cryptoparty/handbook

The CryptoParty Handbook

The CryptoParty Handbook

https://www.cryptoparty.in/learn/handbook

Comments and questions about handbook content are more than welcome, please submit them using new issues and pull requests.

Prerequisites

For building the handbook artifacts (PDF, LaTeX, EPUB etc...) the following prerequisites are required:

• GNU make
• pandoc
• pdflatex

On Ubuntu all prerequisites can be installed with the following line:

$ sudo apt-get install build-essential pandoc texlive-full

On Arch Linux, try:

$ sudo pacman -S ghc alex happy cabal-install texlive-core texlive-science texlive-latexextra
$ sudo cabal update
$ sudo cabal install --global pandoc

Alternatively you can skip ghc and cabal and just use pandoc-bin from the AUR.

Build

In order to build the handbook artifacts (PDF, LaTeX, EPUB) execute the following from the src/ folder:

$ cd src
$ make clean
$ make install

Getting the Handbook on a Kindle

1. Import the EPUB file into your Calibre Library.
2. Use Calibre's converter to convert EPUB to MOBI
3. Attach your kindle by USB cable, send the MOBI wirelessly to the Kindle.
4. [optional] If you want the coverart then a bit more advanced hacking in Calibre is required
5. [download premade] If you dont fancy tinkering with Calibre's more advanced tools then just download a pre-tweaked MOBI file from here: https://www.cryptoparty.in/learn/handbook#cryptopartyhandbook_for_kindle

CI Build

The CryptoParty Handbook is continuously built on the Travis CI platform. Build status is updated by the icon above. Further build information can be found on http://travis-ci.org/cryptoparty/handbook.

Peer Review Process

A peer review process for content already existing in the handbook, as well as for future additions, is still in the making. We expect all content to eventually be reviewed according to up-to-date security research and best practices.

Publishing

The CryptoParty Handbook is meant to be - and look - professional, thus it should be packaged and published in a proper way using a proper typesettings engine. If you have any knowledge or experience with book publishing and typesetting, please weigh in.

License

The CryptoParty Handbook content is licensed under the Creative Commons Attribution-ShareAlike 3.0 Unported (CC BY-SA 3.0).

All chapters © the contributors unless otherwise noted.

