y”: “AGlQuRpbat4drE_fcdSZrEVfS6Fme3tNfUoJVRec1pUhoSo9PBHKFx3lbBmI8Vnub8vuY1nM2yTadOZ8H4-TYxB5JNMVTK7vLNdVcWvUUF9zRZCwps1bl0_Al29X0I1iQYJN6Klxi_QbKaSf5PhfXLVom9bJYp7_TwZCouaab296”,<br /> “g”: “AES5hk-DKXP__t6yDsXIdykf7lhSKHqQCW5H2V5dMg8JkoFBSP7mIvaCHT4IxoxdM2AIpWgcoi5XSrd_hD2sjNa1JHTb9BUh31dHJLym6rTsV12ClN6f78Cjt0oKFIRI\__yWn9KM-vLEsjpd10VHlPfbEgKYePCnXFt7Y78G0wGr”,<br /> “size”: 1024<br /> },<br /> “x”: “AGLJry5Q0CZo9cH6XRYd2ZZZppwg”,<br /> “size”: 1024,<br /> }</p> </blockquote> <p>There are many instant messaging (IM) apps that provide solid support for the OTR chat encryption protocol. Many people use the same IM account across multiple computers and programs, but this generally causes lots of headaches when using OTR. One technique for eliminating these headaches is to use the same private OTR key across all programs and computers, but since each program has a different file format, this is hard to setup. In order to address this issue, we first mapped out the key and file formats for a number of the most widely used OTR programs (Pidgin, Adium, Gibberbot, Jitsi, irssi). As part of the <a href="https://github.com/guardianproject/otrfileconverter">OTRFileConverter project</a>, we have written parsers for these file formats, and are close to being able to convert between all of them. These parsers not only convert the private keys for each account, but also the known public keys of remote accounts as well as their verified status. In this process, we discovered a fundamental incompatibility in the otr4j library used in Gibberbot, Jitsi, beem-otr, and other software. Fortunately, it should be possible to fix the otr4j library itself and all the software based on it should have the issue transparently fixed by including the updated otr4j.</p> <p>Coming soon, OTRFileConverter will be able to sync all of your key information between Pidgin and Gibberbot, so that means private keys, other people’s public keys, and whether those keys have been manually verified, or verified via the Socialist Millionaire’s Protocol (SMP).</p> <p>Track our progress at: <a href="https://github.com/guardianproject/otrfileconverter">https://github.com/guardianproject/otrfileconverter</a></p> https://guardianproject.info/2012/02/22/free-sip-providers-with-zrtp-support/ Wed, 22 Feb 2012 19:10:11 -0400 https://guardianproject.info/2012/02/22/free-sip-providers-with-zrtp-support/ <p>This post is part of a series on our work researching the <a href="https://guardianproject.info/tag/ostn/">Open Secure Telephony Network</a>. After you have <a href="https://code.google.com/p/csipsimple/">CSipSimple installed</a> on your mobile handset, you will need a place to register a SIP username so you can contact others. The fastest way to get started with this is to use one of a handful of free SIP providers. I like the <a href="https://www.ekiga.net/index.php?page=register">Ekiga free SIP service</a>.</p> <p><a href="http://www.flickr.com/photos/andwar/45070135/" title="Red Telephone Boxes by Andwar, on Flickr"><img src="https://farm1.staticflickr.com/26/45070135_a1dd5889a7.jpg" alt="Red Telephone Boxes" width="500" height="375" /></a></p> <p>The only drawback to this service is the userbase is large enough that the namespace of easy to remember words is frequently occupied. Chances are you will not be able to register your name and must make some novel admendments to ensure a unique name. Since telephony is closely associated with numbers, not words, it will be easier to find a 10 digit number combination to use as your username. This makes username input simpler since CSipSimple gives you the familliar telephone dial pad as the default interface.</p> <p>After you create a user with Ekiga, you must input the username and password into CSipSimple to register with the service. There is a preset configuration screen for the Ekiga service in the Account Add interface. Fill in the forms and your handset will be registered if you have an active data connection.</p> <p>Calling another user with CSipSimple will initiate the ZRTP handshake if both people have enabled it. Subsequent calls do not require this verfication, since it checks a Short Authentication String (SAS) for each peer.</p> <p>Another SIP provider that is similar to Ekiga is <a href="http://www.iptel.org/service">IPtel</a>. It supports the same features, including ZRTP.</p> <p>At this point, now you should have everything you need to start an anonymous conversation on a mobile handset. The one drawback of this configuration is you may not fully trust the third-party SIP registrar, namely Ekiga. The solution to this is to run your own registrar, which is the <a href="http://lee.rockingtiger.com/posts/79">next installment</a>.</p> <p>ZRTP me ASAP!</p> https://guardianproject.info/2012/02/22/open-source-sip-client-for-android/ Wed, 22 Feb 2012 16:12:25 -0400 https://guardianproject.info/2012/02/22/open-source-sip-client-for-android/ <p>The first step in the <a href="https://guardianproject.info/tag/ostn/">Open Secure Telephony Network (OSTN)</a> is a client. We can’t make a phone call without a phone. In this case there are three primary goals and a number of optional features. The primary goal is an application which speaks the SIP protocol for signalling. It must also speak the ZRTP protocol for peer to peer encryption key exchange. Finally the client must have source code freely available with a license that allows free redistribution.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/02/csipzrtp.jpg"><img class="size-full wp-image-1546 alignleft" style="border-width: 3px;border-color: black;border-style: solid;margin: 3px" src="https://guardianproject.info/wp-content/uploads/2012/02/csipzrtp.jpg" alt="" width="200" height="300" /></a>As of today, the only client for Andriod that fufills this qualification is named <a href="https://code.google.com/p/csipsimple/">CSipSimple</a>. Also as of today, the ZRTP functionality is only available from a <a href="http://nightlies.csipsimple.com/trunk/">nightly build</a> of the binary package. Your mobile handset will not allow you to install this package until you enable “Unknown sources” in the Applications settings of your phone. By default this option is disabled on all phones. To do this, open Settings from the application menu and select Applications. Check the “Unknown sources” box. Some handset vendors <a href="http://www.androidcentral.com/att-confirms-third-party-apps-coming-existing-phones">disable this process</a> (referred to by the euphemism “sideloading”) though <a href="http://www.androidcentral.com/swm">there are workarounds</a>. Remember, don’t install the version from the market, since that does not support the ZRTP protocol. You must type in the URL for the nightly build in the handset’s browser and download the .apk. Once the package is installed, future updates may be installed through the CSipSimple application settings menu.</p> <p>CSipSimple offers some nice features. It abstracts the dizzying array of configuration options required by any application that wishes to speak the SIP protocol with another. It also has some template configuration for external service providers, which I will get to in my <a href="http://lee.rockingtiger.com/posts/78">next post</a>.</p> <p>CSipSimple. Do it!</p> <p>Original post created at 2012-01-14 05:19:02 UTC <a href="http://lee.rockingtiger.com/posts/77">Permalink</a></p> https://guardianproject.info/2012/02/22/open-secure-telephony-network/ Wed, 22 Feb 2012 15:39:26 -0400 https://guardianproject.info/2012/02/22/open-secure-telephony-network/ <p>Over the last two months, I have been working on a project to research and develop a set of tools to provide secure peer to peer Voice over IP on the Android mobile platform. It is called the Open Secure Telephony Network, or <a href="https://guardianproject.info/wiki/OSTN">OSTN</a>. This work is done under the umbrella of <a href="https://guardianproject.info/">The Guardian Project</a>.</p> <p><a href="http://www.flickr.com/photos/stuartbarr/5893549665/" title="Telephone wires by Stuart Barr, on Flickr"><img src="https://farm6.staticflickr.com/5119/5893549665_24943d362e.jpg" alt="Telephone wires" width="500" height="333" /><br /> </a> <em>this is not the type of “open” we mean, and definitely not secure</em></p> <p>The project will continue for another four months and I will post my public findings here. It’s well underway and I have developed a functional system in the SATELLITE lab in New York City. The goal by the the end of the project is to offer an alternative to Skype or Google Talk, which are both good voice services but don’t offer the kind of security needed by human rights activists and journalists.</p> <p>Right now the stack looks like this</p> <ul> <li>A client that understands the <a href="https://en.wikipedia.org/wiki/Session_Initiation_Protocol">SIP</a> protocol and the <a href="https://en.wikipedia.org/wiki/ZRTP">ZRTP</a> protocol</li> <li>A server that can register SIP users and pass off the ZRTP traffic to peers</li> </ul> <p>Sounds simple enough, though the development landscape for these applications changes quickly, as does the legal implications of various implementations of both protocols.</p> <p>On top of that, there are networking issues that make building this kind of network a challenge.</p> <p><a href="https://guardianproject.info/wiki/OSTN">Stay tuned at https://guardianproject.info/wiki/OSTN</a>!</p> <p>Originally published at 2012-01-10 22:03:09 UTC <a href="http://lee.rockingtiger.com/posts/76">Permalink</a></p> https://guardianproject.info/2012/02/09/february-2012-project-update/ Thu, 09 Feb 2012 17:19:06 -0400 https://guardianproject.info/2012/02/09/february-2012-project-update/ <p>Through coordination with the Tor Project, we released <strong>Orbot</strong> 1.0.7, which includes an embedded version of OpenSSL to assure we have the latest security enhancements for this critical cryptographic library. In addition, compatibility testing was done on Android 4.0 (Ice Cream Sandwich) and with the latest versions of Firefox Mobile. As always you can learn more and download Orbot in the Android Market and at <a href="https://guardianproject.info/apps/orbot">https://guardianproject.info/apps/orbot</a></p> <p>With the public awareness of internet censorship and surveillence growing thanks to SOPA, PIPA and CarrierIQ, not to mention the ongoing unrest in many regions if the world, we have seen a huge spike in interest and download of Orbot, Orweb and Gibberbot. Here are some notable links:<br /> <a href="http://mobileactive.org/howtos/user-guide-to-orbot">http://mobileactive.org/howtos/user-guide-to-orbot</a><br /> <a href="http://www.chinagfw.org/2012/01/orbot-tor.html">http://www.chinagfw.org/2012/01/orbot-tor.html</a><br /> <a href="http://geeknews.cz/orbot-svobodnejsi-brouzdani-pro-android/352/">http://geeknews.cz/orbot-svobodnejsi-brouzdani-pro-android/352/</a><br /> <a href="http://www.101hacker.com/2012/01/10-must-have-free-android-apps.html">http://www.101hacker.com/2012/01/10-must-have-free-android-apps.html</a></p> <p>We pushed a small fix to <strong>ObscuraCam</strong> to solve a problem with saving processed images on many Samsung Galaxy devices, and a number of fixes in the native Android JPEG Redaction library which has been developed as part of the project.<br /> <a href="https://github.com/guardianproject/securesmartcam/tree/obscurav1">https://github.com/guardianproject/securesmartcam/tree/obscurav1</a></p> <p>Along with our partners at WITNESS, we presented the entire <strong>SecureSmartCam</strong> project at the monthly New York Tech Meetup event, attended by hundreds of the city’s top developers, entrepreneurs and investors. Our goal was too raise awareness about visual privacy, show off our app, and highlight the fact that we are doing grant-funded, open-source human rights tech work in the middle of Silicon Alley. The project was well received with the demo going off without a hitch. The Economist also featured the SecureSmartCam project in print and online through a story focused on the future of protest video.</p> <p>Economist blog and video: <a href="http://www.economist.com/blogs/babbage/2012/01/technology-and-democracy">http://www.economist.com/blogs/babbage/2012/01/technology-and-democracy</a><br /> New York Tech Meetup full stream: <a href="http://vimeo.com/34608516">http://vimeo.com/34608516</a></p> <p>Formal management of the <strong>SQLCipher for Android</strong> project has been moved over to a joint effort between Zetetic, LLC and the Guardian Project, with the new online home being <a href="https://github.com/sqlcipher">https://github.com/sqlcipher</a> and the code packaging moving to a net.sqlcipher.* base. Zetetic is the creator of the original core SQLCipher project and they have been critical in our efforts to bring it to Android. We expect to release an update to SQLCipher 2 with support for Android ICS 4.x this month.</p> <p>Our <strong>Portable Shared Security Tokens (PSST)</strong> research project made great headway in sorting through the many, many formats for storing cryptographic keys in open-source software, specifically messaging apps using the Off-the-Record private messaging protocol. One of the project goals is to enable synchronization of keys, included trusted or verified status, from desktop to mobile contexts. An initial set of code has been posted which enables transfer of key between Pidgin and Gibberbot. Learn more at <a href="https://guardianproject.info/wiki/PSST">https://guardianproject.info/wiki/PSST</a></p> <p><strong>Open Secure Telephony Network (OSTN)</strong> is another internal research effort to audit and promote reliable solutions for secure open-source, mobile voice communication. Our chief focus has been the determining which client apps and server soft switches properly support TLS, SRTP and ZRTP protocols for encrypting both SIP signaling and the actual RTP media streaming. We also surveyed the mobile telephony habits of over twenty activists and NGOs, and unsurprisingly found a great dependence on Skype. We plan to release the results of the survey publicly, along with some initial assessments and tutorials in February. Track our efforts at <a href="https://guardianproject.info/wiki/OSTN">https://guardianproject.info/wiki/OSTN</a></p> https://guardianproject.info/2012/01/20/introducing-informacam/ Fri, 20 Jan 2012 13:58:26 -0400 https://guardianproject.info/2012/01/20/introducing-informacam/ <p>These are interesting times, if you go by Times Magazine as an indicator. The magazine’s person of the year for 2011 was The Protester, preceded in 2010 by Facebook founder Mark Zuckerberg. Both entities partners with equal stake in freely sharing the digital content that shows the world what’s going on in it, at any time, from behind any pair of eyes.<img class="alignright size-medium wp-image-1471" alt="The Protester: Person of the Year" src="https://guardianproject.info/wp-content/uploads/2012/01/poy_cover-225x300.jpg" width="225" height="300" srcset="https://guardianproject.info/wp-content/uploads/2012/01/poy_cover-225x300.jpg 225w, https://guardianproject.info/wp-content/uploads/2012/01/poy_cover.jpg 474w" sizes="(max-width: 225px) 100vw, 225px" /> Also casting in their lot with the others is Time Magazine’s 2006 person of the year, You: the You that puts the “you” in “user-generated content;” the You whose miasma of bits, bytes, and the powerful images they express are becoming increasingly problematic. Problematic and exciting. As governments, police forces, and other power players here and abroad crack down on voices of dissent, it is only You, The Protester, armed not with a press pass, but with a smartphone and a Twitter account, who brings the rest of the world its news. You do it mainly without either the support or permission of those in power, and this makes you a very important person in the world.</p> <p>The smartphone’s role in the defense of human rights has thus become ever-more clear. How can we make it clearer? Our latest project, InformaCam, tackles this issue head-on. In collaboration with <a href="https://www.witness.org/" target="_blank">Witness.ORG</a> and the <a href="www.ibanet.org/" target="_blank">International Bar Association</a>, we’re building a powerful tool to create iron-clad digital images and video that could, should the occasion arise, be used in courts of law to bring justice. This is no small feat– with this project we are helping create the first evidentiary standards for digital media in the social networking age. So, <a href="http://www.economist.com/node/21542748" target="_blank">there’s been a lot of excitement</a> these past few weeks about InformaCam, as well as a lot of mystery. It’s time to give the project a proper unveiling.</p> <p>InformaCam is a plugin for ObscuraCam that allows the user, without much intervention on their own part, to inflate image and video with extra points of data, or metadata. The metadata includes information like the user’s current GPS coordinates, altitude, compass bearing, light meter readings, the signatures of neighboring devices, cell towers, and wifi networks; and serves to shed light on the exact circumstances and contexts under which the digital image was taken. Some users will already be familiar with ObscuraCam, which allows for capturing and digitally manipulating media. With InformaCam included, the app starts to behave almost like Adobe Photoshop or GIMP, supporting non-destructive, layer-based edits to media. This means that a version of an image can be created with any sensitive image data and metadata preserved and encrypted to trusted entities, along with a redacted version that has its metadata stripped which can be easily shared to Facebook, Twitter, Flickr, or any public service the user wishes to use.</p> <h2 id="how-informacam-works">How InformaCam Works</h2> <p><img class="alignleft size-full wp-image-1459" alt="InformaCam (1)" src="https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.18.27-PM.png" width="205" height="341" srcset="https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.18.27-PM.png 205w, https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.18.27-PM-180x300.png 180w" sizes="(max-width: 205px) 100vw, 205px" /> The workflow is similar to that of ObscuraCam, but with a few key differences. Notice that on start-up, the app triggers the on-board sensors. (Notifications in the top right corner clearly indicate the GPS and Bluetooth modules have been turned on.) This allows the app to register sensory and atmospheric data throughout the session. These “bundles” of data contain the following:</p> <ul> <li>Current timestamp</li> <li>Device’s identification</li> <li>User’s public (PGP) key</li> <li>Image Regions created in the image/video</li> <li>Current latitude &amp; longitude</li> <li>Current cell ID (if available)</li> <li>Altitude</li> <li>Compass bearing</li> </ul> <p>Whether the user is taking a picture, or editing an existing piece of media, the app registers the goings-on, and signs each bundle of data with the user’s private key. This mean that all actions taken on a piece of media (from capture to editing) are attributed to the user.</p> <p>As with ObscuraCam, the user can perform image filtering and obfuscation on image regions. InformaCam also adds the “Identify” filter, which prompts the user for the subject’s name (or pseudonym) and to fill in whether or not the subject has given his or her consent to be filmed. This checklist of subject permissions can be further developed to match the needs of any organization to provide further protection to the people in front of the camera. Notice again the sensor notifications: the context surrounding each edit to the image is recorded and will be inserted into the media as metadata once the media is saved.</p> <p>When the user saves the image or video, a dialog appears prompting her to choose one or more “trusted destinations.” This could be an organization, a news outlet, or any friend whose PGP key is known to you. A copy of the unredacted, data-rich image will be created and encrypted to those parties. At the same time, a redacted and data-stripped version is made available to share with anyone, anywhere.</p> <table> <tr> <td width="201"> <img class="alignnone size-full wp-image-1461" alt="InformaCam (2)" src="https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.21.07-PM.png" width="201" height="332" srcset="https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.21.07-PM.png 201w, https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.21.07-PM-181x300.png 181w" sizes="(max-width: 201px) 100vw, 201px" /> </td> <td width="197"> <img class="alignnone size-full wp-image-1462" alt="InformaCam (3)" src="https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.21.21-PM.png" width="197" height="330" srcset="https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.21.21-PM.png 197w, https://guardianproject.info/wp-content/uploads/2012/01/Screen-shot-2012-01-20-at-1.21.21-PM-179x300.png 179w" sizes="(max-width: 197px) 100vw, 197px" /> </td> </tr> <tr> <td> <i>Using the InformaCam “Identify” filter.</i> </td> <td> <i>Select a Trusted Destination for your encrypted media.</i> </td> </tr> </table> <h2 id="the-informa-metadata-schematic">The Informa Metadata Schematic</h2> <p>The metadata is organized in four categories: intent, consent, geneaology, and data. Here’s a rundown of what these categories mean.</p> <h3 id="intent">Intent</h3> <p>This expresses information about the media’s creator, and the rules governing how this particular media object can be shared, and to whom.</p> <h3 id="consent">Consent</h3> <p>This bucket of information regards the subjects contained in the image. Each subject is identified (by a name or pseudonym selected by the user) along with their stated preferences regarding treatment of their likeness. For example, if Bobby insists that he wants his face to be fully redacted (rather than blurred) this preference should be registered in metadata.</p> <h3 id="genealogy">Genealogy</h3> <p>This information regards chain-of-custody, and represents how the media was acquired, and if a particular image or video is a duplicate of another.</p> <h3 id="data">Data</h3> <p>This category includes all standard metadata (timestamp, acquired sensory data, location and movement data) that have been collected during the lifetime of the image, from the moment it was opened to the instant it was saved.</p> <p>A sample metadata bundle for an image taken with InformaCam looks like this in JSON notation:</p> <p><code>&lt;br /&gt; {&lt;br /&gt; &quot;data&quot;:{&lt;br /&gt; &quot;device&quot;:{&lt;br /&gt; &quot;bluetoothInformation&quot;:{&lt;br /&gt; &quot;selfOrNeighbor&quot;:-1,&lt;br /&gt; &quot;deviceBTAddress&quot;:&quot;00:25:36:79:EC:6C&quot;,&lt;br /&gt; &quot;deviceBTName&quot;:&quot;nexxxie&quot;&lt;br /&gt; },&lt;br /&gt; &quot;imei&quot;:&quot;363289131048142&quot;&lt;br /&gt; },&lt;br /&gt; &quot;sourceType&quot;:101,&lt;br /&gt; &quot;imageRegions&quot;:[&lt;br /&gt; {&lt;br /&gt; &quot;regionDimensions&quot;:{&lt;br /&gt; &quot;height&quot;:256,&lt;br /&gt; &quot;width&quot;:256.00006103515625&lt;br /&gt; },&lt;br /&gt; &quot;regionCoordinates&quot;:{&lt;br /&gt; &quot;left&quot;:527.705078125,&lt;br /&gt; &quot;top&quot;:196.15255737304688&lt;br /&gt; },&lt;br /&gt; &quot;obfuscationType&quot;:&quot;Identify&quot;,&lt;br /&gt; &quot;location&quot;:{&lt;br /&gt; &quot;locationType&quot;:11,&lt;br /&gt; &quot;locationData&quot;:{&lt;br /&gt; &quot;gpsCoords&quot;:&quot;[40.7085011,-73.9668647]&quot;,&lt;br /&gt; &quot;cellId&quot;:&quot;36789325&quot;&lt;br /&gt; }&lt;br /&gt; },&lt;br /&gt; &quot;captureTimestamp&quot;:{&lt;br /&gt; &quot;timestamp&quot;:1326216508313,&lt;br /&gt; &quot;timestampType&quot;:7&lt;br /&gt; },&lt;br /&gt; &quot;subject&quot;:{&lt;br /&gt; &quot;consentGiven&quot;:&quot;general_consent&quot;,&lt;br /&gt; &quot;informedConsentGiven&quot;:true,&lt;br /&gt; &quot;subjectName&quot;:&quot;Harlo!&quot;&lt;br /&gt; },&lt;br /&gt; &quot;unredactedRegion&quot;:&quot;I@4070cf30&quot;&lt;br /&gt; }&lt;br /&gt; ],&lt;br /&gt; &quot;imageHash&quot;:&quot;f18e7510faaad0d942db68b5c75f219a&quot;,&lt;br /&gt; },&lt;br /&gt; &quot;geneaology&quot;:{&lt;br /&gt; &quot;dateAcquired&quot;:0,&lt;br /&gt; &quot;localMediaPath&quot;:&quot;\/mnt\/sdcard\/DCIM\/Camera\/1326216520426.jpg&quot;,&lt;br /&gt; &quot;dateCreated&quot;:1326216527629&lt;br /&gt; },&lt;br /&gt; &quot;intent&quot;:{&lt;br /&gt; &quot;owner&quot;:{&lt;br /&gt; &quot;ownershipType&quot;:25,&lt;br /&gt; &quot;ownerKey&quot;:&quot;MY-IDENTITY-IS-HERE&quot;&lt;br /&gt; },&lt;br /&gt; &quot;securityLevel&quot;:1,&lt;br /&gt; &quot;intendedDestination&quot;:&quot;[\&quot;&amp;#x68;ar&amp;#x6c;&amp;#x6f;.h&amp;#x6f;&amp;#x6c;me&amp;#x73;@g&amp;#x6d;&amp;#x61;il&amp;#x2e;&amp;#x63;om\&quot;]&quot;&lt;br /&gt; }&lt;br /&gt; </code></p> <h2 id="your-help">Your Help</h2> <p>InformaCam is a work-in-process, and we’d love help from the community in fleshing out our metadata specification, especially in adding new items to the consent checklist. Feel free to contact us with any suggestions/comments, or just leave some helpful tips in the comments below.</p> https://guardianproject.info/2012/01/04/strong-mobile-passwords-with-yubikey-usb-token/ Wed, 04 Jan 2012 00:45:43 -0400 https://guardianproject.info/2012/01/04/strong-mobile-passwords-with-yubikey-usb-token/ <p>We have been experimenting with the <a href="http://www.yubico.com/yubikey">Yubikey</a>, a USB hardware password token, a bit over the last few weeks and would like to share our initial findings. We have not received any financial support or donation from Yubico for this work. We simply think they have a very affordable, interesting product that, due to its design, does *not* require any on-device driver software and can easily work with any Android device that supports USB Host/HID mode.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.05.17.jpg"><img title="2012-01-03 14.05.17" src="https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.05.17-300x225.jpg" alt="" width="300" height="225" /><br /> </a> <em>Yubikey is small, light and attaches to a keychain</em></p> <p>Our motivation for investigating this device was in finding a way to encourage the use of strong (aka long, mixed-case, etc) passwords on mobile devices, for use with SQLCipher, screenlock passwords, and on boot disk encryption. The issue is that most users rely on short PINs or a visual unlock pattern, which does not provide enough randomness to ensure security of their data. In addition, due to the use of a touchscreen, fingerprint oil smudges on the screen often reveal the numbers entered or the pattern drawn to unlock the device (See the <a href="https://docs.google.com/viewer?url=http%3A%2F%2Fwww.usenix.org%2Fevents%2Fwoot10%2Ftech%2Ffull_papers%2FAviv.pdf">“Smudge Attacks on Smartphone Touch Screens”</a> paper.)</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/01/medium_nexus-one-gesture-password-insecure-536x587_01.jpg"><img class="alignnone size-full wp-image-1397" title="medium_nexus-one-gesture-password-insecure-536x587_01" src="https://guardianproject.info/wp-content/uploads/2012/01/medium_nexus-one-gesture-password-insecure-536x587_01.jpg" alt="" width="300" height="298" srcset="https://guardianproject.info/wp-content/uploads/2012/01/medium_nexus-one-gesture-password-insecure-536x587_01.jpg 300w, https://guardianproject.info/wp-content/uploads/2012/01/medium_nexus-one-gesture-password-insecure-536x587_01-150x150.jpg 150w" sizes="(max-width: 300px) 100vw, 300px" /><br /> </a> <em>On-screen password entry can leave smudges (<a href="http://gizmodo.com/5613737/your-greasy-fingers-are-giving-up-your-android-passcode">Gizmodo</a>)</em></p> <p>Even when a user enters a traditional character based pattern, it is often laborious on a mobile device to use symbols and mixed case characters.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.05.55.jpg"><img class="alignnone size-medium wp-image-1386" title="2012-01-03 14.05.55" src="https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.05.55-300x225.jpg" alt="" width="300" height="225" srcset="https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.05.55-300x225.jpg 300w, https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.05.55.jpg 1024w" sizes="(max-width: 300px) 100vw, 300px" /><br /> </a> <em>Yubikey with inexpensive micro-USB adapter</em></p> <p>The Yubikey is a hardware token that plugs into a USB port, and is activated by a short press on the touch sensitive gold-colored disc. It essentially looks and acts like an external hardware keyboard, which is how it works in a drivelress manner. While the primary function of the Yubikey is as a generator for one-time passwords to be verified over a network with a back-end authentication system, it can also be used to store and generate local strong static passwords. It is the static password mode which we have initially worked with for use with Android devices, in order to do local authentication for disk encryption, screen unlock and local encrypted application databases. <em>(We do plan to investigate the other modes of the Yubikey in future posts.)</em></p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/01/yubikey.png"><img class="alignnone size-medium wp-image-1384" title="yubikey" src="https://guardianproject.info/wp-content/uploads/2012/01/yubikey-300x246.png" alt="" width="300" height="246" srcset="https://guardianproject.info/wp-content/uploads/2012/01/yubikey-300x246.png 300w, https://guardianproject.info/wp-content/uploads/2012/01/yubikey.png 902w" sizes="(max-width: 300px) 100vw, 300px" /></a></p> <p><em>Yubikey Personalization Tool – simple and free</em></p> <p>Android has a limit of 17 characters for its disk encryption and screen unlock password. Using the <a href="http://www.yubico.com/personalization-tool">Yubikey Personalization Tool</a>, we were able to generate a strong password of that limit, as well as a 13 character password, which we combined with a memorized, manually entered 4 digit pin. By combining the long password from the Yubikey with a short memorized version, a certain amount of security is preserved even if the key is physically stolen along with your mobile device.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.07.10.jpg"><img class="alignnone size-medium wp-image-1388" title="2012-01-03 14.07.10" src="https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.07.10-300x225.jpg" alt="" width="300" height="225" srcset="https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.07.10-300x225.jpg 300w, https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.07.10.jpg 1024w" sizes="(max-width: 300px) 100vw, 300px" /><br /> </a> <em>Yubikey activation via micro-USB on Motorola Xoom</em></p> <p>__At this point in time, it seems that only Android tablets, such as the Viewsonic GTab, Motorola Xoom and Toshiba Thrive support the necessary <a href="https://en.wikipedia.org/wiki/USB_human_interface_device_class">USB Human Interface Device mode</a> to enable the Yubikey to work. We have not yet found a smartphone that supports external keyboard hardware, but we are sure they are out there, or else it will not be long. Our initial tests were with the Motorola Xoom, which only includes a micro USB port. Fortunately, using a <a href="http://www.amazon.com/Micro-USB-Male-Female-Adapter/dp/B0027YYMU6/ref=sr_1_1?ie=UTF8&amp;qid=1325636089&amp;sr=8-1">very simple adapter purchased on Amazon</a>, we were able to make it work. Open the Android settings to the Location &amp; Security screen, and configure your lock screen to be “Secured with password”. When asked to type it in, plug in the Yubikey with adapter, touch the disc, and the pre-configured static password spits out into the password field that is currently in focus on the device.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.09.04.jpg"><img class="alignnone size-medium wp-image-1390" title="2012-01-03 14.09.04" src="https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.09.04-300x225.jpg" alt="" width="300" height="225" srcset="https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.09.04-300x225.jpg 300w, https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.09.04.jpg 1024w" sizes="(max-width: 300px) 100vw, 300px" /><br /> </a> <em>Yubikey password entry</em></p> <p>The Toshiba and Viewsonic tablets offer full-size USB ports, which makes the use of the Yubikey much easier, as seen below. However, as a best practices policy, even if the key can be left plugged in to the device while in use and in motion, it makes most sense to remove the Yubikey immediately, and have it attached to a keychain or other physical item you always keep on your person.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.08.08.jpg"><img class="alignnone size-medium wp-image-1389" title="2012-01-03 14.08.08" src="https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.08.08-300x225.jpg" alt="" width="300" height="225" srcset="https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.08.08-300x225.jpg 300w, https://guardianproject.info/wp-content/uploads/2012/01/2012-01-03-14.08.08.jpg 1024w" sizes="(max-width: 300px) 100vw, 300px" /></a></p> <p>Yubikey also offers an <a href="http://www.yubico.com/rfid-yubikey">RFID-enabled version of their key</a> which is compatible with the Near Field Communication (NFC) technology found in some newer Android phones. Using this solution, it may be possible to not require actually plugging in the key at all, but instead just having it in the vicinity of your mobile device. You would still need to combine this with a short directly entered password or PIN, in case the NFC signal is somehow wirelessly sniffed by an attacker, though the risk of that is very low for most typical deployments, and NFC itself does provide some amount of security.</p> <p>All in all, we find the Yubikey to server a useful purpose in improving the base level of local device security on compatible Android devices. While one could type in a 17 character, mixed-case, number and symbol password directly into a device, it would grow old quickly, especially with typical, end-users. The act of plugging in a Yubikey takes very little effort, and combined with a short manually entered PIN, provides the maximum amount of password security for disk encryption, screen locking, and application-based security on Android.</p> <p>Look for future posts on the use of the Yubikey and other hardware token devices, specifically investigating their use in one-time password, challenge-response, and RFID/NFC modes.</p> <p> </p> https://guardianproject.info/2011/12/22/thoughts-on-mobile-video-for-activism/ Thu, 22 Dec 2011 16:39:43 -0400 https://guardianproject.info/2011/12/22/thoughts-on-mobile-video-for-activism/ <p>I’ve co-written a blog post with Bryan Nunez of WITNESS, on some important concepts around using mobile video technology within activists and protest situations.  It is up now <a href="https://blog.witness.org/2011/12/mobile-workflow-human-rights-video/">on their blog</a>, but here is a short excerpt:</p> <blockquote> <p>Activists all over the world have turned to mobile phones to organize, coordinate and document their struggle.  Images and videos shot on mobile phones have been the standard for what revolution looks like in the public imagination.  We have seen iconic moments, captured in low resolution on mobile phones, captivate global audiences. We have moved from a handful of grainy clips uploaded hours or days after events unfold, to multiple livestreams, showing different angles on something happening right now. The Arab Spring, the #Occupy Movement, as well less politicized events like the <a href="https://blog.witness.org/2011/08/citizen-media-in-the-london-riots/">London and Vancouver riots</a><a href="https://blog.witness.org/2011/08/citizen-media-in-the-london-riots/"> </a>have shown us that the mobile phone is the recording device used to document the next breaking news story, especially if that story involves any sort of protest or activism.</p> </blockquote> <p> </p> <p><a href="https://guardianproject.info/wp-content/uploads/2011/12/image07.png"><img title="image07" src="https://guardianproject.info/wp-content/uploads/2011/12/image07.png" alt="" width="634" height="135" /></a></p> <p>Read on here: <a href="https://blog.witness.org/2011/12/mobile-workflow-human-rights-video/">https://blog.witness.org/2011/12/mobile-workflow-human-rights-video/</a></p> <p> </p> <p> </p> <p> </p> <p> </p> <p> </p> https://guardianproject.info/2011/11/29/sqlcipher-for-android-v1-final/ Tue, 29 Nov 2011 18:17:47 -0400 https://guardianproject.info/2011/11/29/sqlcipher-for-android-v1-final/ <p> </p> <p>Team GP along with the good folks at <a href="http://zetetic.net/">Zetetic</a>, are happy to announce that we have reached <em><strong>FINAL</strong></em> on our first release (“v1” 0.0.6 build) of <a href="https://guardianproject.info/code/sqlcipher/">SQLCipher for Android</a>. This means we consider this a production release, ready for shipping with your apps to provide for reliable, open-source, secure application data encryption.</p> <p>If you need a refresher, here is what the cross-platform, open-source <a href="https://www.zetetic.net/sqlcipher/">SQLCipher</a> provides:</p> <blockquote> <p>SQLCipher is an <a href="http://sqlite.org/">SQLite</a> extension that provides transparent 256-bit AES encryption of database files. Pages are encrypted before being written to disk and are decrypted when read back. Due to the small footprint and great performance it’s ideal for protecting embedded application databases and is well suited for mobile development.</p> <ul> <li>Blazing fast performance with as little as 5-15% overhead for encryption on many operations</li> <li>100% of data in the database file is encrypted</li> <li>Uses good security practices (CBC mode, key derivation)</li> <li>Zero-configuration and application level cryptography</li> <li>Broad platform support: works with C/C++, Obj-C, QT, Win32/.NET, Java, Python, Ruby, etc on Windows, Linux, iPhone/iOS…</li> <li>Algorithms provided by the peer reviewed <a href="http://openssl.org/">OpenSSL</a> crypto library.</li> </ul> </blockquote> <p>In addition to our work porting the core codebase, the work done on Android also provides near exact API compatibility with the default <a href="http://developer.android.com/reference/android/database/package-summary.html">Android Database API</a>. This means that developers can drop in SQLCipher, and add data encryption to their application, with very little changes to their existing codebase.</p> <p>Finally, while full disk encryption is offered newer Android devices from Motorola, and those running Android 3.x Honeycomb or 4.x Ice Cream Sandwich, that only provides encryption of the entire internal or external storage, which must be unlocked and decrypted when the device is booted. The SQLCipher model ensures only a limited amount of data from your app is accessible at anytime, and allows the user or the app to lock itself down, whether or not the device itself is locked or encryption.</p> <blockquote> <p><strong>Download the Software Development Kit here for integration with your Android apps: <a href="https://github.com/downloads/guardianproject/android-database-sqlcipher/SQLCipherForAndroid-SDK-0.0.6-FINAL.zip">https://github.com/downloads/guardianproject/android-database-sqlcipher/SQLCipherForAndroid-SDK-0.0.6-FINAL.zip</a></strong></p> </blockquote> <p>You can see all the <a href="https://github.com/guardianproject/android-database-sqlcipher/issues?sort=updated&amp;direction=desc&amp;state=closed&amp;page=1">closed issues addressed</a> in this release.</p> <p>If you want to build from source, you will need the Android NDK, as well as the SDK. Pull the repo, and run ‘make all’ with the included <a href="https://github.com/guardianproject/android-database-sqlcipher/blob/master/Makefile">SQLCipher Makefile</a>.</p> <p>Our partners at <a href="http://zetetic.net/">Zetetic</a> have published a <a href="https://www.zetetic.net/sqlcipher/sqlcipher-for-android/">step-by-step application integration tutorial</a>.<a href="https://www.zetetic.net/sqlcipher/sqlcipher-for-android/"><br /> </a> <a href="https://www.zetetic.net/sqlcipher/sqlcipher-for-android/"><img class="alignnone size-medium wp-image-1345" title="eclipse-class-libraries" src="https://guardianproject.info/wp-content/uploads/2011/11/eclipse-class-libraries-300x214.png" alt="" width="300" height="214" srcset="https://guardianproject.info/wp-content/uploads/2011/11/eclipse-class-libraries-300x214.png 300w, https://guardianproject.info/wp-content/uploads/2011/11/eclipse-class-libraries.png 754w" sizes="(max-width: 300px) 100vw, 300px" /></a><a href="https://www.zetetic.net/sqlcipher/sqlcipher-for-android/"><br /> </a></p> <p>You can also get started by working with our <a href="https://github.com/guardianproject/notepadbot">sample ‘NoteCipher’ project available on Github</a>.</p> <p>If you happen to encounter them, <a href="https://github.com/guardianproject/android-database-sqlcipher/issues/new">please report any unexpected behaviours</a>, bugs, typos or other abnormalities, as soon as you can. We know there are still some <a href="https://github.com/guardianproject/android-database-sqlcipher/issues?sort=updated&amp;direction=desc&amp;state=open">outstanding issues</a> faced in some cases, but we did not consider them blockers.</p> <p>SQLCipher for Android Home: <a href="https://guardianproject.info/code/sqlcipher/">https://guardianproject.info/code/sqlcipher/</a></p> https://guardianproject.info/2011/11/16/dont-get-burned-anonymize-your-fire/ Wed, 16 Nov 2011 22:37:24 -0400 https://guardianproject.info/2011/11/16/dont-get-burned-anonymize-your-fire/ <p>Thanks to Jesse Vincent, aka <a href="https://twitter.com/obra">@obra</a> of the <a href="https://code.google.com/p/k9mail/">K-9 mail project</a>, we can say that <a href="https://guardianproject.info/apps/orbot">Orbot (Tor on Android)</a> and <a href="https://guardianproject.info/apps/orweb">Orweb (Privacy Browser)</a> work just fine on the new <a href="http://www.amazon.com/Kindle-Fire-Amazon-Tablet/dp/B0051VVOB2">Amazon Kindle Fire</a>. This means that while everything you do through Amazon’s store and browser are tracked and accounted for by Team Bezos, you can use our apps to more safely and privately access web content through the <a href="https://torproject.org">Tor network</a>. While we are mostly <a href="https://guardianproject.info/hardware/">Nook Color fans</a> around here, we know that the Kindle Fire is going to be quite popular this Christmas, and are glad to see that mobile privacy now has a toehold on the device from Seattle.</p> <p><a href="http://twitpic.com/7f2bo3"><img title="448565907" src="https://guardianproject.info/wp-content/uploads/2011/11/448565907-300x224.jpg" alt="" width="300" height="224" /></a></p> <p>This provides a nice counterpoint to some of the <a href="http://www.slashgear.com/eff-talks-silk-browser-privacy-with-amazon-19189281/">earlier privacy concerns about the Amazon Silk browser</a>, which proxies all your http connections through their data center. In addition, the fact that our <a href="https://gitweb.torproject.org/orbot.git/blob_plain/HEAD:/BUILD">very complex apps</a> work without modification on Amazon’s stripped down flavor of Android, shows that the reports of fragmentation have been greatly exaggerated. From our perspective, the power of Android comes from the compatibility of the underlying platform APIs and Linux-based foundation, and not about having a one size fits all user interface or a single-point of control app marketplace.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2011/11/Kindle-Fire.jpg"><img class="size-medium wp-image-1306 alignnone" title="Kindle-Fire" src="https://guardianproject.info/wp-content/uploads/2011/11/Kindle-Fire.jpg" alt="" srcset="https://guardianproject.info/wp-content/uploads/2011/11/Kindle-Fire.jpg 500w, https://guardianproject.info/wp-content/uploads/2011/11/Kindle-Fire-300x168.jpg 300w" sizes="(max-width: 500px) 100vw, 500px" /></a></p> <p><strong>Installation Instructions</strong></p> <p>1) Under the settings section labeled “Device,” there is an option that says “Allow Installation of Applications From Unknown Sources.” Enable this!</p> <p>2) Then download these files directly via the Fire’s browser, or side-load them from the desktop using the Android SDK “adb” tool.</p> <p>Orbot: <a href="https://www.torproject.org/dist/android/Orbot-1.0.6-Tor-0.2.3.7-alpha-FINAL.apk">https://www.torproject.org/dist/android/Orbot-1.0.6-Tor-0.2.3.7-alpha-FINAL.apk</a></p> <p>Orweb: <a href="https://github.com/downloads/guardianproject/Orweb/Orwebv2-20010809-0.2.2.apk">https://github.com/downloads/guardianproject/Orweb/Orwebv2-20010809-0.2.2.apk</a></p> <p> </p> <p>3) Start Orbot, follow the wizard, and press the power up button to connect to Tor.</p> <p>4) Start Orweb to connect to the Tor Check page to verify your connection, then browse away to your (private) heart’s content.</p> <p>5) Do a happy dance because your Kindle Fire just got way more l33t and slightly less p0wn3d.</p> <p> </p> https://guardianproject.info/code/libsqlfs/ Thu, 27 Oct 2011 00:00:00 +0000 https://guardianproject.info/code/libsqlfs/ <div class="source-code" style="text-align: center;"> <a href="https://gitlab.com/guardianproject/libsqlfs" target="_blank" title="libsqlfs on Gitlab"> <i class="fa fa-gitlab"></i> GitLab </a> - <a href="https://github.com/guardianproject/libsqlfs" target="_blank" title="libsqlfs on Github"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/libsqlfs" target="_blank" title="libsqlfs blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /> <p>libsqlfs provides a complete virtual disk on top of a SQLite or SQLCipher database. The virtual disk is encrypted and contained in a single file, which can be easily moved around, copied, shared, etc. It is a standard FUSE filesytem that can work on Android, GNU/Linux, and perhaps also macOS.</p> https://guardianproject.info/code/libsqlfs/ Thu, 27 Oct 2011 00:00:00 +0000 https://guardianproject.info/code/libsqlfs/ <div class="source-code" style="text-align: center;"> <a href="https://gitlab.com/guardianproject/libsqlfs" target="_blank" title="libsqlfs on Gitlab"> <i class="fa fa-gitlab"></i> GitLab </a> - <a href="https://github.com/guardianproject/libsqlfs" target="_blank" title="libsqlfs on Github"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/libsqlfs" target="_blank" title="libsqlfs blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /> <p>libsqlfs provides a complete virtual disk on top of a SQLite or SQLCipher database. The virtual disk is encrypted and contained in a single file, which can be easily moved around, copied, shared, etc. It is a standard FUSE filesytem that can work on Android, GNU/Linux, and perhaps also macOS.</p> https://guardianproject.info/2011/10/25/two-years-in/ Tue, 25 Oct 2011 15:11:39 -0400 https://guardianproject.info/2011/10/25/two-years-in/ <p>Greetings mobile believers,</p> <p>I am about to head into the first ever Silicon Valley Human Rights Conference, aka #RightsCon, and though I would post some thoughts about the state of the Guardian Project, and the world in which we operate. RightsCon looks to be an amazing event (live streaming here: <a href="https://www.rightscon.org/">https://www.rightscon.org/</a>), by an amazing organization (Access), and it comes at an interesting time in the world, and for our project.</p> <p>One year ago, I was invited to attend the first Liberation Technology held at Stanford University, a forebearer of sorts, to the RightsCon event today. It was a novel event, being that is was so forthright about the possibility of liberation from oppressors through ones and zeros. It was also quite informative, in that brought together a wide array of participants, including from Egypt, Syria and Yemen, and allowed them to speak directly about the variety of tactics they were using to defeat censors, route around filters, connect diasporas to their homeland and ultimately find fissures in the system that could slowly be mined and widened.</p> <p>I gave a short talk as part of a panel I was asked to be on, which covered the history of my sometimes bi-polar work as an activist and a technologist. In this talk, I discussed how the human-need focused brilliance of Steve Jobs, should be combined with the deep understanding of movements by Gene Sharp. I talked about how the icon of Android has some things to learn from OTPOR! if it wants people to join in liberating their mobiles. I proposed that the ideas of free culture and code held by Stallman and Lessig need to be studied, spread and embodied by activist communities, such as the Tibetan independence groups, with home I work closely.</p> <p>While it is better in person with my arm waving, you can view the visual portion of this presentation here:<br /> <a href="http://prezi.com/ttsj526jjlsi/libtech/">http://prezi.com/ttsj526jjlsi/libtech/</a></p> <p>Since that event, so much has happened, both in the world and within our work here at the Guardian Project. The recent events in the Middle East and North Africa, have shown, that now more then ever, social, mobile technology, combined with non-violent direct action, is a central solution for helping citizens of this planet defend their rights to live, study, pray, commune, transact and organise. I think my words and presentation at that event were less about foreseeing the near future, and more about just sensing all the components in the air, and hoping that someone, somewhere, would put them all together in service of a good cause.</p> <p>This same analogy can be used for the state of the Guardian Project itself. It was two years ago, we had our first breakthrough with the port of Tor to Android:<br /> <a href="http://openideals.com/2009/10/22/orbot-proxy/">http://openideals.com/2009/10/22/orbot-proxy/</a></p> <p>This was about as raw as it gets – source code, a user interface made up of a few grey buttons and a console log output, and very complex set of steps to actually get proxying working. However, it was a start – “Day 0” if you will – and where I mark the public entry of our project into the world.</p> <p>Now, today, October 25, 2011, two years since Tor port, and one year since the LibTech event, we are quite a bit further than that. We have real, polished apps, and perhaps, some of the best user experience design in mobile security solutions. There have been over 100,000 downloads of Orbot, both from the Android Market and through direct distribution:<br /> <a href="https://www.torproject.org/docs/android.html.en">https://www.torproject.org/docs/android.html.en</a></p> <p>Beyond Orbot, we have an entire suite of (literally “award-winning”) apps in the Android Market, covering the range of capabilities expected from anonymous, circumventing web browsing, encrypted chat, secure file storage, to our more original projects, such as ObscuraCam, a privacy-aware camera app.</p> <p>View all of our apps in the Android Market:<br /> <a href="https://market.android.com/search?q=guardianproject&amp;so=1&amp;c=apps">https://market.android.com/search?q=guardianproject&amp;so=1&amp;c=apps</a></p> <p>We have stayed true to our open-source, grant-funded goals, and have built a vibrant project for all to share, learn and take from:<br /> <a href="https://github.com/guardianproject">https://github.com/guardianproject</a></p> <p>We have also collaborated with many other human rights and activist organizations, to ensure our tools and technology are directly informed by their tangible day-to-day needs. ObscuraCam is a project with WITNESS, the leading human-rights video organization, and is part of a larger effort called the SecureSmartCam, which we aim to one day power international human rights evidence gathering.