Hi Tails developers and other Tor/EFF involved people, A third student has submitted a proposal aimed at implementing our meta-data anonymizing toolkit during GSoC. Here it is. I am going to review it and ask questions to Garrett ASAP. I doubt we'll have time for many proposal / feedback cycles, considering this proposal arrived very late :/ I'm nevertheless forwarding his proposal here as Garrett agreed on IRC to discuss his proposal over public channels such as the tails-dev mailing-list.
Meta-data anonymizing toolkit for file publication Garrett Robinson Email: [email protected] Short description: A tool that helps users remove identifying metadata from a variety of commonly used document formats, with an API that makes it possible to add support for more filetypes easily. Abstract I propose to create a tool that assists users in removing identifying metadata from files they wish to send anonymously over the Tor Network. 1. The Project The basis for this project is section m. of of the “Project Ideas” page. This project will be focused on creating a cross-platform, accessible, and extensible tool to remove identifying metadata from various file formats before transmitting them over the network. Multimedia submissions from activists, such as cell phone/digital camera photographs, audio and video, as well as common document formats like Microsoft Office/OpenOffice/LibreOffice and Adobe PDF can contain information about the devices and identities of those who have created, edited, or possibly even just viewed them. This information could theoretically be used, sometimes even quite easily (see the recent cree.py project), to compromise the anonymity of these parties. Although information concerning this issue has been mentioned all over the web, there are only a handful of open-source tools available for editing metadata, and none dedicated to this purpose. Tasks: 1. Research methods of identifying individuals from file metadata. The viewing and editing of some are obvious, such as the “Author” and “Last Saved by” fields in Microsoft Office metadata. Some are less so, such as in MP3 watermarking. 2. Research existing tools the are used to edit metadata. There are numerous proprietary tools designed for lawyers, law enforcement and so on. Some open source tools that I found through research are Phil Harvey’s ExifTool, 3. Identify a set of file formats the will be processed by the project by the end of the summer. Current ideas are: Office document formats, PDF, Image Formats (jpg, png, gif, tiff, raw) and Camera Formats (many are proprietary). 4. Design an API or similar framework to allow new file formats to be supported by the program without needing to add to the source code. 5. Write the code. I envision this program being available both as a command line tool and as a simple GUI. Focus on the command line program first, and build the GUI on top of it. Timeline: Pre-SoC: Research identifying issues with metadata. Pick a few key formats to focus on and research them, find specifications, figure out how they store metadata and how it can be safely altered or removed. Pick one random format and write a program to clear its metadata, to get an idea of the challenges and process involved. Week 1-2: Design a specification for file metadata. How can we create “rules” for locating and removing metadata depending on filetype? Week 3: Begin writing a command line program that can use a filetype specification to clean metadata from documents of that type. Focus on getting this to work with one filetype specification and just a handful of essential command line options. Also investigate verification - how can I be confident there is no metadata left in the file, or that the program has worked? Week 4: Expand command line options to include useful features like batch processing, verbose/force options, and viewing of metadata as well as deleting it. Week 5-6: Add more filetype specifications to the program, and test them on a variety of inputs. Focus on a few core document types: Office Documents, PDF, and Image Files seem to be the most important. Week 7-8: Develop a GUI for the software that will make it accessible to those not working on the command line. The GUI should allow files to be selected, metadata to be viewed, and then cleared, with various options such as choosing a location for the cleared copy, etc. Week 10: Address portability and packaging. Week 11: Hunt down bugs and squash them. Week 12: Documentation, specification, plan for future maintenance. 1. Code Sample The code from many of my recent projects can be found on my github at https://github.com/handsomeransoms. walkproj is a good example of my Python (Django) coding. A good example of a complete Python project of mine is XenLabs, which may be found here: http://www.cs.oberlin.edu/~xenlabs/ 1. Why Tor/EFF? Tor really demonstrates the incredible opportunity for open source software to enable activism and powerful social change. I have been working on a project related to secure, anonymous whistle blowing for several months, and one of the key elements of our framework to protect sources is their use of the Tor software. The Tor Project has helped not only my project, but many others around the world with an essential task. I would like to give back to the program by using my skills to contribute to Tor. 1. Experiences I spent the last summer working on XenLabs, an educational tool for computer security classes. I inherited the project and some code from previous students, and communicate with them via e-mail throughout the summer to discuss design and resolve some tricky issues. I also worked with my professor, Benjamin Kuperman, to design a program that would be useful from the perspectives of both students and faculty. We also worked on debugging together, testing the software in various scenarios and hunting down bugs. The software was written in Python and uses Xen, an open source virtualization program. I joined the Xen mailing lists and IRC channel, asked a lot of questions and even contributed a few solutions to common problems, although no code. The Xen community was extremely helpful and my project would likely have been derailed several times without their wisdow. The software is available under the GPL here: We have been using successfully in a class of 25 students this semester. It will be used in future class at Oberlin College and is currently being implemented by SUNY Oswego as well. 1. Summer Commitments I am committed to working part time on the whistle blowing project mentioned earlier this summer. I am one of a group of 3-4 developers, so my time commitment will not be severe. I am anticipating working approximately 20 hours a week on this project. I am also planning to travel some later in the summer, and take up to two weeks off in at the end of August to go backpacking with my brother. 1. Project status after the summer My goal for the summer is to have the command line version of the program complete and ready to use. I also plan to have made serious progress on the GUI - an ideal goal would be to complete one, but in my experience there are a lot of kinks to be worked out when designing effective GUIs for cross-platform applications. After the summer, the program will probably benefit from improvements to the GUI and adding support for additional file types (via the API, so anybody can easily contribute). I would be happy to continue to work on and maintain the project for as long as it is useful - I really want to get it out there and into the community if there is a desire to see something like this! I believe that my C skills would need improvement before I could make contributions of value to Tor itself, but I would love to be at that point someday. I am also going to continue working on the whistle blower project mentioned earlier, and Tor will undoubtedly continue to be an important component of our work. 1. Mentoring and Management I forsee this project as being a relatively independent endeavor. Of course I would highly value the guidance of a mentor, but I do not think I would need to be closely supervised. I am highly motivated, a dedicated worker, and a careful and thorough problem solver. There is also no existing code base, which would ease some of the difficulties and requirements for oversight related to working on an existing project. 1. Education I attend Oberlin College, where I am majoring in Computer Science. I am graduating at the end of May. 1. Contact Information I can be reached by: E-mail: [email protected] IRC: grobin, I’ll be idling in #tor and #tor-dev Bye, -- intrigeri <[email protected]> | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc | Do not be trapped by the need to achieve anything. | This way, you achieve everything. _______________________________________________ tails-dev mailing list [email protected] https://boum.org/mailman/listinfo/tails-dev
