{"article":{"id":266318,"heading":"New ID Verification Feature on this Site","author":"johnk idVer:f9b399091dc85eb8fbd97920f333d403","created":"2014-10-21 08:06:29","modified":"2014-10-25 19:15:53","last_modified":"Sun, 26 Oct 2014 03:15:53","article":"<!DOCTYPE html PUBLIC \"-\/\/W3C\/\/DTD HTML 4.0 Transitional\/\/EN\" \"http:\/\/www.w3.org\/TR\/REC-html40\/loose.dtd\">\n<?xml encoding=\"UTF-8\"><html><body><p>Due to the complaints from a user, we have added a feature to the site that fulfills one of the functions of \"user registration\" which is to allow people to have a consistent identity. It's called \"ID verification\", and it appears as a long hex string after your name, like this: <br><br> imc-volunteer idVer:324659533317de05378c76587 <br><br> That hex string is computed from the \"author\" and \"secret\" fields. <br><br> By using the same author and secret for each post, you'll produce the same idVer value. That matching value verifies you.  The reads need to manually check that the idVer values match. <br><br> idVer works because someone else won't know your secret. You should pick a secret that isn't a password for any other website. Even though the secret is not stored anywhere, it may be intercepted as it's sent up to the server.  <br><br> The secret is not stored anywhere.  It's used to calculate the idVer, and then disposed.  The idVer is appended to the author field, and saved. <br><br> (It *is* possible to spoof a user if you have direct access to the database.  You could replace the author and bypass the calculations.  But that's not any worse or better than any other similar commenting software.)<\/p>\n<\/body><\/html>\n","contact":"","link":"","address":"","phone":"","parent_id":0,"mime_type":"text\/plain","summary":"We don't have accounts, but there is a way to verify that you are who you say you are.","numcomment":11,"fileurl":"\/uploads\/","filesize":null,"article_url":"\/news\/2014\/10\/266318.php"},"attachments":[],"comments":[{"id":266336,"heading":"Greasemonkey script to highlight idVer.","article":"Below is a script you can use in Greasemonkey to highlight the first 12 digits after &quot;idVer:&quot;.  The color is an HTML color based on the hex values for each set of six digits.  If it works, we'll just add that javascript to this site.\r\n\r\n\r\n\/\/ ==UserScript==\r\n\/\/ @name        highlight idVer\r\n\/\/ @namespace   jk\r\n\/\/ @description Highlights strings that start with &quot;idVar:&quot; and followed by hex digits\r\n\/\/ @include     http:\/\/la.indymedia.org\/news\/*\r\n\/\/ @version     1\r\n\/\/ @grant       none\r\n\/\/ ==\/UserScript==\r\n\r\nvar idver_re=\/idVer:([0-9a-f]{6})([0-9a-f]{6})\/g;\r\nvar scratch = document.getElementsByClassName('bgcentercol')[0];\r\nvar html = scratch.innerHTML;\r\nhtml = html.replace( idver_re, 'idVar:<span style=&quot;color:#$1;&quot;>$1<\/span><span style=&quot;color:#$2;&quot;>$2<\/span>' );\r\nscratch.innerHTML = html;\r\n","author":"johnk","parent_id":266318,"mime_type":"text\/plain","created":"2014-10-22 06:11:43","modified":"2014-10-22 06:11:43","fileurl":""},{"id":266337,"heading":"The GM script kills the freenet box","article":"It needs more work - enabling the idVer colorizer script causes the freenet box to stop working.  So it needs more work.","author":"johnk idVer:f9b399091dc85eb8fbd97920f333d403","parent_id":266318,"mime_type":"text\/plain","created":"2014-10-22 06:18:45","modified":"2014-10-22 06:18:45","fileurl":""},{"id":266346,"heading":"a small question","article":"Does this IMC still retain use logs with their I.P.s?\r\nDon't even try to tell me you never have, as I have direct testimony otherwise.\r\nSometimes the members of this site lets a bit too much out.","author":"Curious","parent_id":266318,"mime_type":"text\/plain","created":"2014-10-23 23:13:29","modified":"2014-10-23 23:13:29","fileurl":""},{"id":266348,"heading":"yes we do so never post here again","article":"be afraid\r\n\r\nbe very afraid\r\n\r\n","author":"johnk idVe\u0157:f9b399091dc85eb8fbd97920f333d403","parent_id":266318,"mime_type":"image\/png","created":"2014-10-24 00:11:31","modified":"2014-10-24 00:11:31","fileurl":"http:\/\/la.indymedia.org\/\/uploads\/2014\/10\/social_websites.png","image":{"original":"http:\/\/la.indymedia.org\/\/uploads\/2014\/10\/social_websites.png"}},{"id":266349,"heading":"of course they know who you are","article":"Of course they know who you are. How could they ever block you otherwise? nessie once blurted it out about checking server logs, by the way, and we all know she was a felon who had to be a stoolie to stay on the streey, and after Andy the cop killer appeared at SF. \r\n\r\nAnd what's with the &quot;secret&quot; horseshit? \r\n\r\n&quot;The secret is used to produce an id verification code displayed with your author name. Use the same author name and secret on all your posts.&quot; \r\n\r\nSo what if everybody uses the name &quot;Claude Balls&quot; ?