<br /> <a href="https://guardianproject.info/2011/09/10/progress-on-mobile-video-privacy-tools/">https://guardianproject.info/2011/09/10/progress-on-mobile-video-privacy-tools/</a></p> <p>We also joined MobileActive, in the development of the SaferMobile project’s InTheClear app for Blackberry, Nokia and Android phones, a mobile panic button for quickly erasing sensitive data and sending emergency distress calls, via SMS:<br /> <a href="https://lab.safermobile.org/wiki/InTheClear">https://lab.safermobile.org/wiki/InTheClear</a></p> <p>Finally, SQLCipher for Android, our port of an existing, tested, trusted open-source encrypted database solution by Zetetic, is gathering a lot of support quickly, because we consciously made it easy for developers to implement. We have a number of major partners who will be using it in their solutions, and we hope we can talk about them more soon.</p> <p>Encrypted your mobile app data:<br /> <a href="https://guardianproject.info/code/sqlcipher/">https://guardianproject.info/code/sqlcipher/</a></p> <p>There is so much more to share, and I am already running long (and late for the #RightsCon!). I also know we have quite a bit more work to do in getting our apps to be more reliable, more stable and more functional in all of the places where people are depending upon their mobile phones to defend their rights, and in many cases, their lives. We are two years into our five year mission, and we have so many good things to announce in the coming weeks and months. Stay tuned, get your mobiles ready to power-up.</p> <p>Best,<br /> n8fr8 and the entire amazing <a href="https://twitter.com/guardianproject">@guardianproject</a> crew</p> https://guardianproject.info/2011/09/10/progress-on-mobile-video-privacy-tools/ Sat, 10 Sep 2011 04:36:11 -0400 https://guardianproject.info/2011/09/10/progress-on-mobile-video-privacy-tools/ <p><em>If you are  a developer you may just want to skip all the prose below, and just jump over to Github to find our new <a href="https://github.com/guardianproject/android-ffmpeg">FFMPEG on Android project</a>{.vt-p} and build system. You can also check out our <a href="https://github.com/guardianproject/SSCVideoProto">SSCVideoProto Project</a>{.vt-p} to understand how we are using it to redact faces and other identifying areas of HD video right on the Android phone itself. For more context, read on…</em></p> <p>Last October at the Open Video Conference 2010, the idea of a camera application that could be designed to understand the needs and requirements of the human rights community was born. During a <a href="https://blog.witness.org/2010/10/ovc2010-opensubtitles/">hackday hosted with WITNESS</a>{.vt-p}, we proved that is was possible to take a feature like “Face Detection” which is built into the Android operating system, and turn it into a capability that could be used to protect people, by blurring, pixelating or removing faces that unintentionally appeared in a video filmed on a mobile phone. In the last year, through our partnership with <a href="https://www.witness.org/cameras-everywhere/witness-labs">WITNESS Labs</a>, we have built on that concept, designing, developing and releasing apps and source code which move the state of the art in mobile video privacy and anonymity capabilities forward.</p> <p>Here is a short video of <a href="https://blog.witness.org/2010/10/ovc2010-opensubtitles/">where we were a year ago</a>{.vt-p}.</p> <p>The idea was that using a combination of approaches, we might be able to take the human rights video workflow, and ideas of consent and intent, that <a href="https://www.witness.org/training">WITNESS has developed for over twenty years</a>{.vt-p}, and encode that into best practices and features in a software application. This was the catalyst for the launch of our joint <a href="https://github.com/guardianproject/securesmartcam/wiki">Secure Smart Cam Project</a>{.vt-p}, which just a three months ago resulted in the <a href="https://guardianproject.info/2011/06/23/announcing-obscuracam-v1-enhance-your-visual-privacy/">launch of our first public app</a>{.vt-p}, <a href="https://guardianproject.info/2011/06/23/announcing-obscuracam-v1-enhance-your-visual-privacy/">ObscuraCam v1</a>{.vt-p}. Available in the Android Market, this app allows a user to quickly process a still photo taken on an Android smartphone, empowering them to remove unwanted identifying visual elements (faces, logos, signs, places) and remove unwanted digital metadata attached to the photo (GPS data, camera make and model, timestamps, etc). The app assists the user in this process by using Android’s built-in face detection technology to automatically identify and pixelize faces found in photos.</p> <p><a href="https://guardianproject.info/2011/06/23/announcing-obscuracam-v1-enhance-your-visual-privacy/"><img class="alignnone" alt="" src="https://guardianproject.info/wp-content/uploads/2011/06/02_autodetect.png" width="560" height="336" /></a>{.vt-p}</p> <p>We continue to develop ObscuraCam in order to add new features, filters and privacy-enhancing capabilities. In addition, we exploring the “Informa” mode of this application, which uses the same technologies developed to assist in removing information, and instead uses them to add layers of extra verification, subject consent and intent tracking, and full media encryption. The idea is that in many cases people want to use visual media as evidence, or at least as reliable sources for journalistic use, and the more data that can be securely and safely captured and associated with a mediafile, the better. This is still in the research and design phase, but we expect to have some concepts of this ready for public play in the next few months.</p> <p>While ObscuraCam is exciting, it only supports photos at this time. This is a fundamental issue, because WITNESS is a human-rights video organization, and the type of compelling content people are creating on their mobile phones are moving pictures not still. A year out from when the idea was first prototyped, I am happy to say that we have addresses the major challenges necessary to achieve mobile video processing of high-resolution video on the Android phone itself. The prototype last year was faking it in a sense, as it couldn’t actual record anything, and just showed the idea that you could detect faces. Our new <a href="https://github.com/guardianproject/sscvideoproto">SSCVideoProto project</a>{.vt-p}, utilizes the open-source <a href="https://github.com/guardianproject/android-ffmpeg">FFMPEG video processing library</a>{.vt-p}, to redact regions from recorded video files. Below is a short video that demonstrates the current state of the work.</p> <p>In summary, this means we can now remove, pixelize or otherwise modify any identifying content in a high-resolution video recorded on a mobile phone, before that video is uploaded to YouTube, Facebook or elsewhere. Faces can be removed, screens blacked out or any other element that shouldn’t be shown, as it would increase some risk to the subjects of the video. Beyond redaction, we can now process any video, using open-source software, on an Android phone, including trimming, splitting, adjusting color, balance, brightness or any other common ffmpeg feature.</p> <p><em>Thanks to Shawn, Andrew and Hans for the collective work on getting us to this milestone</em></p> <p><a href="https://github.com/guardianproject/android-ffmpeg">FFMPEG on Android project</a>{.vt-p}<br /> <a href="https://github.com/guardianproject/SSCVideoProto">SSCVideoProto Project</a>{.vt-p}</p> https://guardianproject.info/2011/09/05/cacertman-app-to-address-diginotar-other-bad-cas/ Mon, 05 Sep 2011 03:29:00 -0400 https://guardianproject.info/2011/09/05/cacertman-app-to-address-diginotar-other-bad-cas/ <p>As I expect many of you are aware, there was a major compromise to a Dutch Certificate Authority named “DigiNotar” recently, where they allowed SSL certs for domains like *.google.com, *.torproject.org and even *.cia.gov as well as *.*.com to be issued.</p> <p>It was brought up to the contribs of CyanogenMOD that they should probably remove the DigiNotar CA cert from the built-in Android OS keystore (located at /system/etc/security/cacerts.bks). Since they have 500k+ users, and can be more nimble than other ROM/device distributors, it was seen as a way to quickly address the problem, at least within their community. It turns out that it wasn’t as easy to convince them to do this (even though Mozilla, Google Chrome, IE, etc already had). You can read the thread, but it is still an open issue:<br /> h<a href="ttp://code.google.com/p/cyanogenmod/issues/detail?id=4260">ttp://code.google.com/p/cyanogenmod/issues/detail?id=4260</a>{.vt-p}</p> <p>In the meantime, I decided to do something proactive about this, and took two approaches:</p> <p>1) Create our own curated cacerts.bks file which rooted users could install using ‘adb’ from their desktop and/or the ‘Root Explorer’ app available in the market and elsewhere. Our version of the CACert file removes DigiNotar, as well as CNNIC, a Chinese gov’t-managed cert authority who we have reason not to trust. Our goal is to continue to audit, update and distribute our own cacerts file for users who trust us.</p> <p>Install info: <a href="https://raw.github.com/guardianproject/cacert/master/INSTALLATION">https://raw.github.com/guardianproject/cacert/master/INSTALLATION</a>{.vt-p}</p> <p>Guardian’s CACert: <a href="https://github.com/downloads/guardianproject/cacert/cacerts.bks">https://github.com/downloads/guardianproject/cacert/cacerts.bks</a>{.vt-p}</p> <p><a href="https://guardianproject.info/wp-content/uploads/2011/09/device-2011-09-04-232720.png"><br /> </a>{.vt-p} 2) We also wanted to create an app that let the user decided which certs they wanted available, and which they didn’t. Beyond this one CA problem, there are potentially many more, and every handset manufacturer or carrier can also place their own CA certs into the system. We need an app to address today’s and future CA threats.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2011/09/device-2011-09-04-232720.png"><img class="alignleft size-medium wp-image-1254" style="margin: 6px;" title="device-2011-09-04-232720" src="https://guardianproject.info/wp-content/uploads/2011/09/device-2011-09-04-232720-180x300.png" alt="" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2011/09/device-2011-09-04-232720-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2011/09/device-2011-09-04-232720.png 480w" sizes="(max-width: 180px) 100vw, 180px" /></a>{.vt-p}I have been hacking away on a solution to address this, and an initial test release is available for you. ‘CACertMan’ is a simple app that loads up the system cacert store, allows you to back it up, search for certs, delete them, and then save it back to the system. You can always restore from your initial backup, as well. In the future we may allow for a cert to just be disabled, but for now it is delete and/or restore.</p> <p>Here is the first alpha build for testing. This does require root, as well as a device that has the ‘grep’ command on it. This is basically CyanogenMOD, but most likely any other custom ROM. If the ‘save’ doesn’t work, then you will need to use ‘RootExplorer’ to make you /system partition read-write.</p> <p>Download CACertMan v0.0.1-Alpha: <a href="https://github.com/guardianproject/cacert/CACertMan-0.0.1-alpha.apk/qr_code">https://github.com/guardianproject/cacert/CACertMan-0.0.1-alpha.apk/qr_code</a>{.vt-p}</p> <p>You can find the source project here: <a href="https://github.com/guardianproject/cacert">https://github.com/guardianproject/cacert</a>{.vt-p}</p> <p>Once we get confirmation that the app works for most people, we’ll place it in the market, and on or site for wider distribution.</p> <p>Through these two approaches, we hope to mitigate the threats facing Android users who might encounter man-in-the-middle attacks enabled through the DigiNotar exploit. While many of you are presumably in “free” countries, we do know that may of our users of Orbot, Gibberbot and other software are not, and we hope this message can reach them.</p> https://guardianproject.info/2011/08/19/aclu-believes-software-developers-can-put-privacy-first-and-so-do-we/ Fri, 19 Aug 2011 19:46:40 -0400 https://guardianproject.info/2011/08/19/aclu-believes-software-developers-can-put-privacy-first-and-so-do-we/ <p>A <a href="http://www.aclu-wa.org/blog/software-developers-can-put-privacy-first">bit more on our big win</a> in the Develop4Privacy contest, from Brian Robick at the <a href="http://www.aclu-wa.org/">ACLU of Washington State</a>:</p> <blockquote> <p>When software developers put privacy first, everybody wins!</p> <p>Too often, user privacy is an afterthought in the design of computer software and online services.  In recent months, social networks have rolled back changes, cell phone manufacturers have altered the way that location tracking data is stored, and most recently, mobile application developers have been caught inappropriately collecting children’s personal data. For companies, the costs in lost consumer confidence, fines, and corrective measures can be substantial. Everyday users pay a price as well, and for victims of domestic violence, political protesters, whistleblowers, and others whose safety and livelihood could hinge on their privacy, those costs can be devastating.</p> <p>…</p> <p>Thankfully, there are developers dedicated to incorporating privacy into their software designs from the start.  On August 5^th, at the DEF CON conference in Las Vegas representatives from the ACLU of Washington, the ACLU of Northern California, the Tor Project, and the Office of the Information and Privacy Commissioner of Ontario presented awards for the top submissions to the Develop for Privacy Challenge, which sought open-source mobile applications that allow users to take advantage of new technology without sacrificing their privacy.</p> <p>We presented the top prize to <strong>Harlo Holmes of the Guardian Project for Gibberbot</strong>, a mobile chat application for Android that keeps your conversation and your identity off-the-record.</p> </blockquote> <p><img class="alignnone" src="https://www.aclu-wa.org/sites/default/files/imagecache/main-image-275/images/d4plogo.JPG" alt="" width="275" height="246" /><img class="alignnone" src="https://www.aclu-wa.org/sites/default/files/u7/Harlo-Roland_0.jpg" alt="" width="288" height="250" /></p> https://guardianproject.info/export-information/ Fri, 19 Aug 2011 15:52:01 -0400 https://guardianproject.info/export-information/ <p>This page provides detailed information on the export control status of the Guardian Project&rsquo;s products, as well as pointers to the open source code from which those products are built.</p> <h1 id="exporting">Exporting Guardian Project Apps</h1> <p>The Guardian Project is an open-source project based in the United States of America. All of our products are developed via online collaboration in public forums and distributed from a central server within the U.S. Therefore, U.S. export laws and regulations apply to our distributions and remain in force as products and technology are re-exported to different parties and places around the world. Information on export control classifications and associated restrictions may be required for exporting, re-exporting, record keeping, bundling/embedding of GP products, encryption reporting, and shipping documentation. More information on U.S. Export Regulations can be found at &ldquo; <a href="https://www.bis.doc.gov/">https://www.bis.doc.gov/</a> &rdquo;.</p> <p>The <a href="https://bxa.doc.gov/">Bureau of Industry and Security (BIS)</a> , a branch of the U.S. Department of Commerce, regulates exports through the <a href="https://www.access.gpo.gov/bis/ear/ear_data.html">Export Administration Regulations (EAR)</a>. The regulations describe the export rules and restrictions on a wide range of commodities, technologies, and software. This document is no substitute for understanding those regulations; the GP cannot anticipate how they might apply to third party distributions or for specific export decisions made by those parties. End-user, end-use and country of ultimate destination may affect export licensing requirements.</p> <p>Below is a general listing of GP software products and their source links for which we have determined an export classification for that product as distributed by the Guardian Project. The matrix is to be used in conjunction with the EAR to provide classification information in order to assist exporters in the export of GP products and to provide guidance to BIS employees that seek the source code for GP products. All export classification information contained in the matrix is subject to change without notice.</p> <h2 id="embargoed">Embargoed Destinations</h2> <p>GP software and/or technical data may NOT be exported/reexported, either directly or indirectly, to any destination subject to U.S. embargoes or trade sanctions unless formally authorized by the U.S. Government. Note that said embargoed destinations are subject to change and the scope of what technology is included in the embargo is specific to each embargoed country. For the most current information on U.S. embargoed and sanctioned countries, see the U.S. <a href="https://www.access.gpo.gov/bis/index.html">Export Administration Regulations</a> and <a href="https://www.treas.gov/offices/enforcement/ofac/">Treasury Department regulations</a>.</p> <h2 id="denied">Denied Parties List</h2> <p>U.S. export regulations require that all international and domestic transactions be screened against the U.S. Government listing of prohibited end users. Shipments to certain individuals, organizations, or institutions who have violated U.S. export laws are prohibited. The United States government maintains <a href="https://www.bis.doc.gov/ComplianceAndEnforcement/ListsToCheck.htm">export prohibited lists</a> , including but not limited to the <a href="https://www.treas.gov/offices/eotffc/ofac/sdn/index.html">Treasury Department&rsquo;s Specially Designated Nationals List</a> and <a href="https://bxa.doc.gov/dpl/Default.shtm">Commerce Department&rsquo;s Entity and Denied Persons Lists</a>.</p> <h1 id="matrix">GP Product Classification Matrix</h1> <p>The Guardian Project (GP) makes NO WARRANTY or representation that the information contained in the GP Product Classification Matrix is accurate, current, or complete. It is your obligation as the exporter to comply with the current applicable requirements of United States export rules and regulations. Any use of such information by you is without recourse to the GP and is at your own risk. The GP is in no way responsible for any damages, whether direct, consequential, incidental, or otherwise, suffered by you as a result of using or relying upon such information for any purpose.</p> <p>Each GP product is <a href="https://www.bis.doc.gov/licensing/exportingbasics.htm">classified</a> with an Export Control Classification Number (ECCN) if it is believed to correspond to an entry in the Commerce Control List (CCL) and subject to the EAR. All ASF software is published in a publicly available source code form. Since publicly available software is only <a href="https://www.access.gpo.gov/bis/ear/txt/734.txt">subject to the EAR</a> when it is classified as <a href="https://www.access.gpo.gov/bis/ear/txt/ccl5-pt2.txt">ECCN 5D002 or 5D992</a> , all GP software product versions that do not fit those two classifications are noted as ECCN &ldquo;n/a&rdquo; (not applicable) or not included in the matrix.</p> <p>Products classified as <a href="https://www.access.gpo.gov/bis/ear/txt/ccl5-pt2.txt">ECCN 5D002</a> , are exported by the GP under the <a href="https://www.access.gpo.gov/bis/ear/txt/740.txt">TSU exception in EAR 740.13(e)</a> , which applies to software containing or designed for use with encryption software that is publicly available as open source. Exception TSU further provides that &ldquo; _Posting encryption source code and corresponding object code on the Internet (e.g., FTP or World Wide Web site) where it may be downloaded by anyone neither establishes &ldquo;knowledge&rdquo; of a prohibited export or reexport for purposes of this paragraph, nor triggers any &ldquo;red flags&rdquo; necessitating the affirmative duty to inquire[&hellip;]_ &rdquo; Note that exporters other than the GP within the US may or may not be eligable for exception TSU, and it is each specific exporter&rsquo;s responsibility to understand and comply with all export regulations applicable within their jurisdiction.</p> <p>**<br /> **</p> <table width="100%" border="1"> <tr> <th colspan="4"> Orbot </th> </tr> <tr> <th> Product Name </th> <th> Versions </th> <th> ECCN </th> <th> Controlled Source </th> </tr> <tr> <td rowspan="2"> Orbot </td> <td> development </td> <td> 5D002 </td> <td> The Tor Project <a href="https://gitweb.torproject.org/orbot.git">https://gitweb.torproject.org/orbot.git</a> </td> </tr> <tr> <td> 1.5 and later </td> <td> 5D002 </td> <td> The Tor Project <a href="https://www.torproject.org/docs/android.html.en">https://www.torproject.org/docs/android.html.en</a> </td> </tr> <tr> <td rowspan="2"> Gibberbot </td> <td> development </td> <td> 5D002 </td> <td> GP <a href="https://github.com/guardianproject">https://github.com/guardianproject</a> </td> </tr> <tr> <td> 1.x and later </td> <td> 5D002 </td> <td> GP <a href="https://guardianproject.info/apps/gibber/">https://guardianproject.info/apps/gibber/</a> </td> </tr> <tr> <td rowspan="2"> SQLCipher for Android </td> <td> development </td> <td> 5D002 </td> <td> GP <a href="https://github.com/guardianproject">https://github.com/guardianproject/android-database-sqlcipher/</a> </td> </tr> <tr> <td> </td> <td> </td> <td>  SQLCipher: <a href="https://www.zetetic.net/sqlcipher/">https://www.zetetic.net/sqlcipher/</a> </td> </tr> </table> <p>&nbsp;</p> https://guardianproject.info/export-information/ Fri, 19 Aug 2011 15:52:01 -0400 https://guardianproject.info/export-information/ <p>This page provides detailed information on the export control status of the Guardian Project&rsquo;s products, as well as pointers to the open source code from which those products are built.</p> <h1 id="exporting">Exporting Guardian Project Apps</h1> <p>The Guardian Project is an open-source project based in the United States of America. All of our products are developed via online collaboration in public forums and distributed from a central server within the U.S. Therefore, U.S. export laws and regulations apply to our distributions and remain in force as products and technology are re-exported to different parties and places around the world. Information on export control classifications and associated restrictions may be required for exporting, re-exporting, record keeping, bundling/embedding of GP products, encryption reporting, and shipping documentation. More information on U.S. Export Regulations can be found at &ldquo; <a href="https://www.bis.doc.gov/">https://www.bis.doc.gov/</a> &rdquo;.</p> <p>The <a href="https://bxa.doc.gov/">Bureau of Industry and Security (BIS)</a> , a branch of the U.S. Department of Commerce, regulates exports through the <a href="https://www.access.gpo.gov/bis/ear/ear_data.html">Export Administration Regulations (EAR)</a>. The regulations describe the export rules and restrictions on a wide range of commodities, technologies, and software. This document is no substitute for understanding those regulations; the GP cannot anticipate how they might apply to third party distributions or for specific export decisions made by those parties. End-user, end-use and country of ultimate destination may affect export licensing requirements.</p> <p>Below is a general listing of GP software products and their source links for which we have determined an export classification for that product as distributed by the Guardian Project. The matrix is to be used in conjunction with the EAR to provide classification information in order to assist exporters in the export of GP products and to provide guidance to BIS employees that seek the source code for GP products. All export classification information contained in the matrix is subject to change without notice.</p> <h2 id="embargoed">Embargoed Destinations</h2> <p>GP software and/or technical data may NOT be exported/reexported, either directly or indirectly, to any destination subject to U.S. embargoes or trade sanctions unless formally authorized by the U.S. Government. Note that said embargoed destinations are subject to change and the scope of what technology is included in the embargo is specific to each embargoed country. For the most current information on U.S. embargoed and sanctioned countries, see the U.S. <a href="https://www.access.gpo.gov/bis/index.html">Export Administration Regulations</a> and <a href="https://www.treas.gov/offices/enforcement/ofac/">Treasury Department regulations</a>.</p> <h2 id="denied">Denied Parties List</h2> <p>U.S. export regulations require that all international and domestic transactions be screened against the U.S. Government listing of prohibited end users. Shipments to certain individuals, organizations, or institutions who have violated U.S. export laws are prohibited. The United States government maintains <a href="https://www.bis.doc.gov/ComplianceAndEnforcement/ListsToCheck.htm">export prohibited lists</a> , including but not limited to the <a href="https://www.treas.gov/offices/eotffc/ofac/sdn/index.html">Treasury Department&rsquo;s Specially Designated Nationals List</a> and <a href="https://bxa.doc.gov/dpl/Default.shtm">Commerce Department&rsquo;s Entity and Denied Persons Lists</a>.</p> <h1 id="matrix">GP Product Classification Matrix</h1> <p>The Guardian Project (GP) makes NO WARRANTY or representation that the information contained in the GP Product Classification Matrix is accurate, current, or complete. It is your obligation as the exporter to comply with the current applicable requirements of United States export rules and regulations. Any use of such information by you is without recourse to the GP and is at your own risk. The GP is in no way responsible for any damages, whether direct, consequential, incidental, or otherwise, suffered by you as a result of using or relying upon such information for any purpose.</p> <p>Each GP product is <a href="https://www.bis.doc.gov/licensing/exportingbasics.htm">classified</a> with an Export Control Classification Number (ECCN) if it is believed to correspond to an entry in the Commerce Control List (CCL) and subject to the EAR. All ASF software is published in a publicly available source code form. Since publicly available software is only <a href="https://www.access.gpo.gov/bis/ear/txt/734.txt">subject to the EAR</a> when it is classified as <a href="https://www.access.gpo.gov/bis/ear/txt/ccl5-pt2.txt">ECCN 5D002 or 5D992</a> , all GP software product versions that do not fit those two classifications are noted as ECCN &ldquo;n/a&rdquo; (not applicable) or not included in the matrix.</p> <p>Products classified as <a href="https://www.access.gpo.gov/bis/ear/txt/ccl5-pt2.txt">ECCN 5D002</a> , are exported by the GP under the <a href="https://www.access.gpo.gov/bis/ear/txt/740.txt">TSU exception in EAR 740.13(e)</a> , which applies to software containing or designed for use with encryption software that is publicly available as open source. Exception TSU further provides that &ldquo; _Posting encryption source code and corresponding object code on the Internet (e.g., FTP or World Wide Web site) where it may be downloaded by anyone neither establishes &ldquo;knowledge&rdquo; of a prohibited export or reexport for purposes of this paragraph, nor triggers any &ldquo;red flags&rdquo; necessitating the affirmative duty to inquire[&hellip;]_ &rdquo; Note that exporters other than the GP within the US may or may not be eligable for exception TSU, and it is each specific exporter&rsquo;s responsibility to understand and comply with all export regulations applicable within their jurisdiction.</p> <p>**<br /> **</p> <table width="100%" border="1"> <tr> <th colspan="4"> Orbot </th> </tr> <tr> <th> Product Name </th> <th> Versions </th> <th> ECCN </th> <th> Controlled Source </th> </tr> <tr> <td rowspan="2"> Orbot </td> <td> development </td> <td> 5D002 </td> <td> The Tor Project <a href="https://gitweb.torproject.org/orbot.git">https://gitweb.torproject.org/orbot.git</a> </td> </tr> <tr> <td> 1.5 and later </td> <td> 5D002 </td> <td> The Tor Project <a href="https://www.torproject.org/docs/android.html.en">https://www.torproject.org/docs/android.html.en</a> </td> </tr> <tr> <td rowspan="2"> Gibberbot </td> <td> development </td> <td> 5D002 </td> <td> GP <a href="https://github.com/guardianproject">https://github.com/guardianproject</a> </td> </tr> <tr> <td> 1.x and later </td> <td> 5D002 </td> <td> GP <a href="https://guardianproject.info/apps/gibber/">https://guardianproject.info/apps/gibber/</a> </td> </tr> <tr> <td rowspan="2"> SQLCipher for Android </td> <td> development </td> <td> 5D002 </td> <td> GP <a href="https://github.com/guardianproject">https://github.com/guardianproject/android-database-sqlcipher/</a> </td> </tr> <tr> <td> </td> <td> </td> <td>  SQLCipher: <a href="https://www.zetetic.net/sqlcipher/">https://www.zetetic.net/sqlcipher/</a> </td> </tr> </table> <p>&nbsp;</p> https://guardianproject.info/archive/lildebi/ Fri, 24 Jun 2011 15:28:42 -0400 https://guardianproject.info/archive/lildebi/ <h1 id="no-longer-maintained">NO LONGER MAINTAINED</h1> <p><br/><br/></p> <p>Have an Android phone and want an easy Debian chroot running that you can trust? Install <a href="https://github.com/guardianproject/lildebi">Lil’ Debi</a>, and you can have a Debian install running with a single click of a button. It builds up a whole Debian chroot on your phone entirely using debootstrap. You choose the release, mirror, and size of the disk image, and away it goes. It could take up to an hour on a slow device, then its done. The entire package is built from source using publicly available, repeatable builds. It even includes <code>gpgv</code> and the Debian repository keys in the apk and verifies the packages it downloads in the first stage of debootstrap before installing them. It will also check and update a SHA1 checksum to make sure your debian.img file has not be tampered with.</p> <p>Then it has a simple chroot manager that <code>fsck</code>s your disk, mounts and unmounts things, and starts/stops sshd if you have it installed. You can also then use ‘apt-get’ to install any package that is released for ARM processors. This includes things like a complete real shell, Tor, TraceRouteTCP, iwconfig/ipconfig, and other security and crypto tools.</p> <p>The aim of Lil&rsquo; Debi is to provide a transparent and tightly integrated Debian install on your Android device. It mounts all of your Android partitions in Debian space, so you see a fusion of both systems. Its even possible to have Lil&rsquo; Debi launch the normal Debian <code>init</code> start-up scripts when it starts, so that all you need to do is <code>apt-get install</code> and any servers you install will just work.</p> <p>The aim is to make it work with as few modifications to the Android system as possible. Currently, it only adds a <code>/bin</code> symlink, and a <code>/debian</code> mount directory. It does not touch <code>/system</code> at all.</p> <h2 id="download">Download</h2> <ul> <li><a href="https://play.google.com/store/apps/details?id=info.guardianproject.lildebi" target="_blank">Google Play Store</a> (free)</li> <li><a href="https://f-droid.org/repository/browse/?fdfilter=lildebi&#038;fdid=info.guardianproject.lildebi" target="_blank">F-Droid</a></li> <li>direct download: <a href="https://guardianproject.info/releases/LilDebi-release-0.4.5.apk">LilDebi-release-0.4.5.apk</a> <ul> <li><a href="https://guardianproject.info/releases/LilDebi-release-0.4.5.apk.asc">detached gpg signature</a></li> <li>MD5: 7bbee559ee4349dd6a937f0d0585f57d</li> <li>SHA1: 352a6049e6ac931ee4a112f60b42688d7bf1eddb</li> </ul></li> <li><a href="https://guardianproject.info/builds/LilDebi/" title="nightly test builds">nightly test builds</a></li> </ul> <h3 id="source">Source</h3> <ul> <li>full source (except gpgv): <a href="https://github.com/guardianproject/lildebi" target="_blank"><a href="https://github.com/guardianproject/lildebi">https://github.com/guardianproject/lildebi</a></a></li> <li>gpgv is built as part of <a href="https://github.com/guardianproject/gnupg-for-android" title="GnuPG-for Android source repo" target="_blank">GnuPG-for-Android</a></li> </ul> <p>Learn more (for now), from <a href="https://guardianproject.info/2011/06/18/lil-debi-easy-installer-for-debian-on-android/">our blog post</a>.</p> <p><img class="alignnone" src="https://guardianproject.info/wp-content/uploads/2011/06/LilDebiInstalling.png" alt="" width="288" height="480" /></p> <h2 id="reporting-bugs">Reporting Bugs</h2> <p>Please report any bugs or issues that you have with this app! We want to hear from you, no need to worry about technical details or language skills. Help us improve this software by filing bug reports about any problem that you encounter. Feature requests and patches are also welcome!</p> <ul> <li><p><a href="https://github.com/guardianproject/lildebi/issues/new"><img src="https://guardianproject.info/wp-content/uploads/2011/02/reportbug-150x150.jpg" alt="report bug" width="150" height="150" class="size-thumbnail wp-image-12362" srcset="https://guardianproject.info/wp-content/uploads/2011/02/reportbug-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2011/02/reportbug-100x100.jpg 100w, https://guardianproject.info/wp-content/uploads/2011/02/reportbug-200x200.jpg 200w, https://guardianproject.info/wp-content/uploads/2011/02/reportbug.jpg 225w" sizes="(max-width: 150px) 100vw, 150px" /> <strong style="font-size: 200%">Report a Bug or Issue</strong></a></p></li> <li><p><a href="https://github.com/guardianproject/lildebi/issues" title="Issue Tracker" target="_blank">List of all open issues</a></p></li> <li><p><a href="https://github.com/guardianproject/lildebi/issues/new" title="New Issue Tracker" target="_blank">submit a new issue report</a></p></li> </ul> https://guardianproject.info/archive/lildebi/ Fri, 24 Jun 2011 15:28:42 -0400 https://guardianproject.info/archive/lildebi/ <h1 id="no-longer-maintained">NO LONGER MAINTAINED</h1> <p><br/><br/></p> <p>Have an Android phone and want an easy Debian chroot running that you can trust? Install <a href="https://github.com/guardianproject/lildebi">Lil’ Debi</a>, and you can have a Debian install running with a single click of a button. It builds up a whole Debian chroot on your phone entirely using debootstrap. You choose the release, mirror, and size of the disk image, and away it goes. It could take up to an hour on a slow device, then its done. The entire package is built from source using publicly available, repeatable builds. It even includes <code>gpgv</code> and the Debian repository keys in the apk and verifies the packages it downloads in the first stage of debootstrap before installing them. It will also check and update a SHA1 checksum to make sure your debian.img file has not be tampered with.</p> <p>Then it has a simple chroot manager that <code>fsck</code>s your disk, mounts and unmounts things, and starts/stops sshd if you have it installed. You can also then use ‘apt-get’ to install any package that is released for ARM processors. This includes things like a complete real shell, Tor, TraceRouteTCP, iwconfig/ipconfig, and other security and crypto tools.</p> <p>The aim of Lil&rsquo; Debi is to provide a transparent and tightly integrated Debian install on your Android device. It mounts all of your Android partitions in Debian space, so you see a fusion of both systems. Its even possible to have Lil&rsquo; Debi launch the normal Debian <code>init</code> start-up scripts when it starts, so that all you need to do is <code>apt-get install</code> and any servers you install will just work.</p> <p>The aim is to make it work with as few modifications to the Android system as possible. Currently, it only adds a <code>/bin</code> symlink, and a <code>/debian</code> mount directory. It does not touch <code>/system</code> at all.</p> <h2 id="download">Download</h2> <ul> <li><a href="https://play.google.com/store/apps/details?id=info.guardianproject.lildebi" target="_blank">Google Play Store</a> (free)</li> <li><a href="https://f-droid.org/repository/browse/?fdfilter=lildebi&#038;fdid=info.guardianproject.lildebi" target="_blank">F-Droid</a></li> <li>direct download: <a href="https://guardianproject.info/releases/LilDebi-release-0.4.5.apk">LilDebi-release-0.4.5.apk</a> <ul> <li><a href="https://guardianproject.info/releases/LilDebi-release-0.4.5.apk.asc">detached gpg signature</a></li> <li>MD5: 7bbee559ee4349dd6a937f0d0585f57d</li> <li>SHA1: 352a6049e6ac931ee4a112f60b42688d7bf1eddb</li> </ul></li> <li><a href="https://guardianproject.info/builds/LilDebi/" title="nightly test builds">nightly test builds</a></li> </ul> <h3 id="source">Source</h3> <ul> <li>full source (except gpgv): <a href="https://github.com/guardianproject/lildebi" target="_blank"><a href="https://github.com/guardianproject/lildebi">https://github.com/guardianproject/lildebi</a></a></li> <li>gpgv is built as part of <a href="https://github.com/guardianproject/gnupg-for-android" title="GnuPG-for Android source repo" target="_blank">GnuPG-for-Android</a></li> </ul> <p>Learn more (for now), from <a href="https://guardianproject.info/2011/06/18/lil-debi-easy-installer-for-debian-on-android/">our blog post</a>.</p> <p><img class="alignnone" src="https://guardianproject.info/wp-content/uploads/2011/06/LilDebiInstalling.png" alt="" width="288" height="480" /></p> <h2 id="reporting-bugs">Reporting Bugs</h2> <p>Please report any bugs or issues that you have with this app! We want to hear from you, no need to worry about technical details or language skills. Help us improve this software by filing bug reports about any problem that you encounter. Feature requests and patches are also welcome!</p> <ul> <li><p><a href="https://github.com/guardianproject/lildebi/issues/new"><img src="https://guardianproject.info/wp-content/uploads/2011/02/reportbug-150x150.jpg" alt="report bug" width="150" height="150" class="size-thumbnail wp-image-12362" srcset="https://guardianproject.info/wp-content/uploads/2011/02/reportbug-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2011/02/reportbug-100x100.jpg 100w, https://guardianproject.info/wp-content/uploads/2011/02/reportbug-200x200.jpg 200w, https://guardianproject.info/wp-content/uploads/2011/02/reportbug.jpg 225w" sizes="(max-width: 150px) 100vw, 150px" /> <strong style="font-size: 200%">Report a Bug or Issue</strong></a></p></li> <li><p><a href="https://github.com/guardianproject/lildebi/issues" title="Issue Tracker" target="_blank">List of all open issues</a></p></li> <li><p><a href="https://github.com/guardianproject/lildebi/issues/new" title="New Issue Tracker" target="_blank">submit a new issue report</a></p></li> </ul> https://guardianproject.info/2011/06/23/announcing-obscuracam-v1-enhance-your-visual-privacy/ Thu, 23 Jun 2011 21:28:20 -0400 https://guardianproject.info/2011/06/23/announcing-obscuracam-v1-enhance-your-visual-privacy/ <p>We’re very happy to announce the beta release of <a href="https://guardianproject.info/apps/securecam/">ObscuraCam</a> for Android. This is the first release from the SecureSmartCam project, a partnership with <a href="https://www.witness.org/">WITNESS</a>, a leading human rights video advocacy and training organization. This is the result of an <a href="https://github.com/guardianproject/SecureSmartCam/tree/obscurav1">open-source development cycle</a>, comprised of multiple sprints (and branches), that took place over the last five months. This “v1” release is just the first step towards the complete vision of the project.</p> <p>The goal of the SecureSmartCam project to to design and develop a new type of smartphone camera app that makes it simple for the user to respect the visual privacy, anonymity and consent of the subjects they photograph or record, while also enhancing their own ability to control the personally identifiable data stored inside that photo or video. Also, we think an app that allows you to pixelize your friends, disguise their faces and otherwise defend their privacy just a little bit, is a lot of fun and helps raise awareness about an important issue. In this first release we have focused on ‘obscura’ by optimizing the workflow of identity obfuscation in still images. Future releases will look at ‘informa,’ the process of properly gaining and recording informed consent from subjects, while also moving to video.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2011/06/teamdinner.jpg"><img class="size-full wp-image-1199 alignnone" title="teamdinner" alt="" src="https://guardianproject.info/wp-content/uploads/2011/06/teamdinner.jpg" width="450" height="337" srcset="https://guardianproject.info/wp-content/uploads/2011/06/teamdinner.jpg 640w, https://guardianproject.info/wp-content/uploads/2011/06/teamdinner-300x225.jpg 300w" sizes="(max-width: 450px) 100vw, 450px" /></a></p> <h4 id="quick-download-links">Quick Download Links</h4> <p><a href="https://market.android.com/details?id=org.witness.sscphase1&amp;feature=search_result"><img class="alignleft" style="margin: 3px;" title="obscura_market_qr" alt="" src="https://guardianproject.info/wp-content/uploads/2011/06/obscura_market_qr.jpg" width="130" height="130" /></a>For those of you who just want to get to it, head over to the <a href="https://market.android.com/details?id=org.witness.sscphase1&amp;feature=search_result">Android Market</a> to grab the latest version of the app. You can also scan the QR code to the left, and it will take you in that direction.<a href="https://guardianproject.info/wp-content/uploads/2011/06/obscura_market_qr.jpg"><br /> </a></p> <p>For those without access to the Android Market, you can get the ObscuraCam.APK file from our <a href="https://guardianproject.info/builds/Obscura/">public builds folder</a>. The official signed release binary is also available <a href="https://guardianproject.info/downloads/ObscuraCam-1.0.4.2-20110624.apk">here</a>. For these options, be sure to check back for updates, because the app will not auto-update itself.</p> <h4 id="the-cameras-everywhere-initiative">The “Cameras Everywhere” Initiative</h4> <p>In January, WITNESS launched their <a href="https://blog.witness.org/2011/01/cameraseverywhere/">Cameras Everywhere</a> initiative, in which they ask:</p> <blockquote> <p><em>As more and more people film people speaking out and taking a stand against human rights crises, how can we protect victims and witnesses and ensure informed consent as much as possible?</em> <em>As more and more footage circulates from human rights crises around the world, how does powerful footage reach audiences in comprehensible ways that move people to action?</em> <em>And how do we know how to trust that footage?</em></p> <p><em>…</em></p> <p>_Critical issues to address in this realm include safety and security in the use of video; ethical questions raised by the widespread capacity to shoot and circulate human rights video; challenges around the authenticity of video and the preservation of evidence; and the need for effective documentation around the use of video in advocacy.<br /> _</p> </blockquote> <p>Through our collaboration, WITNESS has decided to move beyond just awareness, training and advocacy, and instead help design a next generation of Camera app software that is not just intended to share and capture more, but is meant to allow its operator to stop, think and be empowered to control the media they are capturing.</p> <h4 id="a-primer-on-visual-privacy-and-anonymity">A Primer on Visual Privacy and Anonymity</h4> <p><a href="https://en.wikipedia.org/wiki/Visual_privacy">Visual Privacy</a> is the relationship between collection and dissemination of visual information, the public expectation of privacy, and the legal issues surrounding them. It relates particularly to the increasing presence of large-scale still- and video-camera networks in everyday life. This not only includes those surveillance-oriented networks under the control of corporations and governments, but also applies to the vast new network of citizen-controlled media capture devices such as smartphones and handheld cameras that has created a peer-to-peer, social-networking based surveillance. At the same time that these networks have exploded in size, face detection and recognition technologies have also improved considerably while policy regarding the privacy and fair use of such systems and content, as well as the rights of those imaged by such networks, are topics that are not resolved. What results is a situation in which massive amounts of media are being captured every day with little to no protection of individual rights to privacy or anonymity – something that is especially detrimental to human rights efforts.</p> <p>As Sam Gregory of WITNESS <a href="https://blog.witness.org/2011/02/human-rights-video-privacy-and-visual-anonymity-in-the-facebook-age/">points out</a>, most contemporary discussions around anonymous communication on the Internet focus on the data protection side – for instance options for data encryption or censorship circumvention. In the case of media content, a largely unaddressed question arises: what about the rights to anonymity and privacy for those people who appear, intentionally or not, in visual recordings? Visual privacy and anonymity may sound like a contradiction in terms, but people often wish to speak out and to ‘be seen’ while at the same time concealing their face and identifying surroundings. As human rights documentation and organizing increasingly involves media capture, how are people enabled to make purposeful choices about when they speak out and what degrees of anonymity they hold onto for themselves? Conversely, people caught in the background of a video or still may be unaware that they are even being filmed in that moment and have no option to protect themselves – particularly true in mass protest settings where the wave of group solidarity may overwhelm any sense of personal privacy. For those speaking out from marginalized positions, personal safety is a very real risk.</p> <p>Some examples where visual privacy and anonymity is being diluted in the name of features or security:</p> <ul> <li>The <a href="http://www.timesonline.co.uk/tol/news/uk/article6913273.ece">persecution</a> later faced by bystanders and people who stepped in to film or assist Neda Agha-Soltan as she lay dying during the 2009 Iranian election protests.</li> <li>Facebook’s <a href="http://blog.facebook.com/blog.php?post=467145887130">opt-out feature</a> for auto-detection and tagging of faces</li> <li>British Columbia’s privacy watchdog <a href="http://www.metronews.ca/vancouver/local/article/897762--province-s-privacy-watchdog-oks-facial-recognition-to-identify-rioters">OKs the use of facial recognition technology</a> to identify rioters from video and still images of Vancouver’s 2011 hockey riots.</li> <li><a href="http://www.viewdle.com/products/mobile/index.html">Viewdle’s Social Camera</a> automatically tags your friends in photos based on the social networking profile pictures they have published</li> </ul> <p>While some of these examples might seem harmless, or even a useful feature for law enforcement, the main issue is that the subjects of these photos and videos are never asked if they wish to participate in them, not to mention whether they want their photo published online in the first place. The permanence of media on the Web means that any uploaded content can be poured over again and again to identify individuals – either by old-fashioned investigative techniques, but crowd-sourcing, or by face detection /recognition software.</p> <h4 id="how-obscuracam-helps">How ObscuraCam Helps</h4> <p><a href="https://guardianproject.info/wp-content/uploads/2011/06/01_home.png"><img class="alignleft" style="margin: 3px;" title="01_home" alt="" src="https://guardianproject.info/wp-content/uploads/2011/06/01_home-180x300.png" width="180" height="300" /></a>Part of the problem currently surrounding visual privacy and anonymity is the fact that many of the tools and applications that people use on an everyday basis do not have features built in to protect privacy. As a result, everyone with a smartphone, tablet or laptop – not to mention an actual video camera! – captures raw, unedited content that exposes the identities of participants and bystanders present at sensitive events or activities.</p> <p><a href="https://guardianproject.info/apps/securecam/">ObscuraCam</a> is a mobile application for Android that makes it easy for anyone to protect the identity of individuals or groups represented in their photos by building obfuscation and redaction directly into the app. It can be used on photos taken directly from the app itself, or on any photo that your mobile device has access to, including local memory card images or linked Picasa albums. By moving a usually cumbersome post-production process into the daily workflow of those capturing sensitive images, it’s our hope that visual privacy will be respected when it really matters.</p> <h4 id="using-obscuracam">Using ObscuraCam</h4> <p>ObscuraCam features a simple, touch-based user interface for easy manipulation and redaction of images, as well as an automated removal of identifying metadata stored in the photo itself. The following steps walk through the process of capturing and sharing an obscured photo using ObscuraCam.</p> <ol> <li>From the application home page, choose to either capture a new image or choose an existing image from your existing collections. These options just launch your standard Camera and Gallery application. When the photo is imported, identifying EXIF metadata stored in the file itself, such as GPS location, camera make and model or timestamp, will be removed.</li> <li>After you capture or open an image with ObscuraCam, it is automatically scanned to detect faces. Any faces detected are marked as tagged regions in an image, and the user is able to create as many additional tagged regions as they wish – either via the menu or by long-pressing the desired region. By default, tagged regions are set to be obscured via pixelation.</li> <li>Once a tagged region has been created, the user can interact with that region by simply touching it to bring up a contextual menu.<a href="https://guardianproject.info/wp-content/uploads/2011/06/02_autodetect.png"><img class="aligncenter size-medium wp-image-1171" title="02_autodetect" alt="" src="https://guardianproject.info/wp-content/uploads/2011/06/02_autodetect-300x180.png" width="300" height="180" srcset="https://guardianproject.info/wp-content/uploads/2011/06/02_autodetect-300x180.png 300w, https://guardianproject.info/wp-content/uploads/2011/06/02_autodetect.png 800w" sizes="(max-width: 300px) 100vw, 300px" /></a></li> <li>Options available from the contextual tagging menu include: <ul> <li>Edit – select to scale and move tagged regions</li> <li>Redact – select to fully redact tagged region and replace with black space</li> <li>Pixelate – select to selectively obfuscate identities of persons or situations</li> <li>bgPixelate – select to easily obfuscate everything BUT the tagged region</li> <li>Mask – select to pin a set of ‘groucho marks’ glasses on the tagged region – not only a bit of fun, but useful for quickly defeating facial recognition schemes.</li> <li>Delete – delete the current tagged region</li> </ul></li> <li>Once you’re done selecting and obfuscating tagged regions, you can use the options from the main application menu to see a preview of the finished image, save it to your local memory, or share the picture with any application on your handset that is configured to accept images. This includes applications like Facebook, Twitter, or the default Messaging app. <a href="https://guardianproject.info/wp-content/uploads/2011/06/09_processed.png"><img class="aligncenter size-medium wp-image-1172" title="09_processed" alt="" src="https://guardianproject.info/wp-content/uploads/2011/06/09_processed-180x300.png" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2011/06/09_processed-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2011/06/09_processed.png 480w" sizes="(max-width: 180px) 100vw, 180px" /></a></li> </ol> <h4 id="share-with-us-and-save-your-face">Share With Us and “Save Your Face”!