Slashdot Mirror
Will ParanoidLinux Protect the Truly Paranoid?
ruphus13 writes "There are still places on the world where having anonymity might mean the difference between life and death. Covering one's tracks is considered to be of such paramount importance that we are now witnessing the rise of a Linux distro catering to the most paranoid. The 'alpha-alpha' version of ParanoidLinux is now out. But is this the best way to protect oneself? Couldn't it be easily circumvented? The article asks, 'Why is it necessary to put the applications and services designed to protect anonymity, to encrypt files, to make the user nameless and faceless, all together, in one distribution? Let's think in a truly paranoid manner. Wouldn't it be far easier for a nefarious government organization to target that distribution's repositories, mirror that singular distribution's disk images with files of its own design, and leave every last one of that distribution's users in the great wide open?' What should truly paranoid user do?"
The truly paranoid user should get some help...
What should truly paranoid user do?
get help?
It sets up fairly easily and once you've got it running no one will ever come near you again ... to harm you.
Trust no one?
Read my blog.
If you are truly that paranoid then you shouldn't even use the Internet and should start taking Xanex or something. The Internet will likely become less private as we move towards more interactive web applications and social networks.
truly paranoid need drugs not Linux.
As the island of our knowledge grows, so does the shore of our ignorance.
A truly paranoid person would be suspicious of absolutely everyone and everything. That would mean writing your own OS on your own hardware etc etc.
Since this is impossible, go and live in hiding with no human contact or chance thereof.
Why would you download this 'super-safe' OS from some people you never met, through a public unencrypted network, if your life depended on it?
Little Brother by Cory Doctorow uses this idea (and name), and the distro was started based on that.
The meme is dead, long live the meme!
...don't use computers, phones or other electronic devices with a network connection. If you're truly paranoid, don't use any at all, regardless of networking capability. Where anonymity means the difference between life and death, cryptography at least puts you behind bars, so you're screwed if you use it and screwed if you don't.
So, you'd like me to THINK I should post me extensive array of opinions on this distribution here? Well you're not so smart after all! ha-ha! You'll never get me, you hear me?! neVERE!! hahahahahhahahhahahaahaaaaaa.....
Everything I needed to know about life, I learnt from Blake's Seven
If you do not examine the source, how can you trust any piece of software? You are in effect agreeing to trust the unknown people that have looked at the source. Except in the case of a smallish distribution nobody may have actually looked into that particular distribution in any detail at all.
Of course, there is a greater issue of trust. If you accept chips made by unknown fabricators, do you know what microcode has been implemented? If you cannot examine the "source code" of the chips being used how can you actually trust that these chips are not doing things behind your back to reveal your identity and files?
So without a truly "open" computer, you are trusting a whole raft of unknown individuals and companies with your identity, your data, your reputation.
Moreover, if you are not knowledgeable about programming languages, using any computer is an act of utter faith with plenty of reason to not be so trusting. It is like climbing a mountain with a guide that only lost "a few" parties last year.
"What should truly paranoid user do?"
Stay off the internet.
Gone!
1. Always borrow random open wifi access points,
in a geographic pattern not centered around your habitual location
2. Get a new unknowing assistant to type in roughly what you want to say each time. There are pattern detectors for your ways of expressing things.
3. Establish online identities such as gmail that have no tie whatsoever to any of your identity info or financial info
Where are we going and why are we in a handbasket?
What should truly paranoid user do?
Pull the tinfoil hat down tighter....
I was afraid to login because, well, how do I truly know that it is really my machine? Or if it's really the exact same distro I put on and it didn't update behind my back?
Sorry, folks, it's just not paranoid enough for me.
Not that I need it. I have nothing to hide. I don't see why the NSA is spying on me, but they ARE!
And, I'm SURE this site was created to spy on me. I can't believe the Government has spent ALL this money on a site like this just to spy on me. What do all of you posters get out of this?!? Or are you all one guy faking being a bunch of posters just to see what I'm doing?
I need to leave this site - I'm ON TO YOU NSA!!
This slashdot story was posted to get us to use Paranoid Linux, which can only mean that some one planted a backdoor in it.
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
Find a balance of functionality and security that you're comfortable with. It really is that simple.
