July 2018 - cypherpunks-legacy

[cryptography] OT: Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security
by Jeffrey Walton 06 Jul '18

06 Jul '18

Hot off the presses (but its not limited to Android): "Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security", http://www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdf. Or should it be "The Case for Public Key Pinning"? "...The most common approach to protect data during communication on the Android platform is to use the Secure Sockets Layer (SSL) or Transport Layer Security (TLS) protocols. To evaluate the state of SSL use in Android apps, we downloaded 13,500 popular free apps from Googlebs Play Market and studied their properties with respect to the usage of SSL. In particular, we analyzed the appsb vulnerabilities against Man-in-the-Middle (MITM) attacks due to the inadequate or incorrect use of SSL. For this purpose, we created MalloDroid, an Androguard extension that performs static code analysis to a) analyze the networking API calls and extract valid HTTP(S) URLs from the decompiled apps; b) check the validity of the SSL certificates of all extracted HTTPS hosts; and c) identify apps that contain API calls that differ from Androidbs default SSL usage, e.g., contain non-default trust managers, SSL socket factories or hostname verifiers with permissive verification strategies. Based on the results of the static code analysis, we selected 100 apps for manual audit to investigate various forms of SSL use and misuse: accepting all SSL certificates, allowing all hostnames regardless of the certificatebs Common Name (CN), neglecting precautions against SSL stripping, trusting all available Certificate Authorities (CAs), not using SSL pinning, and misinforming users about SSL usage." _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[ZS] Money transfers, due process, and freedom
by Mark Nuzzolilo II 06 Jul '18

06 Jul '18

It seems like the bottleneck for any organization that wants freedom, comes down to accepting donations or payments from members. When a law is broken, there is supposed to be due process. Presumably, with the way the law is supposed to work, laws should be enforced through a lawsuit or criminal proceeding, in an actual courtroom. But what happens when the laws aren't actually broken, but someone wants to shut you down anyway? They will just tell the credit card companies and the banks to stop accepting payments for that vendor. So we have a situation where due process is sidestepped. But it's likely that the government isn't even the problem here, but the banks themselves (more later). While I don't condone breaking any laws, the fact remains that power is being abused in this way in a perversion of justice. There is a concrete example of this here, where Fetlife.com got screwed by a payment processor, who claims there were illegal images (the images in question were actually a simpsons cartoon, and a picture of a dog): http://ft.trillian.im/30a23cd835c1a6834bcb6c7b2740649b0f2aaf28/6egJy16qp1Fh… http://ft.trillian.im/30a23cd835c1a6834bcb6c7b2740649b0f2aaf28/6egJWdWX2OcB… We have some Bitcoin experts here. Bitcoin, as we know, cannot be regulated by the banks. But because our financial system is largely dependent on these banks and credit cards, there needs to be a way to connect these two systems together in such a way where to get that money into the Bitcoin system. The currency itself is relatively viable, but the financial system just isn't there. Any attempt to set up an anonymous payment processor will likely result in some sort of termination by any mainstream bank that is used. And for what reason? Even without any proof of wrongdoing, or any due process, the banks will do what they can to shut down any financial processor that operates outside their realm of influence. So how do we overthrow this cartel? We would need a smoothly operating financial system that would need to reach enough critical mass where it could be completely outside the influence of the banking elite. Credit card payments would still be necessary. We would need some sort of abstraction layer between the point where a user enters in their payment information, and where a payment is made to its destination. Assume that the banks will close it off, but think about this, it's easy to turn off one valve, but how easy is it to turn off 10,000 valves at once? A swarm of financial channels could be used, and only one of them would actually have to be operational for the system to succeed. And the money that could be made from such a system would be astounding. This would be a great Zero State project to have, definitely worthy of having the need for secrecy, while still not breaking any actual laws. We have the technological smarts to get something like this in the works. Has it really been tried before? Here is a "Bitcoin Bank" but they don't even accept anything other than Bitcoins, which doesn't solve the problem at all: http://www.flexcoin.com/ -- -- Zero State mailing list: http://groups.google.com/group/DoctrineZero --- You received this message because you are subscribed to the Google Groups "Doctrine Zero" group. To unsubscribe from this group and stop receiving emails from it, send an email to DoctrineZero+unsubscribe(a)googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

The Son of Patriot Act Also Rises
by Gregory Hicks 06 Jul '18

06 Jul '18

Dave: For IP if you wish... Regards, Gregory hicks >From the Dartmouth list "Security in the News" http://www.wired.com/news/privacy/0,1848,63800,00.html Elements of a Justice Department draft legislation known as "Patriot Act II", widely criticized when news about it was released in 2003, are making their way into the law books as minor provisions of other bills. For example, the Anti-Terrorism Intelligence Tools Improvement Act of 2003 (HR 3179) contains four sections that appeared in the Patriot II draft, establishing five-year prison terms for anyone who discloses Patriot Act requests for information made by the FBI (Federal Bureau of Investigation). Former Representative Bob Barr (R-Georgia) says the Justice Department has been asking sympathetic lawmakers to slip elements of Patriot II into other legislation. Proponents of HR 3179 says the provisions merely address holes in the original Patriot Act; the Act made it illegal to disclose FBI Patriot Act searches, but specified no penalty. Opponents counter that it strengthens already overly broad search and seizure powers for the government while denying citizens the right to petition for a redress of grievances. ------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3400 San Jose, CA 95134 | Internet: ghicks(a)cadence.com I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[IP] The Son of Patriot Act Also Rises
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: Big brother would be envious...
by David P. Reed 06 Jul '18

