July 2013 - cypherpunks - lists.cpunks.org

Re: [liberationtech] Interesting things in keyservers
by Eugen Leitl 17 Aug '16

17 Aug '16

----- Forwarded message from micah <micah(a)riseup.net> ----- Date: Sat, 20 Jul 2013 10:05:42 -0400 From: micah <micah(a)riseup.net> To: Micah Lee <micahflee(a)riseup.net>, 'liberationtech' <liberationtech(a)lists.stanford.edu> Subject: Re: [liberationtech] Interesting things in keyservers User-Agent: Notmuch/0.15.2 (http://notmuchmail.org) Emacs/24.3.1 (x86_64-pc-linux-gnu) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> Hi Micah! Micah Lee <micahflee(a)riseup.net> writes: > I'm working on a talk for OHM2013 about PGP. Can anyone send me examples > of interesting keys in key servers that you know of? Since you are preparing a talk about the subject, I'm going to be pedantic and correct your usage of "PGP", because it is important to get your terminology straight when giving a talk. I presume you aren't giving a talk about the commercial software, but instead you are actually giving a talk about OpenPGP which is the standard specified by RFC4880 that different programs like GnuPG, Seahorse, MacGPG, and PGP etc. all implement. If that is true, then you should refer to it as OpenPGP, and not PGP. I dont know what your talk will consist of, besides the funny enigmail XSS and goatse.cx stuff (thanks for that! always good to have some goatse early in the morning), but I would like to point out a few things that might be useful to mention. One is a wiki page that I created with some people: https://we.riseup.net/riseuplabs+paow/openpgp-best-practices - it contains some useful hints about using OpenPGP, maintaining a good key and some general good practices that people often dont know about (such as the importance of keeping your keys updated to get critical revocation and expiration extension certifications!) One thing mentioned on that page that I wanted to highlight, because you used pgp.mit.edu links in your original email, is that the keyserver pgp.mit.edu is not a good one to use/promote. Everyone uses it as their 'goto' keyserver, but it is a really bad idea! As a keyserver, it has been broken for years. For a long time it was just dropping revocations, subkey updates and expirations on the floor. That is *really* bad. Eventually, they upgraded their keyserver software, but it is *still* running an older version of SKS, a version that fails to handle 16-digit subkeyid lookups (among other failings). So, please don't rely on pgp.mit.edu for your security, and please don't include them in your slides! If you are looking for one to use, I highly recommend using the SKS pool address (hkp://pool.sks-keyservers.net or http://hkps.pool.sks-keyservers.net/ - or if you want a more close geographical pool, have a look at http://sks-keyservers.net/overview-of-pools.php) Finally, there seems to be some amazing misconceptions about keyservers, keys and the web of trust. In particular this http://cryptome.org/2013/07/mining-pgp-keyservers.htm circulated recently and it pained me to see because it suggested various wreckless conclusions that were dangerously off the mark[0] (and used pgp.mit.edu, hah). While it is true that we've jokingly called the OpenPGP web of trust "the original social network" because of the exposed social relational graphing that can be done by querying keyservers, and it is for this reason that many activists I know do not want to have signatures uploaded to keyservers (and instead use the bulky local-only signature work-around)... ... but for some reason people seem to think that if it is on a keyserver, is true, or it means something that it doesn't. People don't realize critical things, such as the fact that I can create a key with the UID Nadim Kobeissi and upload it to the keyservers[1]. That doesn't mean that is the real Nadim's key (this is what exchanging key fingerprints and doing certifications is for, so you can know, with a certain degree of certainty, that this person is the person who controls that secret key material). Or people think that because I signed your key and that signature is on the keyserver that indicates: I trust you; we met in person at that date; we know each other; we are involved in a criminal conspiracy with each other; or many other wrong assumptions about what that certification means. I can sign Edward Snowden's key and send that to the keyservers[1]. Hell, I can sign Snowden's key with my fake Nadim Kobeissi key[1] and then send it to the keyservers. Does that mean that Nadim and Snowden have met in person?! No, it does not at all. Anyways, I can keep going... but I dont know what the focus of your OHM talk is about, so going on like this isn't particularly useful to you and your talk... however, I'd be happy to provide more feedback about your talk if you would like![2] After all, we Micahs need to stick together, micah 0. "the cryptome article just sounds like impenetrable bullshit from someone with no interest in actually understandning what's happening" - I'm not saying who said this... 1. no, I didn't do that, nor did I upload the edward snowden or bradly manning keys. -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

