July 2018 - cypherpunks-legacy

seeking information for Wired News article
by Danit Lidor 06 Jul '18

06 Jul '18

Hi there, I am a reporter at Wired News. We received notice of the upcoming Cypherpunks10th anniversary bash. I am thinking of writing a short article about the history and current status of the cypherpunk community. Obviously, things have changed a lot in the last 10 years. I imagine that you and other cypherpunks would have much to say on the topic. Please feel free to rant and rave to me about whatever you feel would be relevant to this kind of article. When did the Cypherpunks come into existence? Who were the founding members? What was the inital purpose? What kinds of people are involved? Who (socially, i mean, not names!) exactly are the members of the group? How many at any one time? Is it a rotating membership, with people coming and going? There has been a substantial amount of press dedicated to the Cypherpunks, what's been the community response? Have their been internal discussions about the repercussions of the media's involvment and the like? WN has had a very familiar relationship with the cypherpunks - has it been viewed as a positive thing? Have the ideals of the group changed over the years? Are there any manifestos or official statements from the group that I can access? What are the future plans for the cypherpunks? I attempted to access cypherpunks.com but most of the links are dead, why isn't anyone maintaining it? Or is it unrelated to the current community? With whom else are the cypherpunks allied? What do you, personally, have to say about the future of the Internet, privacy, legislation, hacking, phreaking, cyber terrorism, the governement. etc? and finally, who else should I be talking to? Thanks for your time. I am hoping to get the story done before the end of next week (i.e. before the actual party.) Of course, I would never publish the location of the party or any other information that you don't feel comfortable about. Danit Lidor I am also available at 415.276.3925. please leave me a message if I'm away from my desk. I am more than happy to call you back. --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: [p2p-hackers] SHA1 broken?
by Gordon Mohr (＠ Bitzi) 06 Jul '18

06 Jul '18

Serguei Osokine wrote: >># * collisions in the the full SHA-1 in 2**69 hash operations, >># much less than the brute-force attack of 2**80 operations... > > > Okay, so the effective SHA-1 length is 138 bits instead of full > 160 - so what's the big deal? If the results hold up: SHA1 is not as strong as it was designed to be, and its effective strength is being sent in the wrong direction, rather than being confirmed, by new research. Even while maintaining that SHA1 was unbroken and likely to remain so just last week, NIST was still recommending that SHA1 be phased out of government use by 2010: http://www.fcw.com/fcw/articles/2005/0207/web-hash-02-07-05.asp One more paper from a group of precocious researchers anywhere in the world, or unpublished result exploited in secret, could topple SHA1 from practical use entirely. Of course, that's remotely possible with any hash, but the pattern of recent results suggest that a further break is now more likely with SHA1 (and related hashes) than others. So the big deal would be: don't rely on SHA1 in any applications you intend to have a long effective life. > It is still way more than, say, MD5 > length. And MD5 is still widely used for stuff like content id'ing > in various systems, because even 128 bits is quite a lot, never > mind 138 bits. Just because it's widely used doesn't mean it's a good idea. MD5 should not be used for content identification, given the ability to create content pairs with the same MD5, with one version being (and appearing and acquiring a reputation for being) innocuous, and the other version malicious. - Gordon @ Bitzi _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[IP] Collecting of Details on Travelers Documented - washingtonpost.com
by David Farber 06 Jul '18