Besides, if you're truly that paranoid, using a computer is the least of your worries. It's waaaay down the list after you've shaved all the hair off your body (no DNA by hair sample) and chewed your own fingertips off (fingerprints), severed every tie to any other human that knew you or your history, and dug out that deep hole you plan on living in somewhere in Alaska.
Someone (an agency?) might have put this story on /. in order to find out how you protect yourself from eavesdropping and which Linux distro you use. Do not answer to this thread thruthfully!!!
And always know where your towel is!
Am I missing something obvious, or is this exactly what MD5 checksums on the main site, and the error checking built into BitTorrent files, are designed for?
They are a part of the conspiriakii! They are trying to lull you into false security! GET OFF THE GRID! Burn your credit cards! Burn your drivers license! Burn your birth certificate! GO FAR AWAY!!!!
I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
Write their entire OS from scratch?
The truly paranoid user would use OpenBSD, assuming of course that he's got out of M$ world.
The largest prime factor of my UID is 263267.
I'm too paranoid to post under my real alias.
Maybe Paranoid Linux should rather be called Anonymous Coward Linux?
The truly paranoid are irrational and contradictory.
They do things like refuse to fly on planes because the government obviously staged 9/11 and killed all of those people on the planes, so they don't want to become a part of that. But they'll work in the same areas that would be likely targets if another round of 9/11-esque hijackings occurred. They do things wrap everything in tin foil to keep the mind control/thought reading beams out, but happily sit in conspiracy theory forums all day, and go to work or to the store to get supplies.
If the paranoid want to find fault, they'll find fault. Obviously this is a thinly-veiled attempt by the government to see what the paranoid want to hide.
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
The truly paranoid user should get use a liveCD with a mac address scrambler off of a wireless connection that does not belong to them.
There is more to science than physics!
www.iomalfunction.blogspot.com
Forget Linux, throw away all electronic devices, and follow these handy tips:
1. Preferably find a wife/husband related to you (the closer the better, because you can trust your blood kin more, but avoid anything closer than 3rd cousins if possible).
2. Squat on a large remote property you don't own (preferably somewhere considered by other folk to be inhabitable).
3. Have 10-50 kids (more than that and you might just be inviting mutiny).
4. Teach kids to how to hunt, fish, and guard the perimeter of the property you're squatting on.
5. Please note that aluminum foil around the head isn't safe anymore because of darn nanotechnology, in fact nothing is completely safe. But making everything from nature is as safe as your going to get, so make everything from all natural materials that you find and grow yourself.
6. Stop reading slashdot. They watch people that read slashdot.
In any case an effort like this is, for the truly paranoid, feeble. The mechanisms available, proven mechanisms, are well known.
First of all you cannot trust any binary which was compiled with a toolchain which is not itself trusted at least as much as the code you are compiling. It is a well known fact that Ken Ritchie (IIRC it was he) added a block of code to pcc (the portable C compiler) which detected the compilation of the 'login' program and added a back door to it. Then he also added a piece of code which caused pcc when compiling ITSELF added both of these behaviors to the new pcc binary. This resulted in a period of a number of years in which the backdoor existed in virtually all Unix based systems. The pernicious part is, pcc's SOURCE code contained no trace of any of this because the source for the hack only existed ONCE, in the orginal 'ancestor' copy of pcc from which all others descended. It would be at best VERY difficult to know that some similar technique was not used on any given distribution. In theory one could do analysis of every binary, but then how do you know your debugger and disassembler aren't lying to you? Etc.
Even assuming you have by some process guaranteed you have a clean set of binaries, why would you think that the hardware you're running them on is trustworthy? It would be foolish to assume that of the billions of transistors of which your CPU is composed that some small fraction are not dedicated to nefarious purposes...
No, the people working on this may think they're paranoid, but frankly if they thought about it a bit more, they would realize they are not 1/10th paranoid enough...
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
That scary place where you have to protect your identity so the secret police don't get you in the middle of the night, isn't that called U.S.A. ?
"It is also possible to create a backdoor without modifying the source code of a program, or even modifying it after compilation. This can be done by rewriting the compiler so that it recognizes code during compilation that triggers inclusion of a backdoor in the compiled output. When the compromised compiler finds such code, it compiles it as normal, but also inserts a backdoor (perhaps a password recognition routine). So, when the user provides that input, he gains access to some (likely undocumented) aspect of program operation. This attack was first outlined by Ken Thompson in his famous paper Reflections on Trusting Trust."
http://en.wikipedia.org/wiki/Backdoor_(computing)
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
In these jurisdictions.. wouldn't the fact that you've downloaded/used ParanoidLinux suggest you have something to hide, and hence need to be sent to a re-education though labour camp?
