July 2018 - cypherpunks-legacy

[technoliberation] Vernor Vinge on computers, freedom and privacy
by Hughes, James J. 05 Jul '18

05 Jul '18

http://technology.guardian.co.uk/weekly/story/0,,1807882,00.html Big Brother takes a controlling interest in chips A chilling novel details how everyday technologies could gradually lead to a far more invasive society than even Orwell dreamed of Wendy Grossman Thursday June 29, 2006 The Guardian Science fiction writers love to ask "What if?" What if a super-intelligent alien race had planted a pair of devices to boost our development at key moments? What if new technologies such as television and electronics become pervasive? George Orwell's answer to the latter, in 1948's 1984, was to show the apparently perfect, controlled society they could enable. But one thing usually missing is the "how?" At the Computers, Freedom, and Privacy (CFP) conference, held in Washington, DC, last month, Vernor Vinge, a retired computer scientist and the author of Rainbows End, provided a compelling explanation of how developing technology and powerful interests could create a society far more invasive and controlled than anything Orwell dreamed of. The scenario he describes is the background he researched for Rainbows End. Set in 2025, the characters are surrounded by logical extensions of today's developing technology. Wearable computing is commonplace. Tagging and ubiquitous networked sensors mean you can look at the landscape with your choice of overlay and detail. People send each other silent messages and Google for information within conversations with participants who may be physically present or might be remote projections. One character's projection is hijacked and becomes the front for three people. The owner of another remote intelligence is unknown. Several continents' top intelligence operatives try to solve a smart biological attack that infects a test population with the willingness to obey orders. Assumptions Vinge makes two opening assumptions: no grand physical disaster occurs, and today's computing and communications trends continue. He added a third trend: "The great conspiracy against human freedom." As novelist Doris Lessing has observed, barons on opposite sides of the river don't need to be in cahoots if their interests coincide. In our case, defence, homeland security, financial crime enforcement, police, tax collectors and intellectual property rights holders offer reasons to want to control the hardware we use. Then there are geeks, who can be tempted to forget the consequences if the technology is cool enough. Vinge quotes the most famous line from the comic strip Pogo: "We have met the enemy, and he is us." Vinge's technology to satisfy these groups' dreams is the Secure Hardware Environment (She), which dedicates some bandwidth and a small portion of every semiconductor for regulatory use. Deployment is progressive, as standards are implemented. Built into new chips, She will spread inevitably through its predecessors' obsolescence. This part is terribly plausible. It sounds much like the Trusted Computing Platform, implemented in Intel chips and built into machines from Dell, Fujitsu-Siemens and others. Most people don't realise their new computer contains a chip designed to block the operation of any software not certified by the group. Now enhance that and build it into RFID chips, networked embedded systems, shrink and distribute as "smart dust". All are current trends or works in progress. Geeks are willing to fight Trusted Computing on the grounds that it could be used to block open-source software or to enforce draconian digital rights management. But what if accepting it meant less visible security, less bureaucracy, even slight profit? She automatically sends taxes, enables much less noticeable surveillance and gets you through security checkpoints with no waiting. There's less crime, because legislative reality can be enforced on physical reality. Fewer false convictions. Make regulation automatic, and it seems to go away. New laws can be downloaded as a regulatory upgrade. "She," Vinge concluded at the conference, "fits the trajectory that economics and technical progress are following. The infrastructure for such control will probably arrive in any case." He also calls his scenario optimistic. This is, however, one of the paths to Technological Singularity, which Vinge wrote up in a 1993 essay. It's the moment superhuman intelligence is achieved, either through systems we build or human augmentation. The Singularity changes everything; nothing after it is predictable. In the world of Rainbows End, he thinks, they are either on the verge of Singularity or it is happening. This caused its own singularity in science fiction. Charlie Stross, whose novel Accelerando attempts to depict living through the Singularity, has called it "the turd in the punchbowl of near-future SF - you may politely pretend it isn't there, but everyone has to deal with it." Author Ken MacLeod places the Singularity in the context of post-2001 hopelessness. "When human beings feel they can't change the future, they begin to imagine that maybe superhuman beings can: gods, angels, aliens - and now artificial intelligences (AI). The idea of the Singularity is just a sophisticated version of this ancient ... superstition, that human history is or soon will be made by something other and better than human beings." Way to believe Vinge doesn't dispute the notion that humans look for a way to believe things will be better. Year 2000 software remediation is an example: "Prudent apprehension caused an awful lot of money to be spent ... and was one reason there were no significant problems." Most people assume the cause of the Singularity, if it happens, will be the effect of Moore's Law (that the number of transistors that can fit in a given space on a semiconductor doubles every 18 months). It's also usually connected to AI. In his essay, however, Vinge suggested four or five paths to the Singularity, only one of which was unitary AI. But here is where Vinge's thinking gets optimistic (unlike the CFP conference, which saw surveillant databases everywhere). The road to technological Gaia is full of frictional costs that could stop it. "It's not going to work very well," he says, "but it will be attempted, both by the state and by civil special interest petitioners." The drug laws provide a perfect illustration: "The ideal job to have in government is something everybody is convinced is essential to be done successfully that cannot be done successfully and the government is the only entity that can do it. Every time you fail, you say, 'The problem is much larger than we imagined, give us some more money.'" "The leaders of most powerful countries are coming to realise that the most important natural resources are not factories or the size of armies. Economic power is in the size of the population that is well-educated, creative and generally happy enough to be optimistic enough to want to do something creative." "The illusion of freedom becomes a strange thing when a government is dealing with ... thousands of people who are as bright as the smartest people running the government. Together, they outclass the people running the show. The turning point is the notion that to provide this illusion of freedom for such a group would wind up being more like real freedom than anything in human history." Or, as he thinks Pogo might say for the 21st century, "We have met what's going to save our ass and it is us." ------------------------ Yahoo! Groups Sponsor --------------------~--> See what's inside the new Yahoo! Groups email. http://us.click.yahoo.com/2pRQfA/bOaOAA/yQLSAA/XgSolB/TM --------------------------------------------------------------------~-> Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/technoliberation/ <*> To unsubscribe from this group, send an email to: technoliberation-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

