July 2018 - cypherpunks-legacy

[p2p-hackers] The Fifth HOPE in NYC
by V. Alex Brennen 06 Jul '18

06 Jul '18

At The Fifth HOPE a talk will be given on how to break anonymity networks. Some commonly used p2p code such as Tor and the remailers will be covered. I cannot attend the conference. Is anyone on the list going who could report back? I'm interested to hear if anything other than what's already been widely published is covered in this talk. I'm working on a p2p anonymity project. Thanks, - VAB The Fifth HOPE, NYC July 9-11th, 2004 http://www.the-fifth-hope.org/ How To Break Anonymity Networks Nick Mathewson Today's anonymous communication software (such as Mixmaster, Mixminion, Nymservers, JAP, Tor, Anonymizer, etc.) allows people to communicate while concealing their identities from each other and from external attackers. But no deployed system is strong enough to protect every pattern of user behavior against a sufficiently resourceful adversary, and many of them fall to far simpler attacks. In this talk, Nick will discuss working attacks against today's anonymity networks, drawing from past technical and social attacks on deployed networks and from recent academic research in traffic analysis, stylometry, and mix-net design. He will present defenses to these attacks when such defenses are known to exist. Saturday 2300 Area "B" _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[drone-list] Article from Foreign Policy
by villa＠ee.ucla.edu 06 Jul '18

06 Jul '18

Some people may be interested in this article published in Foreign Policy today: What's Not Wrong With Drones? http://www.foreignpolicy.com/articles/2012/09/05/whats_not_wrong_with_drones The same author also wrote a piece last week on targeted killings: http://www.foreignpolicy.com/articles/2012/08/29/all_the_pentagons_lawyers and plans to write next week on what "reasons we should worry about drone strikes." John _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: TOR in Java?
by Nick Mathewson 06 Jul '18

06 Jul '18

On Thu, Oct 06, 2005 at 08:21:20PM +0200, Oliver S. wrote: > I think that TOR-servers don't need to be that performant as their > usage is currently and will in future be very uncommon. So it would > be easier to deveop TOR in Java (or maybe even C#?). This would also > reduce the probability of security-issues like buffer-overflows (may- > be it would be even possible to go back the TOR-chain through chai- > ned buffer-overflows, i.e. BOs that go from one gate in the chain > from the previous). > What do you think of my idea. I think your idea is a fine one for somebody's spare time; we always need more implementations for the Tor protocol, and Java is a popular choice these days. You might want to start with the code from the Java Anon Proxy people; I don't know their current status here, but for a while, they had a working Tor *client* written in Java. Of course, a server is significantly more complicated, so there would be a lot more work. As for the performance issue: you are completely wrong about Tor servers not needing CPU; at reasonable bandwidth, the requirements are high. Fortunately, most of the CPU is used for AES, DH, and RSA, all of which any sane implementation will implement in native code, so one might stand a chance of having a compatible implementation of the Tor protocol written in a less performance critical language. In other words: if you want to clone Tor in Java, feel free! We look forward to your work. Note, however, that I keep talking about "compatible implementations" here. Tor is 49 thousand lines right now[1], and we're trying to strengthen incrementally it all the time. Throwing out the implementation that we've been working on for the last four years and starting again from scratch is not likely to work for us. As for the rest of this thread: language choice is a classical bike-shed problem[2]. Please, tread lightly, and consider whether what you're saying needs to be said. If you're worried about Java: there's no risk we'll switch the main Tor implementation to it in the foreseeable future. If you want Java: great, get some programmers together and bang out an implementation. [1] Tor has about 37.6 klines of code, and 11.4 klines of comments. [2] On bikesheds: http://www.unixguide.net/freebsd/faq/16.19.shtml yrs, -- Nick Mathewson ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[x-risks] Jobs available working on terrorism in MD/Wash DC
by Hughes, James J. 06 Jul '18

