July 2018 - cypherpunks-legacy

None
by None 06 Jul '18

06 Jul '18

Society URL: http://www.crcs.deas.harvard.edu/workshop (Open to the press and the general public) Although there has been significant public attention to the civil liberties issues of data surveillance over the past few years, there has been little discussion of the actual techniques that could be employed in any but the most restricted settings. Likewise, there has been little discussion of methods and technologies for conducting data surveillance while respecting privacy and preserving civil liberties. Our keynote speaker will be: Bob Popp, Ph.D., Executive Vice President of Aptima, Inc., and formerly Deputy of the Information Awareness Office and Total Information Awareness (TIA) program, Defense Advanced Research Projects Agency (DARPA). His talk will be on "A Vision for Countering Terrorism Through Information and Privacy Protection Technologies," Other featured speakers include: Morning Sessions -- Kenneth Mandl, MD, M.P.H., Harvard Medical School Center for Biomedical Informatics and the Children's Hospital Informatics Program at the Harvard-MIT Division of Health Sciences and Technology --- "Real Time Automated Disease Surveillance: Opportunities and Challenges." -- Jeff Ubois, Internet Archive --- "Web Logs, Privacy, and Data Surveillance." -- Lew Oleinick, Privacy Technology Advisor for the Defense Logistics Agency. --- "The Federal Interagency RFID Working Group." -- Latanya Sweeney, Ph.D., Director, Laboratory for International Data Privacy; Associate Professor of Computer Science, Technology and Policy, Carnegie Mellon University --- "What Homeland Security Can Learn From the Homeless: The P3Tracker System." Afternoon Sessions -- Philippe Golle, Ph.D., Palo Alto Research Center. --- "Self- Enforcing Privacy" -- Rafail Ostrovsky, Ph.D., Director, Center for Information and Computation Security; Professor, Computer Science Department, University of California, Los Angeles --- "Private Searching on Streaming Data." -- Johannes Gehrke, Ph.D., Associate Director, Cornell Theory Center; Associate Professor, Department of Computer Sciences, Cornell University --- "Data Privacy and Background Knowledge." -- Brad Malin, Ph.D., Carnegie Mellon University --- "Fraud Detection; DNA Data Privacy, and De-identification," -- John Bliss, J.D., Privacy Strategist, Entity Analytic Solutions, IBM Software Group -- Rebecca Wright, Ph.D., Principal Investigator, Privacy, Obligations, and Rights in Technologies of Information Assessment (PORTIA) project; Associate Professor, Stevens Institute of Technology. --- "Progress on the PORTIA Project in Privacy-Preserving Data Mining." Closing Speaker: James Bamford, J.D., Author, The Puzzle Palace and Body of Secrets Are you interested in coming? The workshop is free but you must register to attend. For more information on the workshop and to register, please visit the conference website: http://crcs.deas.harvard.edu/workshop/2006/ If you have any further questions, please contact me: Simson L. Garfinkel Postdoctoral Fellow and Conference Program Chair 617-876-6111 simsong(a)acm.org ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

