Summary

After working with tunnels and proxies in Variable we moved to La Poissonnerie where Wendy Van Wynsberghe, one of the hosts of this session, relates the major events of this workshop. We are sitting in the fridge of the former fish shop. She is on a small stage with a webcam, plates, fluorescent green cardboard cutouts of words. People are sitting around the stage and by the fireplace. There is a bar serving organic local beers and wines.

A beetle walks onto a dinner plate with a paper cutout of the word Jitsi. Jitsi¹ (or Жици in Bulgarian which means “cables”) is a voice over IP application². We carry our voice over the Internet Protocol. “We’re numbers.”

---

---

 
 

The beetle slides off the plate when Wendy removes the cutouts. Dramatic twist of events. But the tragic hero finds its way back to the plate, together with a cutout of the word XMPP protocol. We talked to each other, we found out the IP address² number of our machines and spoke to each other via the machines, encrypted! Wendy shakes a cutout with an encryption key on it. We wanted to create a VPN (Virtual Private Network)³, a tunnel back to the IP address² where information floats through a tunnel allowing us to communicate to another machine in a secure way.

Why did we want to do that? Sometimes a government does not allow for certain kinds of communication. Of course it has to be encrypted.

We got lost in configuration, Wendy concludes.

---

Notes

Read the live notes at: <http://vj14.constantvzw.org/r/notes::friday>

---

Aim of the workshop: from IRC⁴ chat to Jitsi¹ and from IPsec⁵ to OpenVpn⁶ or TincVpn⁷; come dig a communication tunnel with us. Will we reach the other side? Or will we get lost in configuration?

---

We’ll talk about communication but also about hiding. Talking to each other through encrypted channels. Configuring VPN³ . “We’ll go under.” What started all this hiding? Verification. Verifying you’re really dealing with the person you want to communicate with. First step is a message of authentication using Jitsi <https://jitsi.org>. Jitsi¹ runs a little server which constantly listens to the ports. You need someone’s IP address² tomake phone or video calls. if you know the IP address and you’re in the same network, it listens and you can phone each other. All IP addresses have to be in the same range. Local network addresses are not routable so you cannot be reached by someone outside of the local network.

full house,
Guillaume is cooking,
smell of soup arriving through glitch under door,
small sounds are coming from the kitchen tools while Wendy is reading

Wendy explains how Jitsi¹ works and what it can do… An example: Wendy wants to talk to Femke, who is at a location where all communications go through Pieter, who wants to block, or spy on, their exchanges. How is this communication blocked? Through the blocking of IPs². A proxy is a server which is functioning as a relay station, passing communication through so that blocked IPs² are not visible. When you inspect a package, you can see the second part is being read by the router to see where to send the package, the rest it just sends on. Jitsi puts for instance XMPP/Jabber inside this wrapper/enveloppe. Our situation has a router communicating between the public and private network. The Jitsi¹ application sets up a service to do session initiation. Here Jitsi¹ can find us all because we are all on the same network.

Jitsi uses lots of protocols, XMPP
[we go offline, the network does not do the job, we lose info —sad, because it is nice to write together]
Workshop Tunnels, dig into communication

---

Audience

What is a tunnel?

---

Wendy

A tunnel is a point-to-point connection through the use of dedicated connections, encryption or a combination of the two.

---

Audience

What is a port?

---

Wendy

On a computer there are different processes. The Operating System (OS) needs to know to which process it should send the data. Through assigning port numbers, the OS will be able to tell by which process the data needs to be processed.

---

Wendy and Denis give an example of a port block work-around. Denis’ Etherpad uses port 8000 but this was blocked at Namur University. If you want to use Etherpad when you’re on a network that blocks a certain port, you need to change or add a port on the webserver that is running Etherpad, so that packets from, for instance, port 80 are also processed by Etherpad.

e.g. SMTP uses port 25; webserver listens to port 80
point-to-point: be precise on how to communicate

doorbell! Two people come in
Who wants to be the webserver?
Pieter is a proxy!
proxy: relay station of web, not for chat...
“we’ll go under”
proxy = http
tunnel = speaking into Pieter’s mouth ~ ssh

In the case of Virtual Private Networks (VPN)³, the tunnel is a wrapper with packages inside. Tunnels might look suspect but ISPs cannot decrypt the communication. Using VPN³, all envelopes are stamped with Pieter’s name, and a specific port number they agreed on. Pieter will open the package, on the inside envelope Wendy will have put Femke’s name. Encryption protects who can open what kind of layer. Pieter sees all traffic that is going on: he sees when it is locked, thinks it may be suspicious.

