July 2018 - cypherpunks-legacy

[IP] France Announces Massive Internet Surveillance by ISPs
by David Farber 06 Jul '18

06 Jul '18

________________________________________ From: Lauren Weinstein [lauren(a)vortex.com] Sent: Monday, November 26, 2007 4:15 PM To: David Farber Cc: lauren(a)vortex.com Subject: France Announces Massive Internet Surveillance by ISPs France Announces Massive Internet Surveillance by ISPs http://lauren.vortex.com/archive/000331.html Greetings. In a breathtaking act of arrogance reminiscent of the heyday of Louis XVI (and likely to trigger similar public reactions among many Internet users, though perhaps unfortunately absent the "equalizing" influence of la guillotine), the French government and its overseers (the entertainment industry), along with a cowering collection of gutless ISPs, have announced an agreement for ISPs to become the Internet Police Force in France. Under the agreement (see below for links) ISPs will monitor users for presumed illegal activities (read that as "file sharing") and send reports on the accused to what amounts to an anti-piracy board. This board could then mete out punishments as it sees fit, including (attempted) banishment from the Internet (via what amounts to a national blacklist). To streamline the process, the entire procedure, as I understand it right now, would operate -- at least initially -- on an extrajudicial basis, without the messy intervention of courts, judges, trials, or other post-Magna Carta niceties that might help to assure that only the truly guilty are punished. Proponents are arguing that this approach will avoid overly severe judicial judgments, but in reality it's clearly an attempt to avoid fixing broken laws, while kowtowing to entertainment industry demands. The utter idiocy and recklessness of this approach is pretty much beyond description. It is ripe for privacy abuses on a grand scale, mistaken identities, false "convictions," and a long list of other associated problems. On the positive side though, the plan is likely to speed widespread adoption of encryption, as even routine Internet communications move to secure and in some cases cloaked channels to avoid these kinds of repressive enforcement regimes. It's one thing to use the conventional legal system to enforce legitimate intellectual property rights, but it's something wholly different to deputize ISPs into Network Monitors, feeding data to what apparently could easily become a Star Chamber operating outside the normal bounds of the conventional legal system. More details from: BBC: http://news.bbc.co.uk/2/hi/technology/7110024.stm or Le Monde (French): http://www.lemonde.fr/web/article/0,1-0,36-982011,0.html or (Google translation): http://tinyurl.com/2wynfs "Liberty, equality, fraternity"? --Lauren-- Lauren Weinstein lauren(a)vortex.com or lauren(a)pfir.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, NNSquad - Network Neutrality Squad - http://www.nnsquad.org Founder, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by Trei, Peter 06 Jul '18

06 Jul '18

> Vasco uses DES (I don't know the details). I'm sorry, I already read this somewhere on the web; the term I should have used was "protocol": how do they use DES to create those numbers - do they encrypt a counter, or a time, or a shared secret - what? Does anybody know? [I assume they encrypt something based on 1) the serial number and 2) a time or a counter.] Plus, there are less than 24 (7 * 3.3) bits in 7 digits; how does it get these particular 24 out of the 64 in a block? Thanks for any help, Mark

1 0

Re: [liberationtech] Quantum computation & communication
by Matt Mackall 06 Jul '18