\r\n\r\nSomething is as fishy as the global warming bullshit.","author":"dead_nessie idVer:e00afa39fd648fc696cdf9f4904","parent_id":266318,"mime_type":"text\/plain","created":"2014-10-24 03:55:16","modified":"2014-10-24 03:55:16","fileurl":""},{"id":266351,"heading":"salty nuts","article":"it's still hashed against whatever {dumb_smashy} name you use and a SALT\r\n\r\nwell I see computer science is yet another one of your strong points :)\r\n\r\n","author":"crazy_inventor","parent_id":266318,"mime_type":"text\/plain","created":"2014-10-24 12:45:00","modified":"2014-10-24 12:45:00","fileurl":""},{"id":266353,"heading":"heh","article":"the only problem I see is that this compromised IMC allows outside parties to have access to the information on these logs.\r\nso fuck you, johnk.","author":" &quot;Claude Balls&quot; ?","parent_id":266318,"mime_type":"text\/plain","created":"2014-10-24 17:34:32","modified":"2014-10-24 17:34:32","fileurl":""},{"id":266354,"heading":"the hashing function is intended to","article":"prevent spoofing and nothing more.\r\n\r\nyour sexual advances are directed at the wrong parties\r\n\r\n","author":"crazy_inventor","parent_id":266318,"mime_type":"image\/jpeg","created":"2014-10-24 17:46:28","modified":"2014-10-24 17:46:28","fileurl":"http:\/\/la.indymedia.org\/\/uploads\/2014\/10\/big_brotherwatching-698x1023.jpg","image":{"original":"http:\/\/la.indymedia.org\/\/uploads\/2014\/10\/big_brotherwatching-698x1023.jpg"}},{"id":266361,"heading":"answers","article":"I forgot my original secret, so I used a new one.  (I haven't fixed the unicode letter-spoofing issue yet, so people should look out for that.  This idVer feature isn't finished until that's done.)\r\n\r\nWe don't log IP addresses of readers, but we do log accesses at this time.  We also automatically delete old server logs.\r\n\r\nWe do log IP addresses of posters - but these are not in the regular server logs.  They go to a text file, and we delete that periodically.\r\n\r\nWe have considered turning off logging entirely, but it's the only way that we detect the usual URL-based attacks, and detect if something has been somehow uploaded and executed.\r\n\r\nThe risk of logs being compromised or subpoenaed exists, but the logs are so inconclusive they aren't that useful.  Also, given the current political climate, it's more likely that the FBI would install an invisible proxy as a kind of &quot;wiretap&quot; and record the traffic.  Due to the lack of encryption, they would get the data, and the metadata.\r\n\r\nIf we added SSL encryption (which we eventually will), they could still get the metadata, but not the data... but that's moot because all the data is already public on this site. (Think about it - they would know all the SSL setup - ip addresses and url.  They could download the page you're reading, and see what you're seeing.  If you commented or posted, they'd get the publish urls.  Though they wouldn't get the content as it's posted - they could just get the public page after it's been published, and correlate the time of the post with the timestamp on the post.  On a site like this IMC, SSL is, at best, an illusion of security if the police use their powers to subpoena the actual traffic.  The only time SSL is useful is if all the URLs are anonymous or generic without identifying information.  The site must also randomize or not save the &quot;post times&quot; - but that's a huge problem because news relies on time.  Finally, it should not be a website like the IMC where all the inputs are turned into public outputs.)\r\n\r\nSo, to be secured against IP snooping, you need to use something like TOR that will hide your IP address.  I think it also forces all TOR users to have the same agent string, so that's less useful for identification as well.\r\n\r\n* I absolutely advocate that people use Tor or a similar proxy to read this site. *\r\n\r\nThe more people do it, the less valuable our log lines become.","author":"johnk idVer:d502486912de3028a731b503d263f8ac","parent_id":266318,"mime_type":"text\/plain","created":"2014-10-25 18:33:46","modified":"2014-10-25 18:33:46","fileurl":""},{"id":266362,"heading":"one other thing: freenet","article":"If  you're extremely paranoid, you can try out freenet and comment on there.\r\n\r\nFreenet is more fully anonymous, with all requests and data encrypted and proxies across thousands of nodes.  Architecturally, it's more safe than Tor.  Try it out.\r\n\r\nWe don't have a two-way gateway, but it's something, and I'll definitely see the information and might post the comment to the public site.\r\n\r\nPosts with local content will probably bet copied up to freenet, too, so you can just bookmark the imc-volunteer account's flog and read the news up there.  (I dream of automating this cross-posting of info.)","author":"johnk idVer:d502486912de3028a731b503d263f8ac","parent_id":266318,"mime_type":"text\/plain","created":"2014-10-25 19:06:02","modified":"2014-10-25 19:06:02","fileurl":""},{"id":266363,"heading":"panopticlick","article":"Within our dataset of several million visitors, only one in 1,545,293 browsers have the same fingerprint as yours.\r\n\r\n&quot;and he shall be known by his USER_AGENT&quot;\r\n\r\n+hide-user-agent{Mozilla\/5.0 (X11; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.0.1478.0\r\n\r\ntools > change user agent > user agent switcher\r\n\r\n","author":"crazy_inventor","parent_id":266318,"mime_type":"text\/plain","created":"2014-10-25 19:15:53","modified":"2014-10-25 19:15:53","fileurl":""}]}