06 Jul '18

[1]http://www.washingtonpost.com/wp-dyn/content/article/2007/09/21/AR2 007092102347.html?hpid=topnews Collecting of Details on Travelers Documented U.S. Effort More Extensive Than Previously Known By [2]Ellen Nakashima Washington Post Staff Writer Saturday, September 22, 2007; Page A01 The U.S. government is collecting electronic records on the travel habits of millions of Americans who fly, drive or take cruises abroad, retaining data on the persons with whom they travel or plan to stay, the personal items they carry during their journeys, and even the books that travelers have carried, according to documents obtained by a group of civil liberties advocates and statements by government officials. The personal travel records are meant to be stored for as long as 15 years, as part of the [3]Department of Homeland Security's effort to assess the security threat posed by all travelers entering the country. Officials say the records, which are analyzed by the department's Automated Targeting System, help border officials distinguish potential terrorists from innocent people entering the country. <snip> _________________________________________________________________ [4]Archives [5][feed-icon-10x10.jpg] [6]Powered by Listbox References 1. http://www.washingtonpost.com/wp-dyn/content/article/2007/09/21/AR200709210… 2. http://projects.washingtonpost.com/staff/email/ellen+nakashima/ 3. http://www.washingtonpost.com/ac2/related/topic/U.S.+Department+of+Homeland… 4. http://v2.listbox.com/member/archive/247/=now 5. http://v2.listbox.com/member/archive/rss/247/ 6. http://www.listbox.com/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [ZS] Bitcoin + Open Transactions + Web Of Trust
by Bryce Lynch 06 Jul '18

06 Jul '18

On Fri, Aug 3, 2012 at 4:24 AM, Eugen Leitl <eugen(a)leitl.org> wrote: > Web-Of-Trust: Provides: Reputation system so there is consequences if somebody scams (nobody will > trade with them), and good reputations have value. Needs: Low-Trust transfer of value, so parties with no > reputation can build a good reputation: (Bitcoin) Needs: Formal way to describe contracts, that can describe > the Didn't the cypherpunks do research on zero-trust reputation management networks back in the 90's? Also, the trust metric normalization research being done now should be part of that if it's not already. -- The Doctor [412/724/301/703] [ZS] https://drwho.virtadpt.net/ "I am everywhere." -- -- Zero State mailing list: http://groups.google.com/group/DoctrineZero ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Politech] Colorado sheriff creates roadblock so private firm can demand DNA blood samples [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

I've been behind on Politech recently, but this story made me irritated enough to catch up on things. The Gilpin County Sheriff's Office in Colorado, a rural area not that far west of Denver, recently set up a highway checkpoint where motorists were stopped and, at least in some cases, not allowed to leave until they gave breath, blood, and saliva samples for the benefit of a private research firm. A report by Ernie Hancock says the National Highway Traffic Safety Administration was involved as well. A Denver Post article is here: http://www.denverpost.com/headlines/ci_6922089 More: http://cw2.trb.com/news/kwgn-invasive-checkpoint,0,2092732.story http://worldnetdaily.com/news/article.asp?ARTICLE_ID=57733 http://freedomsphoenix.com/Discussion-Page.htm?InfoNo=024006 The Post says the private organization in question is the Pacific Institute for Research and Evaluation, or PIRE, in Calverton, MD. Their Web site seems to be down but can be viewed here: http://web.archive.org/web/20050826173038/www.pire.org/ This seems to be a fine opportunity for Politech readers to let PIRE executives and Gilpin County supervisors know what they think about police abusing their authority at the demand of a private research firm. Gilpin County email addresses: rbaker(a)co.gilpin.co.us, scate(a)co.gilpin.co.us, pubcomment(a)co.gilpin.co.us PIRE email addresses: langevin(a)pire.org, info(a)pire.org, mblackston(a)pire.org The thoroughly-misnamed PIRE is a major DC government contractor (and in fact its offices are within walking distance of the Beltway). It specializes in funneling over $35 million of taxpayer money a year into its own coffers through law enforcement contracts of dubious utility, mostly dealing with drugs and alcohol, from sources including the U.S. Department of Justice. 100 percent of its budget appears to come from government contracts or grants. Although PIRE pretends to be a "nonprofit" organization -- at least that label helps to collect those fat taxpayer-funded checks from the DOJ -- in reality it spends about $1.35 million a year on lobbyists. Not a bad 30-fold return on investment. And its employees are paid six-figure salaries that would be handsome even by for-profit standards.* PIRE seems to specialize in devising new and intrusive ways of government meddling in personal lives. One PIRE success story helps to coerce retailers to card octogenarians who dare to try to buy a bottle of Cabernet. ("This method of enforcement gives retailers the necessary incentive to comply with the statebs law regarding the sale of alcohol, given that their next customer could be part of a compliance check. The Pacific Institute for Research and Evaluation (PIRE) has developed a detailed document to assist in the development and implementation of compliance checks." See: http://www.nhtsa.dot.gov/people/injury/alcohol/dotpartners/chapter_5.htm PIRE is an ardent supporter of the War On (Some Politically Unacceptable) Drugs, also known as an excellent way for Feds and contractors to fleece the public in a war that will never end, eviscerate the Fourth Amendment, and create a police state with perfectly legal no-knock raids. One PIRE researcher who focuses on "middle-school-based drug prevention programs" and has written a paper claiming anti-drug programs in schools actually work: http://www.nida.nih.gov/Meetings/Prevention/PrevBios4.html PIRE also supports higher taxes on alcohol and firmly opposes lowering the minimum drinking age to be akin to Europe or Canada (something that would probably do much to limit abuse). See: http://www.higheredcenter.org/thisweek/tw010629.html http://resources.prev.org/documents/BeerTaxesNewsRelease.pdf I'm sure that PIRE will be delighted to hear from the members of the public that pay its executive salaries. And if course if they have apologized for the Colorado incident, and pledge never to rely on such underhanded tactics again, I'd be delighted to send along a response from them. -Declan * Robert Carpenter, PIRE's CEO, was paid $221,785 in 2005 Ted Langevin, a VP/CFO, was paid $200,760 Joel Grube, a PIRE research director, was paid $237,075 Ted Miller, a PIRE research director, was paid $192,444 Jan van der Eijk, IS director, was paid $194,532 Paul Gruenwald, a science director, was paid $212,437 Robert Saltz, an associate director, was paid $191,527 Genevive Ames, a staff director, was paid $183,770 I've put PIRE's 2005 990 form here so you can see for yourself: http://politechbot.com/docs/pire.pacific.institute.research.evaluation.fina… _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Politech] Colorado sheriff creates roadblock so private firm can demand DNA blood samples [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