</h4> <p>As impediments of visual privacy continue to expand, help us get the word out that we can take back control over our online identities with ObscuraCam! We’ve set up a <a href="https://www.facebook.com/pages/ObscuraCam-Saving-Your-Social-Face/110765659013081">Facebook Page</a> where you can share your creations with us, and with eachother!</p> <h4 id="source-code-issue-reporting">Source Code &amp; Issue Reporting</h4> <p>We’re big fans of open source and living in public. As consistent with all our projects, source code for the SecureSmartCam project, along with the ObscuraCam release, is available online at <a href="https://github.com/guardianproject/SecureSmartCam">GitHub</a>.</p> <p>We also use GitHub to manage our development milestones and active bugs / issues. If you encounter any bugs or issues when testing out this beta build, please report them directly to us in the comments below or by filing directly on the <a href="https://github.com/guardianproject/SecureSmartCam/issues">Issues</a> page.</p> <p> </p> https://guardianproject.info/2011/06/18/lil-debi-easy-installer-for-debian-on-android/ Sat, 18 Jun 2011 04:22:52 -0400 https://guardianproject.info/2011/06/18/lil-debi-easy-installer-for-debian-on-android/ <p>Have an Android phone and want an easy Debian chroot running it?</p> <p>Alpha test our new app, <a href="https://github.com/guardianproject/lildebi">Lil’ Debi</a>. It builds up a whole Debian chroot on your phone entirely using debootstrap. You choose the release, mirror, and size of the disk image, and away it goes. It could take up to an hour, then its done. Then it has a simple chroot manager that mounts and unmounts things, and starts/stops sshd if you have it installed. You can also then use ‘apt-get’ to install any package that is released for ARM processors. This includes things like GPG, Tor, TraceRouteTCP and other security and crypto tools.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2011/06/LilDebiInstalling.png"><img class="alignleft size-full wp-image-1137" style="margin-right: 6px;" title="LilDebiInstalling" src="https://guardianproject.info/wp-content/uploads/2011/06/LilDebiInstalling.png" alt="" width="288" height="480" srcset="https://guardianproject.info/wp-content/uploads/2011/06/LilDebiInstalling.png 480w, https://guardianproject.info/wp-content/uploads/2011/06/LilDebiInstalling-180x300.png 180w" sizes="(max-width: 288px) 100vw, 288px" /></a></p> <p>Project and source are here:<br /> <a href="https://github.com/guardianproject/lildebi">https://github.com/guardianproject/lildebi<br /> </a></p> <p>Have a look at our automatic build bot for the latest binary installer APK here: <a href="https://github.com/guardianproject/lildebi/LilDebi-debug-20110617.apk/qr_code">https://guardianproject.info/builds/lildebi/</a></p> <p>Check the GitHub <a href="https://github.com/guardianproject/lildebi/wiki">wiki</a> for tips on using it. If you don’t know what you need this for, then you probably should not install it (for now).</p> https://guardianproject.info/apps/obscuracam/about-v1/ Wed, 08 Jun 2011 19:00:42 -0400 https://guardianproject.info/apps/obscuracam/about-v1/ <p><strong>Obscura v1</strong> is our first public release from the Secure Smart Cam Project. This an open-source collaboration between the <a href="https://guardianproject.info">Guardian Project</a> and <a href="https://www.witness.org">Witness</a> to develop new visual media software for human rights.</p> <p>Please review our <a href="https://raw.github.com/guardianproject/SecureSmartCam/obscurav1/TERMS">Terms of Use</a> and our <a href="https://raw.github.com/guardianproject/SecureSmartCam/obscurav1/LICENSE">Source Code License</a>. The entire source code of this app is <a href="https://github.com/guardianproject/SecureSmartCam/blob/obscurav1/">available on Github</a>.</p> <p>The app currently supports:</p> <ul> <li>taking a new picture or loading an existing photo from the Gallery app</li> <li>removal of all EXIF image metadata from the photo</li> <li>blur, pixelize, redact/remove or overlay mask to protect identity of people or places in the photos</li> <li>save as a JPEG to the sdcard</li> <li>share to other apps (twitter, text message, facebook, dropbox, etc)</li> </ul> https://guardianproject.info/2011/05/17/orbot-1.0.5.2-now-available/ Tue, 17 May 2011 19:43:30 -0400 https://guardianproject.info/2011/05/17/orbot-1.0.5.2-now-available/ <p>Our flagship app, <a href="https://guardianproject.info/apps/orbot">Orbot: Tor on Android</a>, has been updated to version 1.0.5.2. It is available in the <a href="https://market.android.com/details?id=org.torproject.android&amp;feature=search_result">Android Market</a>, or through direct download from the <a href="https://www.torproject.org/docs/android.html.en">Tor Project’s website</a>.</p> <p>This release fixes a number of long standing bigs, includes the latest and greatest release of Tor itself, cleans up the user interface a bit, and adds some new advanced options (you can specify your exit node country!). It also fixes an issue with our “Tor Everything” capability, that allowed some Android system network traffic to leak and bypass the Tor routing. Finally, it provides for compatibility for <a href="https://code.google.com/p/cyanogenmod/issues/detail?id=1120">CyanogenMOD 7</a>, as well as Android Gingerbread and Honeycomb.</p> <p>Enjoy and stay safe out there!</p> <p>CHANGELOG</p> <p>1.0.5.1/.2<br /> – small updates to layout of main screen to fit smaller screens<br /> – fixed preference setting of EntryNode torrc value</p> <p>1.0.5<br /> – added exit node and “StrictExitNode” preference<br /> – fixed tor binary installation issue related to max resource size and compression<br /> – updated “start on boot” code to test for proper launch event<br /> – updated to Tor 0.2.2.25-alpha binary<br /> – moved back to single notification bar id to avoid double entries<br /> – cleaned up progress dialog and alert handling to avoid leaky windows<br /> – Merged __sporkbomb’s patch for how transproxy all works; now does “everything but Tor”<br /> – Added new toolbar notifications and alerts for displaying notifications and Tor messages<br /> – Removed unused Socks client code from android.net package<br /> – Updated wizard to show link to Gibberbot (formerly OTRchat) chat app<br /> – Bundled iptables 1.4.7 for ARM instead of relying on installed version<br /> – Fixed various issues related to iptables, transproxying for CyanogenMod7/Android 2.3.*<br /> – Changed how settings changed are processed through the control port (batched instead of one by one)<br /> – Stopped app by app flushing of iptables rules, in favor of complete flush of ‘nat’ and ‘filter’ type<br /> – removed useless log screen (logs can be viewed/retrieved using ‘alogcat’ 3rd party app)</p> https://guardianproject.info/2011/05/09/announcing-sqlcipher-for-android-developer-preview-r1/ Mon, 09 May 2011 22:45:09 -0400 https://guardianproject.info/2011/05/09/announcing-sqlcipher-for-android-developer-preview-r1/ <p>After some major breakthroughs during last week’s development sprint, we’re extremely excited to announce <a href="https://guardianproject.info/code/sqlcipher/">SQLCipher for Android</a>, Developer Preview r1. SQLCipher is an <a href="http://sqlite.org/">SQLite</a> extension that provides transparent 256-bit AES encryption of database files. To date, it has been open-sourced, sponsored and maintained by <a href="http://zetetic.net/">Zetetic LLC</a>, and we are glad to be able to extend their efforts to a new mobile platform. In the mobile space, SQLCipher has enjoyed widespread use in Apple’s <a href="https://www.zetetic.net/sqlcipher/documentation/ios.html">iOS</a>, as well as <a href="http://www.qtcentre.org/wiki/index.php?title=Building_QSQLITE_driver_with_AES-256_encryption_support">Nokia / QT</a> for quite some time. Given that Android <a href="http://developer.android.com/guide/topics/data/data-storage.html#db">by default</a> provides integrated support for SQLite databases, our goal was to create an almost identical API for SQLCipher, so that developers of all skill level could use it, without a steep learning curve.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2011/02/logo-sqlcipher.png"><img title="logo-sqlcipher" src="https://guardianproject.info/wp-content/uploads/2011/02/logo-sqlcipher-300x31.png" alt="" width="300" height="31" /></a></p> <blockquote> <p>If you are impatient, you can just get right to the SDK download here:<br /> <a href="https://github.com/downloads/guardianproject/android-database-sqlcipher/SQLCipherForAndroid-alpha-sdk-0.0.2.zip">SQLCipher for Android, Developer Preview r1 (0.0.2)</a></p> </blockquote> <p>In an environment where mobile data privacy is increasingly <a href="http://www.reuters.com/article/2011/05/08/us-privacy-congress-idUSTRE7471SA20110508">in the headlines</a>, this project will make it easier than ever for mobile developers to properly secure their local application data, and in turn better protect the privacy of their users. The data stored by Android apps protected by this type of encryption will be less vulnerable to access by malicious apps, protected in case of device loss or theft, and highly resistant to <a href="http://www.cellebrite.com/">mobile data forensics tools</a> that are increasingly used to mass copy a mobile device during <a href="http://www.thenewspaper.com/news/34/3458.asp">routine traffic stops</a>.</p> <p>However, while the core SQLCipher database is <a href="http://zetetic.net/index">vetted and market-ready</a>, the Android support libraries in this release are still very much alpha quality, hence the Developer Preview label. <strong><em>This R1 release should not be integrated into critical or production software</em>.</strong> Our goal is to give Android developers early access to the technology, so they can provide feedback on our approach, and help us deliver the right offering for securing mobile data. We expect to release a market-ready version this summer, and will be <a href="https://github.com/guardianproject/android-database-sqlcipher/commits/master">publicly iterating through the codebase</a> until then.</p> <h4 id="an-illustrative-terminal-listing">An Illustrative Terminal Listing</h4> <p>A typical SQLite database in unencrypted, and visually parseable even as encoded text. The following example shows the difference between hexdumps of a standard SQLite db and one implementing SQLCipher.</p> <blockquote> <p>~ sjlombardo$ hexdump -C sqlite.db<br /> 00000000 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 |SQLite format 3.|<br /> …<br /> 000003c0 65 74 32 74 32 03 43 52 45 41 54 45 20 54 41 42 |et2t2.CREATE TAB|<br /> 000003d0 4c 45 20 74 32 28 61 2c 62 29 24 01 06 17 11 11 |LE t2(a,b)$…..|<br /> …<br /> 000007e0 20 74 68 65 20 73 68 6f 77 15 01 03 01 2f 01 6f | the show…./.o|<br /> 000007f0 6e 65 20 66 6f 72 20 74 68 65 20 6d 6f 6e 65 79 |ne for the money|</p> <p>~ $ sqlite3 sqlcipher.db<br /> sqlite&gt; PRAGMA KEY=’test123′;<br /> sqlite&gt; CREATE TABLE t1(a,b);<br /> sqlite&gt; INSERT INTO t1(a,b) VALUES (‘one for the money’, ‘two for the show’);<br /> sqlite&gt; .quit</p> <p>~ $ hexdump -C sqlite.db<br /> 00000000 84 d1 36 18 eb b5 82 90 c4 70 0d ee 43 cb 61 87 |.?6.?..?p.?C?a.|<br /> 00000010 91 42 3c cd 55 24 ab c6 c4 1d c6 67 b4 e3 96 bb |.B<!--?U$???.?g??.?| ... 00000be0 dc 77 5c 6c de c6 d3 be 43 49 48 3e f3 02 94 a9 |?w\l??ӾCIH-->?..?|</p> <p>00000bf0 8e 99 ee 28 23 43 ab a4 97 cd 63 42 8a 8e 7c c6 |..?(#C??.?cB..|?|</p> <p>~ $ sqlite3 sqlcipher.db<br /> sqlite&gt; SELECT * FROM t1;<br /> Error: file is encrypted or is not a database</p> </blockquote> <p>(example courtesy of <a href="https://www.zetetic.net/sqlcipher/design">SQLCipher</a>)</p> <h4 id="details-for-developers">Details for Developers</h4> <p>We’ve packaged up a very simple SDK for any Android developer to add SQLCipher into their app with the following three steps:</p> <ol> <li>Add a single sqlcipher.jar and a few .so’s to the application libs directory<br /> ****</li> <li>Update the import path from <em>android.database.sqlite.*</em> to <em>info.guardianproject.database.sqlite.*</em> in any source files that reference it. The original android.database.Cursor can still be used unchanged.</li> <li>Init the database in onCreate() and pass a variable argument to the open database method with a password*:</li> </ol> <blockquote> <ul> <li>SQLiteDatabase.loadLibs(this); //first init the db libraries with the context</li> <li>SQLiteOpenHelper.getWritableDatabase(“thisismysecret”):</li> </ul> </blockquote> <p>*<strong>Note:</strong> we are working on some dialog builder helper methods for password and PIN input, password caching, and other features that we would like to standardize across all applications that use SQLCipher.</p> <h4 id="compatibility">Compatibility</h4> <p>The Developer Preview implements SQLCipher v1, is compatible with Android 2.2 &amp; 2.3, and works only within one process (you can’t pass a Cursor from a remote Service to an Activity).</p> <h4 id="notepad-sqlcipher-notepadbot">Notepad + SQLCipher = Notepadbot</h4> <p>Notepadbot is a sample application pulled from the standard Android samples code and updated to use SQLCipher. You can browse the source <a href="https://github.com/guardianproject/notepadbot">here</a> and download the apk <a href="https://github.com/guardianproject/notepadbot/Notepadbot-0.0.1c-dev.apk/qr_code">here</a>.</p> <p style="text-align: center;"> <img class="alignnone" src="https://guardianproject.info/wp-content/uploads/2011/05/prompt.png" alt="" width="180" height="300" /><img class="alignnone" title="successful authentication" src="https://guardianproject.info/wp-content/uploads/2011/05/notes.png" alt="" width="180" height="300" /> </p> <h4 id="final-notes">Final Notes</h4> <p>It’s important to note that this project is not intended to be a distinct, long-term fork of SQLCipher. We’ve been working closely with the SQLCipher team at <a href="http://zetetic.net/">Zetetic</a> and fully intent to closely maintain the project as SQLCipher evolves, re-integrating changes in upcoming releases such as <a href="https://github.com/sjlombardo/sqlcipher/tree/v2beta">SQLCipher v2</a>.</p> <p>The Android support libraries are licensed under <a href="https://github.com/guardianproject/android-database-sqlcipher/blob/master/LICENSE">Apache 2.0</a>, in line with the Android OS code on which they are based. The SQLCipher code itself is licensed under a <a href="https://github.com/guardianproject/android-database-sqlcipher/blob/master/SQLCIPHER_LICENSE">BSD-style license from Zetetic LLC.</a> Finally, the original SQLite code itself is in the <a href="http://www.sqlite.org/copyright.html">public domain</a>.</p> <p><strong>Downloads and Source</strong></p> <ul> <li>SQLCipher for Android project source repo is here: <a href="https://github.com/guardianproject/android-database-sqlcipher">https://github.com/guardianproject/android-database-sqlcipher</a></li> <li>Current SDK distro for developers, with the jar’s, .so’s and a quick sample can be found here: <a href="https://github.com/guardianproject/android-database-sqlcipher/downloads">https://github.com/guardianproject/android-database-sqlcipher/downloads</a></li> </ul> https://guardianproject.info/2011/04/06/our-foolish-hackday/ Wed, 06 Apr 2011 21:51:12 -0400 https://guardianproject.info/2011/04/06/our-foolish-hackday/ <p>We had a great group of people show up at our <a href="https://guardianproject.info/wiki/%22Don%27t_Be_Fooled%22_Mobilehack_Day">April 1st “Don’t Be Fooled” Hackday</a> here at the OpenMobileLab in New York. There were users, there were devs, and all sorts of other people in between. We tracked some of the brainstormed ideas on an open etherpad at: <a href="http://piratepad.net/bQPFn6FOhN">http://piratepad.net/bQPFn6FOhN</a> (text of this pasted in below).</p> <p>The main outputs of the hacking were <a href="https://github.com/guardianproject/lildebi">LilDebi</a>, an updated Debian installer for Android, the beginnings of a <a href="http://www.bitcoin.org/">Bitcoin</a> digital currency client, and another called <a href="https://github.com/nathanfreitas/UpOnApp">UpOn App</a>, which uses the accelerometer and white noise generators in the device to stop your cellphone from spying on you.</p> <p>Thanks to all for coming, and hope you enjoyed the donuts and beer!</p> <div id='gallery-4' class='gallery galleryid-899 gallery-columns-2 gallery-size-thumbnail'> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2011/04/donuts.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2011/04/donuts-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2011/04/eyes.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2011/04/eyes-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2011/04/hackers.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2011/04/hackers-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2011/04/noneck.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2011/04/noneck-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2011/04/table.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2011/04/table-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" /></a> </dt> </dl> <br style='clear: both' /> </div> <p> </p> <p> </p> <div id="magicdomid6"> <strong>The Pirated Pad Hackday Idea Tracker!</strong> </div> <div id="magicdomid8"> <strong>I. UpOn</strong> </div> <div id="magicdomid9"> <ul> <li> phone that goes on and off airplane mode, based on gyroscope face up and down </li> </ul> </div> <div id="magicdomid10"> <ul> <li> prototype code is here: <a href="https://github.com/nathanfreitas/UpOnApp">https://github.com/nathanfreitas/UpOnApp</a> </li> </ul> </div> <div id="magicdomid12"> <strong>Research</strong> </div> <div id="magicdomid13"> <ul> <li> need to look into e911 requirements </li> </ul> </div> <div id="magicdomid14"> <ul> <li> is Airplane mode a don’t broadcast, but receive is on type mode? </li> </ul> </div> <div id="magicdomid15"> <ul> <li> can we detect radio signals at all </li> </ul> </div> <div id="magicdomid16"> <ul> <li> scanning engine for radio communications (cv ettercap) </li> </ul> </div> <div id="magicdomid18"> <strong>Ideas</strong> </div> <div id="magicdomid19"> <ul> <li> Kickstarter projects for faraday cage mobile phone case </li> </ul> </div> <div id="magicdomid20"> <ul> <li> little phone ornament that lights up on radio signals (they have these today!) </li> </ul> </div> <div id="magicdomid21"> <ul> <li> star wars ringing sensor phone charm: <a href="http://www.thinkgeek.com/gadgets/cellphone/c99c/">http://www.thinkgeek.com/gadgets/cellphone/c99c/</a> </li> </ul> </div> <div id="magicdomid22"> <ul> </ul> </div> <div id="magicdomid23"> <ul> </ul> </div> <div id="magicdomid24"> <ul> <li> discuss the kickstarter project for designing a faraday cage mobile phone case… or did someone already do that? </li> </ul> </div> <div id="magicdomid25"> <ul> <li> <a href="http://secretagentmagazine.com/how-to/CellPhoneJamming.htm">http://secretagentmagazine.com/how-to/CellPhoneJamming.htm</a> </li> </ul> </div> <div id="magicdomid26"> <ul> <li> <a href="https://www.google.com/products?q=%22Cell+phone+signal+blocker+pouch%22">https://www.google.com/products?q</a><a href="http://piratepad.net/ep/search?query=%2522Cell+phone+signal+blocker+pouch%2522"></a><a href="https://www.google.com/products?q=%22Cell+phone+signal+blocker+pouch%22">=%22Cell+phone+signal+blocker+pouch%22</a> </li> </ul> </div> <div id="magicdomid28"> <strong>threats</strong> </div> <div id="magicdomid29"> <ul> <li> can baseband exploit / lawful intercept activate on report </li> </ul> </div> <div id="magicdomid30"> <ul> <li> habitual paranoia </li> </ul> </div> <div id="magicdomid31"> <ul> <li> create a physical switch on the battery cover </li> </ul> </div> <div id="magicdomid32"> <ul> <li> sell faraday cases cell phone </li> </ul> </div> <div id="magicdomid33"> <ul> <li> turn off and on the phone , but necessarily super protect </li> </ul> </div> <div id="magicdomid36"> <strong>II – Anonymous Currency [BitCoin]</strong> </div> <div id="magicdomid38"> <ul> <li> <a href="http://www.weusecoins.com/">http://www.weusecoins.com/</a> </li> </ul> </div> <div id="magicdomid39"> <ul> <li> <a href="http://bitcoinmonitor.com/">http://bitcoinmonitor.com/</a> </li> </ul> </div> <div id="magicdomid40"> <ul> <li> <a href="http://blockexplorer.com/">http://blockexplorer.com/</a> </li> </ul> </div> <div id="magicdomid41"> <ul> <li> <a href="http://bitcoincharts.com/markets/">http://bitcoincharts.com/markets/</a> </li> </ul> </div> <div id="magicdomid43"> <strong>a.</strong><strong> Bitcoin for Android</strong> </div> <div id="magicdomid45"> <ul> <li> Virtual p2p currency: <a href="http://www.bitcoin.org/">http://www.bitcoin.org/</a> </li> </ul> </div> <div id="magicdomid46"> <ul> <li> Any interesections between Bitcoin and FrontlineSMS Credit?: <a href="http://credit.frontlinesms.com/">http://credit.frontlinesms.com/</a> </li> </ul> </div> <div id="magicdomid47"> <ul> <li> Check out: <a href="http://ripple-project.org/">http://ripple-project.org/</a> </li> </ul> </div> <div id="magicdomid48"> <ul> <li> Android BitCoin wallet </li> </ul> </div> <div id="magicdomid49"> <ul> <li> qrcodes for half-offline transactions </li> </ul> </div> <div id="magicdomid51"> <strong> b. Bitcoin in General</strong> </div> <div id="magicdomid52"> <ul> <li> Laundromat to maintain anonymity of BitCoin pseudonyms </li> </ul> </div> <div id="magicdomid53"> <ul> <li> trust laundromat a few cents at a time </li> </ul> </div> <div id="magicdomid54"> <ul> <li> trade keys in realishtime </li> </ul> </div> <div id="magicdomid56"> <strong>III Building CyanogenMod from Source!</strong> </div> <div id="magicdomid57"> <ul> <li> Seems like a fun experiment for the day </li> </ul> </div> <div id="magicdomid58"> <ul> <li> Can we drop in SQLCipher? </li> </ul> </div> <div id="magicdomid59"> <ul> <li> Possibly work on exploring OWNER module issues with current kernel </li> </ul> </div> <div id="magicdomid60"> <ul> <li> Yes, we need to figure out how to dynamically load kernel modules </li> </ul> </div> <div id="magicdomid62"> <strong>IV. Debian Autoinstaller</strong> </div> <div id="magicdomid63"> <ul> <li> can you simplify the installer in the market </li> </ul> </div> <div id="magicdomid64"> <ul> <li> checkout the QT market installer </li> </ul> </div> <div id="magicdomid66"> <strong>V. How to Build Stuff</strong> </div> <div id="magicdomid67"> <ul> <li> <a href="https://svn.torproject.org/svn/projects/android/trunk/Orbot/BUILD">https://svn.torproject.org/svn/projects/android/trunk/Orbot/BUILD</a> </li> </ul> </div> <div id="magicdomid68"> <ul> <li> <a href="https://github.com/bitcoin-labs/bitcoin-mobile-android/commit/19fde8f58690b79177c7eb474ea242805e570a6d#diff-2">https://github.com/bitcoin-labs/bitcoin-mobile-android/commit/19fde8f58690b79177c7eb474ea242805e570a6d</a><a href="http://piratepad.net/ep/search?query=diff-2"></a><a href="https://github.com/bitcoin-labs/bitcoin-mobile-android/commit/19fde8f58690b79177c7eb474ea242805e570a6d#diff-2">#diff-2</a> </li> </ul> </div> <div id="magicdomid69"> <ul> <li> Gradle for building apps, or “ant release” </li> </ul> </div> <div id="magicdomid70"> <ul> </ul> </div> <div id="magicdomid72"> <strong>VI. Port Ghostery to Firefox for Android</strong> </div> <div id="magicdomid73"> <ul> <li> blocks cookies, tracking, etc </li> </ul> </div> <div id="magicdomid74"> <ul> <li> <a href="http://www.ghostery.com/faq">http://www.ghostery.com/faq</a> </li> </ul> </div> <div id="magicdomid76"> <strong>VII Securely Reporting Photo/Video/Audio</strong> </div> <div id="magicdomid77"> <ul> <li> <a href="http://quietbabylon.com/2011/the-best-networked-plans/">http://quietbabylon.com/2011/the-best-networked-plans/</a> </li> </ul> </div> <p> </p> https://guardianproject.info/2011/04/01/growing-mobile-test-lab-and-library/ Fri, 01 Apr 2011 00:32:08 -0400 https://guardianproject.info/2011/04/01/growing-mobile-test-lab-and-library/ <p>At our new meatspace location in New York City, we are building up a library of mobile devices from around the world for open-source developers to use for testing, and specifically to help verify the security of apps running on different carrier configurations and hardware variables.</p> <p>Mostly our collection has come from picking up what we can, when we can, always with an eye towards anything a few generations back from the state of the art. If you’ve got any mobile hardware to donate, we would love to have it.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2011/04/267664324.jpg"><img class="alignnone size-full wp-image-893" title="267664324" src="https://guardianproject.info/wp-content/uploads/2011/04/267664324.jpg" alt="" width="600" height="451" srcset="https://guardianproject.info/wp-content/uploads/2011/04/267664324.jpg 600w, https://guardianproject.info/wp-content/uploads/2011/04/267664324-300x225.jpg 300w" sizes="(max-width: 600px) 100vw, 600px" /></a></p> https://guardianproject.info/how-you-can-work-with-us/ Wed, 30 Mar 2011 18:18:41 -0400 https://guardianproject.info/how-you-can-work-with-us/ <p><strong>Guardian as Development Partner</strong></p> <p>The Guardian Project can be utilized by partner organizations in three ways. First, as a turn-key product, for daily personal use as well as organizational deployment in sensitive field world. Second, as a mobile security platform, on which developers can build custom applications that required circumvention, anonymity, encryption and other capabilities. Finally, as an open-source project, with which to collaborate on in core mobile security research and development.</p> <p>You can view our <a href="https://guardianproject.info/home/partners/">current set of partners here</a>.</p> <p><strong>1. Turn-key &ldquo;Beta&rdquo; Product</strong><br /> Through apps available in the Android Market and distributed through direct secure download, any person with an Android phone can utilize specific capabilities of the Guardian Project app suite. This includes Orbot for access to the Tor network, Gibberbot for encrypted chat, and Orweb and ProxyMob for secured web access. Guardian also offers tuned configuration and documentation for use a variety of third-party open-source solutions for secure voice communications and email. The current state of our apps is definitely pre-release and &ldquo;beta&rdquo;, and any user or organization is expected to have some technical capability and be motivated to participate in improving our product.</p> <p><strong>2. Mobile Security Platform</strong><br /> The Guardian Project offers developers looking to enhance the security of their applications through APIs, code libraries, and sample source code. As an example, the ORLib &ldquo;Onion Routing Library&rdquo; is a simple add-in for any application that would benefit from anonymity and circumvention capability through Tor. For instance, an blogging or media delivery tool might use ORlib to automatically handle any local filtering or censorship in the local region. Our SQLCipher for Android project provides pin-protected data encryption on the device, safeguarding sensitive information from access by malware apps or<br /> physical theft. Organizations that have mobile developers skilled at building apps, but without the capability or confidence to implement their own security features, can partner with Guardian, confident in our open-source tools. We are currently partnering with Witness.org on the SecureSmartCamera, which utilizes a number of our libraries.</p> <p><strong>3. Open-Source Project</strong><br /> The extended Guardian Project open-source development team and user community is a growing, valuable resource for many non-governmental and human rights-oriented organizations to interface with. We currently have ten core development team members, and even larger group of users around the world who help test, support and inform our work. We partner with the Tor Project in this manner, and support work by other efforts on mobile support for disk encryption, mobile public key cryptography and encrypted voice communication. Through academic relationships with New York University’s Interactive Telecommunication Program, Columbia University, the New School, and other academic institutions in the New York area, we have a strong ability to tap into a growing pool of talented students and research. In addition, New York City is fast becoming the established center for mobile+social entrepreneurial activities.</p> <p><strong>Guardian as Platform (ala Drupal)</strong><br /> Through some of our team&rsquo;s experience using Drupal as a platform, we are investigating ways as how to make Drupal a secure backend for communicating. This is currently in development.</p> https://guardianproject.info/how-you-can-work-with-us/ Wed, 30 Mar 2011 18:18:41 -0400 https://guardianproject.info/how-you-can-work-with-us/ <p><strong>Guardian as Development Partner</strong></p> <p>The Guardian Project can be utilized by partner organizations in three ways. First, as a turn-key product, for daily personal use as well as organizational deployment in sensitive field world. Second, as a mobile security platform, on which developers can build custom applications that required circumvention, anonymity, encryption and other capabilities. Finally, as an open-source project, with which to collaborate on in core mobile security research and development.</p> <p>You can view our <a href="https://guardianproject.info/home/partners/">current set of partners here</a>.</p> <p><strong>1. Turn-key &ldquo;Beta&rdquo; Product</strong><br /> Through apps available in the Android Market and distributed through direct secure download, any person with an Android phone can utilize specific capabilities of the Guardian Project app suite. This includes Orbot for access to the Tor network, Gibberbot for encrypted chat, and Orweb and ProxyMob for secured web access. Guardian also offers tuned configuration and documentation for use a variety of third-party open-source solutions for secure voice communications and email. The current state of our apps is definitely pre-release and &ldquo;beta&rdquo;, and any user or organization is expected to have some technical capability and be motivated to participate in improving our product.</p> <p><strong>2. Mobile Security Platform</strong><br /> The Guardian Project offers developers looking to enhance the security of their applications through APIs, code libraries, and sample source code. As an example, the ORLib &ldquo;Onion Routing Library&rdquo; is a simple add-in for any application that would benefit from anonymity and circumvention capability through Tor. For instance, an blogging or media delivery tool might use ORlib to automatically handle any local filtering or censorship in the local region. Our SQLCipher for Android project provides pin-protected data encryption on the device, safeguarding sensitive information from access by malware apps or<br /> physical theft. Organizations that have mobile developers skilled at building apps, but without the capability or confidence to implement their own security features, can partner with Guardian, confident in our open-source tools. We are currently partnering with Witness.org on the SecureSmartCamera, which utilizes a number of our libraries.</p> <p><strong>3. Open-Source Project</strong><br /> The extended Guardian Project open-source development team and user community is a growing, valuable resource for many non-governmental and human rights-oriented organizations to interface with. We currently have ten core development team members, and even larger group of users around the world who help test, support and inform our work. We partner with the Tor Project in this manner, and support work by other efforts on mobile support for disk encryption, mobile public key cryptography and encrypted voice communication. Through academic relationships with New York University’s Interactive Telecommunication Program, Columbia University, the New School, and other academic institutions in the New York area, we have a strong ability to tap into a growing pool of talented students and research. In addition, New York City is fast becoming the established center for mobile+social entrepreneurial activities.</p> <p><strong>Guardian as Platform (ala Drupal)</strong><br /> Through some of our team&rsquo;s experience using Drupal as a platform, we are investigating ways as how to make Drupal a secure backend for communicating. This is currently in development.</p> https://guardianproject.info/2011/03/22/april-26-advancing-the-new-machine-at-uc-berkeley/ Tue, 22 Mar 2011 20:20:56 -0400 https://guardianproject.info/2011/03/22/april-26-advancing-the-new-machine-at-uc-berkeley/ <p>I, along with a number of others from the Guardian Project core dev team, will be at the UC Berkeley’s Human Rights Center “Advancing the New Machine” conference at the end of April. I am on a panel regarding security in the context of human rights. We will also be presenting the Secure Smart Cam project with our partners at Witness. (<a href="https://guardianproject.info/apps/securecam/">https://guardianproject.info/apps/securecam/</a>).</p> <p>You can learn more about the event here:<br /> <a href="http://www.law.berkeley.edu/HRCweb/events/TechConference2011/index.html">http://www.law.berkeley.edu/HRCweb/events/TechConference2011/index.html</a><br /> <img class="alignnone" src="https://www.law.berkeley.edu/HRCweb/events/TechConference2011/images/Conference-Logo-Large.jpg" alt="" width="394" height="224" /></p> <p>It was the 2009 version of the same conference hosted by UC Berkeley’s Human Rights Conference, the “Soul of the New Machine”, where I initially pitched the idea of Guardian, and happily won a $15,000 grant which acted as our seed funding.<br /> <a href="http://www.netsquared.org/challenges/hrc-mobile/uc-berkeley-human-rights-center-mobile-challenge-winners">http://www.netsquared.org/challenges/hrc-mobile/uc-berkeley-human-rights-center-mobile-challenge-winners</a></p> <p>We are also planning to have an all-day open collaborative hack session on Friday, April 29th, somewhere in the bay area. Reaching out to friends at EFF, Tor, Whispersys, Google, etc to host and/or join us. More information as we have it, but I can definitely say that we will have stickers!</p> https://guardianproject.info/2011/03/21/guardian-project-general-update-march-2011/ Mon, 21 Mar 2011 05:18:48 -0400 https://guardianproject.info/2011/03/21/guardian-project-general-update-march-2011/ <p>We have recently updated our general presentation on the project, and thought we would share it with you here. Please post any comments, questions or feedback right here, and we will get back to you shortly.<br /> <a href="https://docs.google.com/present/view?id=ddr5dm94_493gvh263gt"><img class="alignnone size-full wp-image-910" title="gp2011" src="https://guardianproject.info/wp-content/uploads/2011/03/gp2011.png" alt="" width="472" height="348" srcset="https://guardianproject.info/wp-content/uploads/2011/03/gp2011.png 786w, https://guardianproject.info/wp-content/uploads/2011/03/gp2011-300x221.png 300w" sizes="(max-width: 472px) 100vw, 472px" /></a></p> <p>You can find this <a href="https://docs.google.com/present/view?id=ddr5dm94_493gvh263gt">presentation on Google Docs</a>, where you can also find it in downloadable, offline formats.</p> https://guardianproject.info/2011/03/10/photos-from-our-january-hackday/ Thu, 10 Mar 2011 17:41:18 -0400 https://guardianproject.info/2011/03/10/photos-from-our-january-hackday/ <p>Back in January, we held a very excellent hackday at <a href="http://eyebeam.org">Eyebeam</a> in New York. We rooted a NookColor, made encrypted calls over SIP, and generally had a full day of talking about the state of mobile security and privacy. Thanks to everyone who attended, and many thanks to _hc and Eyebeam for hosting!</p> <p>View the full <a href="http://www.flickr.com/photos/eyebeam/sets/72157625808310021/">Flickr photo set</a>.<br /> <a href="http://www.flickr.com/photos/eyebeam/5398828041/" title="DSC_0083 by eyebeam, on Flickr"><img src="https://farm6.static.flickr.com/5053/5398828041_83c603319d.jpg" alt="DSC_0083" width="500" height="335" /></a></p> <p><a href="http://www.flickr.com/photos/eyebeam/5399436072/" title="DSC_0121 by eyebeam, on Flickr"><img src="https://farm6.static.flickr.com/5172/5399436072_d9bcbbab50.jpg" alt="DSC_0121" width="500" height="335" /></a></p> https://guardianproject.info/2011/03/04/proxy-mobile-add-on-0.0.7-for-firefox-on-android/ Fri, 04 Mar 2011 00:01:24 -0400 https://guardianproject.info/2011/03/04/proxy-mobile-add-on-0.0.7-for-firefox-on-android/ <p>We’ve updated our <a href="https://addons.mozilla.org/en-US/mobile/addon/proxy-mobile/">Proxy Mobile</a> add-on for <a href="https://www.mozilla.com/en-US/mobile/">Firefox on Android</a> that allows user to configure their proxy settings. We first released this <a href="https://guardianproject.info/2010/11/08/proxy-settings-add-on-for-firefox-mobile/">back in November of last year</a>, and have done our best to keep up with all the various beta updates of the browser. There are no features in this release, just a few small changes to make sure everything is running smoothly out there.</p> <p>To install the add-on, just search for “Proxy” from the add-on search menu within the Firefox settings screen. You can also point your Firefox mobile browser to this link: <a href="https://guardianproject.info/downloads/proxymob-addon-0.0.7.xpi">https://guardianproject.info/downloads/proxymob-addon-0.0.7.xpi</a></p> <p>If you are a developer interested in writing mobile browser add-ons, please check out <a href="https://github.com/guardianproject/proxymob">our source code</a>, and let us know if you’d like to pitch to add even more awesome privacy-enhancing features!</p> <p> </p> <p> </p> <p> </p> <p> </p> https://guardianproject.info/2011/03/02/addressing-a-privacy-challenge-with-guardian/ Wed, 02 Mar 2011 20:39:18 -0400 https://guardianproject.info/2011/03/02/addressing-a-privacy-challenge-with-guardian/ <p>Organized by the <a href="http://aclunc.org/">ACLU</a>, <a href="https://www.torproject.org/">Tor Project</a>, and <a href="http://privacybydesign.ca/">PrivacyByDesign.c</a>a, the <a href="http://www.develop4privacy.org/">“Develop for Privacy Challenge”</a> is an interesting new software development challenge that was announced last month. Developers (teams or individuals) have until May 31st to come up with apps which address this goal:</p> <blockquote> <p>Develop apps for smartphones or other mobile devices that educate users about mobile privacy and give them the ability to claim or demand greater control of their own personal information.</p> </blockquote> <p>We don’t plan to compete in this contest ourselves, as we would rather support and encourage other developers to take a shot at it. Along those lines, we would really like to see developers use some of the <a href="https://guardianproject.info/apps">apps we have built</a>, and <a href="https://github.com/guardianproject">code we have released</a>, as part of their solutions. We have been putting together a large number of “lego” building blocks over the last year, just waiting for someone to come and put them together in a revolutionary way. Here is a breakdown of some of our more useful components:</p> <p><a href="https://www.torproject.org/images/THS-4.png"><img class="alignleft" style="margin-left: 3px; margin-right: 3px;" src="https://www.torproject.org/images/THS-4.png" alt="" width="162" height="111" /></a></p> <p><a href="https://guardianproject.info/apps/orbot">ORbot -More than just Circumvention</a>: beyond just being a great way to connect to Tor on Android, Orbot also supports <a href="https://www.torproject.org/docs/hidden-services.html.en">Tor Hidden Services</a>. This means you can run local servers on your Android device, and access them via a .onion hostname from any other device or computer on the Tor network. We have been looking at building all sorts of cool anonymous peer-to-peer apps using this capability, but haven’t found the time yet.</p> <p><a href="https://guardianproject.info/code/orlib/">ORlib – Privacy-powered HTTP and Sockets:</a> This an Android Library for use by any application that wishes to route its network traffic through the Tor network. If your app uses this library, and Orbot is installed and activated on the device, it will automatically handle routing your connections, DNS requests and traffic through the Tor network. By building this into your device, it means your users do not need to have a rooted device in order to have their network traffic anonymized and otherwise protected from filtering and surveillence.</p> <p><a href="https://guardianproject.info/apps/proxymob-firefox-add-on/">ProxyMob</a>: We have the beginnings of a Firefox for Android add-on that allows user to control the proxy settings for their browser. However, this add-on needs to fully evolve into a mobile version of <a href="https://www.torproject.org/torbutton/">TorButton</a>. This alone would be a great project to tackle, discovering what unique challenges their are to anonymizing mobile web access, such as constant geolocation tracking!</p> <p><a href="https://github.com/guardianproject/SecureSmartCam/raw/master/doc/comps/Still/11_blur.jpg"><img class="alignright" style="margin-left: 3px; margin-right: 3px;" src="https://github.com/guardianproject/SecureSmartCam/raw/master/doc/comps/Still/11_blur.jpg" alt="" width="173" height="288" /></a></p> <p><a href="https://guardianproject.info/apps/securecam/">SecureSmartCam</a>: Visual privacy is an emerging area of research and development, specifically with the growing problem/benefit of cameras being everywhere, in our pockets, on our streets, at all times. We are partnering with <a href="https://www.witness.org">Witness.org</a> to build camera software that is capable of protecting identities, securing sensitive metadata stored in photos, and empowering the documenter and subjects of photos, video and audio recordings to maintain more control of media that they have consented to be a part of. With all that in mind, we need some serious media hackers who are interested in thing liks OpenCV, GStreamer, EXIF and more to contribute to this project, and to come up with some new brilliant secure cam apps of their own.</p> <p>We have a number of other ongoing projects that you can find on our <a href="https://github.com/guardianproject">Github site</a>, including encrypted SQL databases and file system tools, and our secure instant messaging app, <a href="https://guardianproject.info/apps/gibber">Gibberbot</a>. All in all, there is a quite a bit of work on which any interest in improving mobile privacy can build upon. We would be very happy to provide support via <a href="https://guardianproject.info/contact/">email or IRC</a> to any dev interested in working with us, as well.</p> <p><strong>Good luck, and <a href="http://www.develop4privacy.org/">game on</a>!</strong></p> <p>**<a href="http://www.develop4privacy.org/">http://www.develop4privacy.org/</a><br /> **</p> https://guardianproject.info/2011/03/01/secured-htc-wildfires-get-guardian/ Tue, 01 Mar 2011 23:23:14 -0400 https://guardianproject.info/2011/03/01/secured-htc-wildfires-get-guardian/ <p>As we’ve <a href="https://guardianproject.info/2010/11/09/secured-t-mobile-mytouch-4g-gets-guardian/">posted</a> in the past, one of the services we provide at The Guardian Project is customizing off-the-shelf Android phones to be generally more secure, privacy minded and updated with a powerful suite of trusted apps. We’ve gotten our mitts on a number of devices over the last few months in this regard, including: myTouch 4G, Motorola Milestone (GSM Droid), HTC Desire GSM, TMobile G2, Samsung Galaxy S, Nook Color, and Viewsonic 10″ GTablet. Whew! And if there’s one thing we’ve learned, it’s that some devices are much much harder to crack than others (cough cough… <a href="http://alpharev.nl/">Desire GSM’s hardened bootloader</a>). With that in mind, we’ve recently added a <a href="https://guardianproject.info/hardware/">Hardware</a> page to our site that lists the devices that we recommend for ‘Guardianization’.</p> <p>This weekend we got our hands on one of the devices that has recently made our list – the <a href="http://www.htc.com/uk/product/wildfire/overview.html">HTC Wildfire A3333</a>. As far as trade-offs are concerned, the Wildfire is like a ‘mini me’ version of our trusted Nexus One – a smaller, lower resolution capacitive screen along with a processor with half the speed means much improved battery life and a fuller wallet (just $300 / ea.!).</p> <p><a href="https://guardianproject.info/wp-content/uploads/2011/03/DSC01246.jpg"><img class="aligncenter size-medium wp-image-771" title="HTC Wildfires" src="https://guardianproject.info/wp-content/uploads/2011/03/DSC01246-300x199.jpg" alt="" width="300" height="199" srcset="https://guardianproject.info/wp-content/uploads/2011/03/DSC01246-300x199.jpg 300w, https://guardianproject.info/wp-content/uploads/2011/03/DSC01246-1024x681.jpg 1024w, https://guardianproject.info/wp-content/uploads/2011/03/DSC01246.jpg 1600w" sizes="(max-width: 300px) 100vw, 300px" /></a></p> <p>Our app suite has been evolving along with our hardware preferences: we still rely on Orbot (Tor on Android), TextSecure, K9 &amp; APG. OtRChat has become Gibberbot and is currently in alpha status, and SipDroid has been replaced with CSipSimple, a very powerful sip client that provides SRTP-encrypted voice over TLS. More on CSip in a future blog posting.</p> <p>We’re very happy with how these Wildfires have turned out – Cyanogenmod 6 firmware is very responsive and stable and the hardware is very convenient. As long as they stay straightforward to customize they’ll be staying on our ‘good list’ down the road.</p> https://guardianproject.info/archive/hardware/ Thu, 24 Feb 2011 03:47:39 -0400 https://guardianproject.info/archive/hardware/ <p><strong style="font-style: italic;">January 2013: We recognize this page is quite out of date and are working to update it.</strong><span style="line-height: 13px;"><br /> </span></p> <p>While we don&rsquo;t (yet) produce our own hardware, we do offer custom configured versions of off-the-shelf devices. We&rsquo;re also often asked &ldquo;which phone should I get?&rdquo; or &ldquo;which carrier should I choose?&rdquo;, so we decided to gather that information here for you.</p> <p>If you would like more information on our custom configured Guardian devices, please <a href="https://guardianproject.info/contact/">contact us</a>. Otherwise, read on below&hellip;</p> <p><strong>Android Devices We Like</strong></p> <p>_<img class="alignright" style="margin-left: 6px; margin-right: 6px;" title="nexusone" alt="" src="https://docs.google.com/document/pubimage?id=1XRbMDFnRQYLGhVMVoc-TbE0M2goB2FZ2mr-Ml8_z_KY&image_id=1E-aS8PAE1a1ey-z-STcaAEQ_nVIy_Q" width="110" height="215" />_</p> <p>There is certainly no shortage of Android devices out there - some say <a href="http://www.zdnet.com/blog/gadgetreviews/android-ambivalence-the-plight-of-too-many-google-phones/20485">too many</a>. To combat confusion, we&rsquo;re going to keep this list short and sweet. Our main criteria in compiling the list follows:</p> <ul> <li>What is the general user experience? How responsive is the user interface?</li> <li>What is the general battery life? Are you constantly tethered to an outlet?</li> <li>How easy is it to root the device?</li> <li>Does the device support external memory? &lt;-  important for storing and disposing of sensitive materials</li> <li>Lastly, we have to had <em>used</em> a device hands-on for it to make our list - oherwise it makes our wish list below.</li> </ul> <p>Without further ado, here is our Top 3 List for Android handsets and tablets. If you know of any devices that you feel should take a place on the podium, please let us know!</p> <p><em>Baseline Handsets****</em>**<br /> **</p> <ul> <li>Galaxy Nexus for $349 is hard to beat.</li> </ul> <p><em>Affordable Handsets</em></p> <ul> <li>ZTE devices can be ordered directly from China for $100-150 USD and are able to run CyanogenMOD on them</li> </ul> <p><em>Tablets</em><strong>_</strong> _<img class="alignright" title="nook" alt="" src="https://docs.google.com/document/pubimage?id=1XRbMDFnRQYLGhVMVoc-TbE0M2goB2FZ2mr-Ml8_z_KY&image_id=1HQoRKDXuEOBtX3QYoKcKkePHj6ISMA" width="186" height="274" /><em>**</em>**</p> <ul> <li>Nexus 7 is the gold standard for affordable, but powerful.</li> <li>Kindle Fires provide good value for price and are easy to root and rom.</li> </ul> <p><strong>_</strong> __**<br /> _ Other Root Friendly Devices<br /> **</p> <p>The folks over at Unrevoked have a very cool &lsquo;Root Friendly&rsquo; list that provides great detail on a whole range of Android devices: <a href="http://unrevoked.com/rootwiki/doku.php/public/root_friendly">Root Friendly List</a>. You can also review the <a href="http://www.cyanogenmod.com/devices">CyanogenMod Supported Devices</a> page for a good overview of the handsets that best support custom, after-market tweaking.</p> <p>For step-by-step information on how to root, please check out and contribute to our &ldquo;Device Rooting Guide&rdquo; on the <a href="https://guardianproject.info/wiki/Device_Rooting_Guides">Guardian Project Wiki</a>.</p> <p><strong>Where to Buy</strong></p> <p>The explosion of Android devices in the market has resulted in a number of secondary electronics markets. Aside from the usual options like eBay and Craigslist, we&rsquo;ve found that it&rsquo;s often easy to get our hands on a good-as-new handset from any of the below vendors:</p> <ul> <li><a href="http://swappa.com/">Swappa Android marketplace</a></li> <li><a href="http://mobilecityonline.com/wireless/store/android_phones.asp">Mobile City (New York)</a></li> <li><a href="http://jandr.com">J&amp;R (New York)</a></li> </ul> <div> <em><br /> </em> </div> <div> <strong><em><br /> </em></strong> </div> https://guardianproject.info/archive/hardware/ Thu, 24 Feb 2011 03:47:39 -0400 https://guardianproject.info/archive/hardware/ <p><strong style="font-style: italic;">January 2013: We recognize this page is quite out of date and are working to update it.</strong><span style="line-height: 13px;"><br /> </span></p> <p>While we don&rsquo;t (yet) produce our own hardware, we do offer custom configured versions of off-the-shelf devices. We&rsquo;re also often asked &ldquo;which phone should I get?&rdquo; or &ldquo;which carrier should I choose?&rdquo;, so we decided to gather that information here for you.</p> <p>If you would like more information on our custom configured Guardian devices, please <a href="https://guardianproject.info/contact/">contact us</a>. Otherwise, read on below&hellip;</p> <p><strong>Android Devices We Like</strong></p> <p>_<img class="alignright" style="margin-left: 6px; margin-right: 6px;" title="nexusone" alt="" src="https://docs.google.com/document/pubimage?id=1XRbMDFnRQYLGhVMVoc-TbE0M2goB2FZ2mr-Ml8_z_KY&image_id=1E-aS8PAE1a1ey-z-STcaAEQ_nVIy_Q" width="110" height="215" />_</p> <p>There is certainly no shortage of Android devices out there - some say <a href="http://www.zdnet.com/blog/gadgetreviews/android-ambivalence-the-plight-of-too-many-google-phones/20485">too many</a>. To combat confusion, we&rsquo;re going to keep this list short and sweet. Our main criteria in compiling the list follows:</p> <ul> <li>What is the general user experience? How responsive is the user interface?</li> <li>What is the general battery life? Are you constantly tethered to an outlet?</li> <li>How easy is it to root the device?</li> <li>Does the device support external memory? &lt;-  important for storing and disposing of sensitive materials</li> <li>Lastly, we have to had <em>used</em> a device hands-on for it to make our list - oherwise it makes our wish list below.