Anonym.OS a Boon for Privacy Geeks?

The Hosting Guy writes "Wired is running an article about a live CD that makes anonymous browsing easy enough for everyone. 'So easy to use you can hand it to your grandmother and send her off on her own to the local Starbucks.' Anonym.OS makes extensive use of Tor, the onion routing network that relies on an array of servers passing encrypted traffic to permit untraceable surfing."

Comments

Privacy Geek

[(1 -sqrt(5))*(2**-1)]

I'm decidedly uncomfortable with the neologism "privacy geek": it implies that wanting to be left the hell alone is now fringe.

Has the will to un-molestation finally passed out of mainstream?

Re:Privacy Geek

[DogDude]

Has the will to un-molestation finally passed out of mainstream?

There's a big difference between not wanting the government to tap your phone and not wanting web sites to put a cookie on your PC. The latter is a "privacy geek" thing, and yes, that level of privacy is fringe.

Re:Privacy Geek

[poot_rootbeer]

Has the will to un-molestation finally passed out of mainstream?

Funny you should mention "molestation", because guess what behavior Big Brother is going to cite when they crack down on anonymous Internet proxying?

I value my privacy and will fight tooth and nail to preserve it. However, "privacy" and "anonymity" are not the same thing.

My home is private. My computer is private.
Anything I do outside of my home, whether I travel via foot or via wire, is public and there's a possibility that I may be seen or even recognized.

Re:Privacy Geek

[whoever57]

Anything I do outside of my home, whether I travel via foot or via wire, is public and there's a possibility that I may be seen or even recognized.

So you don't think warrants are required for any phone taps?

Re:Privacy Geek

[Apathist]

So you don't think warrants are required for any phone taps? Actually, that is a bit of a simplification. Wire taps are used to listen in to essentially private conversations between people who are expected to be friends/collegues/etc, hence the assumption of privacy.

On the other hand, wandering the public internet is akin to strolling in the park or mall, where one would not expect privacy to be guaranteed... and the officers of the Ministry of Love happily exploit that expectation.

Re:Privacy Geek

[(1 -sqrt(5))*(2**-1)]

Who the fuck uses the word neologism?

Students of Greek; neologism is actually a bit of a misnomer, though, since we're talking about the novel combination of predicate and noun. "Neo-epithet" would do the trick, but then I'm guilty of neologism.

"Privacy Geek" might also refer to someone who is an objective intellect simply studying the technical details of privacy laws as they pertain to todays digital culture.

It might; but the article touts making "anonymous browsing easy enough for everyone:" so they're clearly talking about the demos, or trough.

Re:Privacy Geek

[PoopMonkey]

On the other hand, wandering the public internet is akin to strolling in the park or mall, where one would not expect privacy to be guaranteed... and the officers of the Ministry of Love happily exploit that expectation.

The problem with this statement is that not all activity on the internet is like strolling in the park or mall. Many times activity on the internet is exactly like a phone call, a communicatin between friends/colleagues/etc. For instance, email or instant messaging. If you post something on a forum such as slashdot, however, in that case it's in the public.

Re:Privacy Geek

[c_forq]

I think if you have a letter in an envolope, you have phone line encrypteded (or if it is a line not connected to the larger standard grid), or you are using encryption/SSL on the internet you can expect protection from warrentless searches and privacy. But I don't think you should always expect a phone conversation to be private (it is insanely easy for someone else inside the same house/building to pick up onto the same line) especially wireless or cell phones (you can listen to cell phone conversations with $30 worth of gear from radioshack). Likewise with the amount of servers your queries may run through I don't think you should expect privacy on the internet. And with a unsealed letter you shouldn't expect that no one will read it (like a post-card).

I qoute the 4th ammendment:
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

Searching and seizing needs to be limited to private places and things, otherwise police can't arrest anyone anywhere without a warrant or confiscate drugs in public parks.

Re:Privacy Geek

[Jelloman]

On the other hand, wandering the public internet is akin to strolling in the park...
(pretending that's not a troll...)

The Internet being "public" is your assumption. You infer it, but it's certainly not implied.

The Internet is designed as an end-to-end architecture. AKA point-to-point, which is exactly what the telephone system is. It's not inherently designed to be public or private, but the end-to-end architecture certainly enables truly private communication (assuming the continuing existence of encryption technologies not broken or illegal), and to me it strongly suggests that, given demand, it should be a feature of most Internet applications. Which it sort of is, if you don't count security (i.e., my email and IM and web surfing is private, but that privacy is usually not very secure.)

Ultimately, the Internet with private communication is ten times as useful as the one without it. Maybe a thousand times. Hell, given the cultural impact, you can't measure the difference at all. It leads to two very different worlds.

Re:Privacy Geek

[YU Nicks NE Way]

Many times activity on the internet is exactly like a phone call, a communicatin between friends/colleagues/etc. For instance, email or instant messaging

Um...no. Unencrypted electronic mail is quite clearly not "private" in the legal sense of the word. (a) SMTP is a store and forward protocol, in which copies are made of each message at each intermediate point. You can't care very much about the contents of a message if you allow an unknown and anonymous intermediate to copy it, now can you? (b) TCP/IP itself works by packet relay through unknown computers. Same applies. The only way in which you can assert a reasonable expectation of privacy is if you send all packets encrypted. In any other case, no, you are doing the equivalent of playing telephone with packets.

Re:Privacy Geek

[Anonymous Coward]

"Anything I do outside of my home, whether I travel via foot or via wire, is public and there's a possibility that I may be seen or even recognized."

Being "seen" or "recognized" as in the pre-computer-age sense isn't the issue. The issue is having the minutiae of your online and offline behavior recorded, wherever you go and whatever you do.

How do you think the police would react if you, a private citizen, set up cameras recording all of their officers as they left and returned to their station. You would deploy robotic cameras to follow them on the public roadways. You'd correlate this video with officer names and pictures and store it in a database, which you'd sell to anyone who would pay your price. I don't think they would permit you to do it for long.

This is essentially what they want to do to us. Why should we permit it, when they won't permit us the same privilege? Are police some sort of superbeings who won't use this imbalance to their own advantage? Are they the world's most perfect database administrators and programmers, who will never leave any flaws or bugs that would let someone steal this information? Are they free of bureaucracy and able to establish truly secure protocols for the management of this information?

It's a power grab, plain and simple, happening online and offline. Technology isn't the problem; the problem is that the current authorities are seizing the initiative to establish every new technological application in their own favor, further empowering the powerful and weakening everyone else.

Re:Privacy Geek

[adolf]

...there is also the possibility that, while outside of your home, you might elect to wear a mask or makeup, in a deliberate attempt to disguise your identity. You might also speak softly, or with a characteristically different voice, or in a different language. You could carry cash, instead of credit cards or checks.

Nothing wrong with any of that, even if it does look a bit out of place to those around you.

Now then, I might elect to use Tor, PGP, S/MIME, OpenVPN in a deliberate attempt to disguise my identity.

And there's nothing wrong with that, either.

The notion that I might be conducting myself "in public" does not require me to wear my secrets on my shirtsleaves.

Re:Privacy Geek

[Anonymous Coward]

You know, there's people that have cookies set on, and start all their internet activity from the same page: Google.

This one company knows everything they do online. And if they have any other G services, with names and emails.

Thinking about that, here's something (Anonym.OS) I want to see.

Re:Privacy Geek

[HellYeahAutomaton]

Any reasonable person who wants to sunbathe nude in their backyard is going to build a fence. A "privacy geek" would build a fence just to build the fence.


