July 2018 - cypherpunks-legacy

May 24: National Day of Outrage at NSA/Telco surveillance
by John Gilmore 06 Jul '18

06 Jul '18

Some alternative media groups have called for a national day of protests against the telcos' latest sleazy activities, including their cooperation in NSA's illegal surveillance of innocent citizens. http://saveaccess.org/ Events are already scheduled in Boston, Chicago, San Francisco, and NYC. You can register your own local event by sending mail to protest(a)saveaccess.org. Curiously, nobody in Washington, DC or Baltimore is protesting yet. Perhaps a contingent should form outside NSA, with signs showing the NSA employees on their way to/from work just what we think of their disrespect for the constitution, the law, and the public. Do we have a local volunteer to organize it? John PS: I don't agree with all the things these people are protesting, but I admire their energy. I haven't seen cryptographers and cypherpunks with protest signs -- yet. But I hope to see you out there on May 24th. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[liberationtech] Would this have worked better for Petraeus & Broadwell?
by Yosem Companys 06 Jul '18

06 Jul '18

What Petraeus & Broadwell *Should* Have Done Remember, when trying to hide things from the FBI, no method is perfect, especially when they're already on your trail. The following tools are not 100% foolproof, but if employed early would have made for a much more convoluted game of cat and mouse, and might even have concealed the amorous activity long enough for the general and his fatal attraction to have escaped unscathed. * 1. PGP Encryption <http://www.wisegeek.com/what-is-pgp.htm>:* PGP stands for "pretty good privacy," and that's exactly what it is. The service encrypts data, like emails, which would have been another hurdle for the FBI to jump through. If this method would have been used, it would have forced Uncle Sam to deploy Trojan-style spyware onto Broadwellbs computer to uncover the emails. With Google snitching the General out, PGP might not have worked. For regular folks though, this tool is a good start. *2. Hide Your IP:* Tools like Tor <https://www.torproject.org/>, an open source method to conceal real IP addresses and Web browsing, would have masked their IP address identification. Another is Hamachi<http://hamachi.en.softonic.com/>, an app that creates free, encrypted Virtual Private Networks<http://lifehacker.com/5763170/how-to-secure-and-encrypt-your-web-browsing-o…> (VPNs) between computers. Just use the VPN every time you log in, and don't log in from your home IP, and you should be safer. Well, unless you're LulzSec<http://torrentfreak.com/vpn-providers-mull-fraudster-database-in-wake-of-lu…> that is. *3. Disposable Email:* This message will self destruct after reading. Really. If the General really was 007, or even 007-ish, he would have used this method. Disposable email functions much like it sounds, with messages that are deleted after reading. Disposable email services include Spamex<http://www.spamex.com/> and Mailinator <http://www.mailinator.com/>, which were originally designed to keep out spam, not the Feds. *4. Don't Send Messages Online Period!* Keep it offline! If this was 1972, short of the U.S. Postal Service intercepting their mail, this would have been the ideal method, and some inquisitive papparazzi snapping a photo would have been all they would have had to worry about. While the two *did* spend a good deal of time together in-person (Broadwell apparently traveled overseas to Iraq and Afghanistan to visit Petraeus), they might have been safer to keep the relationship in person only. The only truly private way to use email? Don't! http://readwrite.com/2012/11/14/how-to-hide-your-email-what-petraeus-did-wh… -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

<nettime> Schneier: The Internet is a surveillance state
by nettime's_roving_reporter 06 Jul '18

