Slashdot Mirror
Tinfoil Hat Linux: A Distribution for the Paranoid
An Anonymous Coward writes: " Tinfoil Hat Linux is a distribution designed to allow the signing and encrypting of documents with the utmost in security. The floppy-image has numerous security features including: entering your passphrase via a video game style selection process to combat hardware keystroke loggers, turning the contrast of your screen down to foil prying eyes and cameras, and to run background PGP processes."
I'd like to be among the first to point this out as a hoax. Maybe I'm wrong, but...dibs!
Got Rhinos?
Like I'm going to trust *them* to secure my Linux box.
I gotta try this when I get home. I guess you could have this as the workstation, and then have an OpenBSD box as a vault type NFS or something.
Luck favors the prepared, darling.
Does it include instructions on building a faraday cage to block stray em radiation (so noone can rebuild your screen?)
Service guarantees Citizenship! Questions Guarantee GITMO.... Amerika Uber Alles!
Speaking of Tinfoil Hats, the coolest comprehensive Tinfoil Hat site (More properly, Aluminum Foil Deflector Beanie) is here.
Also, it may be sampling error or psychosomatic effects, but I have never lost a chess game while wearing my Aluminum Foil Deflector Beanie.
Imagine! A secure Beowulf Cluster of these!
Yeah, i know it doesnt support networking, you needn't point it out...
"a distribution designed to allow the signing and encrypting of documents with the utmost in security"
I guess this is why it is called "Tinfoil Hat" and not "Wet Paper Bag Hat".
... is no distribution at all!!
What is Tinfoil Hat linux ?
It started as a secure, single floppy, bootable Linux distribution for storing PGP keys and then encrypting, signing and wiping files. At some point it became an exercise in over-engineering.
Tinfoil hat is useful if:
You're using a computer that could have a keystroke logger installed. http://www.keyghost.com is an example of a tiny & cheap hardware logger.
You need to use your personal GPG keys at work, school or a web hosting facility where you don't trust or own the equipment.
If you maintain a PGP Certificate Authority or signing key and have to have a safe place to use the CA key.
If you simply don't want to risk putting a PGP key on a hard drive where someone else might have access to it.
The Illuminati are watching your computer, and you need to use morse code to blink out your PGP messages on the numlock key.
Tinfoil hat linux files
readme.txt, also on the floppy image
The source code for files on the floppy
The tinfoilhat linux floppy image plus disk signature file Transfer this image to disk using rawrite (on windows) , dd on unix (dd if=tinfoil.img of=/dev/floppy ), or Diskcopy on a MAC.
FAQ
Q: Why doesn't the floppy I got at codecon match the signature above?
A: because I screwed up & wrote a nvram.md5 file to the floppy I then used as a master. I had to remove that file from every floppy. The result is that the MD5sum of the codecon floppies should be: 3608290765de7d5283a1a22813677a56
Q: How do I undo that horrible screen in paranoid mode?
A: Type "contrast" at the command prompt, or play with ctheme.
Q: Is this really a 1.0 stable release?
A: Think of this as a linux kernel 1.0 . Yes, it's stable to the best of my ability, and has been tested, but not for very long or by many people.
Q: What sort of hardware is required to run tinfoil hat?
A: Any 386DX or faster IBM compatible with more than 8 megs of RAM. Pretty much any PC made in the last 8 years will work fine.
Q: where do I send complaints, bugs & feature requests?
A: anonymous AT nameless DOT cultists.net
Q: What is the license for this distribution?
A: The scripts, documentation, and the distribution as a collection are released under a modified BSD license. Obviously, other people's software in this distribution retain their original licenses.
Check out my blog: My Galaxy is Milky Way Adjacent
For those of you not there.
:)
This was announced at codecon. The author passed out about 50 floppies with the distribution on it.
Really good idea. I may have to run this on my laptop
Thank you, the slashdotting has already taken place.
This topic just has too much potential....
Does this mean that the root passwords are limited to three letters? (and that ASS is the most common password?)
On a serious note, this doesn't protect against the special glasses the invisible NSA agents that are dropped from black helicopters that allow them to see through walls and watch my screen as I type my root password. I'm not using it.