And I, for one, do not want to see a nude privacy geek.

Too bad no one using it can comment

[Anonymous Coward]

Since Slashdot bans most Tor proxies from making comments. Perfect for geeks, eh?

Re:Too bad no one using it can comment

[grub]

testing through tor...

Re:Too bad no one using it can comment

[Anonymous Coward]

I said most. They use one of the Tor blacklists, so you may be on an as yet un-blacklisted node. (Other services like some IRC servers also use them.)

Re:Too bad no one using it can comment

[Omnifarious]

Of course, (s)he also isn't posting anonymously.

Re:Too bad no one using it can comment

[dubl-u]

That's because people use Tor to troll Slashdot.

Anonym.OS: the OS of choice for privacy geeks and serious assholes.

<ironic>If only we could implement some compulsory registration for Tor, everything would be fine!</ironic>

To my mind, that's the problem that all of these anonymous computing efforts fail to solve: a lot of people use anonymity to be jerks. When I look at the traffic my sites get from open proxies, a vanishingly small percentage is from political dissidents; most of it is from turd-in-the-punchbowl fuckheads.

Re:Too bad no one using it can comment

[XSforMe]

(s)he
Stop deluding yourself

Re:Too bad no one using it can comment

[maxpublic]

That's because people use Tor to troll Slashdot

People use *their own accounts* to troll Slashdot as well, not to mention regular AC posts. How the fuck is using Tor any different?

Max

Re:Too bad no one using it can comment

[cyriustek]

I got a copy of this at Shmoocon. It seems to be a good, stable OS. However, it still misses the mark with respect to ease of use. Hardly anyone's grandmother or even their mother would feel comfortable in using this OS. For example, your e-mail settings need to be re-entered everytime you use it. There are a few other areas of concern as well. However, I must say that this was an excellent first try, and I look forward for the enhancements that are supposed to come shortly.

Re:Too bad no one using it can comment

[bugg]

You misunderstand, and it's probably my fault.

People need to anonymize their browsing when they are not surfing casually, but rather doing surfing that they don't want anyone to know they've done (duh). So most people don't bother or care to surf, say, slashdot anonymously.

When you are doing things that a government doesn't approve of (and COINTELPRO has taught us that the US government spends lots of time and resources going after people who exercise their rights) then using tor is a good idea.

To put it another way, people who need to anonymize their traffic are probably only visiting a very small subset of websites: sites where they can post information but fear law enforcement seizing server logs, sites where they want to obtain information but they don't want law enforcement to know that they have it, so on and so forth.

Therefore, it is fundamentally flawed to think "not many people who visit my site need to do so anonymously, therefore not many people need to visit any site anonymously."

anonymous?

[Lord Ender]

With enough confederate nodes, tor can certainly be tracked. It isn't likely to happen, but it is possible.

Re:anonymous?

[Anonymous Coward]

Confederate nodes?

Can't you just declare war and have them rejoin the union?

Re:anonymous?

[B1ackDragon]

Try it out. I know it's for gentoo, but there is a nice howto here: Anonymous web browsing / instant messaging etc.

Yes, it is a little slow, but nothing like freenet. Just slow enough to be too annoying to use consistantly - for me, anyway.

Speaking of anonymous....

[Amoeba]

From the article: "If Granny's into trannies, and doesn't want her grandkids to know, she should be able to download without fear," says Taylor Banks, project leader.

This is why co-workers and I have been working on Fappix - The Pornnoisseur Distro. Not only can you browse anonymously but you have several thousand pre-bookmarked pages to choose from in categories ranging from Amateur Nudes to Bukkake Hentai to Puke porn. You have a hankering for some DP? We got it. Maybe a little fisting for those slow lonely nights at home. Nothing but the best for our users!

Never worry about having the correct video codec or player again as they will all be pre-installed! No more waiting another 20 minutes to download and install some obscure viewer just so you can rub on off to Kismet the Albino Sheep Goes to the Circus!

With our patented "Live (Hand) CD" technology you simply boot from the disk and off you go into fantastic realms of spanktacular fun without the worry of spyware, malware, trojans, or incriminating cache files again. You'll never have to blame that spandex scat video on "some spam or something" ever again!

Fappix. The sound of one hand clapping.

Re:Speaking of anonymous....

[pjt33]

From the article: "If Granny's into trannies, and doesn't want her grandkids to know, she should be able to download without fear," says Taylor Banks, project leader. This is why co-workers and I have been working on Fappix - The Pornnoisseur Distro.

My fascination with the segue from Granny's love of outdated radios to porn is fighting with my desire not to know.

Re:Speaking of anonymous....

[Rosco P. Coltrane]

Never worry about having the correct video codec or player again as they will all be pre-installed!

You can tell the guy who's had to deal with porn video file formats a lot. This is real life experience speaking here.

Re:Speaking of anonymous....

[MightyMartian]

So does anyone know just how much porn there is on the internet? I'm looking for hard statistics cause most "normal" people don't get it when I refer to my connection as a "porn pipe".

Very likely because they think your talking about some body part.

Re:Speaking of anonymous....

[poot_rootbeer]

So does anyone know just how much porn there is on the internet?

All of it?

I'm looking for hard statistics cause most "normal" people don't get it when I refer to my connection as a "porn pipe".

Have you tried wearing pants?

Re:Speaking of anonymous....

[Flunitrazepam]

My idea during the .com era was to sell hard drives... WITH PORN ALREADY ON THEM!!! What a great deal, you can just overwrite it if you want, but now your 10 gig drive is chalk full of porn upon purchase, saving you valuable surfing and downloading time.

I was going to sell water sports porn on Seagate drives :/

Interesting quotes

[Amoeba]

"If Granny's into trannies, and doesn't want her grandkids to know, she should be able to download without fear," says Taylor Banks, project leader.

'So easy to use you can hand it to your grandmother and send her off on her own to the local Starbucks.'

Am I the only one who finds the juxtaposition of these two quotes alarming? I don't want gamgams to end up in the pokey (pun intended) for inappropriate behavior at Starbucks. That would be weird.

Re:Interesting quotes

[temojen]

My grandmother would not know an alternate gearset if she sat on it. But I wouldn't think she'd get arrested for looking up this sort of tranny in a starbucks.

Re:Interesting quotes

[smittyoneeach]

Thus, grandma should take to heart the wisdom of the C++ community, and not make the private members public.
Keep a weather eye on those friends, too.
If her compiler is a little dusty, compile-time meta-programming is definitely out. Bingo is a sufficiently 'edgy' activity for gamgams, think you not?

Re:Anonymous and suspicious

[Anonymous Coward]

Anonymizing yourself isn't a crime or probable cause for any kind of search warrant.

Anonymous developments?

[dada21]

I've been very interested in the world of anonymous information sharing -- possibly as a replacement for the normal IP-based Internet. Maybe someone out there can answer a few questions:

1. What are the theories behind simple anonymous sharing of data? (I know there are newer versions of P2P beyond Torrent that allow for a third party mediator between two anonymous parties. This seems like a start to making a truly free-speech undernet.)

2. Is it possible to completely diversify the Internet away from IP-based hosting to a new swarm-network of anonymous users all hosting little pieces of various forms of information? 2b. Is anyone working on this swarm idea?

3. As information becomes more accessible, will the need for information privacy be important? 3b. Is it more important to create a totally anonymous information sharing network than it is to work on harder to break encryption schemes?

Re:Anonymous developments?

[ivoras]

I'm not an expert in anonymizing, but: to receive any information (really *any* - network packets, postal packages, etc.) efficiently, you have to have a unique address, and the party that sends the information must know it. Therefore, the path of that information can be tracked.

