July 2018 - cypherpunks-legacy

Re: FreeBSD's urandom versus random
by Perry E. Metzger 06 Jul '18

06 Jul '18

Ian G <iang(a)systemics.com> writes: > While we're on the subject of /dev/[u]random, has anyone > looked at the new FreeBSD 5.3 version? Not the 5.3 version but I have looked a bit at earlier versions. I was pretty scared, frankly. The author gave a talk at a BSDCon where he displayed both a profound set of misunderstandings about what the papers he had read meant and an extremely strong amount of arrogance. Among other things, he claimed that Schneier and Co. had proven the security of Yarrow (which of course they never had claimed), and that his changes to Yarrow made it better (very dubious). He also obviously didn't understand crypto very well. I wouldn't have minded so much if he hadn't been extremely belligerent about defending his beliefs. Anyway, after the talk I took a look at the code, and I didn't feel very comfortable with it. It has been too many years now for me to remember specifics, and it may have been changed a lot in the interim -- in any case, you may want to examine it if you are contemplating using it in something where it would be dangerous not to have very solid random numbers available. FreeBSD has some other crypto toys that I'm dubious about. It now has a crypto file system widget that uses a bunch of odd ad hoc modes invented by the author. Some quick analysis shows that most of the complexity they add does not add actual cryptographic strength and does add possible attack vectors, which is worrisome. I'm always against attempting to be clever under such circumstances, but a lot of people don't seem to have the same fear of innovating in cryptography without very careful analysis that I do. It also doesn't protect very well against brute forcing of the file system passphrase, which is (in most cases) the likely way people will break such a thing. (Actually the author claims that you would have to do tremendous disk i/o to break the passphrase, but you can do a time/space tradeoff with RAM that bypasses his hack.) None of this should say that I'm entirely comfortable with the security of, say, NetBSD's /dev/random. Even though I should have, I've never properly audited the whole thing, which is more than mildly embarrassing. Shades of the shoemaker's children and such. For all I know, we've got big flaws, too. Perry --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Hello directly from Jimbo at Wikipedia
by Steven J. Murdoch 06 Jul '18

06 Jul '18

On Tue, Sep 27, 2005 at 05:48:59PM -0400, Jimmy Wales wrote: > All I'm saying is that Tor could segregate users easily enough into two > clouds: "We sorta trust these ones, more or less, a little bit, but no > guarantees" -- "We don't trust these ones, we don't know them". This would be very difficult to do using the existing Tor design as it doesn't know anything about users or sessions. It lives at the TCP layer and all it does is shift packets from one IP address to another, giving some privacy to both ends. Adding higher layer functionality to Tor increases the chance that it will do neither job well, so here is a proposal which I think does what you want, but avoids this problem. The goal is to increase the cost for a Tor user to commit abuse on Wikipedia. It doesn't need to be full-proof, but just enough to make them go elsewhere. Wikipedia could require Tor users to log in before making edits, and ban accounts if they do something bad. However the cost of creating new accounts is not very high. The goal of this proposal is to impose a cost on creating accounts which can be used though Tor. Non-Tor access works as normal and the cost can be small, just enough to reduce the incentive of abuse. Suppose Wikipedia allowed Tor users to only read articles and create accounts, but not able to change anything. The Tor user then goes to a different website, call it the "puzzle server". Here the Tor user does some work, perhaps does a hashcash computation[1] or solves a CAPTCHA[2], then enters the solution along with their new Wikipedia username. The puzzle server (which may be run by Wikipedia or Tor volunteers), records the fact that someone has solved a puzzle along with the username entered. The puzzle server doesn't need the Wikipedia password as there is no reason for someone to do work for another person's account. Now when that Tor user logs into their Wikipedia account to edit something, the Wikipedia server asks the puzzle server whether this account has ever solved a puzzle. If it has, the user can make the edit, if not then the user is told to go to the puzzle server first. This check can be very simple - just an HTTP request to the puzzle server specifying the Wikipedia username, which returns "yes" vs "no", or "200" vs "403". For performance reasons this can be cached locally. There is no cryptography here, and I don't think it is needed, but it can be added without much difficulty. If the Tor user starts committing abuse, his account is cancelled. The puzzle server doesn't need to be told about this, as Wikipedia will not let that user make any edits. The reason this approach avoids the usual problems with proof-of-work schemes[3] is that good Tor users only have to solve the puzzle once, just after they create the account. Bad Tor users will need to solve another puzzle every time they are caught and had their account cancelled. So my question to Jimbo is: what type of puzzle do you think would be enough to reduce abuse through Tor to a manageable level? The difficulty of the puzzle can be tuned over time but what would be necessary for Wikipedia to try this out? Hope this helps, Steven Murdoch. [1] http://www.hashcash.org/ [2] http://www.captcha.net/ [3] "Proof-of-Work" Proves Not to Work by Ben Laurie and Richard Clayton: http://www.cl.cam.ac.uk/users/rnc1/proofwork.pdf -- w: http://www.cl.cam.ac.uk/users/sjm217/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Tracking Anonymous Peer-to-Peer VoIP Calls on the Internet
by Kurt Albershardt 06 Jul '18

