July 2018 - cypherpunks-legacy

Re: Status of opportunistic encryption
by James A. Donald 05 Jul '18

05 Jul '18

-- > > It seems to me opportunistic encryption has moved to > > the application layer, at least as far as Internet > > mail is concerned. Many MTAs use TLS automatically > > with whatever certificates they can get. Of course, > > this only guards against active attacks, but it > > seems to me that this is a reasonable threat model. Victor Duchovni wrote: > It only guards against *passive* eavesdropping. Active > attacks can forge DNS MX records, inject BGP routes, > ... Actual MITM resistant peer authentication with > SMTP+TLS is extremely rare. I know it happens > sometimes because I have it running for a small number > of destinations, otherwise I would suspect that nobody > is doing it. Active attacks are rare, possibly nonexistent except for Wifi. If NSA and the other TLAs were doing active attacks, they would be detected some of the time. They don't like being detected. If anyone does an active attack, this is a one off event. If someone routinely and regularly does active attacks, the attack will be detected, the point where they are modifying messages will be detected, and will be bypassed. > I should also note that once one abandons the (still) > unrealistic assumption of a secure DNS, it is not just > SMTP + TLS that runs into trouble. > > For example, many Kerberos client libraries do a > forward lookup (to alias- expand CNAMEs) and some > perversely a reverse lookup (often the owner of the IP > address is the worst source of the machine's name), > and then give you a mutually authenticated channel to > whatever principal they construct from now rather > questionable data. This carries over to SASL GSSAPI, > where GSSAPI abstraction makes working around this (in > practice nobody tries even with native Kerberos) even > harder. > > Consequently, also SSH with GSS KEX, is not MITM > resistant when the attacker can tamper with DNS > responses. My understanding is that SSH when using GSS KEX does not cache the keys, which strikes me as a amazingly stupid idea, particularly when SSH key caching has been so successful, and when the user thinks he knows his security comes from key caching. The experience with PKI suggests that it is very difficult to have security without durable cached keys. > Ultimately, to close similar security issues in many > other protocols, we need a secure DNS, but I am > somewhat pessimistic about the likelihood of this > happening soon. Attacks on DNS are common, though less common than other attacks, but they are by scammers, not TLA agencies, perhaps because they are so easily detected. All logons should move to SRP to avoid the phishing problem, as this is the most direct and strongest solution for phishing for shared secrets, and phishing for shared secrets is the biggest problem we now have. Encrypting DNS is unacceptable, because the very large number of very short messages make public key encryption an intolerable overhead. A DNS message also has to fit in a single datagram. To accommodate these constraints, we need DNS certificates sent in the clear, and signed with elliptic curve public keys (which allow both signatures and certificates to be short enough to fit in a datagram). The client walks the certificate chain from time to time and it caches the certificates, to avoid excessively loading the issuers of higher level certificates. But this is all theoretical at this stage, for DNS attacks are not our biggest problem. Once we have deployed systems that make it difficult to snoop and scam without attacking DNS, *then* we will see DNS come under heavy attack, and *then* there will be motivation to change the DNS system. After all, we have not fixed or replaced PKI, despite the enormous phishing attack that renders it useless and irrelevant, so we are going to be slower still fixing DNS. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG cwXK8++rEMivkYVd+uiumb8CD2CVphnQhorYYVxx 4KsvRJfxM5XZMseazJM4sjSoGS386TnYrCiBhfQuF --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Dewayne-Net] SF reviews contracts with AT&T over domestic spying
by Dewayne Hendricks 05 Jul '18

