Free XeroBank for blogging / twitter / journalists

[SteveTX]

We will be offering free XeroBank accounts *very* shortly for the purpose of social communication and anti-censorship. Suggestions wanted. Tell your friends. Stay tuned.

[SafetyFirst]

Free speech for free!? :argh:

Will it be the complete multi-hop XeroBank VPN service or some limited version?

[smlj]

that's great :)

[snowdrift]

In theory, it sounds good, but as a paying customer... I fear it will further degrade my bandwidth and uptime. And, as we know, it's all about me. :P

[SteveTX]

Actually, it will increase your anonymity through larger crowding sets. As for performance, it will be high-speed of course, this isn't Tor. ;)

[snowdrift]

I appreciate crowding and multiplexing, but in the end, they're moot issues.

As a Panama-based company, XeroBank isn't beholden to any foreign governments. You've yet to "turn over" anyone because of a subpoena, so why even worry about all the other technical issues that support anonymity? Statelessness trumps all that...

[SteveTX]

Great question! Crowding and multiplexing makes a big difference:

Imagine the corporation was still in Panama, but instead we ran a network that didn't have crowding or multiplexing. That is only a jursidictional protection from external information requests. So then you ask who would still have access to your info and trace it back to you?

Domestic police and communications companies, state surveillance, private and state intelligence orgs, corporate owned internet exchanges and landing stations, telcos and more could still easily monitor and correlate the traffic back to you.

Simply putting information requests out of reach is only one level of defense against trivial adversaries, and isn't anonymity or privacy at all. If you can't forcibly exercise anonymity, regardless of information requests being successful, then you don't have anonymity. Privacy is an external org not being able to discover the content of your traffic because it is encrypted. Anonymity is a when external org can see the traffic flows (encrypted or otherwise), but cannot discover the context [still not being able to correlate the traffic back to you when using tracing techniques (thanks to crowding and multiplexing)].

Pro-tip: If you can look under the hood of a network and discover where the traffic is coming from and going to, then it isn't anonymity.

[onigen]

This sounds great! I look forward to this with great anticipation :)

[SteveTX]

As an update, there was a small delay as we were researching some different technologies for this. Because there is unlimited demand for free anonymity, and limited resources, we have to limit the amount of seats available at any one time to make sure all users get a high quality of service and responsive connection. Initially we figured we could offer a few hundred seats at a time to a few thousand live users. After careful design and testing of some new technology, we have increased the resource efficiency by 1000%. So ten times as many users as before will be able to use the service at any one time, and that is scalable. We should have a closed alpha ready within a week of design documents being completed.

[CaixFang]

No disrespect, but I hate when you do this Steve. Ive been on xB for a few months, and that's all well and grand, but when you pop up with a thread about a new release, that then isn't even released (see new deanonymiser threads for months before Aug 1 - and I still don't know that page even changed.)

To add insult to injury it seems more time is spent over here than back at xB's own forums and support queue, based on the posts I read.

One more thing that makes it worse, is I have to come here to find out the latest info about xB, because the xB site has so little and such poor documentation. Yesterday I got the popup that a new version of xB VPN was available, yet there is basically no information at xB about it, I couldn't even find the most basic info at xB, which is frustrating.

I know you guys are constantly working to make services better and be bleeding edge, but it seems like everything takes a backseat to marketing at xB. I'd personally rather have leading edge with more time dedicated to users and docs rather than bleeding edge and the hit or missness of xB docs and support.

This is not intended to be the start of a thread for those that consistently like to come and point fingers at xB, it is just this paying customers $.02 when he sees a new thread like this...

[SteveTX]

CaixFang,

Join the beta club on the forum if you want to know about new releases ahead of time. I debated posting this info on the xb forum, but for those already there, they have xb accounts and are not the same market for freebie-news accounts we are designing. The new xB VPN that was released was discussed on the forum approximately 4 days ago, 24 hours before you got your first popup, and 2 weeks prior for the rc19 core. As for support, we have live chat going up as soon as we finish the support scripts. Enjoy.

