July 2018 - cypherpunks-legacy

<nettime> Daniel Henninger: Wikileaks R Us (Wall Street Journal)
by Patrice Riemens 06 Jul '18

06 Jul '18

original to: http://online.wsj.com/article/wonder_land.html (will probably change - Google for actual URL) * WONDER LAND * DECEMBER 2, 2010 WikiLeaks R Us We can't put the Internet genie back in the bottle. By DANIEL HENNINGER There is one certain fix for the WikiLeaks problem: Blow up the Internet. Short of that, there is no obvious answer. This summer I was in a movie line behind two guys, and one said: "I hate Facebook. I wish it had never been invented. But I can't live without it." Welcome to the WikiLeaks problem, which was born along with the Internet itself. What we can't live without may kill us. In October, the Secret Service arrested a Malaysian man in New York who had 400,000 bank-card numbers. He'd hacked them out of the Cleveland Federal Reserve and other financial institutions. Last year a contractor remotely inserted a potentially destructive "logic bomb" on Fannie Mae's servers that could have erased a lot of its data. What about your co-worker? Two years ago, a worker in the City of San Francisco's technology department created a password that let him access virtually all the city's files and business on its FiberWAN network, while blocking access to everyone else. They caught him, but for a while he held the city hostage, refusing to give up his key to the city. Can Bank of America say with certainty they haven't been robbed of the data Julian Assange claims to possess? No, they can't. Once you input anything into the digital ethers, it will never be "safe" or "private." Sun Microsystems' co-founder Scott McNealy famously said: "You have zero privacy. Get over it." We know that. What we don't know, or won't admit, is that the idea of confidentialityState Department cables, the design for weapons systems, health recordshas eroded, perhaps permanently. We can't put the Internet genie back in the bottle. Everyone from Hillary Clinton on down is "shocked" at the cables dump. But if last year one had polled experts on the architecture of data systems about the probability of this event, most would have said it surely would happen, eventually. The Government Accountability Office has released survey after survey on this problem, all singing the same song printed on the front of this June's report: "Cybersecurity: Key Challenges Need to Be Addressed." Congress has thrown dozens of bills at cybersecurity. Is WikiLeaks Obama's fault? No. You could throw the entire IQ capacity of Google's work force at the problem. They might devise a solution, but it wouldn't be the answer. Like the Web itself, it's complicated. Private companies already offer solutions to protecting data systems. "Data-at-rest" and "data-in-motion" programs look for anomalies in emails and other data moving through networks or resting on hard drives. SIM (security information management) software tracks network intrusions. It's pretty good, the way climatology is pretty good. But there's a maddening paradox that this technology poses to any organized group of people trying to use it for good ends: How to set up protocols that will haul in the bad guys without hampering the creative work of everyone else? If the U.S. (or Europe) has one big comparative advantage left, it is an information advantage. Out of the organized serendipity of many smart people bouncing information-laden ideas off each other, good things happen here. Whether workers in a knowledge society are creating advances on cancer or software for the pilotless drones killing our worst enemies, they need lots of information, need it now, and need to "talk" about it on the network with colleagues. That means "odd" but legitimate events are going to occur on one's data network. Separating all the odd from one bad is hard. China's security solution is to suppress the flow of information, let creativity be damned, and steal from us. (The New York Times's Thomas Friedman yesterday asked: "What if China had a WikiLeaker?" The three-word answer: They'd execute him.) The Pentagon, State Department and our banks are at risk because it is hard to define who or what should be monitored. Then each institution would have to create an Orwellian "monitoring" office. Oh wait, we already did thatthe Department of Homeland Security. Problem solved. After 9/11, non-communicating, "stove-piped" federal agencies emerged as a top problem. To open the cross-agency information flow of classified information they created SIPRNet. Now the State Department has pulled the plug on SIPRNet. Ponder this: The CIA never joined SIPRNet and took heat for that. Count me as glad that Assange doesn't have access to data on the agency's anti-Taliban drone program. Two big things transformed the postwar world: nuclear fission and the Internet. Nuclear fission gave us clean energy and the atomic bomb. The Internet? With WikiLeaks, we arrive at the Internet version of putting the nuclear genie back in the bottle. There may be no obvious fix for the paradoxes of this inherently vulnerable technology. But we also can't survive in a digital state of nature. The Internet "A-bomb" will go off eventually. Here's a thought for our befuddled national leadership: The first time humans concluded that they needed to deter bad people from taking advantage of civilization, they set common rules. If people broke them, they put them away. Pfc. Bradley Manning, charged with downloading all that data for Assange, is sitting in a Quantico jail. He could get 52 years. He should. And that's just for starters, if we hope to live with the Internet genie. Write to henninger(a)wsj.com # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mail.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Air travel without ID.
by Trei, Peter 06 Jul '18

