July 2018 - cypherpunks-legacy

Re: [tor-talk] registration for youtube, gmail over Tor - fake voicemail / sms anyone?
by Mike Hearn 06 Jul '18

06 Jul '18

> Although it's not an ideal situation, a few days ago a Google employee > posted regarding access via Tor: > > https://lists.torproject.org/pipermail/tor-talk/2012-October/025923.html Hi, I'm that employee. That post is specifically about login to existing accounts that were created outside of Tor. We have a policy of phone verifying every signup via anonymizing proxies. If you signed up via Tor and didn't get asked to phone verify it means the list of exit nodes we're using isn't up to date, or there was a sync issue. Or you used an exit node that isn't in the list for some reason. We use this one: http://exitlist.torproject.org/exit-addresses We appreciate the offer to solve 1000 CAPTCHAs. Unfortunately the cost of 1000 CAPTCHAs is only about $1 on the open market, not exactly a high bar. The need for phone verification is unfortunate but real. If we had a better way to throttle abuse we'd use it. Unfortunately we don't. In the past I've researched and suggested using deposits of Bitcoin so we could set the price of an account in a more nuanced way, see here for a description of how it'd work: https://en.bitcoin.it/wiki/Contracts#Example_1:_Providing_a_deposit (bitcoin is my 20% project) For a variety of practical reasons I don't think that'll happen for Google accounts anytime soon, even assuming the software for it existed, which it doesn't yet. But I think it'd be great if people who are interested in making Tor usable with abusable services worked on the Bitcoin approach. I'd start by integrating with MediaWiki, blogging platforms etc, forum software etc, so if people want to run wikis/forums/blogs as hidden services or otherwise they have a way to make spam expensive without using the proxy of identity. Of course it does move the problem to be "how can I acquire Bitcoin?" but you get unlinkability. Even if the Bitcoin seller you used knows your identity, the recipient of the coins does not. So I'm afraid we don't have a good solution for people who want to sign up to Google anonymously today beyond buying accounts and getting unlinkability that way, but as I said, that's against our terms of service and can easily be confused with abuse so it's somewhat dangerous. thanks -mike _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

FC: Denmark bows to U.S., enacts anti-piracy search and seizure law
by Declan McCullagh 06 Jul '18

06 Jul '18

http://www.cluebot.com/article.pl?sid=01/06/26/042210 Denmark Enacts Anti-Piracy Search and Seizure Law posted by vergil on Friday July 20, @10:51AM from the battering-ram-of-the-bsa dept. If you needed further proof of the U.S. software industry's global muscle, keep reading. The U.S. government, acting on behalf of American firms, has successfully pressured Denmark to change its laws. A document unearthed by Cluebot.com describes how the new law allows physical searches for supposed copyright infringements "without prior notification." ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. To subscribe, visit http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- ----- End forwarded message -----

1 0

Re: Wired misquote [Symantec want's to criminalize full-disclosure]
by Alfred Huger 06 Jul '18

06 Jul '18

I am posting this In reference to the recent Wired article which Richard Smith posted to this list. Symantec fully supports information sharing on threats and vulnerabilities and believes it is an important tool for consumers and IT professionals to gain a measure of early warning of potential attacks. The Bugtraq mailing list, maintained as an independent entity under the SecurityFocus brand, remains one of the most respected and open sources for security information and early alerting by security professionals worldwide and full disclosure is *critical to the integrity of the Bugtraq community*. With regards to cyber crime we need more and higher quality resources for law enforcement to work on computer forensics, and we need cooperation from government and industry to assist prosecutors in building cases against attackers. Given the increase in the number of security threats and the availability of online tools we also believe that the industry should focus on training and educating today???s youth about the ethics of computer crime and its affects and impact on victims. These are not simply my words but also an official Symantec statement. Cheers, -al Alfred Huger Senior Director Engineering Symantec Security Response ----- End forwarded message ----- [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

Re: [silk] Google Targeted ads - gmail
by Rishab Aiyer Ghosh 06 Jul '18

06 Jul '18

biju, you use gmail. of *course* google knows everything, they read your private mails. perhaps "manipal" was mentioned in some mail sent by you, to you or by/to one of the people on your address list who happen to have gmail accounts... -rishab (who was shocked when he heard from a google board member that the store all ip addresses for all searches forever, and won't round off - eg. to class C or zip code - because they don't yet know what they want to do with this wonderful privacy-invading detailed stuff) At 09:17 17/03/2005, Biju Chacko wrote: >Ok, that does it. I am now convinced that Google is the new "Big >Brother". Next to Gabin's reply to my mail was an ad for a program at >Manipal University. > >For those you don't know, Gabin and I became friends at Manipal. > >/me is impressed. Google knows *everything*. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: [silk] Bitcoin
by Alaric Snell-Pym 06 Jul '18

