July 2018 - cypherpunks-legacy

Re: wikileaks unreachable
by Jorge Amodio 06 Jul '18

06 Jul '18

> 'they' is a multicast address ... dyn/everydns or wikileaks? which is > the 'they' that is doing the twittering? wikileaks. seems that they (wikileaks) got the message, following tweets included their IP address and the new .ch domain. The current IP address for the cablegate stuff is 213.251.145.96 which is RIPE block assigned to wikileaks, the RIPE WHOIS entry shows 213.251.128.0/18 with AS16276 as originwhois AS16276 (OVH in Paris France), mtr from here (SATX) seems to go through Dallas and enter Global Crossing network or hosting services, currently <2% packet loss. Server seems to be configured to return IP address based URLs. -J ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: wikileaks unreachable
by Jorge Amodio 06 Jul '18

06 Jul '18

> 'they' is a multicast address ... dyn/everydns or wikileaks? which is > the 'they' that is doing the twittering? wikileaks. seems that they (wikileaks) got the message, following tweets included their IP address and the new .ch domain. The current IP address for the cablegate stuff is 213.251.145.96 which is RIPE block assigned to wikileaks, the RIPE WHOIS entry shows 213.251.128.0/18 with AS16276 as originwhois AS16276 (OVH in Paris France), mtr from here (SATX) seems to go through Dallas and enter Global Crossing network or hosting services, currently <2% packet loss. Server seems to be configured to return IP address based URLs. -J ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Diginotar broken arrow as a tour-de-force of PKI fail
by Marsh Ray 06 Jul '18

06 Jul '18

Preliminary report on-line: > http://www.rijksoverheid.nl/documenten-en-publicaties/rapporten/2011/09/05/… - Marsh _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Politech] Why the cybercrime treaty is privacy-invasive and worrisome, by James Plummer [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

