January 2014 - cypherpunks - lists.cpunks.org

FUCK SVEASOFT! Who the fuck uses dd-wrt anymore? Re: Tor now built into DD-WRT
by Anonymous Remailer (austria) 13 Jan '14

13 Jan '14

sveasoft broke the GPL years ago.. and was FULL of security holes.. most smart folk moved to open-wrt years ago where tor is a compile away also no fees $$$(SVEASOFT) for what is free software FUCK SVEASOFT!! fucking GPL Pirates and scammers

1 0

Re: Replacing corporate search engines with anonymous/decentralized search
by Jesse Taylor 13 Jan '14

13 Jan '14

Thanks for your comments on this folks ... lots of food for thought. coderman(a)gmail.com <mailto:coderman@gmail.com> said: /the longer discussion is how to make decentralized search useful. "Google style" search has a terrific performance advantage over decentralized designs by brute force. however, take advantage of massive endpoint / peer processing and resources combined with implicit observational metrics for reputation and recommendation, inside a well integrated framework for resource discovery in usable software, and you have something more robust and more effective than "Google style" could ever provide./ Yes, it does seem like the speed advantage of centralized search will be a barrier to adoption of decentralized search. This is analogous to the difficulty getting people adopt systems like Tor because it is slow. But I think that as more people become aware of the extent of state/corporate surveillance, they will become more inclined to accept solutions that are slower in exchange for not having their search habits monitored, and also being able to receive uncensored search results. As long as decentralized search is (a) usable/simple and (b) provides quality results, I feel like speed is somewhat of a secondary concern. The key question to me is: "How do we build a search engine that is simple enough for Grandma to use <http://freehaven.net/anonbib/cache/usability:weis2006.pdf>, that produces quality results without massive centralized indexing servers?" Standalone P2P search applications (e.g. Yacy) don't really make sense from a usability perspective. It's unrealistic to expect hundreds of millions of users to download a standalone Java app, and configure a P2P search node. What would make more sense, and would lead to much more rapid/widespread adoption, is to use protocols like WebSockets <http://mikemp.mit.edu/wss/wss-mikemp.pdf> / WebRTC <http://inet.cpt.haw-hamburg.de/papers/vws-lwpcd-13.pdf> to facilitate P2P connectivity in the web browser <http://inet.cpt.haw-hamburg.de/teaching/ws-2012-13/master-projekt/maxjonas-…>, so that everything can be done via a simple browser plugin that can be installed by anyone with few clicks, and would then just allow people to use the browser search bar as usual. This browser integration would also have the bonus of simplifying the choice of what to index -- it could just default to indexing bookmarked and frequently-visited pages, and then be optionally customized by more advanced users to create custom indexes (i.e. all of the complexity of setting up indexing could be hidden from the user, unless they choose to look for it). To help bootstrap the WebRTC nodes into the P2P network, and to deal with some of the instability inherent in P2P networks (i.e. by creating stable "super-peer <http://infolab.stanford.edu/%7Ebyang/pubs/superpeer.pdf>" indexing nodes), I like cathalgarvey's suggestion of utilizing something like a Wordpress//plugin that would use the same index/search standard as the WebRTC clients, but could additionally bootstrap the web-based clients. As cathalgarvey said:/ / /A standard rather than a codebase. But there's a huge advantage to this line of thought, if you'll bear with me. A two-digit fraction of the web right now is powered by Wordpress.org, who explicitly advocate open/free culture. If you can convince them to include a social search/index standard of this type, which is virtually free in terms of computer resources, then you'd have it deployed across the web in days as the next update rolled out. Indeed, even if Wordpress seemed reluctant, a wordpress plugin could probably be written quickly enough to enable such a thing and make it available for casual use. Suddenly, a bunch of PHP-powered sites around the web start committing small bits and pieces of resources to a social search engine based on human-curated attestations of trust that flow through a web, helping to confine spammers to the fringes and to users with stupid taste. / What would also be interesting is if this standard enabled some kind of "pingback" mechanism whereby WebRTC nodes could be associated with specific super-peer nodes (e.g. maybe people who have bookmarked the super-peer site in their browser, or subscribe to its feed), so that in addition to broad/random queries that target the entire P2P network, clients could also create more targeted custom searches that say something like "start the search with the nodes that are clustered around these super-peers". This would create an enormous diversity of search possibilities -- hundreds of thousands (millions) of different "search engines", each of which would return different results for the same query, depending on where you start your search ... This diversity is another reason I find P2P search interesting, in addition to the benefits re: censorship, traffic shaping, and surveillance. I've been looking around for some kind of WebRTC P2P search engine and haven't found anything yet ... maybe I've found a programming project for this summer :) -- Jesse Taylor <http://www.interference.cc>

1 0

Re: 'Jury Booty' and Anti-prosecution tactics. (Was Re:)
by John Young 13 Jan '14

13 Jan '14

This has got to be a spoof. The real Jim Bell would never write this. Unless under pressure to ensnare the stupid and sending a coded message to stay far away. We recently got one of these stay-far-away messages from a noted ISP we had tried to contract who said three customers had been taken down. Wouldn't say why. This ISP fought against keeping an NSL secret for years and lost.

