July 2018 - cypherpunks-legacy

Re: [Fwd: High-traffic Colluding Tor Routers in Washington, D.C. Confirmed]
by Roger Dingledine 06 Jul '18

06 Jul '18

On Fri, Apr 13, 2007 at 03:24:40PM +0700, Vlad SATtva Miller wrote: > ...However none of the mentioned below router nicknames or fingerprints > was found in the current local cache file. > > -------- Original Message -------- > Subject: High-traffic Colluding Tor Routers in Washington, D.C. Confirmed > Date: Thu, 12 Apr 2007 23:35:52 -0400 > From: Nostra2004(a)Safe-mail.net > To: cypherpunks(a)jfet.org > > A group of 9 Tor routers also functioning overtly or indirectly as Tor > exit nodes have been observed colluding on the public Tor network. Yeah. This happened in mid 2006. I don't know why some random person just picked it up now. We (mainly Steven Murdoch and Richard Clayton) tracked down the fellow running them. It turned out to be an innocent mistake. He's still running quite a few, on the same network, but now he sets the MyFamily torrc option on them. This issue also prompted us to speed up the fix/feature in 0.1.2.1-alpha: "Automatically avoid picking more than one node from the same /16 network when constructing a circuit." http://archives.seul.org/or/talk/Aug-2006/msg00300.html > Collusion was definitively established by the following method: For a more interesting (and more conclusive imo) method of deciding they're the same, check out slide 28 in Steven's slides from his CCS paper and 23C3 talk, where he investigated these servers: http://www.cl.cam.ac.uk/~sjm217/talks/ccc06hotornot.pdf --Roger ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Suggested IT Text... Edit or destroy as fitting.
by Michael 06 Jul '18

06 Jul '18

Not to jump in with both feet, but here's some possible starting text ideas for the "IT People Use Tor" section... Ahem... "IT Professionals use Tor: * To verify IP based firewall rules: A firewall may have some policies that only allow certain IP addresses or ranges. Tor can be used to verify those configurations by using an IP number outside of the company's alloted IP block. * To bypass their own security systems for sensitive professional activities: For instance, a company may have a strict policy regarding the material employees can view on the internet. A log review reveals a possible violation. Tor can be used to verify the information without an exception being put into corporate security systems. * To connect back to deployed services: A network engineer can use Tor to remotely connect back to services, without the need for an external machine and user account, as part of operational testing. * To access internet resources: Acceptable use policy for IT Staff and normal employees is usually different. Tor can allow unfettered access to the internet while leaving standard security policies in place. * To work around ISP network outages: Sometimes when an ISP is having routing or DNS problems, Tor can make internet resources available, when the actual ISP is malfunctioning. This can be invaluable is crisis situations. * The CTO is an asshat: Your CTO is a golf loving moron who hasn't spent any time in front of a computer since 1988. He bought some crappy appliance, which sits at the edge of your network, tracking your activity, while you track everyone else's activity- including his. This Mongolian Cluster Fuck never seems to end. Root Cause Analysis sessions go on for days on end. Plans are made to DDOS his Comcast cable connection, one of your assistants claims he can bed the CTOs wife, and the accounting system is missing data (really- it's the CTOs missing porn collection). Cooler heads prevail... you just install Tor and read Slashdot. Ok, maybe the last one isn't salvageable. I gave it my best shot. Michael ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Open Manufacturing] Slashdot | Professor Gets 4 Years in Prison for Sharing Drone Plans With Students
by Paul D. Fernhout 06 Jul '18