06 Jul '18

Not as terrorists, but rather as terrorism experts.... Current Job Opportunities at START The National Consortium for the Study of Terrorism and Responses to Terrorism (START) has several openings for full-time positions to begin in Summer 2010. These positions are all based at START headquarters at the University of Maryland, College Park, and there are opportunities for people at different phases of their careers. Links below provide details on each job as well as on the application process for each position. We look forward to applications from interested, qualified people. Senior Researcher, Terrorism and Counterterrorism Project This is a full-time, non-tenure track position, with an initial term of 12 months (starting in June 2010). The researcher will be a member of a research team engaged in a multiyear study of the nature and impacts of government countermeasures on the evolution of extremist and terrorist movements. The researcher will lead original data collection, revision of an existing codebook, and quantitative coding as well as assist with quantitative data analyses.Click here for Senior Researcher, Terrorism and Counterterrorism position description <http://www.start.umd.edu/start/announcements/Position_Description_IUSSD_CM_…>. Project Manager/Senior Researcher (PM/SR), Radiological and Nuclear Non-State Adversary Research Project This is a full-time, non-tenure track faculty position, with an initial term of 12 months (starting in June 2010). The PM/SR will support overall project coordination and be a member of a research team engaged in a multiyear study assessing various aspects of non-state actor radiological and nuclear behavior, including but not limited to the pursuit and use of radiological and nuclear weapons by terrorists. Click here for Project Manager/Senior Researcher position description <http://www.start.umd.edu/start/announcements/DNDO_Job Description_final.pdf>. Researcher, Countering Weapons of Mass Destruction Project This is a full-time, non-tenure track position, with a term of 12 months (starting in June 2010). The researcher will be a member of a research team engaged in a multiyear study assessing new analytic methods for the use and analysis of open-source databases to enhance situational awareness for effective counter-WMD strategies. Duties will include: validating existing data and collecting new data on related to chemical, biological, radiological and nuclear (CBRN) weapons and conducting case studies on terrorist groups and individuals with respect to CBRN usage. Click here for WMD Researcher position description <http://www.start.umd.edu/start/announcements/DTRA_Job Description_final.pdf >. Gary Ackerman Assistant Director for Research and Communication National Consortium for the Study of Terrorism and Responses to Terrorism Tel: (301) 405-6656 (Direct) Tel: (301) 405-6600 (START Main) Fax: (301) 314-1980 E-mail: gackerman(a)start.umd.edu Website: www.start.umd.edu _______________________________________________ existential mailing list existential(a)ieet.org http://ieet.org/mailman/listinfo/existential ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[x-risks] Jobs available working on terrorism in MD/Wash DC
by Hughes, James J. 06 Jul '18

06 Jul '18

Not as terrorists, but rather as terrorism experts.... Current Job Opportunities at START The National Consortium for the Study of Terrorism and Responses to Terrorism (START) has several openings for full-time positions to begin in Summer 2010. These positions are all based at START headquarters at the University of Maryland, College Park, and there are opportunities for people at different phases of their careers. Links below provide details on each job as well as on the application process for each position. We look forward to applications from interested, qualified people. Senior Researcher, Terrorism and Counterterrorism Project This is a full-time, non-tenure track position, with an initial term of 12 months (starting in June 2010). The researcher will be a member of a research team engaged in a multiyear study of the nature and impacts of government countermeasures on the evolution of extremist and terrorist movements. The researcher will lead original data collection, revision of an existing codebook, and quantitative coding as well as assist with quantitative data analyses.Click here for Senior Researcher, Terrorism and Counterterrorism position description <http://www.start.umd.edu/start/announcements/Position_Description_IUSSD_CM_…>. Project Manager/Senior Researcher (PM/SR), Radiological and Nuclear Non-State Adversary Research Project This is a full-time, non-tenure track faculty position, with an initial term of 12 months (starting in June 2010). The PM/SR will support overall project coordination and be a member of a research team engaged in a multiyear study assessing various aspects of non-state actor radiological and nuclear behavior, including but not limited to the pursuit and use of radiological and nuclear weapons by terrorists. Click here for Project Manager/Senior Researcher position description <http://www.start.umd.edu/start/announcements/DNDO_Job Description_final.pdf>. Researcher, Countering Weapons of Mass Destruction Project This is a full-time, non-tenure track position, with a term of 12 months (starting in June 2010). The researcher will be a member of a research team engaged in a multiyear study assessing new analytic methods for the use and analysis of open-source databases to enhance situational awareness for effective counter-WMD strategies. Duties will include: validating existing data and collecting new data on related to chemical, biological, radiological and nuclear (CBRN) weapons and conducting case studies on terrorist groups and individuals with respect to CBRN usage. Click here for WMD Researcher position description <http://www.start.umd.edu/start/announcements/DTRA_Job Description_final.pdf >. Gary Ackerman Assistant Director for Research and Communication National Consortium for the Study of Terrorism and Responses to Terrorism Tel: (301) 405-6656 (Direct) Tel: (301) 405-6600 (START Main) Fax: (301) 314-1980 E-mail: gackerman(a)start.umd.edu Website: www.start.umd.edu _______________________________________________ existential mailing list existential(a)ieet.org http://ieet.org/mailman/listinfo/existential ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: TOR in Java?
by Nick Mathewson 06 Jul '18

