2006-08-21 10:45 <@ekes> introductions started 2006-08-21 10:46 <@ekes> new people have arried since yesterday 2006-08-21 10:50 <@ekes> ssl / certificates discussion likely to be moved to another time 2006-08-21 10:53 < skep> yup..thanks for all the updates, you guys.. 2006-08-21 10:57 <@ekes> discussion at the moment about translation and keeping people involved 2006-08-21 10:58 < skep> rabble isn#t there by any chance? 2006-08-21 10:59 <@ekes> not that I know of 2006-08-21 10:59 < skep> k 2006-08-21 11:01 <@ekes> proposal: to discuss what should be included in security certification 2006-08-21 11:01 <@ekes> then later to discuss ssl in detail and tech issues 2006-08-21 11:01 -!- nodo50-es [nodo50-es@localhost] has joined #PGA 2006-08-21 11:01 <@ekes> the discussion later can use spek slides 2006-08-21 11:02 <@ekes> agree: disucss the certification program 2006-08-21 11:02 <@ekes> to discuss own secturity 2006-08-21 11:03 <@ekes> to communticate imprltance to users 2006-08-21 11:03 <@ekes> for maintaining servers identity 2006-08-21 11:04 <@ekes> there are proposals, general discussion first: 2006-08-21 11:04 <@ekes> threats: hosting and seizure 2006-08-21 11:04 <@ekes> e-mail: 2006-08-21 11:04 <@ekes> user - server 2006-08-21 11:05 <@ekes> server - server 2006-08-21 11:05 <@ekes> storing the data 2006-08-21 11:05 <@ekes> logs 2006-08-21 11:06 <@ekes> also gpg 2006-08-21 11:06 <@ekes> encrypted mailing lists?? 2006-08-21 11:07 <@ekes> hosting threats: 2006-08-21 11:07 <@ekes> logs 2006-08-21 11:07 <@ekes> uploading 2006-08-21 11:08 <@ekes> scripting language exploits 2006-08-21 11:08 <@ekes> ? are we naming threats or our requirements 2006-08-21 11:09 <@ekes> ? are we thinking about things to consider when designing services 2006-08-21 11:09 <@ekes> we are thinking about the design needs 2006-08-21 11:09 <@ekes> additien to e-mail list: 2006-08-21 11:09 <@ekes> usability 2006-08-21 11:10 <@ekes> has to be usable for ordinary users to move 2006-08-21 11:10 <@ekes> . users freedom of movement 2006-08-21 11:10 <@ekes> . shell accounts 2006-08-21 11:12 <@ekes> alternatives for languages / cms on the hostings 2006-08-21 11:12 <@ekes> e-mail: mta mua send home users address 2006-08-21 11:13 <@ekes> hosting: https 2006-08-21 11:14 <@ekes> protocols boing added to the list of threats 2006-08-21 11:15 <@ekes> . physical location of machines 2006-08-21 11:16 <@ekes> hosting: ssl cetificates 2006-08-21 11:17 <@ekes> (self-signed, cacert, community) 2006-08-21 11:17 <@ekes> discussing ca-certs and assurers 2006-08-21 11:19 <@ekes> different levels of certification - 2006-08-21 11:19 <@ekes> proposed diiscuss this in with the ssl discussion 2006-08-21 11:20 <@ekes> cacert without points 6 months with ponts 2 years 2006-08-21 11:20 <@ekes> propose: brainstorm protocols for certs 2006-08-21 11:21 <@ekes> physical location: 2006-08-21 11:22 <@ekes> propose talk about later - after network discussion 2006-08-21 11:22 <@ekes> propose not happf with cert authority 2006-08-21 11:22 <@ekes> a politcial issue with cert authority 2006-08-21 11:23 <@ekes> centralised structure 2006-08-21 11:23 <@ekes> powwer given 2006-08-21 11:23 <@ekes> power of police to verify the inner structures of servers 2006-08-21 11:24 <@ekes> should be worded differently a group of servers who agree on a set of podnts - something public - no more 2006-08-21 11:24 <@ekes> also good to list bad servers too 2006-08-21 11:25 <@ekes> don't want a "authority" this copies the structures already there - we should make new ones 2006-08-21 11:25 <@ekes> - 2006-08-21 11:25 <@ekes> like the idea of peer review at some point 2006-08-21 11:26 <@ekes> if we agree the list of points 2006-08-21 11:26 <@ekes> then anyone tn the network should be able to find time to peer review 2006-08-21 11:26 <@ekes> - 2006-08-21 11:27 <@ekes> past has been "certicicate anti-authority" 2006-08-21 11:27 <@ekes> caa - stalled by cacert 2006-08-21 11:27 <@ekes> progress held up on it 2006-08-21 11:27 <@ekes> who creates the certs is one question 2006-08-21 11:27 <@ekes> the other is agreeing what the poiints are 2006-08-21 11:28 <@ekes> noone wants to create central power 2006-08-21 11:28 <@ekes> but there should be accountabilty 2006-08-21 11:28 <@ekes> this shoulb be decentralised 2006-08-21 11:28 <@ekes> - 2006-08-21 11:29 <@ekes> sounds good, can find a way to agree, but not clear how 2006-08-21 11:29 <@ekes> need time to talk about the issues involved 2006-08-21 11:29 <@ekes> this issue - how we shape this body - should be long running discussion 2006-08-21 11:29 <@ekes> how we create structures 2006-08-21 11:30 <@ekes> another discussion: 2006-08-21 11:30 <@ekes> there is no internet security - computer security is building prison security against us 2006-08-21 11:31 <@ekes> ? where is this going 2006-08-21 11:31 <@ekes> clarification: 2006-08-21 11:31 <@ekes> daily- id, cctv, biometrics even hackers are dealing with the issues that will put us in jail tommorrow 2006-08-21 11:32 <@ekes> security is an issue of society 2006-08-21 11:32 <@ekes> we have a need for security 2006-08-21 11:33 <@ekes> as activists we need security against authority 2006-08-21 11:33 <@ekes> background - how can we implement security on daily basis, when we figth for a worlkd without this security 2006-08-21 11:34 <@ekes> be aware of the dangers of participating in the global set up - the sept 11 trend 2006-08-21 11:34 <@ekes> - 2006-08-21 11:35 <@ekes> three elements: tech, social, admin 2006-08-21 11:35 <@ekes> (fourth: political) 2006-08-21 11:35 <@ekes> proposal - another time conversation 2006-08-21 11:36 <@ekes> "in my utopia there aree locks on doors, the right to privicy is still important" 2006-08-21 11:36 <@ekes> move on to tech 2006-08-21 11:36 <@ekes> - 2006-08-21 11:36 <@ekes> focus - issues for next 20 mins: 2006-08-21 11:36 <@ekes> user issues: 2006-08-21 11:37 -!- maxigas [maxigas@localhost] has joined #PGA 2006-08-21 11:37 <@ekes> don't care about mail being encrypted 2006-08-21 11:37 <@ekes> most don't know abou headers - 2006-08-21 11:37 <@ekes> no-log riseup have squirelmail 2006-08-21 11:38 <@ekes> plug in to make it clear when encrypted 2006-08-21 11:38 -!- emma [emma@localhost] has quit [Quit: la guerre sociale m'attend ;)] 2006-08-21 11:39 <@ekes> server - server communication - just the discussion tls (not gpg) 2006-08-21 11:39 <@ekes> who talks to who can be seen with gpg not tls 2006-08-21 11:39 < maxigas> because headers are not encrypted 2006-08-21 11:40 <@ekes> . webmail patches 2006-08-21 11:40 <@ekes> to identiy starttls headers 2006-08-21 11:41 <@ekes> ? can only be tackled after the certs issue (man in middle can still happen) 2006-08-21 11:42 <@ekes> no outgoing ips in the headers 2006-08-21 11:42 <@ekes> ? discussion about the law in eu 2006-08-21 11:43 <@ekes> you have to log it some how (not publicly?) 