July 2018 - cypherpunks-legacy

[osint] Militants and the Latest Mobile Phone Technology
by MARQUEZ Thierry 06 Jul '18

06 Jul '18

Militants and the Latest Mobile Phone Technology Dec 08, 2004 1843 GMT Norwegian police said Dec. 8 they want to stop the sale of cell phone cards that allow the caller to remain anonymous. Their fear is that criminals will exploit these cards to avoid detection. This concern, which has been raised by law enforcement agencies elsewhere, could -- and should -- be extended to terrorists. Cell phones used in the planning and execution of attacks pose a serious obstacle to the security and counterterrorism forces charged with disrupting militant activities. These phones allow militants to communicate with one another while in the field, in real time and over long distances using cheap and readily available technology. Couple those advantages with the latest technology -- camera phones -- and law enforcement faces a walking, talking terrorist workshop. On the other hand, a phone is another link in the militant chain, presenting the opportunity for law enforcement to detect -- and thwart -- an attack before it takes place. Technology does allows security and law enforcement agencies to determine who places a phone call or sends an SMS text message, and to track the call to its source. This kind of evidence has been presented in a number of criminal cases around the world, most recently in October in a U.S. case involving a fake kidnapping in Massachusetts. Then again, there are ways to avoid detection. Savvy criminals, including militants, can evade detection in a number of ways, especially if they are operating in a developing country where security agencies might lack the necessary tracking technology or where the mobile phone industry is much less regulated. However, even in developed countries, there are easy and relatively inexpensive ways to get around law enforcement. The cheapest and most effective method is through the use of multiple Subscriber Identity Modules (SIM) cards -- the digital fingerprint of a mobile phone. Authorities can track a cell phone user by tracking the SIM card -- even if the user has not made a call. In order to avoid detection, a savvy militant will use the SIM card only once -- to decrease the number of chances for detection and association -- and then toss it away. High-ranking Hamas officials allegedly use this tactic to avoid identification and targeting by Israeli authorities. Indian authorities warned earlier this year that militants in the Kashmir region were using pre-paid phones (presumably with different SIM cards) to coordinate and plan operations. This tactic is a relatively new development -- conceived by the always innovative criminal mind in response to law enforcement successes in tracking suspected militants through their phones. For example, a multinational mobile phone sting operation was integral in the capture of suspected Sept. 11 mastermind Khalid Sheikh Mohammed. Furthermore, mobile phones also have become almost standard equipment in the construction of remotely detonated bombs, as they make inexpensive and fairly reliable triggers. The March 11 Madrid train bombers used this method to trigger their bombs -- though Spanish authorities later successfully tracked the bombers via one of the cell phone-triggered bombs that failed to detonate. Cell phones used in preoperational surveillance also can present a serious challenge to law enforcement, largely because of their now-ubiquitous nature. In other words, a person -- criminal or not -- talking on a cell phone outside of a building or a landmark raises no alarm bells. A cell phone with instantaneous picture transmission can be an even better terrorist tool. Based on the creativity already demonstrated by some militants in the use of cell phones -- an SMS message instructed a jailed Abu Sayyaf member to escape from an Indonesian prison in 2003 -- new methods of evading detection using mobile technology are likely to emerge. The development of technology to allow users to use the same phone to call from around the world, while changing its SIM cards, possibly is the next step. [Non-text portions of this message have been removed] ------------------------ Yahoo! Groups Sponsor --------------------~--> Make a clean sweep of pop-up ads. Yahoo! Companion Toolbar. Now with Pop-Up Blocker. Get it for free! http://us.click.yahoo.com/L5YrjA/eSIIAA/yQLSAA/TySplB/TM --------------------------------------------------------------------~-> -------------------------- Want to discuss this topic? Head on over to our discussion list, discuss-osint(a)yahoogroups.com. -------------------------- Brooks Isoldi, editor bisoldi(a)intellnet.org http://www.intellnet.org Post message: osint(a)yahoogroups.com Subscribe: osint-subscribe(a)yahoogroups.com Unsubscribe: osint-unsubscribe(a)yahoogroups.com *** FAIR USE NOTICE. This message contains copyrighted material whose use has not been specifically authorized by the copyright owner. OSINT, as a part of The Intelligence Network, is making it available without profit to OSINT YahooGroups members who have expressed a prior interest in receiving the included information in their efforts to advance the understanding of intelligence and law enforcement organizations, their activities, methods, techniques, human rights, civil liberties, social justice and other intelligence related issues, for non-profit research and educational purposes only. We believe that this constitutes a 'fair use' of the copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use this copyrighted material for purposes of your own that go beyond 'fair use,' you must obtain permission from the copyright owner. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/osint/ <*> To unsubscribe from this group, send an email to: osint-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [p2p-hackers] Bitcoin incentive on Kademlia networks
by Changaco 06 Jul '18