05 Jul '18

AP NewsBreak: SF reviews contracts with AT&T over domestic spying - By SCOTT LINDLAW, Associated Press Writer Tuesday, July 11, 2006 (07-11) 14:02 PDT San Francisco (AP) -- City officials are investigating AT&T's alleged cooperation with the National Security Agency and considering possible "consequences" the company could face in its extensive municipal contracts here if it is violating civil liberties, Mayor Gavin Newsom said Tuesday. "If what I'm reading is true, I've got some serious problems as a San Franciscan, as a taxpayer and as mayor," Newsom said in interview with The Associated Press. "And I don't like it." A federal lawsuit filed by Internet privacy advocate Electronic Frontier Foundation accuses the telecommunications giant of illegally cooperating with the NSA to make communications on AT&T networks available to the spy agency without warrants. According to the lawsuit, AT&T allowed the NSA to install data.m.ining equipment in secret rooms at AT&T offices in San Francisco and a handful of other cities. Last month, the government urged a federal judge to dismiss the suit, saying it threatens to reveal state secrets. The judge's decision is pending. Newsom said he has asked City Attorney Dennis Herrera to conduct "fact-finding" on the matter. But the mayor also said he has completed his own compilation of "all of our current business relationships the city has with AT&T." That review, which includes expiration dates and other obligations, "may be suggestive that if we conclude that this is sincerely problematic, there may be a desire to not just make a symbolic statement of opposition, but to make a substantive one." The mayor said he did not know the value of AT&T's contracts with San Francisco. Nor would he provide a timetable for completion of the city attorney's probe. "I recognize the ability, (from) a local perspective, to perhaps have a little more influence because we do have a strong relationship with AT&T and I'd like to continue that," he said. "But I also think it's a two-way street," Newsom said. "If you're going do business with us, and San Francisco always has, we say, please help represent the values of the people that are actually purchasing those goods and services, meaning the taxpayers of this city." The city attorney probably has the power to subpoena, Newsom said, adding that he did not know for sure. If true, that would mean the city might have the power to learn details of the program that have not been publicly disclosed. [snip] URL: <http://sfgate.com/cgi-bin/article.cgi?file=/n/a/2006/07/11/ financial/f140225D55.DTL> Weblog at: <http://weblog.warpspeed.com> ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Dailydave] iAWACS CFP - The no-limit workshop
by Anthony Desnos 05 Jul '18

05 Jul '18

First International Alternative Workshop on Aggressive Computing and Security The no-limit workshop "Enhancing security with the attacker's mind - Orthodoxy and self confidence are weaknesses" "There is no such thing as forbidden knowledge, only forbidden use of knowledge" iAWACS ESIEA - Laval - October 2009 Thinking security can not be done without adopting a preferential mode of thought of the attacker. A system cannot be defended if we do not know how to attack it. If the theory is still an interesting approach to formalize things, the operational approach must be the ultimate goal: to talk about security is meaningless if we do not actually do security. In recent years the major security conferences in the subjects preferred to select papers according to fashion topics, conforming to something like orthodoxy and organize selection as beauty contests. As a result excellent yet unorthodox scientific papers are often rejected and sink into oblivion. The first international Alternative Workshop in Aggressive Computing and Security (iAWACS'09) aims to focus on this vision and to allow researchers and specialists to present relevant research works, with interesting results and operational (theoretical and/or applied) in the field of security. The different points of view, away from unconventional fashion and orthodoxy are particularly welcome. The aim is also to promote discussion of ideas around these topics. Articles submitted will be selected according to the following criteria: # Interest and scientific/technical correctness/accuracy, # New results, # Operational quality Regarding this last point, the authors should give all information and conditions for reproducibility of results they intend to present. This may include, during the selection phase by the reviewers, assessments based on challenges to the authors by the reviewers. iAwacs is not just another hackers workshop where the last exploit is disclosed. The aim of the conference is to make security concepts evolves through both the attacker's view AND a thorough formalization backed by experimental results. The main topics covered (list not exhaustive) are: # Cryptanalysis techniques # Steganalysis techniques # Malicious cryptography # Advances computer virology techniques (malware, backdoor...) # Active security product analysis and testing # Active security auditing # Mathematical concepts and applications with respect to the attacker's view # Cyberwarfare techniques # Cryptographic and steganography techniques # Invisible trap/bacdoor techniques in algorithms and applications # Implementation attacks # Interception/eavesdropping techniques # Forensics and anti-forensics techniques # Tempest and anti-tempest techniques # InfoOps techniques # Satellite hijacking Articles should be submitted in electronic format, preferably in LaTeX format, in English. Submission of Word/OOwriter documents is accepted. The address for submission is iawacs2009(a)esiea.fr. Submissions under hidden identities or aliases are not allowed.A technical challenge will be organized during the conference. Attendees who want to participate must register on site. For this first edition, the theme we have chosen is "Evaluation against active antivirus software to evaluate their resistance to removal by a malicious code." All results will be shared with publishers of antivirus concerned. The technical details of the challenge will be announced later. Important dates : # Submission deadline: July 15th, 2009 # Notification deadline: August 20th, 2009 # Final manuscript submission for inclusion into the proceedings: September 20th, 2009 # Conference dates: October 23rd - 25th, 2009 The conference proceedings will be published with ISBN by the Presses Techniques ESIEA. They will be given to registered participants at the conference and can then be bought on the conference homepage. The conference will be held at Ecole SupC)rieure en Informatique, Electronique et Automatique, in Laval from Friday 23rd to Sunday 25th, 2009 morning. Each author will have 45 minutes of speaking time, each presentation will be followed by a technical discussion between speakers and listeners. Laval is nice medieval city located 250 km west from Paris and can be reach by high speed train (TGV) from Paris International Airport. Conference registration amount to 400 euros (includes proceedings ,coffee breaks, lunches, cocktail reception, social events on Friday evening and Saturday evening, the conference, shuttle bus between the hotels and the conference venue). Program Chair : Eric Filiol Program Co-Chair : Robert Erra Contacts : # Program chair: iawacs2009(a)esiea.fr # Organization comitee: iawacs2009_orga(a)esiea.fr # Press contact: iawacs2009_press(a)esiea.fr http://www.esiea-recherche.eu http://www.esiea-recherche.eu/iawacs_2009.html _______________________________________________ Dailydave mailing list Dailydave(a)lists.immunitysec.com http://lists.immunitysec.com/mailman/listinfo/dailydave

