July 2018 - cypherpunks-legacy

Re: Tor VM stalled at 25%
by coderman 06 Jul '18

06 Jul '18

On Thu, Dec 23, 2010 at 3:08 PM, Praedor Atrebates <praedor(a)yahoo.com> wrote: > ... I want the VM system because I want to be able to browse without having to deactivate java, javascript, and flash... I want the VM so I can access these websites while still being anonymous, thus the necessity of a VM environment. there are still a large number of risks to your anonymity when using things like Java, Flash, arbitrary applications with Tor, even in a fully transparently Tor'ified VM configuration. local DNS resolver IP disclosures and side channels, chained exploits (accelerated VM interfaces are very risky but oh so performant...), many, many other considerations and risks. you need to carefully consider your risks for using such things, hence my recommendation for the stock bundle without those risky things unless you really know what you're doing or the risks are exceptionally low. best regards, *********************************************************************** To unsubscribe, send an e-mail to majordomo(a)torproject.org with unsubscribe or-talk in the body. http://archives.seul.org/or/talk/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Tor VM stalled at 25%
by coderman 06 Jul '18

06 Jul '18

On Thu, Dec 23, 2010 at 3:08 PM, Praedor Atrebates <praedor(a)yahoo.com> wrote: > ... I want the VM system because I want to be able to browse without having to deactivate java, javascript, and flash... I want the VM so I can access these websites while still being anonymous, thus the necessity of a VM environment. there are still a large number of risks to your anonymity when using things like Java, Flash, arbitrary applications with Tor, even in a fully transparently Tor'ified VM configuration. local DNS resolver IP disclosures and side channels, chained exploits (accelerated VM interfaces are very risky but oh so performant...), many, many other considerations and risks. you need to carefully consider your risks for using such things, hence my recommendation for the stock bundle without those risky things unless you really know what you're doing or the risks are exceptionally low. best regards, *********************************************************************** To unsubscribe, send an e-mail to majordomo(a)torproject.org with unsubscribe or-talk in the body. http://archives.seul.org/or/talk/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Azerbaijan wants to register mobile phones
by Pavol Luptak 06 Jul '18

06 Jul '18

Hi! On Mon, Jan 09, 2012 at 12:00:30PM -0500, Katrin Verclas wrote: > > Are there any emergency or national security laws that allow the government to gain control of mobile network (e.g. suspend network, conduct interception, etc)? Data retention law (at least in the EU): https://en.wikipedia.org/wiki/Telecommunications_data_retention > Article 16 entitles the government during times of martial law and state of emergency "to preference in use of necessary telecommunication nets, units and means and can stop, limit their use or apply special rules for use of communication." New rules require all operational mobile devices (cell phones) in the territory of Azerbaijan to be registered at Mobile Devices Registration System (MDRS). MDRS is not ready yet and is to be set up by the Ministry of Communication and IT. All cell phone carriers will have to connect their networks to MDRS. Information required for the system will include cell phone's IMEI code, a number associated with that phone and serial number of the SIM card. A cell phone will work only with a number associated with it and registered at MDRS. Otherwise, cell phone operators will have to block it.In practice, it means the government will be able to switch off every phone in the country. This is also possible in Slovakia/EU if there is a "suspicion" (which can be quite unclear what is the "suspicion") and consequently obtain court order... > Are there any restrictions on encryption, including on VoIP? Is encryption allowed or forbidden? I think it is illegal in the EU to provide _publicly_ end-to-end calls encryption (without possibility of interception for legal/secret agencies). At least in Slovakia, if you decide to find out "ultra secure mobile operator" and provide end-to-end encrypted calls without possibility to intercept these calls by legal authorities, you will not receive an official license for this business. What practically means that this kind of business is illegal. Of course you ca provide end-to-end encrypted calls for private companies, organizations, etc., you can sell crypto phones and all other crypto devices, but you cannot offer completely public end-to-end call encryption services for all people... I guess the situation is similar even in the US - I don't know if it is legal to provide encrypted voice calls services _publicly_ (for all people) without possibility of interception of legal/secret agencies. > The telecom law does not specify any restrictions on encryption. VoIP service is considered a form of communication and requires a license (source: http://news.day.az/hitech/69561.html) That's also true in the EU. If you are VoIP service provider, you also need to follow the data retention law... I believe the situation in Azerbaijan is really bad, but probably not so worse than in the other developed countries :-( Pavol -- _______________________________________________________________ [wilder(a)trip.sk] [http://trip.sk/wilder/] [talker: ttt.sk 5678] _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Azerbaijan wants to register mobile phones
by Pavol Luptak 06 Jul '18

