The XeroBank Development Blog

noreply@blogger.com (Steve Topletz) — Tue, 15 Sep 2009 02:57:00 +0000

test from pocketwit

noreply@blogger.com (Steve Topletz) — Tue, 15 Sep 2009 02:47:00 +0000

test message 2

New ultra-fast anonymous connections released for all XeroBank clients

noreply@blogger.com (Steve Topletz) — Fri, 05 Jun 2009 14:00:00 +0000

We are releasing 14 new routes for all new and existing users. All the machines are exceptionally fast, with users reporting as much as 35,000 Kbps of anonymous high-speed transfer. These new routes are for Canada, Netherlands, the United States, and are multiplexed routes for superior anonymity. Users can select their own entry and exit nodes, and can pick if they want them to be randomized. So a user in the USA could pick a route that has the USA as an entry node because it is close to him, and Random as the exit node, which would select from Canada or Netherlands.

The new addition of Turbo Privacy route is a single-hop that crowds onto a cryptographic terminator with other anonymous multi-hop users. This allows Turbo Privacy users to get less than half the latency and nearly quadruple the bandwidth of other connections, while getting stronger anonymity than any single-hop network. We will shortly also be introducing France into the mix for even more route selections.

Visit the XeroBank forum to download the configuration files. Add them to your current configurations. If you don't have XeroBank, you can try it out for a full month for only $1.

New Login System To Be Developed

noreply@blogger.com (Steve Topletz) — Thu, 28 May 2009 16:39:00 +0000

We pride ourselves on have not only exceptional security, but ease of use. Our team thinks we can do better. Ricardo and I have designed a new login that should make things simpler for most users with a login style they are used to, while allowing advanced users to maintain the high anonymity of their account information.

What we've designed is being codenamed Unilogon. All users will be migrated to it. It will work like this:

Username: ___________ @ xerobank.net
Password:

So the users will login with their xerobank email address. If they are an advanced user their login will be similar to what we have now. They can require their Access Account and Deposit Account credentials, and both will be password encoded. We know many users like long complex passwords and accounts, so we're going to preserve them.

The end result is those who just want strong privacy will have it, and those who want to delve deeper and get strong anonymity, even in the ownership of their account, will be supporteed as well.

New Internet Privacy with Unlimited Bandwidth

noreply@blogger.com (Steve Topletz) — Fri, 22 May 2009 00:47:00 +0000

All XeroBank users will get a new unlimited throughput connection which will not deduct from their premium bandwidth. No more worries about running out of traffic if you are a fan of downloading torrents.

These new unlimited connections are run on Xero Networks cryptographic terminators as a single hop. That means not only will your connection be blazing fast up to 8 Mbps, but still with higher anonymity than any other single-hop provider since traffic will mix with multi-hop users as well!

Enjoy.

XeroBank to Decentralize Trust

noreply@blogger.com (Steve Topletz) — Sat, 16 May 2009 16:50:00 +0000

There is news on high that we are working on a new distributed and decentralized trust system. What that means is that similar to the Tor and Jondonym network, 3rd parties can relay encrypted traffic to us. That means that users will get additional protection because we are no longer able to discover who originated the traffic, only that it was authorized. Unlike the Tor and Jondonym network, we are immune to exit node injection, are broad-band speed, have no untrusted peers, and are not using peers that are in the same or weak legal jurisdictions. More information to be announced including a press release.

XeroBank Unlimited Anonymous High-Speed Traffic Nodes

noreply@blogger.com (Steve Topletz) — Tue, 24 Feb 2009 16:23:00 +0000

XeroBank has all kinds of customers, some just do the most minor of anonymous browsing and encrypted email checking. Others are heavy downloaders of video streams and torrents. XeroBank provides high-quality cascaded/multiplexed anonymous traffic to their users, typically in blocks of 75GB per month. While this meets the needs of 95% of the people, who are the former, what about the last 5%? What happens to them?