06 Jul '18

ABSTRACT Peer-to-peer VoIP calls are becoming increasingly popular due to their advantages in cost and convenience. When these calls are encrypted from end to end and anonymized by low latency anonymizing network, they are considered by many people to be both secure and anonymous. In this paper, we present a watermark technique that could be used for effectively identifying and correlating encrypted, peer-to-peer VoIP calls even if they are anonymized by low latency anonymizing networks. This result is in contrast to many people's perception. The key idea is to em- bed a unique watermark into the encrypted VoIP flow by slightly adjusting the timing of selected packets. Our analysis shows that it only takes several milliseconds time adjustment to make normal VoIP flows highly unique and the embedded watermark could be preserved across the low latency anonymizing network if appropriate redundancy is applied. Our analytical results are backed up by the real-time experiments performed on leading peer- to-peer VoIP client and on a commercially deployed anonymizing network. Our results demonstrate that (1) tracking anonymous peer-to- peer VoIP calls on the Internet is feasible and (2) low latency anonymizing networks are susceptible to timing attacks. <http://ise.gmu.edu/%7exwangc/Publications/CCS05-VoIPTracking.pdf> ------------- End Forwarded Message ------------- --------------------------------------------------------------------- I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

[IP] Tracking Anonymous Peer-to-Peer VoIP Calls on the Internet
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

forget "your license, please"; now it will be "your DNA,
by Jim Warren 06 Jul '18

06 Jul '18

please" One small step for man; one [more] giant step for Big Brother. (Or ... if you don't have anything to hide, you shouldn't mind giving your DNA. And you don't need a lawyer; you shouldn't object to having your home searched; etc., etc.) - --jim http://www.legitgov.org/index.html#breaking_news U.S. Set to Begin a Vast Expansion of DNA Sampling 05 Feb 2007 The Justice Department is completing rules to allow the collection of DNA from most people arrested or detained by federal authorities, officials said, a vast expansion of DNA gathering. The new forensic DNA sampling was authorized by Congress in a little-noticed amendment to a January 2006 renewal of the Violence Against Women Act, which provides protections and assistance for victims of sexual crimes. http://www.nytimes.com/2007/02/05/washington/05dna.html?_r=1&oref=slogin U.S. Set to Begin a Vast Expansion of DNA Sampling By JULIA PRESTON Published: February 5, 2007 The Justice Department is completing rules to allow the collection of DNA from most people arrested or detained by federal authorities, a vast expansion of DNA gathering that will include hundreds of thousands of illegal immigrants, by far the largest group affected. The new forensic DNA sampling was authorized by Congress in a little- noticed amendment to a January 2006 renewal of the Violence Against Women Act, which provides protections and assistance for victims of sexual crimes. The amendment permits DNA collecting from anyone under criminal arrest by federal authorities, and also from illegal immigrants detained by federal agents. Over the last year, the Justice Department has been conducting an internal review and consulting with other agencies to prepare regulations to carry out the law. The goal, justice officials said, is to make the practice of DNA sampling as routine as fingerprinting for anyone detained by federal agents, including illegal immigrants. Until now, federal authorities have taken DNA samples only from convicted felons. The law has strong support from crime victims' organizations and some women's groups, who say it will help law enforcement identify sexual predators and also detect dangerous criminals among illegal immigrants. "Obviously, the bigger the DNA database, the better," said Lynn Parrish, the spokeswoman for the Rape, Abuse and Incest National Network, based in Washington. "If this had been implemented years ago, it could have prevented many crimes. Rapists are generalists. They don't just rape, they also murder." Peter Neufeld, a lawyer who is a co-director of the Innocence Project, which has exonerated dozens of prison inmates using DNA evidence, said the government was overreaching by seeking to apply DNA sampling as universally as fingerprinting. "Whereas fingerprints merely identify the person who left them," Mr. Neufeld said, "DNA profiles have the potential to reveal our physical diseases and mental disorders. It becomes intrusive when the government begins to mine our most intimate matters." ...<SNIP>... -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.3 (Build 5003) Charset: US-ASCII wsBVAwUBRceor2nfFhwmXlFCAQiZBwf6A0ij0S8Vk02xzqT13h2iU8QoYOdNIvhY x8p7zVHRTXnXt5NIUPElen2iLsOW6Ipf3n1z/hTgCVX2lpm8AZSKZ5ksK4Ky0hsG IxLJJgsJVrdpbwBlftod1OOd7cQsMorOe6dscpqipOl+dDO9Qj4GEhMJX/CMaBNC fcASlkPb9ZUh2gLfhVI5JnYtJvV0Wg85W0myALrrIBIk4KX44RTaaLTi94WdbwpS xYAW5JeC7YYO4fBYxNzZAvSGbRuFglcIkCA3mUAsVPouXyczDUHqR4dfEbWCsoG+ 0bSAIlQhmeBOmTImEtQHZVy9eQIKPAKW3GKZ8ZsB2C14z/5UcfdS0g== =MZrQ -----END PGP SIGNATURE----- ------------------------------------------- Archives: http://archives.listbox.com/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] forget "your license, please"; now it will be "your DNA, please"
by David Farber 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Begin forwarded message:

1 0

[fc-announce] Call for papers: Financial Cryptography and Data
by George Danezis 06 Jul '18

06 Jul '18

Security (FC2011) Financial Cryptography and Data Security (FC 2011), Bay Gardens Beach Resort, St. Lucia February 28 - March 4, 2011 - http://ifca.ai/fc11/ [CFP in PDF: http://ifca.ai/fc11/fc11cfp.pdf] Financial Cryptography and Data Security is a major international forum for research, advanced development, education, exploration, and debate regarding information assurance, with a specific focus on commercial contexts. The conference covers all aspects of securing transactions and systems. Original works focusing on both fundamental and applied real-world deployments on all aspects surrounding commerce security are solicited. Submissions need not be exclusively concerned with cryptography. Systems security and inter-disciplinary efforts are particularly encouraged. Topics include: Anonymity and Privacy, Auctions and Audits, Authentication and Identification, Backup Authentication, Biometrics, Certification and Authorization, Cloud Computing Security, Commercial Cryptographic Applications, Transactions and Contracts, Data Outsourcing Security, Digital Cash and Payment Systems, Digital Incentive and Loyalty Systems, Digital Rights Management, Fraud Detection, Game Theoretic Approaches to Security, Identity Theft, Spam, Phishing and Social Engineering, Infrastructure Design, Legal and Regulatory Issues, Management and Operations, Microfinance and Micropayments, Mobile Internet Device Security, Monitoring, Reputation Systems, RFID-Based and Contactless Payment Systems, Risk Assessment and Management, Secure Banking and Financial Web Services, Securing Emerging Computational Paradigms, Security and Risk Perceptions and Judgments, Security Economics, Smartcards, Secure Tokens and Hardware, Trust Management, Underground-Market Economics, Usability, Virtual Economies, Voting Systems IMPORTANT DATES Workshop Proposal Submission: August 6, 2010 Workshop Proposal Notification: August 30, 2010 Paper Submission: October 1, 2010 Paper Notification: November 15, 2010 Final Papers: December 17, 2010 Poster and Panel Submission: December 3, 2010 Poster and Panel Notification: December 13, 2010 SUBMISSION Submission categories: (i) regular papers (15 pg LNCS format), (ii) short papers (8 pg), (iii) panels and workshops (2 pg), and (iv) posters (1 pg). Anonymized submissions will be double-blind reviewed. Papers must be formatted in standard LNCS format and submitted as PDF files. Submissions in other formats will be rejected. All papers must be submitted electronically according to the instructions and forms found on this web site and at the submission site. Authors may only submit work that does not substantially overlap with work that is currently submitted or has been accepted for publication to a conference with proceedings or a journal. We consider double submission serious research fraud and will treat it as such. In case of doubt contact the program chair for any clarifications at fc11chair(a)ifca.ai. Regular Research Papers. Research papers should describe novel, previously unpublished scientific contributions to the field, and they will be subject to rigorous peer review. Accepted submissions will be included in the conference proceedings to be published in the Springer-Verlag Lecture Notes in Computer Science (LNCS) series. Submissions are limited to 15 pages. Short Papers. Short papers are also subject to peer review, however, the intention is to encourage authors to introduce work in progress, novel applications and corporate/industrial experiences. Short papers will be evaluated with a focus on novelty and potential for sparking participants' interest and future research avenues. Short paper submissions are limited to 8 pages in standard LNCS format. The paper title for short papers should necessarily include the text '(a short paper)'. Panel Proposals. We especially would like to encourage submissions of panel proposals. These should include a very brief description of the panel topics, as well as of the prospective panelists. Accepted panel sessions will be presented at the