- cypherpunks-legacy - lists.cpunks.org

[IP] Florida town to record all license plate numbers; check drivers
by Dave Farber 05 Jul '18

05 Jul '18

1 0

Secrecy News -- 05/15/12
by Steven Aftergood 05 Jul '18

05 Jul '18

Format Note: If you cannot easily read the text below, or you prefer to receive Secrecy News in another format, please reply to this email to let us know. SECRECY NEWS from the FAS Project on Government Secrecy Volume 2012, Issue No. 46 May 15, 2012 Secrecy News Blog: http://www.fas.org/blog/secrecy/ ** NATO SUMMIT MEETING IN CHICAGO, AND MORE FROM CRS NATO SUMMIT MEETING IN CHICAGO, AND MORE FROM CRS The North Atlantic Treaty Organization will hold its 2012 summit meeting in Chicago on May 20-21. The meeting, hosted by President Obama, will be closed to the public. The assembled heads of state are expected to discuss the future of the conflict in Afghanistan; NATO defense issues, including the possible reconsideration of the role of nuclear weapons in NATO; and other matters. A preview of the NATO summit meeting was presented in a new report from the Congressional Research Service. See NATO's Chicago Summit, May 14, 2012: http://www.fas.org/sgp/crs/row/R42529.pdf Other new and updated CRS reports that were obtained by Secrecy News include the following. Ukraine: Current Issues and U.S. Policy, May 10, 2012: http://www.fas.org/sgp/crs/row/RL33460.pdf U.S. Assistance Programs in China, May 11, 2012: http://www.fas.org/sgp/crs/row/RS22663.pdf Bahrain: Reform, Security, and U.S. Policy, May 14, 2012: http://www.fas.org/sgp/crs/mideast/95-1013.pdf Medicare Financing, May 11, 2012: http://www.fas.org/sgp/crs/misc/R41436.pdf Medicare: History of Insolvency Projections, May 11, 2012: http://www.fas.org/sgp/crs/misc/RS20946.pdf Job Growth During the Recovery, May 10, 2012: http://www.fas.org/sgp/crs/misc/R41434.pdf Foreign Direct Investment in the United States: An Economic Analysis, May 10, 2012: http://www.fas.org/sgp/crs/misc/RS21857.pdf Outsourcing and Insourcing Jobs in the U.S. Economy: Evidence Based on Foreign Investment Data, May 10, 2012: http://www.fas.org/sgp/crs/misc/RL32461.pdf Keystone XL Pipeline Project: Key Issues, May 9, 2012: http://www.fas.org/sgp/crs/misc/R41668.pdf Immigration of Foreign Nationals with Science, Technology, Engineering, and Mathematics (STEM) Degrees, May 11, 2012: http://www.fas.org/sgp/crs/misc/R42530.pdf Federal Labor Relations Statutes: An Overview, May 11, 2012: http://www.fas.org/sgp/crs/misc/R42526.pdf FEMA's Community Disaster Loan Program: History, Analysis, and Issues for Congress, May 10, 2012: http://www.fas.org/sgp/crs/homesec/R42527.pdf How Measures Are Brought to the House Floor: A Brief Introduction, May 14, 2012: http://www.fas.org/sgp/crs/misc/RS20067.pdf Carbon Capture and Sequestration (CCS): A Primer, May 14, 2012: http://www.fas.org/sgp/crs/misc/R42532.pdf The Presidential Nominating Process and the National Party Conventions, 2012: Frequently Asked Questions, May 14, 2012: http://www.fas.org/sgp/crs/misc/R42533.pdf Secrecy News will be back next week. _______________________________________________ Secrecy News is written by Steven Aftergood and published by the Federation of American Scientists. The Secrecy News Blog is at: http://www.fas.org/blog/secrecy/ To SUBSCRIBE to Secrecy News, go to: http://www.fas.org/sgp/news/secrecy/subscribe.html To UNSUBSCRIBE, go to http://www.fas.org/sgp/news/secrecy/unsubscribe.html OR email your request to saftergood(a)fas.org Secrecy News is archived at: http://www.fas.org/sgp/news/secrecy/index.html Support the FAS Project on Government Secrecy with a donation: http://www.fas.org/member/donate_today.html _______________________ Steven Aftergood Project on Government Secrecy Federation of American Scientists web: www.fas.org/sgp/index.html email: saftergood(a)fas.org voice: (202) 454-4691 twitter: @saftergood ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[>Htech] The bioweapon is in the post
by Brian Atkins 05 Jul '18