06 Jul '18

On Wed, 2012-12-19 at 00:38 -0600, Gregory Foster wrote: > After reading Assange, et. al.'s "Cypherpunks: Freedom and the Future of > the Internet", wherein classical encryption is presented as a panacea > for ensuring privacy in an age of mass surveillance, I found the > following article succinct in questioning the long-term viability of > that narrative (or at least insisting on some qualifications). Quantum > computation and communication is still a long distance away, but this > article provides the outlines of how that technology will be used (and > abused) by the institutions that will be able to afford it. Don't believe the hype. Shor's algorithm for quantum factoring is a special case. With it, future large quantum computers may some day be able to break today's RSA and ECC, the two most popular schemes for public key encryption. However, most other cryptographic schemes (including several other public-key schemes) will NOT be rendered broken. Instead, they will become as strong as ciphers with half the key length. For instance, today's AES-256 will become as strong as today's AES-128. It is considered very unlikely that there will be significant breakthroughs in quantum computing theory to improve on that. In short, given everything known today about the possible potential of quantum computers, it is already possible to do all the sorts of things we do with cryptography today in a way that is secure against future adversaries with quantum computers. Unfortunately, "Quantum Computing Not Really A Big Deal For Security" doesn't make for a very good magazine article. To give you a sense of how far there is to go for quantum computers to be practical at breaking SSL, the largest number factored by researchers with a "quantum computer" is the number 143 (ie 11x13), though there's much debate about whether the approach used is actually "quantum". The largest undisputed result is for the number 21, also this year, besting the factoring of the number 15 in 2001. Needless to say, you don't even need pencil and paper, let alone a quantum computer, to factor these sorts of numbers. By comparison, today's typical SSL keys have hundreds of digits. The biggest risk is that the secrets you encrypt today with SSL or GPG might be decrypted by a very rich, patient adversary 20 to 50 years from now. That risk exists with or without quantum computers and I very much doubt the NSA and friends see enough code-breaking potential in quantum computing to be putting serious effort into it. -- Mathematics is the supreme nostalgia of our time. -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Call for Participation: Computers, Freedom & Privacy
by announce＠cfp.acm.org 06 Jul '18

06 Jul '18

Conference Research Showcase CALL FOR PARTICIPATION COMPUTERS, FREEDOM AND PRIVACY CONFERENCE RESEARCH SHOWCASE June 1-4, 2009, Washington DC http://www.cfp2009.org/ This year's Computers, Freedom and Privacy Conference will feature a research showcase in the form of a research poster session as well as a research panel that includes the authors of the best research posters. CFP is the leading policy conference exploring the impact of the Internet, computers, and communications technologies on society. For more than a decade, CFP has anticipated policy trends and issues, and has shaped the public debate on the future of privacy and freedom in an ever more technology-filled world. CFP focuses on topics such as freedom of speech, privacy, intellectual property, cybersecurity, telecommunications, electronic democracy, digital rights and responsibilities, and the future of technologies and their implications. Researchers who work in any of these areas are invited to submit research abstracts. We seek research abstracts describing recent or ongoing research in all areas relevant to the conference themes. We are especially interested in research abstracts that present results with clearly articulated policy implications. Abstracts should be written for a general audience and should avoid using technical or legal jargon. Submitted research abstracts can be either unpublished original research (including work in progress), or research that has been recently published (2008 or 2009). Accepted abstracts or links to published papers will be posted on the CFP web site and authors will be invited to present their work in the form of a poster during a poster session on June 1 or 2, 2009. The authors of the best research posters will be invited to participate in a panel discussion. Please submit your abstract via email to cfp-posters AT cups.cs.cmu.edu. In the body of the message include the title, authors, and brief abstract. If the research has been published, also include the full citation and URL. Attach a 1-2 page extended abstract or the full paper as a PDF file. Please note that poster abstracts should be formatted like short papers, not like posters. Authors of accepted posters will be sent information about how to prepare and format posters for the conference. Submissions will close at 5pm, US East Coast time, the evening of April 3. CFP2009 RESEARCH SHOWCASE COMMITTEE Lorrie Faith Cranor, Carnegie Mellon University (co-chair) Alessandro Acquisti, Carnegie Mellon University (co-chair) Lance Hoffman, George Washington University Deirdre Mulligan, University of California, Berkeley Adam Shostack, Microsoft http://www.cfp2009.org/wiki/index.php/Research_Showcase

1 0

Re: [IP] more on Steve Gibson: MS WMF is a Backdoor, Not a
by Matt Manor 06 Jul '18