None
by None 06 Jul '18

06 Jul '18

Society URL: http://www.crcs.deas.harvard.edu/workshop (Open to the press and the general public) Although there has been significant public attention to the civil liberties issues of data surveillance over the past few years, there has been little discussion of the actual techniques that could be employed in any but the most restricted settings. Likewise, there has been little discussion of methods and technologies for conducting data surveillance while respecting privacy and preserving civil liberties. Our keynote speaker will be: Bob Popp, Ph.D., Executive Vice President of Aptima, Inc., and formerly Deputy of the Information Awareness Office and Total Information Awareness (TIA) program, Defense Advanced Research Projects Agency (DARPA). His talk will be on "A Vision for Countering Terrorism Through Information and Privacy Protection Technologies," Other featured speakers include: Morning Sessions -- Kenneth Mandl, MD, M.P.H., Harvard Medical School Center for Biomedical Informatics and the Children's Hospital Informatics Program at the Harvard-MIT Division of Health Sciences and Technology --- "Real Time Automated Disease Surveillance: Opportunities and Challenges." -- Jeff Ubois, Internet Archive --- "Web Logs, Privacy, and Data Surveillance." -- Lew Oleinick, Privacy Technology Advisor for the Defense Logistics Agency. --- "The Federal Interagency RFID Working Group." -- Latanya Sweeney, Ph.D., Director, Laboratory for International Data Privacy; Associate Professor of Computer Science, Technology and Policy, Carnegie Mellon University --- "What Homeland Security Can Learn From the Homeless: The P3Tracker System." Afternoon Sessions -- Philippe Golle, Ph.D., Palo Alto Research Center. --- "Self- Enforcing Privacy" -- Rafail Ostrovsky, Ph.D., Director, Center for Information and Computation Security; Professor, Computer Science Department, University of California, Los Angeles --- "Private Searching on Streaming Data." -- Johannes Gehrke, Ph.D., Associate Director, Cornell Theory Center; Associate Professor, Department of Computer Sciences, Cornell University --- "Data Privacy and Background Knowledge." -- Brad Malin, Ph.D., Carnegie Mellon University --- "Fraud Detection; DNA Data Privacy, and De-identification," -- John Bliss, J.D., Privacy Strategist, Entity Analytic Solutions, IBM Software Group -- Rebecca Wright, Ph.D., Principal Investigator, Privacy, Obligations, and Rights in Technologies of Information Assessment (PORTIA) project; Associate Professor, Stevens Institute of Technology. --- "Progress on the PORTIA Project in Privacy-Preserving Data Mining." Closing Speaker: James Bamford, J.D., Author, The Puzzle Palace and Body of Secrets Are you interested in coming? The workshop is free but you must register to attend. For more information on the workshop and to register, please visit the conference website: http://crcs.deas.harvard.edu/workshop/2006/ If you have any further questions, please contact me: Simson L. Garfinkel Postdoctoral Fellow and Conference Program Chair 617-876-6111 simsong(a)acm.org ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

None
by None 06 Jul '18

06 Jul '18

Society URL: http://www.crcs.deas.harvard.edu/workshop (Open to the press and the general public) Although there has been significant public attention to the civil liberties issues of data surveillance over the past few years, there has been little discussion of the actual techniques that could be employed in any but the most restricted settings. Likewise, there has been little discussion of methods and technologies for conducting data surveillance while respecting privacy and preserving civil liberties. Our keynote speaker will be: Bob Popp, Ph.D., Executive Vice President of Aptima, Inc., and formerly Deputy of the Information Awareness Office and Total Information Awareness (TIA) program, Defense Advanced Research Projects Agency (DARPA). His talk will be on "A Vision for Countering Terrorism Through Information and Privacy Protection Technologies," Other featured speakers include: Morning Sessions -- Kenneth Mandl, MD, M.P.H., Harvard Medical School Center for Biomedical Informatics and the Children's Hospital Informatics Program at the Harvard-MIT Division of Health Sciences and Technology --- "Real Time Automated Disease Surveillance: Opportunities and Challenges." -- Jeff Ubois, Internet Archive --- "Web Logs, Privacy, and Data Surveillance." -- Lew Oleinick, Privacy Technology Advisor for the Defense Logistics Agency. --- "The Federal Interagency RFID Working Group." -- Latanya Sweeney, Ph.D., Director, Laboratory for International Data Privacy; Associate Professor of Computer Science, Technology and Policy, Carnegie Mellon University --- "What Homeland Security Can Learn From the Homeless: The P3Tracker System." Afternoon Sessions -- Philippe Golle, Ph.D., Palo Alto Research Center. --- "Self- Enforcing Privacy" -- Rafail Ostrovsky, Ph.D., Director, Center for Information and Computation Security; Professor, Computer Science Department, University of California, Los Angeles --- "Private Searching on Streaming Data." -- Johannes Gehrke, Ph.D., Associate Director, Cornell Theory Center; Associate Professor, Department of Computer Sciences, Cornell University --- "Data Privacy and Background Knowledge." -- Brad Malin, Ph.D., Carnegie Mellon University --- "Fraud Detection; DNA Data Privacy, and De-identification," -- John Bliss, J.D., Privacy Strategist, Entity Analytic Solutions, IBM Software Group -- Rebecca Wright, Ph.D., Principal Investigator, Privacy, Obligations, and Rights in Technologies of Information Assessment (PORTIA) project; Associate Professor, Stevens Institute of Technology. --- "Progress on the PORTIA Project in Privacy-Preserving Data Mining." Closing Speaker: James Bamford, J.D., Author, The Puzzle Palace and Body of Secrets Are you interested in coming? The workshop is free but you must register to attend. For more information on the workshop and to register, please visit the conference website: http://crcs.deas.harvard.edu/workshop/2006/ If you have any further questions, please contact me: Simson L. Garfinkel Postdoctoral Fellow and Conference Program Chair 617-876-6111 simsong(a)acm.org ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Surveillance targeted to convention / Wide network of cameras
by Monty Solomon 06 Jul '18

