December 2013 - cypherpunks - lists.cpunks.org

30c3: To Protect And Infect, Part 2
by coderman 30 Dec '13

30 Dec '13

so much asking for names, details, conspirators. so many months and months of nearly zero satisfaction. ... until: kudos Jake for delivering; specifically. :) "[QI vector] 30c3: To Protect And Infect, Part 2" http://www.youtube.com/watch?v=b0w36GAyZIA --- you can argue some subset of these attacks are exercised in a targeted manner, however, this does nothing to prevent collateral damage to domestic and global individuals, indiscriminately. fuck these guys![0] best regards, 0. fuck you, at least in so far as your offensive efforts to undermine privacy and liberty in the name of route tasking without restraint. to those who go privacy tech repurpose, i will sing your praises and support your efforts!

1 0

automated crash reporting XKeyscore hooks
by coderman 29 Dec '13

29 Dec '13

seems automated processes are a great XKeyscore source: "in practical terms, the NSA's agents... enjoy it because it allows them [a "neat way" to gain "passive access" to a machine] ... In one internal graphic, they replaced the text of Microsoft's original error message with one of their own reading, "This information may be intercepted by a foreign sigint system to gather detailed information and better exploit your machine." --- http://www.spiegel.de/international/world/the-nsa-uses-powerful-toolbox-in-… Inside TAO Documents Reveal Top NSA Hacking Unit By SPIEGEL Staff The NSA's TAO hacking unit is considered to be the intelligence agency's top secret weapon. It maintains its own covert network, infiltrates computers around the world and even intercepts shipping deliveries to plant back doors in electronics ordered by those it is targeting. In January 2010, numerous homeowners in San Antonio, Texas, stood baffled in front of their closed garage doors. They wanted to drive to work or head off to do their grocery shopping, but their garage door openers had gone dead, leaving them stranded. No matter how many times they pressed the buttons, the doors didn't budge. The problem primarily affected residents in the western part of the city, around Military Drive and the interstate highway known as Loop 410. In the United States, a country of cars and commuters, the mysterious garage door problem quickly became an issue for local politicians. Ultimately, the municipal government solved the riddle. Fault for the error lay with the United States' foreign intelligence service, the National Security Agency, which has offices in San Antonio. Officials at the agency were forced to admit that one of the NSA's radio antennas was broadcasting at the same frequency as the garage door openers. Embarrassed officials at the intelligence agency promised to resolve the issue as quickly as possible, and soon the doors began opening again. It was thanks to the garage door opener episode that Texans learned just how far the NSA's work had encroached upon their daily lives. For quite some time now, the intelligence agency has maintained a branch with around 2,000 employees at Lackland Air Force Base, also in San Antonio. In 2005, the agency took over a former Sony computer chip plant in the western part of the city. A brisk pace of construction commenced inside this enormous compound. The acquisition of the former chip factory at Sony Place was part of a massive expansion the agency began after the events of Sept. 11, 2001. On-Call Digital Plumbers One of the two main buildings at the former plant has since housed a sophisticated NSA unit, one that has benefited the most from this expansion and has grown the fastest in recent years -- the Office of Tailored Access Operations, or TAO. This is the NSA's top operative unit -- something like a squad of plumbers that can be called in when normal access to a target is blocked. According to internal NSA documents viewed by SPIEGEL, these on-call digital plumbers are involved in many sensitive operations conducted by American intelligence agencies. TAO's area of operations ranges from counterterrorism to cyber attacks to traditional espionage. The documents reveal just how diversified the tools at TAO's disposal have become -- and also how it exploits the technical weaknesses of the IT industry, from Microsoft to Cisco and Huawei, to carry out its discreet and efficient attacks. The unit is "akin to the wunderkind of the US intelligence community," says Matthew Aid, a historian who specializes in the history of the NSA. "Getting the ungettable" is the NSA's own description of its duties. "It is not about the quantity produced but the quality of intelligence that is important," one former TAO chief wrote, describing her work in a document. The paper seen by SPIEGEL quotes the former unit head stating that TAO has contributed "some of the most significant intelligence our country has ever seen." The unit, it goes on, has "access to our very hardest targets." A Unit Born of the Internet Defining the future of her unit at the time, she wrote that TAO "needs to continue to grow and must lay the foundation for integrated Computer Network Operations," and that it must "support Computer Network Attacks as an integrated part of military operations." To succeed in this, she wrote, TAO would have to acquire "pervasive, persistent access on the global network." An internal description of TAO's responsibilities makes clear that aggressive attacks are an explicit part of the unit's tasks. In other words, the NSA's hackers have been given a government mandate for their work. During the middle part of the last decade, the special unit succeeded in gaining access to 258 targets in 89 countries -- nearly everywhere in the world. In 2010, it conducted 279 operations worldwide. Indeed, TAO specialists have directly accessed the protected networks of democratically elected leaders of countries. They infiltrated networks of European telecommunications companies and gained access to and read mails sent over Blackberry's BES email servers, which until then were believed to be securely encrypted. Achieving this last goal required a "sustained TAO operation," one document states. This TAO unit is born of the Internet -- created in 1997, a time when not even 2 percent of the world's population had Internet access and no one had yet thought of Facebook, YouTube or Twitter. From the time the first TAO employees moved into offices at NSA headquarters in Fort Meade, Maryland, the unit was housed in a separate wing, set apart from the rest of the agency. Their task was clear from the beginning -- to work around the clock to find ways to hack into global communications traffic. Recruiting the Geeks To do this, the NSA needed a new kind of employee. The TAO workers authorized to access the special, secure floor on which the unit is located are for the most part considerably younger than the average NSA staff. Their job is breaking into, manipulating and exploiting computer networks, making them hackers and civil servants in one. Many resemble geeks -- and act the part too. Indeed, it is from these very circles that the NSA recruits new hires for its Tailored Access Operations unit. In recent years, NSA Director Keith Alexander has made several appearances at major hacker conferences in the United States. Sometimes, Alexander wears his military uniform, but at others, he even dons jeans and a t-shirt in his effort to court trust and a new generation of employees. The recruitment strategy seems to have borne fruit. Certainly, few if any other divisions within the agency are growing as quickly as TAO. There are now TAO units in Wahiawa, Hawaii; Fort Gordon, Georgia; at the NSA's outpost at Buckley Air Force Base, near Denver, Colorado; at its headquarters in Fort Meade; and, of course, in San Antonio. One trail also leads to Germany. According to a document dating from 2010 that lists the "Lead TAO Liaisons" domestically and abroad as well as names, email addresses and the number for their "Secure Phone," a