July 2018 - cypherpunks-legacy

RE: [p2p-hackers] P2P Authentication
by Matthew Kaufman 06 Jul '18

06 Jul '18

Alen Peacock: > Personally, I'm put off by the centralization. I'm not > really concerned about the library size or complexity of > PKI,. In fact, my experience indicates that implementing > centralized CAs is a good deal less complex than trying to > distribute identity verification throughout the system with > no centralization. Agreed... Hierarchical PKI with a single root is distinctly easier than multiple roots, random chains of trust, or reputation models, which is why we've started with the simplest design for the default PKI that ships with the amicima MFP and MFPNet libraries. > Completely decentralized p2p applications have the > advantage of being especially resilient to DoS and other > attacks on centrality. > Introducing centralized components negates this advantage. It negates some advantages, not all. > In the case of using CAs in a p2p app, the entire network can > be disabled by attacking the CAs. As has already been pointed out, the network still runs, but new clients can't be authenticated. However, it is possible to make that unlikely... For instance, if enough trusted entities already have the ability to sign keys, you can reduce the odds that an attacker can successfully disable ALL of the CAs. Adding additional roots to the PKI, especially if they are public roots that are unlikely to be disabled, also helps... It doesn't seem likely that the world will shut down the existing secure web PKI in order to take your P2P app off the air. > p2p networks pose an interesting challenge because you have > to design for the fact that malicious or misbehaving clients > *will* be present. This is actually true of the entire Internet and isn't unique to p2p networks at all. All protocol implementations and higher level applications that run on them must be designed to deal with malicious or misbehaving clients will be present... See buffer overflows of mail servers and http servers, for instance. > Since there is no single entity or known > group of entities controlling the nodes (as in typical > distributed applications), there is no way to enforce > adherence to protocols other than with the protocols > themselves. This isn't about p2p networks at all, but about open-source distribution, it seems. Lots of totally proprietary p2p and client-server applications have been shipped where "a single entity" controls the implementation... Skype comes to mind as an example in the P2P space. These have the temporary advantage of unpublished protocols and implementations, but this won't stop a dedicated attacker for long, which brings us back to the original point, that everything attached to the Internet needs to assume that malicious and misbehaving things will try to mess things up. Whether or not that really matters is another point... There's numerous ways one could build a highly incorrect Gnutella peer, for instance, and yet it doesn't seem to have become commonplace. > This may sound idealistic and naive, perhaps > justly so, but the further away from protocols that require > centralized architectures we get, the better (IMHO, of course). Well, that's why we're all here on the "P2P" hackers list, I suppose, because we believe that decentralization is good, but it doesn't really change the most basic of the design parameters at all. Matthew Kaufman matthew(a)matthew.at www.amicima.com _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [tor-talk] access sites
by Paul Syverson 06 Jul '18