06 Jul '18

planned Surveillance targeted to convention Wide network of cameras planned By Ralph Ranalli and Rick Klein, Globe Staff | July 18, 2004 An unprecedented number of video cameras will be trained on Boston during the Democratic National Convention, with Boston police installing some 30 cameras near the FleetCenter, the Coast Guard using infrared devices and night-vision cameras in the harbor, and dozens of pieces of surveillance equipment mounted on downtown buildings to monitor crowds for terrorists, unruly demonstrators, and ordinary street crime. For the first time, 75 high-tech video cameras operated by the federal government will be linked into a surveillance network to monitor the Central Artery, City Hall Plaza, the FleetCenter, and other sensitive sites. Their feeds from cameras mounted on various downtown buildings will be piped to monitoring stations in the Boston area and in Washington, D.C., and officials will be able to zoom in from their work stations to gather details of facial descriptions or read license plates. With Boston Harbor just a few steps from the arena, the Coast Guard will be using its new ''hawkeye system" -- in place in one other port in the nation -- to watch area waterways. The network of infrared imaging, radar, and cameras that operate in both day and night conditions will give security officials a real-time picture of the harbor, and provide agencies an early warning if an unexpected ship enters area waters. An unspecified number of State Police cameras are also being installed, and more than 100 previously existing MBTA cameras will be used to monitor area subway and bus stations. Law enforcement officials will have as-needed access to as many as 900 cameras that have been operated for months or years by the Massachusetts Port Authority, the state Highway Department, and the Big Dig. Civil libertarians warn that the latest technology will be used to scare away protesters and others exercising their rights under the First Amendment. The critics complain that there are few state and federal laws regulating the use of video surveillance in public places. ... http://www.boston.com/news/politics/conventions/articles/2004/07/18/ surveillance_targeted_to_convention/ ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[IP] Surveillance targeted to convention / Wide network of cameras
by David Farber 06 Jul '18

06 Jul '18

planned X-Mailer: Apple Mail (2.618) Reply-To: dave(a)farber.net Begin forwarded message:

1 0

Tor: Please block these file-sharing ports from your exit policy
by Roger Dingledine 06 Jul '18

