Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - astor

Pages: 1 ... 56 57 [58] 59 60 ... 208
856
Security / Re: Tails and TOR bridges
« on: July 02, 2013, 05:34 pm »
You can't for now.  It's a TO DO item.

https://tails.boum.org/todo/persistence_preset_-_bridges/

857
Security / Re: Voice call encryption
« on: July 01, 2013, 10:28 pm »
Tor doesn't require root, but the transparent proxy stuff does (to the best of my knowledge).  So basically the tor app runs exactly like it does on your PC, and your browser uses it exactly like on your PC too.  By way of analogy, Tails would require root permissions because it fucks with the kernel NAT stuff.  Er, that's ambiguous... not in a hacking way, in a "uses as designed," way.

Ah yeah, that's what it was. In cases where the app doesn't have configurable proxy settings, you'd have to transproxy the connections by running Tor as root. So I wonder if Red Phone has configurable proxy settings.

858
Security / Re: Voice call encryption
« on: July 01, 2013, 08:57 pm »
Most exploits rely on root being installed, and especially package manager + root.
To prevent this build with seandroid MAC or use another permissions check like Open-Pdroid
http://forum.xda-developers.com/showthread.php?p=42368298#post42368298

The most important things :
- locked bootloader to prevent encryption key recovery
- no recovery mod or sabotaged one so they can't easily flash some forensics exploits
- disabling bluetooth, gps, google location service and NFC. disable wifi if not using it
-  full encryption, then download 3rd party screen locker (or run your own) and uninstall it. now can use different pw for full disc and screen unlock instead of having to type in a gigantic unlock password
- not using a carrier install, installing anything else even Cyanogen mod (with su, pm and adb removed or chmod 000)
- not using the regular browser ever, only ORweb + Tor because Android is using old linux kernels full of known exploits
- turning off roaming to avoid Stingray fake FBI towers
- VPN or traffic through Tor to avoid carrier snooping and Stingray

You can also run that Nexus 4 rom in an Android Emulator and probably use it to make calls with Redphone + a Google voice number. I haven't tried it.

This is great advice and I will have to look into it, but aren't there problems with Tor on unrooted phones? IDK, I've never run it on a phone myself as I've always considered phones too unsafe for that. Up until now, I've simply avoided doing anything illegal on a phone, but if it's possible to make a phone safe, that's great. Occasionally people ask about it here on the forum.


859
Security / Re: Voice call encryption
« on: July 01, 2013, 08:07 pm »
Tor I'm pretty sure is too slow/laggy for voice. I don't even think Jondonym mixmaster would work with RTP packets fast enough to not just hear echoing static.

People have had success with Mumble servers. The main issue seems to be the lag between each person speaking, so they recommend using control words ("Roger, over").

Take a look at

https://guardianproject.info/2013/01/31/anonymous-cb-radio-with-mumble-and-tor/

I've also heard some chatter about running Jitsi over Tor. It shouldn't be much worse than the few seconds delays you see when someone is being interviewed by satellite from a remote location.

I think it's an acceptable trade off for the privacy that Tor provides, compared to routing your communications through open clearnet infrastructure.

Quote
I wouldn't root your phone either, if in the future it might be seized. You can bypass encryption, unlock screens and a whole bunch of evil with a rooted phone. Check out secdroid on XDA developers it's a pretty good replacement for standard carrier installs

As opposed to the LE backdoors that they will download to your unrooted phone?

860
Security / Re: BTC Price drop
« on: July 01, 2013, 07:41 pm »
Yeah, I'm recently disappointed. If you look at various indicators of interest in bitcoin, they are all way down compared to a few months ago.

Number of transactions excluding popular addresses (ie, Satoshi Dice): https://blockchain.info/charts/n-transactions-excluding-popular

Number of transactions per block: https://blockchain.info/charts/n-transactions-per-block

Number of unique addresses used: https://blockchain.info/charts/n-unique-addresses

Most importantly, USD exchange trade volume: https://blockchain.info/charts/trade-volume

We lost a lot of momentum with that crash, and it seems like every once in a while someone holding a lot of BTC decides to cash out.

