July 2018 - cypherpunks-legacy

Re: Kiwi expert cracks chip passport
by Peter Gutmann 06 Jul '18

06 Jul '18

"David G. Koontz" <david_koontz(a)xtra.co.nz> writes: >http://www.stuff.co.nz/4659100a28.html?source=RSStech_20080817 > >Peter Gutmann has gotten himself in the news along with Adam Laurie and >Jeroen van Beek for altering the passport microchip in a passport. The original story was actually the coverage in the UK Times last week, http://www.timesonline.co.uk/tol/news/uk/crime/article4467098.ece. It was a three-person effort, Adam Laurie did the RFID part (via RFIDIOt), Jeroen van Beek did the passport software implementation and tying the whole thing together, all I did was the signing. We never touched the passport chip, what we showed was that it's possible to create your own fictitious e-passport that's accepted as valid by the reference Golden Reader Tool. In other words we showed that what security researchers had been warning about ever since e- passports were first proposed was actually possible, following the l0pht's motto "Making the theoretical practical". Jeroen presented the work at Black Hat'08, http://www.blackhat.com/html/bh-usa-08/bh-usa-08-speakers.html#vanBeek. >http://www.stuff.co.nz/images/748842.jpg Ugh, no, make it go away. (Alert readers may notice the anomaly with the carefully-placed monitor right behind my head, which is displaying something slightly different from the surrounding sea of Vista desktops :-). It's actually a file photo from a news story from the start of last year about Vista). Peter. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

UK RIPA Pt 3
by Peter Fairbrother 06 Jul '18

06 Jul '18

The UK Home Office have just announced that they intend to bring the provisions of Pt 3 of the Regulation of Investigatory Powers Act 2000 into force on 1st October. This is the law that enables Policemen to demand keys to encrypted material, on pain of imprisonment, and without judicial approval of these demands. There is one last Parliamentary process to go through, the approval of a code of practice, but as far as I know there has never been a case of one of these failing to pass - though a related one was withdrawn a few years ago. We will try to prevent it happening, the chances of success are against us but it is not impossible. You are not required to keep keys indefinitely, or give up a key you don't have, but the rules regarding the assumption that you know a key at least partially reverse the normal burden of proof. m-o-o-t will be there on the day. m-o-o-t is a freeware live CD containing OS and applications, including an ephemerally keyed messaging service, and a steganographic file system. If anyone knows of any other technologies to defeat this coercive attack I would be glad to hear of them, and perhaps include them in m-o-o-t. -- Peter Fairbrother www.m-o-o-t.org --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Kiwi expert cracks chip passport
by Peter Gutmann 06 Jul '18

06 Jul '18

"David G. Koontz" <david_koontz(a)xtra.co.nz> writes: >http://www.stuff.co.nz/4659100a28.html?source=RSStech_20080817 > >Peter Gutmann has gotten himself in the news along with Adam Laurie and >Jeroen van Beek for altering the passport microchip in a passport. The original story was actually the coverage in the UK Times last week, http://www.timesonline.co.uk/tol/news/uk/crime/article4467098.ece. It was a three-person effort, Adam Laurie did the RFID part (via RFIDIOt), Jeroen van Beek did the passport software implementation and tying the whole thing together, all I did was the signing. We never touched the passport chip, what we showed was that it's possible to create your own fictitious e-passport that's accepted as valid by the reference Golden Reader Tool. In other words we showed that what security researchers had been warning about ever since e- passports were first proposed was actually possible, following the l0pht's motto "Making the theoretical practical". Jeroen presented the work at Black Hat'08, http://www.blackhat.com/html/bh-usa-08/bh-usa-08-speakers.html#vanBeek. >http://www.stuff.co.nz/images/748842.jpg Ugh, no, make it go away. (Alert readers may notice the anomaly with the carefully-placed monitor right behind my head, which is displaying something slightly different from the surrounding sea of Vista desktops :-). It's actually a file photo from a news story from the start of last year about Vista). Peter. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Another data point on SSL "trusted" root CA reliability (S Korea)
by Ralph Holz 06 Jul '18

