Debian over HTTPS
Posted on December 8, 2021
| Hans-Christoph Steiner
Debian’s package manager apt has a time-tested method of securely providing packages from the network built on OpenPGP signatures. Even though this signing method works well for verifying the indexes and package files, there are new threats that have become relevant as man-in-the-middle attacks and data mining become ever easier. Since 2013, apt developers have supported encrypted transport methods HTTPS and Tor Onion Service. We have been recommending their use since 2013.
[Read More]
Implementing TLS Encrypted Client Hello
Posted on November 30, 2021
| Hans-Christoph Steiner
As part of the DEfO project, we have been working on accelerating the development Encrypted Client Hello (ECH) as standardized by the IETF. ECH is the next step in improving Transport Layer Security (TLS). TLS is one of the basic building blocks of the internet, it is what puts the S in HTTPS. The ECH standard is nearing completion. That is exciting because ECH can encrypt the last plaintext TLS metadata that it is possible to encrypt.
[Read More]
Announcement: AnyNews 1.0: Censorship-Resistant News and Media Distribution
Posted on November 29, 2021
| David Oliver
Summary For content publishers, AnyNews is a news distribution suite focused on service to censorship-prone geographies, easily integrated into existing content sources. AnyNews is open-source and easily branded (or customized, if desired) without extensive effort or expense. AnyNews integrates technologies to counter a range of censorship regimes and is designed to accommodate new technologies more easily and quickly as they arise. Tools are provided to support a range of publishing options for environments that suffer from connectivity or performance problems.
[Read More]
IETF112 - Meeting Update (November 2021)
Posted on November 24, 2021
| David
The 112th meeting of the Internet Engineering Task Force (IETF) took place November 8-12, 2021 - as a virtual event for the sixth time in succession due to the COVID-19 pandemic. Here’s a summary of the work I found important to the Internet Freedom community.
Privacy Preserving Measurement While we often (rightly) focus on unwanted surveillance of targeted individuals by nation-states and other bad actors, the Internet’s surveillance economy presents a major threat to personal privacy and freedom for all users of the Internet, as Mozilla so aptly describes on this wiki page.
[Read More]
The IETF and Internet Freedom
Posted on October 18, 2021
| David
It seems useful to clarify the relationship between the near-term work of keeping the Internet open on a daily basis - work that dominates the efforts of the Internet Freedom community - and the long term work of the industry on crafting operational standards for the same network.
Those involved in Internet Freedom are typically focused on the “problems of today”, creating solutions using existing technologies offering immediate effect. Often, it’s hard to tell if Internet standards are helping, hurting, or just in the way.
[Read More]
New insights into clean analytics
Posted on March 2, 2021
| Hans-Christoph Steiner
There is a giant problem with the “collect it all” status quo that pervades on the Internet, this has been clear for a long time. Tracking people has become so widespread that organizations, communities, projects and university labs have sprung up dedicated to detecting and publicizing their presence. Data and analytics are clearly useful for software creators and funders, but they also easily lead to harming people’s privacy and well-being.
[Read More]
Usability: the wonderful, powerful idea that betrayed us
Posted on February 18, 2021
| Hans-Christoph Steiner
Usability triggered a revolution in computing, taking arcane number crunching machines and making them essential tools in so many human endeavors, even those that have little to do with mathematics. It turned the traditional design approach on its head. Initially, experts first built a system then trained users to follow it. User experience design starts with goals, observes how people actually think and act in the relevant context, then designs around those observations, and tests with users to ensure it fits the users’ understanding.
[Read More]
Clean Insights: February 2021 Update on Privacy-Preserving Measurement
Posted on February 10, 2021
| Nathan (n8fr8)
Greetings, all. I hope this finds you healthy and well, finding ways to enjoy the season (whichever it may be). While everyday still provides new challenges in the life of our team at Guardian Project, we continue to strive to be productive as productive as we can be in our professional and personal lives.
I’ve just posted an updated presentation on Clean Insights, reflecting on the symposium in May, and the work we have done since then.
[Read More]
New Data Sources: API Key Identifiers and BroadcastReceiver Declarations
Posted on December 15, 2020
| Hans-Christoph Steiner
A central focus of the Tracking the Trackers project has been to find simple ways to detect whether a given Android APK app file contains code which tracks the user. The ideal scenario is a simple program that can scan the APK and tell a non-technical user whether it contains trackers, but as decades of experience with anti-virus and malware scanners have clearly demonstrated, scanners will always contain a large degree of approximation and guesswork.
[Read More]
εxodus ETIP: The Canonical Database for Tracking Trackers
Posted on December 11, 2020
| Hans-Christoph Steiner
There is a new story to add to the list of horrors of Surveillance Capitalism: the United States’ Military is purchasing tracking and location data from companies that track many millions of people. We believe the best solution starts with making people aware of the problem, with tools like Exodus Privacy. Then they must have real options for stepping out of “big tech”, where tracking dominates. F-Droid provides Android apps that are reviewed for tracking and other “anti-features”, and F-Droid is built into mobile platforms like CalyxOS that are free of proprietary, big tech software.
