July 2018 - cypherpunks-legacy

[gsc] Trubanc Web Client Public Beta
by Bill St. Clair 05 Jul '18

05 Jul '18

I've been working since late July on Trubanc, an anonymous, digitally-signed vault and trading system. Inspired by Patrick Chkeroff's Loom.cc, but with digital signatures for security. The first version of a web client is available for beta testing. Check it out. Send me email to get a coupon with the usage tokens you need to register. Site: http://trubanc.com/ Announcement: http://billstclair.com/blog/trubanc_web_client_public_beta.html Client: http://trubanc.com/client/ Client docs: http://trubanc.com/client.html Technical stuff Protocol description: http://trubanc.com/plain-english.html Protocol and database details: http://trubanc.com/viewtext.php?file=doc/db.txt Client database details: http://trubanc.com/viewtext.php?file=doc/client.txt Source viewer: http://trubanc.com/viewtext.php Git archive: http://repo.or.cz/w/Trubanc.git It's open source. Please review for security if you're inclined and able. Mine is a US-based testing and development server only. Hopefully, servers with real assets, hosted in financial-privacy-respecting countries, will follow shortly, maybe run by some of you. -Bill

1 0

[liberationtech] The Emergence of Open and Organized Pro-Government Cyber Attacks in the Middle East: The Case of the Syrian Electronic Army
by Masashi Nishihata 05 Jul '18

05 Jul '18

Citizen Lab Senior Researcher Helmi Noman and the Information Warfare Monitor have released a detailed report on the activities of the Syrian Electronic Army. Since the beginning of the popular uprisings and protests in the Middle East and North Africa, events in the region have been characterized by increased contestation in cyberspace among regime sympathizers, governments, and opposition movements. One component of this contestation is the tendency among governments and networks of citizens supportive of the state to use offensive computer network attacks. Such tactics are supplements to legal, regulatory, and other controls, and technical forms of Internet censorship. For example, a group known as the Iranian Cyber Army has defaced Twitter and Iranian opposition websites. Also, Tunisian political activists and Yemeni oppositional websites have both accused their government security organizations of launching attacks on their sites in an attempt to silence their message and deny access to their content. In this report, we document the activities of the Syrian Electronic Army, which appears to be a case of an open and organized pro-government computer attack group that is actively targeting political opposition and Western websites. Our aim is to assess to what extent we can find evidence of Syrian government assistance for the attack groups, and what the significance of the attacks themselves are for civil society and cyberspace contestation. See the full post here: http://www.infowar-monitor.net/2011/05/7349/ Masashi Nishihata Research Manager, Citizen Lab Munk School of Global Affairs University of Toronto e: masashi(a)kmdi.utoronto.ca w: http://www.citizenlab.org _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [Freedombox-discuss] Debian GNU/Linux on tablet hardware
by Luke Kenneth Casson Leighton 05 Jul '18

05 Jul '18

[for the benefit of the freedombox list, cc'd here: a discussion is taking place - again - on debian-arm about the cost and availability of ARM-based systems. a chipset has been found which meets eben's criteria in mass-volume. actually, is a whopping 25% _below_ eben's expectations of $20, and is 40% lower than the raspberrypi price, with, being a 1ghz Cortex A8 instead of a 700mhz ARM11, roughly 2 to 2.5x better performance.] On Fri, Oct 28, 2011 at 4:07 PM, Phil Endecott <spam_from_debian_arm(a)chezphil.org> wrote: > lsorense(a)csclub.uwaterloo.ca wrote: >> >> On Fri, Oct 28, 2011 at 02:37:06PM +0000, Phil Endecott wrote: >>> >>> Why do you think that? I have personally never seen an "Android >>> motherboard" >>> offered for sale at all, let alone for a low price. >> >> The i.MX53 LOCO board has an android BSP available. Does that qualify? > > It does to me, but Rob doesn't seem to like these "not mass produced", > "relatively expensive" boards; I think his idea of an "android motherboard" > is something from a no-name Chinese tablet manufacturer. i am in touch with such a "no-name" chinese tablet manufacturer. i can negotiate one of those "into existence"... *if* people are willing to commit - publicly so that i can refer the factory to the archives - to buying some. let's work through the costs, and i'll ask the factory to confirm, but it'll be roughly something like this: * the mass-production BOM of a 1ghz Cortex A8 system using the chiprise aka bmorn aka allwinner SoC will be - literally - around the $15 mark. * morphing the "Reference Board Design" into a "FreedomBox-like" device will be about 10 days @ $150 per day (NOT $150 per hour, REALLY $150 per day). * back-caclulating that cost to include it in to the first.. say... 100 units, that's $15 extra per unit. * scaling up on the BOM to 100-only quantities, you prooobbbably need to add about 60% to 70%. * $15 * 1.7 = $25.50 plus $15 amortised over 100 units is $40. * add a reasonable profit margin - say 25% (that's *really* generous btw), that's now $50. * $50 plus shipping, tax and a box, that's about $80 to get it into your hands. $80 is still a f*** of a lot lower than $125 *excluding* shipping for a beagleboard. and, once it hits mass-production and goes world-wide, that $80 becomes about $35, and if you do a "Special FreedomBox Special Order" of 100,000 units, that $35 becomes about $25 *including* shipping and tax. so it's up to you, folks. if you want to see something like this happen, you have to say so. btw - if you want to take over negotiations with the factory, i am quite happy to put anyone who wishes to take over in touch with the factory. i will give you their email address, you can talk directly with them. l. _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[cryptography] OT: Key Internet [DNS] operator VeriSign hit by hackers
by Jeffrey Walton 05 Jul '18

