July 2018 - cypherpunks-legacy

Unmask 1.0 Release Party at My House!
by Dave Aitel 06 Jul '18

06 Jul '18

I've released Unmask today - available at http://www.immunitysec.com/unmask.html >From the web page: What is Unmask? Unmask is a python script that allows you to break the anonymity of e-mail or other text. It works by doing basic statistical matching against stored "signatures." It may require some tweaking to fit your particular use to it (un-anonymizing IRC chats, email, web pages on FreeNet, etc). Another fun parlor game use is using it to distinguish between two groups of any kind. Male/Female, Engineers/Computer Scientists, Scientists/Liberal Arts Majors, etc. If you improve it in some way, please send me (dave(a)immunitysec.com) a note. Unmask is released under the GNU GPL v2.0. As a further note, I specifically designed Unmask to be resistant to GOBBLES style "Chinese reordered english." Dave Aitel Immunity, Inc. ----- End forwarded message ----- -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: Judge orders defendant to decrypt PGP-protected laptop
by John Gilmore 06 Jul '18

06 Jul '18

> I would not read too much into this ruling -- I think that this is a > special situation, and does not address the more important general > issue. > In other cases, where alternative evidence is not available to the > government, and where government agents have not already had a look at > the contents, the facts (and hence perhaps the ruling) would be > different. Balls. This is a straight end-run attempt around the Fifth Amendment. The cops initially demanded a court order making him reveal his password -- then modified their stance on appeal after they lost. So he can't be forced to reveal it, but "on a technicality" he can be forced to produce the same effect as revealing it? Just how broad is this technicality, and how does it get to override a personal constitutional right? If the cops bust down your door and you foolishly left your computer turned on, are they entitled to make you reveal your encryption passwords anytime later, because your encrypted drive was accessible when they ran in screaming at your family and shooting your dog? Suppose they looked it over and typed a few things to the screen? Suppose they didn't? Suppose they used a fancy power-transfer plug to keep it running as they walked it out the door, but they tripped and dropped it and it powered off? That's a technicality, isn't it? Don't forget, this is a nuisance case. It's about a harmless Canadian citizen who's a permanent US resident, who crossed the Canadian border with his laptop. A guy smart enough to encrypt his drive. On the drive, among other things, was a few thousand porn images downloaded from the net. Legal porn. The border guards, who had no business even looking at his laptop's contents, trolled around in it until they found some tiny fraction of the images that (they allege) contained underage models. (How would *he* know the ages of the models in random online porn? Guess he'd better just store no porn at all, whether or not porn is legal. That's the effect that the bluenoses who passed the "child porn" laws want, after all.) That's the "crime" being prosecuted here. This isn't the Four Horsemen's torture-the-terrorist-for-the-password hostage situation where lives are at stake and the seconds are ticking away. This is a pointless search containing the only evidence of a meaningless censorship non-crime. If the feds can force you to reveal your password in this hick sideshow, they can force it anytime. Suppose the guy had powered off his laptop rather than merely foolishly suspending it. If the border guards had DRAM key recovery tools that could find a key in the powered-down RAM, but then lost the key or it stopped working, would you think he should later be forced to reveal his password? Suppose they merely possessed DRAM key recovery software, but never deployed it? Hey, we claim that you crossed the border with that key in decaying RAM; fork over that password, buddy! Don't give them an inch, they'll take a mile. Drug users can now not safely own guns, despite the Second Amendment. Not even guns locked in safes in outbuildings, because the law passed against "using a gun in a drug crime" has been expanded by cops and judges to penalize "having a gun anywhere on the property even though it was never touched", and even when the only drug crime was simple possession. Five year mandatory minimum sentence enhancement. (Don't expect NRA to help -- their motto is "screw the criminals, leave us honest people alone". That's no good when everybody's a criminal, especially the honest people like this guy, who had nothing to hide from the border guards and helped them search his laptop.) > Sessions wrote: "Boucher's act of producing an unencrypted > version of the Z drive..." There is no such document as "an unencrypted version of the Z drive". It does not exist. It has never existed. One could in theory be created, but that would be the creation of a new document, not the production of an existing one. The existing one is encrypted, and the feds already have it. I'm still trying to figure out what the feds want in this case if the guy complies. They'll have a border guard testify that he saw a picture with a young teen in it? They'll show the jury a picture of a young teen, but won't "authenticate" it as a picture that came off the hard drive? It can just be any random picture of a young teen, that could've come from anywhere? How will that contribute to prosecuting this guy for child porn? Maybe they're just bored from training themselves by viewing official federal child porn images (that we're not allowed to see), or endlessly searching gigabytes of useless stuff on laptops. Instead they want the thrill of setting a precedent that citizens have no right to privacy in their encrypted hard drives. Let's not help them by declaring this guy's rights forfeit on a technicality. John --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by Ross Stapleton-Gray 06 Jul '18

