November 2013 - cypherpunks - lists.cpunks.org

Re: [Cryptography][Law] Jeremy Hammond Banned from using Cryptography
by John Young 16 Nov '13

16 Nov '13

Still, the USA's description of how its Cooperating Witness (presumably Hector Sabu Monsegur) allegedly induced Hammond to ply his fine mind and technical skills indicates that ban on the use of encryption is the least hazard facing hackers and confrontational comsec wizards: http://cryptome.org/2013/11/hammond-060.pdf Self-serving insiders of the comsec industry, black, white or gray, continue to be the Achilles heel of comsec. Government use of these trusted allies reminds that it is not only nations who fuck their friends. Now, this is not news, but also reminds that protestations of injustice, outrage and anger, is all too often a conventional cover for betrayal by cooperating witnesses. Unfortunately, the same goes for eager participants in payback, fault correction, workarounds, vengeance, product upgrades to defeat the bastards. These exact means and methods were allegedly used by Sabu to ensnare and imprison a batch of confederates. An ancient practice effectively used on Julian Assange: followers can be lethal. Encryption offers squat protection from this kind of legal, political and social engineering whose history is much older and more effective than top coding, math, engineering, ethics and brave challenges to authority. Usually, offer of an irresistable plea deal, job contract, witness protection, PR outpouring, turns a valiant outsider into a handsomely rewarded insider. Mudge one of hundreds, perhaps thousands, who got the warning message. Then what to avoid the looming scythes the various Sabus (he is surely not alone) have provided law enforcement to gradually take down the opposition, not all at once but in the Snowden-Greenwald manner, to slowly dribble prosecutions for maximum effect, promising "much, much more to come?"

1 0

re: passwords! (p7)
by brian carroll 16 Nov '13

16 Nov '13

// two other techniques not yet mentioned... consider the previous example once again: [pass]-[wo]-[r]-[ds] ---> [mo]-[sp]-[ssap]-[J] there could be multiple transformations (a->b->c) that could involve switching the sequence of the set, and other such ~operations, whether to the entire password in aggregate (as string) or inside the separate 'bit' sets, each potentially having overlapped or different changes due to symmetry with alphanumerics (hiox), usually the reference is to vertical, horizontal mirroring and rotation of 180 degrees, though this could also involve 90/270 degrees, such that a pass could filter the entire string for 90 degrees, as in the example below, or in other instance, only set 1, etc. [mo]-[sp]-[ssap]-[J] ---> [3o]-[иp]-[ииap]-[J] in this example, the letters 's' when rotated 90 degrees turn into the russian lowercase 'и' via substitution. likewise the letter 'm' turned into a '3' via its partial rotation. another rule for bit set transformation could involve the contraction and expansion of what is inside the set or the string en total... such that in the original example, the duplicates letters in a given set are dropped into a single letter... though this could then double the other letters within the set... [ssap] ---> [sap] ---> [saapp] therefore, a starting password string could in a given instance change from nine to ten characters... [mospssapJ] ---> [mospsaappJ] a different take on this same technique of expansion and contraction is more deconstructive, in that that the 'intra-sign' or 'infra-sign' structure itself could be tapped into as its own layer of character abstraction. consider once again the basic example already used... [pass]-[wo]-[r]-[ds] ---> [mo]-[sp]-[ssap]-[J] it is possible to modify what is within each bit set in a range of ways, this transformative process equivalent in some sense to calculus, relying on geometric ordering as it relates to typography though could extend further into linguistics (phonetics, meaning, grammar, syntax) variables. the focus of consideration is what could potentially happen to meaningfully transform a bit set or bit string and then use this as a framework or basis for a ruleset for such processing take the first bit set in the transformed version: [mo] it can be broken down or opened up via its correspondence with other structuring, so for example the issue of rotation is such that 3,w,E,m are variables for rotation while o is the same: [3o|wo|Eo|mo] so in that particular range of parameter, the superposition for the original letter 'm' is more varied than for the letter 'o' in the same set further though, the structure of the sign itself (at the intra-bit set level of measurement), that of a single letter, could also be the basis for such transformative rulesets that further expand or contract 'variables' in that through their "options" or optionality, provide various structures that may or may not be used in given bit set permutations at multiple levels of the letter sign, intra-bit set, inter-bit set, and bit set string [mo] again, consider the potential letter-based structuring that could be broken apart and merged/fused together to either expand or contract the given alphabetic and likewise other alphanumeric example... [mo] ---> [rno] ---> [rn()] the letter 'm' is fragmented into a letter 'r' and letter 'n' which combine back into the letter m via proximity or adjacency, and the letter 'o' can be abstracted into paired symmetric parentheses. what this also does is take the bit set and expand it from two letters to four characters the takeaway is that the length of a password could be variable given what rules are involved, such that a base password could expand and- or contract and itself be variable across many of its attributes, existing in a potential state or superposition, that is more the parameters of a Schrödinger scenario than a pattern-match in a dictionary context for any given [password] that could be a million potential permutations consider the following example of a bit string instance, again... [mospssapJ] just making one transformation could change it from pw1 to pw2, say using a 180 degree rotation first, then a repeated letter function that drops a letter and expands others in the set (in this case string)... mospssapJ ---> wosdssedr ---> wwoossddseeddrr notice the original password ~instance expanded from 9 characters to 15 characters and has actually changed 'variables' of the password, so that even if the original password is known, (and then: outdated), without knowing the rules, it would not be easy to establish pw2 due to potentially infinite variability, whatever the hidden rulesets may be another example going further into this transformation via expansion is to breakdown the sign-structures, again exampled at the bit string level. mospssapJ ---> rn()s|oss|oJ not much is occuring in this example, it expands from 9 to 12 characters. though to make it more elaborate, lets rotate the letters 's' ninety degrees... moиpииapJ ---> rn()VI|⁰VIVI|⁰J this instance transforms the 9 character pw1 into a 15 character pw2 and also introduces special characters that could be mapped to alphanumeric structures. and this could go anywhere, to pw3...pwᴺ for example, further mirroring, symmetry, rotation, duplication, substitution... rn()VI|⁰VIVI|⁰J ---> L⁰|IVIV⁰|IV()nr ....horizontal mirroring of the string, and its further 180 rotation.... L⁰|IVIV⁰|IV()nr ---> ju()^I|ₒ^I^I|ₒ7 another pass could again recombine letters, such as substituting a letter 'b' for '|ₒ', and turning each letter within the set 180 degrees, if it can be mapped into another character structure... ju()^I|ₒ^I^I|ₒ7 ---> rn()VIpVIVIpL so the idea here is that it is possible to move from pw1 to pwᴺ and have a running password that is a transmutation of some original or seed password that is itself autonomous, changing and variable across a range of parameters; in this way, the password could have involve aspects of superposition in its bounded local interactions as its variability is encountered mospssapJ ---> rn()VIpVIVIpL in other words, pw1 and pw2 and pwᴺ could be a continual process of transformation, and this variability could fill time, and expand and contract and change characters, languages, inter and intra-sign structures, and likewise could include other variables as mentioned (temperature, other relativistic variables- moon phase, number of sunspots, UV index, etc) thus, pw1 could be 15 characters in one moment, 38 the next, and potentially even strengthened if more than five attempts at access occur, dropping gates and walls and further parameters, or spawning a false basic password as entry into the labyrinth... x⁽ xⁿ x⁾

1 0

re: passwords! (p6)
by brian carroll 16 Nov '13

16 Nov '13

additional layers of transformation could also be included that use symmetries or other calculus-like transformations. consider the previous example... [1][2][3][4] ---> [2][4][1][3] now consider if within each subset additional characteristics could be modified, such that set 2 is mirrored by vertically by the letters that obey these principles... and set 1 has its letters in reverse... and sets 3 and 4 are rotated 180 degrees [pass]-[wo]-[r]-[ds] ---> [mo]-[sp]-[ssap]-[J] and that this could also be dynamic and change, for a given instantiation of the base password as it is mediated for login, as an ever-changing password with its own variability which could change daily given, say, a range of 30 such criteria that may or may not be accessible in various combinations then rulesets would be important, what if some letters can be transformed and others cannot, are substitutions chosen or are only some characters changed, or how to deal with a character with multiple options for superposition translation this kind of exponential potential for passwords in a context where the simple model is so simple to allow easy hacking, what if systems were designed to be significantly more difficult to access and that /time/ was leveraged to limit unauthorized access and to limit, via relativism, what can be seen in a given threshold or timeframe, to potentially make it impossible for automated attacks of logins via brute-force via zombie-nets, by making the odds more the opposite of what they are today, given access, enough time and dictionaries, versus limiting the exploitable window, limiting the time frame, and use of dictionaries via increased variability that is never static, and thus each login could tend more towards 1 in a million guess, by chance, and have that be the repeated situation encountered at login, versus allowing 10 million attempts to gain illegal access it just seems common sense that perhaps it is made to be broken and that without such introducing or allowing parameters of such increased difficulty, that perhaps it is the design of the ecosystem itself versus its merit in terms of 'actual security' versus what is allowable, thus making the password issue itself that of a false perspective, as if 8-12 alphanumerics w/special characters is maxing out possibilities when instead limiting the questions to those parameters may force another approach prematurely, which could be even worse, policy-wise 😺 😶 😈