ST

[CaixFang]

-{ Quote: "CaixFang,

Join the beta club on the forum if you want to know about new releases ahead of time. I debated posting this info on the xb forum, but for those already there, they have xb accounts and are not the same market for freebie-news accounts we are designing. The new xB VPN that was released was discussed on the forum approximately 4 days ago, 24 hours before you got your first popup, and 2 weeks prior for the rc19 core. As for support, we have live chat going up as soon as we finish the support scripts. Enjoy.

ST" }-


I wasnt saying that releases wernt mentioned there, only here, I was just saying it seems like there is a lack of information overall available at xB, and generally more info is availble here. Maybe that's a traffic thing, but then again I thought based on your Aug 30th post that you had decided to stop posting so much here and redirect it to xB....

I'm not trying to come off like an ass, I like the service, or I wouldn't be paying for it, especially with as many times as I have directly questioned different aspects of xB. It just *feels* like more attention is paid to getting the word out about new stuff, and we never get fully documented stuff unless we pry, or have specific setup questions.

Again, that is just my personal view...let the thread continue on topic.

[SteveTX]

Ah, I see what you mean. The reason you'll still find some posts here, is that we are designing a new content management system for XeroBank. It is being designed to integrate the forum, blog, knowledgebase, and support documents. It's kind of a huge task, so you will see support threads popup on the forum, you will see sporadic blog posts, and more across different areas. The CMS is where wiki docs and support stuff is going to go, and users will supposedly be able to submit articles and patches and info there. Wilders is just considered one extension for media, just like some of the articles we are planning on writing for the BlackOpsSecurity forum. Most of the stuff is still on the xB forum though. Stay tuned on the blog. We've scheduled 3 months worth of weekly articles already.

[LockBox]

-{ Quote: "just like some of the articles we are planning on writing for the BlackOpsSecurity forum." }-

Hi Steve, What is the BlackOpsSecurity forum? not even a Google search helped me. Thanks!

[SteveTX]

It's a little something (http://blackopsecurity.net/forum/index.php) I found out about.

[LockBox]

-{ Quote: "It's a little something (http://blackopsecurity.net/forum/index.php) I found out about." }-

Interesting. Thanks, Steve.

[ploder]

This project sounds interesting. Keep up the good work.

[snowdrift]

-{ Quote: "It's a little something (http://blackopsecurity.net/forum/index.php) I found out about." }-

Nice one.

I esp. like the anti-Computer Forensics information.

:lurking:

[onigen]

Any update on the status of this or any other new XeroBank services?

[SteveTX]

Yes! We finished writing the proxy system and API and protocols on the server. The service and server is complete. We are now working on the client, it uses authenticated SOCKS over SSL. We expect a working beta any moment.

[ploder]

That's great news. I'm intrigued by this free system and xerobank in general. I've wanted to use Xerobank but can't really justify spending more on this service than the total cost of my internet access.

[Searching_ _ _]

-{ Quote: "It's a little something (http://blackopsecurity.net/forum/index.php) I found out about." }-

-{ Quote: "not even a Google search helped me. Thanks!" }-
Google search result (http://www.google.com/#hl=en&q=blackopsecurity+forum&aq=f&aqi=&oq=&fp=b36c7832dbb01be6)

Maybe you used too many secrets... ah, letters.
Doesn't show on first page with blackopssecurity forum.

Are there any posts earlier than Oct. 05, 2009?

I'm going to go see if I can find the Wiki!

Man you been busy. No posts in awhile says a lot.

Free speech! woohoo!

[SteveTX]

Was just in a voice conf with Kyle and Stefan. We got the client working and fetching tokens. More tests to do and a user-interface to be built for creating accounts. Those of you who are signed up onto the XeroBank beta list on the XB forum will get to try out the system first.

[SteveTX]

The browser works. :) We have Chromium tunneling to Privoxy to perform multithreaded HTTP/HTTPS, Privoxy tunnels over ProxyChains to perform SOCKS5 with Authentication, which is tunneled over Stunnel to create an SSL connection to the XeroBank server.

