July 2018 - cypherpunks-legacy

Re: [Freedombox-discuss] Wireless routers "knitted" together
by Ben Mendis 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The paper they refer to acknowledges the recent research into using ad-hoc mesh networks as a backup communication system for emergency responders. They assert that mesh node density may be insufficient in certain geographic areas to maintain the necessary coverage of the mesh. Based on this assertion, they are proposing that "at some point in the future" an emergency switch would be implemented into all (or most?) home routers such that the could be flipped from normal mode into an emergency mesh network mode granting access to emergency responders. They then proceed to use an Android wardriving app to collect data on existing residential WiFi-enabled routers one neighborhood and make the case that these routers would be capable of running the necessary software to form a mesh network with consistent coverage of that neighborhood. Although the paper appears to be well-researched and well-written, I think they focus too much on the wardriving aspect and trying to establish the proliferation of privately owned WiFi equipment in a particular urban neighborhood in a well-developed country. There is a lot of important discussion which they seem to leave out of this paper. They may have already addressed it in their previous paper, which they reference several times, however I have not read that one. Some of the issues I see, which I would have liked to see addressed further: 1. Who has the authority to activate the emergency switch, and what mechanisms prevent its abuse? 2. What mechanism is used to activate this emergency switch? 3. Who has access to make use of the mesh network after it has been activated? The paper seems to imply that it would only be used by emergency responders, but their methodology is to open it up such that anyone would be able to connect and access the network. 4. What liability would individuals face if their network was misused by guests while this emergency switch was activated? Eg, what happens if someone uses your now-unlocked network to commit a crime such as illegally transferring copyrighted materials or child pornography? 5. How would the network be utilized in the absence of Internet access? In the use case the authors describe, the mesh network is being activiated because of a failure of traditional infrastructure, so it's reasonable to assume that Internet access would be scare to impossible in the region. 6. If traditional infrastructure is disrupted, that could include power lines, how many of the residential routers they identified would still be online if power was lost? Could FreedomBox implement something similar to what they describe? Easily. However I think it would be more interesting and arguably more valuable for FreedomBox to implement an always-on mesh network rather than one that is only switched on when emergency responders deem it is appropriate. That's my two cents. On Wed, 22 Aug 2012, Sandy Harris wrote: > http://www.securityweek.com/home-wifi-could-be-used-emergency-responders > > Is this something the Box should/could support? Is the method discussed in > the article the right one for us? > > _______________________________________________ > Freedombox-discuss mailing list > Freedombox-discuss(a)lists.alioth.debian.org > http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBAgAGBQJQNF51AAoJEMco5sYyM+0wyRgH/0vatkh6n+WtOrJAvQ29lzq4 vKs9wjODzw1O7n7X2Wo56/U0KlMNnb/e/v8YujMPUXIjOwfBEjFuIyVvI1hhw1tp MEnSkZ+btZMOdMcdsYACmg3GmvRd5mPZB6fgrvPWX/n0KKBn3AXjvDbb/ztR8qTK fqcQqyy+nkQsiMwB7u8oyI/ztK9TOEmJ1DPNqPAC8tIP9VEoOaAM/CjT4iH7jcEX f/IxN6S9/TwCN2DfByW6qdbwNr2oKsR4T7Cn5kIdkrtsFg8H48rlUds2SQBmUDlB FhKrLFz7kDtg8QqP0F43UJfUo3qubV/HsjmTAjZKfbjyUn8udfIl/HjG0JtNc0g= =iZ45 -----END PGP SIGNATURE----- _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