1 0

re: passwords! (p5)
by brian carroll 16 Nov '13

16 Nov '13

// incompleteness of completeness, additional oddity... if considering [password] as a bit-set instead of linear string, such that [p|a|s|s|w|o|r|d] could itself be variable, per bit, ex. [pass|word|1234|bluegreen] then, if a password service used this principle, instead of requiring just 8-12 alphanumerics plus allowed special characters as the basis for /security/, instead what if it was 3-4 sets instead, themselves having special rules... [set1|set2|set3|set4] in this way, a 'rolling password' could be developed in that the sequence could be arbitrary or change, given the instance or interaction, which may or may not include changing variables (months till b-day, temperature in zipcode, etc) in other words: [password] ---> [pass][wo][r][ds] whereby, via its continual dynamic state, could exist in multiple versions by default, and then have this managed between client/server [1][2][3][4] ---> [2][4][1][3] [pass]-[wo]-[r]-[ds] ---> [wo]-[ds]-[pass]-[r] this could extend into sequences of not only alphanumerics through also icons (picked amongst many on the server, thus creating more unknowns), say choose 1 of available 20 icons, which is not included in stored password, nor its place in sequence knowable to attacker... [pass][icon13][wo][r][ds] ---> [icon13][wo][ds][pass][r] thus a changing string made up of subsets rearranged that may even have non-stored variables [#], icons or other approach [3b]-[alphanum1a]-[5e]-[32^F]-[4d]-[icon]-[2c] [2c]-[3b]-[alphanum1a]-[4d]-[icon]-[67^F]-[5e] then the probabilities and computation is upped exponentially even if accessing some part of the correct code, which may not be reliably reused, seemingly the more subsets, more security from an initial attack-- thus even if one instance of passwords were found, they could be changed or even transformed into another set and detach from those lost, locking out else deactivating the previous versions. a lot could seemingly be done with this though a secure environment would be required which seems difficult to guarantee if not allow for sake of someone elses interests, known & unknown 𝓶 𝟡 𝑤

1 0

[tor-talk] USB Sticks for TAILS
by Moritz Bartl 15 Nov '13

15 Nov '13

Hi, I know there is a dedicated mailinglist for TAILS, but I figured I would reach a larger audience here, and it might be of interest to many who are not subscribed to the TAILS list. Ideally, you use TAILS from a read-only medium. CD is best, but many devices these days don't have an optical drive, and handling CDs is not as convenient as a USB stick. For quite some time, people kept recommending the TrekStor CS USB stick [ https://geizhals.de/trekstor-cs-8gb-50324-a240853.html ], one of the few sticks available in Germany with write-protection switch. Turns out they use a new firmware, and now don't support booting from it in read-only mode. The company confirmed this via email. There are roughly no alternatives, and I figured I'm not the only one looking for USB sticks with write protection switch. Via alibaba.com, a "wholesale Chinese ebay", I contacted various Chinese suppliers, and ended up ordering two samples. Even there, the selection of sticks with write protection is very limited. I ended up paying paying 60€ for the 2 samples because of shipping and Western Union fees. The sticks are not very fast, but acceptable, and boot in read-only mode. They are not as slim as I hoped for, but the supplier is friendly, production and shipping was very fast. (less than 2 weeks altogether). Logo printing is cheap ($0.15 per stick), so to try the quality I also had them print a logo on the samples. I am still undecided whether I want the final sticks to have a logo, or simply be blank to not attract too much attention. If you have a nice idea for a logo, let me know. I want to order 100 sticks in time for Chaos Communication Congress 30C3. The production cost is $4 per stick (8GB), the final price (taxes, GEMA, shipping) will likely be around $15. Pictures: http://share.pho.to/48Egt # dmesg [55679.884123] usb 2-1.2: new high-speed USB device number 5 using ehci_hcd [55680.051089] usb 2-1.2: New USB device found, idVendor=058f, idProduct=6387 [55680.051092] usb 2-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [55680.051094] usb 2-1.2: Product: Mass Storage [55680.051095] usb 2-1.2: Manufacturer: Generic [55680.051096] usb 2-1.2: SerialNumber: B6BA8F3F [55680.051459] scsi9 : usb-storage 2-1.2:1.0 [55681.051827] scsi 9:0:0:0: Direct-Access Generic Flash Disk 8.07 PQ: 0 ANSI: 4 [55681.053860] sd 9:0:0:0: Attached scsi generic sg1 type 0 [55681.055544] sd 9:0:0:0: [sdb] 15937536 512-byte logical blocks: (8.16 GB/7.59 GiB) [55681.056665] sd 9:0:0:0: [sdb] Write Protect is off [55681.056676] sd 9:0:0:0: [sdb] Mode Sense: 23 00 00 00 [55681.057742] sd 9:0:0:0: [sdb] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA [55681.176618] sdb: sdb1 [55681.179808] sd 9:0:0:0: [sdb] Attached SCSI removable disk # hdparm -t /dev/sdb /dev/sdb: Timing buffered disk reads: 54 MB in 3.07 seconds = 17.60 MB/sec # dd if=tails-i386-0.21.iso of=/dev/sdb bs=1M 891+1 records in 891+1 records out 934471680 bytes (934 MB) copied, 170.058 s, 5.5 MB/s -- Moritz Bartl https://www.torservers.net/ -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

1 0

Re: [tor-talk] BitMail.sf.net v 0.6 - Secure Encrypting Email Client
by Ulex Europae 15 Nov '13

15 Nov '13

At 09:04 PM 11/13/2013, grarpamp wrote: >On Tue, Nov 5, 2013 at 2:38 AM, <rwest(a)countermail.com> wrote: > > Hello, > > > > can BitMail.sf.net as a p2p email tool for encrypted Email (and > hybrid with IMAP-Email) be regarded as a reference model for > research to create a secure Email Client? as it uses both, gnupg and openssl! > > > > http://bitmail.sourceforge.net/ > > https://sourceforge.net/projects/bitmail/files/BitMail_0.6_2088RC1/ > > > > Does anyone know, if it runs over Tor? > > > > Sincerely, Robert > >So... 'Robert', who do you work for? NSA? Financial crime? >I mean, with the net moving to encrypt everything >we'd expect to see many new and unknown yet seemingly >polished tools being dropped on unsuspecting first time >users just to collect their key material. >Surely someone will have fun with your windows binaries. Hmm, lots of lists I'm not subscribed to on the To: line, bad juju on someone's part for the initial crosspost. Hopefully, those other list maintainers will see and approve my comment, even though I'm not subscribed to all those other lists: I'm replying because, Sourceforge? They fell out of vogue when they started bundling binary downloads with other executables, they deserve to die a quick death for that as users flock to safer environs. 'Robert' should upload his binaries to Github. Along with his source code. Then, if the MD5 checksum on his compiled binaries matches the MD5 checksum on the source code when it is compiled independently, he's golden. That is how that works, how it is supposed to work. Accept no substitutes. --

1 0

<nettime> Google wins book-scanning case: judge finds “fair use,” cites many benefits
by Felix Stalder 14 Nov '13

14 Nov '13

[I'm somewhat conflicted about this. While I'm generally glad to see fair use expanded, I think the judge misunderstood Google's business model when citing in favor of favor of that Google "does not sell the scans" as evidence of its benign character. They clearly wouldn't do it if they were not convinced that making these books searchable is adding to their bottom-line by refining user profiles. Felix] http://gigaom.com/2013/11/14/google-wins-book-scanning-case-judge-finds-fai… Google wins book-scanning case: judge finds “fair use,” cites many benefits By Jeff John Roberts The long-running copyright fight between Google and the Authors Guild is over: Judge Denny Chin issued a resounding ruling in favor of fair use. tweet this Google has won a resounding victory in its eight-year copyright battle with the Authors Guild over the search giant’s controversial decision to scan more than 20 million books from libraries and make them available on the internet. In a ruling (embedded below) issued Thursday morning in New York, US Circuit Judge Denny Chin said the book scanning amounted to fair use because it was “highly transformative” and because it didn’t harm the market for the original work. “Google Books provides significant public benefits,” Chin wrote, describing it as “an essential research tool” and noting that the scanning service has expanded literary access for the blind and helped preserve the text of old books from physical decay. Chin also rejected the theory that Google was depriving authors of income, noting that the company does not sell the scans or make whole copies of books available. He concluded, instead, that Google Books served to help readers discover new books and amounted to “new income from authors.” The ruling is being hailed on Twitter by librarians and scholars, who intervened in the case to urge the court to declare that Google Books was fair use — a four-part test that seeks to balance the rights of authors against broader interests of society. “This has been a long road and we are absolutely delighted with today’s judgement. As we have long said Google Books is in compliance with copyright law and acts like a card catalog for the digital age – giving users the ability to find books to buy or borrow,” Google said in an emailed statement. Author’s Guild Executive Director Paul Aiken said by email that the group would appeal the decision. He added: “We disagree with and are disappointed by the court’s decision today. This case presents a fundamental challenge to copyright that merits review by a higher court. Google made unauthorized digital editions of nearly all of the world’s valuable copyright-protected literature and profits from displaying those works. In our view, such mass digitization and exploitation far exceeds the bounds of the fair use defense.” The decision itself comes as a volte-face for Judge Chin, who expressed major skepticism about the project in a highly-publicized 2010 ruling that blew up a three-part deal between Google, publishers and the Authors Guild that would have created a market for the scanned books. Chin also agreed last year to allow the cases to proceed as a class action — but the U.S. Second Circuit Court of Appeals reversed that decision and ordered Chin to instead rule on the fair use question. Thursday’s ruling is effectively an acknowledgment by Chin that the higher court (on which he now sits) wanted him to find fair use. The ruling is unlikely to sit well with some authors, including Scott Turow, who have decried Google’s scanning as an indignity and a money grab. The latter idea — that Google is profiting off the books at the expense of authors — has been a rallying cry for opponents of the book scanning. Chin’s ruling, however, takes care to reject the notion in detail, and states that Google “does not engage in the direct commercialization of copyrighted works.” <...> Chin’s ruling is also likely to be decisive in a companion case between the Authors Guild and the HathiTrust, a group of university libraries that have created a shared corpus of digital books for scholars and students. The HathiTrust case is on appeal, but the group’s victory at the lower court stage may have paved the way for today’s decision: The HathiTrust case really clinched this. "If there is no liability… on the libraries' part, there can be no liability on Google's part."— Tim Carmody (@tcarmody) November 14, 2013 The ruling is below with key portions underlined. For more perspective, see Mathew Ingram’s “Whatever you think of Google, the book-scanning decision is the right one.” (For more background, see my ebook The Battle for the Books: Inside Google’s Gambit to Create the World’s Biggest Library.) -- ||||||||||||||||||||||||||||||||| http://felix.openflows.com |OPEN PGP: 056C E7D3 9B25 CAE1 336D 6D2F 0BBB 5B95 0C9F F2AC # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org

