July 2013 - cypherpunks - lists.cpunks.org

how much havoc can a compromised baseband do to a Guardian ROM device?
by Eugen Leitl 29 Jul '13

29 Jul '13

Anyone knows whether a Nexus 4 baseband processor has r/w access to system memory? The firmware doesn't seem to be loaded at boot, so I presume it's entirely out of reach/ reversing?

2 1

Stronghold, revisited
by tz 29 Jul '13

29 Jul '13

Way back when I was writing SSLeay encrypting proxies so Lynx could use them, there was a commercial product called StrongHold. I apologize for my insufficient memory. However much of the problem with forcing browsers to update might be solved with an encryption proxy (on a raspi if needed). For those who are too young to remember, during the "crypto is munitions" period where the source to strong crypto needed to be sent via FAX, Stronghold was a proxy that would take ordinary sessions (or I assume 40 bit - yes, 40 bit, that was "export" strength) crypto on the browser end and transform it to the maximum strength on the remote end. IE apparently has some problems with PFS. One way to maybe fix this is to create an encrypting proxy that would do full strength, PFS encryption and remove the other weaknesses, and run on the local machine or LAN (if that isn't secure there are bigger problems). And it would refuse or at least complain if the strength wasn't up to snuff, and could itself add things like cert/CA validation management - trust on first time and the rest as options. If I had a box (DD-WRT?) that would warn me if something was amiss, I would be in a better position.

2 1

Redecentralize podcast on the Cryptosphere
by Tony Arcieri 29 Jul '13

29 Jul '13

Ohai various lists. Here's what I've been working on. Hope you like it. If you want to chat and you happen to be coming to DEFCON, hit me up. https://www.youtube.com/watch?v=NjOqYZzWqI0 Links: - Cryptosphere: http://cryptosphere.org - Celluloid: http://celluloid.io/ - Oasis.js: http://oasisjs.com/ - Conductor.js: https://github.com/tildeio/conductor.js - Xanadu: https://en.wikipedia.org/wiki/Project_Xanadu - Tahoe-LAFS: https://tahoe-lafs.org/trac/tahoe-lafs -- Tony Arcieri

1 0

<nettime> John Naughton: Edward Snowden's not the story. The fate of the
by Eugen Leitl 28 Jul '13