1 0

[Freedombox-discuss] Wlan 802.11s became standard after 7 years
by Marc Manthey 05 Jul '18

05 Jul '18

hello ladys and gentleman, i4ve just read on the german IT news page heise, that 802.11s became standard after 7 years http://www.heise.de/newsticker/meldung/WLAN-Mesh-Standard-endlich-fertig-13… Some selected resources: http://open80211s.org/trac http://cozybit.com/our-projects/wireless-mesh-networks/o11s-mesh/ http://linuxwireless.org/en/developers/Documentation/ieee80211/802.11s http://www.ict-carmen.eu/ have a nice weekend Marc P.S. I think links in emails is a big advantage beside from snail mails. -- Les enfants teribbles - research / deployment Marc Manthey- Vogelsangerstrasse 97 50823 Kvln - Germany Tel.:0049-221-29891489 Mobil:0049-1577-3329231 blog: http://let.de project : http://stattfernsehen.com twitter: http://twitter.com/macbroadcast/ facebook: http://macbroadcast.tk Please think about your responsibility towards our environment: Each printed e-mail causes about 0.3 grams of CO2 per page. Opinions expressed may not even be mine by the time you read them, and certainly don't reflect those of any other entity (legal or otherwise). _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Update: Torbutton 1.0.1
by Roger Dingledine 05 Jul '18

05 Jul '18

On Sat, Mar 18, 2006 at 01:59:13PM -0600, Scott Squires wrote: > Announcing Torbutton 1.0.1 > http://zargon.hobbesnet.org/~squires/torbutton/torbutton-1.0.1.xpi I've just changed the Tor installation docs to recommend Torbutton rather than SwitchProxy: http://zargon.hobbesnet.org/~squires/torbutton/ If you all could please give it a try and let us know if you can find any compatibility problems, bugs, etc, that would be great. I'd like to get all the issues worked out so we can have a stable plugin to recommend. Thanks! --Roger ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: Status of opportunistic encryption
by James A. Donald 05 Jul '18

