EFF Says 'Stop Using Haystack'

tenco writes "Based on a blog post by the CRC today, EFF warns against using Haystack for circumventing censorship firewalls in Iran. Jacob Appelbaum states on twitter: 'Haystack is the worst piece of software I have ever had the displeasure of ripping apart.'"

Comments

Destroy "someone's" piece of software?

[Wildfire Darkstar]

The EFF has withdrawn their recommendation because the developers of Haystack have basically asked people to stop using it pending their security review.

There's nothing dirty or questionable going on here. CRC has been criticized for certain things, they've taken those criticisms to heart and are attempting to deal with the problems, and in the meantime are warning people that their tool shouldn't be used until those problems are resolved. The EFF's actions reflect this, and nothing else.

Re:Ok you've got my attention

[Anonymous Coward]

Reading through the tweets [shudder], it appears they submitted their findings to Haystack in private. Haystack reviewed the findings and agreed fully and shut down testing, and their board resigned, basically killing the project. Jacob Applebaum is still deciding whether or not to fully disclose his findings to the public, the reasons for which are a bit unclear, but likely trying to avoid the Iranians who have already tested the software from being found out.

Re:Alternatives?

[Anonymous Coward]

So, if he says it's a horribly written piece of software or it just doesn't do what he wants or whatever his reasons are; is he going to write something better? Because if this is the only option, why should people stop using it?

Because if it doesn't work, the users may be stoned to death.

Since the article is mostly content-free

[Nerull]

Here are some links:
http://neteffect.foreignpolicy.com/posts/2010/09/09/one_week_inside_the_haystack

http://jilliancyork.com/2010/09/13/haystack-and-media-irresponsibility/

http://calixte.tumblr.com/post/1120185415/no-more-haystack - Lead Developers resignation Letter

http://www.oblomovka.com/wp/2010/09/14/haystack-vs-how-the-internet-works/

Re:Ok you've got my attention

[doomy]

Here is a better explanation of what happened by Danny O'Brien (http://twitter.com/mala)

---- posted in verbatim for /. proof ----

Theres been a lot of alarming but rather brief statements in the past few days about Haystack, the anti-censorship software connected with the Iranian Green Movement. Austin Heap, the co-creator of Haystack and co-founder of parent non-profit, the Censorship Research Center, stated that it had halted ongoing testing of Haystack in Iran; EFF made a short announcement urging people to stop using the client software; the Washington Post wrote about unnamed engineers who said that lax security in the Haystack program could hurt users in Iran.

A few smart people asked the obvious, unanswered question here: What exactly happened? With all that light and fury, there is little public info about why the worlds view of Haystack should switch from it being a step forward for activists working in repressive environments that provides completely uncensored access to the internet from Iran while simultaneously protecting the users identity to being something that no-one should consider using.

Obviously, some security flaw in Haystack had become apparent, but why was the flaw not more widely documented? And why now?

As someone who knows a bit of the back story, Ill give as much information as I can. Firstly, let me say I am frustrated that I cannot provide all the details. After all, I believe the problem with Haystack all along has been due to explanations denied, either because its creators avoided them, or because those who publicized it failed to demand one. I hope I can convey why we still have one more incomplete explanation to attach to Haystacks name.

(Those whod like to read the broader context for what follows should look to the discussions on the Liberation Technology mailing list. Its an open and public mailing list, but it with moderated subscriptions and with the archives locked for subscribers only. Im hoping to get permission to publish the core of the Haystack discussion more publicly.)

First, the question that I get asked most often: why make such a fuss, when the word on the street is that a year on from its original announcement, the Haystack service was almost completely nonexistant, restricted to only a few test users, all of whom were in continuous contact with its creators?

One of the things that the external investigators of Haystack, led by Jacob Appelbaum and Evgeny Morozov, learned in the past few days is that there were more users of Haystack software than Haystacks creators knew about. Despite the lack of a public executable for examination, versions of the Haystack binary were being passed around, just like unofficial copies of Windows (or videos of Iranian political violence) get passed around. Copying: its how the Internet works.

We were also told that Haystack had a centralized, server-based model for providing the final leg of the censorship circumvention. We were assured that Haystack had a high granularity of control over usage. Surely those servers could control rogue copies, and ensure that bootleg Haystacks were exc

Don't use it in America, either

[SethJohnson]

There was a Slashdot blurb about this on August 17th. The general consensus in that discussion was the haystack technique is a fool's solution to http traffic analysis. It's hardly even a proxy. All it does is stuff a bunch of random 'safe' http requests around your illicit requests. Yeah, that might slow down the work of a traffic monitor that has to look at all your requests. Haystack is completely ignorant to the common filtering methods of http traffic monitoring tools. It's essentially the work of inexperienced students. EFF got all serious because it was possible Haystack might be endangering people with it's false sense of security.

If you try to use this tool to browse 4chan at work, it's going to surround your browser's 4chan image http requests with nonsensical weather.com http requests. Your network admin will still see that your browser requested .jpg files from the 4chan image server.

Seth