October 2014 - cypherpunks - lists.cpunks.org

Malaysian Minister of Information in 2007
by Ryan Carboni 19 Oct '14

19 Oct '14

https://www.youtube.com/watch?v=4nAWrQmTmI8 Reminds me of the current FBI director. Actually Baghdad Bob is the best government spokesperson in the history of fascism.

1 0

Re: Fwd: [whispersystems] Warrant Canary - Gag order in place
by Subrosa.io 18 Oct '14

18 Oct '14

Alternatively, it's also possible that Apple has received an order under Section 215 of the USA Patriot Act. >Date: Fri, 17 Oct 2014 10:26:25 +0100 >From: Alfie John <alfiej(a)fastmail.fm> >To: cypherpunks(a)cpunks.org >Subject: Re: Fwd: [whispersystems] Warrant Canary - Gag order in place > right now? >Message-ID: > <1413537985.1291115.180081117.257FD1CC(a)webmail.messagingengine.com> >Content-Type: text/plain > > Even Apple, which had the biggest market cap >in the world so could afford to take on this fight, bowed down and >removed their warrant canary recently. > >Sadly, until someone with a set of big brass ones goes all guns blazing >to specifically set precedent, everyone is going to sit on the sidelines >on this issue.

1 0

Legality of warrant canaries
by Griffin Boyce 18 Oct '14

18 Oct '14

Hey all, There's been a lot of discussion around warrant canaries lately, and I just want to pipe in with my experience. Back in 2012, I talked to my attorney about setting up a warrant canary or a dead man's switch -- which he pointed out would have the same legal repercussions as just releasing the gagged warrant/NSL. Why? Because they are frequently phrased in such a way that if you do or fail to do a thing to somehow make it known, then you've violated the order. You're in just as much trouble if you take out a billboard or tweet a scan of the order or use pantomime or comment out a warrant canary. The only difference is that there *might* be plausible deniability if you tell your partner "something happened at work today and I can't tell you what it is" [1], whereas you have *no* ability to deny anything if you remove a publicized warrant canary from a website. I'm not saying don't do it, but maybe talk to a lawyer first. ~Griffin [1] http://www.newyorker.com/tech/elements/what-its-like-to-get-a-national-secu… -- "I believe that usability is a security concern; systems that do not pay close attention to the human interaction factors involved risk failing to provide security by failing to attract users." ~Len Sassaman

7 6

NYPD Gets Glomar Powers
by Rich Jones 17 Oct '14

17 Oct '14

Not sure if this is too relevant to the list, but thought I'd bring it up anyway. Fairly important ruling today: http://www.rcfp.org/browse-media-law-resources/news/trial-court-allows-poli… Basically, a few years ago, the NYPD hired a bunch of ex-TLA guys to handle their freedom of information program, and then began declaring things as being secret, even though the law mentioned nothing about the ability to do this. Of course, they even extended their newly-created power to declare the even the existence-or-non-existence of information secret. Today, in horrifying fashion, the court affirmed their power to do this. FTA: > The case, *Abdur-Rashid v. New York City Police Department > <http://www.nycourts.gov/reporter/3dseries/2014/2014_24271.htm>*, > involved a request by Imam Talib Abdur-Rashid for records regarding NYPD > surveillance of himself and his mosque in New York City. The city refused > to disclose to Mr. Abdur-Rashid whether any such records existed, and told > him that even if they did exist, such records would be exempt under the New > York Freedom of Information Law (“FOIL”). > > In its decision > <http://www.nycourts.gov/reporter/3dseries/2014/2014_24271.htm>, the > court somewhat perplexingly acknowledged that according to federal and > state case law, “[i]t should follow that when a local agency such as the > NYPD is replying to a FOIL request, the Glomar doctrine is similarly > inapplicable.” However, it then went on to state that as this was a case of > first impression, the NYPD’s use of a Glomar response “is in keeping with > the spirit of similar appellate court cases.” The court determined that > “disclosing the existence of responsive records would reveal information > concerning operations, methodologies, and sources of information of the > NYPD, the resulting harm of which would allow individuals or groups to take > counter-measures to avoid detection of illegal activity, undermining > current and future NYPD investigations.” Therefore, it granted the NYPD’s > motion to dismiss the case. > This is particularly troubling as a lot of police departments look to NYPD as an example, and we may see this as a new tactic opposing police investigators across the country. It's a very bad day for FOIA in my opinion. R

