[145682] in cryptography@c2.net mail archive
Re: Haystack
daemon@ATHENA.MIT.EDU (Steve Weis)
Tue Aug 17 15:10:12 2010
In-Reply-To: <C80C4BFA-1940-44C3-B581-319E4E937DF8@lrw.com>
Date: Tue, 17 Aug 2010 11:46:54 -0700
From: Steve Weis <steveweis@gmail.com>
To: Jerry Leichter <leichter@lrw.com>
Cc: "cryptography@metzdowd.com List" <cryptography@metzdowd.com>
I sent an email asking for technical information several months ago
and did not receive a response. The FAQ says "the Haystack client
connects to our servers which in turn talk to websites on behalf of
our users" and "from a user's point of view, Haystack appears to be a
normal HTTP proxy". There is no binary or source available for
download and the FAQ says "revealing the source code at this time
would only aide the authorities in blocking Haystack".
Based on those statements, I'm going to speculate that the client
connects to a static list of innocuous-looking proxies and that they
are relying on keeping those proxies secret. If those servers were
known to an authority, it would be trivial to block. I think that is
why they're making the unrealistic assumption that an authority will
not be able to reverse engineer or even monitor traffic from a client.
On Tue, Aug 17, 2010 at 12:57 AM, Jerry Leichter <leichter@lrw.com> wrote:
> The mainstream press is full of discussion for a new program, Haystack,
> developed by a guy name Austin Heap and sponsored by the Censorship Resea=
rch
> Center as a new kind of secure proxy. =A0See
> http://www.haystacknetwork.com/faq/ for some information.
>
> As described, the program relies on some kind of steganography to hide
> encrypted connections inside of connections to "approved" sites. =A0It wa=
s
> specifically designed to help Iranian dissidents maintain connections in =
the
> face of active government efforts to locate and block proxies and Tor ent=
ry
> and exit nodes.
>
> A Google search reveals absolutely no technical information about exactly
> what Haystack does or now it does it. =A0The program is available on mult=
iple
> platforms but is closed source - the FAQ linked to above discusses this,
> citing fears that making the source available would help censors.
>
> Anyone know anything more about what Haystack is actually doing?
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