06 Jul '18

On Thu, Apr 05, 2012 at 05:24:28AM +0300, Maxim Kammerer wrote: > On Thu, Apr 5, 2012 at 04:15, Ted Smith <tedks(a)riseup.net> wrote: > > > (Also, have you missed the mail *on this list* from .mil domains?) > > There is Paul Syverson, who works at NRL, if I am not mistaken; did I > miss anyone else? > We created Tor to protect military communications. Much like other things invented at NRL (e.g., the joystick controller for remote control---patented in 1923! or GPS) it also has widespread civilian use. For most of those, the civilian, business, or other government use is icing on the cake of the purpose that prompted research on them. For some, e.g., IFF (identification friend-or-foe) their development into civilian use (ATCRBS, the air traffic control radar beacon system) importantly facilitates military use of the shared space. For onion routing, we argued publicly right from the start that the diversity of users was an essential element in effective use of the technology---even way back when we were just calling our systems onion routing, rather than _the_ onion routing (Tor) to distinguish from instances of onion routing developed elsewhere. As you can see, I'm not averse to touting these creations. But I am a researcher who does publicly published research in this area and whose work largely benefits from visibility. As Roger and others have pointed out earlier in this thread, people who rely on Tor to protect sensitive communications are rarely going to be happy to have anything revealed about their usage. You are simply not going to hear from (most of) those people, and you are definitely not going to get a representative sample of such use. At best you are going to be lucky to have anecdotal examples or even just anecdotal claims of usage from which to extrapolate. You seem to be asking for a statistically accurate demographic study of all users. But I am sure there are whole classes of users who don't want even their class of activity on Tor, much less their specific activity, known. I have no idea what classes, but that just makes sense. And on a more individual level, for every stalking victim who both managed to connect to Andrew and decided to trust him to help her protect herself online there are ??? others who did not have that opportunity or were unsure enough about trust to not reveal. (Of course ideally anyone regardless of technical background should know about the benefits of Tor and how to use it for their needs without having to talk to Andrew or someone. Let's not get into any of those issues.) A well-designed user study will tell us something interesting about Tor users. What it will definitely not do is give us a representative distribution of Tor users by purpose (and as already touched on usage demographics, e.g., by country can be significantly dynamic). And inferring user distributions from traffic distributions in studies that are methodologically controversial is not helpful. If that's all we've got for now, then that's all we've got. But we should be very careful what we infer from it. aloha, Paul _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Dewayne-Net] No email privacy rights under Constitution, US
by dewayne＠warpspeed.com 06 Jul '18

06 Jul '18

gov claims [Note: This item comes from reader Ken DiPietro. DLH] Original URL: <http://www.theregister.co.uk/2007/11/04/4th-amendment_email_privacy/ > No email privacy rights under Constitution, US gov claims By Mark Rasch, SecurityFocus Published Sunday 4th November 2007 12:02 GMT On October 8, 2007, the United States Court of Appeals for the Sixth Circuit in Cincinnati granted the government's request for a full- panel hearing in United States v. Warshak case centering on the right of privacy for stored electronic communications. At issue is whether the procedure whereby the government can subpoena stored copies of your email - similar to the way they could simply subpoena any physical mail sitting on your desk - is unconstitutionally broad. This appears to be more than a mere argument in support of the constitutionality of a Congressional email privacy and access scheme. It represents what may be the fundamental governmental position on Constitutional email and electronic privacy - that there isn't any. What is important in this case is not the ultimate resolution of that narrow issue, but the position that the United States government is taking on the entire issue of electronic privacy. That position, if accepted, may mean that the government can read anybody's email at any time without a warrant. What is Privacy? In a seminal case (Katz v. United States in 1963) the US Supreme Court, over the strenuous objections of the US government, upheld the right of the user of a payphone to claim a right to privacy in the contents of those communications. The Court held that the Fourth Amendment right to be secure in your "persons, house, places and effects" against unreasonable searches and seizures protected people, not just places. Thus, to determine whether you had a right against unreasonable seizure - a kind of privacy right - the court adopted a two-pronged test: did you think what you were doing was private and is society willing to accept your belief as objectively reasonable? [snip] ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] No email privacy rights under Constitution, US gov claims
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: <nettime> Steve Coll: Leaks (The New Yorker)
by John Young 06 Jul '18

