July 2018 - cypherpunks-legacy

[Politech] E.U. Parliament votes to force "data retention" on telecom, Net firms [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

Previous Politech messages: http://www.politechbot.com/2005/12/05/european-data-retention/ http://www.politechbot.com/2005/09/23/european-commission-proposes/ http://www.politechbot.com/2005/06/16/feds-contemplate-forcing/ -------- Original Message -------- Subject: EU Parliament agrees to data retention Date: Wed, 14 Dec 2005 16:20:00 +0100 From: Ralf Bendrath <bendrath(a)zedat.fu-berlin.de> Reply-To: bendrath(a)zedat.fu-berlin.de To: Declan McCullagh <declan(a)well.com> Declan, something for Politech? Very bad news from Europe. The European Parliament this morning voted in favour of a backroom deal that had been made between the two big parties in Brussels and the Council of Ministers, currently chaired by the UK. The deal completely ignored the amendmends proposed by the Parliament's Rapporteur and by the Justice and Civil Liberties Committee that was (well - officialy) in charge of the process. After a hot debate and a number of signs of cracks in the party blocks, a majority of 378 parliamentarians voted in favour of mandatory retention of telecommunications data, 197 against, 30 abstained. This is in short what we will get now: - retention of telephone and internet connection data (including email addresses) and location data for mobile phone calls - no harmonisation of the retention period (6 to 24 months but longer is allowed: Poland wants 15 years) - no harmonisation of cost reimbursement for the needed investments on the providers' side - no limitation to certain types of crimes for which access is allowed - retention of unsuccessful call attempts - no independent evaluation - no extra privacy safeguards - follow-up committee without representation from civil rights organisations Civil liberties organizations, consumers organizations and all the telco industry associations as well as journalists associations had been fighting like hell against this major and unprecedented surveillance plan until the last minute. We did not win (the outcome is in fact the worst possible, exactly what the UK home affairs minister Clarke wanted), but we at least raised a lot of awareness and disturbed the conservative and social-democrat party lines. But the UK council presidency had pushed so hard after the London bombings that this directive will enter the EU history as the one which took the shortest time ever from the first Commission draft to the final vote (less than three months - normally they need years). The next steps will be the adoption by the Council of Ministers (before christmas) and then the implementation process into national laws. There will be challenges to this plan before the constitutional courts. I am pretty sure that the German constitutional court will not like it, as it recently had ruled unconstitutional a major eavesdropping plan on phone calls - and that one was only directed at suspicious persons, whereas the EU directive applies to every single communication of all 450 Million inhabitants of the EU. More information, including recordings of the EP debate, is available at <http://wiki.dataretentionisnosolution.com/>. Ralf (European Digital Rights, www.edri.org) _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[MTNews] Schlage Introduces Web- and Mobile Phone-controlled
by MacTech News Moderator 06 Jul '18

