July 2018 - cypherpunks-legacy

Re: [cryptography] Current state of brute-forcing random keys?
by Marsh Ray 05 Jul '18

05 Jul '18

On 06/09/2011 12:14 PM, Paul Hoffman wrote: > > What is the current state of brute-force attacks on AES-128 blobs? > Are there recent results where we can estimate the cost of > brute-forcing 64-bit and 80-bit keys? The article is behind a paywall, but Google quotes the relevant statistic: http://scholar.google.com/scholar?cluster=14788671232027796805 "The standard-cell implementation on a 0.35 B5m CMOS process from Philips Semiconductors occupies an area of only 0.25 mm" Let's assume: * the attacker has only one file for which he wishes to find the key * you generate the key using a method for which the attacker can do no better than brute force for the nominal key size. * the attacker can do no better than brute force against AES * the attacker has ASICs using an AES implementation similar in chip area to Philips' standard cell * the attacker can run his chips at a rate of 1 GHz The last two assumptions are probably wrong. The Philips standard cell may not be optimized rapid re-keying and one that is might be larger in area. But the estimate of 1 GHz is probably conservative and there's an inherent output rate vs. area tradeoff in the pipelining of the design. But I think these assumptions are probably within a factor of 10x, i.e., a few bits of key size. So we're close to a nice round figure... 2^32 trials per mm2-second. Now you just have to find out how many mm2 of silicon the attacker is going to commit to decrypting your file! But obviously that's not the real metric, in large systems power and cooling is the limiting factor. How big of an air conditioner will he use? Looking up a random modern Intel chip (Core i5-650 4M Cache, 3.20 GHz), it has a die size of 81 mm2 and a max TDP of 73 W. A recent Nvidia chip (GTX 480) is 529 mm2 and said to be 250W TDP. The bruteforce algorithm need not spend any time at all waiting for data, so it seems like it could easily be pushing the limits of power density. 1 W per mm2 seems like a reasonable guess, but unless the data center will be built underwater you could probably double it to account for the cost of heat removal. Which neatly fits 2^32 trials per watt-second. A real engineer would probably design the chips to minimize energy-per-trial, but I think our estimate is probably still within an order of magnitude or two. Last I checked, in the US electric power is around $0.07 per kWh in areas considered "cheap". So each trial costs $4.53eb18 in electric power. For an 64-bit key, you expect the adversary to need 2^63 trials for which he might pay a power bill of $597. For an 80-bit key, you expect the adversary to need 2^79 trials for which he might pay a power bill of $2.7M. For a 128-bit key, you expect the adversary to need 2^127 trials for which he might pay a power bill of $11.0e21. Note that some botnet operators control millions of nodes and they do not usually pay their own power bills. But they probably don't have the efficiency of our specialized ASIC attacker either. As others have said, you need a real key derivation function (like PBKDF2) with a at least a little added work factor for this. If the password is going to be human-chosen or human-remembered it's not likely to have even this much entropy in practice. - Marsh _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [p2p-hackers] darknet ~= (blacknet, f2f net)
by Ian Clarke 05 Jul '18

05 Jul '18

On 02/12/05, zooko(a)zooko.com <zooko(a)zooko.com> wrote: > Let 1 be the set of networks which are used for illegal transmission of > information, I do wish you would refer to these networks as those which allow the covert transmission of information, rather than those which are used for the illegal transmission of information - since I am not aware of any networks that are specifically designed for the illegal transmission of information. I think this would help alleviate the political problem you raise later in your email. > and 2 be the set of networks which are built on f2f connections, > and 1^2 be the intersection -- the set of networks which are used for illegal > transmission of information and which are built on f2f connections. If you broaden your definition of set 1 to be networks which are used for the covert transmission of information (I think this is a more useful definition for the set as not all covert activity is illegal), then I am not sure, in practice, how many networks will fall into set 2 that aren't also members of set 1, in fact, I can't think of any non-contrived situations where one would create a f2f network motivated by something other than a desire to be covert in some way. > [bepw2002] introduces "darknet" to mean concept 1. I'm not going to spend time dissecting their paper to determine exactly what BEPW's intention was for the term "darknet", certainly they could have been much more explicit about this if they wanted to, and they use the term in contradictory ways throughout their paper. For example, they refer to "the darknet" as if there is only one, but subsequenly refer to "darknets". Given this vagueness, I can't imagine that is was their goal to provide an authorative definition for the term. While we can debate what BEPW intended the term to mean when they used it in their paper, this is ultimately irrelevant. Software engineers often seem to forget that English isn't like a programming language where a designer specifies an unambigous definition at the outset (Richard Stallman is particularly guilty of this). The meaning of words in English is a consensus that is arrived at over time, and eventually finds its way into a dictionary (long) after that consensus is stable. The BEPW paper is one early voice in that consensus-forming process. Mine is another, yours is another still. > By the way, I should point out that I have a personal interest in this history > because between 2001 and 2003 I tried to promulgate concept 2, using Lucas > Gonze's coinage: "friendnet" [zooko2001, zooko2002, zooko2003, gonze2002]. > I would like to know for my own satisfaction if my ideas were a direct > inspiration for some of this modern stuff, such as the Freenet v0.7 design. I am not sure that they were a direct inspiration. We (Freenet) have been concerned about the fact that Freenet was harvestable for several years now. Around spring this year I made the observation that if human relationships form a small world network, it should be possible to assign locations to people such that we form a Kleinberg-style small world network, and thus we could make the network routable. Oskar Sandberg then suggested a way to do this, and we set about validating the concept using simulations. > Now the problem is that in the current parlance of the media, the word > "darknet" is used to mean vaguely 1 or 2 or 1^2. The reason that this is a > problem isn't that it breaks with some etymological tradition, but that it is > ambiguous and that it deprives us of useful words to refer to 1 or 2 > specifically. The ambiguity has nasty political consequences -- see for > example these f2f network operators struggling to persuade newspaper readers > that they are not primarily for illegal purposes: [globe]. I think a much better way to avoid this nasty political consequence is to stop describing set 1 in terms of illegal activity, but rather describe such networks as being "covert", or "anonymity preserving" - neither of which implies illegal activity (it is perfectly legal to be anonymous in most countries whose legal systems I am familiar with). > > defining the term "darknet" as a f2f network that is designed > > to conceal the activities of its participants (this being, so far as I > > have seen, one of the main motivations for building an f2f network), > > So you think of "darknet" as meaning 1^2. Or just 2, since I think the sets 1^2 and 2 are, in practical terms, virtually identical. > That's an interesting remark -- that you regard concealment as one of the main > motivations. I personally regard concealment as one of the lesser motivations > -- I'm more interested in attack resistance (resisting attacks such as > subversion or denial-of-service, rather than attacks such as surveillance), > scalability, and other properties. Although I'm interested in the concealment > properties as well. That is surprising. Are you aware of any current or proposed f2f networks for which concealment of user activity is not a goal? Ian. _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

EDRI-gram newsletter - Number 4.10, 24 May 2006
by EDRI-gram newsletter 05 Jul '18