06 Jul '18

Hi! On Mon, Jan 09, 2012 at 12:00:30PM -0500, Katrin Verclas wrote: > > Are there any emergency or national security laws that allow the government to gain control of mobile network (e.g. suspend network, conduct interception, etc)? Data retention law (at least in the EU): https://en.wikipedia.org/wiki/Telecommunications_data_retention > Article 16 entitles the government during times of martial law and state of emergency "to preference in use of necessary telecommunication nets, units and means and can stop, limit their use or apply special rules for use of communication." New rules require all operational mobile devices (cell phones) in the territory of Azerbaijan to be registered at Mobile Devices Registration System (MDRS). MDRS is not ready yet and is to be set up by the Ministry of Communication and IT. All cell phone carriers will have to connect their networks to MDRS. Information required for the system will include cell phone's IMEI code, a number associated with that phone and serial number of the SIM card. A cell phone will work only with a number associated with it and registered at MDRS. Otherwise, cell phone operators will have to block it.In practice, it means the government will be able to switch off every phone in the country. This is also possible in Slovakia/EU if there is a "suspicion" (which can be quite unclear what is the "suspicion") and consequently obtain court order... > Are there any restrictions on encryption, including on VoIP? Is encryption allowed or forbidden? I think it is illegal in the EU to provide _publicly_ end-to-end calls encryption (without possibility of interception for legal/secret agencies). At least in Slovakia, if you decide to find out "ultra secure mobile operator" and provide end-to-end encrypted calls without possibility to intercept these calls by legal authorities, you will not receive an official license for this business. What practically means that this kind of business is illegal. Of course you ca provide end-to-end encrypted calls for private companies, organizations, etc., you can sell crypto phones and all other crypto devices, but you cannot offer completely public end-to-end call encryption services for all people... I guess the situation is similar even in the US - I don't know if it is legal to provide encrypted voice calls services _publicly_ (for all people) without possibility of interception of legal/secret agencies. > The telecom law does not specify any restrictions on encryption. VoIP service is considered a form of communication and requires a license (source: http://news.day.az/hitech/69561.html) That's also true in the EU. If you are VoIP service provider, you also need to follow the data retention law... I believe the situation in Azerbaijan is really bad, but probably not so worse than in the other developed countries :-( Pavol -- _______________________________________________________________ [wilder(a)trip.sk] [http://trip.sk/wilder/] [talker: ttt.sk 5678] _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[drone-list] Time Magazine "Rise of the Drones" issue
by Gregory Foster 06 Jul '18

06 Jul '18

An upcoming issue of Time Magazine is titled "Rise of the Drones" and juxtaposes a low-flying Predator over a suburban American home. Time (Feb 11) - "Drone Home" by Lev Grossman: http://www.time.com/time/magazine/article/0,9171,2135132-1,00.html HT @MaryMad, who took umbrage at Chris Anderson's "don't worry be droned" article (emphasis mine), also in this issue. http://twitter.com/marymad/status/297346778217451521 Time (Jan 31) - "Why We Shouldn't Fear Personal Drones" by Chris Anderson: http://ideas.time.com/2013/01/31/why-we-shouldnt-fear-personal-drones/ > ...soon civilian drones will be flying commonly overhead here at home. > What will they be doing? > > The usual assumption is that it will be police surveillance and general > snooping. Interestingly, thatbs just what people feared when the > computer, which had also been introduced as a military technology, > started to be used commercially in the 1960s. The worry then was that > computers would be used primarily to spy on us, as an arm of Big > Brother. Only decades later, once we all had one, did we figure out > that they were better at work and entertainment, communicating with > each other and generally being welcome additions to our lives. I wanted to take a moment to explain how Mr. Anderson is attempting to take some liberties with the history of computation here. The concept and prototype of personal computers first emerged in the late 1960's amongst a small group of academics and innovators on the west coast, so I'm not really sure how folks could have had a more open-minded view about the potential uses of computers at that time. Up to that time and into the mid-70's computers took the form of bulky mainframes and mini-computers, only accessible to government agencies and very large corporations. I myself have not encountered much in the literature that talks about people fearing computers in the 1960s, other than some amusing IBM public relations efforts. So I can only conclude that Mr. Anderson has constructed a straw man through unsourced assertions. For facts, I recommend reading about the emergence of the idea and implementation of personal computers in John Markoff's _What the Dormouse Said: How Sixties Counterculture Shaped the Personal Computer Industry_: http://en.wikipedia.org/wiki/What_the_Dormouse_Said And as @MaryMad said, someone should remind Mr. Anderson that computers *have* proven remarkably good at spying on us. I suppose we could be gracious and say the qualification "that computers would be used *primarily* to spy on us" let's him off the hook, but I'm afraid this article is too obviously biased by Mr. Anderson's desire to service and profit from the DIY drone community through his company 3D Robotics. http://store.diydrones.com/ gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] janusvm still safe?
by tor＠lists.grepular.com 06 Jul '18

