Psiphon Program By Amine Moubtasim

Today’s Discussion What is Psiphon? How does Psiphon work? Is Psiphon anonymous? Is it safe to use Psiphon? Who is behind Psiphon?

Key terms Psiphonode Psiphonode administrator Psiphonite A psiphonode is a psiphon server that is operated by an administrator residing in an uncensored country (this is an integration of 'psiphon' and 'Node'). The psiphonode administrator is responsible for creating and managing user accounts and running the psiphon server. A psiphonite is a psiphon user, residing within a jurisdiction that blocks arbitrary web sites, and utilizes a psiphonode residing in an uncensored jurisdiction.

What is Psiphon? Psiphon is a Program that allows users to access blocked sites It turn a home computer into a personal server Psiphon was originally designed in Python *Psiphon is a program that allows users to access blocked sites in countries where the internet is censored. *It turns a regular home computer into a personal, encrypted server capable of retrieving and displaying web pages anywhere. *Psiphon was originally implemented in Python, but has been re-designed and re-written in C++, and designed as a cross-platform, user friendly proxy server tool which uses a https protocol to transfer data. With a user name and password, people in countries that use Internet content filtering can send encrypted requests for information to a trusted computer located in another country and receive encrypted information in return. As https protocol is widely used for secure communication over the Internet (from web mail to Internet banking), no government can block https traffic without further restricting its citizens' ability to use the web

How Psiphon work? Psiphon works through social network It acts as a web proxy There is no connection between the Psiphonite and the requested website *Psiphon works through social networks. A net user in an uncensored country can download the program to their computer, which transforms it into an access point. *They can then give contacts in censored countries a unique web address, login and password, which enables the restricted users to freely browse the web through an encrypted connection to the proxy server. * even if the psiphon website is blocked, it does not affect psiphon’s distribution model. Psiphon is completely decentralized; each psiphonode is independent of all others. * it acts as a web proxy for authenticated psiphonites, retrieving requested web pages and displaying them in a user’s browser. * There is no connection between the Psiphonite and the requested website, as psiphon transparently proxies the request through the psiphonode’s computer allowing the psiphonite to browse blocked websites seamlessly. * Psiphonites go to their psiphonodes’ machine using a unique web address. The first page displayed is the user login. The psiphonite must login with a valid username and password given to them by the psiphonode administrator. After authentication the server displays a toolbar at the top of the page where psiphonite can then enter the website they want to browse.

Is Psiphon Anonymous? Psiphon is not an anonymous software program Users can be monitored by the ISP or Government Psiphon uses HTTPS for extended period of time *psiphon is not an anonymous software program. psiphon users are not anonymous from the psiphon provider. Although traffic between the psiphon user and psiphon provider is encrypted, psiphon providers can potentially monitor everything that is done by the psiphon users they host. When psiphon users visit websites through the psiphon server their identity and location is hidden from the web-site *Note: Do not use psiphon for anything you do not want the psiphon provider to be able to see. *Yes, your government and/or ISP can always monitor which web sites you visit. When you use psiphon, your government and/or ISP can only see that you connected to another computer, not the sites you visit. psiphon makes it difficult for anyone to determine that you are using psiphon. Note: bypassing censorship may violate law. Serious thought should be given to the risks involved and potential consequences. *From a technical perspective traffic between the psiphonode and the psiphonite is identical to normal HTTPS (encrypted) traffic. Although many sites only use HTTPS during the login process many sites, such as email providers and banking services, use HTTPS for extended periods of time, as does psiphon. The differences are that psiphon uses self-signed certificates and connections to home computers, rather than signed certificates and domain names. However, unless the attacker has the private psiphon URL it cannot be easily determined that psiphon is being used. The key to detecting psiphon is infiltration of the psiphon administrator's social network. *Note for advanced users: To maximize protection against the discovery of the psiphon user's true IP address, all scripting languages, such as JavaScript and ActiveX, should be turned off in the user's browser.

Is it safe to use Psiphon? Its encryption provides strong protection against electronic eavesdropping The use of small trusted network makes it more difficult for eavesdropping *The Citizen Lab said the system provides strong protection against "electronic eavesdropping" because censors or ISPs can only see that end users are connected to another computer and not view the sites that are being visited. *It added that using small trusted networks as a delivery mechanism will make it more difficult for censors to find and shut down psiphon.

Who is behind Psiphon? Psiphon is part of the CiviSec Project run by the Citizen Lab at the Munk Center for international studies at the U. of Toronto It is funded by the Open Society Institute Which is a private operating and grant-making foundation, aims to shape public policy to promote democratic governance, human rights, and economic, legal, and social reform. On a local level, OSI implements a range of initiatives to support the rule of law, education, public health, and independent media.

Demonstration http://psiphon.civisec.org/PsiphonAug232006.html