Code Signing and Inclusion Upstream

[HulaHoopWhonix]

Hi I'm a member of the Whonix project [whonix.org], a Tor centric distro like TAILS except we use a multi-vm design to force all traffic into an anonymizing middlebox vm.

Until I came across nymphemeral, the choice of mixmaster GUIs on Linux was very lacking. I think you did a great job designing and explaining anonymous email and nym servers and I would like nymphemeral to be included in our project and upstream repositories.

Please consider:

• Packaging nymphemeral for inclusion in Debian
• Signing your code using the git tag signing feature (https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work) so we can build it from source with certainty that the code has not been tampered with.
• signing your tar.gz tarball on pypi.python.org and possibly documenting how users can verify and install your software in a safe manner. Signing a .deb is straight forward or it can be done with setup.py too (https://www.davidfischer.name/2012/05/signing-and-verifying-python-packages-with-pgp/).

[felipedau]

Hi @HulaHoopWhonix, thank you for your request. It means a lot for us! We will start working on the packaging and will let you know as soon as we have it ready.

Thank you very much! -Felipe

[felipedau]

I forgot to mention, but as I was reading the ticket, I noticed something that maybe is not too clear on the documentation and would like to explain that:

Although the new nym server can act as the usual Zax-type nym server, the client (nymphemeral) cannot act as an usual Zax-type client. It only supports the new server and in fact that's the only way to exchange messages. It is not specifically a mixmaster GUI, but when sending messages to the nym server, the user could choose to do so (automatically) using mixmaster.

nymphemeral was designed to use only ephemeral encryption, but some changes could be made to support both the usual and new nym servers.

Regarding a mixmaster GUI: I believe that a new (and simpler) application should be developed so that users can send messages via mixmaster without all the complexity of the nym stuff, since they might not wish to use that.

Let me know if I should clarify that on the documentation and tell us what option (if not all of them!) you believe would be more useful for Whonix. I am more than happy to help :)

Thank you very much! -Felipe

[HulaHoopWhonix]

Very informative. Yes please add your explanation to the documentation.

nymphemeral was designed to use only ephemeral encryption, but some changes could be made to support both the usual and new nym servers.

I'm in favor of backwards compatibility so as to grow the user base and anonymity set.

Regarding a mixmaster GUI: I believe that a new (and simpler) application should be developed so that users can send messages via mixmaster without all the complexity of the nym stuff, since they might not wish to use that.

I don't want to ask you for too much, but here's how a simpler one-way mail on Mixmaster could be added to Nymphemeral: It would be an extra mode and the interface would implement a subset of the fields of the nym management GUI.

Let me know if I should clarify that on the documentation and tell us what option (if not all of them!) you believe would be more useful for Whonix. I am more than happy to help :)

Really appreciate it.

[felipedau]

Very informative. Yes please add your explanation to the documentation.

Alright, will be added soon.

I'm in favor of backwards compatibility so as to grow the user base and anonymity set.

That's true!

I don't want to ask you for too much, but here's how a simpler one-way mail on Mixmaster could be added to Nymphemeral: It would be an extra mode and the interface would implement a subset of the fields of the nym management GUI.

That can be done and I believe it would not be too hard.

I am going to open a few issues regarding these discussions we had and I will let you know once they are closed.

Thanks!