05 Jul '18

============================================================ EDRI-gram biweekly newsletter about digital civil rights in Europe Number 4.10, 24 May 2006 ============================================================ Contents ============================================================ 1. Draft Audiovisual Media Services Directive under criticism 2. Data Retention faces growing opposition in Germany 3. Set up of the Internet Governance Forum Advisory Group 4. French draft copyright law continues to be criticised 5. German Constitutional Court has outlawed preventive data screening 6. UK Government asks for the encryption keys 7. Big Brother Awards Italy 2006 8. Application of the FOI law in Macedonia 9. PM supports rejected UK ID Cards Act 10. Recommended reading 11. Agenda 12. About ============================================================ 1. Draft Audiovisual Media Services Directive under criticism ============================================================ The European Commission proposal to regulate commercial audio and video broadcasts over the Internet and mobile phones, continues to be strongly opposed by the supporters of free speech, but also tranditional and new media providers. At the meeting of Education, Youth and Culture Council in Brussels (18-19 May 2006) the proposal for a directive amending the Directive on the pursuit of television broadcasting activities was discussed . The debate covered, in particular, the following issues in relation with the proposed directive: the appropriateness and the sustainability of the distinction between linear and non-linear services; the common rules applying to both categories of services; the extent of the modernization and simplification of the television advertising and teleshopping rules. The draft Audiovisual Media Services Directive - a revision of the 1989 Television without Frontiers Directive - introduces the notion of audiovisual media services and distinguishes between "linear" services (e.g. scheduled broadcasting via traditional TV, the internet or mobile phones, which "push" content to viewers) and "non-linear" services (such as video-on-demand, which the viewer "pulls" from a network). Only a basic tier of rules would apply to non-linear services. This draft has already met oppositions and criticism at the beginning of this year being considered as unacceptable. Traditional media as well as new media and technology providers opposed the directive considering, among other things, that it would shortly be obsolete due to the fast development of technology, that it discourages innovation and that it creates a distinction between linear and non-linear broadcasting when in reality this distinction is more and more blurred by the technological development. At the press conference on 18 May, Viviane Reding, EU commissioner for Information Society and Media, had to answer accusations of censorship related to the Directive. The Commissioner stated that the directive had "nothing to do with free speech" and aimed at protecting children and that the new rules were meant to protect "basic societal values". Mrs. Reding considers the rules are only intended to apply to commercial content and that the application of Audiovisual Media Services Directive has as purpose to prevent certain programmes from being shown to children. The idea would be to harmonise rules across the whole European Union so that programme makers don't face bureaucracy every time they try and sell their products to another member country. EU regulation attacked as censorship (19.05.2006) http://www.theregister.co.uk/2006/05/19/eu_censorship/ EU Internet proposals to protect society (18.05.2006) http://go.reuters.co.uk/newsArticle.jhtml?type=internetNews&storyID=12258324 2729th Education, Youth and Culture Council meeting - Brussels, 18-19 May 2006 (provisional version) (18.05.2006) http://www.consilium.europa.eu/cms3_applications/Applications/newsRoom/Load… cument.asp?directory=en/educ/&filename=89661.pdf The Television without Frontiers Directive: another "directive too far"? (5.05.2006) http://www.it-analysis.com/business/content.php?cid=8476 Legislative Proposal for an Audiovisual Media Services Directive (13.12.2005) http://ec.europa.eu/comm/avpolicy/docs/reg/modernisation/proposal_2005/com2… 5-646-final-en.pdf Debates on draft directive on Television without Frontiers Directive (2.02.2006) http://www.edri.org/edrigram/number4.2/twfdirective ============================================================ 2. Data Retention faces growing opposition in Germany ============================================================ The EU directive on mandatory retention of communications traffic data went into force as an EU law on 3 May 2006, but its transposition into national laws seems more uncertain than before. 16 of the 25 member states of the EU have declared that they will delay the retention of Internet traffic data for an additional period of 18 months. The recent NSA scandal in the United States also clarified the dangers of access to the data by intelligence agencies and led a number of civil liberties groups, among which EDRi member Netzwerk Neue Medien, to protest against data retention in Europe. A draft data retention law has already been withdrawn in the House of Representatives in Washington. In the German Parliament, the Greens have drafted a resolution that would ask the Government to challenge the legality of the EU directive before the European Court of Justice and postpone its implementation on the national level until the court has made a decision. According to the not yet published text, of which EDRi was able to obtain a copy, the data retention decision should have been made in the "Third Pillar" of the European Union structure, as the sole purpose of retaining the data is the law enforcement. Therefore, the proper legislative procedure should have been a framework directive, which gives more power to national Parliaments and requires an unanimous vote on the EU Council of Ministers. The motion is so far being supported by 118 parliamentarians from all parties; the vote is scheduled for 2 June. The period for challenging the directive on these grounds ('230 of the Treaty on the European Community) will end on 10 July 2006. Even if the directive is transposed into the German law, several groups and individuals - among which the former German federal minister of the interior, Gerhart Baum - have announced that they will challenge it before the Constitutional Court. After several recent decisions by the courts against overly intrusive surveillance, retention, and data-screening practices, there is a growing indication that the court will declare the directive illegal under the human rights provisions of the German Constitution. German Parliament: Draft Resolution, "Richtlinie zur Vorratsdatenspeicherung vom EuGH pr|fen lassen" (Reviewing the Directive on Data Retention by the European Court of Justice) (in German only, 18.05 2006) http://www.edri.org/docs/German-Parliament_Draft-DR-Resolution_18-5-2006.pdf Press release by EDRi-Member Netzwerk Neue Medien together with AK Vorratsdatenspeicherung and Stop1984.de: American snooping scandal shows the need for revision of opinion in Europe (in German only, 15.05.2006) http://www.nnm-ev.de/show/135496.html ISP snooping plans take backseat (18.05.2006) http://news.com.com/2100-1028_3-6074070.html Directive 2006/24/EC on the retention of data, Official Journal of the EU, (including declarations by EU member state governments postponing internet data retention) (13.04.2006) http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2006:105:0054:00… :EN:PDF EDRi Data Retention overview page http://www.edri.org/issues/privacy/dataretention EDRi Data Retention Wiki http://wiki.dataretentionisnosolution.com (Contribution by Ralf Bendrath, EDRi member Netzwerk Neue Medien - Germany) ============================================================ 3. Set up of the Internet Governance Forum Advisory Group ============================================================ The Internet Governance Forum Advisory Group (IGF AG) to the UN Secretary-General, selected by United Nations Secretary-General Kofi Annan on 17 May, meets in Geneva on 22-23 May to discuss the agenda and the programme of the Athens Meeting (31 October - 3 November 2006). Members of the group and observers had a two-day meeting meeting under the leadership of Nitin Desai and Markus Kummer. In an open and transparent discussion, the draft of the program included main topics for each day of the coming IGF meeting in Athens. These are : - Access ( Internet connectivity, policies and costs with following workshops on: open standards, investment incentives, etc.) - Security ( building trust online, protecting users from spam, phishing, viruses, maintain security while protecting privacy and workshops with people from technologies, ISP, CERT, law enforcement and human rights, workshops by ITU (cybersecurity) and OECD (spam toolkit) ) - Diversity ( Promoting multilinguism through IDN, and local content and Respecting geographical diversity) - Openness ( Free flow of information, ideas and access to knowledge) The IGF AG consists of 46 people from different countries and cultures and is a good example of the way the UN opened up during the WSIS process. This includes 20 representatives from the governmental sector, 10 from the business sector, 7 representing civil society and 9 from the ICANN system. All stakeholders are well represented - governments, civil society, business, and the relevant international organizations, e.g. ITU, ICANN, ISOC, IETF, International Chamber of Commerce, UNESCO, Internet registries and registrars, and others. People involved in the proceedings say that the IGF will be launched this year in Athens, but will continue in 2007 in Brazil, and in 2008. IGF website - includes webcast and transcripts of the session http://www.intgovforum.org/index.htm EDRI-gram : Consultations on Internet Governance Forum (1.03.2006) http://www.edri.org/edrigram/number4.4/igf (Contribution by Veni Markovski - EDRi-Member ISOC Bulgaria) ============================================================ 4. French draft copyright law continues to be criticised ============================================================ As a continuation of the "saga" of the French draft law on copyright and related rights of the information society (DASDVSI), the French Senate