July 2018 - cypherpunks-legacy

Bitcoin v0.1 released
by Satoshi Nakamoto 06 Jul '18

06 Jul '18

Announcing the first release of Bitcoin, a new electronic cash system that uses a peer-to-peer network to prevent double-spending. It's completely decentralized with no server or central authority. See bitcoin.org for screenshots. Download link: http://downloads.sourceforge.net/bitcoin/bitcoin-0.1.0.rar Windows only for now. Open source C++ code is included. - Unpack the files into a directory - Run BITCOIN.EXE - It automatically connects to other nodes If you can keep a node running that accepts incoming connections, you'll really be helping the network a lot. Port 8333 on your firewall needs to be open to receive incoming connections. The software is still alpha and experimental. There's no guarantee the system's state won't have to be restarted at some point if it becomes necessary, although I've done everything I can to build in extensibility and versioning. You can get coins by getting someone to send you some, or turn on Options->Generate Coins to run a node and generate blocks. I made the proof-of-work difficulty ridiculously easy to start with, so for a little while in the beginning a typical PC will be able to generate coins in just a few hours. It'll get a lot harder when competition makes the automatic adjustment drive up the difficulty. Generated coins must wait 120 blocks to mature before they can be spent. There are two ways to send money. If the recipient is online, you can enter their IP address and it will connect, get a new public key and send the transaction with comments. If the recipient is not online, it is possible to send to their Bitcoin address, which is a hash of their public key that they give you. They'll receive the transaction the next time they connect and get the block it's in. This method has the disadvantage that no comment information is sent, and a bit of privacy may be lost if the address is used multiple times, but it is a useful alternative if both users can't be online at the same time or the recipient can't receive incoming connections. Total circulation will be 21,000,000 coins. It'll be distributed to network nodes when they make blocks, with the amount cut in half every 4 years. first 4 years: 10,500,000 coins next 4 years: 5,250,000 coins next 4 years: 2,625,000 coins next 4 years: 1,312,500 coins etc... When that runs out, the system can support transaction fees if needed. It's based on open market competition, and there will probably always be nodes willing to process transactions for free. Satoshi Nakamoto --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

"Fed's RFIDiocy pwnd at DefCon"
by Jerry Leichter 06 Jul '18

06 Jul '18

http://blogs.zdnet.com/storage/?p=565 "NSA spooks gather for a colleaguebs retirement party at a bar. What they donbt know is that an RFID scanner is picking them out - and a wireless Bluetoothwebcam is taking their picture. Could that really happen? It already did. (The Feds got a taste of the real world risks of RFID passports and IDs at DefCon, the annual hacker conference. According to Wired http://www.wired.com/threatlevel/2009/08/fed-rfid/) : . . . federal agents at the conference got a scare on Friday when they were told they might have been caught in the sights of an RFID reader. The reader, connected to a web camera, sniffed data from RFID-enabled ID cards and other documents carried by attendees in pockets and backpacks as they passed a table where the equipment was stationed in full view...." -- Jerry --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Point compression prior art?
by Zooko O'Whielacronx 06 Jul '18

06 Jul '18

Have you seen DJB's "Irrelevant patents on elliptic-curve cryptography" http://cr.yp.to/ecdh/patents.html The section on "Point Compression" says: """ Miller in 1986, in the paper that introduced elliptic-curve cryptography, suggested compressing a public key (x,y) to simply x: ``Finally, it should be remarked, that even though we have phrased everything in terms of points on an elliptic curve, that, for the key exchange protocol (and other uses as one-way functions), that only the x-coordinate needs to be transmitted. The formulas for multiples of a point cited in the first section make it clear that the x-coordinate of a multiple depends only on the x-coordinate of the original point.'' This is exactly the compression method that I use. Popular rumor states that point compression is covered by a subsequent Vanstone-Mullin-Agnew patent: US patent 6141420, filed 1994.07.29, granted 2000.10.31. What the patent actually claims are (1--28) encryption using an elliptic curve over a finite field of characteristic 2 with elements represented on a normal basis; (29, 36) communicating (x,y) on a curve by communicating x and having the receiver somehow compute y; (30--35, 37--41) communicating x and ``identifying information'' of y, such as one bit; and (42--52) some secret-key encryption mechanisms. My Curve25519 software never computes y, so it is not covered by the patent. It should, in any case, be obvious to the reader that a patent cannot cover compression mechanisms published seven years before the patent was filed. """ DJB also has this page, which goes into more detail about 6141420: http://cr.yp.to/patents/us/6141420.html Contrary to the "filed 1994.07.29" above, the patent was actually filed January 29, 1997: http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=… Which means it expires January 29, 2017. Regards, Zooko _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Point compression prior art?
by Zooko O'Whielacronx 06 Jul '18

