Hot answers tagged

111

Tor is used to circumvent censorship! No, not directly. Tor is about anonymity, not about availability. Tor alone does not help its users access blocked content. Tor helps by making it hard to link clients with site visits, so that people can publish content without being identified. A government that controls all the network equipment of ISPs in the ...


96

In order to block Tor all that has to be done is have the current list of Tor nodes which can be found at the following link: http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv and then block them bidirectionally via the Routers or Firewalls. That said there will be numerous ways around such efforts, people can still use VPN's to connect ...


48

Despite the media hype, the key thing here is not that the FBI/NSA/US Government was intercepting all phone calls, but that it was collecting all phone 'metadata' records which includes: Originating Phone Number Terminating Phone NUmber IMSI Number IMEI Number Trunk Identifier (which relates to the location) Telephone Calling Card numbers Time of the call ...


46

I see two possible uses of such information from a government perspective. None of them involves the password or actually using your WiFi access. Forensic analysis: connected devices store an history of access points they were connected to, sometimes associated with "last seen" dates. Using this history, it is therefore possible to know where someone was ...


45

My opinion (and I am a cryptographer -- I have a shiny diploma which says so) is that: We cannot speculate on unknown algorithms, because they are, well, unknown. NSA is like all secret services in the World, they really love secrecy and will practice it for the sake of it. So the fact that their algorithms are not published is in no way indicative of some ...


45

Wiretapping case in Greece 2004–05: officially mandated but disabled interface for tapping into talks was used by unknown entity to listen to talks by high-profile politicians. Juniper VPN Backdoor: use of NSA mandated insecure random generator together with the modifications added by an unknown party allowed decryption of VPN traffic by third parties by ...


45

It is likely that the from header has been forged. I get emails from fake .govs quite often, mostly they end up in my spam filter. The hyperlink within is either unique, allowing tracking, or just delivers malware. Most of the time I just ignore these. If you believe that the header is not forged then you can typically contact the agency by Googling their ...


37

Tor will be actually quite hard to block because of tor bridges: Bridge relays (or "bridges" for short) are Tor relays that aren't listed in the main Tor directory. Since there is no complete public list of them, even if your ISP is filtering connections to all the known Tor relays, they probably won't be able to block all the bridges. To ban Tor ...


35

The Internet at large is designed to resist nuclear blasts. At least, it was a design goal of its immediate predecessor, ARPANET. There is no secret: to survive loss of components, you must have redundancy. In the context of nuclear blasts, this means that there must exist several paths for data between any two machines, and the paths should be as ...


34

To add to the answer from @RoryAlsop I'd agree that you probably don't, as an average person, have a lot to worry about in terms of the PRISM/phone tapping by the NSA being used for it's intended purprose (anti-terrorism operations by the US gov.) as people's concept of security/privacy most of the time isn't too great. There are other good reasons to be ...


29

There are a number of reasons why building their "own OS" is not a viable option. 1. Research Cost To built a new OS, from ground up without the use of any existing code would require significant research. Even today, there are only four or five popularly used kernels like Unix , Linux kernel, BSD, XNU and Windows NT. 2. Security through obscurity It's a ...


22

As someone who tracks people and their habits for a living, I will share a few observations about the average user. Implications of the phone information collection initiative on the internet: There will be a little more activity online worrying about privacy. The twitterverse will "explode" momentarily, but people will be aware of this as something going ...


22

You should respond to phishing from .gov addresses the same way you respond to any other sort of phishing - you don't. Don't reply to the e-mail, don't click links, don't open attachments, don't do anything the e-mail asks you to do. If you really want to be generous, check the WHOIS records for the domain the message claims to come from. That may have ...


20

Thanks for the insightful question. The more I think about it the more it feels like someone has pulled the rag below my feet (living without cryptographic protection). Analyzing the resulting threats (strictly from the business point of view - the requirements of dissidents etc. are a different story), I see them being: Corrupt government officials who ...


20

What's the point of stealing hashed passwords? Let's say I steal a hashed password, I can take a random string, hash it, and see if the hashes match. If they do then I've just cracked your password. For example, assume that under some hash function we get the following hash table: "cat" --> AA "dog" --> AB "elephant" --> AC ... If I steal a ...