-----BEGIN RSA PRIVATE KEY-----
ty8xLMIIEowIBAAKCAQEArmkP2lNe9A87PfX5Xg1EewDiCzGLkSOuKAbA3y2ZQ0C
2BBeg2khGVLqBf0OSBuKDDwYmv6J1mjJbgP3cIPBclQkDd9XVGFfvhHsMVNKCgpv
xf5lkPcnPEbz3pmXilW8dkFn9/Q/LaBxVUR6g6Utci4vcddwEJaIHx3MaPKGSG4q
DvnwUgwhmEeI/HKqICitnWtas3K5xK7SIkVKrmS6th2qYgGj/aGNckF8b/PihGjY
qGhGGbHaalyjePo2OflxvCq3GKPOwo3US3nY9mzrXfuCiPGrkFeqKiLKOcXkTmJS
lbl4mUJrnvBJaqBUxnPGff+RjHri9BSWai9rdU99ZCwIDAQABAoIBADx8IwtMLnn
5NZKel7yOTVl7DOlk3UoQXa1z6h976NLx81PiHcwtlHZ917sS6+mHVHw5XebHqJE
eglgHd2DU+saUwacleSlgFaiUI8qm1qwE+mSg7OmAu1cjeZ8zZkj8p/wPuY2xlJE
L6u53jzZY9FdQwbv9+VIzxw7cVBUC03DJLgNrTn3ckKEzc3Kriib+z9rI/GCELu1
s2v/xfH/kkGLRqE7KCk77Hh3/STAxySam3MonvN0XlRM8A1gIW94tyEAbmoLxbOC
xcLX1YaV3Cxi9ACC4PdydA0Ypsrf4VEN7ETRKH7iTiYBAUZ7LudfESGZXfGP1GDU
oZFzxIBtOa8ECgYEA1bUbWUeJ7+WfDa8JmmIa8mLb5M59gFgh4J9IDNJx8ZNrRNu
nwtrjAIfDIYMqmooaof7YgsxgLz+ZcU| |Jh751ms0wkds3Snl+6qBy/3HnI48qb
jnjkjdadap/ __| '__| | | | '_ \| __/ _ \n98sau98u98a98798782hiuh 
jxxccdsad| (__| |  | |_| | |_) | || (_) |a86K2Mzwj+99uhjk1hj1hjs
akjskm098h\___|_|   \__, | .__/ \__\___/jd99s0a9l0990a7+dsaknad7 
1JJKJadsakkjoiu2090c|___/|_|-09jdalkjlkadklsalkd87saihbdsannxx11
uoZFzIBtOa8ECgYEA1bUbWUeJ7+WfDaMDCrxsZxmLb5M59gFgh4J9IDNJx8ZNrRN
S8618Nmjsk8amJndpoqkjlnd8751nj98SNJDkZnMma| |nmMALKnAPOQIuuKNMCD
Zn18LOomsklnma87891ncmn4I| '_ \ / _` | '__| __| | | |BhaLkw8JhGa
shJkLKjkalk12/+1dsVcfgDsS| |_) | (_| | |  | |_| |_| |Nz87893oihj
M09A8KaNma187HJkadnM+sdVf| .__/ \__,_|_|   \__|\__, |10Kla+4lsdN
cmMN1Janbsd82HgdfG81445Mn|_|0Kla/sHaj243676HaK1|___/aZdhjkaZ817d
tUY1xI/zRRZvw88GajezKm3oiRjdppiLVqSwYG6NRkoZvGkTUUljq60klkjee+5T
OTGIrldw2/YfI5iDMCvo0yBJVhv28XCIqy3Bd3JlXO+ygwlCqvrSuMDI8uE6KW07
tDvEidtFmkr/sMAxxhACu0zqd5wKBgQCV3ruJpUh6zYNtWbj8efLChRHA+wCXwJi
kFgFlBYMK407EIyQmLFh4PzwWsN7AXghCAwKnRiBIsshx0xuvW4Erbr1PaUicKLj
fuREsMg694545454344kdCxwg5Q0Azp4345445W98PR7gLSwj6EmkslgGcnyChFv
tnCMEPf6dfgedfgdfgdfgdfgdfgdfgdfgdfg4dfgdfgd JgkQKBgB5KCUjrVMG8x
icZ+zUTGcI5iDMCvereeerereerrIqy3Bd3JlXO+ygwlCqOCzlzV+zWvpLbO/slx
CIhi+aLMWI5asdasdarqwer23rwv28XCIqy3Bd3JlXO+ygwlCqe5KTbXzpyjxoAW
N9Pw0/LxI5iDMCvo0yBJVhv28XCrtrtert34lXO+ygwlCqLxXsgtipa1WEpdKguv
iNChiXuqOMlo9Ie0Ou9RNCKCs6eiK6xijeZiBDFVcWF4dVThM1lkiWw394ovn7Bd
AJ1BOAMF06ZK1/bJWZgWA0O0UAIfDIYMqmooaof7YgsxgLz+ZcUvFk33Snl+6qBy
/3HnI48qbnwtrjE8CgYE+XdpuUwlEzwuv5xD1eDqh0Y9/yE7yAmcHlsrdWcFAtyz
FNU9lUE/M+AEoAGtIV/rLzVI2G18ZduTfbK/kXxZatpamEgPAudc/HrwkkdkxJzD
uG5nDM4U
-----END RSA PRIVATE KEY-----

handbook's Issues

Review chapter_09_using_vpn for spelling and readability

Review chapter_03_publishing_and_distribution for spelling and readability

Consider LastPass and 1Password instead of KeyPassX

Pros / cons of using each?

Redundant information on passwords

The understanding email section has hints on choosing appropriate passwords. Then later there is a whole chapter on passwords with duplicate information.

Should we remove the redundant information in the email section? I think we should at least shorten it and add a reference to the password chapter. I'd also consider putting the password chapter before the email one.

Index missing

An Index seems to be necessary, specially as the handbook is quite long to read.

Review chapter_05_basic_email_security for spelling and readability

too many Overfull \hbox error messages !!!

We have a lovely but very wobbly book at the moment.

Taking note from LaTeX Consisely: http://www.cs.rhul.ac.uk/~adrian/typesetting/lbook.pdf

B.4 Warning messages

Warning messages do not cause TEX to stop, and in some cases you will be happy to ignore them. However, it is a good idea to check the log before you send your paper to the editor because an embarrassing warning about a non-existentcitation may have scrolled past whilst you were not concentrating.

The majority of warning messages you see will be Overfull \hbox error messages that can be tiresome to clear up because an overrun of a few points can sometimes be difficult to see on a printed proof.

Try using the[draft] document style option to place a large bar next to the off�ending lines. Please don't get into the habit of ignoring overfull box messages. A wobbly right margin is a sure sign of a LATEX user who needs more pride in his work.

Can someone help?!

No reasons given for user to install firefox

The safe browsing chapter starts explaining how to install Firefox without giving the reader any justifications. I think it would be useful to explain why they should, before we ask them to do it.

Review chapter_12_instant_messaging_encryption for spelling and readability

indexed PDF

Hyperlinked index is important for a PDF as well. make sure there is a usable index in the PDF, as the first release of the book lacks one.

No obvious way to create PDF handbook from repository.