conference. Moreover, each participant will contribute a one-page abstract to be published in the conference proceedings. Please feel free to contact us directly if you would like to further discuss the suitability of a certain topic. Panel submissions should be up to 2 pages, sent to fc11chair(a)ifca.ai. Posters. The poster session is the perfect venue to share a provocative opinion, interesting established or preliminary work, or a cool idea that will spark discussion. Poster presenters will benefit from a multi-hour session to discuss their work, get exposure, and receive feedback from attendees. Poster submissions should be 1 page (in the same LNCS format). Please keep in mind that the poster deadline is later than the main paper submission deadline. The posters will be published in the proceedings. Poster proposals should be sent to the posters chair at fc11chair(a)ifca.ai. Workshop Proposals. Proposals for workshops to be held at FC 2011 are also solicited. A workshop can be full day or half day in length. Workshop proposals should include: (i) a title, (ii) a call for papers, (iii) a brief summary and justification -- including how it would fit into the greater FC scope, (iv) a (tentative) Program Committee and its Chair, (v) one-paragraph bios for key organizers, and (vi) the expected (or previous - if workshop has been held in previous years) number of submissions, participants and acceptance rates. Workshop proposals should be sent fc11workshops(a)ifca.ai. The Rump Session. FC'11 will also include the popular "rump session" held on one of the evenings in an informal, social atmosphere. The rump session is a program of short (5-7 minute), informal presentations on works in progress, off-the-cuff ideas, and any other matters pertinent to the conference. Any conference attendee is welcome to submit a presentation to the Rump Session Chair (to be announced at the conference). This submission should consist of a talk title, the name of the presenter, and, if desired, a very brief abstract. Submissions may be sent via e-mail, or submitted in person in the morning on the day of the session. ORGANIZERS General Chair: Steven Murdoch, University of Cambridge, UK Local Arrangements Chair: Fabian Monrose, University of North Carolina Chapel Hill, US PROGRAM COMMITTEE Program Chair: George Danezis, Microsoft Research, UK Ross Anderson, University of Cambridge, UK Tuomas Aura, Helsinki University of Technology, FI Lucas Ballard, Google, US Adam Barth, UC Berkeley, US Elisa Bertino, Purdue University, US Kevin Butler, Pennsylvania State University, US Srdjan Capkun, ETH Zurich, CH Veronique Cortier, CNRS / LORIA, FR Ernesto Damiani, University of Milan, IT Claudia Diaz, K.U.Leuven, BE Roger Dingledine, The Tor Project, US Orr Dunkelman, Weizmann Institute of Science, IL Simone Fisher-Hubner, Karlstad University, SE Craig Gentry, Stanford University, US Dieter Gollmann, Technische Universitat Harburg, DE Rachel Greenstad, Drexel University, US Jean-Pierre Hubaux, Ecole Polytechnique Federale de Lausanne, CH Markus Jakobsson, Indiana University, US Jaeyeon Jung, Intel Research, US Stefan Katzenbeisser, Technische Universitat Darmstadt, DE Angelos Keromytis, Columbia University, US Arjen Lenstra, Ecole Polytechnique Federale de Lausanne, CH Helger Lipmaa, Cybernetica AS, EE Evangelos Markatos, FORTH, GR David Molnar, Microsoft Research, US Tyler Moore, Harvard University, US David Naccache, Ecole normale superieure, FR Thomas Ristenpart, University of Wisconsin, US Peter Ryan, Universite du Luxembourg, LU Ahmad-Reza Sadeghi, Ruhr-University Bochum, DE Rei Safavi-Naini, University of Calgary, CA Nigel Smart, University of Bristol, UK Jessica Staddon, Google, US Angelos Stavrou, George Mason University, US Paul Syverson, Naval Research Laboratory, US Nicholas Weaver, International Computer Science Institute, US Moti Yung, Google, US The Financial Cryptography and Data Security Conference is organized by The International Financial Cryptography Association (IFCA). _______________________________________________ fc-announce mailing list fc-announce(a)ifca.ai http://mail.ifca.ai/mailman/listinfo/fc-announce