Audience

Is Tor a darknet or a tunnel?

---

Pieter

Tor is being monitored, so they keep rewriting, relaying etc. Tor originated 6 or 7 years ago from a USA military lab. It is still being sponsored by them to initially conceal heavy diplomatic traffic… Using Tor means there are many different signals from proxies linking before the transfer is linked to the final destination. It is always changing random links throughout the network so nobody would know anymore where the packages comes from and where they go to.

---

Audience

Is TOR secure and anonymous?

---

Denis

Yes and No.

---

Audience

It is not really anonymous? Is it still traceable?

---

Denis

My project <http://domainepublic.net> became a Tor exit node⁸ for a month but received legal notice that it was under investigation because the address that was used was usually attributed to pedophile pornography images. I wanted to be a final node to be able to provide anonymous and secure access to the Internet. We replied with a very polite letter explaining what Tor is and why we had decided to do what we did and they never bothered us again. We could have been fined or even taken into custody or put in jail for not logging our IP addresses, for instance. We would have needed a whole team of lawyers to get us out of there. If the servers that host the Tor nodes would have less constraining legislation, it could be alright.

Still you can never know who was the originator of any channel. Tor numbers show that banned sites receive a lot of visits. Tor uses tunnels to reach the other nodes so it’s the same mechanism as Jitsi¹.

Wendy launches Tor.
We decided not to have tor in the workshop,
it’s off-topic
[hey people! Tor was not on the program, on purpose]

Audience

Last question on Tor! What extra services do you need to be an exit node for Tor?

---

Denis

You need money for a lawyers team to protect your rights, resistance capacity, etc.

$ ifconfig
$ ping 192.168.42.107

It will be a one-on-one communication where each person gives their IP² to another and sets up Jitsi¹ to start a chat. People start wearing their IP on papertape stuck to their shirt. IP addresses² have to be in the same range —with us all connected to the same router, it’s the case. Inside a router you have one leg in the local network and one leg at the provider. After installing Jitsi from <http://jitsi.org> people try to connect to each other. Get IP address with command-line tools: ifconfig. After starting Jitsi¹ you need to add a SIP account, you simply create a username and password. Then you sit with someone and add them as a contact by adding their username. SIP figures out their IP. It is only working for a few.

INTRANET created in many countries for censorship.
TUNNELS against censorship.
PROXY is http and tunnel is a relay station.
VPN³ virtual private network becomes a “tunnel”
A VPN³ extends a private network across a public network, such as the Internet.
PORT which processes to get a parcel where it needs to go.
PORT NUMBERS.
PORTS are like docks for info, parcels they pass by them.

Calling Istanbul…

We’re going to connect to someone, to Baris Fidaner, who is in Istanbul, through Freenode <http://webchat.freenode.net>. People who use these techniques are situated in countries where there is censorship.

---

Contribution of Baris in #vj14 @ webchat.freenode.net:

1. An announcement with three quotes from the tragedy _Antigone_ by Sophocles (-441);
2. A brief statement on its significance;
3. An image with an explanatory phrase to register this significance.

http://fidaner.wordpress.com/2013/12/13/right-to-encryption/

---

But to reach Istanbul, it is different, Fidaner has no public IP address², only a local one with the router in between. So Jitsi¹ sets up this service relaying Jabber messages. Fidaner has an account there, and so does Wendy. In the middle is this machine relaying messages, so the problem is bypassed. Bulgarian servers are doing the relaying. So you are relying on Jitsi for this and there is still a third party in the middle, but the data is encrypted so communication is safe in that sense.

When the call gets initiated, Wendy receives a code she has to verify with Fidaner. She is not receiving sound/video (using zrtp, encrypted audio/video with “secret key” which both need to accept by a one-on-one captcha (point-to-point), no man in the middle). The packets are sent directly to the public IP of the person we’re talking to (not through Jitsi-servers in Bulgaria). For some reason, he is only receiving video, so they cannot verify.

This verification code is part of the encryption, you should both have the same key in your display and read the key to each other to know you’ve established a connection (with the right person).

Trying out another time with 2 local machines and it’s working perfectly. Sound and video and feedback. Lasse is connected with a Jabber account in Austria. Luisa and her friend managed to use Jitsi¹ with XMPP.

12h56

Fidaner waited for 3 hours in Istanbul to connect to us, so now we’re writing something for him on the whiteboard, since audio is not working. Femke and Maaike do a live video performance introducing themselves with drawings and gestures via webcam getting text back from Fidaner over the chat.

---

Wendy apologizes for getting stuck in configuration.

---

Fidaner

We are always stuck in configuration, there is nothing else to get stuck in.