voted this month the law which continues to be severely criticised by the consumer associations as well as software companies. The Senators have adopted the law with 164 votes for and 128 against. The "for" votes came from UMP (Union pour un Mouvement Populaire) and from the radical part of RDSE (Rassemblement Democratique et Social Europeen). The socialist group of Verts (Greens) and the PCF (French Communist Party) voted against it. The law supported by the Senate has also changed the article 7, that was adopted by the Deputies and required the DRM vendors and commercial platforms to open their technology to competitors in order to make it interoperable. This brought forth the reaction of companies such as Apple or Microsoft and of the American Minister of Commerce. The senators, guided by the rapporteur Michel Thiollihre and by Renaud Donnedieu de Vabres, Minister of Culture, adopted a totally different system based on the creation of an independent administrative authority. The current text no longer guaranties the right to the private copy, which is considered as a serious blow to the consumers. The CLCV (Association Consommation, logement et cadre de vie) states a "conditioned private copy" takes away from the consumer the right to privately use a work that was acquired legally. The association considers the consumer should no longer pay for the possibility to copy, which is actually refused. Another measure considered as unrealistic is the one that holds software companies liable when their software is used for piracy. This measure also affects companies relying on open- source software. "It is the nature of open source that there is nothing we can do about a program once it is distributed," said Gilles Gravier, chief technology strategist for security at Sun Microsystems. "Also the open-source licenses are issued on a global basis. Finally, this law draft has succeeded in raising more criticism after having been voted by the Senate than after it was passed by the National Assembly in March 2006. The DADVSI law will be debated further on in a Mixed Joint Commission including seven deputies and seven senators, which has the task to reconcile the disagreements between the texts adopted by the two Assemblies. According to certain sources, this Commission would be gathered on 30 May. French iPod bill moves forward (11.05.2006) http://www.iht.com/articles/2006/05/11/business/apple.php The draft law on copyright raises vivid critics (only in French, 12.05.2006) http://www.01net.com/editorial/315533/legislation/le-projet-de-loi-sur-le-d… it-d-auteur-suscite-de-vives-critiques/ The Senate cancels the forced interoperability (only in French, 10.05.2006) http://www.ratiatum.com/news3108_Le_Senat_supprime_l_interoperabilite_forcee. html EDRI-gram : Update on French EUCD Transposition (29.03.2006) http://www.edri.org/edrigram/number4.6/frencheucd What's so special about French EUCD transposition? (15.03.2006) http://www.edri.org/edrigram/number4.5/franceeucd ============================================================ 5. German Constitutional Court has outlawed preventive data screening ============================================================ On 22 May the German Constitutional Court has declared illegal under the German Constitution the practice of screening data across several private and public databases in order to find potential terrorists ("sleepers"). Several federal states will now have to change their police laws. The decision does not make data screening ("Rasterfahndung", literally: "grid investigation", usual transliterations: "dragnet investigation" or "data trawl") completely illegal, but binds it to very narrow conditions. The measure is still legal for investigations in specific criminal cases, as it was used against the left-wing guerrilla RAF in the 1970s, when the "Rasterfahndung" was invented. But for crime prevention purposes, it can only be done in the presence a concrete danger for the lives or liberties of persons or for the existence of the Federal Republic of Germany or a federal state (Land). This requires factual indicators for an imminent attack. A general threat condition or foreign tensions like after 9/11 2001 are not sufficient. The Federal Police Agency (Bundeskriminalamt) had coordinated such screenings, in cooperation with the state-level police authorities after the terrorist attacks of 11 September 2001. Universities, private companies, private security firms, public transport institutions, facility providers, municipal authorities, and the Federal Register of Foreign Residents were required to submit comprehensive information they had on anybody matching a set of criteria (male, aged between 18 and 40, student or former student, country of origin mainly Muslim) to the state police agencies. The latter did a screening run for matches across the different submitted databases that combined included more than 8 million people. The 31 988 hits were stored in a central file called "sleepers" and again screened by the Federal Police Agency against a database that included up to 300 000 persons who held a pilot license, were supposed to be dangerous, or matched some other criteria. The remaining several thousand persons (matches) was manually reviewed by the state police agencies. The whole exercise did not lead to a single terrorist suspect or prosecution. The plaintiff, a Morrocan citizen who studied in Germany in 2001, argued that his right for informational self-determination was breached, that the screening was an especially severe breach of fundamental rights because it took place unbeknownst to the people affected, that it was not proportionate because of the lack of factual indicators for an imminent terrorist attack in Germany, and that the criteria were discriminating him and fellow Muslims on the basis of religion. The lower courts had overturned his arguments. The official data protection commissioners, the opposition parties Greens, Liberals and Socialists, and civil liberties groups applauded the court decision and demanded an immediate stop of plans for similar measures like communications traffic data retention, license-plate screening, or the creation of new investigative powers for the Federal Police Agency for the prevention of crimes. A spokesperson of the federal Ministry of the Interior said that in international terrorism, there was only a thin line between a general and a concrete threat condition, making it difficult to apply the decision. The Bavarian Minister of the Interior, G|nther Beckstein, called the decision "a black day for the effective fight against terrorism in Germany." The association of student representatives, which had supported the plaintiff, demanded a "personal apology" from the responsible authorities for the illegal and unconstitutional discrimination of foreign and Muslim students in Germany. Up to eleven federal states will now have to change their police laws and criminal procedures acts. The decision will also have an impact on the discussion about the legality of mandatory communications data retention in Germany. The Constitutional Court explicitly re-emphasised in the reasons given for the judgement the "strict prohibition, beyond statistical purposes, of the storage of personally identifiable data on stock." ("auf Vorrat"). "Vorratsdatenspeicherung" - literally: "data storage on stock" - is the German term for data retention. Decision of the German Constitutional Court, 1 BvR 518/02 (in German only, 22.05.2006) http://www.bundesverfassungsgericht.de/entscheidungen/rs20060404_1bvr051802… tml Press Release of the German Constitutional Court (in German only, 23.05.2006) http://www.bundesverfassungsgericht.de/pressemitteilungen/bvg06-040.html Overview of reactions to the decision (in German only) http://www.netzpolitik.org/2006/reaktionen-auf-das-urteil-zur-rasterfahndun… Berlin Data Protection and Freedom of Information Commissioner: Special Report on the Execution of Data Screening in Berlin (in German only, 1.12.2002) http://www.datenschutz-berlin.de/infomat/sonderbericht/rasterfahndung.pdf (Contribution by Ralf Bendrath, EDRi member Netzwerk Neue Medien - Germany) ============================================================ 6. UK Government asks for the encryption keys ============================================================ The UK Home Office is planning to implement Part 3 of the Regulation of Investigatory Powers Act (RIPA). That would allow the police forces to ask for the disclosure of encryption keys, or force suspects to decrypt encrypted data. RIPA was promoted in 2000, but until now the officials have not implement Part 3. There were still voices that considered that parts I and III of the Act should be reviewed to consider whether the Act was effective in meeting its aims. However, until now, the Act has remained in its initial form . Recently, the Home Office started a consultation considering that the provisions in Part 3 would be needed to fight against an increased use of encryption by criminals, paedophiles, and terrorists. The officials are also expecting proposals for amendments to RIPA. The Home Office minister of state, Liam Byrne, told Parliament last week that "Encryption products are more widely available and are integrated as security features in standard operating systems, so the Government has concluded that it is now right to implement the provisions of Part 3 of RIPA... which is not presently in force." This decision has triggered a lot of comments and criticism from experts in the industry, considering that anyone who refuses to hand over a key to the police would face up to two years imprisonment. Experts are worried about the effects of the Act, that might push some businesses outside UK, but also about the practical solutions related to financial institutions that use such security devices. Readers and experts cited by Zdnet UK point out that the law might be impossible to enforce. The encryption expert Peter Fairbrother underlined: "It is, as ever, almost impossible to prove 'beyond a reasonable doubt' that some random-looking data is in fact ciphertext, and then prove that the accused actually has the key for it, and that he has refused a proper order to divulge it". UK Government to force handover of encryption keys (18.05.2006) http://news.zdnet.co.uk/internet/security/0,39020375,39269746,00.htm Anger over encryption key seizure threat (19.05.2006) http://news.zdnet.co.uk/internet/security/0,39020375,39270276,00.htm ============================================================ 7. Big Brother Awards Italy 2006 ============================================================ >From 19 May to 20 May Florence has hosted the E-Privacy 2006 conference, organized as usual - by the Winston Smith Project with the help of several volunteers. This edition saw a much larger participation than 2005: the participants could hardly fit the hall of Palazzo Vecchio, and several people had to stand for the whole duration of the event. The number of presentations (19) and participating organizations (14) saw a marked and unexpected growth. As usual, the Italian Big Brother Awards were given during the conference. Although none of the awards' recipients were present, a mock Darth Vader - prompting hilarity from the public - took the prizes in custody. The positive prize "Winston Smith - Privacy Hero", which was assigned in 2005 to Stefano Rodot` (former president of the Italian Privacy Authority) was won by the No1984.org group, for its relentless information work against Trusted Computing. Trusted Computing was indeed one of the central players of the whole event, as it also won the prize for "Most Invasive Technology", while the prize for "Worst Private Group" was assigned to the Trusted Computing Group, the business association that is developing the technical specs of the Trusted Computing technology. One can only deduce that the most dangerous enemy for net-privacy in the coming future has been clearly identified by netizens. Other BBA winners include Enzo Mazza, president of FIMI (Federazione Industria Musicale Italiana - Italian Music Industry Federation) for its organization's lobbying on ISP's responsibilities in copyright violation, the Italian Privacy Authority for its power (pursuant to art. 158, Legislative Decree 196/03) to enter private premises even without a judicial mandate, and Mauro Masi of the Office of the President of the Council, for blocking the ongoing reform work on Italian copyright law - which, among other things, would have moved copyright violation from the criminal to the civil sphere. E-Privacy 2006 Conference http://e-privacy.firenze.linux.it/index-e.html Big Brother Awards Italy 2006 https://bba.winstonsmith.info/ Winston Smith Project http://www.winstonsmith.info/ (Contribution by Andrea Glorioso, consultant on digital policies, and Marco Calamari, founder of the Winston Smith Project) ============================================================ 8. Application of the FOI law in Macedonia ============================================================ The Parliament of Macedonia adopted the Law on Free Access to Information of Public Character in February 2006. NGO activists made some effort to make some quality changes to the proposed law and as a result some essential recommendations were accepted and implemented in the law. Although three months have past since the adoption of the law, the Commission for protection of the right for free access to information was established only last week. According to the law, the Commission should have been appointed by the Parliament of Macedonia a month after the law was passed. According to government officials, the Commission will become operational from September this year, when the implementation of the law itself must start. It means that citizens can refer to the Commission if they think that their right to have access to information of public character is violated. On 11 May 2006 the Commission had a constitutive session and presented its tasks. In this respect, a lot of activities for raising awareness must be conducted in cooperation with NGOs in order to promote the new institution and support the successful implementation of the law. The most important task of the Commission is to provide guidance and procedures for a proper implementation of the law. Moreover, the Commission must publish a list of institutions that represent information holders. After that, the holders of public information must appoint an official FOI person in charge of dealing with FOI requests. Several NGOs are working on the monitoring of the implementation of the FOI law and conduct raising awareness activities. So far, NGOs articulated and sustained activities have had results. Hopefully, their efforts will also speed-up the process of creating an proper environment for an efficient FOI implementation in Macedonia. EDRi-gram : Freedom of Information Act in Macedonia (18.01.2006) http://www.edri.org/edrigram/number4.1/macedoniafoia (Contribution by Bardhyl Jashari, EDRI-member Foundation Metamorphosis - Macedonia) ============================================================ 9. PM supports rejected UK ID Cards Act ============================================================ Tony Blair stated a strong support for the ID card Act that was rejected by the House of Lords in January this year. The Government had considered the card as essential in the fight against crime, illegal immigration, and identity theft. However, the House of Lords required from the Government to give further clarifications related to detailed costs for such a system, a higher security in recording and storing personal data and asked for a change in one of the purposes of the system from 'securing efficient and effective provision of public services' to preventing 'illegal and fraudulent access to public services'. The 'Identity Project' report of the London School of Economics had also stated that the government proposal lacked defined goals without clearly showing the impact upon terrorism or identity theft and also considered the project as underestimated from the point of view of the costs. In endorsing the project, the Prime Minister went as far as stating "we need identity cards both for foreign nationals and for British nationals. If we want to track people coming in and out of our country and to know the identity of people who are here, then that is what we have to do." Foreign nationals are not presently included in the Act. As a response to the claims that the ID scheme is a tracking mean, Blair used 'log' or 'identify' as synonyms for 'track', considered as not a very fortunate choice of words. The Register's columnist John Lettice considers that the so called "ring of steel" promoted by Tony Blair has several failing issues. The e-Borders which is supposed to help the Government know who is coming into the country, and who is going out, even if implemented at all border entry points shows a lot of vulnerabilities. EU citizens will be able to come in and work if they like, and travellers from numerous countries don't require visas. The identity of these travellers is not certain as false documents can be obtained in these countries. Blair's plans to solve the immigration question through the application of IT will meet difficulties on several levels. Fortress Blair - PM bets on biometric ring of steel to 'fix' immigration (22.05.2006) http://www.theregister.co.uk/2006/05/22/blair_biometric_migration_fix/ EDRI-gram: UK ID card scheme - defeated in the House of Lords (18.01.2006) http://www.edri.org/edrigram/number4.1/ukidcard London School of Economics 'Identity Project' http://is.lse.ac.uk/idcard/ ============================================================ 10. Recommending Reading ============================================================ >From 15 to 17 May the University of Illinois Chicago (USA) hosted the conference "FM10 Openness: Code, Science and Content". The occasion was the tenth anniversary of "First Monday", the first peer-reviewer journal born on the Internet. The final day of the conference gathered a group that brainstormed over the first draft of the "Chicago Manifesto". Chicago Manifesto on Openness (17.05.2006) http://blogger.uic.edu:16080/weblog/nrj/FM10/?permalink=ChicagoManifesto.ht… &page=trackback Website of the conference (with abstracts and papers) http://numenor.lib.uic.edu/fmconference/ First Monday http://www.firstmonday.org/ ============================================================ 11. Agenda ============================================================ 14-18 June, Rathen, Germany ICA-IAMCR Symposium on Internet Governance http://www.ntu.edu.sg/sci/sirc/icapreconf.html 19-20 June 2006, Paris, France New relations between creative individuals and communities, consumers and citizens. Hosted by the TransAtlantic Consumer Dialogue (TACD) http://www.tacd.org/docs/?id=296 19-23 June, Singapore Euro-Southeast Asia ICT Forum (EUSEA2006) (with the EU Commission as co-host) http://www.eusea2006.org 21 June 2006, Luxembourg Safer Internet Forum 2006 Focus on two topics: "Children's use of new media" and "Blocking access to illegal content: child sexual abuse images" http://europa.eu.int/information_society/activities/sip/si_forum/forum... 26-27 June 2006, Berlin, Germany The Rising Power of Search-Engines on the Internet: Impacts on Users, Media Policy, and Media Business http://www.uni-leipzig.de/journalistik/suma/home_e.html 3-5 July, Cambridge, UK Privacy Laws & Business, 19th Annual International Conference "Privacy Crisis Ahead? Investing enough in data protection to strengthen and defend your reputation" http://www.privacylaws.com/conferences.annual.html 16 - 28 July 2006, Oxford, UK Annenberg/Oxford Summer Institute: Global Media Policy: Technology and New Themes in Media Regulation http://www.pgcs.asc.upenn.edu/events/ox06/index.php 2-4 August 2006, Bregenz, Austria 2nd International Workshop on Electronic Voting 2006 Students may apply for funds to attend the workshop until 30 June 2006. http://www.e-voting.cc/stories/1246056/ 14-16 September 2006, Berlin, Germany Wizards of OS 4 Information Freedom Rules http://wizards-of-os.org/ =========================================================== 12. About =========================================================== EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 21 members from 14 European countries and 5 observers from 5 more countries (Italy, Ireland, Poland, Portugal and Slovenia). European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 2.0 License. See the full text at http://creativecommons.org/licenses/by/2.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/index.php?option=com_content&task=view&id=6… &Itemid=4&lang=mk - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [cryptography] Current state of brute-forcing random keys?
by Marsh Ray 05 Jul '18

