Privoxy: Submitting Javascript-Forms

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

We just found a post on the onionforum (tor required) with a nice filter for privoxy.

It adds a submit-button to forms that are usually submitted via javascript and makes them usable for javascript-disabled browsers.

Add this to your .filter -file

FILTER: unhide
s@(<input type="?)hidden("?[^>]+name="?([^" >]+)"?)@$1text$2 style="background-color:RoyalBlue" title="$3"@gis
s@<input type="submit" value="s" style="background-color:RoyalBlue"></form>@<input type="submit" value="s" style="background-color:RoyalBlue"><input type="submit" value="s" style="background-color:RoyalBlue"></form>@gis
s@display: ?none@background-color:CornflowerBlue@gis
s@(<[^>]*?)disabled(="disabled")?@$1@gis

...and the following to your .action -file:

{ +filter{unhide} }
/

..or to enable this only for specific sites:

{ +filter{unhide} }
.evilshare.com/
.example.com

If it does not work, you can try:

{ +filter{unhide} +prevent-compression }

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: http://firegpg.tuxfamily.org

iD8DBQFH64tjLAZ+Vq4hPgARAnh7AJ9AM140LvxN7PYYiC3q+gREN4TrPgCfSrnQ
eZUGPh2diU98pDmXLAfC7q0=
=Rq8g
-----END PGP SIGNATURE-----

faster ssh/scp on SMP/multi-core systems

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

A nice paper just popped up on
the tor-mailing list.

Abstract
SCP and the underlying SSH2 protocol implementation in OpenSSH is network performance limited by statically defined internal flow control buffers. These buffers often end up acting as a bottleneck for network throughput of SCP, especially on long and high bandwith network links. Modifying the ssh code to allow the buffers to be defined at run time eliminates this bottleneck. We have created a patch that will remove the bottlenecks in OpenSSH and is fully interoperable with other servers and clients. In addition HPN clients will be able to download faster from non HPN servers, and HPN servers will be able to receive uploads faster from non HPN clients. However, the host receiving the data must have a properly tuned TCP/IP stack. Please refer to this tuning page for more information.

The amount of improvement any specific user will see is dependent on a number of issues. Transfer rates cannot exceed the capacity of the network nor the throughput of the I/O subsystem including the disk and memory speed. The improvement will also be highly influenced by the capacity of the processor to perform the encryption and decryption. Less computational expensive ciphers will often provide better throughput than more complex ciphers.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: http://firegpg.tuxfamily.org

iD8DBQFHs/FVLAZ+Vq4hPgARAt3SAKCe3ntK729GBG3uAY6PMh6Xa9WjXgCg1Swr
vv3DTUO3G+/c4w7utqmuCuI=
=pzqX
-----END PGP SIGNATURE-----

getting anonymous gpg-keys signed

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


GPG is a fine thing with it's web of trust.
But the probleme here being...a web of trust is not anonymous.
There is no identity to prove to get a key sign if you want to
be anonymous.

One nice service here is the
PGP Global Directory.
It does only checks that one of the email-adresses in the key indeed works.
Just like a double-opt-in.

Another one is the robotCA, where you send an email to robotca AT signedtimestamp DOT org with the subject "sign key: your key id" (e.g. "sign key: AE213E00") and it will load that key from a keyserver and send a signed copy to the email-adresses in it.

But at least that's something that can be done.
Verify that the key-owner can recevive at that that address without sending a message yourself.
(Like, if that key is to be used outside of an email-context.)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: http://firegpg.tuxfamily.org

iD8DBQFHuZdjLAZ+Vq4hPgARAoJUAJ975yR30c11Tj0PI0oOLMmmkgm2KQCdFTl6
dq9/QQi+jM396gv8XAFmurQ=
=y1vL
-----END PGP SIGNATURE-----

possibly backdoored random-number-generator added with Vista-SP1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



As reported by Bruce Schneier (A very well known cryptoanalyst),
Microsoft has added the Dual_ElipticCurve- PseudoRandomNumberGenerator to Windows Vista.

