July 2018 - cypherpunks-legacy

Photos of an FBI tracking device found by a suspect
by Perry E. Metzger 05 Jul '18

05 Jul '18

My question: if someone plants something in your car, isn't it your property afterwards? http://gawker.com/5658671/dont-post-pictures-of-an-fbi-tracking-device-you-… -- Perry E. Metzger perry(a)piermont.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Photos of an FBI tracking device found by a suspect
by Perry E. Metzger 05 Jul '18

05 Jul '18

My question: if someone plants something in your car, isn't it your property afterwards? http://gawker.com/5658671/dont-post-pictures-of-an-fbi-tracking-device-you-… -- Perry E. Metzger perry(a)piermont.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [FoRK] "Aaron's Army" (transcript)
by Stephen Williams 05 Jul '18

05 Jul '18

Nice. Right on. I would file pro-se suits arguing various types of malfeasance, perhaps one for every database and document that I wanted. And encourage others to do so. For one thing, the US government is limited in what copyrights they can hold. It used to be said they couldn't hold copyrights at all, and I've seen documents explicitly put into the public domain by NASA and others on that grounds. Copyright validity is less certain for a government agency than for an individual or corporation. http://en.wikipedia.org/wiki/Copyright_status_of_work_by_the_U.S._government http://www.infotoday.com/searcher/apr09/Klein.shtml Additionally, you can argue fair use and public right to know. Pay for a document and sue to get a refund. Appeal the inevitable brush off. File claims against agencies with the agencies, the prerequisite to filing a suit against them. When you do file a suit, file creative pre-trial discovery. Subpoena relevant tax records. There's more than one way to fix a broken system. While you may have to pay some small court fees ($50, $74, etc.) and spend some time watching on hearing day, they'll have to pay for expensive attorneys. There seem to only be a few thing places where you can't represent yourself and even those are something that should be tested. sdw On 1/24/13 11:28 PM, Eugen Leitl wrote: > ----- Forwarded message from Bryan Bishop <kanzure(a)gmail.com> ----- > > From: Bryan Bishop <kanzure(a)gmail.com> > Date: Fri, 25 Jan 2013 00:01:20 -0600 > To: science-liberation-front(a)googlegroups.com, > Bryan Bishop <kanzure(a)gmail.com> > Subject: "Aaron's Army" (transcript) > Reply-To: science-liberation-front(a)googlegroups.com > > https://public.resource.org/aaron/army/ > > """ > TEXT OF REMARKS BY CARL MALAMUD > > Do not think for a moment that Aaron's work on JSTOR was the random act of > a lone hacker, some kind of crazy, spur-of-the-moment bulk download. > > JSTOR had long come in for withering criticism from the net. Larry Lessig > called JSTOR a moral outrage in a talk and I suppose I have to confess he > was quoting me. We weren't the only ones fanning those flames. > > Sequestering knowledge behind pay wallsbmaking scientific journals only > available to a few kids fortunate enough to be at fancy universities and > charging $20 an article for the remaining 99% of usbwas a festering wound. > It offended many people. > > It embarrassed many who wrote those articles that their work had become > somebody's profit margin, a members-only country club of knowledge. > > Many of us helped fan those flames. Many of us feel guilty today for > fanning those flames. > > But JSTOR was just one of many battles. They tried to paint Aaron as some > kind of lone-wolf hacker, a young terrorist who went on a crazy IP killing > spree that caused $92 million in damages. > > Aaron wasn't a lone wolf, he was part of an army, and I had the honor of > serving with him for a decade. You have heard many things about his > remarkable life, but I want to focus tonight on just one. > > Aaron was part of an army of citizens that believes democracy only works > when the citizenry are informed, when we know about our rightsband our > obligations. An army that believes we must make justice and knowledge > available to allbnot just the well born or those that have grabbed the > reigns of powerbso that we may govern ourselves more wisely. > > He was part of an army of citizens that rejects kings and generals and > believes in rough consensus and running code. > > We worked together on a dozen government databases. When we worked on > something, the decisions weren't rash. Our work often took months, > sometimes years, sometimes a decade, and Aaron Swartz did not get his > proper serving of decades. > > We looked at and poked at the U.S. Copyright database for a long time, a > system so old it was still running WAIS. The government hadbbelieve it or > notbasserted copyright on the copyright database. How you copyright a > database that is specifically called out in the U.S. Constitution is beyond > me, but we knew we were playing with fire by violating their terms of use, > so we were careful. > > We grabbed that data and it was used to feed the Open Library here at the > Internet Archive and it was used to feed Google Books. And, we got a letter > from the Copyright Office waiving copyright on that copyright database. But > before we did that, we had to talk to many lawyers and worry about the > government hauling us in for malicious premeditated bulk downloading. > > These were not random acts of aggression. We worked on databases to make > them better, to make our democracy work better, to help our government. We > were not criminals. > > When we brought in 20 million pages of U.S. District Court documents from > behind their 8 cent-per-page PACER pay wall, we found these public filings > infested with privacy violations: names of minor children, names of > informants, medical records, mental health records, financial records, tens > of thousands of social security numbers. > > We were whistle blowers and we sent our results to the Chief Judges of 31 > District Courts and those judges were shocked and dismayed and they > redacted those documents and they yelled at the lawyers that filed them and > the Judicial Conference changed their privacy rules. > > But you know what the bureaucrats who ran the Administrative Office of the > United States Courts did? To them, we weren't citizens that made