05 Jul '18

http://www.newscientist.com/channel/opinion/mg18825252.900.html The bioweapon is in the post # 09 November 2005 # NewScientist.com news service # Peter Aldhous YOU might think it would be difficult for a terrorist to obtain genes from the smallpox virus, or a similarly vicious pathogen. Well, it's not. Armed with a fake email address, a would-be bioterrorist could probably order the building blocks of a deadly biological weapon online, and receive them by post within weeks. That's the sobering reality uncovered by a New Scientist investigation into the bioterror risks posed by the booming business of gene synthesis. Dozens of biotech firms now offer to synthesise complete genes from the chemical components of DNA (See "A dollar a base pair"). Yet some are carrying out next to no checks on what they are being asked to make, or by whom. It raises the frightening prospect of terrorists mail-ordering genes for key bioweapon agents such as smallpox, and using them to engineer new and deadly pathogens. Customers typically submit sequences by email or via a form available on a company's website. The companies then construct the specified genes and mail them back a few weeks later, usually spliced into a bacterium such as Escherichia coli. New Scientist approached 16 such firms, identified by a Google search, to ask whether they screened orders for DNA sequences that might pose a bioterror threat. Of the 12 companies that replied, just five said they screen every sequence received. Four said they screen some sequences, and three admitted not screening sequences at all (see Table). The risks posed by gene synthesis first hit the headlines in 2002, when a team from the State University of New York at Stony Brook made infectious polioviruses from synthetic DNA. And just last month, researchers with the US Centers for Disease Control and Prevention in Atlanta, Georgia, said that they had used similar means to recreate the virus that caused the 1918 flu (New Scientist, 8 October, p 16). In theory, a terrorist group could try to emulate the latter feat, or create a virus such as Variola major, which causes smallpox. However, the Variola genome comprises some 190,000 base pairs of DNA, and while some companies will make sequences 20,000 or more base pairs long, an attempt to order all the genes necessary to launch a smallpox attack would probably arouse suspicion. "That would stand out from a technological point of view," suggests Drew Endy, a bioengineer at the Massachusetts Institute of Technology. A more realistic risk is that terrorists could order genes that confer virulence to dangerous pathogens such as the Ebola virus, and engineer them into another virus or bacterium. They could also order genes for a hazardous bacterial toxin - although many of these are also available by isolating the microorganisms from the environment. Virulence genes are typically no more than a few thousand base-pairs long. Their sequences are publicly available, so screening gene-synthesis orders for potential bioweapons shouldn't pose a huge challenge. Indeed, a company called Craic Computing, based in Seattle, has written open-source software called Blackwatch that does just that. It is used by one of the leading gene-synthesis companies, Blue Heron Biotechnology of Bothell, Washington. Robert Jones, president of Craic Computing, says that Blackwatch "casts a wide net", comparing orders against sequences from organisms identified by the US government as "select agents" that raise bioterror concerns. But not all of these sequences are dangerous, and some customers may have the clearance to work with those that are. So even legitimate orders may be flagged up as suspicious, and that means companies must employ biologists to carefully examine any matches that crop up. The need for expert human checks may be one factor deterring some companies from screening orders. Others like to reassure customers who may be worried about commercial confidentiality that their sequence data will remain secret. But whatever the reasons, some firms freely admit that they run no sequence screens. "That's not our business," says Bob Xue, a director of Genemed Synthesis in South San Francisco. Even if they don't routinely perform sequence checks, some companies say that they do investigate their customers. But the scope of these checks varies widely. While some firms say they conduct thorough probes into customers' affiliations and scientific publications, others are less exhaustive. For instance, Jennifer Wang, general manager of Bio Basic, based in Markham, Canada, says that her company examines email addresses to see if