05 Jul '18

-- > > It seems to me opportunistic encryption has moved to > > the application layer, at least as far as Internet > > mail is concerned. Many MTAs use TLS automatically > > with whatever certificates they can get. Of course, > > this only guards against active attacks, but it > > seems to me that this is a reasonable threat model. Victor Duchovni wrote: > It only guards against *passive* eavesdropping. Active > attacks can forge DNS MX records, inject BGP routes, > ... Actual MITM resistant peer authentication with > SMTP+TLS is extremely rare. I know it happens > sometimes because I have it running for a small number > of destinations, otherwise I would suspect that nobody > is doing it. Active attacks are rare, possibly nonexistent except for Wifi. If NSA and the other TLAs were doing active attacks, they would be detected some of the time. They don't like being detected. If anyone does an active attack, this is a one off event. If someone routinely and regularly does active attacks, the attack will be detected, the point where they are modifying messages will be detected, and will be bypassed. > I should also note that once one abandons the (still) > unrealistic assumption of a secure DNS, it is not just > SMTP + TLS that runs into trouble. > > For example, many Kerberos client libraries do a > forward lookup (to alias- expand CNAMEs) and some > perversely a reverse lookup (often the owner of the IP > address is the worst source of the machine's name), > and then give you a mutually authenticated channel to > whatever principal they construct from now rather > questionable data. This carries over to SASL GSSAPI, > where GSSAPI abstraction makes working around this (in > practice nobody tries even with native Kerberos) even > harder. > > Consequently, also SSH with GSS KEX, is not MITM > resistant when the attacker can tamper with DNS > responses. My understanding is that SSH when using GSS KEX does not cache the keys, which strikes me as a amazingly stupid idea, particularly when SSH key caching has been so successful, and when the user thinks he knows his security comes from key caching. The experience with PKI suggests that it is very difficult to have security without durable cached keys. > Ultimately, to close similar security issues in many > other protocols, we need a secure DNS, but I am > somewhat pessimistic about the likelihood of this > happening soon. Attacks on DNS are common, though less common than other attacks, but they are by scammers, not TLA agencies, perhaps because they are so easily detected. All logons should move to SRP to avoid the phishing problem, as this is the most direct and strongest solution for phishing for shared secrets, and phishing for shared secrets is the biggest problem we now have. Encrypting DNS is unacceptable, because the very large number of very short messages make public key encryption an intolerable overhead. A DNS message also has to fit in a single datagram. To accommodate these constraints, we need DNS certificates sent in the clear, and signed with elliptic curve public keys (which allow both signatures and certificates to be short enough to fit in a datagram). The client walks the certificate chain from time to time and it caches the certificates, to avoid excessively loading the issuers of higher level certificates. But this is all theoretical at this stage, for DNS attacks are not our biggest problem. Once we have deployed systems that make it difficult to snoop and scam without attacking DNS, *then* we will see DNS come under heavy attack, and *then* there will be motivation to change the DNS system. After all, we have not fixed or replaced PKI, despite the enormous phishing attack that renders it useless and irrelevant, so we are going to be slower still fixing DNS. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG cwXK8++rEMivkYVd+uiumb8CD2CVphnQhorYYVxx 4KsvRJfxM5XZMseazJM4sjSoGS386TnYrCiBhfQuF --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Dewayne-Net] SF reviews contracts with AT&T over domestic spying
by Dewayne Hendricks 05 Jul '18

05 Jul '18

AP NewsBreak: SF reviews contracts with AT&T over domestic spying - By SCOTT LINDLAW, Associated Press Writer Tuesday, July 11, 2006 (07-11) 14:02 PDT San Francisco (AP) -- City officials are investigating AT&T's alleged cooperation with the National Security Agency and considering possible "consequences" the company could face in its extensive municipal contracts here if it is violating civil liberties, Mayor Gavin Newsom said Tuesday. "If what I'm reading is true, I've got some serious problems as a San Franciscan, as a taxpayer and as mayor," Newsom said in interview with The Associated Press. "And I don't like it." A federal lawsuit filed by Internet privacy advocate Electronic Frontier Foundation accuses the telecommunications giant of illegally cooperating with the NSA to make communications on AT&T networks available to the spy agency without warrants. According to the lawsuit, AT&T allowed the NSA to install data.m.ining equipment in secret rooms at AT&T offices in San Francisco and a handful of other cities. Last month, the government urged a federal judge to dismiss the suit, saying it threatens to reveal state secrets. The judge's decision is pending. Newsom said he has asked City Attorney Dennis Herrera to conduct "fact-finding" on the matter. But the mayor also said he has completed his own compilation of "all of our current business relationships the city has with AT&T." That review, which includes expiration dates and other obligations, "may be suggestive that if we conclude that this is sincerely problematic, there may be a desire to not just make a symbolic statement of opposition, but to make a substantive one." The mayor said he did not know the value of AT&T's contracts with San Francisco. Nor would he provide a timetable for completion of the city attorney's probe. "I recognize the ability, (from) a local perspective, to perhaps have a little more influence because we do have a strong relationship with AT&T and I'd like to continue that," he said. "But I also think it's a two-way street," Newsom said. "If you're going do business with us, and San Francisco always has, we say, please help represent the values of the people that are actually purchasing those goods and services, meaning the taxpayers of this city." The city attorney probably has the power to subpoena, Newsom said, adding that he did not know for sure. If true, that would mean the city might have the power to learn details of the program that have not been publicly disclosed. [snip] URL: <http://sfgate.com/cgi-bin/article.cgi?file=/n/a/2006/07/11/ financial/f140225D55.DTL> Weblog at: <http://weblog.warpspeed.com> ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Freedombox-discuss] Wlan 802.11s became standard after 7 years
by Marc Manthey 05 Jul '18