06 Jul '18

From: http://yro.slashdot.org/story/09/07/03/1721230/Professor-Gets-4-Years-in-Pr… "Retired University of Tennessee Professor Dr. John Reece Roth has been sentenced to four years in prison after he allowed a Chinese graduate student to see sensitive information on Unmanned Air Vehicles (UAVs), also known as drones. In 2004, the company Roth helped found, Atmospheric Glow Technologies, won a US Air Force contract to develop a plasma actuator that could help reduce drag on the wings of drones, such as the ones the military uses. Under the contract, for which Roth was reportedly paid $6,000, he was prohibited from sharing sensitive data with foreign nationals. Despite warnings from his university's Export Control Officer, in 2006, Roth took a laptop containing sensitive plans with him on a lecture tour in China and also allowed graduate students Xin Dai of China and Sirous Nourgostar of Iran to work on the project. 'The illegal export of restricted military data represents a serious threat to national security,' says David Kris of the US Department of Justice. 'We know that foreign governments are actively seeking this information for their own military development. Today's sentence should serve as a warning to anyone who knowingly discloses restricted military data in violation of our laws.' During his trial, Roth testified that he was unaware that hiring the graduate students was a violation of his contract. 'This whole thing has not helped me, it has not helped the university,' said Roth. 'And it has probably not helped this country, either.'" http://www.scientificamerican.com/blog/60-second-science/post.cfm?id=tennes… http://www.knoxnews.com/news/2008/jun/24/atmospheric-glow-to-sell/ http://news.prnewswire.com/DisplayReleaseContent.aspx?ACCT=104&STORY=/www/s… Some space related technology has similar restrictions. So, scarcity-oriented organizations are preventing information flow to other scarcity-oriented organizations using post-scarcity means (bureaucracy, computers coordinating data collection, government tax dollars raised through cooperation). But in the process they are producing artificial scarcity for everyone, because it is not clear what you can legally share is some fields. In general, stories like this have a chilling effect on cross-border cooperation. People had related stories at the SSI conferences about legal issues sharing information related to rocketry and satellites. Similar paranoia crippled and delayed strong encryption in the USA, one of the reason the internet is a less safe place today as far as phishing and other problems. --Paul Fernhout http://www.pdfernhout.net/ --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Open Manufacturing" group. To post to this group, send email to openmanufacturing(a)googlegroups.com To unsubscribe from this group, send email to openmanufacturing+unsubscribe(a)googlegroups.com For more options, visit this group at http://groups.google.com/group/openmanufacturing?hl=en -~----------~----~----~----~------~----~------~--~--- ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Freedombox-discuss] Introducing the Technical Advisory Committee
by James Vasile 06 Jul '18

06 Jul '18

# Introducing the Technical Advisory Committee As the community continues to push the FreedomBox from idea towards reality, it is time to expand our technical leadership team. We are happy to announce the formation of a technical advisory committee to help coordinate and guide the development efforts of this project. This advisory committee is already underway, with an initial membership of industry leaders including: * Bdale Garbee, Open Source & Linux Chief Technologist at Hewlett-Packard, * Jacob Appelbaum from the Tor project, * Sam Hartman, former Chief Technologist at the MIT Kerberos Consortium and IETF Security Area Director, * Sascha Meinrath, Director of the New America Foundation's Open Technology Initiative, * Rob Savoye, long-time GNU hacker, Gnash lead developer, and winner of the 2010 award for the Advancement of Free Software * Matt Zimmerman, former Canonical CTO We'll be hearing more from the TAC over the coming weeks and months. Anyone interested in following the activity of the advisory committee as it happens is welcome to check out the public archives of their email list at http://lists.freedomboxfoundation.org/s/arc/tac. If you want to talk to the TAC in real time, they can be found in #freedombox-tac on irc.oftc.net. _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] The consequences of DigiNotar's failure
by Ian G 06 Jul '18

06 Jul '18

On 18/09/11 8:38 AM, Jeffrey Walton wrote: > On Fri, Sep 16, 2011 at 1:07 PM, M.R.<makrober(a)gmail.com> wrote: >> On 16/09/11 09:16, Jeffrey Walton wrote: >>> >>> The problem is that people will probably die >>> due Digitar's failure. >> >> I am not the one to defend DigiNotar, but I would not make such >> dramatic assumption. > I don't think DigiNotar has any defenders remaining :) As for the > dramatic assumptions, I believe past performance is indicative of > future expectations: http://en.wikipedia.org/wiki/SAVAK and > http://en.wikipedia.org/wiki/SAVAMA. (Sorry about the lame wiki > reference, I probably should have found a UN human rights report). I don't think there is any doubt that people can die because of breached communications. No need to look at the Iranians, just look at the US CIA, and the intel feeding into drones. The question of causality is one that is very difficult to determine, absent some pattern revealed by WikiLeaks (who have been accused as well). However causality is also very important. Without some historical pattern of facts, we're all speculating to a greater or lesser degree. How confident are we of that? >> No one actively working against a government that is known to engage >> in extra-legal killings will trust SSL secured e-mail to protect him >> or her from the government surveillance. This is a sadly inaccurate statement. Most people working actively and aggressively against unconstrained governments know diddly squat about tech. The communities have frequent roll-over, frequent recruitment. The techies working with them are under considerable pressure to deliver, and often make basic mistakes. > Perhaps I don't appreciate all the pressure and options, but I believe > an [external] email service using HTTPS is one of the safer options > available when observing due dilligence. Yes, definately. Open question: did the 9/11 guys use HTTPS? Or just HTTP? I'm still searching for a case where it makes a clear difference. (Their main counter-intel coup was to understand that the threat model better than their enemy. Their technique was to open an ordinary Yahoo style account, share the account, then open up a draft email, and share that! Never send it, just edit and delete, over and over. The NSA which were presumably hoovering all sent emails ... never saw a thing.) > Its kind of like the poor > man's cloud (and corporate america is flocking to the cloud, in part > due to the additional layer of liability offload). ! OK, I'll bite. How does one offload liability by using the cloud? (Note that liability is the keystone to the PKI debate.... Understand the liability transfers and you understand why it's SNAFU.) iang _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Exactly how are satellite transmissions tapped/intercepted, in Syria and elsewhere?
by Brian Conley 06 Jul '18