1 0

superconductivity (urls)
by brian carroll 14 Nov '13

14 Nov '13

// what about indoor light pollution from little LEDs on various equipment // that create an ambient glow everywhere. dark skies initiative for indoors! Computers and phones in children's bedrooms 'can cause anxiety and sleep loss' (via drudgereport) http://www.telegraph.co.uk/education/educationnews/10448123/Computers-and-p… "The paper’s lead author, psychologist Dr Jennifer Vriend, of Dalhousie University in Canada, said: “One of the biggest culprits for inadequate and disturbed sleep is technology. " Dark-sky movement http://en.wikipedia.org/wiki/Dark-sky_movement // presumably like dams, wave power could also have ecosystem // consequences for marine life, likewise underwater comms, sonar // as potentially related to mass beachings of whales, dolphins, etc. Solar Panels Frying Birds Along Major Migration Path (via drudge) http://www.breitbart.com/Big-Government/2013/11/12/Oops-Solar-Energy-Plants… [Birds dying in two ways... crashing into mirage-like 'areas of water' and having feathers torched via reflected sunlight] Accidental discovery dramatically improves electrical conductivity http://phys.org/news/2013-11-accidental-discovery-electrical.html "Quite by accident, Washington State University researchers have achieved a 400-fold increase in the electrical conductivity of a crystal simply by exposing it to light. The effect, which lasted for days after the light was turned off, could dramatically improve the performance of devices like computer chips." ... re: holographic memory, data storage inside crystal vs. on surface [&] Electrons with a "split personality" // anisotropy, metal, & lifetimes http://phys.org/news/2013-11-electrons-personality.html "Conventional or unconventional – depending on momentum" " Up until now, the interaction of the electrons has generally been assumed to be isotropic. " "In terms of electrons, resistivity corresponds to the mean free path of the electrons, i.e. the distance an average electron covers before bumping into something – the shorter the mean free path, the higher the resistivity. Generally, the higher the temperature the higher the resistivity because the particles the electrons can collide with are moving faster at higher temperatures which makes collisions more likely." {what is metal} // amateur astronomy is in need of a massive technological upgrade, // this tied to light pollution, environmental & urban planning issues. How a Superconducting Camera Could Revolutionize Astrophysics http://gizmodo.com/how-a-superconducting-camera-could-revolutionize-astrop-… film --> semiconductors --> hyperspectral superconductors "Mazin's imaging device... dubbed the ARray Camera for Optical to Near-infrared (IR) Spectrophotometry (ARCONS), sees all of the wavelengths all of the times. It is literally the first imaging device to ever actually see in color. It is also the first imaging device to utilize Microwave Kinetic Inductance Detectors (MKIDs), a superconducting photon detector used to measure energy across the electromagnetic spectrum." [also waiting for this tech in consumer digital & video cameras, going beyond visual parameters, using IR and UV imaging vs. stylized filters- why not multispectral wavelength options. hell, what if there was an 'electromagnetic signals' setting, to visualize EM signaling in space as if kirlian photography] Evelyn Glennie: How to truly listen (video) http://www.ted.com/talks/evelyn_glennie_shows_how_to_listen.html description: In this soaring demonstration, deaf percussionist Evelyn Glennie illustrates how listening to music involves much more than simply letting sound waves hit your eardrums. "... Allow your body is open up, to allow your body to be this resonating chamber..." "... please take note of the life of the sound after the initial strike..." [bio] Evelyn Glennie http://en.wikipedia.org/wiki/Evelyn_Glennie // in approaching music independently i enjoyed this documentary a lot. // her approach is unique, educational, instructive, and inspirational... // about tuning into events, learning to ~listen with all the senses Touch the Sound documentary http://www.touch-the-sound.com/ Battle Cry -- from the album: Shadow Behind The Iron Sun https://myspace.com/variousartists-45950709/music/song/battle-cry-28420027-… // if only geometry could be taught through these techniques, // including origami tesslations, platonic solids, into music... The Handheld Mathematics of Geometer Ron Resch (video) http://gizmodo.com/the-handheld-mathematics-of-geometer-ron-resch-1463859152 "testing out posed solutions..." [bio] http://en.wikipedia.org/wiki/Ron_Resch note: the expandable structures seem ideal both for satellite or spacecraft and also lunar habits or robotic missions, such as a small format expandable base camp tent, etc. likewise, emergency tents or shelters, perhaps even windtunnel testing of the dome to consider if anchored structures could short-circuit hurricane winds via acting more like ground vs walls; for instance, with certain hi-tech fabrics perhaps flexibility and deformity is a strength. also, potential antennas, collapsible or not, or even portable radio telescope/telemetry arrays. how to fix any computer - The Oatmeal http://theoatmeal.com/blog/fix_computer ∰ ≉ ⊊

1 0

[IP] My blog today on "Permissionless Innovation"
by Eugen Leitl 14 Nov '13

14 Nov '13

----- Forwarded message from Dave Farber <dave(a)farber.net> ----- Date: Thu, 14 Nov 2013 11:28:48 -0500 From: Dave Farber <dave(a)farber.net> To: ip <ip(a)listbox.com> Subject: [IP] My blog today on "Permissionless Innovation" Message-ID: <CAKx4triMv4zeA6mV_POaLfyosZk_1qumW7m+=1Fw37zVs9mC_A(a)mail.gmail.com> Reply-To: dave(a)farber.net ---------- Forwarded message ---------- From: *Young, David E* Date: Thursday, November 14, 2013 Subject: My blog today on "Permissionless Innovation" To: "Dave Farber (dave(a)farber.net)" <dave(a)farber.net> Dave, Perhaps of interest… http://publicpolicy.verizon.com/blog/entry/permissionless-innovation-on-the… Permissionless Innovation On the Internet *David Young <http://publicpolicy.verizon.com/experts/david-young>* Nov 14 | David Young <http://publicpolicy.verizon.com/experts/david-young> In a story posted yesterday – A Remedy to Clueless Tech Lawyers<http://venturebeat.com/2013/11/13/a-remedy-to-clueless-tech-lawyers/>– my old friend Jonathan Askin describes some work he did as a young lawyer for another good friend of mine, tech innovator Jeff Pulver<https://twitter.com/jeffpulver>. In the mid-90s, Jeff was trying to create a peer-to-peer communications service called Free World Dial-Up (FWD)<https://en.wikipedia.org/wiki/Free_World_Dialup> . Jonathan beats himself up in his essay because, as Jeff’s lawyer (or “wartime consigliere <http://www.fundraisers.com/ideas/charitypoker.html>” as he called himself), he “put the reins on FWD” and advised Jeff to ask the FCC for permission “to launch FWD free of regulatory constraints.” Jonathan rightly understood that the FCC could decide to regulate FWD as a *telephone service*, and sought to protect his client from that risk. “Permissionless Innovation<http://techliberation.com/2013/03/04/who-really-believes-in-permissionless-…>” may be one of the key features of the Internet, but as Jonathan rightly understood, regulated companies and service providers too often have to ask permission from their regulators before innovating, or else face potential consequences. After more than a year, the FCC agreed that FWD was an “information service” not subject to common carrier telephone regulation. Unfortunately for Jeff Pulver, the many months it took to get permission from the FCC allowed a non-US company <http://en.wikipedia.org/wiki/Skype> to innovate freely and capture the market opportunity. In 2013, you may not have ever heard of Free World Dial-Up, but you’ve certainly heard of Skype. In retrospect, perhaps Jonathan would have advised his client to “just do it,” as the delay waiting for permission was indeed a very bad thing for FWD. However, the eventual FCC decision – the “Pulver Order<http://hraunfoss.fcc.gov/edocs_public/attachmatch/FCC-04-27A1.pdf/>” - was a critically important precedent. Jeff’s sacrifice helped pave the way for innovators everywhere to offer new services in the US (and we owe him our heartfelt thanks!). As a young phone company engineer trying to get into broadband and VOIP in the 90s, I experienced firsthand the problem of needing regulatory permission to try new, innovative things that don’t fit into the existing regulatory buckets. That is why decisions like the Pulver Order that protect some new services like FWD from common carrier regulation, the “Vonage Order <http://www.techlawjournal.com/topstories/2004/20041109.asp>” protecting VoIP services from state telephone regulators, the FCC actions protecting cable modem broadband service from regulation by 30,000 local franchise authorities <http://www.techlawjournal.com/telecom/19990616.htm>, and the FCC orders confirming that traditional common carriage regulation doesn’t apply to broadband<http://www.techlawjournal.com/topstories/2005/20050805a.asp>services, were so important to enabling innovation without the regulatory overhang that early innovators like Pulver and Askin faced. Permissionless innovation shouldn’t be reserved for just certain types of innovators (like software developers) and not others. Given the dynamism, innovation and competition that are the hallmarks of today’s Internet ecosystem, the ability to innovate without having to seek permission from regulators at every step along the way is critical to the continued success of the Internet, and must be preserved. ------------------------------------------- Archives: https://www.listbox.com/member/archive/247/=now RSS Feed: https://www.listbox.com/member/archive/rss/247/25094221-ddf8422b Powered by Listbox: http://www.listbox.com ----- End forwarded message -----

