October 2014 - cypherpunks - lists.cpunks.org

Time for IETF witch hunt? (was: NSA Co-Chairs of Crypto Forum Research Group, Legitimacy of WebCrypto API in Doubt)
by Nicolas Bourbaki 26 Oct '14

26 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is this a victory? Has anything been learned from the process? We know that regime changes are meaningless if the means of governance are not also reformed. In July of 2013 JFC Morfin registered an appeal [1] to the IAB (IETF governing body). He asked the IAB to consider how the concept of a protocol should account for social and ethical requirements. The IAB's response [2] was terse. It showed that these governing bodies lack the means and will to consider how the tools they develop effect people. We sit in a time where the architect of good citizenry is being increasingly dictated by undemocratic institutions. We are quickly trading space beholden to social contracts of the commons for those built by neo-liberal corporations. The ethics of "the protocol" is dictated by whichever company provides the most coffee and cake for the next workgroup meeting. I think the argument of "GeoIP as a threat to democracy" [3] provides an example rhetoric illustrating why concern for this is so important and why perhaps a witch hunt within the IETF is in order. 1. http://www.iab.org/wp-content/IAB-uploads/2013/07/appeal-morfin-2013-07-08.… 2. https://www.ietf.org/mail-archive/web/ietf-announce/current/msg11697.html 3. https://cpunks.org/pipermail/cypherpunks/2014-July/005037.html On 23/10/2014 20:30, odinn wrote: > As a (hopefully final) note to this particular issue, please note > the resolution at: > > https://www.w3.org/Bugs/Public/show_bug.cgi?id=25839#c64 > > The NSA co-chair is resigning, and it appears the Working Groups > are moving ahead without the involvement of that co-chair, for > example: > > (see comments 61 and 62 at) > > https://www.w3.org/Bugs/Public/show_bug.cgi?id=25618#c61 > > Cheers, > > > -Odinn -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJUS4SzAAoJEHi6xtksL8/uwzcP/01mXaZiWgfcR6QEo7te2iC2 ECGnIHCXmHT4amxPDtjWGWJwPaY7ZY3k4c328gx/hOewS1a2BYU1LIpv9nJ2Hq/P B96QciRIJG4lIzaoYUE72RyvorEUOyB5VDzDTzx5McqAkW0STReJSTJKlg9G30He vJ7wrDBS3VB1G8kY32i39fEDPJMm4vlv+1n2R9FM6lSXyD/QCuTQQQzrqA1Z9XCD Y+8r6XNhN0+H5oMRyutQV9qJp6+BNXJLl3rQBi8JPtxtKxNCa3kbdt1bINjWy/2J fheKL6gUynX/EpL0epNnX1OgXWHd6SjnEjPZj08w142UQT7aEL5W1WHi/nbdKx1u uZIkEoAzJq0Gb/Bnumon0R3WA+xU2tqPF/BGr2kFCvws8PgQr6K5lZEmzLcu0AyV dGABC921MLA2scOqRSTmaYiVgVMrp8JAkjxwHe7TSJIh94M7e2GzbVnkkzeJhyEF pSpK6lkSJrq0lDlqN6njKB0P+myBEh3a0kPBoK93UfaFYD36elOBjvdIKN4mBMp1 1b2nC/0jrpjtfWe8gGwOhLXBeCDLunVJWLG47x4JhRy4YwTfBZicFs1rdoyOQBkd zoPTlOoBShYV87ERdPvWrRzdwa0fcFeJhXuFHL4OIc+nPRU1ged1TPnNkjfZW6Az E0ig0q8YefURxuz4BPBN =5/1u -----END PGP SIGNATURE-----