2006-08-21 11:43 <@ekes> at the moment is default public in headers 2006-08-21 11:43 <@ekes> session fixation attacks 2006-08-21 11:44 <@ekes> (easy to attack webmail - but there is a plug in to solve) 2006-08-21 11:45 <@ekes> session storage 2006-08-21 11:45 <@ekes> cookie storage (users shouldn't have access to /tmp for examlpe) 2006-08-21 11:45 <@ekes> (should not be in url either) 2006-08-21 11:46 <@ekes> https only 2006-08-21 11:47 <@ekes> (cookies better than uri - no referrer_uri) 2006-08-21 11:47 <@ekes> (issues with https only - slow on old hw and sw) 2006-08-21 11:48 <@ekes> ? xss 2006-08-21 11:48 <@ekes> just make sure the code is good 2006-08-21 11:48 <@ekes> ? cookies 2006-08-21 11:49 <@ekes> no sensative data in them - make sure not using program that does this 2006-08-21 11:49 <@ekes> need to keep up to date with all software 2006-08-21 11:50 <@ekes> ? logs 2006-08-21 11:50 <@ekes> another section 2006-08-21 11:50 <@ekes> . ssl certificates 2006-08-21 11:51 <@ekes> cacert relies on offical documents - passport ect 2006-08-21 11:51 <@ekes> who runs cacert - does anyone "know" him 2006-08-21 11:52 <@ekes> how we create a movement alternative - are they part of the movement 2006-08-21 11:52 <@ekes> because of the tech we use the certs 2006-08-21 11:52 <@ekes> - 2006-08-21 11:53 <@ekes> three options: cacert, anti-cert authority (caa), lots of individual certs (or none and be vulnerable) 2006-08-21 11:54 <@ekes> - 2006-08-21 11:54 <@ekes> happy with cacert as the less worse cert authority 2006-08-21 11:55 <@ekes> and have a link between our network of trust with cacert 2006-08-21 11:55 <@ekes> - 2006-08-21 11:55 <@ekes> ? what is the current situation 2006-08-21 11:56 <@ekes> list of cacert users: poivron, ... 2006-08-21 11:57 <@ekes> another group - have own certificators 2006-08-21 11:57 <@ekes> cannot read the signers for certs from the certs (or ask cacert) 2006-08-21 11:58 <@ekes> riseup - have an organisational account 2006-08-21 11:58 <@ekes> ? so people happy with as now cacert 2006-08-21 12:02 <@ekes> 3.ee use cacert 2006-08-21 12:02 <@ekes> aktivix use cacert 2006-08-21 12:03 <@ekes> propose just there should be verification of a certificate 2006-08-21 12:03 <@ekes> cacert, caa, many groups 2006-08-21 12:04 <@ekes> users: don't understand mismatched certificates - just click "yes" 2006-08-21 12:05 <@ekes> unlocking certs: private key - storage 2006-08-21 12:05 <@ekes> (don't want to retype passphrase an reboot - so remove) 2006-08-21 12:06 <@ekes> returning to users: importing cacert, then accept other cacert signed - do we want users to trust them? 2006-08-21 12:07 <@ekes> (this is the same as anyother cert body) 2006-08-21 12:07 <@ekes> - 2006-08-21 12:07 <@ekes> this is not main concern, 2006-08-21 12:08 <@ekes> really how do we get users to import the cert 2006-08-21 12:08 <@ekes> how do we make sure they get the right cert (man in the middle here) 2006-08-21 12:08 <@ekes> - 2006-08-21 12:08 <@ekes> propose: move to ca discussion 2006-08-21 12:08 <@ekes> - 2006-08-21 12:08 <@ekes> only strong cyphers 2006-08-21 12:09 <@ekes> (issues with old hardware and software - tech solidarity) 2006-08-21 12:10 <@ekes> (only