Guardian Project @guardianproject@librem.one
- home page
- https://guardianproject.info
- Liberapay
- https://liberapay.com/GuardianProject
People, apps and code you can trust
Joined Aug 2019
Our #HKPE (RFC9180) implementation shipped by #OpenSSL has been audited, and passed with flying colors: "Auditors did not identify any directly exploitable vulnerabilities". Nice work, Stephen Farrell!
https://7asecurity.com/blog/2023/12/defo-2-openssl-hpke-pr-security-audit/
https://www.opentech.fund/security-safety-audits/defo-2-openssl-hpke-pr-security-audit/
We hit a major new milestone our DEfO partnership project to accelerate adoption of #TLS Encrypted ClientHello (#ECH): Stephen Farrell made a pull request to #OpenSSL with a complete, working implementation: https://github.com/openssl/openssl/pull/22938
Guardian Project
boosted
TOR support for Debian bullseye and buster have been marked End-of-Life (EOL). Consider upgrading to bookworm to continue receiving TOR support and updates. https://lists.debian.org/debian-lts/2023/11/msg00019.html https://micronews.debian.org/2023/1701658911.html?utm_source=dlvr.it&utm_medium=mastodon
Guardian Project
boosted
🇺🇦 🇹🇼
Later today, I am finally going to live-present a conference paper again: "Anonymously Publishing Liveness Signals with Plausible Deniability", mostly by Michael Sonntag and in cooperation with Stefan Rass and me. The topic is a cryptographic protocol for verifying that whistleblowers and other secrets holders are still alive and well, that is, generating and verifying binary signals (without further information content) sent (semi-) regularly.
The most interesting aspects follow from the goal of plausible deniability: as a prover (whisteblower) or verifier, being able to plausibly claim to hold the respective other role or being part of an interaction that has already become inactive before, because stored data does not allow deciding either way when provided with the wrong decryption passphrase. Tools we use are Tor onion services and hash chains (totally not a Blockchain), prototyped as a Java library and Android app.
Details at https://link.springer.com/chapter/10.1007/978-3-031-48348-6_1, preprint soon so be available at https://www.digidow.eu/publications/.
Guardian Project
boosted
So there is a lack of accessibility to folks in the #GlobalSouth in particular. These Motorolas cost around half of what the budget versions of Pixel phones cost and are sold in many countries in continents where Pixels are not, including in #SouthAmerica #Asia and #MENA
Thank you to #StartSmall and jack dorsey for believing in us, and for the funding that made this possible ! And a BIG thank you to our friends at @LineageOS for their work on platform support for the Motorola phones
Guardian Project
boosted
Huge announcement ! @calyxos is now available for the Motorola G32, G42 and G52 ! Why is this a big deal ? Because it helps us further our mission of making #PrivacyByDesign available to the maximum amount of people around the world as we can..
Google Pixel phones are the default and easiest phones to support while maintaining the #Android security model with a locked boot loader and full verified boot. But they are only sold in around a dozen countries around the world...
Guardian Project
boosted
EFF's latest report shows that many of the internet's ills have one thing in common: they're based on the business model of widespread corporate surveillance online. https://www.eff.org/deeplinks/2023/11/address-online-harms-we-must-first-do-privacy
Guardian Project
boosted
Oh, and lastly, this whole Mastodon thread as a much more convenient blog post 😜:
Guardian Project
boosted
Guardian Project
boosted
I hacked some ECH (encrypted client hello) support in the JDK network stack the other day (in TLS 1.3).
https://github.com/johanvos/jdk/tree/ech2
Guardian Project
boosted
Hey, so #RFC9460 HTTPS/SVCB records are neat, right?
They...
- speed up your time-to-first-packet (by basically stuffing the Alt-Svc HTTP header / ALPN TLS extension into the #DNS);
- let you do redirection on the zone apex without using CNAMEs;
- allow for simple DNS load distribution and failover;
- obviate HSTS and the cumbersone preloading process;
- enable stronger privacy protections via Encrypted Client Hello aka #ECH
#Wireshark can now present some of the details of #EncryptedClientHello in #TLS streams, as of v4.2.0. For example, it can dissect the #ECH config data that comes from DNS. https://gitlab.com/wireshark/wireshark/-/merge_requests/12260
We have started the second round of our partnership https://defo.ie to ensure that the new #TLS standard called #EncryptedClientHello (#ECH) works for public interest use cases. We also are working to reduce the pressure towards #centralization inherent to the #privacy improvements of hiding the domain name. You can find more details in our project announcement: https://guardianproject.info/2023/11/09/defo-developing-ech-for-openssl-round-two/
We just created a #HOWTO for how to set up dev/test servers using our #TLS #EncryptedClientHello #ECH enabled forks of #OpenSSL #nginx and #curl running on #Debian. It should be very quick to get started using a new domain: https://guardianproject.info/2023/11/10/quick-set-up-guide-for-encrypted-client-hello-ech/
We are looking for feedback about how to help interested devs start messing around with #TLS #EncryptedClientHello #ECH. What are your blockers and interests?
The first fully merged, audited and shipped bit of code from our https://defo.ie project is Hybrid Public Key Encryption (#HKPE RFC9180), it has been shipped by #OpenSSL https://www.openssl.org/blog/blog/2023/10/18/ossl-hpke/ It is a building block for #EncryptedClientHello #ECH and #MessagingLayerSecurity #MLS, providing standard methods for using public key cryptography to encrypt arbitrary blocks of data.
For anyone who is interested in implementing #TLS Encrypted ClientHello (#ECH), we have set up a new public room: https://matrix.to/#/#ech-dev:matrix.org or irc://irc.oftc.net/ech-dev
Guardian Project
boosted
Mozilla is ringing the alarm bell on a dangerous EU regulation.
@calyxinstitute's #CalyxOS developers did some review of their #Android-based project and found no leaks:
https://gitlab.com/CalyxOS/calyxos/-/issues/1947
Guardian Project
boosted
Willkommen bei #ORFodon!
Der @ORF_News Bot hat jetzt seine eigene Instanz und eine Menge neuer Funktionen. Die Sparten und Bundesländernachrichten haben jetzt ihre eigenen Konten und dementsprechend ist eine viel flexiblere Filterung der Nachrichten und Beiträge des #ORF möglich.
Um Mehrfachbeiträge zu vermeiden, boosten die Kanäle einander.
Der Dienst wird weiterhin inoffiziell und privat betrieben.
Viel Spaß!
Weitere Informationen:
https://orfodon.org/about
- home page
- https://guardianproject.info
- Liberapay
- https://liberapay.com/GuardianProject
People, apps and code you can trust
Joined Aug 2019
