- cypherpunks-legacy - lists.cpunks.org

RE: [p2p-hackers] SHA1 broken?
by Serguei Osokine 06 Jul '18

06 Jul '18

> # * collisions in the the full SHA-1 in 2**69 hash operations, > # much less than the brute-force attack of 2**80 operations... Okay, so the effective SHA-1 length is 138 bits instead of full 160 - so what's the big deal? It is still way more than, say, MD5 length. And MD5 is still widely used for stuff like content id'ing in various systems, because even 128 bits is quite a lot, never mind 138 bits. Best wishes - S.Osokine. 16 Feb 2005. -----Original Message----- From: p2p-hackers-bounces(a)zgp.org [mailto:p2p-hackers-bounces@zgp.org]On Behalf Of Gordon Mohr (@ Bitzi) Sent: Tuesday, February 15, 2005 9:41 PM To: p2p-hackers Subject: [p2p-hackers] SHA1 broken? Via Slashdot, as reported by Bruce Schneier: http://www.schneier.com/blog/archives/2005/02/sha1_broken.html Schneier writes: # SHA-1 Broken # # SHA-1 has been broken. Not a reduced-round version. Not a # simplified version. The real thing. # # The research team of Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu # (mostly from Shandong University in China) have been quietly # circulating a paper announcing their results: # # * collisions in the the full SHA-1 in 2**69 hash operations, # much less than the brute-force attack of 2**80 operations # based on the hash length. # # * collisions in SHA-0 in 2**39 operations. # # * collisions in 58-round SHA-1 in 2**33 operations. # # This attack builds on previous attacks on SHA-0 and SHA-1, and # is a major, major cryptanalytic result. It pretty much puts a # bullet into SHA-1 as a hash function for digital signatures # (although it doesn't affect applications such as HMAC where # collisions aren't important). # # The paper isn't generally available yet. At this point I can't # tell if the attack is real, but the paper looks good and this # is a reputable research team. # # More details when I have them. - Gordon @ Bitzi _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [IP] [EPIC_IDOF] Getting consumers' consent to sell
by Kris Gabor 06 Jul '18

06 Jul '18

cellphone tracking data Interesting debate. I don't see the big deal here, though. A lot of valuable information can be gleaned from using cell phones as anonymous mobile transponders. The key is that the wireless carriers not pass on any personally identifiable information to the company doing the aggregation and analysis, and that the scope of the information is geographically limited. Requiring consumers to opt in would render this concept DOA. I would be interested in seeing the details of what raw data they are intending to turn over. The way the wireless carrier should do this to keep me happy as a consumer who values his privacy is to send the aggregator a feed of lat/long with some ephemeral ID that is constant for my phone (maybe changes daily), but cannot be resolved back to the ESN or phone number. Moreover, they should only do this if the location is within some geographic mask that represents highway systems of interest. I wouldn't want them to send a record of me pulling into my driveway, for instance. This way, we get the utility without giving up privacy. Seems like a win-win to me. -- Kris On 11/30/05 14:25, "David Farber" <dave(a)farber.net> wrote: > > >Begin forwarded message: > >From: "Richard M. Smith" <rms(a)computerbytesman.com> >Date: November 29, 2005 12:12:46 PM EST >To: EPIC_IDOF(a)mailman.epic.org >Subject: [EPIC_IDOF] Getting consumers' consent to sell cellphone >tracking data > >Hi, > >The Baltimore Sun and New York Times recently ran articles about the >State >of Maryland getting ready to roll out a traffic flow monitoring >system which >works by tracking the position of cellphones which are being >carried in >cars. The Baltimore Sun article is still online at this URL: > > Cell phone data tracing traffic in Md. > System 'watches' vehicles, raises fears about privacy > http://tinyurl.com/7we6q > >Virginia and Missouri are also about ready to test similar systems. > >I want to see a requirement put into place that wireless companies >must get >a customer's written consent before any of their cellphone position >data is >turned over to a third-party for any uses not related to making >cellphone >calls. > >I recent contacted the Maryland Highway Department and requested a >copy of >the contract for the system. The contract is now online as a Word >document >file on my Web site: > > http://www.computerbytesman.com/privacy/mdotcontract.doc > >I haven't had time to review the contract yet, but I did see that the >funds >for this Maryland project are coming from the Federal Highway >Administration >(http://www.fhwa.dot.gov/) Perhaps the FHWA are the folks who >should be >requiring consumers to provide consent to have their cellphone >position data >sold to other companies. > >Richard M. Smith >http://www.ComputerBytesMan.com > > > >_______________________________________________ >EPIC_IDOF mailing list >EPIC_IDOF(a)mailman.epic.org >https://mailman.epic.org/cgi-bin/mailman/listinfo/epic_idof > > > >------------------------------------- >You are subscribed as KGabor(a)aol.com >To manage your subscription, go to > http://v2.listbox.com/member/?listname=ip > >Archives at: http://www.interesting-people.org/archives/interesting- >people/ ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Getting consumers' consent to sell cellphone tracking data
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