06 Jul '18

[For IP, if you wish - pt] >From RISKS 23.50: http://catless.ncl.ac.uk/Risks/23.50.html#subj6 ----------------- U.S. air travel without government identification <Dan Wallach <dwallach(a)cs.rice.edu>> Thu, 19 Aug 2004 19:41:02 -0500 Recently, John Gilmore has been publicly decrying the unstated Federal requirement that one must present government-issued identification (e.g., a driver's license) in order to travel via air within the U.S. Unfortunately for me, I got to test this requirement on a recent trip to give a talk at Fermilab when I managed to leave my driver's license at home. Here's what happened. For what it's worth, I've recently taken to carrying two wallets. The large one has my money, credit cards, receipts, and other assorted junk. The small one has my business cards and the two ID cards I most often need: my driver's license and my university ID card (a magstripe card that I need to get into my building after hours). In order to make my flight at the ungodly hour of 7:35am, I had to get up quite early. In the confusion of the morning, I managed to leave the little wallet at home. I didn't notice this oversight until I was standing in front of the ticket counter at 7:00am. In order to have gotten my driver's license, I would have had to miss my flight. Instead, I decided to see how the system would work without it. == Intercontinental Airport: Houston, Texas I pleaded my case to the Continental ticket agent. "Do you have any picture ID on you at all?" Nope. I showed her my Continental frequent flyer card, my credit card, and my social security card (which I probably shouldn't have had in my wallet, but that's a story for another day) as well as my boarding pass, printed that morning on my home computer. She escorted me to the security guard, with all my cards in her hand, and briefly described the situation. The guards expressed some confusion, but decided to let me through. After that, everything proceeded normally. == Fermilab: Suburban Chicago, Illinois My hosts at Fermilab had helpfully arranged a rental car for me. It dawned on me that I'd never get out of the rental car lot without a driver's license. I called Fermilab's travel agent and explained my predicament. As it turns out, Fermilab has a limo service that they regularly use. The travel agent made a reservation for me with the limo service, who happily picked me up at the airport and delivered me to Fermilab. If you're into high-energy physics, you know all about Fermilab. For the rest of us, they have a ring, about 1km in radius, around which they fling protons and anti-protons at very high energies, arranging for them to collide inside a massive detector. Those high-energy collisions cause all sorts of interesting subatomic particles to come flying out, hopefully to be detected by a variety of impressive devices. (My high school physics teacher quipped that it's like trying to learn how cars work by smashing them together and seeing what falls out.) Before September 11, the Fermilab campus was wide open, and the locals could go fishing in the lake, jogging around the ring, and so forth. These days, you have to go to a guard shack. Visitors get a limited pass and are instructed to only go to specific places where they're allowed (e.g., the education center). I'd been told that a badge would be waiting for me. The guard asked for my ID. "Let me tell you a story," I began. Ultimately, the guard had to telephone my hosts who drove down to the guard shack to pick me up. After that, it was smooth sailing. == O'Hare Airport: Chicago, Illinois Everybody to whom I'd told this story was amazed that I'd gotten as far as I did, and I was repeatedly warned that O'Hare security was quite stringent. Just to make sure, I had the limo get me to the airport a full two hours before my 11:00am flight. I printed out my boarding pass using the Continental kiosk, using my credit card to authenticate myself to the system, and then explained my story to the ticket agent. "Do you have any government issued ID?" Sorry, no. She wrote "SSSS" in big letters on my boarding pass, highlighted it in pink, and pointed me at the security checkpoint: the special security checkpoint without a line in front of it. I walked up and presented my boarding pass to the guard. "ID?" I began my story, but the only phrase that seemed to matter was "No ID", which she wrote onto my boarding pass. She then wrote "SSSS" again and circled it, also circling the original pink-highlighted copy. On I went. First the normal X-ray machine, take your laptop out, etc. Then, on the other side, they gave me the extended treatment, which normally occurs when I've been "randomly" selected. They X-rayed my shoes, swabbed my laptop for explosives, and unzipped every compartment of my luggage. After I passed all of those tests, they let me through, never once examining any of the cards I had in my wallet. Moral of the story While my story is hardly the same thing as a conclusive examination of the policies of all major U.S. airports, my experience shows that it is, indeed, possible to do interstate air travel without a driver's license. You're no longer using the "fast path" of the airport security apparatus, and there is clearly some variation in how the rules govern your slow path through the system. However, if you're willing to put up with the "SSSS" treatment, then it appears that you can legally travel by air within the U.S. without a government-issued ID. (Gilmore acknowledges this in his lawsuit, which is focused on finding out where the requirement for presenting ID came from, in the first place.) Postscript As a Continental frequent flyer, I was invited to show up at the airport to be measured for a new biometric-based system that they've installed in Houston. (I think it measures fingerprints, but I'm not entirely sure.) I was out of town, and thus unable to give that system a shot. They do require several forms of ID to get yourself registered, so it will have to wait for another day. Maybe I'll give it a try and write something about it later for RISKS. For all the known issues with biometric authentication, it's quite difficult to leave your fingerprints at home in the wrong trousers. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[IP] Air travel without ID.
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [Freedombox-discuss] FreedomBox and Bitcoin (and the petition)
by Ted Smith 06 Jul '18