</li> </ul> <p>Without further ado, here is our Top 3 List for Android handsets and tablets. If you know of any devices that you feel should take a place on the podium, please let us know!</p> <p><em>Baseline Handsets****</em>**<br /> **</p> <ul> <li>Galaxy Nexus for $349 is hard to beat.</li> </ul> <p><em>Affordable Handsets</em></p> <ul> <li>ZTE devices can be ordered directly from China for $100-150 USD and are able to run CyanogenMOD on them</li> </ul> <p><em>Tablets</em><strong>_</strong> _<img class="alignright" title="nook" alt="" src="https://docs.google.com/document/pubimage?id=1XRbMDFnRQYLGhVMVoc-TbE0M2goB2FZ2mr-Ml8_z_KY&image_id=1HQoRKDXuEOBtX3QYoKcKkePHj6ISMA" width="186" height="274" /><em>**</em>**</p> <ul> <li>Nexus 7 is the gold standard for affordable, but powerful.</li> <li>Kindle Fires provide good value for price and are easy to root and rom.</li> </ul> <p><strong>_</strong> __**<br /> _ Other Root Friendly Devices<br /> **</p> <p>The folks over at Unrevoked have a very cool &lsquo;Root Friendly&rsquo; list that provides great detail on a whole range of Android devices: <a href="http://unrevoked.com/rootwiki/doku.php/public/root_friendly">Root Friendly List</a>. You can also review the <a href="http://www.cyanogenmod.com/devices">CyanogenMod Supported Devices</a> page for a good overview of the handsets that best support custom, after-market tweaking.</p> <p>For step-by-step information on how to root, please check out and contribute to our &ldquo;Device Rooting Guide&rdquo; on the <a href="https://guardianproject.info/wiki/Device_Rooting_Guides">Guardian Project Wiki</a>.</p> <p><strong>Where to Buy</strong></p> <p>The explosion of Android devices in the market has resulted in a number of secondary electronics markets. Aside from the usual options like eBay and Craigslist, we&rsquo;ve found that it&rsquo;s often easy to get our hands on a good-as-new handset from any of the below vendors:</p> <ul> <li><a href="http://swappa.com/">Swappa Android marketplace</a></li> <li><a href="http://mobilecityonline.com/wireless/store/android_phones.asp">Mobile City (New York)</a></li> <li><a href="http://jandr.com">J&amp;R (New York)</a></li> </ul> <div> <em><br /> </em> </div> <div> <strong><em><br /> </em></strong> </div> https://guardianproject.info/2011/02/23/a-note-on-funding-and-our-mention-in-wired/ Wed, 23 Feb 2011 16:50:38 -0400 https://guardianproject.info/2011/02/23/a-note-on-funding-and-our-mention-in-wired/ <p><em>A message from Nathan Freitas, lead developer on Guardian, who has a life long bad habit of being misquoted or selectively quoted, a phenomenon he must now blame on himself, and not the reporters who interview him.</em></p> <p>Some of you might have seen a <a href="http://www.wired.com/dangerroom/2011/02/mobile-tech-activists-wary-of-state-department-cash/">story on Wired.com</a> on which I am quoted, regarding the <a href="http://www.state.gov/e/eeb/cip/netfreedom/index.htm">US State Department’s “Internet Freedom” agenda</a>. In particular, I was asked to comment on the entrepreneurial angle they are taking. Overall, I think the article is good in laying out the challenges for activist technology projects to take funding from the Government. I also think the motivations of the State Department’s effort are authentic and there is great potential to benefit the overall health of the Internet.</p> <p>However, I just want to clarify this portion:</p> <blockquote> <p>Nathan Freitas of the Guardian Project, which designs Android-based tools for mobile anonymity, says he’s not going to apply for any of State’s money. “Accounting complexity of process means we’d have to spend 25 percent of it” on an accountant, he says, while praising the idea in theory</p> </blockquote> <p>To get to the point, I just wish it had said:</p> <blockquote> <p>While he is not going to apply direct for any of this round of State’s money, the project has received funding and support from US Gov’t funded organizations in the past.</p> </blockquote> <p>I am not faulting the reporter on accuracy (as they will always just edit down to the most direct statement), and I hope I am not parsing words, but somewhere in my “praising the idea in theory”, I did mention that we had received small grants from US government funded organizations. The last thing I want to do is sound like a hypocrite, and so I decided to write this post to clarify the statement, while also helping shed light on how a project like ours is able to exist and grow. While the work we are doing is <a href="https://en.wikipedia.org/wiki/Gratis_versus_Libre">free as in speech, and free as in beer</a>, paying rent and putting food on the table is definitely NOT free.</p> <p>From my participation as a developer on the <a href="https://torproject.org">Tor Project</a> (who is completely transparent with their <a href="https://www.torproject.org/about/sponsors.html.en">funding sources here</a>) and through conversations with other organizations (university research groups, Washington DC-based NGOs), I have been exposed to the significant complexity it takes to receive, process and account for this type of government funding. As mentioned in the article, it is nothing out of order for a government, which should have strong oversight on tax payer dollars, but their approach seems still pretty far from the more dynamic, flexible entrepreneurial-style we are seeing from <a href="http://www.firstround.com/">seed and angel round venture capitalists</a> today or efforts like <a href="http://ycombinator.com/">YCombinator</a> and the <a href="http://www.newschallenge.org/">Knight News Challenge</a>.</p> <p>Guardian at this point is just an <a href="https://github.com/guardianproject">open-source project</a>. We are not a non-profit or a corporation, and are not tied to a university. We exist on the coattails of a variety of other organizations, whose support we greatly benefit from. Based on this, I again just want to clarify that while this project is not applying for “any of State’s money” in this next round of $25 Million, <span style="text-decoration: underline;">we have received small grant funding and contract consulting work from groups funded by State department funding</span>. The type of funding we have received historically are small grants from larger NGOs in the $10-20k range, and most of that money has gone to pay developers. The contract work we do (which is actually done as independent contractors, not through Guardian) includes training activists around the world in our how to secure their communications better, setting up specific hardware/software kits for use by NGOs in the field, and software development work for other organizations that need our expertise. At this point however, the <em>majority</em> of our relatively small funding comes from private donors and foundations, and not the US Government.</p> <p>In the end, these are all new waters for me and the project to navigate. We believe that by keeping all of our <a href="https://guardianproject.info/code/">code, designs and communications</a> completely open to the world for scrutiny, we can help address any concerns over our motivations or the trustworthiness of our software. We hope that by taking funding from a variety of sources and <a href="https://guardianproject.info/about/partners">being as transparent about those sources</a> as we can, we can keep the projects vision and ideals whole.</p> <p>Feel free to chime in below with your thoughts. You can also keep an eye on our <a href="https://guardianproject.info/about/partners/">partners and funding</a> page to see who we are working with and how. Finally, if you want to work with us, we are eager to <a href="https://guardianproject.info/contact/join/">fund talented developers and designers</a> to help us build the open-source mobile security apps the world very much needs.</p> https://guardianproject.info/2011/02/19/interviewed-chomp.fm-007-podcast/ Sat, 19 Feb 2011 09:58:04 -0400 https://guardianproject.info/2011/02/19/interviewed-chomp.fm-007-podcast/ <p><a href="http://chomp.fm">CHOMP.FM</a> is a weekly broadcast on information freedom, internet privacy and cyberculture.</p> <p><img src="http://chomp.fm/img/chomp.gif" alt="chomp.fm logo" /></p> <p>We were excited to be interviewed and including in the latest episode, <a href="http://chomp.fm/007/">CHOMP.FM 007</a>. Many thanks to Nadim Kobeissi for featuring us in his super-interesting and relevant show.</p> <p>You can listen to and <a href="http://chomp.fm/audio/007.mp3">download the mp3 directly</a>.</p> https://guardianproject.info/archive/luks/ Sat, 19 Feb 2011 09:05:06 -0400 https://guardianproject.info/archive/luks/ <p>If you are looking for the homepage for LUKS, you can find it here: <a href="https://gitlab.com/cryptsetup/cryptsetup/"><strong>https://gitlab.com/cryptsetup/cryptsetup/</strong></a></p> <p>We are not the creators or maintainers of LUKS. We simply got it working on Android a long, long time ago!</p> <hr /> <p>LUKS is the standard for Linux hard disk encryption. By providing a standard on-disk-format, it does not only facilitate compatibility among distributions, but also provides secure management of multiple user passwords. In contrast to existing solution, LUKS stores all setup necessary setup information in the partition header, enabling the user to transport or migrate his data seamlessly.</p> <p>This project is the port of LUKS to Android. You can find more information on the current status here: <a href="https://github.com/guardianproject/luks/wiki">https://github.com/guardianproject/luks/wiki</a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2011/02/luks-logo-cropped.png"><img class="alignnone size-full wp-image-966" title="luks-logo-cropped" src="https://guardianproject.info/wp-content/uploads/2011/02/luks-logo-cropped.png" alt="" width="330" height="112" srcset="https://guardianproject.info/wp-content/uploads/2011/02/luks-logo-cropped.png 330w, https://guardianproject.info/wp-content/uploads/2011/02/luks-logo-cropped-300x101.png 300w" sizes="(max-width: 330px) 100vw, 330px" /></a></p> <h3 id="design">Design</h3> <p>LUKS was designed according to TKS1, a template design developed in <a href="https://code.google.com/p/cryptsetup/wiki/TKS1">TKS1</a> for secure key setup. LUKS closely reassembles the structure recommended in the TKS1 paper, but also adds meta data for cipher setup management and LUKS also supports for multiple keys/passphrases.</p> <h3 id="a-name-why-luks-a-why-luks"><a name="Why_LUKS?"></a>Why LUKS?</h3> <ul> <li>compatiblity via standardization,</li> <li>secure against low entropy attacks,</li> <li>support for multiple keys,</li> <li>effective passphrase revocation,</li> <li>free</li> </ul> <p>The original LUKS CryptSetup project is here: <a href="https://code.google.com/p/cryptsetup/">https://code.google.com/p/cryptsetup/</a></p> https://guardianproject.info/archive/luks/ Sat, 19 Feb 2011 09:05:06 -0400 https://guardianproject.info/archive/luks/ <p>If you are looking for the homepage for LUKS, you can find it here: <a href="https://gitlab.com/cryptsetup/cryptsetup/"><strong>https://gitlab.com/cryptsetup/cryptsetup/</strong></a></p> <p>We are not the creators or maintainers of LUKS. We simply got it working on Android a long, long time ago!</p> <hr /> <p>LUKS is the standard for Linux hard disk encryption. By providing a standard on-disk-format, it does not only facilitate compatibility among distributions, but also provides secure management of multiple user passwords. In contrast to existing solution, LUKS stores all setup necessary setup information in the partition header, enabling the user to transport or migrate his data seamlessly.</p> <p>This project is the port of LUKS to Android. You can find more information on the current status here: <a href="https://github.com/guardianproject/luks/wiki">https://github.com/guardianproject/luks/wiki</a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2011/02/luks-logo-cropped.png"><img class="alignnone size-full wp-image-966" title="luks-logo-cropped" src="https://guardianproject.info/wp-content/uploads/2011/02/luks-logo-cropped.png" alt="" width="330" height="112" srcset="https://guardianproject.info/wp-content/uploads/2011/02/luks-logo-cropped.png 330w, https://guardianproject.info/wp-content/uploads/2011/02/luks-logo-cropped-300x101.png 300w" sizes="(max-width: 330px) 100vw, 330px" /></a></p> <h3 id="design">Design</h3> <p>LUKS was designed according to TKS1, a template design developed in <a href="https://code.google.com/p/cryptsetup/wiki/TKS1">TKS1</a> for secure key setup. LUKS closely reassembles the structure recommended in the TKS1 paper, but also adds meta data for cipher setup management and LUKS also supports for multiple keys/passphrases.</p> <h3 id="a-name-why-luks-a-why-luks"><a name="Why_LUKS?"></a>Why LUKS?</h3> <ul> <li>compatiblity via standardization,</li> <li>secure against low entropy attacks,</li> <li>support for multiple keys,</li> <li>effective passphrase revocation,</li> <li>free</li> </ul> <p>The original LUKS CryptSetup project is here: <a href="https://code.google.com/p/cryptsetup/">https://code.google.com/p/cryptsetup/</a></p> https://guardianproject.info/code/sqlcipher/ Sat, 19 Feb 2011 08:27:13 -0400 https://guardianproject.info/code/sqlcipher/ <p><img class="alignnone size-medium wp-image-1329" title="logo-sqlcipher-android" src="https://guardianproject.info/wp-content/uploads/2011/02/logo-sqlcipher-android-300x50.png" alt="" width="300" height="50" srcset="https://guardianproject.info/wp-content/uploads/2011/02/logo-sqlcipher-android-300x50.png 300w, https://guardianproject.info/wp-content/uploads/2011/02/logo-sqlcipher-android.png 522w" sizes="(max-width: 300px) 100vw, 300px" /></p> <p><div class="source-code" style="width: 30%; margin: 0 auto;"> <a href="https://github.com/sqlcipher/android-database-sqlcipher" target="_blank" title="SQLCipher for Android"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/sqlcipher" target="_blank" title="SQLCipher blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /></p> <p>In an environment where mobile data privacy is increasingly <a href="https://www.reuters.com/article/2011/05/08/us-privacy-congress-idUSTRE7471SA20110508">in the headlines</a>, this project will make it easier than ever for mobile developers to properly secure their local application data, and in turn better protect the privacy of their users. The data stored by Android apps protected by this type of encryption will be less vulnerable to access by malicious apps, protected in case of device loss or theft, and highly resistant to <a href="https://www.cellebrite.com/">mobile data forensics tools</a> that are increasingly used to mass copy a mobile device during <a href="https://www.thenewspaper.com/news/34/3458.asp">routine traffic stops</a>.</p> <p>SQLCipher is a <a href="https://sqlite.org/">SQLite</a> extension that provides transparent 256-bit AES encryption of database files. To date, it has been open-sourced, sponsored and maintained by <a href="https://zetetic.net/">Zetetic LLC</a>. In the mobile space, SQLCipher has enjoyed widespread use in Apple’s <a href="https://www.zetetic.net/sqlcipher/documentation/ios.html">iOS</a>, as well as <a href="https://www.qtcentre.org/wiki/index.php?title=Building_QSQLITE_driver_with_AES-256_encryption_support">Nokia / QT</a> for quite some time. Given that Android <a href="https://developer.android.com/guide/topics/data/data-storage.html#db">by default</a> provides integrated support for SQLite databases, our goal was to create an almost identical API for SQLCipher, so that developers of all skill level could use it, without a steep learning curve.</p> <h2 id="learn-more-and-download">Learn More and Download</h2> <ul> <li><a href="https://www.zetetic.net/sqlcipher/sqlcipher-for-android/">SQLCipher for Android</a></li> <li>source: <a href="https://github.com/sqlcipher/android-database-sqlcipher">https://github.com/sqlcipher/android-database-sqlcipher</a></li> </ul> <h3 id="an-illustrative-terminal-listing">An Illustrative Terminal Listing</h3> <p>A typical SQLite database in unencrypted, and visually parseable even as encoded text. The following example shows the difference between hexdumps of a standard SQLite db and one implementing SQLCipher.</p> <blockquote> <p>~ sjlombardo$ hexdump -C sqlite.db<br /> 00000000 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 |SQLite format 3.|<br /> &hellip;<br /> 000003c0 65 74 32 74 32 03 43 52 45 41 54 45 20 54 41 42 |et2t2.CREATE TAB|<br /> 000003d0 4c 45 20 74 32 28 61 2c 62 29 24 01 06 17 11 11 |LE t2(a,b)$&hellip;..|<br /> &hellip;<br /> 000007e0 20 74 68 65 20 73 68 6f 77 15 01 03 01 2f 01 6f | the show&hellip;./.o|<br /> 000007f0 6e 65 20 66 6f 72 20 74 68 65 20 6d 6f 6e 65 79 |ne for the money|</p> <p>~ $ sqlite3 sqlcipher.db<br /> sqlite&gt; PRAGMA KEY=&lsquo;test123&rsquo;;<br /> sqlite&gt; CREATE TABLE t1(a,b);<br /> sqlite&gt; INSERT INTO t1(a,b) VALUES (&lsquo;one for the money&rsquo;, &lsquo;two for the show&rsquo;);<br /> sqlite&gt; .quit</p> <p>~ $ hexdump -C sqlite.db<br /> 00000000 84 d1 36 18 eb b5 82 90 c4 70 0d ee 43 cb 61 87 |.?6.?..?p.?C?a.|<br /> 00000010 91 42 3c cd 55 24 ab c6 c4 1d c6 67 b4 e3 96 bb |.B<!--?U$???.?g??.?| ... 00000be0 dc 77 5c 6c de c6 d3 be 43 49 48 3e f3 02 94 a9 |?w\l??ӾCIH-->?..?|</p> <p>00000bf0 8e 99 ee 28 23 43 ab a4 97 cd 63 42 8a 8e 7c c6 |..?(#C??.?cB..|?|</p> <p>~ $ sqlite3 sqlcipher.db<br /> sqlite&gt; SELECT * FROM t1;<br /> Error: file is encrypted or is not a database</p> </blockquote> <p>(example courtesy of <a href="https://www.zetetic.net/sqlcipher/design">SQLCipher</a>)</p> <h4 id="details-for-developers">Details for Developers</h4> <p>We&rsquo;ve packaged up a very simple SDK for any Android developer to add SQLCipher into their app with the following three steps:</p> <ol> <li>Add a single sqlcipher.jar and a few .so&rsquo;s to the application libs directory</li> <li>Update the import path from <em>android.database.sqlite.*</em> to <em>info.guardianproject.database.sqlite.*</em> in any source files that reference it. The original android.database.Cursor can still be used unchanged.</li> <li>Init the database in onCreate() and pass a variable argument to the open database method with a password*:</li> </ol> <blockquote> <ul> <li>SQLiteDatabase.loadLibs(this); //first init the db libraries with the context</li> <li>SQLiteOpenHelper.getWritableDatabase(“thisismysecret”):</li> </ul> </blockquote> <p>*<strong>Note:</strong> we are working on some dialog builder helper methods for password and PIN input, password caching, and other features that we would like to standardize across all applications that use SQLCipher.</p> <h4 id="compatibility">Compatibility</h4> <p>The Developer Preview implements SQLCipher v1, is compatible with Android 2.2 &amp; 2.3, and works only within one process (you can&rsquo;t pass a Cursor from a remote Service to an Activity).</p> <h4 id="notepad-sqlcipher-notepadbot">Notepad + SQLCipher = Notepadbot</h4> <p>Notepadbot is a sample application pulled from the standard Android samples code and updated to use SQLCipher. You can browse the source <a href="https://github.com/guardianproject/notepadbot">here</a> and download the apk <a href="https://github.com/guardianproject/notepadbot/Notepadbot-0.0.1c-dev.apk/qr_code">here</a>.</p> <p style="text-align: center;"> <img class="alignnone" src="https://guardianproject.info/wp-content/uploads/2011/05/prompt.png" alt="" width="180" height="300" /><img class="alignnone" title="successful authentication" src="https://guardianproject.info/wp-content/uploads/2011/05/notes.png" alt="" width="180" height="300" /> </p> <h4 id="final-notes">Final Notes</h4> <p>It&rsquo;s important to note that this project is not intended to be a distinct, long-term fork of SQLCipher. We&rsquo;ve been working closely with the SQLCipher team at <a href="https://zetetic.net/">Zetetic</a> and fully intent to closely maintain the project as SQLCipher evolves, re-integrating changes in upcoming releases such as <a href="https://github.com/sjlombardo/sqlcipher/tree/v2beta">SQLCipher v2</a>.</p> <p>The Android support libraries are licensed under <a href="https://github.com/guardianproject/android-database-sqlcipher/blob/master/LICENSE">Apache 2.0</a>, in line with the Android OS code on which they are based. The SQLCipher code itself is licensed under a <a href="https://github.com/guardianproject/android-database-sqlcipher/blob/master/SQLCIPHER_LICENSE">BSD-style license from Zetetic LLC.</a> Finally, the original SQLite code itself is in the <a href="https://www.sqlite.org/copyright.html">public domain</a>.</p> <!--:--> https://guardianproject.info/code/sqlcipher/ Sat, 19 Feb 2011 08:27:13 -0400 https://guardianproject.info/code/sqlcipher/ <p><img class="alignnone size-medium wp-image-1329" title="logo-sqlcipher-android" src="https://guardianproject.info/wp-content/uploads/2011/02/logo-sqlcipher-android-300x50.png" alt="" width="300" height="50" srcset="https://guardianproject.info/wp-content/uploads/2011/02/logo-sqlcipher-android-300x50.png 300w, https://guardianproject.info/wp-content/uploads/2011/02/logo-sqlcipher-android.png 522w" sizes="(max-width: 300px) 100vw, 300px" /></p> <p><div class="source-code" style="width: 30%; margin: 0 auto;"> <a href="https://github.com/sqlcipher/android-database-sqlcipher" target="_blank" title="SQLCipher for Android"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/sqlcipher" target="_blank" title="SQLCipher blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /></p> <p>In an environment where mobile data privacy is increasingly <a href="https://www.reuters.com/article/2011/05/08/us-privacy-congress-idUSTRE7471SA20110508">in the headlines</a>, this project will make it easier than ever for mobile developers to properly secure their local application data, and in turn better protect the privacy of their users. The data stored by Android apps protected by this type of encryption will be less vulnerable to access by malicious apps, protected in case of device loss or theft, and highly resistant to <a href="https://www.cellebrite.com/">mobile data forensics tools</a> that are increasingly used to mass copy a mobile device during <a href="https://www.thenewspaper.com/news/34/3458.asp">routine traffic stops</a>.</p> <p>SQLCipher is a <a href="https://sqlite.org/">SQLite</a> extension that provides transparent 256-bit AES encryption of database files. To date, it has been open-sourced, sponsored and maintained by <a href="https://zetetic.net/">Zetetic LLC</a>. In the mobile space, SQLCipher has enjoyed widespread use in Apple’s <a href="https://www.zetetic.net/sqlcipher/documentation/ios.html">iOS</a>, as well as <a href="https://www.qtcentre.org/wiki/index.php?title=Building_QSQLITE_driver_with_AES-256_encryption_support">Nokia / QT</a> for quite some time. Given that Android <a href="https://developer.android.com/guide/topics/data/data-storage.html#db">by default</a> provides integrated support for SQLite databases, our goal was to create an almost identical API for SQLCipher, so that developers of all skill level could use it, without a steep learning curve.</p> <h2 id="learn-more-and-download">Learn More and Download</h2> <ul> <li><a href="https://www.zetetic.net/sqlcipher/sqlcipher-for-android/">SQLCipher for Android</a></li> <li>source: <a href="https://github.com/sqlcipher/android-database-sqlcipher">https://github.com/sqlcipher/android-database-sqlcipher</a></li> </ul> <h3 id="an-illustrative-terminal-listing">An Illustrative Terminal Listing</h3> <p>A typical SQLite database in unencrypted, and visually parseable even as encoded text. The following example shows the difference between hexdumps of a standard SQLite db and one implementing SQLCipher.</p> <blockquote> <p>~ sjlombardo$ hexdump -C sqlite.db<br /> 00000000 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 |SQLite format 3.|<br /> &hellip;<br /> 000003c0 65 74 32 74 32 03 43 52 45 41 54 45 20 54 41 42 |et2t2.CREATE TAB|<br /> 000003d0 4c 45 20 74 32 28 61 2c 62 29 24 01 06 17 11 11 |LE t2(a,b)$&hellip;..|<br /> &hellip;<br /> 000007e0 20 74 68 65 20 73 68 6f 77 15 01 03 01 2f 01 6f | the show&hellip;./.o|<br /> 000007f0 6e 65 20 66 6f 72 20 74 68 65 20 6d 6f 6e 65 79 |ne for the money|</p> <p>~ $ sqlite3 sqlcipher.db<br /> sqlite&gt; PRAGMA KEY=&lsquo;test123&rsquo;;<br /> sqlite&gt; CREATE TABLE t1(a,b);<br /> sqlite&gt; INSERT INTO t1(a,b) VALUES (&lsquo;one for the money&rsquo;, &lsquo;two for the show&rsquo;);<br /> sqlite&gt; .quit</p> <p>~ $ hexdump -C sqlite.db<br /> 00000000 84 d1 36 18 eb b5 82 90 c4 70 0d ee 43 cb 61 87 |.?6.?..?p.?C?a.|<br /> 00000010 91 42 3c cd 55 24 ab c6 c4 1d c6 67 b4 e3 96 bb |.B<!--?U$???.?g??.?| ... 00000be0 dc 77 5c 6c de c6 d3 be 43 49 48 3e f3 02 94 a9 |?w\l??ӾCIH-->?..?|</p> <p>00000bf0 8e 99 ee 28 23 43 ab a4 97 cd 63 42 8a 8e 7c c6 |..?(#C??.?cB..|?|</p> <p>~ $ sqlite3 sqlcipher.db<br /> sqlite&gt; SELECT * FROM t1;<br /> Error: file is encrypted or is not a database</p> </blockquote> <p>(example courtesy of <a href="https://www.zetetic.net/sqlcipher/design">SQLCipher</a>)</p> <h4 id="details-for-developers">Details for Developers</h4> <p>We&rsquo;ve packaged up a very simple SDK for any Android developer to add SQLCipher into their app with the following three steps:</p> <ol> <li>Add a single sqlcipher.jar and a few .so&rsquo;s to the application libs directory</li> <li>Update the import path from <em>android.database.sqlite.*</em> to <em>info.guardianproject.database.sqlite.*</em> in any source files that reference it. The original android.database.Cursor can still be used unchanged.</li> <li>Init the database in onCreate() and pass a variable argument to the open database method with a password*:</li> </ol> <blockquote> <ul> <li>SQLiteDatabase.loadLibs(this); //first init the db libraries with the context</li> <li>SQLiteOpenHelper.getWritableDatabase(“thisismysecret”):</li> </ul> </blockquote> <p>*<strong>Note:</strong> we are working on some dialog builder helper methods for password and PIN input, password caching, and other features that we would like to standardize across all applications that use SQLCipher.</p> <h4 id="compatibility">Compatibility</h4> <p>The Developer Preview implements SQLCipher v1, is compatible with Android 2.2 &amp; 2.3, and works only within one process (you can&rsquo;t pass a Cursor from a remote Service to an Activity).</p> <h4 id="notepad-sqlcipher-notepadbot">Notepad + SQLCipher = Notepadbot</h4> <p>Notepadbot is a sample application pulled from the standard Android samples code and updated to use SQLCipher. You can browse the source <a href="https://github.com/guardianproject/notepadbot">here</a> and download the apk <a href="https://github.com/guardianproject/notepadbot/Notepadbot-0.0.1c-dev.apk/qr_code">here</a>.</p> <p style="text-align: center;"> <img class="alignnone" src="https://guardianproject.info/wp-content/uploads/2011/05/prompt.png" alt="" width="180" height="300" /><img class="alignnone" title="successful authentication" src="https://guardianproject.info/wp-content/uploads/2011/05/notes.png" alt="" width="180" height="300" /> </p> <h4 id="final-notes">Final Notes</h4> <p>It&rsquo;s important to note that this project is not intended to be a distinct, long-term fork of SQLCipher. We&rsquo;ve been working closely with the SQLCipher team at <a href="https://zetetic.net/">Zetetic</a> and fully intent to closely maintain the project as SQLCipher evolves, re-integrating changes in upcoming releases such as <a href="https://github.com/sjlombardo/sqlcipher/tree/v2beta">SQLCipher v2</a>.</p> <p>The Android support libraries are licensed under <a href="https://github.com/guardianproject/android-database-sqlcipher/blob/master/LICENSE">Apache 2.0</a>, in line with the Android OS code on which they are based. The SQLCipher code itself is licensed under a <a href="https://github.com/guardianproject/android-database-sqlcipher/blob/master/SQLCIPHER_LICENSE">BSD-style license from Zetetic LLC.</a> Finally, the original SQLite code itself is in the <a href="https://www.sqlite.org/copyright.html">public domain</a>.</p> <!--:--> https://guardianproject.info/2011/02/17/stickers/ Thu, 17 Feb 2011 13:44:05 -0400 https://guardianproject.info/2011/02/17/stickers/ <p>If you see us in person, make sure to ask for one. Otherwise, if you really, really want some, we can mail them to you. Just fill out our “contact” form with your address, and we’ll do our best to pop a few in this thing called an envelope and they should get there in a week(!).</p> <p><a href="https://guardianproject.info/wp-content/uploads/2011/02/stickers.jpg"><img src="https://guardianproject.info/wp-content/uploads/2011/02/stickers.jpg" alt="" title="stickers" width="451" height="600" class="alignleft size-full wp-image-631" srcset="https://guardianproject.info/wp-content/uploads/2011/02/stickers.jpg 451w, https://guardianproject.info/wp-content/uploads/2011/02/stickers-225x300.jpg 225w" sizes="(max-width: 451px) 100vw, 451px" /></a></p> https://guardianproject.info/2011/02/02/create-an-encrypted-file-system-on-android-with-luks/ Wed, 02 Feb 2011 23:29:15 -0400 https://guardianproject.info/2011/02/02/create-an-encrypted-file-system-on-android-with-luks/ <p><a href="https://code.google.com/p/cryptsetup/">LUKS</a> is the standard for Linux hard disk encryption. By providing a standard on-disk-format, it not only facilitates compatibility among distributions, but also provides secure management of multiple user passwords.</p> <p>Building off the work from other <a href="https://androidvoid.wordpress.com/2009/09/30/android-encryption-using-cryptsetup-and-luks/">great</a> <a href="http://forum.xda-developers.com/showthread.php?t=866131">sources</a>, the Guardian Project hack team decided to take a crack at porting LUKS to Android recently, with the goal of creating a proof of concept build process that can be easily adapted to future projects.</p> <p>On our stock Guardian hardware (rooted NexusOne running <a href="http://www.cyanogenmod.com/">CyanogenMod</a>) we were able to create a 50MB “secretagentman.mp3” file on the device sdcard to store our encrypted filesystem. We think the possibilities for enhanced privacy here are great: to the average phone snooper, this would appear as just another harmless media file on your device storage!</p> <p>You can give it a shot by following the instructions over at the project <a href="https://github.com/guardianproject/LUKS/wiki">wiki</a>. Note that the build process requires setting up the <a href="http://developer.android.com/sdk/ndk/index.html">Android NDK</a> on your machine, and the current setup process must be done through adb shell or terminal, requiring root permissions. Work on a GUI is just getting started.</p> <p>As usual we encourage those wishing to get involved to check out our projects on <a href="https://github.com/guardianproject">Git</a>, <a href="https://guardianproject.info/contact/">get in touch</a> with us, and join us on IRC at #guardianproject on <a href="http://freenode.net/irc_servers.shtml">freenode</a>.</p> https://guardianproject.info/archive/firefoxprivacy/ Mon, 15 Nov 2010 13:48:35 -0400 https://guardianproject.info/archive/firefoxprivacy/ <!--:--> <!--:en--> <p><strong>Fall 2016: We no longer promote the user of Firefox with add-ons, as the solution can be insecure still and easily misconfigured.</strong></p> <p>Please use our new <a href="https://guardianproject.info/apps/orfox/">Orfox browser for Android</a>, based on Tor Browser.</p> <hr /> <p>&nbsp;</p> <p><!--:de-->The latest releases of</p> <p><a href="https://www.mozilla.com/en-US/mobile/">Firefox on Android</a> are proving to be very usable, stable and an increasingly viable alternative to the built-in webkit browser. However, it unfortunately lacks the ability to manually configure proxy settings through any sort of standard user interface. This is a common problem for Android, which also lacks the ability to set browser or system-wide proxy settings. To solve this problem, we have created a very simple Firefox add-on <a href="https://addons.mozilla.org/en-US/firefox/?browse=featured">Proxy Mobile</a> that exposes the Firefox browser&rsquo;s proxy settings through a simple, graphical options menu.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2010/11/proxymob.png"><img class="alignleft" src="https://guardianproject.info/wp-content/uploads/2010/11/proxymob-180x300.png" alt="proxymob" width="126" height="211" /></a></p> <p>This means any user can easily set the HTTP and SOCKS proxy settings for Firefox, enabling access to web browsing on networks which require a proxy to access the web. This also means that users can connect Firefox to Orbot on Android devices and browse the web using the <a href="https://torproject.org">Tor network </a>or any other HTTP or SOCKS proxy.</p> <h3 id="span-style-color-aa0000-simply-proxying-through-tor-is-not-the-same-as-the-full-a-href-https-www-torproject-org-projects-torbrowser-html-en-torbrowser-feature-set-a-and-does-not-provide-any-strong-anonymity-protections-against-directed-attacks-span"><span style="color: #aa0000;">Simply proxying through Tor is not the same as the full <a href="https://www.torproject.org/projects/torbrowser.html.en">TorBrowser feature set</a>, and does not provide any strong anonymity protections against directed attacks. </span></h3> <p>&nbsp;</p> <p>That said, there are many things you can do to configure Firefox for Android to be more privacy-preserving and secure.</p> <p>First, you will need to get Firefox for Android:</p> <ul> <li><strong><a href="https://play.google.com/store/apps/details?id=org.mozilla.firefox" rel="nofollow">Install Firefox from the Google Play Store</a></strong></li> <li>or go to <strong><a href="https://firefox.com/m" rel="nofollow">firefox.com/m</a></strong> in your phone&rsquo;s web browser.</li> <li>or download the Firefox APK file <strong><a href="https://ftp.mozilla.org/pub/mozilla.org/mobile/releases/latest/android/multi/" rel="nofollow">directly from the Mozilla FTP server</a></strong>.</li> </ul> <p>Then follow the 10 steps below to enhance your mobile web privacy!</p> <ol> <li>Use <a href="https://support.mozilla.org/en-US/kb/mobile-private-browsing-browse-web-without-saving-syncing-info">Mobile Private Browsing</a> which &ldquo;<strong>allows you to browse the internet without saving any information about which sites and pages you&rsquo;ve visited&rdquo;.</strong> Learn more in this <a href="https://support.mozilla.org/en-US/kb/mobile-private-browsing-browse-web-without-saving-syncing-info">detailed article</a>.</li> <li>Use the <a href="https://addons.mozilla.org/en-US/android/addon/phony/?src=hp-dl-featured">Phony Add-on</a> to change your user-agent, to impersonate a different mobile device or browser. <a href="https://addons.mozilla.org/en-US/android/addon/phony/?src=hp-dl-featured">INSTALL ADD-ON</a></li> <li>Use the <a href="https://addons.mozilla.org/en-US/android/addon/cleanquit/">Clean Quit Add-on</a> to ensure your browsing history, cookies and other data are deleted when you want them to be. <a href="https://addons.mozilla.org/en-US/android/addon/cleanquit/">INSTALL ADD-ON</a></li> <li>Use the <a href="https://addons.mozilla.org/en-US/android/addon/self-destructing-cookies/">Self-Destructing Cookies Add-on</a> to only keep cookies around as long as you need them. <a href="https://addons.mozilla.org/en-US/android/addon/self-destructing-cookies/">INSTALL ADD-ON</a></li> <li>In Firefox Settings, set &ldquo;Plugins&rdquo; to &ldquo;Disabled&rdquo; under the Content section.</li> <li>Under &ldquo;Privacy &amp; Security&rdquo;, set Cookies to &ldquo;Enabled, excluding 3rd Party&rdquo;</li> <li>Also under &rdquo;Privacy &amp; Security&rdquo;, set Tracking to &ldquo;Tell sites that I do not want to be tracked&rdquo;.</li> <li>If you want the browser to remember your passwords, make sure to &ldquo;Use master password&rdquo; to secure them.</li> <li>Switch your search engine to <a href="https://addons.mozilla.org/en-us/firefox/addon/duckduckgo-for-firefox/">DuckDuckGo</a> (a search engine that does not track) using their SSL mode search add-on. <a href="https://addons.mozilla.org/en-us/firefox/addon/duckduckgo-for-firefox/">INSTALL ADD-ON</a></li> <li>Obviously, if you haven&rsquo;t done so, already, install ProxyMob to proxy your traffic through Tor, protecting it from logging, interception and targeting. <a href="https://guardianproject.info/downloads/proxymob.xpi">INSTALL ADD-ON</a>. It requires that Tor is already running, so make sure to get <a href="https://guardianproject.info/apps/orbot">Orbot: Tor for Android</a> and turn it on. ProxyMob will have all of the settings configured automagically. To test that it&rsquo;s working, goto <a href="http://check.torproject.org/" target="_blank">check.torproject.org</a> and look for the congratulations message saying that it&rsquo;s configured properly.</li> </ol> <p><a href="https://guardianproject.info/wp-content/uploads/2010/11/privatebrowsing.png"><img class="alignleft" src="https://guardianproject.info/wp-content/uploads/2010/11/privatebrowsing-180x300.png" alt="privatebrowsing" width="126" height="210" /></a>  <a href="https://guardianproject.info/wp-content/uploads/2010/11/phony.png"><img class="alignleft" src="https://guardianproject.info/wp-content/uploads/2010/11/phony-180x300.png" alt="phony" width="126" height="210" /></a> <img class="wp-image-11589 alignleft" src="https://guardianproject.info/wp-content/uploads/2010/11/selfdestructingcookies-180x300.png" alt="selfdestructingcookies" width="126" height="210" srcset="https://guardianproject.info/wp-content/uploads/2010/11/selfdestructingcookies-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/11/selfdestructingcookies-614x1024.png 614w, https://guardianproject.info/wp-content/uploads/2010/11/selfdestructingcookies.png 768w" sizes="(max-width: 126px) 100vw, 126px" /><a href="https://guardianproject.info/wp-content/uploads/2010/11/duckduckgo.png"><img class="alignleft" src="https://guardianproject.info/wp-content/uploads/2010/11/duckduckgo-180x300.png" alt="duckduckgo" width="126" height="210" /></a><a href="https://guardianproject.info/wp-content/uploads/2010/11/cleanquit.png"><img class="alignleft" src="https://guardianproject.info/wp-content/uploads/2010/11/cleanquit-180x300.png" alt="cleanquit" width="126" height="210" /></a></p> <p>&nbsp;</p> <h3 id="how-to-contribute-alignnone">How to Contribute {.alignnone}</h3> <p>As with all of our work, this is open-source, and we encourage you to contribute to and improve upon what we&rsquo;ve done via our Github project: <a href="https://github.com/guardianproject/ProxyMob">https://github.com/guardianproject/ProxyMob</a></p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> https://guardianproject.info/archive/firefoxprivacy/ Mon, 15 Nov 2010 13:48:35 -0400 https://guardianproject.info/archive/firefoxprivacy/ <!--:--> <!--:en--> <p><strong>Fall 2016: We no longer promote the user of Firefox with add-ons, as the solution can be insecure still and easily misconfigured.</strong></p> <p>Please use our new <a href="https://guardianproject.info/apps/orfox/">Orfox browser for Android</a>, based on Tor Browser.</p> <hr /> <p>&nbsp;</p> <p><!--:de-->The latest releases of</p> <p><a href="https://www.mozilla.com/en-US/mobile/">Firefox on Android</a> are proving to be very usable, stable and an increasingly viable alternative to the built-in webkit browser. However, it unfortunately lacks the ability to manually configure proxy settings through any sort of standard user interface. This is a common problem for Android, which also lacks the ability to set browser or system-wide proxy settings. To solve this problem, we have created a very simple Firefox add-on <a href="https://addons.mozilla.org/en-US/firefox/?browse=featured">Proxy Mobile</a> that exposes the Firefox browser&rsquo;s proxy settings through a simple, graphical options menu.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2010/11/proxymob.png"><img class="alignleft" src="https://guardianproject.info/wp-content/uploads/2010/11/proxymob-180x300.png" alt="proxymob" width="126" height="211" /></a></p> <p>This means any user can easily set the HTTP and SOCKS proxy settings for Firefox, enabling access to web browsing on networks which require a proxy to access the web. This also means that users can connect Firefox to Orbot on Android devices and browse the web using the <a href="https://torproject.org">Tor network </a>or any other HTTP or SOCKS proxy.</p> <h3 id="span-style-color-aa0000-simply-proxying-through-tor-is-not-the-same-as-the-full-a-href-https-www-torproject-org-projects-torbrowser-html-en-torbrowser-feature-set-a-and-does-not-provide-any-strong-anonymity-protections-against-directed-attacks-span"><span style="color: #aa0000;">Simply proxying through Tor is not the same as the full <a href="https://www.torproject.org/projects/torbrowser.html.en">TorBrowser feature set</a>, and does not provide any strong anonymity protections against directed attacks. </span></h3> <p>&nbsp;</p> <p>That said, there are many things you can do to configure Firefox for Android to be more privacy-preserving and secure.</p> <p>First, you will need to get Firefox for Android:</p> <ul> <li><strong><a href="https://play.google.com/store/apps/details?id=org.mozilla.firefox" rel="nofollow">Install Firefox from the Google Play Store</a></strong></li> <li>or go to <strong><a href="https://firefox.com/m" rel="nofollow">firefox.com/m</a></strong> in your phone&rsquo;s web browser.</li> <li>or download the Firefox APK file <strong><a href="https://ftp.mozilla.org/pub/mozilla.org/mobile/releases/latest/android/multi/" rel="nofollow">directly from the Mozilla FTP server</a></strong>.</li> </ul> <p>Then follow the 10 steps below to enhance your mobile web privacy!</p> <ol> <li>Use <a href="https://support.mozilla.org/en-US/kb/mobile-private-browsing-browse-web-without-saving-syncing-info">Mobile Private Browsing</a> which &ldquo;<strong>allows you to browse the internet without saving any information about which sites and pages you&rsquo;ve visited&rdquo;.</strong> Learn more in this <a href="https://support.mozilla.org/en-US/kb/mobile-private-browsing-browse-web-without-saving-syncing-info">detailed article</a>.</li> <li>Use the <a href="https://addons.mozilla.org/en-US/android/addon/phony/?src=hp-dl-featured">Phony Add-on</a> to change your user-agent, to impersonate a different mobile device or browser. <a href="https://addons.mozilla.org/en-US/android/addon/phony/?src=hp-dl-featured">INSTALL ADD-ON</a></li> <li>Use the <a href="https://addons.mozilla.org/en-US/android/addon/cleanquit/">Clean Quit Add-on</a> to ensure your browsing history, cookies and other data are deleted when you want them to be. <a href="https://addons.mozilla.org/en-US/android/addon/cleanquit/">INSTALL ADD-ON</a></li> <li>Use the <a href="https://addons.mozilla.org/en-US/android/addon/self-destructing-cookies/">Self-Destructing Cookies Add-on</a> to only keep cookies around as long as you need them. <a href="https://addons.mozilla.org/en-US/android/addon/self-destructing-cookies/">INSTALL ADD-ON</a></li> <li>In Firefox Settings, set &ldquo;Plugins&rdquo; to &ldquo;Disabled&rdquo; under the Content section.</li> <li>Under &ldquo;Privacy &amp; Security&rdquo;, set Cookies to &ldquo;Enabled, excluding 3rd Party&rdquo;</li> <li>Also under &rdquo;Privacy &amp; Security&rdquo;, set Tracking to &ldquo;Tell sites that I do not want to be tracked&rdquo;.</li> <li>If you want the browser to remember your passwords, make sure to &ldquo;Use master password&rdquo; to secure them.</li> <li>Switch your search engine to <a href="https://addons.mozilla.org/en-us/firefox/addon/duckduckgo-for-firefox/">DuckDuckGo</a> (a search engine that does not track) using their SSL mode search add-on. <a href="https://addons.mozilla.org/en-us/firefox/addon/duckduckgo-for-firefox/">INSTALL ADD-ON</a></li> <li>Obviously, if you haven&rsquo;t done so, already, install ProxyMob to proxy your traffic through Tor, protecting it from logging, interception and targeting. <a href="https://guardianproject.info/downloads/proxymob.xpi">INSTALL ADD-ON</a>. It requires that Tor is already running, so make sure to get <a href="https://guardianproject.info/apps/orbot">Orbot: Tor for Android</a> and turn it on. ProxyMob will have all of the settings configured automagically. To test that it&rsquo;s working, goto <a href="http://check.torproject.org/" target="_blank">check.torproject.org</a> and look for the congratulations message saying that it&rsquo;s configured properly.</li> </ol> <p><a href="https://guardianproject.info/wp-content/uploads/2010/11/privatebrowsing.png"><img class="alignleft" src="https://guardianproject.info/wp-content/uploads/2010/11/privatebrowsing-180x300.png" alt="privatebrowsing" width="126" height="210" /></a>  <a href="https://guardianproject.info/wp-content/uploads/2010/11/phony.png"><img class="alignleft" src="https://guardianproject.info/wp-content/uploads/2010/11/phony-180x300.png" alt="phony" width="126" height="210" /></a> <img class="wp-image-11589 alignleft" src="https://guardianproject.info/wp-content/uploads/2010/11/selfdestructingcookies-180x300.png" alt="selfdestructingcookies" width="126" height="210" srcset="https://guardianproject.info/wp-content/uploads/2010/11/selfdestructingcookies-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/11/selfdestructingcookies-614x1024.png 614w, https://guardianproject.info/wp-content/uploads/2010/11/selfdestructingcookies.png 768w" sizes="(max-width: 126px) 100vw, 126px" /><a href="https://guardianproject.info/wp-content/uploads/2010/11/duckduckgo.png"><img class="alignleft" src="https://guardianproject.info/wp-content/uploads/2010/11/duckduckgo-180x300.png" alt="duckduckgo" width="126" height="210" /></a><a href="https://guardianproject.info/wp-content/uploads/2010/11/cleanquit.png"><img class="alignleft" src="https://guardianproject.info/wp-content/uploads/2010/11/cleanquit-180x300.png" alt="cleanquit" width="126" height="210" /></a></p> <p>&nbsp;</p> <h3 id="how-to-contribute-alignnone">How to Contribute {.alignnone}</h3> <p>As with all of our work, this is open-source, and we encourage you to contribute to and improve upon what we&rsquo;ve done via our Github project: <a href="https://github.com/guardianproject/ProxyMob">https://github.com/guardianproject/ProxyMob</a></p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> https://guardianproject.info/2010/11/10/seeking-slightly-paranoid-android-developers-for-hire-and-internships/ Wed, 10 Nov 2010 18:59:10 -0400 https://guardianproject.info/2010/11/10/seeking-slightly-paranoid-android-developers-for-hire-and-internships/ <p>The Guardian Project is kicking off a three month project focused on finishing up our secure chat app, codenamed <a href="https://guardianproject.info/apps/gibber">Gibber</a> but also known as “OtRChat”. We are looking for developers of all levels to join us in this work. We have already implemented the primary  <a href="http://www.cypherpunks.ca/otr/">“Off the Record” messaging</a> functionality, and achieved interoperability with desktop clients such as Pidgin and AdiumX. From here, there is work to be done on implementing some unique features, cleaning up the user experience, and ensuring that the implementation is as secure as possible, providing all the necessary features for verifying and managing secure identities and sessions.</p> <p>We have a few contract positions available, but are also looking for interns and students interested in getting real-world production development under their belt. <em>All in all, you should be keenly interested in work that strives to find the right balance of usability and security on mobile devices.</em></p> <p>If you are interested, please <a href="https://guardianproject.info/contact/join/">get in touch with us</a>, and we will go from there. We are looking for individuals or small teams. For the paid positions, we would expect you have at least one Android app released in public on the Android Market, and would prefer you have experience with open-source projects, as well. There is much more work to do beyond this specific app, but this is a good place to start. Work can be done anywhere, anytime, assuming your are familiar with the tools and culture of open-source+agile development.</p> <p>Below are some screenshots of the work so far. You can learn more and check out the source on the <a href="https://guardianproject.info/apps/gibber">Gibber app page</a>.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2010/06/account.jpg" title="account"><img class="alignleft" title="account" src="https://guardianproject.info/wp-content/uploads/2010/06/account-150x150.jpg" alt="account" width="150" height="150" /></a></p> <p><dt style="font-style: italic;"> </dt></p> <p><dt style="font-style: italic;"> </dt></p> <p><dt style="font-style: italic;"> </dt></p> <p><dt style="display: inline !important;"> <em><a title="contacts" href="https://guardianproject.info/wp-content/uploads/2010/06/contacts.jpg"><img class="alignleft" title="contacts" src="https://guardianproject.info/wp-content/uploads/2010/06/contacts-150x150.jpg" alt="contacts" width="150" height="150" /></a></em> </dt></p> <p><dt style="display: inline !important;"> <em><a title="secured" href="https://guardianproject.info/wp-content/uploads/2010/06/secured.jpg"><img class="alignleft" title="secured" src="https://guardianproject.info/wp-content/uploads/2010/06/secured-150x150.jpg" alt="secured" width="150" height="150" /></a></em> </dt></p> <p>__</p> <p style="font-style: italic;"> <em> </em> </p> <p>__</p> <p>__</p> https://guardianproject.info/2010/11/09/secured-t-mobile-mytouch-4g-gets-guardian/ Tue, 09 Nov 2010 23:26:59 -0400 https://guardianproject.info/2010/11/09/secured-t-mobile-mytouch-4g-gets-guardian/ <p>One of the services we provide at the Guardian Project is taking any off the shelf Android phone and setting it up to be generally more secure, privacy minded and updated with a powerful suite of trusted apps. Today we were excited to get our hands on a myTouch 4G, manufactured by HTC and sold by T-Mobile. Really beautiful piece of hardware, and once we got our hands on it, a powerhouse of encrypted, anonymous and circumventing communications.</p> <p>Brief list of our current trusted app suite (not all are open-source but they are tested/vetted as best we can otherwise): Orbot (Tor on Android), Firefox with ProxyMob add-on, TextSecure, OtRChat, RedPhone, SipDroid with VPN, DroidTracker, Norton Mobile Security Suite, Android Privacy Guard with K9Mail for GPG, OISafe and OINotes for locally encrypted data collection and more!</p> <p>All in all, through our own development work and the larger Android security community, things are really coming together. With hardware like the 4G, it can all be put into a shiny, blazing package.</p> <p><img style="display: block; margin-right: auto; margin-left: auto;" src="https://guardianproject.info/wp-content/uploads/2010/11/wpid-IMG_20101109_174732.jpg" alt="image" /></p> <p><img style="display: block; margin-right: auto; margin-left: auto;" src="https://guardianproject.info/wp-content/uploads/2010/11/wpid-IMG_20101109_174618.jpg" alt="image" /></p> https://guardianproject.info/2010/11/08/proxy-settings-add-on-for-firefox-mobile/ Mon, 08 Nov 2010 03:43:24 -0400 https://guardianproject.info/2010/11/08/proxy-settings-add-on-for-firefox-mobile/ <p>The latest beta of <a href="https://www.mozilla.com/en-US/mobile/">Firefox 4 on Android</a> is proving to be very usable, stable and an increasingly viable alternative to the built-in webkit browser. However, it is unfortunately lacking the ability to manually configure proxy settings through any sort of standard user interface. This is a common problem for Android, which also lacks the ability to set browser or system wide proxy settings. This has caused real issues for us with getting <a href="https://guardianproject.info/apps/orbot">Orbot</a> (aka “Tor on Android”) to work for un-rooted Android devices, because for routing through Tor to work, you must be able to set the HTTP or SOCKS proxy settings. Why this <a href="https://code.google.com/p/android/issues/detail?id=1273">very basic feature</a> keeps getting missed or ignored is a mystery to us.