Well, I'm sure you've all heard of anonabox. I think the idea is positive but the implementation looks like it's being run by amateurs. My wife came up with the idea of doing something similar, but more secure and cheaper. She has sourced hardware. Samples should be here by Monday. Other logistics are more or less sorted.
There are a few criticisms of the anonabox, some of which are addressable, others not so much. I'll break down the concerns that I'm aware of and possible solutions. If there are other issues that you can think of, or solutions that I haven't considered, I'd love to hear them.
Criticism: They lied about a heap of stuff.
Solution: No lying.
Criticism: They weren't open about the hardware being off the shelf.
Solution: Be open. Provide people with specs and rom. If they want to make their own with a box off aliexpress then they can go for it.
Criticism: The firmware created by the anonabox people was a joke.
Solution: This was amateur hour and pointed to a serious lack of expertise on their side. It would be locked down properly.
Criticism: Claims of anonymity.
Solution: Make it clear to people that some end user behaviour will effectively remove anonymity and that they shouldn't trust their lives or freedom to a box like this.
Criticism: Browser fingerprinting
Solution: I'm not sure about this one. I did think about some kind of packet inspection within the router and flattening the browser agent for example. I'm not sure there's enough CPU power for that (though I'll find out when engineering samples get here in a few days) and there are holes in it as a solution. Ultimately the solution here may be education.
Criticism: Possible hardware back doors.
Solution: We're not manufacturing ourselves, so this is a possibility. Test for them. Other options that don't cost a bajillion euro?
Criticism: Intercepted packages with "custom" firmware installed
Solution: Tamper evident package and / or ability to flash firmware from website (with hash) on arrival.
Criticism: What if a hole is found in Tor?
Solution: Provide security update. Open source software offers the option of indefinite community driven updates.
Thanks for reading this far.
If you have any input or suggestions I'd by really grateful to hear it all.