06 Jul '18

Give apathy a chance, stash away adrenaline rush. Be quiet preacher, deity is snoozing with the flock. Leaks are not what they are claimed to be. Ooze is better. It is true that nearly all who have asked me, excuse the Thomas Friedman conceit, to comment on Wikileaks chastise for failing to join the orchestrated furor. I don't call them, the Wikileaks shills drop the dime and pretend insult when I call them what they are. Wikileaks in its original formulation is not what it has become, but that is a common bait and switch of authoritatives, compulsively reciting their credentials -- the history, the brand -- in the face of skepticism, or worse, disinterest -- how dare you ignore Wikileaks was one of its last press releases and pep talks to its volunteers mail list in the fall of 2009. No matter I praise the initiative's valuable contribution of documents for study, the main focus since the fall of 2009 has been on the Wikileaks advertising wrapping which diminishes attention for the documents as does all advertising diminish journalism, publishing, education and other means of information distribution. Wikileaks commentary and preen on their documents substitutes for the time and required to read, reflect and ponder, in accord with editorialism and hyperbole of authoritatives who only profit from the cream robbed from the milk. Few consume Wikileaks documents of the past or present so enjoyable is the substitute MREs composed of ignorant opinion. Some brag of not reading the documents, then proceed to boogy madly "on the urgent issue," i.e., Glenn Greenwald and a pack of other pro and con yappers wrapped in ads for themselves, sorry, opinionators, articulators of authoritativenss, fierce wide- eyeballers hoping to offset the dupery of opposing glazers. No doubt the apatheticism induced by ages-old advertising of authoritatives is the intent of hyperbole. However, it is worth considering how apathy -- a euphemism which can conceal a battery of resistances to parental hounding to behave and believer -- frees from obedience of an incessant message to be like us, those who know, i.e. "breaking news," and a slew of exhortations to eat branded puke upchucked in lieu of your own meals, your own musings and doubts of the high-volume yellers. Adrenaline is the aboriginal drug and without it not much pig in a poke would be sold, whether for love, war, politics, security and, OMG, wisdom, trenchancy, insight, reason, responsibility, the lot of the imaginary chimericals resting on a natural bed of chemical thrill at being in the know of "what's important to know." And who knows this best, the articulators of authoritativeness. Call them charlatans, for which they will thank you, but do not ignore them, for which they will assault your go away. Noise is what these brayers make, this is not needed by Wikileaks to do what it does best, indeed its PR is wide-mouthedly wretched in the carny barker tradition, and has led to a cessation of document publication. All tweets and no docs is what adrenaline peddlers inject. Knowledge industry is coequal with entertainment, mix the two and you have advertising, which is a word over-trenchantly examined for its teleological importance, self-vaunting, with decades of blather and bombast about whore media and its pimps, "the finest minds on earth." Writing and speaking in cliches is the norm now wrapped in self-hype to counter other people's apathy. # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mail.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: <nettime> Steve Coll: Leaks (The New Yorker)
by John Young 06 Jul '18

06 Jul '18

Give apathy a chance, stash away adrenaline rush. Be quiet preacher, deity is snoozing with the flock. Leaks are not what they are claimed to be. Ooze is better. It is true that nearly all who have asked me, excuse the Thomas Friedman conceit, to comment on Wikileaks chastise for failing to join the orchestrated furor. I don't call them, the Wikileaks shills drop the dime and pretend insult when I call them what they are. Wikileaks in its original formulation is not what it has become, but that is a common bait and switch of authoritatives, compulsively reciting their credentials -- the history, the brand -- in the face of skepticism, or worse, disinterest -- how dare you ignore Wikileaks was one of its last press releases and pep talks to its volunteers mail list in the fall of 2009. No matter I praise the initiative's valuable contribution of documents for study, the main focus since the fall of 2009 has been on the Wikileaks advertising wrapping which diminishes attention for the documents as does all advertising diminish journalism, publishing, education and other means of information distribution. Wikileaks commentary and preen on their documents substitutes for the time and required to read, reflect and ponder, in accord with editorialism and hyperbole of authoritatives who only profit from the cream robbed from the milk. Few consume Wikileaks documents of the past or present so enjoyable is the substitute MREs composed of ignorant opinion. Some brag of not reading the documents, then proceed to boogy madly "on the urgent issue," i.e., Glenn Greenwald and a pack of other pro and con yappers wrapped in ads for themselves, sorry, opinionators, articulators of authoritativenss, fierce wide- eyeballers hoping to offset the dupery of opposing glazers. No doubt the apatheticism induced by ages-old advertising of authoritatives is the intent of hyperbole. However, it is worth considering how apathy -- a euphemism which can conceal a battery of resistances to parental hounding to behave and believer -- frees from obedience of an incessant message to be like us, those who know, i.e. "breaking news," and a slew of exhortations to eat branded puke upchucked in lieu of your own meals, your own musings and doubts of the high-volume yellers. Adrenaline is the aboriginal drug and without it not much pig in a poke would be sold, whether for love, war, politics, security and, OMG, wisdom, trenchancy, insight, reason, responsibility, the lot of the imaginary chimericals resting on a natural bed of chemical thrill at being in the know of "what's important to know." And who knows this best, the articulators of authoritativeness. Call them charlatans, for which they will thank you, but do not ignore them, for which they will assault your go away. Noise is what these brayers make, this is not needed by Wikileaks to do what it does best, indeed its PR is wide-mouthedly wretched in the carny barker tradition, and has led to a cessation of document publication. All tweets and no docs is what adrenaline peddlers inject. Knowledge industry is coequal with entertainment, mix the two and you have advertising, which is a word over-trenchantly examined for its teleological importance, self-vaunting, with decades of blather and bombast about whore media and its pimps, "the finest minds on earth." Writing and speaking in cliches is the norm now wrapped in self-hype to counter other people's apathy. # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mail.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] access sites
by Paul Syverson 06 Jul '18