This has effectively accomplished multithreaded HTTP over SOCKS5 with Authentication over SSL, something that no standalone linux system has done before. Amazing, efficient, FAST! We tested out the system and got 12 Mbps download and 8 Mbps upload @110ms viewing realtime flash video.

We're now debating whether we make it "ready to go" or require the user to enter in a username / password to begin with.

[I no more]

-{ Quote: "The browser works. :) We have Chromium tunneling to Privoxy to perform multithreaded HTTP/HTTPS, Privoxy tunnels over ProxyChains to perform SOCKS5 with Authentication, which is tunneled over Stunnel to create an SSL connection to the XeroBank server.

This has effectively accomplished multithreaded HTTP over SOCKS5 with Authentication over SSL, something that no standalone linux system has done before. Amazing, efficient, FAST! We tested out the system and got 12 Mbps download and 8 Mbps upload @110ms viewing realtime flash video.

We're now debating whether we make it "ready to go" or require the user to enter in a username / password to begin with." }-

Steve, if I'm understanding correctly, you're offering free Xerobank accounts. I don't fully understand how you can offer this because, as you said, there'll be unlimited demand.

How are you going to keep the hundreds of thousands or millions of hyenas and jackals off your system? No offense to the hyenas and jackals on this forum, of course. I'm certainly interested, but I guess I don't fully understand how you can offer this.

[Pleonasm]

-{ Quote: "Steve, if I'm understanding correctly, you're offering free Xerobank accounts. I don't fully understand how you can offer this because, as you said, there'll be unlimited demand." }-
SteveTX, to expand upon this question, I wonder: since the users of XeroBank are anonymous to Xero Networks, how will the company be able to certify whether an individual is a “journalist” and therefore qualifies for the free service?

Or, will XeroBank now be free to everyone and anyone? If the latter, what's your new business model?

[I no more]

I think I understand now. ??? By limiting the access to a browser, you're theoretically eliminating the rampant file sharing that you would normally get on your system while still allowing blogging and other types of communication.

So, theoretically, anyone can use your browser and get high speed anonymous access, just without the possibility of P2P and other file sharing.

p.s. I'm still waiting for the $30 buffet you offered a while ago. I'm really hungry. :)

[SteveTX]

-{ Quote: "Steve, if I'm understanding correctly, you're offering free Xerobank accounts. I don't fully understand how you can offer this because, as you said, there'll be unlimited demand.

How are you going to keep the hundreds of thousands or millions of hyenas and jackals off your system? No offense to the hyenas and jackals on this forum, of course. I'm certainly interested, but I guess I don't fully understand how you can offer this." }-

I have been given a directive to provide free high-speed encrypted internet access to the masses for web browsing. So we designed this. As demand for service is unlimited, we have to impose resource limits somewhere. This system will use time as a limit. It has a token authentication system inside it. Each token is good for x minutes of free service. We can control the dispersal of tokens on these free accounts without taxing the system.

So the end result is you get access to heaven, but for only x minutes per day. Enough time to do your web surfing, posting, new reading, and more. The accounts are restricted in time and protocols. This lends itself to giving away for free the necessities of anonymity to everyone, without providing the luxuries of paid accounts.

[SteveTX]

-{ Quote: "If the latter, what's your new business model?" }-

Free for x time, protocols limited. Paid accounts to be inexpensive, unlimited time. Locked to web surfing only. Open to everyone. This is to be the buffet.

A beta will be available at XeroBank tonight.

[tobacco]

Steve

That's great to hear - Thanks a bunch:thumb:

Any idea what the time limit will be???

[I no more]

-{ Quote: "Free for x time, protocols limited. Paid accounts to be inexpensive, unlimited time. Locked to web surfing only. Open to everyone. This is to be the buffet.

A beta will be available at XeroBank tonight." }-

Steve, I'm glad you're releasing this, and it definitely looks interesting. But I have to take issue with you promising a product months in advance but leaving out important details. You never stated previously that the free accounts would be time limited.