05 Jul '18

hello ladys and gentleman, i4ve just read on the german IT news page heise, that 802.11s became standard after 7 years http://www.heise.de/newsticker/meldung/WLAN-Mesh-Standard-endlich-fertig-13… Some selected resources: http://open80211s.org/trac http://cozybit.com/our-projects/wireless-mesh-networks/o11s-mesh/ http://linuxwireless.org/en/developers/Documentation/ieee80211/802.11s http://www.ict-carmen.eu/ have a nice weekend Marc P.S. I think links in emails is a big advantage beside from snail mails. -- Les enfants teribbles - research / deployment Marc Manthey- Vogelsangerstrasse 97 50823 Kvln - Germany Tel.:0049-221-29891489 Mobil:0049-1577-3329231 blog: http://let.de project : http://stattfernsehen.com twitter: http://twitter.com/macbroadcast/ facebook: http://macbroadcast.tk Please think about your responsibility towards our environment: Each printed e-mail causes about 0.3 grams of CO2 per page. Opinions expressed may not even be mine by the time you read them, and certainly don't reflect those of any other entity (legal or otherwise). _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tahoe-dev] Tahoe-LAFS Sixth Birthday Party! Sat. Oct 27
by Zooko Wilcox-O'Hearn 05 Jul '18

05 Jul '18

Folks: Details will follow as I work them out, but this is just to remind you that yes, there *will* be a Tahoe-LAFS Sixth Birthday Celebration next Saturday, October 27, 2012, in Boulder, Colorado and possibly elsewhere. I'm going to ask the Boulder Hackerspace if we can use their space. It is apparently populated with 3-D printers and computer-controlled machining tools, which is awesome. b: Shawn suggested using Google Hangouts to connect party locations. I think that is a great idea! Everyone get Google Hangouts working before Saturday. I also strongly recommend the use of projectors to make the screen real-estate be shared state among all the participants (who are physically in one room). In contrast, laptop screens are not good for physical sharing, and parties with laptop screens tend to result in people reading their private email and stuff, where parties with projector screens tend to result in people doing things that are more interesting to everyone else present. So, I really want to borrow at least two projectors for the Boulder location. Anybody in Boulder have projectors we can use? I am thinking of having LeastAuthority.com pay to make t-shirts that say Tahoe-LAFS on them, and maybe "6th Birthday Party, Oct 27, 2012" in small print somewhere. Want one? I'll pay the cost to manufacture and deliver such a t-shirt to the first few [*] people who ask for one! To get one: 1. sign up for https://LeastAuthority.com service (which actually costs you *only* for the space you use, so it isn't a big commitment), and 2. agree to show up at a Physical Tahoe-LAFS Birthday Party Location to receive your t-shirt. Regards, Zooko Wilcox-O'Hearn Founder, CEO, and Customer Support Rep https://LeastAuthority.com [*] "The first few" = until I run out of t-shirts. I haven't yet decided how many to make. _______________________________________________ tahoe-dev mailing list tahoe-dev(a)tahoe-lafs.org https://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Cryptography super-group creates unbreakable encryption
by Christopher Soghoian 05 Jul '18

05 Jul '18

> Chris, > You have repeatedly stood up asking VoIP software to be more transparent > about their encryption. You have repeatedly stood up when the media > overblew coverage into hype. > > I've never asked Skype to release the source code to their products, nor have I berated Apple, Facebook or Microsoft for not releasing the source code to their products. I have, however, asked Skype to be more transparent about the extent to which it can provide communications interception assistance to law enforcement and intelligence agencies. There is a big difference. If you don't want to use Silent Circle without seeing the source code, that is an entirely legitimate point of view (and in fact, one that I share, and that I expressed to Ryan Gallagher last year): http://www.slate.com/articles/technology/future_tense/2012/10/silent_circle… Christopher Soghoian, principal technologist at the ACLU's Speech Privacy and Technology Project, said he was excited to see a company like Silent Circle visibly competing on privacy and security but that he was waiting for it to go open source and be audited by independent security experts before he would feel comfortable using it for sensitive communications. Even though I am not using Silent Circle for sensitive conversations, I am still absolutely delighted to see them be as proactive as they have been about embracing and documenting progressive law enforcement policies. https://silentcircle.com/web/law-compliance/ My area of research is the intersection of law, policy and technology. As such, I am most interested in companies' surveillance policies, their commitment to transparency, and their stated willingness to tell the government to GTFO if they come and ask for backdoors. On this front, Silent Circle is extremely interesting, probably more so than any other Internet company. For many people on this list, source code is their #1 priority. That is fine. However, it is not my priority. I am more concerned with surveillance policy, because that is what I study and where I think I can be most effective in applying pressure. What I resent though, is Nadim's repeated, malicious attempts to drag my name through the mud, simply because I will not join his witch hunt against Silent Circle. Since he cannot find a single example of me saying anything false in the handful of interviews I have given to journalists writing about this company, instead he criticizes me for not throwing rocks at Phil Zimmermann. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0