06 Jul '18

Locks This message comes to you from MacTech News -- the Mac(tm) OS Technical News and Info server. See below for more info on this list (including sub/unsub details). __________________________ Schlage Introduces Innovative Web- and Mobile Phone-controlled Locks CARMEL, Ind., Sept. 3 -- Schlage, the most trusted brand of door locks, today unveiled the latest consumer electronic innovation that fuses home security and automation with mobile technology. The new Schlage LiNK deadbolts and locks provide homeowners the power to remotely control and monitor access to their home 24/7 with any web-enabled mobile phone or computer. The new Schlage LiNK deadbolts and locks provide keyless entry through 4-digit access codes that can be entered, activated, deleted or disabled on the lock's 11-digit push button keypad, or via the Schlage LiNK web portal or mobile application. This solution gives homeowners the freedom of never having to carry or circulate multiple sets of keys, coupled with the ability to instantaneously grant access to family members, friends, unexpected house guests, and service providers such as handymen and housekeepers. Via the Schlage LiNK online portal, homeowners also have the control to set up user codes for specific days and times, receive text or e-mail notifications when certain codes are used and track codes that have been used over the past 90 days. These features deliver peace of mind to the parents of active families so they know exactly when their children, family members, friends and even service providers are entering their home. It also does away with the need to regularly replace locks for rental properties and second homes. "Schlage LiNK deadbolts and locks give homeowners the control and peace of mind of always knowing that even if their home is not in sight, it's never out of reach," says Dwight Gibson, general manager, Intelligent Residential Security, for Ingersoll Rand, the parent company of Schlage. "Schlage has been the leading lock brand for the residential security market for more than 85 years and we are dedicated to continually developing product innovations that not only deliver first-rate security but also add convenience to our customers' busy lives." Additional product attributes include: -- Schlage LiNK locks are the first Z-Wave-enabled locks and work seamlessly with more than 300 other Z-Wave-enabled home automation devices including products ranging from lighting and temperature to pool and spa controls. -- The Schlage LiNK web portal utilizes the same Secure Socket Layer (SSL) protection used by the banking industry and the Z-Wave Bridge's RF signals are fully encrypted using AEC 128 bit encryption protocols. -- Designed with plug and play simplicity, the wireless Z-Wave Bridge easily plugs into an Ethernet port on the home computer's Internet router and the light module plugs into any standard 3 prong electrical outlet. -- Schlage LiNK locks are powered by regular batteries and typically install in less than 30 minutes with only a screwdriver. -- The Schlage LiNK Starter Kit retails for $299 and includes one Schlage LiNK deadbolt or lock, a wireless Z-Wave Bridge and a compatible light module. Additional Schlage LiNK deadbolts or locks will retail for $199. -- There is also a $12.99 monthly subscription fee for use of the Schlage LiNK online portal and mobile applications. With the monthly subscription, homeowners also receive 100 MB of memory to store IP camera video, if installed with the system. -- Schlage LiNK deadbolts and locks can be used anywhere in the home a traditional lock is used and are available in bright brass, satin nickel and aged bronze, to complement any decor. Schlage LiNK deadbolts and locks will be available at Fry's Electronics Retail Stores, on Fry's web site (www.frys.com) and through select professional builders in late October. About Schlage & Ingersoll Rand Security Technologies Schlage is the leader in security devices, trusted for more than 85 years, spanning both the commercial and residential markets. Commercial grade quality is built into every Schlage product. The brand is on the forefront of developing cutting-edge technology and innovation such as wireless security products and biometrics, among others. www.schlage.com Ingersoll Rand Security Technologies is a leading global provider of products and services that make environments safe, secure and productive. The sector's market-leading products include electronic and biometric access control systems; time and attendance and personal scheduling systems; mechanical locks and portable security, door closers and exit devices, steel doors and frames, architectural hardware and technologies and services for global security markets. Ingersoll Rand Security Technologies is a sector of Ingersoll-Rand Company Limited, a global provider of products, services and solutions to industries as diverse as transportation, manufacturing, food retailing, construction and agriculture. www.ingersollrand.com About Z-Wave Z-Wave is the first technology to bring affordable, reliable and easy-to-use wireless control to every aspect of daily life -- the home, consumer electronics, healthcare, and energy use, to name a few. Z- Wave is an award-winning, proven and interoperable wireless mesh networking technology that allows a wide array of devices in and around the home to communicate including lighting, appliances, HVAC, entertainment centers, and security systems. Z-Wave brings many benefits to everyday life including remote home monitoring, home healthcare, safety and security, and energy conservation. Z-Wave certified products are currently available from leading consumer brands in more than 170 products. Z-Wave is the recipient of the 2006 Wall Street Journal Technology Innovation Award in the wireless category, the CNET "Best of CES Award" in the enabling technologies category, along with PC World's 2006 World Class Award, which recognizes the 100 best technologies and products of the year. For more information about Z-Wave please visit www.z-wave.com About the Z-Wave Alliance Formed in January 2005, the Z-Wave Alliance is a consortium of leading companies in the home technology space dedicated to solidifying Z-Wave as the standard for wireless home control products. The principal members include Cooper Wiring Devices, Danfoss, FAKRO, Ingersoll Rand Security Technologies, Intel, Intermatic, Leviton, Monster Cable, Wayne-Dalton, Universal Electronics Inc. (UEI) and Zensys. Its members lead the home controls market, providing leading edge products and systems that deliver increased comfort, convenience, safety and security. Z-Wave technology is the foundation of all products manufactured by the Alliance members. For more information about the Z-Wave Alliance, visit www.zwavealliance.org . __________________________ Please visit our sponsors: BetterRAM.com(sm): Your Source for RAM. Memory built to order. http://www.betterram.com, mailto:info@betterram.com Or call 800-895-3493 MacTech(r) Magazine: The journal of Macintosh technolog. http://www.mactech.com, mailto:info@mactech.com, or 877-MACTECH To submit a posting to MacTech News, mailto:press_releases@mactech.com. To subscribe to MacTech News, send mail to listserv(a)listmail.xplain.com with the SUBJECT line reading "SUBSCRIBE MacTechNews". To unsubscribe, the SUBJECT line should read "UNSUBSCRIBE MacTechNews". MacTech, Xplain Corporation and its sponsors are not responsible for any errors, omissions, or other inaccuracies in this message. MacTech is a registered trademark of Xplain Corporation. MacDev-1, NetProLive, and NetProfessional are trademarks of Xplain Corporation. News may be propagated freely, but please attribute your source as MacTech Magazine, <http://www.mactech.com>.