06 Jul '18

<dave(a)farber.net> Subject: DOD IPv6 director arrested for possession of child porn This is not going to bode well for the IPv4->IPv6 transition, but what the heck is up with high-level DC bureaucrats and the kid pr0n?? http://www.gcn.com/online/vol1_no1/40341-1.html DOD IPv6 director arrested for possession of child porn 04/06/06 -- 03:54 PM By Patience Wait, A high-ranking Defense Department IT official has been arrested and indicted on child pornography charges. Charles Lynch, director of the Defense Information Systems Agencybs Internet Protocol version 6 transition program, was arrested March 8 and indicted in the U.S. District Court for the Eastern District of Virginia the next day on one count of possessing child pornography. According to a statement by the DOD Inspector Generalbs Office, court documents allege that Lynch had been operating a peer-to-peer file- sharing program on a computer in his office at DISA. Agents confiscated several computers and more than 1,000 CDs from Lynchbs office. Agents found child pornography in computer file folders, the IGbs statement said. Lynch, 44, is on leave without pay from DISA. If convicted, he faces up to 10 years in prison. The investigation is being conducted by the Defense Criminal Investigative Service, the Federal Bureau of Investigation and the DISA OIG. Officials with those agencies, as well as the U.S. Attorneybs Office, declined to comment on the ongoing investigation. In apparently unrelated cases, a Homeland Security Department official was arrested earlier this week for soliciting sex over the Internet with a minor. And last week, federal agents seized computer equipment from the desk of a NASA official March 29, based on information developed during a U.S. Postal Inspection Service undercover investigation of Internet trafficking in child pornography. B) 1996-2006 Post-Newsweek Media, Inc. All Rights Reserved. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] DOD IPv6 director arrested for possession of child porn
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: Judge orders defendant to decrypt PGP-protected laptop
by John Gilmore 06 Jul '18

06 Jul '18

> I would not read too much into this ruling -- I think that this is a > special situation, and does not address the more important general > issue. > In other cases, where alternative evidence is not available to the > government, and where government agents have not already had a look at > the contents, the facts (and hence perhaps the ruling) would be > different. Balls. This is a straight end-run attempt around the Fifth Amendment. The cops initially demanded a court order making him reveal his password -- then modified their stance on appeal after they lost. So he can't be forced to reveal it, but "on a technicality" he can be forced to produce the same effect as revealing it? Just how broad is this technicality, and how does it get to override a personal constitutional right? If the cops bust down your door and you foolishly left your computer turned on, are they entitled to make you reveal your encryption passwords anytime later, because your encrypted drive was accessible when they ran in screaming at your family and shooting your dog? Suppose they looked it over and typed a few things to the screen? Suppose they didn't? Suppose they used a fancy power-transfer plug to keep it running as they walked it out the door, but they tripped and dropped it and it powered off? That's a technicality, isn't it? Don't forget, this is a nuisance case. It's about a harmless Canadian citizen who's a permanent US resident, who crossed the Canadian border with his laptop. A guy smart enough to encrypt his drive. On the drive, among other things, was a few thousand porn images downloaded from the net. Legal porn. The border guards, who had no business even looking at his laptop's contents, trolled around in it until they found some tiny fraction of the images that (they allege) contained underage models. (How would *he* know the ages of the models in random online porn? Guess he'd better just store no porn at all, whether or not porn is legal. That's the effect that the bluenoses who passed the "child porn" laws want, after all.) That's the "crime" being prosecuted here. This isn't the Four Horsemen's torture-the-terrorist-for-the-password hostage situation where lives are at stake and the seconds are ticking away. This is a pointless search containing the only evidence of a meaningless censorship non-crime. If the feds can force you to reveal your password in this hick sideshow, they can force it anytime. Suppose the guy had powered off his laptop rather than merely foolishly suspending it. If the border guards had DRAM key recovery tools that could find a key in the powered-down RAM, but then lost the key or it stopped working, would you think he should later be forced to reveal his password? Suppose they merely possessed DRAM key recovery software, but never deployed it? Hey, we claim that you crossed the border with that key in decaying RAM; fork over that password, buddy! Don't give them an inch, they'll take a mile. Drug users can now not safely own guns, despite the Second Amendment. Not even guns locked in safes in outbuildings, because the law passed against "using a gun in a drug crime" has been expanded by cops and judges to penalize "having a gun anywhere on the property even though it was never touched", and even when the only drug crime was simple possession. Five year mandatory minimum sentence enhancement. (Don't expect NRA to help -- their motto is "screw the criminals, leave us honest people alone". That's no good when everybody's a criminal, especially the honest people like this guy, who had nothing to hide from the border guards and helped them search his laptop.) > Sessions wrote: "Boucher's act of producing an unencrypted > version of the Z drive..." There is no such document as "an unencrypted version of the Z drive". It does not exist. It has never existed. One could in theory be created, but that would be the creation of a new document, not the production of an existing one. The existing one is encrypted, and the feds already have it. I'm still trying to figure out what the feds want in this case if the guy complies. They'll have a border guard testify that he saw a picture with a young teen in it? They'll show the jury a picture of a young teen, but won't "authenticate" it as a picture that came off the hard drive? It can just be any random picture of a young teen, that could've come from anywhere? How will that contribute to prosecuting this guy for child porn? Maybe they're just bored from training themselves by viewing official federal child porn images (that we're not allowed to see), or endlessly searching gigabytes of useless stuff on laptops. Instead they want the thrill of setting a precedent that citizens have no right to privacy in their encrypted hard drives. Let's not help them by declaring this guy's rights forfeit on a technicality. John --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Unmask 1.0 Release Party at My House!
by Dave Aitel 06 Jul '18

