July 2018 - cypherpunks-legacy

nym-0.3 released
by Jason Holt 05 Jul '18

05 Jul '18

Hacking MediaWiki to map client certificates to IP addresses turns out to be quite trivial. nym-0.3 includes the 17 line patch, as well as the security fix proposed by cyphrpunk. The live demo at erg.no-ip.org now includes a live, patched MediaWiki called NymWiki. http://lunkwill.org/src/nym/nym-0.3.tar.gz http://www.lunkwill.org/src/nym/Readme http://www.lunkwill.org/src/nym/CHANGELOG If you want to be able to edit wikipedia through tor, I suggest you try out the code and email me, so that we can make a case that there's actual demand for inclusion of the patches. -J ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Cryptography] Crypto being blamed in the London riots.
by Perry E. Metzger 05 Jul '18

05 Jul '18

Quoting from the New York Times: David Lammy, Britain's intellectual property minister, also called for a suspension of Blackberry's encrypted instant message service. Many rioters, exploiting that service, had been able to organize mobs and outrun the police, who were ill-equipped to monitor it. "It is unfortunate, but for the very short term, London can't have a night like the last," Mr. Lammy said in a Twitter post. Officials at Research in Motion, the corporate parent of Blackberry, declined to comment on whether the service would be suspended. But the company, based in Waterloo, Ontario, issued a statement saying: "We feel for those impacted by recent days' riots in London. We have engaged with the authorities to assist in any way we can." http://www.nytimes.com/2011/08/10/world/europe/10britain.html -- Perry E. Metzger perry(a)piermont.com _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [drone-list] Feb 27 US House Judiciary Drones hearing
by Al Mac Wow 05 Jul '18

05 Jul '18

http://www.lawfareblog.com/2013/02/house-judiciary-committee-written-stateme nts-for-tomorrows-hearing/ Witness statements now available for Feb 27 hearing of US House Judiciary committee http://judiciary.house.gov/ hearing Wed Feb 27 at 10 a.m., on "Drones and the War on Terror: When Can the U.S. Target Alleged American Terrorists Overseas?" Testimony from the various witnesses: Bellinger 11 pages http://www.lawfareblog.com/wp-content/uploads/2013/02/Bellinger-02272013.pdf Chesney 11 pages http://www.lawfareblog.com/wp-content/uploads/2013/02/Chesney-02272013.pdf Vladeck 12 pages Wittes 18 pages See http://judiciary.house.gov/hearings/113th/hear_02272013_2.html and http://www.lawfareblog.com/2013/02/house-judiciary-committee-written-stateme nts-for-tomorrows-hearing/ Other relevant links: House Judiciary Press Release http://judiciary.house.gov/news/2013/02252013_3.html All House Judiciary Committee hearings are webcast live at www.judiciary.house.gov. Witness list for http://judiciary.house.gov/hearings/113th/hear_02272013_2.html Feb 27 hearing: http://www.lawfareblog.com/2013/02/witness-list-for-feb-27-house-judiciary-h earing-on-drones-and-the-war-on-terror/ Initial discovery that this was coming http://www.lawfareblog.com/2013/02/february-27-house-judiciary-hearing-on-dr ones-and-the-war-on-terror/ http://www.volokh.com/2013/02/24/house-judiciary-committee-feb-27-hearing-on -drones-and-the-war-on-terror/?ModPagespeed=noscript Al Mac (WOW) = Alister William Macintyre -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/drone-list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Why we all have a stake in the Freedom of the Press Foundation
by Peter Langston 05 Jul '18

