July 2018 - cypherpunks-legacy

[cryptography] trustwave admits issuing corporate mitm certs
by Adam Back 06 Jul '18

06 Jul '18

So it happened, per recent discussion on this list, it seems that at least one CA *has* been issuing sub-CA certs for corporate use in mitm boxes. http://www.infoworld.com/d/security/trustwave-admits-issuing-man-in-the-mid… mozilla is threatening to remove the CA from their browser. Trustwave says they have/will revoke all these sub-CAs and will not issue any more. They also claim in their defense that other CAs are doing this. Adam _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [drone-list] FAA/privacy
by John Young 06 Jul '18

06 Jul '18

>the FAA shouldn't be the ones to address this. We also made a >point - that I expect many will agree with, that there's really a >broader context for privacy - generally - that we as a nation >need to address. Good point that deserves much greater attention, drones as good a starting point as any other evolving surveillance technology. Fragmentation of privacy policy and enforcement among a slew of stakeholders inside and outside government allows, actually encourages, diverse, contradictory, and evasive compliance with all too flatulent aspirations for privacy forever subjected to security. The US has no fully empowered privacy commission, presumably to allow continuous evasion of fulfilling privacy promises deliberately intended to be violated on behalf of evolving, usual secret, national interests of government and commerce. Same old BS of putting government and its contractors before taxpayers. Secrecy, both governmental and non-governmental, remains the biggest threat to privacy and security around the globe. Secrecy policy is a huge mess, bloated and costly, and privacy policy cannot compete so long as the secrecy hegemon prevails. US Patent and Trademark Office today seeks comments on revising policy to issue secrecy orders for "economically significant patents." Economy as vital as WMDs. It is apt to refer to all technologies, Google, MS, Cisco, universities, et al, which perform the dual use of user convenience and spying on users. And arguments for both being necessarily linked are specious apologias which open the door for privacy abuse under guise of security, now economical -- a segue perfect for opposing Occupy Wall Street. An industry has grown to eploit the two sides of privacy and security, using the wedge of secrecy to assure secrecy always wins over privacy in the name of law enforcement and national security. No privacy policy is worth a centavo due to the ever-present flatulence about abiding with lawful requests for data access which in turn is a cover story to hide technological access outside the law. Finally, it has become commonplace for technologists to succumb to legal persuasion to lie about technological capabilities to transgress human rights. Put a lawyer and a technologist together and you have a duality now ruling communications by hook and crook. _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Ready, Aim, HACK!
by brian-slashdotnews＠hyperreal.org 06 Jul '18

06 Jul '18

Link: http://slashdot.org/article.pl?sid=04/08/06/149207 Posted by: michael, on 2004-08-06 15:10:00 from the reach-out-and-touch-someone dept. [1]KD5YPT writes "According to a story on Wired, Adam Laurie and Martin Herfurt demonstrated that they can [2]hack a Bluetooth enabled phone from up to a mile away using a sniper rifle with yagi antenna. Kinda gives a new meaning to '1337 hAx0r2'." [3]Click Here References 1. mailto:stweitx16@hotmail.com 2. http://www.wired.com/news/privacy/0,1848,64463,00.html 3. http://ads.osdn.com/?ad_id=4894&alloc_id=10418&site_id=1&request_id=5371386… p=click&page=%2farticle%2epl ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[cryptography] trustwave admits issuing corporate mitm certs
by Adam Back 06 Jul '18

06 Jul '18

So it happened, per recent discussion on this list, it seems that at least one CA *has* been issuing sub-CA certs for corporate use in mitm boxes. http://www.infoworld.com/d/security/trustwave-admits-issuing-man-in-the-mid… mozilla is threatening to remove the CA from their browser. Trustwave says they have/will revoke all these sub-CAs and will not issue any more. They also claim in their defense that other CAs are doing this. Adam _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [drone-list] FAA/privacy
by John Young 06 Jul '18

