Web security everywhere

Finally... I posted them in the details.

The first one is mine. My gimp skills are almost nonexitent. Artistic or not, you decide...
The second one is from my friend El_Panda. It was way too cool to not post it...

I just finished uploading the 5mn video for the semifinal :

5mn is very short when there is so much to show...

I apologize for the shaking, but I wanted to show it wasn't faked. I was also in a hurry because the rain was coming, and it still rains since then...

Hi everyone !

I have been very busy with the project in the last weeks, cleaning up the code, rewriting some parts I wasn't happy about, writing documentation, adding new features, solving some little bugs here and there, stripping down the operating system and trying new things.

So I just pushed the actual working code to GitHub. This one doesn't have all the features present in my actual development version, but it is working well. Some features inside the published code are not implemented in the main interface, that's because they are still under development.

It relies on bash scripts to build the TOR iptables rules on the fly, for the moment it is easier to customize this way. I plan to add custom rules feature inside the main interface but it is not finished yet.

I also added the updated documentation inside the GitHub repo, so I removed the documentation repo from the links.

You could find it here :

https://github.com/CaptainStouf/WebSecurityEverywhere

Finally, I choosed GNU GPL v3 instead of MIT license.

I will post an extended log later, but feel free to comment !

As mentionned, I had a show on wednesday : some swiss CEO and technician wanted to see my prototype. This was a very informative moment, we had some great talk about the whole concept.

Now, I know people and corporations are very interested in it. I just had to do a small demonstration, under their own corporate network, to make the prototype speak by itself.

I see swiss people are very interested about the "physical security" features : 

• on the actual prototype, SD-card could be removed (or even destroyed) to make the device useless in a few seconds
• the device software could be installed on the SD-card almost on-demand, from an encrypted image file

Although, I know the actual prototype is not enough. It is very nice for the client side, but corporations are also interested in the server side. They want the server side to provide 4x ethernet hub/switch, I'm actually thinking about this feature. I know the BPi-R1 open router could provide everything I need, but it's not released yet. I'm actually trying to get an engineering prototype, but I may have it in a month.

On the other hand, I'm now invited to HP Europe headquarters in Geneva to test it from their corporate network. This is again a great opportunity for some great talks about the concept. This show will take place after the september 28, as I still have a lot of work until the next contest vote...

So, since wednesday, and taking into account the discussions we had here with GeremyCondra, Dan and other people, I'm doing some big changes.

The project is now two devices :

• The first device is the actual prototype device. 

People really want the touch interface, so I rebuilt the software from scratch, using notro Raspbian image. I removed every unnecessary parts from it and kept only what is needed for the device to work. There is no more Apache, PHP, MySQL, X desktop, camera, etc... I will post an installed components list for everyone to check. I may have some more to remove.

I'm also trying to move to Moebius OS, as it is a minimal Raspbian. However I would have to rebuild the touch display kernel for it, and time is missing... So while I'm working on it, the actual prototype is still Raspbian based : I need it to work for the shows.

• The second device is the router/server device. 

It is still Raspberry Pi-B based, as I don't have the BPi-R1 device to build it yet. I also think it is a good idea to build it around a well known board. It will allow a lot of people to build it at home.

I tried Kali Linux and Moebius, but I think a specialized router distro would be the better choice. So, I'm actually building OpenWRT from scratch for this second device. I think It would also be easier to move to a different board.

However it still needs some kind of physical interface. I don't plan to use a touch display on it (although it would be nice), but I may use some I2C LCD display and a small keypad, as it doesn't require some big librairies.

I would like to know your opinions about these changes. What do you think about them ?

Hi people,

Given the comments and reactions on the project blog article, I think it's time for a little explaination. I think there was some misunderstanding, maybe because of the name's project.
I don't mean to secure the whole world internet with this box. Many people are way smarter than me on this subject, and they are doing well most of the time. But I also know there is something to do from the end-user perspective.

For the last 15 years, I worked in many structures, always doing some computers repair / cleanup / hardening, etc. I had many (well, thousands, litterally) end users computers to work on, and also many small / moderate / big companies. During these many years, one thing became clear, from the end-user perspective : privacy is too difficult for individuals to really interest in. People computers are full of virus and malwares all the time, because it's just to difficult to not click on the last Facebook link. People use the same weak password everywhere, and continue to do so, just because it's too difficult to remember them all. And I could tell you many other stories. Companies are not different, really.
During these many years, when I work on people computers, often directly at their home, I take this time, while I'm repairing/cleaning their computer, to give them advices, tell them about privacy, what to do to harden it. Some listen, many don't. Sometimes, I could even teach them about some linux, and remove their old Windows XP for some fresh distro.
But, when I leave someone computer, it's meant to be secure, at least for a few hours (and then, they return on clicking on this stupid FB video...). Believe it or not, the last active virus I met on my own computers, was wormblast, many years ago. This one teached me many things.