05 Jul '18

On 06/09/2011 12:14 PM, Paul Hoffman wrote: > > What is the current state of brute-force attacks on AES-128 blobs? > Are there recent results where we can estimate the cost of > brute-forcing 64-bit and 80-bit keys? The article is behind a paywall, but Google quotes the relevant statistic: http://scholar.google.com/scholar?cluster=14788671232027796805 "The standard-cell implementation on a 0.35 B5m CMOS process from Philips Semiconductors occupies an area of only 0.25 mm" Let's assume: * the attacker has only one file for which he wishes to find the key * you generate the key using a method for which the attacker can do no better than brute force for the nominal key size. * the attacker can do no better than brute force against AES * the attacker has ASICs using an AES implementation similar in chip area to Philips' standard cell * the attacker can run his chips at a rate of 1 GHz The last two assumptions are probably wrong. The Philips standard cell may not be optimized rapid re-keying and one that is might be larger in area. But the estimate of 1 GHz is probably conservative and there's an inherent output rate vs. area tradeoff in the pipelining of the design. But I think these assumptions are probably within a factor of 10x, i.e., a few bits of key size. So we're close to a nice round figure... 2^32 trials per mm2-second. Now you just have to find out how many mm2 of silicon the attacker is going to commit to decrypting your file! But obviously that's not the real metric, in large systems power and cooling is the limiting factor. How big of an air conditioner will he use? Looking up a random modern Intel chip (Core i5-650 4M Cache, 3.20 GHz), it has a die size of 81 mm2 and a max TDP of 73 W. A recent Nvidia chip (GTX 480) is 529 mm2 and said to be 250W TDP. The bruteforce algorithm need not spend any time at all waiting for data, so it seems like it could easily be pushing the limits of power density. 1 W per mm2 seems like a reasonable guess, but unless the data center will be built underwater you could probably double it to account for the cost of heat removal. Which neatly fits 2^32 trials per watt-second. A real engineer would probably design the chips to minimize energy-per-trial, but I think our estimate is probably still within an order of magnitude or two. Last I checked, in the US electric power is around $0.07 per kWh in areas considered "cheap". So each trial costs $4.53eb18 in electric power. For an 64-bit key, you expect the adversary to need 2^63 trials for which he might pay a power bill of $597. For an 80-bit key, you expect the adversary to need 2^79 trials for which he might pay a power bill of $2.7M. For a 128-bit key, you expect the adversary to need 2^127 trials for which he might pay a power bill of $11.0e21. Note that some botnet operators control millions of nodes and they do not usually pay their own power bills. But they probably don't have the efficiency of our specialized ASIC attacker either. As others have said, you need a real key derivation function (like PBKDF2) with a at least a little added work factor for this. If the password is going to be human-chosen or human-remembered it's not likely to have even this much entropy in practice. - Marsh _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Politech] Paul Levy: Politicians, infomercial kings try to stifle anonymous Internet speech [fs]
by Declan McCullagh 05 Jul '18

