blog/tags/sikkerhet/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
   4   <head>
   5     <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
   6     <title>Petter Reinholdtsen: Entries Tagged sikkerhet</title>
   7     <link rel="stylesheet" type="text/css" media="screen" href="https://people.skolelinux.org/pere/blog/style.css" />
   8     <link rel="stylesheet" type="text/css" media="screen" href="https://people.skolelinux.org/pere/blog/vim.css" />
   9     <link rel="alternate" title="RSS Feed" href="sikkerhet.rss" type="application/rss+xml" />
  10   </head>
  11   <body>
  12     <div class="title">
  13  <h1>
  14      <a href="https://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16  </h1>
  17
  18 </div>
  19
  20
  21     <h3>Entries tagged "sikkerhet".</h3>
  22
  23     <div class="entry">
  24       <div class="title">
  25         <a href="https://people.skolelinux.org/pere/blog/New_and_improved_sqlcipher_in_Debian_for_accessing_Signal_database.html">New and improved sqlcipher in Debian for accessing Signal database</a>
  26       </div>
  27       <div class="date">
  28         12th November 2023
  29       </div>
  30       <div class="body">
  31         <p>For a while now I wanted to have direct access to the
  32 <a href="https://signal.org/">Signal</a> database of messages and
  33 channels of my Desktop edition of Signal.  I prefer the enforced end
  34 to end encryption of Signal these days for my communication with
  35 friends and family, to increase the level of safety and privacy as
  36 well as raising the cost of the mass surveillance government and
  37 non-government entities practice these days.  In August I came across
  38 a nice
  39 <a href="https://www.yoranbrondsema.com/post/the-guide-to-extracting-statistics-from-your-signal-conversations/">recipe
  40 on how to use sqlcipher to extract statistics from the Signal
  41 database</a> explaining how to do this.  Unfortunately this did not
  42 work with the version of sqlcipher in Debian.  The
  43 <a href="http://tracker.debian.org/sqlcipher/">sqlcipher</a>
  44 package is a "fork" of the sqlite package with added support for
  45 encrypted databases.  Sadly the current Debian maintainer
  46 <a href="https://bugs.debian.org/961598">announced more than three
  47 years ago that he did not have time to maintain sqlcipher</a>, so it
  48 seemed unlikely to be upgraded by the maintainer.  I was reluctant to
  49 take on the job myself, as I have very limited experience maintaining
  50 shared libraries in Debian.  After waiting and hoping for a few
  51 months, I gave up the last  week, and set out to update the package.  In
  52 the process I orphaned it to make it more obvious for the next person
  53 looking at it that the package need proper maintenance.</p>
  54
  55 <p>The version in Debian was around five years old, and quite a lot of
  56 changes had taken place upstream into the Debian maintenance git
  57 repository.  After spending a few days importing the new upstream
  58 versions, realising that upstream did not care much for SONAME
  59 versioning as I saw library symbols being both added and removed with
  60 minor version number changes to the project, I concluded that I had to
  61 do a SONAME bump of the library package to avoid surprising the
  62 reverse dependencies.  I even added a simple
  63 autopkgtest script to ensure the package work as intended.  Dug deep
  64 into the hole of learning shared library maintenance, I set out a few
  65 days ago to upload the new version to Debian experimental to see what
  66 the quality assurance framework in Debian had to say about the result.
  67 The feedback told me the pacakge was not too shabby, and yesterday I
  68 uploaded the latest version to Debian unstable.  It should enter
  69 testing today or tomorrow, perhaps delayed by
  70 <a href="https://bugs.debian.org/1055812">a small library
  71 transition</a>.</p>
  72
  73 <p>Armed with a new version of sqlcipher, I can now have a look at the
  74 SQL database in ~/.config/Signal/sql/db.sqlite.  First, one need to
  75 fetch the encryption key from the Signal configuration using this
  76 simple JSON extraction command:</p>
  77
  78 <pre>/usr/bin/jq -r '."key"' ~/.config/Signal/config.json</pre>
  79
  80 <p>Assuming the result from that command is 'secretkey', which is a
  81 hexadecimal number representing the key used to encrypt the database.
  82 Next, one can now connect to the database and inject the encryption
  83 key for access via SQL to fetch information from the database.  Here
  84 is an example dumping the database structure:</p>
  85
  86 <pre>
  87 % sqlcipher ~/.config/Signal/sql/db.sqlite
  88 sqlite> PRAGMA key = "x'secretkey'";
  89 sqlite> .schema
  90 CREATE TABLE sqlite_stat1(tbl,idx,stat);
  91 CREATE TABLE conversations(
  92       id STRING PRIMARY KEY ASC,
  93       json TEXT,
  94
  95       active_at INTEGER,
  96       type STRING,
  97       members TEXT,
  98       name TEXT,
  99       profileName TEXT
 100     , profileFamilyName TEXT, profileFullName TEXT, e164 TEXT, serviceId TEXT, groupId TEXT, profileLastFetchedAt INTEGER);
 101 CREATE TABLE identityKeys(
 102       id STRING PRIMARY KEY ASC,
 103       json TEXT
 104     );
 105 CREATE TABLE items(
 106       id STRING PRIMARY KEY ASC,
 107       json TEXT
 108     );
 109 CREATE TABLE sessions(
 110       id TEXT PRIMARY KEY,
 111       conversationId TEXT,
 112       json TEXT
 113     , ourServiceId STRING, serviceId STRING);
 114 CREATE TABLE attachment_downloads(
 115     id STRING primary key,
 116     timestamp INTEGER,
 117     pending INTEGER,
 118     json TEXT
 119   );
 120 CREATE TABLE sticker_packs(
 121     id TEXT PRIMARY KEY,
 122     key TEXT NOT NULL,
 123
 124     author STRING,
 125     coverStickerId INTEGER,
 126     createdAt INTEGER,
 127     downloadAttempts INTEGER,
 128     installedAt INTEGER,
 129     lastUsed INTEGER,
 130     status STRING,
 131     stickerCount INTEGER,
 132     title STRING
 133   , attemptedStatus STRING, position INTEGER DEFAULT 0 NOT NULL, storageID STRING, storageVersion INTEGER, storageUnknownFields BLOB, storageNeedsSync
 134       INTEGER DEFAULT 0 NOT NULL);
 135 CREATE TABLE stickers(
 136     id INTEGER NOT NULL,
 137     packId TEXT NOT NULL,
 138
 139     emoji STRING,
 140     height INTEGER,
 141     isCoverOnly INTEGER,
 142     lastUsed INTEGER,
 143     path STRING,
 144     width INTEGER,
 145
 146     PRIMARY KEY (id, packId),
 147     CONSTRAINT stickers_fk
 148       FOREIGN KEY (packId)
 149       REFERENCES sticker_packs(id)
 150       ON DELETE CASCADE
 151   );
 152 CREATE TABLE sticker_references(
 153     messageId STRING,
 154     packId TEXT,
 155     CONSTRAINT sticker_references_fk
 156       FOREIGN KEY(packId)
 157       REFERENCES sticker_packs(id)
 158       ON DELETE CASCADE
 159   );
 160 CREATE TABLE emojis(
 161     shortName TEXT PRIMARY KEY,
 162     lastUsage INTEGER
 163   );
 164 CREATE TABLE messages(
 165         rowid INTEGER PRIMARY KEY ASC,
 166         id STRING UNIQUE,
 167         json TEXT,
 168         readStatus INTEGER,
 169         expires_at INTEGER,
 170         sent_at INTEGER,
 171         schemaVersion INTEGER,
 172         conversationId STRING,
 173         received_at INTEGER,
 174         source STRING,
 175         hasAttachments INTEGER,
 176         hasFileAttachments INTEGER,
 177         hasVisualMediaAttachments INTEGER,
 178         expireTimer INTEGER,
 179         expirationStartTimestamp INTEGER,
 180         type STRING,
 181         body TEXT,
 182         messageTimer INTEGER,
 183         messageTimerStart INTEGER,
 184         messageTimerExpiresAt INTEGER,
 185         isErased INTEGER,
 186         isViewOnce INTEGER,
 187         sourceServiceId TEXT, serverGuid STRING NULL, sourceDevice INTEGER, storyId STRING, isStory INTEGER
 188         GENERATED ALWAYS AS (type IS 'story'), isChangeCreatedByUs INTEGER NOT NULL DEFAULT 0, isTimerChangeFromSync INTEGER
 189         GENERATED ALWAYS AS (
 190           json_extract(json, '$.expirationTimerUpdate.fromSync') IS 1
 191         ), seenStatus NUMBER default 0, storyDistributionListId STRING, expiresAt INT
 192         GENERATED ALWAYS
 193         AS (ifnull(
 194           expirationStartTimestamp + (expireTimer * 1000),
 195           9007199254740991
 196         )), shouldAffectActivity INTEGER
 197         GENERATED ALWAYS AS (
 198           type IS NULL
 199           OR
 200           type NOT IN (
 201             'change-number-notification',
 202             'contact-removed-notification',
 203             'conversation-merge',
 204             'group-v1-migration',
 205             'keychange',
 206             'message-history-unsynced',
 207             'profile-change',
 208             'story',
 209             'universal-timer-notification',
 210             'verified-change'
 211           )
 212         ), shouldAffectPreview INTEGER
 213         GENERATED ALWAYS AS (
 214           type IS NULL
 215           OR
 216           type NOT IN (
 217             'change-number-notification',
 218             'contact-removed-notification',
 219             'conversation-merge',
 220             'group-v1-migration',
 221             'keychange',
 222             'message-history-unsynced',
 223             'profile-change',
 224             'story',
 225             'universal-timer-notification',
 226             'verified-change'
 227           )
 228         ), isUserInitiatedMessage INTEGER
 229         GENERATED ALWAYS AS (
 230           type IS NULL
 231           OR
 232           type NOT IN (
 233             'change-number-notification',
 234             'contact-removed-notification',
 235             'conversation-merge',
 236             'group-v1-migration',
 237             'group-v2-change',
 238             'keychange',
 239             'message-history-unsynced',
 240             'profile-change',
 241             'story',
 242             'universal-timer-notification',
 243             'verified-change'
 244           )
 245         ), mentionsMe INTEGER NOT NULL DEFAULT 0, isGroupLeaveEvent INTEGER
 246         GENERATED ALWAYS AS (
 247           type IS 'group-v2-change' AND
 248           json_array_length(json_extract(json, '$.groupV2Change.details')) IS 1 AND
 249           json_extract(json, '$.groupV2Change.details[0].type') IS 'member-remove' AND
 250           json_extract(json, '$.groupV2Change.from') IS NOT NULL AND
 251           json_extract(json, '$.groupV2Change.from') IS json_extract(json, '$.groupV2Change.details[0].aci')
 252         ), isGroupLeaveEventFromOther INTEGER
 253         GENERATED ALWAYS AS (
 254           isGroupLeaveEvent IS 1
 255           AND
 256           isChangeCreatedByUs IS 0
 257         ), callId TEXT
 258         GENERATED ALWAYS AS (
 259           json_extract(json, '$.callId')
 260         ));
 261 CREATE TABLE sqlite_stat4(tbl,idx,neq,nlt,ndlt,sample);
 262 CREATE TABLE jobs(
 263         id TEXT PRIMARY KEY,
 264         queueType TEXT STRING NOT NULL,
 265         timestamp INTEGER NOT NULL,
 266         data STRING TEXT
 267       );
 268 CREATE TABLE reactions(
 269         conversationId STRING,
 270         emoji STRING,
 271         fromId STRING,
 272         messageReceivedAt INTEGER,
 273         targetAuthorAci STRING,
 274         targetTimestamp INTEGER,
 275         unread INTEGER
 276       , messageId STRING);
 277 CREATE TABLE senderKeys(
 278         id TEXT PRIMARY KEY NOT NULL,
 279         senderId TEXT NOT NULL,
 280         distributionId TEXT NOT NULL,
 281         data BLOB NOT NULL,
 282         lastUpdatedDate NUMBER NOT NULL
 283       );
 284 CREATE TABLE unprocessed(
 285         id STRING PRIMARY KEY ASC,
 286         timestamp INTEGER,
 287         version INTEGER,
 288         attempts INTEGER,
 289         envelope TEXT,
 290         decrypted TEXT,
 291         source TEXT,
 292         serverTimestamp INTEGER,
 293         sourceServiceId STRING
 294       , serverGuid STRING NULL, sourceDevice INTEGER, receivedAtCounter INTEGER, urgent INTEGER, story INTEGER);
 295 CREATE TABLE sendLogPayloads(
 296         id INTEGER PRIMARY KEY ASC,
 297
 298         timestamp INTEGER NOT NULL,
 299         contentHint INTEGER NOT NULL,
 300         proto BLOB NOT NULL
 301       , urgent INTEGER, hasPniSignatureMessage INTEGER DEFAULT 0 NOT NULL);
 302 CREATE TABLE sendLogRecipients(
 303         payloadId INTEGER NOT NULL,
 304
 305         recipientServiceId STRING NOT NULL,
 306         deviceId INTEGER NOT NULL,
 307
 308         PRIMARY KEY (payloadId, recipientServiceId, deviceId),
 309
 310         CONSTRAINT sendLogRecipientsForeignKey
 311           FOREIGN KEY (payloadId)
 312           REFERENCES sendLogPayloads(id)
 313           ON DELETE CASCADE
 314       );
 315 CREATE TABLE sendLogMessageIds(
 316         payloadId INTEGER NOT NULL,
 317
 318         messageId STRING NOT NULL,
 319
 320         PRIMARY KEY (payloadId, messageId),
 321
 322         CONSTRAINT sendLogMessageIdsForeignKey
 323           FOREIGN KEY (payloadId)
 324           REFERENCES sendLogPayloads(id)
 325           ON DELETE CASCADE
 326       );
 327 CREATE TABLE preKeys(
 328         id STRING PRIMARY KEY ASC,
 329         json TEXT
 330       , ourServiceId NUMBER
 331         GENERATED ALWAYS AS (json_extract(json, '$.ourServiceId')));
 332 CREATE TABLE signedPreKeys(
 333         id STRING PRIMARY KEY ASC,
 334         json TEXT
 335       , ourServiceId NUMBER
 336         GENERATED ALWAYS AS (json_extract(json, '$.ourServiceId')));
 337 CREATE TABLE badges(
 338         id TEXT PRIMARY KEY,
 339         category TEXT NOT NULL,
 340         name TEXT NOT NULL,
 341         descriptionTemplate TEXT NOT NULL
 342       );
 343 CREATE TABLE badgeImageFiles(
 344         badgeId TEXT REFERENCES badges(id)
 345           ON DELETE CASCADE
 346           ON UPDATE CASCADE,
 347         'order' INTEGER NOT NULL,
 348         url TEXT NOT NULL,
 349         localPath TEXT,
 350         theme TEXT NOT NULL
 351       );
 352 CREATE TABLE storyReads (
 353         authorId STRING NOT NULL,
 354         conversationId STRING NOT NULL,
 355         storyId STRING NOT NULL,
 356         storyReadDate NUMBER NOT NULL,
 357
 358         PRIMARY KEY (authorId, storyId)
 359       );
 360 CREATE TABLE storyDistributions(
 361         id STRING PRIMARY KEY NOT NULL,
 362         name TEXT,
 363
 364         senderKeyInfoJson STRING
 365       , deletedAtTimestamp INTEGER, allowsReplies INTEGER, isBlockList INTEGER, storageID STRING, storageVersion INTEGER, storageUnknownFields BLOB, storageNeedsSync INTEGER);
 366 CREATE TABLE storyDistributionMembers(
 367         listId STRING NOT NULL REFERENCES storyDistributions(id)
 368           ON DELETE CASCADE
 369           ON UPDATE CASCADE,
 370         serviceId STRING NOT NULL,
 371
 372         PRIMARY KEY (listId, serviceId)
 373       );
 374 CREATE TABLE uninstalled_sticker_packs (
 375         id STRING NOT NULL PRIMARY KEY,
 376         uninstalledAt NUMBER NOT NULL,
 377         storageID STRING,
 378         storageVersion NUMBER,
 379         storageUnknownFields BLOB,
 380         storageNeedsSync INTEGER NOT NULL
 381       );
 382 CREATE TABLE groupCallRingCancellations(
 383         ringId INTEGER PRIMARY KEY,
 384         createdAt INTEGER NOT NULL
 385       );
 386 CREATE TABLE IF NOT EXISTS 'messages_fts_data'(id INTEGER PRIMARY KEY, block BLOB);
 387 CREATE TABLE IF NOT EXISTS 'messages_fts_idx'(segid, term, pgno, PRIMARY KEY(segid, term)) WITHOUT ROWID;
 388 CREATE TABLE IF NOT EXISTS 'messages_fts_content'(id INTEGER PRIMARY KEY, c0);
 389 CREATE TABLE IF NOT EXISTS 'messages_fts_docsize'(id INTEGER PRIMARY KEY, sz BLOB);
 390 CREATE TABLE IF NOT EXISTS 'messages_fts_config'(k PRIMARY KEY, v) WITHOUT ROWID;
 391 CREATE TABLE edited_messages(
 392         messageId STRING REFERENCES messages(id)
 393           ON DELETE CASCADE,
 394         sentAt INTEGER,
 395         readStatus INTEGER
 396       , conversationId STRING);
 397 CREATE TABLE mentions (
 398         messageId REFERENCES messages(id) ON DELETE CASCADE,
 399         mentionAci STRING,
 400         start INTEGER,
 401         length INTEGER
 402       );
 403 CREATE TABLE kyberPreKeys(
 404         id STRING PRIMARY KEY NOT NULL,
 405         json TEXT NOT NULL, ourServiceId NUMBER
 406         GENERATED ALWAYS AS (json_extract(json, '$.ourServiceId')));
 407 CREATE TABLE callsHistory (
 408         callId TEXT PRIMARY KEY,
 409         peerId TEXT NOT NULL, -- conversation id (legacy) | uuid | groupId | roomId
 410         ringerId TEXT DEFAULT NULL, -- ringer uuid
 411         mode TEXT NOT NULL, -- enum "Direct" | "Group"
 412         type TEXT NOT NULL, -- enum "Audio" | "Video" | "Group"
 413         direction TEXT NOT NULL, -- enum "Incoming" | "Outgoing
 414         -- Direct: enum "Pending" | "Missed" | "Accepted" | "Deleted"
 415         -- Group: enum "GenericGroupCall" | "OutgoingRing" | "Ringing" | "Joined" | "Missed" | "Declined" | "Accepted" | "Deleted"
 416         status TEXT NOT NULL,
 417         timestamp INTEGER NOT NULL,
 418         UNIQUE (callId, peerId) ON CONFLICT FAIL
 419       );
 420 [ dropped all indexes to save space in this blog post ]
 421 CREATE TRIGGER messages_on_view_once_update AFTER UPDATE ON messages
 422       WHEN
 423         new.body IS NOT NULL AND new.isViewOnce = 1
 424       BEGIN
 425         DELETE FROM messages_fts WHERE rowid = old.rowid;
 426       END;
 427 CREATE TRIGGER messages_on_insert AFTER INSERT ON messages
 428       WHEN new.isViewOnce IS NOT 1 AND new.storyId IS NULL
 429       BEGIN
 430         INSERT INTO messages_fts
 431           (rowid, body)
 432         VALUES
 433           (new.rowid, new.body);
 434       END;
 435 CREATE TRIGGER messages_on_delete AFTER DELETE ON messages BEGIN
 436         DELETE FROM messages_fts WHERE rowid = old.rowid;
 437         DELETE FROM sendLogPayloads WHERE id IN (
 438           SELECT payloadId FROM sendLogMessageIds
 439           WHERE messageId = old.id
 440         );
 441         DELETE FROM reactions WHERE rowid IN (
 442           SELECT rowid FROM reactions
 443           WHERE messageId = old.id
 444         );
 445         DELETE FROM storyReads WHERE storyId = old.storyId;
 446       END;
 447 CREATE VIRTUAL TABLE messages_fts USING fts5(
 448         body,
 449         tokenize = 'signal_tokenizer'
 450       );
 451 CREATE TRIGGER messages_on_update AFTER UPDATE ON messages
 452       WHEN
 453         (new.body IS NULL OR old.body IS NOT new.body) AND
 454          new.isViewOnce IS NOT 1 AND new.storyId IS NULL
 455       BEGIN
 456         DELETE FROM messages_fts WHERE rowid = old.rowid;
 457         INSERT INTO messages_fts
 458           (rowid, body)
 459         VALUES
 460           (new.rowid, new.body);
 461       END;
 462 CREATE TRIGGER messages_on_insert_insert_mentions AFTER INSERT ON messages
 463       BEGIN
 464         INSERT INTO mentions (messageId, mentionAci, start, length)
 465
 466     SELECT messages.id, bodyRanges.value ->> 'mentionAci' as mentionAci,
 467       bodyRanges.value ->> 'start' as start,
 468       bodyRanges.value ->> 'length' as length
 469     FROM messages, json_each(messages.json ->> 'bodyRanges') as bodyRanges
 470     WHERE bodyRanges.value ->> 'mentionAci' IS NOT NULL
 471
 472         AND messages.id = new.id;
 473       END;
 474 CREATE TRIGGER messages_on_update_update_mentions AFTER UPDATE ON messages
 475       BEGIN
 476         DELETE FROM mentions WHERE messageId = new.id;
 477         INSERT INTO mentions (messageId, mentionAci, start, length)
 478
 479     SELECT messages.id, bodyRanges.value ->> 'mentionAci' as mentionAci,
 480       bodyRanges.value ->> 'start' as start,
 481       bodyRanges.value ->> 'length' as length
 482     FROM messages, json_each(messages.json ->> 'bodyRanges') as bodyRanges
 483     WHERE bodyRanges.value ->> 'mentionAci' IS NOT NULL
 484
 485         AND messages.id = new.id;
 486       END;
 487 sqlite>
 488 </pre>
 489
 490 <p>Finally I have the tool needed to inspect and process Signal
 491 messages that I need, without using the vendor provided client.  Now
 492 on to transforming it to a more useful format.</p>
 493
 494 <p>As usual, if you use Bitcoin and want to show your support of my
 495 activities, please send Bitcoin donations to my address
 496 <b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
 497
 498       </div>
 499       <div class="tags">
 500
 501
 502         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
 503
 504
 505       </div>
 506     </div>
 507     <div class="padding"></div>
 508
 509     <div class="entry">
 510       <div class="title">
 511         <a href="https://people.skolelinux.org/pere/blog/Latest_Jami_back_in_Debian_Testing__and_scriptable_using_dbus.html">Latest Jami back in Debian Testing, and scriptable using dbus</a>
 512       </div>
 513       <div class="date">
 514         12th January 2021
 515       </div>
 516       <div class="body">
 517         <p>After a lot of hard work by its maintainer Alexandre Viau and
 518 others, the decentralized communication platform
 519 <a href="https://en.wikipedia.org/wiki/Jami_(software)">Jami</a>
 520 (earlier known as Ring), managed to get
 521 <a href="https://tracker.debian.org/pkg/ring">its latest version</a>
 522 into Debian Testing.  Several of its dependencies has caused build and
 523 propagation problems, which all seem to be solved now.</p>
 524
 525 <p>In addition to the fact that Jami is decentralized, similar to how
 526 bittorrent is decentralized, I first of all like how it is not
 527 connected to external IDs like phone numbers.  This allow me to set up
 528 computers to send me notifications using Jami without having to find
 529 get a phone number for each computer.  Automatic notification via Jami
 530 is also made trivial thanks to the provided client side API (as a DBus
 531 service).  Here is my bourne shell script demonstrating how to let any
 532 system send a message to any Jami address.  It will create a new
 533 identity before sending the message, if no Jami identity exist
 534 already:</p>
 535
 536 <p><pre>
 537 #!/bin/sh
 538 #
 539 # Usage: $0 <jami-address> <message>
 540 #
 541 # Send <message> to <jami-address>, create local jami account if
 542 # missing.
 543 #
 544 # License: GPL v2 or later at your choice
 545 # Author: Petter Reinholdtsen
 546
 547
 548 if [ -z "$HOME" ] ; then
 549     echo "error: missing \$HOME, required for dbus to work"
 550     exit 1
 551 fi
 552
 553 # First, get dbus running if not already running
 554 DBUSLAUNCH=/usr/bin/dbus-launch
 555 PIDFILE=/run/asterisk/dbus-session.pid
 556 if [ -e $PIDFILE ] ; then
 557     . $PIDFILE
 558     if ! kill -0 $DBUS_SESSION_BUS_PID 2>/dev/null ; then
 559         unset DBUS_SESSION_BUS_ADDRESS
 560     fi
 561 fi
 562 if [ -z "$DBUS_SESSION_BUS_ADDRESS" ] && [ -x "$DBUSLAUNCH" ]; then
 563     DBUS_SESSION_BUS_ADDRESS="unix:path=$HOME/.dbus"
 564     dbus-daemon --session --address="$DBUS_SESSION_BUS_ADDRESS" --nofork --nopidfile --syslog-only < /dev/null > /dev/null 2>&1 3>&1 &
 565     DBUS_SESSION_BUS_PID=$!
 566     (
 567         echo DBUS_SESSION_BUS_PID=$DBUS_SESSION_BUS_PID
 568         echo DBUS_SESSION_BUS_ADDRESS=\""$DBUS_SESSION_BUS_ADDRESS"\"
 569         echo export DBUS_SESSION_BUS_ADDRESS
 570     ) > $PIDFILE
 571     . $PIDFILE
 572 fi &
 573
 574 dringop() {
 575     part="$1"; shift
 576     op="$1"; shift
 577     dbus-send --session \
 578         --dest="cx.ring.Ring" /cx/ring/Ring/$part cx.ring.Ring.$part.$op $*
 579 }
 580
 581 dringopreply() {
 582     part="$1"; shift
 583     op="$1"; shift
 584     dbus-send --session --print-reply \
 585         --dest="cx.ring.Ring" /cx/ring/Ring/$part cx.ring.Ring.$part.$op $*
 586 }
 587
 588 firstaccount() {
 589     dringopreply ConfigurationManager getAccountList | \
 590       grep string | awk -F'"' '{print $2}' | head -n 1
 591 }
 592
 593 account=$(firstaccount)
 594
 595 if [ -z "$account" ] ; then
 596     echo "Missing local account, trying to create it"
 597     dringop ConfigurationManager addAccount \
 598       dict:string:string:"Account.type","RING","Account.videoEnabled","false"
 599     account=$(firstaccount)
 600     if [ -z "$account" ] ; then
 601         echo "unable to create local account"
 602         exit 1
 603     fi
 604 fi
 605
 606 # Not using dringopreply to ensure $2 can contain spaces
 607 dbus-send --print-reply --session \
 608   --dest=cx.ring.Ring \
 609   /cx/ring/Ring/ConfigurationManager \
 610   cx.ring.Ring.ConfigurationManager.sendTextMessage \
 611   string:"$account" string:"$1" \
 612   dict:string:string:"text/plain","$2"
 613 </pre></p>
 614
 615 <p>If you want to check it out yourself, visit the
 616 <a href="https://jami.net/">the Jami system project page</a> to learn
 617 more, and install the latest Jami client from Debian Unstable or
 618 Testing.</p>
 619
 620 <p>As usual, if you use Bitcoin and want to show your support of my
 621 activities, please send Bitcoin donations to my address
 622 <b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
 623
 624       </div>
 625       <div class="tags">
 626
 627
 628         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
 629
 630
 631       </div>
 632     </div>
 633     <div class="padding"></div>
 634
 635     <div class="entry">
 636       <div class="title">
 637         <a href="https://people.skolelinux.org/pere/blog/Secure_Socket_API___a_simple_and_powerful_approach_for_TLS_support_in_software.html">Secure Socket API - a simple and powerful approach for TLS support in software</a>
 638       </div>
 639       <div class="date">
 640          6th June 2020
 641       </div>
 642       <div class="body">
 643         <p>As a member of the <a href="https://www.nuug.no/">Norwegian Unix
 644 User Group</a>, I have the pleasure of receiving the
 645 <a href="https://www.usenix.org/">USENIX</a> magazine
 646 <a href="https://www.usenix.org/publications/login/">;login:</a>
 647 several times a year.  I rarely have time to read all the articles,
 648 but try to at least skim through them all as there is a lot of nice
 649 knowledge passed on there.  I even carry the latest issue with me most
 650 of the time to try to get through all the articles when I have a few
 651 spare minutes.</p>
 652
 653 <p>The other day I came across a nice article titled
 654 "<a href="https://www.usenix.org/publications/login/winter2018/oneill">The
 655 Secure Socket API: TLS as an Operating System Service</a>" with a
 656 marvellous idea I hope can make it all the way into the POSIX standard.
 657 The idea is as simple as it is powerful.  By introducing a new
 658 socket() option IPPROTO_TLS to use TLS, and a system wide service to
 659 handle setting up TLS connections, one both make it trivial to add TLS
 660 support to any program currently using the POSIX socket API, and gain
 661 system wide control over certificates, TLS versions and encryption
 662 systems used.  Instead of doing this:</p>
 663
 664 <p><blockquote><pre>
 665 int socket = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
 666 </pre></blockquote></p>
 667
 668 <p>the program code would be doing this:<p>
 669
 670 <p><blockquote><pre>
 671 int socket = socket(PF_INET, SOCK_STREAM, IPPROTO_TLS);
 672 </pre></blockquote></p>
 673
 674 <p>According to the ;login: article, converting a C program to use TLS
 675 would normally modify only 5-10 lines in the code, which is amazing
 676 when compared to using for example the OpenSSL API.</p>
 677
 678 <p>The project has set up the
 679 <a href="https://securesocketapi.org/">https://securesocketapi.org/</a>
 680 web site to spread the idea, and the code for a kernel module and the
 681 associated system daemon is available from two github repositories:
 682 <a href="https://github.com/markoneill/ssa">ssa</a> and
 683 <a href="https://github.com/markoneill/ssa-daemon">ssa-daemon</a>.
 684 Unfortunately there is no explicit license information with the code,
 685 so its copyright status is unclear.  A
 686 <a href="https://github.com/markoneill/ssa/issues/2">request to solve
 687 this</a> about it has been unsolved since 2018-08-17.</p>
 688
 689 <p>I love the idea of extending socket() to gain TLS support, and
 690 understand why it is an advantage to implement this as a kernel module
 691 and system wide service daemon, but can not help to think that it
 692 would be a lot easier to get projects to move to this way of setting
 693 up TLS if it was done with a user space approach where programs
 694 wanting to use this API approach could just link with a wrapper
 695 library.</p>
 696
 697 <p>I recommend you check out this simple and powerful approach to more
 698 secure network connections. :)</p>
 699
 700 <p>As usual, if you use Bitcoin and want to show your support of my
 701 activities, please send Bitcoin donations to my address
 702 <b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
 703
 704       </div>
 705       <div class="tags">
 706
 707
 708         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sysadmin">sysadmin</a>.
 709
 710
 711       </div>
 712     </div>
 713     <div class="padding"></div>
 714
 715     <div class="entry">
 716       <div class="title">
 717         <a href="https://people.skolelinux.org/pere/blog/Jami_as_a_Zoom_client__a_trick_for_password_protected_rooms___.html">Jami as a Zoom client, a trick for password protected rooms...</a>
 718       </div>
 719       <div class="date">
 720          8th May 2020
 721       </div>
 722       <div class="body">
 723         <p>Half a year ago,
 724 <a href="http://people.skolelinux.org/pere/blog/Jami_Ring__finally_functioning_peer_to_peer_communication_client.html">I
 725 wrote</a> about <a href="https://jami.net/">the Jami communication
 726 client</a>, capable of peer-to-peer encrypted communication.  It
 727 handle both messages, audio and video.  It uses distributed hash
 728 tables instead of central infrastructure to connect its users to each
 729 other, which in my book is a plus.  I mentioned briefly that it could
 730 also work as a SIP client, which came in handy when the higher
 731 educational sector in Norway started to promote Zoom as its video
 732 conferencing solution.  I am reluctant to use the official Zoom client
 733 software, due to their <a href="https://zoom.us/terms">copyright
 734 license clauses</a> prohibiting users to reverse engineer (for example
 735 to check the security) and benchmark it, and thus prefer to connect to
 736 Zoom meetings with free software clients.</p>
 737
 738 <p>Jami worked OK as a SIP client to Zoom as long as there was no
 739 password set on the room.  The Jami daemon leak memory like crazy
 740 (approximately 1 GiB a minute) when I am connected to the video
 741 conference, so I had to restart the client every 7-10 minutes, which
 742 is not great.  I tried to get other SIP Linux clients to work
 743 without success, so I decided I would have to live with this wart
 744 until someone managed to fix the leak in the dring code base.  But
 745 another problem showed up once the rooms were password protected.  I
 746 could not get my dial tone signaling through from Jami to Zoom, and
 747 dial tone signaling is used to enter the password when connecting to
 748 Zoom.  I tried a lot of different permutations with my Jami and
 749 Asterisk setup to try to figure out why the signaling did not get
 750 through, only to finally discover that the fundamental problem seem to
 751 be that Zoom is simply not able to receive dial tone signaling when
 752 connecting via SIP.  There seem to be nothing wrong with the Jami and
 753 Asterisk end, it is simply broken in the Zoom end.  I got help from a
 754 very skilled VoIP engineer figuring out this last part.  And being a
 755 very skilled engineer, he was also able to locate a solution for me.
 756 Or to be exact, a workaround that solve my initial problem of
 757 connecting to password protected Zoom rooms using Jami.</p>
 758
 759 <p>So, how do you do this, I am sure you are wondering by now.  The
 760 trick is already
 761 <a href="https://support.zoom.us/hc/en-us/articles/202405539-H-323-SIP-Room-Connector-Dial-Strings#sip">documented
 762 from Zoom</a>, and it is to modify the SIP address to include the room
 763 password.  What is most surprising about this is that the
 764 automatically generated email from Zoom with instructions on how to
 765 connect via SIP do not mention this.  The SIP address to use normally
 766 consist of the room ID (a number), an @ character and the IP address
 767 of the Zoom SIP gateway.  But Zoom understand a lot more than just the
 768 room ID in front of the at sign.  The format is "<tt>[Meeting
 769 ID].[Password].[Layout].[Host Key]</tt>", and you can here see how you
 770 can both enter password, control the layout (full screen, active
 771 presence and gallery) and specify the host key to start the meeting.
 772 The full SIP address entered into Jami to provide the password will
 773 then look like this (all using made up numbers):</p>
 774
 775 <p><blockquote>
 776 <tt>sip:657837644.522827@192.168.169.170</tt>
 777 </blockquote></p>
 778
 779 <p>Now if only jami would reduce its memory usage, I could even
 780 recommend this setup to others. :)</p>
 781
 782 <p>As usual, if you use Bitcoin and want to show your support of my
 783 activities, please send Bitcoin donations to my address
 784 <b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
 785
 786       </div>
 787       <div class="tags">
 788
 789
 790         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
 791
 792
 793       </div>
 794     </div>
 795     <div class="padding"></div>
 796
 797     <div class="entry">
 798       <div class="title">
 799         <a href="https://people.skolelinux.org/pere/blog/Jami_Ring__finally_functioning_peer_to_peer_communication_client.html">Jami/Ring, finally functioning peer to peer communication client</a>
 800       </div>
 801       <div class="date">
 802         19th June 2019
 803       </div>
 804       <div class="body">
 805         <p>Some years ago, in 2016, I
 806 <a href="http://people.skolelinux.org/pere/blog/Experience_and_updated_recipe_for_using_the_Signal_app_without_a_mobile_phone.html">wrote
 807 for the first time about</a> the Ring peer to peer messaging system.