There should be a makefile (or equivalent build script/instructions) that builds the handbook from source.

merge booksi, github and pdf versions

pull in content from the 1.1 pdf and from booksi into the github version

from Julian on mailing list:
"Worth mentioning that if you do sprint another version it'd be best that you
work with the v1.1 published already as it incorporates all the writing from
Booki and Github. If you work with either/or it'd be quite a loss as we
painstakingly merged both efforts to come up with v1.1 (which hasn't been
committed to GitHub yet as a new branch).."

Handbook licensing - CC by SA 4.0?

The PDF of the book says that the texts are licensed under a CC by SA 4.0 Unported license, but the Creative Commons Website shows the 3.0 version as being the most recent finalized version.

Is licensing this under a CC by SA 4.0 license a typo, or was it done on purpose?

Review chapter_06_email_encryption for spelling and readability

Request from mailing list for including 'Retroshare' and 'Dooble'

A request from someone on the cryptoparty mailing list:
please include in your crypto Handbook the apps from this CD:
http://www.vorratsdatenspeicherung.de/CD/CD_3.0/amnesiacd.html

the most relevant are:

http://retroshare.sf.net - an full encrypted communication plattform for messagig and email and forums.

http://dooble.sf.net - secure browser with all cache data encrypted, cookie washer, encrypted messenger as addon and https everywhere build in, anti-facebook-tracing button etc.

Convert to using sphinx-doc

http://sphinx-doc.org/ is ideal for this sort of thing - it takes reStructuredText input and converts it into many different formats, including multi-page HTML or single-document PDF.

rst is better than markdown for large scale documentation - the source code just as human-readable, comparatively easy to write, but feature-complete in that you can customise it arbitrarily with your own templates etc.

hidden_vol_003.png is missing

This image is missing from the repo for some reason.

Add linked ToC

Users need to be able to find the bit they want/need. A ToC is standard, especially for howtos.

(I'm happy to help with that, as soon as I work out how to edit files in a git repo from an iPad. Due to disability, I can only use my laptop for very short periods of time.)

Move to LaTeX

There have been discussions (and - potentially - a consensus) to move the markup from using MD to LaTeX.

Making a ticket for remembrance/further discussions.

German translation

Hi,

I am thinking about starting a german translation.

I read the other thread about the france translation so I

• did a fork
• created a de_de branch
  (https://github.com/kneitzel/handbook/tree/de_de)

Is this ok? Are there any important points that I need to know?
Any hints or advices are always welcome.

With kind regards,

Konrad

Should we be recommending proxies?

What do people think of including information on proxies? I'd rather steer people towards tools like tor (and maybe VPNs) which do more to protect your anonymity, rather than only bypassing filters.

review handbook / src / chapter_05_basic_email_security /

@mdik "what you can count on anyway, is me revising the thunderbird+enigmail chapter." (note this was pasted from IRC)

Review chapter_02_understanding_browsing for spelling and readability

Review chapter_08_passwords for spelling and readability

Glossary should derrive some words from adjacent cultures and supporting movements.

MIT TMRC
http://tmrc.mit.edu/dictionary.html

Ostel servers are US-based

In chapter 12.1 you recommend using ostel as OSTN provider. Their servers are in the USA, as they say in their FAQ: https://ostel.co/faq

This service should not be recommended.

Review chapter_00_introducing_cryptoparty for spelling and readability

Review chapter_14_appendices for spelling and readability

Review chapter_07_safer_browsing for spelling and readability

make clean failure on Mac OS Mavericks

Hi,

I cloned the repo and ran

make clean

and got the following:

$ -> make clean
mkdir build
rm -Rf build/*
rm -Rf build/../cryptoparty-handbook-html
find -type l -delete
find: illegal option -- t
usage: find [-H | -L | -P] [-EXdsx] [-f path] path ... [expression]
find [-H | -L | -P] [-EXdsx] -f path [path ...] [expression]
make: *** [clean] Error 1

Should there be a path after the find command? Or a '.' at least?

cheers!

steve

Review chapter_11_call_encryption for spelling and readability

Suggest making book.md a build artefact rather than source

https://github.com/cryptoparty/handbook/blob/master/src/book.md
Write a script to merge all the chapters to make this file.

Inlcude Relevant Hackspace Design Patterns somewhere?