06 Jul '18

Have you seen DJB's "Irrelevant patents on elliptic-curve cryptography" http://cr.yp.to/ecdh/patents.html The section on "Point Compression" says: """ Miller in 1986, in the paper that introduced elliptic-curve cryptography, suggested compressing a public key (x,y) to simply x: ``Finally, it should be remarked, that even though we have phrased everything in terms of points on an elliptic curve, that, for the key exchange protocol (and other uses as one-way functions), that only the x-coordinate needs to be transmitted. The formulas for multiples of a point cited in the first section make it clear that the x-coordinate of a multiple depends only on the x-coordinate of the original point.'' This is exactly the compression method that I use. Popular rumor states that point compression is covered by a subsequent Vanstone-Mullin-Agnew patent: US patent 6141420, filed 1994.07.29, granted 2000.10.31. What the patent actually claims are (1--28) encryption using an elliptic curve over a finite field of characteristic 2 with elements represented on a normal basis; (29, 36) communicating (x,y) on a curve by communicating x and having the receiver somehow compute y; (30--35, 37--41) communicating x and ``identifying information'' of y, such as one bit; and (42--52) some secret-key encryption mechanisms. My Curve25519 software never computes y, so it is not covered by the patent. It should, in any case, be obvious to the reader that a patent cannot cover compression mechanisms published seven years before the patent was filed. """ DJB also has this page, which goes into more detail about 6141420: http://cr.yp.to/patents/us/6141420.html Contrary to the "filed 1994.07.29" above, the patent was actually filed January 29, 1997: http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=… Which means it expires January 29, 2017. Regards, Zooko _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

E-voting in Japan
by Rodney Van Meter 06 Jul '18

06 Jul '18

>From Sunday's Daily Yomiuri: http://www.yomiuri.co.jp/dy/national/20070527TDY03003.htm The last sentence is by far the most intriguing, and I wish I knew more. E-voting system eyed for national elections The Yomiuri Shimbun An electronic voting system using touch-screen panels likely will be phased in for national elections starting from next year, it has been learned. The ruling coalition of the Liberal Democratic Party and New Komeito is eyeing the new system after New Komeito reversed its initially cautious stance and decided to support the move, according to sources. The ruling parties will submit a bill to revise the special law for the Public Offices Election Law in the current Diet session, which will stipulate Jan. 1, 2008, as the date for the law's enforcement, the sources said. However, the electronic voting system will not be introduced simultaneously in all municipalities. Among municipalities that already have ordinances allowing the use of electronic ballots for mayoral and assembly elections, the internal affairs and communications minister will choose municipalities based on applications received from election boards. Currently, eight municipalities have such an ordinance. The use of electronic polling systems for local elections became possible in February 2002, since when it has been used for 15 elections held in 10 municipalities. The result of one election that employed the system was nullified after errors were detected in the electronic voting machines. ===== Last week there was an article about quick election results here. In prefectural (state) elections, some towns returned their results in as little as 20 minutes even when using hand-counted paper ballots! (Some other municipalities ranged as high as a couple of hours.) One simple expedient is that when you go to vote, you are given separate ballots for each office you are voting for. Then returns for any given office are a simple matter of sorting the ballots into one stack per candidate, and counting the stacks. To me, this would seem to make ballot challenges more difficult. There may also be additional opportunities for various forms of fraud -- ballot box stuffing, etc. depending on the protocols used. But it does appear to have the advantage of being efficient. If paper ballot results can be returned in so little time, what is the incentive for electronic balloting? --Rod (P.S. Speaking of elections, did you know that department chairs and even the presidents of universities here are chosen by direct election among the faculty? There are campaign speeches and balloting at an all-faculty meeting.) ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] E-voting in Japan
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[silk] Hacking the World
by Udhay Shankar N 06 Jul '18