But, more importantly, I don't recall you ever mentioning that the low cost accounts would be limited to web surfing. Perhaps you changed your mind later about the package. It still might be a good deal, but it's definitely not as good as I thought when you first mentioned it. Considering that you're a VPN provider, I don't think it's strange that I assumed it would be a VPN service.

Edit: Here's an exact quote from October 21, 2009


-{ Quote: "XeroBank will be introducing a VPN solution for anonymous web surfing, for only $29.95 per year, in the next two months." }-

You did in fact say it would be for anonymous web surfing but you also said "VPN", which to me implies that all traffic would be covered.

[SteveTX]

It is a VPN solution. It is the new xB Browser (Chromium edition) inside a secure linux virtual machine. The virtual machine exports the browser to your native desktop so it appears just like a normal browser window on your OS without the linux frame. The linux VM has a VPN connection (like JanusVM) back to your localhost machine via VirtualBox/VMWare/QEMU etc. The VM then creates a SSL tunnel over the VPN connection and tunnels to XeroBank. It then initiates an authenticated SOCKS5 connection inside the encrypted tunnel. This particular implementation is designed to do web surfing, but we can expand it to any programs we want inside the VM such as email, chat, skype, etc.

So not only do you get a VPN connection of all the traffic, it comes in a transparent, portable, secure, encrypted OS that is immune to spyware, malware, viruses, etc.

[I no more]

-{ Quote: "It is a VPN solution. It is the new xB Browser (Chromium edition) inside a secure linux virtual machine. The virtual machine exports the browser to your native desktop so it appears just like a normal browser window on your OS without the linux frame. The linux VM has a VPN connection (like JanusVM) back to your localhost machine via VirtualBox/VMWare/QEMU etc. The VM then creates a SSL tunnel over the VPN connection and tunnels to XeroBank. It then initiates an authenticated SOCKS5 connection inside the encrypted tunnel. This particular implementation is designed to do web surfing, but we can expand it to any programs we want inside the VM such as email, chat, skype, etc.

So not only do you get a VPN connection of all the traffic, it comes in a transparent, portable, secure, encrypted OS that is immune to spyware, malware, viruses, etc." }-


Okay, I understand. I'll have to try it out to see if it suits my needs. Is the free version the same as the paid version, the only difference being the time limits with the free version?

[SteveTX]

BETA NOW AVAILABLE FOR FREE DOWNLOAD.

Users signed up for the XeroBank beta program (https://xerobank.com/forum/index.php/topic,683.0.html) get full access.

[SteveTX]

214260

-{ Quote: "Okay, I understand. I'll have to try it out to see if it suits my needs. Is the free version the same as the paid version, the only difference being the time limits with the free version?" }-

So far, yes. It is likely that we will prevent users from reaching certain domains in the free version as well, such as high-risk/fraud areas.

I just tried is at the university and got a 28 42 Mbps speed. :)

[Webby]

Hi Steve,

Once again, is this new software/service the results of this #9 post found here:

http://www.wilderssecurity.com/showthread.php?p=1490252#post1490252

Cheers Webby

[SteveTX]

No. This service is designed for lightning-fast web surfing, and is entirely designed and run by XeroBank. The JonDos thing is on hold because of a network node issue that needs to get sorted.

[nancer99]

I'm loving the idea of xerobank, but you guys need to reply to queries. I'm signed up, would like to continue or expand services and need to talk to someone about several issues. Contact please.
nnorelli@platanalytics.com

[onigen]

Great! Can't wait to sign up for the buffet :)

[goldenone]

-{ Quote: "It is a VPN solution. It is the new xB Browser (Chromium edition) inside a secure linux virtual machine. The virtual machine exports the browser to your native desktop so it appears just like a normal browser window on your OS without the linux frame. The linux VM has a VPN connection (like JanusVM) back to your localhost machine via VirtualBox/VMWare/QEMU etc. The VM then creates a SSL tunnel over the VPN connection and tunnels to XeroBank. It then initiates an authenticated SOCKS5 connection inside the encrypted tunnel. This particular implementation is designed to do web surfing, but we can expand it to any programs we want inside the VM such as email, chat, skype, etc.