orders come from a legitimate research organisation. Such a check would have spotted one suspicious order, sent from a Hotmail address to BaseClear of Leiden, the Netherlands. This was for a modified sequence from a hepatitis-like virus. BaseClear itself rejected the order after the would-be customer failed to respond to requests for more information, says Gerben Zondag, the firm's scientific director. But email addresses are notoriously easy to fake. And even orders from legitimate institutions may not be what they seem. Alfred Lasher, who manages Picoscript in Houston, Texas, says that he turned down one order placed by an individual at a US biotech firm, after Picoscript's enquiries revealed the gene was being ordered on behalf of a friend in another country. Experts are concerned that the checks currently employed by some companies aren't sufficient to exclude orders placed by terrorists. "We're taking this very seriously," says Endy. Together with the J. Craig Venter Institute in Rockville, Maryland, and the Center for Strategic and International Studies in Washington DC, Endy's research group at MIT has launched a study into the risks and benefits of synthetic genomics, and aims to produce a set of policy recommendations by late 2006. The US National Science Advisory Board for Biosecurity, set up last year to advise the US government on which advances in biology could be exploited by terrorists, is also considering the issue. Some gene synthesis companies say they would welcome more detailed rules. John Mulligan, president of Blue Heron, says it would be helpful to have a list of "select sequences" that are off-limits for gene synthesis without explicit government permission, rather than having to make difficult judgments based on the list of select agents. "Tell us what we can't make," he implores. But with gene synthesis firms springing up all over the world, and the underlying technology becoming cheaper and more widely available, it is unclear whether regulations enacted in any one country will be enough. "It's going to be virtually impossible to control," predicts David Magnus, director of the Stanford Center for Biomedical Ethics in Palo Alto, California. Endy argues that what's needed is better self-regulation: if researchers only do business with companies that are diligent in sequence screening and other security checks, then terrorists would soon find themselves unable to place orders for dangerous genes. Otherwise, he fears a crackdown that could close valuable avenues of research. For instance, gene synthesis can be used to make DNA vaccines, which may eventually provide a means of responding rapidly to emerging diseases - or bioterrorist attacks. "As soon as people start dying from a bioengineered organism, there will be a huge security response and research will be clamped down," warns Endy. From issue 2525 of New Scientist magazine, 09 November 2005, page 8 A dollar a base pair Biochemists have long known how to build DNA from its component "bases" - the chemical letters of the genetic code. By adding the bases in a prescribed order and carefully performing a series of chemical reactions, they can create precisely tailored stretches of DNA. The process became significantly less laborious with the debut of the automated DNA synthesiser in the 1980s. But a full gene - a DNA sequence up to several thousand base pairs long - involves a formidable jigsaw puzzle. Commercial gene synthesis has only really taken off in the past few years with advances in automating this assembly process. And as the main players jostle for position, the costs of gene synthesis are plummeting. Prices have dropped about tenfold in five years, and some firms now supply genes for less than $1.50 per base pair. -- Brian Atkins Singularity Institute for Artificial Intelligence http://www.singinst.org/ ------------------------ Yahoo! Groups Sponsor --------------------~--> Get fast access to your favorite Yahoo! Groups. Make Yahoo! your home page http://us.click.yahoo.com/dpRU5A/wUILAA/yQLSAA/PMYolB/TM --------------------------------------------------------------------~-> Post message: transhumantech(a)yahoogroups.com Subscribe: transhumantech-subscribe(a)yahoogroups.com Unsubscribe: transhumantech-unsubscribe(a)yahoogroups.com List owner: transhumantech-owner(a)yahoogroups.com List home: http://www.yahoogroups.com/group/transhumantech/ Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/transhumantech/ <*> To unsubscribe from this group, send an email to: transhumantech-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[>Htech] The bioweapon is in the post
by Brian Atkins 05 Jul '18

