July 2018 - cypherpunks-legacy

Federal Agencies Secretly Sharing Passenger Data
by Barry Steinhardt 06 Jul '18

06 Jul '18

Dave, It has come to light that Department of Homeland Security (DHS) signed a secret agreement with the Centers for Disease Control to share airline passenger information. This despite the fact that a public comment period is underway before the CDC over that agency's effort to institute its own CAPPS II/Secure Flight-style airline data collection regime. And, despite the fact that such sharing appears to violate the conditions of the US-EU agreement that was reached to allow the sharing of European passenger data with the US government. The secret agreement was referenced in a little-noticed paragraph in comments filed with the CDC by the Air Transport Association. We have filed a FOIA seeking information on the agreement. A press release as well as our FOIA and our previous comments on the issue to the CDC can be found athttp://www.aclu.org/privacy/spying/ 25246prs20060421.html An article on the secret agreement, which was first noticed by Federal Computer Week, is online at http://www.fcw.com/ article94142-04-20-06-Web The ATA's comments to the CDC, which includes the paragraph disclosing the agreement on page 5, is at http://www.cdc.gov/ncidod/ dq/nprm/comments/2006Mar1_ATA.pdf Barry Steinhardt Director Technology and Liberty Project ACLU Director Technology and Liberty Project ACLU 125 Broad Street NYC 10004 212 549 2508 (o) 917 412 7139 (mobile) ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Federal Agencies Secretly Sharing Passenger Data
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

RFC 4772 on Security Implications of Using the Data Encryption Standard (DES)
by rfc-editor＠rfc-editor.org 06 Jul '18

06 Jul '18

A new Request for Comments is now available in online RFC libraries. RFC 4772 Title: Security Implications of Using the Data Encryption Standard (DES) Author: S. Kelly Status: Informational Date: December 2006 Mailbox: scott(a)hyperthought.com Pages: 28 Characters: 68524 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-kelly-saag-des-implications-06.txt URL: http://www.rfc-editor.org/rfc/rfc4772.txt The Data Encryption Standard (DES) is susceptible to brute-force attacks, which are well within the reach of a modestly financed adversary. As a result, DES has been deprecated, and replaced by the Advanced Encryption Standard (AES). Nonetheless, many applications continue to rely on DES for security, and designers and implementers continue to support it in new applications. While this is not always inappropriate, it frequently is. This note discusses DES security implications in detail, so that designers and implementers have all the information they need to make judicious decisions regarding its use. This memo provides information for the Internet community. INFORMATIONAL: This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF list and the RFC-DIST list. Requests to be added to or deleted from the IETF distribution list should be sent to IETF-REQUEST(a)IETF.ORG. Requests to be added to or deleted from the RFC-DIST distribution list should be sent to RFC-DIST-REQUEST(a)RFC-EDITOR.ORG. Details on obtaining RFCs via FTP or EMAIL may be obtained by sending an EMAIL message to rfc-info(a)RFC-EDITOR.ORG with the message body help: ways_to_get_rfcs. For example: To: rfc-info(a)RFC-EDITOR.ORG Subject: getting rfcs help: ways_to_get_rfcs Requests for special distribution should be addressed to either the author of the RFC in question, or to RFC-Manager(a)RFC-EDITOR.ORG. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. Submissions for Requests for Comments should be sent to RFC-EDITOR(a)RFC-EDITOR.ORG. Please consult RFC 2223, Instructions to RFC Authors, for further information. The RFC Editor Team USC/Information Sciences Institute ... _______________________________________________ IETF-Announce mailing list IETF-Announce(a)ietf.org https://www1.ietf.org/mailman/listinfo/ietf-announce --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[cryptography] crypto & security/privacy balance (Re: Digital cash in the news...)
by Adam Back 06 Jul '18

06 Jul '18

Well said StealthMonger, I suspect Nico is in the minority on this list with that type of view. I read Nico's later reply also. Short of banning crypto privacy and security rights stand a better chance of being balanced by more deployment of crypto. (In terms of warrantless wiretaps etc which seem to just keeping going and getting worse in many supposedly civilized western democracies.) There are still plenty of things government security people can usefully do towards security - spend the money on inflitration of groups who are real security threats. I would say privacy tech & crypto is essential to maintaining a good point on the security/privacy balance in a world where security policy encroachment has gone into overdrive. To retain electronic liberty, crypto is the answer. I dont think crypto can be realistically banned in western countries at this stage, the electronic part of security encroachment is mostly opportunistic hoovering up things that are not protected. There are multiple privacy properties - confidentiality of communication contents, privacy of association (cryptographic freedom of association) like pseudonymous email (protection against traffic analysis), cryptographic enforced member only discussion groups/chats. Then there are countries where crypto is officially or effectively already banned - there being caught with privacy tech on your laptop, cell phone etc would be dangerous. Crypto and other privacy techniques can counteract somewhat - with steganography, that though obviously its a tough threat model. See http://www.nytimes.com/2011/06/12/world/12internet.html?_r=1 Its also a kind of interesting conflict that western governments think of themselves, or try to portray themselves as moral forces of good and yet there are a few cases where this technology the US is helping fund really needs to be used in western democracies, including the US. The UK governments right to force key disclosure is an abomination, no civilized country should be going in that direction. Adam On Tue, Jun 14, 2011 at 10:30:18PM +0100, StealthMonger wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Nico Williams <nico(a)cryptonector.com> writes: > >> Crypto will NOT protect you from the state. > > Hmm? Protection from the state is the very reason some of us are > here. Even Philip Zimmermann wrote twenty years ago [1] > > Why Do You Need PGP? ... you may be doing something that you feel > shouldn't be illegal, but is. > > And the very title of David Chaum's 1985 paper was "Security without > Identification: Transaction Systems to Make Big Brother Obsolete" [2] > > [1] pgpdoc1.txt > > [2] CACM 28(10), October 1985 _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Newbie Question
by Marsh Ray 06 Jul '18