So not only do you get a VPN connection of all the traffic, it comes in a transparent, portable, secure, encrypted OS that is immune to spyware, malware, viruses, etc." }-

I thought I should jump in here and make some minor corrections and elaborate some more as I'm the developer who put this project together. Steve was pleasantly surprised when I showed him what I'm about to explain to you.

Let's start from the beginning with a basic run down.

You have a Virtual Machine, and inside this VM is CoreLinux (Ubuntu based) which is small and designed for custom solutions.

Then you have a web browser called Chromium. The web browser uses a proxy, which is connected to our servers over SSL.

I include xPDF to view PDF files. Just click on the download once it's finished.

Now this is where things start to get a bit different. Normal VM's are only accessible through the VM's window, which is usually the size of the desktop you've set IN the VM. So I thought it would be neat to "export" the browser window back to the host OS, and break out of the traditional VM window. What this does is create an appearance as though the browser is an application that's running in your host OS, when it is really running INSIDE the VM. It creates a button in your Windows systray like any application, and allows you to resize, minimize, or maximize the window.

So the whole time you feel like you're using a regular browser even though it's really running inside the VM. This is done using the X11 protocol, and requires Xming for Windows users. Mac and Linux tests have worked very well since X is the graphic manager of both Linux and Mac OS X.

Further more, the VM is packed inside an ISO file. This ISO file is used by the VM as a Bootable CD, or it can be burned to a CD-ROM and used as a bootable CD on bare metal hardware as well (just select the "Local X" boot option). The primary reason for putting the entire OS inside an ISO was to protect it from getting infected by rootkits/viruses/trojans/etc permanently. Every time you boot the Browser VM you know you are running from a known good state (unless your host OS is already infected then all bets are off). If you burn a bootable CD-ROM (and finalize the CD), you can't write data back to that CD because it's treated as READ ONLY. So any changes that are made to the Browser VM while it's running are wiped out with a reboot.

I wanted a solution I could use that would allow me to surf anywhere on the Internet and not catch a virtual STD. (Insert clever Trojan joke here...)

This has some drawbacks. That means no saving bookmarks, history, or cookies. Correction: Google now allows you to "Sync" your bookmarks with your Google account. Neato. We can save files though. The *temporary* solution to saving downloads was to create a Share on the HOST OS, and mount that Share from inside the VM using Samba. I know, this probably isn't the best way to address the issue, but every solution I've thought of has a down side of adding an extra user to the end-user's system, or requiring the user's real login and password to the Host OS, and I really don't like that idea....I'm sure you don't either. So yeah, NetBIOS and Samba for the win?....ugh. :( Suggestions welcome. Their's room for improvement, I know, but at least you can save Downloads for now.

Next problem, Printing. I get to pass the buck on this one to Chromium. Linux printing support is still being developed for Chromium, and you'll get it shortly after they implement it.

Next, not necessary a problem, but something worth noting is Audio/Video playback. This supports HTML5 Audio and Video HTML tags. The browser includes Flash. Youtube, Hulu, etc.. are watchable, just not in full screen. Full screen is very, very choppy video, so try and watch in native resolution or in HD. Facebook and Myspace are sooo over bloated with damn Flash ads, it can cause some delay's in web page renderings and video playback. I don't know exactly why this happens, Flash just sucks that way.

Note: There is a boot option to disable plugins (Flash, Audio/Video).

I'm sure more bugs will show up, but I've been using this for about 2 months and I absolutely love not having to trust the websites to not have bad things that infect my PC because my damn browser failed at security, again and again and again. When malware authors spend millions of dollars and manage to get their spyware Ads into the major media sites, you know ***** gone really bad.

FTR, this project started at
http://www.janusvm.com/chromium_vm/index.html
It has documentation, setup instructions, and is available for Download...for free. Check it out.

Originally this was called the Chromium Browser VM. The Chromium Browser VM supports normal (not anonymous) browsing, Tor, but not Xerobank. It has Transmission, a torrent client, built in to support downloading torrents. It also supports torrents over Tor. ;) Tested with TPB and a well shared movie, and it worked over Tor...very, very slow though...as expected with Tor.