I'll tell you. They consume their data volume for the month, and then they are unprotected because they can't connect. I asked Kristin about this, since she recently ran out of volume on one of our overhead accounts. While it was trivial to refill her data allowance, she stated that for that time, she felt unprotected, like she was surfing naked. I wondered if others felt that way, because I certainly knew it was they case that they were unprotected from hacking/surveillance/snooping. Turns out, they do, and it turns them off that it seems XB doesn't fit them. Well now it will.

After bringing this issue to management, they seemed to think we could find a solution so we weren't turning people away. In a month or so XeroBank will release a new unlimited 100Mbps node. The node will not be part of our multiplexed cascade, but will still offer encryption and IP obfuscation. That means that instead of you getting blocked from accessing if you run out of data allowance, you'll still be able to connect as long as you have an account in good standing. That way normal users can get the premium bandwidth they want, and we don't have to turn heavy users away either. Also, if you haven't run out of bandwidth, and still just want to use the Unlimited node so you aren't depleting your premium bandwidth, you should be able to.

VPN DNS Spill Prevention

noreply@blogger.com (Steve Topletz) — Sat, 24 Jan 2009 23:18:00 +0000

We've got some new updates coming for users that should provide added security against DNS leaks in OpenVPN due to Windows networking settings. The updates will be automatic, so enjoy!

UPDATE: We've implemented many new server-side changes that should prevent DNS leaks. We will next be looking at some client-side items.

XeroBank Releases USA Exit Nodes

noreply@blogger.com (Steve Topletz) — Fri, 23 Jan 2009 01:58:00 +0000

All XeroBank accounts now have access to the USA exit nodes. You can use the keyfile downloader to add them to your configuration directory, OR, you can just run the XeroBank Installer and it will get them as well. Enjoy!

New USA Exit Node

noreply@blogger.com (Steve Topletz) — Wed, 21 Jan 2009 20:44:00 +0000

New USA exit node released for XeroBank customers with xB VPN. Check out the forum for the download instructions!

New developments and ShadowVPN

noreply@blogger.com (Steve Topletz) — Thu, 08 Jan 2009 14:07:00 +0000

Greetings everyone. It has been a while since we posted an update here. Xero Network's ShadowVPN discount brand has officially launched, I've been working on some of our software and design, and Kyle has new projects underway.

First things first. ShadowVPN is a new $10/month VPN-only service from Xero. Many folks have asked me how this compares to XeroBank. First off, ShadowVPN has no encrypted email or other features that come with it. It is pure vpn for those who just need to do a little web surfing. How little? 10GB/month, whereas Xero give 75GB/month. How does ShadowVPN compare to the XeroBank network? Shadow is a 1-hop network in the Netherlands, XeroBank is a multi-hop international network with many cascade anonymity techniques. Shadow allows only 1 connection, XeroBank allows unlimited concurrent connections so you can sure all your computers at one time.

That begs the question, why ShadowVPN? Many people want the promise of secrecy that Xero brings, but can't afford XeroBank's luxuries. We encounter folks from all walks of life that really believe in XeroBank and want to support it, so they buy a ShadowVPN account. At the end of the day you have lots of VPN services you can choose from. Almost none of them cost as little as $10/month that provide true OpenVPN. The others provide terrible PPTP or L2TP. So this is a great value, especially if you just want a taste of privacy. Not to mention, the privacy provided by ShadowVPN is high than others, why? Because ShadowVPN user traffic mixes with XeroBank client traffic, so there is even higher crowding and anonymity. Anyone spying on our network can't tell if you came from the 1-hop network, or if you came from XeroBank!

My projects have been something different as of late. We recently added MD5-RSA checking against weak SSL certificates into xB Browser. This was exactly what was needed due to the recent threat that was demonstrated at 25C3 recently. I am proud to say XeroBank got there first, and is the only browser with this protection. I am also working on a new auto-updater that works outside the browser, that stays as a live service quietly updating your components in the background. As many of you can tell, we have restructured the site and have brought back the forum and blog and will be opening up two or three new areas on the site for community interaction. You said you wanted it, so we're doing it for you.