06 Jul '18

On 12/01/2011 11:11 PM, Sampo Syreeni wrote: > On 2011-12-01, Randall Webmail wrote: > >> I am an almost-complete greenie WRT crypto, which is why I'm here >> to learn. >> >> What is the proper thing to do when one of those things pops up? >> (It is NOT a rare event). > > They mostly mean you no harm. You don't know that. For all we know, Randall Webmail is someone who posted something derogatory about the King or El Presidente and when the Honor Police get on his Facebook they're going to round up all his friends along with him. Or he's sitting comfortably in his quite suburban home and he happens to have one of the estimated 1M home routers that are pwned or 1M PCs with the dnschanger trojan and his banking session is being redirected to a hostile server. http://www.eweek.com/c/a/Security/Researchers-Discover-Link-Between-TDSS-Ro… > So just accept/except. This is not good advice. > But always bear in mind that it *could* be a man-in-the-middle > attack. All legitimate secure sites have a valid certificate, or the site is horribly broken. If you ask for a secure site, and are presented with a certificate that was not issued to the legitimate site, it *is* a man-in-the-middle attack, by definition. Just because you're staying in a hotel does not mean that you must allow that hotel to intercept your secure communications. Furthermore, you probably have know way of knowing that it even is the hotel that's intercepting you. Hotel networks are not known for themselves being secure, and authentication systems tend not to degrade gracefully. - Marsh _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Federal Agencies Secretly Sharing Passenger Data
by Barry Steinhardt 06 Jul '18

06 Jul '18

Dave, It has come to light that Department of Homeland Security (DHS) signed a secret agreement with the Centers for Disease Control to share airline passenger information. This despite the fact that a public comment period is underway before the CDC over that agency's effort to institute its own CAPPS II/Secure Flight-style airline data collection regime. And, despite the fact that such sharing appears to violate the conditions of the US-EU agreement that was reached to allow the sharing of European passenger data with the US government. The secret agreement was referenced in a little-noticed paragraph in comments filed with the CDC by the Air Transport Association. We have filed a FOIA seeking information on the agreement. A press release as well as our FOIA and our previous comments on the issue to the CDC can be found athttp://www.aclu.org/privacy/spying/ 25246prs20060421.html An article on the secret agreement, which was first noticed by Federal Computer Week, is online at http://www.fcw.com/ article94142-04-20-06-Web The ATA's comments to the CDC, which includes the paragraph disclosing the agreement on page 5, is at http://www.cdc.gov/ncidod/ dq/nprm/comments/2006Mar1_ATA.pdf Barry Steinhardt Director Technology and Liberty Project ACLU Director Technology and Liberty Project ACLU 125 Broad Street NYC 10004 212 549 2508 (o) 917 412 7139 (mobile) ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Federal Agencies Secretly Sharing Passenger Data
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

RFC 4772 on Security Implications of Using the Data Encryption Standard (DES)
by rfc-editor＠rfc-editor.org 06 Jul '18