06 Jul '18

http://edition.cnn.com/2013/03/16/opinion/schneier-internet-surveillance/ The Internet is a surveillance state By Bruce Schneier, Special to CNN March 16, 2013 -- Updated 1804 GMT (0204 HKT) I'm going to start with three data points. One: Some of the Chinese military hackers who were implicated in a broad set of attacks against the U.S. government and corporations were identified because they accessed Facebook from the same network infrastructure they used to carry out their attacks. Two: Hector Monsegur, one of the leaders of the LulzSac hacker movement, was identified and arrested last year by the FBI. Although he practiced good computer security and used an anonymous relay service to protect his identity, he slipped up. And three: Paula Broadwell,who had an affair with CIA director David Petraeus, similarly took extensive precautions to hide her identity. She never logged in to her anonymous e-mail service from her home network. Instead, she used hotel and other public networks when she e-mailed him. The FBI correlated hotel registration data from several different hotels -- and hers was the common name. The Internet is a surveillance state. Whether we admit it to ourselves or not, and whether we like it or not, we're being tracked all the time. Google tracks us, both on its pages and on other pages it has access to. Facebook does the same; it even tracks non-Facebook users. Apple tracks us on our iPhones and iPads. One reporter used a tool called Collusion to track who was tracking him; 105 companies tracked his Internet use during one 36-hour period. Become a fan of CNNOpinion Stay up to date on the latest opinion, analysis and conversations through social media. Join us at Facebook/CNNOpinion and follow us @CNNOpinion on Twitter. We welcome your ideas and comments. Increasingly, what we do on the Internet is being combined with other data about us. Unmasking Broadwell's identity involved correlating her Internet activity with her hotel stays. Everything we do now involves computers, and computers produce data as a natural by-product. Everything is now being saved and correlated, and many big-data companies make money by building up intimate profiles of our lives from a variety of sources. News: Cyberthreats getting worse, House intelligence officials warn Facebook, for example, correlates your online behavior with your purchasing habits offline. And there's more. There's location data from your cell phone, there's a record of your movements from closed-circuit TVs. This is ubiquitous surveillance: All of us being watched, all the time, and that data being stored forever. This is what a surveillance state looks like, and it's efficient beyond the wildest dreams of George Orwell. Sure, we can take measures to prevent this. We can limit what we search on Google from our iPhones, and instead use computer web browsers that allow us to delete cookies. We can use an alias on Facebook. We can turn our cell phones off and spend cash. But increasingly, none of it matters. There are simply too many ways to be tracked. The Internet, e-mail, cell phones, web browsers, social networking sites, search engines: these have become necessities, and it's fanciful to expect people to simply refuse to use them just because they don't like the spying, especially since the full extent of such spying is deliberately hidden from us and there are few alternatives being marketed by companies that don't spy. This isn't something the free market can fix. We consumers have no choice in the matter. All the major companies that provide us with Internet services are interested in tracking us. Visit a website and it will almost certainly know who you are; there are lots of ways to be tracked without cookies. Cellphone companies routinely undo the web's privacy protection. One experiment at Carnegie Mellon took real-time videos of students on campus and was able to identify one-third of them by comparing their photos with publicly available tagged Facebook photos. Maintaining privacy on the Internet is nearly impossible. If you forget even once to enable your protections, or click on the wrong link, or type the wrong thing, and you've permanently attached your name to whatever anonymous service you're using. Monsegur slipped up once, and the FBI got him. If the director of the CIA can't maintain his privacy on the Internet, we've got no hope. In today's world, governments and corporations are working together to keep things that way. Governments are happy to use the data corporations collect -- occasionally demanding that they collect more and save it longer -- to spy on us. And corporations are happy to buy data from governments. Together the powerful spy on the powerless, and they're not going to give up their positions of power, despite what the people want. Fixing this requires strong government will, but they're just as punch-drunk on data as the corporations. Slap-on-the-wrist fines notwithstanding, no one is agitating for better privacy laws. So, we're done. Welcome to a world where Google knows exactly what sort of porn you all like, and more about your interests than your spouse does. Welcome to a world where your cell phone company knows exactly where you are all the time. Welcome to the end of private conversations, because increasingly your conversations are conducted by e-mail, text, or social networking sites. And welcome to a world where all of this, and everything else that you do or is done on a computer, is saved, correlated, studied, passed around from company to company without your knowledge or consent; and where the government accesses it at will without a warrant. Welcome to an Internet without privacy, and we've ended up here with hardly a fight. # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Why some Tor servers are slow (was Re: TOR Park Exit Node Question)
by Roger Dingledine 06 Jul '18

06 Jul '18

On Fri, Sep 30, 2005 at 02:04:46PM +0300, Giorgos Pallas wrote: > >What I mean is, is it normal for the Tonga server to claim over 4 MB of > >bandwidth ? If so, why are other servers that are on a 100 Mbit link not > >reporting more bandwidth ? Tonga is using dual AMD64's. Moria also uses those CPUs. They seem to be extremely fast at crypto (and everything else). Tonga also advertises port 80 and 443, so it's useful for people stuck behind fascist firewalls. Tonga also opened up its exit policy to attract more traffic. Servers that have lots of unused capacity, and are fast and have high uptime, and offer unusual ports like the default file-sharing ports, will bootstrap themselves by advertising a little bit, attracting more clients, and so on. (I'm not sure I actually like the fact that Tonga opened up its file sharing ports, since it puts more load on the rest of the network too, but I guess since we're still in development, a little bit of stress like this can be good for us.) > >While typing this it occurred to me that the default > >MaxAdvertisedBandwith is 2 MB and that Tonga has probably set it higher... Actually, the default MaxAdvertisedBandwidth is 128 TB. I believe you're thinking of BandwidthRate. > Whis has also been a question of mine. Why my tor router handles a very > low traffic volume (~30 KB in and out) while at the same time has 100% > connectivity, 100Mbps of real bandwidth and stays up for more than a > week (until it crashes due to memory ;-)... Could anyone help with that? > It's frustrating wanting to share (bandwidth in our case) with the > community but not being able to do so! There is something wrong with the masquerade Tor server. You can see it yourself (you may have to try from someplace other than masquerade's LAN, though) -- run "telnet 155.207.113.227 9001" and hit enter about 10 times. Notice how it's really sluggish and takes a long time before it hangs up. Now run "telnet 82.94.251.206 443" and do the same thing. Notice how it realizes the ssl handshake has failed after about 5 lines. This is how it's supposed to be. So masquerade is somehow not putting much attention into its ssl handshakes. This could be because its network connection is actually through a proxy or a firewall that is dropping some of the packets or slowing things down tremendously. It could also be that it's running on a 100 mhz 486, or its ulimits are set to something crazy-low, or it's busy ray-tracing a movie, or something else. I'd be curious to learn what's up with it. I've seen this behavior before on Windows machines behind cable modems and crappy NAT boxes. --Roger ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Politech] Data retention endorsed by International Association of Chiefs of Police [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