06 Jul '18

Coding Mistake Microsoft Responds... http://blogs.technet.com/msrc/archive/2006/01/13/417431.aspx Looking at the WMF issue, how did it get there? Hi everyone, Stephen Toulouse here. Now that the monthly release has passed and people are deploying the updates I wanted to take a moment to discuss some things related to questions we've been receiving on the recent WMF issue. (Which was addressed in MS06-001). One question we've gotten is about SetAbortProc, the function that allows printing jobs to be cancelled. (The link is to the public documentation of the function) Specifically people are wondering about how the vulnerability was present. Bear with me, I'm going to get rather technical here in the interests of clearly pointing it out. The long story short is that the vulnerability can be triggered with either correct OR incorrect metafile record size values, there seems to have been some confusion on that point. To detail it a little bit, SetAbortProc functionality was a needed component in the graphics rendering environment for applications to register a callback to cancel printing, before even the WMF file format existed. Remember, those were the days of co-operative multitasking and the only way to allow the user to cancel a print job would be to call back to them, usually via a dialog. Around 1990, WMF support was added to Windows 3.0 as a file-based set of drawing commands for GDI to consume. The SetAbortProc functionality, like all the other drawing commands supported by GDI, was ported over (all in assembly language at this point) by our developers to be recognized when called from a WMF. This was a different time in the security landscape and these metafile records were all completely trusted by the OS. To recap, when it was introduced, the SetAbortProc functionality served an important function. The vulnerability was introduced when all that GDI functionality was allowed to be called from metafiles. The potential danger of this type of metafile record was recognized and some applications (Internet Explorer, notably) will not process any metafile record of type META_ESCAPE, the overall type of the SetAbortProc record. That restriction is the reason it's not possible to exploit this vulnerability by simply referencing an image directly in HTML. IE just won't process it. How then is Internet Explorer an attack vector for the vulnerability? An example of that is through the Windows Picture and Fax Viewer. That application can convert a raw WMF into a printable EMF record. During this conversion, the application will process the META_ESCAPE record. All the current exploits we're aware of are based on creating an html construct using an IFRAME. At a high level, the IFRAME passes off content to the Windows shell to display. The shell looks up the registered handler for WMF which is the Windows Picture and Fax Viewer (shimgvw.dll) by default. It can run into the vulnerability when converting a raw WMF to a printable EMF if MS06-001 is not applied to the system. Now, there's been some speculation that you can only trigger this by using an incorrect size in your metafile record and that this trigger was somehow intentional. That speculation is wrong on both counts. The vulnerability can be triggered with correct or incorrect size values. If you are seeing that you can only trigger it with an incorrect value, it's probably because your SetAbortProc record is the last record in the metafile. The way this functionality works is by registering the callback to be called after the next metafile record is played. If the SetAbortProc record is the last record in the metafile, it will be more difficult to trigger the vulnerability. The next question we've been getting is around previous operating systems like Windows 98, Windows 98 SE, and Windows Me. Specifically people are wondering why there is no update available for these platforms. Well first off it's extremely important to note that these products are under an extended support lifecycle. Back in 2004, we made a decision that we would extend support for security updates for updates rated as Critical only through June of 2006 for these older operating systems. We publicly posted the policy at the following location: http://support.microsoft.com/gp/lifean1 With WMF we want to be very clear: the Windows 9x platform is not vulnerable to any "Critical" attack vector. The reason Windows 9x is not vulnerable to a "Critical" attack vector is because an additional step exists in the Win9x platform: When not printing to a printer, applications will simply never process the SetAbortProc record. Although the vulnerable code does exist in the Win9x platform, all "Critical" attack vectors are blocked by this additional step. The remaining attack vectors that we have identified require extensive user interaction and are not rated "Critical". Again the "Critical" rating refers to code execution attacks that could result in automated attacks requiring little or no user interaction. I'd like to thank the members of the Secure Windows Initiative team for the supplemental research and history on this. Once again we urge everyone to deploy MS06-001 for the supported platforms, and thanks for the feedback we've been getting! S. *This posting is provided "AS IS" with no warranties, and confers no rights.* posted on Friday, January 13, 2006 11:57 PM by stepto ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] more on MS responds --more on Steve Gibson: MS WMF is a
by David Farber 06 Jul '18

06 Jul '18

Backdoor, Not a Coding Mistake X-Mailer: Apple Mail (2.746.2) Reply-To: dave(a)farber.net Begin forwarded message:

1 0

[IP] more on "if you are not doing anything wrong, why should you worry about it
by Dave Farber 06 Jul '18

