* How to get trainers on the same page regarding tools * How not to scare visitors and make them believe they can „make meaningful progress“ * „It depends“
Topics * How the internet works * linux * hard drive enc * email enc * mobile enc * Easy: TorBrowser, TrueCrypt | Hard: Enigmail (bc of webmailer) * what do they expect * categories: communication, data enc, anonymity * BBBBBBBBYYYYYYYYYYOOOOOOOOOODDDDDDDDDD * but also Test Systems (fresh linux, windows, mac, phones) to setup demo accounts * other peoples' keyboards are lava (reduces blame on the trainer if sth goes wrong)
„how many people did this at at least one of their cryptoparties?“ (max=9) XMPP 3 XMPP Desktop 1 Conversations 4 Signal 6 PGP 9 Enigmail 9 Mailvelope 0 TrueCrypt 2 VeraCrypt 3 TorBrowser 7 Threema 1 Telegram 1 PW Managers 6 (KeePass, one person OnePassword) Ublock Origin 3 Adblock 3 Priv Badger 5 NoScript 8 HTTPS every 8 Phone enc 3 Linux 4 BSD 1 (FreeBSD/OpenBSD) Offering Tails 4 Whonix 2 I2P 1 Freenet Project 2 Tox 1 Ring 0 Wire 0 WhatsApp e2e 0 2 factor auth (2 ppl informally, no walkthrough) SMSSecure 0 Cryptocat 0 Examples of (spear)fishing 0 Keybase 1 protonmail 0 pep 0
„Asymmetric encryption: Public and private key“ „End2End encryption works, but both parties need it, how to verify“ „Encrypting non-important stuff makes encryption seem less suspicious“ „Show visual traceroute from local place to mail provider (look at all these computers) visualroute.com“ „“
* start with peoples' ideas and needs, give sense of empowerment, don't rush, never use computer to explain stuff, theoretical stuff beforehand, no wise-ass-guy, more moderation than explaining * don't be shy to cover topics we are not familiar with, „intersting, but i cannot help“ / „i'm not comfortable with explaining that to you“ / „let's find out together“ / say beforehand „we're not experts“ * empowerment: „study: if 15% use crypto, the nsa starts having economic problems“ → audience has influence! * use the peoples' machines, make them more secure * „don't assume everybody worries about the nsa“ → instead talk about cybercriminals, advertisers, device theft * share stuff on https://github.com/cryptoparty * be up to date on cryptoparty.in, global mailing lists, contact info * trackography.org * how does the inet work → trackers →
Things gone terribly wrong: * PGP on apple * Truecrypt (wrecked partitions, no backups were made despite warnings) * Updating a Raspi took all the time that was intended to demo hidden services * Setting up Linux for person who bought laptop for that particular person and „had backups“, and hat to catch a flight the next morning (uefi fuckup, hw/software problems until 5am) * ASK PEOPLE WHEN THEY MADE BACKUPS OVER AND OVER AGAIN * Linux install day on MONDAY evening (6 trainers, 50 guests), 40 installs, less than 4% retention rate (LUG event)
windows fearmongering is „dangerous territory“ because there is no hard proof and borders conspiracy theories
"TSA approved locks" analogy though
How do we ask people what they are worried about?
"What are you worried about?" "
Post-session talk ended here because people were tired
NEXT DAY: HOW TO ORGANIZE A CRYPTOPARTY
Q: „Organizers, what is important?“
"Same regular time and place for the meeting" "Avoid Hackspaces, because they attract the wrong kind of audience" "Hand out flyers" "Don't grow it too big (200ppl at one party)" -yolo "need to be inclusive, ppl should be able to be anonymous" "bootstrap from core community that already has problems (eg activists)" "don't have technical discussions (cacert guy batteling gpg guy)" "do the techy part at the end so ppl can leave beforehand"
Q: „How do you prevent the discussion from drifting away to 'advantages of privacy' or 'tool1 vs tool2'?“
"have separate rooms" -yolo "there will be smaller groups later!" "deputize the disruptive nerd and give them a hard task" "oh you know so much about that? here's your own table" biobrause
Q: Can i start in my living room with my friends? → eveybody: „Yes!“
Q: How to deal with different languages at same Cryptoparty?
split languages by table explain in lang a, and while person a figures it out explain to person b in language b
Q: Different language materials
blabla look on cryptoparty.in use language specific subdomains of cryptoparty.in
Q: When are the topics decided? (flyers, intro, group)
few ppl: ask everbody what they want / larger group: raise hands or let ppl come to teacher discuss beforehand which tool to teach for each task (yolo) experimental format: "who are your enemies" -> (corps+ads | russian intelligence) -> threat model centered approach (including tool selection) let groups interact, roleplay situation (ukrainians, russians, journalists, etc) -> what ressources do your enemies have?
Learn from each other, let elderly woman teach about passwords, ask attendees what they can teach
„Why are you here?“
start with current events -> how does this affect me -> who has an iphone? -> show alternatives surveillance in your city
Don't use red/green tables, bc ppl will just believe you and not think about what the tools do for them (→ threat model)
Don't overwhelm ppl with many options, instead make them have success
Don't force them to give out contact info for testing purposes
Tell what is important to YOU! → What do you use? → do they satisfy your requirements? → oh we have to uninstall everything
convince ppl oss is better bc nerds can check it out
is it secure? → if you throw your phone into a river and can read your message on a new device, it's not god
have person use social media for you (guenther) local newspaper tell all your frieds have your venue announce go where ppl gather put up ads in the analog world word of mouth (reqs recurring event) all of the above
Share posters/stickers/etc on github!!1
Q: ppl are sceptical of tools and think police is almighty and ppl believe that anything can be broken
give them examples of criminals/activists who [are/have been] active for a long time
Q: wat do when ppl have a threat model you cannot handle?
nobody actually responds to questions for a long time do special event for those ppl and go into more detail however it's not a good idea to announce a "whistleblower cryptoparty" you can still help them by raising the average level of crypto usage have one or two special angels ready for these ppl that can contact more advanced help ("are you a surveillance target?" -> "yes" -> and of to the other room)
Aspirin dont help, so i dont take it? → not taking it is no solution
Will i draw attention on me if i use $tool?
German reunification -> they cannot get us all when we are enough
cryptoparty is mental help: try to separate actual threat and paranoia. listen to ppl and validate what you say, capture the trauma (bring others for support)
then answer the question and relieve the stress from the situation -> emotional work
ppl who are sceptics of crypto are defeated, but they came to you despite them „knowing everything is bad“ → talk them down, emotional help
names: cryptoparty/privacy cafe/cafe privé actually do a party and let the musicians "accidently" learn about crypto
how do you plan the angel/attendee-ratio, what info to get from angels?
1:5 (never works out) dont plan anything, bc normally enough angels show up (berlin) failed for us, bc they showed up late and didnt know wat to do (yolo) do smaller cryptoparties get more reliable angels have backup plan in case no angels show up (funny youtube videos) (non-berlin) recruit attendees for next party: "send me an encrypted email if you wanna help"
ppl with android 2.2 → wat do?
tell them how the internet works and let them realise their phone is shit show them newer android where you can fine-grained permissions
REQUEST: USE THE LIST ON CRYPTOPARTY.IN!!!! (and the other stuff there)