1 0

(Times of Israel) Stuxnet, gone rogue, hit Russian nuke plant, space station (fwd)
by Tomasz Rola 14 Nov '13

14 Nov '13

Hi, I guess this is news? They say it happened few years ago, but I see it being reported right now. Regards, Tomasz Rola -- ** A C programmer asked whether computer had Buddha's nature. ** ** As the answer, master did "rm -rif" on the programmer's home ** ** directory. And then the C programmer became enlightened... ** ** ** ** Tomasz Rola mailto:tomasz_rola@bigfoot.com ** ---------- Forwarded message ---------- Date: Tue, 12 Nov 2013 20:30:11 +0100 (CET) From: Tomasz Rola <rtomek(a)ceti.pl> To: <info(a)postbiota.org>, Transhuman Tech <tt(a)postbiota.org> Cc: Tomasz Rola <rtomek(a)ceti.pl> Subject: (Times of Israel) Stuxnet, gone rogue, hit Russian nuke plant, space station [ http://www.timesofisrael.com/stuxnet-gone-rogue-hit-russian-nuke-plant-spac… ] (... links deleted all the way down ...) * Tuesday, November 12, 2013 * Kislev 9, 5774 * 12:43 am IST * Site updated 2 minutes ago Stuxnet, gone rogue, hit Russian nuke plant, space station A cyber-security expert says several ostensibly secure facilities became victims of the virus that struck Iran's nuclear program By [30]David Shamah November 11, 2013, 4:21 pm [36]Eugene Kaspersky (Photo credit: Courtesy Tel Aviv University) Eugene Kaspersky (Photo credit: Courtesy Tel Aviv University) A Russian nuclear power plant was reportedly "badly infected" by the rogue Stuxnet virus, the same malware that reportedly disrupted Iran's nuclear program several years ago. The virus then spread to the International Space Station via a Stuxnet-infected USB stick transported by Russian cosmonauts. Speaking to journalists in Canberra, Australia, last week, Eugene Kaspersky, head of the anti-virus and cyber protection firm that bears his name, said he had been tipped off about the damage by a friend who works at the Russian plant. Kaspersky did not say when the attacks took place, but implied that they occurred around the same time the Iranian infection was reported. He also did not comment on the impact of the infections on either the nuclear plant or the space station, but did say that the latter facility had been attacked several times. The revelation came during a question-and-answer period after a presentation on cyber-security. The point, Kaspersky told reporters at Australia's National Press Club last week, was that not being connected to the Internet -- the public web cannot be accessed at either the nuclear plant or on the ISS -- is a guarantee that systems will remain safe. The identity of the entity that released Stuxnet into the "wild" is still unknown (although media speculation insists it was developed by Israel and the United States), but those who think they can control a released virus are mistaken, Kaspersky warned. "What goes around comes around," Kaspersky said. "Everything you do will boomerang." The Stuxnet virus came to light in 2010, having attacked Iranian nuclear facilities by hitting the programmable logic control automation systems that control them. The PLC system, manufactured by German conglomerate Siemens, runs the centrifuges used to enrich uranium at Iran's Natanz facility. Variants of Stuxnet have affected the facility's centrifuges in various ways, mostly by changing the activity of valves controlled by the PLC software that feed the uranium to centrifuges at a specific rate required for enrichment, Kaspersky said in several presentations last year. It's not known when Stuxnet began its activities, but researchers at anti-virus company Symantec said that they had gathered evidence that earlier versions of the code were already seen "in the wild" in 2005, although it wasn't yet operational as a virus. Stuxnet, said Symantec, was the first virus known to attack national infrastructure projects, and according to the company, the groups behind Stuxnet were already seeking to compromise Iran's nuclear program in 2007 -- the year Iran's Natanz nuclear facility, where much of the country's uranium enrichment is taking place, went online. Now that the plague has been unleashed, said Kaspersky, no one is immune -- and that includes its originators, who are no longer in control of it. "There are no borders" in cyberspace, and no one should be surprised at any reports of a virus attack, no matter how ostensibly secure the facility, he said. (... links deleted ...) Š 2013 The Times of Israel, All rights reserved. Concept, design & development by [188]RGB Media Powered by [189]Salamandra Quantcast References (... all deleted, ouch ...)

6 8

re: passwords
by Joseph Tag 14 Nov '13

14 Nov '13

I prefer old liscencd plates; maybe repeated. I.e.: ZIGZAG9NYzigzag9ny . Also zip codes: zip02134ma . -- Sent from Gmail Mobile

2 1

Re: expanded security model (was passwords! (p2) deux)
by brian carroll 14 Nov '13

14 Nov '13

attempt to clarify an overlapping conceptualization........ (pseudo-truth 2 (truth N)) <===> ((pT 2) truth N) [pT <---> T] [pT <---> T] ...these are the more accurate dynamics, though even moreso: (pseudo-truth 2 (truth N)) <===> ((pT 2) truth N) [pT.binary <---> t.N) [pT.binary <---> t.N) skipped a step in the diagram above, meant to correlate how pT & binarism are symbiotic and often correlate with ideology and 'closed' rationalizations, though the original approach referenced 'machine 2' that suddenly morphed into representing a 2-value or binary relation, viz. symmetry with machine N. (such frameworks probably need to be broken down into 2 or 3x more detail to actually get into the mechanisms, so these are only abstract sketches, though could be further described as structures or 'additional variables'...) though the appearance may indicate otherwise, from a biased perspective. > truth would be moving throughout this system, and the emulation of it > {its *mimicking* via pseudo-truth} would likewise be transferred, yet > only one version is accurate at the level of verification as truth, > while the other validates and relies upon its [signage] instead. > this is the fundamental issue of patterns and their connection > with truth, in a security context, as related to "information" > and quasi-entropy, entropy-as-sign and entropy-as-truth. (note: wrote mask for some reason above, i think that was inadvertent bullshit because it makes no sense, stills do not have the words to describe what is going on, abstraction level too high, too confusing the overlapping frameworks of multiple meaning, though wanted to to attempt to make a correction via the diagram that follows..) forgot to diagram the 'information' transfer via the exchange, as the differing models migrate toward their associated models. in this way... (pT 2 (truth N)) <=:=> ((pT 2) truth N) : pT <--------:-------- [pT = pT] : [T = T] --------:--------> T : such that: (pT 2 (truth N)) <=:=> ((pT 2) truth N) : [pT = pT] : [T = T] : -ungrounded- -grounded- relation relation also of potential relevance with regard to information as it relates to entropy, is the proposition that 'truth' precedes falsity and establishes the means to evaluate it. this is something i have concluded after years of thinking about the dynamics though have not formalized it as of yet though it just seems self-evident, especially in terms of the cosmos, everything relates in truth, and the variance within that structure (mutations, anomalies, errors) that is already established in a foundation built within and upon shared truth as framework- literally, ~continuum as truth relates to circuitry, informational scaffolding. this easily gets into Sartre or Heidegger metaphysics, of being and non-being (then related to nothing), as it also involves truth and not-truth in relation to falsity, though this is likewise ambiguous, with /unknowns/ and other fundamental concepts like partial-truth, pseudo-truth (one in the same, in some cases, depending upon if it is distinguished and-or purified as truth, removed of error or structurally reliant upon it for a given view or relation). snooker, eight ball, trickshot

1 0

Re: [tor-talk] BitMail.sf.net v 0.6 - Secure Encrypting Email Client
by grarpamp 14 Nov '13

14 Nov '13

On Tue, Nov 5, 2013 at 2:38 AM, <rwest(a)countermail.com> wrote: > Hello, > > can BitMail.sf.net as a p2p email tool for encrypted Email (and hybrid with IMAP-Email) be regarded as a reference model for research to create a secure Email Client? as it uses both, gnupg and openssl! > > http://bitmail.sourceforge.net/ > https://sourceforge.net/projects/bitmail/files/BitMail_0.6_2088RC1/ > > Does anyone know, if it runs over Tor? > > Sincerely, Robert So... 'Robert', who do you work for? NSA? Financial crime? I mean, with the net moving to encrypt everything we'd expect to see many new and unknown yet seemingly polished tools being dropped on unsuspecting first time users just to collect their key material. Surely someone will have fun with your windows binaries.