I am the maverick of Slashdot
The truly paranoid would want something much more stable and time-proven than alpha-alpha software I'd think. Maybe go with OpenBSD or a more stable distro with SELinux.
Huh? Trying to trick me into saying something!
> Wouldn't it be far easier for a nefarious government organization to target that distribution's repositories, mirror that singular distribution's disk images with files of its own design, and leave every last one of that distribution's users in the great wide open?
I believe Debian solved this problem long ago, it's called public-key encryption.
This leaves one thing the user must do: acquire the distributor's public key from a trusted source. Unfortunately as far as I know only APT-based distributions sign all their packages, leaving everybody else putting a lot of trust in their sysadmin/ISP/government.
-----BEGIN PGP MESSAGE----- jA0EAwMC3Y3ZOSlLpKNgycAHw2kwRePQBGcBvD1OI4mBCRlBFayMVSrTJtW0KBol Glh0nvrU7ium8C+EVIBYghTRhd8lfJvme7fJnv1QURuOLVonj/+Mx0AMs7+Vi18Y 3hsOybSIton3BG0iQA2ujdm+ynngefwsxX9wnap+KjHBZ6jvds6SQnoIL6yX/o59 e3zVpVCZuiCIuq8y9oNw+meSU6r/KkVMBHFExb2dBZOjdGSaMleo8/l0MxxXDuWa hpqzHFQJBPOiwVu3+BSXJ5XC9wUCAl61Pg== =D/fa -----END PGP MESSAGE-----
I'm really disappointed this story was not submitted by Anonymous Coward.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
If you don't or can't trust the single distribution's integrity, there's an easy alternative that no one seems to have mentioned. You can always check which tools ParanoidLinux includes and how they are configured, and then go download a more ordinary (less attention-attracting, if you really are paranoid) distribution. Then just install those same open-source tools and configure them in a similar manner and you no longer need to trust that particular distribution. If you believe that someone or a group of people wants to compromise the ParanoidLinux distribution, then by doing this you have just forced them to also compromise every other Linux distribution in order to achieve the same result.
This is, after all, what security is about. You really cannot make anything impossible to compromise; what you can do is make your system more and more difficult for an adversary to both successfully compromise and to successfully compromise without being detected. Personally, I consider a system to be "secure" when the effort needed to compromise it is far, far more expensive than anything that would be gained by doing so.
It is a miracle that curiosity survives formal education. - Einstein
Obviously look for UFOs, watch re-runs of X-Files and try to summon our intergalactic serpent overlords, of course.
You'd be better off with a tweaked bare bones openBSD system. Configure a remote server with TOR and a Freenet/Darknet node for anything serious. Depends on if you're disseminating or hiding.
Nothing will stop a (smart) determined attacker with physical access, so why keep anything incriminating locally?
Impossible! Infrareds can't do stuff like that. You have to atleast have clearens INDIGO.
"The 'alpha-alpha' version of ParanoidLinux is now out."
No, it is *NOT*.
I can't belive Slashdot published this story without ANY fact checking.
It's worth pointing out that the USA and Canada are among jurisdictions where having anonymity might mean the difference between life and death, thanks to the existence of Extraordinary Rendition (for example the cases of Maher Arar, and other Canadian citizens who have been kidnapped and tortured at the US/Canada border) and Guantanamo Bay (where due process is suspended, and several inmates have died).
you had me at #!
I did not mean "tortured AT the border" - obviously what occurred is he was kidnapped on arrival in the US, and deported by US authorities to Syria (in Arar's case) where he was tortured. Unfortunately his case is far from unique.
you had me at #!
Any tampering such as that mentioned by the OP would be ridiculously easy to detect and correct. This is simply not an issue.
Paranoia Enhanched Desktop Operating System
An acronym will probably be used, to keep things simpler.
I wrote at http://www.gotoguy.com/?p=229 that 84% of people said they would not disclose details about their income online but it turns out that 89% actually had willingly done so. We're volunteering our identities at this point.
doesn't the age old process of using the md5 checksum solve the problem of a government posting it's own distro?