06 Jul '18

On Thu, Apr 05, 2012 at 05:24:28AM +0300, Maxim Kammerer wrote: > On Thu, Apr 5, 2012 at 04:15, Ted Smith <tedks(a)riseup.net> wrote: > > > (Also, have you missed the mail *on this list* from .mil domains?) > > There is Paul Syverson, who works at NRL, if I am not mistaken; did I > miss anyone else? > We created Tor to protect military communications. Much like other things invented at NRL (e.g., the joystick controller for remote control---patented in 1923! or GPS) it also has widespread civilian use. For most of those, the civilian, business, or other government use is icing on the cake of the purpose that prompted research on them. For some, e.g., IFF (identification friend-or-foe) their development into civilian use (ATCRBS, the air traffic control radar beacon system) importantly facilitates military use of the shared space. For onion routing, we argued publicly right from the start that the diversity of users was an essential element in effective use of the technology---even way back when we were just calling our systems onion routing, rather than _the_ onion routing (Tor) to distinguish from instances of onion routing developed elsewhere. As you can see, I'm not averse to touting these creations. But I am a researcher who does publicly published research in this area and whose work largely benefits from visibility. As Roger and others have pointed out earlier in this thread, people who rely on Tor to protect sensitive communications are rarely going to be happy to have anything revealed about their usage. You are simply not going to hear from (most of) those people, and you are definitely not going to get a representative sample of such use. At best you are going to be lucky to have anecdotal examples or even just anecdotal claims of usage from which to extrapolate. You seem to be asking for a statistically accurate demographic study of all users. But I am sure there are whole classes of users who don't want even their class of activity on Tor, much less their specific activity, known. I have no idea what classes, but that just makes sense. And on a more individual level, for every stalking victim who both managed to connect to Andrew and decided to trust him to help her protect herself online there are ??? others who did not have that opportunity or were unsure enough about trust to not reveal. (Of course ideally anyone regardless of technical background should know about the benefits of Tor and how to use it for their needs without having to talk to Andrew or someone. Let's not get into any of those issues.) A well-designed user study will tell us something interesting about Tor users. What it will definitely not do is give us a representative distribution of Tor users by purpose (and as already touched on usage demographics, e.g., by country can be significantly dynamic). And inferring user distributions from traffic distributions in studies that are methodologically controversial is not helpful. If that's all we've got for now, then that's all we've got. But we should be very careful what we infer from it. aloha, Paul _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Dewayne-Net] No email privacy rights under Constitution, US
by dewayne＠warpspeed.com 06 Jul '18