The idea of data retention -- forcing Internet companies to keep track of what their customers are doing -- will probably be one of the biggest Politech topics of 2007. That's when the new Congress will convene and the FBI will resume its push for federal legislation. The groundwork is being laid right now. The International Association of Chiefs of Police endorsed the concept in a resolution, and FBI director Robert Mueller applauded them a few hours later: http://www.fbi.gov/pressrel/speeches/mueller101706.htm "Today, terrorists coordinate their plans cloaked in the anonymity of the Internet, as do violent sexual predators prowling chat rooms... Before we can catch these offenders, Internet service providers have unwittingly deleted the very records that would help us identify these offenders and protect future victims. We must find a balance between the legitimate need for privacy and law enforcementbs clear need for access. Your resolution on records retention passed this morning will help put us on the right path." Here's a timeline so far: http://news.com.com/2100-7348_3-6126877.html The IACP resolution follows (I converted it from a Word document, so the formatting isn't quite perfect). Note that data retention is being extended from ISPs to registrars and registries. Search engines have also been talked about as potential targets. -Declan --------------------- The International Association of Chiefs of Police Adopted at the 113th Annual Conference Boston, Massachusetts October 17, 2006 Support For Data Retention In Aid Of The Investigation Of Crimes Facilitated Or Committed Through The Use Of The Internet And Telephony-Based Communications Services Submitted by the Communications & Technology Committee WHEREAS, the lawful investigation of Internet data and telephonic communications has historically proven to be one of the most valuable tools available to law enforcement in identifying both the perpetrators and victims of crimes; WHEREAS, the Internet is global in nature, and as such, poses challenges when conducting multi-agency international investigations, including delays imposed when obtaining local and international legal process; WHEREAS, the IACP has previously noted in its Resolution of September 27, 2005 entitled b Support for Preservation of Access to Publicly Available Resources in Cyber Investigations, b CT23.a05, that electronic forensic evidence is fleeting in nature, and law enforcement officials must obtain timely access to this information to fulfill law enforcement duties before the information is destroyed or otherwise becomes unavailable; WHEREAS, criminals use the anonymity and international nature of the Internet, and the fleeting nature of electronic evidence, to enhance their ability to victimize citizens and thwart law enforcement investigations; WHEREAS, publicly available b whoisb databases containing information involving the allocation of Internet resources, such as Internet Protocol address space and domain names, are a critical tool used by law enforcement, but may not remain publicly available, which would severely hamper or eliminate the ability for law enforcement agencies to conduct investigations in a timely manner; WHEREAS, the failure of Internet access provider industry to retain subscriber information, and source or destination information for any uniform, predictable reasonable period, has resulted in the absence of data, which has become a significant hindrance and even an obstacle in certain investigations such as computer intrusion investigations and child obscenity and exploitation investigations, although law enforcement has generally acted expeditiously in processing lawful requests to Internet providers; WHEREAS, the migration in telephony from "toll service" to a nationwide or continental flat rate billing system has substantially eroded law enforcementbs ability to utilize lawful process to obtain telephone toll records historically critical to the identification, detection and prevention terrorist threat and the investigation of serious criminal conspiracies; WHEREAS, the effect of the lack of uniform retention periods of customer/subscriber records, and communication source and destination data in various industries and amongst various providers in the same industry has been to undermine law enforcementbs ability to predictably prioritize investigations or strategically assign resources to those investigations which are largely dependant upon the existence of such data, and; WHEREAS, the European Union addressed this problem in March 2006 by passing a Directive on Data Retention, Directive 2006/24/EC, requiring Member States to adopt laws to combat serious crime and terrorism by requiring the retention of customer information and communication source and destination information for a uniform minimum period, now, therefore, be it -b RESOLVED, that the IACP strongly urges national legislatures, the Internet administration and telephony communities, including regional Internet registries, the Internet Corporation for Assigned Names and Numbers, domain-name registries, domain-name registrars, Internet access and service providers and telecommunication providers to develop an appropriate but uniform data retention mandate for both the aforementioned Internet administration community and telephony service providers requiring the retention of customer subscriber information, and source and destination information for a minimum specified reasonable period of time so that it will be available to the law enforcement community, upon applicable legal process, to enhance public safety and prevent, deter or detect terrorists and criminals through the ability to investigate offenses facilitate by use of the Internet and telephony. FURTHER RESOLVED, that the IACP membership actively engage their respective governmental executive and legislative components, Internet administration, and telephony industry communities and coordinate their efforts to achieve the goal of providing consistent, equal, and uniform lawful access to the above-referenced resources for all of the law enforcement community. _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [cryptography] Bitcoin-mining Botnets observed in the wild? (was: Re: Bitcoin in endgame
by Adam Back 06 Jul '18

