Hi, intro, and introducing System Transparency

[Bernhard M. Wiedemann]

Thanks for the interesting concept.

On 17/01/2021 13.40, Fredrik Strömberg wrote:
> https://system-transparency.org/
> https://mullvad.net/en/blog/2019/6/3/system-transparency-future/
> https://mullvad.net/nl/blog/2019/8/7/open-source-firmware-future/

in https://mullvad.net/media/system-transparency-rev5.pdf
you wrote
> The goal of the provisioning ritual is to convince future auditors that the stated hardware specifications are correct; that the boot ROM was programmed with an artifact with a specific checksum; and, finally, to tie the platform to a newly generated public key contained in the platform TPM. Assurance that the platform has not been tampered with after the provisioning ritual is provided by tamper detection switches connected to the casing and TPM; through the use of an enclosure PUF; or similar measures.

That reminded me very much of the design the DCI used to secure digital
projectors+media blocks that were allowed to receive encrypted video
content.


However, for a VPN, I'd prefer the tor design, because it is clear that
it is possible to monitor incoming and outgoing traffic at the ISP or
routers and correlate some of it via timing and packet sizes (harder if
you use padding and random delays).
Can be combined though. E.g. tor over VPN.

Of course, a lot depends on your threat model - are your users evading
the nosy neighbor, RIAA or the Mossad?


-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 236 bytes
Desc: OpenPGP digital signature
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20210122/57d54101/attachment.sig>