06 Jul '18

On 23/12/11 01:00, Gozu-san wrote: > Using encrypted LVM, swap (everything except boot) is encrypted. Still, > amnesia requires shutting down the host. If total amnesia is important, > you can turn off swap, write zeros to it, and then turn it back on again. I use encrypted LVM on my laptop. I disabled swap altogether. I placed the boot partition and boot loader on a separate USB stick which I keep on my person at all times. The full disk encryption uses a key file rather than a password. The key file lives on the USB stick, protected using GnuPG's symmetric encryption option. I also patched my Linux kernel with something called TRESOR to prevent the full disk encryption key living in RAM, to help defend against cold boot attacks. I wrote it all up here: https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sophisticated_Atta… -- Mike Cardwell https://grepular.com/ https://twitter.com/mickeyc Professional http://cardwellit.com/ http://linkedin.com/in/mikecardwell PGP.mit.edu 0018461F/35BC AF1D 3AA2 1F84 3DC3 B0CF 70A5 F512 0018 461F _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] janusvm still safe?
by tor＠lists.grepular.com 06 Jul '18

06 Jul '18

On 23/12/11 01:00, Gozu-san wrote: > Using encrypted LVM, swap (everything except boot) is encrypted. Still, > amnesia requires shutting down the host. If total amnesia is important, > you can turn off swap, write zeros to it, and then turn it back on again. I use encrypted LVM on my laptop. I disabled swap altogether. I placed the boot partition and boot loader on a separate USB stick which I keep on my person at all times. The full disk encryption uses a key file rather than a password. The key file lives on the USB stick, protected using GnuPG's symmetric encryption option. I also patched my Linux kernel with something called TRESOR to prevent the full disk encryption key living in RAM, to help defend against cold boot attacks. I wrote it all up here: https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sophisticated_Atta… -- Mike Cardwell https://grepular.com/ https://twitter.com/mickeyc Professional http://cardwellit.com/ http://linkedin.com/in/mikecardwell PGP.mit.edu 0018461F/35BC AF1D 3AA2 1F84 3DC3 B0CF 70A5 F512 0018 461F _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[i2p] weekly status notes [jun 21]
by jrandom 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi y'all, time to start back up our weekly status notes * Index 1) Dev[eloper] status 2) Dev[elopment] status 3) Unit test bounty 4) Service outage 5) ??? * 1) Dev[eloper] status After 4 cities in 4 countries, I'm finally getting settled and churning through code again. Last week I got the last of the pieces to a laptop together, I'm no longer couch hopping, and while I don't have net access at home, there are plenty of net cafes around, so access is reliable (just infrequent and expensive). That last point means that I won't be hanging out on irc as much as before, at least until the fall (I've got a sublet through August or so and will be looking for a place where I can get 24/7 net access). That doesn't, however, mean that I won't be doing as much - I'll just be working largely on my own test network, pushing out builds for live net testing (and, er, oh yeah, releases). It does mean though that we may want to move some discussions that used to go on free form in #i2p onto the list [1] and/or the forum [2] (I do still read the #i2p backlog though). I haven't found a reasonable place where I can go to for our development meetings yet, so I won't be there this week, but perhaps by next week I'll have found one. Anyway, enough about me. [1] http://dev.i2p.net/pipermail/i2p/ [2] http://forum.i2p.net/ * 2) Dev[elopment] status While I've been moving, there have been two main fronts that I've been working on - documentation and the SSU transport (the later only since I got the laptop). The docs are still in progress, with a big ol' scary overview one as well as a series of smaller implementation docs (covering things like source layout, component interaction, etc). SSU progress is going well - the new ACK bitfields are in place, the communication is dealing with (simulated) loss effectively, rates are appropriate for the various conditions, and I've cleared some of the uglier bugs I had run into previously. I am continuing to test these changes though, and once its appropriate we'll plot out a series of live net tests for which we'll need some volunteers to help out with. More news on that front when its available. * 3) Unit test bounty I'm glad to announce that Comwiz has come forward with a series of patches to claim the first phase of the unit test bounty [3]! We are still working through some minor details of the patches, but I've received the updates and generated both the junit and clover reports as necessary. I expect we'll have the patches in CVS shortly, at which point we'll put out Comwiz's testing docs. As clover is a commercial product (free for OSS developers [4]), only those who have installed clover and received their clover license will be able to generate the clover reports. In any case, we'll be publishing the clover reports on the web periodically, so those who don't have clover installed can still see how well our test suite is doing. [3] http://www.i2p.net/bounties_unittest [4] http://www.cenqua.com/clover/ * 4) Service outage As many have probably noticed, (at least) one of the outproxies is offline (squid.i2p), as is www.i2p, dev.i2p, cvs.i2p, and my blog. These are not unrelated events - the machine hosting them is hosed. I'm working on getting it back up though, at which point those five services will be back in operation. Just an FYI. * 5) ??? As there isn't a dev meeting on irc this week, if anyone else has anything to bring up, please feel free to post up to the list or the forum. I've been following the discussions on the list, the forum, and in #i2p while I've been away, and have been glad to be able to sit back and let other people answer most of the questions. I do appreciate the patience people have had with the slow down in releases as well, and realize that in some projects that would be cause for alarm. I2P is not, however, one of those projects - I've been working on it fulltime for more than two years now and will not stop until the needs that have been driving it are met. I am not wed to particular technologies for technologies sake, but merely follow what seems to be the best path from here to where we need to be, and as far as I can tell, we are still following the best path available. This summer, fall, and winter look to be a very exciting time in the anonymity field. =jr -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFCuEcEWYfZ3rPnHH0RAvltAJ0fuhd/QRRqICtnqITeljKRw8cbbACeInKx gaRYTsDAU3zHBCxr4TiSl18= =uXj9 -----END PGP SIGNATURE----- _______________________________________________ i2p mailing list i2p(a)i2p.net http://i2p.dnsalias.net/mailman/listinfo/i2p ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [tor-talk] Tor banned in Pakistan.
by andrew＠torproject.org 06 Jul '18