I've been behind on Politech recently, but this story made me irritated enough to catch up on things. The Gilpin County Sheriff's Office in Colorado, a rural area not that far west of Denver, recently set up a highway checkpoint where motorists were stopped and, at least in some cases, not allowed to leave until they gave breath, blood, and saliva samples for the benefit of a private research firm. A report by Ernie Hancock says the National Highway Traffic Safety Administration was involved as well. A Denver Post article is here: http://www.denverpost.com/headlines/ci_6922089 More: http://cw2.trb.com/news/kwgn-invasive-checkpoint,0,2092732.story http://worldnetdaily.com/news/article.asp?ARTICLE_ID=57733 http://freedomsphoenix.com/Discussion-Page.htm?InfoNo=024006 The Post says the private organization in question is the Pacific Institute for Research and Evaluation, or PIRE, in Calverton, MD. Their Web site seems to be down but can be viewed here: http://web.archive.org/web/20050826173038/www.pire.org/ This seems to be a fine opportunity for Politech readers to let PIRE executives and Gilpin County supervisors know what they think about police abusing their authority at the demand of a private research firm. Gilpin County email addresses: rbaker(a)co.gilpin.co.us, scate(a)co.gilpin.co.us, pubcomment(a)co.gilpin.co.us PIRE email addresses: langevin(a)pire.org, info(a)pire.org, mblackston(a)pire.org The thoroughly-misnamed PIRE is a major DC government contractor (and in fact its offices are within walking distance of the Beltway). It specializes in funneling over $35 million of taxpayer money a year into its own coffers through law enforcement contracts of dubious utility, mostly dealing with drugs and alcohol, from sources including the U.S. Department of Justice. 100 percent of its budget appears to come from government contracts or grants. Although PIRE pretends to be a "nonprofit" organization -- at least that label helps to collect those fat taxpayer-funded checks from the DOJ -- in reality it spends about $1.35 million a year on lobbyists. Not a bad 30-fold return on investment. And its employees are paid six-figure salaries that would be handsome even by for-profit standards.* PIRE seems to specialize in devising new and intrusive ways of government meddling in personal lives. One PIRE success story helps to coerce retailers to card octogenarians who dare to try to buy a bottle of Cabernet. ("This method of enforcement gives retailers the necessary incentive to comply with the statebs law regarding the sale of alcohol, given that their next customer could be part of a compliance check. The Pacific Institute for Research and Evaluation (PIRE) has developed a detailed document to assist in the development and implementation of compliance checks." See: http://www.nhtsa.dot.gov/people/injury/alcohol/dotpartners/chapter_5.htm PIRE is an ardent supporter of the War On (Some Politically Unacceptable) Drugs, also known as an excellent way for Feds and contractors to fleece the public in a war that will never end, eviscerate the Fourth Amendment, and create a police state with perfectly legal no-knock raids. One PIRE researcher who focuses on "middle-school-based drug prevention programs" and has written a paper claiming anti-drug programs in schools actually work: http://www.nida.nih.gov/Meetings/Prevention/PrevBios4.html PIRE also supports higher taxes on alcohol and firmly opposes lowering the minimum drinking age to be akin to Europe or Canada (something that would probably do much to limit abuse). See: http://www.higheredcenter.org/thisweek/tw010629.html http://resources.prev.org/documents/BeerTaxesNewsRelease.pdf I'm sure that PIRE will be delighted to hear from the members of the public that pay its executive salaries. And if course if they have apologized for the Colorado incident, and pledge never to rely on such underhanded tactics again, I'd be delighted to send along a response from them. -Declan * Robert Carpenter, PIRE's CEO, was paid $221,785 in 2005 Ted Langevin, a VP/CFO, was paid $200,760 Joel Grube, a PIRE research director, was paid $237,075 Ted Miller, a PIRE research director, was paid $192,444 Jan van der Eijk, IS director, was paid $194,532 Paul Gruenwald, a science director, was paid $212,437 Robert Saltz, an associate director, was paid $191,527 Genevive Ames, a staff director, was paid $183,770 I've put PIRE's 2005 990 form here so you can see for yourself: http://politechbot.com/docs/pire.pacific.institute.research.evaluation.fina… _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[liberationtech] What I've learned from Cryptocat
by Uncle Zzzen 06 Jul '18

