March 2006 - cypherpunks-legacy

for the bored: test an iso (esp those with via padlock hw)
by coderman 24 Mar '06

24 Mar '06

if you'd like to help me test some crypto pieces the following ISO includes a test mode which gathers stats and hardware info. feel free to trim whatever from this report and send me the remainder. additional modes support a network-less key management mode and a network enabled instance and cd/dvd writing clone mode. i'm curious about the following mainly: - does it boot? - is network hardware (no wireless) detected in 'net' target? - does entropy mgmt on VIA hardware work? (c5test/c5keys/c5net) - does the clonecd/clonedvd work with your hardware? (clone) - are the key mgmt tools provided sufficient/working? (gpg, openssl, ssh) feedback appreciated. please note the test mode may take a loooong time (30 mins not uncommon). also note you may be left with a single seeder on a slow DSL line, which might take a while as well. src for mtrngd and modified hw_random in src/ on the iso. these bits need some work... thanks http://home.peertech.org:65534/test.iso.torrent gpg --print-md sha256 test.iso test.iso: C7096E4F 76F6AE52 F3E61058 0C269EC3 9C2A1478 B11DDDC5 0664F9F 864DDB44 you can run this without any disks for the security conscious. the full project is intended for release at defcon this year. hope to see you there. (not as a presentation, we just like to geek out. and i'll try to be sober this year but no promises!)

2 3

[perry@piermont.com: Greek officials were tapped using law enforcement back door]
by Eugen Leitl 24 Mar '06

24 Mar '06

----- Forwarded message from "Perry E. Metzger" <perry(a)piermont.com> -----

1 0

entropy status / benchmarks [was test an iso]
by coderman 24 Mar '06

24 Mar '06

On 3/16/06, coderman <coderman(a)gmail.com> wrote: > ... > - does entropy mgmt on VIA hardware work? (c5test/c5keys/c5net) for those with VIA/Intel/AMD hw entropy device support and a running mtrngd you can get current status via '/etc/rc.d/rcS.mtrngd status'. logs are in /var/log/mtrngd/. i'd be interesting in knowing run times for large amounts of entropy gathered and mixed to /dev/random (gigabytes if it remains stable for that long). particularly for the Intel and AMD hw devices which i do not currently have at my disposal for testing. status output is similar to the following; sizes are in Bytes, times/stats are in microseconds (not milli): [Fri Mar 24 08:46:14-459926] Current MTRNGD Status: bad fips blocks ......: 13080 monobit failures ___: 3359 poker run failures _: 542707 bit run failures __: 1104377 long run failures __: 9687 cont run failures __: 35 good fips blocks .....: 41614750 hwrng read bytes .....: 104069575000 entropy add bytes ....: 104036872320 random writeable cnt .: 541858710 hw entropy read stats ....: min: 2479 avg: 3359 max: 22788 total: 139833561751 rng fips check stats .....: min: 904 avg: 919 max: 6464 total: 38267989605 random recv starve stats .: min: 3416 avg: 4305 max: 24018 total: 179159453561 you can stress /dev/random via 'bench-rng /dev/random 1024 1000000' or simply 'cat /dev/random > /dev/null'. uptime would be helpful. note that i accidentally left "forgiving fips check" set in the rcS.mtrngd script; this can be turned off for a better real world test. the forgiving option does not fail blocks with poker or bit runs. monobit, long, and continuous runs are always critical and the block is discarded. the FIPS check block size is 1500 bytes. see http://csrc.nist.gov/fips/fips1401.htm for more info. by default entropy density is at 80% so take that into consideration when calculating available /dev/random throughput. ex: entropy add bytes ....: 104036872320 x 0.80 == 83,229,497,856 Bytes of actual entropy added to /dev/random pool.

1 0

PayPal Goes Mobile
by R. A. Hettinga 23 Mar '06

23 Mar '06

--- begin forwarded text Date: Wed, 22 Mar 2006 21:33:16 -0500 To: Philodox Clips List <clips(a)philodox.com> From: "R. A. Hettinga" <rah(a)shipwright.com> Subject: PayPal Goes Mobile <http://mobilecrunch.com/> MobileCrunch March 22, 2006 PayPal Goes Mobile! Posted by Oliver | Discussion: 1 comment Hot on the heels of yesterday's post, comes this amazing news from PayPal that PayPal is launching a mobile product! According the the Internet Payment Giant's website, it is now possible to send and recieve money via mobile phones as well as make purchases directly from a mobile phone. According to their published materials: Send money to friends and family Send money securely, anytime, from wherever you are. You don't need cash or a check - just your phone. After you activate your phone, you can send money one of two ways: * Text to 729725 (PAYPAL) with the amount and recipient's phone number. Example: send 5 to 4150001234 Or * Call 1-800-4PAYPAL (1-800-472-9725) and follow the instructions. Since a picture is worth more than a thousand words, here's a screen cap from their website. I'll be revisiting this later today with more details. Tags: m-commerce, mobile-money, PayPal, PayPal-Mobile, OliverStarr, mobile-commerce Categories: Uncategorized | Bookmark this post with del.icio.us Google's New F-Finance Beta Pretty on Mobile but Lacking Substance Posted by Oliver | Discussion: 1 comment Another day, another Google Beta. Pretty soon they'll have to start giving them numeric designations instead of names. Today's suspect is Google Finance which was apparently released yesterday in beta (of course) with little fanfare. If you enter the URL into a mobile phone it automatically mobilizes the content so that it is easier to read (which is a plus here, but a disaster on many other websites that have already been optimized by the site's original authors- and a topic about which I will post on shortly). The content is a little light however, as I will demonstrate in the below images where I searched for Foldera (FDRA.ob) on both Google Finance and via YubNub. The results speak for themselves. Categories: Google Mobile, Announcements, Analysis | Bookmark this post with del.icio.us -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

