Auditing Twitter With Orbot
Posted on June 13, 2012
| patch
Twitter’s new Android application provides a proxy option that supports Orbot. It is a great way to access Twitter, particularly if Twitter is blocked. Check out the Orbot Your Twitter blog post! That post explains how to set up Orbot with Twitter, however, it came with an important disclaimer:
WARNING AND DISCLAIMER: Twitter for Android is proprietary, closed-source software. Details of the implementation of proxy support have not been publicly disclosed or audited by a third-party at this time.
[Read More]
<!--:en-->A Partnership for Open Secure Mobile Messaging between iOS and Android<!--:-->
Posted on June 8, 2012
| n8fr8
We believe in protocols, not products. We believe in partnerships, not proprietary fiefdoms. We believe in building a community of collaborators, not a cacophony of criticism and unnecessary competition. We believe in practical solutions to perilous problems.
With all of this in mind, we are very happy to announce our partnership and support of the ChatSecure for iOS open-source free software project. Through our our two year history, we have been lucky to receive support from a variety of donors and funders, and we are now using what influence and opportunities we have to endorse other projects that we feel are compatible with our outlook and goals.
[Read More]
<!--:en-->OSTN secure VoIP wizard now built into CSipSimple for Android<!--:-->
Posted on May 26, 2012
| n8fr8
If you saw our last post about how to
setup your own secure voice-over-IP server instance, then this news is for you.
If you are an Android user looking for the best open-source VoIP app, and really need one that can support secure communications, then this post is ALSO for you.
CSipSimple, the previously mentioned “best VoIP app”, now includes a wizard for setting up an account configuration for any server which complies with our Open Secure Telephony Network specification.
[Read More]
<!--:en-->Build your own Open Secure Telephony Network, some assembly required<!--:-->
Posted on May 17, 2012
| lee
The Open Secure Telephony Network is a standard that defines how to configure a VoIP softswitch with the capability to have secure two-way VoIP conversations if both parties are using the same server. The system requires both backend and frontend components, which makes OSTN is a little different than some of the other Guardian apps. Unlike Gibberbot, there are few public SIP services that support secure signalling for a mobile app to connect with.
[Read More]
IOCipher lives! encrypted virtual file system for Android
Posted on May 17, 2012
| Hans-Christoph Steiner
Nathan and I just got the first complete test of IOCipher working in the IOCipherServer/SpotSync app. We created a filesystem sqlite.db file, then mounted it and got all the files via HTTP. In the test suite, I have lots of operations all running fine and encrypting! The core idea here is a java.io API replacement that transparently writes to an encrypted store. So for the most part, just change your import statements from:
[Read More]
<!--:en-->Bye, bye, BBM! Facebook Allows Verifiable Encrypted Mobile Messaging for Android and iOS; Mobile Revenue Threatened?<!--:-->
Posted on May 16, 2012
| n8fr8
Yes, yes, we are trying to get in on all of the Facebook pre-IPO buzz. Fortunately, the headline is true – through
Facebook’s support for open-standards messaging, our secure mobile messaging app, Gibberbot for Android, can be used to communicate securely with any other friend on Facebook who is ALSO using a secure messaging app. Whether it is Gibberbot, ChatSecure for iOS, Adium (Mac), Pidgin (Windows/Linux), or one of the many secure messaging apps that support the Off-the-Record encryption capability, Facebook allows encrypted messaging between mobile and desktops alike.
[Read More]
Cross-Domain calling, or “toll-free long distance VoIP”
Posted on May 4, 2012
| lee
In a standard OSTN configuration, the Fully Qualified Domain Name (FQDN) of the server running Freeswitch is a core dependency to operate the service. For example, the domain ostel.me was first configured as a DNS record, a server was bootstrapped with ostel.me as the local hostname and a Freeswitch cookbook was run using the Chef automation system. Because the domain was configured both in DNS and locally, the cookbook has enough information to automatically build an operational OSTN node.
[Read More]
Orbot Your Twitter!
Posted on May 2, 2012
| n8fr8
In some ways, Twitter is the perfect application to run over the Tor network. It works with small bits of data, it is asynchronous, works naturally in a “store and forward” queue model, and in general, has a decent amount of default security built-in through HTTP/S support and OAuth. Compared to the problem-child of the open web, which often involves large websites, streaming video, flash embeds, and malicious javascript, Twitter is a nearly perfect candidate for use over a secure, anonymous (but sometimes high latency) network.
[Read More]
Mobile mesh in a real world test
Posted on May 2, 2012
| Hans-Christoph Steiner
Nathan, Mark, Lee, and I tried some OLSR mesh testing during the May Day protests and marches. We were able to get 4 devices to associate and mesh together, but not without some trials and travails. Two pairs of devices setup two separate BSSIDs, so were on separate networks. We turned them all off, then associated them one at a time, and then they all got onto the same BSSID and olsrd started doing its thing.
