README

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

################
# Legal        #
################

TorBOX is a non-offical, community project. We are not affiliated with
torproject.org. The Tor developers are not responsible for this project.
See Disclaimer for more information.

TorBOX is produced independently from the Tor® anonymity software and
carries no guarantee from The Tor Project about quality, suitability
or anything else.

################
# About TorBOX #
################

TorBOX is an anonymous general purpose operating system based on
Virtual Box, Ubuntu GNU/Linux and Tor. By TorBOX design, IP and
DNS leaks are impossible. Not even malware with root rights can
find out the user's real IP/location.

This is because TorBOX consists of two virtual machines. One machine
solely runs Tor and acts as a gateway, which we call TorBOX-Gateway.
The other machine, which we call TorBOX-Workstation, is on a completely
isolated network. Only connections through Tor are possible.

The project homepage with a full project description and documentation
can be found here:
https://trac.torproject.org/projects/tor/wiki/doc/TorBOX

####################
# Trademark issues #
####################

Due to trademark issues TorBOX will be soon renamed to aos, which stands
for anonymous operating system. TorBOX also needs a new website. Stay
tuned for updates.

#####################
# How to contact me #
#####################

This is my personal user site. It acts as a brief introduction into TorBOX
and explains, how to contact me and what the caveats are.

########################
# Mirrors of this site #
########################

Github:
* https://github.com/adrelanos/aos
* Github.com is accessible over SSL, see SSL security below.

Torproject.org Wiki:
* https://trac.torproject.org/projects/tor/wiki/doc/proper
* Anyone can edit the torproject.org wiki and exchange content with malicious
  one. Therefore check the history feature. Obviously I do trust Tor and
  torproject.org. My wiki account should be genuine.

TorBOX.org  
* https://www.torbox.org
* Not as in Mai/July 2012, but hopefully soon.

################
# SSL security #
################

Note, that the SSL public certificate authority system is not to be trusted,
since the recent major security breaks. (Comodo, DigiNotar)

########################
# Contact me by e-mail #
########################

I do not trust any e-mail providers. They can shut down or impersonate my
account at any time. If that concerns you, read GPG security below.

In the past I used proper _a-t_ tormail.net or
proper _a-t_ secure-mail _d-o-t_ biz. Because there were too many problems,
I switched to:

adrelanos _a-t_ riseup _d-o-t_ net

################
# GPG security #
################

GPG is, as it is, secure. The tricky thing is the web of trust model and
being sure, you got the right GPG key.

My GPG public key is not stored on any keyservers, because as an anonymous
developer, I can't get my key signed. The key can be found here and within
the file proper.asc on github. Check the fingerprint of the key.

All mirrors of my personal site, do also have the power to exchange my GPG
key with a malicious one. It's unlikely, that all mirrors will cooperate
and tamper with my GPG key.

As soon as our new website https://www.torbox.org is ready, my GPG key and
GPG fingerprint will be mirrored on at least on three different sites
(torproject wiki, torbox,org, github).

After all, the GPG key also only proves, that a message was singed with a
specific key id. It doesn't prove, if I am a genuine or evil developer or
even a whole entity.

Also see https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/Trust.

###################
# GPG fingerprint #
###################

gpg --fingerprint 9C131AD3713AAEEF

pub   4096R/713AAEEF 2012-03-02
      Key fingerprint = 9B15 7153 925C 303A 4225  3AFB 9C13 1AD3 713A AEEF
uid                  proper <e-mail removed>
sub   4096R/794279C4 2012-03-02

##################
# GPG public key #
##################

Note, that due to signing this message,
"-----BEGIN PGP PUBLIC KEY BLOCK-----" got converted to
"- -----BEGIN PGP PUBLIC KEY BLOCK-----" and
"-----END PGP PUBLIC KEY BLOCK-----" got converted to
"- -----END PGP PUBLIC KEY BLOCK-----".

If you want to copy and import the GPG public key, you have to remove the
leading "- " from the begin and the end of the pgp public key block.

