July 2018 - cypherpunks-legacy

Re: [liberationtech] Travel with notebook habit
by Julian Oliver 06 Jul '18

06 Jul '18

..on Thu, Dec 27, 2012 at 09:51:02PM +0100, Jerzy Eogiewa wrote: > I am just reading this, > http://www.schneier.com/blog/archives/2012/12/breaking_hard-d.html > > Can we start some discussion about good notebook travel habit? I have read > Jacob Appelbaum say he does not travel with _ANY_ drive in notebook, and this > seem to be extreme. > > Without removing drive, what is the best habit for FDE for prevent attacks as > Schneier describe? Full power-down? No hibernate file? Any other things? Well, it's not the disk but what's on it. I don't trust closed platforms like OS X or Windows systems. Take what I write with a grain of salt but here's my general approach on a GNU/Linux system: First tar up all the documents/files you need at the destination, note the md5sum and then securely copy them to a server you trust. Then start an sshd instance on port 443 (https) on the file server, so as to get around standard filtering on port 22 on the other end. Even some hotels filter against ssh but none do 443. Then set up two bootable stock Linux distributions with *full disk encryption* on fast USB sticks andsetup user accounts. Ensure tsocks, macchanger and Tor Browser Bundle, ssh, nmap and a few other basics are on the machine. Install Do Not Track plugin (or similar) alongside a User Agent Switcher. Take the actual hard disk out of the machine. Put one stick in your pocket and another in your check-in luggage. Take a few external USB wireless internet adapters with you. Take the plane/train/car over the border. On arrival and when you know you have an Internet gateway, plug one of the sticks in and boot up and get online using the external USB wireless adapter. If you have a link using Ethernet cable (RJ45) with an onboard Ethernet adapter then use it but only if you change your MAC address. Use macchanger to do this like so: sudo ifconfig eth0 down # now plug in Ethernet cable sudo macchanger -A eth0 # A random hardware address will be assigned sudo ifconfig eth0 up sudo dhclient eth0 Now securely copy all the files back onto the local machine as a torified instance (only with tsocks to avoid UDP and DNS leaks) something like so: cd torify scp -P 443 you@remotehost.net:/path/to/files.tar.gz . md5sum files.tar.gz # check it's the real deal against noted md5sum earlier tar xvzf files.tar.gz Avoid using any web services that track you across sites (at the least use Do Not Track plugins and the like). Change your User Agent in the Torified browser you use to something ubiquitous like the Android browser (most popular smartphone by 3x in most countries). Always use SSL when connecting to mail services and the like. Before you fly again destroy that USB stick physically (smash with hammer and then burn). Destroy the USB network adapter you purchased also. Buy another USB stick, copy from the other stick you have (use 'dd' or 'cpio') and fly. I'm sure there's a far more user friendly approach that's sane enough out in the field. One can't expect journalists to learn the CLI (albeit I think anyone that needs to trust their machine, isolate and mitigate network threats (among others) ought to!). Cheers, -- Julian Oliver http://julianoliver.com http://criticalengineering.org -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[drone-list] Mini Drones Used by British Troops
by Amie Stepanovich 06 Jul '18

06 Jul '18

This story didn't get passed around much yesterday (I hear there was some sport event on? ;)) but I thought some of you may find it interesting - http://news.sky.com/story/1047004/mini-drones-army-deploys-tiny-helicopters "British troops are using a nano drone just 10cm long and weighing 16 grams on the front line in Afghanistan to provide vital information on the ground. They are the first to use the state-of-the-art handheld tiny surveillance helicopters, which relay reliable full motion video and still images back to the devices' handlers in the battlefield. The Black Hornet Nano Unmanned Air Vehicle is the size of a child's toy, measuring just 10cm (4 ins) by 2.5cm (1 inch), and is equipped with a tiny camera." Amie Stepanovich Associate Litigation Counsel Electronic Privacy Information Center 202.483.1140 x104 @astepanovich Defend Privacy. Support EPIC. http://www.epic.org/donate/ _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

FW: Government Uses Color Laser Printer Technology to Track
by Richard Forno 06 Jul '18