06 Jul '18

Interesting piece on Aaron Swartz, and on Biella. Biella, want to say more? Udhay https://chronicle.com/article/Hacking-the-World/138163/ April 1, 2013 Hacking the World An anthropologist in the midst of a geek insurgency By Nathan Schneider Hacking the World To hold an event in the Great Hall at Cooper Union in New York City is to lay claim on history. The typical invocation at the start of an evening there, whatever the occasion, includes recounting that Abraham Lincoln once made an important speech in the same room. And such was the opening ritual on January 19. Hundreds of eminent geeks, start-up-ers, reporters, radicals, and admirers gathered that evening among the stone arches and white columns to remember the life of Aaron Swartz. At the age of 26, after living under the threats of federal prosecutors trying to pressure him into a plea bargain, he had hanged himself. Several times in January, his name was on the front page of The New York Times. His former girlfriend, the Wired writer Quinn Norton, observed in her remarks that "Aaron has left us and entered the realm of mythmaking." David Segal, who with Swartz founded the organization Demand Progress, said from the stage of the Great Hall, "He wanted to hack the whole world, in the best way." The forces that seem to have hastened Swartz's death were very much haunting the room. In the audience was a mischievous, greasy-haired hacker known as "weev," who faces as much as a decade in prison for embarrassing AT&T by publicizing a flaw in its system that compromised users' privacy. A member of Occupy Wall Street's press team handed out slips of paper about the case of Jeremy Hammond, an anarchist and Anonymous member who was in prison awaiting trial for breaking into the servers of the security company Stratfor. There was Stanley Cohen, a civil-rights lawyer representing some of Hammond's fellow Anons, and there was a T-shirt with the face of Bradley Manning, the soldier charged with passing classified material to WikiLeaks. Just behind weev sat Gabriella Coleman, an anthropologist, occasionally jotting notes in a notepad. She teaches at McGill University. Coleman first met Aaron Swartz when he was just 14, and over the years she had come to know many others in the room as well. Even more of them were among her 17,500-strong Twitter following or had seen her TED talk about Anonymous. Part participant and part observer, she began fieldwork on a curious computer subculture while still in graduate school. Now, more than a decade later, her work has made her the leading interpreter of a digital insurgency. Hacking the World Onstage, speakers recounted Swartz's exploits in acronyms: As a teenager, he co-created the RSS specification and Reddit and Creative Commons, and in 2012 he helped organize the widespread and successful opposition to the Congressional intellectual-property bills SOPA and PIPA. His conviction that information wants to be free was what led him to liberate scholarly articles from behind JSTOR's paywall en masse. That brought on the prosecutors determined to make an example of him, whose reaction in turn reveals just how dangerous the geek crusaders' cry of freedom has come to seem. Swartz's crusade has been much celebrated since his death, if not very well understood by those not also taking part. It's a peculiar kind of politics. Why would someone care so much, and take such risks, to set information free? That question, in certain respects, is what Gabriella Coleman has spent her career studying. Coleman started to care about open-source software because she cared about something else. At Columbia University in the early 90s, a friend of hers wouldn't stop talking about a CD-ROM he'd brought home of Slackware, an early Linux-based operating system. She didn't see what the big deal was, so the friend explained it to her this way: He knew she was interested in drug patentsbin particular, how intellectual-property laws prevent medicine from being available to people who need it but can't pay inflated prices. This kind of software was the opposite. Not only was it free of cost, but the license ensured that the source code behind it was freely available for people to copy, modify, and share. Computer companies were making billions by controlling proprietary operating systems, yet here was one anyone could use for nothingbanyone, at least, willing to put in the effort to make it work. "I was just floored," Coleman recalls. "It wasn't a pipe dream. It was a reality, and that was exciting to me: an actually existing alternative in place." She went on to study anthropology at the University of Chicago. Her goal was to write a dissertation on spiritual healing in Guyana. But the notion of free software was still on her mind, and the community that produced it started to interest her more and more. What just about settled it, though, was an illness during graduate school that kept her homebound for a year. She couldn't take classes or go on trips to Guyana, but she could get on the Internet. Through chat rooms and online bulletin boards, she learned a