July 2018 - cypherpunks-legacy

Tor: A JAP Replacement
by brian-slashdotnews＠hyperreal.org 06 Jul '18

06 Jul '18

Link: http://slashdot.org/article.pl?sid=04/08/05/2352235 Posted by: CowboyNeal, on 2004-08-06 01:14:00 from the trust-no-one dept. [1]kid_wonder writes "Wired is running an article [2]describing an answer to this [3]previous /. story. Packets are sent through a network of randomly selected servers each of which knows only its predecessor and successor. Packets are unwrapped by a symmetric encryption key at each server that peels off one layer and reveals instructions for the next downstream node. As a 'connection-based low-latency anonymous communication system,' [4]Tor seems to be the answer to [5]JAP to allow anonymous networking activities of all kinds." References 1. http://.moc.nielk-ttocs..ta..nielks/ 2. http://www.wired.com/news/print/0,1294,64464,00.html 3. file://ask.slashdot.org/article.pl?sid=03/09/18/0051216&tid=158 4. http://www.freehaven.net/tor/ 5. http://anon.inf.tu-dresden.de/index_en.html/ ----- End forwarded message ----- Onion Routing Averts Prying Eyes By Ann Harrison Story location: http://www.wired.com/news/privacy/0,1848,64464,00.html 02:00 AM Aug. 05, 2004 PT Computer programmers are modifying a communications system, originally developed by the U.S. Naval Research Lab, to help Internet users surf the Web anonymously and shield their online activities from corporate or government eyes. The system is based on a concept called onion routing. It works like this: Messages, or packets of information, are sent through a distributed network of randomly selected servers, or nodes, each of which knows only its predecessor and successor. Messages flowing through this network are unwrapped by a symmetric encryption key at each server that peels off one layer and reveals instructions for the next downstream node. In contrast, messages traveling across the Internet are generally not encrypted, and the path of a message can be seen easily, linking users to activities like website visits. The Navy is financing the development of a second-generation onion-routing system called Tor, which addresses many of the flaws in the original design and makes it easier to use. The Tor client behaves like a SOCKS proxy (a common protocol for developing secure communication services), allowing applications like Mozilla, SSH and FTP clients to talk directly to Tor and route data streams through a network of onion routers, without long delays. Onion routing does not guarantee perfect anonymity. But it helps protect users from eavesdroppers who aren't watching both the initiator and recipient of the message at the time of the transaction. Developers say Tor can be used to prevent websites from tracking their users; block governments from collecting lists of website visitors; protect whistleblowers; and circumvent local censorship by employers, ISPs or schools that restrict access to certain online services. The Navy is financing Tor because it wants to hide the identity of government employees who have long used anonymous communications systems for intelligence gathering and politically sensitive negotiations. "The point of the Tor system is to spread the traffic over multiple points of control so that no one person or company has the ability to link people," said programmer Roger Dingledine. Dingledine and Nick Mathewson, both based in Boston, are building Tor as a research platform with a worldwide community of open-source software developers. Their goal is to blend together a wide range of users and avoid the weakness of many anonymizing services that are located on a handful of machines and vulnerable to a single point of failure. Companies could also use Tor for discreet competitive research, said Dingledine, or to route their employees' Web browsing so employment sites like Monster can't determine which of them are trolling for a job. "Plenty of people don't want their source IP listed in Web logs, especially .mil or .gov visitors," said Dingledine. The security of the Tor service is proportional to the number of nodes in the system. Tor is slowly scaling and looking for tens of thousands of participants who can provide enough nodes to prevent the service from being compromised by what the project website describes as "curious telcos and brute-force attacks." "The current Tor version very effectively builds on 20 years of development in anonymous designs," said cryptographer David Chaum, whose 1981 paper on untraceable e-mail, return addresses and digital pseudonyms set the groundwork for the Tor service. Tor is distributed as free software under the commonly used 3-clause BSD license. About 1,000 users (it's an anonymous network, so developers aren't exactly sure) are running the service in client or server mode. The Tor network currently includes 35 servers that forward each data stream at least three times. Each server averages 10 Kbps of bandwidth. Those with reliable Internet connections, who can support at least 1 Mbps in both directions, are being recruited as potential servers in the network. Users are permitted to operate an unrestricted number of nodes. But Dingledine pointed out that a well-funded adversary could sign up for a large number of servers and potentially take over the network. Those who want to operate Tor routers must therefore convince the Tor directory server operators that they are trustworthy and reliable. Dingledine said developers are trying to find ways to scale the system without having to have a human check the integrity of every new server that becomes part of the network. Dingeldine said the developers of another online anonymity project, called JAP, were forced by the German government to insert a backdoor into the program and were barred from revealing it. If anyone insisted on similar measures for Tor, Dingledine said the community of open-source developers who analyze source-code changes for each Tor revision would expose it -- as they did with JAP. "The reason Tor works is that it's free and available software," said Dingledine. "If it was a closed source or a proprietary system, there is no way to know." -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[ShmooCon-News] Saturday night's con
by shmoocon-news＠lists.shmoo.com 06 Jul '18