4 3

Getting started
by stakewinner00 09 Aug '13

09 Aug '13

Hi, I'm 16 years old and I was searching in duckduckgo and Google for some material about cypherpunks but I not find nothing more than this mailing list and some deserted website. If someone can give me some more information, I would be very grateful. Sorry for my bad English and for the spam.

12 12

Urea at NSA Utah Data Center
by John Young 09 Aug '13

09 Aug '13

There are two spaces labeled "Urea Tank Room" in the NSA Utah Data Center's Generator Plant shown in construction drawings recently leaked: http://cryptome.org/2013-info/07/nsa-utah-dc/nsa-utah-dc.htm See Generator Plant floor plan drawing 11.2 A101 at bottom and top left, spaces labeled "UT." Urea is used in fuel cells. Are there other uses of urea in generator or data processing equipment?

6 6

Re: [cryptography] a Cypherpunks comeback
by Bill Stewart 08 Aug '13

08 Aug '13

>On Mon, Jul 22, 2013 at 3:41 AM, Adam Back <adam(a)cypherspace.org> wrote: > > Could you please get another domain name, that name is just ridiculous. Absolutely. I mean, has anybody actually used JFETs in recent years? :-)

6 8

Re: Cypherpunks
by John Young 07 Aug '13

07 Aug '13

Opposition, disgust, revulsion, ridicule toward al-qaeda is perfectly cypherpunkian. Never, ever unanimous nor what's acceptable without merciless, obnoxious, off-topic digression argument. "Fuck that to death." - A Sage "Cypherpunks" -- the name, the adventure, the rise and fall, and multiple rebirths and splits and plagiarisms -- has been subjected to as much irrational ridicule and exploitation as hyper-plagiarized "al-qaeda." "Cryptography" list is a bastard of a bastard of a bastard of cypherpunks, each iteration trying to act snooty about villanous cryptography and failing repeatedly to hide its cypherpunkian malice. There are thousands of vile and sappy posts in the cpunk archives as with the "fucked to death and still going" internet. Crud begets crud. Delete the crud and there's nothing left of the shit-hole except the gargantuan cesspools on Wayback and Wikipedia and Tor "hidden services" and blacknet and undernet and intel.net and virulent cheating, lying and fucking users and each other. Extra good shit:, big data crud is growing exponentially, a golden bowl of explosive fertilizer likely leading to global cyberwar over who runs the cess. Never ask for permission, never give it. Cross-sub everybody and spy them secretly.

5 5

Radiation Emission Controls
by John Young 02 Aug '13

02 Aug '13

An engineer formerly working at the National Radio Astronomy Observatory (http://www.gb.nrao.edu/nrqz/) lists its radiation emissions controls: http://cryptome.org/2013/07/radiated-emissions-control.htm Among them is the banning of vehicles which use spark plugs, thus diesel-fueled are required. Which suggests a question about radiation emissions at NSA Utah Data Center's 32 large generators. Since nearly all government and commercial data centers have generator back-ups, how are emissions from generators controlled? NRAO also "banned digital cameras down range after they proved quite noisy." Are noisy digital camera emissions more privacy threatening than phone signals? Is NSA harvesting those emissions?