Kyle's new projects include the DeAnonymizer that will check for anonymity leaks via a website. This will be a free new service so those of you without VPN anonymity can see what everyone else can see about you. The issue is companies like who provide pseudo-anonymity and little to no privacy for their users. These users get a false sense of security, and we will show them why. This deanonymizer tools will bypass those "anonymity" company's products and reveal the true IP of a visitor. Kind of cool. Kyle has also been working on our junior CryptoRouter, codenamed the JanusPA. It is a consumer-level product that locks down your internet connection to an anonymity service without the use of any software. It is all plug and play hardware. Kyle thought it would be nice to give away the design to the Tor community, and I agree. Their reception of it has been positive thus far, with much clamoring for purchases. We'll see what we can do for them, and for our users. Surprisingly, you know what the biggest hurdle here is? Enclosure fabrication. Who knew? Kyle is going to be showing more projects at XeroBank shortly, so get ready users and competitors to have your minds blow.

2009 is going to be a great year!

XeroBank Activator

noreply@blogger.com (Steve Topletz) — Sun, 21 Sep 2008 16:16:00 +0000

On the beta mailing list we just released a demo of the beta activator. This is essentially a link in the start menu that you use if you are a free xB Browser user who is upgrading to XeroBank network. The idea is to make it easier for those who were just using xB Browser and want to taste the speed.

CryptoRouters Now Available

noreply@blogger.com (Steve Topletz) — Wed, 03 Sep 2008 02:13:00 +0000

Full details here: http://xerobank.com/cryptorouter.php

DefCon 16 Redux

noreply@blogger.com (Steve Topletz) — Sun, 31 Aug 2008 15:12:00 +0000

Below are pictures from DefCon, the 16th annual security convention held in Las Vegas. Kristin Aubel, and Kyle Williams attended so we can keep up with industry developments. While there, Kyle held a party at his suite, inviting DefCon speakers and special guests.

Magnus sent me his pictures from DefCon. One of them stuck out for some reason. I thought I would include it here. Above is Roger Dingledine and his wife Rachel (Tor Project), Kyle Williams (JanusVM & XeroBank), Mike Perry (TorButton), and Magnus Bråding (Phantom Anonymity Protocol). It was a pleasure to speak with them again this year. I think there is a lot of potential when these heads get together in the same room, and I wish it could happen more often.

Below are images of Magnus consulting whom he assured me were his tax accountants, network engineer, and legal advisor. Further below is a picture of Dan Kaminsky expressing his delight at having met Magnus's staff. All in all it was excellent fun, and we got to meet a lot of interesting people working on amazing projects. We look forward to DefCon 17 next year.

xB Mail is here

noreply@blogger.com (Steve Topletz) — Tue, 26 Aug 2008 17:42:00 +0000

XeroBank Installer 2.8.8.26 includes the first xB Mail beta for public release. Inside the installer we put in all the needed Encrypted eMail settings. We also added an encryption module for automatically protecting your login/password with user PIN codes as the Master Password (PKCS11 Module).

All of xB Mail is experimental currently, but seems to work well.

Recently there was a snafu for Vista users, where the VPN connector stopped working due to a Vista UAC conflict. This regression bug was fixed in xB VPN 2.1.0.9b, which is also included in the package.

xB Browser 2.0.0.16b has had an upgrade so that the splash knows *exactly* when the browser opens, so for Tor users, they don't have to wait and wonder while the browser is loading. Another bug fixed was an INI bug where it would be written to the root folder of the drive, instead of the relative folder. Another issue solved was a popup flaw, so we removed the popup until the DLL can be sorted, so all flash content is removed out of storage again.

The update doesn't appear to be live at the site yet, but it is available here for download right now.

CryptoRouters have arrived!

noreply@blogger.com (Steve Topletz) — Fri, 22 Aug 2008 20:46:00 +0000

The first batch of CryptoRouters have come off the line!