 808 It would provide messaging without any central server coordinating the
 809 system and without requiring all users to register a phone number or
 810 own a mobile phone.  Back then, I could not get it to work, and put it
 811 aside until it had seen more development.  A few days ago I decided to
 812 give it another try, and am happy to report that this time I am able
 813 to not only send and receive messages, but also place audio and video
 814 calls.  But only if UDP is not blocked into your network.</p>
 815
 816 <p>The Ring system changed name earlier this year to
 817 <a href="https://en.wikipedia.org/wiki/Jami_(software)">Jami</a>.  I
 818 tried doing web search for 'ring' when I discovered it for the first
 819 time, and can only applaud this change as it is impossible to find
 820 something called Ring among the noise of other uses of that word.  Now
 821 you can search for 'jami' and this client and
 822 <a href="https://jami.net/">the Jami system</a> is the first hit at
 823 least on duckduckgo.</p>
 824
 825 <p>Jami will by default encrypt messages as well as audio and video
 826 calls, and try to send them directly between the communicating parties
 827 if possible.  If this proves impossible (for example if both ends are
 828 behind NAT), it will use a central SIP TURN server maintained by the
 829 Jami project.  Jami can also be a normal SIP client.  If the SIP
 830 server is unencrypted, the audio and video calls will also be
 831 unencrypted.  This is as far as I know the only case where Jami will
 832 do anything without encryption.</p>
 833
 834 <p>Jami is available for several platforms: Linux, Windows, MacOSX,
 835 Android, iOS, and Android TV.  It is included in Debian already.  Jami
 836 also work for those using F-Droid without any Google connections,
 837 while Signal do not.
 838 <a href="https://git.jami.net/savoirfairelinux/ring-project/wikis/technical/Protocol">The
 839 protocol</a> is described in the Ring project wiki.  The system uses a
 840 distributed hash table (DHT) system (similar to BitTorrent) running
 841 over UDP.  On one of the networks I use, I discovered Jami failed to
 842 work.  I tracked this down to the fact that incoming UDP packages
 843 going to ports 1-49999 were blocked, and the DHT would pick a random
 844 port and end up in the low range most of the time.  After talking to
 845 the developers, I solved this by enabling the dhtproxy in the
 846 settings, thus using TCP to talk to a central DHT proxy instead of
 847
 848 peering directly with others.  I've been told the developers are
 849 working on allowing DHT to use TCP to avoid this problem.  I also ran
 850 into a problem when trying to talk to the version of Ring included in
 851 Debian Stable (Stretch).  Apparently the protocol changed between
 852 beta2 and the current version, making these clients incompatible.
 853 Hopefully the protocol will not be made incompatible in the
 854 future.</p>
 855
 856 <p>It is worth noting that while looking at Jami and its features, I
 857 came across another communication platform I have not tested yet.  The
 858 <a href="https://en.wikipedia.org/wiki/Tox_(protocol)">Tox protocol</a>
 859 and <a href="https://tox.chat/">family of Tox clients</a>.  It might
 860 become the topic of a future blog post.</p>
 861
 862 <p>As usual, if you use Bitcoin and want to show your support of my
 863 activities, please send Bitcoin donations to my address
 864 <b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
 865
 866       </div>
 867       <div class="tags">
 868
 869
 870         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
 871
 872
 873       </div>
 874     </div>
 875     <div class="padding"></div>
 876
 877     <div class="entry">
 878       <div class="title">
 879         <a href="https://people.skolelinux.org/pere/blog/Fetching_trusted_timestamps_using_the_rfc3161ng_python_module.html">Fetching trusted timestamps using the rfc3161ng python module</a>
 880       </div>
 881       <div class="date">
 882          8th October 2018
 883       </div>
 884       <div class="body">
 885         <p>I have  earlier covered the basics of trusted timestamping using the
 886 'openssl ts' client.  See blog post for
 887 <a href="http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html">2014</a>,
 888 <a href="http://people.skolelinux.org/pere/blog/syslog_trusted_timestamp___chain_of_trusted_timestamps_for_your_syslog.html">2016</a>
 889 and
 890 <a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_trusted_timestamps_in_a_Noark_5_archive.html">2017</a>
 891 for those stories.  But some times I want to integrate the timestamping
 892 in other code, and recently I needed to integrate it into Python.
 893 After searching a bit, I found
 894 <a href="https://dev.entrouvert.org/projects/python-rfc3161">the
 895 rfc3161 library</a> which seemed like a good fit, but I soon
 896 discovered it only worked for python version 2, and I needed something
 897 that work with python version 3.  Luckily I next came across
 898 <a href="https://github.com/trbs/rfc3161ng/">the rfc3161ng library</a>,
 899 a fork of the original rfc3161 library.  Not only is it working with
 900 python 3, it have fixed a few of the bugs in the original library, and
 901 it has an active maintainer.  I decided to wrap it up and make it
 902 <a href="https://tracker.debian.org/pkg/python-rfc3161ng">available in
 903 Debian</a>, and a few days ago it entered Debian unstable and testing.</p>
 904
 905 <p>Using the library is fairly straight forward.  The only slightly
 906 problematic step is to fetch the required certificates to verify the
 907 timestamp.  For some services it is straight forward, while for others
 908 I have not yet figured out how to do it.  Here is a small standalone
 909 code example based on of the integration tests in the library code:</p>
 910
 911 <pre>
 912 #!/usr/bin/python3
 913
 914 """
 915
 916 Python 3 script demonstrating how to use the rfc3161ng module to
 917 get trusted timestamps.
 918
 919 The license of this code is the same as the license of the rfc3161ng
 920 library, ie MIT/BSD.
 921
 922 """
 923
 924 import os
 925 import pyasn1.codec.der
 926 import rfc3161ng
 927 import subprocess
 928 import tempfile
 929 import urllib.request
 930
 931 def store(f, data):
 932     f.write(data)
 933     f.flush()
 934     f.seek(0)
 935
 936 def fetch(url, f=None):
 937     response = urllib.request.urlopen(url)
 938     data = response.read()
 939     if f:
 940         store(f, data)
 941     return data
 942
 943 def main():
 944     with tempfile.NamedTemporaryFile() as cert_f,\
 945          tempfile.NamedTemporaryFile() as ca_f,\
 946          tempfile.NamedTemporaryFile() as msg_f,\
 947          tempfile.NamedTemporaryFile() as tsr_f:
 948
 949         # First fetch certificates used by service
 950         certificate_data = fetch('https://freetsa.org/files/tsa.crt', cert_f)
 951         ca_data_data = fetch('https://freetsa.org/files/cacert.pem', ca_f)
 952
 953         # Then timestamp the message
 954         timestamper = \
 955             rfc3161ng.RemoteTimestamper('http://freetsa.org/tsr',
 956                                         certificate=certificate_data)
 957         data = b"Python forever!\n"
 958         tsr = timestamper(data=data, return_tsr=True)
 959
 960         # Finally, convert message and response to something 'openssl ts' can verify
 961         store(msg_f, data)
 962         store(tsr_f, pyasn1.codec.der.encoder.encode(tsr))
 963         args = ["openssl", "ts", "-verify",
 964                 "-data", msg_f.name,
 965                 "-in", tsr_f.name,
 966                 "-CAfile", ca_f.name,
 967                 "-untrusted", cert_f.name]
 968         subprocess.check_call(args)
 969
 970 if '__main__' == __name__:
 971    main()
 972 </pre>
 973
 974 <p>The code fetches the required certificates, store them as temporary
 975 files, timestamp a simple message, store the message and timestamp to
 976 disk and ask 'openssl ts' to verify the timestamp.  A timestamp is
 977 around 1.5 kiB in size, and should be fairly easy to store for future
 978 use.</p>
 979
 980 <p>As usual, if you use Bitcoin and want to show your support of my
 981 activities, please send Bitcoin donations to my address
 982 <b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
 983
 984       </div>
 985       <div class="tags">
 986
 987
 988         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/noark5">noark5</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 989
 990
 991       </div>
 992     </div>
 993     <div class="padding"></div>
 994
 995     <div class="entry">
 996       <div class="title">
 997         <a href="https://people.skolelinux.org/pere/blog/Stortingsflertallet_g_r_inn_for_ny_IP_basert_sensurinfrastruktur_i_Norge.html">Stortingsflertallet går inn for ny IP-basert sensurinfrastruktur i Norge</a>
 998       </div>
 999       <div class="date">
1000         24th April 2018
1001       </div>
1002       <div class="body">
1003         <p><a href="https://www.vg.no/sport/i/J1g8zj/stortingsvedtak-snart-ip-blokkerer-utenlandske-spillselskaper">VG</a>,
1004 <a href="https://www.dagbladet.no/nyheter/stortinget-blokkerer-utenlandske-spillselskaper/69740219">Dagbladet</a>
1005 og
1006 <a href="https://www.nrk.no/ostfold/tar-opp-kampen-mot-utenlandske-spillselskap-1.14021381">NRK</a>
1007 melder i dag at flertallet i Familie- og kulturkomiteen på Stortinget
1008 har bestemt seg for å introdusere en ny sensurinfrastruktur i Norge.
1009 Fra før har Norge en «frivillig» sensurinfrastruktur basert på
1010 DNS-navn, der de største ISP-ene basert på en liste med DNS-navn
1011 forgifter DNS-svar og omdirigerer til et annet IP-nummer enn det som
1012 ligger i DNS.  Nå kommer altså IP-basert omdirigering i tillegg.  Når
1013 infrastrukturen er på plass, er sensur av IP-adresser redusert et
1014 spørsmål om hvilke IP-nummer som skal blokkeres.  Listen over
1015 IP-adresser vil naturligvis endre seg etter hvert som myndighetene
1016 endrer seg.  Det er ingen betryggende tanke.</p>
1017
1018       </div>
1019       <div class="tags">
1020
1021
1022         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
1023
1024
1025       </div>
1026     </div>
1027     <div class="padding"></div>
1028
1029     <div class="entry">
1030       <div class="title">
1031         <a href="https://people.skolelinux.org/pere/blog/_Rapporten_ser_ikke_p__informasjonssikkerhet_knyttet_til_personlig_integritet_.html">«Rapporten ser ikke på informasjonssikkerhet knyttet til personlig integritet»</a>
1032       </div>
1033       <div class="date">
1034         27th June 2017
1035       </div>
1036       <div class="body">
1037         <p>Jeg kom over teksten
1038 «<a href="https://freedom-to-tinker.com/2017/06/21/killing-car-privacy-by-federal-mandate/">Killing
1039 car privacy by federal mandate</a>» av Leonid Reyzin på Freedom to
1040 Tinker i dag, og det gleder meg å se en god gjennomgang om hvorfor det
1041 er et urimelig inngrep i privatsfæren å la alle biler kringkaste sin
1042 posisjon og bevegelse via radio.  Det omtalte forslaget basert på
1043 Dedicated Short Range Communication (DSRC) kalles Basic Safety Message
1044 (BSM) i USA og Cooperative Awareness Message (CAM) i Europa, og det
1045 norske Vegvesenet er en av de som ser ut til å kunne tenke seg å
1046 pålegge alle biler å fjerne nok en bit av innbyggernes privatsfære.
1047 Anbefaler alle å lese det som står der.
1048
1049 <p>Mens jeg tittet litt på DSRC på biler i Norge kom jeg over et sitat
1050 jeg synes er illustrativt for hvordan det offentlige Norge håndterer
1051 problemstillinger rundt innbyggernes privatsfære i SINTEF-rapporten
1052 «<a href="https://www.sintef.no/publikasjoner/publikasjon/Download/?pubid=SINTEF+A23933">Informasjonssikkerhet
1053 i AutoPASS-brikker</a>» av Trond Foss:</p>
1054
1055 <p><blockquote>
1056 «Rapporten ser ikke på informasjonssikkerhet knyttet til personlig
1057   integritet.»
1058 </blockquote></p>
1059
1060 <p>Så enkelt kan det tydeligvis gjøres når en vurderer
1061 informasjonssikkerheten.  Det holder vel at folkene på toppen kan si
1062 at «Personvernet er ivaretatt», som jo er den populære intetsigende
1063 frasen som gjør at mange tror enkeltindividers integritet tas vare på.
1064 Sitatet fikk meg til å undres på hvor ofte samme tilnærming, å bare se
1065 bort fra behovet for personlig itegritet, blir valgt når en velger å
1066 legge til rette for nok et inngrep i privatsfæren til personer i
1067 Norge.  Det er jo sjelden det får reaksjoner.  Historien om
1068 reaksjonene på Helse Sør-Østs tjenesteutsetting er jo sørgelig nok et
1069 unntak og toppen av isfjellet, desverre.  Tror jeg fortsatt takker nei
1070 til både AutoPASS og holder meg så langt unna det norske helsevesenet
1071 som jeg kan, inntil de har demonstrert og dokumentert at de verdsetter
1072 individets privatsfære og personlige integritet høyere enn kortsiktig
1073 gevist og samfunnsnytte.</p>
1074
1075       </div>
1076       <div class="tags">
1077
1078
1079         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
1080
1081
1082       </div>
1083     </div>
1084     <div class="padding"></div>
1085
1086     <div class="entry">
1087       <div class="title">
1088         <a href="https://people.skolelinux.org/pere/blog/How_to_talk_with_your_loved_ones_in_private.html">How to talk with your loved ones in private</a>
1089       </div>
1090       <div class="date">
1091          7th November 2016
1092       </div>
1093       <div class="body">
1094         <p>A few days ago I ran a very biased and informal survey to get an
1095 idea about what options are being used to communicate with end to end
1096 encryption with friends and family.  I explicitly asked people not to
1097 list options only used in a work setting.  The background is the
1098 uneasy feeling I get when using Signal, a feeling shared by others as
1099 a blog post from Sander Venima about
1100 <a href="https://sandervenema.ch/2016/11/why-i-wont-recommend-signal-anymore/">why
1101 he do not recommend Signal anymore</a> (with
1102 <a href="https://news.ycombinator.com/item?id=12883410">feedback from
1103 the Signal author available from ycombinator</a>).  I wanted an
1104 overview of the options being used, and hope to include those options
1105 in a less biased survey later on.  So far I have not taken the time to
1106 look into the individual proposed systems.  They range from text
1107 sharing web pages, via file sharing and email to instant messaging,
1108 VOIP and video conferencing.  For those considering which system to
1109 use, it is also useful to have a look at
1110 <a href="https://www.eff.org/secure-messaging-scorecard">the EFF Secure
1111 messaging scorecard</a> which is slightly out of date but still
1112 provide valuable information.</p>
1113
1114 <p>So, on to the list.  There were some used by many, some used by a
1115 few, some rarely used ones and a few mentioned but without anyone
1116 claiming to use them.  Notice the grouping is in reality quite random
1117 given the biased self selected set of participants.  First the ones
1118 used by many:</p>
1119
1120 <ul>
1121
1122 <li><a href="https://whispersystems.org/">Signal</a></li>
1123 <li>Email w/<a href="http://openpgp.org/">OpenPGP</a> (Enigmail, GPGSuite,etc)</li>
1124 <li><a href="https://www.whatsapp.com/">Whatsapp</a></li>
1125 <li>IRC w/<a href="https://otr.cypherpunks.ca/">OTR</a></li>
1126 <li>XMPP w/<a href="https://otr.cypherpunks.ca/">OTR</a></li>
1127
1128 </ul>
1129
1130 <p>Then the ones used by a few.</p>
1131
1132 <ul>
1133
1134 <li><a href="https://wiki.mumble.info/wiki/Main_Page">Mumble</a></li>
1135 <li>iMessage (included in iOS from Apple)</li>
1136 <li><a href="https://telegram.org/">Telegram</a></li>
1137 <li><a href="https://jitsi.org/">Jitsi</a></li>
1138 <li><a href="https://keybase.io/download">Keybase file</a></li>
1139
1140 </ul>
1141
1142 <p>Then the ones used by even fewer people</p>
1143
1144 <ul>
1145
1146 <li><a href="https://ring.cx/">Ring</a></li>
1147 <li><a href="https://bitmessage.org/">Bitmessage</a></li>
1148 <li><a href="https://wire.com/">Wire</a></li>
1149 <li>VoIP w/<a href="https://en.wikipedia.org/wiki/ZRTP">ZRTP</a> or controlled <a href="https://en.wikipedia.org/wiki/Secure_Real-time_Transport_Protocol">SRTP</a> (e.g using <a href="https://en.wikipedia.org/wiki/CSipSimple">CSipSimple</a>, <a href="https://en.wikipedia.org/wiki/Linphone">Linphone</a>)</li>
1150 <li><a href="https://matrix.org/">Matrix</a></li>
1151 <li><a href="https://kontalk.org/">Kontalk</a></li>
1152 <li><a href="https://0bin.net/">0bin</a> (encrypted pastebin)</li>
1153 <li><a href="https://appear.in">Appear.in</a></li>
1154 <li><a href="https://riot.im/">riot</a></li>
1155 <li><a href="https://www.wickr.com/">Wickr Me</a></li>
1156
1157 </ul>
1158
1159 <p>And finally the ones mentioned by not marked as used by
1160 anyone. This might be a mistake, perhaps the person adding the entry
1161 forgot to flag it as used?</p>
1162
1163 <ul>
1164
1165 <li>Email w/Certificates <a href="https://en.wikipedia.org/wiki/S/MIME">S/MIME</a></li>
1166 <li><a href="https://www.crypho.com/">Crypho</a></li>
1167 <li><a href="https://cryptpad.fr/">CryptPad</a></li>
1168 <li><a href="https://github.com/ricochet-im/ricochet">ricochet</a></li>
1169
1170 </ul>
1171
1172 <p>Given the network effect it seem obvious to me that we as a society
1173 have been divided and conquered by those interested in keeping
1174 encrypted and secure communication away from the masses.  The
1175 finishing remarks <a href="https://vimeo.com/97505679">from Aral Balkan
1176 in his talk "Free is a lie"</a> about the usability of free software
1177 really come into effect when you want to communicate in private with
1178 your friends and family.  We can not expect them to allow the
1179 usability of communication tool to block their ability to talk to
1180 their loved ones.</p>
1181
1182 <p>Note for example the option IRC w/OTR.  Most IRC clients do not
1183 have OTR support, so in most cases OTR would not be an option, even if
1184 you wanted to.  In my personal experience, about 1 in 20 I talk to
1185 have a IRC client with OTR.  For private communication to really be
1186 available, most people to talk to must have the option in their
1187 currently used client.  I can not simply ask my family to install an
1188 IRC client.  I need to guide them through a technical multi-step
1189 process of adding extensions to the client to get them going.  This is
1190 a non-starter for most.</p>
1191
1192 <p>I would like to be able to do video phone calls, audio phone calls,
1193 exchange instant messages and share files with my loved ones, without
1194 being forced to share with people I do not know.  I do not want to
1195 share the content of the conversations, and I do not want to share who
1196 I communicate with or the fact that I communicate with someone.
1197 Without all these factors in place, my private life is being more or
1198 less invaded.</p>
1199
1200 <p><strong>Update 2019-10-08</strong>: Børge Dvergsdal, who told me he
1201   is Customer Relationship Manager @ Whereby (formerly appear.in),
1202   asked if I could mention that appear.in is now renamed and found at
1203   <a href="https://whereby.com/">https://whereby.com/</a>.  And sure,
1204   why not.  Apparently they changed the name because they were unable
1205   to trademark appear.in somewhere...  While I am at it, I can mention
1206   that Ring changed name to Jami, now available from <a
1207   href="https://jami.net/">https://jami.net/</a>.  Luckily they were
1208   able to have a direct redirect from ring.cx to jami.net, so the user
1209   experience is almost the same.</p>
1210
1211       </div>
1212       <div class="tags">
1213
1214
1215         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
1216
1217
1218       </div>
1219     </div>
1220     <div class="padding"></div>
1221
1222     <div class="entry">
1223       <div class="title">
1224         <a href="https://people.skolelinux.org/pere/blog/Aktivitetsb_nd_som_beskytter_privatsf_ren.html">Aktivitetsbånd som beskytter privatsfæren</a>
1225       </div>
1226       <div class="date">
1227          3rd November 2016
1228       </div>
1229       <div class="body">
1230         <p>Jeg ble så imponert over
1231 <a href="https://www.nrk.no/norge/forbrukerradet-mener-aktivitetsarmband-strider-mot-norsk-lov-1.13209079">dagens
1232 gladnyhet på NRK</a>, om at Forbrukerrådet klager inn vilkårene for
1233 bruk av aktivitetsbånd fra Fitbit, Garmin, Jawbone og Mio til
1234 Datatilsynet og forbrukerombudet, at jeg sendte følgende brev til
1235 forbrukerrådet for å uttrykke min støtte:
1236
1237 <blockquote>
1238
1239 <p>Jeg ble veldig glad over å lese at Forbrukerrådet
1240 <a href="http://www.forbrukerradet.no/siste-nytt/klager-inn-aktivitetsarmband-for-brudd-pa-norsk-lov/">klager
1241 inn flere aktivitetsbånd til Datatilsynet for dårlige vilkår</a>.  Jeg
1242 har ønsket meg et aktivitetsbånd som kan måle puls, bevegelse og
1243 gjerne også andre helserelaterte indikatorer en stund nå.  De eneste
1244 jeg har funnet i salg gjør, som dere også har oppdaget, graverende
1245 inngrep i privatsfæren og sender informasjonen ut av huset til folk og
1246 organisasjoner jeg ikke ønsker å dele aktivitets- og helseinformasjon
1247 med.  Jeg ønsker et alternativ som <em>ikke</em> sender informasjon til
1248 skyen, men derimot bruker
1249 <a href="http://people.skolelinux.org/pere/blog/Fri_og__pen_standard__slik_Digistan_ser_det.html">en
1250 fritt og åpent standardisert</a> protokoll (eller i det minste en
1251 dokumentert protokoll uten patent- og opphavsrettslige
1252 bruksbegrensinger) til å kommunisere med datautstyr jeg kontrollerer.
1253 Er jo ikke interessert i å betale noen for å tilrøve seg
1254 personopplysninger fra meg.  Desverre har jeg ikke funnet noe
1255 alternativ så langt.</p>
1256
1257 <p>Det holder ikke å endre på bruksvilkårene for enhetene, slik
1258 Datatilsynet ofte legger opp til i sin behandling, når de gjør slik
1259 f.eks. Fitbit (den jeg har sett mest på).  Fitbit krypterer
1260 informasjonen på enheten og sender den kryptert til leverandøren.  Det
1261 gjør det i praksis umulig både å sjekke hva slags informasjon som
1262 sendes over, og umulig å ta imot informasjonen selv i stedet for
1263 Fitbit.  Uansett hva slags historie som forteller i bruksvilkårene er
1264 en jo både prisgitt leverandørens godvilje og at de ikke tvinges av
1265 sitt lands myndigheter til å lyve til sine kunder om hvorvidt
1266 personopplysninger spres ut over det bruksvilkårene sier.  Det er
1267 veldokumentert hvordan f.eks. USA tvinger selskaper vha. såkalte
1268 National security letters til å utlevere personopplysninger samtidig
1269 som de ikke får lov til å fortelle dette til kundene sine.</p>
1270
1271 <p>Stå på, jeg er veldig glade for at dere har sett på saken.  Vet
1272 dere om aktivitetsbånd i salg i dag som ikke tvinger en til å utlevere
1273 aktivitets- og helseopplysninger med leverandøren?</p>
1274
1275 </blockquote>
1276
1277 <p>Jeg håper en konkurrent som respekterer kundenes privatliv klarer å
1278 nå opp i markedet, slik at det finnes et reelt alternativ for oss som
1279 har full tillit til at skyleverandører vil prioritere egen inntjening
1280 og myndighetspålegg langt foran kundenes rett til privatliv.  Jeg har
1281 ingen tiltro til at Datatilsynet vil kreve noe mer enn at vilkårene
1282 endres slik at de forklarer eksplisitt i hvor stor grad bruk av
1283 produktene utraderer privatsfæren til kundene.  Det vil nok gjøre de
1284 innklagede armbåndene «lovlige», men fortsatt tvinge kundene til å
1285 dele sine personopplysninger med leverandøren.</p>
1286
1287       </div>
1288       <div class="tags">
1289
1290
1291         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
1292
1293
1294       </div>
1295     </div>
1296     <div class="padding"></div>
1297
1298     <div class="entry">
1299       <div class="title">
1300         <a href="https://people.skolelinux.org/pere/blog/Experience_and_updated_recipe_for_using_the_Signal_app_without_a_mobile_phone.html">Experience and updated recipe for using the Signal app without a mobile phone</a>
1301       </div>
1302       <div class="date">
1303         10th October 2016
1304       </div>
1305       <div class="body">
1306         <p>In July
1307 <a href="http://people.skolelinux.org/pere/blog/How_to_use_the_Signal_app_if_you_only_have_a_land_line__ie_no_mobile_phone_.html">I
1308 wrote how to get the Signal Chrome/Chromium app working</a> without
1309 the ability to receive SMS messages (aka without a cell phone).  It is
1310 time to share some experiences and provide an updated setup.</p>
1311
1312 <p>The Signal app have worked fine for several months now, and I use
1313 it regularly to chat with my loved ones.  I had a major snag at the
1314 end of my summer vacation, when the the app completely forgot my
1315 setup, identity and keys.  The reason behind this major mess was
1316 running out of disk space.  To avoid that ever happening again I have
1317 started storing everything in <tt>userdata/</tt> in git, to be able to
1318 roll back to an earlier version if the files are wiped by mistake.  I
1319 had to use it once after introducing the git backup.  When rolling
1320 back to an earlier version, one need to use the 'reset session' option
1321 in Signal to get going, and notify the people you talk with about the
1322 problem.  I assume there is some sequence number tracking in the
1323 protocol to detect rollback attacks.  The git repository is rather big
1324 (674 MiB so far), but I have not tried to figure out if some of the
1325 content can be added to a .gitignore file due to lack of spare
1326 time.</p>
1327
1328 <p>I've also hit the 90 days timeout blocking, and noticed that this
1329 make it impossible to send messages using Signal.  I could still
1330 receive them, but had to patch the code with a new timestamp to send.
1331 I believe the timeout is added by the developers to force people to
1332 upgrade to the latest version of the app, even when there is no
1333 protocol changes, to reduce the version skew among the user base and
1334 thus try to keep the number of support requests down.</p>
1335
1336 <p>Since my original recipe, the Signal source code changed slightly,
1337 making the old patch fail to apply cleanly.  Below is an updated
1338 patch, including the shell wrapper I use to start Signal.  The
1339 original version required a new user to locate the JavaScript console
1340 and call a function from there.  I got help from a friend with more
1341 JavaScript knowledge than me to modify the code to provide a GUI
1342 button instead.  This mean that to get started you just need to run
1343 the wrapper and click the 'Register without mobile phone' to get going
1344 now.  I've also modified the timeout code to always set it to 90 days
1345 in the future, to avoid having to patch the code regularly.</p>
1346
1347 <p>So, the updated recipe for Debian Jessie:</p>
1348
1349 <ol>
1350
1351 <li>First, install required packages to get the source code and the
1352 browser you need.  Signal only work with Chrome/Chromium, as far as I
1353 know, so you need to install it.
1354
1355 <pre>
1356 apt install git tor chromium
1357 git clone https://github.com/WhisperSystems/Signal-Desktop.git
1358 </pre></li>
1359
1360 <li>Modify the source code using command listed in the the patch
1361 block below.</li>
1362
1363 <li>Start Signal using the run-signal-app wrapper (for example using
1364 <tt>`pwd`/run-signal-app</tt>).
1365
1366 <li>Click on the 'Register without mobile phone', will in a phone
1367 number you can receive calls to the next minute, receive the
1368 verification code and enter it into the form field and press
1369 'Register'.  Note, the phone number you use will be user Signal
1370 username, ie the way others can find you on Signal.</li>
1371
1372 <li>You can now use Signal to contact others.  Note, new contacts do
1373 not show up in the contact list until you restart Signal, and there is
1374 no way to assign names to Contacts.  There is also no way to create or
1375 update chat groups.  I suspect this is because the web app do not have
1376 a associated contact database.</li>
1377
1378 </ol>
1379
1380 <p>I am still a bit uneasy about using Signal, because of the way its
1381 main author moxie0 reject federation and accept dependencies to major
1382 corporations like Google (part of the code is fetched from Google) and
1383 Amazon (the central coordination point is owned by Amazon).  See for
1384 example
1385 <a href="https://github.com/LibreSignal/LibreSignal/issues/37">the
1386 LibreSignal issue tracker</a> for a thread documenting the authors
1387 view on these issues.  But the network effect is strong in this case,
1388 and several of the people I want to communicate with already use
1389 Signal.  Perhaps we can all move to <a href="https://ring.cx/">Ring</a>
1390 once it <a href="https://bugs.debian.org/830265">work on my
1391 laptop</a>?  It already work on Windows and Android, and is included
1392 in <a href="https://tracker.debian.org/pkg/ring">Debian</a> and
1393 <a href="https://launchpad.net/ubuntu/+source/ring">Ubuntu</a>, but not
1394 working on Debian Stable.</p>
1395
1396 <p>Anyway, this is the patch I apply to the Signal code to get it
1397 working.  It switch to the production servers, disable to timeout,
1398 make registration easier and add the shell wrapper:</p>
1399
1400 <pre>
1401 cd Signal-Desktop; cat &lt;&lt;EOF | patch -p1
1402 diff --git a/js/background.js b/js/background.js
1403 index 24b4c1d..579345f 100644
1404 --- a/js/background.js
1405 +++ b/js/background.js
1406 @@ -33,9 +33,9 @@
1407          });
1408      });
1409
1410 -    var SERVER_URL = 'https://textsecure-service-staging.whispersystems.org';
1411 +    var SERVER_URL = 'https://textsecure-service-ca.whispersystems.org';
1412      var SERVER_PORTS = [80, 4433, 8443];
1413 -    var ATTACHMENT_SERVER_URL = 'https://whispersystems-textsecure-attachments-staging.s3.amazonaws.com';
1414 +    var ATTACHMENT_SERVER_URL = 'https://whispersystems-textsecure-attachments.s3.amazonaws.com';
1415      var messageReceiver;
1416      window.getSocketStatus = function() {
1417          if (messageReceiver) {
1418 diff --git a/js/expire.js b/js/expire.js
1419 index 639aeae..beb91c3 100644
1420 --- a/js/expire.js
1421 +++ b/js/expire.js
1422 @@ -1,6 +1,6 @@
1423  ;(function() {
1424      'use strict';
1425 -    var BUILD_EXPIRATION = 0;
1426 +    var BUILD_EXPIRATION = Date.now() + (90 * 24 * 60 * 60 * 1000);
1427
1428      window.extension = window.extension || {};
1429
1430 diff --git a/js/views/install_view.js b/js/views/install_view.js
1431 index 7816f4f..1d6233b 100644
1432 --- a/js/views/install_view.js
1433 +++ b/js/views/install_view.js
1434 @@ -38,7 +38,8 @@
1435              return {
1436                  'click .step1': this.selectStep.bind(this, 1),
1437                  'click .step2': this.selectStep.bind(this, 2),
1438 -                'click .step3': this.selectStep.bind(this, 3)
1439 +                'click .step3': this.selectStep.bind(this, 3),
1440 +                'click .callreg': function() { extension.install('standalone') },
1441              };
1442          },
1443          clearQR: function() {
1444 diff --git a/options.html b/options.html
1445 index dc0f28e..8d709f6 100644
1446 --- a/options.html
1447 +++ b/options.html
1448 @@ -14,7 +14,10 @@
1449          &lt;div class='nav'>
1450            &lt;h1>{{ installWelcome }}&lt;/h1>
1451            &lt;p>{{ installTagline }}&lt;/p>
1452 -          &lt;div> &lt;a class='button step2'>{{ installGetStartedButton }}&lt;/a> &lt;/div>
1453 +          &lt;div> &lt;a class='button step2'>{{ installGetStartedButton }}&lt;/a>
1454 +           &lt;br> &lt;a class="button callreg">Register without mobile phone&lt;/a>
1455 +
1456 +         &lt;/div>
1457            &lt;span class='dot step1 selected'>&lt;/span>
1458            &lt;span class='dot step2'>&lt;/span>
1459            &lt;span class='dot step3'>&lt;/span>
1460 --- /dev/null   2016-10-07 09:55:13.730181472 +0200
1461 +++ b/run-signal-app   2016-10-10 08:54:09.434172391 +0200
1462 @@ -0,0 +1,12 @@
1463 +#!/bin/sh
1464 +set -e
1465 +cd $(dirname $0)
1466 +mkdir -p userdata
1467 +userdata="`pwd`/userdata"
1468 +if [ -d "$userdata" ] && [ ! -d "$userdata/.git" ] ; then
1469 +    (cd $userdata && git init)
1470 +fi
1471 +(cd $userdata && git add . && git commit -m "Current status." || true)
1472 +exec chromium \
1473 +  --proxy-server="socks://localhost:9050" \
1474 +  --user-data-dir=$userdata --load-and-launch-app=`pwd`
1475 EOF
1476 chmod a+rx run-signal-app
1477 </pre>
1478
1479 <p>As usual, if you use Bitcoin and want to show your support of my
1480 activities, please send Bitcoin donations to my address
1481 <b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
1482
1483       </div>
1484       <div class="tags">
1485
1486
1487         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
1488
1489
1490       </div>
1491     </div>
1492     <div class="padding"></div>
1493
1494     <div class="entry">
1495       <div class="title">
1496         <a href="https://people.skolelinux.org/pere/blog/NRKs_kildevern_n_r_NRK_epost_deles_med_utenlands_etterretning_.html">NRKs kildevern når NRK-epost deles med utenlands etterretning?</a>
1497       </div>
1498       <div class="date">
1499          8th October 2016
1500       </div>
1501       <div class="body">
1502         <p>NRK
1503 <a href="https://nrkbeta.no/2016/09/02/securing-whistleblowers/">lanserte
1504 for noen uker siden</a> en ny
1505 <a href="https://www.nrk.no/varsle/">varslerportal som bruker
1506 SecureDrop til å ta imot tips</a> der det er vesentlig at ingen
1507 utenforstående får vite at NRK er tipset.  Det er et langt steg
1508 fremover for NRK, og når en leser bloggposten om hva de har tenkt på
1509 og hvordan løsningen er satt opp virker det som om de har gjort en
1510 grundig jobb der.  Men det er ganske mye ekstra jobb å motta tips via
1511 SecureDrop, så varslersiden skriver "Nyhetstips som ikke krever denne
1512 typen ekstra vern vil vi gjerne ha på nrk.no/03030", og 03030-siden
1513 foreslår i tillegg til et webskjema å bruke epost, SMS, telefon,
1514 personlig oppmøte og brevpost.  Denne artikkelen handler disse andre
1515 metodene.</p>
1516
1517 <p>Når en sender epost til en @nrk.no-adresse så vil eposten sendes ut
1518 av landet til datamaskiner kontrollert av Microsoft.  En kan sjekke
1519 dette selv ved å slå opp epostleveringsadresse (MX) i DNS.  For NRK er
1520 dette i dag "nrk-no.mail.protection.outlook.com".  NRK har som en ser
1521 valgt å sette bort epostmottaket sitt til de som står bak outlook.com,
1522 dvs. Microsoft.  En kan sjekke hvor nettverkstrafikken tar veien
1523 gjennom Internett til epostmottaket vha. programmet
1524 <tt>traceroute</tt>, og finne ut hvem som eier en Internett-adresse
1525 vha. whois-systemet.  Når en gjør dette for epost-trafikk til @nrk.no
1526 ser en at trafikken fra Norge mot nrk-no.mail.protection.outlook.com
1527 går via Sverige mot enten Irland eller Tyskland (det varierer fra gang
1528 til gang og kan endre seg over tid).</p>
1529
1530 <p>Vi vet fra
1531 <a href="https://no.wikipedia.org/wiki/FRA-loven">introduksjonen av
1532 FRA-loven</a> at IP-trafikk som passerer grensen til Sverige avlyttes
1533 av Försvarets radioanstalt (FRA).  Vi vet videre takket være
1534 Snowden-bekreftelsene at trafikk som passerer grensen til
1535 Storbritannia avlyttes av Government Communications Headquarters
1536 (GCHQ).  I tillegg er er det nettopp lansert et forslag i Norge om at
1537 forsvarets E-tjeneste skal få avlytte trafikk som krysser grensen til
1538 Norge. Jeg er ikke kjent med dokumentasjon på at Irland og Tyskland
1539 gjør det samme.  Poenget er uansett at utenlandsk etterretning har
1540 mulighet til å snappe opp trafikken når en sender epost til @nrk.no.