Politech coverage from two months ago: http://www.politechbot.com/2005/11/29/fuzzy-logic-behind/ http://www.politechbot.com/2005/11/30/cybercrime-treaty-before/ -------- Original Message -------- Subject: for POLITECH - Cybercrime treaty Date: Mon, 30 Jan 2006 11:48:38 -0500 From: James Plummer <jplummer76(a)gmail.com> Reply-To: jplummer(a)libertycoalition.net To: declan(a)well.com Declan, I wanted to send you a copy of a piece I wrote last month for Human Events Online about the Convention on Cybercrime for Politech. I don't think this issue is getting enough attention in the "electronic civil liberties" community. If any of your readers want to get more involved in this issue, I invite them to please contact me. ------------------------ *Senate Must Reject Cybercrime Treaty* by James Plummer Posted Dec 08, 2005 An internationalist assault on the sovereignty of the United States and the privacy of U.S. citizens is currently awaiting action by the full Senate. The Council of Europe Convention on Cybercrime is being aggressively pushed by Senate Foreign Relations Chairman Richard Lugar (R.-Ind.), who reported the treaty out from his committee in early November. That should come as little surprise, in that Lugar has also been a leading proponent of the better-known Law of the Sea Treaty (LOST), another key building-block in the structure of world government. Originally conceived as a tool to facilitate international cooperation in the pursuit of computer hackers and the like, the Cybercrime Treaty evolved during 15 years of negotiations to encompass any criminal offense that involves electronic evidence -- which in the 21st century is essentially limitless. As written, it could require more surveillance on Americans who have been accused of violating the laws of foreign countries -- even if they haven't violated U.S. law. Treaty cheerleaders paint menacing pictures of hackers and child pornographers. But in reality the Convention is drafted so broadly that it encompasses virtually every area of law where the possibility exists of computerized evidence. That could affect thousands of innocent people, including not only political dissidents, but also the politically incorrect. Fortunately, one heroic, albeit currently anonymous, conservative senator has placed a "hold" on this Cybercrime Convention, a procedural maneuver that prevents an immediate, unannounced vote on the floor of the whole Senate. Conservatives concerned with sovereignty and the Bill of Rights need to both become aware and raise others' awareness of the dangers posed by the Cybercrime Treaty, lest the Senate acquiesce in this subjugation of Americans to European-style "hate speech" laws through an electronic back door. Lugar's pro-treaty rhetoric belies the broad, expansionary nature of the treaty. He claimed last year, in opening the sole hearing on the treaty, that "Prompt ratification . . . will help advance the security of Americans." That is simply not the case when one considers that the treaty could allow European or even Chinese Communist agents to electronically spy on innocent Americans. And make no mistake, greater control over what we do on the Internet is the goal of the Eurocrats so enamored with global government. This is what Council of Europe Deputy Secretary General Maud de Boer-Buquicchio had to say in mid-November at the "World Summit on the Information Society," hosted by that great human rights champion, Tunis: "The Information Society is clearly in need of a global governance mechanism. The Council of Europe, with its unchallenged human rights expertise, political consultation structures, and solid relationship with civil society, must be party to discussions undertaken at every step of the way concerning internet governance and human rights," she said. The European view of "human rights" includes the shielding from mere criticism of certain protected minorities such as abortionists, third-world immigrants, and homosexuals. The London Times reports that the European Commission has announced its first list of mandatory continent-wide criminal laws and will soon seek to add speech-based crimes such as incitement to hatred to the list. (France has in the past fined California's Yahoo! for an American customer's auction of a vintage Nazi war medal.) De Boer-Buquicchio and other Eurocrats regard the Cybercrime Treaty as one of those "global governance mechanisms" by which to enforce these views. She even went on to press for greater ratification of the Cybercrime Treaty in the very same speech. And so it is no wonder that many leading conservatives have called on the Senate to hold serious, open hearings on this treaty. Leaders from American Conservative Union, Eagle Forum, and Free Congress Foundation, among others, wrote to the Senate in June urging real hearings on these important concerns. But despite these concerns, Lugar has put the treaty on the Senate calendar without conducting serious, probative hearings or investigations, calling only *pro forma* hearings and inviting only treaty supporters from the Justice and State Departments to testify. It's little wonder that the hearings were rigged. An open discussion of the issues at stake could cause many senators to cast a skeptical eye on the treaty, raising as it does many bipartisan concerns similar to those that have stalled expansion of the USA PATRIOT Act in the upper body as of late. Though the treaty is replete with mutual assistance in electronic surveillance, not one of the articles mention privacy. Most egregious in Lugar's ratification report to the full Senate is the voluntary declaration that foreign governments, under the fig leaf of "urgency," be able to order American law enforcement agencies to enforce their orders without judicial review. So even though these foreign orders may be opposition to the U.S. Constitution, no U.S. judge will be able to enforce the Constitution to prevent it. The treaty also has no "dual criminality" requirement, which means federal law enforcement agencies could be investigating Americans for constitutionally-protected activities which offend European sensibilities. Even worse, the Cybercrime Treaty is open to all nations to ratify. That means a future leftist President could even allow Communist China to sign on to the treaty and direct U.S. law enforcement to investigate Chinese dissidents, even Americans, based in the United States. The Convention on Cybercrime would be highly detrimental to American sovereignty and free people everywhere. The Senate should under no circumstances blindly approve such a document. ------------------------------ Copyright (c) 2006 HUMAN EVENTS. All Rights Reserved. -- James Plummer Policy Director Liberty Coalition jplummer(a)libertycoalition.net _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [cryptography] Diginotar broken arrow as a tour-de-force of PKI fail
by Marsh Ray 06 Jul '18

06 Jul '18

Preliminary report on-line: > http://www.rijksoverheid.nl/documenten-en-publicaties/rapporten/2011/09/05/… - Marsh _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[cryptography] London Hum Used to Timestamp Recordings
by mheyman＠gmail.com 06 Jul '18

06 Jul '18

>From <http://tech.slashdot.org/story/12/12/14/0229248/electrical-grid-hum-used-to…> "It appears that the Metropolitan Police in London have been recording the frequency of the mains supply for the past 7 years. With this, they claim to be able to pick up the hum from any digital recording and tell when the recording was made. From the article: 'Comparing the unique pattern of the frequencies on an audio recording with a database that has been logging these changes for 24 hours a day, 365 days a year provides a digital watermark: a date and time stamp on the recording.'" I hope they kept that recording secret. Anybody can start recording now and then backdate things like recorded verbal agreements. ---- -Michael Heyman _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[liberationtech] Introducing 'Tent' - The decentralized social web
by Yosem Companys 06 Jul '18