public > data better, we were thieves that took $1.6 million of their property. > > So they called the FBI, they said they were hacked by criminals, an > organized gang that was imperiling their $120 million per year revenue > stream selling public government documents. > > The FBI sat outside Aaron's house. They called him up and tried to sucker > him into meeting them without his lawyer. The FBI sat two armed agents down > in an interrogation room with me to get to the bottom of this alleged > conspiracy. > > But we weren't criminals, we were only citizens. > > We did nothing wrong. They found nothing wrong. We did our duty as citizens > and the government investigation had nothing to show for it but a waste of > a whole lot of time and money. > > If you want a chilling effect, sit somebody down with a couple overreaching > federal agents for a while and see how quickly their blood runs cold. > > There are people who face danger every day to protect usbpolice officers > and firefighters and emergency workersband I am grateful and amazed by what > they do. But the work that people like Aaron and I did, slinging DVDs and > running shell scripts on public materials, should not be a dangerous > profession. > > We weren't criminals, but there were crimes committed, crimes against the > very idea of justice. > > When the U.S. Attorney told Aaron he had to plead guilty to 13 felonies for > attempting to propagate knowledge before she'd even consider a deal, that > was an abuse of power, a misuse of the criminal justice system, a crime > against justice. > > And that U.S. Attorney does not act alone. She is part of a posse intent on > protecting property not people. All over the United States, those without > access to means don't have access to justice and face these abuses of power > every day. > > It was a crime against learning when a nonprofit corporation like JSTOR, > charged with advancing knowledge, turned a download that caused no harm and > no damage into a $92 million federal case. > > And the JSTOR corporate monopoly on knowledge is not alone. All over the > United States, corporations have staked their fences on the fields of > education: for-profit colleges that steal from our veterans, nonprofit > standards bodies that ration public safety codes while paying million > dollar salaries, and multinational conglomerates that measure the worth of > scientific papers and legal materials by their gross margins. > > In the JSTOR case, was the overly aggressive posture of the Department of > Justice prosecutors and law enforcement officials revenge because they were > embarrassed thatbin their view at leastbwe somehow got away with something > in the PACER incident? Was the merciless JSTOR prosecution the revenge of > embarrassed bureaucrats because they looked stupid in the New York Times, > because the U.S. Senate called them on the carpet? > > We will probably never know the answer to that question, but it sure looks > like they destroyed a young man's life in a petty abuse of power. This was > not a criminal matter, Aaron was not a criminal. > > If you think you own something and I think that thing is public, I'm more > than happy to meet you in a court of law andbif you're rightbI'll take my > lumps if I've wronged you. But when we turn armed agents of the law on > citizens trying to increase access to knowledge, we have broken the rule of > law, we have desecrated the temple of justice. > > Aaron Swartz was not a criminal, he was a citizen, and he was a brave > soldier in a war which continues today, a war in which corrupt and venal > profiteers try to steal and hoard and starve our public domain for their > own private gain. > > When people try to restrict access to the law, or they try to collect tolls > on the road to knowledge, or deny education to those without means, those > people are the ones who should face the stern gaze of an outraged public > prosecutor. > > What the Department of Justice put Aaron through for trying to make our > world better is the same thing they can put you through. Our army isn't one > lone wolf, it is thousands of citizensbmany of you in this roombwho are > fighting for justice and knowledge. > I say we are an army, and I use the word with cause because we face people > who want to imprison us for downloading a database to take a closer look, > we face people who believe they can tell us what we can read and what we > can say. > > But when I see our army, I see an army that creates instead of destroys. I > see the army of Mahatma Gandhi walking peacefully to the sea to make salt > for the people. I see the army of Martin Luther King walking peacefully but > with determination to Washington to demand their rights because change does > not roll in on the wheels of inevitability, it comes through continuous > struggle. > > When I see our army, I see an army that creates new opportunities for the > poor, an army that makes our society more just and more fair, an army that > makes knowledge universal. > > When I see our army, I see the people who have created the Wikipedia and > the Internet Archive, people who coded GNU and Apache and BIND and LINUX. I > see the people who made the EFF and the Creative Commons. I see the people > who created our Internet as a gift to the world. > > When I see our army, I see Aaron Swartz and my heart is broken. We have > truly lost one of our better angels. > > I wish we could change the past, but we cannot. But, we can change the > future, and we must. > > We must do so for Aaron, we must do so for ourselves, we must do so to make > our world a better place, a more humane place, a place where justice works > and access to knowledge is a human right. > """ > > - Bryan > http://heybryan.org/ > 1 512 203 0507 > -- Stephen D. Williams sdw(a)lig.net stephendwilliams(a)gmail.com LinkedIn: http://sdw.st/in V:650-450-UNIX (8649) V:866.SDW.UNIX V:703.371.9362 F:703.995.0407 AIM:sdw Skype:StephenDWilliams Yahoo:sdwlignet Resume: http://sdw.st/gres Personal: http://sdw.st facebook.com/sdwlig twitter.com/scienteer _______________________________________________ FoRK mailing list http://xent.com/mailman/listinfo/fork ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] New Satphone Safety Guide
by Jacob Appelbaum 05 Jul '18