06 Jul '18

Hi folks, You're getting this mail because you've registered a Tor server. Thanks for contributing to the Tor network! We've been getting a lot of nodes lately from people saying they're happy Tor exists because now they can publish anonymously, reach websites that are blocked from their country, etc etc. This is all possible because of people like you. There are two parts to this mail: (1) asking how Tor servers are doing and reminding you to upgrade / restart them, and (2) asking you to prepend some more exit policy lines in their torrc. ****** Part one: ****** If your Tor server has crashed and you haven't noticed, please notice, and consider upgrading to at least 0.0.9.3 and restarting it. :) If it was running 0.0.9.3 when it crashed, please let me know of any hints (e.g. core files and error messages) you might have for us. If you've turned off your Tor server because it's eating too much of your bandwidth/CPU, please consider setting BandwidthRate and BandwidthBurst and starting it up again. Bandwidth limiting also limits the cpu use, since it's tied to how many bytes you process. Even cable and DSL rates are usable and useful to us. Also, note that we've implemented Hibernation, which lets you set a maximum number of bytes to handle per day/week/month, and your server goes to sleep in between. Let me know if you need help choosing good configuration parameters; I'm happy to help. If you're feeling adventurous, feel free to try the code in CVS: http://tor.eff.org/developers.html It hasn't crashed on us lately, and it uses pthreads rather than forking so the "using lots of memory for each dnsworker" problem should be resolved. We'll be putting out an actual package for 0.1.0-alpha in a week or two, if you prefer to wait. If you're feeling adventurous and still have bandwidth to spare, feel free to set your BandwidthRate to something higher than the 780 KB default. http://serifos.eecs.harvard.edu:8000/cgi-bin/exit.pl?sortbw=1 shows the daily top servers by usefulness, for those with a competitive streak. :) And if you have any wishlist items or other comments, we'd love to hear them. ****** Part two: ****** In the past weeks, file-sharing has been pummeling the Tor network: http://www.noreply.org/tor-running-routers/ While we don't have any legal or moral opinions about this particular traffic, we need to take technical measures to make the network usable again. One solution would be to enumerate the ten or so ports that we know we want to accept, and reject the rest. We may end up needing to do that, but we'd like to try an intermediate approach first. So, please prepend the following line to your exit policy, by putting this line in your torrc file: ExitPolicy reject *:4661-4666,reject *:6346-6429,reject *:6881-6999 There's no need to do this if you're a middleman node, or your chosen exit policy already rejects these. But otherwise, please do it even if you personally do not mind carrying traffic for these ports: Tor's architecture means that most of the hops in the circuit don't know what traffic they're carrying, and at least for now we'd like to crank down the overall bandwidth used by applications on these ports. Hopefully in the future we'll have a better (e.g. more decentralized) Tor that can handle it, but there's no point letting the network die in the meantime. Thanks! --Roger ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: SSL fro hidden services
by Dan Mahoney, System Admin 06 Jul '18

06 Jul '18

On Thu, 20 Oct 2005, loki tiwaz wrote: >hi, > >>>>>That said, the certificate naming scheme may be way off, since there's >>>>>no concept of a valid certificate (I doubt verisign will want to sign >>>>>one for 786237261871621.onion :) > >i am considering running an onion-based CA which could be used... i simply >need to make a script which allows a user to sign a certificate signing >request and produce a signed server key. the server key only needs to have >its onion address as content, nothing more is required, and a link to >import the CA key into the browser so that it can be trusted automatically >by the browser. > >>>>>However, assuming the user installs your self-signed cert, it *should* >>>>>work the same unless there's something I'm missing.) >>>>> >>>>>Of course, you're really just protecting content from being sniffed >>>>>between the user and the entry node (usually, the same machine, but not >>>>>always), and the exit node and the hidden service (presumably, you >>>>>control both). >>>>> >>>>>This is my understanding of it -- if someone has a better one please >>>>>step on me without hesitation :) > >yes, this is the case, and it is a valid reason to use ssl. in my opinion, >since tor already uses multi-layered encryption anyway, one more layer at >the core is not going to create that much of an extra load on the server, >and it means that there is no way the traffic can be sniffed at any point - >for example a trojan could sniff localhost traffic. also, using onion >routing defeats the one way in which SSL can be attacked, by >man-in-the-middle intermediaries on the network pathway, which of course >cannot be known within the tor network. Also, it should be noted that tor >exit nodes could potentially be modified to become men-in-the-middle, >although this would not be possible without compromising the key of the >server being contacted - another aspect of the advantage of using tor. > >onion addresses are impossible to remember though - which brings me to >another idea - of a name resolution system within the tor network so >simpler names can be used. this would require a second directory system, i >don't know if it is practical or not, but i thought i should put the idea >out there because i2p has name resolution systems, and benig able to type >in oniondomainname.onion rather than u15syoa125au.onion would be nice. it >would increase the rate of take-up of hidden services, both use and hosting. The other thing that could be interesting of course is an onion-only search engine, which could either compliment or reduce the need for vanity names. Still, I don't see why the directory servers can't maintain this info. It would have to (for the most part) be first-come first-served, and I suppose some sort of uptime monitoring should also play a part (i.e. if you don't use it for say 6 months, you lose it). Shame there's not a whole lot of clients that make use of SRV records, as an onion specifier in there could prove remarkably useful in some way. -- "If you aren't going to try something, then we might as well just be friends." "We can't have that now, can we?" -SK & Dan Mahoney, December 9, 1998 --------Dan Mahoney-------- Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site: http://www.gushi.org --------------------------- ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Workshop on Data Surveillance at Harvard on June 3rd
by Simson Garfinkel 06 Jul '18