05 Jul '18

http://www.newscientist.com/channel/opinion/mg18825252.900.html The bioweapon is in the post # 09 November 2005 # NewScientist.com news service # Peter Aldhous YOU might think it would be difficult for a terrorist to obtain genes from the smallpox virus, or a similarly vicious pathogen. Well, it's not. Armed with a fake email address, a would-be bioterrorist could probably order the building blocks of a deadly biological weapon online, and receive them by post within weeks. That's the sobering reality uncovered by a New Scientist investigation into the bioterror risks posed by the booming business of gene synthesis. Dozens of biotech firms now offer to synthesise complete genes from the chemical components of DNA (See "A dollar a base pair"). Yet some are carrying out next to no checks on what they are being asked to make, or by whom. It raises the frightening prospect of terrorists mail-ordering genes for key bioweapon agents such as smallpox, and using them to engineer new and deadly pathogens. Customers typically submit sequences by email or via a form available on a company's website. The companies then construct the specified genes and mail them back a few weeks later, usually spliced into a bacterium such as Escherichia coli. New Scientist approached 16 such firms, identified by a Google search, to ask whether they screened orders for DNA sequences that might pose a bioterror threat. Of the 12 companies that replied, just five said they screen every sequence received. Four said they screen some sequences, and three admitted not screening sequences at all (see Table). The risks posed by gene synthesis first hit the headlines in 2002, when a team from the State University of New York at Stony Brook made infectious polioviruses from synthetic DNA. And just last month, researchers with the US Centers for Disease Control and Prevention in Atlanta, Georgia, said that they had used similar means to recreate the virus that caused the 1918 flu (New Scientist, 8 October, p 16). In theory, a terrorist group could try to emulate the latter feat, or create a virus such as Variola major, which causes smallpox. However, the Variola genome comprises some 190,000 base pairs of DNA, and while some companies will make sequences 20,000 or more base pairs long, an attempt to order all the genes necessary to launch a smallpox attack would probably arouse suspicion. "That would stand out from a technological point of view," suggests Drew Endy, a bioengineer at the Massachusetts Institute of Technology. A more realistic risk is that terrorists could order genes that confer virulence to dangerous pathogens such as the Ebola virus, and engineer them into another virus or bacterium. They could also order genes for a hazardous bacterial toxin - although many of these are also available by isolating the microorganisms from the environment. Virulence genes are typically no more than a few thousand base-pairs long. Their sequences are publicly available, so screening gene-synthesis orders for potential bioweapons shouldn't pose a huge challenge. Indeed, a company called Craic Computing, based in Seattle, has written open-source software called Blackwatch that does just that. It is used by one of the leading gene-synthesis companies, Blue Heron Biotechnology of Bothell, Washington. Robert Jones, president of Craic Computing, says that Blackwatch "casts a wide net", comparing orders against sequences from organisms identified by the US government as "select agents" that raise bioterror concerns. But not all of these sequences are dangerous, and some customers may have the clearance to work with those that are. So even legitimate orders may be flagged up as suspicious, and that means companies must employ biologists to carefully examine any matches that crop up. The need for expert human checks may be one factor deterring some companies from screening orders. Others like to reassure customers who may be worried about commercial confidentiality that their sequence data will remain secret. But whatever the reasons, some firms freely admit that they run no sequence screens. "That's not our business," says Bob Xue, a director of Genemed Synthesis in South San Francisco. Even if they don't routinely perform sequence checks, some companies say that they do investigate their customers. But the scope of these checks varies widely. While some firms say they conduct thorough probes into customers' affiliations and scientific publications, others are less exhaustive. For instance, Jennifer Wang, general manager of Bio Basic, based in Markham, Canada, says that her company examines email addresses to