1541 I tillegg er det selvsagt tilgjengelig for Microsoft som er underlagt USAs
1542 jurisdiksjon og
1543 <a href="https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data">samarbeider
1544 med USAs etterretning på flere områder</a>.  De som tipser NRK om
1545 nyheter via epost kan dermed gå ut fra at det blir kjent for mange
1546 andre enn NRK at det er gjort.</p>
1547
1548 <p>Bruk av SMS og telefon registreres av blant annet telefonselskapene
1549 og er tilgjengelig i følge lov og forskrift for blant annet Politi,
1550 NAV og Finanstilsynet, i tillegg til IT-folkene hos telefonselskapene
1551 og deres overordnede.  Hvis innringer eller mottaker bruker
1552 smarttelefon vil slik kontakt også gjøres tilgjengelig for ulike
1553 app-leverandører og de som lytter på trafikken mellom telefon og
1554 app-leverandør, alt etter hva som er installert på telefonene som
1555 brukes.</p>
1556
1557 <p>Brevpost kan virke trygt, og jeg vet ikke hvor mye som registreres
1558 og lagres av postens datastyrte postsorteringssentraler.  Det vil ikke
1559 overraske meg om det lagres hvor i landet hver konvolutt kommer fra og
1560 hvor den er adressert, i hvert fall for en kortere periode.  Jeg vet
1561 heller ikke hvem slik informasjon gjøres tilgjengelig for.  Det kan
1562 være nok til å ringe inn potensielle kilder når det krysses med hvem
1563 som kjente til aktuell informasjon og hvor de befant seg (tilgjengelig
1564 f.eks.  hvis de bærer mobiltelefon eller bor i nærheten).</p>
1565
1566 <p>Personlig oppmøte hos en NRK-journalist er antagelig det tryggeste,
1567 men en bør passe seg for å bruke NRK-kantina.  Der bryter de nemlig
1568 <a href="http://www.lovdata.no/all/hl-19850524-028.html#14">Sentralbanklovens
1569 paragraf 14</a> og nekter folk å betale med kontanter.  I stedet
1570 krever de at en varsle sin bankkortutsteder om hvor en befinner seg
1571 ved å bruke bankkort.  Banktransaksjoner er tilgjengelig for
1572 bankkortutsteder (det være seg VISA, Mastercard, Nets og/eller en
1573 bank) i tillegg til politiet og i hvert fall tidligere med Se & Hør
1574 (via utro tjenere, slik det ble avslørt etter utgivelsen av boken
1575 «Livet, det forbannede» av Ken B. Rasmussen).  Men hvor mange kjenner
1576 en NRK-journalist personlig?  Besøk på NRK på Marienlyst krever at en
1577 registrerer sin ankost elektronisk i besøkssystemet.  Jeg vet ikke hva
1578 som skjer med det datasettet, men har grunn til å tro at det sendes ut
1579 SMS til den en skal besøke med navnet som er oppgitt.  Kanskje greit å
1580 oppgi falskt navn.</p>
1581
1582 <p>Når så tipset er kommet frem til NRK skal det behandles
1583 redaksjonelt i NRK.  Der vet jeg via ulike kilder at de fleste
1584 journalistene bruker lokalt installert programvare, men noen bruker
1585 Google Docs og andre skytjenester i strid med interne retningslinjer
1586 når de skriver.  Hvordan vet en hvem det gjelder?  Ikke vet jeg, men
1587 det kan være greit å spørre for å sjekke at journalisten har tenkt på
1588 problemstillingen, før en gir et tips.  Og hvis tipset omtales internt
1589 på epost, er det jo grunn til å tro at også intern eposten vil deles
1590 med Microsoft og utenlands etterretning, slik tidligere nevnt, men det
1591 kan hende at det holdes internt i NRKs interne MS Exchange-løsning.
1592 Men Microsoft ønsker å få alle Exchange-kunder over "i skyen" (eller
1593 andre folks datamaskiner, som det jo innebærer), så jeg vet ikke hvor
1594 lenge det i så fall vil vare.</p>
1595
1596 <p>I tillegg vet en jo at
1597 <a href="https://www.nrk.no/ytring/elektronisk-kildevern-i-nrk-1.11941196">NRK
1598 har valgt å gi nasjonal sikkerhetsmyndighet (NSM) tilgang til å se på
1599 intern og ekstern Internett-trafikk</a> hos NRK ved oppsett av såkalte
1600 VDI-noder, på tross av
1601 <a href="https://www.nrk.no/ytring/bekymring-for-nrks-kildevern-1.11941584">protester
1602 fra NRKs journalistlag</a>.  Jeg vet ikke om den vil kunne snappe opp
1603 dokumenter som lagres på interne filtjenere eller dokumenter som lages
1604 i de interne webbaserte publiseringssystemene, men vet at hva noden
1605 ser etter på nettet kontrolleres av NSM og oppdateres automatisk, slik
1606 at det ikke gir så mye mening å sjekke hva noden ser etter i dag når
1607 det kan endres automatisk i morgen.</p>
1608
1609 <p>Personlig vet jeg ikke om jeg hadde turt tipse NRK hvis jeg satt på
1610 noe som kunne være en trussel mot den bestående makten i Norge eller
1611 verden.  Til det virker det å være for mange åpninger for
1612 utenforstående med andre prioriteter enn NRKs journalistiske fokus.
1613 Og den største truslen for en varsler er jo om metainformasjon kommer
1614 på avveie, dvs. informasjon om at en har vært i kontakt med en
1615 journalist.  Det kan være nok til at en kommer i myndighetenes
1616 søkelys, og de færreste har nok operasjonell sikkerhet til at vil tåle
1617 slik flombelysning på sitt privatliv.</p>
1618
1619       </div>
1620       <div class="tags">
1621
1622
1623         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/betalkontant">betalkontant</a>, <a href="https://people.skolelinux.org/pere/blog/tags/dld">dld</a>, <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
1624
1625
1626       </div>
1627     </div>
1628     <div class="padding"></div>
1629
1630     <div class="entry">
1631       <div class="title">
1632         <a href="https://people.skolelinux.org/pere/blog/Unlocking_HTC_Desire_HD_on_Linux_using_unruu_and_fastboot.html">Unlocking HTC Desire HD on Linux using unruu and fastboot</a>
1633       </div>
1634       <div class="date">
1635          7th July 2016
1636       </div>
1637       <div class="body">
1638         <p>Yesterday, I tried to unlock a HTC Desire HD phone, and it proved
1639 to be a slight challenge.  Here is the recipe if I ever need to do it
1640 again.  It all started by me wanting to try the recipe to set up
1641 <a href="https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy">an
1642 hardened Android installation</a> from the Tor project blog on a
1643 device I had access to.  It is a old mobile phone with a broken
1644 microphone The initial idea had been to just
1645 <a href="http://wiki.cyanogenmod.org/w/Install_CM_for_ace">install
1646 CyanogenMod on it</a>, but did not quite find time to start on it
1647 until a few days ago.</p>
1648
1649 <p>The unlock process is supposed to be simple: (1) Boot into the boot
1650 loader (press volume down and power at the same time), (2) select
1651 'fastboot' before (3) connecting the device via USB to a Linux
1652 machine, (4) request the device identifier token by running 'fastboot
1653 oem get_identifier_token', (5) request the device unlocking key using
1654 the <a href="http://www.htcdev.com/bootloader/">HTC developer web
1655 site</a> and unlock the phone using the key file emailed to you.</p>
1656
1657 <p>Unfortunately, this only work fi you have hboot version 2.00.0029
1658 or newer, and the device I was working on had 2.00.0027.  This
1659 apparently can be easily fixed by downloading a Windows program and
1660 running it on your Windows machine, if you accept the terms Microsoft
1661 require you to accept to use Windows - which I do not.  So I had to
1662 come up with a different approach.  I got a lot of help from AndyCap
1663 on #nuug, and would not have been able to get this working without
1664 him.</p>
1665
1666 <p>First I needed to extract the hboot firmware from
1667 <a href="http://www.htcdev.com/ruu/PD9810000_Ace_Sense30_S_hboot_2.00.0029.exe">the
1668 windows binary for HTC Desire HD</a> downloaded as 'the RUU' from HTC.
1669 For this there is is <a href="https://github.com/kmdm/unruu/">a github
1670 project named unruu</a> using libunshield.  The unshield tool did not
1671 recognise the file format, but unruu worked and extracted rom.zip,
1672 containing the new hboot firmware and a text file describing which
1673 devices it would work for.</p>
1674
1675 <p>Next, I needed to get the new firmware into the device.  For this I
1676 followed some instructions
1677 <a href="http://www.htc1guru.com/2013/09/new-ruu-zips-posted/">available
1678 from HTC1Guru.com</a>, and ran these commands as root on a Linux
1679 machine with Debian testing:</p>
1680
1681 <p><pre>
1682 adb reboot-bootloader
1683 fastboot oem rebootRUU
1684 fastboot flash zip rom.zip
1685 fastboot flash zip rom.zip
1686 fastboot reboot
1687 </pre></p>
1688
1689 <p>The flash command apparently need to be done twice to take effect,
1690 as the first is just preparations and the second one do the flashing.
1691 The adb command is just to get to the boot loader menu, so turning the
1692 device on while holding volume down and the power button should work
1693 too.</p>
1694
1695 <p>With the new hboot version in place I could start following the
1696 instructions on the HTC developer web site.  I got the device token
1697 like this:</p>
1698
1699 <p><pre>
1700 fastboot oem get_identifier_token 2>&1 | sed 's/(bootloader) //'
1701 </pre>
1702
1703 <p>And once I got the unlock code via email, I could use it like
1704 this:</p>
1705
1706 <p><pre>
1707 fastboot flash unlocktoken Unlock_code.bin
1708 </pre></p>
1709
1710 <p>And with that final step in place, the phone was unlocked and I
1711 could start stuffing the software of my own choosing into the device.
1712 So far I only inserted a replacement recovery image to wipe the phone
1713 before I start.  We will see what happen next.  Perhaps I should
1714 install <a href="https://www.debian.org/">Debian</a> on it. :)</p>
1715
1716       </div>
1717       <div class="tags">
1718
1719
1720         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
1721
1722
1723       </div>
1724     </div>
1725     <div class="padding"></div>
1726
1727     <div class="entry">
1728       <div class="title">
1729         <a href="https://people.skolelinux.org/pere/blog/How_to_use_the_Signal_app_if_you_only_have_a_land_line__ie_no_mobile_phone_.html">How to use the Signal app if you only have a land line (ie no mobile phone)</a>
1730       </div>
1731       <div class="date">
1732          3rd July 2016
1733       </div>
1734       <div class="body">
1735         <p>For a while now, I have wanted to test
1736 <a href="https://whispersystems.org/">the Signal app</a>, as it is
1737 said to provide end to end encrypted communication and several of my
1738 friends and family are already using it.  As I by choice do not own a
1739 mobile phone, this proved to be harder than expected.  And I wanted to
1740 have the source of the client and know that it was the code used on my
1741 machine.  But yesterday I managed to get it working.  I used the
1742 Github source, compared it to the source in
1743 <a href="https://chrome.google.com/webstore/detail/signal-private-messenger/bikioccmkafdpakkkcpdbppfkghcmihk?hl=en-US">the
1744 Signal Chrome app</a> available from the Chrome web store, applied
1745 patches to use the production Signal servers, started the app and
1746 asked for the hidden "register without a smart phone" form.  Here is
1747 the recipe how I did it.</p>
1748
1749 <p>First, I fetched the Signal desktop source from Github, using
1750
1751 <pre>
1752 git clone https://github.com/WhisperSystems/Signal-Desktop.git
1753 </pre>
1754
1755 <p>Next, I patched the source to use the production servers, to be
1756 able to talk to other Signal users:</p>
1757
1758 <pre>
1759 cat &lt;&lt;EOF | patch -p0
1760 diff -ur ./js/background.js userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/background.js
1761 --- ./js/background.js  2016-06-29 13:43:15.630344628 +0200
1762 +++ userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/background.js    2016-06-29 14:06:29.530300934 +0200
1763 @@ -47,8 +47,8 @@
1764          });
1765      });
1766
1767 -    var SERVER_URL = 'https://textsecure-service-staging.whispersystems.org';
1768 -    var ATTACHMENT_SERVER_URL = 'https://whispersystems-textsecure-attachments-staging.s3.amazonaws.com';
1769 +    var SERVER_URL = 'https://textsecure-service-ca.whispersystems.org:4433';
1770 +    var ATTACHMENT_SERVER_URL = 'https://whispersystems-textsecure-attachments.s3.amazonaws.com';
1771      var messageReceiver;
1772      window.getSocketStatus = function() {
1773          if (messageReceiver) {
1774 diff -ur ./js/expire.js userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/expire.js
1775 --- ./js/expire.js      2016-06-29 13:43:15.630344628 +0200
1776 +++ userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/expire.js2016-06-29 14:06:29.530300934 +0200
1777 @@ -1,6 +1,6 @@
1778  ;(function() {
1779      'use strict';
1780 -    var BUILD_EXPIRATION = 0;
1781 +    var BUILD_EXPIRATION = 1474492690000;
1782
1783      window.extension = window.extension || {};
1784
1785 EOF
1786 </pre>
1787
1788 <p>The first part is changing the servers, and the second is updating
1789 an expiration timestamp.  This timestamp need to be updated regularly.
1790 It is set 90 days in the future by the build process (Gruntfile.js).
1791 The value is seconds since 1970 times 1000, as far as I can tell.</p>
1792
1793 <p>Based on a tip and good help from the #nuug IRC channel, I wrote a
1794 script to launch Signal in Chromium.</p>
1795
1796 <pre>
1797 #!/bin/sh
1798 cd $(dirname $0)
1799 mkdir -p userdata
1800 exec chromium \
1801   --proxy-server="socks://localhost:9050" \
1802   --user-data-dir=`pwd`/userdata --load-and-launch-app=`pwd`
1803 </pre>
1804
1805 <p> The script start the app and configure Chromium to use the Tor
1806 SOCKS5 proxy to make sure those controlling the Signal servers (today
1807 Amazon and Whisper Systems) as well as those listening on the lines
1808 will have a harder time location my laptop based on the Signal
1809 connections if they use source IP address.</p>
1810
1811 <p>When the script starts, one need to follow the instructions under
1812 "Standalone Registration" in the CONTRIBUTING.md file in the git
1813 repository.  I right clicked on the Signal window to get up the
1814 Chromium debugging tool, visited the 'Console' tab and wrote
1815 'extension.install("standalone")' on the console prompt to get the
1816 registration form.  Then I entered by land line phone number and
1817 pressed 'Call'.  5 seconds later the phone rang and a robot voice
1818 repeated the verification code three times.  After entering the number
1819 into the verification code field in the form, I could start using
1820 Signal from my laptop.
1821
1822 <p>As far as I can tell, The Signal app will leak who is talking to
1823 whom and thus who know who to those controlling the central server,
1824 but such leakage is hard to avoid with a centrally controlled server
1825 setup.  It is something to keep in mind when using Signal - the
1826 content of your chats are harder to intercept, but the meta data
1827 exposing your contact network is available to people you do not know.
1828 So better than many options, but not great.  And sadly the usage is
1829 connected to my land line, thus allowing those controlling the server
1830 to associate it to my home and person.  I would prefer it if only
1831 those I knew could tell who I was on Signal.  There are options
1832 avoiding such information leakage, but most of my friends are not
1833 using them, so I am stuck with Signal for now.</p>
1834
1835 <p><strong>Update 2017-01-10</strong>: There is an updated blog post
1836 on this topic in
1837 <a href="http://people.skolelinux.org/pere/blog/Experience_and_updated_recipe_for_using_the_Signal_app_without_a_mobile_phone.html">Experience
1838 and updated recipe for using the Signal app without a mobile
1839 phone</a>.</p>
1840
1841       </div>
1842       <div class="tags">
1843
1844
1845         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
1846
1847
1848       </div>
1849     </div>
1850     <div class="padding"></div>
1851
1852     <div class="entry">
1853       <div class="title">
1854         <a href="https://people.skolelinux.org/pere/blog/syslog_trusted_timestamp___chain_of_trusted_timestamps_for_your_syslog.html">syslog-trusted-timestamp - chain of trusted timestamps for your syslog</a>
1855       </div>
1856       <div class="date">
1857          2nd April 2016
1858       </div>
1859       <div class="body">
1860         <p>Two years ago, I had
1861 <a href="http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html">a
1862 look at trusted timestamping options available</a>, and among
1863 other things noted a still open
1864 <a href="https://bugs.debian.org/742553">bug in the tsget script</a>
1865 included in openssl that made it harder than necessary to use openssl
1866 as a trusted timestamping client.  A few days ago I was told
1867 <a href="https:/www.difi.no/">the Norwegian government office DIFI</a> is
1868 close to releasing their own trusted timestamp service, and in the
1869 process I was happy to learn about a replacement for the tsget script
1870 using only curl:</p>
1871
1872 <p><pre>
1873 openssl ts -query -data "/etc/shells" -cert -sha256 -no_nonce \
1874   | curl -s -H "Content-Type: application/timestamp-query" \
1875          --data-binary "@-" http://zeitstempel.dfn.de > etc-shells.tsr
1876 openssl ts -reply -text -in etc-shells.tsr
1877 </pre></p>
1878
1879 <p>This produces a binary timestamp file (etc-shells.tsr) which can be
1880 used to verify that the content of the file /etc/shell with the
1881 calculated sha256 hash existed at the point in time when the request
1882 was made.  The last command extract the content of the etc-shells.tsr
1883 in human readable form.  The idea behind such timestamp is to be able
1884 to prove using cryptography that the content of a file have not
1885 changed since the file was stamped.</p>
1886
1887 <p>To verify that the file on disk match the public key signature in
1888 the timestamp file, run the following commands.  It make sure you have
1889 the required certificate for the trusted timestamp service available
1890 and use it to compare the file content with the timestamp.  In
1891 production, one should of course use a better method to verify the
1892 service certificate.</p>
1893
1894 <p><pre>
1895 wget -O ca-cert.txt https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt
1896 openssl ts -verify -data /etc/shells -in etc-shells.tsr -CAfile ca-cert.txt -text
1897 </pre></p>
1898
1899 <p>Wikipedia have a lot more information about
1900 <a href="https://en.wikipedia.org/wiki/Trusted_timestamping">trusted
1901 Timestamping</a> and
1902 <a href="https://en.wikipedia.org/wiki/Linked_timestamping">linked
1903 timestamping</a>, and there are several trusted timestamping services
1904 around, both as commercial services and as free and public services.
1905 Among the latter is
1906 <a href="https://www.pki.dfn.de/zeitstempeldienst/">the
1907 zeitstempel.dfn.de service</a> mentioned above and
1908 <a href="https://freetsa.org/">freetsa.org service</a> linked to from the
1909 wikipedia web site.  I believe the DIFI service should show up on
1910 https://tsa.difi.no, but it is not available to the public at the
1911 moment.  I hope this will change when it is into production.  The
1912 <a href="https://tools.ietf.org/html/rfc3161">RFC 3161</a> trusted
1913 timestamping protocol standard is even implemented in LibreOffice,
1914 Microsoft Office and Adobe Acrobat, making it possible to verify when
1915 a document was created.</p>
1916
1917 <p>I would find it useful to be able to use such trusted timestamp
1918 service to make it possible to verify that my stored syslog files have
1919 not been tampered with.  This is not a new idea.  I found one example
1920 implemented on the Endian network appliances where
1921 <a href="http://help.endian.com/entries/21518508-Enabling-Timestamping-on-log-files-">the
1922 configuration of such feature was described in 2012</a>.</p>
1923
1924 <p>But I could not find any free implementation of such feature when I
1925 searched, so I decided to try to
1926 <a href="https://github.com/petterreinholdtsen/syslog-trusted-timestamp">build
1927 a prototype named syslog-trusted-timestamp</a>.  My idea is to
1928 generate a timestamp of the old log files after they are rotated, and
1929 store the timestamp in the new log file just after rotation.  This
1930 will form a chain that would make it possible to see if any old log
1931 files are tampered with.  But syslog is bad at handling kilobytes of
1932 binary data, so I decided to base64 encode the timestamp and add an ID
1933 and line sequence numbers to the base64 data to make it possible to
1934 reassemble the timestamp file again.  To use it, simply run it like
1935 this:
1936
1937 <p><pre>
1938 syslog-trusted-timestamp /path/to/list-of-log-files
1939 </pre></p>
1940
1941 <p>This will send a timestamp from one or more timestamp services (not
1942 yet decided nor implemented) for each listed file to the syslog using
1943 logger(1).  To verify the timestamp, the same program is used with the
1944 --verify option:</p>
1945
1946 <p><pre>
1947 syslog-trusted-timestamp --verify /path/to/log-file /path/to/log-with-timestamp
1948 </pre></p>
1949
1950 <p>The verification step is not yet well designed.  The current
1951 implementation depend on the file path being unique and unchanging,
1952 and this is not a solid assumption.  It also uses process number as
1953 timestamp ID, and this is bound to create ID collisions.  I hope to
1954 have time to come up with a better way to handle timestamp IDs and
1955 verification later.</p>
1956
1957 <p>Please check out
1958 <a href="https://github.com/petterreinholdtsen/syslog-trusted-timestamp">the
1959 prototype for syslog-trusted-timestamp on github</a> and send
1960 suggestions and improvement, or let me know if there already exist a
1961 similar system for timestamping logs already to allow me to join
1962 forces with others with the same interest.</p>
1963
1964 <p>As usual, if you use Bitcoin and want to show your support of my
1965 activities, please send Bitcoin donations to my address
1966 <b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
1967
1968       </div>
1969       <div class="tags">
1970
1971
1972         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
1973
1974
1975       </div>
1976     </div>
1977     <div class="padding"></div>
1978
1979     <div class="entry">
1980       <div class="title">
1981         <a href="https://people.skolelinux.org/pere/blog/Always_download_Debian_packages_using_Tor___the_simple_recipe.html">Always download Debian packages using Tor - the simple recipe</a>
1982       </div>
1983       <div class="date">
1984         15th January 2016
1985       </div>
1986       <div class="body">
1987         <p>During his DebConf15 keynote, Jacob Appelbaum
1988 <a href="https://summit.debconf.org/debconf15/meeting/331/what-is-to-be-done/">observed
1989 that those listening on the Internet lines would have good reason to
1990 believe a computer have a given security hole</a> if it download a
1991 security fix from a Debian mirror.  This is a good reason to always
1992 use encrypted connections to the Debian mirror, to make sure those
1993 listening do not know which IP address to attack.  In August, Richard
1994 Hartmann observed that encryption was not enough, when it was possible
1995 to interfere download size to security patches or the fact that
1996 download took place shortly after a security fix was released, and
1997 <a href="http://richardhartmann.de/blog/posts/2015/08/24-Tor-enabled_Debian_mirror/">proposed
1998 to always use Tor to download packages from the Debian mirror</a>.  He
1999 was not the first to propose this, as the
2000 <tt><a href="https://tracker.debian.org/pkg/apt-transport-tor">apt-transport-tor</a></tt>
2001 package by Tim Retout already existed to make it easy to convince apt
2002 to use <a href="https://www.torproject.org/">Tor</a>, but I was not
2003 aware of that package when I read the blog post from Richard.</p>
2004
2005 <p>Richard discussed the idea with Peter Palfrader, one of the Debian
2006 sysadmins, and he set up a Tor hidden service on one of the central
2007 Debian mirrors using the address vwakviie2ienjx6t.onion, thus making
2008 it possible to download packages directly between two tor nodes,
2009 making sure the network traffic always were encrypted.</p>
2010
2011 <p>Here is a short recipe for enabling this on your machine, by
2012 installing <tt>apt-transport-tor</tt> and replacing http and https
2013 urls with tor+http and tor+https, and using the hidden service instead
2014 of the official Debian mirror site.  I recommend installing
2015 <tt>etckeeper</tt> before you start to have a history of the changes
2016 done in /etc/.</p>
2017
2018 <blockquote><pre>
2019 apt install apt-transport-tor
2020 sed -i 's% http://ftp.debian.org/% tor+http://vwakviie2ienjx6t.onion/%' /etc/apt/sources.list
2021 sed -i 's% http% tor+http%' /etc/apt/sources.list
2022 </pre></blockquote>
2023
2024 <p>If you have more sources listed in /etc/apt/sources.list.d/, run
2025 the sed commands for these too.  The sed command is assuming your are
2026 using the ftp.debian.org Debian mirror.  Adjust the command (or just
2027 edit the file manually) to match your mirror.</p>
2028
2029 <p>This work in Debian Jessie and later.  Note that tools like
2030 <tt>apt-file</tt> only recently started using the apt transport
2031 system, and do not work with these tor+http URLs.  For
2032 <tt>apt-file</tt> you need the version currently in experimental,
2033 which need a recent apt version currently only in unstable.  So if you
2034 need a working <tt>apt-file</tt>, this is not for you.</p>
2035
2036 <p>Another advantage from this change is that your machine will start
2037 using Tor regularly and at fairly random intervals (every time you
2038 update the package lists or upgrade or install a new package), thus
2039 masking other Tor traffic done from the same machine.  Using Tor will
2040 become normal for the machine in question.</p>
2041
2042 <p>On <a href="https://wiki.debian.org/FreedomBox">Freedombox</a>, APT
2043 is set up by default to use <tt>apt-transport-tor</tt> when Tor is
2044 enabled.  It would be great if it was the default on any Debian
2045 system.</p>
2046
2047       </div>
2048       <div class="tags">
2049
2050
2051         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
2052
2053
2054       </div>
2055     </div>
2056     <div class="padding"></div>
2057
2058     <div class="entry">
2059       <div class="title">
2060         <a href="https://people.skolelinux.org/pere/blog/PGP_key_transition_statement_for_key_EE4E02F9.html">PGP key transition statement for key EE4E02F9</a>
2061       </div>
2062       <div class="date">
2063         17th November 2015
2064       </div>
2065       <div class="body">
2066         <p>I've needed a new OpenPGP key for a while, but have not had time to
2067 set it up properly.  I wanted to generate it offline and have it
2068 available on <a href="http://shop.kernelconcepts.de/#openpgp">a OpenPGP
2069 smart card</a> for daily use, and learning how to do it and finding
2070 time to sit down with an offline machine almost took forever.  But
2071 finally I've been able to complete the process, and have now moved
2072 from my old GPG key to a new GPG key.  See
2073 <a href="http://people.skolelinux.org/pere/blog/images/2015-11-17-new-gpg-key-transition.txt">the
2074 full transition statement, signed with both my old and new key</a> for
2075 the details.  This is my new key:</p>
2076
2077 <pre>
2078 pub   3936R/<a href="http://pgp.cs.uu.nl/stats/111D6B29EE4E02F9.html">111D6B29EE4E02F9</a> 2015-11-03 [expires: 2019-11-14]
2079       Key fingerprint = 3AC7 B2E3 ACA5 DF87 78F1  D827 111D 6B29 EE4E 02F9
2080 uid                  Petter Reinholdtsen &lt;pere@hungry.com&gt;
2081 uid                  Petter Reinholdtsen &lt;pere@debian.org&gt;
2082 sub   4096R/87BAFB0E 2015-11-03 [expires: 2019-11-02]
2083 sub   4096R/F91E6DE9 2015-11-03 [expires: 2019-11-02]
2084 sub   4096R/A0439BAB 2015-11-03 [expires: 2019-11-02]
2085 </pre>
2086
2087 <p>The key can be downloaded from the OpenPGP key servers, signed by
2088 my old key.</p>
2089
2090 <p>If you signed my old key
2091 (<a href="http://pgp.cs.uu.nl/stats/DB4CCC4B2A30D729.html">DB4CCC4B2A30D729</a>),
2092 I'd very much appreciate a signature on my new key, details and
2093 instructions in the transition statement. I m happy to reciprocate if
2094 you have a similarly signed transition statement to present.</p>
2095
2096       </div>
2097       <div class="tags">
2098
2099
2100         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
2101
2102
2103       </div>
2104     </div>
2105     <div class="padding"></div>
2106
2107     <div class="entry">
2108       <div class="title">
2109         <a href="https://people.skolelinux.org/pere/blog/Lawrence_Lessig_interviewed_Edward_Snowden_a_year_ago.html">Lawrence Lessig interviewed Edward Snowden a year ago</a>
2110       </div>
2111       <div class="date">
2112         19th October 2015
2113       </div>
2114       <div class="body">
2115         <p>Last year, <a href="https://lessig2016.us/">US president candidate
2116 in the Democratic Party</a> Lawrence interviewed Edward Snowden.  The
2117 one hour interview was
2118 <a href="https://www.youtube.com/watch?v=o_Sr96TFQQE">published by
2119 Harvard Law School 2014-10-23 on Youtube</a>, and the meeting took
2120 place 2014-10-20.</p>
2121
2122 <p>The questions are very good, and there is lots of useful
2123 information to be learned and very interesting issues to think about
2124 being raised.  Please check it out.</p>
2125
2126 <iframe width="560" height="315" src="https://www.youtube.com/embed/o_Sr96TFQQE" frameborder="0" allowfullscreen></iframe>
2127
2128 <p>I find it especially interesting to hear again that Snowden did try
2129 to bring up his reservations through the official channels without any
2130 luck.  It is in sharp contrast to the answers made 2013-11-06 by the
2131 Norwegian prime minister Erna Solberg to the Norwegian Parliament,
2132 <a href="https://tale.holderdeord.no/speeches/s131106/68">claiming
2133 Snowden is no Whistle-Blower</a> because he should have taken up his
2134 concerns internally and using official channels.  It make me sad
2135 that this is the political leadership we have here in Norway.</p>
2136
2137       </div>
2138       <div class="tags">
2139
2140
2141         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
2142
2143
2144       </div>
2145     </div>
2146     <div class="padding"></div>
2147
2148     <div class="entry">
2149       <div class="title">
2150         <a href="https://people.skolelinux.org/pere/blog/Alle_Stortingets_mobiltelefoner_kontrolleres_fra_USA___.html">Alle Stortingets mobiltelefoner kontrolleres fra USA...</a>
2151       </div>
2152       <div class="date">
2153          7th October 2015
2154       </div>
2155       <div class="body">
2156         <p>Jeg lot meg fascinere av
2157 <a href="http://www.aftenposten.no/nyheter/iriks/politikk/Stortinget-har-tilgang-til-a-fjernstyre-600-mobiler-8192692.html">en
2158 artikkel i Aftenposten</a> der det fortelles at «over 600 telefoner som
2159 benyttes av stortingsrepresentanter, rådgivere og ansatte på
2160 Stortinget, kan «fjernstyres» ved hjelp av
2161 <a href="https://play.google.com/store/apps/details?id=com.airwatch.androidagent">programvaren
2162 Airwatch</a>, et såkalte MDM-program (Mobile Device Managment)».  Det
2163 hele bagatelliseres av Stortingets IT-stab, men det er i hovedsak på
2164 grunn av at journalisten ikke stiller de relevante spørsmålene.  For
2165 meg er det relevante spørsmålet hvem som har lovlig tilgang (i henhold
2166 til lokal lovgiving, dvs. i hvert fall i Norge, Sverige, UK og USA)
2167 til informasjon om og på telefonene, og hvor enkelt det er å skaffe
2168 seg tilgang til hvor mobilene befinner seg og informasjon som befinner
2169 seg på telefonene ved hjelp av utro tjenere, trusler, innbrudd og
2170 andre ulovlige metoder.</p>
2171
2172 <p>Bruken av AirWatch betyr i realiteten at USAs etteretning og
2173 politimyndigheter har full tilgang til stortingets mobiltelefoner,
2174 inkludert posisjon og innhold, takket være
2175 <a href="https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act_of_1978_Amendments_Act_of_2008">FISAAA-loven</a>
2176 og
2177 "<a href="https://en.wikipedia.org/wiki/National_security_letter">National
2178 Security Letters</a>" og det enkle faktum at selskapet
2179 <a href="http://www.airwatch.com/">AirWatch</a> er kontrollert av et
2180 selskap i USA.  I tillegg er det kjent at flere lands
2181 etterretningstjenester kan lytte på trafikken når den passerer
2182 landegrensene.</p>
2183
2184 <p>Jeg har bedt om mer informasjon
2185 <a href="https://www.mimesbronn.no/request/saksnummer_for_saker_anganede_br">fra
2186 Stortinget om bruken av AirWatch</a> via Mimes brønn så får vi se hva
2187 de har å fortelle om saken.  Fant ingenting om 'airwatch' i
2188 postjournalen til Stortinget, så jeg trenger hjelp før jeg kan be om
2189 innsyn i konkrete dokumenter.</p>
2190
2191 <p>Oppdatering 2015-10-07: Jeg er blitt spurt hvorfor jeg antar at
2192 AirWatch-agenten rapporterer til USA og ikke direkte til Stortingets
2193 egen infrastruktur.  Det stemmer at det er teknisk mulig å sette
2194 opp mobiltelefonene til å rapportere til datamaskiner som eies av
2195 Stortinget.  Jeg antar det rapporteres til AirWatch sine sentrale
2196 tjenester basert på det jeg leste fra beskrivelsen av
2197 <a href="http://www.airwatch.com/solutions/mobile-device-management/">Mobile
2198 Device Management</A> på AirWatch sine egne nettsider, koblet med at
2199 det brukes en standard app som kan hentes fra "app-butikkene" for å få
2200 tilgang.  Enten må app-en settes opp individuelt hos Stortinget, eller
2201 så får den beskjed fra AirWatch i USA om hvor den skal koble seg opp.
2202 I det første tilfellet vil den ikke rapportere direkte til USA, men
2203 til programvare utviklet av AirWatch som kjører på en maskin under
2204 Stortingets kontroll.  Det er litt bedre, men fortsatt vil det være
2205 umulig for Stortinget å være sikker på hva programvaren som tar imot
2206 forbindelser gjør.  Jeg ser fra beskrivelsen av
2207 <a href="http://www.airwatch.com/differentiators/enterprise-integration/">Enterprice
2208 Integration</a> hos AirWatch at det er mulig å ha lokal installasjon,
2209 og håper innsynsforespørsler mot Stortinget kan fortelle mer om
2210 hvordan ting konkret fungerer der.</p>
2211
2212       </div>
2213       <div class="tags">
2214
2215
2216         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/stortinget">stortinget</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
2217
2218
2219       </div>
2220     </div>
2221     <div class="padding"></div>
2222
2223     <div class="entry">
2224       <div class="title">
2225         <a href="https://people.skolelinux.org/pere/blog/Good_bye_subkeys_pgp_net__welcome_pool_sks_keyservers_net.html">Good bye subkeys.pgp.net, welcome pool.sks-keyservers.net</a>
2226       </div>
2227       <div class="date">
2228         10th September 2014
2229       </div>
2230       <div class="body">
2231         <p>Yesterday, I had the pleasure of attending a talk with the
2232 <a href="http://www.nuug.no/">Norwegian Unix User Group</a> about
2233 <a href="http://www.nuug.no/aktiviteter/20140909-sks-keyservers/">the
2234 OpenPGP keyserver pool sks-keyservers.net</a>, and was very happy to
2235 learn that there is a large set of publicly available key servers to
2236 use when looking for peoples public key.  So far I have used
2237 subkeys.pgp.net, and some times wwwkeys.nl.pgp.net when the former
2238 were misbehaving, but those days are ended.  The servers I have used
2239 up until yesterday have been slow and some times unavailable.  I hope
2240 those problems are gone now.</p>
2241
2242 <p>Behind the round robin DNS entry of the
2243 <a href="https://sks-keyservers.net/">sks-keyservers.net</a> service
2244 there is a pool of more than 100 keyservers which are checked every
2245 day to ensure they are well connected and up to date.  It must be
2246 better than what I have used so far. :)</p>
2247
2248 <p>Yesterdays speaker told me that the service is the default
2249 keyserver provided by the default configuration in GnuPG, but this do
2250 not seem to be used in Debian.  Perhaps it should?</p>
2251
2252 <p>Anyway, I've updated my ~/.gnupg/options file to now include this
2253 line:</p>
2254
2255 <p><blockquote><pre>
2256 keyserver pool.sks-keyservers.net
2257 </pre></blockquote></p>
2258
2259 <p>With GnuPG version 2 one can also locate the keyserver using SRV
2260 entries in DNS.  Just for fun, I did just that at work, so now every
2261 user of GnuPG at the University of Oslo should find a OpenGPG
2262 keyserver automatically should their need it:</p>
2263
2264 <p><blockquote><pre>
2265 % host -t srv _pgpkey-http._tcp.uio.no
2266 _pgpkey-http._tcp.uio.no has SRV record 0 100 11371 pool.sks-keyservers.net.
