July 2018 - cypherpunks-legacy

Wikipedia proposal
by Jason Holt 06 Jul '18

06 Jul '18

I just posted this to wikitech-l: There has been a lot of discussion lately on the or-talk list about how to let tor and other anonymizing proxy users edit wikipedia without allowing vandals free rein. Several straightforward approaches have been proposed, such as holding edits in escrow pending approval by a trusted user, and requiring anonymizing network users to login before posting. The latter idea in particular could easily be abused, since abusers can create a new account for each edit. Roger Dingledine, tor's author, suggested creating a pseudonym service using a cryptographic construction called blind signatures: http://www.rsasecurity.com/rsalabs/node.asp?id=2339 Basically, Alice can generate a token, mathematically blind it (obscuring its value), have it signed, then unblind the signature. Anyone can verify that the signature on the token is valid, but nobody, including the signer, can link the blinded value Alice had signed with her unblinded token. I implemented such a scheme which works as follows: * Alice creates and blinds a token, then submits it to a token server for signing. Optionally, the token server may have a list of IPs banned from wikipedia, and refuse to sign Alice's token if her IP is on the list. * The token server signs the blinded token, then records what IP address Alice used so that she can't obtain multiple tokens per IP address. Later, this will allow us to block Alice's IP address if she misbehaves, just as Wikipedia admins currently do, except that now it'll work even when she connects via tor. Token rationing could also be done based on other (more or less) scarce resources, including email addresses, captchas, CPU-intensive tasks or even money, just as I'm sure has been proposed for the vanilla wikipedia. The advantage of blind signatures is that tokens can be recorded and blocked without revealing the potentially sensitive underlying resource (such as a personal email address or IP address). * Alice can now turn on tor and present her token to wp, without revealing her actual IP address. This token takes the place of the IP address record currently stored along with article edits, and can be blacklisted just the same way that IPs are banned. * However, I implemented an intermediary step which has several advantages. Instead of presenting her token to wp, Alice generates an essentially empty client certificate and presents it via the tor network to a certificate authority (CA) for signing, along with the signed token. The CA records that the token has been "spent" (preventing her from receiving multiple certs per token), then signs her cert just as Verisign would sign a server SSL certificate. Since she connects via tor, the CA doesn't learn her real IP address. * Alice installs the client certificate in her browser, then connects to a special wp server running an SSL server that demands valid client certificates from our CA. That configuration takes only 4 lines in my apache-ssl server's httpd.conf. Apache automatically sets environment variables which identify the client certificate, and which can be used in place of the REMOTE_ADDR variable currently used to record users' incoming IP addresses when marking page edits. Blocking a client cert would then be just as easy as blocking an IP address. All of Alice's edits will be marked with that identifier unless she obtains a new IP address (or other scarce resource) and repeats the process to obtain another certificate. Later, features can optionally be added which will allow her to have separate identifiers for each edit (protecting her in case, say, her repressive government confiscates her computer in order to find out if she wrote a particular article they disagree with). I have already released code to implement this system, with the exception of the wp-specific code. I sent the proposal to both the or-talk lists and the cryptography list at metzdowd.com on Monday. Next I'd like your comments, before I dive into the mediawiki code (or find someone willing to help with this part). Once the feature is complete, we can set up a live test wiki for people to bang on, before we consider implementation on the live wp servers. -J ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Question re: current telco lawsuits
by Richard Forno 06 Jul '18

06 Jul '18

I know EFF, CPSR, EPIC, ACLU, and others are tracking the NSA monitoring item and many have filed lawsuits against the telcos for supporting various NSA programs in recent months. Over this weekend we're seeing both individual and class action suits filed against some of the involved telcos, and at least one state public utility commission (Maine) reportedly opening up an investigation into the allegations. Has anyone developed, or is anyone developing, an aggregate list of current or planned lawsuits against the telcos -- particularly class actions -- that folks can refer to and/or participate in? I've had a few folks ask about it, but I've not come across a "master list" of such endeavors yet. -rick Infowarrior.org ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Question re: current telco lawsuits
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[p2p-hackers] Announcing SocialVPN version 0.3
by Renato Figueiredo 06 Jul '18