06 Jul '18

-------- Original Message -------- Subject: Re: [IP] more on "if you are not doing anything wrong, why should you worry about it?"] Date: Sun, 19 Feb 2006 15:10:17 -0500 From: Lee Revell <rlrevell(a)joe-job.com> To: dave(a)farber.net CC: ip(a)v2.listbox.com, EEKid(a)aol.com References: <e3.25a38acd.3129dbe2(a)aol.com> <27DC3839-A6BF-4058-B00E-C4001E8719D5(a)farber.net> Here's another one from Chicago, about requiring cameras in private businesses. Is there a coordinated PR campaign afoot? http://www.usatoday.com/news/nation/2006-02-14-chicago-cameras_x.htm CHICAGO b Surveillance cameras b aimed at government buildings, train platforms and intersections here b might soon be required at corner taverns and swanky nightclubs. Mayor Richard Daley wants to require bars open until 4 a.m. to install security cameras that can identify people entering and leaving the building. Other businesses open longer than 12 hours a day, including convenience stores, eventually would have to do the same. Daley's proposed city ordinance adds a dimension to security measures installed after the Sept. 11 attacks. The proliferation of security cameras b especially if the government requires them in private businesses b troubles some civil liberties advocates. "There is no reason to mandate all of those cameras unless you one day see them being linked up to the city's 911 system," says Ed Yohnka of the Illinois American Civil Liberties Union. "We have perhaps reached that moment of critical mass when people ... want to have a dialogue about how much of this is appropriate." [...] On Sun, 2006-02-19 at 09:52 -0500, David Farber wrote: > > Begin forwarded message: > > From: EEkid(a)aol.com > Date: February 19, 2006 9:34:10 AM EST > To: dave(a)farber.net > Subject: Re: [IP] "if you are not doing anything wrong, why should > you worry about it?"] > > > > It sounds to me like many of our public officials are trying to mimic > the public surveillance systems used in the UK. For many years, I've > often wondered why they tolerated such intrusions into their lives. > Now, seeing how slowly and quietly such systems appear, I understand. > > Since 9/11, we have seen tremendous change in how our government and > public officials view our civil rights. What was a completely > unacceptable governmental intrusion 5-10 years ago, is viewed as > essential or acceptable today. In my humble opinion, I believe this > slow incepid creep is as good a reason as any to stop the > surveilence, monitoring and intrusion nonsense now. > > Today, we wouldn't want the government listening to our phone > conversations or using technology to monitor our every movement > around town. Our government to my knowledge isn't currently doing > such things. But what happen's 5-10 years from now? When all of > these easily exploited technologies are in place and ripe and ready > for abuse? Will our elected officials demonstrate restraint and > avoid exploiting those technologies as the easiest solution to some > future problem? > > When government officials keep changing the definition of what is > 'wrong'. Such as wearing a tee shirt with a certain slogan or > peacefully protesting at a "nationally significant event" or speaking > out against our elected officials. Then what should we expect in the > future? Which common everyday behavior that everyone views as a God > given right today, will be viewed as the next wrong? > > When asked "if you are not doing anything wrong, why should you worry > about it?" we all need to reply, because you have control over the > definition of was is legally wrong and you keep changing the terms. > > I can remember years ago, I heard FBI director Louis Freeh say > something that made my blood run cold. He said, we will never stop > drug smuggling in the US until we can limit free travel within our > borders and American's aren't ready for that yet. > > Well, when will it be? Tomorrow? Next week? Next year? When will you > accept it as important and essential to our safety? > > Jerry > > > In a message dated 2/19/2006 8:49:51 AM Eastern Standard Time, > dave(a)farber.net writes: > I saw this, indirectly, on Techdirt. > > I do feel sorry for the police chief, and for the people of Houston. > But still, it's a pretty scary idea for anyone to raise. > > -d > > Houston eyes cameras at apartment complexes > http://seattlepi.nwsource.com/national/1110AP_Police_Cameras.html > > By PAM EASTON > ASSOCIATED PRESS WRITER > > HOUSTON -- Houston's police chief on Wednesday proposed placing > surveillance cameras in apartment complexes, downtown streets, > shopping malls and even private homes to fight crime during a > shortage of police officers. > > "I know a lot of people are concerned about Big Brother, but my > response to that is, if you are not doing anything wrong, why should > you worry about it?" Chief Harold Hurtt told reporters Wednesday at a > regular briefing. > > Houston is facing a severe police shortage because of too many > retirements and too few recruits, and the city has absorbed 150,000 > hurricane evacuees who are filling apartment complexes in crime- > ridden neighborhoods. The City Council is considering a public safety > tax to pay for more officers. > > Building permits should require malls and large apartment complexes > to install surveillance cameras, Hurtt said. And if a homeowner > requires repeated police response, it is reasonable to require camera > surveillance of the property, he said. > > Scott Henson, director of the American Civil Liberties Union's Police > Accountability Project in Texas, called Hurtt's building-permit > proposal "radical and extreme" and said it may violate the Fourth > Amendment's protections against unreasonable searches. > > Andy Teas with the Houston Apartment Association said that although > some would consider cameras an invasion of privacy, "I think a lot of > people would appreciate the thought of extra eyes looking out for them." > > Such cameras are costly, Houston Mayor Bill White said, "but on the > other hand we spend an awful lot for patrol presence." He called the > chief's proposal a "brainstorm" rather than a decision. > > The program would require City Council approval. > > > ------------------------------------- > You are subscribed as rlrevell(a)joe-job.com > To manage your subscription, go to > http://v2.listbox.com/member/?listname=ip > > Archives at: http://www.interesting-people.org/archives/interesting-people/ > ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Preconfigured hidden service
by JT 06 Jul '18