The distribution UberSecureLinux, is actually a standard distribution of RedHat Linux 6.2, default installation, but it requires you to remove the PowerCord(TM) device from your PC. With PowerCord(TM) removed, your machine is effectively hacker-proof.
UberSecureLinux hopes to dispel the myths that RedHat 6.2 is one of the most hackable distributions of Linux.
From the readme:
If at all possible, boot THL on a laptop & disconnect all external
cables, including the power & mouse. Turn off nearby
radios, including cell phones and microwaves. Put yourself
and the computer in a well grounded opaque copper cube. Download
your tinfoil hat plans from http://zapatopi.net/afdb.html.
Boot the floppy....
Where can I get well grounded opaque copper cube? Can't find any on ebay.
-- ZeroZenith
Yeah, your distro might be secure, but the illuminati can watch you type, and can enter your hardware. It'll just be a matter of time until they can read the software indirectly.
Do what I do. Compute ONLY in your head! They'll never get that data!!
Oh shit... the orderly is comi...
Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
Just surround your computer with a cage made of chicken wire.
The problem is that as soon as you have to connect to the world outside (like through a network cable... or a power cord) you break the cage, and you've pretty much defeated the whole purpose.
And don't tell me about the incredibly tiny radiation leakage from your monitor carried by the power cord! The Illuminati can still read it!
The enemies of Democracy are
So..does it come with TEMPEST-proof console fonts too? I think that would be the big todo for the really paranoid (aside from coming with a foldout F cage). Highly anti-aliased fonts work decently (in theory) thrwarting VE screen captures but if you're running soley in the console I would think you're at a decent risk of having your data captured considering the regularity of the screen and the unique shaping of console fonts. A little off topic but I was wondering if one could impliment a Matrix style command shell where white space was replaced on screen from /dev/rand in a light font like light grey and then when you type the letters would either be dark grey or white to distinguish them from the random letter replacing white space. While somewhat hard to read it would cause so much static VE screen captures which of crappy monitors can be done with a slightly hacked AM radio, would be pretty difficult to make out. It would just be cool to make a shell that just did that to begin with. Pop open a terminal and have it look super funky would make a pretty badass shell theme.
I'm a loner Dottie, a Rebel.
The following DVDs ought to come bundled:
Enemy of the State
One Who Flew Over the Cuckoo's Nest
No Way Out
Pi
The Matrix
The Net
Jedidiah
--
Craft Beer Programming T-shirts
White Glove Linux is another similar distro. Ajay
http://www.ajaygautam.com
I can see it now:
:amidst the beeping and explosions: No, I'm logging into my Linux box!
PHB: Johnson! Are you playing space-invaders again?
Johnson:
PHB: Oh.. Can I get one for my system, too? That looks fun!
Thanks,
--
Matt
Google's Cache of the page
http://www.google.com/search?q=cache:Q4R-UBjh3wkC: tinfoilhat.cultists.net/+&hl=en
Got Rhinos?
This Tinfoil Hat linux would be called "Folie Hat Linux" in Swedish.
Instead of a floppy, why not use a cdrom? It can hold alot more, has faster load times, and many other features.
PLAC - Portable Linux Auditing CD
LNX-BBC
LBT
Apparently it comes with the following:
But does it keep Major League Baseball from spying on us from space?
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
Slashdot your box, then nothing gets in or out.
Infuriate left and right
The writeup has a link to Tin Foil Hat which is really a rant on how Liberals and Democrats are insane and cites the Presidential election of 2000 as proof.
It seems to me that Liberals and Democrats have historically been supporters of an Individual's right to privacy. Which is what this Linux distro. aims to provide. So why put in an inflamatory reference like this?
Could that link be the best explanation of the origin of the "Tin Foil Hat"? I shure hope it isn't.
If you're not living on the edge, you're taking up too much space.
Try again. Passphrase not entered directly by typing. Enjoy!
SIG: HUP
Read the post again-
"entering your passphrase via a video game style selection process to combat hardware keystroke loggers"
That sounds like the coolest feature to me.
Anybody else find this: "INVALID DNS SERVERS CONFIGURED AT CLIENT." on the site? Seems that there front page prints that, and anything else just shows up as not being there. A move to duck the Slashdotting?