ie use the strong one that riseup want to use - can't log the conversation an replay) 2006-08-21 12:11 <@ekes> lobby firefox - direct action - to make it use thom 2006-08-21 12:11 <@ekes> better browser support 2006-08-21 12:12 <@ekes> detail again in the cert discussion 2006-08-21 12:12 <@ekes> - 2006-08-21 12:12 <@ekes> . logs 2006-08-21 12:13 <@ekes> problem is law, and keeping servers running 2006-08-21 12:13 <@ekes> defend server against attacks and misuse - even ip's help here 2006-08-21 12:13 <@ekes> stats are nice too 2006-08-21 12:13 <@ekes> - 2006-08-21 12:13 <@ekes> logs are evil 2006-08-21 12:14 <@ekes> apache module 2006-08-21 12:14 <@ekes> ? the least logging you can legally get away with 2006-08-21 12:15 <@ekes> - 2006-08-21 12:17 <@ekes> software, syslog-ng-anon, mod_noip, postfix-anon, postgrey-anon, sqpuirellmail-anon, imp-anon 2006-08-21 12:17 <@ekes> - 2006-08-21 12:18 < nodo50-es> http://losvigilantes.nodo50.org/infoenglish.html 2006-08-21 12:19 <@ekes> discussing cases wher logs can be useful 2006-08-21 12:20 <@ekes> - 2006-08-21 12:20 <@ekes> hew we modify post-grey 2006-08-21 12:20 <@ekes> have to have an ip for such service 2006-08-21 12:21 <@ekes> only need to know if the address is the same at a time 2006-08-21 12:21 <@ekes> one way hash can do this 2006-08-21 12:21 <@ekes> so you can't read the address, but know if it has been seen 2006-08-21 12:21 <@ekes> will do awstats too 2006-08-21 12:21 <@ekes> could block spammers maybe 2006-08-21 12:22 <@ekes> if lots of mail frmo ip with same md5sum 2006-08-21 12:22 <@ekes> - 2006-08-21 12:22 <@ekes> one way hashing ips 2006-08-21 12:22 <@ekes> there are still unique id 2006-08-21 12:23 <@ekes> not secure - can be dictionary attack 2006-08-21 12:23 <@ekes> - 2006-08-21 12:23 <@ekes> hostnames are better 2006-08-21 12:23 <@ekes> a bigger dictionary 2006-08-21 12:23 <@ekes> slower (use caching name server) 2006-08-21 12:23 <@ekes> - 2006-08-21 12:23 < gdm> sorry, quick interruption... 2006-08-21 12:23 < gdm> 10:45 <@ekes> cacert relies on offical documents - passport ect 2006-08-21 12:23 < gdm> 10:46 <@ekes> who runs cacert - does anyone "know" him 2006-08-21 12:23 < gdm> answer: YES - 2006-08-21 12:23 < gdm> i met duane, the founder, in sydney about 2 years ago. there are also a couple of other people involved (he had not met all of them at that stage!) - iirc, one from germany, also another from sydney. 2006-08-21 12:23 < gdm> i believe micah has also met duane. micah and i (and chrisc - from postal verification) both have maximal 'points' - needed to assure/verify others... 2006-08-21 12:23 <@ekes> propose: tech discussion 2006-08-21 12:23 < gdm> <end> 2006-08-21 12:24 <@ekes> spam site listing bodies 2006-08-21 12:25 <@ekes> discuss sharing internal lists 2006-08-21 12:25 <@ekes> - 2006-08-21 12:26 < maxigas> (nodo50 has a counter of police visits on their front page) 2006-08-21 12:27 < maxigas> Visitas de Vigilantes: 3324 2006-08-21 12:27 < maxigas> Ultima: 18 ago 2006, 22:46 2006-08-21 12:27 < maxigas> 