1 0

Re: Brazil and Germany issue joint UN resolution on Digital Privacy
by John Young 14 Nov '13

14 Nov '13

Yes: http://cryptome.org/2013/11/br-de-dig-priv.pdf

1 0

Brazil and Germany issue joint UN resolution on Digital Privacy
by Griffin Boyce 14 Nov '13

14 Nov '13

In it, they state that they are "deeply concerned" at human rights violations resulting from digital surveillance and the overall trend away from privacy. It's a great read, and I *highly* recommend sharing it with your friends. http://daccess-dds-ny.un.org/doc/UNDOC/GEN/N13/544/07/PDF/N1354407.pdf best, Griffin (please excuse double post, if any) -- Be kind, for everyone you meet is fighting a hard battle. PGP: 0xD9D4CADEE3B67E7AB2C05717E331FD29AE792C97 OTR: saint(a)jabber.ccc.de

4 5

expanded security model (was passwords! (p2) deux)
by brian carroll 13 Nov '13

13 Nov '13

i need to clarify a point that opens up the interpretation of entropy into a realm of information involving people and technology and nature, because in the modeling i am referencing all information must ground to truth in order to be verified or validated as true, and that nature and technology and people who exist 'in truth' are in this way grounded within it, whereas those who are short-circuiting are partly or partially grounded, as this relates to patterns, exchange, and exploits. the realm of concepts, communication, and ideas also are involved as if a mental-dimension for the physicality of information, and to not include this in a security model seems falsely limiting if not allowing or relying upon a state of distortion, to begin with. thus the overall goal here is to account for truth as a basis for entropy in a security context or empirical evaluation... [machine N] patterns <===> patterns [machine 2] previously the above relation was established between two machines that interact and 'exchange' information, in some dimension, knowingly or unknowingly (as if consciously and subconsciously even). (machine N) ===> (machine 2 (machine N)) and if one of these machines *investigates or interrogates* the other, and somehow gains access, it could be thought that in the successful matching of patterns that what it has achieved _validates its model of relation, by default, even if only in a partially grounded framework. thus to distinguish the _belief of how this structural relation is occurring, with its actuality, the actual condition of this relation in terms of its truth. in other words the relation between 'machine 2' and 'machine N' that is achieved as a relation, via the matching of patterns, could be believed to validate the truth of the worldview of machine N, though the pattern match could instead be pT=pT, due to inaccurate modeling or framework. and thus a false perspective could be the relation, yet validate a perception of things, as if accurate, while not grounded in the larger reality. likewise, what can occur is a two-way relation whereby this inaccuracy is accounted for by the entity interacted with, perceived 'known' via such faulty pattern matching, and thus provide or leak information from itself that is in a context of truth, though the tells as if subconscious or unconscious, resulting from a TSCM-like scanning of relational frameworks, that is if 'machine 2' is functioning within grounded truth. (machine N (machine 2)) <=== ((machine N) machine 2') in this way the real exploit is not occurring through granting or gaining access to validate further _inaccurate pattern matching by 'machine N', it is that this entity is leaking unknown information as part of this balancing process, about its hidden state that is insecure due to its not being based in truth, and thus distortion, bias, warping, and skew reveal frameworks and structuring, allowing perspectives to be traced back to originating beliefs and equations within the pseudo-, where a running cosmological constant occurs to make everything onesidedly correct. and in this way, the relation on the left side is in a context of truth, via the errors betraying 'machine N' via its reliance on pseudo-truth and falsity, and the condition on the right side is a false perspective of a relation that establishes and verifies inaccurate pattern matches, false positives, due to a protected limited onesided evaluation *confirming* true belief which is itself not grounded beyond its partialty. (machine N (machine 2)) <===> ((machine N) machine 2') [truth <-----> truth] [pT <-----> pT] in this way, the advantage is with 'machine 2' (that may actually have more patterns or n-dimensionality) yet this imbalance may not be revealed or accounted for, and thus the balancing could appear onesided, as if from oneside data is being extracted while the other remains protected and static behind a given boundary, versus betraying its secrets unintentionally, via this structural, informatic relation (matter/energy) in other words (more complexity..) there could be more going on than believed, in this basic relation, and /appearances/ may not accurately match the reality, and yet this can also be accounted for, in truth, or become a threshold condition enabling camouflage... in this way the roles may be reversed yet not accounted for by the naive, ungrounded, mistaken, or inaccurate 'true believer' observers... such that machine 2 could actually in its truth be 'N' and likewise, 'machine N' in its unchecked falsity could be binary... (machine 2 (machine N)) <===> ((machine 2) machine N') [truth <-----> truth] [pT <-----> pT] in this way, the 'real machine N' could be granted access to unrestricted pattern matching in a subconscious or unaccounted for realm of the ' 'real machine 2', though this condition could begin by the 'real machine 2' trying to continuously exploit 'the realm Machine N' and in this way, the false perspective of the latter (N->2'), allowing the *belief* that the binary view is actually N-potential in its accuracy and scope even while this is ungrounded beyond its own skewed, relativist accounting. thus patterns are verified in pseudo-truth, and in allowing this relation, also enables the inaccuracies to leak about its actual state to align with the greater patterning of the 'real machine N', via automatic grounding or snap-to-fit correlations that occur in their accuracy, vetted and error-corrected, though in parameters unshared by the differing worldviews keeping it abstract, this is the same scenario for 'smartness' versus intelligence... (smartness N (intel 2)) <===> ((smartness N) intel 2') [truth <-----> truth] [pT <-----> pT] when instead the situation in terms of equilibrium, entropy, and exploit tends toward... (smartness 2 (intel N)) <===> ((smartness 2) intel N') [truth <-----> truth] [pT <-----> pT] and as mentioned many times before, any given concept has its validity established within truth, whether the concept of [entropy] or [information] or smartness, intelligence, or whatever. and so just taking it at face (sign) value, does not make that interpretation true simply because it is *believed* to be true. and yet that rigor can be missing in the evaluation process, often a kind of self-corruption accompanying the ungrounded observation and especially true believers who operate within a protected boundary, 'managing' outside influences, and yet in this very interaction, per entropy, they reveal their own state beyond their own accounting for it and control over it, via energy and other relations. [pseudo-truth 2] patterns <===> patterns [truth N] getting to the essence of the structural situation, of relativism versus the empirical accounting for truth, shared and unshared, grounded and ungrounded, and involving both accurate and inaccurate pattern matching and if it is corrected or relied upon in its error, the above model in an context of entropic two-way exchange... (a balancing of the forces if you will...) though through a false perspective, this basic relation could be reversed via tromp-l'oiel effects, such that a masked condition exists and the structural relation is asymmetrical and of masquerade... [pseudo-truth N] patterns <===> patterns [truth 2'] whereby: (pseudo-truth N) ===> ((pseudo-truth N) truth 2') though in this structural imbalance, via the ungrounded condition, it is an unintentional two-way interaction that through this opening allows unintended access to the protected perimeter via this basic exchange... (pseudo-truth N (truth 2)) <=== ((pT N) truth 2') ...in other words, the *appearance* may exist one of a one-way hierarchical exchange where information is being extracted from oneside via an attack or interrogation or biased relation... where pseudo-truth "knows" the state of 'machine 2' from its island viewpoint of relativistic truth... (pseudo-truth N) ===> ((pT N) truth 2') [truth <-----> truth] ...and yet this viewpoint or belief can be _ungrounded, the perception of truth illusory, inaccurate, even while achieving a pattern match verifying and validating its inaccurate, corrupted model of truth. in addition, via transference, the reverse occurs, whereby the observer is theirself effected by the observation and thus 'observed' in the entropic exchange, via structural information that aligns with or is at odds with the given modeling and its parameters of existence, that leak data that compares or contrasts with unknowns and vetted truth and thus can establish and correlate with this truth even while restricted or protected externally, believed inaccessible (even invisible people in other dimensionality betray themselves this way, via allegiance with or hostility to higher truth) (pseudo-truth N) ===> ((pT N) truth 2') "true!" [pT <-----> pT] so what is proposed to occur is that in this biased situation, ungrounded belief can be confirmed and match a pattern (A=A -> B=B) whereby it can verify or validate limitless notions (pseudo-N equivalent) yet that is not accurate or actually true, yet uncorrected and due to protected boundary, allowed to be 'real' within given constraints- for lack of feedback that would challenge the belief system, else to censor or have deception going on that promotes this relation as a false perspective, the setup necessary for the subsequent takedown. (pseudo-truth N (truth 2)) <===> ((pT N) truth 2') [truth <-----> truth] the idea then was that this goes both ways, and the appearance of 'machine 2' within the domain of 'machine 1' may go unrecognized in its hidden and unaccounted for dimensionality that is active within a realm of entropy and information exchange as it ties into energy and matter in terms of patterning and perhaps provides a basis for imagining its intuitive or felt quality, as knowing is accurately grounded and becomes compass and navigational aid, versus ungrounded knowing that leads to being lost and having inaccurate maps and wrong directions and sensibility, at odds with actual nature... (pseudo-truth N (truth 2)) <===> ((pT N) truth 2') the point of seeking to account for this condition of masquerade in terms of its shared and unshared patterning and in terms of its groundedness in relation to empirical truth, is that the situation could *appear* from a given perspective, and within restricted parameters, to validate a given viewpoint while actually existing or operating beyond it, in other parameters and boundaries that remain a protected threshold, that cannot be observed or that goes unrecognized more finite observers, thereby the limit of sensibility, or computability, of patterning, as it relates to what is and what cannot be matched, via its identification, recognition in real terms versus terms of belief that can be in error, inaccurate, unreal, or self-serving to a given bias, predetermined viewpoint, or values that restrict, seek to control, and-or rationalize existence in a too-small framework (in this way, the belief in 'N-awareness' can actually be that of a restricted binary finiteness, where expansion of view and its limitlessness could result from warping, skew, distortion serving falsity than in truth that is expansive... in this way, the boundary folds upon itself, encompasses itself as ideology, creating a false dome and constellations, given enough time) (pseudo-truth N (truth 2)) <===> ((pT N) truth 2') [truth <---> truth] [pT <---> pT] the unintended consequence would be that 'machine 1' betrays and grants access to its inner state via this exchange and interaction, yet unknowingly. and thereby its unaccounted for truth is accessible to another who exists and observes truth, while it may be denied within operational beliefs, (left) thus the leaking of information that balances the interaction, the seeming benefit of onesidedness (right) actually has a hidden cost, a revealing involves via equilibrium and entropy, balancing the exchange. yet the evaluation of data, its parsing and verification, may also not be accurate across this span, and thus 'pseudo-intelligence' could glean factoids that validate ideological beliefs, via relations in masquerade between pT and T, as pT assumes the role of TRUTH and truth related to and perceived as if the 'known' mimic, when in actuality the situation is reversed. (pseudo-truth 2 (truth N)) <===> ((pT 2) truth N) [truth <---> truth] [pT <---> pT] this modeling remains abstract, a story about these dynamics, like a cave diagram seeking to convey the communicative or other aspects of information exchange as symmetry and asymmetry are involved, and how this relates to pattern matching, and resources based in comprehensive pattern evaluations and how this differs between grounded and ungrounded observations and relations by default. (pseudo-truth 2 (truth N)) <===> ((pT 2) truth N) [pT <---> T] [pT <---> T] ...these are the more accurate dynamics, though even moreso: (pseudo-truth 2 (truth N)) <===> ((pT 2) truth N) [pT.2 <---> t.N) [pT.2 <---> t.N) though the appearance may indicate otherwise, from a biased perspective. >>> truth would be moving throughout this system, and the emulation of it (its >>> mask) would likewise be transferred, yet only one version is accurate at >>> the level of verification as truth, while the other validates and relies >>> upon its [signage] instead. this is the fundamental issue of patterns and >>> their connection with truth, in a security context, as related to >>> "information" and quasi-entropy, entropy-as-sign and entropy-as-truth. >>> >> E1335, 42, 812