</p> <p>To solve this problem, we at the Guardian Project have created a very simple <a href="https://addons.mozilla.org/en-US/firefox/?browse=featured">Firefox add-on</a> which exposes the proxy settings through a simple, graphical options menu. This means any user can easily set the HTTP and SOCKS proxy settings for Firefox, enabling access to web browsing on networks which require a proxy to access the we. This also means, that users can connect Firefox to Orbot on Android 2.x devices and <a href="https://torproject.org">browse the web using the Tor</a>.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2010/11/fennecoptions.png"><img class="size-full wp-image-579 alignnone" title="fennecoptions" src="https://guardianproject.info/wp-content/uploads/2010/11/fennecoptions.png" alt="" width="792" height="499" srcset="https://guardianproject.info/wp-content/uploads/2010/11/fennecoptions.png 792w, https://guardianproject.info/wp-content/uploads/2010/11/fennecoptions-300x189.png 300w" sizes="(max-width: 792px) 100vw, 792px" /></a></p> <p><strong>However, it must be stressed that this not a full port of the <a href="http://www.torproject.org/torbutton/index.html.en">TorButton add-on</a>, and does not provide for strong anonymity.</strong></p> <p>We are working on porting TorButton to Firefox mobile, so stay tuned for that release. In addition, while there are <a href="https://addons.mozilla.org/en-US/firefox/search/?q=proxy&amp;cat=all&amp;lver=any&amp;pid=1&amp;sort=&amp;pp=20&amp;lup=&amp;advanced=">many, many Proxy add-ons for Firefox</a> on the desktop, none have been ported to mobile. We hope this small release will encourage one or more of them to port those add-ons to a mobile version. For now though, if you are eager to play and really need to access the web via a proxy, you can find the “ProxyMob” add-on at the following URL. Just navigate to this address from your Firefox mobile browser, and it will handle the add-on installation process:</p> <p><a href="http://tinyurl.com/proxymob">http://tinyurl.com/proxymob</a><br /> aka: <a href="https://guardianproject.info/downloads/proxymob-addon-0.0.5.xpi">https://guardianproject.info/downloads/proxymob-addon-0.0.5.xpi</a> (<a href="https://guardianproject.info/downloads/proxymob-addon-0.0.5.xpi.asc">gpg sig</a>)</p> <p>As with all of our work, this is open-source, and we encourage you to contribute to and improve upon what we’ve done via our Github project: <a href="https://github.com/guardianproject/ProxyMob">https://github.com/guardianproject/ProxyMob</a></p> https://guardianproject.info/archive/onionkit/ Thu, 07 Oct 2010 21:11:55 -0400 https://guardianproject.info/archive/onionkit/ <h1 id="a-style-font-size-13px-href-https-github-com-guardianproject-onionkit-https-github-com-guardianproject-onionkit-a"><a style="font-size: 13px;" href="https://github.com/guardianproject/onionkit"><a href="https://github.com/guardianproject/onionkit">https://github.com/guardianproject/onionkit</a></a></h1> <p>This is an Android Library Project that provides multiple means to improve network security in mobile applications. The &ldquo;Onion&rdquo; name refers to not only the Onion Routing concept used by Tor (which provides anonymity and resistance to traffic surveillance), but also the idea of multiple layers of security that any application should utilize.</p> <p>More specifically this library provides:</p> <ol> <li>StrongTrustManager: a robust implementation of an TLS/SSL certificate verifier, that can be customized with any set of certificate authorities</li> <li>Proxied Connection Support: HTTP and SOCKS proxy connection support for HTTP and HTTP/S traffic through specific configuration of the Apache HTTPClient library</li> <li>OrbotHelper: a utility class to support application integration with Orbot: Tor for Android. Check if its installed, running, etc.</li> </ol> <p>IT MUST BE NOTED, that you can use this library without using Orbot/Tor, but obviously we think using strong TLS/SSL connections over Tor is just about the best thing in the world.</p> <p>&nbsp;</p> <h1 id="a-href-https-github-com-guardianproject-onionkit-strongtrustmanager-name-strongtrustmanager-a-strongtrustmanager"><a href="https://github.com/guardianproject/onionkit#strongtrustmanager" name="strongtrustmanager"></a>StrongTrustManager</h1> <p>We have implemented a TrustManager for SSL Certificate verification that we believe is better than the default one provided by Android. For app developers, it provides for a consistent implementation of TLS/SSL verification and trust across various versions and devices.</p> <p>It supports full chain verification, limited pinning, and a custom cacerts store based on the Debian set of certs. By providing our own cacert store, we can be assured that certificates are being validated against a known set of trusted Roots, and not compromised, expired or other non-desireable entities.</p> <p>Developers can create their own CACert store using the information provided by our CACertMan project:<a href="https://github.com/guardianproject/cacert">https://github.com/guardianproject/cacert</a></p> <p>It can be used in combination with the MemorizingTrustManager, to support user prompted override for non-validating certificates.</p> <h1 id="a-href-https-github-com-guardianproject-onionkit-proxied-connections-aka-orlib-name-proxied-connections-aka-orlib-a-proxied-connections-aka-orlib"><a href="https://github.com/guardianproject/onionkit#proxied-connections-aka-orlib" name="proxied-connections-aka-orlib"></a>Proxied Connections (aka Orlib)</h1> <p>Once Orbot connects successfully to the Tor network, it offers two proxy servers running on localhost that applications can route their traffic through.</p> <p>HTTP Proxy: localhost:8118 SOCKS ⁴&frasl;₅ Proxy: localhost:9050</p> <p>The sample project shows the basics of how to use this library to open sockets and make HTTP requests via the SOCKS and HTTP proxies available from Orbot The standard Apache HTTPClient libraries provide calls to setup proxying. This sample code demonstrates that. All applications using the SOCKS proxy should not resolve their DNS locally, and instead should pass the hostnames through the SOCKS proxy.</p> <h1 id="a-href-https-github-com-guardianproject-onionkit-orbot-helper-name-orbot-helper-a-orbot-helper"><a href="https://github.com/guardianproject/onionkit#orbot-helper" name="orbot-helper"></a>Orbot Helper</h1> <p>Provides simple helper to check if Orbot (Tor for Android) is installed, and whether it is currently running or not. Allows your app to request Orbot to start (user is prompted whether to start or not). Finally, it can show a user prompt to install Orbot, either from Google Play, or via direct APK download from torproject.org or the guardianproject.info site.</p> <p>For apps with on-device servers, it can also assists in requesting a Tor Hidden Service from Orbot, and discovering the assigned .ONION address.</p> <h1 id="a-href-https-github-com-guardianproject-onionkit-strongtrustmanager-name-strongtrustmanager-a"><a href="https://github.com/guardianproject/onionkit#strongtrustmanager" name="strongtrustmanager"></a></h1> <h1 id="a-href-https-github-com-guardianproject-onionkit-proxied-connections-aka-orlib-name-proxied-connections-aka-orlib-a"><a href="https://github.com/guardianproject/onionkit#proxied-connections-aka-orlib" name="proxied-connections-aka-orlib"></a></h1> <h1 id="a-href-https-github-com-guardianproject-onionkit-orbot-helper-name-orbot-helper-a"><a href="https://github.com/guardianproject/onionkit#orbot-helper" name="orbot-helper"></a></h1> https://guardianproject.info/archive/onionkit/ Thu, 07 Oct 2010 21:11:55 -0400 https://guardianproject.info/archive/onionkit/ <h1 id="a-style-font-size-13px-href-https-github-com-guardianproject-onionkit-https-github-com-guardianproject-onionkit-a"><a style="font-size: 13px;" href="https://github.com/guardianproject/onionkit"><a href="https://github.com/guardianproject/onionkit">https://github.com/guardianproject/onionkit</a></a></h1> <p>This is an Android Library Project that provides multiple means to improve network security in mobile applications. The &ldquo;Onion&rdquo; name refers to not only the Onion Routing concept used by Tor (which provides anonymity and resistance to traffic surveillance), but also the idea of multiple layers of security that any application should utilize.</p> <p>More specifically this library provides:</p> <ol> <li>StrongTrustManager: a robust implementation of an TLS/SSL certificate verifier, that can be customized with any set of certificate authorities</li> <li>Proxied Connection Support: HTTP and SOCKS proxy connection support for HTTP and HTTP/S traffic through specific configuration of the Apache HTTPClient library</li> <li>OrbotHelper: a utility class to support application integration with Orbot: Tor for Android. Check if its installed, running, etc.</li> </ol> <p>IT MUST BE NOTED, that you can use this library without using Orbot/Tor, but obviously we think using strong TLS/SSL connections over Tor is just about the best thing in the world.</p> <p>&nbsp;</p> <h1 id="a-href-https-github-com-guardianproject-onionkit-strongtrustmanager-name-strongtrustmanager-a-strongtrustmanager"><a href="https://github.com/guardianproject/onionkit#strongtrustmanager" name="strongtrustmanager"></a>StrongTrustManager</h1> <p>We have implemented a TrustManager for SSL Certificate verification that we believe is better than the default one provided by Android. For app developers, it provides for a consistent implementation of TLS/SSL verification and trust across various versions and devices.</p> <p>It supports full chain verification, limited pinning, and a custom cacerts store based on the Debian set of certs. By providing our own cacert store, we can be assured that certificates are being validated against a known set of trusted Roots, and not compromised, expired or other non-desireable entities.</p> <p>Developers can create their own CACert store using the information provided by our CACertMan project:<a href="https://github.com/guardianproject/cacert">https://github.com/guardianproject/cacert</a></p> <p>It can be used in combination with the MemorizingTrustManager, to support user prompted override for non-validating certificates.</p> <h1 id="a-href-https-github-com-guardianproject-onionkit-proxied-connections-aka-orlib-name-proxied-connections-aka-orlib-a-proxied-connections-aka-orlib"><a href="https://github.com/guardianproject/onionkit#proxied-connections-aka-orlib" name="proxied-connections-aka-orlib"></a>Proxied Connections (aka Orlib)</h1> <p>Once Orbot connects successfully to the Tor network, it offers two proxy servers running on localhost that applications can route their traffic through.</p> <p>HTTP Proxy: localhost:8118 SOCKS ⁴&frasl;₅ Proxy: localhost:9050</p> <p>The sample project shows the basics of how to use this library to open sockets and make HTTP requests via the SOCKS and HTTP proxies available from Orbot The standard Apache HTTPClient libraries provide calls to setup proxying. This sample code demonstrates that. All applications using the SOCKS proxy should not resolve their DNS locally, and instead should pass the hostnames through the SOCKS proxy.</p> <h1 id="a-href-https-github-com-guardianproject-onionkit-orbot-helper-name-orbot-helper-a-orbot-helper"><a href="https://github.com/guardianproject/onionkit#orbot-helper" name="orbot-helper"></a>Orbot Helper</h1> <p>Provides simple helper to check if Orbot (Tor for Android) is installed, and whether it is currently running or not. Allows your app to request Orbot to start (user is prompted whether to start or not). Finally, it can show a user prompt to install Orbot, either from Google Play, or via direct APK download from torproject.org or the guardianproject.info site.</p> <p>For apps with on-device servers, it can also assists in requesting a Tor Hidden Service from Orbot, and discovering the assigned .ONION address.</p> <h1 id="a-href-https-github-com-guardianproject-onionkit-strongtrustmanager-name-strongtrustmanager-a"><a href="https://github.com/guardianproject/onionkit#strongtrustmanager" name="strongtrustmanager"></a></h1> <h1 id="a-href-https-github-com-guardianproject-onionkit-proxied-connections-aka-orlib-name-proxied-connections-aka-orlib-a"><a href="https://github.com/guardianproject/onionkit#proxied-connections-aka-orlib" name="proxied-connections-aka-orlib"></a></h1> <h1 id="a-href-https-github-com-guardianproject-onionkit-orbot-helper-name-orbot-helper-a"><a href="https://github.com/guardianproject/onionkit#orbot-helper" name="orbot-helper"></a></h1> https://guardianproject.info/2010/09/30/open-video-conference-panel-and-hackday/ Thu, 30 Sep 2010 02:00:07 -0400 https://guardianproject.info/2010/09/30/open-video-conference-panel-and-hackday/ <p>Nathan Freitas will be on a panel at the 2nd annual <a href="http://www.openvideoconference.org/">Open Video Conference</a> in New York this Friday and Saturday. He will be on the panel entitled “Cameras Everywhere” led by our partners at <a href="https://www.witness.org">Witness</a>, on Saturday at 3pm.</p> <blockquote> <p><strong>Summary</strong>: Cameras Everywhere: Human Rights and Web Video – (<em>2:45 PM – 3:30 PM</em>)</p> <p><strong>Description</strong>: Once upon a time, video cameras were rare. Now they are ubiquitous—as are the opportunities to share, use, and re-use video. What are the limits and possibilities of an ethics of openness when it comes to human rights footage?</p> <p>Videos (particularly mobile and online video) make it possible to document and publicize human rights struggles – from monks marching for freedom in Rangoon and Lhasa, and the election protestors in Tehran, to individual voices speaking out against injustice on YouTube and other online spaces. But despite the growing circulation of images of human rights violations, of victims and survivors, there is limited discussion of crucial safety, consent and ethical concerns – particularly for people who are filmed.</p> <p>Issues around consent, representation and re-victimization and retaliation have emerged even more clearly in an open and networked online environment, as have concerns about intentionality and authenticity. Video is being reworked, remixed and recirculated by many more people. New possibilities for action by a global citizenry have arisen, but these carry with them substantial challenges, opportunities and dangers.</p> <p>Presenters:<br /> Sam Gregory — WITNESS<br /> Gabriella Coleman — NYU<br /> Nathan Freitas — The Guardian Project<br /> Steve Grove – News and Politics, YouTube</p> </blockquote> <p>Following the panel, there will be an open workshop, to continue the discussion and brainstorm new approaches and tools to address the issues raised. This feedback will be gathered and fed into the <a href="http://www.openvideoconference.org/hacklabs/">OVC Hackday</a>, held at <a href="http://itp.nyu.edu">NYU ITP</a> on Sunday. Team Guardian will join in with whoever shows up at the hackday, take the ideas from the previous day, and build prototyped mobile video solutions in response to them.</p> <p>You can get more information and register for the hackday here: <a href="http://www.openvideoconference.org/hacklabs/">http://www.openvideoconference.org/hacklabs/</a></p> <blockquote> <p>OVC hack labs: Sunday, October 3</p> <p>Join us at NYU’s Interactive Telecommunications Program for an all-day open space gathering for innovators of all stripes. Meet and collaborate with conference attendees, HTML5 developers, transmedia storytelling experts, and more. Among the planned activities:</p> <p>Make interactive HTML5 video using WebMadeMovies technology like popcorn.js<br /> Map out a transmedia strategy for your content<br /> Build a custom HTML5 player for your site<br /> Create robust video sites using the free+open source Kaltura CE 2.0 self-hosted software stack<br /> or just grab a room and hack on your project!</p> <p>OVC hack labs are free and open to the public.</p> </blockquote> https://guardianproject.info/2010/09/23/orbot-release-1.0-in-the-android-market/ Thu, 23 Sep 2010 22:21:06 -0400 https://guardianproject.info/2010/09/23/orbot-release-1.0-in-the-android-market/ <p>It’s here! We’d like to officially announce the release of <a href="https://guardianproject.info/apps/orbot/">Orbot</a> to the Android Market. After <a href="https://guardianproject.info/2010/03/04/orbot-goes-beta/">going beta</a> back in March, we’ve seriously re-doubled our efforts for this release. By releasing Orbot to the Android Market, we suspect that our user base will eventually evolve towards the more ‘every day’ Android user – so our goal has been to create an experience that is simple yet informative, straightforward yet powerful. As a step towards that goal, we’ve spent some time creating a new <a href="https://guardianproject.info/2010/07/29/orbot-update-new-setup-wizard-at-startup/">setup wizard at Orbot start-up</a> that walks you through the basics of what Orbot does and does not do. The last thing we want is for someone to be endangered because they didn’t understand how to protect themselves.</p> <p>We’ve also spent the time fixing bugs, patching potential security holes, and bringing a bunch of new features to Orbot, including:</p> <ul> <li>‘Start on boot’ option &lt;– set to ‘on’ by default</li> <li><span style="font-size: 13.1944px;">Support for Hidden Services (!!)</span></li> <li><span style="font-size: 13.1944px;">Re-designed per-app torification and application settings</span></li> <li><span style="font-size: 13.1944px;">Easy access to the official Tor ‘check’ site through application menu</span></li> <li><span style="font-size: 13.1944px;">…not to mention a complete application architecture overhaul! (hopefully translating to increased stability)</span></li> </ul> <p>We’re especially excited about Hidden Services support in this release, and we’ve been hacking away at a proof of concept application that shows how powerful this tool can become – hopefully we will be posting about it soon.</p> <p>So now for the juicy stuff. Grab the 1.0 release from the doubletwist Android web app store <a href="http://www.doubletwist.com/apps/android/orbot-tor-on-android/-8175007413332940359">here</a>, by scanning the QR Code below, or just searching the Market for ‘Orbot.’</p> <p><a href="https://guardianproject.info/wp-content/uploads/2010/09/qr_orbot.png"><img class="aligncenter size-full wp-image-526" title="qr_orbot" src="https://guardianproject.info/wp-content/uploads/2010/09/qr_orbot.png" alt="" width="135" height="135" srcset="https://guardianproject.info/wp-content/uploads/2010/09/qr_orbot.png 135w, https://guardianproject.info/wp-content/uploads/2010/09/qr_orbot-64x64.png 64w" sizes="(max-width: 135px) 100vw, 135px" /></a><br /> If you’re new to the Guardian Project, we’d like to make sure you know that all of our official builds are available from the Tor <a href="http://www.torproject.org/dist/android/">website</a>. We’re also proud to be an open-source project – if you’d like to read more about Orbot or would like to reproduce our builds from source, check out the <a href="https://svn.torproject.org/svn/projects/android/trunk/Orbot/">subversion repository</a>.</p> <p>As always we’d like to thank the dedicated team of developers, testers and enthusiasts that have provided feedback throughout Orbot’s development. We’ve tested on Android 1.x and 2.x devices such as the MyTouch, Nexus One and Motorola Droid [we also did port to a Nook 😉 ] – so we’d love to get feedback on performance and functionality on any and all of the ever growing family of Android devices. Please report bugs and feedback <a href="https://trac.torproject.org/projects/tor">here</a>.</p> https://guardianproject.info/2010/07/29/orbot-update-new-setup-wizard-at-startup/ Thu, 29 Jul 2010 17:17:08 -0400 https://guardianproject.info/2010/07/29/orbot-update-new-setup-wizard-at-startup/ <p>We’ve been working away at the 0.0.9 release of <a href="https://guardianproject.info/apps/orbot">Orbot</a> over the last few months, and have put a decent amount of effort into usability. Specifically, we hoped to better communicate to users what it means to run Tor on your Android phone. In addition, we wanted to clearly lay out how the various configuration options help to improve your mobile web anonymity and ability to circumvent web filters and tracking by your mobile service provider.</p> <p>The screenshots below are what you see the first time you install and run Orbot, and also whenever you open the “Help” menu. One important thing to point out is that Orbot can run with or without root, and our setup UI responds to having the capability or not accordingly.</p> <p>Ultimately our goal is to provide a useful bootstrap experience for novice and advanced users alike. We welcome your feedback.</p> <div id='gallery-3' class='gallery galleryid-488 gallery-columns-3 gallery-size-thumbnail'> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2010/07/orbot-1.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/07/orbot-1-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-3-489" srcset="https://guardianproject.info/wp-content/uploads/2010/07/orbot-1-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2010/07/orbot-1-64x64.png 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-3-489'> permissions… we actually will only be asking for INTERNET – so don’t mind the “phone status” permission </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2010/07/orbot-2.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/07/orbot-2-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-3-490" srcset="https://guardianproject.info/wp-content/uploads/2010/07/orbot-2-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2010/07/orbot-2-64x64.png 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-3-490'> Your basic install screen </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2010/07/orbot-3.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/07/orbot-3-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-3-491" srcset="https://guardianproject.info/wp-content/uploads/2010/07/orbot-3-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2010/07/orbot-3-64x64.png 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-3-491'> A friendly welcome </dd> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2010/07/orbot-4.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/07/orbot-4-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-3-492" srcset="https://guardianproject.info/wp-content/uploads/2010/07/orbot-4-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2010/07/orbot-4-64x64.png 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-3-492'> About Orbot! </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2010/07/orbot-5.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/07/orbot-5-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-3-493" srcset="https://guardianproject.info/wp-content/uploads/2010/07/orbot-5-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2010/07/orbot-5-64x64.png 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-3-493'> we ask nicely to get root permissions, if possible </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2010/07/orbot-7.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/07/orbot-7-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-3-495" srcset="https://guardianproject.info/wp-content/uploads/2010/07/orbot-7-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2010/07/orbot-7-64x64.png 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-3-495'> if the user doesn’t have root, we make sure they understand the implications </dd> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2010/07/orbot-8.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/07/orbot-8-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-3-496" srcset="https://guardianproject.info/wp-content/uploads/2010/07/orbot-8-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2010/07/orbot-8-64x64.png 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-3-496'> Offer direct downloads of Orbot/Tor enabled apps </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2010/07/orbot-9.5.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/07/orbot-9.5-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-3-497" srcset="https://guardianproject.info/wp-content/uploads/2010/07/orbot-9.5-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2010/07/orbot-9.5-64x64.png 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-3-497'> (Root only) choose whether to “Torify All” or choose app by app </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2010/07/orbot-9.6.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/07/orbot-9.6-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-3-498" srcset="https://guardianproject.info/wp-content/uploads/2010/07/orbot-9.6-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2010/07/orbot-9.6-64x64.png 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-3-498'> (Root only) Select to send all network traffic through Tor </dd> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2010/07/orbot-9.7.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/07/orbot-9.7-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-3-499" srcset="https://guardianproject.info/wp-content/uploads/2010/07/orbot-9.7-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2010/07/orbot-9.7-64x64.png 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-3-499'> (Root only) Select which apps you want to route through Tor </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2010/07/orbot-9.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/07/orbot-9-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-3-500" srcset="https://guardianproject.info/wp-content/uploads/2010/07/orbot-9-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2010/07/orbot-9-64x64.png 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-3-500'> This is the final step </dd> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2010/07/orbot-10.png'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/07/orbot-10-150x150.png" class="attachment-thumbnail size-thumbnail" alt="" aria-describedby="gallery-3-501" srcset="https://guardianproject.info/wp-content/uploads/2010/07/orbot-10-150x150.png 150w, https://guardianproject.info/wp-content/uploads/2010/07/orbot-10-64x64.png 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> <dd class='wp-caption-text gallery-caption' id='gallery-3-501'> We’ve got root! </dd> </dl> <br style="clear: both" /> </div> https://guardianproject.info/2010/07/13/calling-all-guardians-alpha-testers-needed/ Tue, 13 Jul 2010 20:50:31 -0400 https://guardianproject.info/2010/07/13/calling-all-guardians-alpha-testers-needed/ <p>Recently here at the Guardian Project we’ve been brainstorming &amp; designing a new tool that we think will be core to enabling truly protected mobile communications . We think it will a big step in improving the user-friendliness of making your communications secure, anonymous and private , but we need your help to make it great.</p> <p>While it may give some of us a certain satisfaction to manually cobble together a suite of secure applications that suites our needs, this is by no means a long-term, wider-market solution. The tech community often forget (willfully or otherwise) that there is a huge group of non tech-savvy users for whom security and privacy are top level priorities. The ability to secure ones mobile communications should be accessible to all, through a solution that is beautiful, engaging and idiot-proof in its design. As we try to build that solution, we’re looking for your help in making sure that it meets each of those criteria.</p> <p>As an alpha tester, your job will be to help us shape the product. We’ll want to know everything about your mobile device(s), how you use them to communicate,  what concerns you have about privacy, and how you interact with the products we’re building. In turn we’ll provide you with expert assistance and knowledge about mobile privacy. You’ll get the latest glimpses at our designs and beta versions of our component applications. You will live and breathe mobile anonymity (if you so choose), and you’ll play a key role in defining the future of Guardian.</p> <p>Prerequisites:</p> <ul> <li>Has Android mobile device(s)</li> <li>Highly invested in mobile privacy</li> <li>Willing to regularly engage with the Guardian team through phone calls, online forums &amp; surveys, etc. (at least once per week)</li> <li>Preferably a part of an organization &gt;3 people also matching the above criteria</li> </ul> <p>If this sounds like you, we want to hear from you. Fill out a quick contact form <a href="https://guardianproject.info/contact/alpha-testers-apply-here/">here</a>.</p> https://guardianproject.info/2010/07/09/how-to-lockdown-your-mobile-e-mail/ Fri, 09 Jul 2010 11:00:25 -0400 https://guardianproject.info/2010/07/09/how-to-lockdown-your-mobile-e-mail/ <p><strong>Update 2015-04-27</strong>: _We now recommend <a href="http://www.openkeychain.org/" target="_blank">OpenKeychain</a> over APG, the app described in this blog post. The set up is drastically easier, so you probably don’t even need this HOWTO anymore. Start by downloading K-9 and <a href="http://www.openkeychain.org/" target="_blank">OpenKeychain</a>, then go into OpenKeychain and start the config there._</p> <p>Over the past few years it’s become <a href="https://www.youtube.com/watch?v=Gm8NdNy4wOM">increasingly popular</a> to sound the call that ‘<a href="http://www.pcmag.com/article2/0,2817,2343209,00.asp" title="dead">email is dead</a>{#y8a0}.’ And while many complementary forms of synchronous and asynchronous communication – from IM to social networking – have evolved since email first came on the scene, it’s hard to see email suddenly disappearing from its role as the most important way organizations communicate. I expect to be scooting around on my <a href="https://en.wikipedia.org/wiki/Hoverboard">hoverboard</a> by the time email goes the way of the dinosaur.</p> <p>Unfortunately, many of the protocols involved in sending and receiving e-mail are not considered secure – in the sense that they are vulnerable to eavesdropping. Simple Mail Transport Protocol (SMTP) – the Internet standard for e-mail transmission across IP networks  most commonly used by client applications for sending messages to a mail server for relaying – is typically implemented without any type of transport encryption. Internet Message Access Protocol (IMAP) and Post Office Protocol (POP) suffer from the same eavesdropping issues as SMTP when implemented without transport encryption. Even when SMTP is implemented with transport encryption it does not, by default, require the authentication of e-mail message senders. As a result, mail servers cannot be sure that the senders of messages are really who they claim to be. And even though POP and IMAP require users to authenticate, messages are sent and delivered using SMTP.</p> <p>The result is a situation where the <em>recipient</em> of an e-mail message can be positively identified but the <em>sender</em> cannot. Along with the eavesdropping concerns mentioned at the top of the paragraph, this is an alarming state of affairs. Imagine if the same were true of snail mail – there would be rioting in the streets! Fortunately there has been a lot of great work done to combat these fears – the main issue being that the problem itself is  still one  that is often ignored or not fully understood by the layperson. As secure solutions for mobile platforms gain momentum, we’re hoping to change things.</p> <p>Enter <a href="https://en.wikipedia.org/wiki/Pretty_Good_Privacy#OpenPGP">OpenPGP</a>, an IETF standard for encryption and decryption of data. The version of OpenPGP that exists today is the evolution of PGP, which was created in 1991 as a means for secure BBSs communication and message storage (it ironically also stands for “Pretty Good Privacy”). Why do you need PGP? In the words of its inventory, Phil Zimmerman: “<a href="http://www.spectacle.org/795/byzim.html">It empowers people to take their privacy into their own hands</a>.” How it works is a whole other story – one too complex for the purposes of this posting – but we’ll do our  best to scrape the surface quickly. Disclaimer: The following is meant solely as an introduction. There are many people out there who are experts in these topics, and we welcome any and all comments – especially if we misstate or misrepresent anything!</p> <p>PGP uses a serial combination of hashing, data compression, symmetric-key cryptography, and, finally, public-key cryptography. From the user’s perspective, it creates two <a href="https://en.wikipedia.org/wiki/Cryptographic_key">cryptographic keys</a> to encrypt and decrypt data. The first of these two is called the <a href="https://en.wikipedia.org/wiki/Public-key">Public Key</a> – which can be freely shared with anyone the user wishes and is used by others to encrypt data so that it can be decrypted by <strong>only the intended recipient</strong>. The second key is the Private Key, which should be kept as private and safe as possible. It is used to decrypt data that has been encrypted using a specific Public Key. As long as the Private Key is kept secret, only the owner is  able to decrypt data that has been encrypted with a Public Key. One problem with older methods of encryption was the relative ease with which codes could be broken. With increasingly powerful computers that are able to crack codes via pure ‘brute force,’ encoding methods must be incredibly complex to stand up. To combat this, PGP uses a key that is astronomically large,  meaning that the security of PGP encryption lies entirely with the key as opposed to keeping the method for key generation a secret. In fact, the methods that PGP encryption uses are known and widely documented. In addition, the size of keys can be increased whenever necessary to stay one step ahead of technological advances. And for the time being, each of the algorithms in current use by PGP is not known to have cryptanalytic weaknesses.</p> <p>So how secure does this make your information? Italian Police, the <a href="http://www.pcworld.com/article/110841/pgp_encryption_proves_powerful.html">FBI</a>, and <a href="http://www.theregister.co.uk/2007/11/14/ripa_encryption_key_notice/">British police</a> have been unable to crack its security and have resorted to demanding private keys. It’s been likened as “the closest you’re likely to get to military-grade encryption” by cryptographer <a href="https://en.wikipedia.org/wiki/Bruce_Schneier">Bruce Schneier</a>. Short answer: pretty darn good, as long as you guard your private key wisely.</p> <p>You’ve probably guessed by now that the reason for this posting is to show you how to effectively use OpenPGP to secure your mobile email. And while we would’ve loved to just jump right into the tutorial, there are a few more things you should know first. <a href="https://code.google.com/p/android-privacy-guard/" title="Android Privacy Guard">Android Privacy Guard</a>{#udlg} (or APG for short), is a first step at bringing <a href="https://en.wikipedia.org/wiki/Pretty_Good_Privacy" title="PGP">OpenPGP</a>{#qtjc} to the Android platform, letting you manage OpenPGP keys directly from your Android phone – and use them to encrypt, sign and decrypt emails and files. <a href="http://groups.google.com/group/k-9-mail/browse_thread/thread/921051bc0a61ed0b/d6085b925805ebf2?lnk=raot">Very recently</a> the teams behind APG and the popular, open-source Android email client <a href="https://code.google.com/p/k9mail/">K-9 Mail</a> have joined forces in a limited edition <a href="https://en.wikipedia.org/wiki/Marvel_Team-Up">team-up</a> to create a beta version of K-9 that plays nice with APG quite seamlessly. We’ve been using it as our default email solution at Guardian for weeks now and want to share it with you!</p> <p><strong>Note:</strong> Currently APG only supports importing and deleting keys – not generating them – so you’ve got to use a desktop implementation of OpenPGP (such as <a href="http://www.gnupg.org/" title="GNU Privacy Guard">GNU Privacy Guard</a>{#vrm_}) to actually generate your keypair if you don’t already have one. A number of front-end applications and libraries are available to perform this task. If you already have a keypair set up, you should skip the first step.</p> <p style="padding-left: 30px;"> <strong>1. Download and Install GnuPG Generate an OpenPGP keypair</strong> </p> <p style="padding-left: 30px;"> Install GnuPG  <a href="http://www.gnupg.org/download.html">here</a>. There are binaries available for <a href="http://www.gnupg.org/download/supported_systems.en.html">whatever OS flavor</a> you prefer, and since they do a great job of making documentation and <a href="http://www.dewinter.com/gnupg_howto/english/GPGMiniHowto.html">How-To Guides</a> available, we’ll skip the part where we reinvent the wheel. </p> <p style="padding-left: 30px;"> <strong>2. Generate and export your keypair</strong> </p> <p style="padding-left: 30px;"> Follow the instructions <a href="http://www.dewinter.com/gnupg_howto/english/GPGMiniHowto-3.html#ss3.1">here</a> to create a new keypair. <a href="http://www.dewinter.com/gnupg_howto/english/GPGMiniHowto-3.html#ss3.2">Export</a> your public and private keys (re-direct from stdout to a file) and stick that file on your Android device’s SD card. Usually it’s best to create a new folder /APG to keep things organized, especially if your SD card is a mess like ours 🙂 </p> <p style="padding-left: 30px;"> <strong>3. Download APG and import your keys</strong> </p> <p style="padding-left: 30px;"> <strong> </strong>If you don’t already have it, download Android Privacy Guard from its repository <a href="https://code.google.com/p/android-privacy-guard/downloads/list">here</a> or point your barcode scanner to the QR code below. You can also find it on the Market if you prefer. </p> <p style="padding-left: 30px;"> <span style="line-height: 1px; font-size: 13.2px;"> </span> </p> <p style="padding-left: 30px; text-align: center;"> <a href="https://guardianproject.info/wp-content/uploads/2010/06/qrcode_apg.png"><img class="size-full wp-image-385 aligncenter" title="qrcode_apg" src="https://guardianproject.info/wp-content/uploads/2010/06/qrcode_apg.png" alt="" width="120" height="120" srcset="https://guardianproject.info/wp-content/uploads/2010/06/qrcode_apg.png 120w, https://guardianproject.info/wp-content/uploads/2010/06/qrcode_apg-64x64.png 64w" sizes="(max-width: 120px) 100vw, 120px" /></a> </p> <p style="padding-left: 30px;"> Fire up APG and select ‘Manage Public Keys’ from the menu: </p> <p style="padding-left: 30px; text-align: center;"> <a href="https://guardianproject.info/wp-content/uploads/2010/06/apg_menu1.png"><img class="size-medium wp-image-390 aligncenter" title="apg_menu" src="https://guardianproject.info/wp-content/uploads/2010/06/apg_menu1-180x300.png" alt="" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/06/apg_menu1-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/06/apg_menu1.png 480w" sizes="(max-width: 180px) 100vw, 180px" /></a> </p> <p style="padding-left: 30px; text-align: center;"> <p style="padding-left: 30px;"> From the ‘Manage Public Keys’ screen, select ‘Import Keys’: </p> <p><p style="padding-left: 30px; text-align: center;"> <a href="https://guardianproject.info/wp-content/uploads/2010/06/apg_manage_public_keys_blur.png"><img class="size-medium wp-image-391 aligncenter" title="apg_manage_public_keys_blur" src="https://guardianproject.info/wp-content/uploads/2010/06/apg_manage_public_keys_blur-180x300.png" alt="" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/06/apg_manage_public_keys_blur-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/06/apg_manage_public_keys_blur.png 480w" sizes="(max-width: 180px) 100vw, 180px" /></a> </p></p> <p><p style="padding-left: 30px;"> <p style="padding-left: 30px;"> From the popup dialog, select the public key that you’ve transferred to your SD card. It’s helpful to use a file browser program like Astro File Manager if you don’t already have it installed: </p></p> <pre><code>&lt;p style=&quot;padding-left: 30px; text-align: center;&quot;&gt; &lt;span style=&quot;line-height: 8px;&quot;&gt;&lt;a href=&quot;https://guardianproject.info/wp-content/uploads/2010/06/apg_import_keys_blur.png&quot;&gt;&lt;img class=&quot;size-medium wp-image-392 aligncenter&quot; title=&quot;apg_import_keys_blur&quot; src=&quot;https://guardianproject.info/wp-content/uploads/2010/06/apg_import_keys_blur-180x300.png&quot; alt=&quot;&quot; width=&quot;180&quot; height=&quot;300&quot; srcset=&quot;https://guardianproject.info/wp-content/uploads/2010/06/apg_import_keys_blur-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/06/apg_import_keys_blur.png 480w&quot; sizes=&quot;(max-width: 180px) 100vw, 180px&quot; /&gt;&lt;/a&gt;&lt;/span&gt; &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; Once your public key(s) are successfully imported, return to the main APG menu, select ‘Manage Secret Keys’ and repeat the steps above for your Private Key. &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; &lt;strong&gt;4. Download and Configure K-9 Mail&lt;/strong&gt; &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; Download the latest version of K-9 mail featuring APG integration. You can find it on the Downloads page &lt;a href=&quot;https://code.google.com/p/k9mail/downloads/list&quot;&gt;here&lt;/a&gt; or, again, point your barcode scanner to the QR Code below. Whatever floats your boat. &lt;/p&gt; &lt;p style=&quot;padding-left: 30px; text-align: center;&quot;&gt; &lt;img class=&quot;aligncenter&quot; src=&quot;https://chart.apis.google.com/chart?chs=150x150&amp;cht=qr&amp;chl=http://k9mail.googlecode.com/files/k9-apg-2900-beta.apk&amp;chld=L|1&amp;choe=UTF-8&quot; alt=&quot;&quot; width=&quot;125&quot; height=&quot;125&quot; /&gt; &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; Set up your email account by entering your email address and password, then give it a name. &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; &lt;a href=&quot;https://guardianproject.info/wp-content/uploads/2010/07/k9_setup1.png&quot;&gt;&lt;img class=&quot;aligncenter size-medium wp-image-451&quot; title=&quot;k9_setup&quot; src=&quot;https://guardianproject.info/wp-content/uploads/2010/07/k9_setup1-168x300.png&quot; alt=&quot;&quot; width=&quot;168&quot; height=&quot;300&quot; srcset=&quot;https://guardianproject.info/wp-content/uploads/2010/07/k9_setup1-168x300.png 168w, https://guardianproject.info/wp-content/uploads/2010/07/k9_setup1-84x150.png 84w, https://guardianproject.info/wp-content/uploads/2010/07/k9_setup1.png 480w&quot; sizes=&quot;(max-width: 168px) 100vw, 168px&quot; /&gt;&lt;/a&gt; &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; &lt;p style=&quot;padding-left: 30px; text-align: center;&quot;&gt; &lt;img class=&quot;aligncenter&quot; title=&quot;k9_almost_done&quot; src=&quot;https://guardianproject.info/wp-content/uploads/2010/07/k9_almost_done-168x300.png&quot; alt=&quot;&quot; width=&quot;168&quot; height=&quot;300&quot; /&gt; &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; For more popular accounts such as gmail, Yahoo!, etc., K-9 will automatically detect the correct configuration. For more complex accounts such as Exchange, please check out the K-9 wiki page &lt;a href=&quot;https://code.google.com/p/k9mail/w/list&quot;&gt;here&lt;/a&gt;. &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; &lt;strong&gt;5. Send and Receive Encrypted Email!&lt;/strong&gt; &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; Thanks to the integration effort by the teams at APG and K-9, actually using secure mobile email becomes easy. The compose screen features a prominent checkbox and button that allow you to sign and encrypt your outbound messages, respectively. &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; &lt;a href=&quot;https://guardianproject.info/wp-content/uploads/2010/07/k9_compose.png&quot;&gt;&lt;img class=&quot;aligncenter size-medium wp-image-453&quot; title=&quot;k9_compose&quot; src=&quot;https://guardianproject.info/wp-content/uploads/2010/07/k9_compose-168x300.png&quot; alt=&quot;&quot; width=&quot;168&quot; height=&quot;300&quot; srcset=&quot;https://guardianproject.info/wp-content/uploads/2010/07/k9_compose-168x300.png 168w, https://guardianproject.info/wp-content/uploads/2010/07/k9_compose-84x150.png 84w, https://guardianproject.info/wp-content/uploads/2010/07/k9_compose.png 480w&quot; sizes=&quot;(max-width: 168px) 100vw, 168px&quot; /&gt;&lt;/a&gt; &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; Decrypting messages with your private key is even easier and is literally a 1-touch experience: &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; &lt;a href=&quot;https://guardianproject.info/wp-content/uploads/2010/07/k9_almost_done.png&quot;&gt;&lt;/a&gt;&lt;a href=&quot;https://guardianproject.info/wp-content/uploads/2010/07/k9_view_decrypt.png&quot;&gt;&lt;img class=&quot;aligncenter size-medium wp-image-455&quot; title=&quot;k9_view_decrypt&quot; src=&quot;https://guardianproject.info/wp-content/uploads/2010/07/k9_view_decrypt-180x300.png&quot; alt=&quot;&quot; width=&quot;180&quot; height=&quot;300&quot; srcset=&quot;https://guardianproject.info/wp-content/uploads/2010/07/k9_view_decrypt-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/07/k9_view_decrypt-90x150.png 90w, https://guardianproject.info/wp-content/uploads/2010/07/k9_view_decrypt.png 480w&quot; sizes=&quot;(max-width: 180px) 100vw, 180px&quot; /&gt;&lt;/a&gt; &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; &lt;strong&gt;Enjoy! &lt;/strong&gt;As always, please post all questions, concerns, and jokes (only good ones please) in the Comments section. We’re very excited about the powerful combination that these two apps bring and we’d love to hear from you! &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; If you find any issues with APG, please report them &lt;a href=&quot;https://code.google.com/p/android-privacy-guard/issues/list&quot;&gt;here&lt;/a&gt;: &lt;/p&gt; &lt;p style=&quot;padding-left: 30px;&quot;&gt; &lt;span style=&quot;line-height: 13px;&quot;&gt;&lt;span style=&quot;line-height: 16px;&quot;&gt;Likewise, report issues with K-9 &lt;a href=&quot;https://code.google.com/p/k9mail/issues/list&quot;&gt;here&lt;/a&gt;. &lt;/span&gt;&lt;/span&gt; &lt;/p&gt; </code></pre> https://guardianproject.info/2010/06/05/apad-/-irobot-/-moons-e7001-teardown/ Sat, 05 Jun 2010 13:38:23 -0400 https://guardianproject.info/2010/06/05/apad-/-irobot-/-moons-e7001-teardown/ <p>This is the aPad or iRobot Android 7″ tablet device from <a rel="nofollow" href="http://www.hiapad.com/">www.hiapad.com</a>. I decided to tear mine apart, as the unit I received has a battery issue, and I hoped to see if I could find a bad solder point. In addition, I was curious to see just how hackable or extensible the hardware was. In the end, I was mostly surprised by how much of the thing is put together with tape. I suppose that is what you get for &lt; $200 Android tablet! You can find the <a href="http://www.hiapad.com/?p=9&amp;lang=en">full product overview on the Hiapad site</a>. I have also pasted in the basic specs below.</p> <p>See the <a href="http://slatedroid.com">Slatedroid forums</a> for more tear down and custom rom news: <a rel="nofollow" href="http://slatedroid.com/index.php?board=18.0">slatedroid.com/index.php?board=18.0</a></p> <p>p.s. – the older, distinguished gentleman in the photos is my father, who at age 75, is still fascinated, engaged, and into hacking with all things digital.</p> <p>Summary of hardware specifications for our Rockchip Apad iRobot Android Tablet, Batch 2:<br /> CPU: RK2808 Chipset (ARM9 @ 600 MHz + DSP @ 550 MHz dual-core)<br /> Operating System: Android 1.5<br /> Supported Languages: English, Chinese, others<br /> Display: 800×480 7″ LCD<br /> Input: Resistive single point touchscreen<br /> Sensors: Accelerometer<br /> Camera: 3 Megapixel camera<br /> Audio input: built-in microphone<br /> Audio output: 3.5 mm jack, integrated speakers<br /> Networking: 802.11 Wireless b/g<br /> Peripheral Support: USB HOST (mouse, keyboard, memory stick, more untested)<br /> Battery: 3000 mAH, 2 hours continuous use wifi on, 4 hours reading time wifi off<br /> RAM: 128 MB<br /> ROM: 2 GB<br /> Expansion memory: Transflash (microSD) up to 16 GB<br /> Supported video formats: MKV (H.264 HP)/RMVB/MPEG-4/FLV/MPEG-1/MPEG-2 up to 720p<br /> Supported audio formats: MP3, WMA. FLAC, AAC, AC3, OGG, WAV<br /> Supported picture formats: JPEG, PNG, BMP, GIF<br /> The Rockchip Apad is a MID based on the Rockchip electronics RK2808 platform.</p> https://guardianproject.info/2010/05/26/how-to-setup-a-private-voip-phone-system-for-android/ Wed, 26 May 2010 05:53:54 -0400 https://guardianproject.info/2010/05/26/how-to-setup-a-private-voip-phone-system-for-android/ <div> <div> <strong>MAY 2011: Learn more about our new efforts on the Open Secure Telephony Network at <a href="https://guardianproject.info/wiki/OSTN">https://guardianproject.info/wiki/OSTN</a> – we currently recommend the <a href="https://code.google.com/p/csipsimple/">CSipSimple</a> Android app instead of SIPDroid, for secure voice calls.</strong> </div> <p><div> </div></p> <p><div> Near the very top of Guardian’s open-source application suite <a href="https://guardianproject.info/apps/"><span style="color: #0000ff;"><span>wish l<span style="color: #0000ff;"><span>ist</span></span></span></span></a> is something that might seem like a no-brainer for a secure mobile device: voice. When we take into account network performance and audio fidelity requirements, as well as the International nature of Guardian’s target users (everything from average citizens to multi-national journalists or humanitarian organizations), the prospect of a truly real-time secure VOIP solution starts to reveal itself as quite the challenge. Fortunately, a number of efforts have been underway for some time on the Android platform. <strong>The following is an introduction to one such effort, and this post provides a very easy step-by-step how to enable your very own private mobile phone system.</strong> </div></p> <p><p> <span style="color: #0000ff;"><a href="https://guardianproject.info/wp-content/uploads/2010/05/sipdroidcall.png"><img class="alignleft size-full wp-image-337" title="sipdroidcall" src="https://guardianproject.info/wp-content/uploads/2010/05/sipdroidcall.png" alt="" width="145" height="241" /></a><a href="https://code.google.com/p/sipdroid/">Sipdroid</a></span> is an open-source SIP client that adds native SIP/VOIP to Android’s default dialer / contacts applications. You can find Sipdroid in the Android Market or alternatively can <a href="https://code.google.com/p/sipdroid/downloads/list"><span style="color: #0000ff;"><span>download it here</span></span></a>. SIP (<a href="https://en.wikipedia.org/wiki/Session_Initiation_Protocol"><span style="color: #0000ff;"><span>Session Initiation Protocol</span></span></a>) is the Internet standard for real-time voice and video communications. It’s a fundamental building block for many popular consumer VOIP products that you may have used – <a href="https://www.youtube.com/watch?v=1XU06zbDBBA"><span style="color: #0000ff;"><span>Vonage</span></span></a> or <a href="http://www.magicjack.com/"><span style="color: #0000ff;"><span>MagicJack</span></span></a> are two examples. Once installed and configured properly, sipdroid allows you to make &amp; receive calls over Wifi and 3G / EDGE data connections – which is a really powerful thing! A similar solution from <a href="https://my.gizmo5.com/"><span style="color: #0000ff;"><span>Gizmo5</span></span></a> allowed many Android users to completely untangle themselves from mobile minutes and rely on a purely VOIP solution. Alas, new Gizmo signups were suspended after Google announced their <a href="http://googlevoiceblog.blogspot.com/2009/11/google-welcomes-gizmo5.html"><span style="color: #0000ff;"><span>acquisition</span></span></a> – but we should all be excited to see what they can cook up as part of the official <a href="https://www.google.com/voice"><span style="color: #0000ff;"><span>Google Voice</span></span></a> team. </p></p> <p><p> While it’s expected that SIP providers will become more <a href="https://code.google.com/p/sipdroid/wiki/NewStandbyTechnique"><span style="color: #0000ff;"><span>interoperable</span></span></a>, the simplest and most powerful solution currently available to get sipdroid running involves registering to the virtual PBX service from <a href="https://www1.pbxes.com/index_e.php"><span style="color: #0000ff;"><span>PBXes.com</span></span></a>. For the uninitiated, a PBX (Private Branch Exchange) is what establishes and manages the connections between the telephony products of a private organization (telephones, fax machines, etc.) – each of which is labeled with an ‘extension’. It also is the system through which these extensions are able to access the public telephone network (<a href="https://en.wikipedia.org/wiki/PSTN"><span style="color: #0000ff;"><span>PSTN</span></span></a>). Since the 1990s, traditional PBX solutions – usually out of reach for small businesses or individuals due to cost and complexity – have evolved to IP-based and virtual or hosted PBXes, which greatly simplify the processes of building and scaling telephony services. PBXes.com is one such ‘virtual PBX.’ Once a PBXes account is established, the account owner can create multiple extensions beneath it and easily dial between those extensions. You get 5 extensions for a free account, more for paid <a href="https://www1.pbxes.com/iptel_virtual-pbx.html"><span style="color: #0000ff;"><span>account types</span></span></a>. </p></p> <p><p> <strong>Why is this solution so interesting?</strong> If you have a relatively small group of colleagues (NGO, humanitarian workers, activists, journalists, etc.), it allows you to easily establish a private internal phone system that can be used over a data connection in lieu of the regular phone system. In our experience, the call quality is also quite good. <span>And while the following step-by-step guide will lead you through the process of setting up this simple solution, first a word of caution: t<span>his is <strong><span>not<span> a secure solution yet</span></span></strong><span>. It is a first step, however, down that road. To achieve a more secure solution, we need to enable more features, include tunneling and encrypting traffic through a Virtual Private Network (VPN) as well as integrating to a privately maintained <a href="http://www.techsteward.com/blog/dirk/?p=735"><span style="color: #0000ff;"><span><span style="color: #0000ff;"><span>A<span style="color: #0000ff;"><span>sterisk</span></span></span></span></span></span></a> phone server running with custom security settings. </span></span></span> </p></p> <p><p> <span><span><span>We are also investigating solutions that uses a public key exchange model, such as Philip Zimmermann’s <a id="s_.7" title="ZFone" href="http://zfoneproject.com/">ZFone</a>, such as the new </span><a href="http://whispersys.com/">RedPhone app just announced by WhisperSystems</a><span>.</span></span></span> </p></p> <p><p> <strong><span><span>1.</span></span></strong> <strong><span><span>Configure <span><span>extensions to <span><span>a<span><span> PBXes.com account</span></span></span></span></span></span></span></span></strong> </p></p> <p><p> <span><span>If you don’t already have a PBXes.com account, head over to <a href="http://www.pbxes.com"><span style="color: #0000ff;"><span><span><span><a href="http://www.pbxes.com">http://www.pbxes.com</a></span></span></span></span></a><span><span> and fill out the straightfo<span><span>rward account registration form for a free account.</span></span></span></span></span></span> </p></p> <p><p> <span><a href="https://guardianproject.info/wp-content/uploads/2010/05/welcome.png"><img class="alignnone size-medium wp-image-333" title="welcome" src="https://guardianproject.info/wp-content/uploads/2010/05/welcome-300x172.png" alt="" width="300" height="172" srcset="https://guardianproject.info/wp-content/uploads/2010/05/welcome-300x172.png 300w, https://guardianproject.info/wp-content/uploads/2010/05/welcome.png 615w" sizes="(max-width: 300px) 100vw, 300px" /></a></span> </p></p> <p><p>   </p></p> <p><p> <span><span>Next, select ‘Extensions’ from the left-hand navigation menu, <span><span>then<span><span> choose ‘SIP’ under ‘Add an Extension.’ </span></span></span></span></span></span> </p></p> <p><p> <span> <span>Last, configure your new extension with a few critical elements. Make sure you fill out the following fields, at a minimum:</span></span> </p></p> <p><p> <a href="https://guardianproject.info/wp-content/uploads/2010/05/addSIPExtension.png"><img class="alignnone size-medium wp-image-334" title="addSIPExtension" src="https://guardianproject.info/wp-content/uploads/2010/05/addSIPExtension-300x171.png" alt="" width="300" height="171" srcset="https://guardianproject.info/wp-content/uploads/2010/05/addSIPExtension-300x171.png 300w, https://guardianproject.info/wp-content/uploads/2010/05/addSIPExtension.png 619w" sizes="(max-width: 300px) 100vw, 300px" /></a> </p></p> <p><ul> <li> <ul> <li> <span><span>Extension number (e.g. 100, 101, 402, etc.)</span></span> </li> <li> <span><span>Display name (e.g. johndoe-100)</span></span> </li> <li> <span><span>Password</span></span> </li> </ul> </li> </ul></p> <p><div> <p> <span><span>After clicking ‘Submit,’ go ahead and repeat the process for as many extensions as  you’d like to set up. Each of these will be specific for a unique Android device. Don’t forget to APPLY your changes when finished by clicking the bright red bar – this ensures your changes take effect.</span></span> </p> </div></p> <p><p> <strong>2.</strong> <strong>Configure extensions on sipdroid</strong> </p></p> <p><p> If you don’t already have sipdroid, you can find the latest version <a href="https://code.google.com/p/sipdroid/downloads/list"><span style="color: #0000ff;"><span>here</span></span></a>, or point your barcode scanner to the following QR code: </p></p> <p><div> <a href="http://chart.apis.google.com/chart?cht=qr&chs=170x170&chl=http%3A%2F%2Fwww.androidzoom.com%2Fweb%2Findice%2FqrLink%3FappCode%3Dmaf%26dwnId%3D231933"><img class="alignnone size-full wp-image-335" title="dp82z4m_35fd9f9hgz_b" src="https://chart.apis.google.com/chart?cht=qr&chs=170x170&chl=http%3A%2F%2Fwww.androidzoom.com%2Fweb%2Findice%2FqrLink%3FappCode%3Dmaf%26dwnId%3D231933" alt="" width="170" height="170" /></a> </div></p> <p><div> <p> Within the Account Settings section of sipdroid, set up one of your extensions from step 1: </p> </div></p> <p><p> · Authorization Username and Password </p></p> <p><p> · Server: pbxes.com </p></p> <p><p> · Port: 5060 </p></p> <p><p> · Protocol: TCP </p></p> <p><div> <a href="https://guardianproject.info/wp-content/uploads/2010/05/sipdroid_account.png"><img class="alignnone size-full wp-image-336" title="sipdroid_account" src="https://guardianproject.info/wp-content/uploads/2010/05/sipdroid_account.png" alt="" width="144" height="240" /></a> </div></p> <p><p> <span><span>You should see a green dot appear in your notifications tray on successful registration like so:</span></span> </p></p> <p><div> <a href="https://guardianproject.info/wp-content/uploads/2010/05/sipdroidoptions.png"><img class="alignnone size-full wp-image-338" title="sipdroidoptions" src="https://guardianproject.info/wp-content/uploads/2010/05/sipdroidoptions.png" alt="" width="145" height="241" /></a> </div></p> <p><p>   </p></p> <p><p> <strong>3.</strong> <strong>Trial Run – dial between extensions</strong> </p></p> <p><p> Once you’ve set up a number of extensions within your PBX, you can easily dial between them. Simply input their extension number (e.g. 100). </p></p> <p><p> <a href="https://guardianproject.info/wp-content/uploads/2010/05/sipdroidcall.png"><img title="sipdroidcall" src="https://guardianproject.info/wp-content/uploads/2010/05/sipdroidcall.png" alt="" width="145" height="241" /></a> </p></p> <p><p>   </p></p> <p><p> <strong><span><span>4.</span></span></strong> <strong><span><span>(Optional) <span><span>Configure VPN</span></span></span></span></strong> </p></p> <p><p> <span><span>As mentioned above, the solution so far isn’t a secure one. A first step in the right direction is connecting to <span><span>PBXes<span><span>’ <span><span>PPTP VPN. For those quicker on their feet, configuration instructions can be found <a href="http://mona-lilly.de/wiki/index.php/VPN"><span style="color: #0000ff;"><span><span><span>here</span></span></span></span></a><span><span>. If you’d prefer to stick with us, follow these steps:</span></span></span></span></span></span></span></span></span></span> </p></p> <p><p> <span><span><em>4a.</em> <span><span>On<span><span> your Android phone, access the ‘VPN settings’ section of Wireless &amp; network settings.</span></span></span></span></span></span> </p></p> <p><p> <em>4b. </em>Select ‘Add VPN,’ then ‘Add PPTP VPN’ </p></p> <p><p> <a href="https://guardianproject.info/wp-content/uploads/2010/05/addvpn.png"><img class="alignleft size-full wp-image-340" title="addvpn" src="https://guardianproject.info/wp-content/uploads/2010/05/addvpn.png" alt="" width="144" height="240" /></a><a href="https://guardianproject.info/wp-content/uploads/2010/05/addvpntype.png"><img class="alignleft size-full wp-image-341" title="addvpntype" src="https://guardianproject.info/wp-content/uploads/2010/05/addvpntype.png" alt="" width="144" height="240" /></a><br /> <br style="clear: both;" /><br /> <span><span><em>4c.</em> <span><span>On<span><span> your Android phone, access the ‘VPN settings’ section of Wireless &amp; network settings.</span></span></span></span></span></span> </p></p> <p><ul> <li> VPN Name – your choice </li> <li> VPN server – www#.pbxes.com [for # see URL line after logging into PBXes on your browser] </li> <li> Enable encryption – We haven’t had success with enabling encryption on PBXes yet. This might be due to a sipdroid <a href="https://code.google.com/p/sipdroid/issues/detail?id=370"><span style="color: #0000ff;"><span>issue</span></span></a> or it might not. If you have success on Android 2.0 / Éclair please let us know in the comments! <span><span> Nathan reported issues with encryption using PBXes PPTP VPN as well.  -Derek Halliday 5/12/10 4:33 PM </span></span> </li> <li> DNS search domain – leave empty </li> <li> Username – <account name>-<extension no.> (e.g. guardianproj-401) </li> <li> Password – <extension password> </li> </ul></p> <p><p> <a href="https://guardianproject.info/wp-content/uploads/2010/05/add_pptp_vpn.png"><img class="size-full wp-image-342 alignnone" title="add_pptp_vpn" src="https://guardianproject.info/wp-content/uploads/2010/05/add_pptp_vpn.png" alt="" width="144" height="240" /></a> </p></p> <p><p>   </p></p> <p><p> <span style="color: #000000;"><span><strong>That’s it! </strong><span>If you come across any issues or have any questions along the way, please let us know in the “Comments” below and we’ll do our best to help you out or clarify. And if you’re itching for more, here are a couple next steps. We’re not presenting a deep tutorial on these (yet), so we’d love to hear from you if you have pursued either – or even better – if you’ve used sipdroid and/or PBXes in any other creative ways!</span></span></span> </p></p> <p><ol> <li> <span><span>Hook your PBXes account into an external DID / VOIP number to dial out to standard phone. Think of it as the equivalent of ‘Skype Out’ for sipdroid. You can use a service such as CallCentric (<a href="http://www.callcentric.com/">http://www.callcentric.com/</a>) for this. </span></span> </li> <li> <span><span>You can also integrate desktop VOIP programs or other mobile device client into the same PBXes accounts. Here’s a great list of </span><a href="https://en.wikipedia.org/wiki/List_of_SIP_software#Free_and.2For_open_source_software">free, open-source SIP clients</a><span>. We personally like </span><a href="http://icanblink.com/">Blink for Mac OS</a><span>.</span></span> </li> <li> <span><span>If you have a privately maintained <a id="zdnk" title="Asterisk" href="https://en.wikipedia.org/wiki/Asterisk_(PBX)">Asterisk</a> or other SIP compatible-server, you can use this same approach with that box, and integrate with your own VPN server. We will be covering this in more detail with a future post, as this is a more secure solution that using a provide such as PBXes.</span></span> </li> </ol></p> <p><p>   </p> </div></p> https://guardianproject.info/2010/05/25/tor-on-a-tablet/ Tue, 25 May 2010 16:22:01 -0400 https://guardianproject.info/2010/05/25/tor-on-a-tablet/ <p>We recently acquired a Moons e-7001 “iRobot” tablet which runs Android 1.5. This device is also known as the “aPad”. It is a very basic iPad-clone, though honestly, it can’t really compare with the iPad in terms of quality of screen, build or general use. However, it does only cost $185, supports USB host mode, has a built-in camera, and it is running Android, an actual open-source operating system! It should also be pointed out that you can also now get the <a href="http://www.amazon.com/Archos-Home-Tablet-Android-Black/dp/B003COZM2C/ref=sr_1_1?ie=UTF8&amp;s=electronics&amp;qid=1274748337&amp;sr=1-1">Archos 7 Android tablet</a>, which is basically the same thing as this, from Amazon for $199.</p> <p>The reason we purchased one of these was to be able to tangibly have Orbot (aka <a href="https://www.torproject.org/docs/android.html">Tor on Android</a>) running on a tablet “MID” style device. Since it is running Android 1.5, we were able to easily do this using Orbot and Orweb together without requiring the device to be rooted.</p> <p>So here you have it – Tor on a Tablet, the AnonaPad, GuardianSlate, OrTab, OnionBook, or whatever other clever name you may want to come up with!</p> <div id='gallery-2' class='gallery galleryid-314 gallery-columns-3 gallery-size-thumbnail'> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2010/05/IMG_3222.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/05/IMG_3222-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" srcset="https://guardianproject.info/wp-content/uploads/2010/05/IMG_3222-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2010/05/IMG_3222-64x64.jpg 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon portrait'> <a href='https://guardianproject.info/wp-content/uploads/2010/05/IMG_3208.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/05/IMG_3208-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" srcset="https://guardianproject.info/wp-content/uploads/2010/05/IMG_3208-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2010/05/IMG_3208-64x64.jpg 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2010/05/IMG_3209.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/05/IMG_3209-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" srcset="https://guardianproject.info/wp-content/uploads/2010/05/IMG_3209-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2010/05/IMG_3209-64x64.jpg 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> </dl> <br style="clear: both" /> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2010/05/IMG_3214.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/05/IMG_3214-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" srcset="https://guardianproject.info/wp-content/uploads/2010/05/IMG_3214-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2010/05/IMG_3214-64x64.jpg 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2010/05/IMG_3215.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/05/IMG_3215-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" srcset="https://guardianproject.info/wp-content/uploads/2010/05/IMG_3215-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2010/05/IMG_3215-64x64.jpg 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> </dl> <dl class='gallery-item'> <dt class='gallery-icon landscape'> <a href='https://guardianproject.info/wp-content/uploads/2010/05/IMG_3220.jpg'><img width="150" height="150" src="https://guardianproject.info/wp-content/uploads/2010/05/IMG_3220-150x150.jpg" class="attachment-thumbnail size-thumbnail" alt="" srcset="https://guardianproject.info/wp-content/uploads/2010/05/IMG_3220-150x150.jpg 150w, https://guardianproject.info/wp-content/uploads/2010/05/IMG_3220-64x64.jpg 64w" sizes="(max-width: 150px) 100vw, 150px" /></a> </dt> </dl> <br style="clear: both" /> </div> https://guardianproject.info/2010/05/10/beem-orbot-mobile-instant-messaging-over-tor/ Mon, 10 May 2010 16:32:01 -0400 https://guardianproject.info/2010/05/10/beem-orbot-mobile-instant-messaging-over-tor/ <p>It is no secret that we are big fans of open-source here at Guardian. In fact, it is <a href="https://github.com/guardianproject">what we are made of</a>. Guardian is not just a single app or just one phone, it is a vision for a more private and secure future for personal mobile telecommunications. As part of our work, we are constantly on the lookout other similar, like-minded projects that are developing open-source communications tools for the Android OS which we can make to work with our underlying security platform.</p> <p><a href="http://www.beem-project.com/">BEEM – Android XMPP</a> happens to be one of these. You can find BEEM in the Android Market or you can <a href="http://www.beem-project.com/news/11">download it here</a>. The goal of BEEM is to provide a full featured and easy to use Jabber client on Android. Jabber is another name for XMPP, the <a href="https://en.wikipedia.org/wiki/Extensible_Messaging_and_Presence_Protocol">Extensible Messaging and Presence Protocol</a>, which is another name for Instant Messaging and Status Updates. XMPP is the open-protocol that grew out of the AIM vs. Yahoo vs. MSN vs. ICQ protocol wars of a few years ago. It is now managed by a <a href="http://xmpp.org/">standards foundation</a>, and is supported by an amazing number of <a href="http://xmpp.org/software/clients.shtml">client</a> and <a href="http://xmpp.org/software/servers.shtml">server</a> apps.</p> <p>Beem, available as source code and in the Android Market, is a great looking, highly functional IM application that supports a number of advanced options including SSL/TLS support and SOCKS Proxying. These two features make it ideal for use with running over the <a href="https://www.torproject.org">Tor anonymity network</a> and <a href="https://guardianproject.info/apps/orbot">Orbot</a>. By combining Beem with Orbot, mobile instant messaging can be more private (even anonymous if one chooses), usable without fear of eavesdropping by network operators, and made accessible in places where filtering technologies blocks access to popular instant messaging services.</p> <p><strong>1) Connect to the Tor network using the Orbot app</strong></p> <p>First, if you do not have Orbot installed, first <a href="https://www.torproject.org/docs/android.html">download it from the Tor Project</a> or scan the barcode below:</p> <p><img class="alignnone" src="https://www.torproject.org/img/android/orbot-qr-code-latest.png" alt="" width="123" height="123" /></p> <p>The Orbot app contains an HTTP and SOCKS proxy server which allows any Android app to proxy its network traffic through Tor. By installing and activating Orbot (tap on the big power button!), this proxy server is activated and runs in the background as long as you are connected to the Tor network.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2010/05/torboot.png"><img class="alignnone size-medium wp-image-295" title="torboot" src="https://guardianproject.info/wp-content/uploads/2010/05/torboot-180x300.png" alt="" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/05/torboot-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/05/torboot.png 480w" sizes="(max-width: 180px) 100vw, 180px" /></a> <a href="https://guardianproject.info/wp-content/uploads/2010/05/toron.png"><img class="alignnone size-medium wp-image-294" title="toron" src="https://guardianproject.info/wp-content/uploads/2010/05/toron-180x300.png" alt="" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/05/toron-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/05/toron.png 480w" sizes="(max-width: 180px) 100vw, 180px" /></a></p> <p><strong>2) Configure your XMPP-compatible account using Beem settings</strong></p> <p>If you don’t have BEEM installed, you can <a href="http://www.beem-project.com/news/11">download it here</a> or scan the barcode below:</p> <p><img class="alignnone" src="https://dev.beem-project.com/screenshot_rc1/qr-code.png" alt="" width="100" height="100" /></p> <p>You can use any XMPP service, but we recommend one that supports TLS or SSL security. You can use your Gmail / Google Talk account or you can find a list of public services here: <a href="http://xmpp.org/services/">http://xmpp.org/services/</a></p></p> <p></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2010/05/beemsettings.png"><img class="alignnone size-medium wp-image-293" title="beemsettings" src="https://guardianproject.info/wp-content/uploads/2010/05/beemsettings-180x300.png" alt="" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/05/beemsettings-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/05/beemsettings.png 480w" sizes="(max-width: 180px) 100vw, 180px" /></a> <a href="https://guardianproject.info/wp-content/uploads/2010/05/beemusername.png"><img class="alignnone size-medium wp-image-292" title="beemusername" src="https://guardianproject.info/wp-content/uploads/2010/05/beemusername-180x300.png" alt="" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/05/beemusername-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/05/beemusername.png 480w" sizes="(max-width: 180px) 100vw, 180px" /></a></p> <p><strong>3) Check the SSL/TLS option in the Advanced Menu</strong></p> <p>You must enable this option to protect your password and chat communications when they exit the Tor network. You can learn more about <a href="https://trac.torproject.org/projects/tor/wiki/TheOnionRouter/TorFAQ#CanexitnodeseavesdroponcommunicationsIsntthatbad">exit node eavesdropping on the TorFAQ</a>.</p> <p><strong><a href="https://guardianproject.info/wp-content/uploads/2010/05/advsetings.png"><img class="alignnone size-medium wp-image-291" title="advsetings" src="https://guardianproject.info/wp-content/uploads/2010/05/advsetings-180x300.png" alt="" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/05/advsetings-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/05/advsetings.png 480w" sizes="(max-width: 180px) 100vw, 180px" /></a> <a href="https://guardianproject.info/wp-content/uploads/2010/05/tls.png"><img title="tls" src="https://guardianproject.info/wp-content/uploads/2010/05/tls-180x300.png" alt="" width="180" height="300" /></a></strong></p> <p><strong>4) Enable the SOCKS Proxy Setting in the Proxy Menu</strong></p> <p>The “Use a proxy server” should be checked, the Protocol set to “SOCKS5”. The Server is “localhost” and the Port is “9050”. You must use the SOCKS5 protocol, as it ensures that domain name resolution is also routed through Tor, stopping from someone snooping on which chat service you are using.</p> <p><strong><a href="https://guardianproject.info/wp-content/uploads/2010/05/proxyon.png"><img class="alignnone size-medium wp-image-289" title="proxyon" src="https://guardianproject.info/wp-content/uploads/2010/05/proxyon-180x300.png" alt="" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/05/proxyon-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/05/proxyon.png 480w" sizes="(max-width: 180px) 100vw, 180px" /></a><a href="https://guardianproject.info/wp-content/uploads/2010/05/socks5.png"><img class="alignnone size-medium wp-image-288" title="socks5" src="https://guardianproject.info/wp-content/uploads/2010/05/socks5-180x300.png" alt="" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/05/socks5-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/05/socks5.png 480w" sizes="(max-width: 180px) 100vw, 180px" /></a></strong></p> <p><strong>[](<a href="https://guardianproject.info/wp-content/uploads/2010/05/socks5.png)[">https://guardianproject.info/wp-content/uploads/2010/05/socks5.png)[</a><img class="alignnone size-medium wp-image-287" title="localhost" src="https://guardianproject.info/wp-content/uploads/2010/05/localhost-180x300.png" alt="" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/05/localhost-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/05/localhost.png 480w" sizes="(max-width: 180px) 100vw, 180px" />](<a href="https://guardianproject.info/wp-content/uploads/2010/05/localhost.png)[">https://guardianproject.info/wp-content/uploads/2010/05/localhost.png)[</a><img class="alignnone size-medium wp-image-286" title="port" src="https://guardianproject.info/wp-content/uploads/2010/05/port-180x300.png" alt="" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/05/port-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/05/port.png 480w" sizes="(max-width: 180px) 100vw, 180px" />](<a href="https://guardianproject.info/wp-content/uploads/2010/05/port.png">https://guardianproject.info/wp-content/uploads/2010/05/port.png</a>)</strong></p> <p><strong>5) Connect to the XMPP Service</strong></p> <p>If Orbot is connected, and you have configured the proxy settings correctly, you should be able to connect and see your contacts or buddy list. From here, you can use Beem as you normally would (<a href="http://www.beem-project.com/documents/4">download user documentation here</a>).</p> <p><strong>IMPORTANT:</strong> <em>To ensure Beem is routing through Tor, you should deactivate Orbot, and then try connecting to your XMPP service with Beem again. This SHOULD fail, else you haven’t setup the proxying correctly.</em></p> <p><strong><a href="https://guardianproject.info/wp-content/uploads/2010/05/coonnecting.png"><img class="alignnone size-medium wp-image-285" title="coonnecting" src="https://guardianproject.info/wp-content/uploads/2010/05/coonnecting-180x300.png" alt="" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/05/coonnecting-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/05/coonnecting.png 480w" sizes="(max-width: 180px) 100vw, 180px" /></a><a href="https://guardianproject.info/wp-content/uploads/2010/05/friends.png"><img class="alignnone size-medium wp-image-284" title="friends" src="https://guardianproject.info/wp-content/uploads/2010/05/friends-180x300.png" alt="" width="180" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/05/friends-180x300.png 180w, https://guardianproject.info/wp-content/uploads/2010/05/friends.png 480w" sizes="(max-width: 180px) 100vw, 180px" /></a></strong></p> <p><strong>6) Chat away!</strong></p> <p><strong><span style="font-weight: normal;">At this point, you should be happily chatting away with your buddies. It is important to note that this solution </span>DOES NOT provide end-to-end encryption<span style="font-weight: normal;">, so once your chat reaches the server, it is not secure, both because the service provide can view it if they choose, and the other members of your chat may not be secured themselves.</span></strong></p> <p>We do plan to implement and end-to-end extension to Beem using the <a href="http://www.cypherpunks.ca/otr/">Pidgin+Off The Record</a> approach that has provided effective on desktop systems. If anyone wishes to contribute development cycles to this effort, please let us know!</p> <p>If you find issues with Beem, please report them: <a href="http://www.beem-project.com/projects/beem/issues/new">http://www.beem-project.com/projects/beem/issues/new</a></p> <p>If you find issues with Orbot, please report them: <a href="https://trac.torproject.org/projects/tor/newticket">https://trac.torproject.org/projects/tor/newticket</a></p> https://guardianproject.info/2010/04/11/ultimate-droid-and-orbot/ Sun, 11 Apr 2010 14:11:11 -0400 https://guardianproject.info/2010/04/11/ultimate-droid-and-orbot/ <p>The <a href="http://www.insecuresystem.org/2010/04/ultimate-droid-and-orbot.html">InsecureSystem blog</a> has a nice write-up on how to get Orbot running on your Droid:</p> <blockquote> <p>I’ve always been a supporter of net privacy and Tor in particular, and a friend of mine got me interested in <a href="https://guardianproject.info/">the guardian project</a>, so I grabbed the beta version of <a href="https://guardianproject.info/apps/orbot/">Orbot</a> just to try it out.. sweet, tor from my phone.</p> <p>Unfortunately the Smoked Glass Rom I was using didn’t support the Iptables modules necessary for the transparent proxy method orbot used for tunnelling apps through privoxy/tor. So, I was forced to try out some other Roms and their respective kernels.. okay, forced is a bad way to put it, it was a lot of fun.</p> </blockquote> <p><a href="http://www.insecuresystem.org/2010/04/ultimate-droid-and-orbot.html">Read on…</a></p> <p><img class="alignnone" title="orbot on droid" src="https://1.bp.blogspot.com/_zYnlWpU7s_s/S7aqyLdAgeI/AAAAAAAAAEU/sT9KAH3F7eI/s320/CAP2010033110221.jpg" alt="" width="180" height="320" /></p> https://guardianproject.info/contact/join/ Wed, 31 Mar 2010 18:30:31 -0400 https://guardianproject.info/contact/join/ <p><a href="https://guardianproject.info/wp-content/uploads/2010/03/teamguardianhardatwork.jpg"><img title="teamguardianhardatwork" src="https://guardianproject.info/wp-content/uploads/2010/03/teamguardianhardatwork.jpg" alt="" width="576" height="384" /><br /> </a> <em>Don&rsquo;t let the visual anonymity fool you - Team Guardian is hard at work and proud of it!</em></p> <h3 id="jobs">Jobs</h3> <p><strong>You</strong> - We&rsquo;re looking for developers of all levels to join us - primarily mobile application developers with skills ranging from user interface design down to the core app work at the network and data level. For experienced developers we expect you to have at least one app released in public and prefer that you have experience with open-source and community-led projects. Experience with security software and standards is desired, but not required. The ability to assist in the localization of software to different regions / languages is a plus.</p> <p><strong>Responsibilities</strong> - Dependent on seniority, but ideally you&rsquo;ll be able to confidently take the reins of the overall project engineering processes - specifically software build and release, version control management and software testing. Act as the lead engineer and be responsible for pushing releases to app store(s), markets and other distribution points. Be the team&rsquo;s primary internal contributor of original project code.</p> <p>All work is contract-based and is not limited by geography.</p> <p>If you are interested in the opportunities below, send a resume or link to relevant work <a href="https://guardianproject.info/contact/">through one of our contact methods</a>.</p> <h3 id="internships">Internships</h3> <p>We&rsquo;re always on the look-out for energetic, enthusiastic, and capable interns.</p> <p><strong>You</strong> - While an aptitude for development is preferred, all that is required is a passion for mobile devices, an interest in security, the eagerness to learn and the ability to be self-directed and productive.</p> <p><strong>The Opportunity</strong> - You will be exposed to some of the most advanced work being done in the field of mobile privacy, while at the same time contributing to the general good of humanity and gaining real-world production development experience. If that isn&rsquo;t enough, then you may also end up with a Guardian-enabled Android device of your own.</p> <p><strong>Responsibilities</strong> - Your work will include testing software, working with NGOs and activist groups to setup and use Guardian software, producing online tutorials and guides, and even social media promotion work.</p> <p>Interested? <a href="https://guardianproject.info/contact/">Learn how to contact us here</a> or email &#x6a;&#111;b&#x73;&#x40;gu&#x61;&#114;d&#x69;&#x61;np&#x72;&#111;j&#x65;&#x63;&#116;.&#x69;&#x6e;f&#x6f; with an introduction and resume.</p> <h3 id="current-open-positions">Current open positions</h3> <ul> <li><a href="../../2024/12/06/ruby-jekyll-contractor/">Seeking Ruby contractors for work on Jekyll, Fastlane, and F-Droid</a></li> <li><a href="../android-python-contractor/">Seeking Android/Python contractors for mobile/free software/privacy work</a></li> </ul> <p>&nbsp;</p> https://guardianproject.info/contact/join/ Wed, 31 Mar 2010 18:30:31 -0400 https://guardianproject.info/contact/join/ <p><a href="https://guardianproject.info/wp-content/uploads/2010/03/teamguardianhardatwork.jpg"><img title="teamguardianhardatwork" src="https://guardianproject.info/wp-content/uploads/2010/03/teamguardianhardatwork.jpg" alt="" width="576" height="384" /><br /> </a> <em>Don&rsquo;t let the visual anonymity fool you - Team Guardian is hard at work and proud of it!</em></p> <h3 id="jobs">Jobs</h3> <p><strong>You</strong> - We&rsquo;re looking for developers of all levels to join us - primarily mobile application developers with skills ranging from user interface design down to the core app work at the network and data level. For experienced developers we expect you to have at least one app released in public and prefer that you have experience with open-source and community-led projects. Experience with security software and standards is desired, but not required. The ability to assist in the localization of software to different regions / languages is a plus.</p> <p><strong>Responsibilities</strong> - Dependent on seniority, but ideally you&rsquo;ll be able to confidently take the reins of the overall project engineering processes - specifically software build and release, version control management and software testing. Act as the lead engineer and be responsible for pushing releases to app store(s), markets and other distribution points. Be the team&rsquo;s primary internal contributor of original project code.</p> <p>All work is contract-based and is not limited by geography.</p> <p>If you are interested in the opportunities below, send a resume or link to relevant work <a href="https://guardianproject.info/contact/">through one of our contact methods</a>.</p> <h3 id="internships">Internships</h3> <p>We&rsquo;re always on the look-out for energetic, enthusiastic, and capable interns.</p> <p><strong>You</strong> - While an aptitude for development is preferred, all that is required is a passion for mobile devices, an interest in security, the eagerness to learn and the ability to be self-directed and productive.</p> <p><strong>The Opportunity</strong> - You will be exposed to some of the most advanced work being done in the field of mobile privacy, while at the same time contributing to the general good of humanity and gaining real-world production development experience. If that isn&rsquo;t enough, then you may also end up with a Guardian-enabled Android device of your own.</p> <p><strong>Responsibilities</strong> - Your work will include testing software, working with NGOs and activist groups to setup and use Guardian software, producing online tutorials and guides, and even social media promotion work.</p> <p>Interested? <a href="https://guardianproject.info/contact/">Learn how to contact us here</a> or email &#x6a;&#111;b&#x73;&#x40;gu&#x61;&#114;d&#x69;&#x61;np&#x72;&#111;j&#x65;&#x63;&#116;.&#x69;&#x6e;f&#x6f; with an introduction and resume.</p> <h3 id="current-open-positions">Current open positions</h3> <ul> <li><a href="../../2024/12/06/ruby-jekyll-contractor/">Seeking Ruby contractors for work on Jekyll, Fastlane, and F-Droid</a></li> <li><a href="../android-python-contractor/">Seeking Android/Python contractors for mobile/free software/privacy work</a></li> </ul> <p>&nbsp;</p> https://guardianproject.info/2010/03/10/ushahidi-linda-testimony-protection/ Wed, 10 Mar 2010 19:53:00 -0400 https://guardianproject.info/2010/03/10/ushahidi-linda-testimony-protection/ <p>Ushahidi-linda (“Testimony” + “Protection” – <em>disclaimer: we don’t speak Swahili so this was a shot in the dark!</em>)</p> <p>This is a fork of the <a href="https://github.com/ushahidi/Ushahidi_Android">Ushahidi on Android</a> app, done as a way to prototype the implementation of increased security, anonymity and privacy for users viewing and submitting reports through <a href="http://ushahidi.com">Ushahidi</a>.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2010/03/ushahidi_android_splash.png"><img class="size-full wp-image-199 alignleft" title="ushahidi_android_splash" src="https://guardianproject.info/wp-content/uploads/2010/03/ushahidi_android_splash.png" alt="" width="224" height="336" srcset="https://guardianproject.info/wp-content/uploads/2010/03/ushahidi_android_splash.png 320w, https://guardianproject.info/wp-content/uploads/2010/03/ushahidi_android_splash-200x300.png 200w" sizes="(max-width: 224px) 100vw, 224px" /></a></p> <p>Ushahidi is a platform that crowdsources crisis information, allowing anyone to submit crisis information through text messaging using a mobile phone, email or web form.</p> <p>The network code for the Ushahidi app has been tied into <a href="https://guardianproject.info/apps/orbot">Orbot</a> (Tor on Android) using a SOCKS5 client. This does NOT require a rooted device to work – both it and Orbot can be run on stock, off the shelf Android devices on any mobile operator that offers at least a GPRS connection. This version of the app will ONLY work if Orbot is activated and connected to the Tor Network. Otherwise, network connections will fail.</p> <p>We plan/hope to work with the Ushahidi team to integrate this functionality into the main branch of code, and offer a clear, easy way for users to activate/deactivate use of the anonymity/anti-surveillence features.</p> <p>You can access the complete source code for Ushahidi-Linda on Android via our <a href="https://github.com/guardianproject/Ushahidi_Android">Git repository</a> and also <a href="https://github.com/guardianproject/Ushahidi_Android/downloads">download test builds</a> as they are available. <strong>PLEASE NOTE: Until further notice and formal announcements, these builds should be considered ALPHA and are for testing, proof of concept use only.</strong></p> <p>Specifically you can see how we have provided a new <a href="https://github.com/guardianproject/Ushahidi_Android/tree/master/src/info/guardianproject/net/">SocksHTTPClient package</a> that proxies all GET and POST connections through SOCKS.</p> <p>From here, the plan is to implement a security pin on startup, local data encryption for storage of data both in the database and on the sdcard, as well as quick “delete all” features.</p> <p><em>Learn more about the Tor Project and how network anonymity works at</em> <a href="https://www.torproject.org"><em>https://www.torproject.org</em></a></p> https://guardianproject.info/archive/orweb/ Wed, 10 Mar 2010 19:20:33 -0400 https://guardianproject.info/archive/orweb/ <p style="text-align: left;"> <strong>Our new Orfox browser is now released and makes Orweb obsolete. </strong> </p> <hr /> <p><em><strong>There are now three new options for you to browser easily through Tor with Orbot:</strong></em></p> <p>1) Use Orfox, the NEW browser for Orbot based on Tor Browser and Firefox, that is currently in stable BETA: <a href="https://guardianproject.info/apps/orfox">https://guardianproject.info/apps/orfox</a></p> <p>2) Use Orbot&rsquo;s VPN mode feature to proxy any app through Tor. WARNING: This does not make you anonymous, but does help you get through firewalls, filters and other network troubles that may be blocking access to a website or app. You can use Chrome browser with this, but your identity won&rsquo;t be protected, ONLY your network traffic.</p> <p>3) Use Lightning Browser, a &ldquo;light&rdquo; open-source browser that supports Tor proxying with Orbot, but not all of the privacy features and security hardening of Orfox. Good for phones with less memory / storage: <a href="https://github.com/anthonycr/Lightning-Browser">https://github.com/anthonycr/Lightning-Browser</a></p> <p>Learn more about Orfox at <a href="https://guardianproject.info/apps/orfox">https://guardianproject.info/apps/orfox</a></p> <p>(see below for the archived information on Orweb)</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>★ ACCEPT NO SUBSTITUTES: Orweb is the safest browser on Android. Period. Orweb evades tracking and censorship by bouncing your encrypted traffic several times through computers around the world, instead of connecting you directly like VPNs and proxies. This process takes a little longer, but the strongest privacy and identity protection available is worth the wait.<br /> ★ CIRCUMVENT FIREWALLS AND RESTRICTIONS: Does your office, school, or region block certain websites? Not anymore. Orweb bypasses almost every kind of network restriction.<br /> ★ BROWSE ANONYMOUSLY: As the New York Times writes, “when a communication arrives from Tor, you can never know where or whom it’s from.” No technology is 100% effective, but Orweb is as close to anonymous as it’s possible to get on Android.<br /> ★ PRIVACY YOU CAN TRUST: The Electronic Frontier Foundation (EFF) says “the groundbreaking work from the Tor project helps users everywhere improve the safety of their online communications.”</p> <p><a href="https://play.google.com/store/apps/details?id=info.guardianproject.browser" target="_blank"><img class="aligncenter" src="https://guardianproject.info/wp-content/uploads/2010/03/Screenshot_2013-02-17-23-20-24-168x300.png" alt="Orweb green" width="168" height="300" /></a></p> <p style="text-align: center;"> Download Orweb: <a href="https://market.android.com/details?id=info.guardianproject.browser">Google Play</a> | <a href="https://guardianproject.info/releases/orweb-latest.apk">Direct Download (.apk)</a> </p> <p>*\<em>*IMPORTANT**</em><br /> Requires the free Orbot plugin. Download it here: <a href="https://play.google.com/store/apps/details?id=org.torproject.android">https://play.google.com/store/apps/details?id=org.torproject.android</a></p> <h1 style="text-align: left;"> Features </h1> <p style="text-align: left;"> ★ NO BROWSING HISTORY: Orweb does not store any information about the websites you visit.<br /> ★ FLEXIBLE COOKIE CONTROL: You can prevent sites you visit from installing any cookies (which could track your web activities), allow them selectively, or allow any site to create cookies.<br /> ★ DISGUISE YOUR DEVICE: You choose which phone or computer websites you visit think you are using.<br /> ★ RESISTANT TO JAVASCRIPT ATTACKS: JavaScript, a common attack method for malicious software, is disabled by default.<br /> ★ RESISTANT TO FLASH VULNERABILITIES: Orweb attempts to prevent Flash from loading on sites you visit, blocking many common security threats.<br /> ★ EASY TO USE: You’re just a few clicks away from free, anonymous web surfing. For a quick, interactive walkthrough, visit our website: <a href="https://www.google.com/url?q=https://guardianproject.info/howto/browsefreely&sa=D&usg=AFQjCNEG7commrc67XrUxb_0tfKCMQPy2g" target="_blank">https://guardianproject.info/howto/browsefreely</a><br /> ★ OPEN-SOURCE: Our code is transparent. You can take a look or join the community to help make Orweb even better: <a href="https://www.google.com/url?q=https://github.com/guardianproject/orweb&sa=D&usg=AFQjCNE6hCYUT7_GHfwYQvUg_Xex0TWWXg" target="_blank">https://github.com/guardianproject/orweb</a><br /> ★ FREEDOM IN YOUR LANGUAGE: Orweb is available in: Arabic (العربية), Chinese (中文简体), Dutch (Nederlands), English, Esperanto, Farsi (فارسی), French (Français), German (Deutsch), Greek (Ελληνικά), Hungarian (Magyar Nyelv), Italian (Italiano), Norwegian (Norsk), Russian (Русский), Spanish (Español), Swedish (Svensk), and Tibetan (བོད་སྐད།). Don’t see your language? Join us and help translate the app: <a href="https://www.google.com/url?q=https://www.transifex.com/projects/p/orweb&sa=D&usg=AFQjCNEjLjUZCtAEMuiAMwMYZRC2ZoK8-Q" target="_blank">https://www.transifex.com/projects/p/orweb</a> </p> <p>Orweb is based on the open-source <a href="http://www.cl.cam.ac.uk/research/dtg/android/tor/">Shadow browser</a> from the University of Cambridge, Orweb works hand in hand with <a href="https://guardianproject.info/apps/orbot">Orbot</a> to provide web access that is able to circumvent web filters and firewalls, while also improving a users ability to remain anonymous online. Orweb also enables whitelist control of cookies, keeps no local history, disables Flash, and requires only Internet permissions, keeping you safe from malicious content. Beyond Tor, Orweb also supports any HTTP proxy server.</p> <p><a href="https://play.google.com/store/apps/details?id=info.guardianproject.browser" target="_blank"><img class="aligncenter" src="https://guardianproject.info/wp-content/uploads/2010/03/2013-05-14-18.10.05-168x300.png" alt="2013-05-14 18.10.05" width="168" height="300" /></a></p> <p>You can also help us translate this howto video: <a href="http://www.amara.org/en/videos/8YqG1DmIXHWs/info/howto-using-orweb-for-anonymous-browsing" title="amara orweb">http://www.amara.org/en/videos/8YqG1DmIXHWs/info/howto-using-orweb-for-anonymous-browsing</a></p> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe src="//www.youtube.com/embed/Dcf5sh99ze0" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe> </div> <h1 id="orweb-for-ios">Orweb for iOS?</h1> <p>This doesn&rsquo;t exist yet, but there is a web browser that uses Tor out for iPhones and iPads called <a title="onion browser" href="https://onionbrowser.com" target="_blank">Onion Browser</a>. While not an official release from <a title="Tor Project" href="https://www.torproject.org/" target="_blank">The Tor Project</a>, it is an <a title="onion browser github" href="https://github.com/mtigas/iOS-OnionBrowser" target="_blank">open source effort</a>. It&rsquo;s available in the Apple <a title="onion browser app store" href="https://itunes.apple.com/us/app/onion-browser/id519296448?mt=8&partnerId=30&siteID=6P4Cgxrxf*M" target="_blank">iTunes App Store for $0.99</a>.</p> https://guardianproject.info/archive/orweb/ Wed, 10 Mar 2010 19:20:33 -0400 https://guardianproject.info/archive/orweb/ <p style="text-align: left;"> <strong>Our new Orfox browser is now released and makes Orweb obsolete. </strong> </p> <hr /> <p><em><strong>There are now three new options for you to browser easily through Tor with Orbot:</strong></em></p> <p>1) Use Orfox, the NEW browser for Orbot based on Tor Browser and Firefox, that is currently in stable BETA: <a href="https://guardianproject.info/apps/orfox">https://guardianproject.info/apps/orfox</a></p> <p>2) Use Orbot&rsquo;s VPN mode feature to proxy any app through Tor. WARNING: This does not make you anonymous, but does help you get through firewalls, filters and other network troubles that may be blocking access to a website or app. You can use Chrome browser with this, but your identity won&rsquo;t be protected, ONLY your network traffic.</p> <p>3) Use Lightning Browser, a &ldquo;light&rdquo; open-source browser that supports Tor proxying with Orbot, but not all of the privacy features and security hardening of Orfox. Good for phones with less memory / storage: <a href="https://github.com/anthonycr/Lightning-Browser">https://github.com/anthonycr/Lightning-Browser</a></p> <p>Learn more about Orfox at <a href="https://guardianproject.info/apps/orfox">https://guardianproject.info/apps/orfox</a></p> <p>(see below for the archived information on Orweb)</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>★ ACCEPT NO SUBSTITUTES: Orweb is the safest browser on Android. Period. Orweb evades tracking and censorship by bouncing your encrypted traffic several times through computers around the world, instead of connecting you directly like VPNs and proxies. This process takes a little longer, but the strongest privacy and identity protection available is worth the wait.<br /> ★ CIRCUMVENT FIREWALLS AND RESTRICTIONS: Does your office, school, or region block certain websites? Not anymore. Orweb bypasses almost every kind of network restriction.<br /> ★ BROWSE ANONYMOUSLY: As the New York Times writes, “when a communication arrives from Tor, you can never know where or whom it’s from.” No technology is 100% effective, but Orweb is as close to anonymous as it’s possible to get on Android.<br /> ★ PRIVACY YOU CAN TRUST: The Electronic Frontier Foundation (EFF) says “the groundbreaking work from the Tor project helps users everywhere improve the safety of their online communications.”</p> <p><a href="https://play.google.com/store/apps/details?id=info.guardianproject.browser" target="_blank"><img class="aligncenter" src="https://guardianproject.info/wp-content/uploads/2010/03/Screenshot_2013-02-17-23-20-24-168x300.png" alt="Orweb green" width="168" height="300" /></a></p> <p style="text-align: center;"> Download Orweb: <a href="https://market.android.com/details?id=info.guardianproject.browser">Google Play</a> | <a href="https://guardianproject.info/releases/orweb-latest.apk">Direct Download (.apk)</a> </p> <p>*\<em>*IMPORTANT**</em><br /> Requires the free Orbot plugin. Download it here: <a href="https://play.google.com/store/apps/details?id=org.torproject.android">https://play.google.com/store/apps/details?id=org.torproject.android</a></p> <h1 style="text-align: left;"> Features </h1> <p style="text-align: left;"> ★ NO BROWSING HISTORY: Orweb does not store any information about the websites you visit.<br /> ★ FLEXIBLE COOKIE CONTROL: You can prevent sites you visit from installing any cookies (which could track your web activities), allow them selectively, or allow any site to create cookies.<br /> ★ DISGUISE YOUR DEVICE: You choose which phone or computer websites you visit think you are using.<br /> ★ RESISTANT TO JAVASCRIPT ATTACKS: JavaScript, a common attack method for malicious software, is disabled by default.<br /> ★ RESISTANT TO FLASH VULNERABILITIES: Orweb attempts to prevent Flash from loading on sites you visit, blocking many common security threats.<br /> ★ EASY TO USE: You’re just a few clicks away from free, anonymous web surfing. For a quick, interactive walkthrough, visit our website: <a href="https://www.google.com/url?q=https://guardianproject.info/howto/browsefreely&sa=D&usg=AFQjCNEG7commrc67XrUxb_0tfKCMQPy2g" target="_blank">https://guardianproject.info/howto/browsefreely</a><br /> ★ OPEN-SOURCE: Our code is transparent. You can take a look or join the community to help make Orweb even better: <a href="https://www.google.com/url?q=https://github.com/guardianproject/orweb&sa=D&usg=AFQjCNE6hCYUT7_GHfwYQvUg_Xex0TWWXg" target="_blank">https://github.com/guardianproject/orweb</a><br /> ★ FREEDOM IN YOUR LANGUAGE: Orweb is available in: Arabic (العربية), Chinese (中文简体), Dutch (Nederlands), English, Esperanto, Farsi (فارسی), French (Français), German (Deutsch), Greek (Ελληνικά), Hungarian (Magyar Nyelv), Italian (Italiano), Norwegian (Norsk), Russian (Русский), Spanish (Español), Swedish (Svensk), and Tibetan (བོད་སྐད།). Don’t see your language? Join us and help translate the app: <a href="https://www.google.com/url?q=https://www.transifex.com/projects/p/orweb&sa=D&usg=AFQjCNEjLjUZCtAEMuiAMwMYZRC2ZoK8-Q" target="_blank">https://www.transifex.com/projects/p/orweb</a> </p> <p>Orweb is based on the open-source <a href="http://www.cl.cam.ac.uk/research/dtg/android/tor/">Shadow browser</a> from the University of Cambridge, Orweb works hand in hand with <a href="https://guardianproject.info/apps/orbot">Orbot</a> to provide web access that is able to circumvent web filters and firewalls, while also improving a users ability to remain anonymous online. Orweb also enables whitelist control of cookies, keeps no local history, disables Flash, and requires only Internet permissions, keeping you safe from malicious content. Beyond Tor, Orweb also supports any HTTP proxy server.