SIG: HUP
When I saw this article for the first time appear on slashdot, I saw the following at the bottom:
( Read More... | 6 of 66 comments )
Does THAT make ME paranoid?
Don't sweat the petty things. But do pet the sweaty things.
I'd just put the spy code in the Bios. What else is distributed on every computer, and run every time they boot?
BWAHAAAAAHAAAA
follow to the diceware link off of the main page. pretty neat idea except for this ....
Recently, she wanted to give her Internet password to her husband so that he could get on line. However, she still wanted to be
able to exchange private messages with me that he would not be able to read. I, of course, introduced her to PGP.
Sorry, why the hell was that woman married? sorry but if you cant trust your spouse then you need to not be married, not ever get married, and probably even stop dating for that matter.
Do not look at laser with remaining good eye.
A nice addition would be tempest-resistant fonts! Here's a great article on tempest about tempest & creating fonts that are unreadable. Basically, the tempest setup only picks up the upper 30% of the frequency range, so this font has those components filtered out. But, the cool thing is that you can superimpose a (low amplitude) high-frequency pattern that isn't very visible to the user, but is visible to the tempest receiver. A whole fake Win98 screen transmitted? Here's the slide presentation for the above article (if you just want to look at the pretty pictures)
HIV Crosses Species Barrier... into Muppets
The tinfoil hat only serves to deliver a false sense of security.
To be truly secure, you need to build your own distribution. You need to understand what is being put on your system, and why. You need to be able to verify that the program that says it edits streams really does that, and does it without any funny business.
I ***know*** what it running on my system. I know this because I built the binaries myself. I know this because I can look at the source code and see what it does. This is the most beautiful feature of open source; the ability to let tinfoil hat wearers like myself have near-total assurance that our systems are running only the code we want them to run.
You don't get to say that if you're running Red Hat or Suse, or Windows or Mac. How do you know that any of these companies haven't been approached by the Feds and forced to include code that compromises your security and privacy?
Admittedly, it's going to be some time before I get to running KDE or Gnome. Of course, I can always install a standard distribution and see what is available today. But I appreciate the ability not to have to trust one of these distributions with my personal data, or my source code.
Actually, I'm still not to the point where I can run XFree86 yet, but EMACS using SVGATextMode on new hardware is so obscenely fast, why should I care? Except when I want to look at naked women.
That's why I have a Mac.
Is this truly the only Earth I can live on?
That is what the "video game" style password entry is for.
I dont see how software will help you get around this
It gets around this by not allowing users to input their passwords by using the letters on the keyboard. They use something similar to the arcade "Insert your name here:" interface where you move a cursor up and down to select the letters/numbers/symbols/spaces. It would probably start at a random place in the sequence too, so that the keylogger's capture of up x 15 down x 27 etc. is rendered useless.
Comments should be like skirts. Short enough to keep your attention, but long enough to cover the subject
As I understand it, that's where the "video game" interface comes in. It displays all the letters of the alphabet on screen, and you "type" your passphrase using the mouse, naver touching the keyboard.
The keylogger will get all your other keystrokes, but not your GPG passphrase...maybe the onscreen keyboard can be invoked at other times too.
Liberal (adj.): Free from bigotry; open to progress; tolerant of others.
Operator: Main LCD turn on
Cat: All my fonts are not belong to Tempest
Captain: What you say!!
Captain: You know what you doing
Cool, my new root password will now be up-up-down-down-left-right-left-right-B-A-start.
KRUD (http://www.tummy.com/krud) is another great secure option. A hardened Red Hat, comes out every month with all security updates/patches/etc. It's put together by Kevin Fenzi (author of the Security HOW-TO).
this is getting old and so are you
blog
No No No!
McFly777
- - -
"What do people mean when they say the computer went down on them?" -Marilyn Pittman
Clearly:, A
Up,Up,Down,Down,Left,Right,Left,Right,B
OpenBSD may or may not be a vault, but if you'r running a NFS server on it it'd be the equivalent of forgetting to lock the vault-door.
NFS is to security what Microsoft is to competition.