lot about free software. Soon after, and despite her advisers' hesitation, she was ready to put aside her plan for more-traditional fieldwork and take up this one. Faye Ginsburg, an anthropologist and director of New York University's Center for Media, Culture and History, where Coleman taught in the late 2000s, says, "I think she was a bit ahead of the curve, in terms of the field recognizing the significance of media generally and digital media in particular." For dissertation research, as others in her cohort shipped off for more-exotic, farther-flung places, Coleman moved to the San Francisco Bay Area with Linux running on her computer. "It was painful at first," she says, remembering the buggy early versions of the operating system. "It was the equivalent of having to live with the snakes." She took classes in copyright law and system administration while making her way into communities of geeks and hackers, as she refers to them, and as they refer to themselves. She volunteered at the Electronic Frontier Foundation and infiltrated the ranks of those creating the Linux-based operating system Debian. In that male-dominated world, she suspects that her gender helped: "This little, tiny woman shows up, and they're just in awe that someone cares." At the time, in the early 2000s, Silicon Valley was infatuated with the idea of free and open-source software; futurists promised an overnight revolution, and venture capitalists schemed about how to turn the wisdom of crowds into profits. Coleman's scholarship on the phenomenon, newly compiled in her Princeton University Press book Coding Freedom: The Ethics and Aesthetics of Hacking, stands well beyond either brand of enthusiasm. Her tone is mostly sober, even as she pays close attention to her subjects' jokesbabout the cluelessness of "(l)users, or a program called Mutt that has fleas instead of bugs." What impresses her most, however, is what she learned from the geeks about doing politics. The first chapter of Coding Freedom opens with a gloss on the prototypical autobiography of a free-software hacker. (It always bears repeating that "hacker" does not necessarily mean someone who hacks illegally or nefariously.) That story begins with tinkering, with taking apart household appliances as a child and quickly graduating to whatever primitive computing machines become available. At last the hackerbusually a hebcomes across the world of free software, which is actually just a name for what he'd been pining after all along: infinite tinkering with like-minded people and no external constraints. Through chat rooms and e-mail lists and conferences, he finds a community of others like him, and, even as they find lucrative jobs in the tech sector, their real passion is collaborating on projects that are free and open from the ground up. The programs really work, too. Over the years, they wind up running a good chunk of the Internet's back end. Then, one day, some company or some law comes around and tries to stop the whole show in order to protect an antiquated business model. That makes our hacker angry. In defense of his work flow and his tinkering, he finds himself in a political movement. Coleman herself has activist instincts, and she expected to find them among the free-software hackers. (While doing her fieldwork, she participated in Indymedia, disseminating news about the counter-globalization protests of the period.) What she found instead was a group of people who were engaged in the grueling legal battles and organizational infighting that would be familiar to any activist, but were here put to the service of mainly technical ends. The community as a whole, she says, "was having this political impact, but individuals weren't necessarily politically motivated." The Debian Project is among the more ideological of open-source organizations, yet its several thousand volunteer "maintainers" are held together not so much by revolutionary spirit as by a carefully constructed, overlapping consensus about how to create "the universal operating system." Debian has its own "Social Contract," "Constitution," and "Free Software Guidelines," which serve to coordinate a vast spread of subprojects. Officers are elected according to criteria posited by an 18th-century French mathematician. Coding Freedom chronicles the intensive training process that Debian maintainers must undergo to enter the community. Their programming chops are evaluated, of course, but so is their fluency in the legal and ethical jargon of free software. This legal curriculum is something that geeks and hackers had to learn themselves, and in many cases invent, just to keep doing what they wanted to do. Over time, scholars like Lawrence Lessig realized that they had a point and helped develop legal tools to protect "free culture"btools that cover everything from the Firefox browser's source code to the Creative Commons license on Coleman's book. (It was downloaded around 20,000 times in its first week of being freely available online.) For a hacker, she points out, law is code; legal reform is just another hack. Like