</p> <p><a href="https://play.google.com/store/apps/details?id=info.guardianproject.browser" target="_blank"><img class="aligncenter" src="https://guardianproject.info/wp-content/uploads/2010/03/2013-05-14-18.10.05-168x300.png" alt="2013-05-14 18.10.05" width="168" height="300" /></a></p> <p>You can also help us translate this howto video: <a href="http://www.amara.org/en/videos/8YqG1DmIXHWs/info/howto-using-orweb-for-anonymous-browsing" title="amara orweb">http://www.amara.org/en/videos/8YqG1DmIXHWs/info/howto-using-orweb-for-anonymous-browsing</a></p> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe src="//www.youtube.com/embed/Dcf5sh99ze0" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe> </div> <h1 id="orweb-for-ios">Orweb for iOS?</h1> <p>This doesn&rsquo;t exist yet, but there is a web browser that uses Tor out for iPhones and iPads called <a title="onion browser" href="https://onionbrowser.com" target="_blank">Onion Browser</a>. While not an official release from <a title="Tor Project" href="https://www.torproject.org/" target="_blank">The Tor Project</a>, it is an <a title="onion browser github" href="https://github.com/mtigas/iOS-OnionBrowser" target="_blank">open source effort</a>. It&rsquo;s available in the Apple <a title="onion browser app store" href="https://itunes.apple.com/us/app/onion-browser/id519296448?mt=8&partnerId=30&siteID=6P4Cgxrxf*M" target="_blank">iTunes App Store for $0.99</a>.</p> https://guardianproject.info/2010/03/04/orbot-goes-beta/ Thu, 04 Mar 2010 16:14:01 -0400 https://guardianproject.info/2010/03/04/orbot-goes-beta/ <p>As announced on the <a href="https://blog.torproject.org/blog/tor-android">Tor Blog</a>, an important development:</p> <blockquote> <p>The Tor Project has been working very closely with <a href="http://openideals.com/">Nathan Freitas</a> and <a href="http://openideals.com/guardian/">The Guardian Project</a> to create an Android release. This is an early beta release and is not yet suitable for high security needs. The Android web browser is not protected by Torbutton and we have not yet developed an anonymous browser on the Android platform. Please be cautious with this release, it’s probably pretty fragile and it’s certainly not ready for serious use.</p> </blockquote> <p>We just want to emphasize the word “fragile”. While we are proud of this work, it is a first release, and with all security, anti-censorship, anti-surveillance software, you must take each step slowly, deliberately, and seriously. So please, <a href="https://blog.torproject.org/blog/tor-android">download the Orbot APK build</a>, test the frack out of it, <a href="https://bugs.torproject.org/flyspray/index.php?tasks=all&amp;project=8">report bugs and feedback here</a>.</p> <p>There are some really cool features in Orbot, specifically “Per App Torification” if you have a modified/rooted device, running <a href="http://cyanogenmod.com">CyanogenMOD</a> or another alternative firmware. However, even if you have a stock Android device straight from a T-Mobile, Verizon or China Mobile store, this is for you!</p> <p>If you’d like to do the QRCode scan install thing, point your Android camera at this:</p> <p><a href="https://guardianproject.info/wp-content/uploads/2010/03/orbot-qr-code-latest.png"><img class="alignnone size-full wp-image-186" title="orbot-qr-code-latest" src="https://guardianproject.info/wp-content/uploads/2010/03/orbot-qr-code-latest.png" alt="" width="123" height="123" srcset="https://guardianproject.info/wp-content/uploads/2010/03/orbot-qr-code-latest.png 123w, https://guardianproject.info/wp-content/uploads/2010/03/orbot-qr-code-latest-64x64.png 64w" sizes="(max-width: 123px) 100vw, 123px" /></a></p> https://guardianproject.info/2010/03/02/mobileactive-helps-secure-citizen-journalists/ Tue, 02 Mar 2010 17:28:30 -0400 https://guardianproject.info/2010/03/02/mobileactive-helps-secure-citizen-journalists/ <p>While we appreciate the mention in this new guide from <a href="http://mobileactive.org">MobileActive</a>, we appreciate even more the hard work put into documenting practical solutions for citizen journalists that are available today. This guide covers both low and hi-tech approaches to using a mobile phone to document and share media, while still trying to protect your identity and safeguarding communication:</p> <blockquote> <p>Mobile phones are used to compose stories, capture multi-media evidence and disseminate content to local and international audiences. This can be accomplished extremely quickly, making mobile media tools attractive to citizens and journalists covering rapidly unfolding events such as protests or political or other crises. The rise of mobiles has also helped extend citizen journalism into transient, poor or otherwise disconnected communities.</p> <p>However, for those working under repressive regimes, citizen journalism can be a double-edged sword. Anything you create and disseminate can be used against you, whether through the legal system or in other more sinister forms of suppression.</p> </blockquote> <p>Unfortunately, since our port of Tor (<a href="https://guardianproject.info/apps/orbot">Orbot</a>), isn’t widely available or in the Android Market yet, they decided to promote the existing TorProxy+Shadow solution, which we and the Tor Project team believe to be insecure. Read more about those issue in <a href="http://www.h-online.com/open/news/item/Anonymous-browsing-on-Android-Update-769920.html">this article from H-Online</a>.</p> <p>If you really need anonymous, secure access on an Android phone, please <a href="https://guardianproject.info/contact">contact us</a>, and we will set you up with <a href="https://guardianproject.info/apps/orbot">Orbot</a>.</p> <p>View the complete guide here: <a href="http://mobileactive.org/mobilesecurity-citizenjournalism">http://mobileactive.org/mobilesecurity-citizenjournalism</a></p> https://guardianproject.info/2010/03/01/orbot-main-screen-redesign/ Mon, 01 Mar 2010 21:48:06 -0400 https://guardianproject.info/2010/03/01/orbot-main-screen-redesign/ <p>Here’s a few screenshots of the new “ACTIVATE ORBOT!” user interface. Just polishing up some of the features and doing a last few days of diligent testing before we release to the wider public.</p> <p>Overall, we want Tor on Android to be a one touch type experience, while still offering all the necessary options for configuration of bridges, rate limiting, etc.</p> <p>The coolest Android-only feature, which unfortunately requires your device to be rooted, is the ability to choose which apps on your device will be “Torified” automatically and transparently.</p> <p><a href="https://guardianproject.info/wp-content/uploads/2010/03/orbot-off.jpg"><img class="alignnone size-medium wp-image-152" title="orbot-off" src="https://guardianproject.info/wp-content/uploads/2010/03/orbot-off-203x300.jpg" alt="" width="203" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/03/orbot-off-203x300.jpg 203w, https://guardianproject.info/wp-content/uploads/2010/03/orbot-off.jpg 336w" sizes="(max-width: 203px) 100vw, 203px" /></a></p> <p><a href="https://guardianproject.info/wp-content/uploads/2010/03/orbot-on.jpg"><img class="alignnone size-medium wp-image-153" title="orbot-on" src="https://guardianproject.info/wp-content/uploads/2010/03/orbot-on-203x300.jpg" alt="" width="203" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/03/orbot-on-203x300.jpg 203w, https://guardianproject.info/wp-content/uploads/2010/03/orbot-on.jpg 336w" sizes="(max-width: 203px) 100vw, 203px" /></a></p> https://guardianproject.info/partners/ Thu, 11 Feb 2010 05:53:10 -0400 https://guardianproject.info/partners/ <!--:en--> <p style="text-align: left;"> If you are an activist or represent an NGO or other organization interested in getting access to Guardian-enabled mobile phones, please <a href="https://guardianproject.info/contact">let us know</a>. We are always interested in finding new partners to work with. </p> <p style="text-align: left;"> <em>Note: this project receives grants and sub-contracts from organizations (such as the Open Technology Fund) and research projects (such as the Tor Project) that receive funding from the U.S. Government and other governments around the world. None of this funding has modified or shaped our development plans, and we would never, ever put any sort of backdoor or compromised component into our software based on this funding.</em> </p> <h2 id="filecoin-foundation-for-the-decentralized-web">Filecoin Foundation for the Decentralized Web</h2> <p>In 2021, we received funding and support from the <a href="https://ffdweb.org/">Filecoin Foundation for the Decentralized Web</a> to support our work on improving resiliency, preservation and access to essential, human rights media and content.</p> <h2 id="nlnet">NLnet</h2> <ul> <li><a href="https://nlnet.nl/project/F-Droid-Trackers/">https://nlnet.nl/project/F-Droid-Trackers/</a></li> <li><a href="https://nlnet.nl/project/EthicalApps/">https://nlnet.nl/project/EthicalApps/</a></li> </ul> <h2 id="freedom-of-the-press-foundation">Freedom of the Press Foundation</h2> <p>We received funding in 2017 and support for a <a href="https://freedom.press/donate-support-haven-open-source-project/">crowdfunding effort</a> from FPF related to our work on Haven.</p> <h2 id="vienna-science-and-technology-fund-wwtf-https-www-wwtf-at">Vienna Science and Technology Fund (<a href="https://www.wwtf.at/">WWTF</a>)</h2> <p>Ethics-in-an-app, in partnership with Aaron Kaplan and epicenter.works <a href="https://www.wien.gv.at/presse/2019/11/15/digitaler-humanismus-wien-als-zentrum">https://www.wien.gv.at/presse/2019/11/15/digitaler-humanismus-wien-als-zentrum</a></p> <p>Digital Humanism</p> <h2 id="handshake-foundation">Handshake Foundation</h2> <p>In 2018, we received a grant from <a href="https://handshake.org/">Handshake</a>, an organization developing an experimental peer-to-peer root domain naming system.</p> <h2 id="isc-project">ISC Project</h2> <p>We receive some small grants from ISC Project to support localization with Weblate.</p> <h2 id="eric-and-wendy-schmidt-foundation">Eric and Wendy Schmidt Foundation</h2> <p>In 2014, we received a generous grant from the <a href="https://guardianproject.info/2014/03/10/eric-schmidt-awards-guardian-project-a-new-digital-age-grant/">New Digital Age Grants program</a>.</p> <p><a href="https://www.knightfoundation.org/grants/20123674/"><br /> <img class="alignnone size-full wp-image-3267" src="https://guardianproject.info/wp-content/uploads/2012/03/knight-logo-300.jpg" alt="knight-logo-300" width="300" height="50" /></a><br /> In 2012, we received funding for our <a href="https://guardianproject.info/apps/informacam">InformaCam project</a>, and related supporting technologies from <a style="font-size: 13px;" href="https://guardianproject.info/2013/01/27/informacam-wins-knight-news-challenge/">Knight News Challenge</a></p> <h2 id="google">Google</h2> <p>In January 2011, the Guardian Project received a no strings attached donation from Google. We used this funding to accelerate our development activities in various areas, host developer events, produce audits and guides, and support activists in the field. This should not be seen as any formal endorsement of our work by Google corporate, hence we are not putting their logo here.</p> <p style="text-align: left;"> <a href="https://www.freepressunlimited.org/"><img class="alignnone wp-image-3076" src="https://guardianproject.info/wp-content/uploads/2010/02/free_press_unlimited_herzien.jpg" alt="free_press_unlimited_herzien" width="157" height="152" /></a> </p> <p style="text-align: left;"> The Netherlands-based <a href="https://www.freepressunlimited.org/">Free Press Unlimited</a> has supported our work on StoryMaker, a new project focused on creating tools to help journalists and others use mobile media publishing in a more effective and secure manner. </p> <p style="text-align: left;"> <a href="https://guardianproject.info/wp-content/uploads/2010/02/otrlogo.png"><img class="alignnone size-full wp-image-3404" src="https://guardianproject.info/wp-content/uploads/2010/02/otrlogo.png" alt="otrlogo" width="512" height="72" srcset="https://guardianproject.info/wp-content/uploads/2010/02/otrlogo.png 512w, https://guardianproject.info/wp-content/uploads/2010/02/otrlogo-300x42.png 300w" sizes="(max-width: 512px) 100vw, 512px" /></a> </p> <p style="text-align: left;"> The <a href="https://opentech.fund/">Open Technology Fund</a> has provided support for work on our core apps, the StoryMaker project, and future work on decentralized application distribution. </p> <p style="text-align: left;"> <a href="https://guardianproject.info/wp-content/uploads/2010/02/logo128x128.png"><img class="alignnone" src="https://guardianproject.info/wp-content/uploads/2010/02/logo128x128.png" alt="" width="128" height="128" /></a> </p> <p style="text-align: left;"> Guardian Project has received funding from an continues to collaborate with the <a href="https://tibetaction.net">Tibet Action Institute</a>. In addition, this project wouldn't be anywhere without the early and  enthusiastic support of <a href="https://studentsforafreetibet.org">Students for a Free Tibet</a> and the entire Tibetan community. Bhod Rangzen! </p> <p style="text-align: left;"> Guardian has collaborated with the <a href="https://www.torproject.org">Tor Project</a> to bring their software to Android. </p> <p style="text-align: left;"> We are working with <a href="https://www.witness.org">Witness.org</a> on Proofmode (previously InformaCam) and ObscuraCam, human rights-focused secure camera applications for mobile phones. WITNESS receives funding from the International Bar Association and the <a href="https://knightfoundation.org">Knight Foundation</a>, among other funders, to support this work. </p> <p><a href="https://mobileactive.org"><img title="mLogo2" src="https://guardianproject.info/wp-content/uploads/2010/02/mLogo2.png" alt="" width="301" height="75" /></a></p> <p>In 2010, we worked with <a href="https://mobileactive.org">MobileActive.org</a> on their <a href="https://safermobile.org">SaferMobile</a> initiative.</p> <p style="text-align: left;"> <a href="https://avaaz.org">Avaaz</a> has graciously provided grant funding through our work in support of human rights in Tibet and China. </p> <p style="text-align: left;"> The <a href="https://humanrights.berkeley.edu/">Human Rights Center at UC Berkeley</a> uses innovative technologies and scientific methods to investigate war crimes and human rights abuses. Guardian received first prize in their 2009 "Soul of the New Machine" Grant Competition. </p> <!--:--> <!--:pt--> <!--:--> https://guardianproject.info/partners/ Thu, 11 Feb 2010 05:53:10 -0400 https://guardianproject.info/partners/ <!--:en--> <p style="text-align: left;"> If you are an activist or represent an NGO or other organization interested in getting access to Guardian-enabled mobile phones, please <a href="https://guardianproject.info/contact">let us know</a>. We are always interested in finding new partners to work with. </p> <p style="text-align: left;"> <em>Note: this project receives grants and sub-contracts from organizations (such as the Open Technology Fund) and research projects (such as the Tor Project) that receive funding from the U.S. Government and other governments around the world. None of this funding has modified or shaped our development plans, and we would never, ever put any sort of backdoor or compromised component into our software based on this funding.</em> </p> <h2 id="filecoin-foundation-for-the-decentralized-web">Filecoin Foundation for the Decentralized Web</h2> <p>In 2021, we received funding and support from the <a href="https://ffdweb.org/">Filecoin Foundation for the Decentralized Web</a> to support our work on improving resiliency, preservation and access to essential, human rights media and content.</p> <h2 id="nlnet">NLnet</h2> <ul> <li><a href="https://nlnet.nl/project/F-Droid-Trackers/">https://nlnet.nl/project/F-Droid-Trackers/</a></li> <li><a href="https://nlnet.nl/project/EthicalApps/">https://nlnet.nl/project/EthicalApps/</a></li> </ul> <h2 id="freedom-of-the-press-foundation">Freedom of the Press Foundation</h2> <p>We received funding in 2017 and support for a <a href="https://freedom.press/donate-support-haven-open-source-project/">crowdfunding effort</a> from FPF related to our work on Haven.</p> <h2 id="vienna-science-and-technology-fund-wwtf-https-www-wwtf-at">Vienna Science and Technology Fund (<a href="https://www.wwtf.at/">WWTF</a>)</h2> <p>Ethics-in-an-app, in partnership with Aaron Kaplan and epicenter.works <a href="https://www.wien.gv.at/presse/2019/11/15/digitaler-humanismus-wien-als-zentrum">https://www.wien.gv.at/presse/2019/11/15/digitaler-humanismus-wien-als-zentrum</a></p> <p>Digital Humanism</p> <h2 id="handshake-foundation">Handshake Foundation</h2> <p>In 2018, we received a grant from <a href="https://handshake.org/">Handshake</a>, an organization developing an experimental peer-to-peer root domain naming system.</p> <h2 id="isc-project">ISC Project</h2> <p>We receive some small grants from ISC Project to support localization with Weblate.</p> <h2 id="eric-and-wendy-schmidt-foundation">Eric and Wendy Schmidt Foundation</h2> <p>In 2014, we received a generous grant from the <a href="https://guardianproject.info/2014/03/10/eric-schmidt-awards-guardian-project-a-new-digital-age-grant/">New Digital Age Grants program</a>.</p> <p><a href="https://www.knightfoundation.org/grants/20123674/"><br /> <img class="alignnone size-full wp-image-3267" src="https://guardianproject.info/wp-content/uploads/2012/03/knight-logo-300.jpg" alt="knight-logo-300" width="300" height="50" /></a><br /> In 2012, we received funding for our <a href="https://guardianproject.info/apps/informacam">InformaCam project</a>, and related supporting technologies from <a style="font-size: 13px;" href="https://guardianproject.info/2013/01/27/informacam-wins-knight-news-challenge/">Knight News Challenge</a></p> <h2 id="google">Google</h2> <p>In January 2011, the Guardian Project received a no strings attached donation from Google. We used this funding to accelerate our development activities in various areas, host developer events, produce audits and guides, and support activists in the field. This should not be seen as any formal endorsement of our work by Google corporate, hence we are not putting their logo here.</p> <p style="text-align: left;"> <a href="https://www.freepressunlimited.org/"><img class="alignnone wp-image-3076" src="https://guardianproject.info/wp-content/uploads/2010/02/free_press_unlimited_herzien.jpg" alt="free_press_unlimited_herzien" width="157" height="152" /></a> </p> <p style="text-align: left;"> The Netherlands-based <a href="https://www.freepressunlimited.org/">Free Press Unlimited</a> has supported our work on StoryMaker, a new project focused on creating tools to help journalists and others use mobile media publishing in a more effective and secure manner. </p> <p style="text-align: left;"> <a href="https://guardianproject.info/wp-content/uploads/2010/02/otrlogo.png"><img class="alignnone size-full wp-image-3404" src="https://guardianproject.info/wp-content/uploads/2010/02/otrlogo.png" alt="otrlogo" width="512" height="72" srcset="https://guardianproject.info/wp-content/uploads/2010/02/otrlogo.png 512w, https://guardianproject.info/wp-content/uploads/2010/02/otrlogo-300x42.png 300w" sizes="(max-width: 512px) 100vw, 512px" /></a> </p> <p style="text-align: left;"> The <a href="https://opentech.fund/">Open Technology Fund</a> has provided support for work on our core apps, the StoryMaker project, and future work on decentralized application distribution. </p> <p style="text-align: left;"> <a href="https://guardianproject.info/wp-content/uploads/2010/02/logo128x128.png"><img class="alignnone" src="https://guardianproject.info/wp-content/uploads/2010/02/logo128x128.png" alt="" width="128" height="128" /></a> </p> <p style="text-align: left;"> Guardian Project has received funding from an continues to collaborate with the <a href="https://tibetaction.net">Tibet Action Institute</a>. In addition, this project wouldn't be anywhere without the early and  enthusiastic support of <a href="https://studentsforafreetibet.org">Students for a Free Tibet</a> and the entire Tibetan community. Bhod Rangzen! </p> <p style="text-align: left;"> Guardian has collaborated with the <a href="https://www.torproject.org">Tor Project</a> to bring their software to Android. </p> <p style="text-align: left;"> We are working with <a href="https://www.witness.org">Witness.org</a> on Proofmode (previously InformaCam) and ObscuraCam, human rights-focused secure camera applications for mobile phones. WITNESS receives funding from the International Bar Association and the <a href="https://knightfoundation.org">Knight Foundation</a>, among other funders, to support this work. </p> <p><a href="https://mobileactive.org"><img title="mLogo2" src="https://guardianproject.info/wp-content/uploads/2010/02/mLogo2.png" alt="" width="301" height="75" /></a></p> <p>In 2010, we worked with <a href="https://mobileactive.org">MobileActive.org</a> on their <a href="https://safermobile.org">SaferMobile</a> initiative.</p> <p style="text-align: left;"> <a href="https://avaaz.org">Avaaz</a> has graciously provided grant funding through our work in support of human rights in Tibet and China. </p> <p style="text-align: left;"> The <a href="https://humanrights.berkeley.edu/">Human Rights Center at UC Berkeley</a> uses innovative technologies and scientific methods to investigate war crimes and human rights abuses. Guardian received first prize in their 2009 "Soul of the New Machine" Grant Competition. </p> <!--:--> <!--:pt--> <!--:--> https://guardianproject.info/2010/02/11/one-solution-for-push-to-talk/ Thu, 11 Feb 2010 03:50:22 -0400 https://guardianproject.info/2010/02/11/one-solution-for-push-to-talk/ <p>As part of rolling out the first-phase of <a href="http://openideals.com/guardian">The Guardian Project</a>, I will be writing short reviews of existing applications for Android-based mobile phones that share our general goals or desired functionality. The goal of Guardian, in short, is to enable safe and secure communication for activists, organizers and advocates working for good around the world through the mobile phones they carry in their pockets.</p> <p>The Guardian project has no official relationship with these apps or their creators, but as we work towards developing our own unique software, we want to make sure to shine the spotlight on existing efforts that we admire and which are currently available. We’d also happily collaborate with any of them (or *you* if you are a developer reading this), and have them join our open-source efforts.</p> <p>The first application is <a href="http://hit-mob.com/walkie-talkie-push-to-talk/">Walkie Talkie Push to Talk</a>, which is a great alternative take on real-time VOIP or standard phone calls. Physical walkie talkie radios and Nextel-style PTT services have long been a valuable tool for many activists, and this application bring that capability to a global scale. Walkie Talkie can be used over GRPS, EDGE, 3G or Wifi networks, as well – whatever is available at the time.</p> <p>Here’s a short description from the developer:</p> <blockquote> <p>Walkie Talkie Push to Talk is a mobile application that allows walkie talkie style voice communications. Simply hold down the “Record &amp; Send” button and speak. Messages can be sent to a group of people. Received messages are automatically played. If program is running, incoming messages arrive as soon as 15 seconds. If program is not visible, it polls in the background every 1 minute (to save battery).</p> </blockquote> <p>The back-end messaging system used by this application is actual POP or IMAP, in other words email! If you utilize a secure IMAP/S connection with the application, then the voice communications are transmitted securely over the wireless network and Internet. If you use a service like Gmail (which offers secure IMAP access), then your access is hidden within the millions of other users accessing Gmail, as well.</p> <p>Not drawing attention to your network traffic is often as important as securing your data. Also, while Gmail isn’t always the ideal service to use if you wish to retain full control of your data, it is much more difficult for an authority to block than a single proxy or a private server.</p> <p><a href="http://hit-mob.com/walkie-talkie-push-to-talk/">Learn more about Walkie Talkie</a> and download it from the Android Market today.</p> https://guardianproject.info/2010/02/10/orbot-initial-release-repost/ Wed, 10 Feb 2010 20:26:23 -0400 https://guardianproject.info/2010/02/10/orbot-initial-release-repost/ <p><em>This was originally posted in October 2009.</em></p> <p>I’d like to make this post without much fanfare. Just looking to share information on the work I’ve been doing with the fantastically radical team over at the <a href="https://www.torproject.org">Tor Project</a>, as part of my work on the <a href="http://openideals.com/guardian">Guardian Project</a>. We have successfully ported the native C Tor app to Android and built an Android application bundle that installs, runs and provides the glue needed to make it useful to end users…. secure, anonymous access to the web via Tor on Android is now a reality. (<em>Update: Tor doesn’t magically encrypt all of your Internet activities, though. You should <a href="https://www.torproject.org/download.html.en#Warning">understand what Tor does and does not do for you</a>.</em>)</p> <p>However, there is still much work to be done… read on!</p> <p>1) <strong>Tor 0.2.2.5-alpha release</strong> contains all the necessary code for building the Tor binary exe using the Android C SDK. I utilized <a href="https://github.com/tmurakam/droid-wrapper" target="_blank"><a href="https://github.com/tmurakam/droid-wrapper">https://github.com/tmurakam/droid-wrapper</a></a> toolchain wrapper scripts to make life easier. This will produce the output Tor exe that can run on Android w/o needing root.</p> <p><em>Update: Thanks to <a href="http://www.appelbaum.net/">Jake</a>, you can now read the updated <a href="https://svn.torproject.org/svn/projects/android/trunk/Orbot/BUILD">Orbot BUILD doc</a> for the step by step build how to.</em></p> <p><a href="http://www.flickr.com/photos/ioerror/3933276410/"><img src="http://farm4.static.flickr.com/3510/3933276410_275a88c115_d.jpg" alt="" /></a><br /> <em>(thanks to <a href="http://www.flickr.com/photos/ioerror">ioerror</a> for the pic)</em></p> <p>At this point, we are pretty convinced that the performance and efficiency of the C binary is quite significantly better than the Java-based ports of Tor running within Dalvik… this translate to a better experience for the user, with no noticeable increase in battery drain or lag on the rest of the device while Tor is running in the background.</p> <p>2) <strong>Orbot</strong> – this is the new Android app which bundles the Tor binary, handles its proper installation on the device and then provides a gui for starting/stopping, view the log and torrc, etc. It also provides a built-in HTTP Proxy and is licensed under the <a href="https://www.torproject.org/eff/tor-legal-faq.html">Tor license</a>.</p> <p><a href="http://www.flickr.com/photos/natty/4034052788/" title="home.jpg by nathanialfreitas, on Flickr"><img src="https://farm3.static.flickr.com/2588/4034052788_cff2aaf55c_m.jpg" alt="home.jpg" width="161" height="240" /></a><a href="http://www.flickr.com/photos/natty/4033299037/" title="tor-on.jpg by nathanialfreitas, on Flickr"><img src="https://farm3.static.flickr.com/2503/4033299037_49517e87b7_m.jpg" alt="tor-on.jpg" width="161" height="240" /></a><a href="http://www.flickr.com/photos/natty/4034052826/" title="log.jpg by nathanialfreitas, on Flickr"><img src="https://farm3.static.flickr.com/2484/4034052826_e326c056fc_m.jpg" alt="log.jpg" width="161" height="240" /></a><br /> __</p> <p>_Just to be clear – we aren’t using the NDK or a shared library… we are actually extracting a binary and managing it via Runtime.getRuntime().exec() calls. This is 100% supported – who knew?! More info on how to do this <a href="http://remotedroid.net/blog/2009/04/13/running-native-code-in-android/">here</a><br /> _</p> <p>The first code is up here… all is working, but def needs much polish:<br /> <a href="https://svn.torproject.org/svn/projects/android/trunk/Orbot/" target="_blank"><a href="https://svn.torproject.org/svn/projects/android/trunk/Orbot/">https://svn.torproject.org/svn/projects/android/trunk/Orbot/</a></a></p> <p>This post is in part a call for developers to contribute to the continued development of Orbot, so we can get it to a 1.0 state. The other big task is to modify the open-source, privacy focused <a href="http://www.cl.cam.ac.uk/research/dtg/android/tor/">Shadow browser</a>, from the University of Cambridge DTG group, in order to make it work with our HTTP proxy. That would be a really great step forward, as right now, we have to ask users to set their global APN (read: <a href="https://svn.torproject.org/svn/projects/android/trunk/Orbot/INSTALL" target="_blank"><a href="https://svn.torproject.org/svn/projects/android/trunk/Orbot/INSTALL">https://svn.torproject.org/svn/projects/android/trunk/Orbot/INSTALL</a></a>)</p> <p>Thanks for everyone’s help and support to get here. I’d like to keep pushing on to a public release via the App Market very soon. Let me know if you’d like to contribute in any way – code, screen designs, icons, testing…. ****</p> <p><strong>Domo arigato, Mr. Orbot-o!</strong>!</p> https://guardianproject.info/archive/orbot/ Mon, 08 Feb 2010 06:09:43 -0400 https://guardianproject.info/archive/orbot/ <p><img class="alignnone size-large wp-image-13245" src="https://guardianproject.info/wp-content/uploads/2010/02/featuregraphic-1024x500.png" alt="featuregraphic" width="780" height="381" srcset="https://guardianproject.info/wp-content/uploads/2010/02/featuregraphic.png 1024w, https://guardianproject.info/wp-content/uploads/2010/02/featuregraphic-300x146.png 300w, https://guardianproject.info/wp-content/uploads/2010/02/featuregraphic-768x375.png 768w" sizes="(max-width: 780px) 100vw, 780px" /></p> <h1 id="what-is-orbot">What is Orbot?</h1> <p>Orbot is a free proxy app that empowers other apps to use the internet more securely. Orbot uses Tor to encrypt your Internet traffic and then hides it by bouncing through a series of computers around the world. Tor is free software and an open network that helps you defend against a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security known as traffic analysis. Orbot creates a truly private mobile internet connection.<br /> <a href="https://play.google.com/store/apps/details?id=org.torproject.android" target="_blank"><br /> </a><strong>Download Orbot</strong>: <a href="https://market.android.com/details?id=org.torproject.android">Google Play</a> | <a href="https://guardianproject.info/fdroid">F-Droid</a> | <a href="https://guardianproject.info/releases/orbot-latest.apk">Direct Download (.apk)</a></p> <p><strong>Source code:</strong> <a href="https://gitweb.torproject.org/orbot.git">Tor Gitweb</a> <strong>|</strong> <a href="https://github.com/n8fr8/orbot">GitHub Mirror</a></p> <p><img class="alignnone wp-image-13243 size-medium" src="https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-04-021058-169x300.png" alt="device-2016-01-04-021058" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-04-021058-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-04-021058-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-04-021058.png 720w" sizes="(max-width: 169px) 100vw, 169px" /><img class="alignnone size-medium wp-image-13241" src="https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-07-014823-169x300.png" alt="device-2016-01-07-014823" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-07-014823-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-07-014823-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-07-014823.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></p> <p>★ PRIVATE CHAT MESSAGING: Use ChatSecure with Orbot to chat confidentially with anyone, anywhere for free. <a href="https://guardianproject.info/apps/chatsecure">GetChatSecure</a><br /> ★ PRIVACY ON TWITTER: It works with the <a title="Official Twitter app with proxy feature" href="https://play.google.com/store/apps/details?id=com.twitter.android" target="_blank">official Twitter app.</a> To Tweet anonymously, just change the proxy settings to the following: Proxy Host: localhost: Proxy Port: 8118</p> <p>★ PRIVACY FOR APPS: Any installed app can use Tor if it has a proxy feature, using the settings found here: <a href="https://guardianproject.info/apps/orbot">https://guardianproject.info/apps/orbot</a> . Try private web searching with DuckDuckGo: <a href="https://play.google.com/store/apps/details?id=com.duckduckgo.mobile.android">https://play.google.com/store/apps/details?id=com.duckduckgo.mobile.android</a></p> <p>★ PRIVACY MADE EASY: Check out our easy, interactive walkthrough: <a href="https://www.google.com/url?q=https://guardianproject.info/howto/browsefreely&sa=D&usg=AFQjCNEG7commrc67XrUxb_0tfKCMQPy2g" target="_blank"><a href="https://guardianproject.info/howto/browsefreely">https://guardianproject.info/howto/browsefreely</a></a><br /> ★ IT’S OFFICIAL: This is the official version of the Tor onion routing service for Android.</p> <p>*\<em>*Expert Root Mode**</em><br /> ★ UNIVERSAL MODE: Orbot can be configured to transparently proxy all of your Internet traffic through Tor. You can also choose which specific apps you want to use through Tor.</p> <p>*\<em>*We Love Feedback**</em><br /> ★ OPEN-SOURCE: Orbot is free software. Take a look at our source code, or join the community to make it better: <a href="https://www.google.com/url?q=https://gitweb.torproject.org/orbot.git&sa=D&usg=AFQjCNEpj_yHjh9MXieeSi2hbbd5o0P_5Q" target="_blank"><a href="https://gitweb.torproject.org/orbot.git">https://gitweb.torproject.org/orbot.git</a></a><br /> ★ ABOUT TOR: <a href="https://www.google.com/url?q=https://TorProject.org&sa=D&usg=AFQjCNHBD4XzmolnTDcgLMoDNg7Q2EREJw" target="_blank"><a href="https://TorProject.org">https://TorProject.org</a></a> . Orbot source code is available under the <a href="https://gitweb.torproject.org/orbot.git/blob_plain/HEAD:/LICENSE">Tor License</a><br /> ★ Please report bugs to our bug tracker! <a href="https://trac.torproject.org/projects/tor/newticket" target="_blank"><a href="https://trac.torproject.org/projects/tor/newticket">https://trac.torproject.org/projects/tor/newticket</a></a><br /> ★ MESSAGE US: Are we missing your favorite feature? Found an annoying bug? We’d love to hear from you! Send us an email: support&#x40;&#103;u&#x61;r&#x64;i&#x61;&#110;p&#x72;o&#x6a;&#101;c&#x74;.&#x69;n&#x66;&#111; . Come discuss on #tor, #tor-dev and #guardianproject on irc.oftc.net or #guardianproject on freenode.</p> <p>★ HELP US BRING ORBOT TO YOUR COUNTRY: We’re trying to get Orbot into as many languages as possible. Right now it’s in: Arabic (العربية), Basque (Euskara), Bulgarian (български език), Chinese (中文简体), Czech (Čeština), Danish (Dansk), Dutch (Nederlands), English, Farsi (فارسی), French (Français), French (Français), German (Deutsch), Greek (Ελληνικά), Hebrew (עברית), Hungarian (Magyar Nyelv), Italian (Italiano), Japanese (日本語) Korean (조선말), Latvian (Latviešu), Malaysian (بهاس ملايو ), Polish (Polski), Portuguese (Português), Russian (Русский), Spanish (Español), Swedish (Svensk), and Vietnamese (Tiếng Việt).<br /> If Orbot isn’t in your language yet, we’d love to have you join our translation team: <a href="https://www.transifex.com/projects/p/orbot/" target="_blank"><a href="https://www.transifex.com/projects/p/orbot/">https://www.transifex.com/projects/p/orbot/</a></a></p> <p><p style="text-align: center;"></p> https://guardianproject.info/archive/orbot/ Mon, 08 Feb 2010 06:09:43 -0400 https://guardianproject.info/archive/orbot/ <p><img class="alignnone size-large wp-image-13245" src="https://guardianproject.info/wp-content/uploads/2010/02/featuregraphic-1024x500.png" alt="featuregraphic" width="780" height="381" srcset="https://guardianproject.info/wp-content/uploads/2010/02/featuregraphic.png 1024w, https://guardianproject.info/wp-content/uploads/2010/02/featuregraphic-300x146.png 300w, https://guardianproject.info/wp-content/uploads/2010/02/featuregraphic-768x375.png 768w" sizes="(max-width: 780px) 100vw, 780px" /></p> <h1 id="what-is-orbot">What is Orbot?</h1> <p>Orbot is a free proxy app that empowers other apps to use the internet more securely. Orbot uses Tor to encrypt your Internet traffic and then hides it by bouncing through a series of computers around the world. Tor is free software and an open network that helps you defend against a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security known as traffic analysis. Orbot creates a truly private mobile internet connection.<br /> <a href="https://play.google.com/store/apps/details?id=org.torproject.android" target="_blank"><br /> </a><strong>Download Orbot</strong>: <a href="https://market.android.com/details?id=org.torproject.android">Google Play</a> | <a href="https://guardianproject.info/fdroid">F-Droid</a> | <a href="https://guardianproject.info/releases/orbot-latest.apk">Direct Download (.apk)</a></p> <p><strong>Source code:</strong> <a href="https://gitweb.torproject.org/orbot.git">Tor Gitweb</a> <strong>|</strong> <a href="https://github.com/n8fr8/orbot">GitHub Mirror</a></p> <p><img class="alignnone wp-image-13243 size-medium" src="https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-04-021058-169x300.png" alt="device-2016-01-04-021058" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-04-021058-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-04-021058-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-04-021058.png 720w" sizes="(max-width: 169px) 100vw, 169px" /><img class="alignnone size-medium wp-image-13241" src="https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-07-014823-169x300.png" alt="device-2016-01-07-014823" width="169" height="300" srcset="https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-07-014823-169x300.png 169w, https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-07-014823-576x1024.png 576w, https://guardianproject.info/wp-content/uploads/2010/02/device-2016-01-07-014823.png 720w" sizes="(max-width: 169px) 100vw, 169px" /></p> <p>★ PRIVATE CHAT MESSAGING: Use ChatSecure with Orbot to chat confidentially with anyone, anywhere for free. <a href="https://guardianproject.info/apps/chatsecure">GetChatSecure</a><br /> ★ PRIVACY ON TWITTER: It works with the <a title="Official Twitter app with proxy feature" href="https://play.google.com/store/apps/details?id=com.twitter.android" target="_blank">official Twitter app.</a> To Tweet anonymously, just change the proxy settings to the following: Proxy Host: localhost: Proxy Port: 8118</p> <p>★ PRIVACY FOR APPS: Any installed app can use Tor if it has a proxy feature, using the settings found here: <a href="https://guardianproject.info/apps/orbot">https://guardianproject.info/apps/orbot</a> . Try private web searching with DuckDuckGo: <a href="https://play.google.com/store/apps/details?id=com.duckduckgo.mobile.android">https://play.google.com/store/apps/details?id=com.duckduckgo.mobile.android</a></p> <p>★ PRIVACY MADE EASY: Check out our easy, interactive walkthrough: <a href="https://www.google.com/url?q=https://guardianproject.info/howto/browsefreely&sa=D&usg=AFQjCNEG7commrc67XrUxb_0tfKCMQPy2g" target="_blank"><a href="https://guardianproject.info/howto/browsefreely">https://guardianproject.info/howto/browsefreely</a></a><br /> ★ IT’S OFFICIAL: This is the official version of the Tor onion routing service for Android.</p> <p>*\<em>*Expert Root Mode**</em><br /> ★ UNIVERSAL MODE: Orbot can be configured to transparently proxy all of your Internet traffic through Tor. You can also choose which specific apps you want to use through Tor.</p> <p>*\<em>*We Love Feedback**</em><br /> ★ OPEN-SOURCE: Orbot is free software. Take a look at our source code, or join the community to make it better: <a href="https://www.google.com/url?q=https://gitweb.torproject.org/orbot.git&sa=D&usg=AFQjCNEpj_yHjh9MXieeSi2hbbd5o0P_5Q" target="_blank"><a href="https://gitweb.torproject.org/orbot.git">https://gitweb.torproject.org/orbot.git</a></a><br /> ★ ABOUT TOR: <a href="https://www.google.com/url?q=https://TorProject.org&sa=D&usg=AFQjCNHBD4XzmolnTDcgLMoDNg7Q2EREJw" target="_blank"><a href="https://TorProject.org">https://TorProject.org</a></a> . Orbot source code is available under the <a href="https://gitweb.torproject.org/orbot.git/blob_plain/HEAD:/LICENSE">Tor License</a><br /> ★ Please report bugs to our bug tracker! <a href="https://trac.torproject.org/projects/tor/newticket" target="_blank"><a href="https://trac.torproject.org/projects/tor/newticket">https://trac.torproject.org/projects/tor/newticket</a></a><br /> ★ MESSAGE US: Are we missing your favorite feature? Found an annoying bug? We’d love to hear from you! Send us an email: support&#x40;&#103;u&#x61;r&#x64;i&#x61;&#110;p&#x72;o&#x6a;&#101;c&#x74;.&#x69;n&#x66;&#111; . Come discuss on #tor, #tor-dev and #guardianproject on irc.oftc.net or #guardianproject on freenode.</p> <p>★ HELP US BRING ORBOT TO YOUR COUNTRY: We’re trying to get Orbot into as many languages as possible. Right now it’s in: Arabic (العربية), Basque (Euskara), Bulgarian (български език), Chinese (中文简体), Czech (Čeština), Danish (Dansk), Dutch (Nederlands), English, Farsi (فارسی), French (Français), French (Français), German (Deutsch), Greek (Ελληνικά), Hebrew (עברית), Hungarian (Magyar Nyelv), Italian (Italiano), Japanese (日本語) Korean (조선말), Latvian (Latviešu), Malaysian (بهاس ملايو ), Polish (Polski), Portuguese (Português), Russian (Русский), Spanish (Español), Swedish (Svensk), and Vietnamese (Tiếng Việt).<br /> If Orbot isn’t in your language yet, we’d love to have you join our translation team: <a href="https://www.transifex.com/projects/p/orbot/" target="_blank"><a href="https://www.transifex.com/projects/p/orbot/">https://www.transifex.com/projects/p/orbot/</a></a></p> <p><p style="text-align: center;"></p> https://guardianproject.info/2010/02/08/ideas-and-inspiration/ Mon, 08 Feb 2010 05:34:33 -0400 https://guardianproject.info/2010/02/08/ideas-and-inspiration/ <p><em><strong>Watch the video below to hear directly from Google&rsquo;s Android Team about the benefits of an open-source mobile OS.</strong></em></p> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe src="//www.youtube.com/embed/7Y4thikv-OM" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe> </div> <p>And now, another clip from one of our core, yet fictional, inspirations.</p> <div style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;"> <iframe src="//www.youtube.com/embed/3efV2wqEjEY" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;" allowfullscreen title="YouTube Video"></iframe> </div> <blockquote> <p><strong>Alan Bradley:</strong> I still don&rsquo;t get why you want to break into the system.<br /> <strong>Kevin Flynn:</strong> [frustrated] Because, man, somewhere in one of these memories is the evidence!</p> </blockquote> https://guardianproject.info/1/01/01/ Mon, 01 Jan 0001 00:00:00 +0000 https://guardianproject.info/1/01/01/ <p>In 2010, at the Open Video Conference hackathon, I came up with a concept called <a href="https://blog.witness.org/2010/10/ovc2010-opensubtitles/">&ldquo;auto blur the news&rdquo;</a>, while in a brainstorm with activists, advocates and coders, including Sam Gregory, a longtime ally from <a href="https://witness.org">WITNESS</a>. Using the built-in face recognition features on modern smartphones, you could instantly redact faces from a photo or video, instead of tagging or tracking those same faces. Out of this came an app called <a href="https://play.google.com/store/apps/details?id=org.witness.sscphase1&amp;feature=search_result">ObscuraCam</a>, which was always meant as a proof of concept demonstration to help lobby mainstream apps and operating systems a simple feature available for all.</p> <p>(Un)fortunately, ObscuraCam has been around for 10 years, become a &ldquo;real&rdquo; app, and growing in users and stability, though with minimal funding and resources. WITNESS did make progress convincing YouTube to add a blur capability in some of its tools, and we had many meetings with Samsung, Google, Facebook and others, on the possibility of building this in to their camera software. We have also seen widespread use of ObscuraCam by people wanting to preserve privacy for their children, at school events, when selling cars online or to protect strangers caught in the background of a random photo. We also had the change to integrate some defensive AI image glitching as part of last year&rsquo;s Assembly program.</p> <p>Last night, the idea of adoption of these features beyond the confines of our little PoC occurred, with Signal announcing the general availability of automatic and manual photo redaction tools in their recent update: <a href="https://signal.org/blog/blur-tools/">https://signal.org/blog/blur-tools/</a></p> <p>Our friends at WITNESS <a href="https://twitter.com/SamGregory/status/1268512277877178368">also tweeted</a></p> <p>@SamGregory &ldquo;10 years ago @guardianproject @witnessorg emphasized need for better easy tools to protect people&rsquo;s visual #anonymity, faces on mobile, vs + #facialrecognition. We built #obscuracam, pushed 4 #blur on #YouTube. Great seeing @signalapp introduce on their secure messaging platform!&rdquo;</p> <p>I am beyond thrilled that this has happened, especially right now, because it means users have an option, within the secure messenger they are already using, to capture photos directly to encrypted storage, redact and blur as needed, and then instantly share them in an encrypted manner to trusted contacts. With disappearing messages enabled, the presence of that image on their phone is ephemeral, reducing risk for self-incrimination if they are detained.</p> <p>NOW, I write all of this to you, because as fantastic as it is that Signal&rsquo;s tens of millions of users have this feature, we need this built-in as a normal capability in every device, every camera software and every messenger app. Just like with end-to-end encryption, Signal is leading the way in showing how this capability can be standardized and usable for all.</p> <p>We should probably create a petition or other public call to action. Right now, I think Signal should get the acclaim they deserve for furthering this idea, and pioneering just how secure a messenger app can be. If you have any ins, sway, influence or other connections to any other messenger service, social media or camera app, or mobile operating system vendor, please forward this, and let them know that we here ready to share the insights and wisdom we&rsquo;ve gained over the last decade in how to implement this critical privacy feature correctly.</p> https://guardianproject.info/archive/apps/ Mon, 01 Jan 0001 00:00:00 +0000 https://guardianproject.info/archive/apps/ <p>These are all totally unmaintained and just listed here for the record.</p> <div class="container"> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.otr.app.im.1423001.png" height="96" width="96"/> <div> <h2></h2> <p></p> <i class="fa fa-calendar"></i>&nbsp;Posted on March 19, 2013 &nbsp;(Last modified on December 2, 2016) <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/ChatSecureAndroid" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://dev.guardianproject.info/projects/gibberbot" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.browser.7010.png" height="96" width="96"/> <div> <h2></h2> <p>Privacy-enhanced browser</p> <i class="fa fa-calendar"></i>&nbsp;Posted on October 22, 2012 &nbsp;(Last modified on November 26, 2015) <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/orweb" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://guardianproject.info/apps/orweb" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> <p>Orweb is a companion browser to <a href="https://f-droid.org/packages/org.torproject.android/">https://f-droid.org/packages/org.torproject.android/</a>, the port of Tor to Android.</p> <p>Orbot anonymizes internet traffic by routing it through many different stages and you must have that enabled first, though root isn&rsquo;t needed. Orweb disables certain other browser features that could be used to identify you.</p> <p>Please note that Orweb is superseded by Tor Browser. Orweb is no longer maintained at all.</p> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.lildebi.5400.png" height="96" width="96"/> <div> <h2></h2> <p>Run Debian on your phone</p> <i class="fa fa-calendar"></i>&nbsp;Posted on February 6, 2013 &nbsp;(Last modified on January 26, 2015) <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/lildebi" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://github.com/guardianproject/lildebi/wiki" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> <p>Lil&rsquo; Debi builds up a whole Debian chroot on your phone entirely using debootstrap. You choose the release, mirror, and size of the disk image, and away it goes. It could take up to an hour on a slow device.</p> <p>Then it has a simple chroot manager that fscks your disk, mounts/unmounts things, starts/stops sshd if you have it installed, etc. You can also then use ‘apt-get’ to install any package that is released for ARM processors. This includes things like a complete real shell, Tor, TraceRouteTCP, iwconfig/ipconfig, and other security and crypto tools. Works well with <a href="https://f-droid.org/packages/jackpal.androidterm">https://f-droid.org/packages/jackpal.androidterm</a> —just run <code>/debian/shell</code> to get a Debian shell.</p> <p>The aim of Lil’ Debi is to provide a transparent and tightly integrated Debian install on your Android device. It mounts all of your Android partitions in Debian space, so you see a fusion of both systems. It&rsquo;s even possible to have Lil’ Debi launch the normal Debian init start-up scripts when it starts, so that all you need to do is apt-get install and any servers you install will just work.</p> <p>Lil&rsquo; Debi works with as few modifications to the Android system as possible. Currently, it only adds a /bin symlink, and a /debian mount directory. It does not touch /system at all.</p> <p>Requires root: Yes, because it needs to run debootstrap, create dirs in /, mount/umount, etc.