06 Jul '18

On Mon, 2012-11-12 at 22:11 -0800, Jonathan Wilkes wrote: > My initial point might not have been clear. To keep an ISP from spying it makes > no sense to grab a different IP from the pool every time you view a web page-- > this will not impede the ISP from reviewing their log of your activity if they > chose (or were obliged) to do so. Similarly, if the Bitcoin user's intent is > to keep the entire world from being able to tell which Bitcoin transactions are > theirs, spawning a new address only protects them in the laziest of all possible > worlds. In both cases, the very simplistic security measure raises the cost of an attack out of the reach of a large class of attackers. > If they use TAILS the logging I describe most likely goes away, but you didn't say > it's a significant amount of work to spy on users of Bitcoin who are running it on > TAILS-- we were talking about Bitcoin usage in general. In that case the user's > IP can (and probably does in some cases on blockchain.info) get tied to the > user's transaction. The ease with which the owner of that IP address can be > revealed is a separate matter. Using Bitcoin without Tor and generating a new address for each transaction probably protects you against: * any moderately-skilled 14 year old * local law enforcement * your ISP And several other classes of attacker below the level of, say, the FBI. > Wrt FBX I suppose this wouldn't matter if FBX were being designed from the start to > communicate exclusively over Tor, but that doesn't sound like the plan, so we > have to assess the software in terms of how it works on the normal internet, even if > TAILS solves all the problems I'm talking about (which I think it does). TAILS is just a system that forces all connections over Tor. There are ways to force only specific applications to use Tor that the FBX can use pretty easily. Since the FBX will write the FBX bitcoin client package, it can configure bitcoin to, by default, only use Tor. This isn't hard to do, and since this cheap measure puts Bitcoin out of the reach of Dan Kaminsky, I'm not very worried about claims of bitcoin's anonymity. For reference, it's really, really, really hard to take web browsing and make it anonymous. Forcing every connection from browsers to go through Tor won't help you anywhere near as much as it does for Bitcoin. Bitcoin has already done 99% of the hard work building a protocol that is totally (as far as either of us can tell) anonymous if it's _just_ tunneled through Tor without any other filtering. -- Sent from Ubuntu _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Torbutton 1.1.15-alpha released
by Mike Perry 06 Jul '18

