Actions

Freenet

From Whonix

Freenet Icon

Introduction[edit]

Info Freenet is recommended for advanced users.

Overview[edit]

The Freenet 'About' page provides a simple overview of the protocol: [1]

Freenet is free software which lets you anonymously share files, browse and publish "freesites" (web sites accessible only through Freenet) and chat on forums, without fear of censorship. Freenet is decentralised to make it less vulnerable to attack, and if used in "darknet" mode, where users only connect to their friends, is very difficult to detect.

Communications by Freenet nodes are encrypted and are routed through other nodes to make it extremely difficult to determine who is requesting the information and what its content is.

Users contribute to the network by giving bandwidth and a portion of their hard drive (called the "data store") for storing files. Files are automatically kept or deleted depending on how popular they are, with the least popular being discarded to make way for newer or more popular content. Files are encrypted, so generally the user cannot easily discover what is in his datastore, and hopefully can't be held accountable for it. Chat forums, websites, and search functionality, are all built on top of this distributed data store.

In simple terms, Freenet [2] [3] is a peer-based, encrypted datastore with version control that aims to give anonymity to both publishers and readers. Launched in 1999, it is the oldest of the 'big four' anonymity networks [4] alongside Tor, I2P and GNUnet (GNUnet is based on similar concepts). Its robustness has brought it into the cross-hairs of advanced adversaries. [5] [6] Though it has less users compared to Tor and I2P, it is still the largest network of its kind.

Technical Properties[edit]

This section provides a brief introduction to Freenet's technical properties. For more in-depth reading on this subject, refer to the official documentation [archive].

Freenet's design is very different from other anonymity networks. Instead of obfuscating traffic streams between endpoints, the data itself is sliced up into encrypted blocks and distributed across other peers' datastores -- hard drive space contributed by Freenet nodes to store encrypted pieces of files -- for redundancy and plausible deniability. [7] Users have virtually no control over what ends up in the datastore, since the popularity of files dictates if they are kept or deleted. This also increases resistance to censorship. [8]

After uploading, the publisher obtains a key which acts as the content's Uniform Resource Identifier (URI) [archive] [9] that can be optionally shared to allow others access. These are known as Freesites and host only static content on the Freenet network; active content like databases or server-side scripts are not possible. [10] The data remains available even after the uploader goes offline, meaning it is asynchrounous. Freenet is a self-contained network with no access to the wider web.

Reader requests are routed through multiple hops. Each hop acts as a caching proxy for some of the requested data blocks, propagating the material and providing scalability and availability when demand grows. Understand that Freenet's data storage is not permanent and cannot be, otherwise an attacker could flood it with garbage data and render it useless for users. Unpopular content that is rarely accessed tends to be 'forgotten' and lost over time. Censors cannot rely on Denial-of-service (DoS) attacks [archive] to block content because it actually spreads the information further. You can think of it as a digital embodiment of the Streisand Effect [archive]. [11]

Freenet's FProxy is the component that allows browsers to interact and view pages in the datastore (to access a particular piece of data). [12] Many precautions are taken to protect users from malicious pages, including:

  • JavaScript is completely unavailable on Freenet;
  • only a safe subset of HTML standard is whitelisted; and
  • users are prompted before downloading files or when being redirected to a clearnet site.

Freenet does not utilize telescopic tunnels like Tor, but instead bundles requests together for cover traffic and routes them through a varying number of hops to confuse adversaries as to who is forwarding versus requesting the data. Freenet can also operate in several modes: a 'Darknet' mode that turns it into a private friend-only network; 'Opennet' mode which connects to a public network; and a hybrid mode that includes both.

Freenet's properties make it an excellent and safer choice for disseminating data because it tackles "The Hosting Problem", while providing strong cryptography to guarantee the integrity of files fetched. In short, centralized hosting remains an Achilles Heel for onionspace [13] because traditional anonymous publishing mechanisms like onion services or eepsites require a user resource commitment (an always online server), which places them out of reach for most people. Securing a server is no easy task, particularly in the hostile environment of the dark web. Extensive hardening, auditing and system administrator skills are necessary, but this is no guarantee against a certain class of adversaries; see footnote. [14]

Liability[edit]

According to a Freenet developer in Germany, EU users have strong liability protections when caching content as a side-effect of participating in a network; see footnote. [15]

How-to: Use Freenet in Whonix[edit]

There are three methods of using Freenet in Whonix ™:

  1. Freenet inside Whonix-Workstation (recommended); or
  2. Inproxies inside Whonix-Workstation; or
  3. Freenet SSH Workaround

Freenet inside Whonix-Workstation[edit]

The preferred configuration is to connect to Tor, then a VPN before Freenet inside Whonix-Workstation ™: userTorVPNFreenetDestination [16]

Configure Connection Workaround[edit]

In the "classical sense" a direct connection only over Tor is impossible because Freenet is a UDP-only network. [17] As a workaround it is possible to Tunnel UDP over Tor. Probably the easiest solution is to utilize a VPN, see: Connecting to Tor before a VPN (User → Tor → VPN → Internet)

Freenet Installation[edit]

Unfortunately Freenet is unlikely to be available from Debian repositories in the foreseeable future. The fast development cycle is incompatible with Debian stable's policies. [18] This means it must be manually installed instead.

