Open Privacy

Sarah Jamie Lewis's work on privacy has been massively influential on the work I'm trying to do. I also highly recommend checking out her Oniondildonics post about metadata obfuscation in anonymous teledildonics interactions: https://mascherari.press/oniondildonics/ She's now running the Open Privacy project, which is doing great work on general anonymized communication: https://openprivacy.ca

There should be a link to the society website (https://openprivacy.ca/) on the Cwtch site, but I can see that there isn't - we will get that fixed. Open Privacy Research Society is a Canadian non profit society, founded in 2018, you can find details of our members and operating structure on our website. Most of our funds come from individual donations. Cwtch started as an extension to the Ricochet Tor messenger which I also contributed back in 2014/2015. Our main goal behind Cwtch was to establish that metadata resistant / p2p communication could be done in a similar form factor to traditional server based / non-metadata private protocols like Signal i.e. to try and push the privacy properties that people can wield beyond end to end encryption, in a way that is still usable.

EFF (https://eff.org) and Open Privacy (https://openprivacy.ca/) spring to mind

If you're speaking about iOS, the dev just tweeted this: https://twitter.com/SarahJamieLewis/status/1408857316087058432 > The answer to why is there no Mac/iOS version of Cwtch / why does Cwtch not have feature X is that last year we raised only a fraction of our donation target. You can help change that! > @OpenPriv is powered by hundreds of individual donors just like you! > https://openprivacy.ca/donate/

The cwtch.im project (metadata resistant E2E chat app) started with Golang backend, and Qt as the front-end (targeting x-platform desktop and mobile apps). However they had some issues with Qt, and have been transitioning to Flutter. Their technical blog discusses their issues and experiences. https://openprivacy.ca/discreet-log

A recent Canadian example: > The data being broadcast includes the patients name, age, gender marker, diagnosis, their attending doctor and room number. Other broadcasts regarding medical tests such as x-rays are often associated with a patients last name or medical number, exposing their progression through hospital departments. https://openprivacy.ca/blog/2019/09/09/open-privacy-discovers-vancouve…

You're absolutely right about the various advantages of pagers over cell phones. On the other hand, all of that medical information goes over the air in plain text. It is trivial to capture and decode POCSAG [1], requiring less than $100 of hardware: a Raspberry Pi 3 has enough horsepower to handle the 2 RTL-SDR's needed to capture both the 929MHz and 931MHz bands. Modern security simply demands that pagers go away (or at least be heavily modified). This is not a theoretical concern [2][3]. [1] https://github.com/pvachon/tsl-sdr [2] https://www.rtl-sdr.com/art-installation-eavesdrops-on-hospital-pagers… [3] https://openprivacy.ca/blog/2019/09/09/open-privacy-discovers-vancouve…

Also see Cwtch from OpenPrivacy https://openprivacy.ca/blog/2018/06/28/announcing-cwtch/

> where is the software that circumvents internet spying and censorship? 1.) https://geti2p.net/ 2.) https://www.torproject.org 3.) https://openprivacy.ca/blog/2018/06/28/announcing-cwtch/ Tor is an obvious choice here and has penetrated the mainstream when Gawker ran that article on Silk Road. Now and then newspapers run sensationalist articles on the Dark Web in an attempt to wake up the masses about Tor and its famous (unsecure) Browser Bundle.

There's a nugget of truth there, but I will say that the Swiss government has taken a very thorough/careful approach to implementing online voting. There are legislated cybersecurity standards for e-voting, individual and universal verifiability, pilot programs, meaningful observation, everything is open source, funding is set aside to incentivize researchers to find vulnerabilities [1]. When critical vulnerabilities were found with the previous implementation done by a private vendor, they dropped their vendor and restarted from scratch, doing everything in-house [2,3]. Not all jurisdictions are so careful. Over 200 municipalities in Ontario do voting online, despite no legislated standards (though a voluntary standard was recently developed). The voting systems are offered by private vendors, no organization is responsible for certifying these systems, and many systems do not offer any cryptographic verification of the results. It's quite interesting [4]. [1] https://digital-solutions.post.ch/en/e-government/blog/vollst%C3%A4ndi… [2] https://openprivacy.ca/assets/knightsandknaves.pdf [3] https://www.swissinfo.ch/eng/politics/swiss-post-set-to-relaunch-its-e… [4] https://whisperlab.org/ontario-online.pdf

Oh yeah, this has actually been a bit of a controversy in Vancouver recently[0][1], including speculation that the problem may be national. Local hospitals have now removed diagnosis data from the transmissions, but apparently still broadcast everything else, including "patient name, age, gender marker, their attending doctor and room number" (as of Sept 2019)[2]. Vancouver Coastal Health claims they "have no information to suggest private patient information has been used in any malicious way", which is a very disingenuous statement to make, because there's no conceivable way for them to know who has received radio transmissions or made use of such data maliciously. To be frank, I find this pretty mind-blowing and it's disappointing that even in the face of press/public attention, it's not being remedied. [0] https://openprivacy.ca/blog/2019/09/09/open-privacy-discovers-vancouve… [1] https://www.ctvnews.ca/health/pager-systems-used-in-healthcare-could-b… [2] https://openprivacy.ca/blog/2019/09/26/pager-breach-update/