06 Jul '18

https://crypto.cat will soon stop being a web-based service, and will only exist as a browser extension. The question is, what should future web-app developers do if they need crypto? Rewrite all crypto primitives from scratch [and hope there's enough interest in reviewing the code], then let users install yet another extension? I believe there's a better solution. I've posted something about it. I hope some of you would find it interesting. http://thedod.noblogs.org/post/2012/08/04/what-ive-learned-from-cryptocat/ Cheers, The Dod _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[i2p] weekly status notes [feb 15]
by jrandom 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bonjour, sa cette fois de la semaine encore, * Index 1) Net status 2) 0.5 status 3) i2p-bt 0.1.7 4) ??? * 1) Net status While no new bugs have shown up in the network, last week we gained some exposure on a popular French p2p website, which has led to an increase both in users and in bittorrent activity. At the peak, we reached 211 routers on the net, though its hovering between 150 and 180 lately. Reported bandwidth usage has been up as well, though unfortunately the irc reliability has been degraded, with one of the servers lowering their bandwidth limits due to the load. There have been a bunch of improvements to the streaming lib to help with this, but they've been on the 0.5-pre branch, so not yet available to the live net. Another transient problem has been the outage of one of the HTTP outproxies (www1.squid.i2p), causing 50% of outproxy requests to fail. You can temporarily remove that outproxy by opening up your I2PTunnel config [1], editing the eepProxy, and changing the "Outproxies:" line to contain only "squid.i2p". Hopefully we'll get that other one back online soon to increase redundancy. [1] http://localhost:7657/i2ptunnel/index.jsp * 2) 0.5 status There has been lots of progress this past week on 0.5 (I bet you're tired of hearing that, 'eh?). Thanks to the help of postman, cervantes, duck, spaetz, and some unnamed person, we've been running a test network with the new code for nearly a week and have worked through a good number of bugs that I hadn't seen in my local test network. For the past day or so now, the changes have been minor, and I don't forsee any substantial code left before the 0.5 release goes out. There is some additional cleaning, documentation, and assembly left, and it doesn't hurt to let the 0.5 test network churn through in case additional bugs are exposed over time. Since this is going to be a BACKWARDS INCOMPATIBLE RELEASE, to give you time to plan for updating, I'll fix a simple deadline of THIS FRIDAY as when 0.5 will be released. As bla mentioned on irc, eepsite hosts may want to take their site down on Thursday or Friday and keep them down until Saturday when many users will have upgraded. This will help reduce the effect of an intersection attack (e.g. if 90% of the network has migrated to 0.5 and you're still on 0.4, if someone reaches your eepsite, they know you're one of the 10% of routers left on the network). I could start to get into whats been updated in 0.5, but I'd end up going on for pages and pages, so perhaps I should just hold off and put that into the documentation which I should write up :) * 3) i2p-bt 0.1.7 duck has put together a bugfix release to last week's 0.1.6 update, and word on the street says its kickass (perhaps /too/ kickass, given the increased network usage ;) More info up @ the i2p-bt forum [2] [2] http://forum.i2p.net/viewtopic.php?t=300 * 4) ??? Lots of other things going on in the IRC discussions and on the forum [3], too much to briefly summarize. Perhaps the interested parties can swing by the meeting and give us updates and thoughts? Anyway, see y'all shortly =jr -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFCEl/OGnFL2th344YRAkZQAKC5A+M6tX01BKKplopedAqvpV0QZQCgy+C7 Cbz/JT+3L2OfdhKAy8p/isQ= =VUm2 -----END PGP SIGNATURE----- _______________________________________________ i2p mailing list i2p(a)i2p.net http://i2p.dnsalias.net/mailman/listinfo/i2p ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[i2p] weekly status notes [feb 15]