liaison office is located near Frankfurt -- the European Security Operations Center (ESOC) at the so-called "Dagger Complex" at a US military compound in the Griesheim suburb of Darmstadt. But it is the growth of the unit's Texas branch that has been uniquely impressive, the top secret documents reviewed by SPIEGEL show. These documents reveal that in 2008, the Texas Cryptologic Center employed fewer than 60 TAO specialists. By 2015, the number is projected to grow to 270 employees. In addition, there are another 85 specialists in the "Requirements & Targeting" division (up from 13 specialists in 2008). The number of software developers is expected to increase from the 2008 level of three to 38 in 2015. The San Antonio office handles attacks against targets in the Middle East, Cuba, Venezuela and Colombia, not to mention Mexico, just 200 kilometers (124 miles) away, where the government has fallen into the NSA's crosshairs. Targeting Mexico Mexico's Secretariat of Public Security, which was folded into the new National Security Commission at the beginning of 2013, was responsible at the time for the country's police, counterterrorism, prison system and border police. Most of the agency's nearly 20,000 employees worked at its headquarters on Avenida Constituyentes, an important traffic artery in Mexico City. A large share of the Mexican security authorities under the auspices of the Secretariat are supervised from the offices there, making Avenida Constituyentes a one-stop shop for anyone seeking to learn more about the country's security apparatus. Operation WHITETAMALE That considered, assigning the TAO unit responsible for tailored operations to target the Secretariat makes a lot of sense. After all, one document states, the US Department of Homeland Security and the United States' intelligence agencies have a need to know everything about the drug trade, human trafficking and security along the US-Mexico border. The Secretariat presents a potential "goldmine" for the NSA's spies, a document states. The TAO workers selected systems administrators and telecommunications engineers at the Mexican agency as their targets, thus marking the start of what the unit dubbed Operation WHITETAMALE. Workers at NSA's target selection office, which also had Angela Merkel in its sights in 2002 before she became chancellor, sent TAO a list of officials within the Mexican Secretariat they thought might make interesting targets. As a first step, TAO penetrated the target officials' email accounts, a relatively simple job. Next, they infiltrated the entire network and began capturing data. Soon the NSA spies had knowledge of the agency's servers, including IP addresses, computers used for email traffic and individual addresses of diverse employees. They also obtained diagrams of the security agencies' structures, including video surveillance. It appears the operation continued for years until SPIEGEL first reported on it in October. The technical term for this type of activity is "Computer Network Exploitation" (CNE). The goal here is to "subvert endpoint devices," according to an internal NSA presentation that SPIEGEL has viewed. The presentation goes on to list nearly all the types of devices that run our digital lives -- "servers, workstations, firewalls, routers, handsets, phone switches, SCADA systems, etc." SCADAs are industrial control systems used in factories, as well as in power plants. Anyone who can bring these systems under their control has the potential to knock out parts of a country's critical infrastructure. The most well-known and notorious use of this type of attack was the development of Stuxnet, the computer worm whose existence was discovered in June 2010. The virus was developed jointly by American and Israeli intelligence agencies to sabotage Iran's nuclear program, and successfully so. The country's nuclear program was set back by years after Stuxnet manipulated the SCADA control technology used at Iran's uranium enrichment facilities in Natanz, rendering up to 1,000 centrifuges unusable. The special NSA unit has its own development department in which new technologies are developed and tested. This division is where the real tinkerers can be found, and their inventiveness when it comes to finding ways to infiltrate other networks, computers and smartphones evokes a modern take on Q, the legendary gadget inventor in James Bond movies. Having Fun at Microsoft's Expense One example of the sheer creativity with which the TAO spies approach their work can be seen in a hacking method they use that exploits the error-proneness of Microsoft's Windows. Every user of the operating system is familiar with the annoying window that occasionally pops up on screen when an internal problem is detected, an automatic message that prompts the user to report the bug to the manufacturer and to restart the program. These crash reports offer TAO specialists a welcome opportunity to spy on computers. When TAO selects a computer somewhere in the world as a target and enters its unique identifiers (an IP address, for example) into the corresponding database, intelligence agents are then automatically notified any time the operating system of that computer crashes and its user receives the prompt to report the problem to Microsoft. An internal presentation suggests it is NSA's powerful XKeyscore spying tool that is used to fish these crash reports out of the massive sea of Internet traffic. The automated crash reports are a "neat way" to gain "passive access" to a machine, the presentation continues. Passive access means that, initially, only data the computer sends out into the Internet is captured and saved, but the computer itself is not yet manipulated. Still, even this passive access to error messages provides valuable insights into problems with a targeted person's computer and, thus, information on security holes that might be exploitable for planting malware or spyware on the unwitting victim's computer. Although the method appears to have little importance in practical terms, the NSA's agents still seem to enjoy it because it allows them to have a bit of a laugh at the expense of the Seattle-based software giant. In one internal graphic, they replaced the text of Microsoft's original error message with one of their own reading, "This information may be intercepted by a foreign sigint system to gather detailed information and better exploit your machine." ("Sigint" stands for "signals intelligence.") One of the hackers' key tasks is the offensive infiltration of target computers with so-called implants or with large numbers of Trojans. They've bestowed their spying tools with illustrious monikers like "ANGRY NEIGHBOR," "HOWLERMONKEY" or "WATERWITCH." These names may sound cute, but the tools they describe are both aggressive and effective. According to details in Washington's current budget plan for the US intelligence services, around 85,000 computers worldwide are projected to be infiltrated by the NSA specialists by the end of this year. By far the majority of these "implants" are conducted by TAO teams via the Internet. Increasing Sophistication Until just a few years ago, NSA agents relied on the same methods employed by cyber criminals to conduct these implants on computers. They sent targeted attack emails disguised as spam containing links directing users to virus-infected websites. With sufficient knowledge of an Internet browser's security holes -- Microsoft's Internet Explorer, for example, is especially popular with the NSA hackers -- all that is needed to plant NSA malware on a person's computer is for that individual to open a website that has been specially crafted to compromise the user's computer. Spamming has one key drawback though: It doesn't work very often. Nevertheless, TAO has dramatically improved the tools at its disposal. It maintains a sophisticated toolbox known internally by the name "QUANTUMTHEORY." "Certain QUANTUM missions have a success rate of as high as 