1 0

English 19-year-old jailed for refusal to disclose decryption key
by Ray Dillinger 06 Jul '18

06 Jul '18

a 19-year-old just got a 16-month jail sentence for his refusal to disclose the password that would have allowed investigators to see what was on his hard drive. I suppose that, if the authorities could not read his stuff without the key, it may mean that the software he was using may have had no links weaker than the encryption itself -- and that is extraordinarily unusual - an encouraging sign of progress in the field, if of mixed value in the current case. Really serious data recovery tools can get data that's been erased and overwritten several times (secure deletion being quite unexpectedly difficult), so if it's ever been in your filesystem unencrypted, it's usually available to well-funded investigators without recourse to the key. I find it astonishing that they would actually need his key to get it. Rampant speculation: do you suppose he was using a solid-state drive instead of a magnetic-media hard disk? http://www.bbc.co.uk/news/uk-england-11479831 Bear --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

English 19-year-old jailed for refusal to disclose decryption key
by Ray Dillinger 06 Jul '18

06 Jul '18

a 19-year-old just got a 16-month jail sentence for his refusal to disclose the password that would have allowed investigators to see what was on his hard drive. I suppose that, if the authorities could not read his stuff without the key, it may mean that the software he was using may have had no links weaker than the encryption itself -- and that is extraordinarily unusual - an encouraging sign of progress in the field, if of mixed value in the current case. Really serious data recovery tools can get data that's been erased and overwritten several times (secure deletion being quite unexpectedly difficult), so if it's ever been in your filesystem unencrypted, it's usually available to well-funded investigators without recourse to the key. I find it astonishing that they would actually need his key to get it. Rampant speculation: do you suppose he was using a solid-state drive instead of a magnetic-media hard disk? http://www.bbc.co.uk/news/uk-england-11479831 Bear --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Politech] E.U. Parliament votes to force "data retention" on telecom, Net firms [priv]
by Declan McCullagh 06 Jul '18