06 Jul '18

Saturday night's fun has basically been finalized, so it's time to clue attendees in. ShmooCon 2005 attendees are invited to boogie at FUR, a rather hip dance club in D.C., Saturday night, February 5th, from 10 to whenever. Check out FUR's website here: http://www.furnightclub.com FUR is letting all ShmooCon 2005 attendees, 21 and over, in for FREE. The private speaker party with open bar in the Mafia lounge at FUR runs from 10 to midnight, and features spinning by everyone's favorite West-coast, DefCon & ToorCon-infamous DJ, Keith! w00t! Anyone who reserved a room at the conference hotel under the ShmooCon group rate will get a pass to the speaker party once they check-in at the hotel. If you didn't reserve a room at the conference hotel, or you aren't a speaker, then you'd better practice on your social engineering skills to score a pass to the speaker party. Rumor has it, speakers will have extra passes to distribute as they see fit. ;) And one more note: FUR, not the Shmoo Group, controls the dress code--read the FUR FAQ here: http://www.furnightclub.com/Content/FAQ.html So no whining about having to look (and smell) nice. Got it? See you at FUR on Saturday night of the con! Sincerely, Beetle The Shmoo Group _______________________________________________ Shmoocon-News mailing list Shmoocon-News(a)lists.shmoo.com https://lists.shmoo.com/mailman/listinfo/shmoocon-news --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Pentagon Targets Blogs
by Ralph Sierra 06 Jul '18

06 Jul '18

In what may be the understatement of the year, the Pentagon includes the warning that their actions may "sound ominous." Not only are we paying to have favorable stories planted in foreign newspapers, but now we're employing professionals to post information to blogs. Question: Do you suppose when they blog they identify themselves as paid Pentagon informants? "Pentagon Targets Blogs "A new U.S. Central Command team, according to a news release, "contacts bloggers to inform the writers about any given topic that may have been posted on their site. . . . The team engages bloggers who are posting inaccurate or untrue information, as well as bloggers who are posting incomplete information." "While that may sound ominous, the release says the unit works with more than 250 bloggers "to try to disseminate news about the good work being done by U.S. forces in the global war on terror." This, says Army Reserve Maj. Richard Norton, has a "viral effect" that drives Web users to CentCom's Web site. The team's motto: "Engage." http://www.washingtonpost.com/wp-dyn/content/article/2006/03/05/AR200603050… 90.html Ralph Sierra ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Pentagon Targets Blogs
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [gsc] Led Zeppelin
by Robert dCZ 06 Jul '18

06 Jul '18

Hmmm. So first they scared off foreign investors who wanted to by assets as opposed to paper. Then they started killing off the tourism industry by making visitors feel as unwelcome as once upon a time communist Albania. Now they make people think twice before considering living there and accepting residency (which will of course encourage well healed, smart people to refrain from paying any tax in the US altogether by not becoming residents, but commuters of one type or anither, for tax purposes). What I don't understand is why on Earth wealthy political dynasties have sent the current generation of legislators to public schools? I mean, how else could they be so God-forsakenly dumb? The "law of unforseeable consequences" has outlived its purpose, and someone needs to formulate a "law of predictable hardship as a result of any action by US officials". If you ask me - - - well, nobody ever does ;o) Cheers, Robert.

1 0

Apparent large telco liability based on USA Today facts
by Peter Swire 06 Jul '18

06 Jul '18

Dave: Perhaps your list can spot a flaw here. Based on the statutory language, it seems that the telcos face really large liability on the facts as reported in USA Today. Thanks, Peter http://thinkprogress.org/2006/05/11/telcos-liable/ This morning, USA Today reported that three telecommunications companies - AT&T, Verizon and BellSouth - provided "phone call records of tens of millions of Americans" to the National Security Agency. Such conduct appears to be illegal and could make the telco firms liable for tens of billions of dollars. Here's why: 1. It violates the Stored Communications Act. The Stored Communications Act, Section 2703(c), provides exactly five exceptions that would permit a phone company to disclose to the government the list of calls to or from a subscriber: (i) a warrant; (ii) a court order; (iii) the customer's consent; (iv) for telemarketing enforcement; or (v) by "administrative subpoena." The first four clearly don't apply. As for administrative subpoenas, where a government agency asks for records without court approval, there is a simple answer - the NSA has no administrative subpoena authority, and it is the NSA that reportedly got the phone records. 2. The penalty for violating the Stored Communications Act is $1000 per individual violation. Section 2707 of the Stored Communications Act gives a private right of action to any telephone customer "aggrieved by any violation." If the phone company acted with a "knowing or intentional state of mind," then the customer wins actual harm, attorney's fees, and "in no case shall a person entitled to recover receive less than the sum of $1,000." (The phone companies might say they didn't "know" they were violating the law. But USA Today reports that Qwest's lawyers knew about the legal risks, which are bright and clear in the statute book.) 3. The Foreign Intelligence Surveillance Act doesn't get the telcos off the hook. According to USA Today, the NSA did not go to the FISA court to get a court order. And Qwest is quoted as saying that the Attorney General would not certify that the request was lawful under FISA. So FISA provides no defense for the phone companies, either. In other words, for every 1 million Americans whose records were turned over to NSA, the telcos could be liable for $1 billion in penalties, plus attorneys fees. You do the math. Prof. Peter P. Swire C. William O'Neill Professor of Law Moritz College of Law of The Ohio State University Visiting Senior Fellow, Center for American Progress (240) 994-4142, www.peterswire.net ------------------------------------- You are subscribed as synthesis.law.and.technology(a)gmail.com To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting- people/ -- ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] more on COMMENTS REQUESTED -- Apparent large telco liability
by David Farber 06 Jul '18

