July 2018 - cypherpunks-legacy

[Dewayne-Net] Harlan Levy: Caught Up in DNA's Growing Web
by Dewayne Hendricks 06 Jul '18

06 Jul '18

[Note: This item comes from reader John McMullen. DLH]

1 0

Re: [tor-talk] Tor and HTTPS graphic
by The23rd Raccoon 06 Jul '18

06 Jul '18

On Wed, Mar 7, 2012 at 9:54 PM, Mike Perry <mikeperry(a)torproject.org> wrote: > You know, in hindsight, I don't want to sound like I'm hating on Steven > or his work. His work was quite clear along all of the dimensions I am > talking about, and was excellent research. > > He in fact did even compare 500 flows/hour to 50 flows/hour and found > that the success rate did drastically improve, implicitly acknowledging > and measuring the relationship between event rate and accuracy. Yes. Murdoch's work was quite informative, one of the more palatable dumpster morsels I've happened across. If you draw a line straight down figure 5(a) of [1] at 10k packets, you actually can see the effect of the base rate fallacy right there. As his concurrent flow count increases, the P(M|C) (which he calls P(correct target)) rate drops rather quickly. I bet if you got the actual P(C|M) values and adjusted the units appropriately, you'd find a 1/M^2 in there. George Danezis claimed in [2] that the best-match decision process of modern classifiers eliminates the quadratic 1/M^2 drop-off, but I don't believe that to be the case. I think that experimentally you'll find that your best-match classifier performs worse when you throw more items at it, just as Murdoch did. This effect is also seen in authorship classification work. The more authors you try to correlate, the worse off your rankings are. In fact, the last time I checked, state of the art text classification currently breaks down at around just 100 authors, using a best-match classifier. [1]. http://www.cl.cam.ac.uk/~sjm217/papers/pet07ixanalysis.pdf [2]. https://conspicuouschatter.wordpress.com/2008/09/30/the-base-rate-fallacy-a… _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Dewayne-Net] Harlan Levy: Caught Up in DNA's Growing Web
by Dewayne Hendricks 06 Jul '18

06 Jul '18

[Note: This item comes from reader John McMullen. DLH]

1 0

Re: [tor-talk] Tor and HTTPS graphic
by The23rd Raccoon 06 Jul '18

06 Jul '18

On Wed, Mar 7, 2012 at 9:54 PM, Mike Perry <mikeperry(a)torproject.org> wrote: > You know, in hindsight, I don't want to sound like I'm hating on Steven > or his work. His work was quite clear along all of the dimensions I am > talking about, and was excellent research. > > He in fact did even compare 500 flows/hour to 50 flows/hour and found > that the success rate did drastically improve, implicitly acknowledging > and measuring the relationship between event rate and accuracy. Yes. Murdoch's work was quite informative, one of the more palatable dumpster morsels I've happened across. If you draw a line straight down figure 5(a) of [1] at 10k packets, you actually can see the effect of the base rate fallacy right there. As his concurrent flow count increases, the P(M|C) (which he calls P(correct target)) rate drops rather quickly. I bet if you got the actual P(C|M) values and adjusted the units appropriately, you'd find a 1/M^2 in there. George Danezis claimed in [2] that the best-match decision process of modern classifiers eliminates the quadratic 1/M^2 drop-off, but I don't believe that to be the case. I think that experimentally you'll find that your best-match classifier performs worse when you throw more items at it, just as Murdoch did. This effect is also seen in authorship classification work. The more authors you try to correlate, the worse off your rankings are. In fact, the last time I checked, state of the art text classification currently breaks down at around just 100 authors, using a best-match classifier. [1]. http://www.cl.cam.ac.uk/~sjm217/papers/pet07ixanalysis.pdf [2]. https://conspicuouschatter.wordpress.com/2008/09/30/the-base-rate-fallacy-a… _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Secrecy News -- 09/13/12
by Steven Aftergood 06 Jul '18