06 Jul '18

An never mind... the 555MH and 12.4TH its 23,000 AMD 7970 GPU equivalents, that back in the land of plausible. Or 158 petflops if you accept bitcoinwatch.com's sha256 to "flop" conversion ratio. A human brain by comparison is generally considered to be about 10-100x less than the current bitcoin network (10^15 - 10^16 ops/sec). So maybe the bitcoin network has just enough power to simulate a single human brain. Except a human brain consumes 25watts and even with 23,000 7970s the bitcoin network must be using more than 5 MW. Moore's law still has a lot of work to do to catchup with biologial computers in efficiency and horsepower. Adam On Sat, May 12, 2012 at 01:22:44AM +0200, Adam Back wrote: > Strikes me 12TH/sec is not actually very much computation? > http://bitcoinwatch.com/ also gives network hashrate at 12.4 TH/sec. > > But a single normally clocked (925Mhz) AMD 7970 based graphics card which > has 2048 cores is claimed to provide 555MH/sec. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Why some Tor servers are slow (was Re: TOR Park Exit Node Question)
by Roger Dingledine 06 Jul '18

06 Jul '18

On Fri, Sep 30, 2005 at 02:04:46PM +0300, Giorgos Pallas wrote: > >What I mean is, is it normal for the Tonga server to claim over 4 MB of > >bandwidth ? If so, why are other servers that are on a 100 Mbit link not > >reporting more bandwidth ? Tonga is using dual AMD64's. Moria also uses those CPUs. They seem to be extremely fast at crypto (and everything else). Tonga also advertises port 80 and 443, so it's useful for people stuck behind fascist firewalls. Tonga also opened up its exit policy to attract more traffic. Servers that have lots of unused capacity, and are fast and have high uptime, and offer unusual ports like the default file-sharing ports, will bootstrap themselves by advertising a little bit, attracting more clients, and so on. (I'm not sure I actually like the fact that Tonga opened up its file sharing ports, since it puts more load on the rest of the network too, but I guess since we're still in development, a little bit of stress like this can be good for us.) > >While typing this it occurred to me that the default > >MaxAdvertisedBandwith is 2 MB and that Tonga has probably set it higher... Actually, the default MaxAdvertisedBandwidth is 128 TB. I believe you're thinking of BandwidthRate. > Whis has also been a question of mine. Why my tor router handles a very > low traffic volume (~30 KB in and out) while at the same time has 100% > connectivity, 100Mbps of real bandwidth and stays up for more than a > week (until it crashes due to memory ;-)... Could anyone help with that? > It's frustrating wanting to share (bandwidth in our case) with the > community but not being able to do so! There is something wrong with the masquerade Tor server. You can see it yourself (you may have to try from someplace other than masquerade's LAN, though) -- run "telnet 155.207.113.227 9001" and hit enter about 10 times. Notice how it's really sluggish and takes a long time before it hangs up. Now run "telnet 82.94.251.206 443" and do the same thing. Notice how it realizes the ssl handshake has failed after about 5 lines. This is how it's supposed to be. So masquerade is somehow not putting much attention into its ssl handshakes. This could be because its network connection is actually through a proxy or a firewall that is dropping some of the packets or slowing things down tremendously. It could also be that it's running on a 100 mhz 486, or its ulimits are set to something crazy-low, or it's busy ray-tracing a movie, or something else. I'd be curious to learn what's up with it. I've seen this behavior before on Windows machines behind cable modems and crappy NAT boxes. --Roger ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Politech] Data retention endorsed by International Association of Chiefs of Police [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