The only way I see to guarantee anonymous receiving is some kind of broadcast - for example as exists with satellite downloading systems: the information is always broadcast by the satellite to a really wide area, in which any party can receive it (and discard it if it's not meant for them to have it) without the abbility to detect who and where has received it. The reason this scheme works is because satellite receiving is a "read only" system - the receivers are passive and don't send information to satellites, they only filter the received content (i.e. channels or download streams). This could be useful with a public key encryption scheme.

(btw. the way satellite downloads currently works is that the receiver must have a separate "ground" line to a regular ISP that's used to send requests to the satellite company to broadcast the desired information, so there's still a traceable line, but in one direction only)

Re:Anonymous developments?

[Jim McCoy]

1. What are the theories behind simple anonymous sharing of data?

It depends on what you mean by the terms "simple", "anonymous", and "sharing." Seriously. There is a lot of crypto research out there that touches upon the various possibilities, but it all boils down to this: the more anonymity you have in the network the higher the cost of using that network for everyone involved (where cost == increased bandwidth & CPU consumption and increased message passing latency.) In terms of what is possible there is basically a big dial, labelled "apply various crypto protocols and message-hiding techniques", that you can turn to decide how much inconvenience you are willing to put up with in return for better privacy.

2. Is it possible to completely diversify the Internet away from IP-based hosting to a new swarm-network of anonymous users all hosting little pieces of various forms of information? 2b. Is anyone working on this swarm idea?

Possible, but difficult. The difficulty increases significantly if you want to ensure reliability & availability of the data provided by the swarm or provide the nifty "web 2.0" trappings that most people have come to expect from web sites. Various projects are working on components of this mythical system, ranging from the Tor networking system mentioned in the original post to the Invisible Internet Project and GNUNet. Nailing the whole package in a single effort is a non-starter for anyone who has even casually glanced at the relevant research necessary to begin such a project, so each effort focuses on one specific aspect and eventually it might be possible to combine these efforts into a single coherent sytem.

In other words, don't hold your breath waiting for this one to actually come about.

3. As information becomes more accessible, will the need for information privacy be important? 3b. Is it more important to create a totally anonymous information sharing network than it is to work on harder to break encryption schemes?

I won't bother trying to answer the first part of the question because it is a matter of personal preference. As far as the second half of the question goes, having good end-to-end security does not help you if either of the endpoints is compromised; a malicious server can reveal that you are surfing for child porn while a malicious user can reveal that your site is distributing bomb-making recipes with no need for the points in between the two ends to break the communications encryption.

Re:Anonymous developments?

[drix]

Yes, to track a tor session from server to end-user is theoretically possible. Guess what? So is time travel. The confluence of circumstance and technology needed to make either one actually happen make them practically impossible. I don't know tor all that well, but I'd be damn surprised if they did any sort of connection logging whatsoever. So, your quest ends at hop one unless you've managed to root that box. I don't know tor all that well, but I'd be damn surprised if they were bouncing each conn off < N boxes, where N is probably greater than 5. So you'd need to root say 5 boxes. I don't know tor all that well, but I'd be damn surprised if the routes were not randomized from connection to connection. So, you'd need actually need to root pretty much the entire network, or some large subset of it.

I don't know what your personal odds of pulling that off are, maybe you are more 31337 than I, but I'm estimating that the probability is, say, Planck's constant (scalarized, of course.) For the government, we'll give them about 15 orders of magnitude greater... inverse of Avogadro's number, perhaps. Or maybe the Hartree energy constant, if I'm feeling really generous.

Re:Anonymous developments?

[ZB Mowrey]

1. What are the theories behind simple anonymous sharing of data?

For starters, turn as many people as possible into open proxies. Then encrypt traffic between those proxies. Get brave volunteers to allow their machines to be end-nodes (places where traffic is allowed to exit and enter the network) instead of just routing nodes. Ideally, the end-nodes should be located in countries with a) negligible computer-crime budgets, or b) negligible computer crime laws. This has a detrimental effect on network latency (and possibly throughput), but it's hard for a country to prosecute someone for something that isn't illegal where the someone lives.

2. Is it possible to completely diversify the Internet away from IP-based hosting to a new swarm-network of anonymous users all hosting little pieces of various forms of information? 2b. Is anyone working on this swarm idea?

The concept of a swarm is incompatible with anonymity. See, in a Bittorrent situation, there must be some entity that handles the "who gets connected to whom". Also, it's always possible to see the IP address of anyone who sends you data. So if you're in a swarm, you can tell (by sniffing your own traffic) who is sending and receiving data. If you're only receiving illegal files, you can logically assume that anyone sending you bits is providing said illegal data.

One notable exception to this would be if an entire area (say, a neighborhood, town, or nation) were to have a free-access mesh network that offers dynamic addressing. Then someone could, in theory, write software that would periodically establish a new IP address within the mesh (disconnect, change MAC address, reconnect). Add bonus points if all traffic between the clients and the access point is encrypted.

3. As information becomes more accessible, will the need for information privacy be important? 3b. Is it more important to create a totally anonymous information sharing network than it is to work on harder to break encryption schemes?

The need for information privacy is as important now as it has ever been, or will ever be. It's all based on the user's perception. If you maintain good security practices and don't wind up with trojans on your system, *and* you don't do anything illegal, you only have to worry about commercial exploitation. If you get hacked, the acts of another could be pinned on you.

More important than the need for information privacy is the need for a consensus that the mere encryption of data does not constitute a reason for the authorities to break it and/or question you. Ideally, they'd require real-world probable cause before even being able to capture your traffic. All too often, that is not the case.

Fantastic!

[wmajik]

So easy to use you can hand it to your grandmother and send her off on her own to the local Starbucks.

Fantastic! I've always thought copious amounts of caffeine and an anonymous method of browsing for porn were meant for ubergeeks like myself, but now that my *grandma* can do it as well, that's just fantastic!

... (pause)...

OH GOD, MY EYES!!!

Re:Anonymous and suspicious

[Anonymous Coward]

... yet.

Re:Anonymous and suspicious

[Rosco P. Coltrane]

Anonymizing yourself isn't a crime or probable cause for any kind of search warrant.

In police states, someone who wants to be anonymous deviates from the norm and automatically becomes suspicious, as The Man considers that if you're not guilty, you have nothing to hide.

In US-PATRIOT USA, I'm not sure I'd want to participate in the Tor network. I'm definitely not the only one. Perhaps I'm a coward, but that should tell you something of what this country is slowly turning into...

OpenBSD based, not FreeBSD

[putko]

You might think from the daemon logo that it is a FreeBSD-based thing.

It isn't -- it is OpenBSD-based. So you'd figure the encryption would be top-notch. Also the OS is already very secure. That's what they focus on, to the exclusion of other things.

OpenBSD is quite reliable. If it includes drivers for hardware, they work.

Also, they only use code that they can look at. No blogs of code (like Linux or FreeBSD) are allowed. That's because if you can't inspect them, the NSA or an attacker might have put some bad code in there. It is because of things like this that Theo De Raadt won a prize from Stallman for his contributions to free software.

Re:OpenBSD based, not FreeBSD

[The Amazing Fish Boy]

No blogs of code (like Linux or FreeBSD) are allowed.

// Linux Kernal v.2.7...

int main()
{

while(1)
{

set_mood('depressed');
set_currently_playing('Mourning Dew For You - The Emostreet Boys');
set_post('i know ive said it before but my life sucks. im gonna kill myself i sware. everyone hates me. i cut myself again.');

}
exit(0);

}

Re:OpenBSD based, not FreeBSD

[putko]

Is this good enough? http://kerneltrap.org/node/4965

I'm not a Linux expert. I can't point to the stuff.