any countervailing subculture, the hacker community also depends on fostering environments where, as Coleman puts it, "a different set of lived ethics can incarnate into practice." In the solitary ecstasy of coding they remind her of the 19th-century Romantics. No less ecstatic are the hacker conferences, where online collaborators get to meet, drink excessively, and write software together in the same room. Just as vital are the rules that pervade such spaces, both formal and informal, which seek a balance of individual autonomy and group consensus-seeking. And the impact of these communities has been felt far beyond their geeky membership. That impact was especially visible on January 18, 2012, when signs of protest appeared across large swaths of the Internet, including Google, Wikipedia, and Twitter, to protest the proposed bills then in Congress that stood to radically bolster copyright law, mainly on behalf of the entertainment industry. Aaron Swartz and the many thousands of other hackers who rallied against the bills were acting on behalf of ideals that they had learned to cherish in practice, through their means of collective production. Some hackers, it's true, happen to be anticorporate activists. And the open-source pioneer Eric S. Raymondb"the hacker culture's resident ethnographer since around 1990," as he puts itbtakes Coleman to task for not saying more about the libertarian rationale often held among those of his ilk, which would object to copyright law as an affront to the free market. In the end, though, hackers' varying justifications matter less than what they actually do together. They became a force in mainstream politics through the back door because there was no choice; to the extent that file sharing, copying, and remixing aren't allowed, free software cannot operate. This is the insight that Coleman wants to bring to her fellow anthropologists in Coding Freedom: While liberal values like transparency, autonomy, and free inquiry may be cherished by many people in the abstract, the geeks who have fought for those values most assiduously on our behalf learned to care so much about them through practice, by what those values enabled them to produce. And when hackers are able solve technical problems by setting information free, they start to imagine what other kinds of problems they might be able to fix. By the fall of 2011, while Coleman was knee-deep in her work on Anonymous and other political outgrowths of geek culture, a student of hers named Leah Feder was about to encounter open-source ideals in the streets. Occupy Wall Street began in the last weeks of September, and Feder started going down to occupied Zuccotti Park, in Manhattan, soon afterward. She was excited by it but at first didn't know how to plug in. That's where she met Devin Balkind, also in his mid-20s. Before the movement started, he had incorporated an organization called Sarapis to help nonprofits benefit from open-source software and other peer-to-peer methodologies. Balkind is a wild-eyed true believer who talks about a "sea change" and a "knowledge revolution" to comebsoon, like in six months. Feder dropped out of NYU, and together they devoted themselves to introducing the movement not just to open-source software but also to other forms of free culture, like collaborative permaculture farming and digital currencies. They were less interested in how Occupy could protest than in what alternatives it could produce. The Occupy movement's affinity with free culture expressed itself right from the start; Occupy Wall Street's initial "Principles of Solidarity" statement called for "wide application of open source." Open-source organizing models also fit well with the movement's nonhierarchical and directly democratic proclivities. People with backgrounds in free software tended to have had more experience working in structures like that, and they became involved in Occupy encampments across the country. They also went to work building a digital infrastructure to unite the disparate movement. This infrastructure, much of it assembled in the months after the media had deemed Occupy over and done, was tested when Hurricane Sandy struck the Eastern Seaboard last October. Within days, a band of Occupy Wall Street veterans and their allies had mounted a relief effort that mobilized thousands of volunteers to help in communities where the government response was far from adequate. The effort started with an online platform that could direct people and supplies to sites where they were needed. Soon, Feder and Balkind helped set up a largely open-source system for managing resources and volunteers. "With Sandy we already did it," Balkind says. "We had a better system up within a month." As Occupy's most devoted participants have always believed, it is just one part of a network of interrelated movements. Much is made of the role of corporate social media like Facebook and Twitter on the recent protest scene, including Cairo's Tahrir Square and Canada's #IdleNoMore indigenous uprising, but less noticed is the commitment to free and open