05 Jul '18

Like Paul, I'm having a hard time figuring out which is more loathsome: a censorial politician or a a censorial informercial king. I think it's the politician, who's named Judy Gatelli, but it is a tough choice between two exceptionally well-qualified candidates. Ms. Gatelli's email address is jgatelli(a)scrantonpa.gov. -Declan -------- Original Message -------- Subject: New attacks on the right to speak anonymously on the Internet Date: Fri, 21 Sep 2007 13:21:26 -0400 From: Paul Levy <plevy(a)citizen.org> To: <declan(a)well.com> I am writing to call your attention to two new Internet anonymity cases we have taken on. I am having trouble figuring out which plaintiff's claims I find more offensive. In one case, the President of the Scranton City Council has filed suit against about ninety of her constituents for defamation and "infliction of emotional distress" for calling her names on a local Internet message board (for example, they call her a Nazi for allegedly mistreating citizen speakers during publicly televised council meetings, or they say "she is not for the people, she is for herself.") We have filed in opposition to her motion to compel disclosure of the critics' names. In the other case, the "Video Professor," a TV infomercial king who sells lessons on computer use, is suing a hundred former students for anonymously dissing his product on web sites called "infomercialratings.com" and "infomercialscams.com," claiming libel and product disparagement under state law and the Lanham Act. We have interposed an objection to a subpoena, sent to the web sites' operator, asking for the names of EVERYBODY who has said anything about the Professor's products on the web sites. What makes the Video Professor's demand especially hypocritical is that, in his posture as a "consumer advocate," his own web site urges consumers to check out companies before they buy, by searching for consumer reviews on the Internet. http://www.videoprofessor.com/resourcelibrary/internet/dodgingdangersinetsh… But on his company, it seems, he only wants positive reviews to be available online. In both cases, we take to new forums our argument that courts ought to require a would-be plaintiff to make a showing that it has enough evidence of legal actionable conduct that its interest in going forward with a lawsuit outweighs the First Amendment right to speak anonymously. In each case, it remains to be seen whether the plaintiff can make a sufficient showing with respect to at least some of the postings at issue. But we want to be sure that all the potential defendants get good notice and an opportunity to defend their anonymity. Somewhat longer descriptions of each case, including links to the relevant filings, follow. PUBIC CITIZEN PRESS RELEASE For Immediate Release: Contact: Amanda Long (202) 588-7703 Sept. 21, 2007 Rachel Pleatman (202) 588-7742 'Video Professor' Has No Legal Basis for Unmasking Identities of Anonymous Web Critics Apparently Upset at Criticisms of His Company, Infomercial Guru Sues Customers WASHINGTON, D.C. - The "Video Professor," a ubiquitous purveyor of computer-training lessons via infomercials, has no legal basis for discovering the identities of his disgruntled customers, Public Citizen said today. In a letter sent today to the Video Professor's attorney, Greg Smith of Denver, Public Citizen attorney Paul Alan Levy outlined the many reasons why the Professor's subpoena against John Does 1 through 100 is invalid. In mid-August, in federal court in Denver, the Video Professor, a self-proclaimed consumer advocate, sued his own customers for posting comments on two consumer comment Web sites. The sites, infomercialratings.com and infomercialscams.com, are run by a Nevada company, Leonard Fitness, Inc. The Professor alleged that his detractors had violated federal trademark laws by saying negative things about the name of his product, as well as committing defamation and several violations of state law. Recently, subpoenas were delivered to Leonard Fitness' agent. "It's outrageous that the Professor is suing his own customers," Levy said. "He has shown no legal basis on which to do so. He's very good at promoting himself and wants to suppress criticism." The Video Professor, John Scherer, is not really a professor - he just plays one on TV. He founded his company to offer CDs and online lessons on a wide range of computer programs and skills. His efforts share the airwaves with abdominal rollers, juicers, magic steamers and assorted as-seen-on-TV wares. Scherer claims that more than 8 million people have purchased his products since he started selling instructional videos 20 years ago. "The Professor's own Web site warns consumers to check out companies they don't know by using Internet search engines to find customer reviews," Levy said. "But if the cost of complaining online is having to face a federal lawsuit, a company can unfairly ensure that only compliments will be posted." Not only have state and federal courts throughout the country recognized the right to speak anonymously on the Internet, but the Professor has not met the legal requirements necessary to justify the unmasking of the critics' identities, Levy said. The Professor would have to show a likelihood of success on the merits of the case, which he hasn't done, Levy said. In addition, the Professor's subpoena fails to identify which of the many posts he finds defamatory. There are hundreds of comments about the courses, many of which are complimentary, on the two sites. The subpoena incorrectly burdens the Web site host to identify which critics upset the Professor. Specifics are needed for the anonymous posters to decide whether and how to protect their anonymity, Levy said. A copy of Levy's letter is available at http://www.citizen.org/documents/videoprofletter.pdf. For Immediate Release: Contact: Amanda Long (202) 588-7703 Sept. 21, 2007 Angela Bradbery (202) 588-7741 Critics of Scranton Council President Have Right to Anonymity, Public Citizen Tells Court Petition to Reveal Identity of Message Board Posters Is Unconstitutional WASHINGTON, D.C. - A Scranton, Pa., City Council member cannot compel disclosure of the identity of the almost 100 constituents who anonymously posted messages on a Web site critical of her leadership, Public Citizen said in a motion filed today in the Court of Common Pleas in Lackawanna County. The plaintiff, Scranton City Council President Judy Gatelli, sought a court order requiring the message board's hosts to reveal the identity of posters whom she accuses of defamation, civil conspiracy and "engaging in a campaign of intentional emotional distress." Earlier this year, Gatelli canceled a Council meeting after citing concerns about "threats" against her on www.dohertydeceit.com. The host of that site, Joseph Pilchesky, sued Gatelli for defamation, and Gatelli filed a countersuit against him for the same. She also filed a complaint against Pilchesky's wife and approximately 90 defendants, identified by the pseudonyms used on Scranton "Political" Times Message Board, a site that links to DohertyDeceit and also is operated by Pilchesky. Although Gatelli cites 130 different messages, she doesn't say which posting was made by which defendant. As an elected official, Gatelli's conduct is fair subject for comment, Public Citizen argued. Furthermore, courts have ruled that subpoenas to reveal the names of anonymous speakers can chill free speech, and those courts have upheld the right to communicate anonymously over the Internet. "While some posts are scathing, they are scathing opinions, which are protected speech," said Paul Alan Levy, the Public Citizen attorney representing seven defendants. "This is especially true for elected public officials. Harry Truman said it best: 'If you can't stand the heat, get out of the kitchen.' " The name-calling and rhetorical insults Gatelli cites in her complaint are prime examples of what courts have found to be protected speech in the context of public debate. For example, Gatelli accuses one defendant of making the following post: "Your arrogance blows me away * You didn't just screw the adults of this town, you screwed the children of Scranton." The complaint includes a posting that refers to Gatelli as a fat Nazi. Courts have consistently held that calling someone a Nazi is figurative speech not actionable as libel. Gatelli has failed to introduce any admissible evidence to establish that the facts posted were false or caused any economic damage or harm, Levy said. "The Internet is a democratic institution in its fullest sense." Levy said. "To deny citizens access to it because an elected official says her feelings are hurt would go a long way toward eroding the First Amendment." George Barron, an attorney in Wilkes-Barre, Pa., is local counsel for the Doe defendants in opposing discovery. To reach Barron, visit www.attorneybarron.com. For background on the case, including the brief:, visit http://www.citizen.org/litigation/forms/cases/CaseDetails.cfm?cID=427 Public Citizen has a record of defending the First Amendment rights of Internet users. To learn more, visit http://www.citizen.org/litigation/briefs/IntFreeSpch/. ### Public Citizen is a national, nonprofit consumer advocacy organization based in Washington, D.C. For more information, please see http://www.citizen.org. Paul Alan Levy Public Citizen Litigation Group 1600 - 20th Street, N.W. Washington, D.C. 20009 (202) 588-1000 http://www.citizen.org/litigation _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [Freedombox-discuss] FreedomBox and Bitcoin (and the petition)
by Jonathan Wilkes 05 Jul '18