All I know is that OpenBSD absolutely doesn't allow that stuff.

Kinda'

[DogDude]

Not really true is you're using TOR and a proxy. It'd be hard as hell to trace. But maybe so if you're running a TOR server (an outlet for other people's anonymity). That's why there are a hell of a lot more TOR users that don't also run servers. That's also why TOR is virtually unuseable (it's dial-up speed, when it doesn't time-out altogether).

Re:Maybe it's a newbie question

[shumacher]

Yes. Use encryption. Encryption in your email client, encryption in your browser. Tor does this, but so does https and ssl.

The whole privacy movement seems to have fizzled.

[Deagol]

Back in the early 90's, when I was new to the 'net, I remember uncovering all these programs and concepts that gave me hope that people would be able to wander the internet truly anonymously. I discovered PGP, anon.penet.fi, the whole cypherpunk movement (crypto, remailers, etc.), anonymoizer.com, Chaum's eCash. Things were rough around the edges, and tough to use for a internet newbie, but progressing along fast enough that I thought we'd actually see Joe Sixpack able to easily utilize these tools. Someday.

I'd check on these projects every few years, until finally, I sorta gave up on following them. They seemed to stagnate, never getting beyond the fringe.

A year or so ago, I wanted to the utilize mixmaster remailers, and I *still* wasn't able to find an up-to-date, lucid HOWTO or a client that didn't require a *lot* of work to use.

I haven't actively sought these tools in a while, so maybe they've caught up. But I keep my ear to the wall, and I have yet to hear any murmers of good anonymizing technologies, nor do I ever see any passing references to people using them.

I have assumed that the movement is either dead (nobody cares anymore) or ubiquitous (it's common knowledge and no big deal). Somehow, I kinda doubt it's the latter.

I've been toying with an idea for a site/system in the spirit of the Mixmaster remailers, but I want to be able to evaluate the current technologies before I totally re-invent the proverbial wheel. (Plus, I wish to be as anonymous in the registration and publication of the site as possible). I'd *love* some pointers.

Re:But

[MightyMartian]

my grandma is dead you insensitive clod!

Yes, I suppose they have that kind of porn, too.

Re:Joke's on them

[MightyMartian]

The internet came together when the arpanet, and various service providers merged together and everyone else joined

I nominate this for the most concisely inept retelling of the history of the Internet ever!

Anonymity is your constitutional right

[Anonymous Coward]

You have the right to pamphlet anonymously. You have the right to use the internet to do it. You should be able to criticize the government without worrying about anyone getting revenge on you. I totally agree that the Patriot act goes way too far. By removing our basic freedoms, George W. has given the victory to the terrorists. We should be fighting to preserve our freedoms, not giving up our freedoms to fight the terrorists.

The fact that a bunch of sickos use this technology to be perverted does not mean that the rest of us should not use it. If you care about your freedom and you don't like what is going on then you can use it to safely make your complaints heard.

Re:Anonymity is your constitutional right

[LocalH]

How about this: You show me the section which explicitly denies a right to privacy. Can't do it? Then you lose.

Re:Anonymity is your constitutional right

[Derling Whirvish]

How about this: You show me the section which explicitly denies a right to privacy. Can't do it? Then you lose.

How about the Fourth Amendment? While it denies the government the ability to do "unreasonable" searches and seizures, it allows them to do all the REASONABLE searchin' and seizin' they want. That pretty much limits your privacy to whatever the administration in charge deems to be "reasonable." For instance there is no limit on how intrusive an inspector from Child Protective Services can be. None.

Re:Anonymity is your constitutional right

[aaronl]

You're reading it out of context.

  "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

This means that the government is outright forbidden to conduct unreasonable search and seizure. It also forbids unsubstantiated warrants to be issued. It allows the government the ability to issue warrant, search, or siezure when there is good reason that is supposed under oath and to an exact place, person, or thing. That is quite a narrow power!

With the way the Constitution is written, this is supposed to mean that the government can do those things *only* under that exactly described set of conditions. That inspector that you're talking about, by the Constitution, would require a court supported warrant to a specific place to do a search. The reason of "someone said this bad thing was happening" is insufficient, because you cannot state, under oath, that "bad thing" is happening, unless the person saying that it is can affirmatively testify to the occurrance of "bad thing".

I recognize that things aren't working that way at the moment, but that is what the Constitution *says* is supposed to be going on.

Re:Maybe it's a newbie question

[HTL2001]

yes.

Think about it this way:
HTTPS etc encrypt your data before it is sent to the wireless card
WPA/WEP encrypts the data as its recieved on the wireless card, then transmits it

not quite right but basicly, HTTPS encrypts data before it would be encrypted for WPA wireless.

Ha!

[rbochan]

In Minnesota, just having PGP on your computer is evidence of criminal intent.

Welcome to the land of the free...

Re:Maybe it's a newbie question

[jrockway]

If the certificate validates, then probably yes.

If it doesn't validate, it means that someone could have setup a web server pretending to be the one asking for your credit card. It's a common man-in-the-middle attack, and is very easy to do with automated tools (like ettercap). You are protected, though, since the certificate (shouldn't be) valid in this case... the trusted CAs are trusted because they won't give a valid certificate to someone that's doing MITM attacks in Starbucks. (However, the CAs have been known to lapse. A certificate was granted a while back to something like paypa1.com and was used to phish paypal details. Users thought it was OK because the cert was valid, but it was valid for the wrong site.)

Either way, be careful.

un-molestation

[rodentia]

The idea that one might live one's life in private and without fear of molestation is a *very* recent phenomenon. It's not passing out of the mainstream, it never quite arrived there.

The right to privacy is a post-war interpolation from the set of Constitutional rights. It was hardly a consideration before single-family households became common beyond the elite classes consequent to industrialisation. The very idea of private life took meaning from the distinction to be drawn between the public and private duties of the landed gentry, whether he was acting as public judge or administrator of his chattel. The idea that citizens required more privacy than that demanded by Christian modesty simply did not occur. It is only in the last generation that anyone became actually interested in the details of your private life. Before the information age, such trivia had no value beyond the prurient, of interest only to busibodies and the beat cop; again, unless you were a name.

Re:un-molestation

[Anonymous Coward]

You make some valid points, but on the whole, I disagree.

People have an inherent concept of public vs. private space, just like they have an inherent concept of property. Neither of these things were magically created by feudalism, still less by industrialization. Even animals like dogs understand the concept of territory, and they will fight when another animal intrudes on that territory.

It's true that in the course of history, some people got a lot of private space, and some people got the shaft. And yes, there was always the concept of owning someone else's territory, or even owning another person. None of that is new.

What is new, is the pervasive way that surveillance is being integrated into our lives. The same person who would hate the thought of some busybody leaning over their monitor, and watching their web browsing, can bring himself to accept the much more invasive forms of surveillance practiced by cookies, "phone home" web widget like doubleclick's, and email snooping. That is what we are trying to change-- hopefully not in vain.

Re:un-molestation

[ClamIAm]

The right to privacy is a post-war interpolation (sic) from the set of Constitutional rights.

I don't see how "unresonable search and seizure" and "no troops shall be quartered in private homes" can really be interpreted in any way other than "leave me alone, unless there's a legitimate reason". Some links to research backing up your assertions would be nice.