Weakest level of paranoia: No network drivers Next level: No video drivers or keyboard drivers Next level: panics on boot Final level: erases the hard drive then bricks the box
But when the scientologist find out you have been busting their chops on-line, you'll wish you had used a copy.
I think a lot of people misunderstand the concept of "single point of failure". With all of this stuff in one place, yes, there's only one place that attackers need to attack. But there's also only one place that defenders need to defend. The alternative is that all these security programs remain scattered in lots of places on the Internet. True, attackers probably won't be able to subvert more than a couple of those, but it only takes one flaw in your security for them to get you. If you subverted GPG, it doesn't matter much that TrueCrypt is still working for you. If someone subverted SSL, or DNS, and it doesn't matter much that the Linux Kernel is still secure. Best to get everything from one place, and make sure that one place is really, REALLY damn secure.
It's rare that you're presented with a knob whose only two positions are Make History and Flee Your Glorious Destiny.
I'd say he's well on his way to achieving this.
Engineering is the art of compromise.
This makes me feel old. I always thought Tinfoil hats were enough.
1. it identifies, in 1 place, WHAT packages might be of interest, and WHY.
2. these packages can be got from their original sources, or from torrent/freenet/gnunet, with their verification got from elsewhere ( preferably the original source, but that might identify one's IP# to one's Glorious Murderous Regime Gov't(tm) )
3. it makes the issue of protection against abusive/murderous gov't more visible, so people are more likely to identify it, rather than simply going along with it. .. yeah, like Zimbabwe? and "capturing photographic evidence of OUR abuse of authority is a THREAT" arguments )
( US e.g. "we HAVE TO commit torture, because 70% of OTHERS commit torture"
4. if scrounged through some internet cafe, or open Wi-Fi, or something, the distro can be got by sneakernet to one's system so that one at least has a chance against them.
( better for just oneself to be killed on suspicion, than to have EVERYONE fighting against the abuse of god given worth tortured/murdered )
Remember what the Jewess said, in "Anne Franke Remembered"?
~The Nazis enacted little changes, removing a little right here, a little right there...
Every time, we said "oh, it's just one more thing..."
then they removed our right to go elsewhere. We knew then it was Too Late~
It's a standard rule in the deeper Drama Theory ( game theory + emotions ), that if you make the steps small, in emotional investment, you can force any result you want, given sufficient time + pushing.
Sometimes ( damn rarely ) this is used to push peace, against gangs or fighters against freedom, or dictatorships.
Mostly it is used to implement contained population, so that "rights" won't interfere against authority anymore. It is also used by corporations to deform laws, to appropriate rights from the local populations.
Notice that if you try to exercise your legal right to photography police interacting with citizens, your camera will likely be confiscated now, but YOU are under pervasive surveillance.
Interesting arrangement, that, isn't it?
You think that's "by accident"?
you're either stupid, or on dope.
Try working in the security field, and see how long you can believe that, before they make you disgusted with "humanity"'s greed for abuse.
Why do people want authority on others, and go into that field?
To have the freedom to exercise authority ON others,
without others having any right to limit/control/mitigate one's authority
( as totally asymmetrical as possible ).
I wish humanity would Grow Up,
and accept that others have to have their own worth,
and stop being the State Molester.
Won't happen in my life. But if we push + persist,
then some of our grandchildren will live to experience freedom.
But seriously, wouldn't the truly paranoid user find yet another hypothetical vulnerability besides the ones listed in TFA? I guess that turns it into an arms race with someones paranoia..
Wait... who said that... oh shit.
Someone could resurrect the Anonym.os project, an OpenBSD live CD with anonymity tools.
What paranoid person uses a Beta let alone an Alpha? What is an alpha alpha anyway?
My understanding is:
- Beta = feature complete but bugs mean it's not to be relied on in a prod environment
- Alpha = not yet feature complete, no where near ready for prod
So does Alpha alpha mean vaporware?
These posts express my own personal views, not those of my employer
Get you granddads morse key apparatus and solder it to the RJ45 port. And think very hard before answering.
Overachiever.
If I mod you up, it doesn't necessarily mean I agree with what you've said, sorry.