05 Jul '18

Collin Anderson: > I thought I might resurrect this extremely dead thread with an note I found > after a friend sent a copy of Alan Gross's lawsuit against USG and his > former employer. It may be of interest to a number of people on the list -- > also I would like author's title, "DCNO FOR INFORMATION DOMINANCE" (with > caps). > > http://www.public.navy.mil/bupers-npc/reference/messages/Documents/NAVADMIN… > > 5. INMARSAT BGAN DISCREET SUBSCRIBER IDENTITY MODULE (SIM) CARDS ARE > AN OPTION WHEN PURCHASING SERVICE FROM DISA. THESE DISCREET SIM > CARDS PROVIDE INCREASED OPERATIONAL SECURITY PROTECTION.* THE ONE * > *DRAWBACK IN PURCHASING A DISCRETE SIM CARD COMPARED TO A STANDARD SIM* > *CARD IS THAT CALL COMPLETION WILL BE DENIED BY THE SERVICING INMARSAT * > *WHEN OPERATING IN THE CHINA AND RUSSIA GEOGRAPHIC AREAS.* THE COST OF > THE DISCRETE SIM CARD IS THE SAME AS A STANDARD SIM CARD. IF > ALTERNATE COMMUNICATIONS ARE NOT AVAILABLE, USERS OF INMARSAT BGAN > ARE ENCOURAGED TO CONSIDER THE ADDITION OF A STANDARD SIM CARD WHEN > AN IMPORTANT OPERATIONAL CONNECTION IS NECESSARY. I found this: http://www.disa.mil/Services/SATCOM/~/media/Files/DISA/Services/SATCOM/SCO/… I guess in theory, with the ISDN module - you could have location "anonymity" limited to a given spot beam and then the CryptoPhone ISDN could be used for content confidentiality. That seems almost OK if you're able to point your transmitter directly at the bird. I'm still game to acquire one - I guess that DISA (?) won't sell me one? Will they sell them to the general public? While sorta unrelated - this seems worth mentioning: http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA493741 All the best, Jacob > > > > > On Thu, Mar 22, 2012 at 5:00 AM, Jacob Appelbaum <jacob(a)appelbaum.net>wrote: > >> On 03/21/2012 09:19 PM, Collin Anderson wrote: >>> Would anyone in this conversation be so kind as to satisfy a tangential >>> curiosity of mine. The case of Alan Gross in Cuba seems so wrapped up in >> an >>> under-explained and over-hyped piece of equipment: >>> >>> On his final trip, he brought in a "discreet" SIM card -- or subscriber >>>> identity module card -- intended to keep satellite phone transmissions >> from >>>> being pinpointed within 250 miles (400 kilometers), if they were >> detected >>>> at all. >>> >>> >>> http://www.businessweek.com/ap/financialnews/D9SSHGPG2.htm >>> >>> Beyond the obvious issues with that statement; does anyone know what they >>> are referring to? >>> >> >> Whoa - I had not caught that part of the story with Alan Gross... I >> wonder how he got his hands on the SIM? I've tried to get them and it's >> non-trivial. It requires either favors, a trade or basically a ton of >> cash from the "right" group of people. >> >> My understanding is that there are some special SIM cards that have two >> unique properties that matter for location privacy. The first property >> is that the HLR database knows that the SIM is special and so it will >> authorize a connection without a GPS location in the initial uplink. The >> second is that the device (phone, modem, etc) firmware knows that this >> SIM is special by checking some field on the SIM itself and so it won't >> send the GPS coordinates but rather the spot beam. We can easily >> discover what the field is with a SIMTrace[0] tap if we acquire one of >> these SIMs. >> >> My understanding is that the firmware still fetches the GPS coordinates. >> It then looks up the GPS location in a coverage table of all spot beams >> for the planet and then the firmware returns the spot beam where the GPS >> coordinates are located. The device then sends the spot beam into space, >> etc. >> >> A few years ago I found some