1 0

Novena update
by Eugen Leitl 17 Oct '14

17 Oct '14

Bunnie seems on track. Wonder what the price tag for rubes will be. http://www.bunniestudios.com/blog/?p=4146

2 1

Re: Corporate undercover nation-state agents
by Snehan Kekre 16 Oct '14

16 Oct '14

1 0

Corporate undercover nation-state agents
by bluelotus＠openmailbox.org 16 Oct '14

16 Oct '14

https://firstlook.org/theintercept/2014/10/10/core-secrets/ "But the briefing document suggests another category of employees—ones who are secretly working for the NSA without anyone else being aware. This kind of double game, in which the NSA works with and against its corporate partners, already characterizes some of the agency’s work, in which information or concessions that it desires are surreptitiously acquired if corporations will not voluntarily comply. The reference to “under cover” agents jumped out at two security experts who reviewed the NSA documents for The Intercept. “That one bullet point, it’s really strange,” said Matthew Green, a cryptographer at Johns Hopkins University. “I don’t know how to interpret it.” He added that the cryptography community in America would be surprised and upset if it were the case that “people are inside [an American] company covertly communicating with NSA and they are not known to the company or to their fellow employees.” The ACLU’s Soghoian said technology executives are already deeply concerned about the prospect of clandestine agents on the payroll to gain access to highly sensitive data, including encryption keys, that could make the NSA’s work “a lot easier.” “As more and more communications become encrypted, the attraction for intelligence agencies of stealing an encryption key becomes irresistible,” he said. “It’s such a juicy target.”

4 5

Crypto mechanics in ios8 and android L
by grarpamp 16 Oct '14

16 Oct '14

http://blog.cryptographyengineering.com/2014/10/why-cant-apple-decrypt-your… http://nelenkov.blogspot.com/2014/10/revisiting-android-disk-encryption.html That's the frontdoor. Baseband's still present and wide open. Thus consider a non-cell device (a pad/laptop) tethered to cell hotspot or another phone to provide mobile wifi voice/data (IP) to the device. Is connecting to a cell hotspot or another phone to use the native cell voice/data (cell) of the cell network even possible? ie: You can drive a phone's sms over it's usb port. But that's just sms, not cell voice or cell IP.

6 6

Re: [Cryptography] Cryptography, backdoors and the Second Amendment
by Lodewijk andré de la porte 16 Oct '14