06 Jul '18

Thanks for your comments Jake. Those are all essentially my perceptions as well. This is why I see the primary goal to be informing people just how dangerous satellite phones are, and providing the best practices possible. In the case of Syrian activists, they've turned to satphones not because they believe they are the magical devices seen in "24" but because they are the best of a lot of bad options. Right now we know thuraya is compromised, but its important to ensure activists have the best possible information about the likelihood other networks will be compromised, etc. Where might I locate information about tampering with the location specifics? Would also be really happy to have your insight and other suggestions, on or off list. On Mon, Nov 28, 2011 at 7:16 PM, Jacob Appelbaum <jacob(a)appelbaum.net>wrote: > On 11/28/2011 04:22 PM, Gustaf Bjvrksten wrote: > > On 11/28/2011 05:42 PM, Brian Conley wrote: > >> Hi all, > >> > >> First of all, thanks Brett for that article about Area SpA, great news! > >> > >> Secondly, I'm in the middle of some research into how satellite > >> communications are being used by activists, as well as how they are > being > >> used/intercepted by Syrian authorities in an attempt to quell the > uprising. > >> I've read a number of articles in a disjointed fashion, and am just now > >> beginning to coordinate my efforts. I am working on a series of best > >> practices for being "most safe" as I'm not sure we can offer much better > >> than that with regard to satellite equipment, furthermore I'm hoping to > >> provide an educated understanding of just what the risks are and what > might > >> be done to mitigate them. However my impression is that the guide will > >> primarily be about understanding the full extent of the risk you place > >> yourself in. > >> > >> I have heard rumors about Syria's capacity direct from Syrian activists, > >> including that some calls made with thuraya phones have been recorded, > and > >> that a phone simply making a call, for the first time, in a distant > >> location was tracked by syrian authorities. unfortunately, as many of > you > >> know, such anecdotes are not as helpful as they might seem, and that its > >> important to understand, as best we can, just why thuraya phones seem > to be > >> "less safe" than inmarsat or iridium, and to ensure that syrians don't > >> become lax and begin to depend on an alternate tool to thuraya such as > >> inmarsat phones, only to find themselves equally targeted via that > means, > >> though it may take the regime longer to establish practices. > >> > >> Anyhow, what I'm looking for are accounts of how satphones have been > >> used/tracked in syria, as well as articles about syria's capacity to > >> monitor satellite transmissions. Separately I'll be researching the > >> practical capabilities of various satphones to ensure that readers of > the > >> guide have access to the best information available, though this will > >> obviously need to evolve over time. > > > > Hi Brian, > > > > Access has also heard a number of reports from Syria that Thuraya > > satellite devices have been giving away the location of the device > > operators as soon as the devices are used. Our reports suggest this is > > limited to Thuraya devices only, and that the use of satellite > > technology from other providers does not seem to have the consequence of > > position information leakage to the authorities at this time. > > > > This is not strictly correct. All satellite communications systems are > privacy invasive. BGAN, Thuraya, etc. > > > We do know that Thuraya devices transmit their location periodically as > > part of their communications protocol[1][2]. > > This is common in all satellite communications systems. > > > While this information is > > encrypted there seems to be some doubt as to the strength of that > > encryption. The US military complex did not have much faith in it and > > seems to have been