1. Download the Freenet signing key.

scurl-download https://freenetproject.org/assets/keyring.gpg

2. Check fingerprints/owners without importing anything.

gpg --keyid-format long --with-fingerprint keyring.gpg

Before adding the keyring [19], verify the fingerprints. Always check the fingerprint for yourself. The output at the moment is:

pub   rsa4096/FF24CA421946AA94 2013-09-24 [SC] [expired: 2018-09-23]
      Key fingerprint = B76D 4AA7 96D8 403E ED78  C9F9 FF24 CA42 1946 AA94
uid                           Matthew Toseland (2013-2018 key, higher key length) <matthew@toselandcs.co.uk>
uid                           Matthew Toseland (2013-2018 key, higher key length) <toad@amphibian.dyndns.org>
sub   rsa4096/F877E62895C42009 2013-09-24 [E] [expired: 2018-09-23]
pub   rsa4096/B67C19E817A8D846 2016-01-02 [C] [expired: 2018-01-03]
      Key fingerprint = 5D77 D9A4 2E28 0F5A FF8F  2EBF B67C 19E8 17A8 D846
uid                           Stephen Oliver <steve@infincia.com>
sub   rsa4096/9BCDD1614041F59E 2016-01-02 [S] [expired: 2018-01-03]
sub   rsa4096/1652EBA5AC1BB386 2016-01-02 [E] [expired: 2018-01-03]
sub   rsa4096/38A62E479684F2F2 2016-01-02 [A] [expired: 2018-01-03]
pub   rsa2048/EAC5EBF07AA9C2A3 2013-04-29 [SC]
      Key fingerprint = DBB7 7338 3BC3 49C9 5203  ED91 EAC5 EBF0 7AA9 C2A3
uid                           Florent Daigniere <florent.daigniere@trustmatta.com>
uid                           Florent Daigniere (NextGen$) <nextgens+gpg@freenetproject.org>
uid                           Florent Daigniere (Personal address) <florent-gpg@daigniere.com>
sub   rsa2048/65B7118375AB23F2 2013-04-29 [E]
sub   rsa2048/D21621FD7FA16469 2013-04-29 [A]
pub   rsa4096/B41A6047FD6C57F9 2017-02-23 [SCEA]
      Key fingerprint = B30C 3D91 069F 81EC FEFE  D0B1 B41A 6047 FD6C 57F9
uid                           Arne Babenhauserheide (ArneBab) <arne_bab@web.de>
uid                           Arne Babenhauserheide (freenet releases) <arne_bab@web.de>
pub   rsa4096/00100D897EDBA5E0 2013-09-21 [SC] [expired: 2016-09-08]
      Key fingerprint = 0046 195B 2DCA B176 D394  09CD 0010 0D89 7EDB A5E0
uid                           Steve Dougherty (operhiem1 Release Signing Key) <steve@asksteved.com>
sub   rsa4096/7BF0F7B36AC8B380 2013-09-21 [E] [expired: 2016-09-15]

3. If the output looks sensible, import it with GPG.

gpg --import keyring.gpg

4. Install dependencies.

sudo apt-get update
sudo apt-get install openjdk-11-jre-headless

5. Create an installation directory.

mkdir Freenet
cd Freenet

6. Download the offline installer and signature.

wget 'https://github.com/freenet/fred/releases/download/build01484/new_installer_offline_1484.jar' -O new_installer_offline.jar

wget 'https://github.com/freenet/fred/releases/download/build01484/new_installer_offline_1484.jar.sig' -O new_installer_offline.jar.sig

7. Verify the installer.

gpg --verify new_installer_offline.jar.sig

Check the following message appears before installing anything:

Good signature from "Florent Daigniere <florent.daigniere@trustmatta.com>"

8. Follow the prompts and install it in the current folder.

java -jar new_installer_offline.jar -console

Note that Freenet includes its own secure internal updater that downloads new versions from inside the network. It is unnecessary to repeat these steps after the initial installation.

Tor Browser Configuration Changes[edit]

Note: The following steps will no longer be required once Whonix releases a custom Tor Browser for connecting to alternative networks. [20]

Configure Tor Browser to connect to localhost.

Ambox warning pn.svg.png Warning:

  • This step changes the web fingerprint of Tor Browser!
  • Leave all other settings as is!

In Tor Browser:

  1. Type about:config into the URL bar.
  2. Press Enter
  3. Search for network.proxy.no_proxies_on
  4. Set to 0
  5. Search for network.proxy.allow_hijacking_localhost
  6. Set to false

Usage[edit]

To access Freenet, open http://127.0.0.1:8888 [archive] in Tor Browser to utilize the user interface. The UI is also used for plugin installation or any further setting changes.

