- cypherpunks-legacy - lists.cpunks.org

[tor-talk] Cipherspaces/Darknets: An Overview Of Attack Strategies
by Adrian Crenshaw 06 Jul '18

06 Jul '18

I sent this out as just an animation test awhile back, this one has narration an is about 1hr long. This is essentially the talk I gave at Defcon 19, but I had a little more time to cover the topic in this canned video: http://www.irongeek.com/i.php?page=videos/cipherspaces-darknets-an-overview… Darknets/Cipherspaces such as Tor and I2P have been covered before in great detail. Sometimes it can be hard to follow attack strategies that have been used against them as the papers written on the topic have been academic and abstract. What this talk will attempt to do is step back and give an overview of the topic in a manner hopefully more conducive to the understanding of security practitioners, giving more concrete examples. While little to nothing in this talk will be "new and groundbreaking" it should lead to a better understanding of how encrypted anonymizing networks can be subverted to reveal identities. Thanks, Adrian -- "The ability to quote is a serviceable substitute for wit." ~ W. Somerset Maugham _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [p2p-hackers] Nash equilibrium on p2p networks
by Michael Rogers 06 Jul '18

06 Jul '18

On 07/03/12 20:05, James A. Donald wrote: > If I understand the proposed system > http://www.ee.ucl.ac.uk/~mrio/papers/infocom09.pdf correctly: > > Every entity has a public key. > > Leechers issue IOUs to seeders. This creates a network of IOUs. The > pledgeroute software looks for ways to cancel out IOUs, thus honoring > them - for example Ann seeds Bob, Bob seeds Carol, and Carol seeds Ann. > > If your IOUs get cancelled out, your key gains reputation, causing your > IOUs to be valued. > > It is not clear to me how the sybil attack is avoided: Is it that you > only gain reputation with those benefiting from the cancellation? If you consider a cluster of Sybils, the creator of the Sybils is free to create any structure of IOUs within the cluster, and any structure of IOUs from Sybils to non-Sybils. But IOUs from non-Sybils to Sybils can only be created by non-Sybils, and that only happens when the Sybils provide a service. No matter how many Sybils a person creates, the total debt owed to them by non-Sybils is limited by the total amount of service they provide. So there's no advantage in creating Sybils. It's not impossible - it's just pointless. I think that's how it works, anyway - it's been a while since I read the paper and I could be confusing it with the Sybilproof reputation mechanisms paper Matteo mentioned. Cheers, Michael _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Ross's TCPA paper
by Paul Harrison 06 Jul '18

06 Jul '18

on 6/23/02 6:50 AM, R. A. Hettinga at rah(a)shipwright.com wrote: > > --- begin forwarded text > > > Status: U > From: "Lucky Green" <shamrock(a)cypherpunks.to> > To: <cypherpunks(a)lne.com> > Cc: <cryptography(a)wasabisystems.com> > Subject: RE: Ross's TCPA paper > Date: Sat, 22 Jun 2002 23:01:12 -0700 > Sender: owner-cypherpunks(a)lne.com > <Tres Snippage..> > None of these obstacles are impossible to overcome, but not by Joe > Computer User, not by even the most talented 16-year old hacker, and not > even by many folks in the field. Sure, I know some that could overcome > it, but they may not be willing to do the time for what by then will be > a crime. Come to think of it, doing so already is a crime. > > --Lucky Green > > --- end forwarded text > The discussion of TCPA has a tendency to avoid serious discussion of what I feel is the core security issue: ownership of the platform. Comments such as Lucky's: "TPM will make it near impossible for the owner of that motherboard to access supervisor mode on the CPU without their knowledge" obfuscate this. The Trusted Computing Platform includes the TPM, the motherboard and the CPU, all wired together with some amount of tamper resistance. It is meaningless to speak of different "owners" of different parts. The owner of a TCP might be a corporate IT department (for employee machines), a cable company (for set-top boxen), or an individual. The important question is not whether trusted platforms are a good idea, but who will own them. Purchasing a TCP without the keys to the TPM is like buying property without doing a title search. Of course it is possible to _rent_ property from a title holder, and in some cases this is desirable. I would think a TCP _with_ ownership of the TPM would be every paranoid cypherpunk's wet dream. A box which would tell you if it had been tampered with either in hardware or software? Great. Someone else's TCP is more like a rental car: you want the rental company to be completely responsible for the safety of the vehicle. This is the economic achilles heal of using TCPA for DRM. Who is going to take financial responsibility for the proper operation of the platform? It can work for a set top box, but it won't fly for a general purpose computer. --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[IP] Ruling on Doe v Chao [ for IP list]
by Dave Farber 06 Jul '18