These will be available shortly.

sneak preview:

And now for some hardware specifications:
Via C7-M w/ on-chip Padlock Crypto Engine
12 VDC Input, 0 ~ 50'C Operating Temperature

Free XeroBank for Olympic Journalists

noreply@blogger.com (Steve Topletz) — Tue, 05 Aug 2008 13:37:00 +0000

XeroBank is now offering free accounts to all journalists visiting China, for the duration of their stay.

Terms of the offer are here:

Journalist Security Sponsorship

XeroMail Server Relocation

noreply@blogger.com (Steve Topletz) — Fri, 25 Jul 2008 04:31:00 +0000

For the last couple of weeks we've been moving servers around. This gets planned, and then executed within a fews hours to minimize disturbances. We've so far moved our legacy VPN servers. We are now relocating our legacy Mail servers and legacy SSH. XeroMail is moved, and now available. If you find that you are missing any folder, right click and go to "Subscribe" in thunderbird and check off the boxes again. There will be a SSL certificate conflict that will be moved as well, and should be resolved in the next 24 hours.

XeroBank Blacknet & CryptoRouters

noreply@blogger.com (Steve Topletz) — Thu, 17 Jul 2008 14:37:00 +0000

The skunk works team has finished developing the commercial blacknet, a rather legendary network type beyond the scope of darknets. It is a commercial and government-level IPSec / IPIP / GRE anonymity network. Judging by the design documents, it is a sophisticated 3+ hop system using cryptographic terminators and recrypting to prevent watermarking and fingerprinting attacks, in addition to traffic padding, mixing, and crowding. It is also capable of something called closed-group routing. That essentially means you could have a heavily protected zero-trust anonymous VPN between that peers between you and your allies, that is impervious to penetration even by the service provider itself. There is absolutely nothing like this available anywhere else.

What does this mean for personal users? This network is entirely separate from the XeroBank network, so there won't be any traffic mixing between these networks without a gateway.

So what does this mean for corporations? Your office can now have deployable and seamless anonymous internet access through a hardware device, and it can also communicate with satellite offices in an encrypted, anonymous, high-confidence network. Just plug in a cryptorouter into your network and everyone behind it is protected.

And what does that mean for governments? Your offices and agencies can communicate securely, anonymously, without having to trust any party in the anonymity network because it is end-to-end encrypted, with extremely low political risk. Not to mention, for government contracts, the network offers stateless anonymity, meaning that if you're transmitting classified information and your comsat falls from the sky, or your fiber-optic link is cut, your transmission isn't going to be interrupted.

You can expect more information to be coming soon.

Introducing TAP Manager

noreply@blogger.com (Steve Topletz) — Sun, 29 Jun 2008 07:32:00 +0000

In our development of x64, we've learned some things about the way Vista works. We've come out with a new version of our software, XeroBank Setup, which is now versioned by production date, 2.8.6.28. This now includes key software information, such as versioning, right in the description. What does that mean? You can now see which component versions of xB Browser or xB VPN are in the installer.

But that's nothing. With Vista, we managed to fix the startup/shutdown problem, and also accomplished a way to may OpenVPN portable for x64, and capable of installing kernel level drivers without being run in administrative mode, which is quite an interesting feat. What does this mean? We now have x64 installations that run as smooth as silk, while making x86 installations very robust. I think more x86 driver testing is needed, as are code signatures for the installations.

Kyle is solving some interesting challenges in the xB Machine build environment, but these things always require more testing. We hope to see xB Machine for the XB2 network any moment.

XeroBank Wallpaper Contest

noreply@blogger.com (Steve Topletz) — Thu, 26 Jun 2008 04:34:00 +0000

The wallpaper contest winner has been selected! Congratulations to Matthew Dozier, who earned himself two years of XeroBank service and will have his wallpaper inserted as the default background for xB Machine. Thanks to everyone else who submitted their works, they may also be included in the official distribution.