Exactly this PRNG has is suspected to have a backdoor added to it,

The Overview of Windows Vista Service Pack 1 states: "The Dual Elliptical Curve (Dual EC) PRNG from SP 800-90 is also available for customers who prefer to use it."

---

- - From Did NSA Put a Secret Backdoor in New Encryption Standard? By Bruce Schneier, Wired News, November 15, 2007:

In an informal presentation (.pdf) at the CRYPTO 2007 conference in August, Dan Shumow and Niels Ferguson showed that the algorithm contains a weakness that can only be described a backdoor.

This is how it works: There are a bunch of constants -- fixed numbers -- in the standard used to define the algorithm's elliptic curve. These constants are listed in Appendix A of the NIST publication, but nowhere is it explained where they came from.

What Shumow and Ferguson showed is that these numbers have a relationship with a second, secret set of numbers that can act as a kind of skeleton key. If you know the secret numbers, you can predict the output of the random-number generator after collecting just 32 bytes of its output. To put that in real terms, you only need to monitor one TLS internet encryption connection in order to crack the security of that protocol. If you know the secret numbers, you can completely break any instantiation of Dual_EC_DRBG.

The researchers don't know what the secret numbers are. But because of the way the algorithm works, the person who produced the constants might know; he had the mathematical opportunity to produce the constants and the secret numbers in tandem.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: http://firegpg.tuxfamily.org

iD8DBQFHiyK4LAZ+Vq4hPgARAiEmAKDT3SXjRrImTxUYwheeOJl+shzsOgCeJf7j
O/5jZwEnPpMxOu7jVQ3maHo=
=DF2y
-----END PGP SIGNATURE-----

Combine webmail and GPG using the FireGPG-Extension for Firefox

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

So, you are using TOR to access a gmail- or other webmail-account?

You can use gpg just fine for any email-program but....with webmail there is no such email.

Enter FireGPG.

With this extension you get a context-menu where you can sign, encrypt, decrypt and verify any text you select.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: http://firegpg.tuxfamily.org

iD8DBQFHZ6XhLAZ+Vq4hPgARApUcAKDLT8APB29NyIgK0h+vavL8faNqaACgo7H2
XJvMEAQCwnnRidzuaDZOwRk=
=LxcJ
-----END PGP SIGNATURE-----

Tor and privoxy had been ported to iphone

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

from cjacker huang on or-dev:

I just ported libevent, tor-0.1.2.18 and privoxy to iphone 1.1.1 fw.
and finished a iPhone app named iTor.app.
...
It works pretty good on iphone. also I tested it with privoxy on PC
and tor on iphone.

for more infomation and source.
http://www.linux-ren.org/modules/everestblog/?p=161


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: http://firegpg.tuxfamily.org

iD8DBQFHZ6e5LAZ+Vq4hPgARAroOAKC+wNkt1w4d7d2ZFFbo74t+Ao7n/QCfWt4J
PFJftkVmwY5w9N9MeFfbGsM=
=Ocq5
-----END PGP SIGNATURE-----

european data-retention - what does it mean to you, Mr. Operator?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

(links given by an austrian informant.)

All over europe people offering anonymity-services are forced to log within the next 13 month.

A german tor-operator now published in his blog under the title ""We are fucked individually!"" the commented, relevant parts of the laws as applicable to tor-operators.

On the german tor-talk mailing-list he gave the following numbers for estimated storage-space required for logging after doing real-world experimentation of that toppic.

Server Traffic: 2.000 KB/s average
logs for 1 week: 200 GByte
logs for 1 week after removing irrelevant content: 120 GByte
after compression and encryption: 20 GByte
sum for 26 weeks (6 month): 500 GByte average
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: http://firegpg.tuxfamily.org

iD8DBQFHZ6eyLAZ+Vq4hPgARAtgsAKCk5tQF7EJakP82MlSqG+H0TY+VvwCeOSEE
/ryHIw2Oi5y+QVCabujYKNg=
=/HZL
-----END PGP SIGNATURE-----