see if orders come from a legitimate research organisation. Such a check would have spotted one suspicious order, sent from a Hotmail address to BaseClear of Leiden, the Netherlands. This was for a modified sequence from a hepatitis-like virus. BaseClear itself rejected the order after the would-be customer failed to respond to requests for more information, says Gerben Zondag, the firm's scientific director. But email addresses are notoriously easy to fake. And even orders from legitimate institutions may not be what they seem. Alfred Lasher, who manages Picoscript in Houston, Texas, says that he turned down one order placed by an individual at a US biotech firm, after Picoscript's enquiries revealed the gene was being ordered on behalf of a friend in another country. Experts are concerned that the checks currently employed by some companies aren't sufficient to exclude orders placed by terrorists. "We're taking this very seriously," says Endy. Together with the J. Craig Venter Institute in Rockville, Maryland, and the Center for Strategic and International Studies in Washington DC, Endy's research group at MIT has launched a study into the risks and benefits of synthetic genomics, and aims to produce a set of policy recommendations by late 2006. The US National Science Advisory Board for Biosecurity, set up last year to advise the US government on which advances in biology could be exploited by terrorists, is also considering the issue. Some gene synthesis companies say they would welcome more detailed rules. John Mulligan, president of Blue Heron, says it would be helpful to have a list of "select sequences" that are off-limits for gene synthesis without explicit government permission, rather than having to make difficult judgments based on the list of select agents. "Tell us what we can't make," he implores. But with gene synthesis firms springing up all over the world, and the underlying technology becoming cheaper and more widely available, it is unclear whether regulations enacted in any one country will be enough. "It's going to be virtually impossible to control," predicts David Magnus, director of the Stanford Center for Biomedical Ethics in Palo Alto, California. Endy argues that what's needed is better self-regulation: if researchers only do business with companies that are diligent in sequence screening and other security checks, then terrorists would soon find themselves unable to place orders for dangerous genes. Otherwise, he fears a crackdown that could close valuable avenues of research. For instance, gene synthesis can be used to make DNA vaccines, which may eventually provide a means of responding rapidly to emerging diseases - or bioterrorist attacks. "As soon as people start dying from a bioengineered organism, there will be a huge security response and research will be clamped down," warns Endy. From issue 2525 of New Scientist magazine, 09 November 2005, page 8 A dollar a base pair Biochemists have long known how to build DNA from its component "bases" - the chemical letters of the genetic code. By adding the bases in a prescribed order and carefully performing a series of chemical reactions, they can create precisely tailored stretches of DNA. The process became significantly less laborious with the debut of the automated DNA synthesiser in the 1980s. But a full gene - a DNA sequence up to several thousand base pairs long - involves a formidable jigsaw puzzle. Commercial gene synthesis has only really taken off in the past few years with advances in automating this assembly process. And as the main players jostle for position, the costs of gene synthesis are plummeting. Prices have dropped about tenfold in five years, and some firms now supply genes for less than $1.50 per base pair. -- Brian Atkins Singularity Institute for Artificial Intelligence http://www.singinst.org/ ------------------------ Yahoo! Groups Sponsor --------------------~--> Get fast access to your favorite Yahoo! Groups. Make Yahoo! your home page http://us.click.yahoo.com/dpRU5A/wUILAA/yQLSAA/PMYolB/TM --------------------------------------------------------------------~-> Post message: transhumantech(a)yahoogroups.com Subscribe: transhumantech-subscribe(a)yahoogroups.com Unsubscribe: transhumantech-unsubscribe(a)yahoogroups.com List owner: transhumantech-owner(a)yahoogroups.com List home: http://www.yahoogroups.com/group/transhumantech/ Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/transhumantech/ <*> To unsubscribe from this group, send an email to: transhumantech-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Secrecy News -- 09/07/12
by Steven Aftergood 05 Jul '18

