July 2018 - cypherpunks-legacy

Atty. Gen.: won't rule out domestic warrantless taps
by Brock Meeks 06 Jul '18

06 Jul '18

>From a press release from Rep. Adam Schiff, D-CA: WASHINGTON, DC (April 6, 2006) - During a hearing before the House Judiciary Committee today, Rep. Adam B. Schiff (D-CA) questioned Attorney General Alberto Gonzales about the NSA's secret domestic wiretapping program. The Administration has cited the Authorization to Use Military Force and the commander in chief powers as authorizing the NSA to intercept international communications into and out of the U.S. of persons linked to al Qaeda or related terrorist organizations. After citing his concerns that there was no limiting principle to the Administration's claim of authority in the War on Terror, Rep. Schiff asked the Attorney General whether the Administration believes it has the authority to wiretap purely domestic calls between two Americans without seeking a warrant. "I cannot rule that out," responded the Attorney General. "This is very disturbing testimony," Rep. Schiff commented later, "and represents a wholly unprecedented assertion of executive power. No one in Congress would deny the need to tap certain calls under court order -- but if the Administration believes it can tap purely domestic phone calls between Americans without court approval, there is no limit to executive power. This is contrary to settled law and the most basic constitutional principles of the separation of powers." Rep. Schiff and Rep. Jeff Flake (R-AZ) have introduced bipartisan legislation -- the NSA Oversight Act -- to reassert that FISA and Title III are the sole authority for domestic surveillance. The bill would: 1. Reiterate Exclusivity of Current FISA and Wiretap Laws - states that FISA and the federal criminal wiretap statutes shall continue to be the exclusive means by which domestic electronic surveillance may be conducted. 2. Clarify Military Force Statute - makes clear that the Authorization to Use Military Force (AUMF), passed days after the September 11th attacks, does not provide an exception to that rule. 3. Require Congressional Action - makes clear that current laws apply unless Congress amends the laws or passes additional laws regarding electronic surveillance. 4. Require Report on the Extent of the Wiretapping Program - requires classified disclosure to Congress of information about U.S. persons who have been the subject of any such electronic surveillance. _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Politech] Attorney General won't rule out domestic warrantless taps [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

["Fourth Amendment? What Fourth Amendment?" --Declan] ---

1 0

[Freedombox-discuss] FreedomBox Unstable Image 2012.0629 Available
by Nick M. Daly 06 Jul '18

06 Jul '18

Hi folks, welcome to the fourth weekly FreedomBox test image and progress report. This image is designed to allow anyone to test the current state of the FreedomBox. However, it's not yet a complete privacy solution, so you should rely on other, more established, solutions until we produce a stable release. This is not a stable or complete release. The image is available at: https://www.betweennowhere.net/tracker/freedombox-unstable.torrent https://www.betweennowhere.net/tracker/freedombox-unstable.tar.bz2 Tonight's image was produced with: $ make weekly-card The image includes several FreedomBox-related projects. The changes are changes made by project contributors in the last week that have made it into the test image. The outstanding TODOs are the changes needed before the beta-release is complete. If you'd like to contribute in any way, fork and send me a pull request. Freedom Maker: https://github.com/nickdaly/freedom-maker Changes: - The weekly card is now a make target. Outstanding TODOs: - Build the first run config/setup. - The setup process generates keys for user. - Setup generates keys for the box itself. - Turn DHCP on by default (on first boot). - Enable Wireless Access Point (WAP) by default. Plinth: https://github.com/nickdaly/plinth Changes: - Santiago (FreedomBuddy) gained a UI and JSON output. Outstanding TODOs: - Turn DHCP on/off through Plinth - Select DHCP or Static IP in Plinth - Integrate basic OpenVPN settings into Plinth - Integrate Dnsmasq into Plinth - Point "fbx" and "freedombox" URLs to the Plinth UI - Integrate FreedomBuddy into Plinth. - Hook FreedomBuddy into OpenVPN. - Hook FreedomBuddy into SSH. FreedomBox Privoxy: https://github.com/nickdaly/freedombox-privoxy Outstanding TODOs: - Privoxy should use the released HTTPS Everywhere regexp. - Add enabling and disabling Privoxy to the Plinth UI. PlugServer Setup: https://bitbucket.org/nickdaly/plugserver Outstanding TODOs: - Integrate into Freedom Maker. With SQLite: https://github.com/nickdaly/withsqlite No known TODOs, this is complete. Errata: - The Freedom Maker version on the card doesn't have the weekly-card changes, because I was testing it by building the card. I didn't really feel like rebuilding the entire card after it worked the first time. - Tom Galloway contributed a FreedomBuddy SSH VPN service that I didn't have time to integrate into this week's image. Thanks for your time, Nick _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Atty. Gen.: won't rule out domestic warrantless taps
by Brock Meeks 06 Jul '18