1 0

[fc-announce] Call for papers: Financial Cryptography and Data
by George Danezis 06 Jul '18

06 Jul '18

Security (FC2011) Financial Cryptography and Data Security (FC 2011), Bay Gardens Beach Resort, St. Lucia February 28 - March 4, 2011 - http://ifca.ai/fc11/ [CFP in PDF: http://ifca.ai/fc11/fc11cfp.pdf] Financial Cryptography and Data Security is a major international forum for research, advanced development, education, exploration, and debate regarding information assurance, with a specific focus on commercial contexts. The conference covers all aspects of securing transactions and systems. Original works focusing on both fundamental and applied real-world deployments on all aspects surrounding commerce security are solicited. Submissions need not be exclusively concerned with cryptography. Systems security and inter-disciplinary efforts are particularly encouraged. Topics include: Anonymity and Privacy, Auctions and Audits, Authentication and Identification, Backup Authentication, Biometrics, Certification and Authorization, Cloud Computing Security, Commercial Cryptographic Applications, Transactions and Contracts, Data Outsourcing Security, Digital Cash and Payment Systems, Digital Incentive and Loyalty Systems, Digital Rights Management, Fraud Detection, Game Theoretic Approaches to Security, Identity Theft, Spam, Phishing and Social Engineering, Infrastructure Design, Legal and Regulatory Issues, Management and Operations, Microfinance and Micropayments, Mobile Internet Device Security, Monitoring, Reputation Systems, RFID-Based and Contactless Payment Systems, Risk Assessment and Management, Secure Banking and Financial Web Services, Securing Emerging Computational Paradigms, Security and Risk Perceptions and Judgments, Security Economics, Smartcards, Secure Tokens and Hardware, Trust Management, Underground-Market Economics, Usability, Virtual Economies, Voting Systems IMPORTANT DATES Workshop Proposal Submission: August 6, 2010 Workshop Proposal Notification: August 30, 2010 Paper Submission: October 1, 2010 Paper Notification: November 15, 2010 Final Papers: December 17, 2010 Poster and Panel Submission: December 3, 2010 Poster and Panel Notification: December 13, 2010 SUBMISSION Submission categories: (i) regular papers (15 pg LNCS format), (ii) short papers (8 pg), (iii) panels and workshops (2 pg), and (iv) posters (1 pg). Anonymized submissions will be double-blind reviewed. Papers must be formatted in standard LNCS format and submitted as PDF files. Submissions in other formats will be rejected. All papers must be submitted electronically according to the instructions and forms found on this web site and at the submission site. Authors may only submit work that does not substantially overlap with work that is currently submitted or has been accepted for publication to a conference with proceedings or a journal. We consider double submission serious research fraud and will treat it as such. In case of doubt contact the program chair for any clarifications at fc11chair(a)ifca.ai. Regular Research Papers. Research papers should describe novel, previously unpublished scientific contributions to the field, and they will be subject to rigorous peer review. Accepted submissions will be included in the conference proceedings to be published in the Springer-Verlag Lecture Notes in Computer Science (LNCS) series. Submissions are limited to 15 pages. Short Papers. Short papers are also subject to peer review, however, the intention is to encourage authors to introduce work in progress, novel applications and corporate/industrial experiences. Short papers will be evaluated with a focus on novelty and potential for sparking participants' interest and future research avenues. Short paper submissions are limited to 8 pages in standard LNCS format. The paper title for short papers should necessarily include the text '(a short paper)'. Panel Proposals. We especially would like to encourage submissions of panel proposals. These should include a very brief description of the panel topics, as well as of the prospective panelists. Accepted panel sessions will be presented at the