05 Jul '18

MiniFunPeople........................................ISSN 1098-7649 Forwarded-by: Peter Langston <MiniFunPeople(a)psl.to> Forwarded-by: Dave Farber <dave(a)farber.net> From: *Dewayne Hendricks* <dewayne(a)warpspeed.com Why we all have a stake in the Freedom of the Press Foundation This new nonprofit to protect WikiLeaks and other whistleblowers from payment systems blocking deserves our support By Dan Gillmor Dec 17, 2012 <http://tinyurl.com/d34hf4b> Two years ago this month, the major online payment systems b Visa, Mastercard, PayPal and more b cut off one of the world's most famous journalism organizations from the public. They stopped taking payments on behalf of WikiLeaks and, in the process, highlighted one of the most dangerous threats to modern journalism: the ability of centralized third parties to make trouble for anyone and any organization they didn't like, for whatever reason. With a few exceptions, the traditional journalism industry has been all but indifferent to what happened b a payment boycott done almost certainly under pressure from the American government, which was and remains infuriated by WikiLeaks' methods and results. No other journalism-related organization has been treated this way, as far as I know. But given the rise of independent media organizations and the utter lack of accountability the payment systems have faced for their outrageous actions, the threat is greater than ever. The journalists' silence was unfortunate but, sad to say, a reflection of most media companies' coziness with the rich and powerful in America and around the world. It's fair to assume, though, that had any one of those companies been shut out of modern payment systems, the entire industry would have: a) created a huge outcry; and b) found ways to go around the centralized systems that had taken such pernicious actions. So I'm glad to see the emergence of a new not-for-profit group whose mission is to "promote and fund aggressive, public-interest journalism focused on exposing mismanagement, corruption, and law-breaking in government". It's called the Freedom of the Press Foundation. Its method is "crowd-funding" b pulling together donations from people like you and me b and it could be a game-changer. The foundation is based in San Francisco, with a board of directors that includes Daniel Ellsberg (of Pentagon Papers fame), John Perry Barlow (co-founder of the Electronic Frontier Foundation), Xeni Jardin (from BoingBoing), the Guardian's Glenn Greenwald and several others in the civil liberties and media arenas. (Disclosure: I am friends with several board members, and have offered advice to the founders.) What's novel are the tactics: the foundation will be accepting donations from individuals and then forwarding them along, according to the donors' specific direction, to organizations designed by foundation. The list of organizations will evolve over time; the first group includes WikiLeaks, MuckRock, the National Security Archive and the UpTake, all of which are worthy of support. The foundation has come up with clear and useful criteria for its selections: 1. Record of engaging in transparency journalism or supporting it in a material way, including support for whistleblowers. 2. Public interest agenda. 3. Organizations or individuals under attack for engaging in transparency journalism. 4. Need for support: the foundation's goal is to prioritize support for organizations and individuals who are in need of funding or who face obstacles to gaining support on their own. The system the foundation has devised is simple and smart. Donors can designate as many or few of the organizations as he or she chooses, with online "sliders" that make it easy to raise or lower the percentage going to each of the chosen groups. The foundation also accepts donations, and it takes an 8% cut of the proceeds for operational costs. I'm donating immediately, and will designate that my gift goes to all four organizations, with the bulk to WikiLeaks, given its especially endangered status. The crowdfunding method takes a page from the "HumbleBundle" operation, which has been offering software, books and games this way b asking people to donate whatever they wish, and choosing which providers and/or organizations will get what percentage of their donations. Then, the donors can download the items. Donations range widely. I've participated several times. The best part is that everyone involved gets value from the system. The obvious question raised by the Freedom of the Press Foundation initiative is whether the payment systems will shut this off, too. If they do, they'll be punishing not just WikiLeaks, but the entire journalism ecosystem b and ultimately, your right to get the information you want and need. Will they extend the bad faith they showed two years ago? That I even have to ask this question is evidence of the power of these centralized mega-corporations. They have far too much power, like too many other telecommunications companies and a number of others in the information and communications industries on which we rely more and more for our daily activities. The Freedom of the Press Foundation can be a first step away from the edge of a cliff. But it needs to be recognized and used by as many people as possible, as fast as possible. And journalists, in particular, need to offer their support in every way. This is ultimately about their future, whether they recognize it or not. But it's more fundamentally about all of us. I encourage you to support the foundation and the organizations it is trying to help. This is about your future, too. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] CryptoParty in Tunis tomorrow (Saturday, 1st December)
by James Vasile 05 Jul '18

