4 ms·

It's email transported and authenticated using combination of Tor, Axolotl, and socialist millionaire. Unfortunately: > LookingGlass is meant to be run on a lo

by Canada 11y ago

It's email transported and authenticated using combination of Tor, Axolotl, and socialist millionaire. Unfortunately: > LookingGlass is meant to be run on a local, headless (without monitor), always-on computer. Installation consists of copying a disk image to an SD card, inserting that into a Raspberry Pi, and plugging it into your local network (preferably behind a router). Appliance designs such as this have 0 chance of gaining significant use. The author should consider rolling this solution into software packages that run on operating systems people actually have.

0x006A 11y ago
I guess thats what the virtualbox image is for?
- unicornporn 11y ago
  He said "normal people". Virtual machines are not something the general population is fluent with. Perhaps you can't expect "normal people" to be the target group for everything though. First class security often comes at a price, in some cases this is fine.
  - Canada 11y ago
    If I wanted to talk securely to any of you guys I could just setup a hidden SSH server on Tor. None of you would have any problem using sftp to give me messages and files or use talk to chat. As long as we used the latest OpenSSH and picked the better algorithms we'd stand a better chance of resisting a skilled attacker than using this project. The problem is we have nothing to say to each other. We all have sensitive conversations with our lawyers, doctors, immediate family, and the like. And those people cannot make use of solutions that require knowledge of how to actually use a computer.
    - occult 11y ago
      This is such a good point. There's a chicken / egg problem here where you need a critical mass of activity for anything interesting / useful to emerge but the barrier to entry getting to these places is high enough, and the pain / friction involved with spending time there is significant enough, that communities have a difficult time forming. I think LookingGlass is meant to try to overcome some of these problems. That said, strolling down darknet alley sure does feel a lot like wandering around Chernobyl.
qznc 11y ago
I would suggest Sandstorm https://sandstorm.io/ https://sandstorm.io/
fulafel 11y ago
There are 5+ million RPi's out there and I bet there's significant overlap in the types of propellerheads (read: early adopters) that have gotten one for other reasons or just for kicks, and who might be interested in this. Running this 24/7 on your power guzzling worm infested Windows box is not really the best match.
- Canada 11y ago
  Then what do you suggest people use to connect to the headless appliance?
  - fulafel 11y ago
    Tablet or laptop for example?
    - Canada 11y ago
      How are those any different?
  - occult 11y ago
    Something behind a firewall for sure and with the browser locked down.
akerl_ 11y ago
Is this the physical analogue of the "curl | sudo sh" strategy? Just take this image from our site, toss it on a headless server, plug it into your network and let it do whatever we set it up to do! </tinfoil>
stabilo 11y ago
"Unfortunately..." Can you be more specific? Irrespective of this project and its goals, I agree with the installation approach. What is the impassable step? Purchasing a RPi? Using a program to copy an image to an SD Card? What if SD Cards with the image pre-installed were also available? The RPi stays on unless someone unplugs it, so I trust that no one is going to claim "always on" is an issue. It does not even have a reset button like most consumer routers. Setting up consumer routers involves plugging into a local network so I cannot imagine that is an issue either. So what is it? This image is a whopping 1GB and there is no link to source code. Without source code this is all but worthless. However I agree 100% with the distribution and installation method. All computers, including routers, should boot from removable media. And users should get to choose what OS they run. Control. Who has it? Users have very little and what they have is continually being eroded. If users want more control over what internet companies are allowed to do, then this is the way forward. What do others think?
- Canada 11y ago
  The author of this project notes, "Freenet is stillborn." I agree. And it's pretty obvious the reason why is that Freenet presents itself as a web server. Any privacy project packaged as a web app is doomed. The local web app is a shitty interface. If Freenet had an interface more like Bittorrent, its fate may have been different. There is a market for appliances sporting web interfaces, but that's only because it's the cheapest way to have a graphical interface that's cross platform. Only technical people use such things, and even they have to want the benefits of the appliance pretty badly to put up with the hassle of deployment. The average consumer will never touch that crap, and I don't blame them. You mention consumer routers. Yes, those are appliances with web interfaces. But the benefit of deploying one is ACCESS TO THE INTERNET! That's a pretty compelling reason. Even if LookingGlass was sold pre-configured like a router, it's not even close to compelling enough to gain traction. Besides how inconvenient the web appliance is to use, it's also pretty weak from a security perspective. You want to have all the encryption happening as close to the endpoints as possible. To reduce attack surface it's also best that the architecture is as simple as possible, with minimal dependencies. The LookingGlass approach follows neither of those best practices. The project even recommends deployment behind a firewall. I don't want to shit on LookingGlass here. I haven't looked too hard at it and I support any experimentation with new protocol ideas in this space. It's just that to be successful it needs to be natively written for every platform, especially the mobile ones. Making the core implementation portable by using C or C++ is acceptable. Just getting it going on Linux and asking users to run a server - especially a physical server - is totally not.

