Slashdot Mirror
Will ParanoidLinux Protect the Truly Paranoid?
ruphus13 writes "There are still places on the world where having anonymity might mean the difference between life and death. Covering one's tracks is considered to be of such paramount importance that we are now witnessing the rise of a Linux distro catering to the most paranoid. The 'alpha-alpha' version of ParanoidLinux is now out. But is this the best way to protect oneself? Couldn't it be easily circumvented? The article asks, 'Why is it necessary to put the applications and services designed to protect anonymity, to encrypt files, to make the user nameless and faceless, all together, in one distribution? Let's think in a truly paranoid manner. Wouldn't it be far easier for a nefarious government organization to target that distribution's repositories, mirror that singular distribution's disk images with files of its own design, and leave every last one of that distribution's users in the great wide open?' What should truly paranoid user do?"
The truly paranoid user should get some help...
It sets up fairly easily and once you've got it running no one will ever come near you again ... to harm you.
Trust no one?
Read my blog.
A truly paranoid person would be suspicious of absolutely everyone and everything. That would mean writing your own OS on your own hardware etc etc.
Since this is impossible, go and live in hiding with no human contact or chance thereof.
Why would you download this 'super-safe' OS from some people you never met, through a public unencrypted network, if your life depended on it?
Little Brother by Cory Doctorow uses this idea (and name), and the distro was started based on that.
The meme is dead, long live the meme!
If you do not examine the source, how can you trust any piece of software? You are in effect agreeing to trust the unknown people that have looked at the source. Except in the case of a smallish distribution nobody may have actually looked into that particular distribution in any detail at all.
Of course, there is a greater issue of trust. If you accept chips made by unknown fabricators, do you know what microcode has been implemented? If you cannot examine the "source code" of the chips being used how can you actually trust that these chips are not doing things behind your back to reveal your identity and files?
So without a truly "open" computer, you are trusting a whole raft of unknown individuals and companies with your identity, your data, your reputation.
Moreover, if you are not knowledgeable about programming languages, using any computer is an act of utter faith with plenty of reason to not be so trusting. It is like climbing a mountain with a guide that only lost "a few" parties last year.
"What should truly paranoid user do?"
Stay off the internet.
Gone!
1. Always borrow random open wifi access points,
in a geographic pattern not centered around your habitual location
2. Get a new unknowing assistant to type in roughly what you want to say each time. There are pattern detectors for your ways of expressing things.
3. Establish online identities such as gmail that have no tie whatsoever to any of your identity info or financial info
Where are we going and why are we in a handbasket?
What should truly paranoid user do?
Pull the tinfoil hat down tighter....
This slashdot story was posted to get us to use Paranoid Linux, which can only mean that some one planted a backdoor in it.
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
self help books?
but can the author be trusted?
IranAir Flight 655 never forget!
Only if the self help book is self authored by the paranoid individual.
The truly paranoid user should get use a liveCD with a mac address scrambler off of a wireless connection that does not belong to them.
There is more to science than physics!
www.iomalfunction.blogspot.com
Forget Linux, throw away all electronic devices, and follow these handy tips:
1. Preferably find a wife/husband related to you (the closer the better, because you can trust your blood kin more, but avoid anything closer than 3rd cousins if possible).
2. Squat on a large remote property you don't own (preferably somewhere considered by other folk to be inhabitable).
3. Have 10-50 kids (more than that and you might just be inviting mutiny).
4. Teach kids to how to hunt, fish, and guard the perimeter of the property you're squatting on.
5. Please note that aluminum foil around the head isn't safe anymore because of darn nanotechnology, in fact nothing is completely safe. But making everything from nature is as safe as your going to get, so make everything from all natural materials that you find and grow yourself.