06 Jul '18

On Thu, 01 Nov 2012 08:57:00 +1000 "James A. Donald" wrote: > The big problem in peer to peer is free loaders, the biggest problem > being that we need a seeding incentive. I disagree with that statement. Yes, some people don't understand the rules or don't want to play by them, but overall it still works quite well. > To fix, need something like money. Money based on whatb/? You can't ID people, you can't even ID machines. The Internet is not anonymous, but it's not authenticated either. That's why Bitcoin is based on CPU work, something you can't fake. You can "steal" it though, I believe I heard something about botnets used for Bitcoin mining. On Fri, 02 Nov 2012 09:19:34 +1000 "James A. Donald" wrote: > Need fully automated fractional reserve banks, which use bitcoin as > gold. Accounts are, of course, public keys, banknotes are chaumian tokens. Bitcoin is a good P2P experiment, but it will be abandoned like gold was, because it's neither efficient nor fair. _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: leaker-optimized versions of Tor
by Lucky Green 06 Jul '18

06 Jul '18

On 2010-12-08 06:30, Eugen Leitl wrote: > On Wed, Dec 08, 2010 at 03:15:24PM +0100, Mitar wrote: >> Hi! >> >> On Wed, Dec 8, 2010 at 2:17 PM, Eugen Leitl <eugen(a)leitl.org> wrote: >>> It should default to a much larger number of hops, >> >> Why? Is this really necessary? > > Tor as is wasn't designed to resist TLA-level adversaries (which > have no issues instrumenting each Tor node upstream with realtime > network probes, and dedicate enough resouces for traffic analysis). There are no low-latency anonymizing system designs known to science today that can protect a user's privacy against a determined, global, TLA-level adversary. Considerable and by no means unreasonable doubt exist in the community if such a design is even theoretically possible, a question for which I refrain from forming an opinion solely due to the impressive progress science has made over the millennia. The picture is less clear when it comes to high-latency systems, such as anonymous remailers. No rational doubt exists in the community that the systems so far fielded fail to protect against this treat model. But the question if we know how to design a high-latency system that defends against the proposed threat model largely remains unanswered. This is in part due to the fact that the bulk of recent research has focused primarily on low-latency systems. That said, it is my belief that if a low-latency system protecting privacy in the face of TLA-level actors were to be identified, I suspect the design will be based on PIR, not MIX. It is for this reason that I encourage high-latency anonymity researchers to focus on PIR designs. --Lucky Green *********************************************************************** To unsubscribe, send an e-mail to majordomo(a)torproject.org with unsubscribe or-talk in the body. http://archives.seul.org/or/talk/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [P2P-F] Would you like to write about how to set up a mesh network
by Patrick Anderson 06 Jul '18