06 Jul '18

Hi, > Why do we assume that government spies will go to such lengths to get > at an individual's data, when a downloaded root-kit on the target PC > suffices? Because some governments like spying on Gmail accounts. I would agree with you if your goal is to snoop on a dissident, there are easier procedures there. But if you want to detect dissent in your population, Gmail, Facebook and Twitter is what you want to check. Ralph -- Dipl.-Inform. Ralph Holz I8: Network Architectures and Services Technische Universitdt M|nchen http://www.net.in.tum.de/de/mitarbeiter/holz/ _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [drone-list] Let's see if this works!
by Chris Nicholas 06 Jul '18

06 Jul '18

I wrote my first computer program at 11 in 1971 in BASIC, and of course, it was a bombing simulator (aircraft is flying so fast, so high, drop the bomb so far away; 1/2 a t^2) My Dad was an aerospace engineer moved to California; we had a private aircraft, and I learned to fly on instruments because I couldn't see over the dashboard. I built balsa wood planes and almost lost my fingers untold times tuning up .049 engines. I did my degree in experimental physics, and worked on classified radar systems, down the hall from a bunch of people on the Tomahawk program. I supported GIS and mapping for Sun Microsystems for many years, and knew a bunch of the guys at DMA (defense mapping agency; forerunner of today's NGA..) I co-founded GlobeXplorer, now DigitalGlobe's online arm, and now work for a little company in Cupertino that starts with 'A'. A lot of us were scared shitless when selective availability, the 100m pseudo-random noise, got turned off on the GPS network, making mass, accurate positioning feasible, because we knew this day would come: DIY-drones. A *very* small payload can pack a wallop. Controlled by the wrong intentions, it can create havoc. "With great power comes great responsiblity." Chris _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Assange's claim about Tor losing US government support due to WikiLeaks
by liberationtech＠lewman.us 06 Jul '18

06 Jul '18

: I was a bit puzzled by it. So were people at : Cryptome<http://cryptome.org/2012/01/0053.htm>, : who asked Tor about it. Here is what Andrew Lewman (who's on this list) : wrote to them: To be clear, two other news organizations were as well, but only Cryptome published something. : Now, Andrew's statement is carefully worded, i.e. it does allow for the : possibility that Tor lost the USG money but they think it was not : Jacob/WikiLeaks-related. Yes, it was carefully worded. It was cryptome after all. Generally, the journalists were looking for some drama-filled story where there is none. : So it would be good to know whether a) Tor did lose some or all of USG : support between late 2010 and early 2012? and b) there is any evidence to : link this to WL, as Assange did? Tor did not lose existing funding. We applied for some funding right around the time when Jacob's volunteer activities with wikileaks were in the news. We did not get the funding. The lack of funding the proposal was not attributed to 'wikileaks', but rather lack of sufficient funds. I'm taking it at face value that we applied for some funding near the end of a fiscal year and were denied because there wasn't enough money in the budget to fund the project. : Whatever the motivation, USG cutting support to circumvention tools is a : big news item all in itself, regardless of the link to Assange. I wonder : why it wasn't more widely reported, if true - perhaps, by Tor project : itself?- because ultimately this would all be visible on Tor's financial : statements. We just started our 2011 audit, so in a few months we'll have something for public release. -- Andrew http://tpo.is/contact pgp 0x74ED336B _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

