Slashdot Mirror
Peek-a-Boo (ty)
Anemophilous Coward writes "Tom's Hardware has a story detailing cDc's new anonymity app, just demonstrated Sunday. Peek-A-Booty is designed to let surfers access sites blocked by government restrictions, and is essentially, a distributed proxy network. It uses a peer-to-peer model, masking the identity of each node. This means the user can route around censorship that blocks citizens' access to specific IP addresses, because the censor doesn't know they're going there. There is also a website dedicated to the project."
What exactly does that have to do with security? Doesn't a "security manager" have anything better to do? If anything, be concerned because it's an encrypted channel for information to move in an out, not that someone might <gasp> be doing some personal surfing on the job</gasp>.
If these sorts of applications make it harder for security "managers" to play Network nazi (small 'n'--Godwin's law does no apply here), that that is an added benefit, so far as I see.
One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
Where I work they have the drones' boxen locked down so they can't change their proxy settings. Thus PeekaBooty is not a problem.
The more inspired drones have installed Opera, which doesn't require administrator access to install in Windows. They could presumably use PB. They're a small minority, though.
--
E_NOSIG
Cat
Additionally, your security policy should have language forbidding the use of non-authorized software, thus making the use of said software a fireable offense.
Er, good side: USA. To find DeCSS or similar tools without fear of prosecution, for example, or to keep spreadin' the news that "Censorship bad, even when it's done by a (heh) democratically (heh heh) elected (heh heh heh) administration."
Depends on what your job is. If your job is to protect the bank from liability, anonymised browsing allows you to state with certainty "Nobody can link us or our employees with porn surfing. Not us, not nobody."
If you've been tasked with catching a known baddie in the act (perhaps at preteenlolitas.com), then you've got keyloggers, machine caches (they don't have admin access, right?) or just drop VNC on their machine and catch them with their pants down, so to speak.
I appreciate your concerns, but really, wouldn't it actually make your job easier if users showed a little courtesy and consideration, and stopped waving their dodgy surfing habits in your face (so to speak)?
If you were blocking sigs, you wouldn't have to read this.
So what you're saying is: "On the good side, fundamental human rights. On the bad side, makes life harder for pointy haired bosses who feel that lunch breaks spent playing cards are fine but lunch breaks surfing porn are an abomination.
And this gives you mixed feelings???
The problem: Say I'm a user who wants to connect to a Peek-A-Booty network. I need to get the address of a node to connect to. How do I get this? The obvious solution, and the one used for Gnutella and other peer-to-peer apps, is to publish a list of nodes (or at least one). But that won't work here -- because then the censors can use the same list to track down the nodes and block and/or disable them. This is especially problematic if you're using Peek-A-Booty as it claims it is meant to be: if you're in a country that filters access (say, China) and the government can track down the users trying to circumvent the filters, they can and will punish/torture/kill those people.
Peek-A-Booty has not solved this problem. Read what Tom's article has to say about it:
That's right -- the only way to connect to a Peek-A-Booty network is word-of-mouth, which is horribly ineffective. Finding a node will be extremely difficult unless you know the right people, and then it's very easy for the censor to ruin it. Trust the wrong person, and your whole network is exposed. Government spies could give out addresses that the claim are Peek-A-Booty networks, then catch anyone who tries to connect to those. Worst of all, they could just offer some huge incentive to people for turning in their friends.I hate to say it, but this system simply isn't ready yet. They have not come up with a technically sound solution.
-- Imagine how much more advanced our technology would be if we had eight fingers per hand.
So you mean I can go to any website out there, even if my websurfing is blocked? Great! How do I get this software? Oh go to this website. Hey. It's blocked.
I agree that jpegs of naked cheerleaders with hairy eyebrows are not security issues in and of themselves.
That doesn't really matter, though. The most vulnerable part of any corporate network is its users, now. A user who's violating the acceptable use policies for his or her employer's network is an automatic security risk. First, such an employee becomes a possible blackmail target. In the case of porn, a network admin must bar porn on a professional network because of the possibility of a sexual harassment suit being filed against the company. That means that the AUP must make accessing such materials through the corporate site a disciplinable offense...hey, presto, instant blackmail. Second, though, any user who is actively subverting procedures put in place to prevent such abuse must believe that he or she "knows better than you do". Although the user's right in the vast bulk of cases, the cost in those rare cases where they're wrong is disastrous. What if the site is malicious? If they can get around your barriers, then what else are they downloading? Do they necessarily even know? How tight are the barriers around their machines?
Would you be willing to bet the company on their care?
No this makes it a security issue. Remember, all web browsers have remote expoits in them from time to time. Pr0n sites tend to be the first one's to exploit these holes (to get email addresses, install software, pop up ad pushing, etc.) Surfing pr0n sites at work is an almost for sure way to compromise the office network.
Information-type limiting works against the very idea of the system.
I don't mind helping everyone equally. Even sexual predators- there are other ways to catch them.
Sorry, kiddie porn is not a trump card with me.
What we call folk wisdom is often no more than a kind of expedient stupidity.-Edward Abbey
From the sounds of it, that wouldn't work very well. It's based on P2P networking, so it would hop between known nodes, and likely have nodes added as other nodes inform your node of them.
So it would show up as a lot of connections to various IP's, not one single bannable IP.
Just because he doesn't fully explain the workings of a technological idea he has does not mean they are not tech, he is a writer not an engineer. If everything he wrote about was technologicly possible he would not be an author, he would be making billions off his inventions.
His media system is not perfect, but it follows some of the same principles that this new sofware follows. The Diamond Age was published in Feb 1995, if you can even remotely describe a technology that will not be invented for 7 years I will be impressed, even if you don't work out all the bugs right now.
Millions of drug users use this model quite happily.
My Karma: ran over your Dogma
StrawberryFrog
How about something even simpler - Jane the VP has all her login names and passwords recorded in Gator (or Password Tracker, or an Excel File)
"As God is my witness, I thought turkeys could fly." A. Carlson
Technology merits aside, why did they have to choose the name 'peek a booty' ?? This really isn't helping us getting rid of the 'pron-fiend-p2p-user' stereotype. I can't imagine the company or technology being recognized by corporate types, either.
-Linux was for the masses, who spoke, and everything was crystal clear.
I heard about this program a year ago. Back then I wasn't sure what to think about it, because cDc isn't one of the "software producers" I trust. Personally, I would never install anyhing written by them on my computer.
Peek-a-booty appears to be a valid program, and may even be really useful for people who have governments blocking them from freely accessing the internet. However, I do think that they should get rid of the cDc name, mainly because cDc is associated with lame backdoor trojans by a lot of people. Also, if it ever got mainstream media attention, it is likely that they would start the article by saying something like: "cDC, the makers of the infamous backdoor trojan program Backorifice...". This is likely to scare people from installing it.
Just my two cents...