Re:un-molestation

[Elemenope]

Actually, grandparent is basically correct; what you are forgetting is that the primary concern of citizens during most of our history is insulation against state power, and the Third and Fourth Amendments are restrictions specifically upon the power of the state to intrude substantially into the personal private sphere.

It would not have occurred to anyone for any time except basically our own (with our historically unique communications and information extraction and analysis tools) that the private information of any individual citizen reaqlly needed positive protection. Remember that the only agnecy that could violate that private sphere effectively (the government) was already fairly well-restricted; that the common person's private info has a paramount economic value is a very new concept.

Re:un-molestation

[Anonymous Coward]

The idea that one might live one's life in private and without fear of molestation is a *very* recent phenomenon. It's not passing out of the mainstream, it never quite arrived there.

While I will agree that until very recently most people lived a very communal life, with very limited privacy... I don't think that kind of lack of privacy compares at all with what we're facing today.

In the past, you shared much of your life with the community around you... Your friends and family in a relatively small town. Most people lived with very large families, in very small homes. There were precious few secrets, and very little privacy. But the information you shared with others was all personal... It was a shared existance. The reason people knew all your secrets is because they were there with you when it happened. They knew about the embaressing thing that happened at your last birthday party because they were there. And they also knew enough about you not too judge a single failing too harshly.

Today we've got massive databases storing up interesting bits of information gleened from all over the world. Impersonal corporations are trolling through our garbage looking for anything they can use to sell us something new. This isn't your next-door neighbor or your aunt overhearing some private exchange...this is a willful invasion of your privacy by someone completely un-connected to you.

Re:un-molestation

[techno-vampire]

The right to privacy is a post-war interpolation from the set of Constitutional rights. It was hardly a consideration before single-family households became common beyond the elite classes consequent to industrialisation.

Both the concept of privacy and the right to it go back much farther than you believe. As a simple example, do you think the inhabitants of a Roman insula (Equivalent to a modern apartment house.) had a communal lifestyle? No, of course they didn't, any more than renters in a modern apartment complex do today, and for the same reason. Each family has their own private space, and what they do there is nobody else's business. I suggest you study at least a little history before you start sounding off about it again, lest you put your other foot into your mouth.

Re:un-molestation

[mrchaotica]

I hate to break it to you, but Roman insulae are a pretty bad example to use in this case, since they were more similar to college dorm rooms than modern apartments. For example, they tended to consist of only one or two small rooms -- a bedroom and (maybe) a sitting room. Residents used communal toilets and baths, and bought food from vendors rather than cooking for themselves (especially since cooking in their room was likely to burn down the whole building!). Also, since windows were just opened or curtained (since they didn't have glass), the neighbors could hear everything said.

Really, in an insula there was no privacy at all.

(Sources: 1, 2)

Now, who was it that put their foot in their mouth, again?

Has this been tested?

[argoff]

I'll believe it wen I see it.

Like, have they downloaded/posted credit card numbers, kiddy porn, terrost plots, maybe post a promise to kill the president, and customized ones for several western and radical countries? Maybe send death threats to the head of the CIA, FBI, and NSA? Maybe the russian mafia? Maybe the israli secret police?

If people start getting away with those kind of things, then I'll conisider it.

Re:Has this been tested?

[greg1104]

> have they downloaded/posted credit card numbers, kiddy porn, terrost plots, maybe post a promise to kill the president, and customized ones for several western and radical countries?

Holy shit, where did you get a copy of my to-do list at? Apparently I need to encrypt my information a bit better myself.

Re:The whole privacy movement seems to have fizzle

[GigsVT]

The cypherpunk movement is dead. Just scanning the slashdot comments and reading all the "If you don't have anything to hide, why are you concerned?" posts makes that obvious.

At one point in Internet history, we (the libertarian/anarchists/cypherpunks) thought it might bring a new era of freedom. BBSs had given us a taste, and many people expected the Internet to be like a huge BBS, with everything you could imagine on it.

And it was, for a while.

Then some copyright lawyers started jumping on board, and harassing lyrics sites.

The Scientologists started suing people left and right.

Spam started snowballing.

MP3s cause the record companies to start wishing people were only trading lyrics.

Late 1998 though 1999 was the high point I think. Geeks were Gods. Stories of geek millionaires were all over the place. The US finally watered down the stupid crypto regulations. Things were looking up.

Then the Columbine shootings happened.

The 2000 elections brough all kinds of leftists out of the woodwork. Remember Nader? He sure got enough astroturfing here on Slashdot.

The so called "anarchists" get all over the news acting like total fuckwads at WTO "protests".

The WTC attack caused all the people with comfortable lives that liked to think they were cypherpunks to turn. Pull up some stories from Slashdot on 9/11 and 9/12 and see how many people were so willing to offer up the liberty for a slice of security. PATRIOT act flies through with little hassle.

News media reduced to saying things like "Some civil libertarians have concerns" instead of "What the fuck are they thinking?"

Scam artists hiding behind patent law started really milking it.

So you have left what you have today. An environment where you can't really do anything without the risk of lawsuit or arrest. I see things slowly shifting back toward the side of freedom, but it's been a slow recovery.

If Steve Jackson Games Raid happened today, would people be outraged enough to form something like the EFF? I doubt it.

you first.

[poot_rootbeer]

And thank God..... instead of trying to win a losing battle against privacy loss it would be better if we put our energies into making a completely transparent world. Information wants to be free, deal with it.

Hey, can I have your Social Security and bank account numbers?

What do you mean, "no"? INFORMATION WANTS TO BE FREEEEE!!!

Re:The whole privacy movement seems to have fizzle

[r_naked]

It hasn't completely fizzled and it hasn't become 100% user friendly. But we at anoNet are trying to make it as newbie friendly as possible.

Re:Anonymous and suspicious

[Concerned Onlooker]

but the real thing you're doing is plastering a big "I have something to hide, like trading kidding porn" sign to anybody willing to trace your communications in the first place.

So true. In fact, I would suggest that you stop using envelopes when mailing letters and just use postcards instead, that way everybody along the way can read them much more easily. You don't have anything to hide, do you?

No real reason for secret ballots either, now that I think about it. After all, you're not attemting to make an illegal vote.

The police ought to be able to search your house at will, too. If you're not doing anything wrong you have nothing to fear, right?

Oh, remember that sooner or later if you stop defending your freedoms you lose them. When it becomes illegal to criticize the government and you say "but that wasn't what I meant" it's just a tad too late.

Weak!

[Anonymous Coward]

"...makes extensive use of Tor, the onion routing network that relies on an array of servers passing encrypted traffic to permit untraceable surfing."

Untraceable Hardly. Pehaps a little quote from the Tor Project home page is in order to put things in perspective:

And remember that this is development code--it's not a good idea to rely on the current Tor network if you really need strong anonymity.

I would equate untraceable with some damn strong anonymity, which Tor clearly does not yet offer. Non-buyer beware! ;-P

Re:Anonymous and suspicious

[DrSkwid]

In my days as a hunt saboteur I have seen high ranking policemen defend the right of sabs to wear balaclavas (ski masks) and other identity obscuring clothing.

Contrary to popular belief you run in to quite a few sympathetic coppers in that line of protest. Especially after they'ved been ordered about by a few Audrey Hamilton's.

OT : I know a lot of Americans like their hunting and those of you who don't care one way or the other about hunting, I just want to make the point that in England hunting is not just a sport, it's a heritage. A heritage of murder, execution, force land clearance and other negative behaviour that resonates through our society and legal structure to this day. Reformation of society should be a constant and land ownership is central to this.

http://www.guardian.co.uk/freedom/Story/0,2763,144 3881,00.html

Re:The whole privacy movement seems to have fizzle

[roman_mir]

Try my FireFox extension. It has DES encryption that can be used for email clients, forums, etc. Any text or binary actually. It is true that the other party has to know what password you used for encryption, but that can be agreed upon.