News from my Tor Server raid
by morphium 05 Jul '18

05 Jul '18

Hi, as you may have noticed, 2 days ago I got raided due to ownership of the Domain wikileaks.de On the SAME day, a letter of the state attorney was sent to me (arrived yesterday), stating I can pick my things they raided about 20 months ago, on 1. of april (is that a joke now?) because they (the state attorney) has lifted the embargo. The raid 20 months ago was due to "spreading childporn" (running a Tor node). Just to keep you informed. morphium ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] [info] The NSA Is Building the Country's Biggest Spy Center (Watch What You Say)
by Marsh Ray 05 Jul '18

05 Jul '18

On 03/22/2012 09:57 AM, Peter Maxwell wrote: > > From > http://blogs.computerworld.com/19917/shocker_nsa_chief_denies_total_informa… >> "Remember," former intelligence official Binney stated, "a lot of >> foreign government stuff we've never been able to break is 128 or >> less. Break all that and you'll find out a lot more of what you >> didn't know-stuff we've already stored-so there's an enormous >> amount of information still in there." In other words, they've accumulated a backlog of ciphertext. Encryption working as designed. >> Binney added the NSA is "on the verge of breaking a key encryption >> algorithm." This sounds like budget boondoggle baloney to me. How can you be "on the verge" of something like that? You might have some ideas on how to attack it, but until they're proven they're just guesses and likely to be dead ends. Not something you should justify reworking your computing systems around. But once they're proven, you're not "on the verge". > That sounds far more plausible than the previous explanations. I'd > also suspect the "key encryption algorithm" may be RC4 and not AES > at the moment. Or it could just be all the 40- and 56- bit stuff that was captured by wiretapping Americans and not decrypted way back when the NSA felt constrained by laws. Or it could be everything using 512-bit RSA key exchange. Or it could be everything for which the security of the encryption ultimately depends on a user-chosen password. E.g., MS-PPTP/MPPE (but there's nothing really new about this). Or it could be a common protocol using a cipher weakly. For example, I noticed this the other day about RDP "standard, non-FIPS" mode: http://msdn.microsoft.com/en-us/library/cc240771%28v=prot.10%29.aspx If the endpoints do actually manage to negotiate the use of 128 bit (as opposed to 40 or 56 bit) security, it uses the output of RC4 without discarding any initial bytes. Those initial bytes have some correlations, some of which can expose the whole key. Just to make sure the 1684 bit state size of RC4 doesn't get stale, the protocol refreshes the key every 4096 packets. (Actually better than MPPE which seems to rekey every 1 or 256 packets depending on negotiated options). Or it could be complete BS. - Marsh _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