His two submissions are viewable below.

xB Browser 2.0.0.15a

noreply@blogger.com (Steve Topletz) — Mon, 23 Jun 2008 00:44:00 +0000

It's uploaded and should be cycled into the website tomorrow. What's new? Some enhanced UAC support for VPN users, especially those with trouble installing the TAP drivers. How about new updates of all the plugins, and a new live bookmarks bar with xerobank links in it. We also managed to fix the xB VPN code updates.

So if you have xB VPN or are a VPN user, please uninstall first and reinstall. Next we'll be making xB VPN also auto-update.

TAP dancing with x64

noreply@blogger.com (Steve Topletz) — Sun, 22 Jun 2008 14:48:00 +0000

It appears that some installations of vista act inconsistently in their kernel-level driver installation behaviors. Is it the user who has an IDS system that silently blocks the installation of low level drivers? Could it be an anti-rootkit software that sees and censors TAP drivers? Whatever the case, it appears that the user having UAC disabled, or being the administrator himself, is unable to thoroughly convince x64 that things are running appropriately.

The question is 'how to we fix that?'... first we must figure out what is causing it to behave inconsistently. It is either the user, legitimate programs, illegitimate programs, or the operating system itself. Because it works for some users and not others we are inclined to think it is not the operating system itself.

We're going to investigate what is going on with OpenVPN and x64, and other conflicting softwares. Particularly VMWare and other virtualized TAP/TUN drivers. Over the next couple months, we will be focusing on the problems in OpenVPN GUI/driver implementations, particularly in windows, and see if we can design a cross-compatible software to avoid the hassle of OpenVPN GUI and Tunnelblick. We will also be patching a security hole we found in OpenVPN GUI, while we are under the hood.

Wish us luck!

Update: x64 drivers appear to be solved!

Deep magic

noreply@blogger.com (Steve Topletz) — Fri, 20 Jun 2008 21:29:00 +0000

Integrating the XeroBank installer is an interesting task. Some users need different help than others, so we've got some changes to work out. The first is that xB VPN is having some interaction trouble with x64 in the TAP drivers for one user. Another issue we've seen is that if xB VPN starts too early in the operating system, it throws a GUI error about logs files. For some the xB Mail installer somehow gets triggered, which is slightly interesting. We have yet to replicate that issue. Another interesting issue that caused a reversion error was some symlinks in the SVN environment. That meant that if there weren't full uploads then downloads, you wouldn't see the changes affected.

For xB Browser, for users running XeroBank, we've removed noscript and replaces it with SSP. That allows users to protect against cross-site scripting, and false certificates, without dealing with NoScript issues.

Update: My mistake in reading the minutes, we aren't removing NoScript, we're disabling NoScript script/plugin blocking for VPN users, in addition to playing with adding SSP.

xB Browser of 2008

noreply@blogger.com (Steve Topletz) — Tue, 17 Jun 2008 15:02:00 +0000

Yesterday we got another writeup in the blogsite Lifehacker. I think if they knew what we had accomplished and what was in the pipeline, they would explode with jubilation. I notice there are still some people that think Torpark was abandoned. It is abandoned as much as Gaim was abandoned for Pidgin: It was just renamed. Yet still people hunger for it. Perhaps there needs to be more hoopla about that, who knows. However, the article covered that xB Browser will be available in 2008 for Mac and Linux as well. And they are right, there is a big big future for it, and we've got it imagined out.

There is a vision of a browser. It is cross-platform compatible. It runs on Windows, Mac, and Linux in a breeze. It does all the things that xB Browser today does, and more. What more? How about it being protected at the network level. It is incapable of leaking. It can view full flash and java and javascript without worrying about man-in-the-browser attacks, hijacks, or exploits. It stores no files on the local system, and encrypts everything. That's right, it has a totally encrypted cache, which gets wiped at shutdown. Not deleted. Not erased. Wiped, as in a secure deletion with rewriting.

This is the xB Browser that you will see debut in 2008.

Some of the shortcomings of the browser is that it will be slightly memory intensive. It will be bigger, it will look a little different. But it can remember your settings, and seamlessly integrate with your desktop configuration, running in a full sandboxed mode.