06 Jul '18

Format Note: If you cannot easily read the text below, or you prefer to receive Secrecy News in another format, please reply to this email to let us know. SECRECY NEWS from the FAS Project on Government Secrecy Volume 2012, Issue No. 93 September 13, 2012 Secrecy News Blog: http://www.fas.org/blog/secrecy/ ** AN ARMY INTRODUCTION TO OPEN SOURCE INTELLIGENCE ** HOUSE VOTES TO REAUTHORIZE FISA AMENDMENTS ACT AN ARMY INTRODUCTION TO OPEN SOURCE INTELLIGENCE A new U.S. Army publication provides an introduction to open source intelligence, as understood and practiced by the Army. "Open-source intelligence is the intelligence discipline that pertains to intelligence produced from publicly available information that is collected, exploited, and disseminated in a timely manner to an appropriate audience for the purpose of addressing a specific intelligence and information requirement," the document says. "The world is being reinvented by open sources. Publicly available information can be used by a variety of individuals to [achieve] a broad spectrum of objectives. The significance and relevance of open-source intelligence (OSINT) serve as an economy of force, provide an additional leverage capability, and cue technical or classified assets to refine and validate both information and intelligence." See "Open-Source Intelligence," Army Techniques Publication (ATP) 2-22.9, July 2012: http://www.fas.org/irp/doddir/army/atp2-22-9.pdf The new manual is evidently intended for soldiers in the field rather than professional analysts, and it takes nothing for granted. At some points, the guidance that it offers is remedial rather than state of the art. For example, "if looking for information about Russian and Chinese tank sales to Iraq, do not use 'tank' as the only keyword in the search. Instead, use additional defining words such as 'Russian Chinese tank sales Iraq'." But the manual reflects the ongoing maturation of open source intelligence (OSINT), and it contains several observations of interest. "The reliance on classified databases has often left Soldiers uninformed and ill-prepared to capitalize on the huge reservoir of unclassified information from publicly available information and open sources," the manual states. Classification can also be a problem in open source intelligence, however, and "concern for OPSEC [operations security] can undermine the ability to disseminate inherently unclassified information." "Examples of unclassified information being over-classified [include] reported information found in a foreign newspaper [and a] message from a foreign official attending an international conference." Therefore, pursuant to Army regulations, "Army personnel will not apply classification or other security markings to an article or portion of an article that has appeared in a newspaper, magazine, or other public medium," although the resulting OSINT analysis might be deemed "controlled unclassified information." Curiously, the new manual itself is blocked from access by the general public on Army websites. But an unrestricted copy was released by the Army on request. Somewhat relatedly, the Department of Defense this week published a new Instruction on DoD Internet Services and Internet-Based Capabilities, DODI 8550.01, September 11, 2012: http://www.fas.org/irp/doddir/dod/i8550_01.pdf HOUSE VOTES TO REAUTHORIZE FISA AMENDMENTS ACT The House of Representatives voted yesterday to renew the Foreign Intelligence Surveillance Act (FISA) Amendments Act for five years. The Act generally authorizes electronic surveillance of non-U.S. persons and U.S. persons who are believed to be outside the United States, while prohibiting the "intentional" targeting of persons in the U.S. without an individualized warrant, seemingly leaving a wide opening for unintentional or incidental collection. This and other features of the Act prompted concerns about the expansion of surveillance authority and the erosion of constitutional protections. But such concerns, however eloquently expressed by a few dissenting Members, gained little traction. The House rebuffed efforts to increase reporting on implementation of the law or to shorten the duration of its renewal, and approved the measure by a vote of 300-118. http://www.fas.org/irp/congress/2012_cr/faa_house.html In the Senate, Sen. Ron Wyden has placed a hold on the bill in an attempt to compel disclosure of the current scale of government interception of U.S. communications, which the Administration says it cannot provide. The Congressional Research Service has produced a new report on "Reauthorization of the FISA Amendments Act," dated September 12, 2012. http://www.fas.org/sgp/crs/intel/R42725.pdf The ACLU is challenging the constitutionality of the Act in a case that will be heard by the U.S. Supreme Court on October 29. http://www.aclu.org/national-security/amnesty-et-al-v-clapper _______________________________________________ Secrecy News is written by Steven Aftergood and published by the Federation of American Scientists. The Secrecy News Blog is at: http://www.fas.org/blog/secrecy/ To SUBSCRIBE to Secrecy News, go to: http://www.fas.org/sgp/news/secrecy/subscribe.html To UNSUBSCRIBE, go to http://www.fas.org/sgp/news/secrecy/unsubscribe.html OR email your request to saftergood(a)fas.org Secrecy News is archived at: http://www.fas.org/sgp/news/secrecy/index.html Support the FAS Project on Government Secrecy with a donation: http://www.fas.org/member/donate_today.html _______________________ Steven Aftergood Project on Government Secrecy Federation of American Scientists web: www.fas.org/sgp/index.html email: saftergood(a)fas.org voice: (202) 454-4691 twitter: @saftergood ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Tor 0.1.1.16-rc is out
by Roger Dingledine 06 Jul '18

