July 2018 - cypherpunks-legacy

[liberationtech] Fw: Biometrically locked external hard drive!
by Nick M. Daly 05 Jul '18

05 Jul '18

I received this email earlier today and thought the list might enjoy the references. Taken together, they make a good warning. I'd appreciate it if folks could provide other suggestions for keeping data safe. D. writes: > This has you written all over it. > > http://www.macworld.com/article/2035461/review-aegis-bio-3-0-hard-drive-ide… > >> The pocket-sized hard drive comes with a built-in fingerprint scanner >> than helps alleviates any worries of unapproved access to the >> drive. Fingerprint access might sound like a bit of a novelty, but >> from a security standpoint it actually makes sense; passwords can be >> crackedbfingerprints, not so much. Thank Pete fingerprints are so hard to acquire that not even law enforcement can pull them from crime scenes, make copies, and scan them into some kind of giant national database: http://www.fbi.gov/about-us/cjis/fingerprints_biometrics/iafis/iafis Thank Pete it's so difficult to copy a fingerprint that three amateurs can't do it: https://en.wikipedia.org/wiki/MythBusters_%282006_season%29#Fingerprint_Lock Thank Pete most materials, especially glass, plastic, or any smooth surface, like those found on our electronics, or even paper, can't record a fingerprint for later retrieval: http://www.theregister.co.uk/2008/03/30/german_interior_minister_fingerprin… Keep in mind who you're protecting yourself from. I'd rely on passwords or, if I was really concerned, some sort of encryption key kept on some sort of external drive with a password: http://johnsonyip.com/wordpress/2010/05/01/make-a-key-file-for-truecrypt-vo… Sorry, but I had to. :) -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Cryptography super-group creates unbreakable encryption
by Joseph Lorenzo Hall 05 Jul '18

05 Jul '18

looks like the Silent Circle code is up on github? https://github.com/SilentCircle -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] FBI Preps Award for Biometric Database - New York Times
by David Farber 05 Jul '18