able to bypass or crack the encryption to access the > > location information of Thuraya devices used by Iraqi Government > > officials[2]. While it is not clear exactly how this was achieved we do > > know that Thuraya devices were manufactured by Boeing and this fact may > > have contributed to an easy decryption route for US forces. > > > > Thuraya is easy to monitor. It's not even expensive. There are > commercial solutions and there are non-commercial projects that work > with common hardware. Satellite communication networks are absolutely > not secure to use without additional protection. If location anonymity > is important, I highly advise against using satellite communications > technology. Unless you've properly tampered with the device to falsify > the location reporting, you're probably not as secure as you'd like... > > > In addition to this the location information clearly appears in > > unencrypted form in server logs at Thuraya itself[1]. This is worrying > > as it turns out that Thuraya is predominantly owned by Etisalat, a telco > > from the UAE with a dark history regarding surveillance of their > users[3]. > > > > All of these systems keep logs. All of the satellite companies have a > dark history. > > > Etisalat have telecommunications interests in places including Egypt, > > Iran, Saudi Arabia, Qatar, Indonesia, and Sri Lanka. Etisalat was also > > alleged to be involved in a $39 billion scam in 2010 in India[4], and > > they deployed and manage the internet censorship system under the > > direction of the authorities in the UAE[5]. > > > > Due to the above-mentioned technical and ownership issues we > > recommend civil society do not use Thuraya satellite devices in the MENA > > region. To our knowledge devices from other vendors do not seem to be > > affected at this time. Access is working to gather further evidence from > > the ground in Syria and elsewhere in the MENA region to shine further > > light on the possible misuse of Thuraya satellite device location > > information. We also welcome any further information from anyone on this > > mailing list. > > > > It's all about threat models. If you're worried about people who have > control of Thuraya, use a BGAN. If you're worried about upsetting people > who have control of the Hughes network, use Thuraya. If you're worried > about location anonymity or evading content inspection, hack your device > to lie about the GPS location of your device. The location must be > within the same spot beam as your physical location or your device will > not sync with the birds in the sky. If you're using one of these devices > to transfer data at all, I highly encourage the use of Tor as you're > absolutely to be intercepted by multiple parties. > > Some BGAN devices can be programmed to only send the spot beam ID but > again, you're trusting closed source, proprietary software/hardware with > your life. That's not a thing I'd suggest. Certainly not in a place like > Syria or other extremely hostile places. > > All the best, > Jacob > _______________________________________________ > liberationtech mailing list > liberationtech(a)lists.stanford.edu > > Should you need to change your subscription options, please go to: > > https://mailman.stanford.edu/mailman/listinfo/liberationtech > > If you would like to receive a daily digest, click "yes" (once you click > above) next to "would you like to receive list mail batched in a daily > digest?" > > You will need the user name and password you receive from the list > moderator in monthly reminders. > > Should you need immediate assistance, please contact the list moderator. > > Please don't forget to follow us on http://twitter.com/#!/Liberationtech > -- Brian Conley Director, Small World News http://smallworldnews.tv m: 646.285.2046 Skype: brianjoelconley _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Freedombox-discuss] Introducing the Technical Advisory Committee
by James Vasile 06 Jul '18

