security

Why is this important?

We have tried to minimise what information can be found out about posters. Currently, Indymedia Abruzzo does not log ip addresses. However, it is theoretically possible for someone to monitor individuals who are using the site and check which time they visited Toscana Indymedia. If this corresponds to the time a certain article was posted, then whoever is doing the surveillance may get useful information. One way of diminishing this is to ensure that lots of people are connecting at the same time - hence, any one of them could be making a post or merely viewing the site.

What is an "encrypted connection"?

An encrypted connection between computers is used to hide the details of the information that is being transferred. For example, many organisations use encrypted connections when making or discussing financial transactions: you have probably used one if you've ever booked a ticket or used the bank online.

During the exchange, a third-party is used to verify that the website is who they say they are. There are many big corporate companies who sell identification-certificates - and procedures for acquiring them may be variable; such organisations are known as Certificate Authorities (CAs). Thus, it can be difficult to know whether to trust them or not (although often, one does not have a choice).

Indymedia, instead of using a commercial Certificate Authority, has decided to use the non-profit organisation CACert (cacert.org). All our certificates are certified by the 'root' certificate of the CACert Certificate Authority.

What are certificates?

Certificates are used to verify the identity of people or computers. In particular, certificates are needed to establish secure connections. Without certificates, you would be able to ensure that no one else was listening, but you might be talking to the wrong computer altogether!

What is a certificate authority?

Certificates are the digital equivalent of a government issued identification card. Certificates, however, are usually issued by private corporations called certificate authorities (CA). Indymedia UK has, instead, chosen to use CA Cert (cacert.org), a free and non-profit certificate authority.

Unfortunately, you need to do a little work to get your software to recognize CA Cert as a certificate authority. Every CA has a 'root certificate' which identifies a particular organization as a certificate authority. Corporate CAs have their root certificates distributed with most of the major computer programs and operating systems, and are preconfigured in most web browsers. For CAcert, however, you need to manually install the cacert.org root certificate.

How do I install the cacert.org root certificate?

* IE users can use the Internet Explorer cert install page. * Mozilla users can follow this link to the root cert and follow the instructions that pop up. * Internet Explorer on the Mac is messed up, and requires that you use this link (provided by Riseup) instead: install root certificate using IE on the Mac. Alternately, you may wish to visit the CAcert root cert page.

Here are a few installation tutorials:

• Internet Explorer (windows)
• Internet Explorer (mac)

What happens if I don't install the root certificate?

Without the root certificate, you will receive a security warning each time you attempt to establish a secure connection to indymedia.org.uk. You can usually choose to ignore this warning and accept the server's certificate on a temporary or permanent basis.

"That doesn't sound so bad", you might say. In the past, this is exactly what many users have done in order to use secure connections. But there are major problems with this:

1. If people get in the habit of approving new server certificates every time they get a security warning, it completely defeats the purpose of having certificates in the first place.

2. indymedia has several different servers and a different certificate for each one. It is easier for users to install CA Cert as a certificate authority once, rather than approving each certificate one at a time.

3. indymedia actively wants to spread the adoption of CA Cert as a certificate authority, because it is also being used (or will be) by other parts of the indymedia network as well as other activist collectives and groups around the world.

I thought you were against authority?

We are, but the internet is designed to require certificate authorities and there is not much we can do about it. There are other models for encrypted communication, such as the decentralized notion of a "web of trust" found in PGP. Unfortunately, no one has written any web browsers or mail clients to use PGP for establishing secure connections, so we are forced to rely on certificate authorities. Some day, we hope to collaborate with other tech collectives to create a certificate (anti) authority.

Il browser avverte che il certificato non appartiene al sito abruzzo.indymedia.org

Tor: per navigare in maniera anonima!

Indymedia in passato ha attirato l'attenzione della polizia postale, che ha spesso preteso da chi gestisce i server di indymedia i log degli utenti connessi al sito.
Indymedia crede nel diritto all'anonimato come discorso politico, pertanto non manitiene in memoria sui server un registro contenente questo genere di informazioni, spesso utili alla polizia postale. Questo non basta a garantire l'anonimato. Consigliamo a chi vuole utilizzare indymedia ed è preoccupato per il proprio diritto alla privacy, di utilizzare servizi per l'anonimato come Tor e connessioni crittate SSL.



Tor è un progetto software per difendersi dall'analisi del traffico, una forma di sorveglianza della rete che minaccia le libertà personali e la privacy, le attività e le relazioni riservate d'impresa, e la sicurezza di stato. Tor funziona deviando le tue comunicazioni attraverso una rete distribuita di relay, gestiti da volontari in tutto il mondo: impedisce a qualcuno che osservi la tua connesione Internet di sapere quali siti stai visitando, ed impedisce ai siti che visiti di venire a sapere dove sei realmente. Tor funziona con molti programmi, come i browser web, i client per la chat, i programmi di login remoto e tante altre applicazioni basate sul protocollo TCP. Al mondo centinaia di migliaia di persone usano Tor, per motivi diversi: giornalisti e blogger, operatori umanitari, membri delle forze dell'ordine, soldati, grandi aziende, abitanti di regimi repressivi, e semplici cittadini. Leggi la pagina Chi usa Tor? per degli esempi di alcuni tipici utilizzatori di Tor. Leggi la descrizione generale per una spiegazione più dettagliata di cosa fa Tor, del perché questi diversi tipi di utenti sono importanti, e per sapere come funziona Tor.

Ci sono tre dettagli importanti da conoscere.

Tor non ti protegge se non viene usato correttamente. Leggi la nostra lista di avvertenze e segui attentamente le istruzioni per la tua piattaforma.
Anche se configuri correttamente Tor, ci sono sempre alcuni attacchi potenziali che possono compromettere la protezione fornita da Tor. Nessun sistema anonimo oggigiorno è perfetto, e Tor non fa eccezione: se hai veramente bisogno di anonimato forte non dovresti affidarti unicamente all'attuale rete Tor.

La sicurezza di Tor aumenta al crescere della sua base di utenti, e man mano che più volontari aprono un nodo. (Non è così difficile da fare come si pensa, e in questo modo si può notevolmente aumentare la propria sicurezza contro alcuni attacchi.)

Vedi anche:

• ECN - Crypto - una lista di software per la cifratura e l'anonimato
• http://www.activistsecurity.org/