05 Jul '18

[1]The New York Times _________________________________________________________________ February 5, 2008 FBI Preps Award for Biometric Database By THE ASSOCIATED PRESS Filed at 10:37 a.m. ET WASHINGTON (AP) -- Lockheed Martin, Northrop Grumman and [2]IBM are vying for a multibillion-dollar contract to build a database for fingerprints and other biometric information that the FBI is set to award this week. [3]Lockheed Martin Corp. built and maintains the FBI's current 10-fingerprint database and some analysts consider the nation's largest defense contractor the favorite to win the Next Generation Identification system contract mainly due to its incumbent status. But because the new system is expected to include other identifiers, including palm prints, iris scans and facial recognition, the teams led by [4]Northrop Grumman Corp. and [5]International Business Machines Corp. remain strong contenders, said Stanford Group Co. analyst Jeremy Grant. Northrop's team includes [6]BearingPoint Inc., [7]General Dynamics Corp. and [8]Raytheon Co. An FBI spokesman on Tuesday said the contract is expected to be awarded this week but would not disclose its financial or other terms. The deal is viewed as a major upgrade to the FBI's Integrated Automated Fingerprint Identification System and should help the agency more easily share data supporting anti-terrorism efforts with domestic government offices and international partners. It will include data on known criminals and terrorists, as well as information on foreign visitors to the U.S. whose fingerprints and digital photographs were collected under a separate [9]Department of Homeland Security program that monitors people entering the U.S. via air, land and sea. Privacy advocates, however, say Congress must ensure that the FBI system will not infringe on citizens' rights before the government spends more than a billion dollars on it. ''This system is not ready for prime time,'' said Marc Rotenberg, executive director of the Electronic Privacy Information Center. ''Congress must ask tough questions about the impact on the privacy rights of Americans.'' [10]Home * [11]World * [12]U.S. * [13]N.Y. / Region * [14]Business * [15]Technology * [16]Science * [17]Health * [18]Sports * [19]Opinion * [20]Arts * [21]Style * [22]Travel * [23]Jobs * [24]Real Estate * [25]Automobiles * [26]Back to Top [27]Copyright 2008 The Associated Press * [28]Privacy Policy * [29]Search * [30]Corrections * [31]RSS * [32]First Look * [33]Help * [34]Contact Us * [35]Work for Us * [36]Site Map [&t=&s=0&ui=0&r=http%3a%2f%2fwww%2enytimes%2ecom%2fapo nline%2ftechnology%2fAP%2dFBI%2dBiomterics%2dContract%2ehtml&u=www %2enytimes%2ecom%2faponline%2ftechnology%2fAP%2dFBI%2dBiomterics%2dCon tract%2ehtml%3fpagewanted%3dprint] _________________________________________________________________ [37]Archives [38][feed-icon-10x10.jpg] [39]Powered by Listbox References 1. http://www.nytimes.com/ 2. http://topics.nytimes.com/top/news/business/companies/international_busines… 3. http://topics.nytimes.com/top/news/business/companies/lockheed_martin_corpo… 4. http://topics.nytimes.com/top/news/business/companies/northrop_grumman_corp… 5. http://topics.nytimes.com/top/news/business/companies/international_busines… 6. http://www.nytimes.com/mem/MWredirect.html?MW=http://custom.marketwatch.com… 7. http://topics.nytimes.com/top/news/business/companies/general_dynamics_corp… 8. http://topics.nytimes.com/top/news/business/companies/raytheon_company/inde… 9. http://topics.nytimes.com/top/reference/timestopics/organizations/h/homelan… 10. http://www.nytimes.com/ 11. http://www.nytimes.com/pages/world/index.html 12. http://www.nytimes.com/pages/national/index.html 13. http://www.nytimes.com/pages/nyregion/index.html 14. http://www.nytimes.com/pages/business/index.html 15. http://www.nytimes.com/pages/technology/index.html 16. http://www.nytimes.com/pages/science/index.html 17. http://www.nytimes.com/pages/health/index.html 18. http://www.nytimes.com/pages/sports/index.html 19. http://www.nytimes.com/pages/opinion/index.html 20. http://www.nytimes.com/pages/arts/index.html 21. http://www.nytimes.com/pages/style/index.html 22. http://travel.nytimes.com/pages/travel/index.html 23. http://www.nytimes.com/pages/jobs/index.html 24. http://www.nytimes.com/pages/realestate/index.html 25. http://www.nytimes.com/pages/automobiles/index.html 26. file://localhost/tmp/mutt.html#top 27. http://www.ap.org/ 28. http://www.nytimes.com/privacy 29. http://query.nytimes.com/search/advanced/ 30. http://www.nytimes.com/corrections.html 31. http://www.nytimes.com/rss 32. http://firstlook.nytimes.com/ 33. http://www.nytimes.com/membercenter/sitehelp.html 34. http://nytimes.com/ref/membercenter/help/infoservdirectory.html 35. https://careers.nytco.com/TAM/nyt_docs/TAM/candidate.html 36. http://spiderbites.nytimes.com/ 37. http://v2.listbox.com/member/archive/247/=now 38. http://v2.listbox.com/member/archive/rss/247/ 39. http://www.listbox.com/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: nym-0.2 released (fwd)
by cyphrpunk 05 Jul '18