06 Jul '18

The following are not necessarily focused on 'mesh' networking, but are more generally addressing the shared property ownership of that physical infrastructure. On a similar note: I am forming a plan for an alternative organizational form (or business model) that solves the typical problem of power concentration during the growth of such endeavors which would apply across all types of sharing, not just internet access. ---- http://Frankston.com >>My current interest is moving beyond the 19th century concept of telecom to community owned infrastructure. This would add hundreds of billions of dollars to the US and much more value by creating opportunity for what we can't imagine. http://VillageTelco.org >>an easy-to-use, scalable, standards-based, wireless, local, do-it-yourself, telephone company toolkit http://TheConnective.net >>Together we can replace the telco's 'last mile' - the communication networks at the neighborhood level - with our own 'first mile' of free and open connectivity. http://netBlazr.com >>netBlazr customizes next-generation, but commercially tested, directional radios and networking equipment to deliver high-speed broadband through your office window. http://MuniNetworks.org >>Communities across America have set up community broadband networks to ensure access to affordable, fast networks. http://MediaPolicy.NewAmerica.net/publications/policy/from_the_digital_divi… >>From the Digital Divide to Digital Excellence http://WeRebuild.eu >>We Rebuild is a decentralized cluster of net activists who have joined forces to collaborate on issues concerning access to a free Internet without intrusive surveillance. http://seattlewireless.net >>SeattleWireless is a grassroots Community Wireless Network project in Seattle, Washington. Its goals include the creation of a broadband wireless metropolitan area network, as well as the creation of tools that help us achieve that goal. http://Sites.Google.com/site/wasabinetwifi >>Do you want $9.99/month wireless Internet without needing a telephone line, cable TV, or satellite? Do you want free email? Do you want to own your community's Internet network with your neighbors? http://guifi.net ---- Patrick Anderson Social Sufficiency Coalition http://SourceFreedom.BlogSpot.com On Thu, Feb 3, 2011 at 9:53 AM, Neal Gorenflo <neal(a)shareable.net> wrote: > Hi p2p friends, > We at Shareable are looking for someone to write a how-to article about > how to set up a neighborhood mesh network so neighbors can share > Internet access. > Please contact me if you're interested or know someone who > could do a good job at it. What's especially appreciated is someone who > has actually set one up or knows someone who has that can be a source. > The article would add to our library of around 80 how-to share guides > including how to start a housing coop, a chicken coop, hold a > free market, share a vegetable garden, start a farmers market and more: > http://shareable.net/how-to-share > Neal > > -- > > Neal Gorenflo | Publisher, http://Shareable.net | 415.867.0429 > > _______________________________________________ > P2P Foundation - Mailing list > http://www.p2pfoundation.net > https://lists.ourproject.org/cgi-bin/mailman/listinfo/p2p-foundation > > _______________________________________________ P2P Foundation - Mailing list http://www.p2pfoundation.net https://lists.ourproject.org/cgi-bin/mailman/listinfo/p2p-foundation ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: leaker-optimized versions of Tor
by Lucky Green 06 Jul '18

06 Jul '18

On 2010-12-08 06:30, Eugen Leitl wrote: > On Wed, Dec 08, 2010 at 03:15:24PM +0100, Mitar wrote: >> Hi! >> >> On Wed, Dec 8, 2010 at 2:17 PM, Eugen Leitl <eugen(a)leitl.org> wrote: >>> It should default to a much larger number of hops, >> >> Why? Is this really necessary? > > Tor as is wasn't designed to resist TLA-level adversaries (which > have no issues instrumenting each Tor node upstream with realtime > network probes, and dedicate enough resouces for traffic analysis). There are no low-latency anonymizing system designs known to science today that can protect a user's privacy against a determined, global, TLA-level adversary. Considerable and by no means unreasonable doubt exist in the community if such a design is even theoretically possible, a question for which I refrain from forming an opinion solely due to the impressive progress science has made over the millennia. The picture is less clear when it comes to high-latency systems, such as anonymous remailers. No rational doubt exists in the community that the systems so far fielded fail to protect against this treat model. But the question if we know how to design a high-latency system that defends against the proposed threat model largely remains unanswered. This is in part due to the fact that the bulk of recent research has focused primarily on low-latency systems. That said, it is my belief that if a low-latency system protecting privacy in the face of TLA-level actors were to be identified, I suspect the design will be based on PIR, not MIX. It is for this reason that I encourage high-latency anonymity researchers to focus on PIR designs. --Lucky Green *********************************************************************** To unsubscribe, send an e-mail to majordomo(a)torproject.org with unsubscribe or-talk in the body. http://archives.seul.org/or/talk/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [P2P-F] Would you like to write about how to set up a mesh network
by Patrick Anderson 06 Jul '18