[Read More]
Singing and Dancing for Encryption
Posted on April 19, 2012
| mark
If you see me dancing or signing with my phone in my hand, I may not just be having a great time, but also creating an encryption key. Part of the issue with security is that it can often be difficult to implement or an added step in what users want to be an easy and seamless process. What if we can make secure and private communications fun and easy?
[Read More]
User scenarios to guide our crypto development
Posted on April 14, 2012
| Hans-Christoph Steiner
At Guardian Project, we find user-centered development to be essential to producing useful software that addresses real world needs. To drive this, we work with user stories and scenarios as part of the process of developing software. One particular development focus is the Portable Shared Security Token (PSST) project, which aims to make it easy to use encryption across both mobile and desktop computers, as well as keep the stores of cryptographic identities (i.
[Read More]
How We Help
Posted on April 10, 2012
| n8fr8
While we think that a secure, privacy-enhanced mobile phone is a good thing for just about anybody going about their daily lives, we like to also consider the extreme cases, where this technology might change the course of someones life.
The Economist covered our work with WITNESS on Secure Smart Cameras, and the “Future of Protest Video”.
Below are a few ideas of how Guardian phones might be used in the real world.
[Read More]
Transparent encrypted virtual disks for Android (we call it IOCipher)
Posted on April 3, 2012
| Hans-Christoph Steiner
When using phones, laptops, computers, etc. it feels like a private experience, as if our screen was the same as a piece of paper, and when that paper is gone, then no one can see it anymore. Digital media works very differently. While the user interface portrays the deletion of files as very final, for someone with the right tools, it is actually not hard to recover deleted files. Also, digital information takes up so little space, we now regularly carry vast amounts of information in our pockets.
[Read More]
Knight News funding of SecureSmartCam = a #WIN for open-source mobile security
Posted on March 29, 2012
| n8fr8
Along with our partner WITNESS, we’ve entered our SecureSmartCam project into the Knight News Challenge, and we need your support to get to the next round.
Here’s a bit more about the challenge:
The Knight News Challenge, an international media innovation contest, is evolving – and will be offered three times, with three different topics. The first challenge will be centered on networks, and will accept applications Feb. 27 – March 17.
[Read More]
Call My Email
Posted on March 22, 2012
| mark
What if you could call me directly through my email? No exchanging of phone numbers or searching for handles on Skype. Just plain and simple email. Now what if we can make that phone call as secure as it is easy. That’s the goal of what we’re doing here at Open Secure Telephony Network (OSTN).
The internet is already structured to be able to do this. That’s why I can have all of my emails point to one email box if I want to.
[Read More]
Acrobits Groundwire – OSTN supports iPhone
Posted on March 21, 2012
| lee
The Guardian Project develops open source software primarily for the Android platform but we strive for security by design to be a part of all platforms. With OSTN, there are two major components. The the first is the server, which operates as the primary user directory and call switch. The other is the client, which is the program you interact with to send and receive calls.
While the Apple App Store forbids distribution of GPL licensed software from their service, the underlying protocols used by OSTN are open, so even iPhone developers may implement them in a proprietary client application without breaking any intellectual property laws.
[Read More]
On Verifying Identity Using Cryptography
Posted on March 19, 2012
| Hans-Christoph Steiner
One of the most important uses of cryptography these days is verifying the identity of the other side of a digital conversation. That conversation could be between two people using OTR-encrypted IM, a web browser showing a bank website, a Debian Developer uploading a package to the Debian build server, an ssh client logging into an ssh server, and on and on. In all of these cases, cryptography is used to ensure that the software is indeed receiving replies from the expected entity.
[Read More]
Adventures in Porting: GnuPG 2.1.x to Android!
Posted on March 15, 2012
| Hans-Christoph Steiner
PGP started with Phil Zimmerman’s Pretty Good Privacy, which is now turned into an open IETF standard known as OpenPGP. These days, the reference OpenPGP platform seems to be GnuPG: its used by Debian and all its derivatives in the OS itself for verifying packages and more. It is also at the core of all Debian development work, allowing the very diffuse body of Debian, Ubuntu, etc developers to communicate and share work effectively while maintaining a high level of security.
[Read More]
Our new F-Droid App Repository (out of date!)
Posted on March 15, 2012
| n8fr8
Update: this blog post has been changed to reference our new FDroid repository at https://guardianproject.info/fdroid. If you are still using the old one originally described here which has the URL https://guardianproject.info/repo, you should switch to the new repo as soon as possible!
For all of you out there looking for a safe way to find and download apps outside of the Play Store (aka Android Market) or random, sketchy third-party app stores and file sharing sites, then your wait is over:
[Read More]
VoIP Survey Results of NGOs, Human Rights Groups and Activists
Posted on March 7, 2012
| n8fr8
In November 2011, 25 individuals were surveyed using an online form, representing typical end-users, global journalists, activist and human rights organization perspectives (Thank you to all the participants!). The goal of the survey was to establish a baseline understanding of the types of tools and expectations our target user community has around making “telephone calls” over the internet, otherwise known as Voice over Internet Protocol (VoIP).
This survey is part of our work on the Open Secure Telephony Net (OSTN).
[Read More]