conference. Moreover, each participant will contribute a one-page abstract to be published in the conference proceedings. Please feel free to contact us directly if you would like to further discuss the suitability of a certain topic. Panel submissions should be up to 2 pages, sent to fc11chair(a)ifca.ai. Posters. The poster session is the perfect venue to share a provocative opinion, interesting established or preliminary work, or a cool idea that will spark discussion. Poster presenters will benefit from a multi-hour session to discuss their work, get exposure, and receive feedback from attendees. Poster submissions should be 1 page (in the same LNCS format). Please keep in mind that the poster deadline is later than the main paper submission deadline. The posters will be published in the proceedings. Poster proposals should be sent to the posters chair at fc11chair(a)ifca.ai. Workshop Proposals. Proposals for workshops to be held at FC 2011 are also solicited. A workshop can be full day or half day in length. Workshop proposals should include: (i) a title, (ii) a call for papers, (iii) a brief summary and justification -- including how it would fit into the greater FC scope, (iv) a (tentative) Program Committee and its Chair, (v) one-paragraph bios for key organizers, and (vi) the expected (or previous - if workshop has been held in previous years) number of submissions, participants and acceptance rates. Workshop proposals should be sent fc11workshops(a)ifca.ai. The Rump Session. FC'11 will also include the popular "rump session" held on one of the evenings in an informal, social atmosphere. The rump session is a program of short (5-7 minute), informal presentations on works in progress, off-the-cuff ideas, and any other matters pertinent to the conference. Any conference attendee is welcome to submit a presentation to the Rump Session Chair (to be announced at the conference). This submission should consist of a talk title, the name of the presenter, and, if desired, a very brief abstract. Submissions may be sent via e-mail, or submitted in person in the morning on the day of the session. ORGANIZERS General Chair: Steven Murdoch, University of Cambridge, UK Local Arrangements Chair: Fabian Monrose, University of North Carolina Chapel Hill, US PROGRAM COMMITTEE Program Chair: George Danezis, Microsoft Research, UK Ross Anderson, University of Cambridge, UK Tuomas Aura, Helsinki University of Technology, FI Lucas Ballard, Google, US Adam Barth, UC Berkeley, US Elisa Bertino, Purdue University, US Kevin Butler, Pennsylvania State University, US Srdjan Capkun, ETH Zurich, CH Veronique Cortier, CNRS / LORIA, FR Ernesto Damiani, University of Milan, IT Claudia Diaz, K.U.Leuven, BE Roger Dingledine, The Tor Project, US Orr Dunkelman, Weizmann Institute of Science, IL Simone Fisher-Hubner, Karlstad University, SE Craig Gentry, Stanford University, US Dieter Gollmann, Technische Universitat Harburg, DE Rachel Greenstad, Drexel University, US Jean-Pierre Hubaux, Ecole Polytechnique Federale de Lausanne, CH Markus Jakobsson, Indiana University, US Jaeyeon Jung, Intel Research, US Stefan Katzenbeisser, Technische Universitat Darmstadt, DE Angelos Keromytis, Columbia University, US Arjen Lenstra, Ecole Polytechnique Federale de Lausanne, CH Helger Lipmaa, Cybernetica AS, EE Evangelos Markatos, FORTH, GR David Molnar, Microsoft Research, US Tyler Moore, Harvard University, US David Naccache, Ecole normale superieure, FR Thomas Ristenpart, University of Wisconsin, US Peter Ryan, Universite du Luxembourg, LU Ahmad-Reza Sadeghi, Ruhr-University Bochum, DE Rei Safavi-Naini, University of Calgary, CA Nigel Smart, University of Bristol, UK Jessica Staddon, Google, US Angelos Stavrou, George Mason University, US Paul Syverson, Naval Research Laboratory, US Nicholas Weaver, International Computer Science Institute, US Moti Yung, Google, US The Financial Cryptography and Data Security Conference is organized by The International Financial Cryptography Association (IFCA). _______________________________________________ fc-announce mailing list fc-announce(a)ifca.ai http://mail.ifca.ai/mailman/listinfo/fc-announce

