lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <200308280040.01604.thomas.greene@theregister.co.uk>
Date: Thu, 28 Aug 2003 00:40:01 -0700
From: "Thomas C. Greene " <thomas.greene@...register.co.uk>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com
Subject: JAP service un-backdoored


http://theregister.co.uk/content/6/32533.html

Net anonymity service un-backdoored
Higher court hits pause button

The Java Anonymous Proxy (JAP) service, a collaborative effort of Dresden 
University of Technology, Free University Berlin and the Independent Centre 
for Privacy Protection Schleswig-Holstein, Germany (ICPP), has been allowed 
to suspend its monitoring of users' IP traffic pending a decision on the 
legality of back-dooring it.

Collectively known as the AN.ON Project, the operators appealed a lower 
court's decision allowing the German Feds to obtain reports on users' access 
to a particular IP address (no doubt having to do with KP or bomb-making, 
etc).

The appeals court has allowed the operators to discontinue logging until their 
appeal has been answered. When a decision has been reached, the JAP team says 
they will document the whole affair, but cannot do so until the court issues 
its ruling.

A single record of access to the forbidden IP address has been logged but not 
yet disclosed to the Feds pending the higher court's decision, the JAP team 
says.

In a previous article The Register criticised the way the JAP team handled its 
initial confrontation with the Feds, ie., by waiting quietly until a user 
discovered the back door before acknowledging the situation.

We believe there were better ways of dealing with the court order, either by 
posting a prominent warning that the service might be subject to monitoring 
by the authorities, by leaking the information to the press outside Germany, 
or by disabling the affected proxies temporarily in protest.

We hope that if the JAP team should lose its appeal and be ordered to resume 
monitoring, particularly under a gag order, it will find a way of giving the 
public a proper heads up. Their previous performance hardly inspires 
confidence, but there is always opportunity for redemption. ®


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