80%, where spam is less than 1%," one internal NSA presentation states. A comprehensive internal presentation titled "QUANTUM CAPABILITIES," which SPIEGEL has viewed, lists virtually every popular Internet service provider as a target, including Facebook, Yahoo, Twitter and YouTube. "NSA QUANTUM has the greatest success against Yahoo, Facebook and static IP addresses," it states. The presentation also notes that the NSA has been unable to employ this method to target users of Google services. Apparently, that can only be done by Britain's GCHQ intelligence service, which has acquired QUANTUM tools from the NSA. A favored tool of intelligence service hackers is "QUANTUMINSERT." GCHQ workers used this method to attack the computers of employees at partly government-held Belgian telecommunications company Belgacom, in order to use their computers to penetrate even further into the company's networks. The NSA, meanwhile, used the same technology to target high-ranking members of the Organization of the Petroleum Exporting Countries (OPEC) at the organization's Vienna headquarters. In both cases, the trans-Atlantic spying consortium gained unhindered access to valuable economic data using these tools. The NSA's Shadow Network The insert method and other variants of QUANTUM are closely linked to a shadow network operated by the NSA alongside the Internet, with its own, well-hidden infrastructure comprised of "covert" routers and servers. It appears the NSA also incorporates routers and servers from non-NSA networks into its covert network by infecting these networks with "implants" that then allow the government hackers to control the computers remotely. (Click here to read a related article on the NSA's "implants".) In this way, the intelligence service seeks to identify and track its targets based on their digital footprints. These identifiers could include certain email addresses or website cookies set on a person's computer. Of course, a cookie doesn't automatically identify a person, but it can if it includes additional information like an email address. In that case, a cookie becomes something like the web equivalent of a fingerprint. A Race Between Servers Once TAO teams have gathered sufficient data on their targets' habits, they can shift into attack mode, programming the QUANTUM systems to perform this work in a largely automated way. If a data packet featuring the email address or cookie of a target passes through a cable or router monitored by the NSA, the system sounds the alarm. It determines what website the target person is trying to access and then activates one of the intelligence service's covert servers, known by the codename FOXACID. This NSA server coerces the user into connecting to NSA covert systems rather than the intended sites. In the case of Belgacom engineers, instead of reaching the LinkedIn page they were actually trying to visit, they were also directed to FOXACID servers housed on NSA networks. Undetected by the user, the manipulated page transferred malware already custom tailored to match security holes on the target person's computer. The technique can literally be a race between servers, one that is described in internal intelligence agency jargon with phrases like: "Wait for client to initiate new connection," "Shoot!" and "Hope to beat server-to-client response." Like any competition, at times the covert network's surveillance tools are "too slow to win the race." Often enough, though, they are effective. Implants with QUANTUMINSERT, especially when used in conjunction with LinkedIn, now have a success rate of over 50 percent, according to one internal document. Tapping Undersea Cables At the same time, it is in no way true to say that the NSA has its sights set exclusively on select individuals. Of even greater interest are entire networks and network providers, such as the fiber optic cables that direct a large share of global Internet traffic along the world's ocean floors. One document labeled "top secret" and "not for foreigners" describes the NSA's success in spying on the "SEA-ME-WE-4" cable system. This massive underwater cable bundle connects Europe with North Africa and the Gulf states and then continues on through Pakistan and India, all the way to Malaysia and Thailand. The cable system originates in southern France, near Marseille. Among the companies that hold ownership stakes in it are France Telecom, now known as Orange and still partly government-owned, and Telecom Italia Sparkle. The document proudly announces that, on Feb. 13, 2013, TAO "successfully collected network management information for the SEA-Me-We Undersea Cable Systems (SMW-4)." With the help of a "website masquerade operation," the agency was able to "gain access to the consortium's management website and collected Layer 2 network information that shows the circuit mapping for significant portions of the network." It appears the government hackers succeeded here once again using the QUANTUMINSERT method. The document states that the TAO team hacked an internal website of the operator consortium and copied documents stored there pertaining to technical infrastructure. But that was only the first step. "More operations are planned in the future to collect more information about this and other cable systems," it continues. But numerous internal announcements of successful attacks like the one against the undersea cable operator aren't the exclusive factors that make TAO stand out at the NSA. In contrast to most NSA operations, TAO's ventures often require physical access to their targets. After all, you might have to directly access a mobile network transmission station before you can begin tapping the digital information it provides. Spying Traditions Live On To conduct those types of operations, the NSA works together with other intelligence agencies such as the CIA and FBI, which in turn maintain informants on location who are available to help with sensitive missions. This enables TAO to attack even isolated networks that aren't connected to the Internet. If necessary, the FBI can even make an agency-owned jet available to ferry the high-tech plumbers to their target. This gets them to their destination at the right time and can help them to disappear again undetected after even as little as a half hour's work. Responding to a query from SPIEGEL, NSA officials issued a statement saying, "Tailored Access Operations is a unique national asset that is on the front lines of enabling NSA to defend the nation and its allies." The statement added that TAO's "work is centered on computer network exploitation in support of foreign intelligence collection." The officials said they would not discuss specific allegations regarding TAO's mission. Sometimes it appears that the world's most modern spies are just as reliant on conventional methods of reconnaissance as their predecessors. Take, for example, when they intercept shipping deliveries. If a target person, agency or company orders a new computer or related accessories, for example, TAO can divert the shipping delivery to its own secret workshops. The NSA calls this method interdiction. At these so-called "load stations," agents carefully open the package in order to load malware onto the electronics, or even install hardware components that can provide backdoor access for the intelligence agencies. All subsequent steps can then be conducted from the comfort of a remote computer. These minor disruptions in the parcel shipping business rank among the "most productive operations" conducted by the NSA hackers, one top secret document relates in enthusiastic terms. This method, the presentation continues, allows TAO to obtain access to networks "around the world." Even in the Internet Age, some traditional spying methods continue to live on. REPORTED BY JACOB APPELBAUM, LAURA POITRAS, MARCEL ROSENBACH, CHRISTIAN STÖCKER, JÖRG SCHINDLER AND HOLGER STARK URL: http://www.spiegel.de/international/world/the-nsa-uses-powerful-toolbox-in-…

