No more “Root” features in Orbot… use Orfox & VPN instead!
Posted on October 27, 2017
| n8fr8
Since I first announced the available of Orbot: Tor for Android about 8 years ago (wow!), myself and others have been working on various methods in which to make the capabilities of Tor available through the operating system. This post is to announce that as of the next, imminent release, Orbot v15.5, we will no longer be supporting the Root-required “Transproxy” method. This is due to many reasons.
First, it turns out that allowing applications to get “root” access on your device seems like a good idea, it can also be seen as huge security hole.
[Read More]
New research report on the challenges developers face
Posted on May 15, 2017
| Seamus Tuohy
The Guardian Project has been working with the F-Droid community to make it a secure, streamlined, and verifiable app distribution channel for high-risk environments. While doing this we have started to become more aware of the challenges and risks facing software developers who build software in closed and closing spaces around the world.
There are a wealth of resources available on how to support and collaborate with high-risk users.
[Read More]
HOWTO: get all your Debian packages via Tor Onion Services
Posted on July 31, 2016
| Hans-Christoph Steiner
Following up on some privacy leaks that we looked into a while back, there are now official Debian Tor Onion Services for getting software packages and security updates, thanks to the Debian Sys Admin team. This is important for high risk use cases like TAILS covers, but also it is useful to make it more difficult to do some kinds of targeted attacks against high-security servers. The default Debian and Ubuntu package servers use plain HTTP with unencrypted connections.
[Read More]
Building the most private app store
Posted on June 2, 2016
| Hans-Christoph Steiner
App stores can work well without any tracking at all
Attackers are increasingly seeing app stores as a prime attack vector, whether it is aimed at the masses like XCodeGhost or very targeted like in FBI vs Apple. When we install software from an app store, we are placing a lot of trust in a lot of different parties involved in getting the source code from the original developer delivered to our device in a useful form.
[Read More]
Experimental app to improve privacy in location sharing
Posted on January 29, 2015
| Hans-Christoph Steiner
As part of the T2 Panic effort, I’ve recently been diving deep into the issues of sharing location. It is unfortunately looking really bad, with many services, including Google, frequently sharing location as plain text over the network. I’ve started to write up some of the issues on this blog.
As part of this, I’ve put together an experimental Android app that aims to act as a privacy filter for all ways of sharing location.
[Read More]
Sharing your location privately
Posted on January 23, 2015
| Hans-Christoph Steiner
Facebook location sharing embeds the location in every single message, providing a detailed log to the recipient, Facebook, and anyone Facebook shares that data with One handy feature that many smartphones give us is the ability to easily share our exact position with other people. You can see this feature in a lot of apps. Google Maps lets you click “Share” and send a URL via any method you have available.
[Read More]
Reducing metadata leakage from software updates
Posted on October 16, 2014
| Hans-Christoph Steiner
Update: now you can do this with Tor Onion Services
Many software update systems use code signing to ensure that only the correct software is downloaded and installed, and to prevent the code from being altered. This is an effective way to prevent the code from being modified, and because of that, software update systems often use plain, unencrypted HTTP connections for downloading code updates. That means that the metadata of what packages a machine has installed is available in plain text for any network observer, from someone sitting on the same public WiFi as you, to state actors with full network observation capabilities.
[Read More]
Your own private dropbox with free software
Posted on November 12, 2013
| Hans-Christoph Steiner
There are lots of file storage and sharing software packages out there that make it easy for a group of people to share files. Dropbox is perhaps the most well known of the group, it provides an easy way for a group of people to share files. The downside of Dropbox is that it is not a private service, just like any cloud-based service. Dropbox has total access to your files that you store there.
[Read More]
Issues when distributing software
Posted on October 31, 2013
| Hans-Christoph Steiner
There is currently a discussion underway on the Debian-security list about adding TLS and Tor functionality to the official repositories (repos) of Debian packages that is highlighting how we need to update how we think about the risks when distributing software. Mostly, we are used to thinking about making sure that the software that the user is installing is the same exact software that has been posted for distribution. This is generally handled by signing the software package, then verifying that signature on the user’s machine.
[Read More]
Orbot v12 now in beta
Posted on July 24, 2013
| n8fr8
After much too long, we’ve got a new build of Orbot out, and it is… a stable beta! Nothing radically new here, just many small changes to continue to improve the experience of our hundreds of thousands of active users out in the world. There will likely be one or two more “beta” releases to iron out small issues in v12, but for now, this one is good to go.
[Read More]
Mumble and the Bandwidth – Anonymous CB radio with Mumble and Tor
Posted on January 31, 2013
| lee
The journey towards anonymous and secure voice communication is a long one. There’s lots of roadblocks to get your voice from point A to point B over the Internet if you need to prevent eavesdropping or censorship. There is the limited bandwidth of mobile data connections. There is the high latency of the TCP protocol. To achieve anonymity via Tor, there’s even more latency added to each packet.
Mumble is a non-standard protocol that was originally designed for realtime voice chat for video games.
[Read More]
User scenarios to guide our crypto development
Posted on April 14, 2012
| Hans-Christoph Steiner
At Guardian Project, we find user-centered development to be essential to producing useful software that addresses real world needs. To drive this, we work with user stories and scenarios as part of the process of developing software. One particular development focus is the Portable Shared Security Token (PSST) project, which aims to make it easy to use encryption across both mobile and desktop computers, as well as keep the stores of cryptographic identities (i.
[Read More]
Orbot Update: New Setup Wizard at Startup
Posted on July 29, 2010
| n8fr8
We’ve been working away at the 0.0.9 release of Orbot over the last few months, and have put a decent amount of effort into usability. Specifically, we hoped to better communicate to users what it means to run Tor on your Android phone. In addition, we wanted to clearly lay out how the various configuration options help to improve your mobile web anonymity and ability to circumvent web filters and tracking by your mobile service provider.
[Read More]