7 6

Re: CITIZENFOUR
by Jesse Taylor 26 Oct '14

26 Oct '14

After reading the Salon article you mentioned, I filed FOIA requests regarding "Main Core" with NSA, FBI, DHS, DSS, NORTHCOM, STRATCOM, CYBERCOM, and DODIIS. All I got was responses saying that there were no responsive records. Of course, this is what happens when almost any information about classified programs is requested via FOIA, so I wasn't surprised (FOIA is really just a smokescreen to make people waste their time begging for records they're never going to get, and to promote the illusion that citizens have some sort of oversight over "their" government). I sent a letter to the editorial staff at Salon and Democracy Now, which both ran stories on this based on "anonymous sources", and pointed out to them that pretty much every intelligence agency is responding to FOIA requests saying the topic of one of their stories doesn't actually exist. Neither of them responded. --Jesse odinn wrote: /1) Who might have access to a list known as Main Core? This is such an old story that it would seem that some kind of list would now be available, but I haven't found it. Has it ever been leaked, FOIA'd, successfully released in partially redacted form in some other mechanism, or made searchable somewhere? // // //[[ Main Core notes / background: Salon reported on Main Core in July of 2008 with an article by Tim Shorrock. Apparently, William Hamilton, a former NSA intelligence officer who left the agency in the 1970s, had heard of Main Core at some point in 1992, according to the Salon article. Hamilton, who (was then, and still is) president of Inslaw Inc., a computer services firm that includes clients in government, indicated that the Bush administration's domestic surveillance operations used Main Core - it is not known if it is still used today in 2014. Main Core was first widely reported on in May 2008 by Christopher Ketcham and in July 2008 by Tim Shorrock, which included in July of 2008 an interview by Amy Goodman of Tim Shorrock. However, I am unaware of any release of names, e-mails, etc. which might be on this list, and it seemed kind of obvious that those who were reporting on it probably had never seen the Main Core list. This may involve use of PROMIS software, and according to Adm. Dan Murphy (a former military advisor to Elliot Richardson who later served under President George H.W. Bush as deputy director of the CIA, who 'died' shortly after his meeting in 2001 with William Hamilton), did not specifically mention Main Core. But he informed Hamilton that the NSA's use of PROMIS involved something "so seriously wrong that money alone cannot cure the problem." ]]/

2 1

Re: Of Sealand, corp, and country [was: nation-state]
by Ryan Carboni 25 Oct '14

25 Oct '14

Global warming is devouring island nations.