06 Jul '18

gov claims [Note: This item comes from reader Ken DiPietro. DLH] Original URL: <http://www.theregister.co.uk/2007/11/04/4th-amendment_email_privacy/ > No email privacy rights under Constitution, US gov claims By Mark Rasch, SecurityFocus Published Sunday 4th November 2007 12:02 GMT On October 8, 2007, the United States Court of Appeals for the Sixth Circuit in Cincinnati granted the government's request for a full- panel hearing in United States v. Warshak case centering on the right of privacy for stored electronic communications. At issue is whether the procedure whereby the government can subpoena stored copies of your email - similar to the way they could simply subpoena any physical mail sitting on your desk - is unconstitutionally broad. This appears to be more than a mere argument in support of the constitutionality of a Congressional email privacy and access scheme. It represents what may be the fundamental governmental position on Constitutional email and electronic privacy - that there isn't any. What is important in this case is not the ultimate resolution of that narrow issue, but the position that the United States government is taking on the entire issue of electronic privacy. That position, if accepted, may mean that the government can read anybody's email at any time without a warrant. What is Privacy? In a seminal case (Katz v. United States in 1963) the US Supreme Court, over the strenuous objections of the US government, upheld the right of the user of a payphone to claim a right to privacy in the contents of those communications. The Court held that the Fourth Amendment right to be secure in your "persons, house, places and effects" against unreasonable searches and seizures protected people, not just places. Thus, to determine whether you had a right against unreasonable seizure - a kind of privacy right - the court adopted a two-pronged test: did you think what you were doing was private and is society willing to accept your belief as objectively reasonable? [snip] ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] No email privacy rights under Constitution, US gov claims
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [FoRK] Why We Are Losing The War on Terrorism
by J.Andrew Rogers 06 Jul '18

06 Jul '18

On May 3, 2004, at 9:14 AM, Contempt for Meatheads forwarded: >We desperately need adult supervision and high quality minds in the >intelligence business! I am growing more convince that the security >clearance process, the government hiring/promotion process, and >information silos are overwhelming our ability to get even a >marginally adequate level of intelligence needed to fight terrorism. >Wow, this is depressing. > >My confident belief (100%): we will continue to lose the war on >terrorism until we fix our intelligence system. I think this analysis is correct, but also a bit too shallow to be really insightful. While there are some significant institutional problems and byzantine self-defeating regulations, these things are masking a much bigger technical problem that desperately needs to be tackled from their perspective. The volume of data they collect has reached the point where good analysis is no longer tractable in a theoretical algorithmic sense with the best tools they currently have at their disposal, particularly when you have a data space as broad and diffuse as "terrorism" to sift. Institutional procedures and problems aggravate this, but the underlying issues are deeper. One of the ways I keep track of what the US DoD is up to is by analysis of the open research programs, contracts, and grants that they publish. By threading the many, many programs together over time, you can see how fast different technologies are progressing and you can chain inferences to make an intelligent estimate as to when specific capabilities (which may require the intersection of multiple research tracks) could theoretically be available to the DoD. Furthermore, the program managers have a habit of mildly editorializing their program descriptions in response to some of the proposals they have received and the success of the proposals they have actually funded, which also gives some added insight. One thing that I have noticed for several years is that the advanced data mining and automated intelligence analysis research programs have been essentially stalled for many years now despite aggressive marketing and a large number of agencies willing to liberally fund proposals. And the editorializing of the program managers on this research track makes it clear that they are quite frustrated both with the lack of progress in this area and with the fact that research proposals keep trying to beat the same dead horse over and over. Furthermore, while most programs have a shelf-life after which they are either closed (both on good progress or no progress), these particular programs keep getting extended and re-funded over and over, sometimes under a different name but always with roughly the same parameters. As long as this program track is stuck in neutral, the intelligence agencies will have serious problems that will be all but insurmountable. The US intelligence service is a victim of its own ability to acquire data. This isn't a problem that they can simply throw money at in the sense that it requires pretty substantial algorithm breakthroughs to even be tractable for high-quality analysis. To date, private research organizations have clearly been unable to solve this problem in any meaningful way, and there is substantial evidence of this fact. In the mean time, they are left using narrow brittle algorithms to sift and analyze the data, with holes you could drive a truck (bomb) through. Someone who fully understood the theoretical limitations and likely implementation parameters of the current state-of-the-art could likely defeat the automated analysis. Fortunately for the intelligence agencies, few people have those skills and they get by on a pretty broken system hampered further by institutional problems. j. andrew rogers _______________________________________________ FoRK mailing list http://xent.com/mailman/listinfo/fork ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0