- -----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBE9QN2ABEAC8SpmBxocz27epSQ7w7H4FSbJdMEf+alMiNj569IOw6aEZPbqe
3XajObdbSjMOZ/SPD3ZlONzuJFsrjSuFGnwszlUub8OoU3hL8J2NTJJKphQr9Ne4
reNWkwtayM5p1GFB6eoktpXmlOnmYY54/hvuXyyS0Ya5fy5SCq0r9OfLL83OjKHZ
Yc26AHgAOoUbdZFX6oRnamQRsuKQBNKXG4C413KFzt4Hr5bX1pmWDUWKLZz28i+7
lFHQZFtjJ1FY6LLaPkh4qZgraEL10jjm+2Qq+o7wsK7kZanp+QWOCQtds0aucJjN
HteAXm+KpnTcdOF/JR5IMp85ka0gCHFMa6cYugmTbp6BiNQv5TCC4AlA2DuJohX4
o5OrjCRmhPvRhxJPTpFAHtmeX75YAKl7VuVDhpo/jej5akbG23cJZvlSWJWfvAUp
JjLsh3Pb9IScsQSPW744XbyFOElx7x3CKwcKYeaopfyN6jewDOadhUOFtcQ88Nmw
2cvuHSqK4QGuZqgNnWbeG84M4C4vm27ANYCxZIc/mo6RLp9fRrUR17am9U73zw2U
bblQ4TqVI5OT+xhUFwgEgVRVAETmjbRuqFeMYTzQJJzcs2t5Q4MOH49zDwr2mLCT
y5n52/Fj6DHmQ/EOIPbqezYsSrce6AV+y2zP6Ex8faXEQaBswPtKAYatCQARAQAB
tB9wcm9wZXIgPHByb3BlckBzZWN1cmUtbWFpbC5iaXo+iQI4BBMBAgAiBQJPUDdg
AhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRCcExrTcTqu73d6D/48XbFd
arHrhVKF4LLJalgP1FhI6Fps4gSmMLdllMEvE+a6r7/riYwe1bbxit6xWzyANFcS
GT1rh69qDxx6oyyhEt+Fal5bB+r5Yg4zPp24IpAMMbisx06KITRLDcvgwIrOMzss
zZ//TN1CwHBc9OdtomhAWpx5vfiVk7Q/9l0fPZhsEV9zmQuJ5GzSM+VivzdAjV93
o57RN/f72Qltsy5hiv4ohx0PEN7otkKbftmALdaYvQCRHA29Z2dMi7DWEZPvFozO
2T1h+gq5YSwQzTqjQFuPN4DVeubEw5lsXmLG6ohq2z5L/JDEgAzKq7uddJxPLtjI
LmoMfLmpMNvpyzZnxckWFnbnHSFTIlM1fV64mTzmJgGTQsV2P3LHuhhNvOxT05Lq
FwwK1t6XPoc2ax+Z4/NYbWvtZap+1Ob5As+601fm6vsreCH93pez+eKQkj8LrMyO
te1MpbWsR8lSXF8WxvJf5Wo27dKzZ2cQaLmhGF0RTq0KJS42DJrmkErooGNRTev8
sUnGdYIF1UoEBkacODri+/A/Pkm476CRrh5pgKmHfe9bucJgi2SEq+1NRdTL5yAM
X+uMmftznuO8zQbDRZNhMlVe4git6eVCCnCBMOPjgY8cHA2k2672janzepc+aotn
wyb6uXaKJx614Kr+i6esb6ExUPlpOYpAFGA3DrkCDQRPUDdgARAA20rIrVlqSw5g
bYic4nFCZ9xAF/nZbVXf39jMgUjdjIxc/3WFiT/P2hO46s5jSkCJ2dCFaMyZ6lba
1U0hkMkEJFPHiUDv0X5T8vOXkQb+ctGRwA72e6KVpckZ7mu3JRAWOj1ky3jWQs/C
cCHjog1NCosKN2usgedHxL0XajiMDTOHa10mhG8WF6YacJ2/OhJE/tlN269rhFa4
/rafUOlcqsg7AX2nlXOnRL6i2yYp8cHcwb3PfX7ZPqAxG23qHt8XxF1AHJ1o7Ck2
EiyfymfjZ+KGIXNi2BVF0B4vj5IFBsdevfD8qupcokf/fazJCZgSOLxil6djwyIF
hTPIiXHEDbt5DlHIoq65zUdUp5DSwPQpIFDxf+Hhnt2/9tPSs6D2GHrTqMxm0H5h
02TcSEoqXV/6zd9+fainzZMqayGCvYepk8RPB2WdYZp9m+VoUFZHOXCK5myvghS/
/ZepuTROTvdac1/vEIFCx9RmVQa4TsNJs2oRepNs2zVtzVTnHbmrMSanVdWwTkuB
UalYmPsPxfN/nf4MU/UnD/htN+wpXYIdRSMGBWHHw9eeAhMHU85AZJwm1c7HVetA
eGfHDC7EbwzWl5PnAjc5FCfvUqmVl5H7u01mFk4KwhX3goRxkRet2Op96wP8+B7R
bNySPwtkQT8KY5BPIWciNLs+PcszWxMAEQEAAYkCHwQYAQIACQUCT1A3YAIbDAAK
CRCcExrTcTqu74EJD/4mPn+BHoWuJts1S0tIkbu8Equ+tRdwELn3nWPMLLn6yozp
p3pgJizZo5WleKBNlf1i89jYvhV0hM7sYuFiFnLjCeje9a44GtJQcfwGrOHFBnsR
R5UzR5FP5YwS006Wknn/TD1gNfqAAfeBvDg+uduJ46JaXo/LLuB+Qv1mOdajA75o
VXAEZRJ7a+gOhd13Ulwtvg2Z2vsOd4sEdCUGIOmCyV6ijSyUAICCNN2K/rKIUVxd
lIEPX/yOmYua3yWp45k/2g6QKnCV2RBb7oLL808ZT8DcN7F0AK8RkYrIUyHnu/gv
fQjadOaOBKITLeCnveawfwN5sigeYhaTaR3tDR/8GuaqwElFpXmGWKv3WiJirJvA
bdwh3Xgrc7JVVnUg7DpCP29UxSbDwqd7I5Va3ofPEZXFUEysF1aCSFHnTbjYnH1P
YgiZt7Isdt3AJdAVnpsKbGgE0gFofOkKCAZxJbsqbW5BVXxIrNctXk5J5cT6iM1j
R9zGSXadByDA9OPPA4bgbcg8aONX+d6oYz3wn2e1vRwMkykjFlJ9y3Onv0Oidd3Y
VtiOZQ5ZWabToRyy9gTowgcpvG5axHXhPkwrfOknSqxv/LalnrDa90Djl6nEXPse
+7veqYr3oeJZbUSwgrEc5eOPys4PtvSyRTIIap9XbzeT2AmZ2gGAHrnq3T81Nw==
=N9Kn
- -----END PGP PUBLIC KEY BLOCK-----