8 23

Re: CITIZENFOUR
by tigrutigru＠gmail.com 24 Oct '14

24 Oct '14

Russian gov is not nice. Though it's kind of lucky that it has to do rather nice things to piss US gov off. Sent from my iPhone > On 25 Oct 2014, at 01:27, cypherpunks-request(a)cpunks.org wrote: > > Send cypherpunks mailing list submissions to > cypherpunks(a)cpunks.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://cpunks.org/mailman/listinfo/cypherpunks > or, via email, send a message with subject or body 'help' to > cypherpunks-request(a)cpunks.org > > You can reach the person managing the list at > cypherpunks-owner(a)cpunks.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of cypherpunks digest..." > > > Today's Topics: > > 1. CITIZENFOUR (Rich Jones) > 2. Re: Of Sealand, corp, and country [was: nation-state] (Juan) > 3. Re: CITIZENFOUR (John Young) > 4. Re: Of Sealand, corp, and country [was: nation-state] (Juan) > 5. Re: CITIZENFOUR (Colin Mahns) > 6. Re: Of Sealand, corp, and country [was: nation-state] > (Cathal Garvey) > 7. Re: CITIZENFOUR (Michael C. Toren) > 8. Re: Of Sealand, corp, and country [was: nation-state] (Juan) > 9. Re: CITIZENFOUR (odinn) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 24 Oct 2014 11:58:22 -0700 > From: Rich Jones <rich(a)openwatch.net> > To: "cypherpunks(a)cpunks.org" <cypherpunks(a)cpunks.org> > Subject: CITIZENFOUR > Message-ID: > <CADJYzxL0-5oq9vmFe45YUbF_cYcBkUsxm+kdSNi0c6FvPBU6Ww(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Saw this last night - an obvious must-watch for all CPunks. I think it was > probably the most important documentary film of all time. As Roger Ebert > said, "it’s as if Daniel Ellsberg had a friend with a movie camera who > filmed his disclosure of the Pentagon Papers every step of the way. Or if > the Watergate burglars had taken along a filmmaker who shot their crimes > and the cover-up that followed. Except that the issues “Citizenfour” deals > with are, arguably, a thousand times more potent than Vietnam or > Watergate." Truly, this is the Snowden story we have been waiting for since > 2013. > > The main revelation of the film, however, is what an incredible boob Glenn > Greenwald is. I had some idea of this after seeing him give an extremely > disappointing talk earlier this year, but I don't think I quite understood > how useless this guy really is. He's constantly asking the wrong questions, > displays a technical ineptness (to the point of deliberate ignorance) that > obviously hampers the journalism, and at very step shows a very clear > desire to keep the document cache to himself for careerist purposes. At one > point Ewen MacAskill brings up the idea of there being a Wikileaks-esque > document explorer, and Ed says that this would be the best outcome for the > documents, and Greenwald quickly dismisses the idea to talk about his > publishing schedule. I still have immense respect for him, but I found it > very frustrating and quite cringey to watch him treat the whole event in > news-cycle terms, while everybody around him is obviously thinking in > historical context. For instance, there is a moment when they are prepping > for Ed's first on-camera interview and he asks the reporters how much > background he should give about himself, and they give different answers. > Poitras asks for as much detail as possible, and Greenwald basically says > that isn't important, just be short so we get a good soundbite. > > More importantly, I think the film also misses an opportunity to talk about > *power*. This is something Edward himself has addressed, but it isn't > really covered in Greenwald's reporting or books, and the only time it's > mentioned in the film is when Jacob Appelbaum, while speaking before a > European council of some sort, quite astutely comments that surveillance > and control are one and the same. I think the film should probably have > spent another hour or so investigating, naming and confronting those who > profit from that control. Other than a few choice C-SPAN snippets, the > enemy is completely faceless, which plays well for the pervading sense > paranoia which envelops the film, but also leaves many questions unasked. > Perhaps that's left as an exercise for the viewer, but I think the general > take-away message from both the reporting and to a slightly lesser extent > the film is that any "solution" will be token reform of policy and not > dismantlement of power structures. > > Also, very nice of the Russian government to let Ed have his girlfriend > back. I didn't know that had happened, and it gives a rather unexpected > happy ending to a film which otherwise made me want to cry desperately. > > Anyway, I'd be very interested to hear what you lot thought of it. (JY, you > should throw a torrent up ASAP! I'm sure people will be screenshotting and > analyzing all of the new document shots the film contains.) > > R >

1 0

CITIZENFOUR
by Rich Jones 24 Oct '14

24 Oct '14

Saw this last night - an obvious must-watch for all CPunks. I think it was probably the most important documentary film of all time. As Roger Ebert said, "it’s as if Daniel Ellsberg had a friend with a movie camera who filmed his disclosure of the Pentagon Papers every step of the way. Or if the Watergate burglars had taken along a filmmaker who shot their crimes and the cover-up that followed. Except that the issues “Citizenfour” deals with are, arguably, a thousand times more potent than Vietnam or Watergate." Truly, this is the Snowden story we have been waiting for since 2013. The main revelation of the film, however, is what an incredible boob Glenn Greenwald is. I had some idea of this after seeing him give an extremely disappointing talk earlier this year, but I don't think I quite understood how useless this guy really is. He's constantly asking the wrong questions, displays a technical ineptness (to the point of deliberate ignorance) that obviously hampers the journalism, and at very step shows a very clear desire to keep the document cache to himself for careerist purposes. At one point Ewen MacAskill brings up the idea of there being a Wikileaks-esque document explorer, and Ed says that this would be the best outcome for the documents, and Greenwald quickly dismisses the idea to talk about his publishing schedule. I still have immense respect for him, but I found it very frustrating and quite cringey to watch him treat the whole event in news-cycle terms, while everybody around him is obviously thinking in historical context. For instance, there is a moment when they are prepping for Ed's first on-camera interview and he asks the reporters how much background he should give about himself, and they give different answers. Poitras asks for as much detail as possible, and Greenwald basically says that isn't important, just be short so we get a good soundbite. More importantly, I think the film also misses an opportunity to talk about *power*. This is something Edward himself has addressed, but it isn't really covered in Greenwald's reporting or books, and the only time it's mentioned in the film is when Jacob Appelbaum, while speaking before a European council of some sort, quite astutely comments that surveillance and control are one and the same. I think the film should probably have spent another hour or so investigating, naming and confronting those who profit from that control. Other than a few choice C-SPAN snippets, the enemy is completely faceless, which plays well for the pervading sense paranoia which envelops the film, but also leaves many questions unasked. Perhaps that's left as an exercise for the viewer, but I think the general take-away message from both the reporting and to a slightly lesser extent the film is that any "solution" will be token reform of policy and not dismantlement of power structures. Also, very nice of the Russian government to let Ed have his girlfriend back. I didn't know that had happened, and it gives a rather unexpected happy ending to a film which otherwise made me want to cry desperately. Anyway, I'd be very interested to hear what you lot thought of it. (JY, you should throw a torrent up ASAP! I'm sure people will be screenshotting and analyzing all of the new document shots the film contains.) R