RE: [p2p-hackers] SHA1 broken?
by Serguei Osokine 06 Jul '18

06 Jul '18

> # * collisions in the the full SHA-1 in 2**69 hash operations, > # much less than the brute-force attack of 2**80 operations... Okay, so the effective SHA-1 length is 138 bits instead of full 160 - so what's the big deal? It is still way more than, say, MD5 length. And MD5 is still widely used for stuff like content id'ing in various systems, because even 128 bits is quite a lot, never mind 138 bits. Best wishes - S.Osokine. 16 Feb 2005. -----Original Message----- From: p2p-hackers-bounces(a)zgp.org [mailto:p2p-hackers-bounces@zgp.org]On Behalf Of Gordon Mohr (@ Bitzi) Sent: Tuesday, February 15, 2005 9:41 PM To: p2p-hackers Subject: [p2p-hackers] SHA1 broken? Via Slashdot, as reported by Bruce Schneier: http://www.schneier.com/blog/archives/2005/02/sha1_broken.html Schneier writes: # SHA-1 Broken # # SHA-1 has been broken. Not a reduced-round version. Not a # simplified version. The real thing. # # The research team of Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu # (mostly from Shandong University in China) have been quietly # circulating a paper announcing their results: # # * collisions in the the full SHA-1 in 2**69 hash operations, # much less than the brute-force attack of 2**80 operations # based on the hash length. # # * collisions in SHA-0 in 2**39 operations. # # * collisions in 58-round SHA-1 in 2**33 operations. # # This attack builds on previous attacks on SHA-0 and SHA-1, and # is a major, major cryptanalytic result. It pretty much puts a # bullet into SHA-1 as a hash function for digital signatures # (although it doesn't affect applications such as HMAC where # collisions aren't important). # # The paper isn't generally available yet. At this point I can't # tell if the attack is real, but the paper looks good and this # is a reputable research team. # # More details when I have them. - Gordon @ Bitzi _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [IP] [EPIC_IDOF] Getting consumers' consent to sell
by Kris Gabor 06 Jul '18

06 Jul '18

cellphone tracking data Interesting debate. I don't see the big deal here, though. A lot of valuable information can be gleaned from using cell phones as anonymous mobile transponders. The key is that the wireless carriers not pass on any personally identifiable information to the company doing the aggregation and analysis, and that the scope of the information is geographically limited. Requiring consumers to opt in would render this concept DOA. I would be interested in seeing the details of what raw data they are intending to turn over. The way the wireless carrier should do this to keep me happy as a consumer who values his privacy is to send the aggregator a feed of lat/long with some ephemeral ID that is constant for my phone (maybe changes daily), but cannot be resolved back to the ESN or phone number. Moreover, they should only do this if the location is within some geographic mask that represents highway systems of interest. I wouldn't want them to send a record of me pulling into my driveway, for instance. This way, we get the utility without giving up privacy. Seems like a win-win to me. -- Kris On 11/30/05 14:25, "David Farber" <dave(a)farber.net> wrote: > > >Begin forwarded message: > >From: "Richard M. Smith" <rms(a)computerbytesman.com> >Date: November 29, 2005 12:12:46 PM EST >To: EPIC_IDOF(a)mailman.epic.org >Subject: [EPIC_IDOF] Getting consumers' consent to sell cellphone >tracking data > >Hi, > >The Baltimore Sun and New York Times recently ran articles about the >State >of Maryland getting ready to roll out a traffic flow monitoring >system which >works by tracking the position of cellphones which are being >carried in >cars. The Baltimore Sun article is still online at this URL: > > Cell phone data tracing traffic in Md. > System 'watches' vehicles, raises fears about privacy > http://tinyurl.com/7we6q > >Virginia and Missouri are also about ready to test similar systems. > >I want to see a requirement put into place that wireless companies >must get >a customer's written consent before any of their cellphone position >data is >turned over to a third-party for any uses not related to making >cellphone >calls. > >I recent contacted the Maryland Highway Department and requested a >copy of >the contract for the system. The contract is now online as a Word >document >file on my Web site: > > http://www.computerbytesman.com/privacy/mdotcontract.doc > >I haven't had time to review the contract yet, but I did see that the >funds >for this Maryland project are coming from the Federal Highway >Administration >(http://www.fhwa.dot.gov/) Perhaps the FHWA are the folks who >should be >requiring consumers to provide consent to have their cellphone >position data >sold to other companies. > >Richard M. Smith >http://www.ComputerBytesMan.com > > > >_______________________________________________ >EPIC_IDOF mailing list >EPIC_IDOF(a)mailman.epic.org >https://mailman.epic.org/cgi-bin/mailman/listinfo/epic_idof > > > >------------------------------------- >You are subscribed as KGabor(a)aol.com >To manage your subscription, go to > http://v2.listbox.com/member/?listname=ip > >Archives at: http://www.interesting-people.org/archives/interesting- >people/ ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Getting consumers' consent to sell cellphone tracking data
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