05 Jul '18

A few comments on the implementation details of http://www.lunkwill.org/src/nym/: 1. Limting token requests by IP doesn't work in today's internet. Most customers have dynamic IPs. Either they won't be able to get tokens, because someone else has already gotten one using their temporary IP, or they will be able to get multiple ones by rotating among available IPs. It may seem that IP filtering is expedient for demo purposes, but actually that is not true, as it prevents interested parties from trying out your server more than once, such as to do experimental hacking on the token-requesting code. I suggest a proof of work system a la hashcash. You don't have to use that directly, just require the token request to be accompanied by a value whose sha1 hash starts with say 32 bits of zeros (and record those to avoid reuse). 2. The token reuse detection in signcert.cgi is flawed. Leading zeros can be added to r which will cause it to miss the saved value in the database, while still producing the same rbinary value and so allowing a token to be reused arbitrarily many times. 3. signer.cgi attempts to test that the value being signed is > 2^512. This test is ineffective because the client is blinding his values. He can get a signature on, say, the value 2, and you can't stop him. 4. Your token construction, sign(sha1(r)), is weak. sha1(r) is only 160 bits which could allow a smooth-value attack. This involves getting signatures on all the small primes up to some limit k, then looking for an r such that sha1(r) factors over those small primes (i.e. is k-smooth). For k = 2^14 this requires getting less than 2000 signatures on small primes, and then approximately one in 2^40 160-bit values will be smooth. With a few thousand more signatures the work value drops even lower. A simple solution is to do slightly more complex padding. For example, concatenate sha1(0||r) || sha1(1||r) || sha1(2||r) || ... until it is the size of the modulus. Such values will have essentially zero probability of being smooth and so the attack does not work. CP ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

nym-0.3 released
by Jason Holt 05 Jul '18

05 Jul '18

Hacking MediaWiki to map client certificates to IP addresses turns out to be quite trivial. nym-0.3 includes the 17 line patch, as well as the security fix proposed by cyphrpunk. The live demo at erg.no-ip.org now includes a live, patched MediaWiki called NymWiki. http://lunkwill.org/src/nym/nym-0.3.tar.gz http://www.lunkwill.org/src/nym/Readme http://www.lunkwill.org/src/nym/CHANGELOG If you want to be able to edit wikipedia through tor, I suggest you try out the code and email me, so that we can make a case that there's actual demand for inclusion of the patches. -J ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] FBI Preps Award for Biometric Database - New York Times
by David Farber 05 Jul '18