information underlying so many of these movements. The narrow frame of geek politics has found itself in much more mixed company. "There is a meta-relationship," says Coleman. "These movements enacted a shared set of values in their organizing." Some quarters of the encampment movement in Spain, for instance, have embraced talk of "the commons," and a "European Charter of the Commons" has been drafted in Italy. Harking back to the pre-industrial arrangement of villagers' holding farmland in common, and inspired by the free-software phenomenon, these people envision freeing more of society's vital resources from private control to be shared among those who depend on them. Luis Moreno-Caballud, who teaches in the Hispanic-studies program at the University of Pennsylvania, was closely involved in the movements in both Madrid and New York. He has been tracing a "return of the commons"ba tendency, he explains, "not to see our dependency on others as a weakness, or a lack, but a potential." This impulse was able to manifest itself especially easily in software over the past few decades; it was a new realm where the rules hadn't been made yet. But in the protest movements, Moreno-Caballud has noticed similar commons emerging as people self-organize to resist their governments' austerity policies. "The state is abandoning people," he says. "We need to reclaim what is ours." In the years since the fieldwork that led to Coding Freedom, Gabriella Coleman has found herself playing a new kind of role: that of the world's foremost scholar of Anonymous. "Studying Debian was a pure joy," she says. "It was a safe playground. And then all of a sudden I went to what felt like a nightmare playground, where there were spikes and booby traps and grenades." While before she had only to be careful to keep her Linux operating system from crashing, now she has to make sure not to collect data that could be used in investigations by law enforcementbnot learning where subjects live, for example, and leaving chat rooms if discussions of illegal activity begin. "I've definitely had to create boundaries," she says. Coleman discovered Anonymous while investigating, as a side project, the particular disdain that a number of geeks she'd interviewed over the years had for the Church of Scientology. She started to realize that Scientology is "this perfect inversion" of the hacker ethos. It is secretive, litigious, dogmatic, and freely blends its dogma with technology in ritual gizmos like the "E-meter." This was on her mind when something called "Project Chanology" appeared in early 2008: People in matching masks, calling themselves Anonymous, started protesting at Scientology centers around the world. Among these crowds, Coleman says, the cause of information liberation took on "a distinct modality." Some Anons were skilled coders from the free-software community, but many didn't have technical backgrounds. They were drawn to the cause by a culture and an aesthetic. Anonymous is part prank but also part activism; it led to a lot more of both. Within a couple of years, Anonymous was fighting big banks on behalf of WikiLeaksbthe information-freedom spree of the hacker Julian Assangeband bringing down dictators' Web sites during the Arab Spring. It played key roles in the Occupy movement. Corporations and governments alike had their security breached by this amorphous and often reckless band of information liberators. All along, Coleman turned her ethnographic attention to online chat channels and Twitter hashtags that Anonymous members frequented, and she met with leading Anons. Outlets including CNN, the Guardian, Wired, and Boing Boing use her has a source, and her insights on how Anonymous functions have made the phenomenon a little less mysterious. Anonymous will be the subject of her next book. The success that Anonymous and WikiLeaks have had in spooking the powerful is surely part of what motivated the scare tactics used against Aaron Swartz. Such tactics won't necessarily work. Over the course of the memorial for Swartz in New York, the remembrances swelled into calls for action, and then standing ovationsbagainst the power of corporations in the legal system, against the Citizens United Supreme Court decision, against mass incarceration. One cause led to another. The hackers were connecting the dots. "If people experience a taste of what political action is," Coleman said afterward, "whether it's the power of consensus, whether it's the power to change something, whether it's the power of getting media attentionbthey're hooked." Nathan Schneider is the author of Thank You, Anarchy: Notes From the Occupy Apocalypse and God in Proof: The Story of a Search From the Ancients to the Internet, both forthcoming from the University of California Press in 2013. Copyright 2013. All rights reserved. The Chronicle of Higher Education 1255 Twenty-Third St, N.W. Washington, D.C. 20037 -- ((Udhay Shankar N)) ((udhay @ pobox.com)) ((www.digeratus.com)) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] Tor and P2P (Hidden SMS)
by Fabio Pietrosanti (naif) 06 Jul '18