ANNOUNCE: PGP Corporate Desktop 7.1 Now Available
by Will Price 05 Jul '18

05 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [Resending as a signed message, hit the trigger a little too fast on the last one] PGP Security is pleased to announce that PGP Corporate Desktop 7.1 (formerly Desktop Security) has been made available in trial and upgrade versions on its website. I have included a textual version of the What's New file for Win32 below. Note that there are still a few errors on the website where the product is referred to as "Desktop Security", and the Mac What's New file has not yet been posted. These will be corrected shortly. - From this point forward, all What's New files will be posted online at the following location: http://www.pgp.com/products/whatsnew/ - ------ NEW FEATURES Modularity PGP Corporate Desktop has been split into four products: PGPmail - Email and File Security PGPdisk - Disk Security PGPvpn - IPsec Virtual Private Networking PGPfire - Personal Firewall and Personal IDS PGP Corporate Desktop is also available in the traditional form with all of the products integrated together. Each of the products can be installed and uninstalled in any combination to automatically combine the functionality. Smart Card Support PGP now provides full support for smart cards. Smart cards allow private key storage on secured hardware. Decryption and signing operations using private keys stored on smart cards occur on the smart card itself. Keys can also be generated on the card, and the cards do not allow the private keys to be read off the card. The smart card features have been integrated into PGP's core functionality and thus are available in all of the PGP products whenever key pairs are used. Three smart card types have been certified for this release: Rainbow's iKey 20XX Schlumberger's Cryptoflex GemPlus GemSafe Enterprise For best results, we recommend using these cards. PGP also provides more generic support for any type of smart card that provides full PKCS#11 compatibility. PGP's smart card implementation is fully compatible with certificates placed on cards by Windows 2000 or Netscape Communicator. Personal Firewall / Personal IDS / VPN Application-level firewall. PGP's enterprise-class Personal Firewall and Personal IDS (Intrusion Detection System) now supports the ability to specify applications associated with each firewall rule, and sports a significantly improved user interface. Firewall rule learning. PGP can now be told to watch your network traffic and write firewall rules dynamically for you. Notifications of unknown network traffic. PGP can now ask you whether you want to allow or deny applications from communicating over the network as they occur, and will automatically modify your firewall rules as appropriate based on your answers. Firewall rule sets can now be exported and imported. VPN IP Range support. In addition to the past support for VPN Subnets, PGP now supports Ranges. For many networks, especially extremely large networks, Ranges are a much superior way to specify the configuration of the network. Sniffer-format intrusion packet captures. Packets which cause the intrusion detection system to fire are now automatically captured and logged. They can later be analyzed using packet analysis tools such as Sniffer. Automatic IP Address block ownership tracing. When tracing Intruders, PGP will now provide information about the ownership of the IP Address block from which the intrusion originated. PGPfire is now compatible with the CheckPoint SecuRemote VPN client. Enhanced Exchange Server Support Exchange server identities, which are similar to ""/o=Acme/ou=HR/cn=Recipients/cn=JBob", can now be automatically added as a second PGP user ID when generating keys. The Outlook email plugin will automatically lookup identities of this form as well. This feature makes sending email using the Outlook plugin in an Exchange Server environment even more seamless. Large File Support PGP now supports file encrypt/decrypt/sign/verify operations on files greater than 2.5 Gigabytes. -----BEGIN PGP SIGNATURE----- Version: PGP 7.1 iQA/AwUBOzaMZay7FkvPc+xMEQINwgCdGvO2rRFMharJZTjELFvoapOgmgYAmwT5 L8nGRgAOd8g4eG5zJ8l/gJay =QiHt -----END PGP SIGNATURE----- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