06 Jul '18

Documents Not a new thing, but an FYI anyway. :) -rick Infowarrior.org Government Uses Color Laser Printer Technology to Track Documents http://story.news.yahoo.com/news?tmpl=story&cid=1093&e=4&u=/pcworld/ 20041122 /tc_pcworld/118664 Mon Nov 22, 4:00 AM ET Jason Tuohey, Medill News Service WASHINGTON--Next time you make a printout from your color laser printer, shine an LED flashlight beam on it and examine it closely with a magnifying glass. You might be able to see the small, scattered yellow dots printer there that could be used to trace the document back to you. According to experts, several printer companies quietly encode the serial number and the manufacturing code of their color laser printers and color copiers on every document those machines produce. Governments, including the United States, already use the hidden markings to track counterfeiters. Peter Crean, a senior research fellow at Xerox, says his company's laser printers, copiers and multifunction workstations, such as its WorkCentre Pro series, put the "serial number of each machine coded in little yellow dots" in every printout. The millimeter-sized dots appear about every inch on a page, nestled within the printed words and margins. "It's a trail back to you, like a license plate," Crean says. The dots' minuscule size, covering less than one-thousandth of the page, along with their color combination of yellow on white, makes them invisible to the naked eye, Crean says. One way to determine if your color laser is applying this tracking process is to shine a blue LED light--say, from a keychain laser flashlight--on your page and use a magnifier. Crime Fighting vs. Privacy Laser-printing technology makes it incredibly easy to counterfeit money and documents, and Crean says the dots, in use in some printers for decades, allow law enforcement to identify and track down counterfeiters. However, they could also be employed to track a document back to any person or business that printed it. Although the technology has existed for a long time, printer companies have not been required to notify customers of the feature. Lorelei Pagano, a counterfeiting specialist with the U.S. Secret Service, stresses that the government uses the embedded serial numbers only when alerted to a forgery. "The only time any information is gained from these documents is purely in [the case of] a criminal act," she says. John Morris, a lawyer for The Center for Democracy and Technology, says, "That type of assurance doesn't really assure me at all, unless there's some type of statute." He adds, "At a bare minimum, there needs to be a notice to consumers." If the practice disturbs you, don't bother trying to disable the encoding mechanism--you'll probably just break your printer. Crean describes the device as a chip located "way in the machine, right near the laser" that embeds the dots when the document "is about 20 billionths of a second" from printing. "Standard mischief won't get you around it," Crean adds. Neither Crean nor Pagano has an estimate of how many laser printers, copiers, and multifunction devices track documents, but they say that the practice is commonplace among major printer companies. "The industry absolutely has been extraordinarily helpful [to law enforcement]," Pagano says. According to Pagano, counterfeiting cases are brought to the Secret Service, which checks the documents, determines the brand and serial number of the printer, and contacts the company. Some, like Xerox, have a customer database, and they share the information with the government. Crean says Xerox and the government have a good relationship. "The U.S. government had been on board all along--they would actually come out to our labs," Crean says. History Unlike ink jet printers, laser printers, fax machines, and copiers fire a laser through a mirror and series of lenses to embed the document or image on a page. Such devices range from a little over $100 to more than $1000, and are designed for both home and office. Crean says Xerox pioneered this technology about 20 years ago, to assuage fears that their color copiers could easily be used to counterfeit bills. "We developed the first (encoding mechanism) in house because several countries had expressed concern about allowing us to sell the printers in their country," Crean says. Since then, he says, many other companies have adopted the practice. The United States is not the only country teaming with private industry to fight counterfeiters. A recent article points to the Dutch government as using similar anticounterfeiting methods, and cites Canon as a company with encoding technology. Canon USA declined to comment. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[IP] Government Uses Color Laser Printer Technology to Track
by David Farber 06 Jul '18

06 Jul '18

Documents X-Mailer: Apple Mail (2.619) Reply-To: dave(a)farber.net Begin forwarded message:

1 0

[cryptography] Introducing DM-Steg: Deniable encryption for Linux
by Leo Samulis 06 Jul '18