Now that I own my own (still very new) little one-man company, I could do whatever I want. I don't have people above me to tell me how to do things anymore, when they just want to hide easy processes, because they think computer litterate people could hurt their business. A boss urged me to remove the tools that I often install and configure for customers (you see, a simple noscript plugin) because it would hurt his business. This is a silly practice, and this time is over (for me at least).

I may have not made myself clear enough. I don't meant this box could be use to add privacy to an already crippled endpoint. It's meant to help keep privacy on a already clean endpoint. Cleaning computers is my all day job (well until recently ^^), this part I could assume, and I think I'm known to do it well. But I know many people would be interested in a little standalone box to help them understand all this, while being easy to use. Installing TOR / VPN tunnel / HTTPS everywhere, configuring them well, and using them on the endpoint is not a solution for these people. They want to push a button to activate privacy, basically. If I could teach them how and why to use Keepass for example, this would be a win already. I don't blame them at all, this is not their job. This is mine. 

From an other point of view, when customers see my device, they ask me what is it, they are interested in it. This could easily lead me to teach them some privacy concepts, from a fun perspective : "yes, I built it from scratch, and it does this". Wow factor is a great way to teach important stuff to people, nowadays.

I agree with both the two guys that are discussing on the project blog article : there are things to change on my concept. There are many components to remove, this box should be almost barebone. The actual prototypes, I built them for me, from start. Because I needed this kind of tool in my everyday work. There's a LCD screen (and camera on the first HaD prototype) because I used my first Raspberry Pi as a learning tool, did many things with it, and had a lot of fun. Look at the very first prototype video, more than one year ago : it's just a very autonomous box, with 2 bicolors leds only (I posted a fun log about UnJailPi evolution). It connected the OpenVPN tunnel automatically when it detected some internet access, nothing else. And it worked well. But with only one RPi at this time, I had to move on learning. And I also wanted some kind of interface.

This is the reason why I posted the Doodle poll. I know a barebone box would be better, but I also wanted to know what end-users are interested in. They will use a device they like, not something they detest. This is maybe a stupid assumption, but I think they are more willing to use something actually "fun" or "beautiful" (they say it everyday to me).
People would change their default WPA2 key themselves and their bad habits if it was more easy&fun to do.
See the poll results, it talks by itself. People are not interested in a barebone box, they expect some bells and whistles nowadays. And remember, we are in a contest, where final design is important, where user interface is important. Part of this contest is about bells ans whistles.
Yes we are still talking about web privacy device here, not the last iPhone...

I see I maybe have open a little can of worms here. It's perfect, really. It was one of the intended goals. The other goal was to collect some feedback... I'm not disappointed, really. From my perspective, I already won my own little contest.

So, basically, these two people are right. I have to build another, barebone, more robust prototype. I'm currently building it already, almost from scratch. But I bet this one won't make me do the cut to the final round. I perhaps could apply some of my crazy (but not so stupid IMHO) ideas on it, I will post another project log about these.

In 3 weeks I still have to learn some 3D, draw some enclosures drafts, post the actual sources, etc... There are many things left to do, and I'm already working a lot on this prototype. But I'm ok, I will work on another one.

I didn't thought to make it to this stage, but I'm in. So let's play this game, this is a wonderful learning experience for me.

(I apologize for this not-so-structured post. You made me think about many things in a few days, and I really enjoy this moment. And please remember... English is not my primary language, sometimes I could express myself really bad...)

Here is the new prototype. The box found a new home in the PiModules acrylic case.

The PiModules UPiS advanced battery board works very well, and I solved the overheat issue with a custom top plate, leaving enough room for heat to dissipate.

Unfortunately, the UPiS for Raspberry Pi B+ is not out yet, so I had to go back to the original Raspberry Pi B. The new UPiS may be released during this month, so hopefully the next prototype will be ready for the next contest stage.

In the HackaDay article about this box, someone raised an important question about security in the comments : he says not having OpenVPN on your own computer increases risks, because you have to trust the box. I disagree with him, here is why :

• This web security box is fully open source. So, everyone could check every component, every piece of software. This is a great advantage of open source.