05 Jul '18

[1]The New York Times _________________________________________________________________ February 5, 2008 FBI Preps Award for Biometric Database By THE ASSOCIATED PRESS Filed at 10:37 a.m. ET WASHINGTON (AP) -- Lockheed Martin, Northrop Grumman and [2]IBM are vying for a multibillion-dollar contract to build a database for fingerprints and other biometric information that the FBI is set to award this week. [3]Lockheed Martin Corp. built and maintains the FBI's current 10-fingerprint database and some analysts consider the nation's largest defense contractor the favorite to win the Next Generation Identification system contract mainly due to its incumbent status. But because the new system is expected to include other identifiers, including palm prints, iris scans and facial recognition, the teams led by [4]Northrop Grumman Corp. and [5]International Business Machines Corp. remain strong contenders, said Stanford Group Co. analyst Jeremy Grant. Northrop's team includes [6]BearingPoint Inc., [7]General Dynamics Corp. and [8]Raytheon Co. An FBI spokesman on Tuesday said the contract is expected to be awarded this week but would not disclose its financial or other terms. The deal is viewed as a major upgrade to the FBI's Integrated Automated Fingerprint Identification System and should help the agency more easily share data supporting anti-terrorism efforts with domestic government offices and international partners. It will include data on known criminals and terrorists, as well as information on foreign visitors to the U.S. whose fingerprints and digital photographs were collected under a separate [9]Department of Homeland Security program that monitors people entering the U.S. via air, land and sea. Privacy advocates, however, say Congress must ensure that the FBI system will not infringe on citizens' rights before the government spends more than a billion dollars on it. ''This system is not ready for prime time,'' said Marc Rotenberg, executive director of the Electronic Privacy Information Center. ''Congress must ask tough questions about the impact on the privacy rights of Americans.'' [10]Home * [11]World * [12]U.S. * [13]N.Y. / Region * [14]Business * [15]Technology * [16]Science * [17]Health * [18]Sports * [19]Opinion * [20]Arts * [21]Style * [22]Travel * [23]Jobs * [24]Real Estate * [25]Automobiles * [26]Back to Top [27]Copyright 2008 The Associated Press * [28]Privacy Policy * [29]Search * [30]Corrections * [31]RSS * [32]First Look * [33]Help * [34]Contact Us * [35]Work for Us * [36]Site Map [&t=&s=0&ui=0&r=http%3a%2f%2fwww%2enytimes%2ecom%2fapo nline%2ftechnology%2fAP%2dFBI%2dBiomterics%2dContract%2ehtml&u=www %2enytimes%2ecom%2faponline%2ftechnology%2fAP%2dFBI%2dBiomterics%2dCon tract%2ehtml%3fpagewanted%3dprint] _________________________________________________________________ [37]Archives [38][feed-icon-10x10.jpg] [39]Powered by Listbox References 1. http://www.nytimes.com/ 2. http://topics.nytimes.com/top/news/business/companies/international_busines… 3. http://topics.nytimes.com/top/news/business/companies/lockheed_martin_corpo… 4. http://topics.nytimes.com/top/news/business/companies/northrop_grumman_corp… 5. http://topics.nytimes.com/top/news/business/companies/international_busines… 6. http://www.nytimes.com/mem/MWredirect.html?MW=http://custom.marketwatch.com… 7. http://topics.nytimes.com/top/news/business/companies/general_dynamics_corp… 8. http://topics.nytimes.com/top/news/business/companies/raytheon_company/inde… 9. http://topics.nytimes.com/top/reference/timestopics/organizations/h/homelan… 10. http://www.nytimes.com/ 11. http://www.nytimes.com/pages/world/index.html 12. http://www.nytimes.com/pages/national/index.html 13. http://www.nytimes.com/pages/nyregion/index.html 14. http://www.nytimes.com/pages/business/index.html 15. http://www.nytimes.com/pages/technology/index.html 16. http://www.nytimes.com/pages/science/index.html 17. http://www.nytimes.com/pages/health/index.html 18. http://www.nytimes.com/pages/sports/index.html 19. http://www.nytimes.com/pages/opinion/index.html 20. http://www.nytimes.com/pages/arts/index.html 21. http://www.nytimes.com/pages/style/index.html 22. http://travel.nytimes.com/pages/travel/index.html 23. http://www.nytimes.com/pages/jobs/index.html 24. http://www.nytimes.com/pages/realestate/index.html 25. http://www.nytimes.com/pages/automobiles/index.html 26. file://localhost/tmp/mutt.html#top 27. http://www.ap.org/ 28. http://www.nytimes.com/privacy 29. http://query.nytimes.com/search/advanced/ 30. http://www.nytimes.com/corrections.html 31. http://www.nytimes.com/rss 32. http://firstlook.nytimes.com/ 33. http://www.nytimes.com/membercenter/sitehelp.html 34. http://nytimes.com/ref/membercenter/help/infoservdirectory.html 35. https://careers.nytco.com/TAM/nyt_docs/TAM/candidate.html 36. http://spiderbites.nytimes.com/ 37. http://v2.listbox.com/member/archive/247/=now 38. http://v2.listbox.com/member/archive/rss/247/ 39. http://www.listbox.com/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[bitcoin-list] Bitcoin 0.3.15 is released
by theymos 05 Jul '18

05 Jul '18

http://www.bitcoin.org/smf/index.php?topic=1780.0 Version 0.3.15 is now available. Changes: - paytxfee switch is now per KB, so it adds the correct fee for large transactions - sending avoids using coins with less than 6 confirmations if it can - BitcoinMiner processes transactions in priority order based on age of dependencies - make sure generation doesn't start before block 74000 downloaded - bugfixes by Dean Gores - testnet, keypoololdest and paytxfee added to getinfo ------------------------------------------------------------------------------ Centralized Desktop Delivery: Dell and VMware Reference Architecture Simplifying enterprise desktop deployment and management using Dell EqualLogic storage and VMware View: A highly scalable, end-to-end client virtualization framework. Read more! http://p.sf.net/sfu/dell-eql-dev2dev _______________________________________________ bitcoin-list mailing list bitcoin-list(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[bitcoin-list] Bitcoin 0.3.15 is released
by theymos 05 Jul '18