06 Jul '18

I've released Unmask today - available at http://www.immunitysec.com/unmask.html >From the web page: What is Unmask? Unmask is a python script that allows you to break the anonymity of e-mail or other text. It works by doing basic statistical matching against stored "signatures." It may require some tweaking to fit your particular use to it (un-anonymizing IRC chats, email, web pages on FreeNet, etc). Another fun parlor game use is using it to distinguish between two groups of any kind. Male/Female, Engineers/Computer Scientists, Scientists/Liberal Arts Majors, etc. If you improve it in some way, please send me (dave(a)immunitysec.com) a note. Unmask is released under the GNU GPL v2.0. As a further note, I specifically designed Unmask to be resistant to GOBBLES style "Chinese reordered english." Dave Aitel Immunity, Inc. ----- End forwarded message ----- -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

None
by Ross Stapleton-Gray 06 Jul '18

06 Jul '18

<dave(a)farber.net> Subject: DOD IPv6 director arrested for possession of child porn This is not going to bode well for the IPv4->IPv6 transition, but what the heck is up with high-level DC bureaucrats and the kid pr0n?? http://www.gcn.com/online/vol1_no1/40341-1.html DOD IPv6 director arrested for possession of child porn 04/06/06 -- 03:54 PM By Patience Wait, A high-ranking Defense Department IT official has been arrested and indicted on child pornography charges. Charles Lynch, director of the Defense Information Systems Agencybs Internet Protocol version 6 transition program, was arrested March 8 and indicted in the U.S. District Court for the Eastern District of Virginia the next day on one count of possessing child pornography. According to a statement by the DOD Inspector Generalbs Office, court documents allege that Lynch had been operating a peer-to-peer file- sharing program on a computer in his office at DISA. Agents confiscated several computers and more than 1,000 CDs from Lynchbs office. Agents found child pornography in computer file folders, the IGbs statement said. Lynch, 44, is on leave without pay from DISA. If convicted, he faces up to 10 years in prison. The investigation is being conducted by the Defense Criminal Investigative Service, the Federal Bureau of Investigation and the DISA OIG. Officials with those agencies, as well as the U.S. Attorneybs Office, declined to comment on the ongoing investigation. In apparently unrelated cases, a Homeland Security Department official was arrested earlier this week for soliciting sex over the Internet with a minor. And last week, federal agents seized computer equipment from the desk of a NASA official March 29, based on information developed during a U.S. Postal Inspection Service undercover investigation of Internet trafficking in child pornography. B) 1996-2006 Post-Newsweek Media, Inc. All Rights Reserved. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] DOD IPv6 director arrested for possession of child porn
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [liberationtech] Here Come the Encryption Apps
by Rich Kulawiec 06 Jul '18