PGP incompatible with OSX 10.6
by Dan O'Donnell 06 Jul '18

06 Jul '18

Richard Forno is a well known information security operative and researcher. His recent experience with a Snow Leopard installation attempt on his PGP-enabled laptop should probably be a warning for anybody who has installed PGP. He gave me permission to forward this account to the community. It is also archived at his mailing list archive here: <http://www.mail-archive.com/infowarrior%40attrition.org/msg04917.html>. > Snow Leopard comes out for OSX users today. OSX 10.6. Hurray! > > While watching the Redskins-Patriots on the big screen, I go about > trying to upgrade my test laptop only to discover the Apple DVD is not > recognizing the hard drive as something that can support OSX. WTFO? > Resourceful as ever, I begin to Google for answers. > > As I Google, an email[1] arrives from PGP.COM saying that their > current product is incompatible with 10.6 and if users want to use PGP > they should not upgrade but that if we "intend to upgrade to Snow > Leopard, you must decrypt all PGP encrypted drives and uninstall PGP > Desktop before upgrading the system to Mac OS X 10.6." They go on to > say that 10.6 support is forthcoming in their next major release but > offer no details on when it will be, except to say they're accepting > beta applications now. > > *blink* > > Taking beta applications now? There are freeware and shareware > developers whose products are fully compatible with 10.6 and PGP only > now is soliciting beta testers? Did the company just realize that OSX > 10.6 was coming out today? Didn't they get the memo? Are there no > OSX users at PGP Headquarters? > > So back to my stalled Snow Leopard upgrade on my laptop: Thanks to > Google's timely archiving of the Apple support boards[2] I found out > that not only did I have to uninstall PGP, repair disk permissions, > and reboot (which still didn't fix the problem), but since PGP > apparently does something to the OSX partition table, I had to enter > Disk Utility and dynamically resize my laptop's hard drive a few > megabytes in size just so a new partition table could be written --- > at which point I was able to install OSX 10.6 just fine. (Note that I > had installed, but did not use, PGP on this computer, and certainly > did not use their Whole Disk Encryption.) What kind of stuff did PGP > have to write to my partition table to make it unreadable by Apple's > own installation disk? > > Unfortunately, after many years of dealing with their quirky product > registration system and hiccups with routine OS upgrades, tonight's > news has forced to say that PGP has lost me as a customer --- their > annoying corporate quirks aside, I cannot trust any security product > that tweaks (nay, borks) my system in such a troublesome manner and > certainly one that seems to treat Mac users as third-class citizens. > [3] I'm not the only one who feels this way, either -- indeed they > are correct in titling their concerns the Audacity of Hopelessness. > [4] Accordingly, I will follow the lead of my coworkers and other > securitygeek friends and embrace GPG for my encryption needs. > > Alas, PGP, I bid thee a sad adieu. > > -rick > > [1] > <http://blog.pgp.com/index.php/2009/08/sneak-peek-pgp-whole-disk-encryption-… > > > > [2] <http://discussions.apple.com/thread.jspa?messageID=10063151> > > [3] How about their officially-unsupported but unofficially-supported > Mail.App plug-in? After nearly a decade of OSX in the marketplace > they still don't officially support Apple's Mail program? > > [4] <http://pgpsucks.wordpress.com/>. -- If you want to unsubscribe or change your address, use this link: http://emperor.tidbits.com/webx?unsub@@.3c3f6899!u=30544749