by jrandom 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bonjour, sa cette fois de la semaine encore, * Index 1) Net status 2) 0.5 status 3) i2p-bt 0.1.7 4) ??? * 1) Net status While no new bugs have shown up in the network, last week we gained some exposure on a popular French p2p website, which has led to an increase both in users and in bittorrent activity. At the peak, we reached 211 routers on the net, though its hovering between 150 and 180 lately. Reported bandwidth usage has been up as well, though unfortunately the irc reliability has been degraded, with one of the servers lowering their bandwidth limits due to the load. There have been a bunch of improvements to the streaming lib to help with this, but they've been on the 0.5-pre branch, so not yet available to the live net. Another transient problem has been the outage of one of the HTTP outproxies (www1.squid.i2p), causing 50% of outproxy requests to fail. You can temporarily remove that outproxy by opening up your I2PTunnel config [1], editing the eepProxy, and changing the "Outproxies:" line to contain only "squid.i2p". Hopefully we'll get that other one back online soon to increase redundancy. [1] http://localhost:7657/i2ptunnel/index.jsp * 2) 0.5 status There has been lots of progress this past week on 0.5 (I bet you're tired of hearing that, 'eh?). Thanks to the help of postman, cervantes, duck, spaetz, and some unnamed person, we've been running a test network with the new code for nearly a week and have worked through a good number of bugs that I hadn't seen in my local test network. For the past day or so now, the changes have been minor, and I don't forsee any substantial code left before the 0.5 release goes out. There is some additional cleaning, documentation, and assembly left, and it doesn't hurt to let the 0.5 test network churn through in case additional bugs are exposed over time. Since this is going to be a BACKWARDS INCOMPATIBLE RELEASE, to give you time to plan for updating, I'll fix a simple deadline of THIS FRIDAY as when 0.5 will be released. As bla mentioned on irc, eepsite hosts may want to take their site down on Thursday or Friday and keep them down until Saturday when many users will have upgraded. This will help reduce the effect of an intersection attack (e.g. if 90% of the network has migrated to 0.5 and you're still on 0.4, if someone reaches your eepsite, they know you're one of the 10% of routers left on the network). I could start to get into whats been updated in 0.5, but I'd end up going on for pages and pages, so perhaps I should just hold off and put that into the documentation which I should write up :) * 3) i2p-bt 0.1.7 duck has put together a bugfix release to last week's 0.1.6 update, and word on the street says its kickass (perhaps /too/ kickass, given the increased network usage ;) More info up @ the i2p-bt forum [2] [2] http://forum.i2p.net/viewtopic.php?t=300 * 4) ??? Lots of other things going on in the IRC discussions and on the forum [3], too much to briefly summarize. Perhaps the interested parties can swing by the meeting and give us updates and thoughts? Anyway, see y'all shortly =jr -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFCEl/OGnFL2th344YRAkZQAKC5A+M6tX01BKKplopedAqvpV0QZQCgy+C7 Cbz/JT+3L2OfdhKAy8p/isQ= =VUm2 -----END PGP SIGNATURE----- _______________________________________________ i2p mailing list i2p(a)i2p.net http://i2p.dnsalias.net/mailman/listinfo/i2p ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: [liberationtech] Wickr: Can the Snapchat for Grown-Ups Save You From Spies?
by Shava Nerad 06 Jul '18

