[AktiviX-discuss] Practical Security Advice for Campaigns and Activists

[Max Gastone]

--- Chris <chris at aktivix.org> wrote:

> Hi
> 
> I read the RTF document, "Practical Security Advice
> for
> Campaigns and Activists" on your site [1] with
> interest
> and some thoughts I had regarding internet issues
> were:
> 
> 1. Encrypting partitions not just files (PGP)
> appears to
>    have become essential (FBI seizure of London
> Indymedia
>    server and Italian police siezing laptops of
> activists
>    involved with G8 Geona defence).

Yes, this is important, in particular for campaigns. 

The problem I had with disk encryption was from the
basic user point of view.

People are nervous of new technologies, even though in
hind sight it was nothing to be frightened of . Disk
encryption falls into this catagory, though it has now
greatly improved it's front ends and is more
userfriendly than in old, which is definitely a step
forward and I feel much more confident recommending it
to people.

I cant recall if it is in the ActivistSecurity booklet
or not, but it was recommended as an alternative to
disk encryption to keep everything in one folder and
essentially tarball it, and then encrypt the tarball
with PGP. Worked a treat for me the last time I got
raided.

> 2. Tor (http://tor.eff.org/) seems to be the best
> way of
>    anomomising web browsing these days.

This looks interesting. Unfortunately I dont have a
computer capable of testing it at the moment. However,
if anyone gets feedback on how average users find
installing it, I would be very interested.

Also how much does it slow things - always a bug bear
as when security starts to actively impact on peoples
working that is when all the dangerous short cuts get
made, or features disabled.
 
> 3. Using activist email accounts (eg riseup.net or
>    aktivix.org) makes a lot of sense since most
> these 
>    servers are now using TLS so all mail between
> them is 
>    encrypted.

It also creates a nice bottle neck whereby our
opponents know where to luck straight away. Also, if
RiseUp/Activix and a few other servers were taken
down, how much disruption would that cause! It goes
against the principle of distribution - something that
causes those monitoring us a bit of a headache..

Also, it marks you out to some degree, like in the
days when it was said that using PGP marked you out as
some sort of subversive.

My third disagreement with this point is that it will
lead to a false sense of security among people, in the
same way that hushmail does. It fails to address
issues at the client end and various interception
points along the way.

Max

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com