06 Jul '18

On Thu, Sep 08, 2011 at 10:23:41PM +0100, pumpkin(a)cotse.net wrote 1.4K bytes in 42 lines about: : http://www.guardian.co.uk/world/2011/aug/30/pakistan-bans-encryption-softwa… I talked to someone from the pakistani government about this encryption ban early this spring. They were concerned that this law would be far too broad and demolish whatever nascent e-commerce and online banking markets that had started in the country. They were also concerned that too many people in the government didn't understand the difference between a VPN and HTTPS. This person talked to American counter-terrorism people and found that actual terrorists were not using VPNs nor HTTPS at all. They stating right out in the open, from their registered DSL lines, their plans, where they lived, and what they were planning to do on various online chat network and forums. While technically, yes this law does make anything that uses encryption on the Internet in pakistan illegal, it was primarily aimed at the various VPN providers run by known criminal organizations. Tor, HTTPS Everywhere, and other tools are now illegal. Whether someone is actually prosecuted for using such tools in country remains to be seen. -- Andrew pgp key: 0x74ED336B _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] How secure is Bluetooth?
by Martyn Williams 06 Jul '18

06 Jul '18

Brian, > Again this is of course based on the assumption current technology cannot effectively monitor all 79 channels constantly for the duration of the call. However it also makes the assumption the data packets can be reconstructed into audio. Are you familiar with SDRs software defined radios? These are capable of monitoring a chunk of radio spectrum continuously. They're becoming very popular in amateur radio because they can monitor a band and visually indicate where the signals exist. I have one on my desk that works over 200kHz on frequencies up to 30MHz. The Bluetooth band is much higher in frequency and occupies 80MHz of spectrum. There's at least one SDR out there that can handle a 20MHz chunk of spectrum so, in theory, it could continuously monitor 1/4 of the Bluetooth band. Four radios (each a few thousand dollars) and some PCs and you might be able to monitor the whole band. You'd have to put the packets back together. I expect the difficulty of that depends on how noisy or quiet the Bluetooth spectrum is where the device is being used. If there isn't much traffic, it might be easy to match the packets together. Presumably the hopping works so that a transmission begins on one channel immediately after one ends on another. That might be enough to match them. You could also use the power level to help narrow down transmissions that might match each other. I have no idea if this would work in practice. Realtime would be more difficult than delayed processing. It's a potential method anyway. In reality it might be that the 2.4GHz band, which is also full of WiFi and other low power unlicensed radio stuff, is too noisy to do this easily. Even if you did get all the packets, you're still let with the encryption of the data. My point is, using SDRs it's possible to monitor a chuck of spectrum - not just one channel - continuously. Martyn -- Martyn Williams 2012 John S. Knight Journalism Fellow Stanford University Cell: 650-391-4868 @martyn_williams _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0