2267 %
2268 </pre></blockquote></p>
2269
2270 <p>Now if only
2271 <a href="http://ietfreport.isoc.org/idref/draft-shaw-openpgp-hkp/">the
2272 HKP lookup protocol</a> supported finding signature paths, I would be
2273 very happy.  It can look up a given key or search for a user ID, but I
2274 normally do not want that, but to find a trust path from my key to
2275 another key.  Given a user ID or key ID, I would like to find (and
2276 download) the keys representing a signature path from my key to the
2277 key in question, to be able to get a trust path between the two keys.
2278 This is as far as I can tell not possible today.  Perhaps something
2279 for a future version of the protocol?</p>
2280
2281       </div>
2282       <div class="tags">
2283
2284
2285         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
2286
2287
2288       </div>
2289     </div>
2290     <div class="padding"></div>
2291
2292     <div class="entry">
2293       <div class="title">
2294         <a href="https://people.skolelinux.org/pere/blog/FreedomBox_milestone___all_packages_now_in_Debian_Sid.html">FreedomBox milestone - all packages now in Debian Sid</a>
2295       </div>
2296       <div class="date">
2297         15th April 2014
2298       </div>
2299       <div class="body">
2300         <p>The <a href="https://wiki.debian.org/FreedomBox">Freedombox
2301 project</a> is working on providing the software and hardware to make
2302 it easy for non-technical people to host their data and communication
2303 at home, and being able to communicate with their friends and family
2304 encrypted and away from prying eyes.  It is still going strong, and
2305 today a major mile stone was reached.</p>
2306
2307 <p>Today, the last of the packages currently used by the project to
2308 created the system images were accepted into Debian Unstable.  It was
2309 the freedombox-setup package, which is used to configure the images
2310 during build and on the first boot.  Now all one need to get going is
2311 the build code from the freedom-maker git repository and packages from
2312 Debian.  And once the freedombox-setup package enter testing, we can
2313 build everything directly from Debian. :)</p>
2314
2315 <p>Some key packages used by Freedombox are
2316 <a href="http://packages.qa.debian.org/freedombox-setup">freedombox-setup</a>,
2317 <a href="http://packages.qa.debian.org/plinth">plinth</a>,
2318 <a href="http://packages.qa.debian.org/pagekite">pagekite</a>,
2319 <a href="http://packages.qa.debian.org/tor">tor</a>,
2320 <a href="http://packages.qa.debian.org/privoxy">privoxy</a>,
2321 <a href="http://packages.qa.debian.org/owncloud">owncloud</a> and
2322 <a href="http://packages.qa.debian.org/dnsmasq">dnsmasq</a>.  There
2323 are plans to integrate more packages into the setup.  User
2324 documentation is maintained on the Debian wiki.  Please
2325 <a href="https://wiki.debian.org/FreedomBox/Manual/Jessie">check out
2326 the manual</a> and help us improve it.</p>
2327
2328 <p>To test for yourself and create boot images with the FreedomBox
2329 setup, run this on a Debian machine using a user with sudo rights to
2330 become root:</p>
2331
2332 <p><pre>
2333 sudo apt-get install git vmdebootstrap mercurial python-docutils \
2334   mktorrent extlinux virtualbox qemu-user-static binfmt-support \
2335   u-boot-tools
2336 git clone http://anonscm.debian.org/git/freedombox/freedom-maker.git \
2337   freedom-maker
2338 make -C freedom-maker dreamplug-image raspberry-image virtualbox-image
2339 </pre></p>
2340
2341 <p>Root access is needed to run debootstrap and mount loopback
2342 devices.  See the README in the freedom-maker git repo for more
2343 details on the build.  If you do not want all three images, trim the
2344 make line.  Note that the virtualbox-image target is not really
2345 virtualbox specific.  It create a x86 image usable in kvm, qemu,
2346 vmware and any other x86 virtual machine environment.  You might need
2347 the version of vmdebootstrap in Jessie to get the build working, as it
2348 include fixes for a race condition with kpartx.</p>
2349
2350 <p>If you instead want to install using a Debian CD and the preseed
2351 method, boot a Debian Wheezy ISO and use this boot argument to load
2352 the preseed values:</p>
2353
2354 <p><pre>
2355 url=<a href="http://www.reinholdtsen.name/freedombox/preseed-jessie.dat">http://www.reinholdtsen.name/freedombox/preseed-jessie.dat</a>
2356 </pre></p>
2357
2358 <p>I have not tested it myself the last few weeks, so I do not know if
2359 it still work.</p>
2360
2361 <p>If you wonder how to help, one task you could look at is using
2362 systemd as the boot system.  It will become the default for Linux in
2363 Jessie, so we need to make sure it is usable on the Freedombox.  I did
2364 a simple test a few weeks ago, and noticed dnsmasq failed to start
2365 during boot when using systemd.  I suspect there are other problems
2366 too. :) To detect problems, there is a test suite included, which can
2367 be run from the plinth web interface.</p>
2368
2369 <p>Give it a go and let us know how it goes on the mailing list, and help
2370 us get the new release published. :) Please join us on
2371 <a href="irc://irc.debian.org:6667/%23freedombox">IRC (#freedombox on
2372 irc.debian.org)</a> and
2373 <a href="http://lists.alioth.debian.org/mailman/listinfo/freedombox-discuss">the
2374 mailing list</a> if you want to help make this vision come true.</p>
2375
2376       </div>
2377       <div class="tags">
2378
2379
2380         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/freedombox">freedombox</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>, <a href="https://people.skolelinux.org/pere/blog/tags/web">web</a>.
2381
2382
2383       </div>
2384     </div>
2385     <div class="padding"></div>
2386
2387     <div class="entry">
2388       <div class="title">
2389         <a href="https://people.skolelinux.org/pere/blog/S3QL__a_locally_mounted_cloud_file_system___nice_free_software.html">S3QL, a locally mounted cloud file system - nice free software</a>
2390       </div>
2391       <div class="date">
2392          9th April 2014
2393       </div>
2394       <div class="body">
2395         <p>For a while now, I have been looking for a sensible offsite backup
2396 solution for use at home.  My requirements are simple, it must be
2397 cheap and locally encrypted (in other words, I keep the encryption
2398 keys, the storage provider do not have access to my private files).
2399 One idea me and my friends had many years ago, before the cloud
2400 storage providers showed up, was to use Google mail as storage,
2401 writing a Linux block device storing blocks as emails in the mail
2402 service provided by Google, and thus get heaps of free space.  On top
2403 of this one can add encryption, RAID and volume management to have
2404 lots of (fairly slow, I admit that) cheap and encrypted storage.  But
2405 I never found time to implement such system.  But the last few weeks I
2406 have looked at a system called
2407 <a href="https://bitbucket.org/nikratio/s3ql/">S3QL</a>, a locally
2408 mounted network backed file system with the features I need.</p>
2409
2410 <p>S3QL is a fuse file system with a local cache and cloud storage,
2411 handling several different storage providers, any with Amazon S3,
2412 Google Drive or OpenStack API.  There are heaps of such storage
2413 providers.  S3QL can also use a local directory as storage, which
2414 combined with sshfs allow for file storage on any ssh server.  S3QL
2415 include support for encryption, compression, de-duplication, snapshots
2416 and immutable file systems, allowing me to mount the remote storage as
2417 a local mount point, look at and use the files as if they were local,
2418 while the content is stored in the cloud as well.  This allow me to
2419 have a backup that should survive fire.  The file system can not be
2420 shared between several machines at the same time, as only one can
2421 mount it at the time, but any machine with the encryption key and
2422 access to the storage service can mount it if it is unmounted.</p>
2423
2424 <p>It is simple to use.  I'm using it on Debian Wheezy, where the
2425 package is included already.  So to get started, run <tt>apt-get
2426 install s3ql</tt>.  Next, pick a storage provider.  I ended up picking
2427 Greenqloud, after reading their nice recipe on
2428 <a href="https://greenqloud.zendesk.com/entries/44611757-How-To-Use-S3QL-to-mount-a-StorageQloud-bucket-on-Debian-Wheezy">how
2429 to use S3QL with their Amazon S3 service</a>, because I trust the laws
2430 in Iceland more than those in USA when it come to keeping my personal
2431 data safe and private, and thus would rather spend money on a company
2432 in Iceland.  Another nice recipe is available from the article
2433 <a href="http://www.admin-magazine.com/HPC/Articles/HPC-Cloud-Storage">S3QL
2434 Filesystem for HPC Storage</a> by Jeff Layton in the HPC section of
2435 Admin magazine.  When the provider is picked, figure out how to get
2436 the API key needed to connect to the storage API.  With Greencloud,
2437 the key did not show up until I had added payment details to my
2438 account.</p>
2439
2440 <p>Armed with the API access details, it is time to create the file
2441 system.  First, create a new bucket in the cloud.  This bucket is the
2442 file system storage area.  I picked a bucket name reflecting the
2443 machine that was going to store data there, but any name will do.
2444 I'll refer to it as <tt>bucket-name</tt> below.  In addition, one need
2445 the API login and password, and a locally created password.  Store it
2446 all in ~root/.s3ql/authinfo2 like this:
2447
2448 <p><blockquote><pre>
2449 [s3c]
2450 storage-url: s3c://s.greenqloud.com:443/bucket-name
2451 backend-login: API-login
2452 backend-password: API-password
2453 fs-passphrase: local-password
2454 </pre></blockquote></p>
2455
2456 <p>I create my local passphrase using <tt>pwget 50</tt> or similar,
2457 but any sensible way to create a fairly random password should do it.
2458 Armed with these details, it is now time to run mkfs, entering the API
2459 details and password to create it:</p>
2460
2461 <p><blockquote><pre>
2462 # mkdir -m 700 /var/lib/s3ql-cache
2463 # mkfs.s3ql --cachedir /var/lib/s3ql-cache --authfile /root/.s3ql/authinfo2 \
2464   --ssl s3c://s.greenqloud.com:443/bucket-name
2465 Enter backend login:
2466 Enter backend password:
2467 Before using S3QL, make sure to read the user's guide, especially
2468 the 'Important Rules to Avoid Loosing Data' section.
2469 Enter encryption password:
2470 Confirm encryption password:
2471 Generating random encryption key...
2472 Creating metadata tables...
2473 Dumping metadata...
2474 ..objects..
2475 ..blocks..
2476 ..inodes..
2477 ..inode_blocks..
2478 ..symlink_targets..
2479 ..names..
2480 ..contents..
2481 ..ext_attributes..
2482 Compressing and uploading metadata...
2483 Wrote 0.00 MB of compressed metadata.
2484 # </pre></blockquote></p>
2485
2486 <p>The next step is mounting the file system to make the storage available.
2487
2488 <p><blockquote><pre>
2489 # mount.s3ql --cachedir /var/lib/s3ql-cache --authfile /root/.s3ql/authinfo2 \
2490   --ssl --allow-root s3c://s.greenqloud.com:443/bucket-name /s3ql
2491 Using 4 upload threads.
2492 Downloading and decompressing metadata...
2493 Reading metadata...
2494 ..objects..
2495 ..blocks..
2496 ..inodes..
2497 ..inode_blocks..
2498 ..symlink_targets..
2499 ..names..
2500 ..contents..
2501 ..ext_attributes..
2502 Mounting filesystem...
2503 # df -h /s3ql
2504 Filesystem                              Size  Used Avail Use% Mounted on
2505 s3c://s.greenqloud.com:443/bucket-name  1.0T     0  1.0T   0% /s3ql
2506 #
2507 </pre></blockquote></p>
2508
2509 <p>The file system is now ready for use.  I use rsync to store my
2510 backups in it, and as the metadata used by rsync is downloaded at
2511 mount time, no network traffic (and storage cost) is triggered by
2512 running rsync.  To unmount, one should not use the normal umount
2513 command, as this will not flush the cache to the cloud storage, but
2514 instead running the umount.s3ql command like this:
2515
2516 <p><blockquote><pre>
2517 # umount.s3ql /s3ql
2518 #
2519 </pre></blockquote></p>
2520
2521 <p>There is a fsck command available to check the file system and
2522 correct any problems detected.  This can be used if the local server
2523 crashes while the file system is mounted, to reset the "already
2524 mounted" flag.  This is what it look like when processing a working
2525 file system:</p>
2526
2527 <p><blockquote><pre>
2528 # fsck.s3ql --force --ssl s3c://s.greenqloud.com:443/bucket-name
2529 Using cached metadata.
2530 File system seems clean, checking anyway.
2531 Checking DB integrity...
2532 Creating temporary extra indices...
2533 Checking lost+found...
2534 Checking cached objects...
2535 Checking names (refcounts)...
2536 Checking contents (names)...
2537 Checking contents (inodes)...
2538 Checking contents (parent inodes)...
2539 Checking objects (reference counts)...
2540 Checking objects (backend)...
2541 ..processed 5000 objects so far..
2542 ..processed 10000 objects so far..
2543 ..processed 15000 objects so far..
2544 Checking objects (sizes)...
2545 Checking blocks (referenced objects)...
2546 Checking blocks (refcounts)...
2547 Checking inode-block mapping (blocks)...
2548 Checking inode-block mapping (inodes)...
2549 Checking inodes (refcounts)...
2550 Checking inodes (sizes)...
2551 Checking extended attributes (names)...
2552 Checking extended attributes (inodes)...
2553 Checking symlinks (inodes)...
2554 Checking directory reachability...
2555 Checking unix conventions...
2556 Checking referential integrity...
2557 Dropping temporary indices...
2558 Backing up old metadata...
2559 Dumping metadata...
2560 ..objects..
2561 ..blocks..
2562 ..inodes..
2563 ..inode_blocks..
2564 ..symlink_targets..
2565 ..names..
2566 ..contents..
2567 ..ext_attributes..
2568 Compressing and uploading metadata...
2569 Wrote 0.89 MB of compressed metadata.
2570 #
2571 </pre></blockquote></p>
2572
2573 <p>Thanks to the cache, working on files that fit in the cache is very
2574 quick, about the same speed as local file access.  Uploading large
2575 amount of data is to me limited by the bandwidth out of and into my
2576 house.  Uploading 685 MiB with a 100 MiB cache gave me 305 kiB/s,
2577 which is very close to my upload speed, and downloading the same
2578 Debian installation ISO gave me 610 kiB/s, close to my download speed.
2579 Both were measured using <tt>dd</tt>.  So for me, the bottleneck is my
2580 network, not the file system code.  I do not know what a good cache
2581 size would be, but suspect that the cache should e larger than your
2582 working set.</p>
2583
2584 <p>I mentioned that only one machine can mount the file system at the
2585 time.  If another machine try, it is told that the file system is
2586 busy:</p>
2587
2588 <p><blockquote><pre>
2589 # mount.s3ql --cachedir /var/lib/s3ql-cache --authfile /root/.s3ql/authinfo2 \
2590   --ssl --allow-root s3c://s.greenqloud.com:443/bucket-name /s3ql
2591 Using 8 upload threads.
2592 Backend reports that fs is still mounted elsewhere, aborting.
2593 #
2594 </pre></blockquote></p>
2595
2596 <p>The file content is uploaded when the cache is full, while the
2597 metadata is uploaded once every 24 hour by default.  To ensure the
2598 file system content is flushed to the cloud, one can either umount the
2599 file system, or ask S3QL to flush the cache and metadata using
2600 s3qlctrl:
2601
2602 <p><blockquote><pre>
2603 # s3qlctrl upload-meta /s3ql
2604 # s3qlctrl flushcache /s3ql
2605 #
2606 </pre></blockquote></p>
2607
2608 <p>If you are curious about how much space your data uses in the
2609 cloud, and how much compression and deduplication cut down on the
2610 storage usage, you can use s3qlstat on the mounted file system to get
2611 a report:</p>
2612
2613 <p><blockquote><pre>
2614 # s3qlstat /s3ql
2615 Directory entries:    9141
2616 Inodes:               9143
2617 Data blocks:          8851
2618 Total data size:      22049.38 MB
2619 After de-duplication: 21955.46 MB (99.57% of total)
2620 After compression:    21877.28 MB (99.22% of total, 99.64% of de-duplicated)
2621 Database size:        2.39 MB (uncompressed)
2622 (some values do not take into account not-yet-uploaded dirty blocks in cache)
2623 #
2624 </pre></blockquote></p>
2625
2626 <p>I mentioned earlier that there are several possible suppliers of
2627 storage.  I did not try to locate them all, but am aware of at least
2628 <a href="https://www.greenqloud.com/">Greenqloud</a>,
2629 <a href="http://drive.google.com/">Google Drive</a>,
2630 <a href="http://aws.amazon.com/s3/">Amazon S3 web serivces</a>,
2631 <a href="http://www.rackspace.com/">Rackspace</a> and
2632 <a href="http://crowncloud.net/">Crowncloud</A>.  The latter even
2633 accept payment in Bitcoin.  Pick one that suit your need.  Some of
2634 them provide several GiB of free storage, but the prize models are
2635 quite different and you will have to figure out what suits you
2636 best.</p>
2637
2638 <p>While researching this blog post, I had a look at research papers
2639 and posters discussing the S3QL file system.  There are several, which
2640 told me that the file system is getting a critical check by the
2641 science community and increased my confidence in using it.  One nice
2642 poster is titled
2643 "<a href="http://www.lanl.gov/orgs/adtsc/publications/science_highlights_2013/docs/pg68_69.pdf">An
2644 Innovative Parallel Cloud Storage System using OpenStack’s SwiftObject
2645 Store and Transformative Parallel I/O Approach</a>" by Hsing-Bung
2646 Chen, Benjamin McClelland, David Sherrill, Alfred Torrez, Parks Fields
2647 and Pamela Smith.  Please  have a look.</p>
2648
2649 <p>Given my problems with different file systems earlier, I decided to
2650 check out the mounted S3QL file system to see if it would be usable as
2651 a home directory (in other word, that it provided POSIX semantics when
2652 it come to locking and umask handling etc).  Running
2653 <a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">my
2654 test code to check file system semantics</a>, I was happy to discover that
2655 no error was found.  So the file system can be used for home
2656 directories, if one chooses to do so.</p>
2657
2658 <p>If you do not want a locally file system, and want something that
2659 work without the Linux fuse file system, I would like to mention the
2660 <a href="http://www.tarsnap.com/">Tarsnap service</a>, which also
2661 provide locally encrypted backup using a command line client.  It have
2662 a nicer access control system, where one can split out read and write
2663 access, allowing some systems to write to the backup and others to
2664 only read from it.</p>
2665
2666 <p>As usual, if you use Bitcoin and want to show your support of my
2667 activities, please send Bitcoin donations to my address
2668 <b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
2669
2670       </div>
2671       <div class="tags">
2672
2673
2674         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nice free software">nice free software</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
2675
2676
2677       </div>
2678     </div>
2679     <div class="padding"></div>
2680
2681     <div class="entry">
2682       <div class="title">
2683         <a href="https://people.skolelinux.org/pere/blog/EU_domstolen_bekreftet_i_dag_at_datalagringsdirektivet_er_ulovlig.html">EU-domstolen bekreftet i dag at datalagringsdirektivet er ulovlig</a>
2684       </div>
2685       <div class="date">
2686          8th April 2014
2687       </div>
2688       <div class="body">
2689         <p>I dag kom endelig avgjørelsen fra EU-domstolen om
2690 datalagringsdirektivet, som ikke overraskende ble dømt ulovlig og i
2691 strid med borgernes grunnleggende rettigheter.  Hvis du lurer på hva
2692 datalagringsdirektivet er for noe, så er det
2693 <a href="http://tv.nrk.no/program/koid75005313/tema-dine-digitale-spor-datalagringsdirektivet">en
2694 flott dokumentar tilgjengelig hos NRK</a> som jeg tidligere
2695 <a href="http://people.skolelinux.org/pere/blog/Dokumentaren_om_Datalagringsdirektivet_sendes_endelig_p__NRK.html">har
2696 anbefalt</a> alle å se.</p>
2697
2698 <p>Her er et liten knippe nyhetsoppslag om saken, og jeg regner med at
2699 det kommer flere ut over dagen.  Flere kan finnes
2700 <a href="http://www.mylder.no/?drill=datalagringsdirektivet&intern=1">via
2701 mylder</a>.</p>
2702
2703 <p><ul>
2704
2705 <li><a href="http://e24.no/digital/eu-domstolen-datalagringsdirektivet-er-ugyldig/22879592">EU-domstolen:
2706 Datalagringsdirektivet er ugyldig</a> - e24.no 2014-04-08
2707
2708 <li><a href="http://www.aftenposten.no/nyheter/iriks/EU-domstolen-Datalagringsdirektivet-er-ulovlig-7529032.html">EU-domstolen:
2709 Datalagringsdirektivet er ulovlig</a> - aftenposten.no 2014-04-08
2710
2711 <li><a href="http://www.aftenposten.no/nyheter/iriks/politikk/Krever-DLD-stopp-i-Norge-7530086.html">Krever
2712 DLD-stopp i Norge</a> - aftenposten.no 2014-04-08
2713
2714 <li><a href="http://www.p4.no/story.aspx?id=566431">Apenes: - En
2715 gledens dag</a> - p4.no 2014-04-08
2716
2717 <li><a href="http://www.nrk.no/norge/_-datalagringsdirektivet-er-ugyldig-1.11655929">EU-domstolen:
2718 – Datalagringsdirektivet er ugyldig</a> - nrk.no 2014-04-08</li>
2719
2720 <li><a href="http://www.vg.no/nyheter/utenriks/data-og-nett/eu-domstolen-datalagringsdirektivet-er-ugyldig/a/10130280/">EU-domstolen:
2721 Datalagringsdirektivet er ugyldig</a> - vg.no 2014-04-08</li>
2722
2723 <li><a href="http://www.dagbladet.no/2014/04/08/nyheter/innenriks/datalagringsdirektivet/personvern/32711646/">-
2724 Vi bør skrote hele datalagringsdirektivet</a> - dagbladet.no
2725 2014-04-08</li>
2726
2727 <li><a href="http://www.digi.no/928137/eu-domstolen-dld-er-ugyldig">EU-domstolen:
2728 DLD er ugyldig</a> - digi.no 2014-04-08</li>
2729
2730 <li><a href="http://www.irishtimes.com/business/sectors/technology/european-court-declares-data-retention-directive-invalid-1.1754150">European
2731 court declares data retention directive invalid</a> - irishtimes.com
2732 2014-04-08</li>
2733
2734 <li><a href="http://www.reuters.com/article/2014/04/08/us-eu-data-ruling-idUSBREA370F020140408?feedType=RSS">EU
2735 court rules against requirement to keep data of telecom users</a> -
2736 reuters.com 2014-04-08</li>
2737
2738 </ul>
2739 </p>
2740
2741 <p>Jeg synes det er veldig fint at nok en stemme slår fast at
2742 totalitær overvåkning av befolkningen er uakseptabelt, men det er
2743 fortsatt like viktig å beskytte privatsfæren som før, da de
2744 teknologiske mulighetene fortsatt finnes og utnyttes, og jeg tror
2745 innsats i prosjekter som
2746 <a href="https://wiki.debian.org/FreedomBox">Freedombox</a> og
2747 <a href="http://www.dugnadsnett.no/">Dugnadsnett</a> er viktigere enn
2748 noen gang.</p>
2749
2750 <p><strong>Update 2014-04-08 12:10</strong>: Kronerullingen for å
2751 stoppe datalagringsdirektivet i Norge gjøres hos foreningen
2752 <a href="http://www.digitaltpersonvern.no/">Digitalt Personvern</a>,
2753 som har samlet inn 843 215,- så langt men trenger nok mye mer hvis
2754
2755 ikke Høyre og Arbeiderpartiet bytter mening i saken.  Det var
2756 <a href="http://www.holderdeord.no/parliament-issues/48650">kun
2757 partinene Høyre og Arbeiderpartiet</a> som stemte for
2758 Datalagringsdirektivet, og en av dem må bytte mening for at det skal
2759 bli flertall mot i Stortinget.  Se mer om saken
2760 <a href="http://www.holderdeord.no/issues/69-innfore-datalagringsdirektivet">Holder
2761 de ord</a>.</p>
2762
2763       </div>
2764       <div class="tags">
2765
2766
2767         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/dld">dld</a>, <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
2768
2769
2770       </div>
2771     </div>
2772     <div class="padding"></div>
2773
2774     <div class="entry">
2775       <div class="title">
2776         <a href="https://people.skolelinux.org/pere/blog/Dokumentaren_om_Datalagringsdirektivet_sendes_endelig_p__NRK.html">Dokumentaren om Datalagringsdirektivet sendes endelig på NRK</a>
2777       </div>
2778       <div class="date">
2779         26th March 2014
2780       </div>
2781       <div class="body">
2782         <p><a href="http://www.nuug.no/">Foreningen NUUG</a> melder i natt at
2783 NRK nå har bestemt seg for
2784 <a href="http://www.nuug.no/news/NRK_viser_filmen_om_Datalagringsdirektivet_f_rste_gang_2014_03_31.shtml">når
2785 den norske dokumentarfilmen om datalagringsdirektivet skal
2786 sendes</a> (se <a href="http://www.imdb.com/title/tt2832844/">IMDB</a>
2787 for detaljer om filmen) . Første visning blir på NRK2 mandag
2788 2014-03-31 kl. 19:50, og deretter visninger onsdag 2014-04-02
2789 kl. 12:30, fredag 2014-04-04 kl. 19:40 og søndag 2014-04-06 kl. 15:10.
2790 Jeg har sett dokumentaren, og jeg anbefaler enhver å se den selv.  Som
2791 oppvarming mens vi venter anbefaler jeg Bjørn Stærks kronikk i
2792 Aftenposten fra i går,
2793 <a href="http://www.aftenposten.no/meninger/kronikker/Autoritar-gjokunge-7514915.html">Autoritær
2794 gjøkunge</a>, der han gir en grei skisse av hvor ille det står til med
2795 retten til privatliv og beskyttelsen av demokrati i Norge og resten
2796 verden, og helt riktig slår fast at det er vi i databransjen som
2797 sitter med nøkkelen til å gjøre noe med dette.  Jeg har involvert meg
2798 i prosjektene <a href="http://www.dugnadsnett.no/">dugnadsnett.no</a>
2799 og <a href="https://wiki.debian.org/FreedomBox">FreedomBox</a> for å
2800 forsøke å gjøre litt selv for å bedre situasjonen, men det er mye
2801 hardt arbeid fra mange flere enn meg som gjenstår før vi kan sies å ha
2802 gjenopprettet balansen.</p>
2803
2804 <p>Jeg regner med at nettutgaven dukker opp på
2805 <a href="http://tv.nrk.no/program/koid75005313/tema-dine-digitale-spor-datalagringsdirektivet">NRKs
2806 side om filmen om datalagringsdirektivet</a> om fem dager.  Hold et
2807 øye med siden, og tips venner og slekt om at de også bør se den.</p>
2808
2809       </div>
2810       <div class="tags">
2811
2812
2813         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/dld">dld</a>, <a href="https://people.skolelinux.org/pere/blog/tags/freedombox">freedombox</a>, <a href="https://people.skolelinux.org/pere/blog/tags/mesh network">mesh network</a>, <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
2814
2815
2816       </div>
2817     </div>
2818     <div class="padding"></div>
2819
2820     <div class="entry">
2821       <div class="title">
2822         <a href="https://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html">Public Trusted Timestamping services for everyone</a>
2823       </div>
2824       <div class="date">
2825         25th March 2014
2826       </div>
2827       <div class="body">
2828         <p>Did you ever need to store logs or other files in a way that would
2829 allow it to be used as evidence in court, and needed a way to
2830 demonstrate without reasonable doubt that the file had not been
2831 changed since it was created?  Or, did you ever need to document that
2832 a given document was received at some point in time, like some
2833 archived document or the answer to an exam, and not changed after it
2834 was received?  The problem in these settings is to remove the need to
2835 trust yourself and your computers, while still being able to prove
2836 that a file is the same as it was at some given time in the past.</p>
2837
2838 <p>A solution to these problems is to have a trusted third party
2839 "stamp" the document and verify that at some given time the document
2840 looked a given way.  Such
2841 <a href="https://en.wikipedia.org/wiki/Notarius">notarius</a> service
2842 have been around for thousands of years, and its digital equivalent is
2843 called a
2844 <a href="http://en.wikipedia.org/wiki/Trusted_timestamping">trusted
2845 timestamping service</a>.  <a href="http://www.ietf.org/">The Internet
2846 Engineering Task Force</a> standardised how such service could work a
2847 few years ago as <a href="http://tools.ietf.org/html/rfc3161">RFC
2848 3161</a>.  The mechanism is simple.  Create a hash of the file in
2849 question, send it to a trusted third party which add a time stamp to
2850 the hash and sign the result with its private key, and send back the
2851 signed hash + timestamp.  Both email, FTP and HTTP can be used to
2852 request such signature, depending on what is provided by the service
2853 used. Anyone with the document and the signature can then verify that
2854 the document matches the signature by creating their own hash and
2855 checking the signature using the trusted third party public key.
2856 There are several commercial services around providing such
2857 timestamping.  A quick search for
2858 "<a href="https://duckduckgo.com/?q=rfc+3161+service">rfc 3161
2859 service</a>" pointed me to at least
2860 <a href="https://www.digistamp.com/technical/how-a-digital-time-stamp-works/">DigiStamp</a>,
2861 <a href="http://www.quovadisglobal.co.uk/CertificateServices/SigningServices/TimeStamp.aspx">Quo
2862 Vadis</a>,
2863 <a href="https://www.globalsign.com/timestamp-service/">Global Sign</a>
2864 and <a href="http://www.globaltrustfinder.com/TSADefault.aspx">Global
2865 Trust Finder</a>.  The system work as long as the private key of the
2866 trusted third party is not compromised.</p>
2867
2868 <p>But as far as I can tell, there are very few public trusted
2869 timestamp services available for everyone.  I've been looking for one
2870 for a while now. But yesterday I found one over at
2871 <a href="https://www.pki.dfn.de/zeitstempeldienst/">Deutches
2872 Forschungsnetz</a> mentioned in
2873 <a href="http://www.d-mueller.de/blog/dealing-with-trusted-timestamps-in-php-rfc-3161/">a
2874 blog by David Müller</a>.  I then found
2875 <a href="http://www.rz.uni-greifswald.de/support/dfn-pki-zertifikate/zeitstempeldienst.html">a
2876 good recipe on how to use the service</a> over at the University of
2877 Greifswald.</p>
2878
2879 <p><a href="http://www.openssl.org/">The OpenSSL library</a> contain
2880 both server and tools to use and set up your own signing service.  See
2881 the ts(1SSL), tsget(1SSL) manual pages for more details.  The
2882 following shell script demonstrate how to extract a signed timestamp
2883 for any file on the disk in a Debian environment:</p>
2884
2885 <p><blockquote><pre>
2886 #!/bin/sh
2887 set -e
2888 url="http://zeitstempel.dfn.de"
2889 caurl="https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt"
2890 reqfile=$(mktemp -t tmp.XXXXXXXXXX.tsq)
2891 resfile=$(mktemp -t tmp.XXXXXXXXXX.tsr)
2892 cafile=chain.txt
2893 if [ ! -f $cafile ] ; then
2894     wget -O $cafile "$caurl"
2895 fi
2896 openssl ts -query -data "$1" -cert | tee "$reqfile" \
2897     | /usr/lib/ssl/misc/tsget -h "$url" -o "$resfile"
2898 openssl ts -reply -in "$resfile" -text 1>&2
2899 openssl ts -verify -data "$1" -in "$resfile" -CAfile "$cafile" 1>&2
2900 base64 < "$resfile"
2901 rm "$reqfile" "$resfile"
2902 </pre></blockquote></p>
2903
2904 <p>The argument to the script is the file to timestamp, and the output
2905 is a base64 encoded version of the signature to STDOUT and details
2906 about the signature to STDERR.  Note that due to
2907 <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742553">a bug
2908 in the tsget script</a>, you might need to modify the included script
2909 and remove the last line.  Or just write your own HTTP uploader using
2910 curl. :) Now you too can prove and verify that files have not been
2911 changed.</p>
2912
2913 <p>But the Internet need more public trusted timestamp services.
2914 Perhaps something for <a href="http://www.uninett.no/">Uninett</a> or
2915 my work place the <a href="http://www.uio.no/">University of Oslo</a>
2916 to set up?</p>
2917
2918       </div>
2919       <div class="tags">
2920
2921
2922         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
2923
2924
2925       </div>
2926     </div>
2927     <div class="padding"></div>
2928
2929     <div class="entry">
2930       <div class="title">
2931         <a href="https://people.skolelinux.org/pere/blog/Freedombox_on_Dreamplug__Raspberry_Pi_and_virtual_x86_machine.html">Freedombox on Dreamplug, Raspberry Pi and virtual x86 machine</a>
2932       </div>
2933       <div class="date">
2934         14th March 2014
2935       </div>
2936       <div class="body">
2937         <p>The <a href="https://wiki.debian.org/FreedomBox">Freedombox
2938 project</a> is working on providing the software and hardware for
2939 making it easy for non-technical people to host their data and
2940 communication at home, and being able to communicate with their
2941 friends and family encrypted and away from prying eyes.  It has been
2942 going on for a while, and is slowly progressing towards a new test
2943 release (0.2).</p>
2944
2945 <p>And what day could be better than the Pi day to announce that the
2946 new version will provide "hard drive" / SD card / USB stick images for
2947 Dreamplug, Raspberry Pi and VirtualBox (or any other virtualization
2948 system), and can also be installed using a Debian installer preseed
2949 file.  The Debian based Freedombox is now based on Debian Jessie,
2950 where most of the needed packages used are already present.  Only one,
2951 the freedombox-setup package, is missing.  To try to build your own
2952 boot image to test the current status, fetch the freedom-maker scripts
2953 and build using
2954 <a href="http://packages.qa.debian.org/vmdebootstrap">vmdebootstrap</a>
2955 with a user with sudo access to become root:
2956
2957 <pre>
2958 git clone http://anonscm.debian.org/git/freedombox/freedom-maker.git \
2959   freedom-maker
2960 sudo apt-get install git vmdebootstrap mercurial python-docutils \
2961   mktorrent extlinux virtualbox qemu-user-static binfmt-support \
2962   u-boot-tools
2963 make -C freedom-maker dreamplug-image raspberry-image virtualbox-image
2964 </pre>
2965
2966 <p>Root access is needed to run debootstrap and mount loopback
2967 devices.  See the README for more details on the build. If you do not
2968 want all three images, trim the make line.  But note that thanks to <a
2969 href="https://bugs.debian.org/741407">a race condition in
2970 vmdebootstrap</a>, the build might fail without the patch to the
2971 kpartx call.</p>
2972
2973 <p>If you instead want to install using a Debian CD and the preseed
2974 method, boot a Debian Wheezy ISO and use this boot argument to load
2975 the preseed values:</p>
2976
2977 <pre>
2978 url=<a href="http://www.reinholdtsen.name/freedombox/preseed-jessie.dat">http://www.reinholdtsen.name/freedombox/preseed-jessie.dat</a>
2979 </pre>
2980
2981 <p>But note that due to <a href="https://bugs.debian.org/740673">a
2982 recently introduced bug in apt in Jessie</a>, the installer will
2983 currently hang while setting up APT sources.  Killing the
2984 '<tt>apt-cdrom ident</tt>' process when it hang a few times during the
2985 installation will get the installation going.  This affect all
2986 installations in Jessie, and I expect it will be fixed soon.</p>
2987
2988 <p>Give it a go and let us know how it goes on the mailing list, and help
2989 us get the new release published. :) Please join us on
2990 <a href="irc://irc.debian.org:6667/%23freedombox">IRC (#freedombox on
2991 irc.debian.org)</a> and
2992 <a href="http://lists.alioth.debian.org/mailman/listinfo/freedombox-discuss">the
2993 mailing list</a> if you want to help make this vision come true.</p>
2994
2995       </div>
2996       <div class="tags">
2997
2998
2999         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/freedombox">freedombox</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>, <a href="https://people.skolelinux.org/pere/blog/tags/web">web</a>.