06 Jul '18

Torbutton 1.1.15-alpha has been released at https://torbutton.torproject.org/dev/. Those of you who installed Torbutton 1.1.14 should also be able to fetch the latest version now by simply clicking Find Updates in the addons window. This release features a number of fixes for bugs discovered by Gregory Fleischer. Greg discovered a way to unmask the Javascript hooks for window.screen, window.history, window.Date and window.navigator. It is technically possible to use an unmasked window.history object in combination with an exploit for Firefox Bug 409737 to write Javascript that waits for Tor to be disabled to connect to a site via your IP. The Date unmasking unfortunately has not been fixed due to idiosyncrasies with the way the Date class is implemented in the Firefox Javascript interpreter. This means it is possible for a malicious website or exit node to determine your timezone if they perform Greg's attack to unmask the original Date implementation from behind the hooks. It appears that the only way to fix this issue is to implement a fix for either Firefox Bug 392274 or 419598. Here is the complete ChangeLog for 1.1.15: * bugfix: Fix hook unmasking of window.screen, window.history, and window.navigator discovered by Greg Fleischer. window.Date unmasking is still unfixed. window.history unmasking represents potential IP disclosure due to Firefox Bug 409737. * bugfix: Fix view-source extension disclosure bug found by Greg Fleischer. * bugfix: Fix javascript and about links. Found by Greg Fleischer. * new: Attempt to prevent window sizes from drifting during resize. -- Mike Perry Mad Computer Scientist fscked.org evil labs ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

another privacy survey
by Sonia Arrison 06 Jul '18

06 Jul '18

"Ranks of Privacy 'Pragmatists' Are Growing" Most Americans support the dissemination of data contained in public records, but they also say that there must be a legitimate legal or social reason for the extraction of this data, according to a recent survey conducted by Privacy and American Business and ORC International. As long as the information is not abused, most Americans support the use of personal data on the Internet for commercial purposes. This support includes the use of home or work addresses by law enforcement, potential employers, or consumer credit companies. Those surveyed believe it is less acceptable to allow private investigators or ordinary citizens to access the information. The 1,000 people surveyed in the report also say that they object to the government posting personally identifiable public information on the Internet unless there are safeguards. These safeguards include the government requiring the consent of the individual before personal information is displayed on public record, and requesting a specific purpose for such information to be displayed on the Internet. Privacy and American Business President Alan Westin says that more Americans now fall into the category of "privacy pragmatist" rather than "privacy fundamentalist." Ron Plesser of Piper Marbury Rudnick & Wolf says that the Internet industry must determine how to properly use Social Security numbers. "Regulating the purchase and sale of Social Security numbers over the Internet won't come overnight," Plesser says. http://www.acm.org/technews/articles/2000-2/1211m.html#item6

