July 2018 - cypherpunks-legacy

Re: [liberationtech] Exactly how are satellite transmissions tapped/intercepted, in Syria and elsewhere?
by Matt Mackall 06 Jul '18

06 Jul '18

On Tue, 2011-11-29 at 16:43 +0000, Enrique Piraces wrote: > Hi all, thanks for the detailed responses on this thread. > > I'm trying to understand how weak BGAN, Thuraya, Iridium encryption > could be. For example one of them claims in its site that "Thuraya's > integrated satellite communication solutions are rapidly deployable, > employ the highest level of encryption, and are proven in meeting > exacting security standards for use in the field." A security self-evaluation by a company's marketing department isn't worth much. > Beyond the ability that some may have to detect the location of a > call/connection and log their calls, how true is that their encryption > can protect the contents of the information transmitted? Is the risk > the same for each voice/data/text? Thuraya is a telecom company, which means the default assumption should be that they: - use poorly-implemented crypto that can be defeated by sophisticated third parties - have built-in "lawful intercept capability" - have extensive logging and data retention - will hand this data over to authorities at the slightest provocation The past decade has shown us the above is true of basically all terrestrial providers, and there's no good reason to think satellite is different. And there's no reason to think they've done a better job with their crypto tech than the industry groups that created WEP and GSM. > Is part of the solution to use encryption modules like http://www.shoghicom.com/thuraya-encryption.html? No. The first two bullet points above (at least!) probably apply. The only way for a private citizen to get assurances that are better than marketing copy is to use open source tools that have survived the close public scrutiny of the security community. -- Mathematics is the supreme nostalgia of our time. _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

PrivacyShield Alert - July 2004
by Anonymizer.com 06 Jul '18

06 Jul '18

[....] The previous mail messages appeared to have "local to Anonymizer" mail delivery systems sending them. Does it bother anyone else that Anonymizer is outsourcing its customer information?

1 0

Re: India to tax / levy license fees on ISPs that offer VPNs
by Suresh Ramasubramanian 06 Jul '18

06 Jul '18

Deepak Jain [16/11/04 18:15 -0500]: > > I guess it depends on how you define a VPN over just a private network. > Is an SSH tunnel a VPN? What about an encrypting SOCKS proxy? > This "tax" is aimed at a few Indian ISPs that are making lots of money selling managed IP-VPN services.. the incumbent telco seems to think all the money going there would be better spent by companies if they bought copper / fiber from it, and so the DoT (http://www.dot.gov.in) - lots of telco types there who wouldn't know a vpn from a hole in the ground - decided to "level the playing field" Just for laughs, here's the DoT press release on this: srs http://www.dot.gov.in/pressnote10nov04ISP.doc 142/04 www.pib.nic.in PRESS INFORMATION BUREAU GOVERNMENT OF INDIA ****** ISP LICENSING CONDITIONS AMENDED TO PERMIT VPN SERVICES New Delhi, Kartika 19, 1926 November 10, 2004 The Department of Telecommunications today decided to extend the scope of the Licence conditions of Internet Service Providers (ISP) ,thereby allowing them to provide managed Virtual Private Network services to corporates and individuals. In accordance with the decision, the ISP licences (both -Licence without Internet Telephony and with Internet Telephony) will have an enabling provision for VPN services by ISPs under specified terms & conditions. The annual licence fee will be at 8% of the Gross Revenue generated under the licence. There will be one time non-refundable entry fee of Rs. 10, 2 and 1 crore for Category A, B , and C ISPs respectively ISP-with VPN licencee will be permitted to lay optical fibre cable or use radio links for provision of the services under their licence in its Service Area. Further, ISPs shall be free to enter into mutually agreed commercial agreement with infrastructure service providers for sharing of infrastructure. The ISPs shall not engage in reselling bandwidth directly or indirectly. The above decision will help as many 388 ISP Licensees, more particularly 61 all India (Category A) ISP Licensees, to offer VPN services to their customers, thus adding to their revenue stream from Internet Access Services. VPN is a service where a customer perceives to have been provided with a private network which actually is configured over a shared public network. Benefits of VPN include secure communication over public network and guaranteed quality of service. A High Level DoT Committee had examined the matter and had observed that while on one hand such VPN services were not under the scope of the present ISP licences, on the other hand it would be desirable to permit ISPs to provide such services in the present day liberalized telecom environment in the country. The services which are technologically possible should be allowed while at the same time ensuring level playing field to all the service providers. Such VPN services which provide a platform for utilization of bandwidth in a very cost effective and efficient manner are emerging services internationally. This facility is necessary for the corporate world in meeting their growing communication needs of inter-office connectivity to send/transfer data securely and such services are widely available in telecom sector globally. RM/AMA 101104 ISP Licencing Conditions - --- end forwarded text - -- - ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' -----BEGIN PGP SIGNATURE----- Version: 1308 iQA/AwUBQZqZ5MPxH8jf3ohaEQKgbQCeIwR9Sbb1xf0KngQzvjuG0BJ/aakAoJ// mB3sxphFvIrWgiMVKTw5LIwY =PRwA -----END PGP SIGNATURE-----