28 Jul '13

----- Forwarded message from Patrice Riemens <patrice(a)xs4all.nl> ----- Date: Sun, 28 Jul 2013 09:47:11 +0200 From: Patrice Riemens <patrice(a)xs4all.nl> To: nettime-l(a)kein.org Subject: <nettime> John Naughton: Edward Snowden's not the story. The fate of the Reply-To: a moderated mailing list for net criticism <nettime-l(a)mail.kein.org> original to: http://www.guardian.co.uk/technology/2013/jul/28/edward-snowden-death-of-in… Edward Snowden's not the story. The fate of the internet is John Naughton The Observer, Sunday 28 July 2013 The press has lost the plot over the Snowden revelations. The fact is that the net is finished as a global network and that US firms' cloud services cannot be trusted Repeat after me: Edward Snowden is not the story. The story is what he has revealed about the hidden wiring of our networked world. This insight seems to have escaped most of the world's mainstream media, for reasons that escape me but would not have surprised Evelyn Waugh, whose contempt for journalists was one of his few endearing characteristics. The obvious explanations are: incorrigible ignorance; the imperative to personalise stories; or gullibility in swallowing US government spin, which brands Snowden as a spy rather than a whistleblower. In a way, it doesn't matter why the media lost the scent. What matters is that they did. So as a public service, let us summarise what Snowden has achieved thus far. Without him, we would not know how the National Security Agency (NSA) had been able to access the emails, Facebook accounts and videos of citizens across the world; or how it had secretly acquired the phone records of millions of Americans; or how, through a secret court, it has been able to bend nine US internet companies to its demands for access to their users' data. Similarly, without Snowden, we would not be debating whether the US government should have turned surveillance into a huge, privatised business, offering data-mining contracts to private contractors such as Booz Allen Hamilton and, in the process, high-level security clearance to thousands of people who shouldn't have it. Nor would there be -- finally -- a serious debate between Europe (excluding the UK, which in these matters is just an overseas franchise of the US) and the United States about where the proper balance between freedom and security lies. These are pretty significant outcomes and they're just the first-order consequences of Snowden's activities. As far as most of our mass media are concerned, though, they have gone largely unremarked. Instead, we have been fed a constant stream of journalistic pap -- speculation about Snowden's travel plans, asylum requests, state of mind, physical appearance, etc. The "human interest" angle has trumped the real story, which is what the NSA revelations tell us about how our networked world actually works and the direction in which it is heading. As an antidote, here are some of the things we should be thinking about as a result of what we have learned so far. The first is that the days of the internet as a truly global network are numbered. It was always a possibility that the system would eventually be Balkanised, ie divided into a number of geographical or jurisdiction-determined subnets as societies such as China, Russia, Iran and other Islamic states decided that they needed to control how their citizens communicated. Now, Balkanisation is a certainty. Second, the issue of internet governance is about to become _very_ contentious. Given what we now know about how the US and its satraps have been abusing their privileged position in the global infrastructure, the idea that the western powers can be allowed to continue to control it has become untenable. Third, as Evgeny Morozov has pointed out, the Obama administration's "internet freedom agenda" has been exposed as patronising cant. "Today," he writes, "the rhetoric of the 'internet freedom agenda' looks as trustworthy as George Bush's 'freedom agenda' after Abu Ghraib." That's all at nation-state level. But the Snowden revelations also have implications for you and me. They tell us, for example, that no US-based internet company can be trusted to protect our privacy or data. The fact is that Google, Facebook, Yahoo, Amazon, Apple and Microsoft are all integral components of the US cyber-surveillance system. Nothing, but nothing, that is stored in their "cloud" services can be guaranteed to be safe from surveillance or from illicit downloading by employees of the consultancies employed by the NSA. That means that if you're thinking of outsourcing your troublesome IT operations to, say, Google or Microsoft, then think again. And if you think that that sounds like the paranoid fantasising of a newspaper columnist, then consider what Neelie Kroes, vice-president of the European Commission, had to say on the matter recently. "If businesses or governments think they might be spied on," she said, "they will have less reason to trust the cloud, and it will be cloud providers who ultimately miss out. Why would you pay someone else to hold your commercial or other secrets, if you suspect or know they are being shared against your wishes? Front or back door -- it doesn't matter -- any smart person doesn't want the information shared at all. Customers will act rationally and providers will miss out on a great opportunity." Spot on. So when your chief information officer proposes to use the Amazon or Google cloud as a data-store for your company's confidential documents, tell him where to file the proposal. In the shredder. # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

SSLegance
by tz 28 Jul '13

28 Jul '13

For the interim, the solution might be to have an extension that besides pushing PFS (and alerting when it doesn't work) would cache the Cert hashes or more and allow a browser (e.g. firefox) to run with all CAs as untrusted, but then do a verification on a per-site basis. The big hole in web page security is that there is the web page, then there is the extra info like javascript and css. So, for example, https://amazon.com might be accepted, but https://images-na.cdn.azws.com is in the background ready to rewrite the entire page. And the page will be broken until you manually "view source" and open a link and allow the cert/CA/page for the javascript/css/images/metadata.