Awesome, this operating system will even pick up chicks for me. Forget the whole "paranoid" reasoning behind this feature, this feature makes my Linux machine into a love-machine.
Well spoken.. like a true paranoid!
Paranoid linux protects no one. Its site demands cookie acceptance. That alone is enough to say it is an agent of the Gestapo Homeland Security. Its shill of commenters seem to want their own computers spied on as they foolishly demand the use of the HTTPS protocol that would facilitate exactly that. And no one there is talking about the 800 pound gorilla in the room, the lack of the shredder in the Konqueror KDE file manager in all 2.6 kernels. The lack of the shredder makes all these linuxes insecure and unusable in a business environment. The lack of available shredders to be installed aftermarket on the internet is a telling tribute to either a campaign by microsoft shills to suppress it in order to damage linux, or to government shills afraid of the shredder on linux systems, expecially in fascist United States and Europe
What should truly paranoid user do?
Write your own apps. Well, you better write your own OS too. Come to think of it, the compiler could easily have been compromised, better write your own one of those too. From scratch.
Well hang on, why are we trusting the hardware here? Better build your own storage media, who knows what off the shelf HDs store without you knowing. Put together your own cpu (we will trust off the shelf ram.....for now), probably be easier to start with opensparc and move on from there. Ok, so we have a somewhat secure computer, but what can we do with it. I cannot trust my isp, or any protocols out there designed to protect privacy. Come to think of it, even off the network I do not know what capacities "they" have regarding van eck phreaking.
Maybe the truly paranoid should just stay away from electronics.
Finkployd
move to the mountains.
have no electrical equipment nor lines of any kind
insulate the roof with a thin lining of led
sound proof the walls
build large bunker in mountain with only entrance under floor boards of house.
um........ I know I'm forgetting something.
I laugh at those people installing Paranoid Linux. It is clearly nothing but an Illuminati ploy to get us to install their OS. Once installed, it will phone home to Al Qaeda and annihilate us all, I tell you!11!!!!
The truly paranoid don't trust any code they can't verify themselves. Linux is too big to be secure.
...and that is all I have to say about that.
http://jessta.id.au
I don't think it's under active development any more but take a look at;
http://en.wikipedia.org/wiki/Anonym.OS
so idea is not foreign to me. But having something that confidential on a laptop is not a good idea anyway.
And if the evil government suspects you have something important on your laptop, they won't even try to break in, they will go straight to torture until you tell them.
As the island of our knowledge grows, so does the shore of our ignorance.
.. we found you.. :-)
Insert
If you want, say, to do something on the Internet that no one should know or be able to prove that you did it, you'll need following items:
- An open Wifi access point (Starbucks, some tech illiterate neighbor etc.)
- A customized LiveCD which has startup scripts to random-generate your hostname and MAC-Address of your wireless network adapter on each boot. (There must be a way to change other hardware data that might help to identify you)
- Some way to quickly cut the power to your PC in case some institution will attempt to get your PC while it's on.
-Enough RAM.
As no information stays on your hard disks no one will be able to prove anything. Tracking you will also be close to impossible.
A truly paranoid user should use openbsd and not linux ! Which is safe by design and even banned from hack contests, and has proven this year after year after year, this isn't just some alpha release which still needs to prove itself year after year after year !
ParanoidLinux was created by the NSA and CIA to setup a global spy network, running on the very computers they would most like to spy on.
Discuss...
--- Generation X: The first generation to have SIG lines inferior to their parents... ---
A major plot point in the novel Little Brother, which inspired ParanoidLinux, is that even with ParanoidLinux and an army of supporters, the protagonist's cover is still blown by a single mole. It does not matter how crazy awesome your security procedures are if you can't trust the people you're working with.
So, a "truly paranoid" user would not have a chance. You need to know who you can trust, and you need to notice when someone goes bad. That's something that no operating system can help you with.
The really useful feature of the fictional ParanoidLinux is its ability to establish a darknet quickly and quietly, disguising its traffic by distributing it amongst the surrounding access points. Thus, if you already have a good web of trust, it's easy to get in touch with those people who can access your network without attracting attention. So ParanoidLinux focuses primarily on making heavy security as easy as possible to use, with the paranoia thing being more of a constraint than a feature.
Or having to register your email address thru paranoidlinux.org to get the download? Hello?!