The idea of data retention -- forcing Internet companies to keep track of what their customers are doing -- will probably be one of the biggest Politech topics of 2007. That's when the new Congress will convene and the FBI will resume its push for federal legislation. The groundwork is being laid right now. The International Association of Chiefs of Police endorsed the concept in a resolution, and FBI director Robert Mueller applauded them a few hours later: http://www.fbi.gov/pressrel/speeches/mueller101706.htm "Today, terrorists coordinate their plans cloaked in the anonymity of the Internet, as do violent sexual predators prowling chat rooms... Before we can catch these offenders, Internet service providers have unwittingly deleted the very records that would help us identify these offenders and protect future victims. We must find a balance between the legitimate need for privacy and law enforcementbs clear need for access. Your resolution on records retention passed this morning will help put us on the right path." Here's a timeline so far: http://news.com.com/2100-7348_3-6126877.html The IACP resolution follows (I converted it from a Word document, so the formatting isn't quite perfect). Note that data retention is being extended from ISPs to registrars and registries. Search engines have also been talked about as potential targets. -Declan --------------------- The International Association of Chiefs of Police Adopted at the 113th Annual Conference Boston, Massachusetts October 17, 2006 Support For Data Retention In Aid Of The Investigation Of Crimes Facilitated Or Committed Through The Use Of The Internet And Telephony-Based Communications Services Submitted by the Communications & Technology Committee WHEREAS, the lawful investigation of Internet data and telephonic communications has historically proven to be one of the most valuable tools available to law enforcement in identifying both the perpetrators and victims of crimes; WHEREAS, the Internet is global in nature, and as such, poses challenges when conducting multi-agency international investigations, including delays imposed when obtaining local and international legal process; WHEREAS, the IACP has previously noted in its Resolution of September 27, 2005 entitled b Support for Preservation of Access to Publicly Available Resources in Cyber Investigations, b CT23.a05, that electronic forensic evidence is fleeting in nature, and law enforcement officials must obtain timely access to this information to fulfill law enforcement duties before the information is destroyed or otherwise becomes unavailable; WHEREAS, criminals use the anonymity and international nature of the Internet, and the fleeting nature of electronic evidence, to enhance their ability to victimize citizens and thwart law enforcement investigations; WHEREAS, publicly available b whoisb databases containing information involving the allocation of Internet resources, such as Internet Protocol address space and domain names, are a critical tool used by law enforcement, but may not remain publicly available, which would severely hamper or eliminate the ability for law enforcement agencies to conduct investigations in a timely manner; WHEREAS, the failure of Internet access provider industry to retain subscriber information, and source or destination information for any uniform, predictable reasonable period, has resulted in the absence of data, which has become a significant hindrance and even an obstacle in certain investigations such as computer intrusion investigations and child obscenity and exploitation investigations, although law enforcement has generally acted expeditiously in processing lawful requests to Internet providers; WHEREAS, the migration in telephony from "toll service" to a nationwide or continental flat rate billing system has substantially eroded law enforcementbs ability to utilize lawful process to obtain telephone toll records historically critical to the identification, detection and prevention terrorist threat and the investigation of serious criminal conspiracies; WHEREAS, the effect of the lack of uniform retention periods of customer/subscriber records, and communication source and destination data in various industries and amongst various providers in the same industry has been to undermine law enforcementbs ability to predictably prioritize investigations or strategically assign resources to those investigations which are largely dependant upon the existence of such data, and; WHEREAS, the European Union addressed this problem in March 2006 by passing a Directive on Data Retention, Directive 2006/24/EC, requiring Member States to adopt laws to combat serious crime and terrorism by requiring the retention of customer information and communication source and destination information for a uniform minimum period, now, therefore, be it -b RESOLVED, that the IACP strongly urges national legislatures, the Internet administration and telephony communities, including regional Internet registries, the Internet Corporation for Assigned Names and Numbers, domain-name registries, domain-name registrars, Internet access and service providers and telecommunication providers to develop an appropriate but uniform data retention mandate for both the aforementioned Internet administration community and telephony service providers requiring the retention of customer subscriber information, and source and destination information for a minimum specified reasonable period of time so that it will be available to the law enforcement community, upon applicable legal process, to enhance public safety and prevent, deter or detect terrorists and criminals through the ability to investigate offenses facilitate by use of the Internet and telephony. FURTHER RESOLVED, that the IACP membership actively engage their respective governmental executive and legislative components, Internet administration, and telephony industry communities and coordinate their efforts to achieve the goal of providing consistent, equal, and uniform lawful access to the above-referenced resources for all of the law enforcement community. _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [cryptography] Bitcoin-mining Botnets observed in the wild? (was: Re: Bitcoin in endgame
by Adam Back 06 Jul '18

06 Jul '18

An never mind... the 555MH and 12.4TH its 23,000 AMD 7970 GPU equivalents, that back in the land of plausible. Or 158 petflops if you accept bitcoinwatch.com's sha256 to "flop" conversion ratio. A human brain by comparison is generally considered to be about 10-100x less than the current bitcoin network (10^15 - 10^16 ops/sec). So maybe the bitcoin network has just enough power to simulate a single human brain. Except a human brain consumes 25watts and even with 23,000 7970s the bitcoin network must be using more than 5 MW. Moore's law still has a lot of work to do to catchup with biologial computers in efficiency and horsepower. Adam On Sat, May 12, 2012 at 01:22:44AM +0200, Adam Back wrote: > Strikes me 12TH/sec is not actually very much computation? > http://bitcoinwatch.com/ also gives network hashrate at 12.4 TH/sec. > > But a single normally clocked (925Mhz) AMD 7970 based graphics card which > has 2048 cores is claimed to provide 555MH/sec. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [IP] Re: 2 on fingerprinting in Japan
by Gohsuke Takama 06 Jul '18