Okay, maybe not the first.

[Futurepower(R)]

Another thing wrong with the story is that they didn't post a link to the CD: Anonym.OS LiveCD.

That's the first time I've ever known a Slashdot editor to be sloppy.

TOR

[Jesus 2.0]

I stopped using TOR when I discovered the name of one of the common exit nodes. I forget exactly what it was, but I kid you not, it was something like "datapirates.org".

Re:TOR

[typical]

I stopped using Tor after i realised, that more than 1/3 of it's exit nodes where (us-)navy machines.

Tor was developed by the US Navy. This is not a huge surprise -- DARPA and the ONR fund a lot of computer research, including security. Besides, if the federal government wanted to spy on you, it wouldn't be doing so via the Navy. That's the FBI's job.

Well, unless you don't live in the US. Then it's the CIA's job.

Re:TOR

[TCM]

An important thing to note is that Tor provides IP-based anonymity, not privacy. It _only_ helps to hide your IP address. If you send the password for your anonymous e-mail account in cleartext, the last node can intercept it. Actually, when I was running a Tor node, I sniffed people's traffic to see what they were doing. That didn't help me know _who_ the person was, unless he posted his name in cleartext somewhere. This is something you should expect. Tor nodes are random people with unknown interests. That someone is running a Tor node does not mean they don't look at the data you send.

I'll say it again: the encryption in Tor does _not_ hide your payload. It only serves to hide your IP address.

If you use Tor, use encryption on the upper layer.

Re:Anonymous and suspicious

[glowworm]

When it becomes illegal to criticize the government...

That's exactly what Australian citizens now face as part of the sedition laws brought in because of the "war on Terror".

If we decide that the Australian government is doing the wrong thing in Iraq or Afganistan and we mention this publicly we can be arrested and held without trial or warrant for 14 days. Once the case gets to court it's 7 years jail if proven.

Be afraid, it *can* happen in America too. One day they could tack the same bill on an appropriation request.

The scary thing is if you are arrested for sedition in Australia it is illegal for the press to report that fact, reporting someone is being held for sedition is also a seven year jail term.

I now use TOR so I can email my MP and the Prime Minister without the threat of jail being held over me. Australia *is* now a police state and we need TOR to attempt to balance the evil.

Torrent Download

[HazE_nMe]

I couldn't find a torrent link in the comments, so here is one:
http://linuxtracker.org/download.php?id=1249&name= anonymos-shmoo.iso.torrent
175seeds to 700peers as of 6:53PM MST

Re:The whole privacy movement seems to have fizzle

[dcam]

I haven't actively sought these tools in a while, so maybe they've caught up. But I keep my ear to the wall, and I have yet to hear any murmers of good anonymizing technologies, nor do I ever see any passing references to people using them.

There's your problem. You are supposed to put the glass to the wall and your ear to the glass.

Beware of Geeks Bearing Grifts

[fm6]

First off, "privacy geek" isn't a neologism. To get one of those, you have to invent a completely new word or at least use an old word or phrase in a completely new way. There's nothing new about "privacy" or "geek" and there's nothing particular special about using the two words together.

(One reason I stopped contributing to Wikipedia: members of that community love to use the word "neologism" but obviously have no idea what it actually means.)

Anyway, geekhood is hardly fringe. A geek is just somebody who has an unusual interest in technology. Geeks constitute a special community with their own interests, priorities and jargon, but the same can be said for Freemasons, Realtors, and NASCAR enthusiasts — none of whom count as "fringe".

Besides, a "privacy geek" isn't just somebody who cares about privacy, any more than anybody who uses a computer is a "computer geek".

Re:Beware of Geeks Bearing Grifts

[fm6]

The OED, ooh! Wish I could afford access to it. But my M-W says the same thing. And I did mention there was nothing special about putting the two words together.

What makes you think the public doesn't take privacy seriously? Try getting caught peeking in somebody's bedroom window, and you'll find out how serious most people are about their privacy. It's just that for most people don't need the level of privacy that the Tor Network provides. Someobdy goes to that much trouble to obfuscate their internet traffic definitely deserves to be called a "geek".

Re:Beware of Geeks Bearing Grifts

[minus9]

"Oh, I'm sorry, sir. I'm anispeptic, frasmotic, even compunctuous to have caused you such pericombobulation."

sniffing outbound connections from a tor node

[SuperBanana]

With enough confederate nodes, tor can certainly be tracked. It isn't likely to happen, but it is possible.

Just by running a tor node, you get the oppertunity to collect login+password information for any non-ssl site tor users log into. You also get to see cookie information to boot. Hey, at some point, the traffic has to exit the tor obfuscation network, and if you run a node, you're going to get a bunch of that traffic. It's only a matter of time.

That's why I refuse to use "anonymizer" networks like tor. You can't even login to your damn webmail, without giving away your account information.

Re:sniffing outbound connections from a tor node

[Jonboy X]

I think that either you or the users you have in mind are missing the point of an anonymous Internet proxy. The idea is that when you go through a proxy network, the website you're viewing/posting can't (easily) identify you by your IP. Sure, the site admins can see what you posted, but they can't be sure where it originated.

If you're worried about man-in-the-middle attacks, then the website you're visiting is probably the party you trust most in the transaction, and every step that your info takes along the way is another set of eyes that might be snooping on it. In this situation, you are correct that an anonymizing proxy will probably result in subjectively poorer security.

Then again, any website that has private data that you'd like to keep that way most likely has SSL enabled anyway. If you're using an end-to-end SSL-enabled webmail service like Gmail (httpS://gmail.com), and you trust 128-bit SSL, then you've probably got nothing to fear*. If you don't trust SSL, then you're probably worried about Big Brother and No Such Agency and the like. In this case, you're probably better off just hiding under your bed.

*Note that Yahoo! mail SSL-enables only their login page. Anybody in the middle running a packet sniffer or checking their web proxy logs can see your mail when you read it. They just can't see your Yahoo! password.

Re:sniffing outbound connections from a tor node

[Kadin2048]

Huh?

He's talking about Yahoo webmail, and Google (GMail) webmail. There's no SMTP involved.

On GMail, the whole HTTP session is secured with SSL, on Yahoo only the login page is, so anyone can sniff the rest of the session and read your messages. With GMail that's not possible (assuming you trust 128-bit SSL). Everything, at least as it was being discussed, is being done through the browser, not through a regular email client. So at least if you use GMail, there is end-to-end encryption. With Yahoo there is not; they only protect your login info.

However the major question there becomes whether you trust Yahoo! or Google to keep your messages secure on the server, since I doubt they're stored in any sort of an encrypted form.

Also, enencrypted SMTP would make outgoing messages vunerable to sniffing, but GMail at least uses POP secured with SSL for incoming messages. I believe Yahoo uses either POP or IMAP; since I don't use it I can't comment on the security. But POP over SSL is the recommended way of using GMail through a "regular" mail program.

However you are correct in saying that PGP is definitely the way to go -- it's a pity that it's still a PITA to set up; with the exception of HushMail, there isn't a way to start using it that's not fairly intimidating to new users. I've always been very disappointed that Apple hasn't ever bought Sente's GPGMail for the OS X "Mail" program and rolled it in offically, since it's the easiest thing I've come across (still not something I could have my mother start using though).