3000
3001
3002       </div>
3003     </div>
3004     <div class="padding"></div>
3005
3006     <div class="entry">
3007       <div class="title">
3008         <a href="https://people.skolelinux.org/pere/blog/A_fist_full_of_non_anonymous_Bitcoins.html">A fist full of non-anonymous Bitcoins</a>
3009       </div>
3010       <div class="date">
3011         29th January 2014
3012       </div>
3013       <div class="body">
3014         <p>Bitcoin is a incredible use of peer to peer communication and
3015 encryption, allowing direct and immediate money transfer without any
3016 central control.  It is sometimes claimed to be ideal for illegal
3017 activity, which I believe is quite a long way from the truth.  At least
3018 I would not conduct illegal money transfers using a system where the
3019 details of every transaction are kept forever.  This point is
3020 investigated in
3021 <a href="https://www.usenix.org/publications/login">USENIX ;login:</a>
3022 from December 2013, in the article
3023 "<a href="https://www.usenix.org/system/files/login/articles/03_meiklejohn-online.pdf">A
3024 Fistful of Bitcoins - Characterizing Payments Among Men with No
3025 Names</a>" by Sarah Meiklejohn, Marjori Pomarole,Grant Jordan, Kirill
3026 Levchenko, Damon McCoy, Geoffrey M. Voelker, and Stefan Savage.  They
3027 analyse the transaction log in the Bitcoin system, using it to find
3028 addresses belong to individuals and organisations and follow the flow
3029 of money from both Bitcoin theft and trades on Silk Road to where the
3030 money end up.  This is how they wrap up their article:</p>
3031
3032 <p><blockquote>
3033 <p>"To demonstrate the usefulness of this type of analysis, we turned
3034 our attention to criminal activity. In the Bitcoin economy, criminal
3035 activity can appear in a number of forms, such as dealing drugs on
3036 Silk Road or simply stealing someone else’s bitcoins. We followed the
3037 flow of bitcoins out of Silk Road (in particular, from one notorious
3038 address) and from a number of highly publicized thefts to see whether
3039 we could track the bitcoins to known services. Although some of the
3040 thieves attempted to use sophisticated mixing techniques (or possibly
3041 mix services) to obscure the flow of bitcoins, for the most part
3042 tracking the bitcoins was quite straightforward, and we ultimately saw
3043 large quantities of bitcoins flow to a variety of exchanges directly
3044 from the point of theft (or the withdrawal from Silk Road).</p>
3045
3046 <p>As acknowledged above, following stolen bitcoins to the point at
3047 which they are deposited into an exchange does not in itself identify
3048 the thief; however, it does enable further de-anonymization in the
3049 case in which certain agencies can determine (through, for example,
3050 subpoena power) the real-world owner of the account into which the
3051 stolen bitcoins were deposited.  Because such exchanges seem to serve
3052 as chokepoints into and out of the Bitcoin economy (i.e., there are
3053 few alternative ways to cash out), we conclude that using Bitcoin for
3054 money laundering or other illicit purposes does not (at least at
3055 present) seem to be particularly attractive."</p>
3056 </blockquote><p>
3057
3058 <p>These researches are not the first to analyse the Bitcoin
3059 transaction log.  The 2011 paper
3060 "<a href="http://arxiv.org/abs/1107.4524">An Analysis of Anonymity in
3061 the Bitcoin System</A>" by Fergal Reid and Martin Harrigan is
3062 summarized like this:</p>
3063
3064 <p><blockquote>
3065 "Anonymity in Bitcoin, a peer-to-peer electronic currency system, is a
3066 complicated issue. Within the system, users are identified by
3067 public-keys only. An attacker wishing to de-anonymize its users will
3068 attempt to construct the one-to-many mapping between users and
3069 public-keys and associate information external to the system with the
3070 users. Bitcoin tries to prevent this attack by storing the mapping of
3071 a user to his or her public-keys on that user's node only and by
3072 allowing each user to generate as many public-keys as required. In
3073 this chapter we consider the topological structure of two networks
3074 derived from Bitcoin's public transaction history. We show that the
3075 two networks have a non-trivial topological structure, provide
3076 complementary views of the Bitcoin system and have implications for
3077 anonymity. We combine these structures with external information and
3078 techniques such as context discovery and flow analysis to investigate
3079 an alleged theft of Bitcoins, which, at the time of the theft, had a
3080 market value of approximately half a million U.S. dollars."
3081 </blockquote></p>
3082
3083 <p>I hope these references can help kill the urban myth that Bitcoin
3084 is anonymous.  It isn't really a good fit for illegal activites.  Use
3085 cash if you need to stay anonymous, at least until regular DNA
3086 sampling of notes and coins become the norm. :)</p>
3087
3088 <p>As usual, if you use Bitcoin and want to show your support of my
3089 activities, please send Bitcoin donations to my address
3090 <b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
3091
3092       </div>
3093       <div class="tags">
3094
3095
3096         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/usenix">usenix</a>.
3097
3098
3099       </div>
3100     </div>
3101     <div class="padding"></div>
3102
3103     <div class="entry">
3104       <div class="title">
3105         <a href="https://people.skolelinux.org/pere/blog/All_drones_should_be_radio_marked_with_what_they_do_and_who_they_belong_to.html">All drones should be radio marked with what they do and who they belong to</a>
3106       </div>
3107       <div class="date">
3108         21st November 2013
3109       </div>
3110       <div class="body">
3111         <p>Drones, flying robots, are getting more and more popular.  The most
3112 know ones are the killer drones used by some government to murder
3113 people they do not like without giving them the chance of a fair
3114 trial, but the technology have many good uses too, from mapping and
3115 forest maintenance to photography and search and rescue.  I am sure it
3116 is just a question of time before "bad drones" are in the hands of
3117 private enterprises and not only state criminals but petty criminals
3118 too.  The drone technology is very useful and very dangerous.  To have
3119 some control over the use of drones, I agree with Daniel Suarez in his
3120 TED talk
3121 "<a href="https://archive.org/details/DanielSuarez_2013G">The kill
3122 decision shouldn't belong to a robot</a>", where he suggested this
3123 little gem to keep the good while limiting the bad use of drones:</p>
3124
3125 <blockquote>
3126
3127 <p>Each robot and drone should have a cryptographically signed
3128 I.D. burned in at the factory that can be used to track its movement
3129 through public spaces. We have license plates on cars, tail numbers on
3130 aircraft. This is no different. And every citizen should be able to
3131 download an app that shows the population of drones and autonomous
3132 vehicles moving through public spaces around them, both right now and
3133 historically. And civic leaders should deploy sensors and civic drones
3134 to detect rogue drones, and instead of sending killer drones of their
3135 own up to shoot them down, they should notify humans to their
3136 presence. And in certain very high-security areas, perhaps civic
3137 drones would snare them and drag them off to a bomb disposal facility.</p>
3138
3139 <p>But notice, this is more an immune system than a weapons system. It
3140 would allow us to avail ourselves of the use of autonomous vehicles
3141 and drones while still preserving our open, civil society.</p>
3142
3143 </blockquote>
3144
3145 <p>The key is that <em>every citizen</em> should be able to read the
3146 radio beacons sent from the drones in the area, to be able to check
3147 both the government and others use of drones.  For such control to be
3148 effective, everyone must be able to do it.  What should such beacon
3149 contain?  At least formal owner, purpose, contact information and GPS
3150 location.  Probably also the origin and target position of the current
3151 flight.  And perhaps some registration number to be able to look up
3152 the drone in a central database tracking their movement.  Robots
3153 should not have privacy.  It is people who need privacy.</p>
3154
3155       </div>
3156       <div class="tags">
3157
3158
3159         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/robot">robot</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
3160
3161
3162       </div>
3163     </div>
3164     <div class="padding"></div>
3165
3166     <div class="entry">
3167       <div class="title">
3168         <a href="https://people.skolelinux.org/pere/blog/Det_er_jo_makta_som_er_mest_s_rbar_ved_massiv_overv_kning_av_Internett.html">Det er jo makta som er mest sårbar ved massiv overvåkning av Internett</a>
3169       </div>
3170       <div class="date">
3171         26th October 2013
3172       </div>
3173       <div class="body">
3174         <p>De siste måneders eksponering av
3175 <a href="http://www.aftenposten.no/nyheter/uriks/Her-er-Edvard-Snowdens-mest-omtalte-avsloringer-7351734.html">den
3176 totale overvåkningen som foregår i den vestlige verden dokumenterer
3177 hvor sårbare vi er</a>.  Men det slår meg at de som er mest sårbare
3178 for dette, myndighetspersoner på alle nivåer, neppe har innsett at de
3179 selv er de mest interessante personene å lage profiler på, for å kunne
3180 påvirke dem.</p>
3181
3182 <p>For å ta et lite eksempel: Stortingets nettsted,
3183 <a href="http://www.stortinget.no/">www.stortinget.no</a> (og
3184 forsåvidt også
3185 <a href="http://data.stortinget.no/">data.stortinget.no</a>),
3186 inneholder informasjon om det som foregår på Stortinget, og jeg antar
3187 de største brukerne av informasjonen der er representanter og
3188 rådgivere på Stortinget.  Intet overraskende med det.  Det som derimot
3189 er mer skjult er at Stortingets nettsted bruker
3190 <a href="http://en.wikipedia.org/wiki/Google_Analytics">Google
3191 Analytics</a>, hvilket gjør at enhver som besøker nettsidene der også
3192 rapporterer om besøket via Internett-linjer som passerer Sverige,
3193 England og videre til USA.  Det betyr at informasjon om ethvert besøk
3194 på stortingets nettsider kan snappes opp av svensk, britisk og USAs
3195 etterretningsvesen.  De kan dermed holde et øye med hvilke
3196 Stortingssaker stortingsrepresentantene synes er interessante å sjekke
3197 ut, og hvilke sider rådgivere og andre på stortinget synes er
3198 interessant å besøke, når de gjør det og hvilke andre representanter
3199 som sjekker de samme sidene omtrent samtidig.  Stortingets bruk av
3200 Google Analytics gjør det dermed enkelt for utenlands etteretning å
3201 spore representantenes aktivitet og interesse.  Hvis noen av
3202 representantene bruker Google Mail eller noen andre tjenestene som
3203 krever innlogging, så vil det være enda enklere å finne ut nøyaktig
3204 hvilke personer som bruker hvilke nettlesere og dermed knytte
3205 informasjonen opp til enkeltpersoner på Stortinget.</p>
3206
3207 <p>Og jo flere nettsteder som bruker Google Analytics, jo bedre
3208 oversikt over stortingsrepresentantenes lesevaner og interesse blir
3209 tilgjengelig for svensk, britisk og USAs etterretning.  Hva de kan
3210 bruke den informasjonen til overlater jeg til leseren å undres
3211 over.</p>
3212
3213       </div>
3214       <div class="tags">
3215
3216
3217         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/stortinget">stortinget</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
3218
3219
3220       </div>
3221     </div>
3222     <div class="padding"></div>
3223
3224     <div class="entry">
3225       <div class="title">
3226         <a href="https://people.skolelinux.org/pere/blog/Videos_about_the_Freedombox_project___for_inspiration_and_learning.html">Videos about the Freedombox project - for inspiration and learning</a>
3227       </div>
3228       <div class="date">
3229         27th September 2013
3230       </div>
3231       <div class="body">
3232         <p>The <a href="http://www.freedomboxfoundation.org/">Freedombox
3233 project</a> have been going on for a while, and have presented the
3234 vision, ideas and solution several places.  Here is a little
3235 collection of videos of talks and presentation of the project.</p>
3236
3237 <ul>
3238
3239 <li><a href="http://www.youtube.com/watch?v=ukvUz5taxvA">FreedomBox -
3240 2,5 minute marketing film</a> (Youtube)</li>
3241
3242 <li><a href="http://www.youtube.com/watch?v=SzW25QTVWsE">Eben Moglen
3243 discusses the Freedombox on CBS news 2011</a> (Youtube)</li>
3244
3245 <li><a href="http://www.youtube.com/watch?v=Ae8SZbxfE0g">Eben Moglen -
3246 Freedom in the Cloud - Software Freedom, Privacy and and Security for
3247 Web 2.0 and Cloud computing at ISOC-NY Public Meeting 2010</a>
3248 (Youtube)</li>
3249
3250 <li><a href="http://www.youtube.com/watch?v=vNaIji_3xBE">Fosdem 2011
3251 Keynote by Eben Moglen presenting the Freedombox</a> (Youtube)</li>
3252
3253 <li><a href="http://www.youtube.com/watch?v=9bDDUyJSQ9s">Presentation of
3254 the Freedombox by James Vasile at Elevate in Gratz 2011</a> (Youtube)</li>
3255
3256 <li><a href="http://www.youtube.com/watch?v=zQTmnk27g9s"> Freedombox -
3257 Discovery, Identity, and Trust by Nick Daly at Freedombox Hackfest New
3258 York City in 2012</a> (Youtube)</li>
3259
3260 <li><a href="http://www.youtube.com/watch?v=tkbSB4Ba7Ck">Introduction
3261 to the Freedombox at Freedombox Hackfest New York City in 2012</a>
3262 (Youtube)</li>
3263
3264 <li><a href="http://www.youtube.com/watch?v=z-P2Jaeg0aQ">Freedom, Out
3265 of the Box! by Bdale Garbee at linux.conf.au Ballarat, 2012</a> (Youtube) </li>
3266
3267 <li><a href="https://archive.fosdem.org/2013/schedule/event/freedombox/">Freedombox
3268 1.0 by Eben Moglen and Bdale Garbee at Fosdem 2013</a> (FOSDEM) </li>
3269
3270 <li><a href="http://www.youtube.com/watch?v=e1LpYX2zVYg">What is the
3271 FreedomBox today by Bdale Garbee at Debconf13 in Vaumarcus
3272 2013</a> (Youtube)</li>
3273
3274 </ul>
3275
3276 <p>A larger list is available from
3277 <a href="https://wiki.debian.org/FreedomBox/TalksAndPresentations">the
3278 Freedombox Wiki</a>.</p>
3279
3280 <p>On other news, I am happy to report that Freedombox based on Debian
3281 Jessie is coming along quite well, and soon both Owncloud and using
3282 Tor should be available for testers of the Freedombox solution. :) In
3283 a few weeks I hope everything needed to test it is included in Debian.
3284 The withsqlite package is already in Debian, and the plinth package is
3285 pending in NEW.  The third and vital part of that puzzle is the
3286 metapackage/setup framework, which is still pending an upload.  Join
3287 us on <a href="irc://irc.debian.org:6667/%23freedombox">IRC
3288 (#freedombox on irc.debian.org)</a> and
3289 <a href="http://lists.alioth.debian.org/mailman/listinfo/freedombox-discuss">the
3290 mailing list</a> if you want to help make this vision come true.</p>
3291
3292       </div>
3293       <div class="tags">
3294
3295
3296         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/freedombox">freedombox</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>, <a href="https://people.skolelinux.org/pere/blog/tags/web">web</a>.
3297
3298
3299       </div>
3300     </div>
3301     <div class="padding"></div>
3302
3303     <div class="entry">
3304       <div class="title">
3305         <a href="https://people.skolelinux.org/pere/blog/Recipe_to_test_the_Freedombox_project_on_amd64_or_Raspberry_Pi.html">Recipe to test the Freedombox project on amd64 or Raspberry Pi</a>
3306       </div>
3307       <div class="date">
3308         10th September 2013
3309       </div>
3310       <div class="body">
3311         <p>I was introduced to the
3312 <a href="http://www.freedomboxfoundation.org/">Freedombox project</a>
3313 in 2010, when Eben Moglen presented his vision about serving the need
3314 of non-technical people to keep their personal information private and
3315 within the legal protection of their own homes.  The idea is to give
3316 people back the power over their network and machines, and return
3317 Internet back to its intended peer-to-peer architecture.  Instead of
3318 depending on a central service, the Freedombox will give everyone
3319 control over their own basic infrastructure.</p>
3320
3321 <p>I've intended to join the effort since then, but other tasks have
3322 taken priority.  But this summers nasty news about the misuse of trust
3323 and privilege exercised by the "western" intelligence gathering
3324 communities increased my eagerness to contribute to a point where I
3325 actually started working on the project a while back.</p>
3326
3327 <p>The <a href="https://alioth.debian.org/projects/freedombox/">initial
3328 Debian initiative</a> based on the vision from Eben Moglen, is to
3329 create a simple and cheap Debian based appliance that anyone can hook
3330 up in their home and get access to secure and private services and
3331 communication.  The initial deployment platform have been the
3332 <a href="http://www.globalscaletechnologies.com/t-dreamplugdetails.aspx">Dreamplug</a>,
3333 which is a piece of hardware I do not own.  So to be able to test what
3334 the current Freedombox setup look like, I had to come up with a way to install
3335 it on some hardware I do have access to.  I have rewritten the
3336 <a href="https://github.com/NickDaly/freedom-maker">freedom-maker</a>
3337 image build framework to use .deb packages instead of only copying
3338 setup into the boot images, and thanks to this rewrite I am able to
3339 set up any machine supported by Debian Wheezy as a Freedombox, using
3340 the previously mentioned deb (and a few support debs for packages
3341 missing in Debian).</p>
3342
3343 <p>The current Freedombox setup consist of a set of bootstrapping
3344 scripts
3345 (<a href="https://github.com/petterreinholdtsen/freedombox-setup">freedombox-setup</a>),
3346 and a administrative web interface
3347 (<a href="https://github.com/NickDaly/Plinth">plinth</a> + exmachina +
3348 withsqlite), as well as a privacy enhancing proxy based on
3349 <a href="http://packages.qa.debian.org/privoxy">privoxy</a>
3350 (freedombox-privoxy).  There is also a web/javascript based XMPP
3351 client (<a href="http://packages.qa.debian.org/jwchat">jwchat</a>)
3352 trying (unsuccessfully so far) to talk to the XMPP server
3353 (<a href="http://packages.qa.debian.org/ejabberd">ejabberd</a>).  The
3354 web interface is pluggable, and the goal is to use it to enable OpenID
3355 services, mesh network connectivity, use of TOR, etc, etc.  Not much of
3356 this is really working yet, see
3357 <a href="https://github.com/NickDaly/freedombox-todos/blob/master/TODO">the
3358 project TODO</a> for links to GIT repositories.  Most of the code is
3359 on github at the moment.  The HTTP proxy is operational out of the
3360 box, and the admin web interface can be used to add/remove plinth
3361 users.  I've not been able to do anything else with it so far, but
3362 know there are several branches spread around github and other places
3363 with lots of half baked features.</p>
3364
3365 <p>Anyway, if you want to have a look at the current state, the
3366 following recipes should work to give you a test machine to poke
3367 at.</p>
3368
3369 <p><strong>Debian Wheezy amd64</strong></p>
3370
3371 <ol>
3372
3373 <li>Fetch normal Debian Wheezy installation ISO.</li>
3374 <li>Boot from it, either as CD or USB stick.</li>
3375 <li><p>Press [tab] on the boot prompt and add this as a boot argument
3376 to the Debian installer:<p>
3377 <pre>url=<a href="http://www.reinholdtsen.name/freedombox/preseed-wheezy.dat">http://www.reinholdtsen.name/freedombox/preseed-wheezy.dat</a></pre></li>
3378
3379 <li>Answer the few language/region/password questions and pick disk to
3380 install on.</li>
3381
3382 <li>When the installation is finished and the machine have rebooted a
3383 few times, your Freedombox is ready for testing.</li>
3384
3385 </ol>
3386
3387 <p><strong>Raspberry Pi Raspbian</strong></p>
3388
3389 <ol>
3390
3391 <li>Fetch a Raspbian SD card image, create SD card.</li>
3392 <li>Boot from SD card, extend file system to fill the card completely.</li>
3393 <li><p>Log in and add this to /etc/sources.list:</p>
3394 <pre>
3395 deb <a href="http://www.reinholdtsen.name/freedombox/">http://www.reinholdtsen.name/freedombox</a> wheezy main
3396 </pre></li>
3397 <li><p>Run this as root:</p>
3398 <pre>
3399 wget -O - http://www.reinholdtsen.name/freedombox/BE1A583D.asc | \
3400    apt-key add -
3401 apt-get update
3402 apt-get install freedombox-setup
3403 /usr/lib/freedombox/setup
3404 </pre></li>
3405 <li>Reboot into your freshly created Freedombox.</li>
3406
3407 </ol>
3408
3409 <p>You can test it on other architectures too, but because the
3410 freedombox-privoxy package is binary, it will only work as intended on
3411 the architectures where I have had time to build the binary and put it
3412 in my APT repository.  But do not let this stop you.  It is only a
3413 short "<tt>apt-get source -b freedombox-privoxy</tt>" away. :)</p>
3414
3415 <p>Note that by default Freedombox is a DHCP server on the
3416 192.168.1.0/24 subnet, so if this is your subnet be careful and turn
3417 off the DHCP server by running "<tt>update-rc.d isc-dhcp-server
3418 disable</tt>" as root.</p>
3419
3420 <p>Please let me know if this works for you, or if you have any
3421 problems.  We gather on the IRC channel
3422 <a href="irc://irc.debian.org:6667/%23freedombox">#freedombox</a> on
3423 irc.debian.org and the
3424 <a href="http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss">project
3425 mailing list</a>.</p>
3426
3427 <p>Once you get your freedombox operational, you can visit
3428 <tt>http://your-host-name:8001/</tt> to see the state of the plint
3429 welcome screen (dead end - do not be surprised if you are unable to
3430 get past it), and next visit <tt>http://your-host-name:8001/help/</tt>
3431 to look at the rest of plinth.  The default user is 'admin' and the
3432 default password is 'secret'.</p>
3433
3434       </div>
3435       <div class="tags">
3436
3437
3438         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/freedombox">freedombox</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>, <a href="https://people.skolelinux.org/pere/blog/tags/web">web</a>.
3439
3440
3441       </div>
3442     </div>
3443     <div class="padding"></div>
3444
3445     <div class="entry">
3446       <div class="title">
3447         <a href="https://people.skolelinux.org/pere/blog/Dr__Richard_Stallman__founder_of_Free_Software_Foundation__give_a_talk_in_Oslo_March_1st_2013.html">Dr. Richard Stallman, founder of Free Software Foundation, give a talk in Oslo March 1st 2013</a>
3448       </div>
3449       <div class="date">
3450         27th February 2013
3451       </div>
3452       <div class="body">
3453         <p>Dr. <a href="http://www.stallman.org/">Richard Stallman</a>,
3454 founder of <a href="http://www.fsf.org/">Free Software Foundation</a>,
3455 is giving <a href="http://www.nuug.no/aktiviteter/20130301-rms/">a
3456 talk in Oslo March 1st 2013 17:00 to 19:00</a>.  The event is public
3457 and organised by <a href="">Norwegian Unix Users Group (NUUG)</a>
3458 (where I am the chair of the board) and
3459 <a href="http://www.friprog.no/">The Norwegian Open Source Competence
3460 Center</a>.  The title of the talk is «The Free Software Movement and
3461 GNU», with this description:
3462
3463 <p><blockquote>
3464 The Free Software Movement campaigns for computer users' freedom to
3465 cooperate and control their own computing. The Free Software Movement
3466 developed the GNU operating system, typically used together with the
3467 kernel Linux, specifically to make these freedoms possible.
3468 </blockquote></p>
3469
3470 <p>The meeting is open for everyone.  Due to space limitations, the
3471 doors opens for NUUG members at 16:15, and everyone else at 16:45.  I
3472 am really curious how many will show up.  See
3473 <a href="http://www.nuug.no/aktiviteter/20130301-rms/">the event
3474 page</a> for the location details.</p>
3475
3476       </div>
3477       <div class="tags">
3478
3479
3480         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
3481
3482
3483       </div>
3484     </div>
3485     <div class="padding"></div>
3486
3487     <div class="entry">
3488       <div class="title">
3489         <a href="https://people.skolelinux.org/pere/blog/1_4_millioner_potensielle_journalistsamtaler_i_politiets_hender.html">1.4 millioner potensielle journalistsamtaler i politiets hender</a>
3490       </div>
3491       <div class="date">
3492         27th November 2012
3493       </div>
3494       <div class="body">
3495         <p>I fjor meldte Dagbladet og andre medier at
3496 <a href="http://www.dagbladet.no/2011/09/27/nyheter/innenriks/terror/anders_behring_breivik/18323147/">politiet
3497 hadde samlet inn informasjon om 1.4 millioner telefonsamtaler</a> i
3498 området rundt Akersgata, regjeringskvartalet og Utøya, i forbindelse
3499 med etterforskningen rundt bombeattentatet og massemordet 22. juli
3500 2011.  Politiadvokat Pål-Fredrik Hjort Kraby fortalte i følge
3501 artikkelen at</p>
3502
3503 <blockquote>
3504 - «Dette er ikke kun samtaler som knyttes til Breivik. Dette er alle
3505 samtaler som er registrert på basestasjoner i tilknytning til både
3506 bomba i Regjeringskvartalet og aksjonen på Utøya. Vi må analysere tid,
3507 lengde og fra hvilke basestasjoner de er registrert på. Vi prøver å
3508 finne ut hvem som har ringt til en hver tid, også i dagene før.»
3509 </blockquote>
3510
3511 <p>Det triste og merkelige er at ingen presseoppslag tok opp hva dette
3512 egentlig betød for kildevernet.  Et stenkast fra regjeringskvartalet
3513 befinner redaksjonene til blant annet VG, Dagbladet og Aftenposten
3514 seg.  Det betyr at et betydelig antall av journalisters samtaler var
3515 og er tilgjengelig for politiet.  Og dette var ikke en unik hendelse.
3516 Politiet henter rutinemessig ut informasjon om telefonsamtaler i
3517 kriminaletterforskningen, og en kan gå ut ifra at det ofte vil være
3518 noe kriminelt å undersøke nær en redaksjon da redaksjoner holder til i
3519 sentrum og tettsteder, der det meste av annen aktivitet i et område
3520 også foregår.  F.eks. befinner Aftenposten seg like ved Oslo
3521 Sentralstasjon, et ganske kriminelt belastet område, der jeg mistenker
3522 politiet ofte hente ut samtaleinformasjon.  Og avisen Aftenposten
3523 annonserte jo for noen år siden at ansatte kun skulle ha mobiltelefon
3524 (noe de kanskje angret på
3525 <a href="http://www.digi.no/216833/raadlose-bedrifter-uten-sikkerhetsnett">da
3526 mobilnettet brøt sammen</a>), hvilket betyr at alle samtaler
3527 journalistene gjennomfører går via nabolagets mobilbasestasjoner og
3528 dermed blir med og analysert når politiet ber om informasjon om
3529 mobilsamtaler i området.  Det samme gjelder antagelig de fleste
3530 mediehus nå for tiden.</p>
3531
3532 <p>Konsekvensen er at en må gå ut i fra at politiet kan få tilgang til
3533 informasjon om alle samtaler med journalister, hvilket bør få varslere
3534 og andre som vil tipse journalister til å tenke seg to ganger før de
3535 ringer en journalist.  Det er for meg en svært uheldig situasjon.</p>
3536
3537 <p>Anders Brenne tipset meg om dette tidligere i år, og har skrevet om
3538 problemstillingen i sin bok
3539 <a href="http://www.hoyskoleforlaget.no/index.asp?template=40&bokId=978-82-7147-358-7">Digitalt
3540 kildevern</a> som ble lansert i år og
3541 <a href="http://www.netthoder.no/2012/04/dette-ma-du-vite-om-du-vil-sikre-kildevernet-referat/">presentert
3542 på et NONA-møte i april</a>.  Oppsummeringen fra møtet inneholder
3543 flere detaljer og bakgrunnsinformasjon.  Jeg synes det er besynderlig
3544 at så få journalister tar opp denne problemstillingen, og ikke stiller
3545 flere kritiske spørsmål til innføringen av datalagringsdirektivet og
3546 den raderingen av personvernet som har foregått i Norge i løpet av
3547 mange år nå.</p>
3548
3549       </div>
3550       <div class="tags">
3551
3552
3553         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/dld">dld</a>, <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
3554
3555
3556       </div>
3557     </div>
3558     <div class="padding"></div>
3559
3560     <div class="entry">
3561       <div class="title">
3562         <a href="https://people.skolelinux.org/pere/blog/FAD_tvinger_igjennom_BankID_tilgang_til_personsensitiv_informasjon_om_meg.html">FAD tvinger igjennom BankID-tilgang til personsensitiv informasjon om meg</a>
3563       </div>
3564       <div class="date">
3565         21st November 2012
3566       </div>
3567       <div class="body">
3568         <p>I dag fikk jeg svar fra fornyingsdepartementet på min
3569 <a href="http://people.skolelinux.org/pere/blog/BankID_skal_ikke_gi_tilgang_til_min_personsensitive_informasjon.html">forespørsel
3570 om å reservere meg mot at BankID</a> brukes til å få tilgang til
3571 informasjon om meg via ID-porten.  Like etter at svaret kom fikk jeg
3572 beskjed om at min henvendelse har fått
3573 <a href="http://www.oep.no/search/result.html?caseNumber=2012/3446&searchType=advanced&list2=94&caseSearch=true&sortField=doknr">saksnummer
3574 12/3446 hos FAD</a>, som dessverre ikke har dukket opp i Offentlig
3575 Elektronisk Postjournal ennå.  Her er svaret jeg fikk:</p>
3576
3577 <blockquote>
3578 <p>Date: Wed, 21 Nov 2012 11:18:52 +0000
3579 <br>From: Hornnes Stig &lt;Stig.Hornnes (at) fad.dep.no&gt;
3580 <br>To: Petter Reinholdtsen
3581 <br>Subject: Reservasjon mot BankID</p>
3582
3583 <p>Hei Petter,</p>
3584
3585 <p>Du har sendt oss forespørsel om at din bruker blir reservert mot bruk
3586 av BankID i ID-porten. Det er ikke lagt opp til at enkeltpersoner kan
3587 reservere seg på denne måten.</p>
3588
3589 <p>Tanken bak ID-porten er at innbyggerne skal kunne velge hvilken eID de
3590 ønsker å bruke for å logge på offentlige tjenester. For å sikre
3591 valgfriheten har vi inngått avtaler med BankID, Buypass og
3592 Commfides. I tillegg har vi den offentlige MinID, men hvor utstedelse
3593 skjer til adresse registrert i folkeregisteret, og derfor ikke er
3594 egnet til tjenestene med det høyeste sikkerhetsbehovet.</p>
3595
3596 <p>Sikkerhet er et viktig tema for oss. Alle leverandørene som er i
3597 ID-porten i dag, inkl. BankID, har oppfylt både kravene som fremgår av
3598 Kravspek PKI (pluss noen tilleggskrav fra Difi i anskaffelsen) og er
3599 selvdeklarerte hos Post og Teletilsynet (PT) som har tilsynsansvar for
3600 denne typen virksomheter. For BankID sin del ble det gjennomført
3601 revisjon av løsningen i 2009, på bestilling fra PT etter en del
3602 negative oppslag knyttet til nettopp sikkerheten i løsningen. Det
3603 fremkom ingen alvorlige sikkerhetsproblemer i revisjonen.</p>
3604
3605 <p>Når dette er sagt; Ingen løsninger er 100 prosent sikre, verken
3606 papirbaserte systemer eller elektroniske. Eksempelvis vil misbruk av
3607 identitetsbevis for å urettmessig skaffe seg en e-ID, alltid være en
3608 risiko. Men det er en generell risiko for alle nivå 4-e-id-er vi har i
3609 Norge per i dag.  Det er kriminelt, men det er umulig å være ett
3610 hundre prosent sikker på at det ikke kan skje. Vi har imidlertid fokus
3611 på å redusere risikoen så mye som mulig, og skal jobbe videre sammen
3612 med blant annet Justisdepartementet med ulike tiltak som vil bidra til
3613 bedre grunnidentifisering av innbyggere.</p>
3614
3615 <p>Mvh
3616 <br>Stig Hornnes
3617 <br>Rådgiver - FAD</p>
3618 </blockquote>
3619
3620 <p>Litt merkelig at de har glemt å legge opp til at enkeltpersoner kan
3621 reservere seg på denne måten.  FAD burde være klar over
3622 problemstillingen med reservasjon, da jeg tok det opp med dem da de
3623 presenterte MinID på en presentasjon de holdt på Gardermoen for noen
3624 år siden.  Det burde jo også være teknisk svært enkelt å få støtte for
3625 slikt i en ID-portal.  Her må det visst tyngre virkemidler til enn en
3626 vennlig forespørsel om å reservere seg.  Får tenke igjennom neste
3627 steg.</p>
3628
3629 <p>Du lurer kanskje på hva som er problemet med BankID?  For å
3630 forklare det, er det greit å gå et steg tilbake og beskrive offentlig
3631 nøkkel-kryptering, eller
3632 <a href="http://snl.no/asymmetrisk_kryptografi">asymmetrisk
3633 kryptografi</a> som det også kalles.  En fin beskrivelse
3634 <a href="http://www.matematikk.org/artikkel.html?tid=63068">finnes på
3635 matematikk.org</a>:</p>
3636
3637 <blockquote>
3638 Se for deg at person A har en hengelås og at han sender den til deg (i
3639 åpen tilstand), men beholder nøkkelen. Du kan dermed låse inn en
3640 hemmelighet ved hjelp av hengelåsen og sende den til A. Bare A kan
3641 låse opp igjen, siden bare A har den riktige nøkkelen.