1 0

PGP incompatible with OSX 10.6
by Dan O'Donnell 06 Jul '18

06 Jul '18

Richard Forno is a well known information security operative and researcher. His recent experience with a Snow Leopard installation attempt on his PGP-enabled laptop should probably be a warning for anybody who has installed PGP. He gave me permission to forward this account to the community. It is also archived at his mailing list archive here: <http://www.mail-archive.com/infowarrior%40attrition.org/msg04917.html>. > Snow Leopard comes out for OSX users today. OSX 10.6. Hurray! > > While watching the Redskins-Patriots on the big screen, I go about > trying to upgrade my test laptop only to discover the Apple DVD is not > recognizing the hard drive as something that can support OSX. WTFO? > Resourceful as ever, I begin to Google for answers. > > As I Google, an email[1] arrives from PGP.COM saying that their > current product is incompatible with 10.6 and if users want to use PGP > they should not upgrade but that if we "intend to upgrade to Snow > Leopard, you must decrypt all PGP encrypted drives and uninstall PGP > Desktop before upgrading the system to Mac OS X 10.6." They go on to > say that 10.6 support is forthcoming in their next major release but > offer no details on when it will be, except to say they're accepting > beta applications now. > > *blink* > > Taking beta applications now? There are freeware and shareware > developers whose products are fully compatible with 10.6 and PGP only > now is soliciting beta testers? Did the company just realize that OSX > 10.6 was coming out today? Didn't they get the memo? Are there no > OSX users at PGP Headquarters? > > So back to my stalled Snow Leopard upgrade on my laptop: Thanks to > Google's timely archiving of the Apple support boards[2] I found out > that not only did I have to uninstall PGP, repair disk permissions, > and reboot (which still didn't fix the problem), but since PGP > apparently does something to the OSX partition table, I had to enter > Disk Utility and dynamically resize my laptop's hard drive a few > megabytes in size just so a new partition table could be written --- > at which point I was able to install OSX 10.6 just fine. (Note that I > had installed, but did not use, PGP on this computer, and certainly > did not use their Whole Disk Encryption.) What kind of stuff did PGP > have to write to my partition table to make it unreadable by Apple's > own installation disk? > > Unfortunately, after many years of dealing with their quirky product > registration system and hiccups with routine OS upgrades, tonight's > news has forced to say that PGP has lost me as a customer --- their > annoying corporate quirks aside, I cannot trust any security product > that tweaks (nay, borks) my system in such a troublesome manner and > certainly one that seems to treat Mac users as third-class citizens. > [3] I'm not the only one who feels this way, either -- indeed they > are correct in titling their concerns the Audacity of Hopelessness. > [4] Accordingly, I will follow the lead of my coworkers and other > securitygeek friends and embrace GPG for my encryption needs. > > Alas, PGP, I bid thee a sad adieu. > > -rick > > [1] > <http://blog.pgp.com/index.php/2009/08/sneak-peek-pgp-whole-disk-encryption-… > > > > [2] <http://discussions.apple.com/thread.jspa?messageID=10063151> > > [3] How about their officially-unsupported but unofficially-supported > Mail.App plug-in? After nearly a decade of OSX in the marketplace > they still don't officially support Apple's Mail program? > > [4] <http://pgpsucks.wordpress.com/>. -- If you want to unsubscribe or change your address, use this link: http://emperor.tidbits.com/webx?unsub@@.3c3f6899!u=30544749

1 0

Re: [p2p-hackers] P2P Authentication
by Kerry Bonin 06 Jul '18

06 Jul '18

There are only two good ways to provide man-in-the-middle resistant authentication with key repudiation in a distributed system - using a completely trusted out of band channel to manage everything, or use a PKI. I've used PKI for >100k node systems, it works great if you keep it simple and integrate your CRL mechanism - in a distributed system the pieces are all already there! I think some people are put off by the size and complexity of the libraries involved, which doesn't have to be the case - I've got a complete RSA/DSA X.509 compliant cert based PKI (leveraging LibTomCrypt for crypto primitives) in about 2k lines of C++, <30k object code, works great (I'll open that source as LGPL when I deploy next year...) The only hard part about integrating into a p2p network is securing the CA's, and that's more of a network security problem than a p2p problem... Kerry zooko(a)zooko.com wrote: >>>And if they do, then why reinvent the wheel? Traditional public key >>>signing works well for these cases. >>> >>> >... > > >> Traditional public key signing doesn't work well if you want to >>eliminate the central authority / trusted third party. If you like >>keeping those around, then yes, absolutely, traditional PKI works >>swimmingly. >> >> > >Where is the evidence of this bit about "traditional PKI working"? As far >as >I've observed, traditional PKI works barely for small, highly centralized, >hierarchical organizations and not at all for anything else. Am I missing >some >case studies of PKI actually working as intended? > >Regards, > >Zooko >_______________________________________________ >p2p-hackers mailing list >p2p-hackers(a)zgp.org >http://zgp.org/mailman/listinfo/p2p-hackers >_______________________________________________ >Here is a web page listing P2P Conferences: >http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences > > > > _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [p2p-hackers] Nash equilibrium on p2p networks
by James A. Donald 06 Jul '18