Offtopic: At the moment I think it's actually significantly easier to get encrypted instant messenging than it is to get encrypted email. Adium (multiprotocol IM client for OS X) ships with OTR encryption support and it turns it on automatically if one party requests it and the other party accepts. Totally brainless; this is how everything should work. (You hearing me, Gaim developers?) Gaim on the PC still requires you to install the OTR package separately, then turn it on and generate a key. Not bad, but still too much user intervention required -- IMO one click on either side of the conversation should be all that's required. (One party clicks "Secure," other party gets request to begin secured chat and clicks "Accept," done.)

Re:sniffing outbound connections from a tor node

[kalidasa]

How exactly do you think the mail gets from your GMail account to someone else's Yahoo mail account?

Re:The whole privacy movement seems to have fizzle

[iluvcapra]

Steve Jackson Games

EFF's SJG Archive

SJG's Opinion of the whole thing

In short, the Secret Service knocks over a game publisher (micro-TSR-style games, such as Illuminati) and attempts to prove that D&D'ers taught David Lightman how to use a Shlitz pulltab to hack into the 911 system. Courts decide Secret Service was completely unjustified, award court fees to SJG. The legal team/computer activists that coalesced around the issue became the EFF.

Re:Fringe Group

[ONU CS Geek]

The fact that this score has an Insightful Moderation is scary...I've got Karma to burn, so let me speak my mind.

We should have a reasonable expectation of privacy in our everyday lives, even if the constitution doesn't have a "de facto" privacy clause in it. Remember that crazy court Case Roe v. Wade? The court didn't say that "abortion was legal," the Court declared that laws prohibiting abortion represented a violation of a women's right to privacy. While the right to privacy does to exist as such in the Constitution it has long been interpreted to exist as an umbrella created by the first 5 amendments in the Bill of Rights.

To be quite honest with you, I know cops who have problems with the way that today's society is going. They don't want to have to worry about carrying an ID when they're walking down the street to buy a gallon of milk. (HIIBEL V. SIXTH JUDICIAL DIST. COURT OF NEV.,HUMBOLDT CTY. (03-5554) 542 U.S. 177 (2004) 118 Nev. 868, 59 P.2d 1201, affirmed.)

It really bothers me in a multitude of ways that our civil liberties are being torn down under the guise of terrorism. It really bothers me that many people are letting their guards down and just allowing these rights to just be walked on like nothing matters. Is it just me or am I the only one who sees a problem here?

Re:"Privacy is dead, deal with it!"

[maxpublic]

Information wants to be free, deal with it.

Information doesn't want shit, deal with it.

Max

Phone conversation with Grandma at Starbucks

[davidwr]

[Grandma] Where's the blue E?
[me] There's no blue E grandma, click on the orange and blue ball.
[Grandma] What does "Server not found" mean?
[me, muttering...] fsck'ing TOR timeouts
[Grandma] What was that again, I couldn't hear you.

Re:My personal reasoning

[Anonymous Coward]

Who were the first people to be arrested and killed by the Nazis?

I realize you're an abstract AmeriKwan, but please don't conflate Nazis with the Bolsheviks; the latter of whom pointedly killed productive members of society as "politically unreliable" and "bourgeois."

Re:The whole privacy movement seems to have fizzle

[dominion]

The so called "anarchists" get all over the news acting like total fuckwads at WTO "protests".

As an anarchist, somebody who was at the WTO protests, and someone who strongly supports online privacy and the cypherpunk perspective, I'd like to ask what the hell you're talking about?

The WTO protests was one of the biggest events of the late 20th century, it was part of a snowballing effect against corporate globalization which stretched from all points on the globe, and culminated in events such as the uprisings in Argentina and the Zapatista march on Mexico City.

In what way are the WTO protests, which were centered around deconstructing corporate control of our lives, including information and it's free flow, counter to the cypherpunk position?

Re:What about changing the MAC Address?

[dr.ka0s]

Anonym.OS provides the ability to automatically randomize MAC addresses at bootup. This is not done automatically, as doing so in certain environments (VMware, VirtualPC, MAC-restricted switch ports) may interfere with proper connectivity. Nonetheless, it's a Y/N question at boot time, and if Y it will be difficult -- if not impossible -- to effectively track a user across reboots, even from the same physical node.

How anonymous are we talking?

[TheRon6]

What are you saying? Is this like... better than the "Post Anonymously" check box and stuff?

Further information from kaos.theory

[gavinmead]

I've just updated the kaos.theory blog with some further information about Anonym.OS and some responses to blog, article, and comment criticism:

http://theory.kaos.to/blog/archives/2006/01/17/kao stheory-responds/

First of all, I'd like to take a moment to express, on behalf of kaos.theory, how excited and flattered we are by all of the attention that we and Anonym.OS have received. We always thought we were working on a cool project, but we really underestimated the overwhelming response that we've had. Scores of terabyte upon terrabytes of data have flowed and the hit counters keep on ticking. It appears that privacy is as big of a concern for a large segment of the population as it is for us.

That being said, there have been a few comments made and viewpoints published that we would like to address while we have the bully pulpit provided by the good folks at digg, Slashdot, Reddit, Wired News, and Ars Technica, among others.

USB
In the article written and posted at Wired News, Ethan Zuckerman makes the excellent point that rebooting really isn't an option for many living in oppressive, hostile regimes. Additionally, Mr. Zuckerman suggests the use of a bootable / emulated Anonym.OS environment available from a removable, USB key chain device. This is a feature that we have already incorporated into our road map and that we hope to release very soon.

For now, we need as many people as can reboot or run a session in VMWare / Virtual PC / QEMU to please please please test our release. We're not at 1.0 yet, contrary to some postings and articles. Our hope with this release is to solicit feedback from the community concerning features, bugs, and suggestions for everything from desktop wallpaper to file system optimization. Immediately after the Shmoocon talk, all of the members of the group happily fielded questions and comments from audience members that included many suggestions that we intend to incorporate quickly. This type of candid environment is one of the many traits that make Open Source a success and it's what we need in order to keep Anonym.OS growing and on a positive track.

The "China Problem"
Some have asked how we intend to deal with the "China Problem," which could be rephrased as, "What can Anonym.OS do to protect a user against a monitoring party who owns the entire network that the user is using?" Ultimately, this comes down to the ability of the user to utilize covert channels for escaping the network and reaching tor servers. If the party controlling the network is serious enough about its desires and goals in censoring its users, nothing can stop them from implementing a white-list only policy, effectively blocking all tor traffic as well as access to proxies and other tools used for evading filtering.

With those concerns in mind, kaos.theory will be working towards and automated egress filtering evasion script for use in conjunction with Anonym.OS. In terms of the "China Problem," this may not offer much as it will most likely require a "trusted friend" on the outside of the hostile network. In terms of a restrictive corporate network, this could be a viable solution. Again, however, these "covert channels" will likely lead to a ridiculous number of anomalous packets coming from a system (who really makes 25,000 DNS requests in an hour, anyway?) and thus are not a bullet-proof solution.

This is a staggering issue, and it's not one that's answerable entirely by technology. If a country or company chooses to restrict access for its users, and the entity is really serious in terms of throwing resources at the problem, there's not a lot we can do from the client-side.

The Naysayers
There have been two strains of objection to the project, one classical and the other uninformed. The former line of argument goes that we're simply enabling criminals to hide their illegal activities and, as suc

Re:Further information from kaos.theory

[gavinmead]

Corrected link:

http://theory.kaos.to/blog/archives/2006/01/17/kao stheory-responds-2/

Re:What about changing the MAC Address?