05 Jul '18

http://www.reuters.com/article/2012/02/02/us-hacking-verisign-idUSTRE8110Z8… http://www.msnbc.msn.com/id/46238729/ns/technology_and_science-security/ (Reuters) - VeriSign Inc, the company in charge of delivering people safely to more than half the world's websites, has been hacked repeatedly by outsiders who stole undisclosed information from the leading Internet infrastructure company. The previously unreported breaches occurred in 2010 at the Reston, Virginia-based company, which is ultimately responsible for the integrity of Web addresses ending in .com, .net and .gov. ... The VeriSign attacks were revealed in a quarterly U.S. Securities and Exchange Commission filing in October that followed new guidelines on reporting security breaches to investors. It was the most striking disclosure to emerge in a review by Reuters of more than 2,000 documents mentioning breach risks since the SEC guidance was published. ... _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[liberationtech] The Emergence of Open and Organized Pro-Government Cyber Attacks in the Middle East: The Case of the Syrian Electronic Army
by Masashi Nishihata 05 Jul '18

05 Jul '18

Citizen Lab Senior Researcher Helmi Noman and the Information Warfare Monitor have released a detailed report on the activities of the Syrian Electronic Army. Since the beginning of the popular uprisings and protests in the Middle East and North Africa, events in the region have been characterized by increased contestation in cyberspace among regime sympathizers, governments, and opposition movements. One component of this contestation is the tendency among governments and networks of citizens supportive of the state to use offensive computer network attacks. Such tactics are supplements to legal, regulatory, and other controls, and technical forms of Internet censorship. For example, a group known as the Iranian Cyber Army has defaced Twitter and Iranian opposition websites. Also, Tunisian political activists and Yemeni oppositional websites have both accused their government security organizations of launching attacks on their sites in an attempt to silence their message and deny access to their content. In this report, we document the activities of the Syrian Electronic Army, which appears to be a case of an open and organized pro-government computer attack group that is actively targeting political opposition and Western websites. Our aim is to assess to what extent we can find evidence of Syrian government assistance for the attack groups, and what the significance of the attacks themselves are for civil society and cyberspace contestation. See the full post here: http://www.infowar-monitor.net/2011/05/7349/ Masashi Nishihata Research Manager, Citizen Lab Munk School of Global Affairs University of Toronto e: masashi(a)kmdi.utoronto.ca w: http://www.citizenlab.org _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[p2p-hackers] ePOST: Secure, Severless Email
by Alan Mislove 05 Jul '18