06 Jul '18

A new Request for Comments is now available in online RFC libraries. RFC 4772 Title: Security Implications of Using the Data Encryption Standard (DES) Author: S. Kelly Status: Informational Date: December 2006 Mailbox: scott(a)hyperthought.com Pages: 28 Characters: 68524 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-kelly-saag-des-implications-06.txt URL: http://www.rfc-editor.org/rfc/rfc4772.txt The Data Encryption Standard (DES) is susceptible to brute-force attacks, which are well within the reach of a modestly financed adversary. As a result, DES has been deprecated, and replaced by the Advanced Encryption Standard (AES). Nonetheless, many applications continue to rely on DES for security, and designers and implementers continue to support it in new applications. While this is not always inappropriate, it frequently is. This note discusses DES security implications in detail, so that designers and implementers have all the information they need to make judicious decisions regarding its use. This memo provides information for the Internet community. INFORMATIONAL: This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF list and the RFC-DIST list. Requests to be added to or deleted from the IETF distribution list should be sent to IETF-REQUEST(a)IETF.ORG. Requests to be added to or deleted from the RFC-DIST distribution list should be sent to RFC-DIST-REQUEST(a)RFC-EDITOR.ORG. Details on obtaining RFCs via FTP or EMAIL may be obtained by sending an EMAIL message to rfc-info(a)RFC-EDITOR.ORG with the message body help: ways_to_get_rfcs. For example: To: rfc-info(a)RFC-EDITOR.ORG Subject: getting rfcs help: ways_to_get_rfcs Requests for special distribution should be addressed to either the author of the RFC in question, or to RFC-Manager(a)RFC-EDITOR.ORG. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. Submissions for Requests for Comments should be sent to RFC-EDITOR(a)RFC-EDITOR.ORG. Please consult RFC 2223, Instructions to RFC Authors, for further information. The RFC Editor Team USC/Information Sciences Institute ... _______________________________________________ IETF-Announce mailing list IETF-Announce(a)ietf.org https://www1.ietf.org/mailman/listinfo/ietf-announce --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[cryptography] crypto & security/privacy balance (Re: Digital cash in the news...)
by Adam Back 06 Jul '18

06 Jul '18

Well said StealthMonger, I suspect Nico is in the minority on this list with that type of view. I read Nico's later reply also. Short of banning crypto privacy and security rights stand a better chance of being balanced by more deployment of crypto. (In terms of warrantless wiretaps etc which seem to just keeping going and getting worse in many supposedly civilized western democracies.) There are still plenty of things government security people can usefully do towards security - spend the money on inflitration of groups who are real security threats. I would say privacy tech & crypto is essential to maintaining a good point on the security/privacy balance in a world where security policy encroachment has gone into overdrive. To retain electronic liberty, crypto is the answer. I dont think crypto can be realistically banned in western countries at this stage, the electronic part of security encroachment is mostly opportunistic hoovering up things that are not protected. There are multiple privacy properties - confidentiality of communication contents, privacy of association (cryptographic freedom of association) like pseudonymous email (protection against traffic analysis), cryptographic enforced member only discussion groups/chats. Then there are countries where crypto is officially or effectively already banned - there being caught with privacy tech on your laptop, cell phone etc would be dangerous. Crypto and other privacy techniques can counteract somewhat - with steganography, that though obviously its a tough threat model. See http://www.nytimes.com/2011/06/12/world/12internet.html?_r=1 Its also a kind of interesting conflict that western governments think of themselves, or try to portray themselves as moral forces of good and yet there are a few cases where this technology the US is helping fund really needs to be used in western democracies, including the US. The UK governments right to force key disclosure is an abomination, no civilized country should be going in that direction. Adam On Tue, Jun 14, 2011 at 10:30:18PM +0100, StealthMonger wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Nico Williams <nico(a)cryptonector.com> writes: > >> Crypto will NOT protect you from the state. > > Hmm? Protection from the state is the very reason some of us are > here. Even Philip Zimmermann wrote twenty years ago [1] > > Why Do You Need PGP? ... you may be doing something that you feel > shouldn't be illegal, but is. > > And the very title of David Chaum's 1985 paper was "Security without > Identification: Transaction Systems to Make Big Brother Obsolete" [2] > > [1] pgpdoc1.txt > > [2] CACM 28(10), October 1985 _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Newbie Question
by Marsh Ray 06 Jul '18

06 Jul '18

On 12/01/2011 11:11 PM, Sampo Syreeni wrote: > On 2011-12-01, Randall Webmail wrote: > >> I am an almost-complete greenie WRT crypto, which is why I'm here >> to learn. >> >> What is the proper thing to do when one of those things pops up? >> (It is NOT a rare event). > > They mostly mean you no harm. You don't know that. For all we know, Randall Webmail is someone who posted something derogatory about the King or El Presidente and when the Honor Police get on his Facebook they're going to round up all his friends along with him. Or he's sitting comfortably in his quite suburban home and he happens to have one of the estimated 1M home routers that are pwned or 1M PCs with the dnschanger trojan and his banking session is being redirected to a hostile server. http://www.eweek.com/c/a/Security/Researchers-Discover-Link-Between-TDSS-Ro… > So just accept/except. This is not good advice. > But always bear in mind that it *could* be a man-in-the-middle > attack. All legitimate secure sites have a valid certificate, or the site is horribly broken. If you ask for a secure site, and are presented with a certificate that was not issued to the legitimate site, it *is* a man-in-the-middle attack, by definition. Just because you're staying in a hotel does not mean that you must allow that hotel to intercept your secure communications. Furthermore, you probably have know way of knowing that it even is the hotel that's intercepting you. Hotel networks are not known for themselves being secure, and authentication systems tend not to degrade gracefully. - Marsh _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0