5 7

EFF presentation at SIGINT
by Gregory Foster 27 Jul '13

27 Jul '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 EFF (Jul 5) - "The Politics of Surveillance: Understanding the National Security Agency" by @RaineyReitman: http://www.youtube.com/watch?v=OESf9y-638k Kudos to EFF for fighting the good fight, and kudos to Rainey for synthesizing and presenting a lot of useful information. Mentioned in the talk, Freedom of the Press Foundation (Jul 2) - "Encryption Works: How to Protect Your Privacy in the Age of NSA Surveillance" by @micahflee: https://pressfreedomfoundation.org/encryption-works gf - -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJR80dJAAoJEMaAACmjGtgj9PwP/2O6erOD9Zciwh1wEWe/RpAm av4b9ZDQhcIwkMbCBKL7ptlKYe5lHIlTXqsrfdOJFRCekJYBoenKbyex2qHGi/S+ 1w0C3Qc2CNtjsIOmynDGS2dNa6YeuaRvZkQZ/BkxG5VTV703+JafaCmS2+bGL3uD oWdlbEgLIn/pGM8Hc0Epa7hsrkKt8CuQWSmqu74uuOtzUfCBYQ77/ojDlcOD/CG4 FQVNyB/PyrXXJKg/gPbhRxoWyEQ3DtfFE5/NwVKnpxCJmYeFQy3XV2ZRvGg63xat m4e49c5irQy4MOsJ6eXCvCy+uWIp7/+ce1BFHVS2SxsdAjpsyT2ZnSi9XwGJ0nGd mp9It1cbZ44N+NbrBOOC6nN3tzdFS/jbnaq2GKjnssRAamEdNG/2cYQUtK8EGtMd nWy6rKuJwNxrk8IIqJFNaACPxyeEkhckkajKoUUJRqGOth7LDv0zZI8Y0mEU07OW cZIIBr5KOn1PhPGbqNbPMJjba3cdBVAOauHmlFlWB/0vqv0x3fv8tUhji5hoZOgC Vb2YyfcdkKcvu4m7iKkLOXtLdbwITmzC8iavYFcrurUh3jdvDNcr4aw2+gJFeFBR p/+yMSfb29hW2/5G3QZUNK24+eFAsiGaUG7XFgS480PvTJV0fFxFDzkW0KTFx9qF vbug+icoNC2cBwG1Ju3o =gnIq -----END PGP SIGNATURE-----

2 1

Fwd: Goldbug.sf.net - Secure Multi-Crypto-Messenger v0.1 released
by grarpamp 27 Jul '13