06 Jul '18

What Andrew said. And anyone who glibly says that people's lives can rely on the privacy of their software like that is lying, naive, and/or stupid, to be blunt. We had releases in the wild of Tor we knew people were using (and may still be) that are out of date and we know are security compromised - and we have no way to reach every one of those people ever (nor would she even with registered users necessarily) to make them update, and it makes me weep. So every release you sweat because, if there's a security compromise, an exploit found, a bug somewhere (and hey even my archgeeks are only human ;) -- I mean, Roger Dingledine, Nick Mathewson and Andrew are angels. How many release engineers have to worry if they miss something, people could get hauled away from their families, tortured, and/or killed? It may not be the commonest case of some person using it for pedestrian daily privacy, but it is our critical case that we must model and plan for - and understand and empathize with - and it's thousands of activists, journalists, and so on. No glib "yes" answers please. If you aren't losing sleep you don't get it. Write social apps for suburbia, where you can lie or be naive or be stupid and it won't stand out. In the "Zynga" community of practice that seems to be normative at least - not that it's good for society either, but perhaps it's habit forming, sheep and shepherd. Don't do "social app" marketing to activists. Do risk assessment and education. Open your source, do not register your users (either they give you real PID which you can be forced to give up, or it's encouraging them to break TOS on probably a US email provider - which in any US service makes any activist a felon under the US law Aaron Swartz was accused under - this is my current area of research). Yrs, ---- Shava Nerad shava23(a)gmail.com On Mar 5, 2013 1:48 PM, <liberationtech(a)lewman.us> wrote: > On Tue, 5 Mar 2013 10:16:12 -0800 > Yosem Companys <companys(a)stanford.edu> wrote: > > > The cautionary tale that many reference is the case of Hushmail, an > > encrypted mail service that used to claim that "not even a Hushmail > > employee with access to our servers can read your encrypted email, > > since each message is uniquely encoded before it leaves your computer" > > b words that echo Wickr's own proclamations. Sell tells Mashable that > > Wickr's "architecture eliminates backdoors; if someone was to come to > > us with a subpoena, we have nothing to give them." > > They can, and will, be asked for "envelope data". Since wickr requires > you create an account, they know who is communicating with whom, when, > how often, and how much data. They may even know the file names > transferred, even if they don't know the contents. They get to learn > your email address and your IP addresses. This alone lets them build a > nice social network map of you. > > As it's running on a mobile phone, wickr can learn GPS location, cell > tower, altitude and lots of other data provided by the phone itself > (name, contacts, etc) if they want to do so. > > And as a final thought, they will get preservation requests for > messages from law enforcement. Since you're storing content on their > servers, even if you think you control how long, they can copy off the > messages (also for backups) for law enforcement. > > -- > Andrew > http://tpo.is/contact > pgp 0x6B4D6475 > -- > Too many emails? Unsubscribe, change to digest, or change password by > emailing moderator at companys(a)stanford.edu or changing your settings at > https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0