4 ms·
Protecting Your Anonymity: A How-to for Sex Workers
- djent 12y agoEven the EFF now is recommending Bitlocker. Interesting.
- Spooky23 12y agoIs there some sort of inside joke that I'm not aware of re: BitLocker? By default, it does key escrow. It's pretty trivial to disable that. Other than that, I've yet to hear any substantive reason why I wouldn't use BitLocker.
- wyager 12y ago>Other than that, I've yet to hear any substantive reason why I wouldn't use BitLocker. You shouldn't trust any closed source crypto. Same goes for FileVault. They're certainly better than nothing, however.
- giancarlostoro 12y agoIt's a reference to TrueCrypt being shut down, they are pushing BitLocker. The reason you in theory shouldn't trust closed source encryption solutions is because you have no idea if they have a way to decrypt your data internally. If such a thing were leaked or discovered in the black hat community, your data is now compromised (in theory).
- bowmessage 12y agoI think there are better alternatives available, its security re: NSA etc is obviously questionable just because it is such an enterprise product.
- sliverstorm 12y ago90% of the reason is, IMO, people are just gunshy about all things Microsoft. Which is kind of funny, really- if you are already running Windows, I wouldn't think it would matter whether you use TrueCrypt or BitLocker. Windows is the proverbial janitor with keys to all the offices. It's a little too late to keep Microsoft out.
- michaelt 12y agoOther than that, I've yet to hear any substantive reason why I wouldn't use BitLocker. The thinking goes like this: 1. RSA released software with backdoors, at the behest of the NSA. 2. Therefore, the NSA has the ability to make companies release software with backdoors. 3. The FBI and British governments are known to have asked for backdoors to be included in BitLocker. 4. Therefore, the NSA has the motive to have a backdoor put in. 5. Microsoft have not proved BitLocker /does not/ contain backdoors.
- dijit 12y agoBut you have to run Windows on bitlocker. so you've already handed over your machine no matter what FDE you use. certainly trusting less people is better than trusting more, since _any_ nefarious third party in this scenario already has the keys to the kingdom.
- cookiecaper 12y agoFull-disk encryption is primarily used to protect offline volumes. If no one can boot your disk, it doesn't matter if Microsoft can upload its entire contents to the NSA once Windows is started. The concern is that a flaw in BitLocker's FDE would make it vulnerable to attacks while the volume is offline. FDE doesn't really protect online volumes. Yes, the disk is still encrypted, but the OS transparently decrypts any requested sector, so other security measures are necessary to protect mounted volumes.
- simoncion 12y agoIf you run Windows, you've already handed over root access to Microsoft. Given that, if you're not interested in encrypted volumes that work across OS's, what reason would you have to not use Bitlocker?
- panarky 12y agoIf Redbook users listen to the EFF and start using Tor, how soon before there's a redbook8x7r8ewjk.onion version much harder to take down?
- thejosh 12y agoThis may sound like a very stupid question, but with Tor I've seen URLs where they have whateverxx9191.onion, i'm guessing the first part is randomised, how hard is it for them to get the first part of their name? Is there a program or script that just keeps generating until the minimum hit (redbook* would be acceptable etc) is made?
- sirsar 12y agoThere are a few different programs that will do it, but it comes down to brute force, so the difficulty depends on the length. https://github.com/katmagic/Shallot https://github.com/katmagic/Shallot https://github.com/lachesis/scallion https://github.com/lachesis/scallion
- tomjen3 12y agoFYI I just checked and Shallot is entirely CPU based, so for brute forcing there is no point in using it at all - Scallion (open cl) will always be much, much, much faster.
- frozenport 12y agoI always felt this was the point of the Glory Hole http://www.urbandictionary.com/define.php?term=glory%20hole http://www.urbandictionary.com/define.php?term=glory%20hole ? I feel the EFF has overstepped. At the end of the day, these people were committing crimes, an article dedicating to protecting their privacy, and impeding the law, is in bad precedent and has little to do with internet activism and more to do with prostitution laws.
- deleted 12y ago[deleted]
- skrebbel 12y agoI have no idea why you're being downvoted. This thread isn't about "should prostitution be legal".
- frozenport 12y agoInterestingly, my down-vote level is fluctuationing, so there are indeed up-voters.
- netcan 12y agoI'm not sure if this is downvote worthy. It's certainly not upvote worthy. "Stick to glory holes, hookers!" probably puts it into the negative range. In many cases sex workers are breaking the law. So are various journalists, bloggers, twitter users, homosexuals in a variety of countries. EFF & Tor often aim to protect people from official persecution under the law in their countries. Illegal does not necessarily equate to immoral. This article and the articles it follows on from are in fact partially about protecting prostitutes from legal action and from the indirect consequences of legal action. EFF: The seizure is part of a disturbing trend of targeting sex workers Bay Area Sex Worker Outreach Project: we also lost extensive online forums for a community of sex workers to keep each other safe, screen clients, and blacklist predators. The bigger context of the article is what it means for anonymity, freedom of association and free speech if an allegation and subsequent warrant can lead to extensive records of everyone associated with a site being collected and filed. Imagine a forum dedicated to recreational drug use (one of the first online discussion groups). Various people participate anonymously. Crimes (eg selling supplying drugs are committed. The site is frequented by drug users, advocates, maybe even rehabilitation professionals. A warrant results in full records of every participant being leaked. If you can't see the damage done to the right to free speech and association by that, you are blind. The comment boils down to 'Prostitution is illegal therefore protecting their anonymity is wrong.' It doesn't understand the bigger point about the meta issues. It's unintelligent. Flavored with 'glory holes, hehe' it deserves a down-vote.