27 Jul '13

This was bcc'd to me for some unknown reason. Kicking it over to a somewhat more appropriate destination. ---------- Forwarded message ---------- From: Randolph D. <rdohm321(a)gmail.com> Date: 2013/7/26 Subject: Fwd: Goldbug.sf.net - Secure Multi-Crypto-Messenger v0.1 released To: "Randolph D." <rdohm321(a)gmail.com> Does anyone know, if this tool is really secure? Fwd: >>> DOWNLOAD & PRESS RELEASE 2013-07-27 - English / Deutsch weiter unten _____ _ _ ____ / ____| | | | | _ \ | | __ ___ | | __| | |_) |_ _ __ _ | | |_ |/ _ \| |/ _` | _ <| | | |/ _` | | |__| | (_) | | (_| | |_) | |_| | (_| | GoldBug.sf.net \_____|\___/|_|\__,_|____/ \__,_|\__, | __/ | |___/ TITLE: GoldBug.sf.net: Secure Instant Messenger V0.1 has been released - with p2p Email and decentral IRC public chat DOWNLOAD: https://sourceforge.net/projects/goldbug/files/?source=navbar SHORTY: While today thousands of members of the Stop-Watching-Us initiative against surveillance programs like PRISM demonstrated in several cities all around the globe, the EFF in conjunction with the Chaos Computer Club announced a new secure Instant Messenger called: GoldBug.sf.net (http://goldbug.sf.net) Next to chat as well a serverless Email-System and public IRC-Chat has been introduced with Multi-Encryption: a kind of PGP secured with AES over SSL. The new protocol driving this is called "Echo" and has many potentials to be deployed as well for further secure and anonymous communication applications. Some net communities already call it the Neuland Messenger due to the Font Name of the Logo. DESCRIPTION: StopWatching.Us [3] is the initiative half a million web users have signed due to the mass-surveillance programs like PRISM in USA; TEMPORA in Great Britain, MICS in France and XKEYSCORE Software as well deployed e.g. in Germany. While the governments are powerless in regard to prevent foreign agencies to grab internet-line data and to protect their citizens' privacy, the end-users themself are forced to encrypt their communication and stand up for their Human Rights.Thousands of facebook [4] and twitter [5] members declared to demonstrate on the streets on (last) Saturday, July 27, in many decentral cities. As well at this date, the first release of the Secure Instant Messenger GoldBug (http://goldbug.sf.net) has been announced. It uses multi-encryption (a kind of PGP secured with AES over SSL) based on the new echo protocol. While Mega´s "Spy-proof Email" [6] and Pirate Bay Founder´s "Hemlis Mobile Chat" [7] still play around at crypto-parties to find the right development, the open-source project "GoldBug" has chosen the crypto-library "Lib-Spot-On v. 0.1" (based on libGcrypt). The project brought out not only a secure, beautiful and easy to use messenger, but also a new peer protocol behind it: The Echo Protocol. The so called "Echo" creates a peer-2-peer (p2p), respective friend-2-friend (f2f) network, which sends every (strong encrypted) data packet to everyone connected in that network to your node. When you can decrypt the packet, it is yours and readable, if not, you share it with all your connected neighbors. So far so simple. Thinking other Protocols like Jabber, IRC, Torrent etc. based on the Echo opens up a new perspective, as this new kind of Distant-Chat currently shown in the GoldBug Chat Reference Model introduces a detachment with IP addresses and Private/Public Encryption Keys. The Echo Modus can be half or full: half means, to create a dedicated line to your neighbor, and the Echo stops there: Messages are not shared in the half modus. This creates a Web-of-Trust (friend-to-friend)-network within a p2p network (and not vice versa), which is not detectable - as the user defines at each node how to utilize the Echo. This creates a new view on trust and enables a plausible deniability of having ever utilized a Web of Trust (WoT). An important point in times of 100%-surveillance and data retention tracking over several, but stable line-hops. While for example RetroShare [8] as anonymous, decentral network is a good practice model for a Web of Trust, in a Web of Trust with added echo the user can disconnect from the neighbour while keeping the trust and communication - based on the encryption-key (so called "REPLEO") e.g. shown in the GoldBug Messenger Application. Next to chat as well a serverless Email-System and public IRC-Chat has been inlcuded with the GoldBug-release based on the echo protocol and deployed by the Library Libspoton. How the communities of other apps and protocols will evaluate, discuss and test and maybe adopt the security features of the echo protocol, will be shown by some next hybrid applications - and who knows, maybe the Hemlis-Mobile application or the new secure email systems like BitMail [9] or StartMail [10] announced by IXQUICK will integrate the echo as well. WHY THE NAME: GoldBug was the title of a short story of Edgar Allan Poe about cryptograms in 1843. In the short story Mr. LeGrand, who was recently bitten by a gold-colored bug, starts an adventure with two other friends after deciphering a secret message. Poe took advantage of the popularity of cryptography and the success of the story centers on one such cryptogram. "The Gold-Bug" was an instant success and was the most popular and most widely read of Poe's works during his lifetime. It also helped to popularize cryptograms and secured writing. Even 150 Years later a still vaid approach due to the current events in this time. FEATURES: # Instant Messenger Function: Direct Chat, Group Chat, Public Chat. # the