06 Jul '18

On 2012-03-08 1:52 AM, Matteo Dell'Amico wrote: > On 07/03/2012 15:02, danimoth wrote: >> Il giorno mar, 06/03/2012 alle 16.34 +0000, Michael Rogers ha scritto: >> If you're modelling a DHT as a game then who are the players, what are >>> the possible strategies, what are the payoffs, how much do the players >>> know about each other's strategies and payoffs, and what strategy do >> you >>> want to encourage? >>> >> That's are the questions I'm asking to myself since first post, and >> looking to other's work (if exists) applied to p2p networks maybe could >> help me. > > There's actually plenty of work on incentives to cooperation in P2P > systems that can actually interest you. The keywords to look for in > Google Scholar are probably "p2p incentives", "p2p reputation". > > The papers about the topic that I like most are: "Incentives build > robustness in BitTorrent" by Bram Cohen (P2PEcon 2003) and "Sybilproof > reputation mechanisms" by Alice Cheng and Eric Friedman (P2PEcon 2005). Available at http://www.ee.ucl.ac.uk/~mrio/papers/infocom09.pdf I would summarize their proposal as ripple for bittorrent with a routing algorithm. The paper fails to consider the UI for managing reputation information, or the UI for finding and identifying services With a method for finding torrents and information about torrents, would be a major improvement on bittorrent, since it provides seeding incentive. _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [p2p-hackers] P2P Authentication
by Kerry Bonin 06 Jul '18

06 Jul '18

There are only two good ways to provide man-in-the-middle resistant authentication with key repudiation in a distributed system - using a completely trusted out of band channel to manage everything, or use a PKI. I've used PKI for >100k node systems, it works great if you keep it simple and integrate your CRL mechanism - in a distributed system the pieces are all already there! I think some people are put off by the size and complexity of the libraries involved, which doesn't have to be the case - I've got a complete RSA/DSA X.509 compliant cert based PKI (leveraging LibTomCrypt for crypto primitives) in about 2k lines of C++, <30k object code, works great (I'll open that source as LGPL when I deploy next year...) The only hard part about integrating into a p2p network is securing the CA's, and that's more of a network security problem than a p2p problem... Kerry zooko(a)zooko.com wrote: >>>And if they do, then why reinvent the wheel? Traditional public key >>>signing works well for these cases. >>> >>> >... > > >> Traditional public key signing doesn't work well if you want to >>eliminate the central authority / trusted third party. If you like >>keeping those around, then yes, absolutely, traditional PKI works >>swimmingly. >> >> > >Where is the evidence of this bit about "traditional PKI working"? As far >as >I've observed, traditional PKI works barely for small, highly centralized, >hierarchical organizations and not at all for anything else. Am I missing >some >case studies of PKI actually working as intended? > >Regards, > >Zooko >_______________________________________________ >p2p-hackers mailing list >p2p-hackers(a)zgp.org >http://zgp.org/mailman/listinfo/p2p-hackers >_______________________________________________ >Here is a web page listing P2P Conferences: >http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences > > > > _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [p2p-hackers] Nash equilibrium on p2p networks
by James A. Donald 06 Jul '18