06 Jul '18

The following are not necessarily focused on 'mesh' networking, but are more generally addressing the shared property ownership of that physical infrastructure. On a similar note: I am forming a plan for an alternative organizational form (or business model) that solves the typical problem of power concentration during the growth of such endeavors which would apply across all types of sharing, not just internet access. ---- http://Frankston.com >>My current interest is moving beyond the 19th century concept of telecom to community owned infrastructure. This would add hundreds of billions of dollars to the US and much more value by creating opportunity for what we can't imagine. http://VillageTelco.org >>an easy-to-use, scalable, standards-based, wireless, local, do-it-yourself, telephone company toolkit http://TheConnective.net >>Together we can replace the telco's 'last mile' - the communication networks at the neighborhood level - with our own 'first mile' of free and open connectivity. http://netBlazr.com >>netBlazr customizes next-generation, but commercially tested, directional radios and networking equipment to deliver high-speed broadband through your office window. http://MuniNetworks.org >>Communities across America have set up community broadband networks to ensure access to affordable, fast networks. http://MediaPolicy.NewAmerica.net/publications/policy/from_the_digital_divi… >>From the Digital Divide to Digital Excellence http://WeRebuild.eu >>We Rebuild is a decentralized cluster of net activists who have joined forces to collaborate on issues concerning access to a free Internet without intrusive surveillance. http://seattlewireless.net >>SeattleWireless is a grassroots Community Wireless Network project in Seattle, Washington. Its goals include the creation of a broadband wireless metropolitan area network, as well as the creation of tools that help us achieve that goal. http://Sites.Google.com/site/wasabinetwifi >>Do you want $9.99/month wireless Internet without needing a telephone line, cable TV, or satellite? Do you want free email? Do you want to own your community's Internet network with your neighbors? http://guifi.net ---- Patrick Anderson Social Sufficiency Coalition http://SourceFreedom.BlogSpot.com On Thu, Feb 3, 2011 at 9:53 AM, Neal Gorenflo <neal(a)shareable.net> wrote: > Hi p2p friends, > We at Shareable are looking for someone to write a how-to article about > how to set up a neighborhood mesh network so neighbors can share > Internet access. > Please contact me if you're interested or know someone who > could do a good job at it. What's especially appreciated is someone who > has actually set one up or knows someone who has that can be a source. > The article would add to our library of around 80 how-to share guides > including how to start a housing coop, a chicken coop, hold a > free market, share a vegetable garden, start a farmers market and more: > http://shareable.net/how-to-share > Neal > > -- > > Neal Gorenflo | Publisher, http://Shareable.net | 415.867.0429 > > _______________________________________________ > P2P Foundation - Mailing list > http://www.p2pfoundation.net > https://lists.ourproject.org/cgi-bin/mailman/listinfo/p2p-foundation > > _______________________________________________ P2P Foundation - Mailing list http://www.p2pfoundation.net https://lists.ourproject.org/cgi-bin/mailman/listinfo/p2p-foundation ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] if MitM via sub-CA is going on, need a name-and-shame catalog (Re: really sub-CAs for MitM deep packet inspectors?)
by Adam Back 06 Jul '18

