July 2018 - cypherpunks-legacy

[tor-talk] Teaching Non-technical Folks About Tor...
by Joseph Lorenzo Hall 06 Jul '18

06 Jul '18

Hi tor-talk! This is a request for input. Pedagogical input, but I'm also aware of how crazy smart you all are in general! About six months ago, one of you described vaguely how your servers were seized by German cops and you explained to the police how Tor works using envelopes within envelopes. I had the thought that this kind of a technique could be really helpful in teaching non-technical folks how some aspects of Tor works through a hands-on demonstration. This semester, I'm teaching a class of upper-division undergraduate students in a Communications department at NYU about privacy. I want them to know more about Tor, and thankfully I have Runa and Aaron stopping by my class. woo! However, I sat down recently and tried to sketch out how an in-class hands-on exercise might work that explained some of the core features of Tor. Here is the result: https://josephhall.org/tor/tor-exercise.html https://josephhall.org/tor/tor-exercise.text (Markdown input) This is my first draft. It really only works with a small class (mine is 11) or a sub-set of a larger class. It also doesn't let the students choose much about the messaging (this is to avoid distractions like the hunky guy getting a bunch of love letters during an in-class exercise! ... or more negative versions of the same.). However, it has some serious flaws... for example, the students don't "build circuits" through successive tunnels; the circuits are sort of handed to them. Also, the way it works right now the instructor is a central big brother node. I have tried to think about ways students could be assigned a message and recipient and then roll dice to decide the circuit path, but nothing seems terribly workable (and I don't want it to get much more complex!). Another self-criticism is that it's not immediately apparent what part of this who charade Tor takes care of. ::) So, having a real physical demonstration of onion-routing may be unrealistic... but I'm wondering if you all have comments or better ideas about how to make it realistic without making it terribly complex (Ideally, smart high school or grammar school students could be taught about Tor using this kind of an exercise). best and thanks, Joe -- Joseph Lorenzo Hall Postdoctoral Research Fellow Media, Culture and Communication New York University https://josephhall.org/ _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [dgc.chat] Micropayments and the incentive program at
by Jay W. 06 Jul '18

06 Jul '18

e-gold Reply-To: <dgcchat(a)lists.goldmoney.com> > I realize you have explained this at least 10 times, every time it > comes up every few months, but I alwasy forget and like hearing it > over and over :-) then hopefully this post is a paroxysm of joy for you JP! ;) : the deduction of the e-gold spend fee is not included in velocity numbers. the distribution of any incentive payments per http://www.e-gold.com/unsecure/incentive.htm is not included in velocity numbers. the *only* thing counting as a "spend" in "e-metal spends" is an e-metal spend (aka payment) from one account to another initiated by a user doing one of: a) manually signing into his account and performing a "Spend" b) checking out at a merchant using e-gold SCI c) using phone access to make a spend d) using a program and the e-gold Automation Interface to make a spend those velocity numbers are totals for the amounts users are spending to other users. they do not include any other thing like fees, storage charges, or incentive payments. http://stats.e-gold.com possibly the most informative, accurate and timely economic statistics on earth - possibly the universe!! ;) subscribe: send blank email to dgcchat-join(a)lists.goldmoney.com unsubscribe: send blank email to dgcchat-leave(a)lists.goldmoney.com digest: send an email to dgcchat-request(a)lists.goldmoney.com with "set yourname(a)yourdomain.com digest=on" in the message body --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

"Double Secret" Wiretaps vs. the President's 2004 Statement
by Lauren Weinstein 06 Jul '18

06 Jul '18

Dave, In April 2004, President Bush made a seemingly direct and unequivocal statement regarding U.S. wiretapping policies in the fight against terrorism. We now know that he spoke these words after authorizing the NSA warrantless wiretapping program. You can hear his comments for yourself in this very short video: http://www.vortex.com/bv/wiretaps.wmv (Windows Media) The White House explanation for this seemingly gaping discrepancy is that the President was supposedly (we're now told) only talking about "ordinary" secret wiretaps under the PATRIOT Act, not about what we might call "Double Secret" NSA wiretaps (legal or not). Newspeak is alive and well. Dean Wormer of "Animal House" fame would be proud. --Lauren-- Lauren Weinstein lauren(a)pfir.org or lauren(a)vortex.com or lauren(a)eepi.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, EEPI - Electronic Entertainment Policy Initiative - http://www.eepi.org Moderator, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com DayThink: http://daythink.vortex.com ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] "Double Secret" Wiretaps vs. the President's 2004 Statement
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[tor-talk] Teaching Non-technical Folks About Tor...
by Joseph Lorenzo Hall 06 Jul '18