06 Jul '18

Dave, Please share this with your Interesting-People list. And come if you can! We're especially interested in having outsiders...

1 0

[IP] Workshop on Data Surveillance at Harvard on June 3rd
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [tor-talk] Fwd: ANONdroid
by Paul Syverson 06 Jul '18

06 Jul '18

On Thu, Jan 26, 2012 at 10:35:20AM +0200, Maxim Kammerer wrote: > On Thu, Jan 26, 2012 at 10:05, Karsten N. <kn(a)awxcnx.de> wrote: > > > It is possible, to deanonymize a single user by some features (user IP > > address, website monitoring or user account). The idedentify feature for > > the malicious user has to be provided by the law enforcement agency and > > all operators have to get an official order in their country. > > So there is no difference from Tor? > JonDoNym and Tor have some significant aspects in common, but they are fundamentally different in the basis for their security. JonDoNym is a mix cascade design (or `MIX' as some would write it). This means that all the messages (packets/cells) that enter the network together (enter a node at roughly the same time) proceed through the network together in a batch and leave the network together (exit at a predictable but distinct node all at the same time). In principle, this means that an adversary will have a difficult time separating messages in a batch from one another. (In practice, research indicates that the situation for low-latency traffic is, let's just be generous and say, more complicated.) This is the basis of the security they provide. Onion routing designs like Tor derive their security primarily from the unpredictability of routes: just seeing a message from a client enter the network does not tell you where it is going to come out. The pros and cons of these are a matter of long debate. (I miss you, Andreas.) I come down strongly on the side of onion routing as an approach. Many detailed research papers address lots of the issues, but much of my position is captured in my "Why I'm not an Entropist." (Let me know if you want to see it and can't find it.) The basic difference is roughly that mix cascades attempt to hide you well in a predictable 'anonymity set'. Onion routing networks attempt to make it hard to know where to look/attack if you want to de-anonymize, e.g., what website someone is browsing. And the Tor network is intended to be big enough and in diverse enough jurisdictions that it is hard for any one adversary to look everywhere (thousands of nodes worldwide). That's the main idea, skipping a lot of aspects, such as the possible benefits (or not) of combining the two approachers. > > An scientific paper about the "Revocable Anonymity" impleneted by > > JonDonym > > I see, so is that an optional feature that can be turned on by a MIX > router operator once served by a surveillance order? It seems to me > that it's an advantage over Tor, where relay operators can be served > with an order and some Tor patches that they wouldn't be able to turn > down to to the absence of a similar feature in Tor. Revocable > Anonymity seems to be designed to provide the minimum necessary > information to law enforcement. > Many security researchers, including myself, are quite resistant to the idea of revocable anonymity. Designing, building, and deploying a system to be secure is incredibly hard even without the added burden of building in a systematic means to selectively remove its security properties. See, for example, Matt Blaze's work on key escrow. See http://www.acsac.org/2011/program/keynotes/ for his recent retrospective. But leaving that entire issue aside, from my above comment, I hope it is apparent that there is another important difference from mix cascades. For Tor such a surveillance order for purposes of tracking particular communicants would be pointless, and thus presumably unjustified. Unlike cascades, a message entering the network in one location might come out at any exit node, anywhere in the world. And if, e.g., one observes communication exiting a particular network node and arriving at a destination of interest, there is no reason to think that future communication, even from the same originating client is likely to emerge from that same node. In fact just the opposite. aloha, Paul _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0