July 2018 - cypherpunks-legacy

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

Lynn.Wheeler(a)firstdata.com wrote: > > the current SSL domain name infrastructure supposedly exists because of issues > with trusting the domain name infrastructure ... except the SSL domain name > certificate issuer has to trust the same (untrusted) domain name infrastructure > when issuing a certificate (i.e. the SSL domain name certificate is no better > than the authentication authority that the certificate authority has to rely on > as the final arbitrator of domain name ownership). > > one of the integrity issues with the domain name infrastructure ... is that > domain names have been hijacked ... once hijacked ... you can go to certificate > authority and get a certificate with that domain name (and the certificate > authority will check with the domain name system and confirm that the requester > owns the domain name). The difference is that a CA _also_ binds the certificate to a legal entity. When the fraud is discovered, the identity of the fraudster is, too. Cheers, Ben. -- http://www.apache-ssl.org/ben.html "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

Lynn.Wheeler(a)firstdata.com wrote: > > the current SSL domain name infrastructure supposedly exists because of issues > with trusting the domain name infrastructure ... except the SSL domain name > certificate issuer has to trust the same (untrusted) domain name infrastructure > when issuing a certificate (i.e. the SSL domain name certificate is no better > than the authentication authority that the certificate authority has to rely on > as the final arbitrator of domain name ownership). > > one of the integrity issues with the domain name infrastructure ... is that > domain names have been hijacked ... once hijacked ... you can go to certificate > authority and get a certificate with that domain name (and the certificate > authority will check with the domain name system and confirm that the requester > owns the domain name). The difference is that a CA _also_ binds the certificate to a legal entity. When the fraud is discovered, the identity of the fraudster is, too. Cheers, Ben. -- http://www.apache-ssl.org/ben.html "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

Lynn.Wheeler(a)firstdata.com wrote: > > the current SSL domain name infrastructure supposedly exists because of issues > with trusting the domain name infrastructure ... except the SSL domain name > certificate issuer has to trust the same (untrusted) domain name infrastructure > when issuing a certificate (i.e. the SSL domain name certificate is no better > than the authentication authority that the certificate authority has to rely on > as the final arbitrator of domain name ownership). > > one of the integrity issues with the domain name infrastructure ... is that > domain names have been hijacked ... once hijacked ... you can go to certificate > authority and get a certificate with that domain name (and the certificate > authority will check with the domain name system and confirm that the requester > owns the domain name). The difference is that a CA _also_ binds the certificate to a legal entity. When the fraud is discovered, the identity of the fraudster is, too. Cheers, Ben. -- http://www.apache-ssl.org/ben.html "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

Lynn.Wheeler(a)firstdata.com wrote: > > the current SSL domain name infrastructure supposedly exists because of issues > with trusting the domain name infrastructure ... except the SSL domain name > certificate issuer has to trust the same (untrusted) domain name infrastructure > when issuing a certificate (i.e. the SSL domain name certificate is no better > than the authentication authority that the certificate authority has to rely on > as the final arbitrator of domain name ownership). > > one of the integrity issues with the domain name infrastructure ... is that > domain names have been hijacked ... once hijacked ... you can go to certificate > authority and get a certificate with that domain name (and the certificate > authority will check with the domain name system and confirm that the requester > owns the domain name). The difference is that a CA _also_ binds the certificate to a legal entity. When the fraud is discovered, the identity of the fraudster is, too. Cheers, Ben. -- http://www.apache-ssl.org/ben.html "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

Lynn.Wheeler(a)firstdata.com wrote: > > the current SSL domain name infrastructure supposedly exists because of issues > with trusting the domain name infrastructure ... except the SSL domain name > certificate issuer has to trust the same (untrusted) domain name infrastructure > when issuing a certificate (i.e. the SSL domain name certificate is no better > than the authentication authority that the certificate authority has to rely on > as the final arbitrator of domain name ownership). > > one of the integrity issues with the domain name infrastructure ... is that > domain names have been hijacked ... once hijacked ... you can go to certificate > authority and get a certificate with that domain name (and the certificate > authority will check with the domain name system and confirm that the requester > owns the domain name). The difference is that a CA _also_ binds the certificate to a legal entity. When the fraud is discovered, the identity of the fraudster is, too. Cheers, Ben. -- http://www.apache-ssl.org/ben.html "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff

1 0

Police Acting Like Commandos
by Mike Frese 06 Jul '18

06 Jul '18

Here is a story from last Sunday's Washington Post Magazine about which we should all think carefully. I encourage you to read it all. For those of you not inclined to do so, here is my summary of the key points. A Prince Georges County Sheriff's Special Weapons Attack Team (SWAT) broke down the door of the Cheye Calvo, Mayor of Berwyn Heights, Maryland -- a small community just off the Beltway between College Park and Greenbelt -- killed his and his wife's beloved dogs, and forced her Mother to the floor at gunpoint. The SWAT had a warrant, issued because a shipment of marijuana intercepted at a shipping facility by law enforcement was addressed to the Mayor. The parcel was falsely addressed and intended to be intercepted before delivery by someone working at the shipping facility. The warrant was a knock warrant -- the signing judge did not know the serving officers would break down the door and no one in law enforcement seems to have known that the target was a political figure -- but the Mayor's mother in-law screamed when, through a window, she saw men in black crossing the lawn with long weapons at the ready. In a landmark 1995 case, Wilson v. Arkansas, the US Supreme Court ruled that under exigent circumstances -- such as when there is concern that occupants of the target house might destroy evidence or respond with dangerous force -- those serving a warrant may enter without announcing themselves. But the team was unable to produce the warrant until hours after the raid, so they didn't have it with them, and clearly had no intent of knocking and announcing themselves when they deployed and attacked the Mayor's home and family. So now you get my interpretation. The SWAT pulled on their balaclavas, picked up their weapons, and advanced on the house at the run. The Mayor and his family could not have interpreted those actions as anything other than a criminal home invasion. It says POLICE only on their backs, after all. Their alarm was no unreasonable. If the Calvos had been armed, and had killed the officer who burst through their door, they could very possibly been found innocent of the killing by a jury of their peers by reason of self defense. At least one person has been acquitted in similar circumstances here in New Mexico. Of course, Maryland is not New Mexico. William White, a friend and sometime reader of these missives, recently testified before the legislature in Santa Fe offering a list of procedural restrictions on the use of paramilitary tactics by police. His notes and presentation from his testimony are attached here with his permission. He writes Thank you for the kind words; please feel free to pass along any of the material you'd like. Regarding the article in the W.P., I just got that link last night from Cheye Calvo. He thinks the bill he is pushing in MD has a good chance of passing, and he asked if I would try to get a similar bill introduced in NM. I'm in the process of doing that right now, even though I think chances of passage are slim due to the timing, and the urgency of our budget shortfall. Even so, his hope is that if the bill is being considered in several states at once, it might generate some national coverage and awareness of the problem. With that in mind, you might want to urge your network of folks to contact their legislators to support or co-sponsor a bill. I'll keep you in the loop on my progress, if any. Actually, I'm optimistic of getting a bill introduced. Here are White's reform ideas and suggested restrictions on use of SWAT: Video of all SWAT raids. Liability insurance for officers Premiums by individual/other private source (Not risk management) Condition of employment Point system for substantiated complaintssliding scale Cumulative with time limit. Excess = no certification Prohibit acceptance of forfeiture assets within New Mexico. Prohibit use of National Guard resources for SWAT teams. Higher standard for anywarrant served by SWAT. ONLY for potentially violent suspects. No more raids for simple possession, traffic warrants, medical users, etc. No warrants based solely on snitch evidence. Too often unreliable. No SWAT for suicidal subjects, absent threat to others. No SWAT for welfare checks, absent threat to others. Any raid on a wrong address must be presumptively negligent. Burden shifts to agency. Criminal and Civil. Insurance for damage to property of innocent subjects mandatory for agency. Agency must be presumptively liable for repairs/restitution. i.e. fix it first, then fight it. (Not Risk Management). Require departments to keep statistics on all warrants executed. Purpose (drugs, illegal weapons, fugitive, warrants outstanding, etc). Limits (time of day, no-knock authorized, etc.) Basis (snitch, sworn statement of officer, etc.) Names of affiants, judge, suspect, witness, etc. Names of snitches, confidential informants to be redacted, except in raids of innocent subjects or incorrect address identification. These stats must be available to public under I.P.R.A. (Inspection of Public Records Act. This is New Mexicos version of F.O.I.A.). Limit power of police unions. Prohibit or publicize contributions/ endorsements. I urge you to contact your representatives in Maryland, New Mexico, and elsewhere to urge them to introduce, debate, and pass such a measure. {Dad, Mike}

