Debian over HTTPS

 Posted on December 8, 2021  |  Hans-Christoph Steiner

Debian’s package manager apt has a time-tested method of securely providing packages from the network built on OpenPGP signatures. Even though this signing method works well for verifying the indexes and package files, there are new threats that have become relevant as man-in-the-middle attacks and data mining become ever easier. Since 2013, apt developers have supported encrypted transport methods HTTPS and Tor Onion Service. We have been recommending their use since 2013. [Read More]
Debian  metadata  privacy  TLS 

Free Software Tooling for Android Feature Extraction

 Posted on May 6, 2020  |  Hans-Christoph Steiner

As part of the Tracking the Trackers project, we are inspecting thousands of Android apps to see what kinds of tracking we can find. We are looking at both the binary APK files as well as the source code. Source code is of course easy to inspect, since it is already a form that is meant to be read and reviewed by people. Android APK binaries are a very different story. [Read More]
Android  debian  Exodus Privacy  feature extraction  free software  machine learning  NGI0 PET  NLnet  open source  Tracking the Trackers 

Use Onions/HTTPS for software updates

 Posted on January 23, 2019  |  Hans-Christoph Steiner

There is a new vulnerability in Debian’s apt that allows anything that can Man-in-the-Middle (MITM) your traffic to get root on your Debian/Ubuntu/etc boxes. Using encrypted connections for downloading updates, like HTTPS or Tor Onion Services, reduces this vulnerability to requiring root on the mirror server in order to exploit it. That is a drastic reduction in exposure. We have been pushing for this since 2014, and Debian, mirror operators, and others in the ecosystem have taken some big steps towards making this the standard. [Read More]
debian  distribution  security  updates 

Build Android apps with Debian: apt install android-sdk

 Posted on March 13, 2017  |  Hans-Christoph Steiner


In Debian stretch, the upcoming new release, it is now possible to build Android apps using only packages from Debian. This will provide all of the tools needed to build an Android app targeting the “platform” android-23 using the SDK build-tools 24.0.0. Those two are the only versions of “platform” and “build-tools” currently in Debian, but it is possible to use the Google binaries by installing them into /usr/lib/android-sdk.

[Read More]
Android  bazaar  debian  howto  open source  reproducible builds  security 

HOWTO: get all your Debian packages via Tor Onion Services

 Posted on July 31, 2016  |  Hans-Christoph Steiner

Following up on some privacy leaks that we looked into a while back, there are now official Debian Tor Onion Services for getting software packages and security updates, thanks to the Debian Sys Admin team. This is important for high risk use cases like TAILS covers, but also it is useful to make it more difficult to do some kinds of targeted attacks against high-security servers. The default Debian and Ubuntu package servers use plain HTTP with unencrypted connections. [Read More]
anonymity  debian  distribution  howto  metadata  privacy  security  tor  tor hidden service  tor onion service 

Building the most private app store

 Posted on June 2, 2016  |  Hans-Christoph Steiner

App stores can work well without any tracking at all Attackers are increasingly seeing app stores as a prime attack vector, whether it is aimed at the masses like XCodeGhost or very targeted like in FBI vs Apple. When we install software from an app store, we are placing a lot of trust in a lot of different parties involved in getting the source code from the original developer delivered to our device in a useful form. [Read More]
Android  anonymity  bazaar  debian  encryption  F-Droid  fdroid  identity  mobile  open source  privacy  reproducible builds  security  tor 

Getting Android tools into Debian

 Posted on April 30, 2015  |  Hans-Christoph Steiner

As part of Debian’s project in Google Summer of Code, I’ll be working with two students, Kai-Chung Yan and Komal Sukhani, and another mentor from the Debian Java Team team, Markus Koschany. We are going to be working on getting the Android SDK and tools into Debian, as part of the Debian Android Tools team, building upon the existing work already included from the Java and Android Tools teams. [Read More]
Android  bazaar  debian  gnu/linux  gradle  gsoc  java  linux  open source  packaging  summer of code 

Reducing metadata leakage from software updates

 Posted on October 16, 2014  |  Hans-Christoph Steiner

Update: now you can do this with Tor Onion Services Many software update systems use code signing to ensure that only the correct software is downloaded and installed, and to prevent the code from being altered. This is an effective way to prevent the code from being modified, and because of that, software update systems often use plain, unencrypted HTTP connections for downloading code updates. That means that the metadata of what packages a machine has installed is available in plain text for any network observer, from someone sitting on the same public WiFi as you, to state actors with full network observation capabilities. [Read More]
anonymity  bazaar  debian  distribution  encryption  gnu/linux  howto  https  linux  ssl  tails  tor  ubuntu 

Setting up your own app store with F-Droid

 Posted on November 5, 2013  |  Hans-Christoph Steiner

(_This blog post as now been cooked into an updated HOWTO_) The Google Play Store for Android is not available in all parts of the world, US law restricts its use in certain countries like Iran, and many countries block access to the Play Store, like China. Also, the Google Play Store tracks all user actions, reporting back to Google what apps have been installed and also run on the phone. [Read More]
Android  bazaar  debian  distribution  F-Droid  fdroid  free software  howto  mobile  open source  privacy  ubuntu 

Issues when distributing software

 Posted on October 31, 2013  |  Hans-Christoph Steiner

There is currently a discussion underway on the Debian-security list about adding TLS and Tor functionality to the official repositories (repos) of Debian packages that is highlighting how we need to update how we think about the risks when distributing software. Mostly, we are used to thinking about making sure that the software that the user is installing is the same exact software that has been posted for distribution. This is generally handled by signing the software package, then verifying that signature on the user’s machine. [Read More]
anonymity  bazaar  debian  distribution  encryption  privacy  security  tor