1 0

Re: [liberationtech] Exactly how are satellite transmissions tapped/intercepted, in Syria and elsewhere?
by Matt Mackall 06 Jul '18

06 Jul '18

On Tue, 2011-11-29 at 16:43 +0000, Enrique Piraces wrote: > Hi all, thanks for the detailed responses on this thread. > > I'm trying to understand how weak BGAN, Thuraya, Iridium encryption > could be. For example one of them claims in its site that "Thuraya's > integrated satellite communication solutions are rapidly deployable, > employ the highest level of encryption, and are proven in meeting > exacting security standards for use in the field." A security self-evaluation by a company's marketing department isn't worth much. > Beyond the ability that some may have to detect the location of a > call/connection and log their calls, how true is that their encryption > can protect the contents of the information transmitted? Is the risk > the same for each voice/data/text? Thuraya is a telecom company, which means the default assumption should be that they: - use poorly-implemented crypto that can be defeated by sophisticated third parties - have built-in "lawful intercept capability" - have extensive logging and data retention - will hand this data over to authorities at the slightest provocation The past decade has shown us the above is true of basically all terrestrial providers, and there's no good reason to think satellite is different. And there's no reason to think they've done a better job with their crypto tech than the industry groups that created WEP and GSM. > Is part of the solution to use encryption modules like http://www.shoghicom.com/thuraya-encryption.html? No. The first two bullet points above (at least!) probably apply. The only way for a private citizen to get assurances that are better than marketing copy is to use open source tools that have survived the close public scrutiny of the security community. -- Mathematics is the supreme nostalgia of our time. _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: "I Write Mass Surveillance Software"
by Brian Mearns 06 Jul '18

06 Jul '18

On Wed, Sep 16, 2009 at 5:01 PM, Rich Jones <rich(a)anomos.info> wrote: > http://www.reddit.com/r/IAmA/comments/9kwph/i_am_a_guy_who_writes_covert_so… > > Thoughts? > > also, I realized that two of the posts I've made this this list have now > been reddit-related. Sorry about that. But I'd really like to know what you > all make of this. He doesn't give very many specifics, unfortunately. What > do you think his 'sidestepping' is? > > R > Well, I'm not entirely convinced that this guy is legit, or if he is that his equipment is really as powerful as he implies. On the other hand, I've only been casually studying cryptology for a few years, and in that short time I've encountered more mind-blowing "you can do that!?" moments than I can count on one hand (in binary). Everyone knows that there are side channels in any system if not properly and carefully implemented/operated. DNS lookups, search bar suggestions, software update checks, etc., all have the potential for subverting your privacy with Tor by not using the configured proxy settings. Based on a bunch of the comments, I'm going to guess this sort of thing (and probably many other equally simple but largely non-obvious channels) are a big part of what he does (assuming he does it). I think he (or someone else) also implied that traffic analysis is a big part of it. This has been another one of those "holy crap!" fields for me; the idea that an intelligent and diligent person can uncover a significant amount of information from encrypted communications without even breaking any of the encryption, is surprising but apparently very realistic. Lastly, I can't help but recall the early years of modern crypto, when the public/academic sector was impossibly far behind the more clandestine government/military sector. We like to think that this has changed, but we can't really be sure, can we? I feel fairly comfortable putting a good amount of stock in modern publicly available cryptography, but then again I'm not doing too much that could get me in trouble if I'm wrong, so it's not a high wager. My point is that I personally wouldn't put it completely outside the realm of possibility that a government agency has the capacity to just straight up break modern public cryptography. I think the poster pretty explicitly denied this, but then again, he would, wouldn't he? -Brian -- Feel free to contact me using PGP Encryption: Key Id: 0x3AA70848 Available from: http://keys.gnupg.net ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Colleges protest netwoprk upgrades to allow easier surveillance
by finin 06 Jul '18