05 Jul '18

Hey all, Some of you know me. For those of you who don't, I'm James Vasile, and at OpenITP the buck stops with me. So whatever your complaints about our work in Tunis, I'm the right person to yell at. First of all, everybody on the OpenITP team agreed that the real names policy was terrible. The policy was layered on by USAID as a condition of InformSec bringing in a group of Syrian activists who had specific security concerns (and they'd had a recent security breach that was causing people to freak out a little). From the beginning, we regretted it and have been saying internally that we wouldn't ever put oursevles in a position to have to request real names again. Our intent was not to bar pseudononymous people. We had several pseudononymous participants, albeit all people several members of my team had experience with. Rather, we were trying to get a handle on who was there and how much separation we were going to have to build in for our Syrian contingent if their comfort demanded it. In the end, we limited the real names policy as much as we could and then decided we didn't want to choose between the CryptoParty and Syrian guests. In retrospect, we should have just made the hard choice then and not tried to combine a CryptoParty with people who had elevated security concerns. So, yeah, the policy was a mistake. I thought it was a crappy tradeoff but that the value of getting all those people in a room would make it worthwhile. I figured some people would avoid the event because of it, but my hope was the enough people would want to have the conversation that the compromise would end up being a footnote. Instead, people (most especially the local Tunisian community we had been really excited to meet) took exception to the policy and we had zero outside participation in the CryptoParty. That really made me unhappy, and it underscored how big a mistake the policy had been. Just to be clear: We checked no IDs. We gave no list of names of CryptoParty attendees to USAID. We had several people participating under pseudonyms, and we reached a comfort level that allowed everybody to mix freely by the end of the event. So that's what happened. I'm really sorry we made the wrong policy choice. And I'm really sorry we did a shit job at explaining it. I'll try hard not let it happen again. OpenITP will be hosting a meetup in NY on December 17. If anybody wants to come by and talk about it, I'm game. No real names required. Peace, James -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Greek cellular wiretapping scandal
by Steven M. Bellovin 05 Jul '18

05 Jul '18

The Greek cellular wiretapping scandal was the subject of a front-page article in today's Wall Street Journal. (It's http://online.wsj.com/article/SB115085571895085969.html? mod=hps_us_pageone for subscribers.) The broad outlines of the story are familiar to anyone who has been following the story -- a Lawful Intercept mechanism was abused to send copies of certain calls to prepaid cell phone numbers -- but the details are interesting. >From a non-technical perspective, at least one death may be linked >to the incident. A communications expert who was working on the switch apparently commited suicide, but this has been questioned by some. He told his fiancie not long before he died that it had become "a matter of life or death" that he leave [Vodafone] The problem was discovered when some people had problems sending text messages; the link between the two issues is unclear. The bug itself wasn't simply a matter of turning on Lawful Intercept. That software did exist in the switch, but everyone says it wasn't activated and Ericsson wasn't paid for it. (Aside: Greece does have a CALEA-like law, which means it should have been enabled.) Vodafone denies even knowing about such software, which strikes me as improbable. In addition, the attack required some other software that activated the Lawful Intercept but hid its existence. In other words, it was a rootkit running on a phone switch. I have more than a passing aquaintance with the complexity of phone switch software; doing that was *hard* for anyone, especially anyone not a switch developer. Installing the rogue software quite likely involved "authorized access to Vodafone's networks". Most suspicious, the prepaid phones that could pick up the calls were in contact via phone calls and text messages with various overseas destinations, namely the U.S., including Laurel, Md., the U.K., Sweden and Australia, according to the ADAE preliminary report. Some of these calls and messages were initiated and received directly from the 14 interceptor phones and some were relayed via a second group of at least three other prepaid phones that also were in contact with the 14 interceptor phones. Guess what's just to the east of Laurel, MD... On the other hand, exposing links like that is clumsy -- could it be disinformation? And one of the phones monitored was from the American embassy in Athens -- or is that the disinformation? Or is NSA spying on the embassy? You are in a maze of twisty little spooks, all different. The attack was very sophisticated, and required a great deal of arcane knowledge. Whoever did it had detailed knowledge of Ericsson switches, and probably a test lab with the proper Ericsson gear. It strongly suggests that Ericsson and/or Vodafone insiders were involved -- my guess is both. But who did it, and why, remains obscure. --Steven M. Bellovin, http://www.cs.columbia.edu/~smb --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Greek cellular wiretapping scandal
by David Farber 05 Jul '18