05 Jul '18

----- Original Message ----- > From: Ted Smith <tedks(a)riseup.net> > To: freedombox-discuss <freedombox-discuss(a)lists.alioth.debian.org> > Cc: > Sent: Tuesday, November 13, 2012 8:51 AM > Subject: Re: [Freedombox-discuss] FreedomBox and Bitcoin (and the petition) > [...] > For reference, it's really, really, really hard to take web browsing and > make it anonymous. Forcing every connection from browsers to go through > Tor won't help you anywhere near as much as it does for Bitcoin. Bitcoin > has already done 99% of the hard work building a protocol that is > totally (as far as either of us can tell) anonymous if it's _just_ > tunneled through Tor without any other filtering. When I referred to "these" attacks going away, I was talking about implementations of the Kaminsky attack, or efforts to link an IP address with a transaction even without connecting to all nodes (say, making inferences from the data available at blockchain.info). Bitcoin behind Tor still isn't anonymous in many obvious ways. I refuse to respond to a phrase as fatuous as "totally anonymous", but if the system really protected its users' identity[1] in a practical way then the "coin taint" discussions and (unfortunately) implementations by some services would not be possible. Bitcoin is not Chaumian cash-- which _would_ give the user the kind of anonymity to protect against a self-destructive coin-tainting scheme since it's untraceable. Whatever definition of "totally anonymous" you're using, it is false. That is just one of the consequences of Bitcoin not being anonymous, and there are many other problems with transactions linking to user identity. You should have a look at http://bitcoin.org/ if you don't understand the technology and its (non-)features, and ask questions on a Bitcoin-specific list or forum for more information. -Jonathan [1] The Bitcoin-behind-Tor user is trusting that no one will care about the inferences that can be gleaned from a database that holds every single transaction ever made. Even in the best of circumstances where this user doesn't leak _any_ identifying information out of band, the "coin taint" problem shows that they cannot be immune to such an attack. Whether we like it or not, "coin that well-known Bitcoin service foo claimed was stolen" is mathematically provable, uniquely-identifying information that _will_ currently break that Bitcoin's fungibility. There have been ways proposed to address this, but it's sheer confusion to claim "total anonymity" for Bitcoin-behind-Tor in its current state. _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Happy Creepy February!
by liberationtech＠lewman.us 05 Jul '18

05 Jul '18

On Sun, Feb 10, 2013 at 01:47:18PM -0600, nick.m.daly(a)gmail.com wrote 1.8K bytes in 0 lines about: : Thanks to investigative work by the Guardian, we can tell just how many : steps back online privacy's taken this year. It's unfortunate: : : http://www.guardian.co.uk/world/2013/feb/10/software-tracks-social-media-de… Not too much investigative work in my opinion. This Guardian article reads like a press release for Raytheon, announcing their new product. http://bits.blogs.nytimes.com/2011/08/02/pentagon-seeks-social-networking-e… and https://www.fbo.gov/index?s=opportunity&mode=form&id=972cbc835c3702e9758aed… My guess is this video is a demo made for the DARPA BAA. And what did you expect? People put their lives online and share everything, of course someone is going to record and collate it all. And these same people will get the bright idea to predict the future with suspect data. -- Andrew http://tpo.is/contact pgp 0x6B4D6475 -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: FC: More on Brian K. West, DOJ, and "Good Samaritan" prosecution
by mjinks＠sysvi.com 05 Jul '18

05 Jul '18

On Sun, Aug 26, 2001 at 11:22:57AM -0400, Declan McCullagh wrote: > > From: John Noble <jnoble(a)dgsys.com> > Subject: Re: FC: U.S. Attorney replies to "Good Samaritan" outcry with > statement > Cc: gharlanr(a)bellsouth.net > > It's an interesting defense -- accidental penetration. Maybe somebody on > your list, Declan, who knows more about network security can answer this > question: if a hypothetical cracker was nailed by real-time monitoring -- a > "gotcha" while online and inside the network -- would he likely know it or > suspect it? "An intruder" given full shell access to the machine in question could find out anything about it, within reason, but from what I've read Mr. West is not alleged to have had that kind of access. It sounds like he got read-write access to a section of the filesystem, but probably not an area where any intrusion detection systems would be residing. Was he caught on any monitoring systems? > Or can we assume that his voluntary report of his accidental > accomplishment was the product of good faith and stupidity? I take some issue with the implication that the incident could not have happened casually. Whether it did or not is apparently open to question, no doubt we'll be hearing more about exactly what happened and when. But as I read the accounts presented so far, there is every reason to believe that the initial intrusion _could_ have happened almost before Mr. West had a moment to consider the implications of what he was doing. The alleged misconfiguration was that bad, that easy to exploit. One might ask then, why Mr. West did not immediately cease his actions, why he continued to download files if he knew that his access was illegitimate. I don't want to speculate on Mr. West's state of mind or intentions at the time, but a hole this egregious can outrage a technician, and my own first impulse would probably be to alert the owner of the web site, with proof included. After all, without proof I'm just smearing a competitor. Next an assertion without rigor but which I think bears some intuitive validity: a crime which does not feel at all like a crime, perhaps because of the ease with which it may be committed, should probably be viewed with a certain degree of leniency. Taking a shortcut across someone else's lawn is trespassing, but it's hardly breaking and entering. If someone leaves a business associate's private documents laying around on their front lawn, and a casual passerby picks them up -- well, technically that's stealing. But most of the police types and lawyers I've met would probably laugh at the notion of prosecuting the guy who picked up an unprotected bundle of documents lying on a lawn, rifled through them, realized who they belonged to, and then handed them off with the message "hey I found these on your buddy's lawn." Maybe he went looking, maybe he had something to gain, but one thing that seems clear to me is that without a glaring (negligent?) error on the part of the ISP, none of this would have been possible, and it seems reasonable to think that the ISP shares at least some responsibility for any harm inflicted. As Mr. Mournian seems to suggest in his own letter, the fact that the Internet was involved should not cloud the nature of what actually took place. > John Noble Michael Jinks ******** ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. Declan McCullagh's photographs are at http://www.mccullagh.org/ To subscribe to Politech: http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- ----- End forwarded message -----