06 Jul '18

# Introducing the Technical Advisory Committee As the community continues to push the FreedomBox from idea towards reality, it is time to expand our technical leadership team. We are happy to announce the formation of a technical advisory committee to help coordinate and guide the development efforts of this project. This advisory committee is already underway, with an initial membership of industry leaders including: * Bdale Garbee, Open Source & Linux Chief Technologist at Hewlett-Packard, * Jacob Appelbaum from the Tor project, * Sam Hartman, former Chief Technologist at the MIT Kerberos Consortium and IETF Security Area Director, * Sascha Meinrath, Director of the New America Foundation's Open Technology Initiative, * Rob Savoye, long-time GNU hacker, Gnash lead developer, and winner of the 2010 award for the Advancement of Free Software * Matt Zimmerman, former Canonical CTO We'll be hearing more from the TAC over the coming weeks and months. Anyone interested in following the activity of the advisory committee as it happens is welcome to check out the public archives of their email list at http://lists.freedomboxfoundation.org/s/arc/tac. If you want to talk to the TAC in real time, they can be found in #freedombox-tac on irc.oftc.net. _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

FC: Privacy: Where's the Profit? event Thurs 7/12 in Mountain View
by Declan McCullagh 06 Jul '18

06 Jul '18

[I was scheduled to participate in this event organized by the Silicon Valley Association of Startup Entrepreneurs but, alas, won't be able to make it. It promises to be an excellent discussion, and I urge Politech members in the area to stop by. --Declan] ********* http://www.svase.org/nextmeeting.htm THE MAIN EVENT: SVASE Monthly Meeting Privacy: Where's the Profit? Microsoft Campus, Mountain View Thursday, July 12, 2001, 6 pm Hundreds, perhaps thousands, of startup business plans are based on exploiting privacy technologies. Technologies that protect privacy --- as well as business plans based on those that undermine it --- seem to come out nearly every week. Existing or proposed federal privacy laws will have a huge impact on whether those plans ever succeed. This extraordinarily high-powered panel of experts will sort through the issues and tell you what they view as the key issues for entrepreneurs facing - or hoping to make money from - the rules and regulations of electronic privacy. Our keynote speaker and moderator JIM HARPER, based in Washington, DC, is one of the world's preeminent experts in privacy policy. He is the founder and principal of PolicyCounsel.Com, a lobbying and consulting firm focused on e-commerce, technology, and telecommunications. He is the founder of Privacilla.org, the only online think-tank devoted to privacy as a public policy issue. Mr. Harper served as counsel to committees in both the United States House of Representatives and the United States Senate. He now works to help Congress and regulators understand the New Economy. In his presentation to SVASE, Jim will unpack the complex concept of privacy and discuss the thinking and plans of legislators, regulators, and advocates. Progress & Freedom Foundation (<http://www.pff.org/>http://www.pff.org/) recently named Jim as an Adjunct Fellow. MARK UNCAPHER is Vice President and Counsel of the Information Technology Association of America, responsible for ITAA s Internet Commerce & Communications Division. The more than 100 members of the division include: Amazon.com, AOLTime Warner, AT&T, Boeing, Cable & Wireless, Covad Communications, EDS, Exodus, Focal Communications, Fujitsu Limited, Global Crossings, IBM, MCI WorldCom, Metromedia Fiber Network, Microsoft, Nortel Networks, SunGard Data, Teligent, and Yahoo. Uncapher argues that the issue is not about whether to protect consumer privacy on the Internet -- that is what the public expects and what Internet companies are determined to provide -- the challenge is to identify the best and most profitable ways to do so. DAVE KRAMER is a litigation partner with the reknowned law firm Wilson Sonsini Goodrich & Rosati. On the privacy front, Kramer has worked extensively with technology pioneers such as Google and Netscape, developing startups such as Napster and Yodlee, and new online entrants like Orbitz, Cogit and Enviz. Mr. Kramer will discuss the biggest threats companies currently face in the privacy arena, including privacy regulation. DECLAN McCULLAGH is Washington Bureau Chief for Wired News. He has been writing about the Internet since 1990. McCullagh moderates politech, a mailing list looking broadly at politics and technology that was founded in 1994. He has appeared on CNN, CNN-fn, Court TV, NPR, ABC News, CNBC, CBC, CSPAN, Reuters TV, and Fox News. He is a member of the International Academy of Digital Arts and Sciences and has been a judge in the Webby awards, the Ars Electronica awards, the Internet Freedom journalism awards, and the Pacific Research Institute technology privatization awards. RAY EVERETT-CHURCH, is a Principal at PrivacyClue LLC. Called the "dean of corporate privacy officers" by Inter@ctive Week Magazine, Ray Everett-Church is an internationally recognized expert on privacy law and policy. In 1999, he became the world's first corporate Chief Privacy Officer, a ground-breaking position soon adopted by dozens of Fortune 500 firms. Founder of PrivacyClue LLC, a privacy-oriented consultancy, he advises firms on developing privacy measures consistent with existing laws, prevailing consumer attitudes, and acceptable industry practices. He was previously an attorney with the Washington, DC-area telecommunications law firm of Haley Bader & Potts, and has counseled America Online, Microsoft, and numerous start-up ventures. __________________ Meetings costs are as follows: PRE-REGISTERED RATES Member Meeting Only - FREE Member Meeting & Dinner - $25 Non-Member Meeting & Dinner - $45 New Membership & Meeting - $125 New Membership, Meeting & Dinner - $150 Sponsor or Sponsor's Guest - FREE Sponsor or Sponsor's Guest Meeting & Dinner - $25 Student Meeting Only - $10 WALK IN RATES Member Meeting & Dinner - $35 Non-Member Meeting & Dinner - $55 New Membership & Meeting - $125 New Membership, Meeting & Dinner - $160 Meeting Agenda: 6:00 - Buffet Opens (Time for Networking) 7:00 - Announcements and Reports 7:15 - Panel Begins 9:00 - Final Announcements and More Networking The July meeting is being held at: Microsoft Silicon Valley Campus - Building 1 1065 La Avenida (formerly L'avenida) Mountain View, CA 94043 Phone: 650-693-4000 ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. To subscribe, visit http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- ----- End forwarded message -----