06 Jul '18

On 2012-03-08 1:52 AM, Matteo Dell'Amico wrote: > On 07/03/2012 15:02, danimoth wrote: >> Il giorno mar, 06/03/2012 alle 16.34 +0000, Michael Rogers ha scritto: >> If you're modelling a DHT as a game then who are the players, what are >>> the possible strategies, what are the payoffs, how much do the players >>> know about each other's strategies and payoffs, and what strategy do >> you >>> want to encourage? >>> >> That's are the questions I'm asking to myself since first post, and >> looking to other's work (if exists) applied to p2p networks maybe could >> help me. > > There's actually plenty of work on incentives to cooperation in P2P > systems that can actually interest you. The keywords to look for in > Google Scholar are probably "p2p incentives", "p2p reputation". > > The papers about the topic that I like most are: "Incentives build > robustness in BitTorrent" by Bram Cohen (P2PEcon 2003) and "Sybilproof > reputation mechanisms" by Alice Cheng and Eric Friedman (P2PEcon 2005). Available at http://www.ee.ucl.ac.uk/~mrio/papers/infocom09.pdf I would summarize their proposal as ripple for bittorrent with a routing algorithm. The paper fails to consider the UI for managing reputation information, or the UI for finding and identifying services With a method for finding torrents and information about torrents, would be a major improvement on bittorrent, since it provides seeding incentive. _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[p2p-hackers] "generic & secure" DHT table implementation?
by Ivan Shmakov 06 Jul '18

06 Jul '18

Abstract There're (several?) BitTorrent-specific DHT's, and the P2P anonymity protocols (such as GNUnet) seem to (effectively) implement their own DHT's. But is there any kind of a b universalb (i. e., transport protocol-independent) DHT? And if not, why? Searching by content-derived identifiers There're currently a number of P2P-friendly content-derived resource identifiers, such as the BitTorrent b infohashb values (which can be embedded within magnet: schema URI's, like [1]), as well as the URI's used in GNUnet and Freenet frameworks (like [2]), both non-standard (and the GNUnet ones are, as it seems, interpreting the base URI specification in somewhat an odd way.) What seems to be missing, however, is a b genericb DHT network that could be used to search both the relevant metadata (such as .torrent or Metalink files), and the peers participating in a particular data exchange (and the respective protocols they support), using one or more of an extensible set of identifiers (including BitTorrent infohashes, GNUnet URI's, and the plain SHA-1, SHA-2, or SHA-3 values.) How's it useful? With such a DHT, Alice, having only a bandwidth-limited Internet connection, could compute a SHA-256 of a large file on her host, and send the former to Bob, which, in turn, would use any downloading software (implementing the support for the aforementioned b genericb DHT) to discover the possible sources for the file in question and retrieve it. Security issues As for the security, the b recordsb in such a table could be digitally signed, with the set of the b trustedb public keys being comprised of those keys explicitly approved by the user, the public keys of the peers with which a successful data exchange has occurred before, and the public keys trusted by the peers already trusted, up to a certain depth. (There could then be different levels of trust, just like, e. g., in GnuPG, and perhaps other OpenPGP software.) The purpose of such a facility is exactly to allow for the use of (non-piecewise) digest to metadata records, which otherwise could easily be spoofed, and used to force the downloader to spend its resources to download an otherwise irrelevant data. The question The question is: are there any designs, either implemented, or described in detail, allowing for operation as described above, or are there specific reasons for which the outline above is not feasible to implement? TIA. [1] magnet:?xt=urn:btih:fb5c0d7946469ba48121607458e360cb31336e55 [2] gnunet://ecrs/chk/9E4MDN4VULE8KJG6U1C8FKH5HA8C5CHSJTILRTTPGK8MJ6VHORERHE68JU8Q0FDTOH1DGLUJ3NLE99N0ML0N9PIBAGKG7MNPBTT6UKG.1I823C58O3LKS24LLI9KB384LH82LGF9GUQRJHACCUINSCQH36SI4NF88CMAET3T3BHI93D4S0M5CC6MVDL1K8GFKVBN69Q6T307U6O.17992 -- FSF associate member #7257 _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[drone-list] CIA wants moar drones
by Gregory Foster 06 Jul '18

06 Jul '18

WaPo (Oct 18) - "CIA seeks to expand drone fleet, officials say": http://www.washingtonpost.com/world/national-security/cia-seeks-to-expand-d… gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by science-feedback＠forsythe.stanford.edu 06 Jul '18

06 Jul '18

> NEW Password: 858548 > (Your password is case-sensitive. Please type > it in _exactly_ as it appears above.) LOL... Mark

1 0