06 Jul '18

>the FAA shouldn't be the ones to address this. We also made a >point - that I expect many will agree with, that there's really a >broader context for privacy - generally - that we as a nation >need to address. Good point that deserves much greater attention, drones as good a starting point as any other evolving surveillance technology. Fragmentation of privacy policy and enforcement among a slew of stakeholders inside and outside government allows, actually encourages, diverse, contradictory, and evasive compliance with all too flatulent aspirations for privacy forever subjected to security. The US has no fully empowered privacy commission, presumably to allow continuous evasion of fulfilling privacy promises deliberately intended to be violated on behalf of evolving, usual secret, national interests of government and commerce. Same old BS of putting government and its contractors before taxpayers. Secrecy, both governmental and non-governmental, remains the biggest threat to privacy and security around the globe. Secrecy policy is a huge mess, bloated and costly, and privacy policy cannot compete so long as the secrecy hegemon prevails. US Patent and Trademark Office today seeks comments on revising policy to issue secrecy orders for "economically significant patents." Economy as vital as WMDs. It is apt to refer to all technologies, Google, MS, Cisco, universities, et al, which perform the dual use of user convenience and spying on users. And arguments for both being necessarily linked are specious apologias which open the door for privacy abuse under guise of security, now economical -- a segue perfect for opposing Occupy Wall Street. An industry has grown to eploit the two sides of privacy and security, using the wedge of secrecy to assure secrecy always wins over privacy in the name of law enforcement and national security. No privacy policy is worth a centavo due to the ever-present flatulence about abiding with lawful requests for data access which in turn is a cover story to hide technological access outside the law. Finally, it has become commonplace for technologists to succumb to legal persuasion to lie about technological capabilities to transgress human rights. Put a lawyer and a technologist together and you have a duality now ruling communications by hook and crook. _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Please help me test my hidden service
by Scott Bennett 06 Jul '18

06 Jul '18

On Mon, 03 Aug 2009 16:42:57 -0400 Ringo <2600denver(a)gmail.com> wrote: >I posted a while ago saying I was making a how-to manual for newbies on >how to set up (reasonably) secure hidden services. I'm almost done but I >want to release my server for testing to see if I missed anything >obvious. This is a pretty standard LAMP install running in a virtual >machine. The OS is Ubuntu on both. > >The site is at http://76jejbkd7gtm5jbb.onion I trust that, once you have figured out how to make it work properly, you will generate new keys for your currently not-so-very-hidden service, now that you've identified the connection between the URL above and yourself. :-) For that matter, it's probably best *not* to run most kinds of hidden services on tor relays precisely because tor relays are well known through the directory. Running a hidden service on a client-only tor would be the safest way because clients are not listed anywhere as such. There might be a place for running a hidden service on a bridge, but it would have to be for something not terribly dangerous to the hidden service operator because bridges *are* known to the bridge authorities and thus must be considered to be listed somewhere. Something like a web service that is also accessible directly and publicly and that presents no known danger to its operator (e.g., the various tor status pages) can reasonably be run on a tor relay node, a bridge, or a client. > >There's a drupal install at /drupal and a wordpress install (currently >not working due to forwarding issues) at /wordpress. > >Feel free to poke around all you want, just please don't do anything >that would stop other users from accessing the machine such as DoS >attacks. If you somehow break through, please stay off my home network ; ) Best you learn how to protect your butt *before* opening it up to the world, no? Have you thought about running your service inside a jail or a virtual machine? That would make it much easier to wall it off from the rest of your computer and home network. > >I haven't allowed users to add content because... well.. you know what >would happen with that in onionland. If you want to add content just >throw me an email and I'll make you an account. I figure that way I have >somebody to blame if stuff goes horribly wrong. My PGP key is included Again, a jail or a VM would help you contain any damage, and a backup of the jail's or VM's environment would make it very easy and fast to restore it to the way you set it up. >if you roll that way. > >I'm also interested to hear people's ideas on how exactly to test the >security of this server without handing out shell logins (or is that >exactly what I should do?). A jail or a VM can certainly help you there by limiting the ability of shell accounts to access the world at large, especially when combined with the application of a decent packet filter on the host system. Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * ********************************************************************** ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Appeals Circuit Ruling: ISPs Can Read E-Mail
by brian-slashdotnews＠hyperreal.org 06 Jul '18

06 Jul '18

Link: http://slashdot.org/article.pl?sid=04/06/30/2014242 Posted by: timothy, on 2004-06-30 20:54:00 Topic: privacy, 248 comments from the odd-distinctions dept. leviramsey writes "The US Court of Appeals for the First Circuit (covering Massachusetts, Maine, New Hampshire, and Rhode Island) has ruled that [1]e-mail providers are not violating the law by reading users' e-mail without the user's consent. The [2]decision finds that the Wiretap Act does not cover interception of communications where the communications are being stored, not transmitted. Perhaps OSDN should send the defendant, accused in 2001 of reading users emails in order to find out what they were interested in purchasing from Amazon, a [3]T-shirt from ThinkGeek?" References 1. http://www.wired.com/news/politics/0,1283,64043,00.html?tw=wn_tophead_1 2. http://www.ca1.uscourts.gov/pdf.opinions/03-1383-01A.pdf 3. http://www.thinkgeek.com/tshirts/frustrations/31fb/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: Please help me test my hidden service
by Scott Bennett 06 Jul '18

