5 ms·
Resilient Anonymous Communication for Everyone (RACE)
- ZunarJ5 2y agoMatrix or Briar? Wouldn't P2P/self hosting always be better?
- upon_drumhead 2y agop2p leaks the 'metadata' of the network connections. It makes it trivial for someone to know that these two nodes are talking to each other. A goal of this, and other similar protocols, attempt to prevent that sort of metadata analysis.
- thisconnect 2y agoHave a look at simplex.chat
- ZunarJ5 2y agoInteresting, thanks for the reply.
- Rhapso 2y agoThat only happens if the fact nodes are peering provides information relevant to security. If the peer selection protocol is something like a dht, or a random-k network like bitcoin, it doesn't leak anything. but in practice nothing works better than all-to-all messages via epidemic routing. https://www.miasma.space/anon-dhts/ https://www.miasma.space/anon-dhts/
- deleted 2y ago[deleted]
- mapt 2y agoApparently, Signal is already used heavily by the US military, and Telegram by the Russian & Ukrainian military. As we create, so we destroy for tactical reasons. Telegram's founder was just arrested for "failure to moderate". PGP was regarded as "munitions export". Tor is apparently wide open to the NSA through traffic analysis. Even as a small portion of our government wants freedom of communication, most of it is strongly opposed.
- ants_everywhere 2y agoTelegram can't moderate the encrypted content. Most of Telegram is not encrypted. A more apt comparison might be Facebook groups.
- coliveira 2y agoThe goal of US gov is not to create, it is to control.
- OutOfHere 2y agoThe US government is not one thing. It is diverse agencies, often working together, but sometimes in opposition. It is not guaranteed that all agencies have the same goal of control.
- lawlessone 2y agoTelegram dude was already allegedly cooperating and moderating for the Russian government. If true he loses any argument that suggests he was defending privacy or free speech.
- mapt 2y agoAre you at all familiar with "Telegram Dude"? A fugitive of the Russian Government, an expat whose Facebook-like social network VKontakte was seized by the Russian Government, before he fled Russia and started an encrypted messaging app in response? I'm no expert on his current activities, but this isn't a situation without Known Context.
- upon_drumhead 2y agothere are news articles (I admit, of questionable origin) the claim he visited Russia yearly for the past decade. I do wonder if it the situation is a little more complex then he was a fugitive of the Russian Government
- 2y ago
- upon_drumhead 2y agoFrom https://github.com/tst-race/race-docs/blob/main/what-is-race.md https://github.com/tst-race/race-docs/blob/main/what-is-race... it sounds pretty similar to how TOR works
- Rhapso 2y agoyeah reading this it feels like it lacks anything tor isn't already better at
- ants_everywhere 2y agoThe US military is kinda weird because the offensive and defensive sides have opposite interests when it comes to privacy and anonymity. (1) The defensive side wants the ability to de-anonymize and decrypt everything on demand so they can catch threats to the US. (2) The offensive side wants to promote anonymous encrypted communications so they can encourage pro-democratic dissent in authoritarian regimes.
- rhplus 2y agoGroup (1) also wants their adversaries to feel confident that the encryption promoted by (2) is secure, so that they use it to communicate candidly. It that respect, (2) is just a mouthpiece for (1), provided there’s a back door or vulnerability that only (1) knows about.
- chefandy 2y ago> provided there’s a back door or vulnerability that only (1) knows about. Do you have any examples from existing tools, e.g. Tor, for which that's true? Tor's been around a long time-- surely something would have surfaced at this point, but I haven't really paid attention to it.
- inhumantsar 2y agoTor is an interesting example. A number of attacks are made possible by monitoring Tor exit node traffic, especially at the scale nation states can bring to the table. https://en.m.wikipedia.org/wiki/Tor_(network)#Exit_node_eavesdropping https://en.m.wikipedia.org/wiki/Tor_(network)#Exit_node_eave...
- chefandy 2y agoSure-- but that structural shortcoming has been a thing for a long time-- I wouldn't consider it a secret vulnerability that Tor was facilitating for US intelligence, as was initially implicated. I'm not in the field, but it seems like it would be way more useful for law enforcement working against criminals naive enough to think tor would be a one-stop op-sec solution (e.g. ANOM) than for nation-state-level counterintelligence.
- motohagiography 2y agothis is an important problem to work on so I'm extra irritated by this. looked for the protocol written in standard/BAN notation, didn't find it. if you don't have that for a security protocol, what is there to evaluate or trust? - lack of a top level protocol description? Check. - quirky codeworded modules instead of useful feature abstractions? Check. - promoted by an intelligence agency? Check. I'd be really interested in novel solutions to this general problem, but how is this one not dumber than Urbit?