1 0

Fwd: [Wikitech-l] Planning to tighten TorBlock settings
by Gregory Maxwell 06 Jul '18

06 Jul '18

FYIb ---------- Forwarded message ---------- From: Brion Vibber <brion(a)wikimedia.org> Date: Fri, Apr 3, 2009 at 5:44 AM Subject: [Wikitech-l] Planning to tighten TorBlock settings To: Wikimedia developers <wikitech-l(a)lists.wikimedia.org> en.wikipedia.org and others have seen a rash of abuse coming via Tor in the form of account creations with abusive names and such; this is taking up a large chunk of CheckUser and oversighter time and effort, which is apparently not too fun. It looks like the current settings don't generally restrict various actions to a logged-in user when accessing through Tor; is there any objection to tightening this up to restrict edits, account creations, etc via Tor except when the account is explicitly excepted? -- brion vibber (brion @ wikimedia.org) _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Police Acting Like Commandos
by Mike Frese 06 Jul '18

06 Jul '18

Here is a story from last Sunday's Washington Post Magazine about which we should all think carefully. I encourage you to read it all. For those of you not inclined to do so, here is my summary of the key points. A Prince Georges County Sheriff's Special Weapons Attack Team (SWAT) broke down the door of the Cheye Calvo, Mayor of Berwyn Heights, Maryland -- a small community just off the Beltway between College Park and Greenbelt -- killed his and his wife's beloved dogs, and forced her Mother to the floor at gunpoint. The SWAT had a warrant, issued because a shipment of marijuana intercepted at a shipping facility by law enforcement was addressed to the Mayor. The parcel was falsely addressed and intended to be intercepted before delivery by someone working at the shipping facility. The warrant was a knock warrant -- the signing judge did not know the serving officers would break down the door and no one in law enforcement seems to have known that the target was a political figure -- but the Mayor's mother in-law screamed when, through a window, she saw men in black crossing the lawn with long weapons at the ready. In a landmark 1995 case, Wilson v. Arkansas, the US Supreme Court ruled that under exigent circumstances -- such as when there is concern that occupants of the target house might destroy evidence or respond with dangerous force -- those serving a warrant may enter without announcing themselves. But the team was unable to produce the warrant until hours after the raid, so they didn't have it with them, and clearly had no intent of knocking and announcing themselves when they deployed and attacked the Mayor's home and family. So now you get my interpretation. The SWAT pulled on their balaclavas, picked up their weapons, and advanced on the house at the run. The Mayor and his family could not have interpreted those actions as anything other than a criminal home invasion. It says POLICE only on their backs, after all. Their alarm was no unreasonable. If the Calvos had been armed, and had killed the officer who burst through their door, they could very possibly been found innocent of the killing by a jury of their peers by reason of self defense. At least one person has been acquitted in similar circumstances here in New Mexico. Of course, Maryland is not New Mexico. William White, a friend and sometime reader of these missives, recently testified before the legislature in Santa Fe offering a list of procedural restrictions on the use of paramilitary tactics by police. His notes and presentation from his testimony are attached here with his permission. He writes Thank you for the kind words; please feel free to pass along any of the material you'd like. Regarding the article in the W.P., I just got that link last night from Cheye Calvo. He thinks the bill he is pushing in MD has a good chance of passing, and he asked if I would try to get a similar bill introduced in NM. I'm in the process of doing that right now, even though I think chances of passage are slim due to the timing, and the urgency of our budget shortfall. Even so, his hope is that if the bill is being considered in several states at once, it might generate some national coverage and awareness of the problem. With that in mind, you might want to urge your network of folks to contact their legislators to support or co-sponsor a bill. I'll keep you in the loop on my progress, if any. Actually, I'm optimistic of getting a bill introduced. Here are White's reform ideas and suggested restrictions on use of SWAT: Video of all SWAT raids. Liability insurance for officers Premiums by individual/other private source (Not risk management) Condition of employment Point system for substantiated complaintssliding scale Cumulative with time limit. Excess = no certification Prohibit acceptance of forfeiture assets within New Mexico. Prohibit use of National Guard resources for SWAT teams. Higher standard for anywarrant served by SWAT. ONLY for potentially violent suspects. No more raids for simple possession, traffic warrants, medical users, etc. No warrants based solely on snitch evidence. Too often unreliable. No SWAT for suicidal subjects, absent threat to others. No SWAT for welfare checks, absent threat to others. Any raid on a wrong address must be presumptively negligent. Burden shifts to agency. Criminal and Civil. Insurance for damage to property of innocent subjects mandatory for agency. Agency must be presumptively liable for repairs/restitution. i.e. fix it first, then fight it. (Not Risk Management). Require departments to keep statistics on all warrants executed. Purpose (drugs, illegal weapons, fugitive, warrants outstanding, etc). Limits (time of day, no-knock authorized, etc.) Basis (snitch, sworn statement of officer, etc.) Names of affiants, judge, suspect, witness, etc. Names of snitches, confidential informants to be redacted, except in raids of innocent subjects or incorrect address identification. These stats must be available to public under I.P.R.A. (Inspection of Public Records Act. This is New Mexicos version of F.O.I.A.). Limit power of police unions. Prohibit or publicize contributions/ endorsements. I urge you to contact your representatives in Maryland, New Mexico, and elsewhere to urge them to introduce, debate, and pass such a measure. {Dad, Mike}