06 Jul '18

Dear p2p-hackers, We have a new version of the open-source (GPL v2) SocialVPN P2P software that might be of interest to some of you: http://socialvpn.org This system self-organizes P2P VPN links among peers connected by an online social network. It builds on the Brunet P2P library and the IPOP overlay developed by the ACIS P2P group at U. Florida, supporting transparent NAT traversal and dynamic IP address/DNS name allocation and translation. Key improvements over the Facebook-based version announced in this list a while ago include: - the use of XMPP for peer discovery and certificate exchange (it's been tested with Google chat as well as with ejabberd) - a Web-based user interface, and - code/API re-structuring to facilitate programming of bindings to other online social networks by external developers. We run a public bootstrap overlay on PlanetLab; our code is hosted at GitHub, and we have binaries for Linux and Windows available for download. If you are interested in using or developing around this system, please feel free to contact us. Regards, --rf _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tahoe-lafs-weekly-news] Tahoe Weekly News #5
by Patrick R McDonald 06 Jul '18

06 Jul '18

===================================================== Tahoe-LAFS Weekly News, issue number 5, July 4, 2011 ===================================================== Welcome to the Tahoe-LAFS Weekly News (TWN). Tahoe-LAFS_ is a secure, distributed storage system. `View TWN on the web`_ *or* `subscribe to TWN`_. .. _Tahoe-LAFS: http://tahoe-lafs.org .. _View TWN on the web: http://tahoe-lafs.org/trac/tahoe-lafs/wiki/TahoeLAFSWeeklyNews .. _subscribe to TWN: http://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-lafs-weekly-news Announcements and News ====================== Tahoe-LAFS Summit ----------------- This week saw the first `Tahoe-LAFS Summit`_. Thanks again to the folks at NoiseBridge_ for hosting the Summit. For those who were unable to attend, you can catch up with the ustream feeds provided by nejucomo_ and secorp_. More updates regarding the Summit coming later this week. .. _`Tahoe-LAFS Summit`: http://tahoe-lafs.org/trac/tahoe-lafs/wiki/Summit .. _NoiseBridge: https://noisebridge.net/wiki/Noisebridge .. _nejucomo: http://www.ustream.tv/channel/tahoe-lafs-summit .. _secorp: http://www.ustream.tv/channel/tahoe-lafs-summit-end Least Authority Enterprises --------------------------- At the Summit, Zooko announced `Least Authority Enterprises`_ (LAE). LAE is implementing Tahoe-LAFS on Amazon's S3. The product is currently in alpha release. Send an email to `info(a)leastauthority.com`_ to participate in the alpha testing if you are interested. .. _`Least Authority Enterprises`: http://leastauthority.com/ .. _`info(a)leastauthority.com`: mailto:info@leastauthority.com Open Source Project of the Week =============================== The Open Source project of the week is Tiddly on Tahoe. tiddly_on_tahoe_ combines the functionality of TiddlyWiki_ with Tahoe. Doing so allows you to run an unhosted web application. Prime example of an unhosted web application using tiddly_on_tahoe is `Zooko's blog`_ and the `Unhosted Wiki`_. .. _tiddly_on_tahoe: http://tahoe-lafs.org/trac/tiddly_on_tahoe .. _TiddlyWiki: http://www.tiddlywiki.com/ .. _`Zooko's blog`: http://insecure.tahoe-lafs.org/uri/URI:DIR2-RO:ixqhc4kdbjxc7o65xjnveoewym:5… .. _`Unhosted Wiki`: http://insecure.tahoe-lafs.org/uri/URI:DIR2:fx7qhfvfrrm7um327ntkjwfu3m:tyns… >From the tahoe-dev Mailing List =============================== Nathan Eisenberg, part of `Atlas Networks`_ solicited feedback_ for designing a Tahoe-LAFS grid. Mahmoud Ismail announced_ Nilestore_. Nilestore is a distributed storage system which follows the same design of Tahoe-LAFS. .. _`Atlas Networks`: http://www.atlasnetworks.us .. _feedback: http://tahoe-lafs.org/pipermail/tahoe-dev/2011-June/006499.html .. _announced: http://tahoe-lafs.org/pipermail/tahoe-dev/2011-June/006502.html .. _Nilestore: http://code.google.com/p/nilestore/ Patch Needing Review of the Week ================================ The Patch Needing Review of the Week is 1409_. This patch removes the contrib/fuse directory. This will remove the tools within this directory as they are unsupported. So, if anyone is interested in maintaining and updating these tools, please adopt them and move them into a new source tree and let us know. .. _1409: http://tahoe-lafs.org/trac/tahoe-lafs/ticket/1409 Tips and Tricks of the Week =========================== >From the wiki TipsTricks_ page. Kevin Reid provides instructions_ for automatically repairing Tahoe-LAFS files. .. _instructions: http://tahoe-lafs.org/pipermail/tahoe-dev/2009-October/003012.html ---- *The Tahoe-LAFS Weekly News is published once a week by The Tahoe-LAFS Software Foundation, President and Treasurer: Peter Secor. Scribes: Patrick "marlowe" McDonald, Zooko Wilcox-O'Hearn, Editor: Zooko.* `View TWN on the web`_ *or* `subscribe to TWN`_ *. Send your news stories to* marlowe(a)antagonism.org_ *b submission deadline: Friday night.* .. _marlowe(a)antagonism.org: mailto:marlowe@antagonism.org -- ---------------------------------------------------------------- | Patrick R. McDonald GPG Key: 668AA5DF | | https://www.antagonism.org/ <marlowe(a)antagonism.org> | | <mcdonald.patrick.r(a)gmail.com> | | <patrick(a)opensecurityfoundation.org> | ---------------------------------------------------------------- | Malo periculosam libertatem quam quietum servitium | ---------------------------------------------------------------- _______________________________________________ tahoe-lafs-weekly-news mailing list tahoe-lafs-weekly-news(a)tahoe-lafs.org http://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-lafs-weekly-news ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [i2p] Re: side channel attacks
by Tom Kaitchuck 06 Jul '18