06 Jul '18

MIT policy requires that the Committee on the Use of Humans in Experimental Studies (COUHES) approve all such experiments. The experiments described are "opt-in" with "informed consent" when carried out at MIT. No one is required to participate. Yet I agree that carrying out such experiments in corporate settings (including MIT) are fraught with concerns. That said, this is a future that is already here. Your laptop and phone have live microphones and cameras, and phones report their geographic position to carriers, where the logs are recorded in corporate databases for months or years, and can be subpeonaed (hopefully with probable cause, as is the case in Massachusetts state courts, but not in FBI National Security Letters). Don't shoot the messenger (MIT students). They are just adapting to the reality that we grownups have constructed for them. The law doesn't provide for any of the desired privacy rights. If you carry a phone or corporate laptop, and it turns on its microphone based on a remote command from either the NSA or a botnet, *it is not illegal*. The phone company owns the phone, your employer owns the laptop, and the legal precedents are not in the users' favor. In the case of corporate laptops, it is claimed that corporations are REQUIRED to monitor and record employee communications, because of precedents that hold them liable for sexual and racial harassment. In the case of private cellphones, you don't hold the radio license or the software license. The carrier does, and under NSL regime today, it can be required to capture and search - without any requirement to notify you. So, you are screwed. I wish that were not the case, myself. But don't assume *anyone* in the US Gov't, including your Senators and Representatives, will come to your aid. If you live in Massachusetts, your state might. But in other states, you are on your own. ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Dewayne-Net] Re: Big brother would be envious...
by dewayne＠warpspeed.com 06 Jul '18

06 Jul '18

[Note: This item comes from reader David Reed. DLH]

1 0

[IP] Re: Big brother would be envious...
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

The Son of Patriot Act Also Rises
by Gregory Hicks 06 Jul '18

06 Jul '18

Dave: For IP if you wish... Regards, Gregory hicks >From the Dartmouth list "Security in the News" http://www.wired.com/news/privacy/0,1848,63800,00.html Elements of a Justice Department draft legislation known as "Patriot Act II", widely criticized when news about it was released in 2003, are making their way into the law books as minor provisions of other bills. For example, the Anti-Terrorism Intelligence Tools Improvement Act of 2003 (HR 3179) contains four sections that appeared in the Patriot II draft, establishing five-year prison terms for anyone who discloses Patriot Act requests for information made by the FBI (Federal Bureau of Investigation). Former Representative Bob Barr (R-Georgia) says the Justice Department has been asking sympathetic lawmakers to slip elements of Patriot II into other legislation. Proponents of HR 3179 says the provisions merely address holes in the original Patriot Act; the Act made it illegal to disclose FBI Patriot Act searches, but specified no penalty. Opponents counter that it strengthens already overly broad search and seizure powers for the government while denying citizens the right to petition for a redress of grievances. ------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3400 San Jose, CA 95134 | Internet: ghicks(a)cadence.com I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[IP] The Son of Patriot Act Also Rises
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: Big brother would be envious...
by David P. Reed 06 Jul '18

06 Jul '18

MIT policy requires that the Committee on the Use of Humans in Experimental Studies (COUHES) approve all such experiments. The experiments described are "opt-in" with "informed consent" when carried out at MIT. No one is required to participate. Yet I agree that carrying out such experiments in corporate settings (including MIT) are fraught with concerns. That said, this is a future that is already here. Your laptop and phone have live microphones and cameras, and phones report their geographic position to carriers, where the logs are recorded in corporate databases for months or years, and can be subpeonaed (hopefully with probable cause, as is the case in Massachusetts state courts, but not in FBI National Security Letters). Don't shoot the messenger (MIT students). They are just adapting to the reality that we grownups have constructed for them. The law doesn't provide for any of the desired privacy rights. If you carry a phone or corporate laptop, and it turns on its microphone based on a remote command from either the NSA or a botnet, *it is not illegal*. The phone company owns the phone, your employer owns the laptop, and the legal precedents are not in the users' favor. In the case of corporate laptops, it is claimed that corporations are REQUIRED to monitor and record employee communications, because of precedents that hold them liable for sexual and racial harassment. In the case of private cellphones, you don't hold the radio license or the software license. The carrier does, and under NSL regime today, it can be required to capture and search - without any requirement to notify you. So, you are screwed. I wish that were not the case, myself. But don't assume *anyone* in the US Gov't, including your Senators and Representatives, will come to your aid. If you live in Massachusetts, your state might. But in other states, you are on your own. ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0