[Read More]
Distribution in Depth: Mirrors as a Source of Resiliency
Posted on December 7, 2020
| Hans-Christoph Steiner
There are many ways to get the apps and media, even when the Internet is expensive, slow, blocked, or even completely unavailable. Censorshop circumvention tools from ShadowSocks to Pluggable Transports can evade blocks. Sneakernets and nearby connections work without any network connection. Hosting on Content Delivery Networks (CDNs) can make hosting drastically cheaper and faster. One method that is often overlooked these days is repository mirrors. Distribution setups that support mirrors give users the flexibility to find a huge array of solutions for problems when things are not just working.
[Read More]
Managing offline maps with F-Droid and OsmAnd
Posted on November 28, 2020
| Hans-Christoph Steiner
When disaster strikes, our mobile devices can provide us with many tools to deal with a wide variety of problems. The internet is not available in every corner of the planet, and large scale outages happen. Digital maps allow us to carry detailed maps of the entire planet in our pockets. And the good map apps allow the user to download entire regions to the device so that they operate without internet at all.
[Read More]
Easy translation workflows and the risks of translating in the cloud
Posted on June 8, 2020
| Hans-Christoph Steiner
Crowdsourced translation has opened up software and websites to whole new languages, regions, and uses. Making translating easier has brought in more contributors, and deploying those languages requires less work. A number of providers now offer “live”, integrated translation, speeding up the process of delivering translated websites. On the surface, this looks like a big win. Unfortunately, the way such services have been implemented opens up a big can of worms.
[Read More]
Onion Browser Release 2.6 Tutorial
Posted on June 2, 2020
In this tutorial we’re going to talk about the best practices to browse the web securely on iOS using Onion Browser Release 2.6 and the Tor network. Onion Browser for iOS is a free, open-source web browser app developed originally by Mike Tigas, with Release 2.6 as a collaboration with the Guardian Project. Onion Browser has Tor built-in and uses Tor to protect your web activity.
You can also watch the Onion Browser Video Tutorial on YouTube.
[Read More]
On the classification of tracking
Posted on May 20, 2020
| Aaron Kaplan
This position paper tries to outline a framework for defining trackers in smart phones and lists mechanisms for identifying them. It hopes to serve as the foundation for the work done in the Tracking-the-Trackers project.
In section 1 we start with an abstract analysis of levels of unwanted behaviour in the context of tracking.
Next, in section 2, we focus on an attacker’s perspective, on anonymity and pseudonymity. This foundation allows us to define terms which are needed throughout the paper.
[Read More]
Free Software Tooling for Android Feature Extraction
Posted on May 6, 2020
| Hans-Christoph Steiner
As part of the Tracking the Trackers project, we are inspecting thousands of Android apps to see what kinds of tracking we can find. We are looking at both the binary APK files as well as the source code. Source code is of course easy to inspect, since it is already a form that is meant to be read and reviewed by people. Android APK binaries are a very different story.
[Read More]
"Features" for Finding Trackers
Posted on April 28, 2020
| Hamilton Kaplan
One key component of the Tracking the Trackers project is building a machine learning (ML) tool to aide humans to find tracking in Android apps. One of the most important pieces of developing a machine learning tool is figuring out which “features” should be fed to the machine learning algorithms. In this context, features are constrained data sets derived from the whole data set. In our case, the whole data set is terabytes of APKs.
[Read More]
Figuring Out Crowdsourced Translation of Websites
Posted on April 23, 2020
| Hans-Christoph Steiner
Crowdsourced translation platforms like Weblate, Transifex, Crowdin, etc. have proven to be a hugely productive way to actively translate apps and desktop software. Long form texts like documentation and websites remain much more work to translate and keep translated. Many translation services currently support Markdown and HTML, but very basically, which means much more work for translators and webmasters. Translators can inadvertently break things, either with a typo or because of a lack of knowledge of a specific syntax.
[Read More]
The Promise and Hazards of COVID Contact Tracing Apps
Posted on April 9, 2020
| Hans-Christoph Steiner
There has been increasing interest in the possibilities of tracking people who are infected with Coronavirus using all of the various methods that smart phones provide. There is good reason: “contact tracing” has been a pillar of public health efforts for decades. It is an effective means to curtail the spread of infectious disease. At the same time, governments, companies, and organizations are acting fast to offer services to help end this current pandemic.
[Read More]
We Support the Open COVID Pledge
Posted on April 9, 2020
Please join this Open COVID Pledge by committing to freely share technology for all work that aims to end the Coronavirus Disease 2019 (COVID-19) pandemic.
We believe that free software licenses like the GNU GPL and the Apache License already provide these key benefits. We are making this statement to make it clear that all of our code is available for any effort to end the COVID Pandemic.
We grant to every person and entity that wishes to accept it, a non-exclusive, royalty-free, worldwide, fully paid-up license to fully use, practice and exploit all our patent and copyright rights, for the sole purpose of ending the COVID-19 pandemic and minimising the impact of the disease, including diagnosis, prevention, containment, and treatment.
[Read More]