Xerobank's Browser VM uses Xerobank services, obviously, and has the same guts as the Chromium Browser VM.

The different versions of the Browser VM have been referred to as:

Xerobank Browser VM (Paid Service)
vs
Xerobank Browser VM (Free Edition) -- No torrent support, transmission removed. Sorry.
vs
Chromium Browser VM -- Supports Torrents, supports Tor, but not Xerobank.

The major differences being, one uses the paid for services, and one uses the free services. Pricing and usage policies of paid for or free services is not my responsibility.

One last thing. The performance benchmarks on this kick FF and IE in the face. Chromium in a VM is almost as fast as Chrome in the Host OS, both of which run three to six times faster than FF and IE. Sorry Mozilla, but your browser just got smoked on performance. Why people still use IE, I'll never understand.

Third-party browser plugins are dangerous to the browser as they expose more attack-surface-area for hackers to exploit, and Adobe alone is reason enough to be scared of that fact. Virtualizing specific applications for specific needs is going to be the future of securing your PC from malicious code on the internet.

I surf safer on the Internet now. You should too, whether it's normal browsing, anonymous browsing, paid for or free. I'm sorry if this doesn't fit your every anonymity/privacy/security need, but it's free software with a specific purpose in mind. Updates will be pushed out regularly once the automated build systems are in place.

If you like this project then please consider Xerobank services. We're working hard to keep you safe on the Internet.


Happy Holidays and safe surfing,

Kyle
------------------------------------
Screenshots.

Chromium Browser VM boot screen.
214287

Xerobank Browser VM boot screen.
214288

Example of what it looks like in Microsoft Windows.
214291

[Webby]

Thanks Steve & Kyle

Looking forward to Beta testing if possible.

Cheers Webby

[I no more]

Kyle, you're a talented guy. Xerobank is lucky to have you.

So, I gather the paid version is going to allow torrenting. That's definitely a big plus. I thought it was going to be limited to browsing to save bandwidth. But it looks like you're using this implementation for security reasons and not to limit bandwidth.

If that's the case, I was wondering if it would be possible for a user to add applications that you may not have previously considered adding. The thing for me is that I have a set of applications that I like to use, and I'd like to be able to add those myself. ???

Is it possible?

[SteveTX]

This particular service was designed to address the requests of users who want an anonymous web browser only, and do not need the additional services offerings a VPN provide (thus exceptionally lower cost), but want the connection-integrity a VPN provides.

The reason that such a service is possible is because our ultra-high crowding technique is designed specifically to handle web browsing traffic characteristics. If you introduce atypical characteristics, it lowers the crowding set, and thus lowers the anonymity protection of other users. If users also consume atypical resources outside of web-browsing, it will also raise costs because we will have to allot more resources, and that will cause the price to go up for all users, because we cannot allow the quality of service to be degraded. One way we've addressed this is by making it possible to run torrents inside the VM, but having the traffic pass out either directly, or through the Tor network which is already saturated with torrent traffic.

TINSTAAFL: If you want to do torrents, that is what the VPN is for. This is not a replacement for the VPN service. The new VM is capable of connecting to the Xerobank VPN service, and our high-speed anonymous browsing service. The larger VM we are going to release has a full compliment of web browser, email app, instant messaging, office tools, encryption engines, and more, and it will be able to use the VPN service as well. I've been using it since November, without issue, and it is pretty awesome.

[Triple Helix]

-{ Quote: "BETA NOW AVAILABLE FOR FREE DOWNLOAD.

Users signed up for the XeroBank beta program (https://xerobank.com/forum/index.php/topic,683.0.html) get full access." }-

Got it working well in VMware just had to adjust my firewall to make it work!

Thanks Steve,

TH

[ploder]

Where is the dl link after we have signed up to be beta testers? Is it emailed to us or on the site somewhere?

[Triple Helix]

-{ Quote: "Where is the dl link after we have signed up to be beta testers? Is it emailed to us or on the site somewhere?" }-

It's on the site after you have been accepted to be a Beta tester you will see the Beta section!

TH