06 Jul '18

Hi tor-talk! This is a request for input. Pedagogical input, but I'm also aware of how crazy smart you all are in general! About six months ago, one of you described vaguely how your servers were seized by German cops and you explained to the police how Tor works using envelopes within envelopes. I had the thought that this kind of a technique could be really helpful in teaching non-technical folks how some aspects of Tor works through a hands-on demonstration. This semester, I'm teaching a class of upper-division undergraduate students in a Communications department at NYU about privacy. I want them to know more about Tor, and thankfully I have Runa and Aaron stopping by my class. woo! However, I sat down recently and tried to sketch out how an in-class hands-on exercise might work that explained some of the core features of Tor. Here is the result: https://josephhall.org/tor/tor-exercise.html https://josephhall.org/tor/tor-exercise.text (Markdown input) This is my first draft. It really only works with a small class (mine is 11) or a sub-set of a larger class. It also doesn't let the students choose much about the messaging (this is to avoid distractions like the hunky guy getting a bunch of love letters during an in-class exercise! ... or more negative versions of the same.). However, it has some serious flaws... for example, the students don't "build circuits" through successive tunnels; the circuits are sort of handed to them. Also, the way it works right now the instructor is a central big brother node. I have tried to think about ways students could be assigned a message and recipient and then roll dice to decide the circuit path, but nothing seems terribly workable (and I don't want it to get much more complex!). Another self-criticism is that it's not immediately apparent what part of this who charade Tor takes care of. ::) So, having a real physical demonstration of onion-routing may be unrealistic... but I'm wondering if you all have comments or better ideas about how to make it realistic without making it terribly complex (Ideally, smart high school or grammar school students could be taught about Tor using this kind of an exercise). best and thanks, Joe -- Joseph Lorenzo Hall Postdoctoral Research Fellow Media, Culture and Communication New York University https://josephhall.org/ _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[liberationtech] NSF grant opportunity
by Yosem Companys 06 Jul '18

06 Jul '18

From: Peter Muhlberger <pmuhl1848(a)gmail.com> I would like to invite you to learn more about NSF's Secure and Trustworthy Cyberspace (SaTC) grants program. SaTC provides grants for research that a) makes theoretical and methodological contributions to the SBE sciences and b) helps promote a secure and trustworthy cyberspace. Cybersecurity is a pressing national need for which there are, as of 2012, new research resources in the Social, Behavioral, and Economic (SBE) sciences directorate and which tap resources in the Computer and Information Science and Engineering (CISE) directorate. In the past year, the SBE / SaTC program has, with co-funding from CISE, provided over $15 million (over $6 million to small and medium-sized projects) in funding for people in a range of social sciences, including economics, psychology, sociology, political science, communication research, science of organization, and criminology. SaTC researchers can focus exclusively on social science matters related to cybersecurity or can work with computer scientists. For instance, a purely social science topic of interest is international norms with respect to cybersecurity / cyberwarfare. For those interested in working with computer scientists, the SaTC program is holding a number of events to help social and computer scientists discover mutually advantageous collaborations. If you are interested in exploring the possibility of this line of research, please feel free to look at the SaTC solicitation, participate in the upcoming online cyber cafe in which CISE and SBE scientists will discuss potential SaTC research, consider coming to the SaTC PI meeting (even as a non-PI), and / or sign up for the SBE / SaTC mailing list: SaTC solicitation: http://www.nsf.gov/publications/pub_summ.jsp?WT.z_pims_id=504709&ods_key=ns… Cyber Cafe: 11:30-5:30 EDT, Fri. Nov. 2, 2012. Learn more and register: http://www.satc-cybercafe.net/ SBE / SaTC mailing list: Send the following message text to LISTSERV(a)LISTSERV.NSF.GOV SUBSCRIBE satcspi your_name # For example: SUBSCRIBE satcspi John Wheeler In addition to the cyber-cafe, there remain a limited number of SBE / SaTC slots for the SaTC PI meeting, which can be attended by non-PI social scientists interested in learning more about this line of research. This will be a major event with hundreds of participants. Learn more: http://cps-vo.org/group/satc Register: Use the above site for conference and hotel reservation links. Use the case-sensitive registration code SaTC2012SBE when asked. Sincerely, Peter Muhlberger SBE / Secure and Trustworthy Cyberspace Program Officer National Science Foundation pmuhlber(a)nsf.gov 703-292-7848 -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Google search and seizure, etc. vs. technologists
by Lauren Weinstein 06 Jul '18