- thegeomaster 12y agoI fail to see how this advice applies specifically to sex workers. What I see is a (good) guide on how to protect your privacy and keep your personal data from prying eyes in the general case. You will be at risk of seizure, surveillance or examination if you're doing less serious and more passive stuff than a sex worker has to do. EFF could maybe come up with some advice that will narrowly target sex workers in this case. They mentioned MyRedBook was used to screen clients and keep from predators, so perhaps some advice on how to do that now the site's down will be valuable?
- davorak 12y agoIt seems to be about giving timely advise given the recent take down of of myredbook.com https://www.eff.org/deeplinks/2014/07/whose-redbook-why-everyone-should-be-concerned-seizure-myredbookcom https://www.eff.org/deeplinks/2014/07/whose-redbook-why-ever... hackernews thread: https://news.ycombinator.com/item?id=7974203 https://news.ycombinator.com/item?id=7974203
- bayesianhorse 12y agoI still believe "consent" and "free will" are overestimated when talking about prostitution...
- collyw 12y agoIn some cases for sure, other not.
- deleted 12y ago[deleted]
- queerty 12y agoYou don't understand what 'consent' means, do you?
- bayesianhorse 12y agoI mean that in the sense that a prostitute needs to consent, and be able to consent, to have sex with a client, otherwise it's rape, not a business transaction. Turns out, a large proportion, in some situations the majority, of prostitutes can't even consent. They are underage, drug addicts (often not through a conscious choice but through pimps forcing the addiction), regularly beaten and/or they often are illegal immigrants (less legal protection). That is why I say people overestimate the "free will" involved in prostitutions. Especially in the lower end you will hardly find prostitutes with clear cut cases of "I do it for the money". In european countries often they could have a better life living on welfare. And no, catching welfare payments is normally not more demeaning than getting essentially raped multiple times a day.
- truthmagnet 12y agoEFF are in full drama mode now. They have lost all credibility with me and I'll never, ever donate to them again. P.S. If you want to be safe from many online and offline predators, don't get into sex work.
- netcan 12y agoAre those two sentences related? Can you explain what you mean by full drama mode?
- paletoy 12y agoLet's assume you start with the premise that preventing surveillance if a good thing to do. In general, rational arguments won't get people to act. Drama might. But this post does seems like a reasonable post if you try and imagine it through the eyes of someone who worked in myredbook. > don't get into sex work. That's not a good reason for them to be exposed to harm.
- paletoy 12y agoI do wonder about technical solutions: are there any decent way to write sites that would: 1. Run in the browser. 2. Would be anonymous. 3. Would use an anonymous host. 4. Would encyrpt every private message, and would have clear differentiation between public and private content. 5. Would have an easy option to download an extension to offer greater security. 6. Would enable average programmers to build sites with it. Is there something like this? And if not is it technically possible and what are the technical challenges ?
- lawl 12y agoI don't know if there already is something like this. But if there is i expect it to be fairly immature. The technology you need to build onion routing (what TOR does) are Peer-to-Peer connections. I think this would be doable using WebRTC data channels for which browser support is still lacking though [0]. I think with browser fully supporting P2P-WebRTC data channels it should be possibly to basically implement TOR as a website. Notice though, I am by no means an expert on this topic, these are just my two cents. Also there will probably be a lot of problems in the implementation (node only active as long as website is open, which you could match with when the website was requested from the server etc.) As I said I'm not an expert, so I guess the only thing I'm fairly certain about is that it will not be possible without Web-RTC. [0] http://iswebrtcreadyyet.com/ http://iswebrtcreadyyet.com/ ; no affiliation, just googled this.
- Udo 12y agoRenting a server in a reliable jurisdiction that doesn't care about prostitution would be a giant first step. Germany or the Netherlands comes to mind. The rest really depends on how much tech fiddling you can expect from the audience. Obviously, just using a normal SSLed website has the lowest barrier. You would have the option of using Tor on the client side, but you could still access the thing with a normal smart phone if need be. The next step up would be a site that is reachable only via Tor. This would (within reasonable limits) give users privacy of connection. However, if they exchange real phone numbers and other contact data - which they probably need to - this advantage becomes moot. Encrypting private messages between two or more parties so the host can't read them would require users to keep and manage their own key rings. That's not a reasonable expectation. In any case, the most important content would probably have to be available to all users, such as client information for screening or a general community support message board.