6. Stop reading slashdot. They watch people that read slashdot.
"It is also possible to create a backdoor without modifying the source code of a program, or even modifying it after compilation. This can be done by rewriting the compiler so that it recognizes code during compilation that triggers inclusion of a backdoor in the compiled output. When the compromised compiler finds such code, it compiles it as normal, but also inserts a backdoor (perhaps a password recognition routine). So, when the user provides that input, he gains access to some (likely undocumented) aspect of program operation. This attack was first outlined by Ken Thompson in his famous paper Reflections on Trusting Trust."
http://en.wikipedia.org/wiki/Backdoor_(computing)
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
What should truly paranoid user do?
get help?
get BSD?
Seriously, there is already an OS aimed at security... OpenBSD:
"Our efforts emphasize portability, standardization, correctness, proactive security and integrated cryptography."
"Audit Process:
Our security auditing team typically has between six and twelve members who continue to search for and fix new security holes. We have been auditing since the summer of 1996. The process we follow to increase security is simply a comprehensive file-by-file analysis of every critical software component. We are not so much looking for security holes, as we are looking for basic software bugs, and if years later someone discovers the problem used to be a security issue, and we fixed it because it was just a bug, well, all the better. Flaws have been found in just about every area of the system. Entire new classes of security problems have been found during our audit, and often source code which had been audited earlier needs re-auditing with these new flaws in mind. Code often gets audited multiple times, and by multiple people with different auditing skills."
What? Who let the liberal arts major in here?
What's the value of information that you don't know?
OBVIOUSLY the paranoid individual will not allow anyone else to see the self help book, let alone publish it.
Also, the self help book will be written freehand in blood. Every time the paranoid reads the book they will DNA test the blood to ensure that it is their own blood. DNA tests are ofcourse done in house and using tools that the paranoid has already assembled based on research that they have done themselves.
Still, there is a risk of clone operatives... but isn't there always?
I think a lot of people misunderstand the concept of "single point of failure". With all of this stuff in one place, yes, there's only one place that attackers need to attack. But there's also only one place that defenders need to defend. The alternative is that all these security programs remain scattered in lots of places on the Internet. True, attackers probably won't be able to subvert more than a couple of those, but it only takes one flaw in your security for them to get you. If you subverted GPG, it doesn't matter much that TrueCrypt is still working for you. If someone subverted SSL, or DNS, and it doesn't matter much that the Linux Kernel is still secure. Best to get everything from one place, and make sure that one place is really, REALLY damn secure.
It's rare that you're presented with a knob whose only two positions are Make History and Flee Your Glorious Destiny.
I'd say he's well on his way to achieving this.
Engineering is the art of compromise.
That is for security *NOT* anonymity, those are completely different things.
Paranoid people need to ensure that things like Banshee in Gnome don't perform the "Similar Artists" lookup in case the RIAA is watching, or they are in a place where the internet is restricted, or where there taste in music could get them in trouble.
Then there is the issue of cached files, Gnome by default keeps a listing of all the files you open, it keeps a thumbnail of image that appears in Nautilus. You need to disable a lot of that stuff by default in case someone access your system while your logged in (I assume you have an encrypted partition).
A secure kernel will only do so much to help, such as it will help stop malicious software from gaining root.
cat
You forgot to scrub down your body with a high-level disinfectant (potentially traceable commensal bacteria on your skin). After that, you'll have to spend the rest of your life in a full-body skin garment (DNA from shed skin cells). And you'll have to wear a full-helmet respirator (exhaled trace chemicals from your bloodstream, potentially traceable). And your suit will have to contain and reprocess all your wastes (DNA from epithelial cells in your urine/feces). And you can never speak a word (identification through voice analysis).
(Full disclosure: This post contains high levels of sarcasm, which may be traceable in readers' thought patterns. Do not read if you're worried about "Them" detecting your brainwaves or some other such B.S.)
First rule of trauma: Bleeding always stops.
Someone could resurrect the Anonym.os project, an OpenBSD live CD with anonymity tools.
You must be secure FIRST.
Otherwise you are not anonymous.
Never answer an anonymous letter. - Yogi Berra
God damn it, you gave me an excuse.