• The user keeps complete control over security components : the RSA 1024 bits (or more) key pair is generated while installing the box for the first time, and the OpenVPN setup part is done by the user.

• If one couldn't trust the box OpenVPN software, he shouldn't trust an OpenVPN software installed on a computer either : it is the same software. Being installed on a PC is more risky in my opinion : many other components could break your configuration. The box is the opposite : you install it once, and don't add some non-related softwares all day long. So it remains very reliable (if you keep it updated).

• I don't like Apple much, but what if you want to use OpenVPN with a Mac ? You have to trust OpenVPN + Tunnelblick. One more component to trust. With the box, no problem : just connect to it, and voila ! 

• From professional experience, 90% computers have malwares, but a computer is hard to clean up. How could you be sure your computer OpenVPN endpoint could be trusted ? Do you know and check every bit of it (UEFI BIOS is an example) ? The box has no onboard BIOS, and is very easy to clean up : remove the SD card, format it, and restore your backup. It takes 10 minutes to restore a clean and working system.

• If you fear your box could be stolen or lost, and some hacker would use your OpenVPN software : just remove the SD card when you don't use it... The box alone is useless.

• If you fear some man-in-the-middle attack from the access point part : it is not less secure than your own internet router (this one you can't always trust because of proprietary softwares

• Essentialy, this box only uses unmodified OpenVPN / TOR softwares, custom iptables rules and some python interface. There's nothing one couldn't check by himself, there is no mystery component.

• The web interface configuration part is totally optional (but handy). If you fear the apache/php stack could be risky, don't install this part...

In my opinion, this box lowers the risk with having only one component to care about, as opposed to one component on each computer. 

For an example : many times I had to work with this kind of PC softwares in big companies. It is a pain to maintain and to keep secure, when you have non tech people using it on many different machines and operating systems. The box solves this problem.

About the security technical details :

• Wireless access point is WPA2-PSK

• OpenVPN uses a self-generated OpenSSL RSA 1024 bits (or more) key pair and AES-256 encryption

• OpenVPN protocol is known to have no major vulnerabilities and is considered extremely secure

• PiModules UPiS could provide Extended Tiny Encryption Algorithm (XTEA) cryptographic Customer Software Protection System with custom defined protection keys, although it is not used in the current prototypes.

• SD-card remains accessible so you could remove it from the box. Nothing could be done without it.

There are some nice news :

- I solved the battery / overheat instability with a small enclosure modification : I just had to drill one more big hole just above the battery, and build the display board with a little more room for heat to dissipate. It is now running without a glitch.

- I completely changed the main menu. It is now very touch friendly.

- the screen timeout is now completely configurable from the menu. I calculated the screen timeout function should add 15% more time on battery

- I'm currently adding the battery monitoring code to the main interface. It shows powering mode (AC / Battery), battery voltage, unit voltage and amperage, USB voltage, and charging circuit temperature. Next step will be to write a battery percentage function, add it to the main screen with a nice little icon, like a smartphone interface. The low power mode on low battery works like a charm already.

On a side note, I wish to thank the people who voted on the features poll. I'm very surprised about the results, even if there's not many votes (yet).

Please continue giving your opinions, the next prototype is in the works already, and I really want to know what you are expecting about it.

Features poll

I just pushed a new update to the interface script. The new features include :

- a new menu, a lot more touch friendly, The older one was made for keyboard navigation, and touch navigation could sometimes pose problems,

- a screen timeout has been implemented. The interface shuts down after a user-defined delay, and comes back with a touch anywhere on the display. It should help improve the battery life a lot (it was 6-7h on the 10000mAh external battery). I will make some battery benchmarks soon.

- I started making the code compatible on both Raspberry Pi and Banana Pi

I will certainly post a new youtube video during the week end.

Other than that, I'm currently making tests for a very robust privacy tool (still transparent). I may talk about it very soon also.

I also published two design documents in the project details. Feel free to comment them.

In a few day, I will present the Web Security Everywhere prototype device to some business people in Switzerland. For this, I have to make a nice slideshow. This is something I REALLY hate doing, and I spent the last 72 hours on it... :D

I may still modify some parts of it until the last moment, but here it is for you all, in the preliminary version :

Slideshow on GitHub

I also added the GitHub documentation repos to the links.

I would really like to know what you all think about it : did I missed something ? Did I made some mistakes ? I'm really REALLY bad at that...