06 Jul '18

On 06/20/11 20:13, Jon Cox wrote: > Hold on a moment. > > Because 100% of the worth of a Bitcoin is in its > "gamed network value" (it has zero "intrinsic local value"), > special importance is placed on faith its real-world > institutions. Saying that it was "just mtgox" sounds > absurd. They are the largest Bitcoin exchange. Sure, but my point was that this wasn't a flaw in the bitcoin system itself. Yes, the value of bitcoin is defined by its external exchanges, but *bitcoin* is a system for tracking the ownership of resources in a distributed manner - which is a difficult problem that it, so far, seems to have solved securely. > Bitcoin is therefore a 100% faith-based immature currency > with full code transparency but almost no institutional > transparency or independent auditing. For sure. However, it's got to start somewhere. > That's a recipe for trouble. > > An institutional problem like the one at Mt Gox > should not be able to crash the currency from > $17.50 down to $ 0.01 in 5 min, then put the > people who *do* buy in a state of uncertainty. > All bets are that those who bought at $0.01 > probably won't be able to cash out because of > the rollback. Why shouldn't it? The bitcoin economy is tiny; Mt Gox dominates it like the Bank of England dominates GBP. However, Mt Gox has no de jure power, and in due course, competitors will challenge it, thereby decentralising the economy again. > All currencies are systems; they need to be > analyzed from a systems perspective, or else > you'll wind up like one of those poor people > holding Bitcoins: $17.50 to %0.01 in 5 minutes. I hole 18 bitcoins; I'm not too worried that it's dropped like that - because I think it'll rise again. In fact, now would be a good time to buy some more... ABS -- Alaric Snell-Pym http://www.snell-pym.org.uk/alaric/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] [liberationtech] Not another Haystack right?
by nathan＠freitas.net 06 Jul '18

06 Jul '18

I wrote the block of text attributed to Eugene below, and total agree with you, Andrew. Much of the activist tech support I do is for Tibetans inside Occupied Tibet, and as we know Tor in China right now is quite a difficult proposition. Traditional VPNs can and do work, especially when the user simply needs circumvention, and has enough of a risk safety net that they won't be questioned or detained for simply using a vpn. As the primary developer of Orbot as well, I also deal with mobile latency issues quite a bit as well, and this has led me to think quite a bit about how the real time browse and click model of the web is highly incompatible with the realities of Tor. I think the solution for users who want both strong anonymity and circumvention via Tor, and are operating in a high latency environment, is to use applications like offline web cacheing tools (from pay per minute, dial up era), RSS readers, Twitter clients, Podcast apps and even Mail clients, which support synchronization and offline content access. These types of apps minimize the latency a user has to experience, while maximizing the amount of content that can then be shared via sneakernet or LANs. In summary, I think we should try to expand the way people use Tor, as opposed to pushing them towards less safe solutions. +n8fr8 -- Sent from my Android phone with K-9 Mail. Please excuse my brevity. Andrew <andrew(a)pdqvpn.com> wrote: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/2/2011 4:19 AM, Eugen Leitl wrote: > This also works against Tor in many cases, where people might > understand it is the best option, but will use a less safe VPN or > single-hop proxy, because they want something 'faster' or need to > stream a YouTube video in Flash. In that case, they are following > the wrong instincts, but it is the same mechanic at play We have to be more pragmatic tor is horrendously slow/unusable in some of these countries, and as long as you take some steps like not using single hop for either Proxies or VPNs, then you are addressing the treat model that they face, not one that we are making up in our heads. I realize that it is not perfect, and there is a trade off, but people on the ground are looking at it and making that choice for themselves. I've spent a lot of time working on issues with Syria lately, the universal report is that tor is terrible slow, they can't use tails because it takes too long to download/ is blocked, and their data might leak if if they use Tor, so using a VPN with some precautions taken is much more appetizing. - -Andrew -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJO2VWEAAoJEJW/J8aB8dYICFwIALhvq3K49XfOnd1PJ1jVlWJv YOvWDBZCDkdo8ygMFZpAfRmAELUT4aPw9B3UKJOhBI87Hcjm6RA1BpDw09YdQdbl 4mK1U+X0DZL0dIjQZioqo95w3ey6Jzj6ddF0rctmwC3zAkLUdVg9wTvCUurH+UII TKrTLBaSVacGIqPxrgYOpLpSEUt4HzYQbOJla0VsaUw+voG/03GWaKo5CJrKKhTa Gx+lFlSxrYl+tyHa47vuuJrHdvR9j4sr/AQ2aJyYdXdumUWVMyBIOsssMbqG0xu3 6Y2cbRSTHZJlyFdZasgRsUE3gNiDup9LZ0AuW2hcVDzdaLCWmhkLxoB6kaJmn/A= =JnWc -----END PGP SIGNATURE----- _____________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