[IP] blackmail / real world stego use
by Dave Farber 05 Jul '18

05 Jul '18

>Date: Sat, 23 Aug 2003 00:00:11 +0200 >From: Barry Wels <b.wels(a)nah6.com> >Subject: blackmail / real world stego use >Sender: owner-cryptography(a)metzdowd.com >To: cryptography(a)metzdowd.com > > >Hi, > >So far I have only found one English item in the news about this. > >http://www.expatica.com/index.asp?pad=2,18,&item_id=33655 > >So let me translate some of the dutch information about this >interesting case : > >A 45-year old chip designer from Utrecht was arrested June 3. >He confessed to have tried to blackmail the 'Campina' food company. >He had threatened to poison their products, and demanded 200.000 euro. >The most remarkable thing about this case is however how he >communicated with Campina, and how he thought to receive the money. > >He forced Campina to open a bank account, and get a 'world card' with >it. Then they had to deposit 200.000 Euro on it (about 185.000 >US dollar). He ordered them to buy a credit card reader, and read the >information off the magnetic-stripe of the 'world card'. >Then they had to send him the output of the card reader, together with >the pin code. With this information, he then could create a copy of >the 'world card' using a card-writer and a blank card. > >To send him the information, he made them use steganography! >Campina received an envelope via snailmail containing a floppy with a >stego program and instructions. >They had to encode the 'world card' info into a picture of a red VW >golf, using the stego program, and a fixed crypto key that was >included in the envelope. >Finally, they had to place the picture in a fake add on a website >where large amounts of people sell/buy second hand cars. >He would then read the add, and make a copy of the picture. >Decode the stego info out of it, write his own copy of the card, >and withdraw money. Without ever having personal contact with Campina >(or the police). To be real clever, he did not approach the website >with the car adds directly. Police found out the add was approached >trough a US anonymizer called SURFOLA.com. SURFOLA.com claims on their >website : >"We will not give out your name, residence address, or e-mail address >to any third parties without your permission, for any reason, at any >time, ever." > >The Utrecht police informed the FBI, and asked for assistance. Within >24 hours, the FBI cracked the case, supplying the Dutch police with >a '@wxs.nl' e-mail address and some paypal.com financial data. >This data led to the 45 year old chip programmer. >After his identity was known, the police ofcourse started surveillance on >him. The 'desert terrorist' was arrested red-handed when he withdrew money >from an ATM using the world-card copy.... > >Greetings, > >Barry Wels. > > >The Cryptography Mailing List >Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ------------------------------------- You are subscribed as adam(a)homeport.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

[technoliberation] Vernor Vinge on computers, freedom and privacy
by Hughes, James J. 05 Jul '18