06 Jul '18

On Sat, Dec 03, 2011 at 01:00:14AM +1300, Peter Gutmann wrote: > I was asked not to reveal details and I won't, Of course, I would do the same if so asked. But there are lots of people on the list who have not obtained information indirectly, with confidentiality assurances offered, and for them remailers exist. > but in any case I don't know whether it would achieve much. For the case > of a public CA doing it, you'd see that CA X is involved, ... personally I'd like to know who is doing this and at what scale. > I guess if you're running into this sort of thing for the first time then > you'd be out for blood, but if you've been aware of this it going on for more > than a decade then it's just business as usual for commercial PKI. I'm > completely unfazed by it, it's pretty much what you'd expect. I do not think its what you'd expect. A CA should issue certificates only to the holders of certificates. It should NOT issue sub-CA certifactes to third parties who will then issue certs to domains they dont own. Not even on the fly inside a "packet inspection" box. If someone wants to inspect packets on a corporate lan they can issue their own self-signed cert, and install that in their users browsers in their OS install image. Then if I go on their LAN with my own equipment, I'll get a warning. I think its unacceptable to have CAs issuing such certs. >> It breaks a clear expectation of security and privacy the user, even very >> sophisitcated user, has about privacy of their communications. > > Not on a corporate LAN. IANAL but AFAIK your employer's allowed to run that > in whatever way they want. No. Also IANAL but there were several cases where employees did have an expectation of privacy upheld even in the US. Certainly you cant do that in the EU legally either. >> 3. public provider SSL MitM - if your ISP, wifi hotspot, 3g data prov, is >> doing this to you, paid or free, thats illegal IMO. Heads should roll up >> the CA tree. > > I think this is where we differ in our outlook. This (and yeah, I'd still > like to see the certs for one of these from a public location :-) is business > as usual for commercial PKI. I dont view this as business as usual. If I am on a public hotspot, 3g or my own DSL/cable I do ABSOLUTELY NOT expect the ISP to be getting inside my SSL connection to my bank, my gmail account etc. Whether I paid or not. For any reason at all (not to do advert analysis, not to do anti-virus, not to re-write pages etc). I use airport/hotel wifi a lot and I've never seen it and I am suspicious enough to use cert patrol etc. > Remember the link to the SonicWall docs I posted > a few days ago, > http://www.sonicwall.com/downloads/SonicOS_Enhanced_5.6_DPI-SSL_Feature_Mod… > It's an advertised feature of the hardware (not just from SonicWall, other > vendors do it too), d'you think people are going to buy that and then not make > use of it? So you just build your defences around the fact that it's broken > and then you won't run into problems. Well yes I know the hardware exists. I even helped design and implement a software-only MitM at ZKS. Before you get alarmed the cert it created was known only to the user, generated on the machine, and its purpose was to protect the user via a cookie manager protecting their privacy. If you read the sonic wall stuff its fairly clear the model that they talk about at least is that you do not have a sub-CA key. You generate a self-signed CA key, and install it in your corporate LAN browsers trusted CA dbs. Clearly it would also work with such a cert. Similarly their doco about server SSL shows they dont expect you to have a proper sub-CA key. (scenario where the web server for public access is behind the sonicwall) you are expected to import your server SSL certs mapped per IP address into the box. (Otherwise the public would see self-signed MitM notices when they browse the site. Or the sub-CA cert. > Oh, another place where this happens is WAP gateways, where they MITM > everything so they can rewrite the content to save bandwidth and make things > work on mobile devices. So, is that bad, or good, or both, or neither? Well people were complaining about the "WAP gap" a long time ago. I thought this was more about the phones at the time being not CPU powerful enough to terminate SSL. The idea that a gap exists somewhere where your traffic is decrypted was viewed as a significant security limitation people were pleased to see go a way with phones fast enough to terminate their own SSL. That is bad. Are you saying there is anyone doing SSL mitm for stream compression reasons? Who? Adam _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] if MitM via sub-CA is going on, need a name-and-shame catalog (Re: really sub-CAs for MitM deep packet inspectors?)
by Adam Back 06 Jul '18

