WikiLeaks seeded its database of documents by intercepting traffic through a TOR node they were operating.

This article at Wired highlights an almost buried section of this New Yorker interview with one of the founders of WikiLeaks.

Before the WikiLeaks site went live, the founders noticed that hackers were transferring stolen government documents over the TOR network. They captured over a million of these documents to form the initial core of the WikiLeaks archive.

This shows once again what I have been saying for a long time. Any privacy system that allows any untrusted and unknown person to become part of the infrastructure and have access to cleartext information is fundamentally flawed.

Any person with malicious intent can easily set up a TOR node and begin exactly the same kind of data collection that the WikiLeaks folks practiced.

Reputation is everything in this business. It is not practical for typical individuals to properly vet their providers. Track record, reputation, and respected third party endorsements are your best bet when choosing a privacy or security provider. Look for those for everyone who has access to your information.

John Gruber at Daring Fireball posted this interesting article on the growing practice of websites intercepting your attempts to copy text from their pages. They are actually modifying the contents of your clipboard and tracking the fact that you have clipped the information.

The referenced cases seem to be doing it for marketing and informational purposes, but there are many ways this could be used in more aggressive ways.

Imagine a site with sample code which (when copied) inserted some damaging code in to the middle of a large block.

I am worried that this capability exists at all within browsers. It seems like a major security vulnerability to me.

On May 26th Facebook announced new privacy controls. The EFF has a nice tutorial on how to properly configure these new settings to best protect your privacy.

Unfortunately these new settings options are being rolled out slowly. At this point I still don’t have the ability to use the new settings at all. If you are lucky enough to have been moved to the new system, update those settings ASAP.

Read this post from IntelFusion. It makes a very strong case for why I worry about any privacy system run by operators you can’t really trust, investigate, and verify. In this case it is an investigation of Glype servers. They can be configured to do significant logging, and the author has been able to remotely retrieve the logs from many of the Glype servers. The results show many users from within sensitive US Government organizations and would provide the ability for an attacker to gather all kinds of useful intelligence to find soft targets to exploit.

On the personal privacy side, it is an easy way for attackers to intercept usernames, passwords, travel plans, personal information and more for use in, identity theft, burglary, and hacking among other things.

For a long time I have been saying that storage is cheap and that one should assume that anything put out on the Internet will live forever. It looks like that is even being institutionalized. The US Library of Congress recently announced that it will be creating a public archive of every tweet sent since the founding of Twitter.

This kind of resource will keep tabloids in business for decades to come. Generations of celebrities yet undiscovered should be concerned about their old unguarded, but now professionally preserved, brain droppings.

For the record, I am not opposed to this archiving. It is happening anyway in private databases. This just makes the issue more visible and helps to raise awareness. It is similar in many ways to The Internet Archive project.

Lauren Weinstein’s Blog: Saving Internet Anonymity — The Struggle is Joined

I strongly encourage anyone with a commitment to Internet anonymity to read this blog post. An organized opposition to the existence of such anonymity is growing. Of course, like attempt to clamp down on cryptography, it will only impact the law abiding while criminals use bots and other tools to circumvent the restrictions.

Between this and the push to remove the expectation of privacy from all stored emails, I am very concerned.

Pseudonyms: The Natural State of Online Identity | Privacy Digest

This article does a nice job of making a point I have been talking around for some time. The Internet naturally supports pseudonymity, and that is really what we want most of the time. When I talk to someone on-line, I am most interested that I am still talking today with the person I started talking to last month. Whether the name actually corresponds to their birth certificate is not important (and I would not have any idea in a real world encounter either).

Having just finished initial testing with the actual iPad device, I am pleased to announce that Anonymizer Universal (AU) provides the same level of support on the iPad that we have been providing for the iPhone and iPod Touch!

Considering how these devices are going to be used, the combination of privacy along with the security when using insecure WiFi is really critical.

Tor partially blocked in China | The Tor Blog

That last article lead me to this post on the TOR blog from September 15, 2009 (I am a bit late to this party). China is now blocking about 80% of the public TOR nodes.

This mostly ends a rather baffling situation where for some reason the Chinese were failing to block TOR even though it was being used effectively for censorship circumvention, the list of nodes is publicly available, and they are no more difficult to block than any other server.

Google and India Test the Limits of Liberty - WSJ.com

In this case, it is not the search engine, but their social networking site “Orkut” which is the issue. Google’s troubles stem less from their actions than the fact that they are the dominant social networking site in India, and so most of those issues happen on that site.

Google has been forced to take down a lot of content, and hand over the identities of many posters. If the examples in the article are to be believed, the threshold for censorship is not high.

At the risk of repeating myself, if you live in India and you want to say something that might push or cross the line, do it with robust anonymity technology. You might still have your post taken down, but they can’t come after you.