06 Jul '18

The founder is a friend of the late Ilya Zhitomirskiy and a member of this list... YC "Introducing 'Tent' - The decentralized social web" http://j.mp/Q0eDjz (tent.io) "Tent is a new protocol for open, distributed social networking. What we believe - The Tent Manifesto What makes Tent different? Tent is decentralized, not federated or centralized. Any Tent server can connect to any other Tent server. All features are available to any server as first-class citizens. Anyone can host their own Tent server. Tent servers can also be run as Tor hidden services to create a social darknet for at-risk organizers and activists. Anyone can write applications that connect to Tent in order to display or create user content. Relationships are between users, independent of their service providers, so users take their data and relationships with them when they change Tent service providers. Every user decide which other users can follow them and what information will be shared with each of their followers." -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [p2p-hackers] Pirate Pay
by Tom Ritter 06 Jul '18

06 Jul '18

On 14 May 2012 18:48, James A. Donald <jamesd(a)echeque.com> wrote: > Some design characteristics: > > *. Peers are identified by a durable public key. > > *. Peers interact with keys they do not trust, but expect protocol > conformance and prosocial behavior only from keys they trust. Peers limit > their exposure to non trusted keys so that they can suffer only limited > damage from non trusted keys deviating from protocol or otherwise > misbehaving. > > *. Peers may not only trust Bob, but transitively everyone Bob trusts, and > everyone that those peers trust ... If this works, they increase their > transitive trust in Bob, if it fails they decrease their transitive trust. > > *. Prosocial behavior consists of conforming to protocol, storage > availability, with valuable, or at least demanded, stuff in storage and > accessible on demand, and paying ones bandwidth and storage debts. Since > networks are unreliable, perfect protocol conformity is never expected or > demanded, but the burden that one's deviations from protocol place on other > peers counts against one's karma. Hm. I'm not sure how to bootstrap when you only want to interact with people you trust - but it seems like this could be a model for a Web of Trust that grows over time if you have a way to validate what people are supposed to be sending. I am Alice and I interact with 1000 other people, Bobs1-1000, who send me pieces of a file. They're valid, so I sign their public keys saying they were good for some number of bytes, send them the signature, but also keep it locally. I send data to 50 other people, Carols1-50 who in turn give me signatures. Over time, I interact with Bob50 again, and trust him based on my previous signature. I find a Dave, who I trust a little because he has a signature from Bob600, and Bob600 was good to me. The key pieces (and why this couldn't work for distributed DNS) are that I know that Bob[x] sent me is valid because I have the information to build a merkle tree and validate his piece. The more I download, the more people I 'trust' because they were honest actors last time. The more I upload, the more people 'trust' me because I acted honestly in the past. But I may have reinvented something simple or missed an obvious flaw, because I'm not well-versed in how DHT works, or anything published in this area. -tom _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[silk] Blackberry in India
by Gautam John 06 Jul '18