06 Jul '18

-----Original Message----- From: janice(a)e-mailamerica.net Date: Tue, 24 Feb 2004 14:32:50 To:Dave Farber <dave(a)farber.net> Subject: Ruling on Doe v Chao [ for IP list] Dave, The Supreme Court handed down its decision on the important Doe v Chao case today; please see attached. -- Court Protects Gov't From Privacy Suits Associated Press Tue Feb 24,12:29 PM ET WASHINGTON - The Supreme Court made it tougher Tuesday to make the government pay for revealing someone's Social Security (news - web sites) number and other personal information. Justices ruled 6-3 against a coal miner who sought $1,000 in damages after his Social Security number was revealed. He sued under the Privacy Act, a 1974 law which prohibits routine data collection on ordinary Americans and protects people from having their government records intentionally disclosed. The Supreme Court said the Virginia man, known as Buck Doe, had to prove that the government's violation of the privacy law actually harmed him. Justice David H. Souter, writing for the majority, said it is not enough to argue that someone suffers "presumed damages" when information about them is improperly made public. At issue was the Labor Department (news - web sites)'s handling of black lung disease claims. The department used miners' Social Security numbers as case numbers and then published the numbers in reports that became part of computerized legal research databases. In a dissent that was longer than the ruling in the case, Justice Ruth Bader Ginsburg (news - web sites), joined by Justices John Paul Stevens (news - web sites) and Stephen Breyer (news - web sites), said that the miner was emotionally damaged by the government's mistake. He should not have to prove out-of-pocket expenses, Ginsburg said, like fees for credit reports to ensure his identity was not stolen, or costly prescription drugs for anxiety. The case is Doe v. Chao, 02-1377 ------------------------------------- You are subscribed as rah(a)shipwright.com To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [IP] Verizon says phone record disclosure is protected
by Ethan Ackerman 06 Jul '18

06 Jul '18

free speech Greetings Dave, If I understand correctly, Verizon is now arguing in the NSA spying cases that turning over records to an arm of the government is protected 1st Amendment speech, even if the process of turning them over was of questionable legality. Maybe they want to run that by their co-defendants AT&T first, because AT&T has argued just the opposite... A little over a year ago, AT&T employee Mark Klein turned over proprietary records to the US District Court (an arm of the government) hearing the NSA spying cases brought by EFF. AT&T strongly objected, asserting trade secret claims and that the process of turning them over was of questionable legality. Maybe AT&T's proposed solution in its case should apply here as well: "The Confidential Documents were taken outside of the discovery [[[FISA]]] process. They contain confidential and proprietary AT&T [[[US citzen caller's]]] information. AT&T therefore has filed the Confidential Motion requesting that the Court order plaintiffs [[[NSA]]] to return the documents and make no further use of them unless and until they are obtained by proper [[[FISA-compliant]]] means." from http://www.eff.org/legal/cases/att/ATT38_sealing_motion.pdf bracketed comments mine, obviously. On 5/8/07, David Farber <dave(a)farber.net> wrote: > > >Begin forwarded message: > >From: Joshua Tinnin <krinklyfig(a)gmail.com> >Date: May 8, 2007 11:09:44 AM EDT >To: David Farber <dave(a)farber.net> >Subject: Verizon says phone record disclosure is protected free speech >Reply-To: krinklyfig(a)gmail.com > >http://arstechnica.com/news.ars/post/20070507-verizon-says-phone- >record-disclosure-is-protected-free-speech.html > >Verizon says phone record disclosure is protected free speech > >By Nate Anderson | Published: May 07, 2007 - 01:48PM CT > >Verizon is one of the phone companies currently being sued over its >alleged disclosure of customer phone records to the NSA. In a response >to the court last week, the company asked for the entire consolidated >case against it to be thrown out - on free speech grounds. > >The response also alleges that the case should be thrown out because >even looking into the issue could violate state secrets, of course, >but >a much longer section of the response tries to make the case that >Verizon has a First Amendment right to "petition" the government. >"Based >on plaintiffs' own allegations, defendants' right to communicate such >information to the government is fully protected by the Free Speech >and >Petition Clauses of the First Amendment," argue Verizon's lawyers. > >Essentially, the argument is that turning over truthful information to >the government is free speech, and the EFF and ACLU can't do anything >about it. In fact, Verizon basically argues that the entire lawsuit >is a >giant SLAPP (Strategic Lawsuit Against Public Participation) suit, and >that the case is an attempt to deter the company from exercising its >First Amendment right to turn over customer calling information to >government security services. > >"Communicating facts to the government is protected petitioning >activity," says the response, even when the communication of those >facts >would normally be illegal or would violate a company's owner >promises to >its customers. Verizon argues that, if the EFF and other groups have >concerns about customer call records, the only proper remedy "is to >impose restrictions on the government, not on the speaker's right to >communicate." > >With all of the phone company cases consolidated into one master case, >Verizon is hoping to have the case thrown out on free-speech grounds, >putting an end to its legal troubles over the issue. Should it >fail, the >Bush administration is already preparing to ask Congress for >retroactive >immunity for all telecommunications companies that assisted the >government after September 11, 2001. The government is also fighting >hard in court on behalf of the phone companies, filing repeated briefs >which claim that "state secrets" trump even the legality of the >alleged >security programs. > > >------------------------------------------- >Archives: http://v2.listbox.com/member/archive/247/=now >RSS Feed: http://v2.listbox.com/member/archive/rss/247/ >Powered by Listbox: http://www.listbox.com > ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Re: Verizon says phone record disclosure is protected free speech
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[tor-talk] Cipherspaces/Darknets: An Overview Of Attack Strategies
by Adrian Crenshaw 06 Jul '18