2 2

Re:
by John Young 13 Jan '14

13 Jan '14

The joke about TCM is that this is a spoof like Tim May used to post. If not a spoof better not go there. At 04:59 PM 1/12/2014, you wrote: >Can you elaborate a bit about the panic onion? >Why is reachability and not content the indicator of the service's health? > > >On Sun, Jan 12, 2014 at 12:32 PM, John Young ><<mailto:jya@pipeline.com>jya(a)pipeline.com> wrote: >Welcome back, TCM. You've been missed. > > > > >At 12:46 PM 1/12/2014, you wrote: >So I am organizing a lottery, I think you are all familiar with the concept. >There is currently one death pool with multiple people in it. > >The pool accepts bitcoin and litecoin, and >accurate death predictions will be rewarded 75% >of the funds. The other 25% will stay in the pool for the remaining names. > >You can find more information at: ><http://lotteryd77nqcmtc.onion>http://lotteryd77nqcmtc.onion >Or clearnet: ><http://lotteryd77nqcmtc.onion.lu>http://lotteryd77nqcmtc.onion.lu > > > > > > >-- > > >Rich Jones > ><https://openwatch.net>OpenWatch is a global >citizen news network. Download OpenWatch ><https://itunes.apple.com/us/app/openwatch-social-muckraking/id642680756?ls=…>for >iOS and ><https://play.google.com/store/apps/details?id=org.ale.openwatch&hl=en>for >Android!

1 0

Tor now built into DD-WRT
by John L Grubbs 13 Jan '14

13 Jan '14

Looks like Tor is now included as of build 23220. No GUI as of yet.

2 1

Tamper-Evident electronic device: (was: [Cryptography] Dumb idea: open-source hardware USB key for crypto)
by Jim Bell 13 Jan '14

13 Jan '14

From: stef <s(a)ctrlc.hu> On Sat, Jan 11, 2014 at 02:35:39AM -0500, grarpamp wrote: >> On Fri, Jan 10, 2014 at 5:53 PM, Bill Cox <waywardgeek(a)gmail.com> wrote: >> > I've been noodling the idea of a USB stick designed in a way that we >> > can trust the crypto that goes on there. It's a hard problem, but > >> there seems to be some guidelines that could help: >as hinted earlier in the pcp/pbp discussion, i'm working on such a beast: > https://www.ctrlc.hu/~stef/PITCHFORK.pdf >>> Anyway, it's just a fun idea. I'd love to have such a >>> device in my pocket. There's a lot of applications I can think of >>> that could benefit from it, from electronic voting to >>> microtransactions. >PITCHFORK will allow you to develop your own extensions, so indeed i expect a >lot of experiments and innovation if this gets off. >currently some of my code has licensing problems and needs to be reimplemented >before publication :/ >> Many of these open hardware ideas come down to the fab level... >indeed, there's a lot of trust in things we have limited resources to >validate. turtles all the way down. One thing that's needed is a way to determine if said device has been tampered with or replaced. I suggest that such devices contain a pc board with a few (16 or so?) solder-bumps in a bare area (easily made using surface-mount soldering techniques) onto which would be pressed a carbon-fiber weave of cloth, itself impregnated with epoxy adhesive and held in place (over the solder bumps) until the epoxy is cured. Each connection between a bump and the carbon-fiber weave would have an impossible (?) to replicate resistance. Each solder bump would connect to a lead of a chip, said chip containing analog switches and an A/D convertor. In operation, the resistance between these solder-bumps would be measured by the chip; also, perhaps two or more different solder bumps could be driven by the chip to different voltages (Vcc and Gnd), and the voltages of the rest of the solder bumps would be measured. These as-measured values could be transmitted through the USB (possibly in encrypted or hashed form) and stored by a connected computer. The entire device would be potted in a clear potting material, probably clear epoxy. Any tampering would be automatically detectable electronically, and it would be exceedingly difficult to replicate the results of the large number of possible separate measurements which could be made. There would be (16x15/2)= 120 two-terminal resistance values; Each such measured value could be accompanied by measuring the voltage of the other 14 terminals, or 120 x 14 = 1680 values. Jim Bell

1 0

Re:FBI trap?
by David - 13 Jan '14

13 Jan '14

Not meant to be a trap, but your concerns regarding the tracability of bitcoin are correct. There is currently no way to add to the list. I intent to make a second, much larger pool which will include 'those in congress, the presidency and the judiciary who carry the NSA's water'. And a third pool containing corporate. I am open for suggestions. I will listen to opinions about who should be on the list.