06 Jul '18

Nostra2004(a)Safe-mail.net wrote: >I believe programs that search for spelling and style characteristics can >be largely thwarted by passing the text through at least two language >translation programs and tweaking the text to remove obvious semantic >errors. The translators will also, often, help do an inadvertent spell >checking when they can't identify the English word, leaving it untouched. > >Here is an example of passing the above paragraph through a >English-Russian-English transform using http://www.translate.ru : > >"I believe to programs that searches for spelling and develops features, it >is possible to stir substantially, transferring the text at least through >two language programs of translation and ?????????? the text to remove >obvious semantic mistakes. Translators will be also, often, to help to do >the negligent period checking when they cannot identify an English word, >leaving it is untouched." > >Leaving in the cyrillic selected by the translator for the word "tweaking" >may help throwt automated style analysis programs. > >Here's the same paragraph transformed through German: > >"I believe programs which can look for the orthography and style qualities >be mainly crossed, the text by at least two linguistic translation programs >passing and the text pinching to remove evident semantic mistakes. The >translators will also help often to do an inattentive period examination if >they cannot identify the English word, it untouched leaving." > >Nostra > > If you are that worried about someone identifying you, maybe sending the sensitive information out unencrypted over the Internet to an easily identifiable third-party that can be monitored is a bad idea. Downloading the software is not much better, as it is still a very distinctive feature. When doing anything for the sake of anonymity you must consider both your threat model and your anonymity set. A perfectly secure network is worthless if the bar to entry is so high that only a few people ever join. Even if you could only ever know something came from someone on the network, that fact alone would reduce the number of individuals that could be responsible to fewer than if they hadn't bothered with the network. _______________________________________________ i2p mailing list i2p(a)i2p.net http://i2p.dnsalias.net/mailman/listinfo/i2p ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Wikipedia proposal
by Jason Holt 06 Jul '18