06 Jul '18

Previous Politech messages: http://www.politechbot.com/2005/12/05/european-data-retention/ http://www.politechbot.com/2005/09/23/european-commission-proposes/ http://www.politechbot.com/2005/06/16/feds-contemplate-forcing/ -------- Original Message -------- Subject: EU Parliament agrees to data retention Date: Wed, 14 Dec 2005 16:20:00 +0100 From: Ralf Bendrath <bendrath(a)zedat.fu-berlin.de> Reply-To: bendrath(a)zedat.fu-berlin.de To: Declan McCullagh <declan(a)well.com> Declan, something for Politech? Very bad news from Europe. The European Parliament this morning voted in favour of a backroom deal that had been made between the two big parties in Brussels and the Council of Ministers, currently chaired by the UK. The deal completely ignored the amendmends proposed by the Parliament's Rapporteur and by the Justice and Civil Liberties Committee that was (well - officialy) in charge of the process. After a hot debate and a number of signs of cracks in the party blocks, a majority of 378 parliamentarians voted in favour of mandatory retention of telecommunications data, 197 against, 30 abstained. This is in short what we will get now: - retention of telephone and internet connection data (including email addresses) and location data for mobile phone calls - no harmonisation of the retention period (6 to 24 months but longer is allowed: Poland wants 15 years) - no harmonisation of cost reimbursement for the needed investments on the providers' side - no limitation to certain types of crimes for which access is allowed - retention of unsuccessful call attempts - no independent evaluation - no extra privacy safeguards - follow-up committee without representation from civil rights organisations Civil liberties organizations, consumers organizations and all the telco industry associations as well as journalists associations had been fighting like hell against this major and unprecedented surveillance plan until the last minute. We did not win (the outcome is in fact the worst possible, exactly what the UK home affairs minister Clarke wanted), but we at least raised a lot of awareness and disturbed the conservative and social-democrat party lines. But the UK council presidency had pushed so hard after the London bombings that this directive will enter the EU history as the one which took the shortest time ever from the first Commission draft to the final vote (less than three months - normally they need years). The next steps will be the adoption by the Council of Ministers (before christmas) and then the implementation process into national laws. There will be challenges to this plan before the constitutional courts. I am pretty sure that the German constitutional court will not like it, as it recently had ruled unconstitutional a major eavesdropping plan on phone calls - and that one was only directed at suspicious persons, whereas the EU directive applies to every single communication of all 450 Million inhabitants of the EU. More information, including recordings of the EP debate, is available at <http://wiki.dataretentionisnosolution.com/>. Ralf (European Digital Rights, www.edri.org) _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[cryptography] ICIJ's project - comment on cryptography & tools
by ianG 06 Jul '18

06 Jul '18

In a project similar to Wikileaks, ICIJ comments on tools it used to secure its team-based project work: "ICIJbs team of 86 investigative journalists from 46 countries represents one of the biggest cross-border investigative partnerships in journalism history. Unique digital systems supported private document and information sharing, as well as collaborative research. These included a message center hosted in Europe and a U.S.-based secure online search system. Team members also used a secure, private online bulletin board system to share stories and tips." "The project teambs attempts to use encrypted e-mail systems such as PGP (b Pretty Good Privacyb) were abandoned because of complexity and unreliability that slowed down information sharing. Studies have shown that police and government agents b and even terrorists b also struggle to use secure e-mail systems effectively. Other complex cryptographic systems popular with computer hackers were not considered for the same reasons. While many team members had sophisticated computer knowledge and could use such tools well, many more did not." http://www.icij.org/offshore/how-icijs-project-team-analyzed-offshore-files hattip to Lynn Wheeler's lynn'o'gram. iang. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [silk] "outsourcing torture" - a b-school style case study
by Abhishek Hazra 06 Jul '18

06 Jul '18

Now we finally learned what we all suspected: the numerous reports and testimonies about the Guantanamo and Abu Ghraib prisons were a trap to distract the attention of the public from the true secret: in the last days, big media reported that the CIA operates secret detention facilities beyond the reach of the law and outside official oversight at bases in two eastern European countries and some other Asian countries. The CIA has not even acknowledged the existence of these "black sites" with "ghost prisoners": to do so could open the U.S. government to legal challenges, since the prisoners are there submitted to "Enhanced Interrogation Techniques" (the US newspeak for torture). The original idea was to hide and interrogate the two dozen or so al Qaeda leaders believed to be responsible for the Sept. 11 attacks, or who posed an imminent threat; but as the CIA began apprehending more people whose intelligence value and links to terrorism were less certain, the original standard for consigning suspects to the invisible universe was lowered or ignored. (Zizek in ArtForum: Biopolitics: Between Terri Schiavo and Guantanamo) http://www.lacan.com/zizartforum1205.htm On 1/28/06, Suresh Ramasubramanian <suresh(a)hserus.net> wrote: > > http://davenchit.livejournal.com/15568.html > > > -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - does the frog know it has a latin name? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[cryptography] Diginotar Lessons Learned (long)
by Lucky Green 06 Jul '18