3642 </blockquote>
3643
3644 <p>Signering med asymmetrisk kryptering gjør at en kan vite at kun de
3645 som har tilgang til nøkkelen har signert et gitt dokument.  Mitt
3646 problem med BankID er det er utformet slik at banken beholder nøkkelen
3647 til hengelåsen og kontraktsmessig har lovet å kun bruke den når jeg
3648 ber om det.  Det er ikke godt nok for meg.  Jeg forventer et system
3649 der kun jeg har nøkkelen hvis det skal kunne brukes til å inngå
3650 avtaler på mine vegne eller få tilgang til min personsensitive
3651 informasjon.  Jeg forventer at det velges en teknisk løsning der det
3652 er tvingende nødvendig at jeg er involvert når det skal signeres noe
3653 på mine vegne.  BankID er ikke en slik.</p>
3654
3655       </div>
3656       <div class="tags">
3657
3658
3659         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/bankid">bankid</a>, <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
3660
3661
3662       </div>
3663     </div>
3664     <div class="padding"></div>
3665
3666     <div class="entry">
3667       <div class="title">
3668         <a href="https://people.skolelinux.org/pere/blog/BankID_skal_ikke_gi_tilgang_til_min_personsensitive_informasjon.html">BankID skal ikke gi tilgang til min personsensitive informasjon</a>
3669       </div>
3670       <div class="date">
3671         16th November 2012
3672       </div>
3673       <div class="body">
3674         <p>Onsdag i denne uka annonserte
3675 <a href="http://www.fad.dep.no/">Fornyingsdepartementet</a> at de har
3676 inngått kontrakt med BankID Norge om bruk av BankID for å la borgerne
3677 logge inn på offentlige nettsider der en kan få tilgang til
3678 personsensitiv informasjon.  Jeg skrev i 2009 litt om
3679 <a href="http://people.skolelinux.org/pere/blog/Jeg_vil_ikke_ha_BankID.html">hvorfor
3680 jeg ikke vil ha BankID</a> &mdash; jeg stoler ikke nok på en bank til
3681 å gi dem mulighet til å inngå avtaler på mine vegne.  Jeg forlanger at
3682 jeg skal være involvert når det skal inngås avtaler på mine vegne.</p>
3683
3684 <p>Jeg har derfor valgt å bruke
3685 <a href="http://www.skandibanken.no/">Skandiabanken</a> (det er flere
3686 banker som ikke krever BankID, se
3687 <a href="http://no.wikipedia.org/wiki/BankID">Wikipedia for en
3688 liste</a>) på grunn av at de ikke tvinger sine kunder til å bruke
3689 BankID.  I motsetning til Postbanken, som løy til meg i 2009 da
3690 kundestøtten der sa at det var blitt et krav fra Kreditttilsynet og
3691 BBS om at norske banker måtte innføre BankID, har ikke Skandiabanken
3692 forsøkt å tvinge meg til å ta i bruk BankID.  Jeg fikk nylig endelig
3693 spurt Finanstilsynet (de har byttet navn siden 2009), og fikk beskjed
3694 fra Frank Robert Berg hos Finanstilsynet i epost 2012-09-17 at
3695 Finanstilsynet ikke har fremsatt slike krav.  Med andre ord snakket
3696 ikke Postbankens kundestøtte sant i 2009.</p>
3697
3698 <p>Når en i tillegg fra
3699 <a href="http://www.aftenposten.no/nyheter/iriks/Tyver-kan-tappe-kontoen-din---selv-uten-passord-og-pinkode--6989793.html">oppslag
3700 i Aftenposten</a> vet at de som jobber i alle bankene som bruker
3701 BankID i dag, det være seg utro tjenere, eller de som lar seg lure av
3702 falsk legitimasjon, kan lage og dele ut en BankID som gir tilgang til
3703 mine kontoer og rett til å inngå avtaler på mine vegne, blir det
3704 viktigere enn noen gang å få reservert seg mot BankID.  Det holder
3705 ikke å la være å bruke det selv.  Jeg sendte derfor følgende
3706 epost-brev til Fornyingsdepartementet i går:</p>
3707
3708 <p><blockquote>
3709 <p>Date: Thu, 15 Nov 2012 11:08:31 +0100
3710 <br>From: Petter Reinholdtsen &lt;pere (at) hungry.com&gt;
3711 <br>To: postmottak (at) fad.dep.no
3712 <br>Subject: Forespørsel om reservasjon mot bruk av BankID i ID-porten</p>
3713
3714 <p>Jeg viser til nyheten om at staten har tildelt kontrakt for å
3715 levere elektronisk ID for offentlige digitale tjenester til BankID
3716 Norge, referert til blant annet i Digi[1] og i FADs
3717 pressemelding[2].</p>
3718
3719 <p>1) &lt;URL: <a href="http://www.digi.no/906093/staten-gaar-for-bankid">http://www.digi.no/906093/staten-gaar-for-bankid</a> &gt;
3720 <br>2) &lt;URL: <a href="http://www.regjeringen.no/nb/dep/fad/pressesenter/pressemeldinger/2012/staten-inngar-avtale-med-bankid.html">http://www.regjeringen.no/nb/dep/fad/pressesenter/pressemeldinger/2012/staten-inngar-avtale-med-bankid.html</a> &gt;</p>
3721
3722 <p>Gitt BankIDs utforming, der BankID-utsteder har både privat og
3723 offentlig del av kundens nøkkel hos seg, er jeg ikke villig til å gi
3724 tilgang til informasjon som hører til min min privatsfære ved hjelp av
3725 innlogging med BankID.</p>
3726
3727 <p>Jeg ber derfor herved om at løsningen settes opp slik at ingen kan
3728 logge inn som meg på offentlige digitale tjenester ved hjelp av
3729 BankID, det vil si at jeg reserverer meg mot enhver bruk av BankID for
3730 å logge meg inn på slike tjenester som kan inneholde personsensitiv
3731 informasjon om meg.</p>
3732
3733 <p>Jeg har ikke BankID i dag, men som en kan se i oppslag i Aftenposten
3734 2012-09-13[3] er det ikke til hindrer for at andre kan bruke BankID på
3735 mine vegne for å få tilgang.  Det sikkerhetsproblemet kommer i tillegg
3736 til utformingsproblemet omtalt over, og forsterker bare mitt syn på at
3737 BankID ikke er aktuelt for meg til noe annet enn å logge inn i en
3738 nettbank der banken i større grad bærer risikoen ved misbruk.</p>
3739
3740 <p>3) &lt;URL: <a href="http://www.aftenposten.no/nyheter/iriks/Tyver-kan-tappe-kontoen-din---selv-uten-passord-og-pinkode--6989793.html">http://www.aftenposten.no/nyheter/iriks/Tyver-kan-tappe-kontoen-din---selv-uten-passord-og-pinkode--6989793.html</a> &gt;</p>
3741
3742 <p>Jeg ber om rask tilbakemelding med saksnummer for min henvendelse.
3743 Jeg ber videre om bekreftelse på at BankID-innlogging er blokkert når
3744 det gjelder tilgang til "min" informasjon hos det offentlige, i
3745 forkant av BankID-integrasjon mot ID-porten som i følge
3746 pressemeldingen skal komme på plass i løpet av et par uker.</p>
3747
3748 <p>--
3749 <br>Vennlig hilsen
3750 <br>Petter Reinholdtsen</p>
3751 </blockquote>
3752
3753 <p>Jeg venter spent på svaret.  Jeg mistenker jeg må sende tilsvarende
3754 beskjed til mine bankforbindelser for å sikre mine bankkontoer.</p>
3755
3756 <p>Hvis det skal brukes offentlig nøkkel-teknologi til å inngå avtaler
3757 på mine vegne og skaffe seg personsensitiv informasjon om meg, så er
3758 mitt krav at det kun er jeg som har tilgang på min private nøkkel.
3759 Alt annet blir å gi for mye tillit til andre.  Med BankID sitter andre
3760 på både "min" offentlige og private nøkkel.</p>
3761
3762       </div>
3763       <div class="tags">
3764
3765
3766         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/bankid">bankid</a>, <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
3767
3768
3769       </div>
3770     </div>
3771     <div class="padding"></div>
3772
3773     <div class="entry">
3774       <div class="title">
3775         <a href="https://people.skolelinux.org/pere/blog/The_European_Central_Bank__ECB__take_a_look_at_bitcoin.html">The European Central Bank (ECB) take a look at bitcoin</a>
3776       </div>
3777       <div class="date">
3778          4th November 2012
3779       </div>
3780       <div class="body">
3781         <p>Slashdot just ran a story about the European Central Bank (ECB)
3782 <a href="http://www.ecb.europa.eu/pub/pdf/other/virtualcurrencyschemes201210en.pdf">releasing
3783 a report (PDF)</a> about virtual currencies and
3784 <a href="http://www.bitcoin.org/">bitcoin</a>.  It is interesting to
3785 see how a member of the bitcoin community
3786 <a href="http://blog.bitinstant.com/blog/2012/10/30/the-ecb-report-on-bitcoin-and-virtual-currencies.html">receive
3787 the report</a>.  As for the future, I suspect the central banks and
3788 the governments will outlaw bitcoin if it gain any popularity, to avoid
3789 competition.  My thoughts go to the
3790 <a href="http://en.wikipedia.org/wiki/Wörgl">Wörgl experiment</a> with
3791 negative inflation on cash which was such a success that it was
3792 terminated by the Austrian National Bank in 1933.  A successful
3793 alternative would be a threat to the current money system and gain
3794 powerful forces to work against it.</p>
3795
3796 <p>While checking out the current status of bitcoin, I also discovered
3797 that the community already seem to have
3798 <a href="http://www.theverge.com/2012/8/27/3271637/bitcoin-savings-trust-pyramid-scheme-shuts-down">experienced
3799 its first pyramid game / Ponzi scheme</a>.  Not very surprising, given
3800 how members of "small" communities tend to trust each other.  I guess
3801 enterprising crocks will try again and again, as they do anywhere
3802 wealth is available.</p>
3803
3804       </div>
3805       <div class="tags">
3806
3807
3808         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
3809
3810
3811       </div>
3812     </div>
3813     <div class="padding"></div>
3814
3815     <div class="entry">
3816       <div class="title">
3817         <a href="https://people.skolelinux.org/pere/blog/The_fight_for_freedom_and_privacy.html">The fight for freedom and privacy</a>
3818       </div>
3819       <div class="date">
3820         18th October 2012
3821       </div>
3822       <div class="body">
3823         <p>Civil liberties and privacy in the western world are going down the
3824 drain, and it is hard to fight against it.  I try to do my best, but
3825 time is limited.  I hope you do your best too.  A few years ago I came
3826 across a marvellous drawing by
3827 <a href="http://www.claybennett.com/about.html">Clay Bennett</a>
3828 visualising some of what is going on.
3829
3830 <p><a href="http://www.claybennett.com/pages/security_fence.html">
3831 <img src="http://www.claybennett.com/images/archivetoons/security_fence.jpg"></a></p>
3832
3833 <blockquote>
3834 «They who can give up essential liberty to obtain a little temporary
3835 safety, deserve neither liberty nor safety.» - Benjamin Franklin
3836 </blockquote>
3837
3838 <p>Do you feel safe at the airport?  I do not.  Do you feel safe when
3839 you see a surveillance camera?  I do not.  Do you feel safe when you
3840 leave electronic traces of your behaviour and opinions?  I do not.  I
3841 just remember <a href="http://en.wikipedia.org/wiki/Panopticon">the
3842 Panopticon</a>, and can not help to think that we are slowly
3843 transforming our society to a huge Panopticon on our own.</p>
3844
3845       </div>
3846       <div class="tags">
3847
3848
3849         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
3850
3851
3852       </div>
3853     </div>
3854     <div class="padding"></div>
3855
3856     <div class="entry">
3857       <div class="title">
3858         <a href="https://people.skolelinux.org/pere/blog/Using_NVD_and_CPE_to_track_CVEs_in_locally_maintained_software.html">Using NVD and CPE to track CVEs in locally maintained software</a>
3859       </div>
3860       <div class="date">
3861         28th January 2011
3862       </div>
3863       <div class="body">
3864         <p>The last few days I have looked at ways to track open security
3865 issues here at my work with the University of Oslo.  My idea is that
3866 it should be possible to use the information about security issues
3867 available on the Internet, and check our locally
3868 maintained/distributed software against this information.  It should
3869 allow us to verify that no known security issues are forgotten.  The
3870 CVE database listing vulnerabilities seem like a great central point,
3871 and by using the package lists from Debian mapped to CVEs provided by
3872 the testing security team, I believed it should be possible to figure
3873 out which security holes were present in our free software
3874 collection.</p>
3875
3876 <p>After reading up on the topic, it became obvious that the first
3877 building block is to be able to name software packages in a unique and
3878 consistent way across data sources.  I considered several ways to do
3879 this, for example coming up with my own naming scheme like using URLs
3880 to project home pages or URLs to the Freshmeat entries, or using some
3881 existing naming scheme.  And it seem like I am not the first one to
3882 come across this problem, as MITRE already proposed and implemented a
3883 solution.  Enter the <a href="http://cpe.mitre.org/index.html">Common
3884 Platform Enumeration</a> dictionary, a vocabulary for referring to
3885 software, hardware and other platform components.  The CPE ids are
3886 mapped to CVEs in the <a href="http://web.nvd.nist.gov/">National
3887 Vulnerability Database</a>, allowing me to look up know security
3888 issues for any CPE name.  With this in place, all I need to do is to
3889 locate the CPE id for the software packages we use at the university.
3890 This is fairly trivial (I google for 'cve cpe $package' and check the
3891 NVD entry if a CVE for the package exist).</p>
3892
3893 <p>To give you an example.  The GNU gzip source package have the CPE
3894 name cpe:/a:gnu:gzip.  If the old version 1.3.3 was the package to
3895 check out, one could look up
3896 <a href="http://web.nvd.nist.gov/view/vuln/search?cpe=cpe%3A%2Fa%3Agnu%3Agzip:1.3.3">cpe:/a:gnu:gzip:1.3.3
3897 in NVD</a> and get a list of 6 security holes with public CVE entries.
3898 The most recent one is
3899 <a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0001">CVE-2010-0001</a>,
3900 and at the bottom of the NVD page for this vulnerability the complete
3901 list of affected versions is provided.</p>
3902
3903 <p>The NVD database of CVEs is also available as a XML dump, allowing
3904 for offline processing of issues.  Using this dump, I've written a
3905 small script taking a list of CPEs as input and list all CVEs
3906 affecting the packages represented by these CPEs.  One give it CPEs
3907 with version numbers as specified above and get a list of open
3908 security issues out.</p>
3909
3910 <p>Of course for this approach to be useful, the quality of the NVD
3911 information need to be high.  For that to happen, I believe as many as
3912 possible need to use and contribute to the NVD database.  I notice
3913 RHEL is providing
3914 <a href="https://www.redhat.com/security/data/metrics/rhsamapcpe.txt">a
3915 map from CVE to CPE</a>, indicating that they are using the CPE
3916 information.  I'm not aware of Debian and Ubuntu doing the same.</p>
3917
3918 <p>To get an idea about the quality for free software, I spent some
3919 time making it possible to compare the CVE database from Debian with
3920 the CVE database in NVD.  The result look fairly good, but there are
3921 some inconsistencies in NVD (same software package having several
3922 CPEs), and some inaccuracies (NVD not mentioning buggy packages that
3923 Debian believe are affected by a CVE).  Hope to find time to improve
3924 the quality of NVD, but that require being able to get in touch with
3925 someone maintaining it.  So far my three emails with questions and
3926 corrections have not seen any reply, but I hope contact can be
3927 established soon.</p>
3928
3929 <p>An interesting application for CPEs is cross platform package
3930 mapping.  It would be useful to know which packages in for example
3931 RHEL, OpenSuSe and Mandriva are missing from Debian and Ubuntu, and
3932 this would be trivial if all linux distributions provided CPE entries
3933 for their packages.</p>
3934
3935       </div>
3936       <div class="tags">
3937
3938
3939         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
3940
3941
3942       </div>
3943     </div>
3944     <div class="padding"></div>
3945
3946     <div class="entry">
3947       <div class="title">
3948         <a href="https://people.skolelinux.org/pere/blog/Some_thoughts_on_BitCoins.html">Some thoughts on BitCoins</a>
3949       </div>
3950       <div class="date">
3951         11th December 2010
3952       </div>
3953       <div class="body">
3954         <p>As I continue to explore
3955 <a href="http://www.bitcoin.org/">BitCoin</a>, I've starting to wonder
3956 what properties the system have, and how it will be affected by laws
3957 and regulations here in Norway.  Here are some random notes.</p>
3958
3959 <p>One interesting thing to note is that since the transactions are
3960 verified using a peer to peer network, all details about a transaction
3961 is known to everyone.  This means that if a BitCoin address has been
3962 published like I did with mine in my initial post about BitCoin, it is
3963 possible for everyone to see how many BitCoins have been transfered to
3964 that address.  There is even a web service to look at the details for
3965 all transactions.  There I can see that my address
3966 <a href="http://blockexplorer.com/address/15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a>
3967 have received 16.06 Bitcoin, the
3968 <a href="http://blockexplorer.com/address/1LfdGnGuWkpSJgbQySxxCWhv8MHqvwst3">1LfdGnGuWkpSJgbQySxxCWhv8MHqvwst3</a>
3969 address of Simon Phipps have received 181.97 BitCoin and the address
3970 <a href="http://blockexplorer.com/address/1MCwBbhNGp5hRm5rC1Aims2YFRe2SXPYKt">1MCwBbhNGp5hRm5rC1Aims2YFRe2SXPYKt</A>
3971 of EFF have received 2447.38 BitCoins so far.  Thank you to each and
3972 every one of you that donated bitcoins to support my activity. The
3973 fact that anyone can see how much money was transfered to a given
3974 address make it more obvious why the BitCoin community recommend to
3975 generate and hand out a new address for each transaction.  I'm told
3976 there is no way to track which addresses belong to a given person or
3977 organisation without the person or organisation revealing it
3978 themselves, as Simon, EFF and I have done.</p>
3979
3980 <p>In Norway, and in most other countries, there are laws and
3981 regulations limiting how much money one can transfer across the border
3982 without declaring it.  There are money laundering, tax and accounting
3983 laws and regulations I would expect to apply to the use of BitCoin.
3984 If the Skolelinux foundation
3985 (<a href="http://linuxiskolen.no/slxdebianlabs/donations.html">SLX
3986 Debian Labs</a>) were to accept donations in BitCoin in addition to
3987 normal bank transfers like EFF is doing, how should this be accounted?
3988 Given that it is impossible to know if money can cross the border or
3989 not, should everything or nothing be declared?  What exchange rate
3990 should be used when calculating taxes?  Would receivers have to pay
3991 income tax if the foundation were to pay Skolelinux contributors in
3992 BitCoin?  I have no idea, but it would be interesting to know.</p>
3993
3994 <p>For a currency to be useful and successful, it must be trusted and
3995 accepted by a lot of users.  It must be possible to get easy access to
3996 the currency (as a wage or using currency exchanges), and it must be
3997 easy to spend it.  At the moment BitCoin seem fairly easy to get
3998 access to, but there are very few places to spend it.  I am not really
3999 a regular user of any of the vendor types currently accepting BitCoin,
4000 so I wonder when my kind of shop would start accepting BitCoins.  I
4001 would like to buy electronics, travels and subway tickets, not herbs
4002 and books. :) The currency is young, and this will improve over time
4003 if it become popular, but I suspect regular banks will start to lobby
4004 to get BitCoin declared illegal if it become popular.  I'm sure they
4005 will claim it is helping fund terrorism and money laundering (which
4006 probably would be true, as is any currency in existence), but I
4007 believe the problems should be solved elsewhere and not by blaming
4008 currencies.</p>
4009
4010 <p>The process of creating new BitCoins is called mining, and it is
4011 CPU intensive process that depend on a bit of luck as well (as one is
4012 competing against all the other miners currently spending CPU cycles
4013 to see which one get the next lump of cash).  The "winner" get 50
4014 BitCoin when this happen.  Yesterday I came across the obvious way to
4015 join forces to increase ones changes of getting at least some coins,
4016 by coordinating the work on mining BitCoins across several machines
4017 and people, and sharing the result if one is lucky and get the 50
4018 BitCoins.  Check out
4019 <a href="http://www.bluishcoder.co.nz/bitcoin-pool/">BitCoin Pool</a>
4020 if this sounds interesting.  I have not had time to try to set up a
4021 machine to participate there yet, but have seen that running on ones
4022 own for a few days have not yield any BitCoins througth mining
4023 yet.</p>
4024
4025 <p>Update 2010-12-15: Found an <a
4026 href="http://inertia.posterous.com/reply-to-the-underground-economist-why-bitcoi">interesting
4027 criticism</a> of bitcoin.  Not quite sure how valid it is, but thought
4028 it was interesting to read.  The arguments presented seem to be
4029 equally valid for gold, which was used as a currency for many years.</p>
4030
4031       </div>
4032       <div class="tags">
4033
4034
4035         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin</a>, <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
4036
4037
4038       </div>
4039     </div>
4040     <div class="padding"></div>
4041
4042     <div class="entry">
4043       <div class="title">
4044         <a href="https://people.skolelinux.org/pere/blog/Pornoskannerne_p__flyplassene_bedrer_visst_ikke_sikkerheten.html">Pornoskannerne på flyplassene bedrer visst ikke sikkerheten</a>
4045       </div>
4046       <div class="date">
4047         11th December 2010
4048       </div>
4049       <div class="body">
4050         <p>Via <a href="http://webmink.com/2010/12/10/links-for-2010-12-10/">en
4051 blogpost fra Simon Phipps i går</a>, fant jeg en referanse til
4052 <a href="http://www.washingtontimes.com/news/2010/dec/9/exposed-tsas-x-rated-scanner-fraud/">en
4053 artikkel i Washington Times</a> som igjen refererer til en artikkel i
4054 det fagfellevurderte tidsskriftet Journal of Transportation Security
4055 med tittelen
4056 "<a href="http://springerlink.com/content/g6620thk08679160/fulltext.html">An
4057 evaluation of airport x-ray backscatter units based on image
4058 characteristics</a>" som enkelt konstaterer at
4059 <a href="http://www.dailysquib.co.uk/?a=2389&c=124">pornoscannerne</a>
4060 som kler av reisende på flyplasser ikke er i stand til å avsløre det
4061 produsenten og amerikanske myndigheter sier de skal avsløre.  Kort
4062 sagt, de bedrer ikke sikkerheten.  Reisende må altså la ansatte på
4063 flyplasser <a href="http://www.thousandsstandingaround.org/">se dem
4064 nakne eller la seg beføle i skrittet</a> uten grunn.  Jeg vil
4065 fortsette å nekte å bruke disse pornoskannerne, unngå flyplasser der
4066 de er tatt i bruk, og reise med andre transportmidler enn fly hvis jeg
4067 kan.</p>
4068
4069       </div>
4070       <div class="tags">
4071
4072
4073         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
4074
4075
4076       </div>
4077     </div>
4078     <div class="padding"></div>
4079
4080     <div class="entry">
4081       <div class="title">
4082         <a href="https://people.skolelinux.org/pere/blog/Now_accepting_bitcoins___anonymous_and_distributed_p2p_crypto_money.html">Now accepting bitcoins - anonymous and distributed p2p crypto-money</a>
4083       </div>
4084       <div class="date">
4085         10th December 2010
4086       </div>
4087       <div class="body">
4088         <p>With this weeks lawless
4089 <a href="http://www.salon.com/news/opinion/glenn_greenwald/2010/12/06/wikileaks/index.html">governmental
4090 attacks</a> on Wikileak and
4091 <a href="http://www.salon.com/technology/dan_gillmor/2010/12/06/war_on_speech">free
4092 speech</a>, it has become obvious that PayPal, visa and mastercard can
4093 not be trusted to handle money transactions.
4094 A blog post from
4095 <a href="http://webmink.com/2010/12/06/now-accepting-bitcoin/">Simon
4096 Phipps on bitcoin</a> reminded me about a project that a friend of
4097 mine mentioned earlier.  I decided to follow Simon's example, and get
4098 involved with <a href="http://www.bitcoin.org/">BitCoin</a>.  I got
4099 some help from my friend to get it all running, and he even handed me
4100 some bitcoins to get started.  I even donated a few bitcoins to Simon
4101 for helping me remember BitCoin.</p>
4102
4103 <p>So, what is bitcoins, you probably wonder?  It is a digital
4104 crypto-currency, decentralised and handled using peer-to-peer
4105 networks.  It allows anonymous transactions and prohibits central
4106 control over the transactions, making it impossible for governments
4107 and companies alike to block donations and other transactions.  The
4108 source is free software, and while the key dependency wxWidgets 2.9
4109 for the graphical user interface is missing in Debian, the command
4110 line client builds just fine.  Hopefully Jonas
4111 <a href="http://bugs.debian.org/578157">will get the package into
4112 Debian</a> soon.</p>
4113
4114 <p>Bitcoins can be converted to other currencies, like USD and EUR.
4115 There are <a href="http://www.bitcoin.org/trade">companies accepting
4116 bitcoins</a> when selling services and goods, and there are even
4117 currency "stock" markets where the exchange rate is decided.  There
4118 are not many users so far, but the concept seems promising.  If you
4119 want to get started and lack a friend with any bitcoins to spare,
4120 you can even get
4121 <a href="https://freebitcoins.appspot.com/">some for free</a> (0.05
4122 bitcoin at the time of writing).  Use
4123 <a href="http://www.bitcoinwatch.com/">BitcoinWatch</a> to keep an eye
4124 on the current exchange rates.</p>
4125
4126 <p>As an experiment, I have decided to set up bitcoind on one of my
4127 machines.  If you want to support my activity, please send Bitcoin
4128 donations to the address
4129 <b>15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</b>.  Thank you!</p>
4130
4131       </div>
4132       <div class="tags">
4133
4134
4135         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin</a>, <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
4136
4137
4138       </div>
4139     </div>
4140     <div class="padding"></div>
4141
4142     <div class="entry">
4143       <div class="title">
4144         <a href="https://people.skolelinux.org/pere/blog/DND_hedrer_overv_kning_av_barn_med_Rosingsprisen.html">DND hedrer overvåkning av barn med Rosingsprisen</a>
4145       </div>
4146       <div class="date">
4147         23rd November 2010
4148       </div>
4149       <div class="body">
4150         <p>Jeg registrerer med vond smak i munnen at Den Norske Dataforening
4151 <a
4152 href="http://www.dataforeningen.no/hedret-med-rosingprisen.4849070-133913.html">hedrer
4153 overvåkning av barn med Rosingsprisen for kreativitet i år</a>.  Jeg
4154 er glad jeg nå er meldt ut av DND.</p>
4155
4156 <p>Å elektronisk overvåke sine barn er ikke å gjøre dem en tjeneste,
4157 men et overgrep mot individer i utvikling som bør læres opp til å ta
4158 egne valg.</p>
4159
4160 <p>For å sitere Datatilsynets nye leder, Bjørn Erik Thon, i
4161 <a href="http://www.idg.no/computerworld/article174262.ece">et intervju
4162 med Computerworld Norge</A>:</p>
4163
4164 <p><blockquote>
4165 - For alle som har barn, meg selv inkludert, er førstetanken at det
4166 hadde vært fint å vite hvor barnet sitt er til enhver tid. Men ungene
4167 har ikke godt av det. De er små individer som skal søke rundt og finne
4168 sine små gjemmesteder og utvide horisonten, uten at foreldrene ser dem
4169 i kortene. Det kan være fristende, men jeg ville ikke gått inn i
4170 dette.
4171 </blockquote></p>
4172
4173 <p>Det er skremmende å se at DND mener en tjeneste som legger opp til
4174 slike overgrep bør hedres.  Å flytte oppveksten for barn inn i en
4175 virtuell
4176 <a href="http://en.wikipedia.org/wiki/Panopticon">Panopticon</a> er et
4177 grovt overgrep og vil gjøre skade på barnenes utvikling, og foreldre
4178 burde tenke seg godt om før de gir etter for sine instinkter her.</p>
4179
4180 <p>Blipper-tjenesten får meg til å tenke på bøkene til
4181 <a href="http://en.wikipedia.org/wiki/John_Twelve_Hawks">John Twelve
4182 Hawks</a>, som forbilledlig beskriver hvordan et totalitært
4183 overvåkningssamfunn bygges sakte men sikkert rundt oss, satt sammen av
4184 gode intensjoner og manglende bevissthet om hvilke prinsipper et
4185 liberalt demokrati er fundamentert på.  Jeg har hatt stor glede av å
4186 lese alle de tre bøkene.</p>
4187
4188       </div>
4189       <div class="tags">
4190
4191
4192         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
4193
4194
4195       </div>
4196     </div>
4197     <div class="padding"></div>
4198
4199     <div class="entry">
4200       <div class="title">
4201         <a href="https://people.skolelinux.org/pere/blog/Datatilsynet_mangler_verkt_yet_som_trengs_for___kontrollere_kameraoverv_kning.html">Datatilsynet mangler verktøyet som trengs for å kontrollere kameraovervåkning</a>
4202       </div>
4203       <div class="date">
4204          9th November 2010
4205       </div>
4206       <div class="body">
4207         <p>En stund tilbake ble jeg oppmerksom på at Datatilsynets verktøy for
4208 å holde rede på overvåkningskamera i Norge ikke var egnet til annet
4209 enn å lage statistikk, og ikke kunne brukes for å kontrollere om et
4210 overvåkningskamera i det offentlige rom er lovlig satt opp og
4211 registrert.  For å teste hypotesen sendte jeg for noen dager siden
4212 følgende spørsmål til datatilsynet.  Det omtalte kameraet står litt
4213 merkelig plassert i veigrøften ved gangstien langs Sandakerveien, og
4214 jeg lurer oppriktig på om det er lovlig plassert og registrert.</p>
4215
4216 <p><blockquote>
4217 <p>Date: Tue, 2 Nov 2010 16:08:20 +0100
4218 <br>From: Petter Reinholdtsen &lt;pere (at) hungry.com&gt;
4219 <br>To: postkasse (at) datatilsynet.no
4220 <br>Subject: Er overvåkningskameraet korrekt registrert?</p>
4221
4222 <p>Hei.</p>
4223
4224 <p>I Nydalen i Oslo er det mange overvåkningskamera, og et av dem er
4225 spesielt merkelig plassert like over et kumlokk.  Jeg lurer på om
4226 dette kameraet er korrekt registrert og i henhold til lovverket.</p>
4227
4228 <p>Finner ingen eierinformasjon på kameraet, og dermed heller ingenting å
4229 søke på i &lt;URL:
4230 <a href="http://hetti.datatilsynet.no/melding/report_search.pl">http://hetti.datatilsynet.no/melding/report_search.pl</a> &gt;.
4231 Kartreferanse for kameraet er tilgjengelig fra
4232 &lt;URL:
4233 <a href="http://people.skolelinux.no/pere/surveillance-norway/?zoom=17&lat=59.94918&lon=10.76962&layers=B0T">http://people.skolelinux.no/pere/surveillance-norway/?zoom=17&lat=59.94918&lon=10.76962&layers=B0T</a> &gt;.
4234
4235 <p>Kan dere fortelle meg om dette kameraet er registrert hos
4236 Datatilsynet som det skal være i henhold til lovverket?</p>
4237
4238 <p>Det hadde forresten vært fint om rådata fra kameraregisteret var
4239 tilgjengelig på web og regelmessig oppdatert, for å kunne søke på
4240 andre ting enn organisasjonsnavn og -nummer ved å laste det ned og
4241 gjøre egne søk.</p>
4242
4243 <p>Vennlig hilsen,
4244 <br>--
4245 <br>Petter Reinholdtsen
4246 </blockquote></p>
4247
4248 <p>Her er svaret som kom dagen etter:</p>
4249
4250 <p><blockquote>
4251 <p>Date: Wed, 3 Nov 2010 14:44:09 +0100
4252 <br>From: "juridisk" &lt;juridisk (at) Datatilsynet.no&gt;
4253 <br>To: Petter Reinholdtsen
4254 <br>Subject: VS: Er overvåkningskameraet korrekt registrert?
4255
4256 <p>Viser til e-post av 2. november.
4257
4258 <p>Datatilsynet er det forvaltningsorganet som skal kontrollere at
4259 personopplysningsloven blir fulgt. Formålet med loven er å verne
4260 enkeltpersoner mot krenking av personvernet gjennom behandling av
4261 personopplysninger.</p>
4262
4263 <p>Juridisk veiledningstjeneste hos Datatilsynet gir råd og veiledning
4264 omkring personopplysningslovens regler på generelt grunnlag.</p>
4265
4266 <p>Datatilsynet har dessverre ikke en fullstendig oversikt over alle
4267 kameraer, den oversikten som finner er i vår meldingsdatabase som du
4268 finner her:
4269 <a href="http://www.datatilsynet.no/templates/article____211.aspx">http://www.datatilsynet.no/templates/article____211.aspx</a></p>
4270
4271 <p>Denne databasen gir en oversikt over virksomheter som har meldt inn
4272 kameraovervåkning. Dersom man ikek vet hvilken virksomhet som er
4273 ansvarlig, er det heller ikke mulig for Datatilsynet å søke dette
4274 opp.</p>
4275
4276 <p>Webkameraer som har så dårlig oppløsning at man ikke kan gjenkjenne
4277 enkeltpersoner er ikke meldepliktige, da dette ikke anses som
4278 kameraovervåkning i personopplysningslovens forstand. Dersom kameraet
4279 du sikter til er et slikt webkamera, vil det kanskje ikke finnes i
4280 meldingsdatabasen på grunn av dette.  Også dersom et kamera med god
4281 oppløsning ikke filmer mennesker, faller det utenfor loven.</p>
4282
4283 <p>Datatilsynet har laget en veileder som gjennomgår når det er lov å
4284 overvåke med kamera, se lenke:
4285 <a href="http://www.datatilsynet.no/templates/article____401.aspx">http://www.datatilsynet.no/templates/article____401.aspx</a></p>
4286
4287 <p>Dersom det ikke er klart hvem som er ansvarlig for kameraet, er det
4288 vanskelig for Datatilsynet å ta kontakt med den ansvarlige for å få
4289 avklart om kameraet er satt opp i tråd med tilsynets regelverk. Dersom
4290 du mener at kameraet ikke er lovlig ut fra informasjonen ovenfor, kan
4291 kameraet anmeldes til politiet.</p>
4292
4293 <p>Med vennlig hilsen</p>
4294
4295 <p>Maria Bakke
4296 <br>Juridisk veiledningstjeneste
4297 <br>Datatilsynet</p>
4298 </blockquote></p>
4299
4300 <p>Personlig synes jeg det bør være krav om å registrere hvert eneste
4301 overvåkningskamera i det offentlige rom hos Datatilsynet, med
4302 kartreferanse og begrunnelse om hvorfor det er satt opp, slik at
4303 enhver borger enkelt kan hente ut kart over områder vi er interessert
4304 i og sjekke om det er overvåkningskamera der som er satt opp uten å
4305 være registert.  Slike registreringer skal jo i dag fornyes
4306 regelmessing, noe jeg mistenker ikke blir gjort.  Dermed kan kamera
4307 som en gang var korrekt registrert nå være ulovlig satt opp.  Det
4308 burde også være bøter for å ha kamera som ikke er korrekt registrert,
4309 slik at en ikke kan ignorere registrering uten at det får
4310 konsekvenser.</p>
4311
4312 <p>En ide fra England som jeg har sans (lite annet jeg har sans for
4313 når det gjelder overvåkningskamera i England) for er at enhver borger
4314 kan be om å få kopi av det som er tatt opp med et overvåkningskamera i
4315 det offentlige rom, noe som gjør at det kan komme løpende utgifter ved
4316 å sette overvåkningskamera.  Jeg tror alt som gjør det mindre
4317 attraktivt å ha overvåkningskamera i det offentlige rom er en god
4318 ting, så et slikt lovverk i Norge tror jeg hadde vært nyttig.</p>
4319
4320       </div>
4321       <div class="tags">
4322
4323
4324         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance</a>.
4325
4326
4327       </div>
4328     </div>
4329     <div class="padding"></div>
4330
4331     <div class="entry">
4332       <div class="title">
4333         <a href="https://people.skolelinux.org/pere/blog/Datatilsynet_svarer_om_Bilkollektivets__nske_om_GPS_sporing.html">Datatilsynet svarer om Bilkollektivets ønske om GPS-sporing</a>
4334       </div>
4335       <div class="date">
4336         14th October 2010
4337       </div>
4338       <div class="body">
4339         <p>I forbindelse med Bilkollektivets plan om å skaffe seg mulighet til
4340 å GPS-spore sine medlemmers bevegelser
4341 (<a href="http://people.skolelinux.org/pere/blog/Bilkollektivet_vil_ha_retten_til____se_hvor_jeg_kj__rer___.html">omtalt
4342 tidligere</a>), sendte jeg avgårde et spørsmål til <a
4343 href="http://www.datatilsynet.no/">Datatilsynet</a> for å gjøre dem
4344 oppmerksom på saken og høre hva de hadde å si.  Her er korrespondansen
4345 så langt.</p>
4346
4347 <p><blockquote>
4348 Date: Thu, 23 Sep 2010 13:38:55 +0200
4349 <br>From: Petter Reinholdtsen
4350 <br>To: postkasse@datatilsynet.no
4351 <br>Subject: GPS-sporing av privatpersoners bruk av bil?
4352
4353 <p>Hei.  Jeg er med i Bilkollektivet[1] her i Oslo, og ble i dag
4354 orientert om at de har tenkt å innføre GPS-sporing av bilene og krever
4355 at en for fremtidig bruk skal godkjenne følgende klausul i
4356 bruksvilkårene[2]:</p>
4357
4358 <p><blockquote>
4359   Andelseier er med dette gjort kjent med at bilene er utstyrt med
4360   sporingsutstyr, som kan benyttes av Bilkollektivet til å spore biler
4361   som brukes utenfor gyldig reservasjon.