05 Jul '18

http://technology.guardian.co.uk/weekly/story/0,,1807882,00.html Big Brother takes a controlling interest in chips A chilling novel details how everyday technologies could gradually lead to a far more invasive society than even Orwell dreamed of Wendy Grossman Thursday June 29, 2006 The Guardian Science fiction writers love to ask "What if?" What if a super-intelligent alien race had planted a pair of devices to boost our development at key moments? What if new technologies such as television and electronics become pervasive? George Orwell's answer to the latter, in 1948's 1984, was to show the apparently perfect, controlled society they could enable. But one thing usually missing is the "how?" At the Computers, Freedom, and Privacy (CFP) conference, held in Washington, DC, last month, Vernor Vinge, a retired computer scientist and the author of Rainbows End, provided a compelling explanation of how developing technology and powerful interests could create a society far more invasive and controlled than anything Orwell dreamed of. The scenario he describes is the background he researched for Rainbows End. Set in 2025, the characters are surrounded by logical extensions of today's developing technology. Wearable computing is commonplace. Tagging and ubiquitous networked sensors mean you can look at the landscape with your choice of overlay and detail. People send each other silent messages and Google for information within conversations with participants who may be physically present or might be remote projections. One character's projection is hijacked and becomes the front for three people. The owner of another remote intelligence is unknown. Several continents' top intelligence operatives try to solve a smart biological attack that infects a test population with the willingness to obey orders. Assumptions Vinge makes two opening assumptions: no grand physical disaster occurs, and today's computing and communications trends continue. He added a third trend: "The great conspiracy against human freedom." As novelist Doris Lessing has observed, barons on opposite sides of the river don't need to be in cahoots if their interests coincide. In our case, defence, homeland security, financial crime enforcement, police, tax collectors and intellectual property rights holders offer reasons to want to control the hardware we use. Then there are geeks, who can be tempted to forget the consequences if the technology is cool enough. Vinge quotes the most famous line from the comic strip Pogo: "We have met the enemy, and he is us." Vinge's technology to satisfy these groups' dreams is the Secure Hardware Environment (She), which dedicates some bandwidth and a small portion of every semiconductor for regulatory use. Deployment is progressive, as standards are implemented. Built into new chips, She will spread inevitably through its predecessors' obsolescence. This part is terribly plausible. It sounds much like the Trusted Computing Platform, implemented in Intel chips and built into machines from Dell, Fujitsu-Siemens and others. Most people don't realise their new computer contains a chip designed to block the operation of any software not certified by the group. Now enhance that and build it into RFID chips, networked embedded systems, shrink and distribute as "smart dust". All are current trends or works in progress. Geeks are willing to fight Trusted Computing on the grounds that it could be used to block open-source software or to enforce draconian digital rights management. But what if accepting it meant less visible security, less bureaucracy, even slight profit? She automatically sends taxes, enables much less noticeable surveillance and gets you through security checkpoints with no waiting. There's less crime, because legislative reality can be enforced on physical reality. Fewer false convictions. Make regulation automatic, and it seems to go away. New laws can be downloaded as a regulatory upgrade. "She," Vinge concluded at the conference, "fits the trajectory that economics and technical progress are following. The infrastructure for such control will probably arrive in any case." He also calls his scenario optimistic. This is, however, one of the paths to Technological Singularity, which Vinge wrote up in a 1993 essay. It's the moment superhuman intelligence is achieved, either through systems we build or human augmentation. The Singularity changes everything; nothing after it is predictable. In the world of Rainbows End, he thinks, they are either on the verge of Singularity or it is happening. This caused its own singularity in science fiction. Charlie Stross, whose novel Accelerando attempts to depict living through the Singularity, has called it "the turd in the punchbowl of near-future SF - you may politely pretend it isn't there, but everyone has to deal with it." Author Ken MacLeod places the Singularity in the context of post-2001 hopelessness. "When human beings feel they can't change the future, they begin to imagine that maybe superhuman beings can: gods, angels, aliens - and now artificial intelligences (AI). The idea of the Singularity is just a sophisticated version of this ancient ... superstition, that human history is or soon will be made by something other and better than human beings." Way to believe Vinge doesn't dispute the notion that humans look for a way to believe things will be better. Year 2000 software remediation is an example: "Prudent apprehension caused an awful lot of money to be spent ... and was one reason there were no significant problems." Most people assume the cause of the Singularity, if it happens, will be the effect of Moore's Law (that the number of transistors that can fit in a given space on a semiconductor doubles every 18 months). It's also usually connected to AI. In his essay, however, Vinge suggested four or five paths to the Singularity, only one of which was unitary AI. But here is where Vinge's thinking gets optimistic (unlike the CFP conference, which saw surveillant databases everywhere). The road to technological Gaia is full of frictional costs that could stop it. "It's not going to work very well," he says, "but it will be attempted, both by the state and by civil special interest petitioners." The drug laws provide a perfect illustration: "The ideal job to have in government is something everybody is convinced is essential to be done successfully that cannot be done successfully and the government is the only entity that can do it. Every time you fail, you say, 'The problem is much larger than we imagined, give us some more money.'" "The leaders of most powerful countries are coming to realise that the most important natural resources are not factories or the size of armies. Economic power is in the size of the population that is well-educated, creative and generally happy enough to be optimistic enough to want to do something creative." "The illusion of freedom becomes a strange thing when a government is dealing with ... thousands of people who are as bright as the smartest people running the government. Together, they outclass the people running the show. The turning point is the notion that to provide this illusion of freedom for such a group would wind up being more like real freedom than anything in human history." Or, as he thinks Pogo might say for the 21st century, "We have met what's going to save our ass and it is us." ------------------------ Yahoo! Groups Sponsor --------------------~--> See what's inside the new Yahoo! Groups email. http://us.click.yahoo.com/2pRQfA/bOaOAA/yQLSAA/XgSolB/TM --------------------------------------------------------------------~-> Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/technoliberation/ <*> To unsubscribe from this group, send an email to: technoliberation-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [cryptography] [info] The NSA Is Building the Country's Biggest Spy Center (Watch What You Say)
by Marsh Ray 05 Jul '18