05 Jul '18

Begin forwarded message:

1 0

Re: [cryptography] [info] The NSA Is Building the Country's Biggest Spy Center (Watch What You Say)
by Dean, James 05 Jul '18

05 Jul '18

From http://blogs.computerworld.com/19917/shocker_nsa_chief_denies_total_info rmation_awareness_spying_on_americans?source=CTWNLE_nlt_security_2012-03 -22: Despite the fact that domestic spying on Americans is already an e-hoarding epidemic, the massive new NSA storage facility in Utah will solve the problem of how to manage 20 terabytes a minute of intercepted communications. Even if the intercepted communication is AES encrypted and unbroken today, all that stored data will be cracked some day. Then it too can be data-mined. The super secret spook agency is full of code breakers. "Remember," former intelligence official Binney stated, "a lot of foreign government stuff we've never been able to break is 128 or less. Break all that and you'll find out a lot more of what you didn't know-stuff we've already stored-so there's an enormous amount of information still in there." Binney added the NSA is "on the verge of breaking a key encryption algorithm." _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Greek cellular wiretapping scandal
by Steven M. Bellovin 05 Jul '18

05 Jul '18

The Greek cellular wiretapping scandal was the subject of a front-page article in today's Wall Street Journal. (It's http://online.wsj.com/article/SB115085571895085969.html? mod=hps_us_pageone for subscribers.) The broad outlines of the story are familiar to anyone who has been following the story -- a Lawful Intercept mechanism was abused to send copies of certain calls to prepaid cell phone numbers -- but the details are interesting. >From a non-technical perspective, at least one death may be linked >to the incident. A communications expert who was working on the switch apparently commited suicide, but this has been questioned by some. He told his fiancie not long before he died that it had become "a matter of life or death" that he leave [Vodafone] The problem was discovered when some people had problems sending text messages; the link between the two issues is unclear. The bug itself wasn't simply a matter of turning on Lawful Intercept. That software did exist in the switch, but everyone says it wasn't activated and Ericsson wasn't paid for it. (Aside: Greece does have a CALEA-like law, which means it should have been enabled.) Vodafone denies even knowing about such software, which strikes me as improbable. In addition, the attack required some other software that activated the Lawful Intercept but hid its existence. In other words, it was a rootkit running on a phone switch. I have more than a passing aquaintance with the complexity of phone switch software; doing that was *hard* for anyone, especially anyone not a switch developer. Installing the rogue software quite likely involved "authorized access to Vodafone's networks". Most suspicious, the prepaid phones that could pick up the calls were in contact via phone calls and text messages with various overseas destinations, namely the U.S., including Laurel, Md., the U.K., Sweden and Australia, according to the ADAE preliminary report. Some of these calls and messages were initiated and received directly from the 14 interceptor phones and some were relayed via a second group of at least three other prepaid phones that also were in contact with the 14 interceptor phones. Guess what's just to the east of Laurel, MD... On the other hand, exposing links like that is clumsy -- could it be disinformation? And one of the phones monitored was from the American embassy in Athens -- or is that the disinformation? Or is NSA spying on the embassy? You are in a maze of twisty little spooks, all different. The attack was very sophisticated, and required a great deal of arcane knowledge. Whoever did it had detailed knowledge of Ericsson switches, and probably a test lab with the proper Ericsson gear. It strongly suggests that Ericsson and/or Vodafone insiders were involved -- my guess is both. But who did it, and why, remains obscure. --Steven M. Bellovin, http://www.cs.columbia.edu/~smb --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Greek cellular wiretapping scandal
by David Farber 05 Jul '18

05 Jul '18

Begin forwarded message:

1 0