1 0

re: passwords! (p2)
by brian carroll 13 Nov '13

13 Nov '13

for instance, registration process to access a website could involve something akin to the following... input a word: [mordify] input a image: (choose 1 of 20 icons) -> [sunflowers] input a place: [fort lauderdale] input a number: [3.124] the website could then create the password from this data, such as translating a word between languages, into another character set, then xor'ing various fields together (if grokking the concept), such that when blended, the string would be multicharacterset, perhaps unseen by the user, and then only interfaced via these keywords that could be written down as parameters and not be readily utilized via UI for password management, using the encrypted string itself. in other words; the password would not be: [mordify][sunflower-icon][fort%20lauderdale][3.124] it would be a computation based on those variables, such that, in an impressionist rendering as example: [mord][3][unz][.][for][-]...[fy][4][iconID][whatever] though further, if 'translated' across unicode character sets and alphabets, then perhaps: [морд][3][માટે][.][for][-]...[جو][4][iconID][cibé] and then even this could be further mixed if necessary or helpful in terms of decohering patterns and making the computational stretch the maximum effort per unit of password character space, vs. restricting it to minimum as seems the standard, weakened by the default "rules" Ȉ ͆ ͡ ͤͮ Σ Ж ༎ ༬ ℍ § נ

2 2

The second operating system hiding in every mobile phone
by Eugen Leitl 13 Nov '13

13 Nov '13

http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_eve… The second operating system hiding in every mobile phone posted by Thom Holwerda on Tue 12th Nov 2013 23:06 UTC I've always known this, and I'm sure most of you do too, but we never really talk about it. Every smartphone or other device with mobile communications capability (e.g. 3G or LTE) actually runs not one, but two operating systems. Aside from the operating system that we as end-users see (Android, iOS, PalmOS), it also runs a small operating system that manages everything related to radio. Since this functionality is highly timing-dependent, a real-time operating system is required. This operating system is stored in firmware, and runs on the baseband processor. As far as I know, this baseband RTOS is always entirely proprietary. For instance, the RTOS inside Qualcomm baseband processors (in this specific case, the MSM6280) is called AMSS, built upon their own proprietary REX kernel, and is made up of 69 concurrent tasks, handling everything from USB to GPS. It runs on an ARMv5 processor. The problem here is clear: these baseband processors and the proprietary, closed software they run are poorly understood, as there's no proper peer review. This is actually kind of weird, considering just how important these little bits of software are to the functioning of a modern communication device. You may think these baseband RTOS' are safe and secure, but that's not exactly the case. You may have the most secure mobile operating system in the world, but you're still running a second operating system that is poorly understood, poorly documented, proprietary, and all you have to go on are Qualcomm's Infineon's, and others' blue eyes. The insecurity of baseband software is not by error; it's by design. The standards that govern how these baseband processors and radios work were designed in the '80s, ending up with a complicated codebase written in the '90s - complete with a '90s attitude towards security. For instance, there is barely any exploit mitigation, so exploits are free to run amok. What makes it even worse, is that every baseband processor inherently trusts whatever data it receives from a base station (e.g. in a cell tower). Nothing is checked, everything is automatically trusted. Lastly, the baseband processor is usually the master processor, whereas the application processor (which runs the mobile operating system) is the slave. So, we have a complete operating system, running on an ARM processor, without any exploit mitigation (or only very little of it), which automatically trusts every instruction, piece of code, or data it receives from the base station you're connected to. What could possibly go wrong? With this in mind, security researcher Ralf-Philipp Weinmann of the University of Luxembourg set out to reverse engineer the baseband processor software of both Qualcomm and Infineon, and he easily spotted loads and loads of bugs, scattered all over the place, each and every one of which could lead to exploits - crashing the device, and even allowing the attacker to remotely execute code. Remember: all over the air. One of the exploits he found required nothing more but a 73 byte message to get remote code execution. Over the air. You can do some crazy things with these exploits. For instance, you can turn on auto-answer, using the Hayes command set. This is a command language for modems designed in 1981, and it still works on modern baseband processors found in smartphones today (!). The auto-answer can be made silent and invisible, too. While we can sort-of assume that the base stations in cell towers operated by large carriers are "safe", the fact of the matter is that base stations are becoming a lot cheaper, and are being sold on eBay - and there are even open source base station software packages. Such base stations can be used to target phones. Put a compromised base station in a crowded area - or even a financial district or some other sensitive area - and you can remotely turn on microphones, cameras, place rootkits, place calls/send SMS messages to expensive numbers, and so on. Yes, you can even brick phones permanently. This is a pretty serious issue, but one that you rarely hear about. This is such low-level, complex software that I would guess very few people in the world actually understand everything that's going on here. That complexity is exactly one of the reasons why it's not easy to write your own baseband implementation. The list of standards that describe just GSM is unimaginably long - and that's only GSM. Now you need to add UMTS, HSDPA, and so on, and so forth. And, of course, everything is covered by a ridiculously complex set of patents. To top it all off, communication authorities require baseband software to be certified. Add all this up, and it's easy to see why every cellphone manufacturer just opts for an off-the-shelf baseband processor and associated software. This does mean that each and every feature and smartphone has a piece of software that always runs (when the device is on), but that is essentially a black box. Whenever someone does dive into baseband software, many bugs and issues are found, which raises the question just how long this rather dubious situation can continue. It's kind of a sobering thought that mobile communications, the cornerstone of the modern world in both developed and developing regions, pivots around software that is of dubious quality, poorly understood, entirely proprietary, and wholly insecure by design.