06 Jul '18

>From a press release from Rep. Adam Schiff, D-CA: WASHINGTON, DC (April 6, 2006) - During a hearing before the House Judiciary Committee today, Rep. Adam B. Schiff (D-CA) questioned Attorney General Alberto Gonzales about the NSA's secret domestic wiretapping program. The Administration has cited the Authorization to Use Military Force and the commander in chief powers as authorizing the NSA to intercept international communications into and out of the U.S. of persons linked to al Qaeda or related terrorist organizations. After citing his concerns that there was no limiting principle to the Administration's claim of authority in the War on Terror, Rep. Schiff asked the Attorney General whether the Administration believes it has the authority to wiretap purely domestic calls between two Americans without seeking a warrant. "I cannot rule that out," responded the Attorney General. "This is very disturbing testimony," Rep. Schiff commented later, "and represents a wholly unprecedented assertion of executive power. No one in Congress would deny the need to tap certain calls under court order -- but if the Administration believes it can tap purely domestic phone calls between Americans without court approval, there is no limit to executive power. This is contrary to settled law and the most basic constitutional principles of the separation of powers." Rep. Schiff and Rep. Jeff Flake (R-AZ) have introduced bipartisan legislation -- the NSA Oversight Act -- to reassert that FISA and Title III are the sole authority for domestic surveillance. The bill would: 1. Reiterate Exclusivity of Current FISA and Wiretap Laws - states that FISA and the federal criminal wiretap statutes shall continue to be the exclusive means by which domestic electronic surveillance may be conducted. 2. Clarify Military Force Statute - makes clear that the Authorization to Use Military Force (AUMF), passed days after the September 11th attacks, does not provide an exception to that rule. 3. Require Congressional Action - makes clear that current laws apply unless Congress amends the laws or passes additional laws regarding electronic surveillance. 4. Require Report on the Extent of the Wiretapping Program - requires classified disclosure to Congress of information about U.S. persons who have been the subject of any such electronic surveillance. _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Politech] Attorney General won't rule out domestic warrantless taps [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

["Fourth Amendment? What Fourth Amendment?" --Declan] ---

1 0

Re: [liberationtech] Silent Circle Dangerous to Cryptography Software Development
by Christopher Parsons 06 Jul '18