06 Jul '18

http://economictimes.indiatimes.com/At_last_govt_cracks_BlackBerry_code/art… At last, govt cracks BlackBerry code 22 Sep, 2008, 0121 hrs IST,Niranjan Bharati, ET Bureau NEW DELHI: The government has decrypted the data on Research In Motion's (RIM) BlackBerry networks. The department of telecommunication (DoT), Intelligence Bureau and security agency National Technical Research Organisation (NTRO) have done tests on service providers such as Bharti Airtel, BPL Mobile, Reliance Communications and Vodafone-Essar networks for interception of Internet messages from BlackBerry to non-BlackBerry devices. Initially, there were difficulties in cracking the same on Vodafone-Essar network but that has also been solved. This means that the e-mail messages sent on Internet through your BlackBerry sets would no longer be exclusive and government would be able to track them. "Decompression is being tested in operator's network with three successful testing on Bharti Airtel, Reliance Communication and BPL Mobile," a source in DoT said. He, however, added that the solution reached upon would not be shared with anybody including the national telecom service providers like BSNL or MTNL. "The test is being conducted wholly for non-enterprise solutions," he said. The Union cabinet has also been apprised of the recent developments by the DoT. Makers of BlackBerry set, RIM, could not be contacted for comment. An e-mail sent in this regard the company did not elicit any response till the time of going for press. An official in Vodafone-Essar, however, on conditions of anonymity said that there has been substantial progress in decoding the BlackBerry encryptions and DoT has got success on decompressing the data on the networks of all the major service providers. The test would be conducted on all the network of all the BlackBerry service providers and the service providers, on whose network the interception does not happen smoothly, would be asked to make technical changes in their services to make them compatible for decompression. Decompression is the process of decoding information with an aim to transfer the data to a different medium like data to voice, data to video or data to text. The DoT had earlier asked RIM to provide the master key to allow access to contents transferred over their handsets. RIM had, however, said that it could not handover the message encryption key to the government as its security structure does not allow any third party or even the company to read the information transferred over its network. The BlackBerry issue surfaced earlier this year when DoT asked Tata Tele-services to delay the launch of the service till appropriate security mechanisms were in place. Currently, there are over one lakh BlackBerry users in the country. Bharti Airtel, Reliance Communications, Vodafone Essar and BPL Mobile are offering this service in the country. Tata Teleservices has also been allowed to offer the BlackBerry services recently. Incidentally, Tata Teleservices launched the service after telecom secretary Siddhartha Behura said that the government has no role in stopping the company from offering the service. -- Please read our new blog at: http://blog.prathambooks.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Client Certificate UI for Chrome? [OT anonymous-
by Ray Dillinger 06 Jul '18