2 1

Fwd: the new 2014 Add-Only Sets
by coderman 13 Nov '13

13 Nov '13

---------- Forwarded message ---------- From: Zooko O'Whielacronx <zookog(a)gmail.com> Date: Tue, Nov 12, 2013 at 11:09 PM Subject: the new 2014 Add-Only Sets To: tahoe-dev <tahoe-dev(a)tahoe-lafs.org> Folks: (This is a copy of https://tahoe-lafs.org/trac/tahoe-lafs/ticket/795#comment:13 .) Here's my rendition of our discussion of add-only sets at the Tahoe-LAFS Summit today. (As usual, I altered and embellished this story significantly while writing it down, and people who were present to witness the original discussion are invited to chime in.) An add-only cap doesn't have to also be a write-only cap. It might be good for some use cases that you can give someone a cap that lets them read the whole set, and add elements into the set, without letting them remove elements or change previously-added elements. It might be good in some other use cases to have an "add-only&write-only" cap, which allows you to add elements into the set but doesn't let you read elements of the set, nor remove nor change previously-added elements. We agreed to focus on the former case for now, because it is easier to design and implement a solution to it. (See #796 for discussion of write-only caps.) We agreed to forget about erasure-coding, which makes an already-confusing problem (how to implement add-only sets without allowing a few malicious servers, adders, or set-repairers to perform rollback attack or selection attack), into a very-confusing problem that exceeded my brain's ability to grapple with it. So, for now, assume that add-only sets don't use erasure-coding at all. Now, the basic design we came up with is like this. I'll explain it in multiple passes of successive refinement of the design. FIRST PASS: DESIGN "0" An authorized adder (someone who holds an add-cap) can generate "elements", which are bytestrings that can be added into the set. (I mispronounced "elements" as "elephants" at one point, and from that point forward the design was expressed in terms of a circus act involving elephants.) Elephants have an identity as well as a value (bytestring), so: aos = DistributedSecureAddOnlySet() aos.add_elephant(b"\xFF"*100) aos.add_elephant(b"\xFF"*100) results in aos containing two elephants, not one, even though each elephant has the same value (the bytestring with one hundred 0xFF bytes in it). aos.add_elephant() generates a random 256-bit nonce to make this elephant different from any other elephant with the same value. I call this "putting a tag on the elephant's ear" — a "tagged elephant" is a value plus a nonce. Even if two elephants are identical twins, they can be distinguished by the unique nonce written on their ear-tags. aos.add_elephant() then puts a digital signature on the tagged-elephant (using the add-only-cap, which contains an Ed25519 private key), and sends a copy of the tagged-elephant to every one of N different servers. Putting a digital signature on a tagged-elephant is called "wrapping a net around it". A reader downloads all the tagged-elephants from all the servers, checks all the signatures, takes the union of the results, and returns the resulting set of elephants. Design "A" relies on at least one of the servers that you reach to save you from rollback or selection attacks. Such a server does this by knowing, and honestly serving up to you, a fresh and complete set of tagged-elephants. “Rollback” is serving you a version of the set that existed at some previous time, so the honest server giving you a copy of the most recent set protects you from rollback attack. “Selection” is omitting some elephants from the set, so the honest server giving you a complete copy of the set protects you from selection attack. SECOND PASS: DESIGN "1" We can extend Design "0" to make it harder for malicious servers to perform selection attacks on readers, even when the reader doesn't reach an honest server who has a complete copy of the most recent set. The unnecessary vulnerability in Design "0" is that each tagged-elephant is signed independently of the other tagged-elephants, so malicious servers can deliver some tagged-elephants to a reader and withhold other tagged-elephants, and the reader will accept the resulting set, thus falling for a selection attack. To reduce this vulnerability, adders will sign all of the current tagged-elephants along with their new tagged-elephant with a single signature. More precisely, let the "identity" of a tagged-elephant be the secure hash of the tagged-elephant (i.e. the secure hash of the nonce concatenated with the value). The signature on a new tagged-elephant covers the identity of that tagged-elephant, concatenated with the identities of all extant tagged-elephants, under a single signature. In circus terms, you add the new tagged-elephant into a pile of tagged-elephants and throw a net over the entire pile, including the new tagged-elephant. Now, malicious servers can't omit any of the older tagged-elephants without also omitting the new tagged-elephant. Readers will not accept the new tagged-elephant unless they also have a copy of all of the other tagged-elephants that were signed with the same signature. This limits the servers's options for selection attacks. THIRD PASS: DESIGN "2" We can refine Design "1" to make it cleaner and more CPU-efficient and network-efficient. This will also lay the groundwork for an efficient network protocol. The unnecessary "dirtiness" in Design "1" is that the digital signatures on older tagged-elephants become extraneous once you add a new digital signature. We have a mass of tagged-elephants, we throw a net over the whole mass, then later when we add a new tagged-elephant to the pile, we throw a new net on top of the new (slightly larger) pile. Now the underlying net has become redundant: once you've verified the signature of the outermost net, there is no need to check the signature of the inner net. In fact, if one implementation checks the signature of the inner net and another implementation does not check it, then a malicious adder colluding with a malicious server could cause the implementations to differ in their results, by putting an invalid net (an invalid signature) topped by a new tagged-elephant with a valid net. (Daira was the one who noticed that issue.) To make this cleaner and more efficient, we will never put a net around a net, and instead we'll keep each tagged-elephant in a box. When you want to add a new tagged-elephant to a set, you rip off and throw away any extant nets, then you put the new tagged-elephant in a box which is nailed on top of the previous topmost box. Then you wrap a net around the new topmost box. "Nailing" box Y on top of box X means taking the secure hash of box X and appending that to box Y (before signing box Y). A "box" is a tagged-elephant concatenated with any number of "nails", each of which is the secure hash of a previous box. (Note that you can sometimes have two or more boxes precariously perched at the top of a stack, when two adders have simultaneously added a box before each saw the other's new box. That's okay — the next time an adder adds a box on top of this stack, he'll nail his new box to each of the previous topmost boxes.) Boxes are a lot more CPU-efficient than nets, and more importantly nobody (neither readers, adders, nor servers) needs to revisit a lower-down box in order to add a new top-most box. Once you nail box Y on top of box X, then you can later add box Z just by taking the hash of box Y, without revisiting box X. Note that we need two different secure hashes here: one is the identity of a tagged-elephant, which is the secure hash of: the nonce concatenated with the value. The other is the hash of the box, which is the secure hash of: the identity of a tagged-elephant concatenated with the hashes of any previous boxes. We need the identity of a tagged-elephant for finding out whether a certain tagged-elephant already exists in a stack (regardless of what position it occupies within that stack), and we need the hash of the box for efficiently verifying that all the tagged-elephants in a stack were approved by an authorized adder. This also leads to the efficient network protocol: an adder can remember (cache) the Directed Acyclic Graph of boxes which a given server previously told the adder about. When the adder wants to add a new tagged-elephant or a set of new tagged-elephants to that server, he can send just the boxes which would be new to that server, assuming that the server hasn't learned anything new since the last time they talked. Readers can do likewise, remembering what each server previously told them about, and asking the server to just tell them about things that are not already covered the topmost box(es) that the reader already knows about. CONCLUSION Okay, that's it! I think Design "2" is a good one. It has good security against rollback or selection attacks by malicious servers (assuming some kind of whitelisting of servers! Which is ticket #467 and is not yet implemented.) And, it doesn't go too far over the top in terms of complexity; it seems more intuitive to me than (my vague memories of) previous attempts to design add-only sets for LAFS. (By the way, there are a few other possible ways to strengthen defenses against rollback attack, which we've previously considered in the context of mutable files, but they probably also apply to add-only sets.) I'm excited about this design being feasible, because I think add-only sets could be a critical building block in valuable use-cases such as secure logging, secure email, secure backup, and more. Regards, Zooko P.S. Thanks to Isis and Mike for showing up today and, when asked what Tahoe-LAFS improvements they were interested in, suggesting add-only sets.