06 Jul '18

Hi, is it possible to have a preconfigured hidden service in Tor as I2P has? After installing I2P all a user has to do is put html files in the htdocs folder and he is ready to go. He can look up the URL of this website easily. Every noob can host a hidden eepsite. Is something like this planned for Tor? An simple, secure webserver preconfigured to only listen to 127.0.0 and ready to go? The average user(at least the ones I talk to) barely manages to set up Tor. Some people are even to computer illiterate to click on the onion symbol and choose "start Tor" any yet we need those people in the user base(more distributed trust). I know the programmer's power of the Tor project is limited (due to the number of programmers) and not everything can be implemented at the same time. And this is not a complaint. I love to participate in political discussions an be able to talk freely and without having to worry about being threatened threatened afterwards. I am very greatful for Tor. The technical side of Tor is already very advanced but all the attacks published in the last months were possible because the usability side of Tor is still lacking a lot. I know it is a common problem for everybody in the IT field to assume that the users of the IT have the same knowledge as the creators but this is not even remotely true. Yes smart project attract also smart users but what about the other 80%? What about the 80-20 rule? :) If Tor wants to be a hidden free internet within the internet it must provide a one click service to host a website like I2P. Journalists that work in Sudan, Iraq, Burma, Cuba, Russia or many, many other countries need something that works right away. Not every journalist can go to college and learn how to set up an apache server and configure it. A standard installation should be able to host html only. Tor could learn from I2P. Computer experts can then change the settings to host php, etc also. I think such a thing would spread like wildfire and the Tor user base would explode. Lots of people want to host their own sites and they would with a one click installation of a hidden service web server. I really wish I could help with programming and not only making suggestions. Long live Tor!! :) -- JT toruser(a)fastmail.fm -- http://www.fastmail.fm - Faster than the air-speed velocity of an unladen european swallow ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

face recognition flop
by Christian Kuhtz 06 Jul '18

06 Jul '18

Dave, for IP if you wish.. --- Apparently the BKA (German equivalent of the FBI) tested face recognition, spent 200K euros to test the system in a rail terminal in the city of Mainz and basically declared it worthless in terms of being an investigative tool. Apparently (per the article) this is the first public trial under normal, every day conditions (rather than having the conditions manipulated for a good showing) and only matched 30%. Even when the lighting was modified to be ideal, it only reached 60%. The BKA considers the system only useful if the success rate is very near 100%. The sample size was approximately 23,000 travelers per day over a period of roughly 3 months. The targets were 200 commuters who had volunteered for the trial and travel through this rail terminal at least once per day. BKA recommended that this is not a suitable system for surveillance and facial recognition to try to match suspects in a manhunt etc. Article is in German, try your favorite mechanized translator. If there's enough demand, I happen to be bilingual and may be convinced into doing a translation in my spare time. ;-) http://www.spiegel.de/panorama/justiz/0,1518,493911,00.html ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] face recognition flop
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0