4362 </blockquote></p>
4363
4364 <p>Er slik sporing meldepliktig til datatilsynet?  Har Bilkollektivet
4365 meldt dette til Datatilsynet?  Forsøkte å søke på orgnr. 874 538 892
4366 på søkesiden for meldinger[3], men fant intet der.</p>
4367
4368 <p>Hva er datatilsynets syn på slik sporing av privatpersoners bruk av
4369 bil?</p>
4370
4371 <p>Jeg må innrømme at jeg forventer å kunne ferdes anonymt og uten
4372 radiomerking i Norge, og synes GPS-sporing av bilen jeg ønsker å bruke
4373 i så måte er et overgrep mot privatlivets fred.  For meg er det et
4374 prinsipielt spørsmål og det er underordnet hvem og med hvilket formål
4375 som i første omgang sies å skulle ha tilgang til
4376 sporingsinformasjonen.  Jeg vil ikke ha mulighet til å sjekke eller
4377 kontrollere når bruksområdene utvides, og erfaring viser jo at
4378 bruksområder utvides når informasjon først er samlet inn.<p>
4379
4380 <p>1 &lt;URL: http://www.bilkollektivet.no/ >
4381 <br>2 &lt;URL: http://www.bilkollektivet.no/bilbruksregler.26256.no.html >
4382 <br>3 &lt;URL: http://hetti.datatilsynet.no/melding/report_search.pl >
4383
4384 <p>Vennlig hilsen,
4385 <br>--
4386 <br>Petter Reinholdtsen
4387 </blockquote></p>
4388
4389 <p>Svaret fra Datatilsynet kom dagen etter:</p>
4390
4391 <p><blockquote>
4392 Date: Fri, 24 Sep 2010 11:24:17 +0200
4393 <br>From: Henok Tesfazghi
4394 <br>To: Petter Reinholdtsen
4395 <br>Subject: VS: GPS-sporing av privatpersoners bruk av bil?
4396
4397 <p>Viser til e-post av 23. september 2010.</p>
4398
4399 <p>Datatilsynet er det forvaltningsorganet som skal kontrollere at
4400 personopplysningsloven blir fulgt. Formålet med loven er å verne
4401 enkeltpersoner mot krenking av personvernet gjennom behandling av
4402 personopplysninger. Vi gjør oppmerksom på at vår e-post svartjeneste
4403 er ment å være en kortfattet rådgivningstjeneste, slik at vi av den
4404 grunn ikke kan konkludere i din sak, men gi deg innledende råd og
4405 veiledning. Vårt syn er basert på din fremstilling av saksforholdet,
4406 andre opplysninger vi eventuelt ikke kjenner til og som kan være
4407 relevante, vil kunne medføre et annet resultat.</p>
4408
4409 <p>Det er uklart for Datatilsynet hva slags GPS-sporing Bilkollektivet
4410 her legger opp til. Dette skyldes blant annet manglende informasjon i
4411 forhold til hvilket formål GPS-sporingen har, hvordan det er ment å
4412 fungere, hvilket behandlingsgrunnlag som ligger til grunn, samt om
4413 opplysningene skal lagres eller ikke.</p>
4414
4415 <p>Behandlingen vil i utgangspunket være meldepliktig etter
4416 personopplysningslovens § 31. Det finnes en rekke unntak fra
4417 meldeplikten som er hjemlet i personopplysningsforskriftens kapittel
4418 7. Da dette er et andelslag, og andelseiere i en utstrekning også kan
4419 karakteriseres som kunder, vil unntak etter
4420 personopplysningsforskriftens § 7-7 kunne komme til anvendelse, se
4421 lenke: <a href="http://lovdata.no/for/sf/fa/ta-20001215-1265-009.html#7-7">http://lovdata.no/for/sf/fa/ta-20001215-1265-009.html#7-7</a></p>
4422
4423 <p>Datatilsynet har til orientering en rekke artikler som omhandler
4424 henholdsvis sporing og lokalisering, samt trafikanter og passasjerer,
4425 se lenke:
4426 <br><a href="http://www.datatilsynet.no/templates/article____1730.aspx">http://www.datatilsynet.no/templates/article____1730.aspx</a> og
4427 <br><a href="http://www.datatilsynet.no/templates/article____1098.aspx">http://www.datatilsynet.no/templates/article____1098.aspx</a></p>
4428
4429
4430 <p>Vennlig hilsen
4431 <br>Henok Tesfazghi
4432 <br>Rådgiver, Datatilsynet
4433 </blockquote></p>
4434
4435 <p>Vet ennå ikke om jeg har overskudd til å ta opp kampen i
4436 Bilkollektivet, mellom barnepass og alt det andre som spiser opp
4437 dagene, eller om jeg bare finner et annet alternativ.</p>
4438
4439       </div>
4440       <div class="tags">
4441
4442
4443         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
4444
4445
4446       </div>
4447     </div>
4448     <div class="padding"></div>
4449
4450     <div class="entry">
4451       <div class="title">
4452         <a href="https://people.skolelinux.org/pere/blog/Bilkollektivet_vil_ha_retten_til___se_hvor_jeg_kj_rer___.html">Bilkollektivet vil ha retten til å se hvor jeg kjører...</a>
4453       </div>
4454       <div class="date">
4455         23rd September 2010
4456       </div>
4457       <div class="body">
4458         <p>Jeg er med i
4459 <a href="http://www.bilkollektivet.no/">Bilkollektivet</a> her i Oslo,
4460 og har inntil i dag vært fornøyd med opplegget.  I dag kom det brev
4461 fra bilkollektivet, der de forteller om nytt webopplegg og nye
4462 rutiner, og at de har tenkt å angripe min rett til å ferdes anonymt
4463 som bruker av Bilkollektivet.  Det gjorde meg virkelig trist å
4464 lese.</p>
4465
4466 <p>Brevet datert 2010-09-16 forteller at Bilkollektivet har tenkt å gå
4467 over til biler med "bilcomputer" og innebygget sporings-GPS som lar
4468 administrasjonen i bilkollektivet se hvor bilene er til en hver tid,
4469 noe som betyr at de også kan se hvor jeg kjører når jeg bruker
4470 Bilkollektivet.
4471 <a href="http://people.skolelinux.org/pere/blog/Anonym_ferdsel_er_en_menneskerett.html">Retten
4472 til å ferdes anonymt</a> er som tidligere nevnt viktig for meg, og jeg
4473 finner det uakseptabelt å måtte godta å bli radiomerket for å kunne
4474 bruke bil.  Har ikke satt meg inn i hva som er historien for denne
4475 endringen, så jeg vet ikke om det er godkjent av
4476 f.eks. andelseiermøtet.  Ser at
4477 <a href="http://www.bilkollektivet.no/bilbruksregler.26256.no.html">nye
4478 bilbruksregler</a> med følgende klausul ble vedtatt av styret
4479 2010-08-26:</p>
4480
4481 <blockquote><p>Andelseier er med dette gjort kjent med at bilene er
4482 utstyrt med sporingsutstyr, som kan benyttes av Bilkollektivet til å
4483 spore biler som brukes utenfor gyldig reservasjon.</p></blockquote>
4484
4485 <p>For meg er det prinsipielt uakseptabelt av Bilkollektivet å skaffe
4486 seg muligheten til å se hvor jeg befinner meg, og det er underordnet
4487 når informasjonen blir brukt og hvem som får tilgang til den.  Får se
4488 om jeg har energi til å forsøke å endre planene til Bilkollektivet
4489 eller bare ser meg om etter alternativer.</p>
4490
4491       </div>
4492       <div class="tags">
4493
4494
4495         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
4496
4497
4498       </div>
4499     </div>
4500     <div class="padding"></div>
4501
4502     <div class="entry">
4503       <div class="title">
4504         <a href="https://people.skolelinux.org/pere/blog/Anonym_ferdsel_er_en_menneskerett.html">Anonym ferdsel er en menneskerett</a>
4505       </div>
4506       <div class="date">
4507         15th September 2010
4508       </div>
4509       <div class="body">
4510         <p>Debatten rundt sporveiselskapet i Oslos (Ruter AS) ønske om
4511 <a href="http://www.aftenposten.no/nyheter/iriks/article3808135.ece">å
4512 radiomerke med RFID</a> alle sine kunder og
4513 <a href="http://www.aftenposten.no/nyheter/article3809746.ece">registrere
4514 hvor hver og en av oss beveger oss</a> pågår, og en ting som har
4515 kommet lite frem i debatten er at det faktisk er en menneskerett å
4516 kunne ferdes anonymt internt i ens eget land.</p>
4517
4518 <p>Fant en grei kilde for dette i et
4519 <a href="http://www.datatilsynet.no/upload/Microsoft%20Word%20-%2009-01399-2%20H+%C2%A9ringsnotat%20-%20Samferdselsdepartementet%20-%20Utkas%C3%94%C3%87%C2%AA.pdf">skriv
4520 fra Datatilsynet</a> til Samferdselsdepartementet om tema:</p>
4521
4522 <blockquote><p>Retten til å ferdes anonymt kan utledes av
4523 menneskerettskonvensjonen artikkel 8 og av EUs personverndirektiv.
4524 Her heter det at enkeltpersoners grunnleggende rettigheter og frihet
4525 må respekteres, særlig retten til privatlivets fred.  I både
4526 personverndirektivet og i den norske personopplysningsloven er
4527 selvråderetten til hver enkelt et av grunnprinsippene, hovedsaklig
4528 uttrykt ved at en må gi et frivillig, informert og uttrykkelig
4529 samtykke til behandling av personopplysninger.</p></blockquote>
4530
4531 <p>For meg er det viktig at jeg kan ferdes anonymt, og det er litt av
4532 bakgrunnen til at jeg handler med kontanter, ikke har mobiltelefon og
4533 forventer å kunne reise med bil og kollektivtrafikk uten at det blir
4534 registrert hvor jeg har vært.  Ruter angriper min rett til å ferdes
4535 uten radiopeiler med sin innføring av RFID-kort, og dokumenterer sitt
4536 ønske om å registrere hvor kundene befant seg ved å ønske å gebyrlegge
4537 oss som ikke registrerer oss hver gang vi beveger oss med
4538 kollektivtrafikken i Oslo.  Jeg synes det er hårreisende.</p>
4539
4540       </div>
4541       <div class="tags">
4542
4543
4544         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/betalkontant">betalkontant</a>, <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/ruter">ruter</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
4545
4546
4547       </div>
4548     </div>
4549     <div class="padding"></div>
4550
4551     <div class="entry">
4552       <div class="title">
4553         <a href="https://people.skolelinux.org/pere/blog/Forslag_i_stortinget_om___stoppe_elektronisk_stemmegiving_i_Norge.html">Forslag i stortinget om å stoppe elektronisk stemmegiving i Norge</a>
4554       </div>
4555       <div class="date">
4556         31st August 2010
4557       </div>
4558       <div class="body">
4559         <p>Ble tipset i dag om at et forslag om å stoppe forsøkene med
4560 elektronisk stemmegiving utenfor valglokaler er
4561 <a href="http://www.stortinget.no/no/Saker-og-publikasjoner/Saker/Sak/?p=46616">til
4562 behandling</a> i Stortinget.
4563 <a href="http://www.stortinget.no/Global/pdf/Representantforslag/2009-2010/dok8-200910-128.pdf">Forslaget</a>
4564 er fremmet av Erna Solberg, Michael Tetzschner og Trond Helleland.</p>
4565
4566 <p>Håper det får flertall.</p>
4567
4568       </div>
4569       <div class="tags">
4570
4571
4572         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/valg">valg</a>.
4573
4574
4575       </div>
4576     </div>
4577     <div class="padding"></div>
4578
4579     <div class="entry">
4580       <div class="title">
4581         <a href="https://people.skolelinux.org/pere/blog/Sikkerhetsteateret_p__flyplassene_fortsetter.html">Sikkerhetsteateret på flyplassene fortsetter</a>
4582       </div>
4583       <div class="date">
4584         28th August 2010
4585       </div>
4586       <div class="body">
4587         <p>Jeg skrev for et halvt år siden hvordan
4588 <a href="http://people.skolelinux.org/pere/blog/Sikkerhet__teater__og_hvordan_gj__re_verden_sikrere.html">samfunnet
4589 kaster bort ressurser på sikkerhetstiltak som ikke fungerer</a>.  Kom
4590 nettopp over en
4591 <a href="http://www.askthepilot.com/essays-and-stories/terrorism-tweezers-and-terminal-madness-an-essay-on-security/">historie
4592 fra en pilot fra USA</a> som kommenterer det samme.  Jeg mistenker det
4593 kun er uvitenhet og autoritetstro som gjør at så få protesterer.  Har
4594 veldig sans for piloten omtalt i <a
4595 href="http://www.aftenposten.no/nyheter/iriks/article2057501.ece">Aftenposten</a> 2007-10-23,
4596 og skulle ønske flere rettet oppmerksomhet mot problemet.  Det gir
4597 ikke meg trygghetsfølelse på flyplassene når jeg ser at
4598 flyplassadministrasjonen kaster bort folk, penger og tid på tull i
4599 stedet for ting som bidrar til reell økning av sikkerheten.  Det
4600 forteller meg jo at vurderingsevnen til de som burde bidra til økt
4601 sikkerhet er svært sviktende, noe som ikke taler godt for de andre
4602 tiltakene.</p>
4603
4604 <p>Mon tro hva som skjer hvis det fantes en enkel brosjyre å skrive ut
4605 fra Internet som forklarte hva som er galt med sikkerhetsopplegget på
4606 flyplassene, og folk skrev ut og la en bunke på flyplassene når de
4607 passerte.  Kanskje det ville fått flere til å få øynene opp for
4608 problemet.</p>
4609
4610 <p>Personlig synes jeg flyopplevelsen er blitt så avskyelig at jeg
4611 forsøker å klare meg med tog, bil og båt for å slippe ubehaget.  Det
4612 er dog noe vanskelig i det langstrakte Norge og for å kunne besøke de
4613 delene av verden jeg ønsker å nå.  Mistenker at flere har det slik, og
4614 at dette går ut over inntjeningen til flyselskapene.  Det er antagelig
4615 en god ting sett fra et miljøperspektiv, men det er en annen sak.</p>
4616
4617       </div>
4618       <div class="tags">
4619
4620
4621         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
4622
4623
4624       </div>
4625     </div>
4626     <div class="padding"></div>
4627
4628     <div class="entry">
4629       <div class="title">
4630         <a href="https://people.skolelinux.org/pere/blog/Elektronisk_stemmegiving_er_ikke_til___stole_p____heller_ikke_i_Norge.html">Elektronisk stemmegiving er ikke til å stole på - heller ikke i Norge</a>
4631       </div>
4632       <div class="date">
4633         23rd August 2010
4634       </div>
4635       <div class="body">
4636         <p>I Norge pågår en prosess for å
4637 <a href="http://www.e-valg.dep.no/">innføre elektronisk
4638 stemmegiving</a> ved kommune- og stortingsvalg.  Dette skal
4639 introduseres i 2011.  Det er all grunn til å tro at valg i Norge ikke
4640 vil være til å stole på hvis dette blir gjennomført.  Da det hele var
4641 oppe til høring i 2006 forfattet jeg
4642 <a href="http://www.nuug.no/dokumenter/valg-horing-2006-09.pdf">en
4643 høringsuttalelse fra NUUG</a> (og EFN som hengte seg på) som skisserte
4644 hvilke punkter som må oppfylles for at en skal kunne stole på et valg,
4645 og elektronisk stemmegiving mangler flere av disse.  Elektronisk
4646 stemmegiving er for alle praktiske formål å putte ens stemme i en sort
4647 boks under andres kontroll, og satse på at de som har kontroll med
4648 boksen er til å stole på - uten at en har mulighet til å verifisere
4649 dette selv.  Det er ikke slik en gjennomfører demokratiske valg.</p>
4650
4651 <p>Da problemet er fundamentalt med hvordan elektronisk stemmegiving
4652 må fungere for at også ikke-krypografer skal kunne delta, har det vært
4653 mange rapporter om hvordan elektronisk stemmegiving har sviktet i land
4654 etter land.  En
4655 <a href="http://wiki.nuug.no/uttalelser/2006-elektronisk-stemmegiving">liten
4656 samling referanser</a> finnes på NUUGs wiki.  Den siste er fra India,
4657 der valgkomisjonen har valgt
4658 <a href="http://www.freedom-to-tinker.com/blog/jhalderm/electronic-voting-researcher-arrested-over-anonymous-source">å
4659 pusse politiet på en forsker</a> som har dokumentert svakheter i
4660 valgsystemet.</p>
4661
4662 <p>Her i Norge har en valgt en annen tilnærming, der en forsøker seg
4663 med teknobabbel for å få befolkningen til å tro at dette skal bli
4664 sikkert.  Husk, elektronisk stemmegiving underminerer de demokratiske
4665 valgene i Norge, og bør ikke innføres.</p>
4666
4667 <p>Den offentlige diskusjonen blir litt vanskelig av at media har
4668 valgt å kalle dette "evalg", som kan sies å både gjelde elektronisk
4669 opptelling av valget som Norge har gjort siden 60-tallet og som er en
4670 svært god ide, og elektronisk opptelling som er en svært dårlig ide.
4671 Diskusjonen gir ikke mening hvis en skal diskutere om en er for eller
4672 mot "evalg", og jeg forsøker derfor å være klar på at jeg snakker om
4673 elektronisk stemmegiving og unngå begrepet "evalg".</p>
4674
4675       </div>
4676       <div class="tags">
4677
4678
4679         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/valg">valg</a>.
4680
4681
4682       </div>
4683     </div>
4684     <div class="padding"></div>
4685
4686     <div class="entry">
4687       <div class="title">
4688         <a href="https://people.skolelinux.org/pere/blog/Rob_Weir__How_to_Crush_Dissent.html">Rob Weir: How to Crush Dissent</a>
4689       </div>
4690       <div class="date">
4691         15th August 2010
4692       </div>
4693       <div class="body">
4694         <p>I found the notes from Rob Weir on
4695 <a href="http://feedproxy.google.com/~r/robweir/antic-atom/~3/VGb23-kta8c/how-to-crush-dissent.html">how
4696 to crush dissent</a> matching my own thoughts on the matter quite
4697 well.  Highly recommended for those wondering which road our society
4698 should go down.  In my view we have been heading the wrong way for a
4699 long time.</p>
4700
4701       </div>
4702       <div class="tags">
4703
4704
4705         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/lenker">lenker</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
4706
4707
4708       </div>
4709     </div>
4710     <div class="padding"></div>
4711
4712     <div class="entry">
4713       <div class="title">
4714         <a href="https://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html">One step closer to single signon in Debian Edu</a>
4715       </div>
4716       <div class="date">
4717         25th July 2010
4718       </div>
4719       <div class="body">
4720         <p>The last few months me and the other Debian Edu developers have
4721 been working hard to get the Debian/Squeeze based version of Debian
4722 Edu/Skolelinux into shape.  This future version will use Kerberos for
4723 authentication, and services are slowly migrated to single signon,
4724 getting rid of password questions one at the time.</p>
4725
4726 <p>It will also feature a roaming workstation profile with local home
4727 directory, for laptops that are only some times on the Skolelinux
4728 network, and for this profile a shortcut is created in Gnome and KDE
4729 to gain access to the users home directory on the file server.  This
4730 shortcut uses SMB at the moment, and yesterday I had time to test if
4731 SMB mounting had started working in KDE after we added the cifs-utils
4732 package.  I was pleasantly surprised how well it worked.</p>
4733
4734 <p>Thanks to the recent changes to our samba configuration to get it
4735 to use Kerberos for authentication, there were no question about user
4736 password when mounting the SMB volume.  A simple click on the shortcut
4737 in the KDE menu, and a window with the home directory popped
4738 up. :)</p>
4739
4740 <p>One step closer to a single signon solution out of the box in
4741 Debian Edu.  We already had PAM, LDAP, IMAP and SMTP in place, and now
4742 also Samba.  Next step is Cups and hopefully also NFS.</p>
4743
4744 <p>We had planned a alpha0 release of Debian Edu for today, but thanks
4745 to the autobuilder administrators for some architectures being slow to
4746 sign packages, we are still missing the fixed LTSP package we need for
4747 the release.  It was uploaded three days ago with urgency=high, and if
4748 it had entered testing yesterday we would have been able to test it in
4749 time for a alpha0 release today.  As the binaries for ia64 and powerpc
4750 still not uploaded to the Debian archive, we need to delay the alpha
4751 release another day.</p>
4752
4753 <p>If you want to help out with implementing Kerberos for Debian Edu,
4754 please contact us on debian-edu@lists.debian.org.</p>
4755
4756       </div>
4757       <div class="tags">
4758
4759
4760         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
4761
4762
4763       </div>
4764     </div>
4765     <div class="padding"></div>
4766
4767     <div class="entry">
4768       <div class="title">
4769         <a href="https://people.skolelinux.org/pere/blog/_pne_tr_dl_snett_er_et_samfunnsgode.html">Åpne trådløsnett er et samfunnsgode</a>
4770       </div>
4771       <div class="date">
4772         12th June 2010
4773       </div>
4774       <div class="body">
4775         <p>Veldig glad for å oppdage via
4776 <a href="http://yro.slashdot.org/story/10/06/11/1841256/Finland-To-Legalize-Use-of-Unsecured-Wi-Fi">Slashdot</a>
4777 at folk i Finland har forstått at åpne trådløsnett er et samfunnsgode.
4778 Jeg ser på åpne trådløsnett som et fellesgode på linje med retten til
4779 ferdsel i utmark og retten til å bevege seg i strandsonen.  Jeg har
4780 glede av åpne trådløsnett når jeg finner dem, og deler gladelig nett
4781 med andre så lenge de ikke forstyrrer min bruk av eget nett.
4782 Nettkapasiteten er sjelden en begrensning ved normal browsing og enkel
4783 SSH-innlogging (som er min vanligste nettbruk), og nett kan brukes til
4784 så mye positivt og nyttig (som nyhetslesing, sjekke været, kontakte
4785 slekt og venner, holde seg oppdatert om politiske saker, kontakte
4786 organisasjoner og politikere, etc), at det for meg er helt urimelig å
4787 blokkere dette for alle som ikke gjør en flue fortred.  De som mener
4788 at potensialet for misbruk er grunn nok til å hindre all den positive
4789 og lovlydige bruken av et åpent trådløsnett har jeg dermed ingen
4790 forståelse for.  En kan ikke la eksistensen av forbrytere styre hvordan
4791 samfunnet skal organiseres.  Da får en et kontrollsamfunn de færreste
4792 ønsker å leve i, og det at vi har et samfunn i Norge der tilliten til
4793 hverandre er høy gjør at samfunnet fungerer ganske godt.  Det bør vi
4794 anstrenge oss for å beholde.</p>
4795
4796       </div>
4797       <div class="tags">
4798
4799
4800         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="https://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
4801
4802
4803       </div>
4804     </div>
4805     <div class="padding"></div>
4806
4807     <div class="entry">
4808       <div class="title">
4809         <a href="https://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html">Magnetstripeinnhold i billetter fra Flytoget og Hurtigruten</a>
4810       </div>
4811       <div class="date">
4812         21st May 2010
4813       </div>
4814       <div class="body">
4815         <p>For en stund tilbake kjøpte jeg en magnetkortleser for å kunne
4816 titte på hva som er skrevet inn på magnetstripene til ulike kort.  Har
4817 ikke hatt tid til å analysere mange kort så langt, men tenkte jeg
4818 skulle dele innholdet på to kort med mine lesere.</p>
4819
4820 <p>For noen dager siden tok jeg flyet til Harstad og Hurtigruten til
4821 Bergen.  Flytoget fra Oslo S til flyplassen ga meg en billett med
4822 magnetstripe.  Påtrykket finner jeg følgende informasjon:</p>
4823
4824 <pre>
4825 Flytoget Airport Express Train
4826
4827 Fra - Til        : Oslo Sentralstasjon
4828 Kategori         : Voksen
4829 Pris             : Nok 170,00
4830 Herav mva. 8,00% : NOK 12,59
4831 Betaling         : Kontant
4832 Til - Fra        : Oslo Lufthavn
4833 Utstedt:         : 08.05.10
4834 Gyldig Fra-Til   : 08.05.10-07.11.10
4835 Billetttype      : Enkeltbillett
4836
4837 102-1015-100508-48382-01-08
4838 </pre>
4839
4840 <p>På selve magnetstripen er innholdet
4841 <tt>;E?+900120011=23250996541068112619257138248441708433322932704083389389062603279671261502492655?</tt>.
4842 Aner ikke hva innholdet representerer, og det er lite overlapp mellom
4843 det jeg ser trykket på billetten og det jeg ser av tegn i
4844 magnetstripen.  Håper det betyr at de bruker kryptografiske metoder
4845 for å gjøre det vanskelig å forfalske billetter.</p>
4846
4847 <p>Den andre billetten er fra Hurtigruten, der jeg mistenker at
4848 strekkoden på fronten er mer brukt enn magnetstripen (det var i hvert
4849 fall den biten vi stakk inn i dørlåsen).</p>
4850
4851 <p>Påtrykket forsiden er følgende:</p>
4852
4853 <pre>
4854 Romnummer 727
4855 Hurtigruten
4856 Midnatsol
4857 Reinholdtsen
4858 Petter
4859 Bookingno: SAX69   0742193
4860 Harstad-Bergen
4861 Dep: 09.05.2010 Arr: 12.05.2010
4862 Lugar fra Risøyhamn
4863 Kost: FRO=4
4864 </pre>
4865
4866 <p>På selve magnetstripen er innholdet
4867 <tt>;1316010007421930=00000000000000000000?+E?</tt>.  Heller ikke her
4868 ser jeg mye korrespondanse mellom påtrykk og magnetstripe.</p>
4869
4870       </div>
4871       <div class="tags">
4872
4873
4874         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
4875
4876
4877       </div>
4878     </div>
4879     <div class="padding"></div>
4880
4881     <div class="entry">
4882       <div class="title">
4883         <a href="https://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html">Forcing new users to change their password on first login</a>
4884       </div>
4885       <div class="date">
4886          2nd May 2010
4887       </div>
4888       <div class="body">
4889         <p>One interesting feature in Active Directory, is the ability to
4890 create a new user with an expired password, and thus force the user to
4891 change the password on the first login attempt.</p>
4892
4893 <p>I'm not quite sure how to do that with the LDAP setup in Debian
4894 Edu, but did some initial testing with a local account.  The account
4895 and password aging information is available in /etc/shadow, but
4896 unfortunately, it is not possible to specify an expiration time for
4897 passwords, only a maximum age for passwords.</p>
4898
4899 <p>A freshly created account (using adduser test) will have these
4900 settings in /etc/shadow:</p>
4901
4902 <blockquote><pre>
4903 root@tjener:~# chage -l test
4904 Last password change                                    : May 02, 2010
4905 Password expires                                        : never
4906 Password inactive                                       : never
4907 Account expires                                         : never
4908 Minimum number of days between password change          : 0
4909 Maximum number of days between password change          : 99999
4910 Number of days of warning before password expires       : 7
4911 root@tjener:~#
4912 </pre></blockquote>
4913
4914 <p>The only way I could come up with to create a user with an expired
4915 account, is to change the date of the last password change to the
4916 lowest value possible (January 1th 1970), and the maximum password age
4917 to the difference in days between that date and today.  To make it
4918 simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
4919 avoid testing if 0 is a valid value).</p>
4920
4921 <p>After using these commands to set it up, it seem to work as
4922 intended:</p>
4923
4924 <blockquote><pre>
4925 root@tjener:~# chage -d 1 test; chage -M 10950 test
4926 root@tjener:~# chage -l test
4927 Last password change                                    : Jan 02, 1970
4928 Password expires                                        : never
4929 Password inactive                                       : never
4930 Account expires                                         : never
4931 Minimum number of days between password change          : 0
4932 Maximum number of days between password change          : 10950
4933 Number of days of warning before password expires       : 7
4934 root@tjener:~#
4935 </pre></blockquote>
4936
4937 <p>So far I have tested this with ssh and console, and kdm (in
4938 Squeeze) login, and all ask for a new password before login in the
4939 user (with ssh, I was thrown out and had to log in again).</p>
4940
4941 <p>Perhaps we should set up something similar for Debian Edu, to make
4942 sure only the user itself have the account password?</p>
4943
4944 <p>If you want to comment on or help out with implementing this for
4945 Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
4946
4947 <p>Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
4948 shadow(8) page in Debian/testing now state that setting the date of
4949 last password change to zero (0) will force the password to be changed
4950 on the first login.  This was not mentioned in the manual in Lenny, so
4951 I did not notice this in my initial testing.  I have tested it on
4952 Squeeze, and '<tt>chage -d 0 username</tt>' do work there.  I have not
4953 tested it on Lenny yet.</p>
4954
4955 <p>Update 2010-05-02-19:05: Jim Paris tells me via email that an
4956 equivalent command to expire a password is '<tt>passwd -e
4957 username</tt>', which insert zero into the date of the last password
4958 change.</p>
4959
4960       </div>
4961       <div class="tags">
4962
4963
4964         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
4965
4966
4967       </div>
4968     </div>
4969     <div class="padding"></div>
4970
4971     <div class="entry">
4972       <div class="title">
4973         <a href="https://people.skolelinux.org/pere/blog/Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html">Great book: "Content: Selected Essays on Technology, Creativity, Copyright, and the Future of the Future"</a>
4974       </div>
4975       <div class="date">
4976         19th April 2010
4977       </div>
4978       <div class="body">
4979         <p>The last few weeks i have had the pleasure of reading a
4980 thought-provoking collection of essays by Cory Doctorow, on topics
4981 touching copyright, virtual worlds, the future of man when the
4982 conscience mind can be duplicated into a computer and many more. The
4983 book titled "Content: Selected Essays on Technology, Creativity,
4984 Copyright, and the Future of the Future" is available with few
4985 restrictions on the web, for example from
4986 <a href="http://craphound.com/content/">his own site</a>. I read the
4987 epub-version from
4988 <a href="http://www.feedbooks.com/book/2883">feedbooks</a> using
4989 <a href="http://www.fbreader.org/">fbreader</a> and my N810. I
4990 strongly recommend this book.</p>
4991
4992       </div>
4993       <div class="tags">
4994
4995
4996         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="https://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="https://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/web">web</a>.
4997
4998
4999       </div>
5000     </div>
5001     <div class="padding"></div>
5002
5003     <div class="entry">
5004       <div class="title">
5005         <a href="https://people.skolelinux.org/pere/blog/Sikkerhet__teater__og_hvordan_gj_re_verden_sikrere.html">Sikkerhet, teater, og hvordan gjøre verden sikrere</a>
5006       </div>
5007       <div class="date">
5008         30th December 2009
5009       </div>
5010       <div class="body">
5011         <p>Via Slashdot fant jeg en
5012 <a href="http://www.cnn.com/2009/OPINION/12/29/schneier.air.travel.security.theater/index.html">nydelig
5013 kommentar fra Bruce Schneier</a> som ble publisert hos CNN i går.  Den
5014 forklarer forbilledlig hvorfor sikkerhetsteater og innføring av
5015 totalitære politistatmetoder ikke er løsningen for å gjøre verden
5016 sikrere.  Anbefales på det varmeste.</p>
5017
5018 <p>Oppdatering: Kom over
5019 <a href="http://gizmodo.com/5435675/president-obama-its-time-to-fire-the-tsa">nok
5020 en kommentar</a> om den manglende effekten av dagens sikkerhetsteater
5021 på flyplassene.</p>
5022
5023       </div>
5024       <div class="tags">
5025
5026
5027         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
5028
5029
5030       </div>
5031     </div>
5032     <div class="padding"></div>
5033
5034     <div class="entry">
5035       <div class="title">
5036         <a href="https://people.skolelinux.org/pere/blog/Jeg_vil_ikke_ha_BankID.html">Jeg vil ikke ha BankID</a>
5037       </div>
5038       <div class="date">
5039         30th October 2009
5040       </div>
5041       <div class="body">
5042         <p>Min hovedbankforbindelse,
5043 <a href="http://www.postbanken.no/">Postbanken</a>, har fra 1. oktober
5044 blokkert tilgangen min til nettbanken hvis jeg ikke godtar vilkårene
5045 for <a href="https://www.bankid.no/">BankID</a> og går over til å
5046 bruke BankID for tilgangskontroll.  Tidligere kunne jeg bruke en
5047 kodekalkulator som ga tilgang til nettbanken, men nå er dette ikke
5048 lenger mulig.  Jeg blokkeres ute fra nettbanken og mine egne penger
5049 hvis jeg ikke godtar det jeg anser som urimelige vilkår i
5050 BankID-avtalen.</p>
5051
5052 <p>BankID er en løsning der banken gis rett til å handle på vegne av
5053 meg, med avtalemessig forutsetning at jeg i hvert enkelt tilfelle har
5054 bedt banken gjøre dette.  BankID kan brukes til å signere avtaler,
5055 oppta lån og andre handlinger som har alvorlige følger for meg.
5056 Problemet slik jeg ser det er at BankID er lagt opp slik at banken har
5057 all informasjon og tilgang som den trenger for å bruke BankID, også
5058 uten at jeg er involvert.  Avtalemessing og juridisk skal de kun bruke
5059 min BankID når jeg har oppgitt pinkode og passord, men praktisk og
5060 konkret kan de gjøre dette også uten at min pinkode eller mitt passord
5061 er oppgitt, da de allerede har min pinkode og passord tilgjengelig hos
5062 seg for å kunne sjekke at riktig pinkode og passord er oppgitt av meg
5063 (eller kan skaffe seg det ved behov).  Jeg ønsker ikke å gi banken
5064 rett til å inngå avtaler på vegne av meg.</p>
5065
5066 <p>Rent teknisk er BankID et offentlig nøkkelpar, en privat og en
5067 offentlig nøkkel, der den private nøkkelen er nødvendig for å
5068 "signere" på vegne av den nøkkelen gjelder for, og den offentlige
5069 nøkkelen er nødvendig for å sjekke hvem som har signert.  Banken
5070 sitter på både den private og den offentlige nøkkelen, og sier de kun
5071 skal bruke den private hvis kunden ber dem om det og oppgir pinkode og
5072 passord.</p>
5073
5074
5075 <p>I postbankens
5076 <a href="https://www.postbanken.no//portalfront/nedlast/no/person/avtaler/BankID_avtale.pdf">vilkår
5077 for BankID</a> står følgende:</p>
5078
5079 <blockquote>
5080   <p>"6. Anvendelsesområdet for BankID</p>
5081
5082   <p>PersonBankID kan benyttes fra en datamaskin, eller etter nærmere
5083   avtale fra en mobiltelefon/SIM-kort, for pålogging i nettbank og til
5084   identifisering og signering i forbindelse med elektronisk
5085   meldingsforsendelse, avtaleinngåelse og annen form for nettbasert
5086   elektronisk kommunikasjon med Banken og andre brukersteder som har
5087   tilrettelagt for bruk av BankID. Dette forutsetter at brukerstedet
5088   har inngått avtale med bank om bruk av BankID."</p>
5089 </blockquote>
5090
5091 <p>Det er spesielt retten til "avtaleinngåelse" jeg synes er urimelig
5092 å kreve for at jeg skal få tilgang til mine penger via nettbanken, men
5093 også retten til å kommunisere på vegne av meg med andre brukersteder og
5094 signering av meldinger synes jeg er problematisk.  Jeg må godta at
5095 banken skal kunne signere for meg på avtaler og annen kommunikasjon
5096 for å få BankID.</p>
5097
5098 <p>På spørsmål om hvordan jeg kan få tilgang til nettbank uten å gi
5099 banken rett til å inngå avtaler på vegne av meg svarer Postbankens
5100 kundestøtte at "Postbanken har valgt BankID for bl.a. pålogging i
5101 nettbank , så her må du nok ha hele denne løsningen".  Jeg nektes
5102 altså tilgang til nettbanken inntil jeg godtar at Postbanken kan
5103 signere avtaler på vegne av meg.</p>
5104
5105 <p>Postbankens kundestøtte sier videre at "Det har blitt et krav til
5106 alle norske banker om å innføre BankID, bl.a på grunn av
5107 sikkerhet", uten at jeg her helt sikker på hvem som har framsatt
5108 dette kravet. [Oppdatering: Postbankens kundestøtte sier kravet er
5109 fastsatt av <a href="http://www.kredittilsynet.no/">kreditttilsynet</a>
5110 og <a href="http://www.bbs.no/">BBS</a>.]  Det som er situasjonen er
5111 dog at det er svært få banker igjen som ikke bruker BankID, og jeg
5112 vet ikke hvilken bank som er et godt alternativ for meg som ikke vil
5113 gi banken rett til å signere avtaler på mine vegne.</p>
5114
5115 <p>Jeg ønsker mulighet til å reservere meg mot at min BankID brukes
5116 til annet enn å identifisere meg overfor nettbanken før jeg vil ta i
5117 bruk BankID.  Ved nettbankbruk er det begrenset hvor store skader som
5118 kan oppstå ved misbruk, mens avtaleinngåelse ikke har tilsvarende
5119 begrensing.</p>
5120
5121 <p>Jeg har klaget vilkårene inn for <a
5122 href="http://www.forbrukerombudet.no/">forbrukerombudet</a>, men
5123 regner ikke med at de vil kunne bidra til en rask løsning som gir meg
5124 nettbankkontroll over egne midler. :(
5125
5126 <p>Oppdatering 2012-09-13: Aftenposten melder i dag at det er
5127 <a href="http://www.aftenposten.no/nyheter/iriks/Tyver-kan-tappe-kontoen-din---selv-uten-passord-og-pinkode--6989793.html">sikkerhetsproblem
5128 med BankID</a> som gjør at ens bankkonto kan tappes helt uten at en
5129 har delt passord og pinkode med noen.  Dette illustrerer veldig bra
5130 mitt poeng om at banken kan operere på kontoen (og signere avtaler
5131 etc) helt uten at jeg er involvert.  Jeg takker derfor fortsatt nei
5132 til BankID-modellen.</p>
5133
5134 <p>Oppdatering 2015-11-17: Fant en
5135 <a href="http://1and1are2.blogspot.no/2014/05/bankid-elektronisk-sppel.html">bloggpost
5136 fra Britt Lysaa som belyser hvilke inngrep i privatsfæren bruken av
5137 BankID utgjør</a>, i tillegg til de sikkerhetsmessige vurderingene
5138 omtalt over.  Anbefalt lesning.</p>
5139
5140       </div>
5141       <div class="tags">
5142
5143
5144         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/bankid">bankid</a>, <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
5145
5146
5147       </div>
5148     </div>
5149     <div class="padding"></div>
5150
5151     <div class="entry">
5152       <div class="title">
5153         <a href="https://people.skolelinux.org/pere/blog/Sikkerhet_til_sj_s_trenger_sj_kart_uten_bruksbegresninger.html">Sikkerhet til sjøs trenger sjøkart uten bruksbegresninger</a>
5154       </div>
5155       <div class="date">
5156         23rd August 2009
5157       </div>
5158       <div class="body">
5159         <p>Sikkerhet til sjøs burde være noe som opptar mange etter den siste
5160 oljeutslippsulykken med Full City, som har drept mye liv langs sjøen.