by Canada 11y ago

0x006A 11y ago

I guess thats what the virtualbox image is for?

unicornporn 11y ago
He said "normal people". Virtual machines are not something the general population is fluent with. Perhaps you can't expect "normal people" to be the target group for everything though. First class security often comes at a price, in some cases this is fine.
- Canada 11y ago
  If I wanted to talk securely to any of you guys I could just setup a hidden SSH server on Tor. None of you would have any problem using sftp to give me messages and files or use talk to chat. As long as we used the latest OpenSSH and picked the better algorithms we'd stand a better chance of resisting a skilled attacker than using this project. The problem is we have nothing to say to each other. We all have sensitive conversations with our lawyers, doctors, immediate family, and the like. And those people cannot make use of solutions that require knowledge of how to actually use a computer.
  - occult 11y ago
    This is such a good point. There's a chicken / egg problem here where you need a critical mass of activity for anything interesting / useful to emerge but the barrier to entry getting to these places is high enough, and the pain / friction involved with spending time there is significant enough, that communities have a difficult time forming. I think LookingGlass is meant to try to overcome some of these problems. That said, strolling down darknet alley sure does feel a lot like wandering around Chernobyl.

qznc 11y ago

I would suggest Sandstorm https://sandstorm.io/ https://sandstorm.io/

fulafel 11y ago

There are 5+ million RPi's out there and I bet there's significant overlap in the types of propellerheads (read: early adopters) that have gotten one for other reasons or just for kicks, and who might be interested in this. Running this 24/7 on your power guzzling worm infested Windows box is not really the best match.

Canada 11y ago
Then what do you suggest people use to connect to the headless appliance?
- fulafel 11y ago
  Tablet or laptop for example?
  - Canada 11y ago
    How are those any different?
- occult 11y ago
  Something behind a firewall for sure and with the browser locked down.

akerl_ 11y ago

Is this the physical analogue of the "curl | sudo sh" strategy? Just take this image from our site, toss it on a headless server, plug it into your network and let it do whatever we set it up to do! </tinfoil>

stabilo 11y ago

"Unfortunately..." Can you be more specific? Irrespective of this project and its goals, I agree with the installation approach. What is the impassable step? Purchasing a RPi? Using a program to copy an image to an SD Card? What if SD Cards with the image pre-installed were also available? The RPi stays on unless someone unplugs it, so I trust that no one is going to claim "always on" is an issue. It does not even have a reset button like most consumer routers. Setting up consumer routers involves plugging into a local network so I cannot imagine that is an issue either. So what is it? This image is a whopping 1GB and there is no link to source code. Without source code this is all but worthless. However I agree 100% with the distribution and installation method. All computers, including routers, should boot from removable media. And users should get to choose what OS they run. Control. Who has it? Users have very little and what they have is continually being eroded. If users want more control over what internet companies are allowed to do, then this is the way forward. What do others think?

Canada 11y ago
The author of this project notes, "Freenet is stillborn." I agree. And it's pretty obvious the reason why is that Freenet presents itself as a web server. Any privacy project packaged as a web app is doomed. The local web app is a shitty interface. If Freenet had an interface more like Bittorrent, its fate may have been different. There is a market for appliances sporting web interfaces, but that's only because it's the cheapest way to have a graphical interface that's cross platform. Only technical people use such things, and even they have to want the benefits of the appliance pretty badly to put up with the hassle of deployment. The average consumer will never touch that crap, and I don't blame them. You mention consumer routers. Yes, those are appliances with web interfaces. But the benefit of deploying one is ACCESS TO THE INTERNET! That's a pretty compelling reason. Even if LookingGlass was sold pre-configured like a router, it's not even close to compelling enough to gain traction. Besides how inconvenient the web appliance is to use, it's also pretty weak from a security perspective. You want to have all the encryption happening as close to the endpoints as possible. To reduce attack surface it's also best that the architecture is as simple as possible, with minimal dependencies. The LookingGlass approach follows neither of those best practices. The project even recommends deployment behind a firewall. I don't want to shit on LookingGlass here. I haven't looked too hard at it and I support any experimentation with new protocol ideas in this space. It's just that to be successful it needs to be natively written for every platform, especially the mobile ones. Making the core implementation portable by using C or C++ is acceptable. Just getting it going on Linux and asking users to run a server - especially a physical server - is totally not.