public data on this and I think the company >> offering these SIMS in public is Deltawave[1] - I haven't however found >> an obvious way to buy them on their website. This is also very specific >> to BGAN and it is quite clearly a network by network, firmware by >> firmware specific information. >> >> In theory if we capture the setup with a discreet SIM with SIMTrace, we >> can MITM a normal BGAN SIM and fake a a discreet SIM response with just >> a few dollars of hardware. The network might reject it, obviously. But >> hey, if anyone has a discreet SIM sitting around, I'd be more than happy >> to see if it works in a country where it is legal to not send the GPS >> location of the device. >> >> Alternatively, one could pick a BGAN device and build a GPS MITM tool >> for the actual hardware without any such special SIM... >> >> All the best, >> Jacob >> >> [0] http://www.sysmocom.de/products/simtrace >> [1] http://www.deltawavecomm.com/ >> > > > -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Adding GPS location to IPv6 header
by William Herrin 05 Jul '18

05 Jul '18

On Mon, Nov 26, 2012 at 5:46 PM, Harald Koch <chk(a)pobox.com> wrote: > On 26 November 2012 17:36, William Herrin <bill(a)herrin.us> wrote: >> Suppose you have a large single-owner mesh network, such as a folks >> walking around with cell phones. If you want them to have a stable >> layer 3 address (and you do) then you're handling what amounts to /128 >> routes for tens of millions of devices. If you can guarantee that any >> packet *to* that address also contains a rough geographic location >> then you can discard any routes internally once they're more than a >> short geographic distance from the origin and route on the geography >> until you're close enough to find a specific /128 route. Tens of >> millions of routes is no problem if no single router needs to know >> more than a few thousand of them. >> >> By putting geographic location at layer 3, you're also handling it end >> to end which means you don't need a stateful border device to track >> the current location of all of those /128 routes. The device itself >> doesn't need to add location if it doesn't have the data; it's good >> enough for the receiving tower to attach a rough location. > This also naively assumes that wireless network topology correlates with > geographic location. Any radio engineer (or cell phone user) can explain > why that doesn't work. No. It assumes that the /128 route propagates far enough that every router (read: radio tower) operated by the service provider within the rough geographic locality has that route so that wherever the packet lands in the general area, it can make its way to the origin router currently talking to the device. It makes no assumptions about the particular path or paths between those two routers which could be terrestrial radio, satellite, wired or even a VPN across who knows what Internet path. It does set a requirement on the network architecture that at least one such path must exist: network partitions appear deadly to this architecture. I'm not saying this is a good idea. I'm just saying it's a legitimate topic for research and investigation which, if it shows any promise, would support the addition of a geolocation option header to IPv6's layer 3. By contrast, Ammar's other rationale for why to put it there (common interest at layer 7) aren't legitimate reasons for adding data to layer 3. Regards, Bill Herrin -- William D. Herrin ................ herrin(a)dirtside.com bill(a)herrin.us 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/> Falls Church, VA 22042-3004 ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Data retention in Europe
by Matej Kovacic 05 Jul '18