06 Jul '18

based on USA Today facts X-Mailer: Apple Mail (2.750) Reply-To: dave(a)farber.net Begin forwarded message: From: "Synthesis: Law and Technology" <synthesis.law.and.technology(a)gmail.com> Date: May 12, 2006 12:09:54 PM EDT To: dave(a)farber.net Cc: peter(a)peterswire.net Subject: Re: [IP] COMMENTS REQUESTED -- Apparent large telco liability based on USA Today facts Dave, I doubt Peter expected us to find a flaw in his actual analysis since all the loop holes have already been covered and under the most extreme interpretations one would find it difficult to argue directly against his reasoning. If there is a defence possible for the telcos it might be under yet-another discussion of the presidential authority (or the limits thereof). The difference I see in this one (and I am most definitely not an expert on this) is the monetary one. The direct civil cause of action in the statute would seem to incentive for this one to perhaps be taken further? It will be interesting to observe, especially given Qwest's refusal to comply (apparently without sanction?). If Qwest had concerns and voiced them and was not forced to comply it would appear this could be a difficult one, and not just for the telcos. Dan Steinberg SYNTHESIS:Law & Technology 35, du Ravin phone: (613) 794-5356 Chelsea, Quebec J9B 1N1 On 5/12/06, David Farber <dave(a)farber.net> wrote: Begin forwarded message:

1 0

Re: [IP] more on FBI plans new Net-tapping push
by Phil Karn 06 Jul '18

06 Jul '18

David Farber wrote: >But there's a piece missing. Crypto controls of course! This is of course possible, and it's a bit surprising that this other shoe has not yet fallen so long after 9/11. But consider that any push to regulate or restrict strong crypto would: 1. Draw widespread public attention to the fact that the government cannot break it; 2. Be totally ineffectual since crypto is so widely available from so many places in the world; 3. Go against the strongly stated public positions of many conservative Republicans during the "crypto wars" of the mid 1990s, when, coincidentally, Clinton was in office and pushing the Clipper Chip; 4. Be totally ignored by precisely those people whom the government is supposedly most interested in targeting; and 5. Be mostly irrelevant to what the spooks actually do when they vacuum up electronic communications, namely traffic analysis (who talks to who, when, where and how much) rather than acquiring actual content. Content takes too much effort to analyze (and possibly translate), even when it's in the clear. Traffic analysis can be done automatically on a huge scale, and it can be frighteningly effective. As an aside, I note that not much attention has been paid to the "where" part of communications. Cell phones -- even when they're not in calls -- make excellent physical tracking devices. Not even secure end-to-end encryption can change that. It's inherent in how they work. I have no actual information on this, but based on my knowledge of the technology and ongoing revelations of the government's insatiable appetite for data on non-citizens and citizens alike, I confidently predict that the next big revelation in the ongoing saga of massive government data-mining will involve mobile phone registrations. These are the short "I'm here and ready for a call" data messages that all mobile phones transmit every few minutes whenever they're on and idle. Even without GPS for augmented E911 positioning, registrations tell what cell sector you're in. These sectors can be quite small (a few blocks) in densely populated areas. At the very least, they're certainly sufficient to tell what country and city you're in. --Phil ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] more on FBI plans new Net-tapping push
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [gsc] Led Zeppelin
by Robert dCZ 06 Jul '18

06 Jul '18

Hmmm. So first they scared off foreign investors who wanted to by assets as opposed to paper. Then they started killing off the tourism industry by making visitors feel as unwelcome as once upon a time communist Albania. Now they make people think twice before considering living there and accepting residency (which will of course encourage well healed, smart people to refrain from paying any tax in the US altogether by not becoming residents, but commuters of one type or anither, for tax purposes). What I don't understand is why on Earth wealthy political dynasties have sent the current generation of legislators to public schools? I mean, how else could they be so God-forsakenly dumb? The "law of unforseeable consequences" has outlived its purpose, and someone needs to formulate a "law of predictable hardship as a result of any action by US officials". If you ask me - - - well, nobody ever does ;o) Cheers, Robert.

1 0