1 0

30c3: The Year in Crypto default engines loaded in openssl-1.x through openssl-1.0.1e]
by coderman 29 Dec '13

29 Dec '13

in 30c3: The Year in Crypto with djb, Nadia Heninger, Tanja Lange http://www.youtube.com/watch?v=Fty107Us7oc at ~28min discussion of RDRAND, Intel's pass the buck to NIST no-comment, (after initial "just trust us, we looked at a lab sample close" didn't fly far enough...) alt slides: hyperelliptic.org/tanja/vortraege/talk-30C3.pdf also, Tor 0.2.4.20 (Mon Dec 23 07:21:35 UTC 2013) updates to avoid direct RDRAND use in specific circumstances: https://lists.torproject.org/pipermail/tor-talk/2013-December/031483.html per previous discussion on OpenSSL use of RDRAND directly when engines on.[0] TL; DR - very rare case you may want to re-gen relay and hidden service keys now,, you may wonder if IETF could apply resistance to NSA seducing of NIST, but you'd be stepping into a quagmire :P http://arstechnica.com/security/2013/12/critics-nsa-agent-co-chairing-key-c… http://www.ietf.org/mail-archive/web/cfrg/current/msg03554.html [specifically, all of Dan Harkins "appeals for legitimacy" bear striking resemblance to other demonstratively failed approaches to failure by default designs. Dragonfly is not sufficiently justified. insert pleas to appeal to decency and step away from CFRG and IETF authority roles for propriety sake, regardless of any reasonable claims or other implications best exemplified by RSA[1]] also,, SIMON and SPECK is lulz; no really: fuck those guys! and remember that AES GCM is a choice between: - user-land side channels galore /or/ - hardware instruction back-door . . 2013 was indeed a year for crypto let's not do this again soon? best regards, 0. "BADRAND and testing OpenSSL engines enabled behavior with direct RDRAND engine" https://peertech.org/goodrand BADRAND lets you link a test version of your application or library against OpenSSL 1.0.1e that uses a specific sequence of deterministic "random numbers" in OpenSSL. e.g. standard C lib function rand() seeded at zero replacing RDRAND. the debug logging to stderr can identify bad fork() assumptions. 1. Dual-EC-DRBG is bad and RSA should feel bad. No excuses. https://gist.github.com/0xabad1dea/8101758 IETF standards not a good reference for "formal proof" level thoroughness, and highly deployed does not mean highly used nor scrutinized (WEP, LEAP, OpenSSL's Dual_EC_DRBG implementation, [the set is large]) X. "see that one top post ..." [was: RDRAND used directly when... On Sat, Dec 14, 2013 at 4:33 AM, coderman <coderman(a)gmail.com> wrote: > as per the FreeBSD announcement[0] and others[1][2] direct use of > RDRAND as sole entropy source is not recommended...

1 0

Boycott the RSA Conference - List of Honor
by gwen hastings 28 Dec '13

28 Dec '13

Well Kids, the RSA Conference is coming to the Bay area yet again, So far F-secure is worthy of Honor they have chosen to boycott the conference, as EVERY HONEST security and crypto firm/personnel should do.. the next few months will tell both us and the public who we can start to put on the naughty or nice lists.. Bravo to F-Secure and Mikko Hypponen, the beginning of Honest security consulting firms.. his reason quoted below “I don’t really expect your multibillion dollar company or your multimillion dollar conference to suffer as a result of your deals with the NSA. In fact, I'm not expecting other conference speakers to cancel. Most of your speakers are american anyway – why would they care about surveillance that’s not targeted at them but at non-americans. Surveillance operations from the US intelligence agencies are targeted at foreigners. However I’m a foreigner. And I’m withdrawing my support from your event.” http://www.theregister.co.uk/2013/12/24/fsecure_wont_speak_at_imperialist_l… And Trevor Pott Journalist from the Register is also boycotting.. http://www.theregister.co.uk/2013/06/08/what_about_a_us_tech_boycott/ Let the honor roll grow!! -- Governments are instituted among men, deriving their just powers from the consent of the governed, that whenever any form of government becomes destructive of these ends, it is the right of the people to alter or abolish it, and to institute new government, laying its foundation on such principles, and organizing its powers in such form, as to them shall seem most likely to effect their safety and happiness.’

2 1

Re: [p2p-hackers] The next gen P2P secure email solution
by grarpamp 28 Dec '13

28 Dec '13

On Wed, Dec 25, 2013 at 7:21 PM, Matthew Kaufman <matthew(a)matthew.at> wrote: > So there's already a system that until very recently did peer-to-peer > delivery of messages over encrypted channels between hosts that participated > in a peer-to-peer overlay. It was Skype. Afaik, skype used a central lookup to get to unknown peers, not a DHT. So they perhaps knew who wanted to talk to who. Of course now skype is untrusted by anyone with a clue. > And none of these proposed solutions are viable until there's a solve for > the very reason that Skype is moving away from P2P technology... and that is > that the majority of the billions of new users joining the Internet over the > next few years are doing so with the only Internet-accessing device they > have: a mobile phone. When they're on WiFi, the bandwidth is good, but they > sleep most of the time even in that case to preserve their otherwise meager > battery life... and when they're on 3G/4G, the bandwidth isn't as good and > it can be very expensive, and it burns the battery up even faster. Sure, there's a class of users that want this, a big class. They can have and use their modified legacy centralized email as they wish. There's another big class that want's something more than that. We're also going to see faster hardware, lighter code, and maybe even wearable battery packs... because as you say, these users want it all and are willing to go to almost any means to get it. There could also be ways to make the heavier weight anonymous routing p2p transport let these lightweight clients stub in just to make a direct p2p connection for encrypted voip/messaging (if say you published your node as accepting that option). > These users want to be able to send and receive messages when their device > is on, but the recipient's device isn't. Because most of the time, the > recipient's device, even if they put it in their pocket 10 seconds ago, is > already asleep, trying to preserve as much battery as possible. > > That pretty much eliminates all designs that do direct transfer from sender > to receiver, irrespective of the traffic analysis risks of doing so. > > Additionally, it also means that nearly all the participant nodes are also > unable to participate in a peer-to-peer overlay network, because they can't > afford the network uptime (and consequent battery drain) necessary. We're exploring ideas. What is to say we are able to develop into it some kind of automaton taho-lafs delivery storage nodes. Storing messages in transit under some expiry policy is not a huge space concern. So who knows. Maybe everyone with their uber important phones will end up VPN to their home/colo servers where the horsepower is. Predicting mobile is hard. Throw more apps out there and your $30-50/mo unlimited data plans go away. Now is everyone going to pay $150+/mo for that? Where is free open wifi going to end up spanning? And so many other things. What I think is clear is that there will for the far to indefinite forseeable future be some form of real workstation/laptop in the home and office. Phones just can't replace that. Maybe we're seeing something in how you see larger tablet/netbooks/laptops with headsets being carried about now as if it is natural. And lots of those people will want a highly secure system to communicate over with their peers in this new world of disgustingly gratuitous surveillance and databasing. I would not underestimate the demand for that sort of a comms system. > So we're back to fetching the email off of servers, and just having the > paths between the servers be over this magical new peer-to-peer network. > Only that's already approximately what we have now. That could be the multimodal thing above. Or the in network thing. > Oh, and those servers can do interesting things you can't do at the receiver > nearly so well, like correlate likely spam between recipients and drop it... > or detect viruses before they're delivered, and drop those. DSPAM, spamassassin, clamav and the like do fairly well enough on their own locally. I suggest not cataloging a defeatist list of what you think you can't do... but rather what you could do, what you would gain and what could happen if you build it :) > ps. And then there's the other unsolved problem: If you do actually build a > popular service that lets people securely exchange messages, the government > comes with an order to reveal the content of the messages, and threats to > lock up the principals if those demands aren't met. I wish I could tell you > more stories about this, but of course I'm subject to the same sorts of > non-disclosure that everyone else who's ever gotten one of those is. That's why you should be doing the development of these new protocols entirely within existing secure networks such as Tor and I2P. And why you should bootstrap via peers instead of clearnet authorities like Tor that can be shutdown... it's a little less secure, but you can have in network authorities wrapped in web of trust and then rejoin listening only to them later. And if clearnet get''s that bad, it becomes a freedom of speech issue which is well, SHTF time.

1 0

Article About a Secret Communication Channel in 1980's South Africa
by Alex J. Martin 27 Dec '13

27 Dec '13

This should be of interest to the list. I must credit the find to Schneier's blog: https://www.schneier.com/blog/archives/2013/12/operation_vula.html "Talking to Vula <http://www.anc.org.za/show.php?id=4693>" (http://www.anc.org.za/show.php?id=4693) is the story of a 1980s secret communications channel between black South African leaders and others living in exile in the UK. The system used encrypted text encoded into DTMF "touch tones" and transmitted from pay phones.

1 0

conceptual theatre (addenda)
by brian carroll 26 Dec '13

26 Dec '13

another approach to conveying ideas about surveillance through theater is via commentary on HDTV split-screen... +-------------------+--------------------+ | critique | television | | | show | | o 0 o | | | 0 | 0 | | ==> | 0 o | | | | | |o| ==> | /|\ <--> /\ | | o| o| | ==> | \ || | | | 0 | O | ==> | /\ || | | | | | | | | +-------------------+--------------------+ the aspect ratio could use or shrink a 4:3 aspect ratio for a given show or new content, and then alongside it, to the left have a call center or fundraising booth approach, in league with MSTK3 [3302032.9200] style commentary occurring simultaneously with commentary as satire or otherwise, given original or new content. for instance, an episode for existing or preexisting television comedy could be thus be recontextualized and reinterpreted via this approach, where the surveillance society would have attackers stealing pins via hidden card readers when an actor uses a cash-machine or purchases something at a cash register. likewise, make a phone call and the surveillers light up with commentary about what is going on, adding depth and counterpoint and absurdity into the illusion of the 'secure' context, presented as if normal and everyday. in this way, a theater approach could exist via such conceptual structure and provide a format to explore such ideas via advanced viewpoints and perspectives otherwise lacking or absent in their parallelism, as situations coexist in simultaneous, interacting hidden dimensions these dynamics and relations then, thresholds, boundaries, identity and awareness, as it relates to what is and is not observed, near and far, and how it is all put together or people remain oblivious to the context of their own existence via lack of information or legal protection from events, and shared and-or unshared quasi-'reality' - perhaps a form of wilderness, a condition of rogue ideology waiting for ideas capable of evaluating it [3302032.9200] Mystery Science Theater 3000 http://en.wikipedia.org/wiki/Mystery_Science_Theater_3000 hing (hen ated wid ional sta

1 0

conceptual theatre
by brian carroll 26 Dec '13

26 Dec '13

in times like these you might expect there would be music about what is going on, films investigating the concepts (many quite good actually), other activities, painters painting (a few) and so on, to establish depth to conversation and communication instead of enforcing ideological limits and functioning in limited parameters, reinforcing traditional feedback loops corruption relies upon especially plays, literature. perhaps some of the latter in its detachment or documentary aspects or parallels yet where is the cultural insight of those most free on earth- why the silence when searching for 'play on surveillance' that would have theater delving into realm of importance and providing critique, frameworks to evaluate ongoing situations within, instead of- well, seemingly nothing. - of - the - most - free - people - in - the - entire - world - with nothing to say or views to share about this situation, not using their rights or freedoms -- adding up to nothing fucking disgraceful. shameful, self-indulgent, self serving hypocrisy. as if bureaucracy must sign off on everything. no allowable risk. disneyification of the entirety of culture, endless reruns of previous ideas and interpretations yet no one with enough insight to frame this given picture? or is it fear that holds people back, silence is safety no one willing to take a stab at it, and then another to regain a space and place lost to complacency and lack of will, responsibility, greater purpose than money certainly playwrights of the past would have engaged, though what about direct engagement, for understanding to model the situation and evaluate it as only theater can do, to create other atmospheres that capture these situations and make what is ineffable due to abstractness tangible, realized, understood, and relatable through use of actors and storytelling and stage and props, scenery my contribution to this, as a structural idea for plays about surveillance society, free for use as a concept: that a stage with one person, at other times two people (or more) could exist as if on a basketball court, whereby bleachers would exist on either side of the main area 1) this could involve a central stage with two bleacher wings, splayed out facing an audience as if vanishing perspective 2) else it could be an actual school gymnasium with large bleachers where a theatric performance takes place see: concept for stage design and structure for play https://www.dropbox.com/s/pic7z1x1sqdj8az/concept.gif here is the idea. people in the bleachers are surveillers, they may either sit on the sidelines, and then aspects of the play could move in parallel in these other dimensions (geospatial, store tracking, license scanning, credit card history, database mining and advertising, listening to calls and keyword mapping, metadata, tracking receipts, etc) in version 1 (above) they would then be functioning the _background, otherwise invisible to the people in the center of their daily lives, behind this hidden threshold of rules, laws, language that forbids understanding of this condition at the same time it defines the existence and actions of the people warping or skew of data, the hypocrisy of tracking details by companies or reselling of data, public-private profit strategies, extortion, blackmail, political abuse, marketing, web adverts, social network mapping, any of this commentary introduced into this position of the actors at center stage as they relate with others, such as using the phone or a computer, as this links to people or topics, 'feedback' as various events occur in version 2 (above) the same dynamics could occur though with plants in the audience, sitting amongst others in the bleachers, perhaps people wearing all black suits, dark glasses, holding strange equipment, and instructions for those in the bleachers to relay messages (the telephone game) where a signal is passed along regular routes and thus input is transformed by output, then passing this data back into the play, as improvisation. for instance, a "secret" could be passed into the bleachers by an informant, and then by a defined route, 10 or 15 people in a given line or sequence (marked by graphics) could be part of this flow of data, having to relay what they heard one to the next, to get the data to the black suited mystery people, and thus the message they receive is then output as signal back into the play, to those center stage or others who are inacting with it, such that 'traveling to sign-ville' then becomes 'unraveling the dollar bill' when later output, etc thus, this kind of conceptual format would allow creative expression and exploration of issues, perhaps it would be best and most informed by technical consultation with privacy or security and-or other experts, including data from those surveilled, such that a larger sense of what this involves could be sketched for citizens so that its impact and importance could be gauged in a context of daily living, to what extent this data gathering and this tracking and watching is going on, and what principles it is currently be driven by and how laws do not exist that can constrain its functioning against citizens day to day, and that everyday situations involve these dimensions and issues of privacy, security, and such exploitations playwrights have the unique skills to convey such cultural messages and raise consciousness, and do it in a memorable and intriguing and innovative way. where is the equivalent of the Snowden of playwrights, perhaps such a format could be reinterpreted by a dozen or more playwrights, from varying angels or degrees or settings. what if the structure is modular, and can add, subtract, or modify the ideas of other plays using this structure, and thus open or free source the play for interpretative exploration and development. it is the information and the perspective that is important, the truth of what is going on. theaters are places for living ideas, not the continual regurgitation of those dead and lifeless as if highest value or truth. there is missing data of today, who is willing to approach to present and convey what it involves, using all the resources available to transmit important information and ideas, start and sustain the conversation beyond its existing, stifling boundaries freedom does not exist if it is not made use of. and it goes away if seeking permission to do something, because somewhere along the line it may involve risk. but isn't it worth trying to do something and seeing what the real situation is, and then knowing from that, then to not even try, not even do anything, and supposed to know by not taking it on, accepting defeat without ever fighting there have got to be some playwrights willing to take on these issues. if they exist, hopefully so, it would be interesting to see what such plays involve in their content and approaches to conveying and conceptualizing issues of cyberspace, hacking, surveillance, attacks, and so on 929-2010 780-2888 810-4356

1 0

blackflag operations
by brian carroll 25 Dec '13

25 Dec '13

// proposed relevant to cypherpunks considerations... at a certain point in my independent research it was realized that the US flag itself represented the existing problem encountered with ideology and rule-following that automatically functions against core principles, such that 'the stars' were of false constellations and 'the stripes' were more those of prison bars, to hold the population captive inside a hierarchical top-down structure, which i equate with a conceptualization in Networks of Power, of system, order, and control [1] as it determines economic, social, political dynamics. thus the US flag, its symbolism, is part of the problem in terms of its rigid adherence, especially in a realm of patriotism and xenophobia, such that it appears to deign reasonable the US as world empire without questioning its own failures or correcting for them, only extending it further outward, which then serves policies the hidden US dictatorship perfectly, as long as silence is upheld and no communication is possible about these issues. (that is, in terms of reasoning of empirical truth as this would be observed by the law as the basis for power, versus making the constitution a relativistic document interpreted via power determining what the signs mean) in this way, so too the powerplant and grid of development that underlines present-day civilization, a centralized and hidden realm of top-down power and control governed by private interests said to function on behalf of the public, yet with little evidence of this within ruins of the planet. in other words: power delivery is related to governance. and how power flows in one-direction and 'represents' certain goals and ideals that do not map into the local issues or shared values beyond a certain framework or mindset that makes monetary profit is greatest truth. and yet truth does not work this way. which is to say, it is not invalidated by ignoring or censoring it out of existence within these domains, it still exists though is isolated, disconnected, and thus loses its power via a false-worldview that takes its place via lies and deception, a shared illusion that is ungrounded yet sustained in a bubble, antihuman in word and deed. in terms of consciousness, much of this is known and experienced day to day, life to life, yet remains uncommunicable due to the loss of language, the absence of connection in realistic terms, about this inhuman condition, the center of civilization becoming that of nothingness, of lost souls at the core of it, this essential vacancy of meaning, devaluing of knowledge beyond what interests and benefits those in authority, and thus a seemingly irrational situation exists and is mediated, one by one, that does not add up nor does it make any sense, part to whole, because all is left is fragmented and misaligned, dumbed down, warped and skewed such that a hall of fun-house mirrors is the limit to daily reflection in status quo relations, as nothing more can be said than some finite limit where the basic situation cannot even be acknowledged, so hostile is the background and near-field effects, that any error or wrong thought could jeopardize survival and force a person into exile or worse, via all-seeing accountants for conformity, verifying and making sure the brain washing is effective, all remain followers of the ideological framework, staying within its confines and so knowing is disconnected for saying or even thinking, people detached from themselves and others and then to awake and find oneself situated in this way; essentially without being, without access to their own true nature or capacity or abilities, instead neutered by what is now convention, via subversion, deception electromagnetism as the context for the US flag then recontextualizes some questions of vexillology [2], in that evaluating the symbolic structure of the flag in its relation to electrical infrastructure as a system of power that extends beyond electricity into issues of politics of the state, including waging of war for natural resources, and likewise systems based on this ordering, visualized in urban and rural artifacts of transmission pylons and distribution poles, then provides further context for the issues of control - including 'surveillance' in this same top-down structure, which serves the hierarchy firstly, to retain its existing historical organization, however hollowed out and corrupted, used as a false-flag op in thinking through issues of endless war in the Middle East and the nonsensical War of Error as it relates to failure of ideas to govern state actions and instead submission to faith in leadership and hidden policies and political agendas, antihuman in ideology and nature, due to their inaccuracy, loss of capacity in thinking and language that then functions against citizens and life, instead of on behalf of these -- this situation then becoming 'source code' and program based on flawed and wrong-minded processing of actions, using, relying upon, exploiting loopholes in the US constitution as basis for what is possible, this becoming morality and ethics and its own truth, the danger of action being untethered from grounded reasoning and instead FAITH-BASED in ideology of rightness, with no remaining checks and balances after the orchestrated power grab, post-coup (41) in which the state is opposed to truth that does not serve and submit to this hidden agenda as highest what have you then, as a citizen in this situation, do you benefit or are your days numbered as you wait, channeled into the correct chutes for awaiting cattle cars, death panels and Obamacare first steps enough is enough, sanity must regain its place, and reason based in grounded truth must be secured for anything other than this automatic decline to continue into a realm of pure hate and unrestrained evil, driven by the state in its godless construction and operation in this way, US Blackflag operations were called for to regain control over the state and its actions via an emergency measure built into the constitution that allows a constitutional convention to be called if or when the state goes off course due to legal guidelines once written yet which function against the very principles they stand for and thus, to raise the Blackflag as the symbol and sign of this human citizen, to reclaim control over the shared state and its governance, and remove the existing US flag from its role as oppressor of its own and other populations, in that the truth of the US Constitution has become decoupled from its accounting in logic, beyond that of shared opinion within language (sign=sign based pattern matching), such that the views 'believed' are ideological, based and reliant upon ever shifting relativism that maps to motives of power & authority over this process of interpretation, as institutionalized, this the very structure of society, politics, economics, yet within a bubble view that cannot be falsified, contested, debated even (see: closed, onesided mass media), and this as the authority, the 'mind' at the top of the machinery, that sees and observes everything in this warped, unreal self-serving viewpoint, that what is good for it is the best for everybody, any number of rationalizations reinforcing this viewpoint, and yet no error correction anywhere allowed, especially in a legal context, because truth itself has been outlawed thus the ability to critique or correct the malfunctioning of the state is an impossibility, given the loss of reasoning that no longer relies upon empirical truth for verification and validation of processes, and instead 'shared belief' and a 'superior knowing' takes this place, without anchor to truth outside a binary simplism, yet beyond correction for its errors, because they can be ignored, denied, and the other side destroyed, as is necessitated ideologically; one side must lose for the other side to win, these "rules" blackflag would counter this coup and takeover of the state by a hostile invading population by regaining legal control over its decision-making and accounting for events in terms of accountable truth, not allowing secrecy and privilege to stand-in for assurances of 'good intentions' underneath it all, at the same time those opposed to institutionalized criminality are being weeded out of civilization one by one, via surveillance and attacks against basic existence and subsistence, those of the traitorous state having been empowered by the takeover to go the next step, the purging of dissenters and dissidents, of any who threaten their agenda, privatizing the public realm and denying services to those not of their shared demographic in this way, so too, US taxes serving this group primarily as others go without or are attacked by these same services, health care becoming administering of disease and death, social services to increase helplessness and incapacitation, maximizing profits while engineering conditions impossible to survive, thus crushing the life out of those at the bottom and making each year more difficult than the last, death as if a gift, it cannot arrive early enough, genocide as if mercy my first attempt at conveying these ideas was to recolor the US flag as all black while retaining its stars and stripes as the structure[3]. the problem with this was that it revealed the ideological formatting of the state, in its rigid lines and ordering that are the manifestation of this corruption of the historic compact between individuals & larger organization, and how governance at the top requires imprisoning those below, as part of the warped structural dynamics relied upon and thus injustice built-into the system, its foundation, this notably in 'mankind' as the shared identity, this privatized viewpoint scaled to the public allowing any individual to act in pure selfishness without regard or responsibility to others- this enshrined in law, outdated as viewpoint, 'the public' does not exist in this state beyond an 18 century notion, and this is exactly how this corruption is allowed operate today, by not acknowledging this condition and correcting it in law- which requires logic, 3-value and N-value logic, to prove the binarist viewpoint wrong though also immoral, illegal, unethical, and yet this very 'reasoning' is forbidden today. i began to sew, having a black nylon technical fabric, the goal being to generate a more accurate structure for the flag that would reflect or in some way represent the actual dynamics of truth within society, these ideals and principles of the US constitution in a shared human context, where both men and women are equal as citizens, and that people operate in different conditions yet function together as part of a larger dynamic, an ecosystem that becomes the state via a decentralized and distributed organization, scaling from local to national if global contexts, conditions, situations, aligned via shared dimensions, truth as value the flag that resulted [4] has a slightly different symbology. there are many stars, points of light, though some of these become larger stars via their connected patterning (that is, points connect or scale up into larger star structures, and some may be separated at any moment & other combined) the goal was to demonstrate that constellations of people or ideas can form, amongst points of individuals, organize into patterned structures that form a basis for shared order, and while in the photograph of the flag it is not visible, there are various regions or boundaries for these relations/events, where some of these points and stars exist within the same limits and others exist beyond or outside a given threshold. (there were additional close-up photos though i do not have most any of my work archived, though the language of the zigzag stitching defined these various regional boundaries, that then translates into near or far within larger ecosystem) add to this then the linking or networking of these 'stars', that for me are based on the butterfly paper clamp and also on the star as a high-voltage transmission pylon or tower, in this way, structural interconnections can be conceptualized as -p-o-w-e-r-l-i-n-e-s- and also as the invisible lines that link together constellations invisibility mapping out the night sky as stars and structures relate, and capture or model meaning, to include helping with navigation, awareness, and worldview in this sense pattern recognition is structural, foundational, and connections and relations between people in shared truth is this larger empirical awareness, emerging from relativistic scenarios, as truth is aligned amongst people and related to and through, in changing dynamics, shared state as circuitry and information processor, logical reasoning and organization, this _ground-up leveling of awareness, ideas, intent, action, virtue, truth, justice, development, higher purpose, ideals in this way, so too, power delivery, locally to regionally and how it scales based upon its shared relation with truth and those who serve it, as this contrasts with the US flag and its institutionalization where such dynamics are disallowed, and people are silenced in these relations, truth vanquished, something else taking hold, terrorizing citizens in its place this call for the blackflag to rise and replace the corrupt US government by legal means, regaining control of the failed state via constitutional right, then is a challenge to the reigning falsity that rules and politically 'governs', using its power against citizens to secure its power indefinitely, relying on illegal means and methods beyond accountability due to secrecy and privacy that only applies to oppressors, while such protections are removed for enemies and used to exploit and force the downfall of those who live here the language then may become shared, that yes, such high insanity must be acknowledged and thus the charade can be further extended to allow continuing control as these subversive others continue to attempt to control the reins of state action, at any cost. and thus mimicry could exist that seeks to 'represent' this cause via a traditional mindset that is corrupted by ideology and "believes" something other than what is said, serves some unacknowledged agenda or view, that is only camouflaged by the flag, and thus is assumed to retain control, whatever the shifting dynamics by relying on the same structures to persist, whatever the new color in this way, the blackflag yet another false flag for these traitors who would exist alongside those involved, grounded within this structural awareness of truth, its transparent and logical accounting beyond skewed binary onesidedness. a realm of imposters, mimics, cheats and frauds thus would continue and yet to juxtapose, compare and contrast these dynamics, it should be clear that 'the rationale' is entirely different for these two flags [5], they are not the same idea, and do not sustain the same beliefs, principles, or ordering they are actually set against one another in this very moment, as changes begin to be wrought and pressures exist that still constrain such actions, based upon resistance, power and authority based on forbidding what is best for human citizenry the ideological grid of the present is a cage, a prison camp purpose-built for human holocaust whereby truth is denied and eventually outlawed, nonexistence as the present day, people trapped and existing inside an illusion, not living, only trying to sustain themselves, keep breathing in the cemetery in this condition, this separation into many, the individual parts begin communicating, realize connections in grounded truth that establish this empirical framework needed, and it involves taking down the walls built by the state, its prison bar stripes and false-stars and false-constellations based on emulation, the state as hollywood movie production, leaders as actors playing a role on the world stage, versus addressing issues that exist and being held accountable for such 'representation' driven by taxation that grows this machinery while seeking to extinguish citizens inside who do not obey or are the enemy of those with power. that is what can be seen within various signs and symbols, language, calculus, patterns & geometry the difference between these flags is the difference between ideas and ideology, shared truth versus shared falsity and lies, freedom versus imprisonment, responsibility versus greed and unfettered selfishness, duty in opposition to vanity and frivolity, the network versus the grid, being vs. nothingness, humanity versus antihumans, individuals vs. institutions, democracy of human citizens versus corporate democracy, empirical reality versus relativistic madness, and philosophy versus psychiatry the existing US flag is the embodiment of politics that replace the truth with its antithesis which becomes a basis for power, the blackflag is all about governance, between people who create and compose the larger state via empirical reasoning that is based in truth, accounted for and error corrected by logic, and held accountable and required to change, improve its functioning, not given the right to ignore its obligations to people, life, nature, and the larger order it is situated within the delivery of power will one day arrive, deliverance from this corrupted condition, within a organized coherent agenda that regains control over this automated machinery serving wrong principles and wrong ideas and wrong thinking and beliefs. there are two orders, represented by these flags. one of them is aligned with falsity and serves it for its own benefit. the other serves truth, firstly and wholeheartedly. it is about how the constitution of a person aligns with those around them and how this scales and relates and is represented by the state. the false have their flag. recoloring it is not going to change anything structural, which is required for the oppression and exploitation to continue. it can only and must be destroyed as an institutionalized structure to regain control over the failed state, as the US constitution outlines and allows. the nature of truth is conceptualized in the other flag, its blackness has depth and grounding in principles that reflect those of its people and those who sacrifice and serve, for greater truth and higher principles than the base and monetary as if the meaning of life eternal in other words, no longer will the body govern over the mind, no longer will the grid determine the network, nor ideology the truth of ideas. and indeed there is a binary condition that exists in this situation- between truth and pseudo-truth, where actual truth grounds to 1 and pseudo-truth to falsity (0). in this way there is only one value, it is truth. all or nothing. the US state needs to be brought under constitutional control, destroy the existing dictatorship, and draft a new constitution i for one stand against the ongoing criminality of the state and vote the military take control of its functioning to secure its actions from those hostile to human citizens and our future [1] Networks of Power - Thomas P. Hughes http://en.wikipedia.org/wiki/Thomas_P._Hughes [2] Vexillology http://en.wikipedia.org/wiki/Vexillology [3] black US flag https://www.dropbox.com/s/wyazpebuo9ilzjd/usflag_black.jpg [4] blackflag https://www.dropbox.com/s/m66fp09796k4h6x/blackflag.jpg [5] dual black flags https://www.dropbox.com/s/s3vw6pbrmbl8v2q/dual_blackflag.jpg Alexander Calder 1974 stabile Black Flag http://vintagehudsonvalley.files.wordpress.com/2011/03/stormking-031811.jpg…

1 0

The next gen P2P secure email solution
by grarpamp 25 Dec '13

25 Dec '13

On Wed, Dec 25, 2013 at 8:21 AM, Jeremie Miller <jeremie.miller(a)gmail.com> wrote: > This thread seems pretty immense and in various places, what's the best way to contribute to it? > > I'm pretty keen on the topic, been working on /real/ p2p infrastructure for 5+ years now :) I'm not sure that it has a proper home. I do not suggest metzdowd, which is where I think you picked it up. cypherpunks has the most thread content to date. Though p2p-hackers is perhaps best for now unless anyone else has a better idea? ie: another p2p centric list with a good bit of anonymity and crypto representation. p2p-hackers is having delivery issues at the moment so maybe continue to cc cypherpunks for another week till that is sorted out.

1 0