06 Jul '18

I just wanted to note that hosting things in Canada isn't inherently, or necessarily, safer than hosting in other countries. Canadian courts are as able as American courts to apply pressure towards 'privacy sensitive' companies, with Hushmail being a good example. I would also note that Canada's lawful access legislation - perhaps on ice now, but something that will likely come back to life at some point - includes a decryption requirement that could have serious implications for companies providing encryption services/encrypting data in transit. A colleague of mine and I have written a piece on those decryption requirements (which is available at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2148060) as they would affect cloud services, and it might be of interest to people on this list. Cheers, Chris -- ****************************************** Christopher Parsons Doctoral Candidate Political Science, University of Victoria http://www.christopher-parsons.com ****************************************** > Julian Oliver <mailto:julian@julianoliver.com> > 11 October, 2012 11:36 AM > > A chap on Twitter by the name of Eric King wrote that "I don't have a > URL yet > but Phil said yesterday he was releasing the source code." > > In any case, even with the source (including server-side) it is > unclear as to > whether protection is not compromised by this suite. > > With a credit-card payment system the client list is practically a > click away > for any Government client, itself a worry. Having the servers located on > Canadian soil garners little, I think: software in a position like this > configures the distributor under responsibility to the juristiction in > which its > business is registered whilst foreign governments become potential > clients. > > Ultimately software promising this level of privacy needs to reflect > that people > come from differing geo-political contexts. As such both client and > server needs > to be freely distributed and installable such that communities can > then manage > their own communication needs, taking risks within their techno-political > context as they see fit. > > Cheers, > > Nadim Kobeissi <mailto:nadim@nadim.cc> > 11 October, 2012 11:24 AM > On 10/11/2012 2:14 PM, Katrin Verclas wrote: >> Having sat for the better part of the day with Phil Zimmerman with activists and journalists in a room, here is what I learned: >> >> On Oct 11, 2012, at 12:15 PM, Nadim Kobeissi wrote: >> >>> On 10/11/2012 12:04 PM, James Losey wrote: >>>> Hi Nadim, >>>> >>>> I largely agree with your assessment of Silent Circle and I offer these >>>> thoughts in an effort to increase my understanding of the issue. The >>>> product is a packaged "solution" clearly targeted towards business >>>> customers focused on corporate privacy. And while the company offeres >>>> regular transparency statements on government requests and strives to >>> Unless hit by a search warrant and a gag order at the same time, or a >>> federal subpoena. >> Zimmerman stated that servers are located in Canada to avoid US subpoenas (not a lawyer, not sure what's that worth in the end). > > His entire IP block is connected to servers in the United States. I am > very skeptical of that claim. Furthermore, this is nonsense; the issue > isn't being protected against *one* country's subpoena, it's being > protected against *any* subpoena. > >> According to the Silent Circle website: >> >> Websites and products that donbt list the people behind the technology or where their servers are located, how the encryption keys are held or even how you can verify that your data is actually encrypted, are typical of the industry and provide only pseudo-security based on a lot of unverifiable trust. >> >> Our secure communications products use b Device to Device Encryptionb b putting the keys to your security in the palm of your hand (except for Silent Mail, which is configured for PGP Universal and utilizes server side key encryption). We DO NOT have the ability to decrypt your communications across our network and nor will anyone else - ever. > > The closed-source nature of the software makes pushing > government-mandated backdoors incredibly easy and extremely difficult to > detect if done right. This is a tall claim not backed by evidence or the > possibility of review. > >> Silent Phone, Silent Text and Silent Eyes all use peer-to-peer technology and erase the session keys from your device once the call or text is finished. Our servers donbt hold the keysb&you do. Our secure encryption keeps unauthorized people from understanding your transmissions. It keeps criminals, governments, business rivals, neighbors and identity thieves from stealing your data and from destroying your personal or corporate privacy. There are no back doors, nor will there ever be. > > ...unless they're served a court order, in which case Silent Circle will > either implement a backdoor or go to jail, thank you very much. > >> More importantly, Zimmerman noted that Silent Circle code will be made available for audit. >> > > Skype, too, says that its code is available for audit, and then only > lets a single academic audit it via an auditing that they themselves > fund. This is likely PR; I will not be satisfied unless anyone can > audited the code, and the source code is kept updated with every new > release. > >>>> minimize storage of some types of data (and you're right that payment >>>> info is problematic) the company is clearly interested in paying for >>>> privacy assurances and seems less focused on supporting activists. >> According to Zimmerman (who was keenly interested in use cases for activists) will make licenses available to activists at no cost. They have not figured out the process for this yet, but we'll certainly follow up with them. > > This is just really scary -- a piece of closed source, unaudited, > unverifiable software that costs money for corporations, but is free for > activists? > >> Katrin >> >> -- >> Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech >> > > NK > -- > Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech > Katrin Verclas <mailto:katrin@mobileactive.org> > 11 October, 2012 11:14 AM > Having sat for the better part of the day with Phil Zimmerman with activists and journalists in a room, here is what I learned: > > On Oct 11, 2012, at 12:15 PM, Nadim Kobeissi wrote: > >> On 10/11/2012 12:04 PM, James Losey wrote: >>> Hi Nadim, >>> >>> I largely agree with your assessment of Silent Circle and I offer these >>> thoughts in an effort to increase my understanding of the issue. The >>> product is a packaged "solution" clearly targeted towards business >>> customers focused on corporate privacy. And while the company offeres >>> regular transparency statements on government requests and strives to >> Unless hit by a search warrant and a gag order at the same time, or a >> federal subpoena. > > Zimmerman stated that servers are located in Canada to avoid US subpoenas (not a lawyer, not sure what's that worth in the end). > > According to the Silent Circle website: > > Websites and products that donbt list the people behind the technology or where their servers are located, how the encryption keys are held or even how you can verify that your data is actually encrypted, are typical of the industry and provide only pseudo-security based on a lot of unverifiable trust. > > Our secure communications products use b Device to Device Encryptionb b putting the keys to your security in the palm of your hand (except for Silent Mail, which is configured for PGP Universal and utilizes server side key encryption). We DO NOT have the ability to decrypt your communications across our network and nor will anyone else - ever. Silent Phone, Silent Text and Silent Eyes all use peer-to-peer technology and erase the session keys from your device once the call or text is finished. Our servers donbt hold the keysb&you do. Our secure encryption keeps unauthorized people from understanding your transmissions. It keeps criminals, governments, business rivals, neighbors and identity thieves from stealing your data and from destroying your personal or corporate privacy. There are no back doors, nor will there ever be. > > > More importantly, Zimmerman noted that Silent Circle code will be made available for audit. > > >>> minimize storage of some types of data (and you're right that payment >>> info is problematic) the company is clearly interested in paying for >>> privacy assurances and seems less focused on supporting activists. > > According to Zimmerman (who was keenly interested in use cases for activists) will make licenses available to activists at no cost. They have not figured out the process for this yet, but we'll certainly follow up with them. > > > Katrin > > -- > Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [silk] Bitcoin
by Alaric Snell-Pym 06 Jul '18