05 Jul '18

On 03/22/2012 09:57 AM, Peter Maxwell wrote: > > From > http://blogs.computerworld.com/19917/shocker_nsa_chief_denies_total_informa… >> "Remember," former intelligence official Binney stated, "a lot of >> foreign government stuff we've never been able to break is 128 or >> less. Break all that and you'll find out a lot more of what you >> didn't know-stuff we've already stored-so there's an enormous >> amount of information still in there." In other words, they've accumulated a backlog of ciphertext. Encryption working as designed. >> Binney added the NSA is "on the verge of breaking a key encryption >> algorithm." This sounds like budget boondoggle baloney to me. How can you be "on the verge" of something like that? You might have some ideas on how to attack it, but until they're proven they're just guesses and likely to be dead ends. Not something you should justify reworking your computing systems around. But once they're proven, you're not "on the verge". > That sounds far more plausible than the previous explanations. I'd > also suspect the "key encryption algorithm" may be RC4 and not AES > at the moment. Or it could just be all the 40- and 56- bit stuff that was captured by wiretapping Americans and not decrypted way back when the NSA felt constrained by laws. Or it could be everything using 512-bit RSA key exchange. Or it could be everything for which the security of the encryption ultimately depends on a user-chosen password. E.g., MS-PPTP/MPPE (but there's nothing really new about this). Or it could be a common protocol using a cipher weakly. For example, I noticed this the other day about RDP "standard, non-FIPS" mode: http://msdn.microsoft.com/en-us/library/cc240771%28v=prot.10%29.aspx If the endpoints do actually manage to negotiate the use of 128 bit (as opposed to 40 or 56 bit) security, it uses the output of RC4 without discarding any initial bytes. Those initial bytes have some correlations, some of which can expose the whole key. Just to make sure the 1684 bit state size of RC4 doesn't get stale, the protocol refreshes the key every 4096 packets. (Actually better than MPPE which seems to rekey every 1 or 256 packets depending on negotiated options). Or it could be complete BS. - Marsh _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[bitcoin-list] Version 0.8.0 released
by Gavin Andresen 05 Jul '18

05 Jul '18

Bitcoin-Qt version 0.8.0 are now available from: http://sourceforge.net/projects/bitcoin/files/Bitcoin/bitcoin-0.8.0/ This is a major release designed to improve performance and handle the increasing volume of transactions on the network. Please report bugs using the issue tracker at github: https://github.com/bitcoin/bitcoin/issues How to Upgrade -------------- If you are running an older version, shut it down. Wait until it has completely shut down (which might take a few minutes for older versions), then run the installer (on Windows) or just copy over /Applications/Bitcoin-Qt (on Mac) or bitcoind/bitcoin-qt (on Linux). The first time you run after the upgrade a re-indexing process will be started that will take anywhere from 30 minutes to several hours, depending on the speed of your machine. Incompatible Changes -------------------- This release no longer maintains a full index of historical transaction ids by default, so looking up an arbitrary transaction using the getrawtransaction RPC call will not work. If you need that functionality, you must run once with -txindex=1 -reindex=1 to rebuild block-chain indices (see below for more details). Improvements ------------ Mac and Windows binaries are signed with certificates owned by the Bitcoin Foundation, to be compatible with the new security features in OSX 10.8 and Windows 8. LevelDB, a fast, open-source, non-relational database from Google, is now used to store transaction and block indices. LevelDB works much better on machines with slow I/O and is faster in general. Berkeley DB is now only used for the wallet.dat file (public and private wallet keys and transactions relevant to you). Pieter Wuille implemented many optimizations to the way transactions are verified, so a running, synchronized node uses less working memory and does much less I/O. He also implemented parallel signature checking, so if you have a multi-CPU machine all CPUs will be used to verify transactions. New Features ------------ "Bloom filter" support in the network protocol for sending only relevant transactions to lightweight clients. contrib/verifysfbinaries is a shell-script to verify that the binary downloads at sourceforge have not been tampered with. If you are able, you can help make everybody's downloads more secure by running this occasionally to check PGP signatures against download file checksums. contrib/spendfrom is a python-language command-line utility that demonstrates how to use the "raw transactions" JSON-RPC api to send coins received from particular addresses (also known as "coin control"). New/changed settings (command-line or bitcoin.conf file) -------------------------------------------------------- dbcache : controls LevelDB memory usage. par : controls how many threads to use to validate transactions. Defaults to the number of CPUs on your machine, use -par=1 to limit to a single CPU. txindex : maintains an extra index of old, spent transaction ids so they will be found by the getrawtransaction JSON-RPC method. reindex : rebuild block and transaction indices from the downloaded block data. New JSON-RPC API Features ------------------------- lockunspent / listlockunspent allow locking transaction outputs for a period of time so they will not be spent by other processes that might be accessing the same wallet. addnode / getaddednodeinfo methods, to connect to specific peers without restarting. importprivkey now takes an optional boolean parameter (default true) to control whether or not to rescan the blockchain for transactions after importing a new private key. Important Bug Fixes ------------------- Privacy leak: the position of the "change" output in most transactions was not being properly randomized, making network analysis of the transaction graph to identify users' wallets easier. Zero-confirmation transaction vulnerability: accepting zero-confirmation transactions (transactions that have not yet been included in a block) from somebody you do not trust is still not recommended, because there will always be ways for attackers to double-spend zero-confirmation transactions. However, this release includes a bug fix that makes it a little bit more difficult for attackers to double-spend a certain type ("lockTime in the future") of zero-confirmation transaction. Dependency Changes ------------------ Qt 4.8.3 (compiling against older versions of Qt 4 should continue to work) Thanks to everybody who contributed to this release: ---------------------------------------------------- Alexander Kjeldaas Andrey Alekseenko Arnav Singh Christian von Roques Eric Lombrozo Forrest Voight Gavin Andresen Gregory Maxwell Jeff Garzik Luke Dashjr Matt Corallo Mike Cassano Mike Hearn Peter Todd Philip Kaufmann Pieter Wuille Richard Schwab Robert Backhaus Rune K. Svendsen Sergio Demian Lerner Wladimir J. van der Laan burger2 default fanquake grimd34th justmoon redshark1802 tucenaber xanatos ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_d2d_feb _______________________________________________ bitcoin-list mailing list bitcoin-list(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by Asymmetric 05 Jul '18