06 Jul '18

for IP, if you wish. as an advisory member of Privacy International, I'd like to inform here that Privacy International sent a letter below to Japan's Ministry of Justice which manages immigration process on Nov 19, regarding to recent start of fingerprint scanning and digitized facial picture taking at the immigration. 68 organizations from 30 countries endorsed this letter reflected the issue was containing much broader problems, not just for foreigners visiting or living in Japan. BTW if you compare the US-VISIT and the Japanese system, you would notice the similarity of both and would wonder who did system intergration. Gohsuke Takama ------------------------------------------------------- http://www.privacyinternational.org/article.shtml? cmd[347]=x-347-558619 PI leads coalition of organisations against Japanese Government plans for fingerprinting at border 19/11/2007 Today, in a coalition with 18 Japanese rights groups, Privacy International delivered a letter to the Japanese Minister of Justice to protest against the implementation of a fingerprinting system and face-scanning system at its borders. All visitors and many foreign residents to Japan will be fingerprinted under this plan. Our letter to the Minister is endorsed by 68 organisations from 30 countries. In our letter, we show that there are numerous problems with the Government's plans. On top of infringing the rights to privacy of all visitors to Japan, the Japanese will run the risk of repeating the mistakes encountered by the U.S. Government in its border management systems that have lead to serious technology and management failures. We call on the Minister to reconsider their plans for treating business visitors and tourists as though they are terrorists. The letter is available in PDF at http://www.privacyinternational.org/issues/borders/lettertojapan.pdf . A version of the letter is available below, though within footnote references. -------------- The Rt Honourable Kunio Hatoyama Minister of Justice 1-1-1 Kasumigaseki Chiyoda-ku, Tokyo Nippon November 19, 2007 Dear Minister Hatoyama Regarding plans to fingerprint and face-scan all visitors to Japan We, the undersigned human rights and civil liberties groups from around the world are writing to you to express our grave concerns regarding the Ministry of Justice's imminent implementation of the Immigration Control and Refugee Recognition Act. We believe that your plans to fingerprint and face-scan foreign- residents and visitors to Japan are a gross and disproportionate infringement upon civil liberties, copying the most ineffective, costly and risky practices on border management from around the world. We respectfully call on you to reconsider your plans to implement this system. We also call on you to explain to the world why potential visitors should travel to your country and face these inconveniences when you have done so little to explain the nature of this human processing. We believe it is likely that the implementation of this system will create a negative impact on your tourism industry and on the flow of foreign workers to Japan, thus hurting Japan's economy and in turn giving rise to possible claims of Japanese isolationism. Background According to your plans for Immigration Control: "In order to detect and oust, at the border, terrorists or foreign nationals who have been deported from Japan or committed crimes, one effective method is to further enhance measures against forged and falsified documents and to utilize biometrics in immigration examinations. In order to take facial portraits and fingerprint data during landing examinations of foreign nationals under the b Action Plan for Prevention of Terrorismb (as adopted at the Headquarters for Promotion of Measures Against Transnational Organized Crime and Other Relative Issues and International Terrorism on December 10, 2004), necessary preparations will be made by putting in order points for us to keep in mind, observing relevant measures taken by foreign countries and developing relevant law." It has come to our attention that you plan to implement this system within a matter of weeks that you will face-scan and fingerprint all visitors to Japan and retain this information for an extended period of time (some reports claim that you intend to do so for up to 80 years), and combine this data with other sources of personal information. Infringing upon the Right to Privacy Your plans are in breach of individuals' human rights, and in particular, their right to privacy. The right to privacy is recognized specifically by numerous international human rights treaties. The Universal Declaration of Human Rights recognises the right to privacy under Article 12. Similar language is adopted in the International Covenant on Civil and Political Rights under Article 17, the United Nations (UN) Convention on Migrant Workers in Article 14, and the UN Convention on the Rights of the Child under Article 16. We note that the Japanese Supreme Court has recognized the right to privacy under Article 13 of the Japanese Constitution. Your system proposes to indiscriminately collect sensitive personal information from all foreign travellers. This mass project for the processing of human beings is tantamount to treating all visitors to your country as though they were criminals. We are surprised by the lack of information regarding proposed safeguards and appeal methods. Instead we hear rhetoric about the importance of combating terrorism and threats to force the return of anyone who fails to comply with this new requirement. This is particularly worrisome because Japan's privacy laws are regarded as weak by international standards. We note that Japan has to some extent applied international standards such as the OECD's Privacy Guidelines into two recent privacy laws. The law that covers commercial entities partially follows international standards, yet the law that applies to the use and sharing of data held by government agencies is very weak. This decreases our confidence that your government has the necessary accountability structures to collect such vast amounts of personal information. The protection of human rights is at its weakest when individuals are waiting for