06 Jul '18

This is the second release candidate for the 0.1.1.x series. It fixes a variety of odds and ends, including getting started on making it easier to add new authoritative dirservers. http://tor.eff.org/download.html Changes in version 0.1.1.16-rc - 2006-03-18 o Bugfixes on 0.1.1.15-rc: - Fix assert when the controller asks to attachstream a connect-wait or resolve-wait stream. - Now do address rewriting when the controller asks us to attach to a particular circuit too. This will let Blossom specify "moria2.exit" without having to learn what moria2's IP address is. - Make the "tor --verify-config" command-line work again, so people can automatically check if their torrc will parse. - Authoritative dirservers no longer require an open connection from a server to consider him "reachable". We need this change because when we add new auth dirservers, old servers won't know not to hang up on them. - Let Tor build on Sun CC again. - Fix an off-by-one buffer size in dirserv.c that magically never hit our three authorities but broke sjmurdoch's own tor network. - If we as a directory mirror don't know of any v1 directory authorities, then don't try to cache any v1 directories. - Stop warning about unknown servers in our family when they are given as hex digests. - Stop complaining as quickly to the server operator that he hasn't registered his nickname/key binding. - Various cleanups so we can add new V2 Auth Dirservers. - Change "AllowUnverifiedNodes" to "AllowInvalidNodes", to reflect the updated flags in our v2 dir protocol. - Resume allowing non-printable characters for exit streams (both for connecting and for resolving). Now we tolerate applications that don't follow the RFCs. But continue to block malformed names at the socks side. o Bugfixes on 0.1.0.x: - Fix assert bug in close_logs(): when we close and delete logs, remove them all from the global "logfiles" list. - Fix minor integer overflow in calculating when we expect to use up our bandwidth allocation before hibernating. - Fix a couple of bugs in OpenSSL detection. Also, deal better when there are multiple SSLs installed with different versions. - When we try to be a server and Address is not explicitly set and our hostname resolves to a private IP address, try to use an interface address if it has a public address. Now Windows machines that think of themselves as localhost can work by default. o New features: - Let the controller ask for GETINFO dir/server/foo so it can ask directly rather than connecting to the dir port. - Let the controller tell us about certain router descriptors that it doesn't want Tor to use in circuits. Implement SETROUTERPURPOSE and modify +POSTDESCRIPTOR to do this. - New config option SafeSocks to reject all application connections using unsafe socks protocols. Defaults to off. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: "Low-Resource Routing Attacks Against Anonymous Systems"
by James Muir 06 Jul '18

06 Jul '18

James Muir wrote: >No one seems to have posted this to the list yet, so I thought I should: > >"Low-Resource Routing Attacks Against Anonymous Systems", >K. Bauer, D. McCoy, D. Grunwald, T. Kohno, D. Sicker >Technical Report, University of Colorado > >http://www.cs.colorado.edu/department/publications/reports/docs/CU-CS-1025-0 7.pdf > > >It was posted on Slashdot: > >http://yro.slashdot.org/yro/07/02/25/1913219.shtml For those interested, here is someone's official response about the Technical Report and its implications for the Tor network: http://blogs.law.harvard.edu/anonymous/2007/02/26/the-rumors-of-our-demise/ Does anyone know who authored that? It seems a bit strange to have an anonymous official statement, but maybe this is appropriate for Tor ;-) Here is an FAQ by one of the Tech Report's authors: http://home.cs.colorado.edu/~bauerk/faq.html -James ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[liberationtech] UPDATE - Re: potentially major security flaw in twitter
by Brian Conley 06 Jul '18