06 Jul '18

On Mon, 03 Aug 2009 16:42:57 -0400 Ringo <2600denver(a)gmail.com> wrote: >I posted a while ago saying I was making a how-to manual for newbies on >how to set up (reasonably) secure hidden services. I'm almost done but I >want to release my server for testing to see if I missed anything >obvious. This is a pretty standard LAMP install running in a virtual >machine. The OS is Ubuntu on both. > >The site is at http://76jejbkd7gtm5jbb.onion I trust that, once you have figured out how to make it work properly, you will generate new keys for your currently not-so-very-hidden service, now that you've identified the connection between the URL above and yourself. :-) For that matter, it's probably best *not* to run most kinds of hidden services on tor relays precisely because tor relays are well known through the directory. Running a hidden service on a client-only tor would be the safest way because clients are not listed anywhere as such. There might be a place for running a hidden service on a bridge, but it would have to be for something not terribly dangerous to the hidden service operator because bridges *are* known to the bridge authorities and thus must be considered to be listed somewhere. Something like a web service that is also accessible directly and publicly and that presents no known danger to its operator (e.g., the various tor status pages) can reasonably be run on a tor relay node, a bridge, or a client. > >There's a drupal install at /drupal and a wordpress install (currently >not working due to forwarding issues) at /wordpress. > >Feel free to poke around all you want, just please don't do anything >that would stop other users from accessing the machine such as DoS >attacks. If you somehow break through, please stay off my home network ; ) Best you learn how to protect your butt *before* opening it up to the world, no? Have you thought about running your service inside a jail or a virtual machine? That would make it much easier to wall it off from the rest of your computer and home network. > >I haven't allowed users to add content because... well.. you know what >would happen with that in onionland. If you want to add content just >throw me an email and I'll make you an account. I figure that way I have >somebody to blame if stuff goes horribly wrong. My PGP key is included Again, a jail or a VM would help you contain any damage, and a backup of the jail's or VM's environment would make it very easy and fast to restore it to the way you set it up. >if you roll that way. > >I'm also interested to hear people's ideas on how exactly to test the >security of this server without handing out shell logins (or is that >exactly what I should do?). A jail or a VM can certainly help you there by limiting the ability of shell accounts to access the world at large, especially when combined with the application of a decent packet filter on the host system. Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * ********************************************************************** ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Beowulf] Amazon cloud computing used to crack wi-fi passwords
by Hearns, John 06 Jul '18

06 Jul '18

http://www.theregister.co.uk/2011/01/11/amazon_cloud_wifi_cracking/ I think this is appropriate for an HPC list. This guy is using GPUs on Amazon's cloud service to brute force 400 000 passwords per second. Smart, but a bit depressing really. John Hearns | CFD Hardware Specialist | McLaren Racing Limited McLaren Technology Centre, Chertsey Road, Woking, Surrey GU21 4YH, UK T: +44 (0) 1483 261000 D: +44 (0) 1483 262352 F: +44 (0) 1483 261010 E: john.hearns(a)mclaren.com W: www.mclaren.com The contents of this email are confidential and for the exclusive use of the intended recipient. If you receive this email in error you should not copy it, retransmit it, use it or disclose its contents but should return it to the sender immediately and delete your copy. _______________________________________________ Beowulf mailing list, Beowulf(a)beowulf.org sponsored by Penguin Computing To change your subscription (digest mode or unsubscribe) visit http://www.beowulf.org/mailman/listinfo/beowulf ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Beowulf] Amazon cloud computing used to crack wi-fi passwords
by Hearns, John 06 Jul '18

06 Jul '18

http://www.theregister.co.uk/2011/01/11/amazon_cloud_wifi_cracking/ I think this is appropriate for an HPC list. This guy is using GPUs on Amazon's cloud service to brute force 400 000 passwords per second. Smart, but a bit depressing really. John Hearns | CFD Hardware Specialist | McLaren Racing Limited McLaren Technology Centre, Chertsey Road, Woking, Surrey GU21 4YH, UK T: +44 (0) 1483 261000 D: +44 (0) 1483 262352 F: +44 (0) 1483 261010 E: john.hearns(a)mclaren.com W: www.mclaren.com The contents of this email are confidential and for the exclusive use of the intended recipient. If you receive this email in error you should not copy it, retransmit it, use it or disclose its contents but should return it to the sender immediately and delete your copy. _______________________________________________ Beowulf mailing list, Beowulf(a)beowulf.org sponsored by Penguin Computing To change your subscription (digest mode or unsubscribe) visit http://www.beowulf.org/mailman/listinfo/beowulf ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0