16 Oct '14

This e-mail turned out huge enough that I think I'll not have to speak about the subject again any time soon. I'd still like to listen :) 2014-10-13 5:42 GMT+02:00 Jerry Leichter <leichter(a)lrw.com>: > On Oct 12, 2014, at 12:31 PM, Lodewijk andré de la porte <l(a)odewijk.nl> > wrote: > > Ah, but that wasn't the question. A judge must always give precedence to > constitutional laws. How could a judge explain the second amendment such > that machine guns could be illegal? > > I suspect that ruling should be exceedingly controversial and dangerous. > > This is absurdly far from cryptography, but ... the following is a summary > of the article on the subject in Wikipedia - > http://en.wikipedia.org/wiki/United_States_v._Miller. > But surprisingly relevant. Law is supposedly coherent and, nowadays, all encompassing. An argument valid in the US will hold in all the Western countries, and probably those are or pretend to be developed nations as well. I've thought and read about the subject some more. It's relevant, bizarre, historic and, like many judgements are, of incredible importance. > Private ownership of machine guns has been regulated in the US since 1934, > when the National Firearms Act was passed in response to the Valentine's > Day Massacre, an infamous gang killing. The NFA required registration of > fully automatic weapons and some others, like short-barrelled rifles. > Registration, and every subsequent transfer, required payment of a $200 fee > - a very large sum in those days. > > The controlling decision is US v. Miller, decided by the Supreme Court in > 1939. It's a bizarre case. Miller was a bank robber arrested while > transporting a short-barrelled shotgun across state lines. Miller > testified against his partners, and later disappeared, presenting no > defense to an appeal to the Supreme Court. (In fact, Miller was found > murdered before the decision was rendered.) The US government appeal was > based, among other things, on the interpretation of the reference to "a > well-ordered militia" to say that the protected rights are to arms actually > used by militias. Miller was transporting a short-barrelled shotgun - a > weapon the government claimed was never used by any known militia. (This > claim was actually false, but because no one appeared for the defense, no > one disputed it.) > So, there's no proper judgement on it as of yet. Shocking, given how core weaponry is to much of the US' image. My personal opinion is that the 200usd claim cannot constitutionally be charged, as it could, for some, infringe the ability to bear arms, thus preventing them from obtaining/executing their right. I do think they could charge it provided they do not charge it to someone that can trivially afford it, although avoiding the difficulty in finding that price point has strong preference. I say this mostly because of a European Court judgement against The Netherlands regarding a visa for family members costing a prohibitive per family member, afterwards a maximum price was determined with no regard to applicants' ability to apply for it. A still unsatisfactory situation, but it wouldn't be practical otherwise. The Supreme Court, however, found other reasons to find that the NFA was > likely constitutional, and remanded the case to the district court for > further proceedings. But with Miller dead, those further proceedings never > occurred. The Supreme Court never actually considered the whole issue of > whether a short-barrelled shotgun was, in fact, ever used by a militia; nor > whether that matter anyway; never came up. > It shouldn't be a big difference. The only thing to do is become part of a militia, which is a really good idea anyway ("nesssary to the security of a free State"). The question of which weapons could be of use is easy, ALL OF THEM! Textwise the second amendment is not explitic about which arms must be allowed to be carried, so there's a bit of a hole there. It wouldn't be a meaningfull text if it didn't refer to all arms equally. > The case, which forms the basis for limiting access to some kinds of > weapons, has barely been cited since. In effect, even though there never > really was such a decision, the Court has seen Miller as standing for the > rule that weapons not used by militias may be regulated or banned. In a > 1997 case, Justice Thomas - that far-left liberal - wrote in a concurring > opinion to Printz v. US that "In Miller, we determined that the Second > Amendment did not guarantee a citizen's right to possess a sawed off > shotgun because that weapon had not been shown to be "ordinary military > equipment" that could "contribute to the common defense." In 2008, in a the > very important decision invalidating most of the District of Columbia's gun > control regulations (District of Columbia v Heller), the opinion included > the statement that "Miller stands only for the proposition that the Second > Amendment right, whatever its nature, extends only to certain types of > weapons. It is particularly wrongheaded to read Miller for more than what > it said, because the case did not even purport to be a thorough examination > of the Second Amendment." > I would say there's some syntax/semantics going wrong there. If an entity (item/service/organization/idea/etc) does not contribute to "the common defense" or such a thing if controlled/used by a disciplined/trained organization of people, how could it be a weapon? If it is not "arms", then it could not be protected by the second amendment. That's a signficantly wider category than arms is typically considered to be. But making it smaller is difficult against the thorn of time. So for better or worse, the Supreme Court standard now is that the > protected arms are those that are useful to, and used by, militias - > whatever we take that word to mean; it had a specific meaning in the 18th > century that's no longer of any relevance. Whatever the *actual* facts, > sawed-off shotguns - and apparently fully-automatic weapons - are among the > things that can be banned as "not the right sort of weapons". > That's such a non-sequitor that I feel like I just don't understand, but it's probably just how it is. If the People let their rights be taken from them, by those elected by them, then there is no helping it anyway. > The law is not a simple or pretty thing. It evolves in sometimes > arbitrary ways - note the angst over rulings that treat corporations as > people, which all trace back to a side comment in a footnote in a decision > in a case about something else, which somehow has frozen into a major > principle. (Well, the "somehow" is quite clear: The courts are big on an > idea call stare decisis, which basically means "let sleeping dogs lie": > Unless there is a really, really good reason, the strong bias is to leave > decisions and interpretations that people have come to rely on alone, > avoiding major disruption, whatever their basis.) > It is in many ways their job to interpret the law the way it is commonly accepted to be. Treating legal persons, corporate or corporal, similarly is pretty reasonable. It's just when it disempowers people where it should do the opposite that angst really starts seeping in. There should be recognition of capabilities, an individual or small company cannot (may not?) be expected to be able to perform like a larger company can. Different people can neither be expected to perform to the same standards, for example in case of mental illness. > The Second Amendment's bizarre language has been a problem pretty much > since it was written, and while there have been changes in interpretation > over the years - and there has definitely been a strong trend in recent > years for scholars and judges of all political persuasions to see it as a > stronger protector of an individualized right than was the case in the past > - things like Miller have grown up around it and have also, for now, become > settled law. > Thank you for the dissertation. It was well received :) I think no judge can sanely claim gun regulations that restrict the right to bear arms to be constitutional. Specifically of paramount and contemporary importance is the protection against a tyranical government, and foreign attacks from geopolitical powers like China and Russia and, most Catch-22ish terrorists and murderers, in mass shootings or otherwise. I would very much appreciate people being encouraged to take arms in the context of militia's. A single armed man is not reliable enough, nor capable enough, to contribute meaningfully to the common defense or any such thing. I also would bid the United States' federal government to provide an interpretation of the second amendment that allows the states to prevent purchase or transfer of certain devices when not in conjunction with a militia. That militia's may be registered at the state or federal government, at no charge to them, limited only in that it requires several natural persons to create it and that these natural persons may only participate in three militia's. That militia's must in some shape or form encourage the discipline to comply with laws as they apply in their area of operation, lest they are an encouragement of criminal behavior and are indeed not militia's at all. And more such rules as provide a regulated environment in which one may justly execute his or her right to keep and bear arms After all, a device handled by one not trained to use it can never be arms at all. ------------ To apply this directly to cryptography: export and import could still very well be made illegal. The truth is that information should be free, because without free information reality becomes distorted in ways that can cause harm beyond belief.** I seem to have ran offtopic there. It was meant to prove that information is going to have a lot of changes to it, and knowledge about crypto is fundamentally information. Important and export restrictions are silly. ** ramblings with value perchance moved here because I actually do care about not wasting your time (it's just hard to avoid, sorry about that): The world is not ready for it, but through technological means we are become increasingly capable of making all information stored in computers easily accessed. There is fighting against it but it will not succeed and every person harmed in it is a person too many. We much guide it, lest much else will be lost, copyright and trade secrets have their place for now. However, not just our ability to store and examine information is becoming more and more unlocked. The ability to create and collect information has been growing at least as explosively. The cost of a networked video camera's and microphones is dropping and will continue doing so until every place humans live will be recorded, for ever increasing durations, as any crime's cost to humanity will exceed the cost of placing the recording device. You might think privacy, shame and just the fabric of society will not accept it. And it's true. The whole fabric will tear and tear until privacy becomes ridiculous. Not because privacy isn't a great thing now, it is!, but because as we will come to understand and tolerate each other it will become irrelevant. That's a dreamy outlook on it. Another is a police superstate wherin humans have no real place except as biological machinery.

2 1

State Hash
by John Young 15 Oct '14

15 Oct '14

http://sphincs.cr.yp.to/ Special note to law-enforcement agents: The word "state" is a technical term in cryptography. Typical hash-based signature schemes need to record information, called "state", after every signature. Google's Adam Langley refers to this as a "huge foot-cannon" from a security perspective. By saying "eliminate the state" we are advocating a security improvement, namely adopting signature schemes that do not need to record information after every signature. We are not talking about eliminating other types of states. We love most states, especially yours! Also, "hash" is another technical term and has nothing to do with cannabis.

4 6