<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">This seems to be serious and important
stuff, good info for your average bod to have. Thank you.<br>
<br>
I still don't know what to DO though.<br>
<br>
Where is the super simple, highly circulable, easy for anyone to
use..<br>
<br>
1. graphic or other sexy summary of the info below, plus<br>
<br>
2. entry point for your average bod, in a couple of clicks and a
sign up, "to use a VPN, make sure you control both endpoints, and
that the VPS you set up for this is at a small provider in a
country outside of you local 'landlords' reach.'?<br>
<br>
Looking fwd to seeing them in use, won't they be more use than a
million demos in support of Snowden etc?<br>
<br>
Cheers<br>
<br>
Z<br>
<br>
<br>
<br>
On 07/09/2013 14:04, Sikes wrote:<br>
</div>
<blockquote
cite="mid:alpine.DEB.2.00.1309071413210.7645@sikes.squat.net"
type="cite">HAI
<br>
<br>
The bottomline so far:
<br>
<br>
Snowden leaked a document showing a roadmap to how the NSA wants
to have SSL/TLS broken 'soon', on how they have talked different
software and service providers to put exploitable weaknesses in
crypto products and how they have compromised '30 VPNs', aiming at
300.
<br>
<br>
commented about amongst others on:
<br>
<a class="moz-txt-link-freetext" href="https://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html">https://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html</a>
<br>
<br>
It cannot be excluded, but there is little indication that they
have successfully attacked SSL/TLS on the level of
math&algorythm. Again, like very often in cryptoland, that
weakness is the collusion of the providers of actual
implementations.
<br>
<br>
In other words:
<br>
<br>
- Yes they can read you 'encrypted' gmail/facebook stuff, but not
because encryption is so weak, but because google/facebook gives
them access. That's what Snowdens first revelations already
yielded. Same thing might count for the provider of VPN/S
services, but it's by provider really.
<br>
<br>
- The more of the (crypto) infrastructure you run yourselves, the
safer communication will be. Real end-to-end encryption (e.g GPGed
email with private keys stored on your respective devices, you
reading a website via https on a server hosted by a friend, or a
VPS you run there) is not really compromised.
<br>
<br>
The fact that 2 encryption providers in the US (Silent circle,
Lavabit:
<a class="moz-txt-link-freetext" href="http://thenextweb.com/insider/2013/08/09/silent-circle-follows-lavabit-in-closing-its-encrypted-email-service-because-it-cannot-be-secure/">http://thenextweb.com/insider/2013/08/09/silent-circle-follows-lavabit-in-closing-its-encrypted-email-service-because-it-cannot-be-secure/</a>
) closed down, hinting that installing a backdoor was about to be
forced upon them, gives a good indication of what really might be
the matter. If the NSA/GHCQ would really have broken SSL or PGP,
they would never have asked those for a backdoor.
<br>
<br>
Same thing here:
<a class="moz-txt-link-freetext" href="http://boingboing.net/2013/09/06/uk-censorwall-bans-vpns.html">http://boingboing.net/2013/09/06/uk-censorwall-bans-vpns.html</a> .
Why would they ban Ipredator, if snooping on a VPN was so easy ?
<br>
<br>
So to be 'safer':
<br>
<br>
Ditch you gmail/yahoo/facebook/<insertbigbrandhere> accounts
or at least sanitize them to the point that these channels only
are used to communicate public(able) information, _and_ stop using
your real names.
<br>
<br>
If you want to use a VPN, make sure you control both endpoints,
and that the VPS you set up for this is at a small provider in a
country outside of you local 'landlords' reach.
<br>
<br>
kizziz
<br>
IAH
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
________________________________
<br>
fighting for your digital rights:
<br>
<a class="moz-txt-link-freetext" href="https://gnu.org/">https://gnu.org/</a> (A)
<br>
<br>
<br>
On Sat, 7 Sep 2013, Martin (Crypt) wrote:
<br>
<br>
<blockquote type="cite">I'm just amazed people are supprised at
all about this. We've had the NSA insert a backdoor into
windows, and we had several articles as far back as 2007,
including this:
<br>
<a class="moz-txt-link-freetext" href="http://www.wired.com/politics/security/commentary/securitymatters/2007/11/securitymatters_1115">http://www.wired.com/politics/security/commentary/securitymatters/2007/11/securitymatters_1115</a>
<br>
<br>
All point to this kind of activity, so it should come as no
supprise really. It all adds up to yet another reason to use
open standards and open source software. This isn't a perfect
solution to protect yourself, but its a lot better than
commercial
<br>
packages where the NSA can easily influence the developers to
put the backdoors in. In an open development community this is
a lot harder.
<br>
<br>
<br>
<br>
On Sat, Sep 7, 2013 at 9:50 AM, Chris
<a class="moz-txt-link-rfc2396E" href="mailto:greenbean@riseup.net"><greenbean@riseup.net></a> wrote:
<br>
This article contains leaked information about the NSA's
BULLRUN project
<br>
<br>
" two facts must remain top secret: that NSA makes
modifications to commercial encryption software and devices "to
make them exploitable", and that NSA "obtains cryptographic
details of commercial cryptographic information security systems
<br>
through industry relationships"."
<br>
<br>
<a class="moz-txt-link-freetext" href="http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security">http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security</a><br>
<br>
_______________________________________________
<br>
HacktionLab mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:HacktionLab@lists.aktivix.org">HacktionLab@lists.aktivix.org</a>
<br>
<a class="moz-txt-link-freetext" href="https://lists.aktivix.org/mailman/listinfo/hacktionlab">https://lists.aktivix.org/mailman/listinfo/hacktionlab</a>
<br>
<br>
<br>
<br>
<br>
</blockquote>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
HacktionLab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:HacktionLab@lists.aktivix.org">HacktionLab@lists.aktivix.org</a>
<a class="moz-txt-link-freetext" href="https://lists.aktivix.org/mailman/listinfo/hacktionlab">https://lists.aktivix.org/mailman/listinfo/hacktionlab</a>
</pre>
</blockquote>
<br>
</body>
</html>