FC: Denmark bows to U.S., enacts anti-piracy search and seizure law
by Declan McCullagh 06 Jul '18

06 Jul '18

http://www.cluebot.com/article.pl?sid=01/06/26/042210 Denmark Enacts Anti-Piracy Search and Seizure Law posted by vergil on Friday July 20, @10:51AM from the battering-ram-of-the-bsa dept. If you needed further proof of the U.S. software industry's global muscle, keep reading. The U.S. government, acting on behalf of American firms, has successfully pressured Denmark to change its laws. A document unearthed by Cluebot.com describes how the new law allows physical searches for supposed copyright infringements "without prior notification." ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. To subscribe, visit http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- ----- End forwarded message -----

1 0

Re: Wired misquote [Symantec want's to criminalize full-disclosure]
by Alfred Huger 06 Jul '18

06 Jul '18

I am posting this In reference to the recent Wired article which Richard Smith posted to this list. Symantec fully supports information sharing on threats and vulnerabilities and believes it is an important tool for consumers and IT professionals to gain a measure of early warning of potential attacks. The Bugtraq mailing list, maintained as an independent entity under the SecurityFocus brand, remains one of the most respected and open sources for security information and early alerting by security professionals worldwide and full disclosure is *critical to the integrity of the Bugtraq community*. With regards to cyber crime we need more and higher quality resources for law enforcement to work on computer forensics, and we need cooperation from government and industry to assist prosecutors in building cases against attackers. Given the increase in the number of security threats and the availability of online tools we also believe that the industry should focus on training and educating today???s youth about the ethics of computer crime and its affects and impact on victims. These are not simply my words but also an official Symantec statement. Cheers, -al Alfred Huger Senior Director Engineering Symantec Security Response ----- End forwarded message ----- [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

Re: [silk] Google Targeted ads - gmail
by Rishab Aiyer Ghosh 06 Jul '18

06 Jul '18

biju, you use gmail. of *course* google knows everything, they read your private mails. perhaps "manipal" was mentioned in some mail sent by you, to you or by/to one of the people on your address list who happen to have gmail accounts... -rishab (who was shocked when he heard from a google board member that the store all ip addresses for all searches forever, and won't round off - eg. to class C or zip code - because they don't yet know what they want to do with this wonderful privacy-invading detailed stuff) At 09:17 17/03/2005, Biju Chacko wrote: >Ok, that does it. I am now convinced that Google is the new "Big >Brother". Next to Gabin's reply to my mail was an ad for a program at >Manipal University. > >For those you don't know, Gabin and I became friends at Manipal. > >/me is impressed. Google knows *everything*. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: [silk] Bitcoin
by Alaric Snell-Pym 06 Jul '18

06 Jul '18

On 06/20/11 20:13, Jon Cox wrote: > Hold on a moment. > > Because 100% of the worth of a Bitcoin is in its > "gamed network value" (it has zero "intrinsic local value"), > special importance is placed on faith its real-world > institutions. Saying that it was "just mtgox" sounds > absurd. They are the largest Bitcoin exchange. Sure, but my point was that this wasn't a flaw in the bitcoin system itself. Yes, the value of bitcoin is defined by its external exchanges, but *bitcoin* is a system for tracking the ownership of resources in a distributed manner - which is a difficult problem that it, so far, seems to have solved securely. > Bitcoin is therefore a 100% faith-based immature currency > with full code transparency but almost no institutional > transparency or independent auditing. For sure. However, it's got to start somewhere. > That's a recipe for trouble. > > An institutional problem like the one at Mt Gox > should not be able to crash the currency from > $17.50 down to $ 0.01 in 5 min, then put the > people who *do* buy in a state of uncertainty. > All bets are that those who bought at $0.01 > probably won't be able to cash out because of > the rollback. Why shouldn't it? The bitcoin economy is tiny; Mt Gox dominates it like the Bank of England dominates GBP. However, Mt Gox has no de jure power, and in due course, competitors will challenge it, thereby decentralising the economy again. > All currencies are systems; they need to be > analyzed from a systems perspective, or else > you'll wind up like one of those poor people > holding Bitcoins: $17.50 to %0.01 in 5 minutes. I hole 18 bitcoins; I'm not too worried that it's dropped like that - because I think it'll rise again. In fact, now would be a good time to buy some more... ABS -- Alaric Snell-Pym http://www.snell-pym.org.uk/alaric/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0