05 Jul '18

> I do understand how both types work, however, the opportunity for > subterfuge is always present. I was making a point that the assumed > security of a remailer should not factor in if you intend to put yourself > at risk. Assumptions are dangerous all over the place, and if your > assumption could get you into trouble, it's better to verify it or not > instead of just proceeding blindly, if at all possible. Even if you trust each remailer to "do the right thing" only 10% of the time, by chaining 10 such remailers the probability of having your identity revealed is only 1 in 10^10 - assuming that the remailers are independent. [That secondary assumption can be improved by chosing remailers in different countries.] > What is the outrageous claim? That someone could purposely set up an > insecure remailer, claim that it's secure, and that people could then > unwittingly use it to incriminate themselves? No - that by using an open-relay mailer you get the same anonymity as using a Type 1 / Type 2 remailer. > and honestly my comment about faking > the return addresses was in no way to say that this method could replace > remailers Funny, that's how it looked for everyone. Admit it - you said something stupid. [Even I admit I'm wrong sometimes. <g>] > I'm going to stop myself here.. The original email I sent was simply a > question about what could be done to possibly quell the flow of spam > generated by this list, followed by a few suggestions. It's gotten utterly > out of hand because somebody apparently took it as a personal attack, and > responded with a series of attacks of his own. Most of the regular subscribers are tired of the complaints (which are usually worse - as in more and bigger - than the spam). > As I said before, if [you] (the reader on the list) don't want to hear > these questions, then what's good for the goose is good for the > gander. Filter my emails if you like; It'll be a lot easier for you to > filter them automatically than it will be to filter the spam messages in > any event. I don't use any (deleting) filters; I read about 500 messages each day, and it only takes me 2-3 hours. A friend of mine reads around 2,000 messages each day. It's not such a big deal. > Instead, I received another nasty letter, and then a few days later a call > from my upstream provider. They denied her request to deliver up my name > and address, but told me that if I didn't take the information down that it > would be a violation of the service agreement, and that they would > disconnect the frame relay. I explained to their (the ISPs) lawyer the > situation, and that they did not actually own the copyrights in > question. He responded with "I know, but considering their history, they > are very willing to take us to court over this, and honestly we don't want > to deal with that. Take it down or we shut you down, we don't care who's > right, we just don't want a lawsuit." Yep. Same thing - the fear of lawsuits - is why we were warned, when we came to the US, to not even look at our female colleagues: even a hint of a lawsuit would make our employer send us back to our country in a heartbeat - whether we're guilty or not. [They wouldn't care.] US sucks a lot. Too bad this is where the money is :) > Needless to say, faced with the entire site being removed, I removed the > materials. One word: Freenet. See http://freenet.sourceforge.net > I see. But trying to find a way to save even more time and bandwidth by > even attempting to figure out a solution to this problem is not as valuable? No. There already is a solution: the client filters everything. Wait, there's also a second one: build your own cypherpunks node. [The second one is even better.] > It comes down to a simple bit of confusion on my part. I cannot understand > the mentality of someone who has the time and resources to effectively > combat the spam on this list, and yet who does not have the time or > resource to either respond in a somewhat civil fashion, or to just delete > the message along with the rest of the refuse. Spam takes <1 second to identify and delete. > You seemed to be a bit more level headed, so while I still totally disagree > that it's a waste of time to try and figure a way around this problem, I > haven't utterly lost respect for you as I have with Tim. "Pillar of the > community" or not, the guy is an utter asshole. Here I agree with you :) Mark