entry at the border of a foreign country. Traditionally, governments afforded respect to visitors from other nations on the basis of reciprocity: if you treat one nation's citizens with respect that nation's government will treat yours similarly. Japan is showing a remarkable level of disrespect to the dignity of tourists and foreign business travellers by collecting detailed information on them, in an indiscriminate manner as a condition of entry, with no promise of safeguards, or any means of appeal. We also note that the Japanese Government previously criticised systems such as the one you are about to implement. In 2002 at a meeting of the International Civil Aviation Organisation the Japanese delegation stated that "the Japanese people are saddened by the approach of the United States", and the delegation could not understand "why the United States can not longer trust Japanese citizens" and that the unilateral use of biometrics will have a negative impact on the 17 million Japanese that visit the U.S. every year. We are surprised by this turn of events and opinion. A Complex and Risky System The collection of all this personal information and its centralisation into databases will create privacy risks, and will also lead to likely security risks. We believe that Japan is making a grave mistake by following the path forged by the United States of America with its US-VISIT programme. Until the implementation of your system, the U.S. was alone in the world in fingerprinting and face-scanning all visitors and retaining this information for vast periods of time. Years into their programme it is clear that the U.S. should serve as a cautionary tale rather than as an example of best practice. The US-VISIT system was approved in a similar manner to the Japanese system. That is, it was approved through a highly political environment with little public debate or policy deliberation. In the U.S., the government relied on its rhetoric about fighting terrorism and crime rather than careful policy development and deployment. Now, years later, the US-VISIT system is finally receiving some of its much needed oversight, and the reality of advanced border systems is becoming clear. According to U.S. Government reports, we now know that: b after spending $1.3 billion over 4 years, only half the U.S. system has been delivered. b expenditures continue on projects that "are not well- defined, planned, or justified on the basis of costs, benefits, and risks", lacking "a sufficient basis for effective program oversight and accountability". b the U.S. government has "continued to invest in US-VISIT without a clearly defined operational context that includes explicit relationships with related border security and immigration enforcement initiatives". b "management controls to identify and evaluate computer and operational problems were insufficient and inconsistently administered" and thus "continues to face longstanding US-VISIT management challenges and future uncertainties" as it continues to "fall short of expectations". b "lacking acquisition and financial management controls", and project managers have failed to "economically justify its investment in US-VISIT increments or assess their operational impacts", "had not assessed the impact of the entry and exit capabilities on operations and facilities, in part, because the scope of the evaluations performed were too limited." b "contracts have not been effectively managed and overseen". b and finally, security "weaknesses collectively increase the risk that unauthorized individuals could read, copy, delete, add, and modify sensitive information, including personally identifiable information, and disrupt the operations of the US-VISIT program." According to the chairman of the U.S. Senate Homeland Security Committee, Senator Joseph Lieberman, the U.S. government "is spending $1.7 billion of taxpayer money on a program to detect potential terrorists crossing our borders yet it isn't taking the most basic precautions to keep them from hacking into and changing or deleting sensitive information." It is therefore of little surprise that the U.S. border systems occasionally fail. On a number of occasions the U.S. border systems have broken down resulting in thousands of people being forced to wait until the system problems could be resolved. For instance, in August 2007, 20,000 travellers were left stranded at Los Angeles airport, with visitors spending the night on the airport floors and planes prevented from even coming into the gates for passengers (both citizens and visitors) to de-plane because the airport was overwhelmed. More stories are emerging from around the world where weak security protocols have made personal information held on visa databases widely available to the public and potential identity thieves, and where fingerprint mismatches have lead to gross injustices. Without competent planning and care, visitors to Japan have no reason to be confident that the personal information that they are forced to disclose will be adequately protected by your system. Towards Effective Border Management? Japan should be careful not to follow the U.S. lead. Recent surveys have shown that the U.S. is now rated as the worst place to visit because of its immigration and entry procedures, followed by the Middle East. There are better ways of greeting visitors to your country than treating tourists and business travelers as though they were terrorists. There are privacy-friendly ways of identifying criminals at borders without invading the privacy of all visitors and making them vulnerable to identity theft through the leakage of data from your systems. For instance, border officials could verify passports against the INTERPOL list of lost and stolen passports from around the world. Remarkably so few countries actually do this. It would be a far more effective and proportionate solution. Even this step must be made with great care as errors are still likely which will inhibit the flow of travellers. As an example, in a test of 1.9 million passport records collected over 16 days by U.S. border officials, 273 documents were identified as stolen documents. Eventually however, 219 cases were cleared and 64 remained unresolved. As