[NZLUG] Privacy server

Jim Cheetham jim at gonzul.net
Tue Jun 18 16:09:31 NZST 2013

On 18 June 2013 14:58, David McNab <david at conscious.co.nz> wrote:
> One major thought is that one should *expect to* receive subpoenas from
> Police and GCSB within a day of the site going live, and be forced to
> install arbitrary backdoor logging and MITM software.

Sure, except this is intended to be a private service for people who
can assign trust (or at least mutual distrust) to each other, rather
than any form of public service.
And with a careful setup procedure and a reasonable level of
cross-checking, such an activity should be difficult to keep secret.

> One major countermeasure is to mandate that clients transact a certain level
> of random "chaff" traffic, which the server is unable to distinguish from
> legitimate payload. Also, strongly discouraging users from "connecting and
> using as needed", to mitigage timing attacks.

Great; then perhaps one of the options would be a constant-traffic vpn
connection of some kind :-)

> Thought also needs to go in to the situation of compromised clients.

Not from the perspective of the server; that's a different problem.



More information about the NZLUG mailing list