2 1

Re: passwords! (including long passwords with poor entropy)
by coderman 13 Nov '13

13 Nov '13

On Tue, Nov 12, 2013 at 6:08 PM, brian carroll <electromagnetize(a)gmail.com> wrote: >... > yet what if the passwords 'length' were not the issue, such that a 20 > character string (of several number.words with several intermixed > special characters) could still be successfully attacked, given those > limited parameters. this summer oclHashCat-plus got an upgrade (experimental) for support to 64 characters of search space (55 or more depending on algo). obviously this length implies a more intelligent / direct search through the key space, which, if limited to a much smaller character set, becomes practically attack-able... in fact, optimizing the path of a dict cruncher like oclHashCat or Hashkill for best performance against a particular target set is an enjoyable art unto itself ;)

1 0

Fwd: Talk at Paypal on "The Grand Challenge to Kill Passwords for Good"
by Bill Stewart 13 Nov '13

13 Nov '13

This just arrived; seems germane to the discussion, for any of you who are local to Silicon Valley area. >From: "PayPal's TechXploration" <info(a)meetup.com> >Subject: Monday: Join 347 Xplorers at "The Grand Challenge to Kill Passwords > for Good" > >Monday >The Grand Challenge to Kill Passwords for Good >PayPal's TechXploration >Monday, November 18, 2013 >6:00 PM >PayPal Town Hall >2161 North 1st Street San Jose, CA 95131 >Will you attend? >Yes >No >347 Xplorers attending, including: >Max Gorbunov >"Physicist, software developer" >Van Riper >"I work in Google Developer Relations as the >Global Program Manager for Google Developer >Groups: http://developers.google.com/groups/" >Sanjay Shroff >"Sanjay Shroff >http://www.linkedin.com/in/shroffsanjay >http://www.shroff.ca http://www.facebook.com/sanjays..." >Lourdes >"Hi" >Alvin Wang >"hi" >Suyash Joshi >"devloper" >"Our intention is to really obliterate, within a >certain number of years, both passwords and PINs >and see the whole Internetincluding internally >in enterprisessobliterate user IDs and >passwords and PINs from the faace of the planet.â > >Michael Bar... >Learn more >Sponsored by NextSpace San Jose, PayPal and Content Magazine >Follow us! > >Meetup HQ in NYC is hiring! meetup.com/jobs

1 0

re: passwords! (p4)
by brian carroll 13 Nov '13

13 Nov '13

completeness is its own thing... need to mention case of 'partial passwords' where user and site merge into a final password yet the user password cannot be cracked without the hidden variables blended into the final working password that is either static or changing... for instance, a previous example... [морд][3][માટે][.][for][-]...[جو][4][iconID][cibé] what if [iconID] was hidden as to its bit-set size, it could be 1 character space or twelve, and yet it would remain hidden at password entry by the user yet required to gain access. [морд][#][3][###][માટે][.][for][##][-]...[جو][4][##][cibé][#] such that some algorithm processes the input in another framework and if somehow this is processes is not normal or it triggers a particular mechanism, a threshold condition could activate blocking access within the password itself vague, i do not know exactly how it could be engineered such that it would be needed and unseen by the user and yet be able to distinguish the actual user from imitator or hostile attacker, though in this way, the moat/drawbridge mechanism that would be 'missing information' within the structure of the password, such that the STRING in itself, input by the user, is not the password, until it is mixed in with the other piece via the site security. [#|#|x|ம்|7|#|#|#|ன்] in other words, a password could only be partially that of the user, and perhaps this is already how it exists today, though that each variable could be more than a character and this could be a bit-set computation, as an icon/other coordinates are blended together, some data of which is not in the user domain and would remain unknown and beyond the ordinary boundary, inside a further interior realm of protected data, a second security vestibule, in the above case, all the wildcards could be data that is in the password yet zoned for another level of access, such that the administrators must provide the data else that it could also be variable in size and 'timing', such that real-time or other permutive functioning could be rolling, 'living code' that is masked - "unknown", and potentially has a calculative or image-based input that is not visible on the outside, yet also entangled with it. perhaps it is not of classical physics, this, yet why must the password unit be assumed a single static character and not something in movement, existing beyond perception and operating by unknown rules that influences what the actual password is, at any given point or place in time. unique perspective as the basis for a universal security approach (UID) lime, tequila, [#], triple-sec

1 0

[SOT] {FWD} [Dailydave] Don't use vowels in passwords! (fwd)
by J.A. Terranson 13 Nov '13

13 Nov '13

Mildly interesting, for those who have an interest ? //Alif -- Those who make peaceful change impossible, make violent revolution inevitable. An American Spring is coming: one way or another. ---------- Forwarded message ---------- Date: Thu, 7 Nov 2013 14:01:15 -0500 From: William Arbaugh <warbaugh(a)gmail.com> To: dailydave(a)lists.immunityinc.com Subject: [Dailydave] Don't use vowels in passwords! According to the Defense Finance and Accounting Service (DFAS), you shouldn't use vowels in your password! The DFAS web site myinvoice.csd.disa.mil is instituting new password requirements starting tomorrow. The details can be found at the site (if you're willing to read a PDF hosted by DOD that is). DFAS brings us two significant improvements to password/PIN security by forbidding the use of vowels, and requiring that password/PINs be EXACTLY 15 characters long (no more, no less). I'd guess that the first requirement is to prevent people from using dictionary words. The second requirement is probably due to some obscure issue with their use of an Oracle Java front-end. This is from a web site that until recently ( and I believe still does) required the use of IE and Java 6. Logging in use to require clicking through no less than 3-4 security warning pop-ups. _______________________________________________ Dailydave mailing list Dailydave(a)lists.immunityinc.com https://lists.immunityinc.com/mailman/listinfo/dailydave

8 11

re: passwords! (p3)
by brian carroll 13 Nov '13

13 Nov '13

yet another approach, user registration involves time-based parameter, which is based on NIST shared clock set to a particular city or time-zone, minus a mystery variable, which then runs a 'tally' as the password as it has been transmuted via calculation: thus the password is rolling, every changing and cannot be computed as a string because it is never the same (if designed that way, to include rolling variables within a longer bit string)... in this way, example: [var1] = [Pacific Time Zone] minus (skew variable) - "3.14" [var2] = [DAYDATE spelled out] plus (translation) such that ==> [var1]*[var2] (list fool's magic xor goes here) ==> [var1a][var2c][var1b.var2d]...[var1w][var2i] whereby, the entire variable of [var1] and [var2] when combined is *changing* and transforming in real-time, via hidden, unknown clock and date correspondence, though could involve GPS, weather, other variability that is essentially entangled into a living password. in the realm of impossible to crack, in my estimation. any computation that cannot stop time itself in order to run the brute force would be losing time and then it would be purely chance, never less than the odds of trillion to one, or whatever it could be, every attempt no matter how many dictionaries parsed in parallel... this is not a password: [password]

1 0

Re: passwords!
by brian carroll 13 Nov '13

13 Nov '13

the list fool here chiming in... i just wonder if there is a boundary condition that exists that is making passwords insecure by protocols that could themselves be modified, and alter the probabilities of easy dictionary attacks. for instance, if A-Z and a few special characters are allowed in a US keyboard alphabet, if that is the majority of what is being automatically cracked, perhaps it is not surprising. yet what if the passwords 'length' were not the issue, such that a 20 character string (of several number.words with several intermixed special characters) could still be successfully attacked, given those limited parameters. and such a view may be: moar characters, longer string, etc. perhaps mistaken though i wonder what 'dictionaries' are referenced because if they are mapped to normal words of a given language, and special symbols, and yet held within the walls or boundaries of a particular alphabet or sign-system, then perhaps language-to-language the password cracking situation remains basically the same. yet, what if the Unicode barrier (if that is what it is) is dissolved, such that many languages could co-exist, such as 12 different N's and ligatures and other special characters... ex. normal bounded password in a given Unicode character set / alphabet, with special characters: th3r0uT33Nw4!z+3sezU3 compare this with a multi-alphabet approach: п世לកóવિz what are the computational probabilities of searching across all ascii/unicode alphabet characters and getting that pattern matched, versus let's say [35] options per password character in a constrained alphabet. the calculation would be something like this (to 21 spaces in ex.) [35][35][35][35][35][35][35][35][35][35][35][35][35][35][35]...[35] versus, if wildly approximating: [1,000] options for the 'multiple language Unicode characters and special symbols' password approach. the following estimate may be inaccurate though for 35 times itself over and over twenty one times, the number i arrived at was: 9.321739789445372e+33 again, calculation may be inaccurate, though for the multiple character approach, only 11 characters @ [1000] needed for: 1.e+36 though imagining it could be many fewer characters in comparison, say if accessing Chinese and Arabic other characters. in other words, perhaps a hypothetical [10,000] symbols could be made available per password unit than [35] in the highly restricted approach that is easy to crack, and that would change how computation occurs with regard to how such passwords are created, stored, and exist, especially in a highly constrained OS and peripheral environment that constrains cross-pollination of such key typographic information that would change the basic dynamics, data behavior. this is the slot-machine approach to [p|a|s|s|w|o|r|d|s] because at a certain point, anything could tally... [*|*|x|ம்|7|*|*|#|ன்] though what is more... for each _space_ there could be any sign.symbol, as with icons or special characters, potentially, that could be potential keyspace or what today may appear as "junk" information that is infrastructural for multilanguage computing, and be utilized beyond the language boundary for its signage, for passwords & security. in this way, the three unit password (icon=ascii symbol) ['icon'][પ્રે][ю] could be stronger than a much longer, restricted alphabet, if going towards 10,000+ options per character. yet the model itself could example such that a password is constructed by a bit-set string, where like a slot machine, could instead have 'words' as the units (as with the existing password approach, word1&word2, etc.)... ['word1'][[પ્રે][ю]['gps-coords'] if only viewed in bounded terms and of serial computation, a long *predictable* string may be easier to attack than a shorter unpredictable string that takes massive resources to churn through the possibilities - and who knows, maybe the password has a time-cycle that automatically changes its nature during that time period of calculation. surface tension, iridescence, spinner

1 0