1 0

None
by Asymmetric 05 Jul '18

05 Jul '18

> I do understand how both types work, however, the opportunity for > subterfuge is always present. I was making a point that the assumed > security of a remailer should not factor in if you intend to put yourself > at risk. Assumptions are dangerous all over the place, and if your > assumption could get you into trouble, it's better to verify it or not > instead of just proceeding blindly, if at all possible. Even if you trust each remailer to "do the right thing" only 10% of the time, by chaining 10 such remailers the probability of having your identity revealed is only 1 in 10^10 - assuming that the remailers are independent. [That secondary assumption can be improved by chosing remailers in different countries.] > What is the outrageous claim? That someone could purposely set up an > insecure remailer, claim that it's secure, and that people could then > unwittingly use it to incriminate themselves? No - that by using an open-relay mailer you get the same anonymity as using a Type 1 / Type 2 remailer. > and honestly my comment about faking > the return addresses was in no way to say that this method could replace > remailers Funny, that's how it looked for everyone. Admit it - you said something stupid. [Even I admit I'm wrong sometimes. <g>] > I'm going to stop myself here.. The original email I sent was simply a > question about what could be done to possibly quell the flow of spam > generated by this list, followed by a few suggestions. It's gotten utterly > out of hand because somebody apparently took it as a personal attack, and > responded with a series of attacks of his own. Most of the regular subscribers are tired of the complaints (which are usually worse - as in more and bigger - than the spam). > As I said before, if [you] (the reader on the list) don't want to hear > these questions, then what's good for the goose is good for the > gander. Filter my emails if you like; It'll be a lot easier for you to > filter them automatically than it will be to filter the spam messages in > any event. I don't use any (deleting) filters; I read about 500 messages each day, and it only takes me 2-3 hours. A friend of mine reads around 2,000 messages each day. It's not such a big deal. > Instead, I received another nasty letter, and then a few days later a call > from my upstream provider. They denied her request to deliver up my name > and address, but told me that if I didn't take the information down that it > would be a violation of the service agreement, and that they would > disconnect the frame relay. I explained to their (the ISPs) lawyer the > situation, and that they did not actually own the copyrights in > question. He responded with "I know, but considering their history, they > are very willing to take us to court over this, and honestly we don't want > to deal with that. Take it down or we shut you down, we don't care who's > right, we just don't want a lawsuit." Yep. Same thing - the fear of lawsuits - is why we were warned, when we came to the US, to not even look at our female colleagues: even a hint of a lawsuit would make our employer send us back to our country in a heartbeat - whether we're guilty or not. [They wouldn't care.] US sucks a lot. Too bad this is where the money is :) > Needless to say, faced with the entire site being removed, I removed the > materials. One word: Freenet. See http://freenet.sourceforge.net > I see. But trying to find a way to save even more time and bandwidth by > even attempting to figure out a solution to this problem is not as valuable? No. There already is a solution: the client filters everything. Wait, there's also a second one: build your own cypherpunks node. [The second one is even better.] > It comes down to a simple bit of confusion on my part. I cannot understand > the mentality of someone who has the time and resources to effectively > combat the spam on this list, and yet who does not have the time or > resource to either respond in a somewhat civil fashion, or to just delete > the message along with the rest of the refuse. Spam takes <1 second to identify and delete. > You seemed to be a bit more level headed, so while I still totally disagree > that it's a waste of time to try and figure a way around this problem, I > haven't utterly lost respect for you as I have with Tim. "Pillar of the > community" or not, the guy is an utter asshole. Here I agree with you :) Mark

1 0