1 0

The Word Spy for 10/06/2003 -- declinism
by Paul McFedries 06 Jul '18

06 Jul '18

declinism (dee.CLYN.iz.um) n. The belief that something, particularly a country or a political or economic system, is undergoing a significant and possibly irreversible decline. --declinist n., adj. Example Citation --------------------------------- The declinists, we might say, will always be with us. Wherever anyone believes in progress, someone, possibly the same one, believes in decline. Declinism emerges today from the triumphalism of the right: In our greatness, conservatives say, there is much to lose, and many who threaten us. So, too, does it emerge from the pessimism of the left: Power corrupts, and the corrupt will get their comeuppance. At present, both impulses--triumphalist and pessimistic, chest-beating and self-lacerating--are on the upsurge. So too, then, declinism. --Laura Secor, "That sinking feeling," The Boston Globe, September 14, 2003 Backgrounder --------------------------------- Declinism has been called the "apocalypse soon" school of international relations. The word was coined in 1988 by Samuel P. Huntington (see the first use, below), but the noun "declinist" appears in the Oxford English Dictionary, where a citation from 1831 mentions the "doctrine of the decline of science" and labels one of its proponents as "the leader of the Declinists." The opposite is "triumphalism," which originally (circa 1964) referred to excessive or blind pride in the achievements of one's religion or church, but now has a broader mandate in the language (for example, excessive or blind pride in the achievements of one's country). Example Citation #2 --------------------------------- Nearly every sentiment and idea that Franzen relays about the fallen preeminence of literature has been expressed before, and better. No one needs to be reminded for the umpteenth time that Dickens was a popular sensation and that the audiences that once clamored at the docks for news of Little Nell now queue at the multiplex or congregate in cyberspace. Like Broadway, the fabulous invalid, the serious novel has seemed poised to breathe its last ever since electricity entered the home. As a cultural analyst, Franzen is simply the latest to join the chorus line of declinism: Gore Vidal has been signing the novel's death certificate for a half-century. --James Wolcott, "Advertisements for Himself," The New Republic, December 2, 2002 First Use --------------------------------- In 1988 the United States reached the zenith of its fifth wave of declinism since the 1950s. The roots of this phenomenon lie in the political economy literature of the early 1980s that analyzed the fading American economic hegemony and attempted to identify the consequences of its disappearance. ... Although predominantly of a liberal-leftist hue, declinist writings reflect varying political philosophies and make many different claims. In general, however, they offer three core propositions. First, the United States is declining economically compared to other market economy countries, most notably Japan but also Europe and the newly industrializing countries. The declinists focus on economic performance and on scientific, technological and educations factors presumably related to economic performance. Second, economic power is the central element of a nation's strength, and hence a decline in economic power eventually affects the other dimensions of national power. Third, the relative economic decline of the United States is caused primarily by its spending too much for military purposes, which in turn is the result, in Kennedy's phrase, of "imperial overstretch," of attempting to maintain commitments abroad that the country can no longer afford. --Samuel P. Huntington," The U.S. -- Decline or Renewal?," Foreign Affairs, December 1, 1988 See Also --------------------------------- bads: http://www.wordspy.com/words/bads.asp boomsayer: http://www.wordspy.com/words/boomsayer.asp dread merchant: http://www.wordspy.com/words/dreadmerchant.asp hyper-power: http://www.wordspy.com/words/hyper-power.asp panic merchants: http://www.wordspy.com/words/panicmerchants.asp soft power: http://www.wordspy.com/words/softpower.asp Subject Categories --------------------------------- Business - Economics: http://www.wordspy.com/index/Business-Economics.asp The World - Government: http://www.wordspy.com/index/TheWorld-Government.asp The World - Politics: http://www.wordspy.com/index/TheWorld-Politics.asp Words About Words --------------------------------- English is a language that simply cannot be fixed, not can its use ever be absolutely laid down. It changes constantly; it grows with an almost exponential joy. It evolves eternally; its words alter their senses and their meanings subtly, slowly, or speedily according to fashion and need. --Simon Winchester, English author, The Meaning of Everything, 2003 Subscription Stuff --------------------------------- If this post was forwarded to you and you want to join the Word Spy list, it's easy. Just send an e-mail to listmanager(a)logophilia.com and in the Subject line include the command "join wordspy". To try the HTML version of Word Spy, send a note to listmanager(a)logophilia.com and include the command "html wordspy" in the Subject line. You are currently subscribed as rah(a)shipwright.com. To drop this address from the list, you have two choices: Send a message to listmanager(a)logophilia.com and include only the command "leave wordspy" (without the quotation marks) in the Subject line. Or, Use the following Web address: http://www.wordspy.com/list/remove.asp?Email=rah@shipwright.com&ID=26169 ======================================================== --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[Politech] Mandatory data retention resurfaces; Gonzales, Mueller call for 2-year rule [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