06 Jul '18

I can't help but chuckle about Diginotar's very public display of security incompetence. I mean, who in our line of work can be expected to keep a straight face when reading gems such as this one taken from the report by Diginotar's incidence response rapporteur: "The separation of critical components was not functioning or was not in place. We have strong indications that the CA-servers, although physically very securely placed in a tempest proof environment, were accessible over the network from the management LAN. The network has been severely breached. All CA servers were members of one Windows domain, which made it possible to access them all using one obtained user/password combination". http://www.rijksoverheid.nl/bestanden/documenten-en-publicaties/rapporten/2… We are also seeing a near universal call for "fixes" of the broken PKI paradigm. I couldn't agree more that fixes - and indeed redesigns - are badly needed and have been for some 15+ years. Pretty much since the day the word PKI was coined. What I hear much more rarely are discussions if the proposed fixes actually solve the problem. What I hear hardly ever are discussions as to which unintended consequences the proposed (and in some cases already implemented fixes) may bring. When designing an improvement to a system, it helps to keep in mind the original requirements the system was intended to address. In the case of SSL server certs, those requirements roughly were: - provide Joe Browser user with the ability to connect to a site with which Joe has no prior relationship while giving Joe sufficient confidence that the site is who they say they are without MITM for Joe to part with his credit card number. The public CA infrastructure, high-profile failures notwithstanding, has done a reasonable job meeting that requirement. - shift liability for this authentication from the browser vendors to a third-party (CA). The current system has done a flawless job at this. Defenses such as HSTS and cert pinning cannot do better and likely will do worse, since the browser vendors are getting more actively involved in the decision which sites to protect with the "best" level of security. Indeed, security designers and auditors for financial services firms that fail to demand inclusion of their site in HSTS and cert pinning lists are arguably falling behind on best practices. It is not inconceivable that we will see litigation against a browser vendor initiated by a website that was compromised by a bad cert after the browser vendor refused to include the website in their HSTS lists. Note that there is no chance that browser vendors will be willing to create the infrastructure and build up staffing levels such that all legitimated websites are protected by in-browser HSFS lists. Yet the more sites a browser vendor adds to their HSTS or cert pinning lists, the higher the risk of litigation becomes. - avoid the server vendor (at the time those requirements were identified the sever vendor was equal to the browser vendor) from incurring the costs of having to verify the authenticity of each website or domain. The labor cost of adding cert pinning for a domain from a browser vendor's perspective is identical to that of adding to the browser the hash of a CA operated by that domain. Which is identical to the cost a browser vendor would incur authenticating each website. Not going to happen. At scale, any such list cannot be handled via code updates, but has to be dynamically provided as a service by the browser vendor. Meaning the browser vendor becomes isomorphic to a root CA from the perspective of the users of that browser. - limit the cost of security to the server operator. Website and other encrypted service operators are annoyed as it is obtaining certificates from one CA. It is unreasonable to ask a website operator to engage in separate dealings with each browser vendor. Instead, both the website operator and the browser vendors will prefer dealing with a single entity (or small number) of trusted third parties (TTP). Such as a public CA. - no single trusted entity. Whether you design a security protocol or software counting widgets, there really is only one of three numbers that your design needs to be able to accommodate: one, a few, or a great many. In the public server authentication space, "one" translates to a global authority issuing credentials. It is not clear who that authority would be. Presumably the United Nations. What is clear is that national interests preclude the use of a single global authentication authority. It is conceivable for each country to have a local authentication authority, which would require each country to operate some authentication authority. There is no agreement how many countries exist on our planet, but the number is somewhere around 200. More than there are root CAs in the browsers today. Which gets us to the next number: "a few". A few represents the status quo. Under the status quo, a few CAs are issuing certs. Some CAs have a better security track record than others, though most CAs with an unblemished security record have simply not yet been attacked, failed to disclose attacks, or don't issue certs to customers on the Internet at large and therefore can afford to operate in a purely offline environment. The latter option is not available to CAs or other services that authenticate a large number of domains. When operated by national governments rather than global vendors, one can envision designs in which national CAs issue certificates only for entities located within the nation's borders. Such designs quickly lead to a requirement for a global database (see "one" above) or to a scenario in which Iran's national authority can issue certificates for gmail.com. Moreover, such a design carries the high risk of leading to a need for each site to obtain separate certs for each country in which it operates. That outcome would be welcomed by certain governments, be perhaps organizationally manageable for a large server operator such as Google, but be intractable for many other sites. In addition to likely being detrimental to both the exchange of ideas and security of the Internet as a whole. The "a great many" scenario translates to designs in which each browser reports the certs seen up to a central database, alerting the user if the cert presented by a server doesn't match (most) of those certs that were seen by users of the same service. Meaning the browser vendors or some global entity have to operate a server that more or less logs each https access. I am not sure how I feel about that. What I do know is that it creates a whole new attack surface for other types of attacks. I also believe that for example Tor users, a known target for fake SSL server certs, would unlikely consider such a design to be an improvement. Other designs in the "a great many" category log SSL server certs only locally, alerting the user when a certificate for a particular site previously visited has changed. I can see value in that features. But we need to realize that this feature will add to the SSL server cert alert fatigue users are already experiencing. Time and large field trials will tell if such a feature is a security net positive. It may increase the security posture of very security conscious Tor users. It will not solve the problem for the average Gmail user. Not even for the average Gmail user in Iran. - generate recurring revenue Often mentioned as the primary reason for the existence of CAs, generating recurring revenue is a driver for significant percentage of those in the CA business, but as we have seen above the overall number of entities that derive revenue from issuing certs is quite small. It is, well, "a few". The perceived benefits to the issuer are a powerful driver in the client cert space, where the desire for attribution makes the sum total of drivers in the SSL server cert space tiny by comparison. But we are not talking about client certs here. Most CAs do not make a significant amount money from issuing server certs and the handful of CAs that do likely would do just as well operating alternative authentication systems, be that on behalf of a national SSL server cert authority or on behalf of a browser vendor needing to maintain an HSTS list. The cost structure is dominated by validation costs at any rate and that holds true whether the end result is a signed cert or an entry in a browser's HSTS or cert pinning list. There are additional requirements that drive the existance of SSL server certs and public CAs. The requirements I outlined in this post will suffice to illustrate my point: unless some proposed SSL/CA replacement/augmentation system will do at least as well at meeting those requirements as the status quo, the design is unlikely to succeed in the marketplace. As you are being bombarded with design proposals promising improvement over the status quo in the next weeks and months - and are prehaps are working on designs of your own - it will be helpful to validate those designs against the requirements prior to chosing to implement the design. --Lucky Green _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] TOR-based darknet - negative publicity
by liberationtech＠lewman.us 06 Jul '18