06 Jul '18

Hello folks, I'd like to introduce DM-Steg. It's a Linux device mapper module that provides deniable/steganographic encryption. DM-Steg provides similar capabilities to Rubberhose (a now defunct project by Julian Assange et al.) and more advanced deniable encryption than Truecrypt. DM-Steg can be used to hide any number of strongly encrypted volumes inside block devices or files. Without keys, there is no way for an attacker to determine how many volumes a block device contains or even if the block device is not simply random data. DM-Steg uses strong encryption yet still achives goood performance - up to 148 MB/s on my core 2 duo, and only 1% slowdown on kernel compiles. DM-Steg is working code and free software, so if you have any interest in deniable encryption, please head over to http://dmsteg.sf.net and grab the tarball. For those interested in the mechanics of DM-Steg, the .pdf file on the site should provide a good overview. I've taken this project as far as I want so I'd very much like it if there's anyone in the OSS community who wants to take it further. Don't be shy! :) All the best, - Leo _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

FW: Government Uses Color Laser Printer Technology to Track
by Richard Forno 06 Jul '18

06 Jul '18

Documents Not a new thing, but an FYI anyway. :) -rick Infowarrior.org Government Uses Color Laser Printer Technology to Track Documents http://story.news.yahoo.com/news?tmpl=story&cid=1093&e=4&u=/pcworld/ 20041122 /tc_pcworld/118664 Mon Nov 22, 4:00 AM ET Jason Tuohey, Medill News Service WASHINGTON--Next time you make a printout from your color laser printer, shine an LED flashlight beam on it and examine it closely with a magnifying glass. You might be able to see the small, scattered yellow dots printer there that could be used to trace the document back to you. According to experts, several printer companies quietly encode the serial number and the manufacturing code of their color laser printers and color copiers on every document those machines produce. Governments, including the United States, already use the hidden markings to track counterfeiters. Peter Crean, a senior research fellow at Xerox, says his company's laser printers, copiers and multifunction workstations, such as its WorkCentre Pro series, put the "serial number of each machine coded in little yellow dots" in every printout. The millimeter-sized dots appear about every inch on a page, nestled within the printed words and margins. "It's a trail back to you, like a license plate," Crean says. The dots' minuscule size, covering less than one-thousandth of the page, along with their color combination of yellow on white, makes them invisible to the naked eye, Crean says. One way to determine if your color laser is applying this tracking process is to shine a blue LED light--say, from a keychain laser flashlight--on your page and use a magnifier. Crime Fighting vs. Privacy Laser-printing technology makes it incredibly easy to counterfeit money and documents, and Crean says the dots, in use in some printers for decades, allow law enforcement to identify and track down counterfeiters. However, they could also be employed to track a document back to any person or business that printed it. Although the technology has existed for a long time, printer companies have not been required to notify customers of the feature. Lorelei Pagano, a counterfeiting specialist with the U.S. Secret Service, stresses that the government uses the embedded serial numbers only when alerted to a forgery. "The only time any information is gained from these documents is purely in [the case of] a criminal act," she says. John Morris, a lawyer for The Center for Democracy and Technology, says, "That type of assurance doesn't really assure me at all, unless there's some type of statute." He adds, "At a bare minimum, there needs to be a notice to consumers." If the practice disturbs you, don't bother trying to disable the encoding mechanism--you'll probably just break your printer. Crean describes the device as a chip located "way in the machine, right near the laser" that embeds the dots when the document "is about 20 billionths of a second" from printing. "Standard mischief won't get you around it," Crean adds. Neither Crean nor Pagano has an estimate of how many laser printers, copiers, and multifunction devices track documents, but they say that the practice is commonplace among major printer companies. "The industry absolutely has been extraordinarily helpful [to law enforcement]," Pagano says. According to Pagano, counterfeiting cases are brought to the Secret Service, which checks the documents, determines the brand and serial number of the printer, and contacts the company. Some, like Xerox, have a customer database, and they share the information with the government. Crean says Xerox and the government have a good relationship. "The U.S. government had been on board all along--they would actually come out to our labs," Crean says. History Unlike ink jet printers, laser printers, fax machines, and copiers fire a laser through a mirror and series of lenses to embed the document or image on a page. Such devices range from a little over $100 to more than $1000, and are designed for both home and office. Crean says Xerox pioneered this technology about 20 years ago, to assuage fears that their color copiers could easily be used to counterfeit bills. "We developed the first (encoding mechanism) in house because several countries had expressed concern about allowing us to sell the printers in their country," Crean says. Since then, he says, many other companies have adopted the practice. The United States is not the only country teaming with private industry to fight counterfeiters. A recent article points to the Dutch government as using similar anticounterfeiting methods, and cites Canon as a company with encoding technology. Canon USA declined to comment. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[IP] Government Uses Color Laser Printer Technology to Track
by David Farber 06 Jul '18