05 Jul '18

Hi, > or phone numbers. If so, it's interesting to note that that's exactly > what Tor is for - defeating _traffic_ analysis. Since I live in Europe, just a short explanation of this. Yes, it is about traffic data and not content. So Tor is a good solution to this. But there are some other problems as well. In US there was a case Smith v. Maryland (Smith v. Maryland, 242 U.S. 735 (1979).), which diferentiates between content of communication and traffic data. However, there is State v. Hunt decision (State v. Hunt, 91 N.J. 338, 450 A.2d 952 (1982).), which says individual can expect privacy in traffic data also. But European Court of Human Rights in 1984 (interesting date :-D) in their Malone v. Great Britain decision clearly stated that traffic data are integral part of communication. There are some legal opinions that data retention won't go through so called triple principle test. This test requires that regulation must be a) legal (prescribed by law, law must be accesible to the public) b) necessary in democratic society for the pursuit of a legitimate aim and c) proportionate to the aim pursued. It is also important to know, that European Court of Human Rights critisized so called blanket measures in other decisions as well. So - if there is no suspicion, individual should not be put under surveillance. But data retention is that - surveillance and secret tracking without prior suspicion. The other interesting thing is that this directive was prepared and adopted in very short time. How that? It is likely that some strong lobby was behind direkctive. However, this idea of extended surveilalnce is not new and is NOT the consequence of antiterrorism measures. There are some documents from 1993 which show that extension of surveillance and harmonisation of this area is not new in Europe (see Interception of communications, report to COREPER, ENFOPOL 40, 10090/93, Confidential, Brussels, 16.11.93, published on Statewatch website in 1997). Terrorism is not the reason for this. BTW: one of the latest proposals (I thik this version was also adopted) said retention of data applies to ISP's only. No cybercaffes and public places included. The question is what are you doing in cybercaffe and wha in your home. In cybercaffe you are surfing, posting on forums and checking your mail. But you are not using P2P applications. P2P applications you are using at your home. So which lobby is behind directive? Actually, there is only one lobby strong enough. This is the lobby of anti-piracy groups and industry. It is important to know, that first directive proposals stated that retention is necessariy for fight against terrorism. But then they started to talk about "serious criminal offences". What are they? They are offences, which fall under European arrest warant. The warrant applies in the following cases: a) where a final sentence of imprisonment or a detention order has been imposed for a period of at least four months or b) for offences punishable by imprisonment or a detention order for a maximum period of at least one year. Piracy and filesharing fall under European arrest warrant in some european legislations. OK, it is true, that European arrest warrant is in "crisis" since German constitutional court rejected it, but note this: "no limitation to certain types of crimes for which access is allowed". Slovenian Ministry of justice (I live in Slovenia) declared they support data retention for all crimes which should be prosecuted officially. So next step will be fighting this directive in constitutional courts and finally on the ECHR. Meantime we should propagate using Tor. bye, Matej ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [cryptography] really sub-CAs for MitM deep packet inspectors? (Re: Auditable CAs)
by Peter Gutmann 05 Jul '18

05 Jul '18

Adam Back <adam(a)cypherspace.org> writes: >Start of the thread was that Greg and maybe others claim they've seen a cert >in the wild doing MitM on domains the definitionally do NOT own. It's not just a claim, I've seen them too. For example I have a cert issued for google.com from such a MITM proxy. I was asked by the contributor not to reveal any details on it because it contains the name and other info on the intermediate CA that issued it, but it's a cert for google.com used for deep packet inspection on a MITM proxy. I also have a bunch of certs from private- label CAs that chain directly up to big-name public CAs, there's no technical measure I can see in them anywhere that would prevent them from issuing certs under any name. (An unfortunate effect of the private-label CAs is that they contain identifying information on the organisation that uses them, something I hadn't considered in my "post them to the list" request, and publishing them would publicly out your employer or organisation as doing this. So I'll modify my "post to the list" to "email them to me in private" :-). >The real question again is can we catch a boingo or corp lan or government >using a MitM sub-CA cert, and then we'll know which CA is complicit in issuing >it, and delist them. Given that some of the biggest CAs around sell private-label CA certs, you'd end up shutting down half the Internet if you did so. Peter. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Data retention in Europe
by Matej Kovacic 05 Jul '18