Acts@core.mailboks.com Acrux@core.mailboks.com Adam@core.mailboks.com Adar@core.mailboks.com Ada@core.mailboks.com
They probably could. After all, the Red Hat name is what they are actually selling.
So you not only make your own distribution, but you make your own userland tools? Unless yes to the above, your trusting someone.
The price of Keyghost Keylogger: $999.
Slashdot's first reaction to VMware
but the cia can read my mind with their satelites!
thats what the tinfoil is for
of this guy could probably be considered quite suspect by a large portion of the Slashdot community. have a look at this link listed as the second link in his "links" section.
Acts@core.mailboks.com Acrux@core.mailboks.com Adam@core.mailboks.com Adar@core.mailboks.com Ada@core.mailboks.com
Isn't the whole point that we _don't show_ anything as we type?
-jbn
Yep, just got them in PDF, format!
Paranoid
Delusional
Freak
HA HA!
I'm late I'm Late for a very important date
no thorazine and so I cry, I'm late I'm late I'm Late!
Service guarantees Citizenship! Questions Guarantee GITMO.... Amerika Uber Alles!
http://www.erikyyy.de/tempest/
Ive heard about scavenging screenshots from computers a couple hundred feet away using the EM signal, but had serious questions on how easy this was.
The above link does it in reverse plays MP3's through your MONITOR as an antenna !!!
Now, that said, I have more of a belief in a tempest like system, guess its time to get my copy of tinfiol linux
Sig went tro...aahemmm.....fishing........
-- Don Inodoro
or at least, as little text as possible. goddamn filter.
Well, you better write your own compiler too ;-)
"NFS is to security what Microsoft is to competition."
:)
:)
Uh, the one who ownz all?
Seriously, might want to rework that metaphore.
NFS is to security what Windows95osr1 is to stability?
Hmm, too long.
NFS is to security what Win95 is to stability.
Works I guess. Grammericaly incorrect, but the concept gets through.
Need help treating your acne? Come here!
So I guess I can't say that I fully understand how keystroke loggers work... do any of them (most of them?) also record a high-res timestamp with each keystroke?
What if you were able to type in a passphrase, but with a particular rhythm? Say, typing each individual letter of your passphrase to the rhythm of "shave and a haircut, two bits" or some such nonsense?
Of course this way, they could get the keystrokes, but if they don't know the precise rhythm of the keystrokes, they're SOL.
Go ahead, cynics. Now tell me it's a stupid idea... I'm waiting.
cat:
The "utmost in security" or the "utmost insecurity". The second is what I heard when the article was read to me this morning...
what's even more ironic is the fact that I added
"I mean I've known people who are infactuated with Linux but...."
just to make the point of the joke clearer to those who would not pick up on it.
Please help! I'm stuck inside my virtual reality headset!
turning the contrast of your screen down to foil prying eyes and cameras
So basically, you're going back to the old days. If monitors keep getting better and better, we'll have to make the OS interface worse and worse to compensate. Then maybe monitor manufacturing companies, when they see that demand for their new products is through the floor, perhaps they will stop advancing their technology. And when that happens, we can all blame the halt in technological advancement on Microsoft's anticompetitive business practices!
Everyone use Tinfoil Hat Linux! Surely it is the key to defeating Microsoft!
Lack of eloquence does not denote lack of intelligence, though they often coincide.
...I would never tell _you_. Go away! Why are you reading this, anyway? Are you trackin everything I post on the net? Don't I recognize you from behind the newspaper at the coffe shop?
Liberty uber alles.
And if it's causing interference, it's giving out a signal, most likely one that can be intercepted and read. The best solution is to buy TEMPEST certified products.
Hash: SHA1
.
x Tq /MvKzBdACgg++K
I'm the author of this program. It was intended as a clever
give away at code-con, but it should also be useful for other
people who carry their keys on floppy disks.
I hadn't intended a widespread distribution until I could put the kernel config
up & get a bunch of signatures on the signing key
Oh well.
In response to slashdot and the email flooding in:
The key will be up on keyservers shortly (if it isn't already. )
signatures to follow in the next few days. There isn't any TCP/IP
or network on this distribution, I'm not a christian redneck, keyghost
used to be cheaper, I can't fit tempest fonts on, since the console
is only greyscale. Direct FB fonts would be the answer, but I didn't do it.