05 Jul '18

As some of you may know, the FreePastry group at Rice University is developing ePOST, a secure, decentralized, p2p email system. The service is provided cooperatively by the user's desktop computers, and ePOST provides better security and fault tolerance than existing email systems. Email exchanged between ePOST users is cryptographically sealed and authenticated and the service remains available even when traditional mail servers have failed. ePOST gives users plenty of email storage (users can use as much as they contribute of their own disk space). Moreover, users don't have to entrust their email to a commercial provider, who may mine thier data, target them with advertisement or start charging them once they're hooked. ePOST has been running as the primary email system for members of our group for over a year. ePOST works by joining a peer-to-peer network running a personal IMAP and SMTP server on your desktop, which is only for your email. ePOST is backward compatible with existing email systems, and your ePOST email address works just like a normal email address - you can send and receive messages from non-ePOST users. Additionally, you can use your existing email clients with ePOST, since ePOST provides standard IMAP and POP3 servers. A few of other features of ePOST are: - support for SSL connections - a data durability layer called Glacier, providing durability with up to 60% member node failures - support for laptops and machines behind NATs - support for networks with routing anomalies More information about ePOST is available at http://www.epostmail.org/. We now welcome additional ePOST users. If you are interested in seting up an ePOST account, please follow the installation instructions posted at http://www.epostmail.org/install.html. Most ePOST users have set up mail forwarding so that a copy of incoming mails are kept on their normal mail server, in addition to being forwarded to their ePOST account. We recommend this setup until ePOST is no longer in beta status, although we have not found an instance yet where using this backup was necessary to recover a lost email. Also, please let us know if you are interested in running a local ePOST ring at your institution. Running such a ring allows organizations to ensure all overlay traffic remains internal to the organization, while maintaining global connectivity. More information on running an organizational ring is available at http://www.epostmail.org/deploy.html. We are currently collecting high-level statistics from all of the ePOST nodes in our deployment for research purposes. These statistics concern the number of overlay messages sent and the amount of data stored on disk. We are not recording the plain text of emails, nor are we examining which users are exchanging emails. If the collection of statistics would prevent you from using ePOST, please don't hesitate to contact us, and we can turn these features off for you. Thanks again for your help, and don't hesitate to ask us any questions, comments, or suggestions, Alan Mislove, Ansley Post, Andreas Haeberlen, and Peter Druschel (epost-team(a)rice.epostmail.org) _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

nym-0.4 released (now includes Javascript)
by Jason Holt 05 Jul '18

05 Jul '18

The most notable feature in this release of nym is that you can now use nym entirely from your web browser: http://www.lunkwill.org/src/nym/javascript/jsnymclient.html Until someone figures out how to create client certificate requests in Javascript, the CA will have to do so instead (or, you could generate the request on a separate machine and paste it in with a trivial hack). This means the CA will know your certificate's private key; this is bad if you want to make sure you can never be impersonated. It's actually good if you want deniability, since you can always claim that the CA chose to impersonate you. There are other miscellaneous bugfixes which break compatibility with earlier versions. Sources (including the javascript client) are available here, as always: http://www.lunkwill.org/src/nym/ -J ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [Freedombox-discuss] Debian GNU/Linux on tablet hardware
by Luke Kenneth Casson Leighton 05 Jul '18

05 Jul '18

[for the benefit of the freedombox list, cc'd here: a discussion is taking place - again - on debian-arm about the cost and availability of ARM-based systems. a chipset has been found which meets eben's criteria in mass-volume. actually, is a whopping 25% _below_ eben's expectations of $20, and is 40% lower than the raspberrypi price, with, being a 1ghz Cortex A8 instead of a 700mhz ARM11, roughly 2 to 2.5x better performance.] On Fri, Oct 28, 2011 at 4:07 PM, Phil Endecott <spam_from_debian_arm(a)chezphil.org> wrote: > lsorense(a)csclub.uwaterloo.ca wrote: >> >> On Fri, Oct 28, 2011 at 02:37:06PM +0000, Phil Endecott wrote: >>> >>> Why do you think that? I have personally never seen an "Android >>> motherboard" >>> offered for sale at all, let alone for a low price. >> >> The i.MX53 LOCO board has an android BSP available. Does that qualify? > > It does to me, but Rob doesn't seem to like these "not mass produced", > "relatively expensive" boards; I think his idea of an "android motherboard" > is something from a no-name Chinese tablet manufacturer. i am in touch with such a "no-name" chinese tablet manufacturer. i can negotiate one of those "into existence"... *if* people are willing to commit - publicly so that i can refer the factory to the archives - to buying some. let's work through the costs, and i'll ask the factory to confirm, but it'll be roughly something like this: * the mass-production BOM of a 1ghz Cortex A8 system using the chiprise aka bmorn aka allwinner SoC will be - literally - around the $15 mark. * morphing the "Reference Board Design" into a "FreedomBox-like" device will be about 10 days @ $150 per day (NOT $150 per hour, REALLY $150 per day). * back-caclulating that cost to include it in to the first.. say... 100 units, that's $15 extra per unit. * scaling up on the BOM to 100-only quantities, you prooobbbably need to add about 60% to 70%. * $15 * 1.7 = $25.50 plus $15 amortised over 100 units is $40. * add a reasonable profit margin - say 25% (that's *really* generous btw), that's now $50. * $50 plus shipping, tax and a box, that's about $80 to get it into your hands. $80 is still a f*** of a lot lower than $125 *excluding* shipping for a beagleboard. and, once it hits mass-production and goes world-wide, that $80 becomes about $35, and if you do a "Special FreedomBox Special Order" of 100,000 units, that $35 becomes about $25 *including* shipping and tax. so it's up to you, folks. if you want to see something like this happen, you have to say so. btw - if you want to take over negotiations with the factory, i am quite happy to put anyone who wishes to take over in touch with the factory. i will give you their email address, you can talk directly with them. l. _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[cryptography] OT: Key Internet [DNS] operator VeriSign hit by hackers
by Jeffrey Walton 05 Jul '18

