Slashdot Mirror
EFF Says 'Stop Using Haystack'
tenco writes "Based on a blog post by the CRC today, EFF warns against using Haystack for circumventing censorship firewalls in Iran. Jacob Appelbaum states on twitter: 'Haystack is the worst piece of software I have ever had the displeasure of ripping apart.'"
Now did Mr. Appelbaum post a detailed review somewhere that isn't limited to 140 characters? I would like to read it. The linked blog posts don't satiate me.
EFF says: "Stop using this program you've never heard of to circumvent national firewalls. And don't you DARE consider checking it out since you've heard about it now!"
Streisand effect, anyone?
Living With a Nerd
If they hate it, it means it will be loved by many and have millions of users.
I call it 'The Aristocrats'
How about a link to something that actually contains some information
None of the sources give any clear reason why people should not use this program.
If you're going to systematically try to destroy the user base of someone's piece of software you should at least have the decency to explain why in clear terms, regardless of the reasons behind this kind of alert.
The EFF has withdrawn their recommendation because the developers of Haystack have basically asked people to stop using it pending their security review.
There's nothing dirty or questionable going on here. CRC has been criticized for certain things, they've taken those criticisms to heart and are attempting to deal with the problems, and in the meantime are warning people that their tool shouldn't be used until those problems are resolved. The EFF's actions reflect this, and nothing else.
Sean Daugherty "I have walked in Eternity -- and Eternity weeps."
So, if he says it's a horribly written piece of software or it just doesn't do what he wants or whatever his reasons are; is he going to write something better? Because if this is the only option, why should people stop using it? Just because this guy says he doesn't like it means that we should do what he says without any information as to an alternative he approves of? Hell, people saying that you should do x over y "just because" is bullshit.
-SaNo
What is this, a game of fucking Chinese Whispers ?
Some Random Blog says "Don't use some firewall I've never heard of".
EFF says Some Random Blog says "Don't use some firewall I've never heard of".
Some Twitter Guy says EFF says Some Random Blog says "Don't use some firewall I've never heard of".
OKAY, I WON'T USE IT ... I'M NOT EVEN IN IRAN !!!
My wife just told me to tell the dog to stop chewing on the carpet. If I post this trivia on Twitter, will it appear on Slashdot in the next 15 minutes ?
So the authors of Haystack say that people should stop using it until they've completed their 3rd Party security review and as a result, the EFF are taking the brave step of recommending that people stop using Haystack?
How can you go wrong? Fucking marketspeek with its propagandizing lime green background. How many people has this thing sucked in? And jeeze! Talk about being at war with Iran...
For justice, we must go to Don Corleone
According to some info, the main developer, Daniel Colascione has quit the CRC and the Haystack project.
I am unsure if the e-mail is legit, but if it is, what will that mean? Will the existing codebase be released? No one seems to know.
As far as I can tell, the basic premise (use a variety of 'legitimate' traffic to not necessarily hide what you are doing, but increase the number of false positives to an unacceptable level) is not bad per se. Hopefully a project will get started to do just that.
I tried to click the link, but work has it categorized as "proxy avoidance." That's a pretty good clue, but what exactly is the thing?
Haystack and Tor do fundamentally different things, and actually complement each other.
Tor focuses on using onion routing to ensure that a user's communications cannot be traced back to him or her, and only focuses on evading filters as a secondary goal. Because Tor uses standard SSL protocols, it is relatively easily to detect and block, especially during periods when the authorities are willing to intercept all encrypted traffic.
On the other hand, Haystack focuses on being unblockable and innocuous while simultaneously protecting the privacy of our users. We do not employ onion routing, though our proxy system does provide a limited form of the same benefit.
To a computer, a user using Haystack appears to be engaging in normal, unencrypted web browsing, which raises far fewer suspicions than many encrypted connections. Authorities can block Haystack only by completely disabling access to the internet, which gives Haystack greater availability in crises, during which the authorities may be perfectly willing to block all obviously-encrypted traffic.
"It's ok, I'm completely secure as long as my iron is off"
1. Insular geek clique gets into a pissing match over software design. Software is taken back to alpha by the developers, and they give notice. The EFF propagates the developers own wishes to a wider audience. 2. Slashdot??? RTFA??? Wha??? 3. EFF bashing profit!
That is a huge misinterpretation, here is the real story:
-DEVELOPER of widely used firewall CIRCUMVENTION software says "Don't use MY firewall CIRCUMVENTION software"
-EFF says that DEVELOPER says "Don't use his firewall CIRCUMVENTION software"
-SECURITY AUDITOR that started all this commotion says "Don't use his firewall CIRCUMVENTION software"
This is a huge issue, and I am glad that the EFF is spreading the word. You may not have heard of it, but Haystack is very widely used in Iran. It has been distributed through smuggled CD-R's and USB drives all over the country.
The fact that Haystack is insecure means that MILLIONS of people are at risk of being arrested.
The proof of Fermat's Last Theorem.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
There was a media spoogefest over this software a while ago. It turns out that there are only 100 users and apparently it sucks in the first place.
I'm thinking some programmer forgot to comment his code. Thank you, sir, for your warning.
Here are some links:
http://neteffect.foreignpolicy.com/posts/2010/09/09/one_week_inside_the_haystack
http://jilliancyork.com/2010/09/13/haystack-and-media-irresponsibility/
http://calixte.tumblr.com/post/1120185415/no-more-haystack - Lead Developers resignation Letter
http://www.oblomovka.com/wp/2010/09/14/haystack-vs-how-the-internet-works/
There was a Slashdot blurb about this on August 17th. The general consensus in that discussion was the haystack technique is a fool's solution to http traffic analysis. It's hardly even a proxy. All it does is stuff a bunch of random 'safe' http requests around your illicit requests. Yeah, that might slow down the work of a traffic monitor that has to look at all your requests. Haystack is completely ignorant to the common filtering methods of http traffic monitoring tools. It's essentially the work of inexperienced students. EFF got all serious because it was possible Haystack might be endangering people with it's false sense of security.
