In the scope of a public research project, we ask to to participate in an anonymous survey:
https://m-chair.survey.uni-frankfurt.de/index.php/989977?lang=en
You will thereby support our work and the privacy research.
Sadly, we need to tell that the development of the JonDo live DVD has been stopped. You may still download the current version, but we will remove the download quite soon. The reason for this is, that there are not enough developers available to do the maintenance work. Our focus is to use our available time for maintaining the core components JonDo, JonDoFox, Mixes and other integral software components of the JonDoym system.
We hereby say a big THANK YOU to Cane, the long-time developer of the Live DVD, for the great work he did in the past!
What lately lead to some confusion on the side of Linux users:
We changed the software signing GPG key, but this was news not updated on the Debian repository instruction page. So some users got an error while verifying the GPG signature, while we on our side could not see any problem. This is fixed now, please follow these instructions to get and use the new verification key:
https://anonymous-proxy-servers.net/en/help/install_pgp_signaturen.html
For Debian:
https://anonymous-proxy-servers.net/en/help/firststeps2.html
The change of the key was necessary in order to separate it from the general e-mail and support key, so that developers and the support team do not need to share the same key. Moreover, the key has a greater cryptographic strength now.
Again, the German government passed a law for data retention, which came into force today.
Fortunately, this is nothing JonDonym users need to worry about. Unlike the previous law, which was dropped by the Federal Constitutional Court in 2010, only Internet acces provider are affected [§113(b)(3)]. Pure Internet services like JonDonym will therefore not get into any troubles, now will their users.
In any case, JonDonym users should be safe by against such single-country-laws in general. This is due to the nature of our system: operators from different countries and jurisdictions provide the Mix services, and always two or three of them need to get their data linked together to potentially uncover users.
This allows for legitimate crime prosecution in very serious, individual cases, but effectively prevents a mass observation. Until now, there has not been any court order that obliged a complete premium cascades to log data. By default, the Mix operators neither look into the users' traffic nor do they store it. That's what you can expect, now and in the future!
With today's update of the Mozilla Firefox release, Mozilla made some major changes concerning add-ons. If you do not have the current version of the JonDoFox add-on, it might not work any more in this new Firefox browser.
Important: If you are using JonDoFox, please verify that JonDoFox is still working correctly by visiting our ip-check-site. If you see any major problems here, this strongly indicates that you need to update your JonDoFox add-on.
In case you are using Microsoft Windows, we recommend you to download the latest version of the complete JonDoFox profile and reinstall it on your system:
https://anonymous-proxy-servers.net/en/software_win.html
For all other systems (Mac OS, Linux), please use this URL to directly download the JonDoFox add-on:
https://www.anonymous-proxy-servers.net/downloads/jondofox.xpi.zip
Unpack it by using your favorite zip/unzip tool. Then, use drag-and-drop to pull it in your Firefox browser for installation and update. If you still have problems, please feel free to contact our e-mail support, and we will help you.
If you still have problems updating the XPI, you may do the following:
1. Remove the JonDoFox add-on
2. Restart the browser
3. Move the XPI file (see link above) into the add-on list by drag using drop.
Please note that the two add-ons "Profile Switcher" and
"Canvas Blocker" will nevertheless be unavailable, as their development has been stopped by third parties.
If you moreover have problems to activate "Profile Switcher" or "Canvas blocker", please do the following:
1. Remove these add-ons
2. Restart the browser
3. Re-add these add-ons from the mozilla download site, e.g. from these URLs:
https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/
https://addons.mozilla.org/en-US/firefox/addon/profileswitcher/
Recommendation: In order to prevent future update problems with JonDoFox, please enable automatic extension updates in your browser. You may do this by entering about:config in your address bar. Make sure the options extensions.update.enabled and extensions.update.autoUpdateDefault are both set to "true".