</p> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.mrapp.118.png" height="96" width="96"/> <div> <h2></h2> <p>produce professional-grade videos with your phone</p> <i class="fa fa-calendar"></i>&nbsp;Posted on October 31, 2013 &nbsp;(Last modified on July 19, 2014) <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/storymaker" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://storymaker.cc/" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> Creating great stories is now easier than ever with StoryMaker. Our unique templates, overlays, and lessons guide you through the entire creative process. StoryMaker lets you edit your content right on your mobile, making it even easier to finish your story. Once you&rsquo;ve finished, StoryMaker lets you publish your story to all of your favorite platforms. * AUDIO PHOTO &amp; VIDEO * Whether it’s a photo series, an audio story, or a video package, StoryMaker walks you through what you need to know in order to be successful. * TEMPLATES * Our story templates offer suggested narrative arcs, and potential questions to give you structure, but leave you enough room to tell the story you want. * LEARN * Designed by a group of trainers with years of experience working in the field, StoryMaker is the tool you need to tell the stories you&rsquo;re passionate about, while staying safe. StoryMaker has access to a 55 lesson course in Journalism, Security, Photo, Audio, and Video production. So when you’re ready to dive deep and learn everything you can, we have the lessons to get you started. * OVERLAYS * Everyone recognizes an interview or a location shot when they see them on the news, but with StoryMaker’s innovative overlays it’s easy to recreate the shot you want when it matters the most, at the point of production. * EDIT * StoryMaker lets you rearrange and trim your clips to tweak them to perfection, it even makes it easy to record your own narration to go with your story. * SHARE * When your story is ready you can share it across all of your favorite platforms straight from StoryMaker. * SECURITY * StoryMaker takes security seriously. Our integration with Orbot allows for supported platforms to be accessed via Tor. StoryMaker relies upon Orbot, for defending against network surveillance and enabling circumvention on hostile networks. * EXPERIENCE * StoryMaker is successful because our creative team is filled with trainers with years of experience. People who have been in the field, and know how to break complex ideas down into easy to follow instructions. * MULTILINGUAL * StoryMaker supports English, Arabic, Croation/Bosnian, and Serbian languages. With experimental translations in French, Spanish, Persian, German, Macedonian and Korean. If you find issues, or would like to participate in our localization effort, please visit our wiki for more instructions: <a href="http://storymaker.cc/wiki/index.php?title=Translation">http://storymaker.cc/wiki/index.php?title=Translation</a> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.courier.14.png" height="96" width="96"/> <div> <h2></h2> <p></p> <i class="fa fa-calendar"></i>&nbsp;Posted on May 14, 2014 <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/securereader" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://dev.guardianproject.info/projects/secure-reader" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.gpg.4.png" height="96" width="96"/> <div> <h2></h2> <p>GnuPG via gpgcli</p> <i class="fa fa-calendar"></i>&nbsp;Posted on May 8, 2013 &nbsp;(Last modified on March 12, 2014) <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/gnupg-for-android" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://guardianproject.info/code/gnupg" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> <p>GnuPrivacyGuard extends the gpgcli command line tool to bring an integrated privacy engine to your Android. It gives you command line access to the entire GnuPG suite of encryption software. It also serves as the test bed for complete Android integration for all of GnuPG&rsquo;s crypto services, including OpenPGP, symmetric encryption, and more.</p> <p>GPG is GNU’s tool for end-to-end secure communication and encrypted data storage. This trusted protocol is the free software alternative to PGP. This app is built upon GnuPG 2.1, the new modularized version of GnuPG that now supports S/MIME.</p> <p>GPG aims to provide an integrated experience, so clicking on PGP files should &ldquo;just work&rdquo;. You can also share files to GPG to encrypt them. GPG will also respond when you click on a PGP fingerprint URL (one that starts with openpgp4fpr:).</p> <p>Before using GPG, be sure to launch the app and let it finish its installation process. Once it has completed, then you&rsquo;re ready to use it. The easiest way to get started with GPG is to install <a href="https://f-droid.org/packages/jackpal.androidterm">https://f-droid.org/packages/jackpal.androidterm</a>. GPG will automatically configure Android Terminal Emulator as long as you have the &ldquo;Allow PATH extensions&rdquo; settings enabled.</p> <p>Status: Unmaintained, use <a href="https://f-droid.org/packages/org.sufficientlysecure.keychain/">https://f-droid.org/packages/org.sufficientlysecure.keychain/</a></p> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.notepadbot.12.png" height="96" width="96"/> <div> <h2></h2> <p>Notepad with lock</p> <i class="fa fa-calendar"></i>&nbsp;Posted on January 16, 2013 &nbsp;(Last modified on March 10, 2014) <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/notecipher" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://guardianproject.info" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> <p>Simple app for taking notes that encrypts everything behind a password.</p> <p>Status: Unmaintained.</p> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.soundrecorder.2.png" height="96" width="96"/> <div> <h2></h2> <p>ChatSecure Voice Messaging</p> <i class="fa fa-calendar"></i>&nbsp;Posted on December 13, 2013 <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/ChatSecureVoicePlugin" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://guardianproject.info/apps/chatsecure" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> This is a plugin for [[info.guardianproject.otr.app.im]]. It does not have any function on its own. For Your Ears Only&hellip; completely private, end-to-end encryption voice message recording, sending, receiving and playback.</p> <ul> <li>For use with [[info.guardianproject.otr.app.im]]&rsquo;s encrypted &ldquo;Off-the-record&rdquo; data stream</li> <li>Works over Tor - the ONLY Onion-routed voice messaging system, for total anonymity</li> </ul> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/org.witness.informacam.app.35.png" height="96" width="96"/> <div> <h2>CameraV: Secure Visual Proof</h2> <p></p> <i class="fa fa-calendar"></i>&nbsp;Posted on December 11, 2013 <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/CameraV" target="_blank" title="CameraV: Secure Visual Proof on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://guardianproject.info/apps/camerav/" title="CameraV: Secure Visual Proof website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.chatsecure.emoji.core.1.png" height="96" width="96"/> <div> <h2></h2> <p>ChatSecure Open Emoji Plugin</p> <i class="fa fa-calendar"></i>&nbsp;Posted on December 2, 2013 <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/ChatSecureVoicePlugin" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://guardianproject.info/apps/chatsecure" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> Plugin for <a href="https://f-droid.org/packages/info.guardianproject.otr.app.im/">https://f-droid.org/packages/info.guardianproject.otr.app.im/</a> to support for core emoji input and display. Based on &ldquo;Phantom Open Emoji&rdquo; project. </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.cacert.4.png" height="96" width="96"/> <div> <h2></h2> <p>Disable untrusted certificates</p> <i class="fa fa-calendar"></i>&nbsp;Posted on August 19, 2013 &nbsp;(Last modified on October 31, 2013) <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/cacert" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://guardianproject.info/2011/09/05/cacertman-app-to-address-diginotar-other-bad-cas" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> <p>Android 4+ allows you to disable certificates from the system Settings and root isn&rsquo;t required, so try that first if you want to manually mess with the certificates. The app won&rsquo;t work with Android 4+ anyway.</p> <p>An app to manage security certificates on your phone also containing a version of the Android CACert keystore derived from Mozilla. If a certificate has recently become untrusted you can either install an update to this app or you can backup and remove certificates by yourself.</p> <p>Requires root: Yes, it writes to the system partition. You will need a device that has the ‘grep’ command on it (via busybox: present on most custom ROMs). If the ‘save’ doesn’t work, then you will need to make your /system partition read-write by using a file explorer like <a href="https://f-droid.org/packages/com.ghostsq.commander">https://f-droid.org/packages/com.ghostsq.commander</a> or via a command in <a href="https://f-droid.org/packages/jackpal.androidterm">https://f-droid.org/packages/jackpal.androidterm</a>.</p> </p> </div> <hr/> </div> https://guardianproject.info/archive/apps/ Mon, 01 Jan 0001 00:00:00 +0000 https://guardianproject.info/archive/apps/ <p>These are all totally unmaintained and just listed here for the record.</p> <div class="container"> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.otr.app.im.1423001.png" height="96" width="96"/> <div> <h2></h2> <p></p> <i class="fa fa-calendar"></i>&nbsp;Posted on March 19, 2013 &nbsp;(Last modified on December 2, 2016) <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/ChatSecureAndroid" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://dev.guardianproject.info/projects/gibberbot" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.browser.7010.png" height="96" width="96"/> <div> <h2></h2> <p>Privacy-enhanced browser</p> <i class="fa fa-calendar"></i>&nbsp;Posted on October 22, 2012 &nbsp;(Last modified on November 26, 2015) <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/orweb" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://guardianproject.info/apps/orweb" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> <p>Orweb is a companion browser to <a href="https://f-droid.org/packages/org.torproject.android/">https://f-droid.org/packages/org.torproject.android/</a>, the port of Tor to Android.</p> <p>Orbot anonymizes internet traffic by routing it through many different stages and you must have that enabled first, though root isn&rsquo;t needed. Orweb disables certain other browser features that could be used to identify you.</p> <p>Please note that Orweb is superseded by Tor Browser. Orweb is no longer maintained at all.</p> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.lildebi.5400.png" height="96" width="96"/> <div> <h2></h2> <p>Run Debian on your phone</p> <i class="fa fa-calendar"></i>&nbsp;Posted on February 6, 2013 &nbsp;(Last modified on January 26, 2015) <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/lildebi" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://github.com/guardianproject/lildebi/wiki" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> <p>Lil&rsquo; Debi builds up a whole Debian chroot on your phone entirely using debootstrap. You choose the release, mirror, and size of the disk image, and away it goes. It could take up to an hour on a slow device.</p> <p>Then it has a simple chroot manager that fscks your disk, mounts/unmounts things, starts/stops sshd if you have it installed, etc. You can also then use ‘apt-get’ to install any package that is released for ARM processors. This includes things like a complete real shell, Tor, TraceRouteTCP, iwconfig/ipconfig, and other security and crypto tools. Works well with <a href="https://f-droid.org/packages/jackpal.androidterm">https://f-droid.org/packages/jackpal.androidterm</a> —just run <code>/debian/shell</code> to get a Debian shell.</p> <p>The aim of Lil’ Debi is to provide a transparent and tightly integrated Debian install on your Android device. It mounts all of your Android partitions in Debian space, so you see a fusion of both systems. It&rsquo;s even possible to have Lil’ Debi launch the normal Debian init start-up scripts when it starts, so that all you need to do is apt-get install and any servers you install will just work.</p> <p>Lil&rsquo; Debi works with as few modifications to the Android system as possible. Currently, it only adds a /bin symlink, and a /debian mount directory. It does not touch /system at all.</p> <p>Requires root: Yes, because it needs to run debootstrap, create dirs in /, mount/umount, etc.</p> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.mrapp.118.png" height="96" width="96"/> <div> <h2></h2> <p>produce professional-grade videos with your phone</p> <i class="fa fa-calendar"></i>&nbsp;Posted on October 31, 2013 &nbsp;(Last modified on July 19, 2014) <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/storymaker" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://storymaker.cc/" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> Creating great stories is now easier than ever with StoryMaker. Our unique templates, overlays, and lessons guide you through the entire creative process. StoryMaker lets you edit your content right on your mobile, making it even easier to finish your story. Once you&rsquo;ve finished, StoryMaker lets you publish your story to all of your favorite platforms. * AUDIO PHOTO &amp; VIDEO * Whether it’s a photo series, an audio story, or a video package, StoryMaker walks you through what you need to know in order to be successful. * TEMPLATES * Our story templates offer suggested narrative arcs, and potential questions to give you structure, but leave you enough room to tell the story you want. * LEARN * Designed by a group of trainers with years of experience working in the field, StoryMaker is the tool you need to tell the stories you&rsquo;re passionate about, while staying safe. StoryMaker has access to a 55 lesson course in Journalism, Security, Photo, Audio, and Video production. So when you’re ready to dive deep and learn everything you can, we have the lessons to get you started. * OVERLAYS * Everyone recognizes an interview or a location shot when they see them on the news, but with StoryMaker’s innovative overlays it’s easy to recreate the shot you want when it matters the most, at the point of production. * EDIT * StoryMaker lets you rearrange and trim your clips to tweak them to perfection, it even makes it easy to record your own narration to go with your story. * SHARE * When your story is ready you can share it across all of your favorite platforms straight from StoryMaker. * SECURITY * StoryMaker takes security seriously. Our integration with Orbot allows for supported platforms to be accessed via Tor. StoryMaker relies upon Orbot, for defending against network surveillance and enabling circumvention on hostile networks. * EXPERIENCE * StoryMaker is successful because our creative team is filled with trainers with years of experience. People who have been in the field, and know how to break complex ideas down into easy to follow instructions. * MULTILINGUAL * StoryMaker supports English, Arabic, Croation/Bosnian, and Serbian languages. With experimental translations in French, Spanish, Persian, German, Macedonian and Korean. If you find issues, or would like to participate in our localization effort, please visit our wiki for more instructions: <a href="http://storymaker.cc/wiki/index.php?title=Translation">http://storymaker.cc/wiki/index.php?title=Translation</a> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.courier.14.png" height="96" width="96"/> <div> <h2></h2> <p></p> <i class="fa fa-calendar"></i>&nbsp;Posted on May 14, 2014 <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/securereader" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://dev.guardianproject.info/projects/secure-reader" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.gpg.4.png" height="96" width="96"/> <div> <h2></h2> <p>GnuPG via gpgcli</p> <i class="fa fa-calendar"></i>&nbsp;Posted on May 8, 2013 &nbsp;(Last modified on March 12, 2014) <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/gnupg-for-android" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://guardianproject.info/code/gnupg" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> <p>GnuPrivacyGuard extends the gpgcli command line tool to bring an integrated privacy engine to your Android. It gives you command line access to the entire GnuPG suite of encryption software. It also serves as the test bed for complete Android integration for all of GnuPG&rsquo;s crypto services, including OpenPGP, symmetric encryption, and more.</p> <p>GPG is GNU’s tool for end-to-end secure communication and encrypted data storage. This trusted protocol is the free software alternative to PGP. This app is built upon GnuPG 2.1, the new modularized version of GnuPG that now supports S/MIME.</p> <p>GPG aims to provide an integrated experience, so clicking on PGP files should &ldquo;just work&rdquo;. You can also share files to GPG to encrypt them. GPG will also respond when you click on a PGP fingerprint URL (one that starts with openpgp4fpr:).</p> <p>Before using GPG, be sure to launch the app and let it finish its installation process. Once it has completed, then you&rsquo;re ready to use it. The easiest way to get started with GPG is to install <a href="https://f-droid.org/packages/jackpal.androidterm">https://f-droid.org/packages/jackpal.androidterm</a>. GPG will automatically configure Android Terminal Emulator as long as you have the &ldquo;Allow PATH extensions&rdquo; settings enabled.</p> <p>Status: Unmaintained, use <a href="https://f-droid.org/packages/org.sufficientlysecure.keychain/">https://f-droid.org/packages/org.sufficientlysecure.keychain/</a></p> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.notepadbot.12.png" height="96" width="96"/> <div> <h2></h2> <p>Notepad with lock</p> <i class="fa fa-calendar"></i>&nbsp;Posted on January 16, 2013 &nbsp;(Last modified on March 10, 2014) <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/notecipher" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://guardianproject.info" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> <p>Simple app for taking notes that encrypts everything behind a password.</p> <p>Status: Unmaintained.</p> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.soundrecorder.2.png" height="96" width="96"/> <div> <h2></h2> <p>ChatSecure Voice Messaging</p> <i class="fa fa-calendar"></i>&nbsp;Posted on December 13, 2013 <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/ChatSecureVoicePlugin" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://guardianproject.info/apps/chatsecure" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> This is a plugin for [[info.guardianproject.otr.app.im]]. It does not have any function on its own. For Your Ears Only&hellip; completely private, end-to-end encryption voice message recording, sending, receiving and playback.</p> <ul> <li>For use with [[info.guardianproject.otr.app.im]]&rsquo;s encrypted &ldquo;Off-the-record&rdquo; data stream</li> <li>Works over Tor - the ONLY Onion-routed voice messaging system, for total anonymity</li> </ul> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/org.witness.informacam.app.35.png" height="96" width="96"/> <div> <h2>CameraV: Secure Visual Proof</h2> <p></p> <i class="fa fa-calendar"></i>&nbsp;Posted on December 11, 2013 <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/CameraV" target="_blank" title="CameraV: Secure Visual Proof on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://guardianproject.info/apps/camerav/" title="CameraV: Secure Visual Proof website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.chatsecure.emoji.core.1.png" height="96" width="96"/> <div> <h2></h2> <p>ChatSecure Open Emoji Plugin</p> <i class="fa fa-calendar"></i>&nbsp;Posted on December 2, 2013 <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/ChatSecureVoicePlugin" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://guardianproject.info/apps/chatsecure" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> Plugin for <a href="https://f-droid.org/packages/info.guardianproject.otr.app.im/">https://f-droid.org/packages/info.guardianproject.otr.app.im/</a> to support for core emoji input and display. Based on &ldquo;Phantom Open Emoji&rdquo; project. </p> </div> <hr/> <style> img { float: left; margin-right: 15px; } </style> <div class="archiveapp" style="display: inline; width: 100%; height: 100%;"> <img src="https://guardianproject.info/fdroid/archive/icons-320/info.guardianproject.cacert.4.png" height="96" width="96"/> <div> <h2></h2> <p>Disable untrusted certificates</p> <i class="fa fa-calendar"></i>&nbsp;Posted on August 19, 2013 &nbsp;(Last modified on October 31, 2013) <div class="source-code" style="text-align: left;"> <a href="https://github.com/guardianproject/cacert" target="_blank" title=" on GitHub"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.info/tags/" title=" Blog Posts"> <i class="fa fa-rss"></i> Blog Posts </a> - <a href="https://guardianproject.info/2011/09/05/cacertman-app-to-address-diginotar-other-bad-cas" title=" website"> <i class="fa fa-home"></i> website </a> </div> </div> <p> <p>Android 4+ allows you to disable certificates from the system Settings and root isn&rsquo;t required, so try that first if you want to manually mess with the certificates. The app won&rsquo;t work with Android 4+ anyway.</p> <p>An app to manage security certificates on your phone also containing a version of the Android CACert keystore derived from Mozilla. If a certificate has recently become untrusted you can either install an update to this app or you can backup and remove certificates by yourself.</p> <p>Requires root: Yes, it writes to the system partition. You will need a device that has the ‘grep’ command on it (via busybox: present on most custom ROMs). If the ‘save’ doesn’t work, then you will need to make your /system partition read-write by using a file explorer like <a href="https://f-droid.org/packages/com.ghostsq.commander">https://f-droid.org/packages/com.ghostsq.commander</a> or via a command in <a href="https://f-droid.org/packages/jackpal.androidterm">https://f-droid.org/packages/jackpal.androidterm</a>.</p> </p> </div> <hr/> </div> https://guardianproject.info/contact/chat/ Mon, 01 Jan 0001 00:00:00 +0000 https://guardianproject.info/contact/chat/ <ul style="line-height:150%"> <li> We welcome all questions, from the most beginner to advanced topics </li> <li> Just ask your question, you don't need to ask permission first </li> <li> Be patient, it might take some time for someone to see and answer your question. </li> <li> We want your questions, and we try to answer as many as we can! </li> </ul> <p><a href="https://matrix.to/#/%23guardianproject%3amatrix.org"><img src="https://guardianproject.info/wp-content/uploads/2010/05/chat.jpg" alt="#guardianproject:matrix.org" /></a> <br/> <center><a href="https://matrix.to/#/%23guardianproject%3amatrix.org">#guardianproject:matrix.org</a></center></p> https://guardianproject.info/contact/chat/ Mon, 01 Jan 0001 00:00:00 +0000 https://guardianproject.info/contact/chat/ <ul style="line-height:150%"> <li> We welcome all questions, from the most beginner to advanced topics </li> <li> Just ask your question, you don't need to ask permission first </li> <li> Be patient, it might take some time for someone to see and answer your question. </li> <li> We want your questions, and we try to answer as many as we can! </li> </ul> <p><a href="https://matrix.to/#/%23guardianproject%3amatrix.org"><img src="https://guardianproject.info/wp-content/uploads/2010/05/chat.jpg" alt="#guardianproject:matrix.org" /></a> <br/> <center><a href="https://matrix.to/#/%23guardianproject%3amatrix.org">#guardianproject:matrix.org</a></center></p> https://guardianproject.info/contact/android-python-contractor/ Mon, 01 Jan 0001 00:00:00 +0000 https://guardianproject.info/contact/android-python-contractor/ <p>Guardian Project is seeking Android/Python contractors for mobile/free software/privacy work!</p> <p>We&rsquo;re looking for self-motivated, free software hackers to work with Guardian Project on privacy and internet freedom for mobile devices. Our work is 100% free software and we have a steady stream of projects that tie into F-Droid, Tor, IPFS, Debian, and censorship circumvention. We work to support people and communities around the world. This is a flexible, remote position but we also like to work in person when possible.</p> <h3 id="about-you">About you</h3> <ul> <li>Have at least a few years of experience with native Android development and/or Python.</li> <li>Demonstrated the ability to work collaboratively.</li> <li>Understand public, free software workflows</li> <li>Are proactive and self-directed.</li> <li>Fluent in Git.</li> </ul> <h3 id="bonus-points-for">Bonus points for</h3> <ul> <li>Ruby/Go/C/Rust skills</li> <li>Debian (and derivatives)</li> <li>Ansible/Docker/Vagrant/Kubernetes</li> <li>Experience with GitLab and its API</li> <li>Understanding privacy implications of metadata</li> <li>Life experiences that are underrepresented in tech work</li> <li>Fluency in more than one language</li> <li>User research and UX design</li> <li>Blogging and writing</li> </ul> <h2 id="about-us">About us</h2> <p>This is for projects managed by Hans-Christoph Steiner. We work in Vienna, Austria so ideally you work in a similar time zone, but that is not a requirement. We work in English but our team members speak many languages. Work is contract-based but with the possibility to shift into full-time employment in the future.</p> <p>Please reply to <a href="mailto:jobs@guardianproject.info">jobs@guardianproject.info</a> or find us in any of the regular channels!</p> https://guardianproject.info/contact/android-python-contractor/ Mon, 01 Jan 0001 00:00:00 +0000 https://guardianproject.info/contact/android-python-contractor/ <p>Guardian Project is seeking Android/Python contractors for mobile/free software/privacy work!</p> <p>We&rsquo;re looking for self-motivated, free software hackers to work with Guardian Project on privacy and internet freedom for mobile devices. Our work is 100% free software and we have a steady stream of projects that tie into F-Droid, Tor, IPFS, Debian, and censorship circumvention. We work to support people and communities around the world. This is a flexible, remote position but we also like to work in person when possible.</p> <h3 id="about-you">About you</h3> <ul> <li>Have at least a few years of experience with native Android development and/or Python.</li> <li>Demonstrated the ability to work collaboratively.</li> <li>Understand public, free software workflows</li> <li>Are proactive and self-directed.</li> <li>Fluent in Git.</li> </ul> <h3 id="bonus-points-for">Bonus points for</h3> <ul> <li>Ruby/Go/C/Rust skills</li> <li>Debian (and derivatives)</li> <li>Ansible/Docker/Vagrant/Kubernetes</li> <li>Experience with GitLab and its API</li> <li>Understanding privacy implications of metadata</li> <li>Life experiences that are underrepresented in tech work</li> <li>Fluency in more than one language</li> <li>User research and UX design</li> <li>Blogging and writing</li> </ul> <h2 id="about-us">About us</h2> <p>This is for projects managed by Hans-Christoph Steiner. We work in Vienna, Austria so ideally you work in a similar time zone, but that is not a requirement. We work in English but our team members speak many languages. Work is contract-based but with the possibility to shift into full-time employment in the future.</p> <p>Please reply to <a href="mailto:jobs@guardianproject.info">jobs@guardianproject.info</a> or find us in any of the regular channels!</p> https://guardianproject.info/team/ Mon, 01 Jan 0001 00:00:00 +0000 https://guardianproject.info/team/ <p>Over the last four years, we&rsquo;ve been slowly building up our team of core contributors to the project. Below you&rsquo;ll find &ldquo;privatized&rdquo; photos of our core team, their IRC handles, and a bit about who they are and what they do for the project.</p> <p>We&rsquo;d also like to recognize the many contributions of patches, bug reports, feedback and ideas we have received from members of our larger community.</p> <div class="team-member"> <h3>abelxluck <a href="https://gitlab.com/abelxluck" target="_blank" title="abelxluck on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/abeluck" target="_blank" title="abelxluck on Github"> <i class="fa fa-github"></i> </a> <a href="https://twitter.com/abelxluck" target="_blank" title="abelxluck on Twitter"> <i class="fa fa-twitter"></i> </a> </h3> <img style="float: right;" src="../abelxluck.png" title="abelxluck" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Hacker &amp; Researcher</li> <li>Developer on Guardian ops suite</li> <li><i class="fa fa-matrix-org"></i> <a href="https://matrix.to/#/%40abel%3aneo.keanu.im"><tt>@abel:neo.keanu.im</tt></a></li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0x9185813DDCCD789E5D4BA51B884B649C340C81F4">9185813DDCCD789E5D4BA51B884B649C340C81F4</a></li> </ul> </div> <div class="team-member"> <h3>rosa </h3> <img style="float: right;" src="../rosa.png" title="rosa" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Operations Operative</li> <li>Partnership, products and for-hire services</li> </ul> </div> <div class="team-member"> <h3>n-pex <a href="https://gitlab.com/n-pex" target="_blank" title="n-pex on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/n-pex" target="_blank" title="n-pex on Github"> <i class="fa fa-github"></i> </a> </h3> <img style="float: right;" src="../n-pex.png" title="n-pex" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Mobile Master</li> </ul> </div> <div class="team-member"> <h3>n8fr8 <a href="https://gitlab.com/n8fr8" target="_blank" title="n8fr8 on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/n8fr8" target="_blank" title="n8fr8 on Github"> <i class="fa fa-github"></i> </a> <a href="https://twitter.com/n8fr8" target="_blank" title="n8fr8 on Twitter"> <i class="fa fa-twitter"></i> </a> </h3> <img style="float: right;" src="../n8fr8.png" title="n8fr8" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Founder and Director</li> <li>Developer on Orbot, Haven, ProofMode, ObscuraCam, Keanu and More!</li> <li><i class="fa fa-matrix-org"></i> <a href="https://matrix.to/#/%40n8fr8%3amatrix.org"><tt>@n8fr8:matrix.org</tt></a></li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0xBBE20FD6DA48A3DD4CC7DF41A801183E69B37AA9">BBE20FD6DA48A3DD4CC7DF41A801183E69B37AA9</a></li> </ul> </div> <div class="team-member"> <h3>threeletteracronym <a href="https://gitlab.com/threeletteracronym" target="_blank" title="threeletteracronym on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/tladesignz" target="_blank" title="threeletteracronym on Github"> <i class="fa fa-github"></i> </a> <a href="https://twitter.com/tladesignz" target="_blank" title="threeletteracronym on Twitter"> <i class="fa fa-twitter"></i> </a> </h3> <img style="float: right;" src="../threeletteracronym.png" title="threeletteracronym" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Programmer</li> <li><i class="fa fa-matrix-org"></i> <a href="https://matrix.to/#/%40threeletteracronym%3amatrix.org"><tt>@threeletteracronym:matrix.org</tt></a></li> </ul> </div> <div class="team-member"> <h3>uniq <a href="https://gitlab.com/uniqx" target="_blank" title="uniq on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/uniqx" target="_blank" title="uniq on Github"> <i class="fa fa-github"></i> </a> </h3> <img style="float: right;" src="../uniq.png" title="uniq" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0xEF909D4AD7079062A0BA1DD7725F386C05529A5A">EF909D4AD7079062A0BA1DD7725F386C05529A5A</a></li> </ul> </div> <div class="team-member"> <h3>daveo </h3> <img style="float: right;" src="../daveo.png" title="daveo" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Operations Operative</li> <li>Partnership, products and for-hire services</li> </ul> </div> <div class="team-member"> <h3>_hc <a href="https://gitlab.com/eighthave" target="_blank" title="_hc on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/eighthave" target="_blank" title="_hc on Github"> <i class="fa fa-github"></i> </a> <a href="https://twitter.com/hansstatus" target="_blank" title="_hc on Twitter"> <i class="fa fa-twitter"></i> </a> </h3> <img style="float: right;" src="../_hc.png" title="_hc" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Hacker &amp; Researcher</li> <li>Developer on Guardian developer tool suite</li> <li><i class="fa fa-matrix-org"></i> <a href="https://matrix.to/#/%40eighthave%3amatrix.org"><tt>@eighthave:matrix.org</tt></a></li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0xEE6620C7136B0D2C456C0A4DE9E28DEA00AA5556">EE6620C7136B0D2C456C0A4DE9E28DEA00AA5556</a></li> </ul> </div> <div class="team-member"> <h3>bim <a href="https://gitlab.com/bitmold" target="_blank" title="bim on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/bitmold" target="_blank" title="bim on Github"> <i class="fa fa-github"></i> </a> </h3> <img style="float: right;" src="../bim.png" title="bim" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Programmer</li> <li><i class="fa fa-matrix-org"></i> <a href="https://matrix.to/#/%40lexithesponge%3amatrix.org"><tt>@lexithesponge:matrix.org</tt></a></li> </ul> </div> <div class="team-member"> <h3>carrie <a href="https://gitlab.com/crwinfrey" target="_blank" title="carrie on Gitlab"> <i class="fa fa-gitlab"></i> </a> </h3> <img style="float: right;" src="../carrie.png" title="carrie" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Interaction Designer</li> <li>UI &amp; UX Developer</li> </ul> </div> <h2>Emeritus</h2> <div class="team-member"> <h3>miron </h3> <img style="float: right;" src="../miron.png" title="miron" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Futurist, computer geek, &amp; entrepreneur</li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0xBF6273FAEF7CC0BA1F562E50989F6B3048A116B5">BF6273FAEF7CC0BA1F562E50989F6B3048A116B5</a></li> </ul> </div> <div class="team-member"> <h3>vanevery </h3> <img style="float: right;" src="../vanevery.png" title="vanevery" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Guru of All Things Android</li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0x627180FBC6138C3E8E542D696C5B667D16790E46">627180FBC6138C3E8E542D696C5B667D16790E46</a></li> </ul> </div> <div class="team-member"> <h3>mark </h3> <img style="float: right;" src="../mark.png" title="mark" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Creative Technologist</li> <li>Strategy and Project Management</li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0xB605F087AE875CCA9B762A39EFBFA7278D8EFFDA">B605F087AE875CCA9B762A39EFBFA7278D8EFFDA</a></li> </ul> </div> <div class="team-member"> <h3>harlo <a href="https://github.com/harlo" target="_blank" title="harlo on Github"> <i class="fa fa-github"></i> </a> </h3> <img style="float: right;" src="../harlo.png" title="harlo" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Metadata Rockstar &amp; App Maker</li> <li>Developer on InformaCam, ObscuraCam</li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0x60FB69097B2A759811A86E0E67866BECA4469630">60FB69097B2A759811A86E0E67866BECA4469630</a></li> </ul> </div> <div class="team-member"> <h3>dj </h3> <img style="float: right;" src="../dj.png" title="dj" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Design, User Experience and Strategy</li> <li>Product Manager on Orbot, Gibberbot and beyond</li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0x29D99C07BEA7598B280782BE6692829CD2D2BE81">29D99C07BEA7598B280782BE6692829CD2D2BE81</a></li> </ul> </div> <div class="team-member"> <h3>lee </h3> <img style="float: right;" src="../lee.png" title="lee" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Hacker &amp; Phreaker</li> <li>Lead Developer on Open Secure Telephony Network/Ostel</li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0xD16F04E928688169B64088D5A84BF48A12CA3765">D16F04E928688169B64088D5A84BF48A12CA3765</a></li> </ul> </div> <div class="team-member"> <h3>josh <a href="https://gitlab.com/vitriolix" target="_blank" title="josh on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/vitriolix" target="_blank" title="josh on Github"> <i class="fa fa-github"></i> </a> <a href="https://twitter.com/vitriolix" target="_blank" title="josh on Twitter"> <i class="fa fa-twitter"></i> </a> </h3> <img style="float: right;" src="../josh.png" title="josh" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Designer and Code Ninja</li> <li>Storymaker Developer</li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0xC1A794D89F7846996245B7CAF2726EBB38D2C97C">C1A794D89F7846996245B7CAF2726EBB38D2C97C</a></li> </ul> </div> <div class="team-member"> <h3>noneck <a href="https://github.com/noneck" target="_blank" title="noneck on Github"> <i class="fa fa-github"></i> </a> <a href="https://twitter.com/noneck" target="_blank" title="noneck on Twitter"> <i class="fa fa-twitter"></i> </a> </h3> <img style="float: right;" src="../noneck.png" title="noneck" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0x43CAAB63BC96216D323ED8BA0DC78D8C8A21A058">43CAAB63BC96216D323ED8BA0DC78D8C8A21A058</a></li> </ul> </div> <div class="team-member"> <h3>jlhads </h3> <img style="float: right;" src="../jlhads.png" title="jlhads" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Advisor, Evangelist, Alpha User Extraordinaire</li> <li>Grant writing, speaking, meeting and other outreach</li> </ul> </div> https://guardianproject.info/team/ Mon, 01 Jan 0001 00:00:00 +0000 https://guardianproject.info/team/ <p>Over the last four years, we&rsquo;ve been slowly building up our team of core contributors to the project. Below you&rsquo;ll find &ldquo;privatized&rdquo; photos of our core team, their IRC handles, and a bit about who they are and what they do for the project.</p> <p>We&rsquo;d also like to recognize the many contributions of patches, bug reports, feedback and ideas we have received from members of our larger community.</p> <div class="team-member"> <h3>n8fr8 <a href="https://gitlab.com/n8fr8" target="_blank" title="n8fr8 on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/n8fr8" target="_blank" title="n8fr8 on Github"> <i class="fa fa-github"></i> </a> <a href="https://twitter.com/n8fr8" target="_blank" title="n8fr8 on Twitter"> <i class="fa fa-twitter"></i> </a> </h3> <img style="float: right;" src="../n8fr8.png" title="n8fr8" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Founder and Director</li> <li>Developer on Orbot, Haven, ProofMode, ObscuraCam, Keanu and More!</li> <li><i class="fa fa-matrix-org"></i> <a href="https://matrix.to/#/%40n8fr8%3amatrix.org"><tt>@n8fr8:matrix.org</tt></a></li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0xBBE20FD6DA48A3DD4CC7DF41A801183E69B37AA9">BBE20FD6DA48A3DD4CC7DF41A801183E69B37AA9</a></li> </ul> </div> <div class="team-member"> <h3>uniq <a href="https://gitlab.com/uniqx" target="_blank" title="uniq on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/uniqx" target="_blank" title="uniq on Github"> <i class="fa fa-github"></i> </a> </h3> <img style="float: right;" src="../uniq.png" title="uniq" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0xEF909D4AD7079062A0BA1DD7725F386C05529A5A">EF909D4AD7079062A0BA1DD7725F386C05529A5A</a></li> </ul> </div> <div class="team-member"> <h3>abelxluck <a href="https://gitlab.com/abelxluck" target="_blank" title="abelxluck on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/abeluck" target="_blank" title="abelxluck on Github"> <i class="fa fa-github"></i> </a> <a href="https://twitter.com/abelxluck" target="_blank" title="abelxluck on Twitter"> <i class="fa fa-twitter"></i> </a> </h3> <img style="float: right;" src="../abelxluck.png" title="abelxluck" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Hacker &amp; Researcher</li> <li>Developer on Guardian ops suite</li> <li><i class="fa fa-matrix-org"></i> <a href="https://matrix.to/#/%40abel%3aneo.keanu.im"><tt>@abel:neo.keanu.im</tt></a></li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0x9185813DDCCD789E5D4BA51B884B649C340C81F4">9185813DDCCD789E5D4BA51B884B649C340C81F4</a></li> </ul> </div> <div class="team-member"> <h3>_hc <a href="https://gitlab.com/eighthave" target="_blank" title="_hc on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/eighthave" target="_blank" title="_hc on Github"> <i class="fa fa-github"></i> </a> <a href="https://twitter.com/hansstatus" target="_blank" title="_hc on Twitter"> <i class="fa fa-twitter"></i> </a> </h3> <img style="float: right;" src="../_hc.png" title="_hc" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Hacker &amp; Researcher</li> <li>Developer on Guardian developer tool suite</li> <li><i class="fa fa-matrix-org"></i> <a href="https://matrix.to/#/%40eighthave%3amatrix.org"><tt>@eighthave:matrix.org</tt></a></li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0xEE6620C7136B0D2C456C0A4DE9E28DEA00AA5556">EE6620C7136B0D2C456C0A4DE9E28DEA00AA5556</a></li> </ul> </div> <div class="team-member"> <h3>n-pex <a href="https://gitlab.com/n-pex" target="_blank" title="n-pex on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/n-pex" target="_blank" title="n-pex on Github"> <i class="fa fa-github"></i> </a> </h3> <img style="float: right;" src="../n-pex.png" title="n-pex" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Mobile Master</li> </ul> </div> <div class="team-member"> <h3>rosa </h3> <img style="float: right;" src="../rosa.png" title="rosa" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Operations Operative</li> <li>Partnership, products and for-hire services</li> </ul> </div> <div class="team-member"> <h3>threeletteracronym <a href="https://gitlab.com/threeletteracronym" target="_blank" title="threeletteracronym on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/tladesignz" target="_blank" title="threeletteracronym on Github"> <i class="fa fa-github"></i> </a> <a href="https://twitter.com/tladesignz" target="_blank" title="threeletteracronym on Twitter"> <i class="fa fa-twitter"></i> </a> </h3> <img style="float: right;" src="../threeletteracronym.png" title="threeletteracronym" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Programmer</li> <li><i class="fa fa-matrix-org"></i> <a href="https://matrix.to/#/%40threeletteracronym%3amatrix.org"><tt>@threeletteracronym:matrix.org</tt></a></li> </ul> </div> <div class="team-member"> <h3>carrie <a href="https://gitlab.com/crwinfrey" target="_blank" title="carrie on Gitlab"> <i class="fa fa-gitlab"></i> </a> </h3> <img style="float: right;" src="../carrie.png" title="carrie" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Interaction Designer</li> <li>UI &amp; UX Developer</li> </ul> </div> <div class="team-member"> <h3>bim <a href="https://gitlab.com/bitmold" target="_blank" title="bim on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/bitmold" target="_blank" title="bim on Github"> <i class="fa fa-github"></i> </a> </h3> <img style="float: right;" src="../bim.png" title="bim" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Programmer</li> <li><i class="fa fa-matrix-org"></i> <a href="https://matrix.to/#/%40lexithesponge%3amatrix.org"><tt>@lexithesponge:matrix.org</tt></a></li> </ul> </div> <div class="team-member"> <h3>daveo </h3> <img style="float: right;" src="../daveo.png" title="daveo" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Operations Operative</li> <li>Partnership, products and for-hire services</li> </ul> </div> <h2>Emeritus</h2> <div class="team-member"> <h3>mark </h3> <img style="float: right;" src="../mark.png" title="mark" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Creative Technologist</li> <li>Strategy and Project Management</li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0xB605F087AE875CCA9B762A39EFBFA7278D8EFFDA">B605F087AE875CCA9B762A39EFBFA7278D8EFFDA</a></li> </ul> </div> <div class="team-member"> <h3>noneck <a href="https://github.com/noneck" target="_blank" title="noneck on Github"> <i class="fa fa-github"></i> </a> <a href="https://twitter.com/noneck" target="_blank" title="noneck on Twitter"> <i class="fa fa-twitter"></i> </a> </h3> <img style="float: right;" src="../noneck.png" title="noneck" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0x43CAAB63BC96216D323ED8BA0DC78D8C8A21A058">43CAAB63BC96216D323ED8BA0DC78D8C8A21A058</a></li> </ul> </div> <div class="team-member"> <h3>jlhads </h3> <img style="float: right;" src="../jlhads.png" title="jlhads" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Advisor, Evangelist, Alpha User Extraordinaire</li> <li>Grant writing, speaking, meeting and other outreach</li> </ul> </div> <div class="team-member"> <h3>josh <a href="https://gitlab.com/vitriolix" target="_blank" title="josh on Gitlab"> <i class="fa fa-gitlab"></i> </a> <a href="https://github.com/vitriolix" target="_blank" title="josh on Github"> <i class="fa fa-github"></i> </a> <a href="https://twitter.com/vitriolix" target="_blank" title="josh on Twitter"> <i class="fa fa-twitter"></i> </a> </h3> <img style="float: right;" src="../josh.png" title="josh" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Designer and Code Ninja</li> <li>Storymaker Developer</li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0xC1A794D89F7846996245B7CAF2726EBB38D2C97C">C1A794D89F7846996245B7CAF2726EBB38D2C97C</a></li> </ul> </div> <div class="team-member"> <h3>harlo <a href="https://github.com/harlo" target="_blank" title="harlo on Github"> <i class="fa fa-github"></i> </a> </h3> <img style="float: right;" src="../harlo.png" title="harlo" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Metadata Rockstar &amp; App Maker</li> <li>Developer on InformaCam, ObscuraCam</li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0x60FB69097B2A759811A86E0E67866BECA4469630">60FB69097B2A759811A86E0E67866BECA4469630</a></li> </ul> </div> <div class="team-member"> <h3>miron </h3> <img style="float: right;" src="../miron.png" title="miron" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Futurist, computer geek, &amp; entrepreneur</li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0xBF6273FAEF7CC0BA1F562E50989F6B3048A116B5">BF6273FAEF7CC0BA1F562E50989F6B3048A116B5</a></li> </ul> </div> <div class="team-member"> <h3>vanevery </h3> <img style="float: right;" src="../vanevery.png" title="vanevery" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Guru of All Things Android</li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0x627180FBC6138C3E8E542D696C5B667D16790E46">627180FBC6138C3E8E542D696C5B667D16790E46</a></li> </ul> </div> <div class="team-member"> <h3>dj </h3> <img style="float: right;" src="../dj.png" title="dj" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Design, User Experience and Strategy</li> <li>Product Manager on Orbot, Gibberbot and beyond</li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0x29D99C07BEA7598B280782BE6692829CD2D2BE81">29D99C07BEA7598B280782BE6692829CD2D2BE81</a></li> </ul> </div> <div class="team-member"> <h3>lee </h3> <img style="float: right;" src="../lee.png" title="lee" class="alignleft size-full" width="64" height="64"/> <ul class="team-member"> <li>Hacker &amp; Phreaker</li> <li>Lead Developer on Open Secure Telephony Network/Ostel</li> <li><i class="fa fa-gnupg"></i> PGP: <a href="https://pgp.mit.edu/pks/lookup?op=get&search=0xD16F04E928688169B64088D5A84BF48A12CA3765">D16F04E928688169B64088D5A84BF48A12CA3765</a></li> </ul> </div> https://guardianproject.info/code/tor-android/ Mon, 01 Jan 0001 00:00:00 +0000 https://guardianproject.info/code/tor-android/ <div class="source-code" style="text-align: center;"> <a href="https://gitlab.com/guardianproject/tor-android" target="_blank" title="tor-android on Gitlab"> <i class="fa fa-gitlab"></i> GitLab </a> - <a href="https://github.com/guardianproject/tor-android" target="_blank" title="tor-android on Github"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.github.io/tor-android" target="_blank" title="tor-android javadoc"> Javadoc </a> - <a href="https://guardianproject.info/tags/tor-android" target="_blank" title="tor-android blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /> <p>This is native Android <code>TorService</code> built on the Tor shared library built for Android. It is designed around the Android lifecycle. The included <em>libtor.so</em> binaries can also be used directly as a tor daemon. This is used in <a href="https://orbot.app/">Orbot</a>, <a href="https://gitlab.com/guardianproject/torservices">TorServices</a>, <a href="https://github.com/onionshare/onionshare-android">OnionShare</a>, and more.</p> <h3 id="features">Features</h3> <ul> <li>Native Android <code>TorService</code> for running Tor in a background service</li> <li>Designed around modern Android tools like <a href="https://developer.android.com/topic/libraries/architecture/workmanager/advanced/long-running">WorkManager</a></li> <li>Reproducible Build with included Vagrant setup for running them</li> </ul> <h2 id="source-code-repository">Source Code Repository</h2> <ul> <li>library, helpers, tests, and sample project: <a href="https://github.com/guardianproject/tor-android">https://github.com/guardianproject/tor-android</a></ul></li> </ul> <h2 id="downloads">Downloads</h2> <div class="gradle-line"> <p> The binary jar, source jar, and javadoc jar are all available on jcenter. To include them using gradle, add this line to your <i>build.gradle</i>: </p> <pre style="text-align: center;">implementation &#39;info.guardianproject:tor-android:0.4.7.14&#39;</pre> <p>Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:</p> <ul> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/tor-android/0.4.7.14/tor-android-0.4.7.14.jar">tor-android-0.4.7.14.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/tor-android/0.4.7.14/tor-android-0.4.7.14.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/tor-android/0.4.7.14/tor-android-0.4.7.14-sources.jar">tor-android-0.4.7.14-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/tor-android/0.4.7.14/tor-android-0.4.7.14-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/tor-android/0.4.7.14/tor-android-0.4.7.14-javadoc.jar">tor-android-0.4.7.14-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/tor-android/0.4.7.14/tor-android-0.4.7.14-javadoc.jar.asc"><i>PGP signature</i></a>)</li> </ul> </div> https://guardianproject.info/code/tor-android/ Mon, 01 Jan 0001 00:00:00 +0000 https://guardianproject.info/code/tor-android/ <div class="source-code" style="text-align: center;"> <a href="https://gitlab.com/guardianproject/tor-android" target="_blank" title="tor-android on Gitlab"> <i class="fa fa-gitlab"></i> GitLab </a> - <a href="https://github.com/guardianproject/tor-android" target="_blank" title="tor-android on Github"> <i class="fa fa-github"></i> GitHub </a> - <a href="https://guardianproject.github.io/tor-android" target="_blank" title="tor-android javadoc"> Javadoc </a> - <a href="https://guardianproject.info/tags/tor-android" target="_blank" title="tor-android blog posts"> <i class="fa fa-rss"></i> blog posts </a> </div> <hr /> <p>This is native Android <code>TorService</code> built on the Tor shared library built for Android. It is designed around the Android lifecycle. The included <em>libtor.so</em> binaries can also be used directly as a tor daemon. This is used in <a href="https://orbot.app/">Orbot</a>, <a href="https://gitlab.com/guardianproject/torservices">TorServices</a>, <a href="https://github.com/onionshare/onionshare-android">OnionShare</a>, and more.</p> <h3 id="features">Features</h3> <ul> <li>Native Android <code>TorService</code> for running Tor in a background service</li> <li>Designed around modern Android tools like <a href="https://developer.android.com/topic/libraries/architecture/workmanager/advanced/long-running">WorkManager</a></li> <li>Reproducible Build with included Vagrant setup for running them</li> </ul> <h2 id="source-code-repository">Source Code Repository</h2> <ul> <li>library, helpers, tests, and sample project: <a href="https://github.com/guardianproject/tor-android">https://github.com/guardianproject/tor-android</a></ul></li> </ul> <h2 id="downloads">Downloads</h2> <div class="gradle-line"> <p> The binary jar, source jar, and javadoc jar are all available on jcenter. To include them using gradle, add this line to your <i>build.gradle</i>: </p> <pre style="text-align: center;">implementation &#39;info.guardianproject:tor-android:0.4.7.14&#39;</pre> <p>Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:</p> <ul> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/tor-android/0.4.7.14/tor-android-0.4.7.14.jar">tor-android-0.4.7.14.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/tor-android/0.4.7.14/tor-android-0.4.7.14.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/tor-android/0.4.7.14/tor-android-0.4.7.14-sources.jar">tor-android-0.4.7.14-sources.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/tor-android/0.4.7.14/tor-android-0.4.7.14-sources.jar.asc"><i>PGP signature</i></a>)</li> <li><a href="https://repo1.maven.org/maven2/info/guardianproject/tor-android/0.4.7.14/tor-android-0.4.7.14-javadoc.jar">tor-android-0.4.7.14-javadoc.jar</a> - (<a href="https://repo1.maven.org/maven2/info/guardianproject/tor-android/0.4.7.14/tor-android-0.4.7.14-javadoc.jar.asc"><i>PGP signature</i></a>)</li> </ul> </div>