05 Jul '18

Format Note: If you cannot easily read the text below, or you prefer to receive Secrecy News in another format, please reply to this email to let us know. SECRECY NEWS from the FAS Project on Government Secrecy Volume 2012, Issue No. 90 September 7, 2012 Secrecy News Blog: http://www.fas.org/blog/secrecy/ ** DRONES IN DOMESTIC SURVEILLANCE OPERATIONS, AND MORE FROM CRS DRONES IN DOMESTIC SURVEILLANCE OPERATIONS, AND MORE FROM CRS "The prospect of drone use inside the United States raises far-reaching issues concerning the extent of government surveillance authority, the value of privacy in the digital age, and the role of Congress in reconciling these issues," says a new report on the subject from the Congressional Research Service. "This report assesses the use of drones under the Fourth Amendment right to be free from unreasonable searches and seizures. The touchstone of the Fourth Amendment is reasonableness. A reviewing court's determination of the reasonableness of drone surveillance would likely be informed by location of the search, the sophistication of the technology used, and society's conception of privacy in an age of rapid technological advancement." "While individuals can expect substantial protections against warrantless government intrusions into their homes, the Fourth Amendment offers less robust restrictions upon government surveillance occurring in public places and perhaps even less in areas immediately outside the home, such as in driveways or backyards. Concomitantly, as technology advances, the contours of what is reasonable under the Fourth Amendment may adjust as people's expectations of privacy evolve." The new report reviews the relevant Fourth Amendment landscape, the current status of drone technology and applications, and pending legislation on the subject. A copy was obtained by Secrecy News. See "Drones in Domestic Surveillance Operations: Fourth Amendment Implications and Legislative Responses," September 6, 2012: http://www.fas.org/sgp/crs/natsec/R42701.pdf Other noteworthy new CRS reports that Congress has declined to make publicly available include the following. The "Fiscal Cliff": Macroeconomic Consequences of Tax Increases and Spending Cuts, September 5, 2012: http://www.fas.org/sgp/crs/misc/R42700.pdf The War Powers Resolution: After Thirty-Eight Years, September 5, 2012: http://www.fas.org/sgp/crs/natsec/R42699.pdf Stafford Act Declarations 1953-2011: Trends and Analyses, and Implications for Congress, August 31, 2012: http://www.fas.org/sgp/crs/homesec/R42702.pdf NFIB v. Sebelius: Constitutionality of the Individual Mandate, September 3, 2012: http://www.fas.org/sgp/crs/misc/R42698.pdf Search and Seizure Cases in the October 2012 Term of the Supreme Court, September 4, 2012: http://www.fas.org/sgp/crs/misc/R42697.pdf _______________________________________________ Secrecy News is written by Steven Aftergood and published by the Federation of American Scientists. The Secrecy News Blog is at: http://www.fas.org/blog/secrecy/ To SUBSCRIBE to Secrecy News, go to: http://www.fas.org/sgp/news/secrecy/subscribe.html To UNSUBSCRIBE, go to http://www.fas.org/sgp/news/secrecy/unsubscribe.html OR email your request to saftergood(a)fas.org Secrecy News is archived at: http://www.fas.org/sgp/news/secrecy/index.html Support the FAS Project on Government Secrecy with a donation: http://www.fas.org/member/donate_today.html _______________________ Steven Aftergood Project on Government Secrecy Federation of American Scientists web: www.fas.org/sgp/index.html email: saftergood(a)fas.org voice: (202) 454-4691 twitter: @saftergood ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [cryptography] Web Cryptography API (W3C Working Draft 8 January 2013)
by D. J. Bernstein 05 Jul '18

05 Jul '18

Ryan Sleevi writes: > What use case makes the "NaCl" algorithms (whose specification is merely > 'use NaCl', which boils down to "Use Salsa+Curve25519") worthwhile? Here's the abstract of "The security impact of a new cryptographic library" (http://cr.yp.to/highspeed/coolnacl-20120725.pdf) This paper introduces a new cryptographic library, NaCl, and explains how the design and implementation of the library avoid various types of cryptographic disasters suffered by previous cryptographic libraries such as OpenSSL. Specifically, this paper analyzes the security impact of the following NaCl features: no data flow from secrets to load addresses; no data flow from secrets to branch conditions; no padding oracles; centralizing randomness; avoiding unnecessary randomness; extremely high speed; and cryptographic primitives chosen conservatively in light of the cryptanalytic literature. The paper cites and analyzes cryptographic failures in SSH, ECDSA in SSL, RSA in SSL, Linux disk encryption, the PlayStation 3, et al. What's particularly convincing is to look at _newer_ failures, such as the very recent "Lucky 13" attack recovering plaintext from SSL, and observe that those failures would have been prevented by precisely the NaCl features identified in this document. ("Lucky 13" relies on padding oracles and on these prohibited forms of data flow.) These NaCl features are at a quite different level from the "features" advertised by cryptographic APIs from the dark ages (e.g., "we support MD5 and RSA-512"), and in many cases are in direct conflict with those "features". This is one of the reasons that NaCl has a simple high-level API. Of course, simplicity has other benefits. As for specification, there's a state-of-the-art "Cryptography in NaCl" document (http://cr.yp.to/highspeed/naclcrypto-20090310.pdf) that has complete self-contained definitions of every aspect of key generation, encryption, and authentication involved in NaCl's crypto_box(); plus an end-to-end example expressed both as * self-contained Python/Sage test scripts that compute every detail of the crypto and * simple test programs using NaCl, of course producing the same results; plus security notes. Someone who wants to write a new implementation that interoperates with crypto_box() doesn't need to read anything else. I'm not saying that this is the end of the story---implementors should also learn about crypto_sign(), constant-time code, and more---but it's way ahead of the documentation mess that one has to read to reimplement other existing protocols with similar functionality. > And how can we be sure that the problems that NaCl sets out to solve > are the same problems developers want or need to solve, especially > when all the evidence suggests otherwise? The main reason for a developer to use a cryptographic library is to protect data against espionage, sabotage, etc. There's ample evidence that most cryptographic libraries _don't_ actually manage to protect data---and imitating their decisions is simply going to produce more security disasters. Of course, this doesn't imply that NaCl is what developers want, but high-profile applications such as DNSCrypt are in fact using NaCl in ways that seem easily generalizable to other applications. ---D. J. Bernstein Research Professor, Computer Science, University of Illinois at Chicago _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