06 Jul '18

I sent this out as just an animation test awhile back, this one has narration an is about 1hr long. This is essentially the talk I gave at Defcon 19, but I had a little more time to cover the topic in this canned video: http://www.irongeek.com/i.php?page=videos/cipherspaces-darknets-an-overview… Darknets/Cipherspaces such as Tor and I2P have been covered before in great detail. Sometimes it can be hard to follow attack strategies that have been used against them as the papers written on the topic have been academic and abstract. What this talk will attempt to do is step back and give an overview of the topic in a manner hopefully more conducive to the understanding of security practitioners, giving more concrete examples. While little to nothing in this talk will be "new and groundbreaking" it should lead to a better understanding of how encrypted anonymizing networks can be subverted to reveal identities. Thanks, Adrian -- "The ability to quote is a serviceable substitute for wit." ~ W. Somerset Maugham _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

8-CALL FOR REVIEWERS: Draft NRC report on "Tools and Strategies for Protecting Kids from Pornography and Their Applicability to Other Inappropriate Internet Content."
by Herb Lin 06 Jul '18

06 Jul '18

CALL FOR REVIEWERS - PLEASE POST WIDELY The National Research Council seeks reviewers for a draft report on its project on "Tools and Strategies for Protecting Kids from Pornography and Their Applicability to Other Inappropriate Internet Content." More information on this project, including a list of committee members, can be found at < http://www.itasnrc.org>. Purpose of review Every report of the National Research Council must be reviewed by a diverse group of experts other than its authors before it may be released outside the institution. This independent, rigorous review is a hallmark that distinguishes the NRC from many other organizations offering scientific and technical advice on issues of national importance. The purpose of such review is to assist the authors in making their report as accurate and effective as possible, and to enhance the clarity, cogency, and credibility of the final document. Responsibilities of reviewers Reviewers are asked to consider whether in their judgment the evidence and arguments presented are sound and the report is fully responsive to the study charge, not whether they concur with the findings. Reviewers provide written comments on any and all aspects of the draft report, and the authoring committee is expected to consider all review comments and to provide written responses to those comments, either modifying the report accordingly or explaining why the report was not modified. The committee's responses are themselves evaluated by the National Research Council for adequacy and completeness. Note that NRC reports have a history of changing significantly between draft and final versions as the result of reviewer comments. Qualifications of reviewers Reviewers of NRC reports are selected on the basis of personal expertise in a field or fields relevant to the subject matter of the report; a dedication to drawing conclusions based on the analysis of data and information; sufficiently seniority in their fields to warrant broad respect for their intellect, fairness, and stature. Names of reviewers are made public at the time of the report's final publication, but during the review process they are anonymous to the committee and staff. Confidentiality of report Because NRC reports change as the result of review, reviewers must be willing to keep the draft report absolutely confidential and otherwise abide by the NRC's guidelines for reviewing of reports. Procedure for submitting names Please forward nominations for reviewers (self-nominations acceptable) to itas(a)nas.edu. The "subject" line of the e-mail should say "reviewer nomination." Submitted nominations should include contact information, biographies (including relevant published works, public statements, and current or former positions of relevance), and indications of relevant expertise and the perspective on the subject that the nominee will bring. Note that while the NRC seeks nominations from a wide variety of sources, it reserves the exclusive right to determine reviewers of its reports. Deadline for Nominations While nominations may be submitted at any time, nominations without the information described above, or received after September 15, 2001, may not be fully considered. More information is available from the Web site of this project at < http://www.itasnrc.org> or from Herb Lin (Study Director), at 202-334-2605. ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. Declan McCullagh's photographs are at http://www.mccullagh.org/ To subscribe to Politech: http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- ----- End forwarded message -----