1 0

FBI trap?
by Anonymous Remailer (austria) 13 Jan '14

13 Jan '14

The recent posting by david advertising both a hidden and a real world address may reflect a growing awareness of either the american FBI or of the NSA TAO of constructing digital evidence trails for conspiracy to murder public officials.. I DONT trust onion.lu nor do I trust gandi.net not to log all queries besides they DONT have a way to add to the list, the richly deserving but unamed wizards behind the curtains.. those in congress, the presidency and the judiciary who carry the NSA's water. Such as our current veep who began very visibly in 1991 to support the NSA with SB266 and finishing off with the atrocity that is bluffdale utah

1 0

Twister: P2P microblogging platform
by Jesse Taylor 12 Jan '14

12 Jan '14

I came across this the other day: /"This paper presents a proposal of a new P2P microblogging platform that is scalable, resilient to failures and attacks, does not depend on any central authority for user registration, provides easy-to-use encrypted private communication and authenticated public posts. The architecture tries to leverage from existing and proven P2P technologies such as Bittorrent and Bitcoin as much possible. Privacy is also one of the primary design concerns, no one should be able to see the user's IP or their followers unless he explicitly shares such information. The proposed platform is comprised of three mostly independent overlay networks. The first provides distributed user registration and authentication and is based on the Bitcoin protocol. The second one is a Distributed Hash Table (DHT) overlay network providing key/value storage for user resources and tracker location for the third network. The last network is a collection of possibly disjoint "swarms" of followers, based on the Bittorrent protocol, which can be used for efficient near-instant notification delivery to many users. [...] "/ -- "twister - a P2P microblogging platform <http://arxiv.org/pdf/1312.7152v1.pdf>", Miguel Freitas Personally, I'm impressed by the creative application of Bitcoin/Bitorrent/DHT protocols to the problem of private/anonymous communication ... and the software looks very clean and usable as well. I also like that it's based on P2P technology unlike solutions such as Diaspora, which still require trusting third parties with personal data ... Thoughts? --Jesse Taylor <http://www.interference.cc>

3 2

Re: [Cryptography] Dumb idea: open-source hardware USB key for crypto
by grarpamp 12 Jan '14

12 Jan '14

On Fri, Jan 10, 2014 at 5:53 PM, Bill Cox <waywardgeek(a)gmail.com> wrote: > I've been noodling the idea of a USB stick designed in a way that we > can trust the crypto that goes on there. It's a hard problem, but > there seems to be some guidelines that could help: > > - Open source hardware - schematics and everything including board > layout need to be free > - No ICs that could be compromised. Any CPU would have to be a > soft-core in an FPGA, with an open-source design > - FPGA configuration memory both readable and writable over a JTAG port > - External flash program memory also read/writeable through JTAG > - Reasonable hardware RNG where every node in the circuit can be probed > - Signal isolation from the PC: solid state relays would swap a simple > memory back and forth between the PC side and USB stick side. Maybe > power draw should be randomized to obscure any processing going on. > RF shielding should cover the USB stick. No other communication > should be possible. This is similar to an air gap. > - A community supported audit trail verifying produced USB keys are secure > > The idea still has issues. Where would I be able to store secret keys > securely such that an attacker who stole my USB stick could not > recover it? Anyway, it's just a fun idea. I'd love to have such a > device in my pocket. There's a lot of applications I can think of > that could benefit from it, from electronic voting to > microtransactions. As one security expert once said in an > electronic-voting discussion I followed, no machine ever connected to > the Internet has proven secure. Could we make such a beast? I > probably don't really have time to work on it, but if a group were > building it, I'd participate. Many of these open hardware ideas come down to the fab level... can you examine (and trust) the fab process. Sure, publish all your schematics, VHDL, die masks, etc. But unless some number of random people can routinely make unannounced access-all-areas verification visits to the fab to verify those masks are the ones in use, it's moot. Or unless they can pull unannounced random samples and decap and analyse them, it's moot. That's why I've previously suggested people get together to making hardware RNG's out of discrete components... you don't have those worries then. I agree with the softcore loadable fpga and probe points ideas, they're good things. But in general, once you exceed a certain number of presupplied closed source and relatively unauditable gates [1], you should consider yourself potentially and generally fucked... and start taking a serious defense in depth approach. [1] Let's call it the number required to perform dumb leaks or take pseudo intelligent actions against you. The current lineup from Intel/AMD certainly fall in this category. As would quite a few lesser things... ARM, phones, cards, etc... firmware things. Does it not scare you that the next PC you're about to buy for your firewall is one of these systems, potentially hiding out to honor magic packets? Look at AMD's new CPU's coming out in a few weeks... besides gate count we all know about, it has embedded ARM cores. And just who is going to bring the aforesaid open model upon this class of gear? So it's +1 for spooks.

4 3