06 Jul '18

Documents X-Mailer: Apple Mail (2.619) Reply-To: dave(a)farber.net Begin forwarded message:

1 0

[cryptography] Introducing DM-Steg: Deniable encryption for Linux
by Leo Samulis 06 Jul '18

06 Jul '18

Hello folks, I'd like to introduce DM-Steg. It's a Linux device mapper module that provides deniable/steganographic encryption. DM-Steg provides similar capabilities to Rubberhose (a now defunct project by Julian Assange et al.) and more advanced deniable encryption than Truecrypt. DM-Steg can be used to hide any number of strongly encrypted volumes inside block devices or files. Without keys, there is no way for an attacker to determine how many volumes a block device contains or even if the block device is not simply random data. DM-Steg uses strong encryption yet still achives goood performance - up to 148 MB/s on my core 2 duo, and only 1% slowdown on kernel compiles. DM-Steg is working code and free software, so if you have any interest in deniable encryption, please head over to http://dmsteg.sf.net and grab the tarball. For those interested in the mechanics of DM-Steg, the .pdf file on the site should provide a good overview. I've taken this project as far as I want so I'd very much like it if there's anyone in the OSS community who wants to take it further. Don't be shy! :) All the best, - Leo _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] Tor and P2P
by Mike Perry 06 Jul '18

06 Jul '18

Thus spake adrelanos (adrelanos(a)riseup.net) > grarpamp: > > Given that these services are surely coming in force... and from > > directions that see these networks more as a raw transport than > > say, primarily for the purposes outlined on their respective web > > pages... it seems the usual echo of "we're a nice project, don't > > do that, too much load" may not be useful. This should not imply > > fault, but merely suggest that it's dated and hopeless. > > I tend to agree but I am not sure. At the moment I don't believe the Tor > project will die soon. It's fine with me if we can continue use it for > anonymous browsing, circumvention and so on for the next years. > > It's also questionable if the Tor project should try to get a big share > of the people interested in anonymous p2p. I tend to think no, because > this opens up the project for a lot negative press. That increases the > risk for a new law to forbid the whole network in even more countries. > Let other networks try that out. Yeah. Due to my distributed systems background, I read "P2P" in this thread as "peer to peer", not "filesharing". I assume that was the case for most of the other Tor people commenting in this thread. I would love it for Tor to support ways for people to communicate without revealing either their social network or message content to the network or infrastructure. I literally cannot stand the fact that there are no ways to communicate right now without handing your social graph to someone who wants to datamine it or sell it, or both. I do think it is important to devote thought even to something as simple as P2P chat, or we could end up destroying the network as soon as it becomes popular, as Nathan and Robert said. Hidden services in Tor are quite expensive: ~3-4X more expensive than exit circuits in terms of CPU usage during connection setup, and 2X as expensive in terms of bandwidth consumption during usage. Because of this, I would be annoyed if people wrote bittorrent clients that used hidden services the way I2P does. I would prefer it if people focused such efforts on networks other than Tor, because I like Tor to remain useful for things other than simply filesharing. I recognize we don't have a whole lot of options to prevent such abuse, but I am not opposed to stopgaps such as throttling loud clients and QoS mechanisms to impact the popularity of resource-intensive filesharing apps... I suspect most of the other Tor folks in favor of "Tor and P2P" are in the same boat. -- Mike Perry _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: NSA and the exchanges
by John Adams 06 Jul '18

06 Jul '18

Allegedly? No, definately. https://www.eff.org/nsa-spying https://www.eff.org/files/filenode/att/presskit/ATT_onepager.pdf -j On Wed, Oct 31, 2012 at 11:25 AM, andy lam <anwalam(a)yahoo.com> wrote: > Anyone knows if there's a way to find out how involved NSA monitors 151 > front street at Toronto? NSA allegedly monitors data centres in the US, > but does it have the same influence at a building sitting in its neighbor's > soil? > > There's something on the web like www.ixmaps.ca that tries to piece it > together. but not sure how helpful the information on there really is? > > > feedback welcome. > ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0