UK RIPA Pt 3
by Peter Fairbrother 06 Jul '18

06 Jul '18

The UK Home Office have just announced that they intend to bring the provisions of Pt 3 of the Regulation of Investigatory Powers Act 2000 into force on 1st October. This is the law that enables Policemen to demand keys to encrypted material, on pain of imprisonment, and without judicial approval of these demands. There is one last Parliamentary process to go through, the approval of a code of practice, but as far as I know there has never been a case of one of these failing to pass - though a related one was withdrawn a few years ago. We will try to prevent it happening, the chances of success are against us but it is not impossible. You are not required to keep keys indefinitely, or give up a key you don't have, but the rules regarding the assumption that you know a key at least partially reverse the normal burden of proof. m-o-o-t will be there on the day. m-o-o-t is a freeware live CD containing OS and applications, including an ephemerally keyed messaging service, and a steganographic file system. If anyone knows of any other technologies to defeat this coercive attack I would be glad to hear of them, and perhaps include them in m-o-o-t. -- Peter Fairbrother www.m-o-o-t.org --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Another data point on SSL "trusted" root CA reliability (S Korea)
by Ralph Holz 06 Jul '18

06 Jul '18

Hi, > Why do we assume that government spies will go to such lengths to get > at an individual's data, when a downloaded root-kit on the target PC > suffices? Because some governments like spying on Gmail accounts. I would agree with you if your goal is to snoop on a dissident, there are easier procedures there. But if you want to detect dissent in your population, Gmail, Facebook and Twitter is what you want to check. Ralph -- Dipl.-Inform. Ralph Holz I8: Network Architectures and Services Technische Universitdt M|nchen http://www.net.in.tum.de/de/mitarbeiter/holz/ _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Facebook Group Encryption Chrome Extension
by Isaac Wilder 06 Jul '18

06 Jul '18

Also means they've spent developer time identifying when their users are using encryption. Just saying. Isaac Wilder www.thefnf.org On 04/16/2012 03:56 PM, Jeffrey Burdges wrote: > It's worth mentioning that off-the-record messaging already works fine on facebook chat via facebook's jabber support. Any OtR enabled client like Jitsi, Adium, etc. should provide it happily. > > In fact, if you read the messages on facebook itself, they tactfully replace the message with > [encrypted message] > > I've no idea how they feel about encrypting wall messages with GPG or anything else, but they've spent developer time making private encrypted messages less confusing. > > Jeff > > > > > On 21 Feb 2012, at 19:05, Robert Guerra wrote: > >> Brad, >> >> A question worth considering is if - encrypting data - on Facebook's platform is a violation of their term of service. If it is, one runs the risk of having one's account disabled and/or shut down. >> >> regards >> >> Robert >> >> >> -- >> R. Guerra >> Phone/Cell: +1 202-905-2081 >> Twitter: twitter.com/netfreedom >> Email: rguerra(a)privaterra.org > _______________________________________________ > liberationtech mailing list > liberationtech(a)lists.stanford.edu > > Should you need to change your subscription options, please go to: > > https://mailman.stanford.edu/mailman/listinfo/liberationtech > > If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" > > You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech > > Should you need immediate assistance, please contact the list moderator. > > Please don't forget to follow us on http://twitter.com/#!/Liberationtech _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Freedom Hosting Owner Arrested, Tormail Compromised, Malicious JS Discovered
by Ted Smith 06 Jul '18

06 Jul '18

On Mon, 2013-08-12 at 10:30 +0200, rysiek wrote: >> > While I'm certainly not saying "I don't buy it", how does this >> > reconcile with the reality of The Silk Road still being in >> existance. >> > One would think that governments would use these techniques against >> > the site if for nothing more than to catch/punish them for all the >> tax evasion going on. > >> Yeah, that's a conundrum. >No it isn't. The government agencies that could potentially attack Tor >to bust the Silk Road would *never* care about the level of drugs moved >through it. They care about the people multiple levels above TSR, >drastically higher up in the supply chain. Is there any evidence of this? From all appearances, they care about nothing so much as preserving and expanding their funding. >Remember, TSR sends drugs *through the mail*. You can't successfully >*mail* enough drugs for the NSA/DEA to care. NSA surely doesn't want the publicity, but the DEA is always in search of positive press. If they have to listen to 100K conversations in order to bust one kid, picking up a few hundred Oxycodone pills at the Post Office, is there any reason to suspect they wouldn't do so?

1 0