861
Security / Re: Voice call encryption
« on: July 01, 2013, 09:41 am »
It's probably better to use the regular Redphone app though and not your own server and private app to connect to it.

The TURN servers are just relaying encrypted RTP packets from one device to another, and the more you get lost in a bunch of other Redphone traffic the better so they can't prove you talked to somebody.

Depends. If your phone is rooted and you run your own app over Tor, they may not be able to tell that you are communicating with anyone at all.

I don't have a need for it, personally, but the more services we run in onionland, the more people will use Tor.

862
If your security depends on the indifference of your adversary, you're already screwed.

863
Security / Re: Voice call encryption
« on: July 01, 2013, 03:42 am »
Nice. I'll be making a hidden service for it. :)

864
Security / Re: Voice call encryption
« on: July 01, 2013, 03:19 am »
hmm, I was under the impression that it was open source.

Github: https://github.com/SilentCircle

But yeah, it looks like parts of it are still closed source. Fuck that.

http://log.nadim.cc/?p=89

865
Silk Road discussion / Re: what's the deal with copycats?
« on: July 01, 2013, 03:04 am »
There is the danger of too much centralization over time with the bitcoin miners if the bar for mining gets too steep. Ideally every bitcoin client should double up as a lightweight miner or something. Realistically today if you are doing bitcoin mining and you don't have ASIC or better mining equipment then you're not in the game. One problem is that there is only three or four ASIC producers, which makes a bottleneck the government could control in theory. Having one dominant mining pool probably would be a bad idea as well, although I'm less clear on what effects that would practically have so long as they were profit oriented, higher transaction fees? In any case any centralization leads to the chances of a malicious actor like the FBI taking over becoming higher, that much is certain.

Ironically, Litecoin would be much easier to control since it takes less hashing power overall. The government can run 10,000 regular CPUs, if they can run a bunch of ASICs.

One guy 51 percent-ed Feathercoin and stole 40K FTC. These smaller currencies are much more vulnerable to attack than Bitcoin.

The other issue is, if you make a million alternate cryptocurrencies, you dilute the value of all of them. These coins are only valuable if they are limited.

Quote
I know it seems like a minor tweak to the bitcoin concept, but nearly all technical innovations are evolutionary in this way, or to put it another way, everybody is a copycat if you look closely enough. Bitcoin itself is merely the composite of several different ideas thrown together. What is unique about its creation, is that SN saw the possibility of integrating them, not the ideas themselves, which are quite old. Bitcoin is a collage, not a creation.

Bitcoin slapped together existing ideas, like public key crypto for addressing and hashing for proof of work, but it did so in a way that nobody had done before. Litecoin is just a tweak in comparison. Zerocoin is a truly innovative idea that adds zero knowledge proof-based anonymity to Bitcoin.

866
Silk Road discussion / Re: what's the deal with copycats?
« on: July 01, 2013, 12:50 am »
It was made by people who were jealous that they missed the bitcoin gold rush.

Zerocoin is real innovation.

867
Keep in mind that if the product costs $155, the commission isn't 6%.  It's

$50   * 0.1     = $5
$100 * 0.085 = $8.50
$5     * 0.06   = $0.30

For a total of $13.80, which would be 8.9% in this case.

868
Security / Re: Voice call encryption
« on: July 01, 2013, 12:35 am »
Obviously you would never trust silent circle. The CEO is ex military, they will bend over for the first law enforcement that comes along and feed you a MITM attack session handshake that records your key for easy LE decrypting later.

Then you shouldn't trust PGP, because it's the same guy.

ZRTP, the underlying protocol, uses ephemeral session keys, so unless the Android app is bugged to send the keys to their servers, they can't decrypt your calls. You pay Silent Circle for the infrastructure that routes your calls, that's about it.

869
Yeah, I heard a long time ago that carriers can push hidden apps to your phone, which will record sound and video, and continue to work even when the phone is turned off. Only way to protect against it is to root your phone or take the battery out.

870
Thanks for the heads up. Looks like these bugs were fixed before the disclosure.

Pages: 1 ... 56 57 [58] 59 60 ... 208