Re: [liberationtech] Tragic News: Aaron Swartz commits suicide
by Shava Nerad 06 Jul '18

06 Jul '18

This is what I understand of Aaron's action. First, to be clear, JSTOR settled with Aaron last summer. Aaron was trying to raise consciousness around their model. JSTOR does not pay out a penny to the author or the author's host institution. They do not pay royalties to the research funders - often the taxpayer, so maybe you and me. In other circumstances this would make the work public domain. The only money goes to the paper journal publisher. That is the firewall consortium JSTOR represents. That is the message Aaron meant to amplify with what he likely saw as political/ethical art performance civil disobedience. Personally I think if he had not been on federal radar for organizing SOPA/PIPA nothing more would have come from it as a Harvard-connected white academic of a certain status. But as it is, he faced seven figures in damages and three decades in hard time even after he settled with JSTOR. This is the way my family has observed activists attempted to be neutralized by the immune system of the federal government since Eugene Debs. I have three generations of witness. My instinct is that when you see resources expended out of proportion, look for the proportionate end. Aaron was not being chilled for his potential in copying files, I suspect. He just handed them something for which he could be charged. We can't let it go without response just because it is classic and chronic. I am organizing a vigil at 1 Courthouse in Boston 2pm Tuesday, probably small, and we'll follow on from that at MIT. Federal Prosecutor Ortiz does not seem like a monster in general, and there is hope for some good nonviolent ends out of this. Feedback welcome. Yrs, -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] [info] Anonymous Publishing Is Dead.
by grarpamp 06 Jul '18

06 Jul '18

>> like the NSA for example, consider that they haven't yet managed to track >> down the guys running the Silk Road drug site (http://silkroadvb5piz3r.onion) Call me stupid, but I actually think the NSA does have the capability to locate Tor hidden services, even if only those existing within the USA. But as usual, they may be restricted from originally passing it to enforcement, or from producing data at bequest of same. Or for whatever reason, no one cares, or wishes to keep capabilties or bigger fish under wraps. Nothing new here. > Do you know who runs Silk Road? Silk Road will likely go down via the usual means... some Joe somewhere flapping their gums, a street grudge, too much bling, etc. Just as with Farmer's Market, the case files will certainly make for interesting reading. But not really tell us much about Tor :( _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Indymedia Seizures Initiated In Europe
by brian-slashdotnews＠hyperreal.org 06 Jul '18