#######
# End #
#######
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJQBYANAAoJEJwTGtNxOq7v2WQQAKODLQkVWP1FDVX23F5I2mn/
C6bYOYi+9QQt9eMnPFcrRMhTK0907Z+nqKhjm1t8TSpc5z8kwlvdJKQpjtBDJeth
eloeOIDlzoYP2uUY4f1jO1JVN4uIDfCoihzhui1zc+P9Jhck2xtw0NS6xjUbRouI
PrX9p8h9hubShmgrrXcQTQ/x8h8kosKAl4XF4Ltj/Z9P0C8FZRLRbDXKSXLTvKkW
umYAEafWqR1GKSvgnqkC32aqP/OqhnrfZE+ecqpPnyPk9DA3ZUqRA2vSG8dcguZp
XURrbZb6D67xFecCuMvaVoG8i78a48+UkvpUxjmHiciIhn2I0M7LsrCmxRJb4kMg
AxSKqycefSgnyZnWQauT1Z+yY6o+/ikUID/f+rz0pTh4O9dIgmwyijQpSl5j8Lvn
ED5dbAqyOVI6Pm0GEw1/suibkjuOcbfd3qZ+BGetx2uTU5WJSzhGwYQYUd1LptMQ
uMXzm9djco+Om87PDBseGnXWLNoN3Wm29bHg4l4GB/0NckHpbDBdnBJZqGmolVkk
zGE1sNGHLZjYR3yHs6TWEMsKW43yoKK56hr07DmJJTie+mBq8XUHtr0FSMStb6TL
u3NCpjp+b1RLS+FPmA099QpKQ3D1B8HfoqmizBnN7Ig4+lvrf4FP+VoWfhb/VrzG
lt/KHyIwRUbpJRp2rhpa
=HZ1c
-----END PGP SIGNATURE-----