- dirtdobber 2y agoDARPA isn't an intelligence agency.
- j33zusjuice 2y agoThey partner with them depending on the project, though.
- motohagiography 2y agoanyone who knows what darpa does knows it's included in the IC, which a reasonable person would call an intelligence agency.
- dirtdobber 2y agoDARPA is an R&D agency under the DoD. Even if you work on their classified projects, it's going to be under the umbrella of the DoD. There are specific R&D agencies for the Intel community (see IARPA). Some constructive criticism: it's better to just admit when you made a false statement than to double down on being wrong.
- motohagiography 2y agothat's misdirection and bureaucratic hair splitting. surely if I'm not being precise about the roles of sub-agencies, this blob of code is trustworthy. on the inside, they're different agencies, but on the outside, it is absolutely not. if you're doing cleared work you have obligations and spooks are spooks. Not only is it government, but it is part of DoD. DARPA isn't creating anti-state anarchist communications platforms in spite of the rest of law enforcement and the IC, and if they are, you'd be insane to trust them with your black market or terrorist operation, which is the only meaningful use case for measuring the integrity of an encrypted anonymous platform like the one being proposed. the extremist example use case means that authorities are forced to use some legal method other than mass or passive interception to exploit it for evidence or to disrupt a plot. pretty sure DARPA isn't arming enemies like that, and if they are, they can provide something security pros can reason about instead of something for naive developers to play with.
- EGreg 2y ago[flagged]
- deleted 2y ago[deleted]
- Jerrrrrrry 2y agoReminds me of a recent quote: an ungovernable, decentralized, general trust-less computation protocol/escrow/rep using zkp+ and hormophic encryption was not able to be realized before the alfabit bois got a chance to mole into the development pipeline and backdoor the inevitable Merchanti Ultimatum; anything less would be a massive national security threat globally.
- miovoid 2y agoHuh, do you quote yourself?
- deleted 2y ago[deleted]
- Jerrrrrrry 2y agogreat minds think alike
- the-alchemist 2y agoLooks like a few folks are confused. 1. One of the underlying cryptographic principles is multi-party / secure-party communication (https://en.wikipedia.org/wiki/Secure_multi-party_computation https://en.wikipedia.org/wiki/Secure_multi-party_computation). e.g., three people want to share their salaries to each other, but don't want the information to be traceable to back to the source. 2. Another is Steganography, hiding text in, say, an image, or audio. 3. You want to prevent the problems with Signal, Tor, Bitcoin, etc. This means, no "50%" problem like Bitcoin, no monitoring of exit nodes like Tor, no centralized distribution issue like Signal. Imagine: Alice "sends" a message to Bob by creating an account on Reddit and posts a cat meme which has the hidden text (steganography). Bob knows how to find the text in that cat meme, and responds by posting something on Twitter, which Alice can read and decrypt. All this is deniable (I didn't get anything from Alice!), available (e.g., Twitter goes down), and secure.
- nine_k 2y agoIndeed. For extra security, post cat pics to three different image boards; only by successfully combining all three can the receiver decode the message. If you are limited by the speed of finding / generating new cat pictures, publish frames from public webcam feeds that show life in a big aquarium, or sunsets, or clouds, or apply artistic filters on hourly charts of stock-trading sessions, etc. Make sure that not every picture contains a part of a message, but that every picture has steganography-like minor alterations, also explainable by applying a sensible but crude filter. In general, you can lace any of the plentiful reasonably stochastic streams with a steganogrphic side-channel. The approach has limitations: your bandwidth is very low, and your latency is also pretty poor. Worse yet, you have to first establish a complicated protocol between you and your counterparty. In general, I think, it's not cracking your byzantine protocol that would ruin you, but a couple of small opsec mistakes (see Dread Pirate Roberts and the end of Silk Road), and these mistakes may be not even done by you but by your counterparty. Spear-phising, exploiting the local system that runs the communication and has some sensitive material in plain text, game over. The problem with highly secure and clandestine communication (or any other activity) is that it makes your whole life complicated enough, puts enough extra strain on you, that you become noticeable by that alone. Maybe not immediately, but the probability of a small mistake that could put you on a watch-just-in-case list of a willing state-level actor is always nonzero. This does not mean that the situation is hopeless, but rather means that you have a time limit before your cat-posting scheme, still unbroken, becomes irrelevant, given enough interest from The Man against whom you conspire.