05 Jul '18

http://www.reuters.com/article/2012/02/02/us-hacking-verisign-idUSTRE8110Z8… http://www.msnbc.msn.com/id/46238729/ns/technology_and_science-security/ (Reuters) - VeriSign Inc, the company in charge of delivering people safely to more than half the world's websites, has been hacked repeatedly by outsiders who stole undisclosed information from the leading Internet infrastructure company. The previously unreported breaches occurred in 2010 at the Reston, Virginia-based company, which is ultimately responsible for the integrity of Web addresses ending in .com, .net and .gov. ... The VeriSign attacks were revealed in a quarterly U.S. Securities and Exchange Commission filing in October that followed new guidelines on reporting security breaches to investors. It was the most striking disclosure to emerge in a review by Reuters of more than 2,000 documents mentioning breach risks since the SEC guidance was published. ... _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Is the Cyberwar beginning?
by A.Cammozzo 05 Jul '18

05 Jul '18

Hello Andreas, thank you for your call for discussion. Consider that cyberwar or netwar is "coming" since 1993 [1]... But what kind of "war" are we expecting? What metaphor should we use to describe the increasing belligerency on the net? Surely not a war fought by the military following a declaration according to formal protocols of the Hague Convention! I think we could consider two different metaphors of the latent form of confrontation we are observing: (1) the pirate-like war fought by the privateer, private person or company authorized by a government, making profit from prize money or bounties. Off metaphor, the "Data Privateer" has the freedom to take advantage from data gathered in commerce raiding or "guerre de course" activities, being under explicit or implicit government immunity. Can we find clues or evidence for this kind of entities? Think for instance of government agencies spying on their own citizens, sometimes acting in grey zones un-encoded by laws, and their contractors. (2) Cyberwar as a vector of Data Colonialism. Considering the Cyberspace a "territory" is a mistake, but following Luciano Floridi "Infosphere" [2] concept, it is the part of a wider environment. In this context the net is a sort of "space-like opportunity" where states do confront not in terms of sovereignty, but with their ability to access to all kind of data resources available, even if protected by other state's laws. This "war" is part of the global political and economic effort to control data as raw material and sell data exploitation infrastructures. To achieve this goal, states must show a twofold ability: to offend, stealing and destroying data and data infrastructures; and to defend, an essential element to maintain a tutelary power on their citizens (data protection) and a political and economic power on countries unable to autonomously develop the same abilities. Of course these two metaphors do overlap some times. This kind of collateral warfare has been going on for years. Sincerely, Alberto [1] Arquilla, John, and David Ronfeldt. "Cyberwar is coming!." Comparative Strategy 12, no. 2 (1993): 141-165. p.28: <<netwar represents a new entry on the spectrum of conflict that spans economic, political, and social as well as military forms of b war.b In contrast to economic wars that target the production and distribution of goods, and political wars that aim at the leadership and institutions of a government, netwars would be distinguished by their targeting of information and communications.>> [2] Floridi, L., 2007. A Look into the Future Impact of ICT on Our Lives. The Information Society, 23(1), p.59-64. On 01/31/2013 09:26 AM, Andreas Bader wrote: > On 01-29-2013 the website http://www.syrian-martyrs.com/ got hacked. > On 01-30-2013 there was a man in the middle attack on GitHub (?). > On 01-27-2013 the Pentagon was boosting the "Cybersecurity Force". > On 01-14-2013 "Red October" was exposed. > And that were only the big incidents in this year. Things like that are > accumulating. Are we slipping in the cyberwar experts are warning of > since years? > I just want to initiate a discussion. Your opinions? > > Sincerely, > > Andreas > -- > Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Alberto Cammozzo http://cammozzo.com/en http://tagmenot.info -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0