06 Jul '18

On Sat, Dec 03, 2011 at 01:00:14AM +1300, Peter Gutmann wrote: > I was asked not to reveal details and I won't, Of course, I would do the same if so asked. But there are lots of people on the list who have not obtained information indirectly, with confidentiality assurances offered, and for them remailers exist. > but in any case I don't know whether it would achieve much. For the case > of a public CA doing it, you'd see that CA X is involved, ... personally I'd like to know who is doing this and at what scale. > I guess if you're running into this sort of thing for the first time then > you'd be out for blood, but if you've been aware of this it going on for more > than a decade then it's just business as usual for commercial PKI. I'm > completely unfazed by it, it's pretty much what you'd expect. I do not think its what you'd expect. A CA should issue certificates only to the holders of certificates. It should NOT issue sub-CA certifactes to third parties who will then issue certs to domains they dont own. Not even on the fly inside a "packet inspection" box. If someone wants to inspect packets on a corporate lan they can issue their own self-signed cert, and install that in their users browsers in their OS install image. Then if I go on their LAN with my own equipment, I'll get a warning. I think its unacceptable to have CAs issuing such certs. >> It breaks a clear expectation of security and privacy the user, even very >> sophisitcated user, has about privacy of their communications. > > Not on a corporate LAN. IANAL but AFAIK your employer's allowed to run that > in whatever way they want. No. Also IANAL but there were several cases where employees did have an expectation of privacy upheld even in the US. Certainly you cant do that in the EU legally either. >> 3. public provider SSL MitM - if your ISP, wifi hotspot, 3g data prov, is >> doing this to you, paid or free, thats illegal IMO. Heads should roll up >> the CA tree. > > I think this is where we differ in our outlook. This (and yeah, I'd still > like to see the certs for one of these from a public location :-) is business > as usual for commercial PKI. I dont view this as business as usual. If I am on a public hotspot, 3g or my own DSL/cable I do ABSOLUTELY NOT expect the ISP to be getting inside my SSL connection to my bank, my gmail account etc. Whether I paid or not. For any reason at all (not to do advert analysis, not to do anti-virus, not to re-write pages etc). I use airport/hotel wifi a lot and I've never seen it and I am suspicious enough to use cert patrol etc. > Remember the link to the SonicWall docs I posted > a few days ago, > http://www.sonicwall.com/downloads/SonicOS_Enhanced_5.6_DPI-SSL_Feature_Mod… > It's an advertised feature of the hardware (not just from SonicWall, other > vendors do it too), d'you think people are going to buy that and then not make > use of it? So you just build your defences around the fact that it's broken > and then you won't run into problems. Well yes I know the hardware exists. I even helped design and implement a software-only MitM at ZKS. Before you get alarmed the cert it created was known only to the user, generated on the machine, and its purpose was to protect the user via a cookie manager protecting their privacy. If you read the sonic wall stuff its fairly clear the model that they talk about at least is that you do not have a sub-CA key. You generate a self-signed CA key, and install it in your corporate LAN browsers trusted CA dbs. Clearly it would also work with such a cert. Similarly their doco about server SSL shows they dont expect you to have a proper sub-CA key. (scenario where the web server for public access is behind the sonicwall) you are expected to import your server SSL certs mapped per IP address into the box. (Otherwise the public would see self-signed MitM notices when they browse the site. Or the sub-CA cert. > Oh, another place where this happens is WAP gateways, where they MITM > everything so they can rewrite the content to save bandwidth and make things > work on mobile devices. So, is that bad, or good, or both, or neither? Well people were complaining about the "WAP gap" a long time ago. I thought this was more about the phones at the time being not CPU powerful enough to terminate SSL. The idea that a gap exists somewhere where your traffic is decrypted was viewed as a significant security limitation people were pleased to see go a way with phones fast enough to terminate their own SSL. That is bad. Are you saying there is anyone doing SSL mitm for stream compression reasons? Who? Adam _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Freedombox-discuss] Another reason for the Box
by Sandy Harris 06 Jul '18

06 Jul '18

FBI reading Gmail: http://www.huffingtonpost.com/2012/11/12/petraeus-fbi-gmail_n_2119319.html _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Call for Open Letter on Skype
by Ryan Gallagher 06 Jul '18

06 Jul '18

Nadim Kobeissi <nadim(a)nadim.cc> wrote: > > Isn't it time for an open letter regarding Skype? > I think this is a great idea. I tried and failed back in July to get straight answers from Skype regarding the data it is in a position to hand over to authorities. I found the level of obfuscation extremely frustrating. Skype has since denied that its architecture changes had anything to do with enabling comms interception ( http://blogs.skype.com/en/2012/07/what_does_skypes_architecture_do.html) however, it has failed to respond to other crucial questions, such as: why did Microsoft file a patent for a "legal intercept" technology specifically designed to help intercept Skype VoIP calls? Is the eventual aim to integrate this technology into the Skype architecture? I think Skype's 600 million users around the world have a right to know the answer to that question. As far as an open letter is concerned, it's worth noting that Eric King at Privacy International previously wrote to Skype asking some pertinent questions: https://www.privacyinternational.org/blog/skype-please-act-like-the-respons… I'm not sure what response (if any) Eric received. Either way, I'm pretty sure he'd be willing to get involved with a fresh open letter effort. Personally speaking, I think any open letter should be endorsed by as diverse an array of groups as possible to reflect the broad range of stakeholders with legitimate concerns over Skype's security. This issue is extremely important to people working in my line of work (journalism), and of course it also matters not only to activists but to everyday citizens who want to know exactly what Skype can and can't do with their data. Feel free to get in touch with me if you are pushing forward with this, Nadim. I'd be more than happy to try to get on board some groups that represent the interests of journalists. Best, Ryan -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0