05 Jul '18

http://www.bitcoin.org/smf/index.php?topic=1780.0 Version 0.3.15 is now available. Changes: - paytxfee switch is now per KB, so it adds the correct fee for large transactions - sending avoids using coins with less than 6 confirmations if it can - BitcoinMiner processes transactions in priority order based on age of dependencies - make sure generation doesn't start before block 74000 downloaded - bugfixes by Dean Gores - testnet, keypoololdest and paytxfee added to getinfo ------------------------------------------------------------------------------ Centralized Desktop Delivery: Dell and VMware Reference Architecture Simplifying enterprise desktop deployment and management using Dell EqualLogic storage and VMware View: A highly scalable, end-to-end client virtualization framework. Read more! http://p.sf.net/sfu/dell-eql-dev2dev _______________________________________________ bitcoin-list mailing list bitcoin-list(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Cryptography] Crypto being blamed in the London riots.
by Perry E. Metzger 05 Jul '18

05 Jul '18

Quoting from the New York Times: David Lammy, Britain's intellectual property minister, also called for a suspension of Blackberry's encrypted instant message service. Many rioters, exploiting that service, had been able to organize mobs and outrun the police, who were ill-equipped to monitor it. "It is unfortunate, but for the very short term, London can't have a night like the last," Mr. Lammy said in a Twitter post. Officials at Research in Motion, the corporate parent of Blackberry, declined to comment on whether the service would be suspended. But the company, based in Waterloo, Ontario, issued a statement saying: "We feel for those impacted by recent days' riots in London. We have engaged with the authorities to assist in any way we can." http://www.nytimes.com/2011/08/10/world/europe/10britain.html -- Perry E. Metzger perry(a)piermont.com _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: nym-0.2 released (fwd)
by cyphrpunk 05 Jul '18

05 Jul '18

A few comments on the implementation details of http://www.lunkwill.org/src/nym/: 1. Limting token requests by IP doesn't work in today's internet. Most customers have dynamic IPs. Either they won't be able to get tokens, because someone else has already gotten one using their temporary IP, or they will be able to get multiple ones by rotating among available IPs. It may seem that IP filtering is expedient for demo purposes, but actually that is not true, as it prevents interested parties from trying out your server more than once, such as to do experimental hacking on the token-requesting code. I suggest a proof of work system a la hashcash. You don't have to use that directly, just require the token request to be accompanied by a value whose sha1 hash starts with say 32 bits of zeros (and record those to avoid reuse). 2. The token reuse detection in signcert.cgi is flawed. Leading zeros can be added to r which will cause it to miss the saved value in the database, while still producing the same rbinary value and so allowing a token to be reused arbitrarily many times. 3. signer.cgi attempts to test that the value being signed is > 2^512. This test is ineffective because the client is blinding his values. He can get a signature on, say, the value 2, and you can't stop him. 4. Your token construction, sign(sha1(r)), is weak. sha1(r) is only 160 bits which could allow a smooth-value attack. This involves getting signatures on all the small primes up to some limit k, then looking for an r such that sha1(r) factors over those small primes (i.e. is k-smooth). For k = 2^14 this requires getting less than 2000 signatures on small primes, and then approximately one in 2^40 160-bit values will be smooth. With a few thousand more signatures the work value drops even lower. A simple solution is to do slightly more complex padding. For example, concatenate sha1(0||r) || sha1(1||r) || sha1(2||r) || ... until it is the size of the modulus. Such values will have essentially zero probability of being smooth and so the attack does not work. CP ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0