I've been busy at work writing a series of articles about what's going on in terms of forcing Internet service providers to snoop on Americans. Basically Attorney General Gonzales and FBI Director Mueller met with Internet and telecom companies (including Microsoft, Google, Verizon, and Comcast) last Friday and called on them to store data about users' activities for two years: http://news.com.com/2100-1028_3-6077654.html Until that meeting, Gonzales and the Justice Department had been saying this would be useful for child porn fighting. Now they've realized (took 'em long enough) that (a) the stored data would be useful for terrorism investigations and (b) it might be politically convenient to pitch it as an anti-terrorism measure: http://news.com.com/2100-1028_3-6078229.html Companies aren't very happy about this. And of course any such know-your-user law would presumably apply to libraries, schools, and coffee shops as well: http://news.com.com/2100-1028_3-6078689.html Looking ahead a few years, assuming that data retention is adopted, it's unclear that the Feds would stop there. Imagine a shocking horrible tragedy could have been prevented if only even more expansive laws had been adopted on top of data retention. The end game eventually could involve (a) making it unlawful to offer Internet access without verifying identities, effectively shutting down open WiFi nodes and (b) restricting the use of encryption and anonymity services -- after all, what good is a pile of retained data if it doesn't tell you very much? This is sheer speculation, mind you. But then again a House of Representatives committee once approved a bill that would make it unlawful to sell encryption products without backdoors for the Feds. And Sen. Judd Gregg talked about restricting encryption products soon after 9/11, so perhaps it's not _that_ unlikely either. One other thing worth thinking about in terms of the Washington endgame. The Internet providers I've talked to have been generally opposed to the idea. But one of their primary complaints is the logical one of how much it will cost. If the Feds decide to write them a fat check, their complaints could evaporate and the legislation would instantly experience far less opposition. Watch for this; it would follow what happened with CALEA. Here's Microsoft's statement on data retention: http://news.com.com/2100-1028_3-6078711.html Or, if you prefer, CNN and USA Today coverage of the topic: http://www.usatoday.com/tech/news/internetprivacy/2006-05-31-internet-recor… _x.htm http://money.cnn.com/2006/05/30/technology/justice_internet/ -Declan _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Torbutton 1.1.15-alpha released
by Mike Perry 06 Jul '18

06 Jul '18

Torbutton 1.1.15-alpha has been released at https://torbutton.torproject.org/dev/. Those of you who installed Torbutton 1.1.14 should also be able to fetch the latest version now by simply clicking Find Updates in the addons window. This release features a number of fixes for bugs discovered by Gregory Fleischer. Greg discovered a way to unmask the Javascript hooks for window.screen, window.history, window.Date and window.navigator. It is technically possible to use an unmasked window.history object in combination with an exploit for Firefox Bug 409737 to write Javascript that waits for Tor to be disabled to connect to a site via your IP. The Date unmasking unfortunately has not been fixed due to idiosyncrasies with the way the Date class is implemented in the Firefox Javascript interpreter. This means it is possible for a malicious website or exit node to determine your timezone if they perform Greg's attack to unmask the original Date implementation from behind the hooks. It appears that the only way to fix this issue is to implement a fix for either Firefox Bug 392274 or 419598. Here is the complete ChangeLog for 1.1.15: * bugfix: Fix hook unmasking of window.screen, window.history, and window.navigator discovered by Greg Fleischer. window.Date unmasking is still unfixed. window.history unmasking represents potential IP disclosure due to Firefox Bug 409737. * bugfix: Fix view-source extension disclosure bug found by Greg Fleischer. * bugfix: Fix javascript and about links. Found by Greg Fleischer. * new: Attempt to prevent window sizes from drifting during resize. -- Mike Perry Mad Computer Scientist fscked.org evil labs ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Reliably Erasing Data From Flash-Based Solid State Drives
by Alexander Klimov 06 Jul '18

06 Jul '18

It is also harder to rely on SSD as evidence. <http://www.jdfsl.org/subscriptions/JDFSL-V5N3-Bell.pdf> Digital evidence is increasingly relied upon in computer forensic examinations and legal proceedings in the modern courtroom. The primary storage technology used for digital information has remained constant over the last two decades, in the form of the magnetic disc. Consequently, investigative, forensic, and judicial procedures are well-established for magnetic disc storage devices (Carrier, 2005). However, a paradigm shift has taken place in technology storage and complex, transistor-based devices for primary storage are now increasingly common. Most people are aware of the transition from portable magnetic floppy discs to portable USB transistor flash devices, yet the transition from magnetic hard drives to solid-state drives inside modern computers has so far attracted very little attention from the research community. Here we show that it is imprudent and potentially reckless to rely on existing evidence collection processes and procedures, and we demonstrate that conventional assumptions about the behaviour of storage media are no longer valid. In particular, we demonstrate that modern storage devices can operate under their own volition in the absence of computer instructions. Such operations are highly destructive of traditionally recoverable data. This can contaminate evidence; can obfuscate and make validation of digital evidence reports difficult; can complicate the process of live and dead analysis recovery; and can complicate and frustrate the post recovery forensic analysis. Our experimental findings demonstrate that solid-state drives (SSDs) have the capacity to destroy evidence catastrophically under their own volition, in the absence of specific instructions to do so from a computer. -- Regards, ASK _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0