UK Government loses personal data of 25m people
by Denis Russell 05 Jul '18

05 Jul '18

Dave, Headline news in the UK is of a new world record. "On Tuesday the chancellor told MPs how the entire child benefit database was sent by a junior official from HMRC in Newcastle to the audit office in London through courier TNT on 18 October." ... and was lost: <http://news.bbc.co.uk/1/hi/uk_politics/7104945.stm> At least this has provoked some sensible (for a change) debate on the care of personal data. The BBC Newsnight had a good debate on the subject last night including Ross Andeson. At the moment the video is still online via <http://news.bbc.co.uk/1/hi/programmes/newsnight/default.stm > and will be for a week I believe. At least there may be one silver lining to this cloud, there is now widespread comment that the security risk of large centralized databases may actually be appreciated and this may "have dealt a body blow to the government's plans for a national ID card scheme". I'll believe that when I see it. Denis. ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] UK Government loses personal data of 25m people
by David Farber 05 Jul '18

05 Jul '18

Begin forwarded message:

1 0

[IP] more on on RFIDs in passports
by David Farber 05 Jul '18

05 Jul '18

------ Forwarded Message From: Edward Hasbrouck <edward(a)hasbrouck.org> Organization: The Practical Nomad Date: Mon, 18 Apr 2005 18:15:19 -0700 To: David Farber <dave(a)farber.net> Subject: Re: [IP] More on RFIDs in passports > Moss said that since the chip will only contain information > that is printed on the days page of the passport, it will not > matter, and that "if you wish to out your passport in the > microwave, you will still have a valid travel document that > we will recognize." Accroding to the Notice of Proposed Rulemaking: The proposed rule ... would include a damaged electronic chip as an additional basis for possible invalidation of a passport.... Under the proposed rule, a passport that contains a damaged, defective, or otherwise nonfunctioning electronic chip ... may be invalidated by the Department of State.... If the damage were caused deliberately, the passport would be invalidated upon discovery. The proposed regulation itself provides as follows: Sec. 51.6 --Damaged, mutilated or altered passport: Any passport which has been materially changed in physical appearance or composition, or contains a damaged, defective or otherwise nonfunctioning electronic chip, or which includes unauthorized changes, obliterations, entries or photographs, ... may be invalidated. I discuss this, and some of Moss's other statements, at: http://hasbrouck.org/blog/archives/000558.html -------------------- Edward Hasbrouck edward(a)hasbrouck.org http://hasbrouck.org +1-415-824-0214 "The Practical Nomad: How to Travel Around the World" (3rd edition, 2004) "The Practical Nomad Guide to the Online Travel Marketplace" http://www.practicalnomad.com ------ End of Forwarded Message ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: [IP] Google search and seizure, etc. vs. technologists
by Lauren Weinstein 05 Jul '18