To start Freenet manually after reboot:

cd Freenet

./run.sh start

Plugins[edit]

Plugins provide much of the rich functionality of the Freenet experience. They act as an abstraction layer that present text in different layouts for different use cases including forums, wikis, search engines, mail, blogs, code repositories, social networking, IRC and more [archive]. The Freenet Social Networking Guide [archive] explains how to set up plugins. [21] Other relevant guides are also available; see footnote. [22]

Tips[edit]

The following tips will provide a smoother user experience when accessing Freenet in Whonix ™:

  • Torbirdy must be disabled for Thunderbird to connect locally to Freemail's SMTP server. [23] As a side-effect HTML emails are rendered by Thunderbird. To disable, go to: OptionsViewMessage Body AsPlain Text. Freemail takes care of privacy concerns by scrubbing mail headers. [24]
  • Freemail encrypts metadata and subject lines by default. However, for extra assurance and to future-proof your mail against quantum computers you can layer end-to-end encryption on top of Freemail with Codecrypt. [25]
  • Technically each plugin's generated data is self-contained under its own folder under the Freenet directory. For example, to archive your mail spool, copy /freenet/freemail-wot to your backups.
  • The menu layout in Freenet has changed slightly since the Freenet Social Networking Guide [archive] was written. For WoT identities backup the 'Insert URI' to a safe place. This is your identity's private key and should never be shared. This information is found under Edit of an existing identity. To restore it on a new node paste it in: Create an identityUse an existing SSK URI key pair for the identity

Inproxies inside Whonix-Workstation[edit]

In late-2019, a functional Freenet gateway [archive] is available and can be accessed with Tor Browser. However, this is a restricted inproxy which only allows access to a small selection of whitelisted Freesites. At present, this is the only inproxy which is known to be active.

Freenet SSH Workaround[edit]

A final possible workaround for Freenet connections is to buy, administrate and connect a SSH server anonymously though Whonix-Workstation ™. In this configuration, you must install Freenet on the remote location and connect from your Whonix-Workstation ™ (SSL or SSH tunnel). Refer to the SSH wiki entry for further information.

Footnotes[edit]

  1. https://freenetproject.org/pages/about.html [archive]
  2. https://freenetproject.org/ [archive]
  3. https://en.wikipedia.org/wiki/Freenet [archive]
  4. https://www.planetpeer.de/wiki/index.php/Main_Page [archive]
  5. https://daserste.ndr.de/panorama/aktuell/nsa230_page-4.html [archive]
  6. https://search.edwardsnowden.com/docs/TorOverviewofExistingTechniques2014-12-28nsadocs [archive]
  7. Encrypted blocks are stored in both the datastore directory and Freenet installation directory.
  8. https://freenetproject.org/pages/documentation.html#understand [archive]
  9. In simple terms, this is a character string that definitively identifies a specific resource.
  10. https://en.wikipedia.org/wiki/Freenet#Freesite [archive]
  11. The Streisand effect is a phenomenon whereby an attempt to hide, remove, or censor a piece of information has the unintended consequence of publicizing the information more widely, usually facilitated by the Internet.

  12. The key or link to the data has the following form: http://localhost:8888/ [archive][Freenet Key]
  13. https://mascherari.press/onionscan-report-june-2016/ [archive]
  14. A server is a sitting duck for attackers to probe and test their weapons against. It is also a single point of failure that can be DoS'd offline. Once rooted, the server can be used to mount watering hole attacks [archive] on site visitors whereby the site is infected with malware to target users.
  15. Ademan's Whitepaper on how to improve OpenBazaar by adding anonymity using Freenet [archive]:

    Note that you’re not actively storing: The storage is just a byproduct of transmission in the network. As an example for a similar assessment, the European Court of Justice ruled in 2014 that third parties who reproduce a work in an “integral and essential part of a technological process and carried out for the sole purpose of enabling either efficient transmission in a network between third parties by an intermediary” are exempt from copyright concerns (only the uploader is liable). See http://curia.europa.eu/juris/document/document_print.jsf?doclang=EN&text=&pageIndex=0&part=1&mode=DOC&docid=153302&occ=first&dir=&cid=93105 [archive]

  16. Only Freenet content is available; normal Internet websites cannot be accessed.
  17. This has been tested. Freenet installs normally, but even with lowest security settings a connection is never established. The problem is that Tor does not support UDP. (There has been a discussion [archive] about this topic. Although it is from 2008, it does not appear the situation has changed.)
  18. https://www.mail-archive.com/devl@freenetproject.org/msg26975.html [archive]
  19. https://freenetproject.org/download.html#keyring [archive]
  20. Except in the case of YaCy, which needs internet access.
  21. This resource is also available on GitHub, see: here [archive].
  22. The Unofficial Guide to FMS [archive]
  23. This may no longer apply now that TorBirdy is incompatible with Thunderbird v68.
  24. https://github.com/freenet/plugin-Freemail/blob/master/src/org/freenetproject/freemail/MailHeaderFilter.java [archive]
  25. This is a GnuPG-like Unix program for encryption and signing that only uses quantum-resistant algorithms.


Follow: Twitter.png Facebook.png 1280px-Gab text logo.svg.png Rss.png Matrix logo.svg.png 1024px-Telegram 2019 Logo.svg.png Discourse logo.svg

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate whonix.png

Share: Twitter | Facebook

https link onion link

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation.

Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].

Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint.