November 2013 - cypherpunks - lists.cpunks.org

A Fierce Domain: Conflict in Cyberspace 1986 to 2012
by John Young 12 Nov '13

12 Nov '13

A Fierce Domain: Conflict in Cyberspace 1986 to 2012: http://www.amazon.com/gp/product/B00E00QSN4/ref=cm_cr_rev_prod_title Excerpts: http://cryptome.org/2013/11/fierce-domain.htm

1 0

Re: [cryptography] NIST Randomness Beacon
by Peter Gutmann 11 Nov '13

11 Nov '13

Warren Kumari <warren(a)kumari.net> writes: >I've often wondered if there is a clever way to do the inverse -- basically >to have a "latest" timestamp? This seems like a much harder problem -- 'm >looking for a "movie plot" type solution that the public can easily >understand… You could do it with a physical one-way function. Take a photo of the victim on top of the WTC and you know that it can't have been occurred after 9/11. To generalise it, photograph the victim in front of some documented object and then destroy the object. I'm assuming in the movie-plot scenario that someone who's kidnapped a victim won't worry about blowing up a statue in a park or performing whatever the physical one-way operation is. Depending on how evil your movie-plot villain is (and how convoluted the plot will get), he/she could kill random strangers after photographing them with the victim, in order to fix a point in time. Peter.

1 0

Re: [cryptography] NIST Randomness Beacon
by CodesInChaos 11 Nov '13

11 Nov '13

On Mon, Nov 11, 2013 at 8:14 PM, Natanael <natanael.l(a)gmail.com> wrote: > Proof-of-work, just like Bitcoin itself uses for hashing? No this idea isn't about proof of work. The idea is delaying the computation result, preventing a miner from picking a value. If the computation takes an hour on the fastest available computer and isn't parallelizable, then a miner can't influence the unpredictable value (unless they have 51%). With slightly weaker security requirements iterating only a few million times would be decent as well, since attempting to influence the value would result in a performance hit a competitive miner can't afford.

1 0

[liberationtech] Survey on the security of human rights defenders, activists and journalists
by Security First 11 Nov '13

11 Nov '13

Hi LiberationTech, We're a small group of human rights defenders based in the UK (we will give a more formal announcement soon!) doing some work to develop mobile tools for the physical security of human rights defenders, activists and journalists. It would be a great help to us while we are still in the early development phase if we could get some feedback from the group about some of the physical security problems they face - to help us prioritise our development work. https://docs.google.com/forms/d/1LRATeUm2hmzIBBYAg8LtMxcx6W6X4Fl1iYF-Lqe0Fi… Also, if there are people in London interested in grabbing a coffee then please do drop us a mail! Many thanks, Security First. www.secfirst.org -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

1 0

sidebands of great justice [was: Meet “badBIOS,” the mysterious Mac and PC malware that jumps airgaps]
by coderman 10 Nov '13

10 Nov '13

On Sun, Nov 3, 2013 at 12:47 AM, grarpamp <grarpamp(a)gmail.com> wrote: > ... > Unlikely the average laptop would adequately cover > the airgap in this frequency range. Signal to noise > ratio and packet loss are further inhibitive to data > transmission. friend and i spent a few hours earlier this week playing around with high frequency data transmission over PC speakers and microphones. my hearing is rather poor, as sounds > 13kHz are inaudible to me. $friend can hear just over 17kHz. a few normal laptops and mics were able to emit and receive in the 18kHz to 20kHz frequencies just fine, and (unsurprisingly enough) there's almost nothing in this range naturally. a side channel just waiting for use! bit rate is poor in our limited example, however. i'll leave high speed, error correcting implementations to the reader ;) best regards,

5 8

Re: [Bitcoin-development] BIP proposal - patch to raise selfish mining threshold.
by Peter Todd 09 Nov '13

09 Nov '13

On Tue, Nov 05, 2013 at 12:43:15PM -0500, Ittay wrote: > On Tue, Nov 5, 2013 at 12:14 PM, Peter Todd <pete(a)petertodd.org> wrote: > > > On Tue, Nov 05, 2013 at 12:05:41PM -0500, Peter Todd wrote: > > > On Tue, Nov 05, 2013 at 11:56:53AM -0500, Ittay wrote: > > > > Oh, and I don't want to give the wrong impression: there's no need to > > rush to get this problem fixed. Even if someone wanted to launch an > > attack right now, with a fair amount of resources, there's a lot of > > counter-measures based on human intervention that can definitely stop > > the attack in the short-term > > > The attack can be easily hidden. And be sure that before today, today, > and after today, very smart people are at their computer planning attacks > on Bitcoin. Exploits must be published and fixed FAST. Not this exploit. Here's a perfectly plausible worst-case scenario, that could be happening right now: RAND High Frequency Trading Corp (a subsidiary of General Evil) has a globe-spanning low-latency network of fiber, line-of-sight microwave, and some experimental line-of-site neutrino links criss-crossing the globe. They can get data to and from any point on this planet faster than anyone else. Of course, in addition to their spectacular network they have an immense amount of computing power, as well as exotic overclocked liquid nitrogen bathed CPU's that run at clockspeeds double what commercial hardware can do; in short, they have access to scalar performance no-one else has. Of course, they like to keep a healthy reserve so, 99% of all this fancy gear is constantly idle. Whatever, they can afford it. RAND just hired a bunch of fresh MIT graduates, the best of the best. Problem is the best of the best tends to make not so best mistakes, so RAND figures a Training Exercise is in order. Fortunately for them the NSA (a subsidiary of General Evil) slipped a rootkit into my keyboard a week or so ago - probably that time when I woke up in that farmers field with a *splitting* headache - and are reading what I'm typing right now. I go on to explain how an excellent training exercise for these fresh MIT graduates would be to implement this nifty attack some Cornell researchers came up with. It's really simple, elegant even, but to do it best what you really want is the kind of low-latency network a high-frequency-trading corporation would have. I then point out how a good training exercise ideally is done in a scenario where there is genuine risk and reward, but where the worst-case consequences are manageable - new hires to tend to screw up. (I then go on to explain my analog electronics background, and squeeze in some forced anecdote about how I blew up something worth a lot of money owned by my employers at some point in the distant past) Unfortunately for the operators of BTC Guild, one of these new MIT grads happens to have a: passed General Evil's psych screening with flying colors, and b: have spent too much time around the MIT Kidnappng Club. He decides it'd be easier to just kidnap the guy running BTC Guild than fill out the paperwork to borrow RAND's FPGA cluster, so he does. As expected the attack runs smoothly: with 30% of the hashing power, neutrino burst generator/encoders's rigged around the globe to fire the moment another pool gets a block, and the odd DoS attack for fun, they quickly make a mockery of the Bitcoin network, reducing every other miners profitability to zero in minutes. The other miners don't have a hope: they're blocks have to travel the long way, along the surface of the earth, while RAND's blocks shave off important milliseconds by taking the direct route. Of course, this doesn't go unnoticed, er, eventualy: 12 hours later the operators of GHash.IO, Eligius, slush, Bitminter, Eclipse and ASICMiner open their groggy eyes and mutter something about how that simulcast Tuesday party really shouldn't have had an open bar... or so much coke. They don't even notice that the team from BTC Guild has vanished, but they do notice a YouTube video of Gavin right on bitcoin.org doing his best Spock impression, er, I mean appealing for calm and promising that Top Men are working on the issue of empty blocks as we speak. Meanwhile CNN's top headline reads "IS THIS THE END OF BITCOIN?!?!" It takes another hour for the Aspirin's to finally kick in, but eventually get all get on IRC and start trying to resolve the issue - seems that whenever any of them produce a block, somehow by incredible coincidence someone else finds another block first. After a few rounds of this they're getting suspicious. (if they weren't all so hung-over they might have also found suspicious the fact that whenever they found a block they saw a sudden blue flash - Cherenkov radiation emitted when those neutrino's interacted with the vitreous humour in their eyeballs) It's quickly realized that "somehow" BTC Guild isn't affected... GHash.IO and Eligius, 22% and 13% of the hashing power respectively, decide to try a little experiment: they peer to each other and only each other through an encrypted tunnel and... hey, no more lucky blocks! slush, 7% of the hashing power is invited to the peering group next, followed by Bitminter, 6%, and Eclipse, 2%, and finally ASICMiner, 1%, for a grand total of... 51% of the hashing power! Of course, just creating blocks isn't useful for users, they need to be distributed too, so someone quickly writes up a "one-way firewall" patch that allows the group's blocks to propagate to the rest of the network. Blocks created by anyone else are ignored. It takes a few more hours, but eventually the attacker seems to run out of blocks, and transaction processing returns to normal, albeit a little slow. (20 min block average) Of course, soon there's a 3,000 post thread on bitcointalk complaining about the "centralized pool cartel", but somehow life goes on. The next day Gavin goes on CNN, and gives a lovely interview about how the past two days events show how the strength of the Bitcoin network is in the community. For balance they interview this annoying "Peter Todd" guy from "Keep Bitcoin Free!" who blathers on about how relying on altruism or something will doom the Bitcoin network in the long run. After the interview Gavin respectfully points out that maybe next time they find a so called "developer" with a ratio of bitcointalk posts to actual lines of code in the Bitcoin git repository better than one hundred to one. The producer just wishes that "Mike Hearn" guy was available; at least he's got a sense of fashion, sheesh! Anyway, I'm out of space for my little story, but yeah, the ending involves a group of now-rich pool operators who decide to start a large financial services and data networking company, oh, and time-travel... > Nevertheless, I agree that, as you say, we must not rush it. Look at the > BIP, find if we missed anything, and let's discuss it. Indeed. Quite seriously, your attack is a serious long-term risk, but in the short term the social dynamics of Bitcoin are such that it's just not a show-stopping risk. At worst some miners will lose a bunch of money - that's something that's happened before with the March chain fork, and sure enough Bitcoin survived just fine. > > In addition, keep in mind > > that this attack is very easy to detect, so if one is actually launched > > we will know immediately and can start taking direct counter-measures at > > that time. > > > > Not really. Please see the discussion section in our paper. You can hide *who* is the attacker - you can't hide the fact that an attack is happening if done on a meaningful scale. > > That Gregory Maxwell so quickly identified a flaw in this proposed > > solution suggests we should proceed carefully. > > > > There is no flaw. You were just reiterating that the solution does not give > us the 51% percent security you thought you had before. We showed that > we're not getting this back, I'm afraid. That's not what we're concerned about - what we're concerned about is that your BIP doesn't discuss the issue, and you didn't seem to be aware of it. That suggests that the analysis is incomplete. There's no pressing need to rush changes, as explained above by example, so we're best off understanding the issue thoroughly first. There's a whole spectrum of potential solutions that haven't been discussed - I myself have two approaches I'm working on that may solve this problem in ways you haven't (publicly) considered. I'm sure there are many others out there. -- 'peter'[:-1]@petertodd.org 00000000000000005144f6a7109b9f8543880a0a5f85a054ec53966bc2daa24c ------------------------------------------------------------------------------ November Webinars for C, C++, Fortran Developers Accelerate application performance with scalable programming models. Explore techniques for threading, error checking, porting, and tuning. Get the most from the latest Intel processors and coprocessors. See abstracts and register http://pubads.g.doubleclick.net/gampad/clk?id=60136231&iu=/4140/ostg.clktrk _______________________________________________ Bitcoin-development mailing list Bitcoin-development(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-development

8 8

patterns, processes, procedures (urls)
by brian carroll 09 Nov '13

09 Nov '13

// language, linguistics, typography, signs & symbols, // patterns, techniques perhaps of crypt-relevance... Typography Book Explores What It Feels Like To Have Dyslexia http://www.huffingtonpost.com/2013/11/06/dyslexia-typography_n_4220353.html What happens when you swap the colors of famous logos? http://sploid.gizmodo.com/what-happens-when-you-swap-the-colors-of-famous-l… // regarding Strange Read-Reply Function (SRF), i read this news // and misintepreted the following quote... Hacker behind 'Loverspy' Trojan added to FBI's most wanted cybercriminal list http://www.theverge.com/2013/11/7/5077762/hacker-behind-loverspy-added-to-f… "Back in 2005, a hacker named Carlos Enrique Perez-Melara released a piece of malware called "Loverspy" into the world. The $89 software purported to be a way to catch a cheating lover — it sent the suspected cheater an electronic greeting card that, when opened, would install a particularly malicious Trojan that could capture keystrokes, email addresses, instant messages, and even record video from a webcam. Once it was installed, the infected computer was essentially at the attacker's mercy." (...thought for certain it involved a paper-based 'electronic' card, which set my imagination going as far as potential platforms for delivery of sound-based triggering of computer events... thus: regarding the issue of covert, audio-based data transmission the idea of a silent dog whistle greeting card, modified to send data in inaudible frequencies was imagined, likewise: most any triggered, playback device: x-mas ornaments, singing fish, etc. potentially influencing nearby computers, hotspots, phones... (note also: PIR-motion detecting or light sensors for activation of larger artifacts, e.g. garden gnome, lawn ball, flood lights) ex. Musical Greeting Cards, Talking Personalized Envelopes http://www.soundexpressiongreetings.com/ ex. Invite By Voice greeting card sound modules http://www.invitebyvoice.com/ ex. Talking Products - Record-a-Card 10 seconds http://www.talkingproducts.com/recordable-cards-gifts/recordable-greetings-… (note: tone pattern as key, unlocking hidden parameters) // first, cyborg the pests, next, e-shock dog collars for children... Critics denounce RoboRoach device, which uses a smartphone app the control cockroaches http://www.sciencenewsdaily.org/consumer-gadgets-news/cluster464134548/ // somehow i ended up on this google images array and // it captures a shared trait of both electrical infrastructure // and architecture regarding nautical correspondance, with // buildings as ships, though the connection between boat // rigging and sails and the the distribution and transmission // systems, guywires, masts, including on vessels themselves overlapping structural patterns https://www.google.com/search?client=firefox-a&hs=Rhx&sa=X&rls=org.mozilla:… // this article introduced what is to me an interesting idea // to consider: banks as model for secure crypto exchange... Over $1 million stolen from Bitcoin digital wallet service, claims site owner http://www.theverge.com/2013/11/8/5082350/over-1-million-stolen-from-bitcoi… " It's far safer to keep Bitcoins in "cold storage" by keeping your wallet key offline, possibly even in a safe deposit box. The key used for withdrawals is different than the public one needed for deposits, making cold storage appealing for keeping a reserve of Bitcoin safe from hackers. " question: what if 'the banking system' itself were a model for cryptography in terms of how keys and transactions occur, instead of layer within banking transactions. in other words, what if 'securing data' actually involved taking it offline, removing it into physical media (such as pressed CDs in secure storage, out of circulation) or other approaches. my naive sense is that anything more complicated than can be worked out with paper, envelopes, and social transactions may not be secure by design of incomprehensibility, and who better than banks for these kinds of advanced transactions of exchanging valued information en masse. Franks, Tabasco, Sriracha

1 0

(re: that old-time crypto.religion) trois
by brian carroll 08 Nov '13

08 Nov '13

// further clarification of structural dynamics of previous diagram.... s u b j e c t (many unshared observational frameworks) i v i s m pT = minimal truth + errors & falsity #tends toward 0 [evil] A=B #nothingness, death, hate #inaccuracy, shared lies ungrounded #fragmentation, division (belief) RELATIVISTIC #finiteness, rationalization +---> partial-TRUTH #bias, skew, warping, distortion | #ideology, infallible observers | #injustice, immorality, crime | E | #shallow, superficial, weak FAITH-based | T | protection.. ---| H | i n s e c u r i t y | I | | C | s e c u r i t y | S v | #tends toward 1 [good] grounded | #being, life, true love (belief) +---> EMPIRICAL #accuracy, shared truth TRUTH #integration, unified POV A=A #infinity, logical reasoning #neutrality, paradox, clarity #ideas, error-correction #justice, morality, law o b j #deep, profound, strong e c t i v i t T = maximal truth - errors & falsity y (one universal observational framework) ^note: A=B --> B=B, where B is hidden, secret pseudo-empirical truth whereby A=A --> A=(B=B), where B is established within pT not T yet assumes absolute viewpoint, belief & 'faith' in false-perspective (testing 1 2 3, testing testing...)

1 0

new list in german
by dp 07 Nov '13

07 Nov '13

hello, there is a new list for people, who will be talk in german about cryptology, society and for build up new projects, to give people there privacy back. feel free for joining the cypherpunk-ger list! https://lists.riseup.net/www/info/cypherpunks-ger best wishes, dp -- apt-get install anarchism

1 0

(re: that old-time crypto.religion) deux
by brian carroll 07 Nov '13

07 Nov '13

(another layer of interpretation)... (A=B) manipulation pseudo ------------ +---> TRUTH illusion | ------------ | subversion | E | FAITH-based | T | protection... ---+ H | | I | | C v | S verification | -------------- +---> TRUTH accountability -------------- legal & moral (A=A) foundation http://www.asciiflow.com/#Draw diagram can be imported to edit

1 0