06 Jul '18

On 05/18/11 11:25, Suresh Ramasubramanian wrote: > On Wednesday 18 May 2011 03:34 PM, Alaric Snell-Pym wrote: >> Yep. I've written about this, and many people have suggested that Tor is >> a way around that: see >> http://www.snell-pym.org.uk/archives/2011/05/12/bitcoin-security/ > > That's called a pipe dream. > > 1. Tor nodes get sniffed and monitored, a lot - eg > http://lwn.net/Articles/249388/ so certainly not a substitute for strong > encryption [e&oe mitm attacks in fake tor nodes etc] > > 2. There's all the "follow the money" aspect that lets the transaction > get traced back to you one way or the other That's largely my point in the blog post... ...which is IMHO a good thing as: > 3. You'll find that - as with most of the other currency equivalents > like webmoney, its all too easy for the service to get a rep for being > primarily used by carders and botmasters [the second highest user > constitutency would be the sort of german geek who pgp signs everything > from a post to mutt-users to an email to his wife reminding her to take > the dog to the vet] <- not sure why its mostly german geeks who do this Bitcoin being not very anonymous against concerted attackers will make it less attractive to Evil People, so it'll be legitimised and (hopefully) not destroyed by governments. I know what you mean about those German geeks, but there's plenty of British ones too - they tend to be the tall, thin ones with ponytails! > srs ABS -- Alaric Snell-Pym http://www.snell-pym.org.uk/alaric/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Digital cash in the news...
by Nico Williams 06 Jul '18

06 Jul '18

On Tue, Jun 14, 2011 at 4:30 PM, StealthMonger <StealthMonger(a)nym.mixmin.net> wrote: > Nico Williams <nico(a)cryptonector.com> writes: > >> Crypto will NOT protect you from the state. > > Hmm? Protection from the state is the very reason some of us are > here. Even Philip Zimmermann wrote twenty years ago [1] In a pinch crypto will not protect you. Let's say you have an unbreakable code. But there's still traffic analysis, and even with onion routing and such, you don't know if your peers are ratting you out, or if the state has infiltrated the onion to a sufficient degree to find out a bit of what you're up to. And so on. Push comes to shove, the truth is that power still comes from the barrel of a gun. Do the same thought experiment regarding cryptographic coins if you like. The state could easily make it so insignificant amounts of business gets transacted in a cryptographic coin that the state cannot subvert or control. We use crypto to protect ourselves from non-state actors and insufficiently motivated, _civilized_ state actors. That's it. And even regarding non-state actors, you still depend on the civil law system administered by the state. If there's no state then you have to arm yourself to the teeth and be willing to fight. Uncivilized state actors will not give a damn about your crypto. They will torture you, your friends, your family. They may enslave you. Ultimately they may kill you. The trick regarding uncivilized state actors is to stay under their radar, or to take advantage of such somewhat civilized subset of their behaviors as might remain, and ultimately to get rid of the uncivilized state actors (by emigration, revolution, or just waiting until you get lucky and they civilize on their own). Civilized state actors granting you due process of law might also not give a damn about your crypto (see, e.g., the UK, where you can be compelled, under criminal penalties, to produce cryptographic keys). They won't torture you, etcetera, but they might deprive you of your freedom. So: don't live in an uncivilized state (either civilize it or emigrate), and then refrain from doing the sorts of things that might cause even a civilized state to come down you like a ton of bricks (i.e., refrain from committing crimes). For added safety use crypto. Nico -- _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [silk] Bitcoin
by Alaric Snell-Pym 06 Jul '18