06 Jul '18

transaction bull***t] [Moderator's note: this is getting a bit off topic, and I'd prefer to limit followups. --Perry] On Wed, 2009-08-19 at 06:23 +1000, James A. Donald wrote: > Ray Dillinger wrote: >> If there is not an existing relationship (first time someone >> uses an e-tailer) then there has to be a key depository that >> both can authenticate to, with a token authorizing their >> authentication to authenticate them to the other, which then >> vouches to each for the identity of the other. > > Actually not. > > What the seller wants to know is that the buyer's money is good, not > what the true name of the buyer is - a service provided by Visa, or > Web-money, or some such. No. This juvenile fantasy is complete and utter nonsense, and I've heard people repeating it to each other far too often. If you repeat it to each other too often you run the risk of starting to believe it, and it will only get you in trouble. This is a world that has not just cryptographic protocols but also laws and rules and a society into which those protocols must fit. That stuff doesn't all go away just because some fantasy-world conception of the future of commerce as unlinkable anonymous transactions says it should. In any transaction involving physical goods, the seller also wants to know to whom to ship the product. Since the laws in most nations do not require the recipient of an erroneous shipment to return the goods and *do* require the seller to give back the buyer's money if the shipment doesn't go where the buyer wants it, sellers really care that the correct recipient will receive the package and really need some way to contact the buyer in case there's a mistake about the recipient address or identity. Otherwise you'd get people playing silly buggers with the shipping address to get out of paying for million-dollar equipment. The law usually requires that the recipient of defective goods or services has the ability to return those goods for a refund or obtain a refund in the event of seller nonperformance of services or nonshipment of goods. Since such returns can be used to launder money from illegal enterprises, laws usually restrict anonymous returns. Therefore the seller needs the buyer's (or client's) identity in order to comply with the law. In information-based transactions involving IP that's subject to copyright or trade secret protection (which is effectively all of them since other IP can be had for free) the seller also wants to know who is the licensee that's bound by the terms of the license and who now poses a "risk" of copyright breakage. In both cases this is a liability taken on by the buyer, and not something that his "money being good" for just the transaction price can ameliorate. In financial transactions The seller also wants to know that s/he can comply with, eg, "know your customer" laws and avoid liability for gross negligence in, eg, money laundering cases. In many transactions the seller wants the buyer's identity and a liability waiver signed by the buyer so as to keep track of or avoid liability for what the customer is going to do with his/her products. Most sellers want the ability to offer the buyer credit terms, especially when large sums are involved. And even where money is supposedly firm (like the money Bernie Madoff's clients had in their accounts) it is subject to catastrophic vanishment in extraordinary circumstances. The seller needs to know whom to sue or at least whose name to put on the forms for their insurance claim if contrary to expectations the buyer's money turns out not to be good. If the cert authority does not provide the identity of the buyer but asserts that the buyer's money is good, and this turns out not to be true (as in the case of Madoff's clients), then in most legal systems the cert authority is either liable, or can expect to be sued in a very expensive empirical test of liability. So the cert authority doesn't want to be in the business of vouching for the ability of anonymous people to pay. The only way for the money to be truly firm for these purposes is that the cert authority has it in escrow. This makes the cert authority a financial institution and therefore subject to "know your customer" mandatory reporting, data retention laws, subpeonas, and so on. Also, it introduces a needless delay and complication to the transaction that legitimate buyers and sellers would mostly rather not have. Also, in any large transaction the seller or cert authority or both must retain buyer identity information in order to be able to comply with subpeonas, inquests, or equivalent writs, for periods ranging from zero in a few undeveloped african nations to five years in much of the rest of the world. In most of the nations on earth, there is such a thing as sales tax or use tax on goods or services, and any transaction involving more than a tiny sum must be reported (with the names of buyer and seller) to relevant tax authorities. Even tiny transactions must be reported in aggregate, although these usually don't require the buyers' names. Since the seller has the legal obligation to report, s/he also has the legal obligation to collect identity information from his/her clients. Most nations are very sensitive about cross-border money flows, have tax laws that apply specifically to international transactions, and want to know such things as the buyer and seller identity. In this case it is the legal obligation of both buyer and seller in international transactions to collect whatever information their particular nation requires them to have and report it according to their particular nation's laws. And so on. Maybe in a cypherpunk world where there are no laws other than the natural laws of mathematics, no physical world in which goods have to be manufactured and delivered, no national borders or third parties having a tax or legal interest in transactions, no information other than valuable secrets subject to no post-sale copyrights or licensing, no liability laws or customers-rights laws whatsoever, no taxation, and a bunch of other bizarro-world conditions, the seller would not need anything more than the knowledge that the buyer's money was good. But that's like proving that a pig can fly starting from an assumption of an ideal, spherical pig of zero mass. It is not the world in which we live, unless we are black-marketeers in international waters, not subject to the laws of any nation. If you make it "optional" - where people can request a true name etc when they need it to comply with law, but don't have to request it otherwise - you will find that the number of sellers willing to do business with anonymous buyers, and the number of transactions in which they legally can do business with anonymous buyers, starts low and then drops rapidly as legal troubles and scams of various kinds, as well as new laws designed to prevent those troubles and scams, catch up to the sellers. Anyway, nothing's preventing you from building your "unlinkable" cert system to compete with other forms of commerce. But in the presence of any other system whatsoever, I expect almost no one to use it and predict that using it or running services that allow people to use it will rapidly become illegal in all developed nations. > Again, you are trying to inject a certificate authority into the > middle > of a relationship where it is just not very useful. Perhaps there are other ways to achieve all of the requirements for a system that people can use while complying with applicable laws. I cannot think of a simpler or more useful one. > Ebay does not care > about true names. Aside from being irrelevant because ebay does not function as a buyer or seller, and only minimally as a cert authority in their client's auctions (in particular they do NOT vouch for anyone's ability to pay), this is blatantly false. Ebay cares about true names, and linkable information such as bank account numbers. Without them it won't let you use its payment system. Also, try funding an ebay seller's account using just cash somehow and tell me how it goes. It used to be possible but it's been several years since the law bounced on ebay for allowing that and commanded them to collect true name information from all sellers. Also remember ebay has to collect its fee from somebody and until the auction's conclusion doesn't know how large that fee is going to be. They insist on knowing who that somebody is. Bear --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0