with any watchlist program, clear oversight and accountability structures must be established to allow for the necessary appeals against erroneous data. We have already seen numerous problems with the U.S. watchlists wrongly flagging innocent individuals as terrorists, growing out of control with serious integrity problems. We expect that any system your government implements will likely give rise to similar problems. In our experiences, technological systems fail most when they do not receive adequate policy deliberation. We also believe that immigration policy is a complex domain that rarely attracts the necessary attention and deliberative care that it deserves. Your plans to fingerprint and face-scan every visitor to your country appears to exemplify this risk. It is unfortunate that we could not offer our views earlier but your consultation was only conducted in the Japanese language. Your plans will damage Japan's standing in the world, making a wonderful and beautiful country less inviting to tourists, and will unnecessarily hurt Japan's role as a global economic leader. If serious changes to your plans are not made, we worry that individuals who are concerned about the privacy and security of their personal information will avoid travel to Japan. Please reconsider your plans. Also, please note, that if you move down this path, other governments may well follow and will start fingerprinting your own citizens on the grounds that you do it to theirs. These systems will likely be as complex, risky and insecure as yours. This is not the type of world that you, your citizens or we would like to live in. Yours sincerely, c Privacy International c Action on Rights for Children (UK) APC Africa Women (Africa) APC.au (Australia) ArabDev (Egypt) Asian Coalition for Housing Rights (Japan) Association For Progressive Communications (International) Associazione per la Liberta` nella Comunicazione Elettronica Interattiva (Italy) ATTAC Japan (Japan) Australian Privacy Foundation (Australia) AZUR Developpement (Congo) Big Brother Awards (France) Bluelink (Bulgaria) British Columbia Civil Liberties Association (Canada) BytesForAll.org (South Asia) Canadian Internet Policy and Public Interest Clinic (Canada) Colnodo (Colombia) Community Education Computer Society (South Africa) Digital Rights (Denmark) Digital Rights Ireland Electronic Frontier Finland (Finland) Electronic Frontier Foundation (US) Electronic Privacy Information Center (US) European Digital Rights (EU) Fantsuam Foundation (Nigeria) Focus on the Global South (Asia) Foundation for Information Policy Research (FIPR) Foundation For Media Alternatives (Philippines) GreenNet (UK) Greenspider (Hungary) Index on Censorship (International) International Civil Liberties Monitoring Group (International) International Movement Against All Forms of Discrimination and Racism (Japan) International Solidarity Action of the Have-Nots (Japan) IRIS - Imaginons un reB4seau Internet solidaire (France) Iuridicum Remedium (Czech Republic) Japan Computer Access for Empowerment (Japan) Japan Lawyers Network for Refugees (Japan) JCA-NET(Japan) Jinbonet (South Korea) Joint Labor Union of Christian Offices and Businesses (Japan) Laneta (Mexico) Network Against JUKINET(Japan) Networkers against Surveillance Task-force (Japan) Netzwerk Neue Medien (Germany) No2ID (UK) NODO Tau (Argentina) OneWorld Platform South West Europe (Bosnia-Herzegovina) Open Rights Group (UK) Peace Boat (Japan) Peace Not War Japan (Japan) People's Coalition against Wiretapping Law and Organized Crime Law (Japan) People's Plan Study Group(PPSG) (Japan) PINCH! Against War and Surveillance (Japan) Privacy Journal (US) RITS - Information Network for the Third Sector (Brazil) San'ya Welfare Center for Day-Laborers' Association (Japan) Sex Worker and Sexual Health (Japan) Solidarity Network with Migrants Japan (Japan) Statewatch (UK) StrawberryNet (Romania) Swiss Association to Defend Fundamental Rights (Switzerland) Swiss Internet User Group (Switzerland) Ungana Afrika (Africa) VOICE (Bangladesh) Wamani (Argentina) WiLAC (Uruguay) WomensNet (South Africa) At 8:28 PM -0500 11.22.07: >Begin forwarded message: > >From: Joichi Ito <jito(a)neoteny.com> >Date: November 22, 2007 4:26:14 PM EST >To: dave(a)farber.net >Cc: ip(a)v2.listbox.com >Subject: Re: [IP] Re: fingerprinting in Japan > >The US requires fingerprints for many kinds of visas including some >benefits for permanent residents. Also, I think they require a >photograph showing your earlobe as another biometric. It's on your >card. It is slightly different from requiring a finger print every >time you enter the country, but it's not really true that >"fingerprinting requirements don't apply to permanent residents." > >See: >http://www.uscis.gov/portal/site/uscis/menuitem.eb1d4c2a3e5b9ac89243c6a7543… > >Also, as far as I know, the Japanese are not fingerprinting transit >passengers. My understanding is that even if you are just connecting >via a US city, you still have to fill out the forms and get scanning. > >Basically I think that expecting us to go through US fingerprinting >to visit the US, then deciding not to go to Japan because of >fingerprinting is slightly hypocritical unless you have been vocally >opposed to the fingerprinting in the US. > >Anyway, maybe this is a good opportunity for American who travel to >Japan to take a good look at what the US does to its visitors and be >reflective. I think a lot of Japanese government behavior just >tracks what the US does and often is "encouraged" by the US. See >crypto exports, the new Japanese corporate law or "JSOX" and >copyright terms for other examples. > >- Joi > >From: "Brock N. Meeks" <bmeeks(a)cox.net> >Date: November 22, 2007 7:28:47 PM EST >To: <dave(a)farber.net> >Subject: Re: [IP] Re: fingerprinting in Japan > >Yep, it's a heinous U.S. policy as well; does that make it OK for >others to >emulate? > >But hey, I'd advocate the same thing: stay home; don't come to the >U.S. > >------------------------------------------- >Archives: http://v2.listbox.com/member/archive/247/=now >RSS Feed: http://v2.listbox.com/member/archive/rss/247/ >Powered by Listbox: http://www.listbox.com ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0