06 Jul '18

1) Any practical attempt to "swamp" Google's database in such a manner is unlikely to succeed, given the sheer volume of legit queries that they receive. I suspect they'd be smart enough to detect abuse patterns fairly easily. That kind of analysis is their bread and butter. 2) Attempts to purposely "abuse" Google in such a manner (faked requests) may well violate their Terms of Service, and if they don't now you can be sure that they will in some future version of the ToS. The likely result will at a minimum be bans and ISP actions, and at the max lawsuits. Pull out your wallet. 3) Routing queries through anon proxies will provide some protection for the technological elite who understand such things. They will not protect the average user, who most likely doesn't understand the risks and issues, and will never use such proxies, even assuming that they were trivial to use. It is fashionable for some technologists to unwisely promote ad hoc, short-term technological "fixes" in a sort of cold war escalation mode, without dealing with the fundamental problems. This is especially unproductive when it comes to helping to protect average users who take the default settings for almost everything, but are just as much at risk of abuse, if not more so. In this case, it seems reasonable to ask that Google (and other search engines) show at least as much genuine interest in protecting people's privacy and rights as does the local library. And that library isn't making billions from people's activities -- Google is. Finally, the statement that: >Even if Google were to say that they no longer keep >personally-identifiable search queries, there would be no way to >verify it. is of course not really correct. There are ways (not fullproof, but some are damned good) to audit such activities, assuming that appropriate laws are in place requiring such verification. A simple claim of compliance from the party in question is obviously not sufficient, even in the case of Google, whom I have no reason to believe is lying about what they are doing at this time. --Lauren-- Lauren Weinstein lauren(a)pfir.org or lauren(a)vortex.com or lauren(a)eepi.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, EEPI - Electronic Entertainment Policy Initiative - http://www.eepi.org Moderator, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com DayThink: http://daythink.vortex.com - - - >From: Phil Karn <karn(a)ka9q.net> >Date: December 3, 2005 3:24:11 PM EST > >1. Write and disseminate a little daemon that makes randomize queries >to Google from your computer. Every few minutes to an hour (i.e., at >random times) it would send a Google query with search terms randomly >chosen from a large dictionary. This would pollute Google's logs and >create reasonable doubt if you are later accused of entering queries >for, say, the words "neck" and "snap". > >2. Write and disseminate a web proxy filter that would route all >Google queries through the TOR (The Onion Router) network and strip >off all tracking mechanisms from the results. This may be a more >palatable alternative to routing all your web surfing through TOR, >which can be quite slow. > >I consider it unproductive to scream at Google, as has become so >popular of late. It is also misguided to call for laws to limit what >they can do with our search queries. Even if Google were to say that >they no longer keep personally-identifiable search queries, there >would be no way to verify it. And any new privacy law for search >engines would surely be riddled with enormous loopholes for >government abuse. > >As with confidentiality, the *only* solution here is technological. >So let's get coding. > > ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Google search and seizure, etc. vs. technologists
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[Politech] Missing email messages, and Karl Rove's personal computer, roil Washington
by Declan McCullagh 06 Jul '18

06 Jul '18

http://www.washingtonpost.com/wp-dyn/content/article/2007/04/12/AR200704120… A lawyer for the Republican National Committee told congressional staff members yesterday that the RNC is missing at least four years' worth of e-mail from White House senior adviser Karl Rove that is being sought as part of investigations into the Bush administration, according to the chairman of the House Oversight and Government Reform Committee. http://oversight.house.gov/story.asp?ID=1244 The briefing received by the Committee raises serious concerns about the White House compliance with the Presidential Records Act, which requires that the President b take all such steps as may be necessary to assure that the activities, deliberations, decisions, and policies that reflect the performance of his constitutional, statutory, or other official or ceremonial duties are adequately documented and that such records are maintained as Presidential records.b http://www.nytimes.com/2007/04/13/washington/13emails.html The White House said Thursday that missing e-mail messages sent on Republican Party accounts may include some relating to the firing of eight United States attorneys. -------------------------------- April 12, 2007 Fred Fielding, Esq. Counsel to the President The White House 1600 Pennsylvania Avenue, N.W. Washington, D.C. 20500 Dear Mr. Fielding: We are troubled to learn through the press that the White House cannot account for the e-mails of almost two dozen people at the White House, including some the Senate Judiciary has asked to question in connection with our ongoing investigation. Apparently these officials utilized e-mail accounts, addresses and equipment provided by the Republican National Committee and political campaigns to communicate about the plan to replace a number of United States Attorneys. As you know, by letter dated March 28, 2007, the Chairmen of both the House and Senate Judiciary Committees wrote to you asking that you collect and produce e-mails and documents sent from all e-mail accounts, addresses and domains relevant to these investigations, and made specific reference to the use of such political e-mail addresses. The comments of two White House officials, which were cited in todaybs edition of the Washington Post, raise questions about whether the White House will be able to comply with the March 28 letter. White House spokesman Scott Stanzel reportedly stated, b [t]he White House has not at this point done a good enough job at overseeing the practices of staff with political e-mail accounts," and confirmed that "[s]ome officials' e-mails have potentially been lost and that is a mistake that the White House is aggressively working to fix." The second official who was cited, a White House lawyer who spoke on condition of anonymity, told the press at a briefing that White House staff is now being advised that if they question whether an e-mail is political or official, the staff should use their private accounts, but also preserve a copy to be sent to White House lawyers for a determination of whether the e-mail needs to be saved under the Presidential Records Act. In light of these comments by White House officials, we would like to know what is being done to investigate and remedy this situation. For example, we would like to know if the process described above by the anonymous White House lawyer is intended to apply prospectively only or if staff is also being advised that they should forward past e-mails from their private accounts to White House lawyers for review. Additionally, in reference to the statement that the White House b has not . . . done a good enough job at overseeing practicesb regarding e-mail accounts, we would like to know what was done in the past and whether any private e-mail retention policies were in place. We would also like to know how and when the White House first learned of the problem with private e-mail account usage and when it first came to light that e-mails may have been lost. We recognize that the White House must and should investigate this matter in a timely fashion. We also recognize that the congressional committees of jurisdiction have a separate obligation to investigate. To accommodate our separate obligations without slowing down or otherwise complicating the othersb efforts, we suggest that the White House consult with us and the other congressional committees engaged in affected investigations and that we jointly agree upon a fair and objective process for investigating this matter, including the use of a mutually trusted computer forensic expert. Such a process would help to restore public confidence in the White Housebs desire to comply with the Presidential Records Act. Moreover, it would ensure your office and the Congress that this matter is being taken seriously and that an objective process is employed to investigate, retrieve and reconstruct the information that is reportedly missing due to deleted or otherwise unretained e-mails. Sincerely, PATRICK LEAHY ARLEN SPECTER Chairman Ranking Member _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Google search and seizure, etc. vs. technologists
by Lauren Weinstein 06 Jul '18