05 Jul '18

Hi, > or phone numbers. If so, it's interesting to note that that's exactly > what Tor is for - defeating _traffic_ analysis. Since I live in Europe, just a short explanation of this. Yes, it is about traffic data and not content. So Tor is a good solution to this. But there are some other problems as well. In US there was a case Smith v. Maryland (Smith v. Maryland, 242 U.S. 735 (1979).), which diferentiates between content of communication and traffic data. However, there is State v. Hunt decision (State v. Hunt, 91 N.J. 338, 450 A.2d 952 (1982).), which says individual can expect privacy in traffic data also. But European Court of Human Rights in 1984 (interesting date :-D) in their Malone v. Great Britain decision clearly stated that traffic data are integral part of communication. There are some legal opinions that data retention won't go through so called triple principle test. This test requires that regulation must be a) legal (prescribed by law, law must be accesible to the public) b) necessary in democratic society for the pursuit of a legitimate aim and c) proportionate to the aim pursued. It is also important to know, that European Court of Human Rights critisized so called blanket measures in other decisions as well. So - if there is no suspicion, individual should not be put under surveillance. But data retention is that - surveillance and secret tracking without prior suspicion. The other interesting thing is that this directive was prepared and adopted in very short time. How that? It is likely that some strong lobby was behind direkctive. However, this idea of extended surveilalnce is not new and is NOT the consequence of antiterrorism measures. There are some documents from 1993 which show that extension of surveillance and harmonisation of this area is not new in Europe (see Interception of communications, report to COREPER, ENFOPOL 40, 10090/93, Confidential, Brussels, 16.11.93, published on Statewatch website in 1997). Terrorism is not the reason for this. BTW: one of the latest proposals (I thik this version was also adopted) said retention of data applies to ISP's only. No cybercaffes and public places included. The question is what are you doing in cybercaffe and wha in your home. In cybercaffe you are surfing, posting on forums and checking your mail. But you are not using P2P applications. P2P applications you are using at your home. So which lobby is behind directive? Actually, there is only one lobby strong enough. This is the lobby of anti-piracy groups and industry. It is important to know, that first directive proposals stated that retention is necessariy for fight against terrorism. But then they started to talk about "serious criminal offences". What are they? They are offences, which fall under European arrest warant. The warrant applies in the following cases: a) where a final sentence of imprisonment or a detention order has been imposed for a period of at least four months or b) for offences punishable by imprisonment or a detention order for a maximum period of at least one year. Piracy and filesharing fall under European arrest warrant in some european legislations. OK, it is true, that European arrest warrant is in "crisis" since German constitutional court rejected it, but note this: "no limitation to certain types of crimes for which access is allowed". Slovenian Ministry of justice (I live in Slovenia) declared they support data retention for all crimes which should be prosecuted officially. So next step will be fighting this directive in constitutional courts and finally on the ECHR. Meantime we should propagate using Tor. bye, Matej ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [cryptography] really sub-CAs for MitM deep packet inspectors? (Re: Auditable CAs)
by Peter Gutmann 05 Jul '18