integrated Email Client enables encrypted communication without the usage of a central server. You can even email to offline-friends: other friends from you chace the message for you until your friends come online again. # IPV6 Support: As IPV6 integrates the IP-Adress of the senders into each Datapacket, you can drop this with the Gemini-Feature of a detached communication. # The so called Repleo-Feature based on the Echo-Protocols enables the detachment of logged data retention, that means Data Retention has a solution: a TTL+1 function in an elastic network environment. # Optional you can use furthermore the "GoldBug"-Feature, a kind of password, a hybride-multi-encryption, which integrates a kind of pgp with AES end to end encryption, which offers new standards in regard to Instant Messaging and the Agenda Setting of crypto parties. # Hybrid, optional P2P and F2F Modi. # Proxy Modus: Can run over Tor, 127.0.0.1. : 9150 The GoldBug logo uses the Neuland font: "Neuland is a German typeface that was designed in 1923 by Rudolf Koch. It is often used today when an “exotic” or “primitive” look is desired, such as the logos for the Jurassic Park films", says Wikipedia. That has to be regarded just as a coincidence, no one in the net community would ever have the view to call it the Neuland Messenger or subscribe it to a person, e.g. like Rudolf Koch. WEBSITE: http://goldbug.sourceforge.net https://sourceforge.net/projects/goldbug/?source=navbar DOWNLOAD: https://sourceforge.net/projects/goldbug/files/?source=navbar SOURCE: http://spot-on.svn.sourceforge.net/viewvc/spot-on/?view=tar (as well included in the GB windows installer for your convenience) DEVELOPER-SVN: svn checkout svn://svn.code.sf.net/p/spot-on/code/ spot-on-code PROTOCOL-SIMULATION: http://goldbug.sourceforge.net/img/bitmail.gif Add this gadget to your bog or website - it describes, how the echo protocol works. References: [01] http://goldbug.sourceforge.net [02] https://sourceforge.net/projects/goldbug/?source=navbar [03] https://optin.stopwatching.us/ [04] https://www.facebook.com/events/566858663364951/ [05] https://twitter.com/stopwatchingus [06] http://torrentfreak.com/dotcoms-mega-debuts-spy-proof-messaging-this-summer… [07] http://torrentfreak.com/pirate-bay-founder-announces-encrypted-nsa-proof-co… [08] http://retroshare.sourceforge.net/ [09] http://bitmail.sourceforge.net/ [10] https://beta.startmail.com/ >>>>>>>>>>>>>>> GERMAN LANGUAGE / DEUTSCHE SPRACHE: TITEL: GoldBug.sf.net: Sicherer Messenger mit Multi-Crypto V0.1 veröffentlicht - Auch p2p Email und dezentraler IRC Chat DOWNLOAD: https://sourceforge.net/projects/goldbug/files/?source=navbar KURZ: Während heute tausende von Mitgliedrn der Stop-Watching-Us Initiative gegen Massen-Überwachungsprogramme wie PRISM in vielen Städten rund um den Globus demonstrieren, hat die EFF in Verbindung mit dem CCC mitgeteilt, dass es ein neues Sofortnachrichtenprogramm gibt mit dem Namen GoldBug.sf.net (http://goldbug.sf.net) - zu Deutsch: Goldkäfer. Neben dem Chat wird damit auch ein Email-System ohne zentralen Server und ein öffentlicher IRC Chat vorgestellt mit Multi-Verschlüsselung durch eine Art von PGP abgesichert mit den Verschlüsselungsstandards AES über SSL. Das neue Protokoll, das dieses umsetzt, wird "Echo" genannt und hat zahlreiche Potentiale auch für weitere sichere und anonym eKommunikationsanwendungen genutzt zu werden. Einige Netz-Gemeinschaften nennen das Programm inzwischen auch den Neuland-Messenger. BESCHREIBUNG: StopWatching.Us [3] ist die Initiative, bei der mehr als eine halbe Million Internetnutzer unterzeichnet haben und sich gehen Massenüberwachungsprogramme wie PRISM in den USA, TEMPORA in Großbritannien, MICS in Frankeich sowie der XKEYSCORE SOftware, die ebenso auch in Deutschland angewandt wird. Während die Regierungen kraftlos sind in bezug die jeweils außländischen Agenturen davon abzuhalten, die Daten der Internet-Leitungen abzugreifen und ihre Bürger entsprechend zu schützen, sind die End-Nutzer auf sich selbst gestellt, ihre Kommunikation zu verschlüsseln und für ihre Menschen- und Grundrechte auf Privatheit aufzustehen.Tausende von Facebook [4] und Twitter [5] Mitglieder erklärten, am (letzten) Samstag, 27. Juli, in den Straßen von vielen dezentralen Städten demonstrieren zu wollen.Ebenso an diesem Datum wurde die erste Veröffentlichung des Sicheren Sofortnachrichten Programms / INstant Messengers Golbug (http://goldbug.sf.net) bekannt gegeben. Es nutzt eine Multi-Verschlüsselung (eine Art PGP mit zusätzlichem AES und SSL Standard) basierend auf dem neuen Echo-Protokol. Während für das "abhörsichere Email" von Mega [6] oder dem mobilen "Hemlis Chat" [7] des TPB Gründers immer noch auf Verschlüsselungsparties nach dem richtigen Entwicklungsansatz gesucht wird, hat das quelloffene Project "GoldBug" die Verschlüpsselungs-Bibliothek "Lib-Spot-On v. 0.1" (basierend auf libGcrypt) ausgewählt. Das Projet brachte nicht nur einen sicheren, schönen und einfach zu nutzenden Chat Messenger heraus, sondern auch ein neues Peer-Protokol dahinter: Das Echo-Protokol. Das sogenannte "Echo" erstellt ein peer-zu-peer (p2p), respektive ein freund-zu-freund (f2f) netzwerk, welches jedes (stark verschlüsselte) Datenpaket an jeden der vorhandenen Kontaktknoten senden. Wenn das Datenpacket entschlüsselt werden kann, ist es Deins, und es ist lesbar, wenn nicht, wird es weiterhin mit allen verbundenen Netzwerkknoten geteilt. Soweit so einfach. Andere Protokolle insbesondere der Kommuikation wie Jabber, IRC, Torrent etc neu zu denken basierend auf dem Echo