18

In theory you should still be able to achieve confidentiality protection in some circumstances, because crypto isn't the only way to provide confidentiality, you can also provide it via access control. Realistically however it is difficult to think of any real world system where you can usefully achieve this without at least something like SSL in the ...


16

What properties should an online voting system ideally have? Secure Each voter can vote only once The voting authority can't add or remove votes without getting caught Privacy/Anonymity Other people(including the state) can't find out what you voted for. You should not be able to prove to somebody else how you voted, to prevent bought votes, or votes ...


16

It is not known how to build an Internet voting system that will be verifiably secure and auditable. Ron Rivest, Turing award winner and the R in RSA, has famously compared Internet voting to drunk driving: something you just can't do safely. (By Internet voting, I mean voting over the Internet from client computers not controlled by election authorities, ...


16

An interesting data point here is the DES s-box constants. Wikipedia NSA Wikipedia DES NSA recommended changes in the S-box constants to make DES resistant to differential analysis, which was unknown in the academic and commercial cryptography world at the time. In that case, they were able to make that improvement in a way that was opaque to the users of ...


16

This seems like a bureaucratic way of instilling FUD (Fear, Uncertainty and Doubt) in a population. For example in the old Soviet Union, neighbors would routinely spy on neighbors and agencies collected notes on citizens. But the raw data of those notes were so enormous—and the bureaucracy was/is so inneffecient—that the actual information collected was ...


15

@D3C4FF's answer hits the nail squarely on the head, however there is a further viewpoint regarding the average internet user: The average internet user has no concept of privacy, other than "the government looking at my data is bad, mmmkay" The average user shares far more information about themselves, deliberately, with the rest of the world than the 3-...


14

I think there's not enough information to answer. Without seeing the exact text of the law, we can't say whether it will be possible to communicate securely; it depends. That said, I will make two small points. I think if legislators really want to prevent secure communication, they'll do that. Sometimes technical folks think that legislators are dumb ...


14

I don't believe in security by obscurity in general, but in case of crypto it's actually worse, because it violates Kerckhoffs Principle So is it better? Maybe. Is it different? Sure. Is it necessary to hide the algos? If your crypto was good to begin with, you would not need to hide the algorithms, just the keys. On the other hand, you have the 'many ...


13

Even without cryptography, you could use steganography to make information hard or in some cases near impossible to find. It seems difficult to imagine a situation under which government could effectively ban that, since one could claim that a secret message was hidden anywhere and it is very difficult for an accused individual to demonstrate otherwise (...


13

Unfortunately, HTTPS is about as good as it gets in a situation like this. Encryption will help you prevent someone from viewing your messages in transit, and HTTPS is the correct tool for that in this case. However, the real security hole here isn't transmission of data, it's who you're sending it to. Whenever you visit BBC News or Stack Overflow, they ...


13

GreenHills Software is a company that specializes on creating OSes for military embedded systems. Their INTEGRITY system uses a microkernel (less code with less bugs) that has been formally verified (even less bugs). Such special-purpose domains, where only the most basic software components can be re-used, are probably the only area where it is manageable ...


13

Can this site be trusted? No. Well, not if you consider GoDaddy subverted or subvertable. As even the published serial number or website could be an FBI plant ;-). But if you want your emails, you'll need to connect to the site. What is the reason for allowing password changes only for five days in this context? We are assuming that the government ...


12

It's Always Been an Issue, You Just Didn't Care I'm not sure you need to worry that much more about it than you should have before. Keep in mind that what they are collecting are your operator's Call Data Records (or at leat a subset of that). You were already trusting a third-party with all that, and that was already a third-party I personally wouldn't ...


11

There isn't really enough information out there to know exactly what is being collected, but if most of it is meta data in nature or user records from services, then a VPN isn't really relevant. For the first situation (phone/Internet connection meta-data), the contents are not being requested, but only what connections are made. While the contents of your ...



Only top voted, non community-wiki answers of a minimum length are eligible