05 Jul '18

Adam Back <adam(a)cypherspace.org> writes: >Start of the thread was that Greg and maybe others claim they've seen a cert >in the wild doing MitM on domains the definitionally do NOT own. It's not just a claim, I've seen them too. For example I have a cert issued for google.com from such a MITM proxy. I was asked by the contributor not to reveal any details on it because it contains the name and other info on the intermediate CA that issued it, but it's a cert for google.com used for deep packet inspection on a MITM proxy. I also have a bunch of certs from private- label CAs that chain directly up to big-name public CAs, there's no technical measure I can see in them anywhere that would prevent them from issuing certs under any name. (An unfortunate effect of the private-label CAs is that they contain identifying information on the organisation that uses them, something I hadn't considered in my "post them to the list" request, and publishing them would publicly out your employer or organisation as doing this. So I'll modify my "post to the list" to "email them to me in private" :-). >The real question again is can we catch a boingo or corp lan or government >using a MitM sub-CA cert, and then we'll know which CA is complicit in issuing >it, and delist them. Given that some of the biggest CAs around sell private-label CA certs, you'd end up shutting down half the Internet if you did so. Peter. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-talk] Letter to A at cryptome.org
by frihetnull 05 Jul '18

05 Jul '18

Dearest A, How are you this morning, my dear? With great interest I read your question to dear John Young of Cryptome dated 8 October 2012, published here, http://cryptome.org/2012/10/tor-bradley-mannings.htm. John Young may wish to note that Tor boldly states it is from the US Navy on their Overview page, see https://www.torproject.org/about/overview.html.en. They also boldly state past funding from the US Navy on their sponsors page, see https://www.torproject.org/about/sponsors.html.en. Take a bespectacled gander at "Past Sponsors". And I quote for your reference, "DARPA and ONR via Naval Research Laboratory (2001-2006)". What a curious way to hide an affiliation. Perhaps A should call up "tor management" and ask direct questions. Contact info can be found at https://www.torproject.org/about/contact.html.en. They even list an old-fashioned telephone for direct voice to voice communications. My genitals would quiver with glee if you published this information months before Tor published the information on their website. Andrew Lewman published the financial statements and Dept of Commerce Data Collection Form on Friday, October 5, 2012, see https://lists.torproject.org/pipermail/tor-commits/2012-October/047018.html. Having recovered from a powerful conspriacy-gasm, you clicked links for half of an hour reframing these documents to sound like a fantastic conspiracy of control and puppeteering. You will also note all of these data is easily found, gathered, and published in the name of US Government transparency. The Dept of Commerce Data Collection Form gives you all the source programs one needs to learn to find this information online. You will note very few of such DCF forms are published ever. Why would Tor publish this if for not to create such an easy-to-follow trail? Rather, I think the real conspiracy is that Tor published the documents at all. Plausibly, they did so in the name of transparency and to the horror of their funding organizations. I do so applaud the Tor Project's transparency and commitment to such an ideal. They far outweigh and garner more trust than Wikileaks could ever hope to do. Now if Jacob would with Julian into the Ecuadorian embassy with Julian, the two could bro-code and have endless recursion of bro-love for life. Sadly, my genitals are left wanting for your publishing of such documents means you did not do the faintest bit of work, rather Tor did it all for you. Investigation, my dear, takes time, effort, and disclosure of something the world doesn't already know. Further, your own bro-love slave in Alan Taylor of PGPBOARD (CAPS WERE FUN IN THE 1970s SIR), selectively used copy and paste to reframe your own reframing of said financials and funding for maximal paranoia. You two are aware that Al Gore, nay, DARPA invented the Internet, correct? Your entire means of propagation is due to DARPA research and funding. Imagine the backdoors in TCP, IP, Manchester encoding, and such other protocols on which we rely every day. If you want to recover some higher probability of quivering genitals, publish Tor's 2011 990 before they do. As a former American taxpayer, I do so wish I could direct my taxes towards more projects like Tor. I much rather more Tor and Tor-like projects exist than in lieu of the United States Government spending more money on $22 billion dollar F-22 fighters that cannot fly and are easily copied by the Chinese in 50% of the time for 25% of the cost. If the US Navy and other military branches do wish to spend more money on Tor, I say godspeed sirs. All governments should spend money on Tor. Tor works, unlike smart ships, fancy jets, and other DHS/TSA boondoggles bankrupting what was once a fine society. Freedom sir, is a dish best served to all equally. Thankfully, elements within governments are funding such projects rather than simply funding more fantasies they copied from Metropolis, 1984, Brave New World, Farenheit 451, and Kallocain. I cross posted this letter to tor-talk because I know the Tor Project will publish it unredacted. Unlike sirs John and Alan who selectively edit for maximal conspiracy value. Cheers bretheren, the fight for freedom continues aghast at your apathy and ignorance. Frihet Null _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0