And the "video game style" entry is clumsy, since I didn't want to re-invent
curses. It's all free if you want to improve it.
And now I'm about to get on a plane and be out of communication for a while
;-)
Slashcode is certain to break the signature, but here goes:
Anonymous
~
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE8csA+Fr26O2gKKPMRAp79AJ9/Ej1GyB2lnIxEPv2
uYFX2VCz3Bq9BPuv8kLGCQM=
=6oTm
-----END PGP SIGNATURE-----
Keep reading history and when you get to the part about Carnivore^H^H^H^H^H^H^H^H DCS-1000, notice which party implemented it and which party opposed it.
are for weenies. Real paranoids shop here.
Why did the parent of this get modded down? Quick Robin, to the metamod-cave.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
The phrase "tinfoil hat" has been a symbol of paranoia for several years now; it had apparently already grown into somewhat common usage I first ran across it in 1997. The link was to a copy of the original story that it was derived from, but most, if not all, of the political rantings were added in 2000.
Anyway, I'd like to make it clear that the content of the page probably in no way reflects the author's views; he most likely just thought it would be a good pun on "Red Hat."
boy, these jokes just never get old... *cough*
It would probably start at a random place in the sequence too, so that the keylogger's capture of up x 15 down x 27 etc. is rendered useless.
Not only that, but the alphabet on screen would have to be randomly rearranged on each invocation. If you know that the alphabet is arranged a certain way, and you have a list of keystrokes such as "up,up,up,enter,left,down,enter", it's less-than-trivial to brute force the space of possible cursor starting locations.
And hopefully you'll have a very strong "random" number generator to do it with, since the security of your key now depends entirely on the security of the pseudorandom algorithm.
Once you start going paranoid, there's no end of possibilities...
At least with grey/black LCD's, we won't have to worry about seeing a blue screen of death.... :-P
'The Late isotope23'!
Whatever will we do without isotope23???
Well, obviously if you're a student operating on a typical student's budget, $1K is a lot to spend on compromising your roommate's box.
But to even the smallest corporation or local government, a thousand dollars is pocket change, particularly when you consider the value of the information that could be gained with such a device.
(and as the other poster pointed out, they're actually only $200, which does make it a viable option for getting at your roommate's pr0n (assuming you aren't clever enough to find a cheaper alternative))
Karma: Bored. (Thinking about resurrecting the "Anyone else is an imposter" joke.)
Apparently, two morons moderated this as "offtopic". Let me explain:
Windows -> Lindows
Redhat -> Tinfoil Hat
Maybe Tinfoil is for the mildly paranoid but for the true paranoiac, there is OpenBSD. It hasn't had a hole in it's build in over 2 years and so forth. (There's more that I wont bother to go into. Maybe it's because I can't remember. What's there might be wrong, it's been a while.) *BSD is by far superior to anything Linux anyways, so why bother with Linux?
Are you telling me that you don't see the connection between government and laughing at people? - Interviewer
For the love of god, don't click on its link!
I was naïve to click on it...
The only secure storage is yourself, and you
must also be able to type directly in ciphertext.
Well, you'd better write your own kernel as well. Come to think about, what is stored in the microcode for the P6? Better make your own computer...
So you not only make your own distribution, but you make your own userland tools? Unless yes to the above, your [sic] trusting someone.
Or you just don't trust your linux box. Personally, I trust mine to some extent, but not completely, of course.
not the CIA. Major League Baseball. They're the ones we have to watch out for
Me lose brain? Uh, oh! (laughter) Why I laugh? -Homer Simpson
Offtopic: How does one join the illuminata?
What the hell are you doing the requires this much protection from the MiBs, NSA, Illuminati, or Big Brother? Jesus, get a life people, or a lawyer. Unless you are selling trade or state secrets, fermenting armed insurection or planning a terrorist action, or stealing from the above listed parties, you got NO REASON to use this much security.
Paranoid freaks!
You never installed OS/2 2.1, did you? THAT was long, tedious and the disks would alternate between working/not working. I still have it somewhere...
-- @rjamestaylor on Ello