4 4

Re: Max Blumenthal on Security Forum (Eugen Leitl)
by OTR 02 Aug '13

02 Aug '13

First, glad to be here. Missed the cypherpunks the first time around. I'm going to want to get to know you folks for my ongoing coverage of -- and book project on -- Snowden, NSA and the surveillance-industrial revolution. Second, while it's nice (and rather unexpected) to get a shout-out from Alternet, I wouldn't agree that every other journalist at Aspen was an acolyte. Michael Isikoff did a good job of pushing his panel, especially U.S. Attorney Neil MacBride, who is Snowden's designated prosecutor (and is trying to jail James Risen to force testimony in the Sterling leak case). Pete Williams is also a terrific reporter. He met charm with charm but gently walked Keith Alexander into a corner, eliciting unambiguous statements that the NSA will have to defend as time goes on. Plus, he called on people he knew would ask tough questions. Oh, and yes, Aspen covered my travel costs. I assume it did the same for others. No speaker fee was offered or requested. On 7/30/13 12:00 PM, Eugen Leitl <eugen(a)leitl.org> wrote: Subject: Max Blumenthal on Security Forum (it's Alternet, so caveat lector) http://www.alternet.org/tea-party-and-right/shocking-extermination-fantasie… [...] With perhaps one notable exception, none of the high-flying reporters junketed to Aspen to act as interlocutors seemed terribly interested in interrogating the logic of the war on terror. The spectacle was a perfect window into the world of access journalism, with media professionals brown-nosing national security elites committed to secrecy and surveillance, avoiding overly adversarial questions but making sure to ask the requisite question about how much Snowden has caused terrorists to change their behavior. Jeff Harris, the communications director for the Aspen Institute, did not respond to questions I submitted about whether the journalists who participated in the Security Forum accepted fees. (It is likely that all relied on Aspen to at least cover lodging and travel costs). [...] "You have to do [domestic surveillance] within a closed bubble in order to do it effectively," Dennis Blair, the director of National Intelligence conceded under sustained grilling from the Washington Post's Barton Gellman, one of the reporters who broke Snowden's leaks and perhaps the only journalist at the Security Forum who subjected participants to tough scrutiny. When Gellman reminded Alexander that none of the oversight mechanisms currently in place could determine if the NSA had improperly targeted American citizens with no involvement in terror-related activity, the general declared, "we self-report those mistakes."

3 2

XKeyscore: More fun with NSA
by Karel Bílek 02 Aug '13

02 Aug '13

http://www.theguardian.com/world/2013/jul/31/nsa-top-secret-program-online-… http://www.theguardian.com/world/interactive/2013/jul/31/nsa-xkeyscore-prog… (adding some keywords for NSA and the link to the latest issue Al-Qaeda Inspire magazine for good measure) Bin Laden أسامة بن محمد بن عوض بن لادن Al-Qaeda القاعدة Jihad جهاد‎ Boston marathon تفجيرا ماراثون Hamas حماس‎ Hezbollah حزب الله http://azelin.files.wordpress.com/2013/05/inspire-magazine-issue-11.pdf http://azelin.files.wordpress.com/2013/05/inspire-magazine-issue-11-ar.pdf

2 1

Re: XKeyscore: More fun with NSA
by John Young 01 Aug '13

01 Aug '13

Thanks for the links. Great to see Guardian is again releasing a full document rather than editorial blather. At 10:01 AM 7/31/2013, you wrote: >http://www.theguardian.com/world/2013/jul/31/nsa-top-secret-program-online-… > >http://www.theguardian.com/world/interactive/2013/jul/31/nsa-xkeyscore-prog… > >(adding some keywords for NSA and the link to the latest issue >Al-Qaeda Inspire magazine for good measure) > >Bin Laden >ÃÓÇãÉ Èä ãÍãÏ Èä ÚæÖ Èä áÇÏä >Al-Qaeda >ÇáÞÇÚÏÉ >Jihad >ÌåÇÏý >Boston marathon >ÊÝÌíÑÇ ãÇÑÇËæä >Hamas >ÍãÇÓý >Hezbollah >ÍÒÈ Çááå > >http://azelin.files.wordpress.com/2013/05/inspire-magazine-issue-11.pdf >http://azelin.files.wordpress.com/2013/05/inspire-magazine-issue-11-ar.pdf

3 2

Re: cypherpunks Digest, Vol 1, Issue 20
by Joseph Tag 01 Aug '13

01 Aug '13

Best "intro" of CypherPunks I found was in The New York Times magazine ( mentioned PGP too ) .

1 0