06 Jul '18

On 9/26/12 9:14 PM, Nathan Freitas wrote: > I can tell you that based on prototype code I have created, SMS and > VoIP type p2p applications between mobile devices works just fine. The > latency is not bad, especially since the apps are coded to be > asynchronous anyhow. Whether it takes 10 seconds or 1 minute for > someone to respond does not bother users. > Sure, also GlobaLeaks 0.2 is designed in a way to minimize the impact on TorHS latency and avoid "white page effect" on user's browser. > Hidden Services as a globally anonymous NAT'd networked is an amazing > opportunity for this type of application. We just need to solve the > scalability problem so we do not, as Robert put it "thrash the hidden > services directory". Totally agree, especially it's absolutely reasonable that we will see a growing number of Applications that include Tor as part of their code and use Tor Hidden Services a unique way to communicate. It would be very useful to have an official statement by Tor Project on the current scalability / performance impact of Tor Hidden Service with a Guideline to let Application Developer (bundling Tor, using TorHS) avoid breaking/hurting the Tor Network. That way the limits are clear and the way to be "Polite with the Network considering it's current limitations" would be explicit. Fabio _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Mobile Traffic Interception (SSL/TLS and VPN)
by Jeffrey Walton 06 Jul '18

06 Jul '18

Hi M. > not sure what you meant by mobile Anything wireless is in scope - Cellular radios, WiFi, Bluetooth, etc. I'm really interested in mobile devices which spend most of their time outside a logical security boundary of an organization. > wifi/wimax environment is almost identical to wired networks on this issue I agree that wireless suffers the same problems as wired. But I think the surface area increased disproportionately. With landlines between floors (or perhaps a leased line to/from a datacenter), I usually have some sort of physical security. In wireless, I don't have many of the assurances (how effective they are in a wired environment is a different story). A bad guy could set up a Wifi access point or base station, and my phone or tablet will happily camp to it. Plus, phones and tablets often come pre-loaded with certificates from OEMs and carriers (if they are burned into ROM, I probably can't manage them). And there is the customary law enforcement taps (x2 since both the wireless carriers and telcos likely provide them). Finally, there's WAP which places the MitM by design. > if somebody thinks SSL offers security ... Verbum sapienti. In short, I know the problems exist in the mobile arena, and I'm looking for the published results. Jeff On Sun, Sep 9, 2012 at 3:38 PM, Mh <mhtajik(a)gmail.com> wrote: > not sure what you meant by mobile . wifi/wimax kind of mobile clients or 2g/3g/4g types ? i am not aware of papers but based on personal experiments wifi/wimax environment is almost identical to wired networks on this issue but Xg's and satellite networks have many different factors including the strong country/region based regulations , vendor/operator related demands on customizing application processor OS ( assuming it is the one that handles SSL ) and the update scenario and strategy based on operator or client choices , jailbreak related issues , etc could have impacts on SSL security . i've got many cellphones in lab that have vast difference in trusted authorities , how to handle CRL update , offers of OTA ,etc . essentially , examining Xg's traffics , whether it is Voice , Signaling or Data ( includes IP stuff like SSL ) is by no mean a friendly job . this is why projects like openbts are important . two typical remote attacks are 1.silent change in os by modifying updates which could be done by hacking into the operator which is , trust me , an easy job 2.using a GSM-style active interception and impersonating the network as a whole , then proceed with evil activities using tricks , fishing , bugs , enforced redirects to metasploit-like infected pages . over all , if somebody thinks SSL offers security , and she wants to asses if to use the first environment or the second , i'd suggest the 1st . > > Regards > M. > > > On [Z)X4YX(Y, X4YX1[YX1 [1[9, [1[3[9[1 at [2[3:[3[1, Jeffrey Walton wrote: > >> Hi All, >> >> Is anyone aware of papers or studies on HTTPS traffic interception in >> mobile networks? >> >> I know Colling Mulliner did a study of HTTP headers and information >> leakage in the past. I know we have Trustwave (and I'm not aware of >> published results of Mozilla's subsequent actions) and the more >> general problem of Public CA hierarchies. I am aware of products like >> BlueCoat and Dr. Matt Greene's Interception Proxies page. I believe >> the EFF is aggregating data on SSL/TLS at the moment, but the data >> will not be released for some time. >> >> With HTML5 and WebSockets, I believe we can build a smarter client >> that can detect interception based on pinning (either public key or >> certificate). Is anyone aware of any tools for doing so (perhaps where >> aggregated data is offered)? _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Revised Liberationtech Mailing List Guidelines
by Seth David Schoen 06 Jul '18