06 Jul '18

On Sun, Mar 10, 2013 at 10:29:44AM +0700, Nathan of Guardian wrote: > Glad to see such a great level of academic investigation and discourse > coming out of this esteemed university. I'll give him a pass on rigor, as this is an informal article and not intended to be a journal paper. (Besides, I write in the same style most of the time.) But when he asks: "What app should I use if I'm trying to overthrow my government?" I think he completely misses the point. I think a much more fundamental question is: "Should I use ANY app?" My answer to that is no. In fact: HELL NO. "Using a smartphone" strikes me as one of the most dangerous things you could possibly do in that situation. Yes...I know that's not a happy statement and is likely to be unpopular here, but let me see if I can manage to back it up. First, if you have a government that is so awful that the only alternative left is overthrowing it, then they control the telco. Therefore everyone walking around with a smartphone is providing them with a 24x7 feed of geolocation data, to the resolution available. (And that can be selectively improved in locations of interest.) Second, everyone using a smartphone is providing them data for traffic analysis. Oh, sure, it might be encrypted, but if X sends a 27313 byte message and shortly thereafter Y and Z get a 27313 byte message... Third, everyone using a smartphone and transmitting/receiving IP traffic is also providing them information about their intentions, Tor and VPNs and HTTPS notwithstanding. ("Oh, look: every night, right after the protests die down for the evening, X sends 300-400M of traffic out. Gosh...I wonder what that is.") Fourth, malware on phones is epidemic. One might have a fighting chance of stopping it if the phones are centrally managed and strictly controlled (no downloading of apps, no "updates", only a few web sites accessible, etc.) but few have the knowledge, resources and discpline to do that. Plus "centrally managed" is not exactly the best idea in this context. And of course any government faced with this threat will probably write and release more malware. Any government that *thinks* they might be faced with this threat in the future could plan ahead and embed the malware in the phones somewhere in the supply chain prior to retail sales. (I would. If I were the dictator of Elbonia, I'd be embedding malware in *every* shiny gadget because of course their closed-source nature makes it easy for me to do so. This would constitute an inexpensive insurance policy -- actually, now that I think about it, I could probably just pass the costs along to purchasers and thus get them to fund my malware. I'd label it as "a feature" or as some sort of network performance/diagnostic tool. *cough* CarrierIQ *cough*) Fifth, it's pretty easy to shut down the cellular network. Yes, this might have political and economic consequences. So? It's still not a good idea to use a communications medium that your adversary can turn off at will. (Let me note that it's not even necessary to shut it down entirely: local/temporary disruptions suffice and are easier to explain away. As we've seen.) Sixth, and let me encapsulate it as a principle: If you need a GUI to overthrow your government... you're probably not going to overthrow your government. That's harsh, condescending, snarky...but I think it's probably true. Sorry: revolution is hard. And if you're faced with an oppressive, vicious, murderous government that's fighting for its existence, I assure you that they will have people at *their* disposal who don't need a GUI to do whatever horrible things they have in mind. ---rsk -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[WIKILEAKS] Nuclear accident in Iran may lay behind mystery resignation
by Wikileaks Press Office 06 Jul '18

06 Jul '18

WIKILEAKS NOTE Thu Jul 16 23:03:02 GST 2009 "Nuclear accident in Iran may lay behind mystery resignation" Two weeks ago, a source associated with Iran's nuclear programme confidentially told WikiLeaks of a serious, recent, concealed nuclear accident at Natanz. Natanz is the primary location of Iran's nuclear enrichment program. We have reason to believe the source was credible however contact with this source has been lost. We would not normally mention such an incident without additional confirmation, however according to Iranian media and the BBC, today the head of Iran's Atomic Energy Organization, Gholam Reza Aghazadeh has resigned under mysterious circumstances. According to reports, the resignation was tendered around 20 days ago. Contact: wl-iran(a)ljsf.org +-------------------------------------------------- | Why you receive this mail and what to do with it: | | You are receiving this mail because you were invited to | the Wikileaks Press Release list run by the transparency group Sunshine Press. | | Releases ensure you are aware, before the rest of the world, | of significant geopolitical and other disclosures released | by Wikileaks, an international platform for the first release of | of classified, confidential or censored materials of political, | diplomatic, ethical or historical interest. | | We rely on you to distribute the content of this mail to your | community, industry, press and regulators, to defend us in your | country and to invite people of integrity and commitment via | via https://lists.riseup.net/www/subscribe/wl-press | | Our materials range from secret Guantanamo documents to political | assassinations to confidential reports of children's hospital | corruption, and have spawned tens of thousands of press articles, | many reforms and changed electoral outcomes. | | Releases average one per week but can be higher or lower depending on | events. You can easily set the frequency to monthly or change your | subscription via https://lists.riseup.net/www/sendpasswd/ | | If you know people that have access to sensitive documents of public | interest, tell them about us. We have an unbroken record of protecting | sensitive sources and defeating censorship attacks from all corners of the globe. | See https://secure.wikileaks.org/wiki/Wikileaks:Submissions | | If you are about to release an investigative report or article, we can release the | underlaying source material concurrently to substantiate the allegations, | draw attention away from the true source, deflect legal or censorship | attacks and promote secondary investigations and public awareness. | | Live bank-grade encrypted chat to the office is available via | https://secure.wikileaks.org/chat/irc2.cgi (multiple languages spoken) | | Inquiries for speaking engagements, comment, interventions, | investigations, source-protection and censorship consultations | may be addressed to http://wikileaks.org/wiki/Wikileaks:Contact | | If you are serious about analysis, translation, | legal, coding, network, financial or other contributions, please contact | us via: http://wikileaks.org/wiki/Wikileaks:Contact | | See http://wikileaks.org for all other information and | https://secure.wikileaks.org for secure access. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0