06 Jul '18

Hi all, So an update. Essentially I've run into what some of you have probably previously mentioned, the impact of the OAuth protocol. For an uninformed user of twitter, OAuth can cause them to provide access to their twitter account from secondary devices even after changing passwords at the source. Obviously this has huge implications for citizen journalists, activists, and human rights workers among others. Anyone who is detained and whose twitter passwords become compromised (as well as other applications, i'm guessing the facebook app for iPad also uses OAUTH, though it may just store the password) is at risk of providing ongoing access to these apps if they fail to remove the OAuth authorization after changing their passwords. Does anyone know of resources that have been produced to raise awareness about this issue, or similar issues? I'm wondering whether Small World News should put some effort into developing a more comprehensive social media security 101 that considers these technical issues as well as general best practices? Regards Brian On Wed, Dec 21, 2011 at 5:38 PM, Brian Conley <brianc(a)smallworldnews.tv>wrote: > Hi all, > > So I don't really want to broadcast this to an entire list of people whom > I don't know, but I've found what is potentially a huge flaw in twitter's > security architecture. Can any of you connect me directly with someone at > Twitter who is involved with security? > > I will be happy to brief the list once its fixed. > > Brian > > -- > > > > Brian Conley > > Director, Small World News > > http://smallworldnews.tv > > m: 646.285.2046 > > Skype: brianjoelconley > > public key: > http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE827FACCB139C9F0 > > -- Brian Conley Director, Small World News http://smallworldnews.tv m: 646.285.2046 Skype: brianjoelconley public key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE827FACCB139C9F0 _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Tor 0.1.1.16-rc is out
by Roger Dingledine 06 Jul '18

06 Jul '18

This is the second release candidate for the 0.1.1.x series. It fixes a variety of odds and ends, including getting started on making it easier to add new authoritative dirservers. http://tor.eff.org/download.html Changes in version 0.1.1.16-rc - 2006-03-18 o Bugfixes on 0.1.1.15-rc: - Fix assert when the controller asks to attachstream a connect-wait or resolve-wait stream. - Now do address rewriting when the controller asks us to attach to a particular circuit too. This will let Blossom specify "moria2.exit" without having to learn what moria2's IP address is. - Make the "tor --verify-config" command-line work again, so people can automatically check if their torrc will parse. - Authoritative dirservers no longer require an open connection from a server to consider him "reachable". We need this change because when we add new auth dirservers, old servers won't know not to hang up on them. - Let Tor build on Sun CC again. - Fix an off-by-one buffer size in dirserv.c that magically never hit our three authorities but broke sjmurdoch's own tor network. - If we as a directory mirror don't know of any v1 directory authorities, then don't try to cache any v1 directories. - Stop warning about unknown servers in our family when they are given as hex digests. - Stop complaining as quickly to the server operator that he hasn't registered his nickname/key binding. - Various cleanups so we can add new V2 Auth Dirservers. - Change "AllowUnverifiedNodes" to "AllowInvalidNodes", to reflect the updated flags in our v2 dir protocol. - Resume allowing non-printable characters for exit streams (both for connecting and for resolving). Now we tolerate applications that don't follow the RFCs. But continue to block malformed names at the socks side. o Bugfixes on 0.1.0.x: - Fix assert bug in close_logs(): when we close and delete logs, remove them all from the global "logfiles" list. - Fix minor integer overflow in calculating when we expect to use up our bandwidth allocation before hibernating. - Fix a couple of bugs in OpenSSL detection. Also, deal better when there are multiple SSLs installed with different versions. - When we try to be a server and Address is not explicitly set and our hostname resolves to a private IP address, try to use an interface address if it has a public address. Now Windows machines that think of themselves as localhost can work by default. o New features: - Let the controller ask for GETINFO dir/server/foo so it can ask directly rather than connecting to the dir port. - Let the controller tell us about certain router descriptors that it doesn't want Tor to use in circuits. Implement SETROUTERPURPOSE and modify +POSTDESCRIPTOR to do this. - New config option SafeSocks to reject all application connections using unsafe socks protocols. Defaults to off. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: "Low-Resource Routing Attacks Against Anonymous Systems"
by James Muir 06 Jul '18

06 Jul '18

James Muir wrote: >No one seems to have posted this to the list yet, so I thought I should: > >"Low-Resource Routing Attacks Against Anonymous Systems", >K. Bauer, D. McCoy, D. Grunwald, T. Kohno, D. Sicker >Technical Report, University of Colorado > >http://www.cs.colorado.edu/department/publications/reports/docs/CU-CS-1025-0 7.pdf > > >It was posted on Slashdot: > >http://yro.slashdot.org/yro/07/02/25/1913219.shtml For those interested, here is someone's official response about the Technical Report and its implications for the Tor network: http://blogs.law.harvard.edu/anonymous/2007/02/26/the-rumors-of-our-demise/ Does anyone know who authored that? It seems a bit strange to have an anonymous official statement, but maybe this is appropriate for Tor ;-) Here is an FAQ by one of the Tech Report's authors: http://home.cs.colorado.edu/~bauerk/faq.html -James ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0