06 Jul '18

Greg Norcie writes: > This is a good logic, but there is still a problem even if Google scans > uploads. > > Both state and nonstate actors often use zero day vulnerabilities. Since > a zero day has never been seen before, there is no signature for it in > any virus database. This is totally true in general, and of course these zero days have been used in real attacks, and of course Google can't necessarily recognize zero-day vulnerabilities. In the particular case of text documents shared through Google Docs -- as opposed to Word files hosted for download with some sort of file sharing site! -- I think malware is a comparatively minor risk. The reason is that when you upload a document to Google Docs, Google imports the content of the document into Google's own internal format. When you then download a document from Google Docs, Google is generating _a new document from scratch_ with the same text and formatting content as the original, but the result is not the same file that was originally uploaded. If someone mails you an attachment, or hosts a document file of their own creation on a web site, your word processor could be compromised if there are software vulnerabilities that the document exploits, like a buffer overflow. And this is also true of, say, a PDF document that you're going to open in a PDF reader; we know that there have been exploits used in the wild against PDF readers. By contrast, if you were to import some Microsoft Word file into Google Docs and then export the resulting Google Docs document in Microsoft Word format, what you'd get back would _not_ be the original file or any modified form of the original file. Instead, you would get a completely new Microsoft Word file, generated from scratch by Google, with essentially the same textual content as the original. (And if you were to export the Google Docs document as a PDF, what you'd get would be a PDF that Google generated from scratch.) Since these documents are being generated by Google in this way, using its own internally-developed software, Google will presumably create safe and valid documents for its users, not ones that contain exploits and malware. We might still worry that someone could _upload_ a malicious document to Google in order to attack Google's import process (and perhaps attack the Google Docs servers in various ways, whether to disable other security features or access private information), but I presume Google's security folks have been very cautious about this aspect and Google Docs import is probably much less vulnerable to malware and exploits than the file import features in popular desktop word processors like Microsoft Word, OpenOffice, and LibreOffice. (Also, attackers can study the binary code of Microsoft Word -- as well as Microsoft's security patches to it! -- or the source code of OpenOffice and LibreOffice -- as well as their developers' security patches to them! -- in order to try to find specific vulnerabilities. It's harder for attackers to speculate usefully about what vulnerabilities may exist in Google Docs import functionality because the attackers probably don't have access to any of the Google Docs code, whether source or binary. So even if there are exploitable vulnerabilities in the way Google Docs parses documents, it will be much harder for attackers to find and exploit them than it would be for published desktop software.) (How do I square this with my observation that "Google can't necessarily recognize vulnerabilities"? I think the main point is that the zero-day vulnerabilities we're likely to encounter are vulnerabilities in desktop software. Google may not be able to detect these, but it may not be vulnerable to them either! And with cautious programming, it can also default to rejecting files that are suspicious in some general ways, even if it doesn't know exactly what's bad about them. For instance, Andreas Bogk gave a talk last year at the CCC Camp about a PDF security scanner he's been developing which is able to reject several kinds of invalid PDFs automatically. Some of those invalid PDFs may be innocent and not contain any malware or exploits, but Google could still use a scanner like this to reject them and refuse to import them out of an abundance of caution.) -- Seth Schoen <schoen(a)eff.org> Senior Staff Technologist https://www.eff.org/ Electronic Frontier Foundation https://www.eff.org/join 454 Shotwell Street, San Francisco, CA 94110 +1 415 436 9333 x107 _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0