eröffnet ganz neue Perspektiven, als dass diese neue Art einer Distanz-Kommunikation derzeit gezeigt in dem Forschungs- und Entwicklungsmodell Gold Bug Chat eine neues Beziehungsgefüge von IP Adressen und privaten-öffentlichen Schlüsseln vorstellt. Der Echo-Modus kann halb oder voll sein: Halb bedeutet, eine direkte Verbindung mit dem Nachbarn herzustelen und das Echo stoppt dann auch dort: Nachrichten werden nicht weiter geteilt in dem Halb-Modus. Somit wird ein Vertrauensgeflecht, ein Web of Trust (WoT) inmitten eines Peer-zu-Peer-Netzwerkes erstellt (und gerade nicht umgekehrt), das nicht erkennbar ist, weil der Nutzer selbst definiert an jedem Knotenpunkt, we er das Echo einsetzen möchte. Das ermöglicht eine neue Sichtweise auf Vertrauen im Interner und eröffnet auch eine Plausible Abstreitbarkeit ein Vertrauensnetzwerk (WoT) jemals eingesetzt zu haben. Das kann ein bedeutender Punkt in Zeiten von 100-Prozent-Überwachung der Netzwerkkommunikation und der Vorratsdatenspeicherung selbst über mehrer, aber stablile Netzwerküberleitungen. Während beispielsweise RetroShare [8] als anonymes und dezentrales Netzwerk ein gutes Anwenderbeispiel für ein Vertrauensnetzwerk (Web of Trust) ist, kann der Nutzer jedoch in einem Web of Trust mit hinzugefügtem Echo sich vom Nachbarn abmelden, während die Vertrauens-Signatur und die Kommunikatiosnfähigkeit erhalten bleibt - basieren auf dem Verschlüsselungs-Code (so genanntes "Repleo") wie es beispielsweise in der Anwendung GoldBug Messenger genutz wird. Neben dem Chat is tauch ein dezentrales, severloses Email System und ein öffentlicher IRC CHat in dem GoldBug Release integriert - ebenso basierend auf dem Echo Protokol, das von der Bibliothel Lib-Spot-On umgesetzt wird. Wie nun die Netzgemeinden von anderen Applikationen und Protokollen die Sicherheitsmerkmale und das Echo protokoll evaluieren, diskutieren, testen und möglicherweise auch übernehmen, wir durch ggf. entstehende Hybrid Applikationen gezeigt werden können. Und wer weiss, möglicherweise werden die Hemlis-Mobilanwendung oder die neuen sicheren Emailsysteme wie BitMail [9] oder StartMail [10], angekündigt durch IXQUICK, das Echo ebenso integrieren. WARUM DER NAME: GoldBug wer der Title einer Kurzgeschichte von Edgar Allan Poe über Cryptogramme im Jahr 1843. In der Geshichte startet Herr LeGrand, der neulich von einem gold-farbenen Käfer gebissen wurde, ein Abenteuer mit zwei weiteren Freunden - nachdem sie eine geheime Botschaft entschlüsseln konnten. Der Dichter Poe hat die Popularität von Verschlüsselung damals schon verhergesehen und der Erfolg der Kurzgeschichte basiert auf der Entschlüsselung eines solchen Kryptogramms. "Der GoldKäfer" war ein sofortiger Erfolg and das am meisten populäre und von vielen Bevölkerngsschichten gelesene Werk von Edgar Allan Poe während seiner gesamten Lebenszeit. Es halt ebenso geholfen, die Verwendung von Kryptogrammen und das Schreiben mit Verschlüsselungstechniken populär zu machen. Auch 150 Jahre später ein gültoger Anspruch in Anbetracht der derzeitigen Ereignisse in dieser Zeit. FEATURES: # Instant Messenger Function: Direct Chat, Group Chat, Public Chat. # the integrated Email Client enables encrypted communication without the usage of a central server. You can even email to offline-friends: other friends from you chace the message for you until your friends come online again. # IPV6 Support: As IPV6 integrates the IP-Adress of the senders into each Datapacket, you can drop this with the Gemini-Feature of a detached communication. # The so called Repleo-Feature based on the Echo-Protocols enables the detachment of logged data retention, that means Data Retention has a solution: a TTL+1 function in an elastic network environment. # Optional you can use furthermore the "GoldBug"-Feature, a kind of password, a hybride-multi-encryption, which integrates a kind of pgp with AES end to end encryption, which offers new standards in regard to Instant Messaging and the Agenda Setting of crypto parties. # Hybrid, optional P2P and F2F Modi. # Proxy Modus: Can run over Tor, 127.0.0.1. : 9150 The GoldBug logo uses the Neuland font: "Neuland is a German typeface that was designed in 1923 by Rudolf Koch. It is often used today when an “exotic” or “primitive” look is desired, such as the logos for the Jurassic Park films", says Wikipedia. That has to be regarded just as a coincidence, no one in the net community would ever have the view to call it the Neuland Messenger or subscribe it to a person, e.g. like Rudolf Koch. WEBSITE: http://goldbug.sourceforge.net https://sourceforge.net/projects/goldbug/?source=navbar DOWNLOAD: https://sourceforge.net/projects/goldbug/files/?source=navbar SOURCE: http://spot-on.svn.sourceforge.net/viewvc/spot-on/?view=tar (as well included in the GB windows installer for your convenience) DEVELOPER-SVN: svn checkout svn://svn.code.sf.net/p/spot-on/code/ spot-on-code PROTOCOL-SIMULATION: http://goldbug.sourceforge.net/img/bitmail.gif Add this gadget to your bog or website - it describes, how the echo protocol works. References: [01] http://goldbug.sourceforge.net [02] https://sourceforge.net/projects/goldbug/?source=navbar [03] https://optin.stopwatching.us/ [04] https://www.facebook.com/events/566858663364951/ [05] https://twitter.com/stopwatchingus [06] http://torrentfreak.com/dotcoms-mega-debuts-spy-proof-messaging-this-summer… [07] http://torrentfreak.com/pirate-bay-founder-announces-encrypted-nsa-proof-co… [08] http://retroshare.sourceforge.net/ [09] http://bitmail.sourceforge.net/ [10] https://beta.startmail.com/