06 Jul '18

On Thu, Oct 06, 2005 at 08:21:20PM +0200, Oliver S. wrote: > I think that TOR-servers don't need to be that performant as their > usage is currently and will in future be very uncommon. So it would > be easier to deveop TOR in Java (or maybe even C#?). This would also > reduce the probability of security-issues like buffer-overflows (may- > be it would be even possible to go back the TOR-chain through chai- > ned buffer-overflows, i.e. BOs that go from one gate in the chain > from the previous). > What do you think of my idea. I think your idea is a fine one for somebody's spare time; we always need more implementations for the Tor protocol, and Java is a popular choice these days. You might want to start with the code from the Java Anon Proxy people; I don't know their current status here, but for a while, they had a working Tor *client* written in Java. Of course, a server is significantly more complicated, so there would be a lot more work. As for the performance issue: you are completely wrong about Tor servers not needing CPU; at reasonable bandwidth, the requirements are high. Fortunately, most of the CPU is used for AES, DH, and RSA, all of which any sane implementation will implement in native code, so one might stand a chance of having a compatible implementation of the Tor protocol written in a less performance critical language. In other words: if you want to clone Tor in Java, feel free! We look forward to your work. Note, however, that I keep talking about "compatible implementations" here. Tor is 49 thousand lines right now[1], and we're trying to strengthen incrementally it all the time. Throwing out the implementation that we've been working on for the last four years and starting again from scratch is not likely to work for us. As for the rest of this thread: language choice is a classical bike-shed problem[2]. Please, tread lightly, and consider whether what you're saying needs to be said. If you're worried about Java: there's no risk we'll switch the main Tor implementation to it in the foreseeable future. If you want Java: great, get some programmers together and bang out an implementation. [1] Tor has about 37.6 klines of code, and 11.4 klines of comments. [2] On bikesheds: http://www.unixguide.net/freebsd/faq/16.19.shtml yrs, -- Nick Mathewson ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[cryptography] Why anon-DH is less damaging than current browser PKI (a rant in five paragraphs)
by Peter Gutmann 06 Jul '18

06 Jul '18

In the light of yet another in an apparently neverending string of CA failures, how long are browser vendors going to keep perpetuating this PKI farce? [0]. Not only is there no recorded instance, anytime, anywhere, of a browser certificate warning actually protecting users from harm [1], but the blind faith that browsers place in certificates is actively harming users when things fail, as they have again and again and again. Users, or at least technical ones with enough knowledge to understand the issues, have completely lost faith in browser PKI. If you look at discussion threads on technical forums [2], browser PKI is seen purely as something to roll your eyes at, to make jokes about. No-one (and as before that's with an implied "who understands the details") has any faith in it any more. The total inability and/or unwillingness of the browser vendors to respond to this and provide real security measures that don't involve simply changing the silly-walk they do with certificates and continuing as before is not only not helping users in any way, it's actively harming them, and users are aware of this. Browsers may as well turn off all their PKI-related code and just use anon-DH for everything, which would be safer than the current false-sense-of-security silly-walk they're doing, not to mention saving tens (hundreds?) of millions of dollars paid to commercial CAs by sites wanting to disable the browser warnings. Browser PKI costs a fortune to run, it doesn't protect users from anything the attackers are doing, and at worst it actively endangers them. If it was a commercial good, RAPEX would have it withdrawn [3]. Peter. [0] I mean "farce" in its theatrical sense here, "unlikely, extravagant, and improbable situations [...] highly incomprehensible plot-wise (due to the large number of plot twists and random events that often occur) [...] Farce is also characterized by [...] the use of deliberate absurdity or nonsense, and broadly stylized performances" (from Wikipedia, which has a more detailed definition than e.g. the OED). [1] See "So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users", Cormac Herley. [2] And I realise the likes of Slashdot aren't the best of them, but it's the most accessible and has the most participants, so it's a quick way to gauge public opinion. [3] "RAPEX is the EU rapid alert system that facilitates the rapid exchange of information between Member States and the Commission on measures taken to prevent or restrict the marketing or use of products posing a serious risk to the health and safety of consumers". _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[cryptography] A small public key encryption program
by Elias Yarrkov 06 Jul '18