CHEAP WAY TO BIGGER UR SHORT & THIN D11CK ran
by Martine Dorene 23 Mar '06

23 Mar '06

Is your Diick short? The Only Safe & Natural Way To Bigger ur Size Guaranteed Thicker & up to 3" longer after 1 month http://gaa.weAREFollOWedBY.cOM (Click Here to buy today and get bigger after 30 days) ran but friends tying purpose easy. king discuss easy got address? pretty clear address, explain longer met steps central likely? sudden evil forty mistress purpose journey,

1 0

Low mortagge ratee approvall
by Jo Glover 22 Mar '06

22 Mar '06

1 0

Re-finance at the lowestt ratess
by Emilio Taylor 22 Mar '06

22 Mar '06

1 0

Urgent Notification #165657375031769956
by Claude Little 22 Mar '06

22 Mar '06

1 0

Re-finance at the lowestt ratess
by Isabella Walls 22 Mar '06

22 Mar '06

1 0

Beware the clean-cut WASP cleaning crew member working in solitary late at night...
by coderman 22 Mar '06

22 Mar '06

*grin* [from my neck of the woods, so probably more interesting to me than most. it'd also be interesting to hear other stories of suspected clandestine surveillance. this guy is friends with Brandon Mayfield, another PDX attorney who had represented middle eastern clients, who was jailed on bogus finger print matches to the spain bombings - even when spanish authorities insisted he had nothing to do with it: www.komotv.com/news/printstory.asp?id=31353 ] also interesting that ADT appears to comply fully with such black bag jobs; another reason to roll your own :) ---cut--- http://www.oregonlive.com/news/oregonian/index.ssf?/base/news/1142913320152… Lawyer thinks office was searched in secret Surveillance - A Portland attorney, who represents a Saudi, cites suspicious circumstances Tuesday, March 21, 2006 BRYAN DENSON A Portland lawyer suspects that federal authorities executed warrantless searches of his Lloyd Center office to collect information about a client who is the subject of an international terrorism investigation. Tom Nelson, who represents Saudi national Soliman al-Buthi, previously filed a complaint that alleged warrantless interception of phone and e-mail communications between al-Buthi and his other lawyers. "We allege in our complaint not only that they intercepted communications without a warrant, but they used the interceptions to the disadvantage of the client," Nelson said. Nelson thinks government agents, with no judicial supervision, entered his office on a number of occasions last year. He first raised the suspicion in September in a letter to Karin Immergut, the U.S. attorney for Oregon, who wrote back saying she was aware of no such warrantless searches. Nelson recounted his fears about warrantless searches by the National Security Agency in a story this week in U.S. News & World Report. Two years ago, the federal government charged al-Buthi, who headed an Ashland nonprofit called al-Haramain Islamic Foundation, with taking charitable donations totaling $130,000 in traveler's checks out of the United States. Federal authorities have accused the al-Haramain parent organization, based in Saudi Arabia, of ties to Osama bin Laden. Nelson thinks that while he was representing al-Buthi on the criminal charge and attempting to rid his client of a suspected "global terrorist" designation that someone posing as a janitor repeatedly tried to, and apparently did, enter his Lloyd Center office after hours. Attorney Jonathan Norling, who shares office space with Nelson, said he was sleeping on a couch at their practice early one morning last May when a man dressed as a custodian tried to enter Nelson's office. Norling startled the man twice one night in July when he caught the man trying to enter the locked office. Norling also suspects federal authorities were trying to collect information from Nelson's desk and computer. Whoever it was, he said, had a badge for the building that appeared valid. "This person clearly wasn't a cleaning crew," Norling said. "I know the cleaning crew. They come in at different times. They have a cart, and this guy didn't have a cart. . . . I've worked here seven years, and I've worked a lot of late nights, and I never experienced anything like that until Tom was working (on this case)." Nelson was suspicious of the government, having briefly represented Brandon Mayfield, the lawyer wrongly accused of the 2004 terrorist attack in Spain. Mayfield was the subject of intense federal surveillance. Nelson's suspicions deepened when he found that his computer had inexplicably been rebooted and that papers in his cluttered office had been moved around. "I'm not the world's best housekeeper," he said, "but I know where things are." After a few suspicious experiences, Nelson took his al-Buthi files to his home in Zigzag. There he experienced what he described as unexplained lapses in his burglar alarm, failures that the company that monitors the alarm couldn't adequately explain. On Sept. 23, he fired off the first of two letters to Immergut, the U.S. attorney for Oregon, complaining of "strong indications that my office and my home have been the target of clandestine searches" related to the al-Buthi case. Immergut responded Jan. 19 that she stood by her earlier statements: She was aware of no such searches under her watch. Immergut wrote that she assumed he was referring to news reports about clandestine intercepts by the NSA. Immergut pointed out in her response that the NSA and Department of Justice were separate agencies. In an interview Monday, she added, "The (NSA) is not required to come to the U.S. attorney for the district of Oregon for authorization to conduct any kind of searches." All of which keeps Nelson scratching his head. "I have no proof the government's doing these things," he said. "I just have a very healthy suspicion they are." ---end-cut---

2 1