1 0

OHAI. Also: the shortest Internet censorship debate... EVAH
by rysiek 27 Jul '13

27 Jul '13

OHAI Cypherpunks, I am new here, I am not however new to the topics discussed here. I was involved in many a thing related to privacy, anonymity, freedom of speech (and *after* speech), copyright reform, yadda, yadda, etc. Aaanyway, I bring bad tidings from Poland: yesterday morning the Minister of Justice praised David Censormoron's plan to filter porn in the UK and suggested that maybe it should be implemented in Poland as well. I also bring good tidings from Poland: yesterday evening Polish Prime Minister and the Minister of Administration and Digitization (you should get one of those in your country, they're great) strongly denounced any such ideas. Hence, I have been involved in the shortest Internet porn censorship... ever: http://rys.io/en/109 -- Pozdr rysiek

1 0

Re: SSLegance
by grarpamp 27 Jul '13

27 Jul '13

> This does nothing for the case of "server gives their keys to the feds" Can SSH operate in ephemeral mode? > is active MITM a big enough threat that we need to be worrying > about it other than in airports and hotels? Recent news apparently confirms that 'cooperating' with large adversaries centrally is apparently easier and less costly than those same entities screwing around in the wiring closets of such random local places against specific targets.

1 0

Forward Secrecy
by grarpamp 27 Jul '13

27 Jul '13

Check your preferences are set. Somehow I bet there will be a move to this rather soon. Yet note, Dec, a provider simply logging the session keys is still possible. Though much costlier for evil pursue that cheap route if there are lots of small mail providers out there for people to use... who says you have to use the big three, or cannot run a mail service? Or a distributed social / call / sharing platform, etc? Next topic, DHT p2p tech... we are 'always on' right? http://news.cnet.com/8301-13578_3-57595202-38/feds-put-heat-on-web-firms-fo… http://news.cnet.com/8301-13578_3-57591179-38/data-meet-spies-the-unfinishe… http://googleonlinesecurity.blogspot.com/2011/11/protecting-data-for-long-t… http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html http://nmav.gnutls.org/2011/12/price-to-pay-for-perfect-forward.html

3 2