4 3

NSA Co-Chairs of Crypto Forum Research Group, Legitimacy of WebCrypto API in Doubt
by odinn 23 Oct '14

23 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 For those of you on this list who have been watching the progress of things relating to the W3C coordinated process for the WebCrypto API, you know that a lot of work and thought has gone into this and it is an impressive collaboration. But with the IETF CFRG (Crypto Forum Research Group) still being co-chaired by an agent of the NSA (n1), anything that passes through that organization must be questioned at this time. (In the unlikely event that the CFRG page is censored after this message is sent, I've included the names and e-mail addresses of the current co-chairs as part of this message as they currently appear on the CFRG's site, where their names and e-mail addresses have been sitting in full public view for a very long time (n2)). As some of you already know, people within the Crypto Forum Research Group have tried (so far unsuccessfully) since last year (n1, n2, n3) to remove the NSA Co-chair. It should not matter who the person is, but the issue is that having anyone who is in the employ of or affiliated with the NSA chair (or co-chair) a research group whose purpose it is to advise all IETF Working Groups, is highly problematic for reasons which now should be obvious to anyone reading this message. Currently the WebCrypto API is approaching its last call ~ it's in a process of being finalized. For those who are not sure what the WebCrypto API is, it's one of those things that is designed to basically help make ordinary webpages that you see work, and includes the definition of cryptographic primitives that make your internet go. That's a terrible description actually, but if you want a better or more comprehensive description of WebCrypto API in plain English, consider reading poulpita's blog (n4). It's also described at a W3C page as a "JavaScript API for performing basic cryptographic operations in web applications, such as hashing, signature generation and verification, and encryption and decryption. Additionally, it describes an API for applications to generate and/or manage the keying material necessary to perform these operations. Uses for this API range from user or service authentication, document or code signing, and the confidentiality and integrity of communications." (n5) But the WebCrypto API Doc process and, and indeed the legitimacy of the WebCrypto API itself, should be questioned and doubted, for the WebCrypto group has recently held off on including the widely-used curve25519 within NamedCurve dictionaries or as part of its extensibility and errata process, until the (NSA co-chaired) Crypto Forum Research Group gives W3C the go-ahead. For further information and confirmation on this, see (n6) below. If you are concerned about this, check out the message thread discussing attempts to remove the NSA co-chair (n3) and consider posting to the CFRG list (n7) about it once you subscribe. NSA affiliated persons need to be removed from groups that influence the direction of the entire web. I hope those who receive this message will organize to help make that happen. (n1) https://irtf.org/cfrg (n2) From CFRG's public webpage (n1) as of Oct. 20, 2014: "CFRG is chaired by Kevin Igoe (kmigoe(a)nsa.gov) Kenny Paterson (kenny.paterson(a)rhul.ac.uk) and Alexey Melnikov (alexey.melnikov(a)isode.com)" (n3) http://www.ietf.org/mail-archive/web/cfrg/current/msg03554.html (n4) http://poulpita.com/2014/08/28/w3c-web-crypto-whats-next/ (n5) https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html (n6) https://www.w3.org/Bugs/Public/show_bug.cgi?id=25839 (see in particular: comments 11, 12, 48, and 59 through 63 on that page) (n7) https://irtf.org/mailman/listinfo/cfrg - -- http://abis.io ~ "a protocol concept to enable decentralization and expansion of a giving economy, and a new social good" https://keybase.io/odinn -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJURL5EAAoJEGxwq/inSG8CN6QH+wZK+J15RtA4PART46BJRuPf 6ikb/gncf1oIVqVhII1MZyni9Tz+l9fZxkEiPN7bEAZg9zEkm/UrJhpQGa+Q1Lna vNanGyLfnVGJjsA1AxXpBnBsxqm8uwbLQNtNhLdf/UnEk92aNFgvroxSWk62aGoh 3zpzwTMioe1OWyuWk2y3adx/0WTAP9YRuM3J6MKY+Qh+mJMZJmCsnal+Dw/gqjSn Nd5oYght6H+9Af4bwSq3Eh816ojHg6rmzgAIIyWLyeFQiSPHrZVdFXa1bYUeM2gW 8a1udtaRLfVf69IevOvbIc2RM8Lh+uAKXFk65jfpvh2TbJ6U8PP9BUR799XGfEY= =k9SP -----END PGP SIGNATURE-----