06 Jul '18

On Thu, Oct 20, 2011 at 08:34:29PM -0400, ed.webb(a)gmail.com wrote 0.8K bytes in 18 lines about: : This report on Anonymous' takedown of servers hosting child : pornography is the kind of publicity TOR doesn't want, presumably: : http://diigo.com/0kinp I wonder how that action is different than this, https://lists.torproject.org/pipermail/tor-talk/2011-September/021198.html And you can always tell when someone doesn't bother to talk to Tor itself, https://www.torproject.org/docs/faq.html.en#WhyCalledTor Also, https://www.torproject.org/docs/faq-abuse.html.en#RemoveContent -- Andrew pgp key: 0x74ED336B _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [silk] "outsourcing torture" - a b-school style case study
by Abhishek Hazra 06 Jul '18

06 Jul '18

Now we finally learned what we all suspected: the numerous reports and testimonies about the Guantanamo and Abu Ghraib prisons were a trap to distract the attention of the public from the true secret: in the last days, big media reported that the CIA operates secret detention facilities beyond the reach of the law and outside official oversight at bases in two eastern European countries and some other Asian countries. The CIA has not even acknowledged the existence of these "black sites" with "ghost prisoners": to do so could open the U.S. government to legal challenges, since the prisoners are there submitted to "Enhanced Interrogation Techniques" (the US newspeak for torture). The original idea was to hide and interrogate the two dozen or so al Qaeda leaders believed to be responsible for the Sept. 11 attacks, or who posed an imminent threat; but as the CIA began apprehending more people whose intelligence value and links to terrorism were less certain, the original standard for consigning suspects to the invisible universe was lowered or ignored. (Zizek in ArtForum: Biopolitics: Between Terri Schiavo and Guantanamo) http://www.lacan.com/zizartforum1205.htm On 1/28/06, Suresh Ramasubramanian <suresh(a)hserus.net> wrote: > > http://davenchit.livejournal.com/15568.html > > > -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - does the frog know it has a latin name? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0