06 Jul '18

On 05/18/11 11:25, Suresh Ramasubramanian wrote: > On Wednesday 18 May 2011 03:34 PM, Alaric Snell-Pym wrote: >> Yep. I've written about this, and many people have suggested that Tor is >> a way around that: see >> http://www.snell-pym.org.uk/archives/2011/05/12/bitcoin-security/ > > That's called a pipe dream. > > 1. Tor nodes get sniffed and monitored, a lot - eg > http://lwn.net/Articles/249388/ so certainly not a substitute for strong > encryption [e&oe mitm attacks in fake tor nodes etc] > > 2. There's all the "follow the money" aspect that lets the transaction > get traced back to you one way or the other That's largely my point in the blog post... ...which is IMHO a good thing as: > 3. You'll find that - as with most of the other currency equivalents > like webmoney, its all too easy for the service to get a rep for being > primarily used by carders and botmasters [the second highest user > constitutency would be the sort of german geek who pgp signs everything > from a post to mutt-users to an email to his wife reminding her to take > the dog to the vet] <- not sure why its mostly german geeks who do this Bitcoin being not very anonymous against concerted attackers will make it less attractive to Evil People, so it'll be legitimised and (hopefully) not destroyed by governments. I know what you mean about those German geeks, but there's plenty of British ones too - they tend to be the tall, thin ones with ponytails! > srs ABS -- Alaric Snell-Pym http://www.snell-pym.org.uk/alaric/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Digital cash in the news...
by Nico Williams 06 Jul '18

06 Jul '18

On Tue, Jun 14, 2011 at 4:30 PM, StealthMonger <StealthMonger(a)nym.mixmin.net> wrote: > Nico Williams <nico(a)cryptonector.com> writes: > >> Crypto will NOT protect you from the state. > > Hmm? Protection from the state is the very reason some of us are > here. Even Philip Zimmermann wrote twenty years ago [1] In a pinch crypto will not protect you. Let's say you have an unbreakable code. But there's still traffic analysis, and even with onion routing and such, you don't know if your peers are ratting you out, or if the state has infiltrated the onion to a sufficient degree to find out a bit of what you're up to. And so on. Push comes to shove, the truth is that power still comes from the barrel of a gun. Do the same thought experiment regarding cryptographic coins if you like. The state could easily make it so insignificant amounts of business gets transacted in a cryptographic coin that the state cannot subvert or control. We use crypto to protect ourselves from non-state actors and insufficiently motivated, _civilized_ state actors. That's it. And even regarding non-state actors, you still depend on the civil law system administered by the state. If there's no state then you have to arm yourself to the teeth and be willing to fight. Uncivilized state actors will not give a damn about your crypto. They will torture you, your friends, your family. They may enslave you. Ultimately they may kill you. The trick regarding uncivilized state actors is to stay under their radar, or to take advantage of such somewhat civilized subset of their behaviors as might remain, and ultimately to get rid of the uncivilized state actors (by emigration, revolution, or just waiting until you get lucky and they civilize on their own). Civilized state actors granting you due process of law might also not give a damn about your crypto (see, e.g., the UK, where you can be compelled, under criminal penalties, to produce cryptographic keys). They won't torture you, etcetera, but they might deprive you of your freedom. So: don't live in an uncivilized state (either civilize it or emigrate), and then refrain from doing the sorts of things that might cause even a civilized state to come down you like a ton of bricks (i.e., refrain from committing crimes). For added safety use crypto. Nico -- _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0