1 0

Re: [tor-talk] What is tor used for?
by grarpamp 06 Jul '18

06 Jul '18

> i believe there is a real need for secure communications but as a new user > to tor it seems the common entry points to the network are rife with > criminal activity. > > the torproject website lists users as friends and family, military, > business owners etc - use cases that make sense to me, but i've yet to > find any stories or ancedontal evidence to suggest this is really the > case. instead i find core.onion linking to "adult" content that has > little to do with adults and "market sites" that deal with illegal trade > in weapons and drugs. > > so far it has me wondering if tor is really used for the humanitarian > purposes the technology has the potential of aiding. i would really > appreciate hearing real stories and highlights of how has helped in the > use cases torproject lists. Tor is used for a lot of different things. Sure, the kiddy pron, drug and chan waste and all the talk about those things is disgusting to see infiltrating everywhere. But with nothing to do about it you just have to ignore it. Yes, it would be cool to see stuff like EFF, EPIC, ACLU, Red Cross and whatever else makes you happy all be multihomed into the anonymous space. But really, if you can't get to them on the clearnet, or via Tor exits, you probably have worse problems on your hands, like finding work, food, shelter and not getting shot. Nor do they see it as being all that helpful to them. On the plus side, lots of people use Tor for totally benign and boring everyday stuff, I certainly do. Think about it... IRC with friends, dating, reading the paper, contributing to forums and various projects, blogging, doing your banking and school stuff, email, internet and systems work, looking for work, writing freely with random people, buying stuff. Whatever it might be that people do. It all feels just a bit better knowing your ISP. employer or government doesn't really have such an easy task anymore of cataloging or quoting you, tracking your home/work/travels, turning you into a statistic, optimizing your online experience, or any other such things you might not want to happen. These certainly aren't examples of 'working for the greater global good of humanity' or whatever, but it all adds up. Kindof how anti-spam systems reduce the profitability of spam. And in a way, gaining back some of the anonymity by default that everyone had before everyone and everything went digital, online, databased, monetized and controlled in the 90's. It's unlikely you'll find those who really need Tor for their activities standing up and saying here I am with their use cases in hand. They simply have better things to do and that would entail risk. You're more likely to find relay ops and coders evangelizing to the good. They are the interfaces to the use cases and know what's out there. Just seeing packets flow through the occaisional relay I prop up makes me happy knowing at least some of them weren't full of the aforementioned trash... even if they are just our boring daily stuffs. _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] What is tor used for?
by grarpamp 06 Jul '18

06 Jul '18

> i believe there is a real need for secure communications but as a new user > to tor it seems the common entry points to the network are rife with > criminal activity. > > the torproject website lists users as friends and family, military, > business owners etc - use cases that make sense to me, but i've yet to > find any stories or ancedontal evidence to suggest this is really the > case. instead i find core.onion linking to "adult" content that has > little to do with adults and "market sites" that deal with illegal trade > in weapons and drugs. > > so far it has me wondering if tor is really used for the humanitarian > purposes the technology has the potential of aiding. i would really > appreciate hearing real stories and highlights of how has helped in the > use cases torproject lists. Tor is used for a lot of different things. Sure, the kiddy pron, drug and chan waste and all the talk about those things is disgusting to see infiltrating everywhere. But with nothing to do about it you just have to ignore it. Yes, it would be cool to see stuff like EFF, EPIC, ACLU, Red Cross and whatever else makes you happy all be multihomed into the anonymous space. But really, if you can't get to them on the clearnet, or via Tor exits, you probably have worse problems on your hands, like finding work, food, shelter and not getting shot. Nor do they see it as being all that helpful to them. On the plus side, lots of people use Tor for totally benign and boring everyday stuff, I certainly do. Think about it... IRC with friends, dating, reading the paper, contributing to forums and various projects, blogging, doing your banking and school stuff, email, internet and systems work, looking for work, writing freely with random people, buying stuff. Whatever it might be that people do. It all feels just a bit better knowing your ISP. employer or government doesn't really have such an easy task anymore of cataloging or quoting you, tracking your home/work/travels, turning you into a statistic, optimizing your online experience, or any other such things you might not want to happen. These certainly aren't examples of 'working for the greater global good of humanity' or whatever, but it all adds up. Kindof how anti-spam systems reduce the profitability of spam. And in a way, gaining back some of the anonymity by default that everyone had before everyone and everything went digital, online, databased, monetized and controlled in the 90's. It's unlikely you'll find those who really need Tor for their activities standing up and saying here I am with their use cases in hand. They simply have better things to do and that would entail risk. You're more likely to find relay ops and coders evangelizing to the good. They are the interfaces to the use cases and know what's out there. Just seeing packets flow through the occaisional relay I prop up makes me happy knowing at least some of them weren't full of the aforementioned trash... even if they are just our boring daily stuffs. _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0