5161 En viktig faktor for å bedre sikkerheten til sjøs er at alle som
5162 ferdes på sjøen har tilgang til oppdaterte sjøkart som forteller hvor
5163 det grunner og annet en må ta hensyn til på sjøen.</p>
5164
5165 <p>Hvis en er enig i at tilgang til oppdaterte sjøkart er viktig for
5166 sikkerheten på sjøen, så er det godt å vite at det i dag er teknisk
5167 mulig å sikre alle enkel tilgang til oppdaterte digitale kart over
5168 Internet.  Det trenger heller ikke være spesielt kostbart.</p>
5169
5170 <p>Både ved Rocknes-ulykken i Vatlestraumen, der 18 mennesker mistet
5171 livet, og ved Full City-ulykken utenfor Langesund, der mange tonn olje
5172 lekket ut i havet, var det registrert problemer relatert til
5173 oppdaterte sjøkart.  Ved Rocknes-ulykken var de elektroniske kartene
5174 som ble brukt ikke oppdatert med informasjon om nyoppdagede grunner og
5175 losen kjente visst ikke til disse nye grunnene.  Papirkartene var dog
5176 oppdaterte.  Ved Full City-ulykken hadde en kontroll av skipet noen
5177 uker tidligere konstatert manglende sjøkart.</p>
5178
5179 <p>Jeg tror en løsning der digitale sjøkart kunne lastes ned direkte
5180 fra sjøkartverket av alle som ønsket oppdaterte sjøkart, uten
5181 brukerbetaling og uten bruksbegresninger knyttet til kartene, vil
5182 gjøre at flere folk på sjøen vil holde seg med oppdaterte sjøkart,
5183 eller sjøkart i det hele tatt.  Resultatet av dette vil være økt
5184 sikkerhet på sjøen.  En undersøkelse gjennomført av Opinion for
5185 Gjensidige i 2008 fortalte at halvparten av alle båteierne i landet
5186 ikke har sjøkart i båten.</p>
5187
5188 <p>Formatet på de digitale sjøkartene som gjøres tilgjengelig fra
5189 sjøkartverket må være i henhold til en fri og åpen standard, slik at
5190 en ikke er låst til enkeltaktørers godvilje når datafilene skal tolkes
5191 og forstås, men trenger ikke publiseres fra sjøkartverket i alle
5192 formatene til verdens skips-GPS-er i tillegg.  Hvis det ikke er
5193 kostbart for sjøkartverket bør de gjerne gjøre det selv, men slik
5194 konvertering kan andre ta seg av hvis det er et marked for det.</p>
5195
5196 <p>Hvis staten mener alvor med å forbedre sikkerheten til sjøs, må de
5197 gjøre sitt for at alle båteiere har oppdaterte kart, ikke bare snakke
5198 om hvor viktig det er at de har oppdaterte kart.  Det bør være
5199 viktigere for staten at båtene <strong>har</strong> oppdaterte kart
5200 enn at de er pålagt å ha oppdaterte kart.</p>
5201
5202 <p>Sjøkartene er <a href="http://kart.kystverket.no/">tilgjengelig på web
5203 fra kystverket</a>, men så vidt jeg har klart å finne, uten
5204 bruksvilkår som muliggjør gjenbruk uten bruksbegresninger.</p>
5205
5206 <p>OpenStreetmap.org-folk er lei av mangel på sjøkart, og har startet
5207 på et dugnadsbasert fribrukskart for havet,
5208 <a href="http://openseamap.org/">OpenSeaMap</a>.  Datagrunnlaget er
5209 OpenStreetmap, mens framvisningen er tilpasset bruk på sjøen.  Det
5210 gjenstår mye før en kan bruke dette til å seile sikkert på havet, men
5211 det viser at behovet for fribruks-sjøkart er til stedet.</p>
5212
5213       </div>
5214       <div class="tags">
5215
5216
5217         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/kart">kart</a>, <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="https://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
5218
5219
5220       </div>
5221     </div>
5222     <div class="padding"></div>
5223
5224     <div class="entry">
5225       <div class="title">
5226         <a href="https://people.skolelinux.org/pere/blog/Litt_om_valgfusk_og_problemet_med_elektronisk_stemmegiving.html">Litt om valgfusk og problemet med elektronisk stemmegiving</a>
5227       </div>
5228       <div class="date">
5229         17th June 2009
5230       </div>
5231       <div class="body">
5232         <p><a href="http://www.aftenposten.no/nyheter/uriks/article3127058.ece">Aftenposten
5233 melder</a> at det kan se ut til at Iran ikke har lært av USA når det
5234 gjelder valgfusk.  En bør endre tallene før de publiseres, slik at en
5235 kandidat aldri får færre stemmer under opptellingen, ellers blir det
5236 veldig tydelig at tallene ikke er til å stole på.  I USA er det
5237 derimot <a href="http://www.blackboxvoting.org/">rapporter om at
5238 tallene har vært endret</a> på tur mot opptellingen, ikke etter at
5239 tallene er publiserte (i tillegg til en rekke andre irregulariteter).
5240 En ting Iran åpenbart har forstått, er verdien av å kunne
5241 kontrolltelle stemmer.  Det ligger an til kontrolltelling i hvert fall
5242 i noen områder.  Hvorvidt det har verdi, kommer an på hvordan
5243 stemmene har vært oppbevart.</p>
5244
5245 <p><a href="http://universitas.no/kronikk/48334/kan-vi-stole-pa-universitetets-elektroniske-valgsystem-/">Universitetet
5246 i Oslo derimot</a>, har ikke forstått verdien av å kunne
5247 kontrolltelle.  Her har en valgt å ta i bruk elektronisk stemmegiving
5248 over Internet, med et system som ikke kan kontrolltelles hvis det
5249 kommer anklager om juks med stemmene.  Systemet har flere kjente
5250 problemer og er i mine øyne ikke bedre enn en spørreundersøkelse, og
5251 jeg har derfor latt være å stemme ved valg på UiO siden det ble
5252 innført.</p>
5253
5254 <p>Universitet i Bergen derimot har klart det kunststykket å aktivt gå
5255 inn for å gjøre det kjent at det elektroniske stemmegivingssystemet
5256 over Internet <a href="http://nyheter.uib.no/?modus=vis_nyhet&id=43404">kan
5257 spore hvem som stemmer hva</a> (det kan en forøvrig også ved UiO), og tatt
5258 kontakt med stemmegivere for å spørre hvorfor de stemte som de gjorde.
5259 Hemmelige valg står for fall.  Mon tro hva stemmesedlenne hadde
5260 inneholdt i Iran hvis de ikke hadde hemmelige valg?</p>
5261
5262       </div>
5263       <div class="tags">
5264
5265
5266         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="https://people.skolelinux.org/pere/blog/tags/valg">valg</a>.
5267
5268
5269       </div>
5270     </div>
5271     <div class="padding"></div>
5272
5273     <div class="entry">
5274       <div class="title">
5275         <a href="https://people.skolelinux.org/pere/blog/Kryptert_harddisk___naturligvis.html">Kryptert harddisk - naturligvis</a>
5276       </div>
5277       <div class="date">
5278          2nd May 2009
5279       </div>
5280       <div class="body">
5281         <p><a href="http://www.dagensit.no/trender/article1658676.ece">Dagens
5282 IT melder</a> at Intel hevder at det er dyrt å miste en datamaskin,
5283 når en tar tap av arbeidstid, fortrolige dokumenter,
5284 personopplysninger og alt annet det innebærer.  Det er ingen tvil om
5285 at det er en kostbar affære å miste sin datamaskin, og det er årsaken
5286 til at jeg har kryptert harddisken på både kontormaskinen og min
5287 bærbare.  Begge inneholder personopplysninger jeg ikke ønsker skal
5288 komme på avveie, den første informasjon relatert til jobben min ved
5289 Universitetet i Oslo, og den andre relatert til blant annet
5290 foreningsarbeide.  Kryptering av diskene gjør at det er lite
5291 sannsynlig at dophoder som kan finne på å rappe maskinene får noe ut
5292 av dem.  Maskinene låses automatisk etter noen minutter uten bruk,
5293 og en reboot vil gjøre at de ber om passord før de vil starte opp.
5294 Jeg bruker Debian på begge maskinene, og installasjonssystemet der
5295 gjør det trivielt å sette opp krypterte disker.  Jeg har LVM på toppen
5296 av krypterte partisjoner, slik at alt av datapartisjoner er kryptert.
5297 Jeg anbefaler alle å kryptere diskene på sine bærbare.  Kostnaden når
5298 det er gjort slik jeg gjør det er minimale, og gevinstene er
5299 betydelige.  En bør dog passe på passordet.  Hvis det går tapt, må
5300 maskinen reinstalleres og alt er tapt.</p>
5301
5302 <p>Krypteringen vil ikke stoppe kompetente angripere som f.eks. kjøler
5303 ned minnebrikkene før maskinen rebootes med programvare for å hente ut
5304 krypteringsnøklene.  Kostnaden med å forsvare seg mot slike angripere
5305 er for min del høyere enn gevinsten.  Jeg tror oddsene for at
5306 f.eks. etteretningsorganisasjoner har glede av å titte på mine
5307 maskiner er minimale, og ulempene jeg ville oppnå ved å forsøke å
5308 gjøre det vanskeligere for angripere med kompetanse og ressurser er
5309 betydelige.</p>
5310
5311       </div>
5312       <div class="tags">
5313
5314
5315         Tags: <a href="https://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
5316
5317
5318       </div>
5319     </div>
5320     <div class="padding"></div>
5321
5322     <p style="text-align: right;"><a href="sikkerhet.rss"><img src="https://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14" /></a></p>
5323     <div id="sidebar">
5324
5325
5326
5327 <h2>Archive</h2>
5328 <ul>
5329
5330 <li>2023
5331 <ul>
5332
5333 <li><a href="https://people.skolelinux.org/pere/blog/archive/2023/01/">January (3)</a></li>
5334
5335 <li><a href="https://people.skolelinux.org/pere/blog/archive/2023/02/">February (1)</a></li>
5336
5337 <li><a href="https://people.skolelinux.org/pere/blog/archive/2023/04/">April (2)</a></li>
5338
5339 <li><a href="https://people.skolelinux.org/pere/blog/archive/2023/05/">May (3)</a></li>
5340
5341 <li><a href="https://people.skolelinux.org/pere/blog/archive/2023/06/">June (1)</a></li>
5342
5343 <li><a href="https://people.skolelinux.org/pere/blog/archive/2023/08/">August (1)</a></li>
5344
5345 <li><a href="https://people.skolelinux.org/pere/blog/archive/2023/09/">September (1)</a></li>
5346
5347 <li><a href="https://people.skolelinux.org/pere/blog/archive/2023/10/">October (1)</a></li>
5348
5349 <li><a href="https://people.skolelinux.org/pere/blog/archive/2023/11/">November (3)</a></li>
5350
5351 </ul></li>
5352
5353 <li>2022
5354 <ul>
5355
5356 <li><a href="https://people.skolelinux.org/pere/blog/archive/2022/02/">February (1)</a></li>
5357
5358 <li><a href="https://people.skolelinux.org/pere/blog/archive/2022/03/">March (3)</a></li>
5359
5360 <li><a href="https://people.skolelinux.org/pere/blog/archive/2022/04/">April (2)</a></li>
5361
5362 <li><a href="https://people.skolelinux.org/pere/blog/archive/2022/06/">June (2)</a></li>
5363
5364 <li><a href="https://people.skolelinux.org/pere/blog/archive/2022/07/">July (1)</a></li>
5365
5366 <li><a href="https://people.skolelinux.org/pere/blog/archive/2022/09/">September (1)</a></li>
5367
5368 <li><a href="https://people.skolelinux.org/pere/blog/archive/2022/10/">October (1)</a></li>
5369
5370 <li><a href="https://people.skolelinux.org/pere/blog/archive/2022/12/">December (1)</a></li>
5371
5372 </ul></li>
5373
5374 <li>2021
5375 <ul>
5376
5377 <li><a href="https://people.skolelinux.org/pere/blog/archive/2021/01/">January (2)</a></li>
5378
5379 <li><a href="https://people.skolelinux.org/pere/blog/archive/2021/02/">February (1)</a></li>
5380
5381 <li><a href="https://people.skolelinux.org/pere/blog/archive/2021/05/">May (1)</a></li>
5382
5383 <li><a href="https://people.skolelinux.org/pere/blog/archive/2021/06/">June (1)</a></li>
5384
5385 <li><a href="https://people.skolelinux.org/pere/blog/archive/2021/07/">July (3)</a></li>
5386
5387 <li><a href="https://people.skolelinux.org/pere/blog/archive/2021/08/">August (1)</a></li>
5388
5389 <li><a href="https://people.skolelinux.org/pere/blog/archive/2021/09/">September (1)</a></li>
5390
5391 <li><a href="https://people.skolelinux.org/pere/blog/archive/2021/10/">October (1)</a></li>
5392
5393 <li><a href="https://people.skolelinux.org/pere/blog/archive/2021/12/">December (1)</a></li>
5394
5395 </ul></li>
5396
5397 <li>2020
5398 <ul>
5399
5400 <li><a href="https://people.skolelinux.org/pere/blog/archive/2020/02/">February (2)</a></li>
5401
5402 <li><a href="https://people.skolelinux.org/pere/blog/archive/2020/03/">March (2)</a></li>
5403
5404 <li><a href="https://people.skolelinux.org/pere/blog/archive/2020/04/">April (2)</a></li>
5405
5406 <li><a href="https://people.skolelinux.org/pere/blog/archive/2020/05/">May (3)</a></li>
5407
5408 <li><a href="https://people.skolelinux.org/pere/blog/archive/2020/06/">June (2)</a></li>
5409
5410 <li><a href="https://people.skolelinux.org/pere/blog/archive/2020/07/">July (1)</a></li>
5411
5412 <li><a href="https://people.skolelinux.org/pere/blog/archive/2020/09/">September (1)</a></li>
5413
5414 <li><a href="https://people.skolelinux.org/pere/blog/archive/2020/10/">October (1)</a></li>
5415
5416 <li><a href="https://people.skolelinux.org/pere/blog/archive/2020/11/">November (1)</a></li>
5417
5418 </ul></li>
5419
5420 <li>2019
5421 <ul>
5422
5423 <li><a href="https://people.skolelinux.org/pere/blog/archive/2019/01/">January (4)</a></li>
5424
5425 <li><a href="https://people.skolelinux.org/pere/blog/archive/2019/02/">February (3)</a></li>
5426
5427 <li><a href="https://people.skolelinux.org/pere/blog/archive/2019/03/">March (3)</a></li>
5428
5429 <li><a href="https://people.skolelinux.org/pere/blog/archive/2019/05/">May (2)</a></li>
5430
5431 <li><a href="https://people.skolelinux.org/pere/blog/archive/2019/06/">June (5)</a></li>
5432
5433 <li><a href="https://people.skolelinux.org/pere/blog/archive/2019/07/">July (2)</a></li>
5434
5435 <li><a href="https://people.skolelinux.org/pere/blog/archive/2019/08/">August (1)</a></li>
5436
5437 <li><a href="https://people.skolelinux.org/pere/blog/archive/2019/09/">September (1)</a></li>
5438
5439 <li><a href="https://people.skolelinux.org/pere/blog/archive/2019/11/">November (1)</a></li>
5440
5441 <li><a href="https://people.skolelinux.org/pere/blog/archive/2019/12/">December (4)</a></li>
5442
5443 </ul></li>
5444
5445 <li>2018
5446 <ul>
5447
5448 <li><a href="https://people.skolelinux.org/pere/blog/archive/2018/01/">January (1)</a></li>
5449
5450 <li><a href="https://people.skolelinux.org/pere/blog/archive/2018/02/">February (5)</a></li>
5451
5452 <li><a href="https://people.skolelinux.org/pere/blog/archive/2018/03/">March (5)</a></li>
5453
5454 <li><a href="https://people.skolelinux.org/pere/blog/archive/2018/04/">April (3)</a></li>
5455
5456 <li><a href="https://people.skolelinux.org/pere/blog/archive/2018/06/">June (2)</a></li>
5457
5458 <li><a href="https://people.skolelinux.org/pere/blog/archive/2018/07/">July (5)</a></li>
5459
5460 <li><a href="https://people.skolelinux.org/pere/blog/archive/2018/08/">August (3)</a></li>
5461
5462 <li><a href="https://people.skolelinux.org/pere/blog/archive/2018/09/">September (3)</a></li>
5463
5464 <li><a href="https://people.skolelinux.org/pere/blog/archive/2018/10/">October (5)</a></li>
5465
5466 <li><a href="https://people.skolelinux.org/pere/blog/archive/2018/11/">November (2)</a></li>
5467
5468 <li><a href="https://people.skolelinux.org/pere/blog/archive/2018/12/">December (4)</a></li>
5469
5470 </ul></li>
5471
5472 <li>2017
5473 <ul>
5474
5475 <li><a href="https://people.skolelinux.org/pere/blog/archive/2017/01/">January (4)</a></li>
5476
5477 <li><a href="https://people.skolelinux.org/pere/blog/archive/2017/02/">February (3)</a></li>
5478
5479 <li><a href="https://people.skolelinux.org/pere/blog/archive/2017/03/">March (5)</a></li>
5480
5481 <li><a href="https://people.skolelinux.org/pere/blog/archive/2017/04/">April (2)</a></li>
5482
5483 <li><a href="https://people.skolelinux.org/pere/blog/archive/2017/06/">June (5)</a></li>
5484
5485 <li><a href="https://people.skolelinux.org/pere/blog/archive/2017/07/">July (1)</a></li>
5486
5487 <li><a href="https://people.skolelinux.org/pere/blog/archive/2017/08/">August (1)</a></li>
5488
5489 <li><a href="https://people.skolelinux.org/pere/blog/archive/2017/09/">September (3)</a></li>
5490
5491 <li><a href="https://people.skolelinux.org/pere/blog/archive/2017/10/">October (5)</a></li>
5492
5493 <li><a href="https://people.skolelinux.org/pere/blog/archive/2017/11/">November (3)</a></li>
5494
5495 <li><a href="https://people.skolelinux.org/pere/blog/archive/2017/12/">December (4)</a></li>
5496
5497 </ul></li>
5498
5499 <li>2016
5500 <ul>
5501
5502 <li><a href="https://people.skolelinux.org/pere/blog/archive/2016/01/">January (3)</a></li>
5503
5504 <li><a href="https://people.skolelinux.org/pere/blog/archive/2016/02/">February (2)</a></li>
5505
5506 <li><a href="https://people.skolelinux.org/pere/blog/archive/2016/03/">March (3)</a></li>
5507
5508 <li><a href="https://people.skolelinux.org/pere/blog/archive/2016/04/">April (8)</a></li>
5509
5510 <li><a href="https://people.skolelinux.org/pere/blog/archive/2016/05/">May (8)</a></li>
5511
5512 <li><a href="https://people.skolelinux.org/pere/blog/archive/2016/06/">June (2)</a></li>
5513
5514 <li><a href="https://people.skolelinux.org/pere/blog/archive/2016/07/">July (2)</a></li>
5515
5516 <li><a href="https://people.skolelinux.org/pere/blog/archive/2016/08/">August (5)</a></li>
5517
5518 <li><a href="https://people.skolelinux.org/pere/blog/archive/2016/09/">September (2)</a></li>
5519
5520 <li><a href="https://people.skolelinux.org/pere/blog/archive/2016/10/">October (3)</a></li>
5521
5522 <li><a href="https://people.skolelinux.org/pere/blog/archive/2016/11/">November (8)</a></li>
5523
5524 <li><a href="https://people.skolelinux.org/pere/blog/archive/2016/12/">December (5)</a></li>
5525
5526 </ul></li>
5527
5528 <li>2015
5529 <ul>
5530
5531 <li><a href="https://people.skolelinux.org/pere/blog/archive/2015/01/">January (7)</a></li>
5532
5533 <li><a href="https://people.skolelinux.org/pere/blog/archive/2015/02/">February (6)</a></li>
5534
5535 <li><a href="https://people.skolelinux.org/pere/blog/archive/2015/03/">March (1)</a></li>
5536
5537 <li><a href="https://people.skolelinux.org/pere/blog/archive/2015/04/">April (4)</a></li>
5538
5539 <li><a href="https://people.skolelinux.org/pere/blog/archive/2015/05/">May (3)</a></li>
5540
5541 <li><a href="https://people.skolelinux.org/pere/blog/archive/2015/06/">June (4)</a></li>
5542
5543 <li><a href="https://people.skolelinux.org/pere/blog/archive/2015/07/">July (6)</a></li>
5544
5545 <li><a href="https://people.skolelinux.org/pere/blog/archive/2015/08/">August (2)</a></li>
5546
5547 <li><a href="https://people.skolelinux.org/pere/blog/archive/2015/09/">September (2)</a></li>
5548
5549 <li><a href="https://people.skolelinux.org/pere/blog/archive/2015/10/">October (9)</a></li>
5550
5551 <li><a href="https://people.skolelinux.org/pere/blog/archive/2015/11/">November (6)</a></li>
5552
5553 <li><a href="https://people.skolelinux.org/pere/blog/archive/2015/12/">December (3)</a></li>
5554
5555 </ul></li>
5556
5557 <li>2014
5558 <ul>
5559
5560 <li><a href="https://people.skolelinux.org/pere/blog/archive/2014/01/">January (2)</a></li>
5561
5562 <li><a href="https://people.skolelinux.org/pere/blog/archive/2014/02/">February (3)</a></li>
5563
5564 <li><a href="https://people.skolelinux.org/pere/blog/archive/2014/03/">March (8)</a></li>
5565
5566 <li><a href="https://people.skolelinux.org/pere/blog/archive/2014/04/">April (7)</a></li>
5567
5568 <li><a href="https://people.skolelinux.org/pere/blog/archive/2014/05/">May (1)</a></li>
5569
5570 <li><a href="https://people.skolelinux.org/pere/blog/archive/2014/06/">June (2)</a></li>
5571
5572 <li><a href="https://people.skolelinux.org/pere/blog/archive/2014/07/">July (2)</a></li>
5573
5574 <li><a href="https://people.skolelinux.org/pere/blog/archive/2014/08/">August (2)</a></li>
5575
5576 <li><a href="https://people.skolelinux.org/pere/blog/archive/2014/09/">September (5)</a></li>
5577
5578 <li><a href="https://people.skolelinux.org/pere/blog/archive/2014/10/">October (6)</a></li>
5579
5580 <li><a href="https://people.skolelinux.org/pere/blog/archive/2014/11/">November (3)</a></li>
5581
5582 <li><a href="https://people.skolelinux.org/pere/blog/archive/2014/12/">December (5)</a></li>
5583
5584 </ul></li>
5585
5586 <li>2013
5587 <ul>
5588
5589 <li><a href="https://people.skolelinux.org/pere/blog/archive/2013/01/">January (11)</a></li>
5590
5591 <li><a href="https://people.skolelinux.org/pere/blog/archive/2013/02/">February (9)</a></li>
5592
5593 <li><a href="https://people.skolelinux.org/pere/blog/archive/2013/03/">March (9)</a></li>
5594
5595 <li><a href="https://people.skolelinux.org/pere/blog/archive/2013/04/">April (6)</a></li>
5596
5597 <li><a href="https://people.skolelinux.org/pere/blog/archive/2013/05/">May (9)</a></li>
5598
5599 <li><a href="https://people.skolelinux.org/pere/blog/archive/2013/06/">June (10)</a></li>
5600
5601 <li><a href="https://people.skolelinux.org/pere/blog/archive/2013/07/">July (7)</a></li>
5602
5603 <li><a href="https://people.skolelinux.org/pere/blog/archive/2013/08/">August (3)</a></li>
5604
5605 <li><a href="https://people.skolelinux.org/pere/blog/archive/2013/09/">September (5)</a></li>
5606
5607 <li><a href="https://people.skolelinux.org/pere/blog/archive/2013/10/">October (7)</a></li>
5608
5609 <li><a href="https://people.skolelinux.org/pere/blog/archive/2013/11/">November (9)</a></li>
5610
5611 <li><a href="https://people.skolelinux.org/pere/blog/archive/2013/12/">December (3)</a></li>
5612
5613 </ul></li>
5614
5615 <li>2012
5616 <ul>
5617
5618 <li><a href="https://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
5619
5620 <li><a href="https://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
5621
5622 <li><a href="https://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
5623
5624 <li><a href="https://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
5625
5626 <li><a href="https://people.skolelinux.org/pere/blog/archive/2012/05/">May (12)</a></li>
5627
5628 <li><a href="https://people.skolelinux.org/pere/blog/archive/2012/06/">June (20)</a></li>
5629
5630 <li><a href="https://people.skolelinux.org/pere/blog/archive/2012/07/">July (17)</a></li>
5631
5632 <li><a href="https://people.skolelinux.org/pere/blog/archive/2012/08/">August (6)</a></li>
5633
5634 <li><a href="https://people.skolelinux.org/pere/blog/archive/2012/09/">September (9)</a></li>
5635
5636 <li><a href="https://people.skolelinux.org/pere/blog/archive/2012/10/">October (17)</a></li>
5637
5638 <li><a href="https://people.skolelinux.org/pere/blog/archive/2012/11/">November (10)</a></li>
5639
5640 <li><a href="https://people.skolelinux.org/pere/blog/archive/2012/12/">December (7)</a></li>
5641
5642 </ul></li>
5643
5644 <li>2011
5645 <ul>
5646
5647 <li><a href="https://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
5648
5649 <li><a href="https://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
5650
5651 <li><a href="https://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
5652
5653 <li><a href="https://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
5654
5655 <li><a href="https://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
5656
5657 <li><a href="https://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
5658
5659 <li><a href="https://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
5660
5661 <li><a href="https://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
5662
5663 <li><a href="https://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
5664
5665 <li><a href="https://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
5666
5667 <li><a href="https://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
5668
5669 <li><a href="https://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
5670
5671 </ul></li>
5672
5673 <li>2010
5674 <ul>
5675
5676 <li><a href="https://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
5677
5678 <li><a href="https://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
5679
5680 <li><a href="https://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
5681
5682 <li><a href="https://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
5683
5684 <li><a href="https://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
5685
5686 <li><a href="https://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
5687
5688 <li><a href="https://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
5689
5690 <li><a href="https://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
5691
5692 <li><a href="https://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
5693
5694 <li><a href="https://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
5695
5696 <li><a href="https://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
5697
5698 <li><a href="https://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
5699
5700 </ul></li>
5701
5702 <li>2009
5703 <ul>
5704
5705 <li><a href="https://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
5706
5707 <li><a href="https://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
5708
5709 <li><a href="https://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
5710
5711 <li><a href="https://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
5712
5713 <li><a href="https://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
5714
5715 <li><a href="https://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
5716
5717 <li><a href="https://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
5718
5719 <li><a href="https://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
5720
5721 <li><a href="https://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
5722
5723 <li><a href="https://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
5724
5725 <li><a href="https://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
5726
5727 <li><a href="https://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
5728
5729 </ul></li>
5730
5731 <li>2008
5732 <ul>
5733
5734 <li><a href="https://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
5735
5736 <li><a href="https://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
5737
5738 </ul></li>
5739
5740 </ul>
5741
5742
5743
5744 <h2>Tags</h2>
5745 <ul>
5746
5747  <li><a href="https://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (19)</a></li>
5748
5749  <li><a href="https://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
5750
5751  <li><a href="https://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
5752
5753  <li><a href="https://people.skolelinux.org/pere/blog/tags/bankid">bankid (4)</a></li>
5754
5755  <li><a href="https://people.skolelinux.org/pere/blog/tags/betalkontant">betalkontant (9)</a></li>
5756
5757  <li><a href="https://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (12)</a></li>
5758
5759  <li><a href="https://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (17)</a></li>
5760
5761  <li><a href="https://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
5762
5763  <li><a href="https://people.skolelinux.org/pere/blog/tags/chrpath">chrpath (3)</a></li>
5764
5765  <li><a href="https://people.skolelinux.org/pere/blog/tags/debian">debian (197)</a></li>
5766
5767  <li><a href="https://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (159)</a></li>
5768
5769  <li><a href="https://people.skolelinux.org/pere/blog/tags/debian-handbook">debian-handbook (9)</a></li>
5770
5771  <li><a href="https://people.skolelinux.org/pere/blog/tags/digistan">digistan (11)</a></li>
5772
5773  <li><a href="https://people.skolelinux.org/pere/blog/tags/dld">dld (18)</a></li>
5774
5775  <li><a href="https://people.skolelinux.org/pere/blog/tags/docbook">docbook (32)</a></li>
5776
5777  <li><a href="https://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (4)</a></li>
5778
5779  <li><a href="https://people.skolelinux.org/pere/blog/tags/english">english (454)</a></li>
5780
5781  <li><a href="https://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (23)</a></li>
5782
5783  <li><a href="https://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (14)</a></li>
5784
5785  <li><a href="https://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (34)</a></li>
5786
5787  <li><a href="https://people.skolelinux.org/pere/blog/tags/freedombox">freedombox (9)</a></li>
5788
5789  <li><a href="https://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (20)</a></li>
5790
5791  <li><a href="https://people.skolelinux.org/pere/blog/tags/h264">h264 (20)</a></li>
5792
5793  <li><a href="https://people.skolelinux.org/pere/blog/tags/intervju">intervju (43)</a></li>
5794
5795  <li><a href="https://people.skolelinux.org/pere/blog/tags/isenkram">isenkram (16)</a></li>
5796
5797  <li><a href="https://people.skolelinux.org/pere/blog/tags/kart">kart (23)</a></li>
5798
5799  <li><a href="https://people.skolelinux.org/pere/blog/tags/kodi">kodi (6)</a></li>
5800
5801  <li><a href="https://people.skolelinux.org/pere/blog/tags/ldap">ldap (9)</a></li>
5802
5803  <li><a href="https://people.skolelinux.org/pere/blog/tags/lego">lego (5)</a></li>
5804
5805  <li><a href="https://people.skolelinux.org/pere/blog/tags/lenker">lenker (8)</a></li>
5806
5807  <li><a href="https://people.skolelinux.org/pere/blog/tags/linuxcnc">linuxcnc (5)</a></li>
5808
5809  <li><a href="https://people.skolelinux.org/pere/blog/tags/lsdvd">lsdvd (2)</a></li>
5810
5811  <li><a href="https://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
5812
5813  <li><a href="https://people.skolelinux.org/pere/blog/tags/madewithcc">madewithcc (3)</a></li>
5814
5815  <li><a href="https://people.skolelinux.org/pere/blog/tags/mesh network">mesh network (8)</a></li>
5816
5817  <li><a href="https://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (46)</a></li>
5818
5819  <li><a href="https://people.skolelinux.org/pere/blog/tags/nice free software">nice free software (15)</a></li>
5820
5821  <li><a href="https://people.skolelinux.org/pere/blog/tags/noark5">noark5 (23)</a></li>
5822
5823  <li><a href="https://people.skolelinux.org/pere/blog/tags/norsk">norsk (322)</a></li>
5824
5825  <li><a href="https://people.skolelinux.org/pere/blog/tags/nuug">nuug (198)</a></li>
5826
5827  <li><a href="https://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (40)</a></li>
5828
5829  <li><a href="https://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
5830
5831  <li><a href="https://people.skolelinux.org/pere/blog/tags/opensnitch">opensnitch (4)</a></li>
5832
5833  <li><a href="https://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (75)</a></li>
5834
5835  <li><a href="https://people.skolelinux.org/pere/blog/tags/personvern">personvern (114)</a></li>
5836
5837  <li><a href="https://people.skolelinux.org/pere/blog/tags/raid">raid (2)</a></li>
5838
5839  <li><a href="https://people.skolelinux.org/pere/blog/tags/reactos">reactos (1)</a></li>
5840
5841  <li><a href="https://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
5842
5843  <li><a href="https://people.skolelinux.org/pere/blog/tags/rfid">rfid (3)</a></li>
5844
5845  <li><a href="https://people.skolelinux.org/pere/blog/tags/robot">robot (17)</a></li>
5846
5847  <li><a href="https://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
5848
5849  <li><a href="https://people.skolelinux.org/pere/blog/tags/ruter">ruter (7)</a></li>
5850
5851  <li><a href="https://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (2)</a></li>
5852
5853  <li><a href="https://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (60)</a></li>
5854
5855  <li><a href="https://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
5856
5857  <li><a href="https://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (5)</a></li>
5858
5859  <li><a href="https://people.skolelinux.org/pere/blog/tags/standard">standard (74)</a></li>
5860
5861  <li><a href="https://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (7)</a></li>
5862
5863  <li><a href="https://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (14)</a></li>
5864
5865  <li><a href="https://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (65)</a></li>
5866
5867  <li><a href="https://people.skolelinux.org/pere/blog/tags/sysadmin">sysadmin (5)</a></li>
5868
5869  <li><a href="https://people.skolelinux.org/pere/blog/tags/usenix">usenix (2)</a></li>
5870
5871  <li><a href="https://people.skolelinux.org/pere/blog/tags/valg">valg (9)</a></li>
5872
5873  <li><a href="https://people.skolelinux.org/pere/blog/tags/verkidetfri">verkidetfri (20)</a></li>
5874
5875  <li><a href="https://people.skolelinux.org/pere/blog/tags/video">video (79)</a></li>
5876
5877  <li><a href="https://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (4)</a></li>
5878
5879  <li><a href="https://people.skolelinux.org/pere/blog/tags/web">web (42)</a></li>
5880
5881 </ul>
5882
5883
5884     </div>
5885     <p style="text-align: right">
5886  Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.6</a>
5887 </p>
5888
5889   </body>
5890 </html>