Re: [liberationtech] TrueCrypt Alternatives?

2014-10-03 Thread Natanael
On Fri, Oct 3, 2014 at 2:50 AM, Greg g...@kinostudios.com wrote: Also, you convince me how to keep providing high quality software and support while simultaneously making Espionage completely free and open source and I will do it in a flash. Call up Red Hat and ask them about how they manage

Re: [liberationtech] economic cost of lost emails.

2014-08-24 Thread Natanael
A blockchain of torrent magnet links, of archives of all kinds of data like everything public that Archive.org holds? Then you both have it all accessible and you can that verify everybody sees the same version. I've been thinking of a sci-fi story concept of archivers collecting and indexing

Re: [liberationtech] New protocol sacrifices bandwidth for metadata privacy

2014-08-04 Thread Natanael
Reminds me of I2P's Bote mail. Similar in concept and functionality. I2P is a traffic anonymization network similar to Tor, Bote mail works on top of it using DHT for mail distribution. Public keys as addresses, no servers and everything is encrypted. On Mon, Aug 4, 2014 at 9:09 PM, Marc W. Abel

Re: [liberationtech] data mine the snowden files [was: open the snowden files]

2014-07-09 Thread Natanael
FYI, anonymous torrenting is possible over I2P. While slower than regular torrenting, it works fine and don't need any high capacity servers. - Sent from my tablet Den 9 jul 2014 17:46 skrev Griffin Boyce grif...@cryptolab.net: Nick wrote: Quoth edhelas: What about a Torrent ? We can easily

Re: [liberationtech] Thought experiment for Independence Day...

2014-07-04 Thread Natanael
You mean YaCy? Exists already. - Sent from my phone Den 4 jul 2014 17:10 skrev Doug Schuler doug...@publicsphereproject.org: Thought experiment for Independence Day... How easy would it be to develop a “Public Google” that was distributed across tens of thousands of computers similar to the

Re: [liberationtech] Anonymity / privacy considerations of HTTP 'referer' information

2014-05-14 Thread Natanael
You're not the first to consider the implications of referrer headers: https://addons.mozilla.org/en-US/firefox/addon/refcontrol/ You might find that one useful. - Sent from my phone Den 14 maj 2014 08:07 skrev Tomer Altman taltm...@stanford.edu: It occurred to me that the HTTP 'referer'

Re: [liberationtech] popcorn-time

2014-04-07 Thread Natanael
Bitmessage isn't ideal for this. Both because it has a rolling blockchain (the data to distribute needs to be uploaded repeatedly), because the users will need a special client to download it, and then special instructions to find the file, and because Bitmessage isn't anonymous to network level

Re: [liberationtech] popcorn-time

2014-04-07 Thread Natanael
), - and the sender itself is difficult to find. Cheers, On 04/07/2014 01:14 PM, Natanael wrote: Bitmessage isn't ideal for this. Both because it has a rolling blockchain (the data to distribute needs to be uploaded repeatedly), because the users will need a special client to download

Re: [liberationtech] How to make Whonix really user friendly? Looking for your suggestions!

2014-03-26 Thread Natanael
As I suggested once in the past for another project, you could bundle up all the software in one package, and either run it on dedicated hardware *and VNC into it* to use it's secure browser, or run it locally in which case you interact directly with the VM (and it can still have multiple VMs if a

Re: [liberationtech] About Telegram

2014-03-19 Thread Natanael
Here is what Moxie Marlinspike has to say, and it isn’t pretty; http://www.thoughtcrime.org/blog/telegram-crypto-challenge/ It isn't considered secure by the cryptography experts. It doesn't follow modern cryptographic design principles. I would recommend using ChatSecure (based on XMPP and

Re: [liberationtech] Signed HTTP

2014-03-11 Thread Natanael
It would probably be as easy as using SSL with a null cipher with authentication like poly1305. Good luck getting it implemented anywhere. It would need a fair bit of special treatment, like browsers explicitly recognizing it as *not* an encrypted connection despite being an SSL cipher suite. -

Re: [liberationtech] Signed HTTP

2014-03-11 Thread Natanael
Den 11 mar 2014 20:42 skrev Gregory Maxwell gmaxw...@gmail.com: On Tue, Mar 11, 2014 at 12:37 PM, Patrick Schleizer adrela...@riseup.net wrote: Natanael: It would probably be as easy as using SSL with a null cipher with authentication like poly1305. I preferred to sign the source

Re: [liberationtech] About Telegram

2014-02-20 Thread Natanael
They also aren't crypto experts, which is the only thing that counts. Moxie made a very clear argument for why it isn't it enough to show that a passive attack is hard when you only have the plaintext. Because that is simply not how most attacks are pulled off. WEP is a rare case, you are more

Re: [liberationtech] Twister: P2P Decentralized Microblogging

2014-01-10 Thread Natanael
Syndie on I2P is a forum system, but you can create a public read-only forum to post in. It would however need a better interface and a performance boost. - Sent from my phone Den 10 jan 2014 21:30 skrev hellekin helle...@cepheide.org: -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On

Re: [liberationtech] [cryptography] Preventing Timing Correlation Attacks on XMPP chats?

2014-01-05 Thread Natanael
Den 5 jan 2014 13:23 skrev Randolph rdohm...@gmail.com: Hi - a scrambler could send out from time to time fake messages. - an impersonator could record your own chat behaviour and generate random time and lenght and content data, so it looks like your own chat - the main problem remains that

Re: [liberationtech] Authenticating SSL certificates via QR codes?

2013-12-29 Thread Natanael
Your certainly can, and the easiest way is with SSH, and then there are other options like I2P with the minimum tunnel length, and there's pagekite. - Sent from my phone Den 29 dec 2013 20:17 skrev Uncle Zzzen unclezz...@gmail.com: Sometimes we run small web servers on out notebook or phone. In

Re: [liberationtech] Authenticating SSL certificates via QR codes?

2013-12-29 Thread Natanael
by the user. On Sun, Dec 29, 2013 at 9:17 PM, Uncle Zzzen unclezz...@gmail.com wrote: On 30 December 2013 02:28, Natanael natanae...@gmail.com wrote: Your certainly can, and the easiest way is with SSH, and then there are other options like I2P with the minimum tunnel length, and there's