2006-08-21 12:29 <@ekes> initally they thought of blocking everything, but thought better to make it public 2006-08-21 12:29 <@ekes> ? will it not just make the police use diffrerent ips? 2006-08-21 12:31 <@ekes> they dan't think it makes too much difference, still believe that there will be using other ips 2006-08-21 12:31 <@ekes> does highlight it to userss 2006-08-21 12:32 <@ekes> - 2006-08-21 12:32 <@ekes> reasons to keep logs explained 2006-08-21 12:32 <@ekes> riseup keeps no logs - possibly the most extreme 2006-08-21 12:33 <@ekes> is there a compromise 2006-08-21 12:34 <@ekes> - 2006-08-21 12:34 <@ekes> putting logs into ram 2006-08-21 12:34 <@ekes> ? does that apply to eu law 2006-08-21 12:34 <@ekes> maybe not 2006-08-21 12:35 < maxigas> it can be compulsory by law to keep logs BUT 2006-08-21 12:35 < maxigas> not in a way that makes it easy for the police to access them 2006-08-21 12:36 < maxigas> problem: 2006-08-21 12:36 < maxigas> in France you just have to extract them. 2006-08-21 12:36 < maxigas> for the police. 2006-08-21 12:37 <@ekes> ? need the law details 2006-08-21 12:38 <@ekes> there is a session about eu data retention 2006-08-21 12:39 <@ekes> providers don't care about freedom, just money and hds 2006-08-21 12:39 < skep> hds? 2006-08-21 12:39 <@ekes> it is political issue as we suffer from laws that tell us we info to the polick 2006-08-21 12:40 <@ekes> skep: size of their hard disks (talking about how much daa kept) 2006-08-21 12:40 < skep> ah ok, thx 2006-08-21 12:41 <@ekes> importance of not just avoiding law or adapting, but taking a stand and how to do it 2006-08-21 12:41 <@ekes> - 2006-08-21 12:41 <@ekes> propose: to standards - no logs // minimum legal logs 2006-08-21 12:42 <@ekes> - 2006-08-21 12:43 < maxigas> you could generate fake logs with the police IPs or TOR exit points 2006-08-21 12:43 < maxigas> so you could say that all your users are police officers or TOR users 2006-08-21 12:44 < maxigas> do they have to accept the log you give them as truthful? how they verify the authenticity of the log? 2006-08-21 12:46 <@ekes> - 2006-08-21 12:47 <@ekes> many alternatives to be discussed in detail 2006-08-21 12:47 <@ekes> storing: encrypted, offsite, in memory, the minimal 2006-08-21 12:47 <@ekes> - 2006-08-21 12:47 <@ekes> need the law 2006-08-21 12:48 <@ekes> need of server providers 2006-08-21 12:48 <@ekes> will be different for different people 2006-08-21 12:48 <@ekes> agreement may be difficult 2006-08-21 12:49 <@ekes> agree: "to reduce user data in logs" 2006-08-21 12:49 <@ekes> "to make them hard to get / secure" 2006-08-21 12:50 <@ekes> - 2006-08-21 12:50 <@ekes> maillogs and weblogs important legally 2006-08-21 12:50 <@ekes> generic description 2006-08-21 12:51 <@ekes> allow individual servers to choose? 2006-08-21 12:51 <@ekes> - 2006-08-21 12:51 <@ekes> agrees to different levels? 2006-08-21 12:51 <@ekes> with top level no user identification 2006-08-21 12:52 <@ekes> then others 2006-08-21 12:52 <@ekes> - 2006-08-21 12:52 <@ekes> we should have equality, not layers 2006-08-21 12:52 <@ekes> - 2006-08-21 12:52 <@ekes> us may have problem with data retention in the future 2006-08-21 12:53 <@ekes> so may not just be eu that has diffiuclty meeting "gold standard" 2006-08-21 12:53 <@ekes> - 2006-08-21 12:54 <@ekes> others: shell accounts (only for vservers 2006-08-21 12:55 <@ekes> what has to be on an encrypted partition 2006-08-21 12:55 <@ekes> - 2006-08-21 12:55 <@ekes> proposal: smaller working group to keep working on this 2006-08-21 12:57 <@ekes> proposal: smaller groups this afternoon then meet again 2006-08-21 12:57 <@ekes> proposal: seperate tech non-tch chans