06 Jul '18

I just posted this to wikitech-l: There has been a lot of discussion lately on the or-talk list about how to let tor and other anonymizing proxy users edit wikipedia without allowing vandals free rein. Several straightforward approaches have been proposed, such as holding edits in escrow pending approval by a trusted user, and requiring anonymizing network users to login before posting. The latter idea in particular could easily be abused, since abusers can create a new account for each edit. Roger Dingledine, tor's author, suggested creating a pseudonym service using a cryptographic construction called blind signatures: http://www.rsasecurity.com/rsalabs/node.asp?id=2339 Basically, Alice can generate a token, mathematically blind it (obscuring its value), have it signed, then unblind the signature. Anyone can verify that the signature on the token is valid, but nobody, including the signer, can link the blinded value Alice had signed with her unblinded token. I implemented such a scheme which works as follows: * Alice creates and blinds a token, then submits it to a token server for signing. Optionally, the token server may have a list of IPs banned from wikipedia, and refuse to sign Alice's token if her IP is on the list. * The token server signs the blinded token, then records what IP address Alice used so that she can't obtain multiple tokens per IP address. Later, this will allow us to block Alice's IP address if she misbehaves, just as Wikipedia admins currently do, except that now it'll work even when she connects via tor. Token rationing could also be done based on other (more or less) scarce resources, including email addresses, captchas, CPU-intensive tasks or even money, just as I'm sure has been proposed for the vanilla wikipedia. The advantage of blind signatures is that tokens can be recorded and blocked without revealing the potentially sensitive underlying resource (such as a personal email address or IP address). * Alice can now turn on tor and present her token to wp, without revealing her actual IP address. This token takes the place of the IP address record currently stored along with article edits, and can be blacklisted just the same way that IPs are banned. * However, I implemented an intermediary step which has several advantages. Instead of presenting her token to wp, Alice generates an essentially empty client certificate and presents it via the tor network to a certificate authority (CA) for signing, along with the signed token. The CA records that the token has been "spent" (preventing her from receiving multiple certs per token), then signs her cert just as Verisign would sign a server SSL certificate. Since she connects via tor, the CA doesn't learn her real IP address. * Alice installs the client certificate in her browser, then connects to a special wp server running an SSL server that demands valid client certificates from our CA. That configuration takes only 4 lines in my apache-ssl server's httpd.conf. Apache automatically sets environment variables which identify the client certificate, and which can be used in place of the REMOTE_ADDR variable currently used to record users' incoming IP addresses when marking page edits. Blocking a client cert would then be just as easy as blocking an IP address. All of Alice's edits will be marked with that identifier unless she obtains a new IP address (or other scarce resource) and repeats the process to obtain another certificate. Later, features can optionally be added which will allow her to have separate identifiers for each edit (protecting her in case, say, her repressive government confiscates her computer in order to find out if she wrote a particular article they disagree with). I have already released code to implement this system, with the exception of the wp-specific code. I sent the proposal to both the or-talk lists and the cryptography list at metzdowd.com on Monday. Next I'd like your comments, before I dive into the mediawiki code (or find someone willing to help with this part). Once the feature is complete, we can set up a live test wiki for people to bang on, before we consider implementation on the live wp servers. -J ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Question re: current telco lawsuits
by Richard Forno 06 Jul '18

06 Jul '18

I know EFF, CPSR, EPIC, ACLU, and others are tracking the NSA monitoring item and many have filed lawsuits against the telcos for supporting various NSA programs in recent months. Over this weekend we're seeing both individual and class action suits filed against some of the involved telcos, and at least one state public utility commission (Maine) reportedly opening up an investigation into the allegations. Has anyone developed, or is anyone developing, an aggregate list of current or planned lawsuits against the telcos -- particularly class actions -- that folks can refer to and/or participate in? I've had a few folks ask about it, but I've not come across a "master list" of such endeavors yet. -rick Infowarrior.org ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Question re: current telco lawsuits
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[tahoe-lafs-weekly-news] Tahoe Weekly News #5
by Patrick R McDonald 06 Jul '18