1 0

Fwd: [Wikitech-l] Planning to tighten TorBlock settings
by Gregory Maxwell 06 Jul '18

06 Jul '18

FYIb ---------- Forwarded message ---------- From: Brion Vibber <brion(a)wikimedia.org> Date: Fri, Apr 3, 2009 at 5:44 AM Subject: [Wikitech-l] Planning to tighten TorBlock settings To: Wikimedia developers <wikitech-l(a)lists.wikimedia.org> en.wikipedia.org and others have seen a rash of abuse coming via Tor in the form of account creations with abusive names and such; this is taking up a large chunk of CheckUser and oversighter time and effort, which is apparently not too fun. It looks like the current settings don't generally restrict various actions to a logged-in user when accessing through Tor; is there any objection to tightening this up to restrict edits, account creations, etc via Tor except when the account is explicitly excepted? -- brion vibber (brion @ wikimedia.org) _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Targeted Tracking
by liberationtech＠lewman.us 06 Jul '18

06 Jul '18

On Wed, Jul 27, 2011 at 06:39:26PM -0400, r.deibert(a)utoronto.ca wrote 1.3K bytes in 39 lines about: : The Information Warfare Monitor just posted a short security note on "Targeted Tracking", the link for which is here: : http://www.infowar-monitor.net/2011/07/targeted-tracking/ : : Our security analyst discovered some clever ways in which emails are being sent to targets presumably to collect vulnerability intelligence that can be used later on. Please pass along to Tibetan organizations that you may believe are recipients of this email. As the former CTO of an online marketing firm, this is called "getting to know your customer". The only thing suspicious in the email is the dyndns.org domain. Any real marketer would use 2o7.net or some other global tracking system, like google-analytics.com, to see who is hitting their page, and what characteristics each user presents. These systems automatically map the individual and their entire history to this single email. In fact, the more targetted you want your email campaign, the more it costs, on the order of US$0.001 per email sent (yes, that's less than one cent). I believe you when you say these techniques are also being used to target people. However, at the same time, they've been used for the past decade to gather intelligence about customers to better target ads and features about a product. I get emails from many organizations, non-profit and for-profit alike, that are loaded with tracking links, javascript, and other techniques to elucidate my browsing history, browser profile, etc. Some examples sitting in my inbox right now are from CPJ, ACLU, and CIMA. It seems simpler to me for an adversary to simply buy the needed data from an ad network rather than go through all of the trouble of spearfishing. -- Andrew pgp key: 0x74ED336B _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0