1 1

Digital security consultant willing to be based in LatAm?
by Bethany 22 Oct '14

22 Oct '14

Front Line Defenders (FLD) in partnership with Tactical Technology Collective (TTC) is working to expand capacity of Human Rights Defenders (HRDs) to manage risks associated with the use of digital communications. We would like to offer direct, on the ground support to HRDs with the help of a Digital Security Consultant (DSC) based in Latin America. FLD and TTC are seeking cooperation with a consultant for a contract finishing at the end of 2015 to help with digital security support for HRDs and HR organisations at risk in Latin America. The deadline for the applications is 9th November 2014. Read more: https://www.frontlinedefenders.org/node/27505 --- Front Line Defenders (FLD) y Tactical Technology Collective (TTC) están trabajando juntos para que defensores/as de derechos humanos (DDH) incrementen su capacidad para el manejo de riesgos asociados con las comunicaciones digitales. Nos gustaría ofrecer asistencia directa y en el terreno a los/as DDH a través de la asistencia de un Asesor en seguridad digital (ASD), con base en América Latina. FLD y TTC buscan trabajar en cooperación con un asesor, a través de un contrato hasta fines del 2015, para ayudar a brindar asistencia en seguridad digital para DDH y organizaciones de derechos humanos en riesgo en América Latina. La fecha tope para enviar las postulaciónes esta 9 de noviembre de 2014. Leer más: https://www.frontlinedefenders.org/es/node/27506

1 0

shot over the bow - BIS to control crypto exports anywhere (to ensure backdoor enabled?)
by coderman 20 Oct '14

20 Oct '14

http://www.theregister.co.uk/2014/10/17/intel_subsidiary_crypto_export_fine/ """ Wind River Systems exported its software to China, Hong Kong, Russia, Israel, South Africa, and South Korea. BIS [Bureau of Industry and Security] significantly mitigated what would have been a much larger fine because the company voluntarily disclosed the violations. We believe this to be the first penalty BIS has ever issued for the unlicensed export of encryption software that did not also involve comprehensively sanctioned countries (e.g., Cuba, Iran, North Korea, Sudan or Syria). This suggests a fundamental change in BIS’s treatment of violations of the encryption regulations. Historically, BIS has resolved voluntarily disclosed violations of the encryption regulations with a warning letter but no material consequence, and has shown itself unlikely to pursue such violations that were not disclosed. This fine dramatically increases the compliance stakes for software companies — a message that BIS seemed intent upon making in its announcement. """ fuck BIS!