06 Jul '18

===================================================== Tahoe-LAFS Weekly News, issue number 5, July 4, 2011 ===================================================== Welcome to the Tahoe-LAFS Weekly News (TWN). Tahoe-LAFS_ is a secure, distributed storage system. `View TWN on the web`_ *or* `subscribe to TWN`_. .. _Tahoe-LAFS: http://tahoe-lafs.org .. _View TWN on the web: http://tahoe-lafs.org/trac/tahoe-lafs/wiki/TahoeLAFSWeeklyNews .. _subscribe to TWN: http://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-lafs-weekly-news Announcements and News ====================== Tahoe-LAFS Summit ----------------- This week saw the first `Tahoe-LAFS Summit`_. Thanks again to the folks at NoiseBridge_ for hosting the Summit. For those who were unable to attend, you can catch up with the ustream feeds provided by nejucomo_ and secorp_. More updates regarding the Summit coming later this week. .. _`Tahoe-LAFS Summit`: http://tahoe-lafs.org/trac/tahoe-lafs/wiki/Summit .. _NoiseBridge: https://noisebridge.net/wiki/Noisebridge .. _nejucomo: http://www.ustream.tv/channel/tahoe-lafs-summit .. _secorp: http://www.ustream.tv/channel/tahoe-lafs-summit-end Least Authority Enterprises --------------------------- At the Summit, Zooko announced `Least Authority Enterprises`_ (LAE). LAE is implementing Tahoe-LAFS on Amazon's S3. The product is currently in alpha release. Send an email to `info(a)leastauthority.com`_ to participate in the alpha testing if you are interested. .. _`Least Authority Enterprises`: http://leastauthority.com/ .. _`info(a)leastauthority.com`: mailto:info@leastauthority.com Open Source Project of the Week =============================== The Open Source project of the week is Tiddly on Tahoe. tiddly_on_tahoe_ combines the functionality of TiddlyWiki_ with Tahoe. Doing so allows you to run an unhosted web application. Prime example of an unhosted web application using tiddly_on_tahoe is `Zooko's blog`_ and the `Unhosted Wiki`_. .. _tiddly_on_tahoe: http://tahoe-lafs.org/trac/tiddly_on_tahoe .. _TiddlyWiki: http://www.tiddlywiki.com/ .. _`Zooko's blog`: http://insecure.tahoe-lafs.org/uri/URI:DIR2-RO:ixqhc4kdbjxc7o65xjnveoewym:5… .. _`Unhosted Wiki`: http://insecure.tahoe-lafs.org/uri/URI:DIR2:fx7qhfvfrrm7um327ntkjwfu3m:tyns… >From the tahoe-dev Mailing List =============================== Nathan Eisenberg, part of `Atlas Networks`_ solicited feedback_ for designing a Tahoe-LAFS grid. Mahmoud Ismail announced_ Nilestore_. Nilestore is a distributed storage system which follows the same design of Tahoe-LAFS. .. _`Atlas Networks`: http://www.atlasnetworks.us .. _feedback: http://tahoe-lafs.org/pipermail/tahoe-dev/2011-June/006499.html .. _announced: http://tahoe-lafs.org/pipermail/tahoe-dev/2011-June/006502.html .. _Nilestore: http://code.google.com/p/nilestore/ Patch Needing Review of the Week ================================ The Patch Needing Review of the Week is 1409_. This patch removes the contrib/fuse directory. This will remove the tools within this directory as they are unsupported. So, if anyone is interested in maintaining and updating these tools, please adopt them and move them into a new source tree and let us know. .. _1409: http://tahoe-lafs.org/trac/tahoe-lafs/ticket/1409 Tips and Tricks of the Week =========================== >From the wiki TipsTricks_ page. Kevin Reid provides instructions_ for automatically repairing Tahoe-LAFS files. .. _instructions: http://tahoe-lafs.org/pipermail/tahoe-dev/2009-October/003012.html ---- *The Tahoe-LAFS Weekly News is published once a week by The Tahoe-LAFS Software Foundation, President and Treasurer: Peter Secor. Scribes: Patrick "marlowe" McDonald, Zooko Wilcox-O'Hearn, Editor: Zooko.* `View TWN on the web`_ *or* `subscribe to TWN`_ *. Send your news stories to* marlowe(a)antagonism.org_ *b submission deadline: Friday night.* .. _marlowe(a)antagonism.org: mailto:marlowe@antagonism.org -- ---------------------------------------------------------------- | Patrick R. McDonald GPG Key: 668AA5DF | | https://www.antagonism.org/ <marlowe(a)antagonism.org> | | <mcdonald.patrick.r(a)gmail.com> | | <patrick(a)opensecurityfoundation.org> | ---------------------------------------------------------------- | Malo periculosam libertatem quam quietum servitium | ---------------------------------------------------------------- _______________________________________________ tahoe-lafs-weekly-news mailing list tahoe-lafs-weekly-news(a)tahoe-lafs.org http://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-lafs-weekly-news ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0