.jpg files from the 4chan image server.
If you try to use this tool to browse 4chan at work, it's going to surround your browser's 4chan image http requests with nonsensical weather.com http requests. Your network admin will still see that your browser requested
Seth
$5 / month hosted VPS on linux = awesome!
Needles are known for their superiority against haystack, as there is always needle in haystack, but not otherwise.
Plain text is obviously out. Encrypted data is going to look suspicious. This implies the system probably has to use stego. Data hidden in plain site amongst other data.
For example, imagine if Doubleclick were complicit with Haystack, they could send certain cookies in an embedded iframe that only a Haystack local proxy with the right key could decrypt. To everyone else it would look like a typical ad cookies - encrypted garble. The Haystack app could also encrypt and send back a payload in the other direction by submitting another cookie. As long as authorities didn't compare the send / receive cookies for equality, this traffic could ride piggyback on top of any website.
I think whatever it is, it may start off successfully but the more people who use it, the more it will begin to stand out like a sore thumb. Iranian authorities will even run the app for themselves and see how it's sending & receiving data. Then it's a relatively simple matter to trace which IP addresses which are using it and send around the goons with the rubber hoses.
When I first heard of Haystack, I read their entire website. They did not give enough details to permit a full analysis, but it was clear that the security of Haystack is based on the false premise that steganography can not be detected by automated filter systems. There was also no indication of protection against man-in-the-middle attacks, disclosing to the State not only who is visiting what forbidden website, but also the full content of anything viewed or transmitted. I wrote them a letter pointing out these problems and referencing technical documentation that would confirm my observations and enable the project to start work on correcting some of the gross deficiencies in the Haystack protocol. Apparently I was only one of hundreds, or thousands, to do so. I for one welcome and support all efforts to publicize the fact that Haystack is a broken security tool exposing its users to more, not less, personal and physical danger than non-users.
First, a "privacy system" with "central servers"? What's wrong with this picture?
Second, if you need to hide traffic, you need a big bidirectional flow to an "approved" site to hide it in. Who has that role? Iran blocks Myspace, Facebook, Twitter, and Google, plus 5 million other sites, so finding some place outside Iran to hide the traffic will be tough.
While
http://neteffect.foreignpolicy.com/posts/2010/09/09/one_week_inside_the_haystack
article linked above says he didn't know where it came from, people working with Anonymous Iran knew Austin Heap from the get-go. He had set up some proxies right when the difficulties started and got maximum coverage and kudos for that. He then leveraged that notoriety to start Haystack. Austin Heap is not a programmer but has degrees in marketing and is really excellent at that. He had a full website up for Haystack and was selling it before it existed.
He attended meetings with congress people to ask for these grants all before it existed as well. Many times people posted contact info for people in the security software area and asked that he have his code confidentially peer reviewed since he had already stated it would not be open source. His responses were nothing short of hostile. Any early requests for technical details so people with NGOs could at least get a feel for it's effectiveness were either turned down or answered with non-answers that were confusing, and in some cases technically clueless. So this pissing match started long ago. But Austin has ever tweeted constantly asking for help in donations, grant writing, flash drives, servers, lawyers to set up non-profits, and even developers to write it. Out of the gate he was asking all over Twitter and Anon for $$$.
It wasn't until he continued to dig in on the no peer review that many got suspicious. It smelled like well-hyped vapor-ware, perhaps with good intentions, but so heavily milked for donations likely before even a single line of code existed I do consider it an opportunistic scam at worst or well-intentioned but clueless vaporware at best.
Now it seems he wrote something strong enough to be peer reviewed, and it has issues. Color me *yawning*. I suspect he finally caved on getting it reviewed since it may not sell well without endorsements, or at least one peer review. Though, if his skills in publicity and getting donations are finally harnessed to create something that works via peer reviews maybe everyone will be happy. He can have his shiny well publicized start-up and anti-censorship users can get something that is going to work.
We've already moved away from haystack technology and currently employ stickTech. Their competitors keep preaching about a new field dubbed as "masonry", but I really don't see the need.
That's an admission you don't hear too often in the press, oblique though it was.
-S
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I am Daniel Colascione. I've placed a link to my resignation letter
below; I feel it adds another dimension to the debate on what happened
to Haystack. If anyone has questions, I'll do my best to respond here.
Let me note, also, that as part of my rejoining the project, I
insisted that we release the source under the GPLv3, and that we
engage in an open and honest dialogue with the security community. It
was too late, of course.
-----BEGIN PGP SIGNATURE-----
iEYEAREC AAYFAkyP9 SwACgkQ17c 2LVA10Vtlx ACg6iE3K x2Cbzj3Hg CRO9k6msmz
tH8An iNSdKNga 6sOQWr8wX5 tlbCDRLPP
=s34t
-----END PGP SIGNATURE-----
(Note: the Slashdot lameness filter forced me to break up the signature; please remove the whitespace before verifying.)
My resignation letter.
That depends on what information encoding system you're using, now doesn't it? Choose the right one, and any sinlge thing you want to express fits into a single symbol. For example, in an encoding system where "n" is a symbol that means the proof for Fermat's Last Theorem, said proof can be expressed as "n" and could thus fit into a tweet 140 times.
s(/.,c(n)>c(t))
Or, in other words: Slashdot says that cardinality of proof of Fermat's Last Theorem is greater than cardinality of a tweet.
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.