<br><br><div><span class="gmail_quote">On 4/12/07, <b class="gmail_sendername">scar</b> <<a href="mailto:scar@drigon.com">scar@drigon.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
norvid @ 2007/04/05 17:18:<br>> On 4/5/07, James Muir <<a href="mailto:jamuir@scs.carleton.ca">jamuir@scs.carleton.ca</a>> wrote:<br>>> norvid wrote:<br>>> > On 4/5/07, James Muir <<a href="mailto:jamuir@scs.carleton.ca">
jamuir@scs.carleton.ca</a>> wrote:<br>>> >> norvid wrote:<br>>> ><br>>> > <snip><br>>> ><br>>> >> I've heard that properly configuring a firewall can be tricky. In any
<br>>> >> case, using a firewall still doesn't protect from Java applets reading<br>>> >> identifying information locally and sending it back through the<br>>> >> anonymous connection.
<br>>> ><br>>> > Actually, I believe that with the browser denied access to the<br>>> > internet, the normal 2-way java applet communication is prevented.<br>>> > Please try the test I mentioned.
<br>>><br>>> In the tests that I have done previously, the Java VM inherits the proxy<br>>> settings listed in the browser (at least this is what is supposed to<br>>> happen; sometimes this does not happen). So if the browser is
<br>>> configured to use Privoxy and these setting are communicated correctly<br>>> to the Java VM, what is there to stop a Java applet from sending back<br>>> data through Privoxy?<br>><br>> I don't know the answers to these questions other than to say that I
<br>> am not configuring any of the proxy settings in the Java VM. They are<br>> the default.<br>><br>> I have tried to configure Java VM proxy settings with no apparent<br>> success. I have no idea why this does not work.
<br>><br>> My test might best be performed on a Windows machine as the<br>> availability of software firewalls is fairly extensive. Alot of these<br>> are easily configurable to block the browser and allow Privoxy access.
<br>> Although I don't have much experience with Linux, I'm guessing that<br>> it might be a little more difficult to configure than Windows.<br>><br>> I am certain that on my machine using two different firewalls, the
<br>> very specific test I detailed will not determine my real IP even<br>> though Java is enabled. Of course it cannot determine my IP if Java<br>> is disabled also.<br>></blockquote><div> </div><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
i think what we are trying to say here, is: even though this configuration may prevent java from determining the user's IP, it does not prevent java from determining other personal information.<br><br>this information may include: the local time of the user's machine, screen resolution & color depth, operating system & browser version (if this is found to differ from the UserAgent reply, isn't that suspicious?), and probably many, many other items. these could be just as revealing as an IP address. so, unfortunately, i don't see the point of this configuration with anonymity in mind.
<br><br><br></blockquote></div><br>The local time of the user machine, that could be useful. <br>But if you want to know that the screen size is 1024x768, sure, you just got the screen size of my VM. That doesn't tell you that my real screen size is 1280x1024, 1600x1200, or whatever. As for my OS, I don't care that you find out I'm running Windows, in a VM.
<br>Then what possible REAL information would you be able to find?<br><br>Seriously, someone...anyone, show me how much information you could get using Java, Javascript, or Flash against JanusVM; I don't think you would get much USEFUL information.
<br><br>Specifically:<br>* What information can you find out that is REAL AND TRUE about the user and/or environment they are using? <br>* How would you use this information to track the user to their point of origin or source?
<br>* How can this information compromise the safety / privacy of the user?<br>* Can any of the recovered information be used to calculate the users personality or browsing habits? (such as tracking pedophiles, like HD Moore wants to do.)
<br><br>I would be using JanusVM for the transparent proxy layer, Windows XP Pro for the OS, and both IE and Firefox for the test. Two VM will be running with VMWare Server, JanusVM and Windows XP. <br><br>If anyone is up for this, just let me know.
<br>Personally, java is nice but I hate coding it and have lots to do already, otherwise I would do it myself. <br>I would love to see good results, and have someone make me eat my words. But as it stands, I think JanusVM is your best bet (for now) to protect yourself against Java/Javascript/Flash leaking your real IP or other useful information.
<br><br>(HD Moore, you up for this? If so, let me know because I have a couple of ideas for ya. ;-)<br><br><br>Regards, <br>~Kyle<br>