06 Jul '18

Greetings, guys. I thought you might be interested in this little ECDH-based public key encryption program that I wrote. Primarily this is an experiment in how simple and small this stuff can be. It probably contains the simplest public C implementation of usably efficient elliptic curve point scalar multiplication, and thus might be useful in learning practical ECC. In particular, Curve25519. For symmetric stuff, I use EnRUPT in the sponge construction. XXTEA could've been alternatively used (with increased rounds, of course), but it does not appear to provide as much resistance to attacks per processing time in this context, and is slightly more complex. For EnRUPT, I use twice the standard number of rounds. I use a custom KDF. I intend to write about this manner of constructing KDFs later. The goal is to cause a high area*time cost for massively parallel brute force via ASIC, similar to scrypt. That's about it. More information here: http://cipherdev.org/dhbitty.html -- yarrkov -- http://cipherdev.org/ _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] more on CA State bill could cripple P2P
by David Farber 06 Jul '18

06 Jul '18

------ Forwarded Message From: Mike O'Dell <mo(a)ccr.org> Date: Wed, 19 Jan 2005 13:58:18 -0500 To: <dave(a)farber.net> Subject: Re: [IP] CA State bill could cripple P2P actually, taken at face value, this outlaws all network protocol stacks I know about, even terminal emulators with things like x-modem and even file redirection. it's patently bogus, but it could do an immense amount of mischief done before it gets undone (assuming it ever gets done). What i'd like to see is a bill punishing legislators for introducing unconstitutional bills. if a bill is declared unconstitutional, the sponsors of the bill would do prison time for an assault on the public freedom. -mo ------ End of Forwarded Message ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

<nettime> New Book: Internet and Surveillance: The Challenges of Web 2.0 and Social Media
by Christian Fuchs 06 Jul '18

06 Jul '18

Fuchs, Christian, Kees Boersma, Anders Albrechtslund and Marisol Sandoval (Eds.). 2011. Internet and Surveillance: The Challenges of Web 2.0 and Social Media. New York: Routledge. ISBN 978-0-415-89160-8. EU COST Publication. 332 pages. http://fuchs.uti.at/books/internet-and-surveillance-the-challenges-of-web-2… With contributions by: Anders Albrechtslund, Thomas Allmer, Mark Andrejevic, David Arditi, Roberto Armengol, Kees Boersma, Miyase Christensen, Christian Fuchs, David W. Hill, AndrC) Jansson, Deborah G. Johnson, David Lyon, Thomas Mathiesen, Marisol Sandoval, IvC!n SzC)kely, Monika Taddicken, Daniel Trottier, Kent Wayland, Rolf H. Weber The publication has been supported by EU COST b European Cooperation in Science and Technology and the EU COST Action IS0807 b Living in Surveillance Societiesb . This book is the first ever published volume that is dedicated to Internet surveillance in the age of what has come to be termed b social mediab or b web 2.0b3 (blogs, wikis, file sharing, social networking sites, microblogs, user-generated content sites, etc). The Internet has been transformed in the past years from a system primarily oriented on information provision into a medium for communication and community-building. The notion of b Web 2.0b, social software, and social networking sites such as Facebook, Twitter and MySpace have emerged in this context. With such platforms comes the massive provision and storage of personal data that are systematically evaluated, marketed, and used for targeting users with advertising. In a world of global economic competition, economic crisis, and fear of terrorism after 9/11, both corporations and state institutions have a growing interest in accessing this personal data. Here, contributors explore this changing landscape by addressing topics such as commercial data collection by advertising, consumer sites and interactive media; self-disclosure in the social web; surveillance of file-sharers; privacy in the age of the internet; civil watch-surveillance on social networking sites; and networked interactive surveillance in transnational space. This book is a result of a research action launched by the intergovernmental network COST (European Cooperation in Science and Technology). -- Prof. Christian Fuchs Chair in Media and Communication Studies Department of Informatics and Media Uppsala University KyrkogC%rdsgatan 10 Box 513 751 20 Uppsala Sweden christian.fuchs(a)im.uu.se Tel +46 (0) 18 471 1019 http://fuchs.uti.at http://www.im.uu.se NetPolitics Blog: http://fuchs.uti.at/blog Editor of tripleC: http://www.triple-c.se Book "Foundations of Critical Media and Information Studies" (Routledge 2011) Book "Internet and Society" (Paperback, Routledge 2010) # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0