1 0

Re: More on Brian K. West, DOJ, and "Good Samaritan" prosecution
by Peter Hollings 05 Jul '18

05 Jul '18

I suspect that most IT security managers would initially respond to an intrusion by turning on programs that would log the intruder's activities. To prevent re-occurance, they'd want to know the intruder's identity, method of penetration, activities, etc. Also, any form of prosecution would depend on this. (See, for example: http://www.cert.org/security-improvement/modules/m06.html .) Thus, the intruder would likely NOT KNOW immediately that his presence had been detected.) The second question, whether someone could "accidentally" intrude on someone else's computer is more speculative. In general, people don't accidentally access, much less penetrate, another computer, but it's possible, just like it's possible for a legitimate deliveryman knocking at a door to find that it swings open (because it's unlatched). Ultimately, I think that the important issues are things like motivations, damages, knowledge that it was a secure area being intruded upon, etc. Peter Hollings ********

1 0

None
by Thomas Junker 05 Jul '18

05 Jul '18

On 26 Aug 2001, at 11:22, Declan McCullagh wrote: > Date: Sat, 25 Aug 2001 19:41:18 -0400 > From: John Noble <jnoble(a)dgsys.com> > Subject: Re: FC: U.S. Attorney replies to "Good Samaritan" outcry with > statement > > It's an interesting defense -- accidental penetration. It's more than interesting: we seem to have entered the age of Click on a Link, Go to Jail. Amplification below... > Maybe somebody on > your list, Declan, who knows more about network security can answer this > question: if a hypothetical cracker was nailed by real-time monitoring -- a > "gotcha" while online and inside the network -- would he likely know it or > suspect it? No, but the question presupposes something not suggested by the published facts I have so far seen: that Mr. West was "inside the network." According to the reports he simply clicked on a function in Microsoft Front Page to capture a Web page for use as a sample and, to his surprise, found that Front was allowed editing access to that page. That's like walking up to a door in an unfamiliar office building to read the occupant information and finding one's self sucked through the door and to an open file cabinet, whereupon the hidden cameras film one "penetrating" someone's confidential information. It was Front Page, a tool from a company notorious for going out of its way to facilitate insecure accesses by automating security holes, that did the penetrating, and that was only possible because the site had not been secured in any way. No doubt leaving the site wide open to public modification is the default in Front Page, which would be true to form. Another analogy could be visiting a business office for information, seeing a sign saying, "Public information this way," following the arrow, opening the door to which it points, finding one's self in a room full of file cabinets, briefly examining some file folders thinking they must contain the public information, discovering that the information is most decidedly not of a public nature, leaving, reporting the lack of security to the management, and being accused of "penetrating" the company's files. It is absurd. Had Mr. West used something like WebWhacker to capture pages, or even "Save As" in his browser, he would have been in no danger of "penetrating" anything, intentionally or otherwise. His basic mistake was in using software that tries to do Dangerous Things at the touch of an innocuous button. His second mistake was pride -- he had to tell someone how smart he was. Reporting an unlocked door to clueless weasels is probably a good way to be asked, "And what were *you* doing opening that door?" and to be accused of trespassing. Or to have detectives show up and ask one, "Can you show us this door you found unlocked, and can you show us exactly how you opened it?" Translate all this into the context of doors with ambiguous markings in public offices where public information is advertized to be available and it becomes clear how silly it is. > Or can we assume that his voluntary report of his accidental > accomplishment was the product of good faith and stupidity? Yes, overwhelmingly so. To suggest that he somehow tipped to some form of monitoring by using Front Page and then 'fessed up to seem of innocent intent is a far reach. And what monitoring, for that matter? It seems unlikely that people disorganized enough to leave their Website completely open to editing by Front Page by anyone on the planet would be together enough to be monitoring their network in real time for intrusions. More likely the "monitoring" was the examination of logs after the fact. Something else I have not seen mentioned is this: many TCP/IP tools, particularly browsers and other Web tools, incessantly send requests for documents until they receive an answer. Crank up a sniffer or other form of raw TCP/IP monitoring and point a browser at a host that doesn't exist or doesn't answer on Port 80. You will see the browser send dozens, perhaps hundreds of requests. There is little in such traffic logs to suggest any correlation between the numerous "attempts" and any wilfullness or repeated action on the part of the person using the software making the requests. Worse, the user is unaware of all that activity, seeing only the spinning logo of the Web browser, for example, as it tries to contact a Website. It is as if your phone had an automatic redial feature that would continue to dial until achieving a connection. It would be as mindless to count the number of calls as some kind of indication of intent or persistence on the part of the caller as it may be to count "attempts" to connect to something in the Internet, particularly something intended to be connected to by its very nature and by tools that customarily contain automatic retry functionalities. Have we now reached a place in La-La Land where each of 100 or more TCP port connection tries automatically made by a browser is to become a "count" in an indictment? > Date: Sat, 25 Aug 2001 11:30:21 -0700 > From: Anthony Mournian <mournian(a)acusd.edu> > > August 25, 2001 > > ... > > Somehow this whole thing of Internet security has begun to turn upside > down. Yea, verily! > It has a chilling effect on free and open communication when it > becomes a crime to talk about the possibility of breaching security, or > to discuss it in an open forum. It has a chilling effect on free speech > when the U.S. Government decides to act like the 800 lb gorilla and go > after a person like Brian K. West, who did in fact look at the content > of another person's computer, and had the common sense to report the > complete lack of security to the computer's owner. Very well put. > Funny, I feel even by writing you this note I invite > investigation by Big Brother. As do I by writing to Declan with the possibility that he may include my message in his public list. > ... > > Much of this note is off the point, and yet is directly on point. The > U.S. Government is too much in many of our lives already, and this > newfound Mecca of computer investigation and The Hammer for those who > even technically step off the line, as apparently did Mr. West, is a bit > too much. It is way too much. It is probably to be expected, though. People, including law enforcement, have demonstrated some difficulty in translating concepts well settled in non-computer contexts into the world of computers and Internet. In time this will all shake out but there will be many casualties along the way. In a few decades readers of old accounts of such bizarre applications of law and legal concepts as we are today witnessing will no doubt shake their heads over the silliness of it all, much as we can now gape at the absurdity of the Salem witch trials and others such excursions, but they will in no way gain a sense of the horror of being one of the casualties. There does indeed appear to be a flight of common sense from most all walks of modern life, from the hamburger flipper who replies to an order for a burger to go by asking, "Here or to go?" to the legion of businesses whose Customer Service is less useful than the time-of-day recording to elected representatives who fall all over themselves to offer and pass legislation clearly prohibited by various constitutions. It should not be all that surprising that law enforcement entities are seizing on new computer-related legislation as if the underlying concepts had just been imported from another galaxy and were to be taken without regard to common sense or any other established legal wisdom. On the one hand people in general are having difficulty applying what they already know to the Internet; on the other hand it is in the nature of law enforcment to seek any advantage at the cost of any principle or any loss of rights for all. What we cannot yet see is how far down the road of lunacy this trend will go before it is corrected. Regards, Thomas Junker tjunker(a)tjunker.com ********

1 0