06 Jul '18

According to this story, the only complaint from colleges is the cost. In addition to ultimate concerns about privacy, are there also technical issues that might come up, like adding to latency or congestion? Many universities are engaged in building and testing innovative high speed computation and communication applications and testbeds that span the Internet. Would a required re-architecting of campus networks cause problems for this kind of research? I'm not expert enough in these areas to have a well informed opinion. Tim -- Colleges Protest Call to Upgrade Online Systems By Sam Dillon and Stephen Labaton, NYT, October 23, 2005 http://www.nytimes.com/2005/10/23/technology/23college.html? pagewanted=all The federal government, vastly extending the reach of an 11-year-old law, is requiring hundreds of universities, online communications companies and cities to overhaul their Internet computer networks to make it easier for law enforcement authorities to monitor e-mail and other online communications. The action, which the government says is intended to help catch terrorists and other criminals, has unleashed protests and the threat of lawsuits from universities, which argue that it will cost them at least $7 billion while doing little to apprehend lawbreakers. Because the government would have to win court orders before undertaking surveillance, the universities are not raising civil liberties issues. The order, issued by the Federal Communications Commission in August and first published in the Federal Register last week, extends the provisions of a 1994 wiretap law not only to universities, but also to libraries, airports providing wireless service and commercial Internet access providers. It also applies to municipalities that provide Internet access to residents, be they rural towns or cities like Philadelphia and San Francisco, which have plans to build their own Net access networks. So far, however, universities have been most vocal in their opposition. ... The universities do not question the government's right to use wiretaps to monitor terrorism or criminal suspects on college campuses, Mr. Hartle said, only the order's rapid timetable for compliance and extraordinary cost. ... But the federal law would apply a high-tech approach, enabling law enforcement to monitor communications at campuses from remote locations at the turn of a switch. It would require universities to re-engineer their networks so that every Net access point would send all communications not directly onto the Internet, but first to a network operations center where the data packets could be stitched together into a single package for delivery to law enforcement, university officials said. ... Law enforcement has only infrequently requested to monitor Internet communications anywhere, much less on university campuses or libraries, according to the Center for Democracy and Technology. In 2003, only 12 of the 1,442 state and federal wiretap orders were issued for computer communications, and the F.B.I. never argued that it had difficulty executing any of those 12 wiretaps, the center said. "We keep asking the F.B.I., What is the problem you're trying to solve?" Mr. Dempsey said. "And they have never showed any problem with any university or any for-profit Internet access provider. The F.B.I. must demonstrate precisely why it wants to impose such an enormously disruptive and expensive burden." ... -- Tim Finin, Computer Science & Electrical Engineering, Univ of Maryland Baltimore County, 1000 Hilltop Cir, Baltimore MD 21250. finin(a)umbc.edu http://ebiquity.umbc.edu 410-455-3522 fax:-3969 http://umbc.edu/~finin ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] more on Colleges protest netwoprk upgrades to allow easier
by David Farber 06 Jul '18

06 Jul '18

surveillance X-Mailer: Apple Mail (2.734) Reply-To: dave(a)farber.net Begin forwarded message:

1 0

Re: "I Write Mass Surveillance Software"
by Brian Mearns 06 Jul '18

06 Jul '18

On Wed, Sep 16, 2009 at 5:01 PM, Rich Jones <rich(a)anomos.info> wrote: > http://www.reddit.com/r/IAmA/comments/9kwph/i_am_a_guy_who_writes_covert_so… > > Thoughts? > > also, I realized that two of the posts I've made this this list have now > been reddit-related. Sorry about that. But I'd really like to know what you > all make of this. He doesn't give very many specifics, unfortunately. What > do you think his 'sidestepping' is? > > R > Well, I'm not entirely convinced that this guy is legit, or if he is that his equipment is really as powerful as he implies. On the other hand, I've only been casually studying cryptology for a few years, and in that short time I've encountered more mind-blowing "you can do that!?" moments than I can count on one hand (in binary). Everyone knows that there are side channels in any system if not properly and carefully implemented/operated. DNS lookups, search bar suggestions, software update checks, etc., all have the potential for subverting your privacy with Tor by not using the configured proxy settings. Based on a bunch of the comments, I'm going to guess this sort of thing (and probably many other equally simple but largely non-obvious channels) are a big part of what he does (assuming he does it). I think he (or someone else) also implied that traffic analysis is a big part of it. This has been another one of those "holy crap!" fields for me; the idea that an intelligent and diligent person can uncover a significant amount of information from encrypted communications without even breaking any of the encryption, is surprising but apparently very realistic. Lastly, I can't help but recall the early years of modern crypto, when the public/academic sector was impossibly far behind the more clandestine government/military sector. We like to think that this has changed, but we can't really be sure, can we? I feel fairly comfortable putting a good amount of stock in modern publicly available cryptography, but then again I'm not doing too much that could get me in trouble if I'm wrong, so it's not a high wager. My point is that I personally wouldn't put it completely outside the realm of possibility that a government agency has the capacity to just straight up break modern public cryptography. I think the poster pretty explicitly denied this, but then again, he would, wouldn't he? -Brian -- Feel free to contact me using PGP Encryption: Key Id: 0x3AA70848 Available from: http://keys.gnupg.net ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Colleges protest netwoprk upgrades to allow easier surveillance
by finin 06 Jul '18

06 Jul '18

According to this story, the only complaint from colleges is the cost. In addition to ultimate concerns about privacy, are there also technical issues that might come up, like adding to latency or congestion? Many universities are engaged in building and testing innovative high speed computation and communication applications and testbeds that span the Internet. Would a required re-architecting of campus networks cause problems for this kind of research? I'm not expert enough in these areas to have a well informed opinion. Tim -- Colleges Protest Call to Upgrade Online Systems By Sam Dillon and Stephen Labaton, NYT, October 23, 2005 http://www.nytimes.com/2005/10/23/technology/23college.html? pagewanted=all The federal government, vastly extending the reach of an 11-year-old law, is requiring hundreds of universities, online communications companies and cities to overhaul their Internet computer networks to make it easier for law enforcement authorities to monitor e-mail and other online communications. The action, which the government says is intended to help catch terrorists and other criminals, has unleashed protests and the threat of lawsuits from universities, which argue that it will cost them at least $7 billion while doing little to apprehend lawbreakers. Because the government would have to win court orders before undertaking surveillance, the universities are not raising civil liberties issues. The order, issued by the Federal Communications Commission in August and first published in the Federal Register last week, extends the provisions of a 1994 wiretap law not only to universities, but also to libraries, airports providing wireless service and commercial Internet access providers. It also applies to municipalities that provide Internet access to residents, be they rural towns or cities like Philadelphia and San Francisco, which have plans to build their own Net access networks. So far, however, universities have been most vocal in their opposition. ... The universities do not question the government's right to use wiretaps to monitor terrorism or criminal suspects on college campuses, Mr. Hartle said, only the order's rapid timetable for compliance and extraordinary cost. ... But the federal law would apply a high-tech approach, enabling law enforcement to monitor communications at campuses from remote locations at the turn of a switch. It would require universities to re-engineer their networks so that every Net access point would send all communications not directly onto the Internet, but first to a network operations center where the data packets could be stitched together into a single package for delivery to law enforcement, university officials said. ... Law enforcement has only infrequently requested to monitor Internet communications anywhere, much less on university campuses or libraries, according to the Center for Democracy and Technology. In 2003, only 12 of the 1,442 state and federal wiretap orders were issued for computer communications, and the F.B.I. never argued that it had difficulty executing any of those 12 wiretaps, the center said. "We keep asking the F.B.I., What is the problem you're trying to solve?" Mr. Dempsey said. "And they have never showed any problem with any university or any for-profit Internet access provider. The F.B.I. must demonstrate precisely why it wants to impose such an enormously disruptive and expensive burden." ... -- Tim Finin, Computer Science & Electrical Engineering, Univ of Maryland Baltimore County, 1000 Hilltop Cir, Baltimore MD 21250. finin(a)umbc.edu http://ebiquity.umbc.edu 410-455-3522 fax:-3969 http://umbc.edu/~finin ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] more on Colleges protest netwoprk upgrades to allow easier
by David Farber 06 Jul '18

06 Jul '18

surveillance X-Mailer: Apple Mail (2.734) Reply-To: dave(a)farber.net Begin forwarded message:

1 0