1 0

Re: [Fwd: High-traffic Colluding Tor Routers in Washington, D.C. Confirmed]
by Roger Dingledine 06 Jul '18

06 Jul '18

On Fri, Apr 13, 2007 at 03:24:40PM +0700, Vlad SATtva Miller wrote: > ...However none of the mentioned below router nicknames or fingerprints > was found in the current local cache file. > > -------- Original Message -------- > Subject: High-traffic Colluding Tor Routers in Washington, D.C. Confirmed > Date: Thu, 12 Apr 2007 23:35:52 -0400 > From: Nostra2004(a)Safe-mail.net > To: cypherpunks(a)jfet.org > > A group of 9 Tor routers also functioning overtly or indirectly as Tor > exit nodes have been observed colluding on the public Tor network. Yeah. This happened in mid 2006. I don't know why some random person just picked it up now. We (mainly Steven Murdoch and Richard Clayton) tracked down the fellow running them. It turned out to be an innocent mistake. He's still running quite a few, on the same network, but now he sets the MyFamily torrc option on them. This issue also prompted us to speed up the fix/feature in 0.1.2.1-alpha: "Automatically avoid picking more than one node from the same /16 network when constructing a circuit." http://archives.seul.org/or/talk/Aug-2006/msg00300.html > Collusion was definitively established by the following method: For a more interesting (and more conclusive imo) method of deciding they're the same, check out slide 28 in Steven's slides from his CCS paper and 23C3 talk, where he investigated these servers: http://www.cl.cam.ac.uk/~sjm217/talks/ccc06hotornot.pdf --Roger ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] The consequences of DigiNotar's failure
by Ian G 06 Jul '18

06 Jul '18

On 18/09/11 8:38 AM, Jeffrey Walton wrote: > On Fri, Sep 16, 2011 at 1:07 PM, M.R.<makrober(a)gmail.com> wrote: >> On 16/09/11 09:16, Jeffrey Walton wrote: >>> >>> The problem is that people will probably die >>> due Digitar's failure. >> >> I am not the one to defend DigiNotar, but I would not make such >> dramatic assumption. > I don't think DigiNotar has any defenders remaining :) As for the > dramatic assumptions, I believe past performance is indicative of > future expectations: http://en.wikipedia.org/wiki/SAVAK and > http://en.wikipedia.org/wiki/SAVAMA. (Sorry about the lame wiki > reference, I probably should have found a UN human rights report). I don't think there is any doubt that people can die because of breached communications. No need to look at the Iranians, just look at the US CIA, and the intel feeding into drones. The question of causality is one that is very difficult to determine, absent some pattern revealed by WikiLeaks (who have been accused as well). However causality is also very important. Without some historical pattern of facts, we're all speculating to a greater or lesser degree. How confident are we of that? >> No one actively working against a government that is known to engage >> in extra-legal killings will trust SSL secured e-mail to protect him >> or her from the government surveillance. This is a sadly inaccurate statement. Most people working actively and aggressively against unconstrained governments know diddly squat about tech. The communities have frequent roll-over, frequent recruitment. The techies working with them are under considerable pressure to deliver, and often make basic mistakes. > Perhaps I don't appreciate all the pressure and options, but I believe > an [external] email service using HTTPS is one of the safer options > available when observing due dilligence. Yes, definately. Open question: did the 9/11 guys use HTTPS? Or just HTTP? I'm still searching for a case where it makes a clear difference. (Their main counter-intel coup was to understand that the threat model better than their enemy. Their technique was to open an ordinary Yahoo style account, share the account, then open up a draft email, and share that! Never send it, just edit and delete, over and over. The NSA which were presumably hoovering all sent emails ... never saw a thing.) > Its kind of like the poor > man's cloud (and corporate america is flocking to the cloud, in part > due to the additional layer of liability offload). ! OK, I'll bite. How does one offload liability by using the cloud? (Note that liability is the keystone to the PKI debate.... Understand the liability transfers and you understand why it's SNAFU.) iang _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0