Thoughout the last months, we got a lot of e-mails concerning a payment service called „PerfectMoney“. In these mails, a lot of „customers“ tell us their „interest“ in using this service to pay for ours. Almost all of these e-mails had the subject „Payment“ and contained only one or two lines of text. These are some of them:
„Greetings. I want to use your services. Can i pay with PerfectMoney on your site ? Thanks !“
„Hello sir. I am interested in your services and i want to ask you , can i use Perfect Money to pay on your website? Thanks and have a great day“
„Hello. I want to use your services. I was wondering if i can pay with perfectmoney ? thanks“
„Hello .
I'm interested in using your services and i was just wondering if i can pay with Perfect Money on your website ?“
Obviously, this is SPAM. And it originates from PerfectMoney themselves, as there is neither a URL nor an affiliate code in these messages. But how trustworthy can a payment service be, that is advertised by massive spam? We visited their German website and read:
„Genauer, zuverlässiger finanzservice, den deutsches Volk anerkennen wird“
„Gipfel der Vollendung in der virtuellen Weltwirtschaft wird von nun an durch ein ideales Finanzinstitut – Gesellschaft Perfect Money vertreten, deren Zielprogramm ist es, Finanzoperationen im Internet auf ideales Niveau zu erheben.“
Source: https://perfectmoney.com/?lang=de_DE (2015-04-07)
This sounds like a very bad google translation... How trustworthy can a payment service be, that – instead of writing all English – relies on quite random translations for „informing“ their customers?
Wouldn't it be more honest and effective to directly contact us in the
name of PerfectMoney, and acquire us as a partner rather than as a spam
victim?
Just for clarification:
we are not against new payment services. They help us to finance our services. And maybe we would give
PerfectMoney a try in other circumstances. But we hate SPAM. Maybe
this article helps to stop it.
We installed a new SSL certificate for our webserver. The domains anonymous-proxy-servers.net and www.anonym-surfen.de are affected. The fingerprints of the new certificate are:
(Corrected SHA256 fingerprint on 2015-04-13)
Hello visitors,
just as we got a lot of questions regarding the recently published WebRTC ip leak attack, we just thought it might be a good idea to clarify that this is not an issue for JonDoFox users. Since ever this WebRTC was active in Firefox, we switched it off as even our preliminary analysis showed that it will be harmful for anonymity. So even if you activate JavaScript on a page, this is not a problem for you.
Note that, however, if
you do not use JonDoFox but ANOTHER browser in connection with JonDonym,
for example a self-configured Firefox, you are NOT protected
automatically. Just to make this clear: normal browsers have so many IP
and data leaks that even most tech-users are not able to configure them
privately. Mabye you will be able to fix this one, but forget another
three leaks... So we strongly recommend to use JonDoFox, as we use our
best experience to make it secure for you.
We changed the OpenPGP software signature key for software downloads. The signatures were created with OpenPGP key 0x2146D0CD2B3CAA3E (software@jondos.de). You may download the key file Software_JonDos_GmbH.asc from our server and import it or you may fetch the key from a keyserver. The fingerprint of the key is:
fingerprint: 6899 5C53 D2CE E11B 0E41 82F6 2146 D0CD 2B3C AA3EIf you want to be sure you got the files created by our developer you have to verify the OpenPGP signatures as descripted in our online help: Verify the OpenPGP signatures. Our OpenPGP signatures contain a SHA512 hash of the signed download file. This hash is signed with a private 4096 bit RSA key.
The MD5 and SHA256 hashes on our download websites are only for download verification. If you want to be sure you got the software created by our developers, you have to verify the OpenPGP signatures.
We installed a new SSL certificate for our webserver. The domains anonymous-proxy-servers.net and www.anonym-surfen.de are affected. The fingerprints of the new certificate are:
The unscheduled release 0.9.66 of JonDo live-dvd contains an important security update for Pidgin (version 2.10.10). The updates fixes a heartbleed like bug for Jabber/XMPP (CVE-2014-3698) and contains bugfixes for the validation of SSL certificates (CVE-2014-3694).
Support for Tox was added to Pidgin. Tox is a serverless, secure peer-2-peer instant messaging protocol.
Additional the add-ons for JonDoFox, TorBrowser and Icedove were updated.