05 Jul '18

>In the 1980s, the "average user" would never >need a local area network in his home. In the early 1990s, the >"average user" would never understand or need the Internet. And so on. In fact, the reality of the current security and privacy mess with the Internet helps to prove my point. For example, talk to the folks who drive around plotting all of the open wireless LANs that are literally everywhere in virtually every neighborhood. The vast majority of them have *no* security at all -- not even cruddy old WEP. This includes businesses, medical offices, you name it, as well as vast numbers of private homes. Yet, for years every WLAN product has included at the very least WEP capabilities, and instructions on how to set it up. Despite this, many people's open WLANs are constantly being abused, sometimes with tragic results. That situation is gradually starting to improve, but only because the setting up of *some* level of security has become part of the standard installation scripts for many products. But until this became the *default*, even when it was easy to use, most people didn't bother. Why? Most of the time, simply because they didn't believe that any associated risks applied to them -- and that view is easy to understand. The computer industry is great at promoting the vast benefits of their products, but do their best to keep the downsides to the fine print, buried in click-through license mumbo-jumbo that even many lawyers would have trouble understanding, along with lilliputian quick-start guides that are the only instructions many people read. The same thing goes for Internet services. It is utterly reasonable to expect that the *defaults* provided will respect people's privacy, security, and other rights. We are a society of laws and those laws are there (at least in theory) to help protect those rights. It is unfair in the extreme to suggest that anyone who doesn't jump through hoops to protect themselves from information abuse is somehow negligent, while asserting that legislative efforts should not be made to rein in the way that the services behave -- so that those services meet a reasonable standard that society agrees is appropriate. Yes, imposing society's will on such firms can be tough to do, especially when dealing with powerful and well-heeled interests. But not to do so -- to not even try -- is just surrendering to what most of us know in our hearts is just plain wrong. --Lauren-- Lauren Weinstein lauren(a)pfir.org or lauren(a)vortex.com or lauren(a)eepi.org Tel: +1 (818) 225-2800 http://www.pfir.org/lauren Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org Co-Founder, EEPI - Electronic Entertainment Policy Initiative - http://www.eepi.org Moderator, PRIVACY Forum - http://www.vortex.com Member, ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com DayThink: http://daythink.vortex.com - - - > > >Begin forwarded message: > >From: Phil Karn <karn(a)ka9q.net> >Date: December 3, 2005 7:10:30 PM EST >To: dave(a)farber.net >Cc: ip(a)v2.listbox.com >Subject: Re: [IP] Google search and seizure, etc. vs. technologists > > >>From: Lauren Weinstein <lauren(a)vortex.com> > >>1) Any practical attempt to "swamp" Google's database in such a >> manner is unlikely to succeed, given the sheer volume of legit >> queries that they receive. I suspect they'd be smart enough to >> detect abuse patterns fairly easily. That kind of analysis is >> their bread and butter. > >The idea is not to "swamp" Google. It's simply to create a little >plausible deniability -- i.e., reasonable doubt -- that a given >search was entered by the user and not by the automatic daemon. > >>2) Attempts to purposely "abuse" Google in such a manner (faked >> requests) may well violate their Terms of Service, and if they >> don't now you can be sure that they will in some future version >> of the ToS. The likely result will at a minimum be bans and ISP >> actions, and at the max lawsuits. Pull out your wallet. > >Again, "swamping" or "abusing" Google is not the intent, nor is it >very likely given Google's strong emphasis on performance and >scalability. The idea is simply to create doubt that a given query >was generated by a human, not by the robot. The "quality" of the >synthetic queries is much more important than their quantity. > >Still, the extra traffic just might have the effect of encouraging >Google to adopt a stronger privacy policy. Not that I'd place much >stock in that, of course (see below.) > >>3) Routing queries through anon proxies will provide some protection >> for the technological elite who understand such things. They will >> not protect the average user, who most likely doesn't understand >> the risks and issues, and will never use such proxies, even >> assuming that they were trivial to use. > >I wish I had a nickel for everything I've been told "the average >user" would never understand, need or be able to use. Back in the >1970s, the "average user" would never understand, need or be able to >use a personal computer. In the 1980s, the "average user" would never >need a local area network in his home. In the early 1990s, the >"average user" would never understand or need the Internet. And so on. > >It is no more necessary that the "average user" understand how an >anonymizing Google proxy works to use it effectively than to >understand the fields in TCP/IP packet headers. The whole idea of >civilization and commerce is that many people can benefit from >specialized knowledge and skills that they themselves lack. The open >source movement and the Internet itself have certainly demonstrated >this. > >Personally, I prefer the anonymizing proxy over the random query >generator. The proxy is likely to be more effective, and it generates >no extra load. I mention the generator mainly to be complete. My >point is that there *are* technical defenses against potential >privacy abuses, and we can implement them ourselves instead of >naively demanding that Google respect our privacy against their own >commercial interests. > >And even if Google were completely honest, they would still be >subject to Patriot Act abuses that we would never know about. > >The sad fact is that "national security" has become the root password >to the Constitution. The only effective defense against a "rooted" >system is not to put any sensitive information in it in the first >place. > >--Phil > > ------------------------------------- You are subscribed as BobIP(a)Bobf.Frankston.com To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting- people/ ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0