1 0

FC: NRC asks for reviewers for forthcoming Internet porn report
by Declan McCullagh 06 Jul '18

06 Jul '18

Background from Politech archives: "Net-sex NRC panel asks for testimony, will hold regional mtgs" http://www.politechbot.com/p-01852.html "Patricia Nell Warren's comments to NAS porn panel" http://www.politechbot.com/p-01615.html "National Academy of Sciences panel hears about porn & kids" http://www.politechbot.com/p-01571.html "Free speech advocates fret about NAS Net-porn commission" http://www.politechbot.com/p-01567.html ********

1 0

[i2p] weekly status notes [dec 21]
by jrandom 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ev'nin folks, time for our status update * Index 1) 0.4.2.4 & 0.4.2.5 2) 0.5 strategy 3) naming 4) eepsite roundup 5) ??? 1) 0.4.2.4 & 0.4.2.5 With last week's 0.4.2.4 release, we saw the deployment of some new load balancing algorithms to throttle tunnel participation based on actual bandwidth usage, along side peer profiling updates to select peers better through a wider sample of data. This has done pretty well at both choking tunnel participation when necessary and finding good peers when possible. Another major update in that release was a change to how we verify time synchronization - rather than just checking the time sync once during connection establishment, peers now periodically send messages to each other with their current time, and if the time received is too far skewed, the connection is dropped. This has helped kick a few routers who were skewing off the net until they recovered (which is good), and the vast majority of peers have been quite close to 'correct' (you can see the clock skew on the /oldconsole.jsp page) With that, the network has been performing pretty well, but we were still seeing the occational bulk disconnect. After some debugging we tracked down an unintentional and wholely unnecessary DNS lookup that occurred whenever a router sent a message to a peer who has a hostname specified. This not only wasted time, but it wasted time within the jobqueue - essentially injecting a whole lot of lag for no reason. With that lookup removed, the router handled much better under heavily congested situations, but we were still seeing those occational bulk disconnects. After digging around in the stats and logging, we came up with a plausible theory that explains why those disconnects have been occurring - blaming them almost entirely on those DNS lookups. To test that theory (and to deploy some other goodies), we pushed out the 0.4.2.5 release this afternoon. We'll see how it goes. * 2) 0.5 strategy As the roadmap [1] says, the next planned release is 0.5, including a revised tunnel pool and encryption/id technique. Avoiding a big explanation (see [2], [3], [4], and a tiny bit of [5]), we will do this in two stages - first revamp the tunnel pooling and push that out as an interim release, debugging what is necessary, then revamp the encryption/id stuff, pushing that out as 0.5. Oh, and of course, once the algorithms for the pooling and encryption updates are in pretty good shape, they'll be posted up here and on the website for review. Along the way though, there will probably be small bugfix releases unrelated to the 0.5 stuff, but I don't have any specifically planned. [1] http://www.i2p.net/roadmap [2] http://www.i2p.net/todo#tunnelId [3] http://www.i2p.net/todo#ordering [4] http://www.i2p.net/todo#tunnelLength [5] http://www.i2p.net/todo#batching * 3) naming Yikes, now that I think about it, I really don't want to talk about naming yet - just download Ragnarok's latest addressbook app (2.0.1) from http://ragnarok.i2p/, check out susi's web based manager at http://susi.i2p/susidns/manager, and dig through the stats at http://orion.i2p/ and http://susi.i2p/susisworld.html * 4) eepsite roundup There have been some notable developments on various eepsites worth mentioning: = http://frosk.i2p/ - I2PContent doc updates = http://orion.i2p/ - new form to submit your keys to = http://piespy.i2p/ - neat graphs of the irc channels = http://forum.fr.i2p/ - french language forum = http://pastebin.i2p/ - stop flooding the channels! Of course, there have also been updates to other sites as well, plus some other new sites - check orion.i2p and sort the list by 'last updated' to review (or just go to 'em all ;) 5) ??? I know there's lots more going on, so please, swing on by the meeting in a few minutes and we can chat 'bout stuff. =jr -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFByItjGnFL2th344YRAmmOAKD+HxEAK+dqseq8ZCO5pjvW4EKImQCgkfwX 1KM+uQo7D6BjHAA99DwVyS0= =/T/b -----END PGP SIGNATURE----- _______________________________________________ i2p mailing list i2p(a)i2p.net http://i2p.dnsalias.net/mailman/listinfo/i2p ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0