06 Jul '18

Link: http://slashdot.org/article.pl?sid=04/10/10/1716256 Posted by: timothy, on 2004-10-10 17:18:00 from the fbi-just-along-for-the-ride dept. [1]daveschroeder writes "According to [2]this Indymedia.org article and [3]AFP report, the request to seize Indymedia servers hosted by a U.S. company in the UK (covered in this [4]previous slashdot story) originated from government agencies in Italy and Switzerland, not the United States. Because Indymedia's hosting company, Rackspace.com, is a U.S. company, the FBI coordinated the request and accompanied UK Metropolitan Police on the seizure under the auspices of the [5]Mutual Legal Assistance Treaty (MLAT), an international legal treaty, but, according to an FBI spokesman, 'It is not an FBI operation. Through [MLAT], the subpoena was on behalf of a third country.'" Read on below for more. daveschroeder continues: "Rackspace's statement reads, 'In the present matter regarding Indymedia, Rackspace Managed Hosting, a U.S. based company with offices in London, is acting in compliance with a court order pursuant to a Mutual Legal Assistance Treaty (MLAT), which establishes procedures for countries to assist each other in investigations such as international terrorism, kidnapping and money laundering. Rackspace responded to a Commissioner's subpoena, duly issued under Title 28, United States Code, Section 1782 in an investigation that did not arise in the United States. Rackspace is acting as a good corporate citizen and is cooperating with international law enforcement authorities. The court prohibits Rackspace from commenting further on this matter.'" References 1. mailto:dasNO@SPAMdoit.wisc.edu 2. http://www.indymedia.org/en/2004/10/112047.shtml 3. http://story.news.yahoo.com/news?tmpl=story&cid=1509&ncid=738&e=6&u=/afp/20… 1008/tc_afp/us_internet_justice 4. http://yro.slashdot.org/article.pl?sid=04/10/07/204217&tid=153 5. http://travel.state.gov/law/mlat.html ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Canada's high-tech spies (CSE) leave (commissioner) Lamer in the
by michael taylor 06 Jul '18

06 Jul '18

dark <http://www.theglobeandmail.com/servlet/story/RTGAM.20060626.wcse0626/BNStory /National/home> Canada's high-tech spies leave Lamer in the dark JIM BRONSKILL Canadian Press [The Globe and Mail, June 27, 2006] Ottawa b The watchdog over Canada's eavesdropping agency says he's not getting the detailed information he needs to be sure the secretive spy outfit is obeying the rules. In his annual report, Antonio Lamer laments a "lack of clarity" in the information the Communications Security Establishment provides when seeking ministerial permission for sensitive operations. The disagreement raises questions about whether Mr. Lamer, as CSE commissioner, can provide full assurances that the spy agency is meeting all legal requirements. The Ottawa-based CSE, an ultra-secret wing of the Defence Department, monitors foreign radio, telephone, fax, satellite and computer traffic for information of interest to Canada. The intelligence is used in support of Canadian crime-fighting, defence and trade policies. Military listening posts assist the agency's efforts to intercept the communications of foreign states and organizations, as well as the phone calls and messages of suspected terrorists, drug traffickers and smugglers. The CSE has long been prohibited from directing its surveillance at Canadians or anybody in Canada. However, the Anti-Terrorism Act of 2001 gave the CSE authority to tap into conversations and messages even if those communications begin or end in Canada. For instance, the CSE could now intercept a phone call from a member of Osama bin Laden's al-Qaeda network somewhere in Asia to a residence in Montreal. Various safeguards, including the need for the defence minister's approval, were built into the practice. Mr. Lamer, a former Supreme Court chief justice, recently concluded his term as CSE commissioner, an independent watchdog who scrutinizes the spy agency's activities to ensure compliance with the law. In his final report, he says there should be a clear linkage between the government's intelligence priorities, the targets chosen and the activities for which ministerial approval is needed. But supporting documentation provided by the CSE as part of its requests for authorization address foreign intelligence requirements "only in general terms." The dispute stems from differing legal interpretations held by Mr. Lamer's independent counsel and the deputy minister of Justice, whose department provides legal direction to the CSE. "The lack of clarity in this regard has made it difficult for my staff to assess compliance with certain of the conditions that the legislation requires to be satisfied before a ministerial authorization is given." Mr. Lamer says he has "offered specific recommendations" to the defence minister and CSE to iron out "ambiguities" in the legislation governing the CSE. As a result, Mr. Lamer qualifies his finding that CSE activities 2005-06 complied with the law "as it is currently interpreted by the Department of Justice." CSE spokesman Adrian Simpson said Monday that, as a government agency, the organization "must follow the interpretation" of the Justice Department. Mr. Simpson added that the CSE "takes great pains to comply with all of the laws of Canada." Mr. Lamer says his one regret is leaving the post "without a resolution of the legal interpretation issues that have bedevilled this office since December 2001." "I wish my successor well in bringing this matter to a satisfactory conclusion for all concerned." Defence Minister Gordon O'Connor's office had no immediate comment. A spokesman for Mr. Lamer was unavailable. Mr. Lamer's concerns emerge as the CSE's American counterpart, the National Security Agency, faces the glare of controversy. In December, the New York Times disclosed that U.S. President George W. Bush had authorized the NSA to eavesdrop on Americans and others inside the United States without court-approved warrants, as has been the recognized practice there. Despite pointed criticism from privacy advocates, U.S. officials have defended the program. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0