06 Jul '18

1) Any practical attempt to "swamp" Google's database in such a manner is unlikely to succeed, given the sheer volume of legit queries that they receive. I suspect they'd be smart enough to detect abuse patterns fairly easily. That kind of analysis is their bread and butter. 2) Attempts to purposely "abuse" Google in such a manner (faked requests) may well violate their Terms of Service, and if they don't now you can be sure that they will in some future version of the ToS. The likely result will at a minimum be bans and ISP actions, and at the max lawsuits. Pull out your wallet. 3) Routing queries through anon proxies will provide some protection for the technological elite who understand such things. They will not protect the average user, who most likely doesn't understand the risks and issues, and will never use such proxies, even assuming that they were trivial to use. It is fashionable for some technologists to unwisely promote ad hoc, short-term technological "fixes" in a sort of cold war escalation mode, without dealing with the fundamental problems. This is especially unproductive when it comes to helping to protect average users who take the default settings for almost everything, but are just as much at risk of abuse, if not more so. In this case, it seems reasonable to ask that Google (and other search engines) show at least as much genuine interest in protecting people's privacy and rights as does the local library. And that library isn't making billions from people's activities -- Google is. Finally, the statement that: >Even if Google were to say that they no longer keep >personally-identifiable search queries, there would be no way to >verify it. is of course not really correct. There are ways (not fullproof, but some are damned good) to audit such activities, assuming that appropriate laws are in place requiring such verification. A simple claim of compliance from the party in question is obviously not sufficient, even in the case of Google, whom I have no reason to believe is lying about what they are doing at this time. --Lauren-- Lauren Weinstein lauren(a)pfir.org or lauren(a)vortex.com or lauren(a)eepi.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, EEPI - Electronic Entertainment Policy Initiative - http://www.eepi.org Moderator, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com DayThink: http://daythink.vortex.com - - - >From: Phil Karn <karn(a)ka9q.net> >Date: December 3, 2005 3:24:11 PM EST > >1. Write and disseminate a little daemon that makes randomize queries >to Google from your computer. Every few minutes to an hour (i.e., at >random times) it would send a Google query with search terms randomly >chosen from a large dictionary. This would pollute Google's logs and >create reasonable doubt if you are later accused of entering queries >for, say, the words "neck" and "snap". > >2. Write and disseminate a web proxy filter that would route all >Google queries through the TOR (The Onion Router) network and strip >off all tracking mechanisms from the results. This may be a more >palatable alternative to routing all your web surfing through TOR, >which can be quite slow. > >I consider it unproductive to scream at Google, as has become so >popular of late. It is also misguided to call for laws to limit what >they can do with our search queries. Even if Google were to say that >they no longer keep personally-identifiable search queries, there >would be no way to verify it. And any new privacy law for search >engines would surely be riddled with enormous loopholes for >government abuse. > >As with confidentiality, the *only* solution here is technological. >So let's get coding. > > ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0