2 1

Re: Corporate undercover nation-state agents
by Nicolas Bourbaki 20 Oct '14

20 Oct '14

It should be clear now, if not long ago, that the US Government is the silent occupier of the stateless generation. This is true no matter the protest the American technological industry may attempt present in response to this fact. In light of this "Balkanisation" should be seen as a marketing term thought up by US actors to prevent the rest of the world from noticing that their data, sitting in or traversing the US, has less rights than that of a Syrian refugee. On 11/10/2014 03:20, bluelotus(a)openmailbox.org wrote: > https://firstlook.org/theintercept/2014/10/10/core-secrets/ > > "But the briefing document suggests another category of employees—ones > who are secretly working for the NSA without anyone else being aware. > This kind of double game, in which the NSA works with and against its > corporate partners, already characterizes some of the agency’s work, in > which information or concessions that it desires are surreptitiously > acquired if corporations will not voluntarily comply. The reference to > “under cover” agents jumped out at two security experts who reviewed > the NSA documents for The Intercept. > > “That one bullet point, it’s really strange,” said Matthew Green, a > cryptographer at Johns Hopkins University. “I don’t know how to > interpret it.” He added that the cryptography community in America > would be surprised and upset if it were the case that “people are > inside [an American] company covertly communicating with NSA and they > are not known to the company or to their fellow employees.” > > The ACLU’s Soghoian said technology executives are already deeply > concerned about the prospect of clandestine agents on the payroll to > gain access to highly sensitive data, including encryption keys, that > could make the NSA’s work “a lot easier.” > > “As more and more communications become encrypted, the attraction for > intelligence agencies of stealing an encryption key becomes > irresistible,” he said. “It’s such a juicy target.” >

5 4

Fwd: [whispersystems] Warrant Canary - Gag order in place right now?
by coderman 19 Oct '14

19 Oct '14

---------- Forwarded message ---------- From: Moxie Marlinspike <moxie(a)thoughtcrime.org> Date: Thu, 16 Oct 2014 16:27:04 -0700 Subject: Re: [whispersystems] Warrant Canary - Gag order in place right now? To: whispersystems(a)lists.riseup.net On 10/16/2014 03:13 PM, Advocatus Diaboli wrote: > I've been watching the development of TextSecure and other OWS apps for > a while, and among other things wondered why there is no warrant canary. > > 20 Minutes ago, a comment was posted in the following issue - and > promptly deleted again 5 Minutes ago: As far as I can tell, nothing was deleted, you're just looking at the wrong issue: https://github.com/WhisperSystems/whispersystems.org/issues/34 > It has been deleted by either the author or an OWS administrator. It > stated that, unlike moxie says in the issue, the EFF's lawyers obviously > are of the opinion that warrant canarys do work: There's a huge difference between the EFF taking a public position on an untested legal concept and a lawyer providing council to a client. Of course the EFF is going to advocate them, their job is to take that position. Whether warrant canaries will work or not is not my area of expertise. However, I don't want to experiment with them for two reasons: 1) Lawyers who provide us council have told us it's very likely they won't work. I don't want to advertise something that could be interpreted as an assurance which is actually false if for some reason it ever came down to that. 2) It's not the hill I want to die on. We're not well positioned to push the state of the art in legal policy or to be a test case. It's not what we're good at, and honestly the point of our work is to make those kind of questions irrelevant by not having any data to provide. That's the envelope that we *are* interested in pushing. > If this would be the case, they should not to put up a warrant canary > (because it would be lying), and they would also not be able to explain > why they cannot publish a warrant canary (because that would violate the > gag order). The only thing left do would be to find excuses why no > warrant canary is being put up and trying to avoid public attention to > the topic. Which is exactly what's happening. You left out the part about the lizard people. > So please, Moxie, if this is *not* the case, state on this mailinglist, > publicly and in clear terms, that OWS or the server admins did not yet > receive a subpoena / warrant / gag order related to any OWS app or service. We have never received a subpoena, warrant, or gag order related to any OWS app or service. Now can we go back to writing software? - moxie -- http://www.thoughtcrime.org

4 4