[Darth_brooks]

You mac can be changed at will. The physical address is burned into the card, but the OS (windows or linux) can be bluffed into using a different one.

Re:What about changing the MAC Address?

[typical]

This is easy under Linux:

# ifconfig eth0 hw ether [new MAC address]

However, I've no idea of what the userspace program under Windows is to do this.

Incidently, this breaks a (rather silly) 802.11 security proposal I've heard that relies on people not being able to modify their MAC address.

Re:Anonymous and suspicious

[zoeblade]

I have something to hide, like trading kidding porn

Beautiful woman: I'd really like to make love to you.
Guy: Really?!
Beautiful woman: Nah, just kidding.

Virtual Machine available?

[hagn]

A preconfigured VM for this player would be nice. Then you could use the secure enviroment if you are e.g. at Starbucks and go the normal way, when you are in a secure enviroment. Does anybody know if this already exists?

Problems with Tor.

[crhylove]

I love the IDEA of Tor. I also love the idea of FreeNet. Neither one seems to work at all well (or quickly) in their current iterations however. Until these things are solved, for most people the trade-offs are just not worth it. Especially when so much is achievable under the mere guise of the millions of people involved. Until the RIAA hires MILLIONS of lawyers to sue MILLIONS of customers per year, people won't mind thumbing their nose at them and playing the numbers game. The same is CERTAINLY true for surfing and IM.

rhY

Trusted binaries ?

[pan_sapiens]

While the intent of this project is very good, and I hate to pick holes ....here's one for the ultra-paranoid:

Do you trust the precompiled binaries on the livecd ?

Sure, the OpenBSD source is available for you to comb over for backdoors & sniffers etc, but how do you know that Anonym.OS was compiled using that exact same source code ?

Maybe comparing hashes of the binaries to the offical OpenBSD versions would be a good start, but there are various reasons why this will only get you half way to validating that the build is kosher

I'm not even beginning to suggest this work is trojaned or anything - the last thing I want to do is spread FUD about something this cool and useful ..[whoops, maybe too late], but this is a significant problem that I've come across personally when considering a "privacy" geared livecd. You place a lot of trust in the person(s) packaging the distro unless you pretty much compile the whole thing yourself.

One solution (which is very time consuming, and already dated), is the Trusted Build Live CD (TB) by the Hacktivismo group. It is basically a cookbook for rolling your own Gentoo livecd, with some tailoring for anonymity related applications like Tor (AFAIK, it doesn't do the nice packet filtering that Anonym.OS does, however).

"Automated" does not imply "Private"

[Kadin2048]

While you are correct that "the Internet" (by which I take that you mean TCP/IP) is an end-to-end protocol, email is not. It's a store-and-forward protocol, which means that you are potentially leaving a copy of your message at every intermediate point along the network, and assuming that the servers will purge that message later without allowing anyone to read it.

In fact I wouldn't liken email to regular 'snail mail' at all. It's much more like the old Western Union telegram service. You prepare your message and give it to someone who transmits it to someone else, who copies it down, and then passes it off for delivery to the recipient at some later time. People trust email because the machinery isn't very visible, and the whole thing seems very direct; the telegraph system in contrast is rather obviously not private even to someone unfamiliar with the technology because of the human interaction involved.

People have to divorce the idea of "no human interaction" from "privacy." Just because a system is automated doesn't mean that you should have or make any assumption of privacy. You have no way of knowing whether the recipient's mailserver is retaining copies of all their messages, or forwarding them to a third party, or many third parties. In fact in many corporate environments it's safe to assume that all email is being saved (although it's probably not being looked over immediately by a person) for a number of years -- yet because there's no obvious and constant reminder of the openness of the system (i.e. the telegraph clerk) people forget that it's not private.

As much as I despise the law in its current incarnation, I think the DMCA is an interesting model for the future of privacy in the digital age. If you send unencrpyted conversations over the wire, using any communication model where the messages do not flow directly from one client to the other over TCP/IP (or other network fabric which is commonly known to be end to end, or where the message is not stored and forwarded as a whole, e.g. only as packets), then there should not be any assumption of privacy. The exception is if the owners/operators of all the intermediate servers used in the communication (email servers, IM relays) have explicitly agreed not to retain copies or otherwise retain traffic. (In which case if they do retain copies, it becomes a breach-of-contract case.) If you desire any privacy, either use an end-to-end communication model, which could be as easy as clicking on the other person in AIM and choosing Direct Connect, or use some form of encrpytion on your messages. I don't care if your "encrpytion" is ROT-13, just something so that the person doing the interception has to expend some amount of directed effort to read your message, and that they know the contents were sent with the assumption of privacy.

By encrypting the message you as the communicator are attempting to create a more private channel of communication, and it means that to read your message, someone has to purposely decrypt the message and therefore cannot defend themselves by saying that the message was not sent as a private one. In the same way that the DMCA makes it illegal to circumvent a device meant to protect copyrighted data, a new privacy law could make it illegal for anyone to decrypt a communication that they are not the sender or intended recipient of, without due process and authority (e.g. warrant, or existing agreement with one party).

The point is that nobody with a basic understanding of the technology makes the assumption that email or instant messaging is private; although I understand the feelings of people who don't want privacy to be an "opt in" deal, it's also fair that people should have to take a certain amount of responsibility and consideration of how they communicate. If they desire privacy, it's easy enough to do. What we need to do is make sure that we have a legal framework for protecting people, once they make the decision to attempt to secure their channels of communication, so that there is not an open 'arms race' that will leave all but the most technically adept behind.

Iridium != High Speed Internet

[Kadin2048]

The Iridium system is for mobile voice and data usage, not fixed data service like the GP was speaking about.

You're correct that it's two-way, however it's a very different style of system. Iridium uses a constellation of 66 low-earth-orbit satellites (similar to how GPS works) and small handheld transcievers; satellite internet is much more like satellite television: "pizza box" dishes aimed at geosyncronous satellites (much higher orbits than the LEO Iridiums) that just bounce a signal from the remote earth station to a gateway somewhere else. The Iridium system by contrast features satellites that actually talk to each other, and relay a signal down to the ground station.

Iridium allows for very compact devices, typically battery powered, and worldwide availability, but low bandwidth. Satellite internet requires more hardware and requires a directional antenna (i.e. dish) but provides much more transfer.

Trust me: you wouldn't want to try and bittorrent the latest "24" episode via your Iridium phone. Neat as the system is -- and I think Iridium is cool as hell -- it's not high-speed internet.

Two-way, high speed internet via satellite is the stock in trade of Starband, you can read a very vague "how it works" article here:
http://www.starband.com/whatis/howdoesitwork.asp

Take it to starbucks? I don't think so.

[XMilkProject]

Taking it to Starbucks, (at least where I live) means using Wifi. It really isn't possible they've implemented usable Wifi support in their LiveCD is it? Usually getting wireless to work on linux means finding windows drivers, utilizing NDISWrapper, etc.

That being said, what would be required for the linux community to make Wifi drivers more accessible? Is this something that is reliant entirely on the manufacturers providing drivers or is there some other solution? It would surely aid linux adoption if it was easier to get your Laptop Wifi working.

For the linux-savvy, NDISWrapper is of course very slick, and I was able to get my HP Notebook Wifi card working in about 20 minutes, but the less techy people such as the Grandmother mentioned in the posting are not going to be able to sort their way through ndiswrapper and iwconfig, much less figure out newer encryption methods.

Re:The whole privacy movement seems to have fizzle

[elrous0]

Nobody would take a protest like that seriously.

Yeah, that's probably true.

-Eric