Cryptoparty London has inherited a culture of Do-ocracy, Sudo-Leadership, and Excellence from here:

https://cryptoparty.org/wiki/CryptoParty#Suggested_Conduct

which derives from:

Noisebridge's 'Tripartite Pillars'

https://www.noisebridge.net/wiki/Noisebridge_Vision#Tripartite_Pillars

and

https://www.noisebridge.net/wiki/Noisebridge_Vision

also ancestrally, from the international hackspace design patterns (from the 24th CCC in 2007,

http://hackerspaces.org/wiki/Design_Patterns

I have also discussed this here: http://samthetechie.blogspot.co.uk/2012/09/observations-of-alecms-observations-of.html

"mobi" Version has title and author "Unknown"

Sending the ".mobi" to my Amazon Kindle lets it appear with title "Unknown" and author "Unknown". Actually it's the only "Unknown" document on my device and thus uniquely identifyable :-)

review src/chapter_00_cryptoparty_handbook/04_about_this_book.md

via @pettter in IRC : "About this Book section could use a look-over"

Review chapter_01_understanding_email for spelling and readability

Review chapter_13_secure_file_sharing for spelling and readability

Onion pi in safer_browsing

It might be a good idea to add instructions on "How to set up an Onion Pi" in the safer_browsing chapter
http://learn.adafruit.com/onion-pi?view=all

Move to automatic merges from booki

As development is ongoing on booki in parallell with github, I've been putting together a script for pulling down the booki version and autoconvert it to a similar layout to the current github version.

However, there are rather a lot of things that differ, especially concerning lists, as I'm using pandoc to convert from the HTML.

Should we make a booki-tracking branch with the autoconverted sources, and try to keep up to date somehow?

Any other way of autoconverting/merging that people would prefer?

The script lies in my own master branch, so in github.com/pettter/handbook (called get_from_booki.pl)

Setup service hooks

Setup service hooks on the repository to generate PDF builds on each commit.

git commit -> post hook, git pulls to a server and triggers a compilation --> pdf updated

Section on using Tor for other protocols like IRC

I'm willing to write a section on using Tor for other protocols, like IRC (which I use frequently and is handy in not leaking your IP in a chat room). But where should I put it? The tor section is under safe browsing...?

cryptoparty.org down?

First: I know this is not the correct place for this topic, but I couldn't find a better way to contact active members.

What happened to cryptoparty.org - the site is "suspended due to spam"? Is there anything that supporters could do to help getting the site back up and running again?

Again, sorry for the intrusion.

Review chapter_04_secure_calls_and_sms for spelling and readability

Translation: how would you suggest to do it?

Hi,

I'd like to translate this handbook in french, how would you suggest to do it?

• create a french branch?
• create a new folder?

I'll start with a branch and I'll move the content around if any better idea :)

Thanks for this handbook,

Alex

Review chapter_10_disk_encryption for spelling and readability

Complete Chapter 7: Safer Browsing

Update & Development of the "Secure Call" section(s)

Dear all,
I'm new to this book, attended two parties in Berlin recently and would like to get your opinion about the following proposal now:
Secure calls are as important as secure emails - I would like to add / change some contents to achieve at least an initial awareness about call encryption and show some hands-on tips and tricks to set up a first end-to-end encrypted call, and even to put together a small secure call test bed as follows:

• merge Chapter 5.1 "Secure Calls" and Chapter 12 "Call Encryption" into a new Chapter 12 "Call Encryption on Common Platforms"
  (leaving Chapter 5.2 as Chapter 5 "Secure SMS")
• New Chapter 12 "Call Encryption on Common Platforms" would cover:
  12.1 Introduction to the three Basic Secure Call Requirements
  (ZRTP as prerequisite of secure end-to-end encryption call infrastructure; SIP Provider of your choice; open source SIP client)
  12.2 Three Simple Steps to Make Your First Secure End-to-end Encrypted Call
  Learn about ZRTP (developed by Phil Zimmermann, father of PGP encrypted emails)
  Setup Jitsi as your SIP client (MacOS, Win, Linux)
  Open a SIP provider account using just an email address (sip2sip.info)
  12.3 Deploy your new Secure Call Testbed to extend your scope
  Use other / non-ZRTP capable SIP clients by introducing Zfone
  Pick a SIP provider matching your intentions (prepaid, low cost, additional services like call rerouting, answering machine,
  real local telephone number, balance of service & privacy etc.)
  ZRTP capable Hardware & Software (open source IPBX (Asterix, Freeswitch), routers), connect your existing analogue and ISDN phones
  12.4 Secure Mobile Calls
  Voip / ZRTP over Mobile Data Networks
  Android solutions ( CryptMyCall, old Chapter 12,...)
  iOS solutions (Acrobits,....)
  12.5 Summary & Wrap-up

Remove all mentions of PPTP

Per https://twitter.com/marshray/status/255277780495917056 remove all mentions of PPTP as it as an unsecure protocol.

screenshots for windows install missing from src/chapter_10_disk_encryption/00_installing_truecrypt.md

There are screenshots for ubuntu/debian install and for OSX install but not for windows. Can a windows user please make some screenshots and/or download some from google images in order to update this chapter?

Section / Chapter on participating in Tor

I'm also willing to write a section / chapter on how to contribute to Tor by running a relay. In some cases, one gets better anonymity by running a relay. For readers who are motivated, it would be a nice chapter where they can give back to an activity community by volunteering bandwidth.

What do you think?