November 2014 - cypherpunks - lists.cpunks.org

Re: [Cryptography] STARTTLS, was IAB Statement on Internet Confidentiality
by grarpamp 28 Nov '14

28 Nov '14

On Tue, Nov 18, 2014 at 11:29 PM, John Gilmore <gnu(a)toad.com> wrote: > Censorship of customer communications is always a "best practice" > according to some people. Blocking communications based on the port > number in use? Today some people on this list tried to tell me that 'Port 25 is SMTP'. That's funny because I use it for SSH. > That seems to many people to be heinous, > "picking winners and losers", discriminating against > traffic based on what the endpoint services are, etc. Wasn't > Network Neutrality supposed to outlaw all such discrimination? Yes it was. > Or, is it a catchphrase for "only the politically correct people > are allowed to censor or discriminate against traffic"? It's doublespeak now, said political promises vanish once elected. If the discriminators get their way you better hope you have real estate in the Balkans. > The fact that some ISPs covertly built that censorship into a > supposedly transparent network must be why I never get any spam these > days. But it doesn't matter to zealots whether their methods actually > work or not. They're mad at spammers, and "Hulk smash" is their main > response. Reason, principle, protocols, and respect all went out the > window. > > Anti-spammers have done far more damage to the Internet than spammers. > Now they are claiming that we can't be permitted to encrypt our > Internet connections because then their censorship scheme would stop > working? Yes they are. You better encrypt the net now before they're able to inject that power twist into arguments of political arms. > I don't see any spammers claiming that end users should not > be permitted to encrypt their emails nor any other traffic. To take > the privacy of our communications into our own hands, it is the > anti-spammers who stand in our way, not the spammers. Just like AdBlockPlus, user's mail clients should be shipped and extensible with simple local filtering spam/virus/malware processing engines. Users, having no such simple plugin tools available to them in early days, complained of spam which drove provider/anti filtering more than providers separate ability to handle the traffic load did. All the anti position did for providers was shift their cost from disk spool storing it to cpu rejecting it. And users got censorship tools developed and deployed against them in return. Failure! Users need to do their own filtering and encrypt now. >> Here, for example, is a >> recommendation on the topic that MAAWG published in 2005: >> >> https://www.maawg.org/sites/maawg/files/news/MAAWG_Port25rec0511.pdf > > Exactly -- an anti-spammer group, the "Messaging, Malware and Mobile > Anti-Abuse Working Group", MAAWG. Hmm, there seem to be more M's in > there than in their domain name. Perhaps once they started advocating > censorship for one reason ("Messaging"), they found all sorts of > other reasons for it, too. When you have a censorship hammer, every > problem looks like a need for censorship. > > John Gilmore > (who regularly, daily, gets his personally typed emails - just > like this one -- censored without recourse, by the ISPs of > recipients who rely on unreliable third party censorship > blacklists.)

2 1

Microsoft Root Certificate Bundle, where?
by grarpamp 28 Nov '14

28 Nov '14

MS root cert docs indicate they switched at vista from manual/auto downloadable updates to some form of OS online on the fly only auto update system. Where link at microsoft can one still download a file containing their entire current root cert bundle in some parseable format? It has to be somewhere near here but I'm dense today... http://social.technet.microsoft.com/wiki/contents/articles/3281.introductio… ex: mozilla is here https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/b…

4 6

Deanonymisation of clients in Bitcoin P2P network
by grarpamp 27 Nov '14

27 Nov '14

http://orbilu.uni.lu/handle/10993/18679 Biryukov, Khovratovich, Pustogarov Nov-2014 Bitcoin is a digital currency which relies on a distributed set of miners to mint coins and on a peer-to-peer network to broadcast transactions. The identities of Bitcoin users are hidden behind pseudonyms (public keys) which are recommended to be changed frequently in order to increase transaction unlinkability. We present an efficient method to deanonymize Bitcoin users, which allows to link user pseudonyms to the IP addresses where the transactions are generated. Our techniques work for the most common and the most challenging scenario when users are behind NATs or firewalls of their ISPs. They allow to link transactions of a user behind a NAT and to distinguish connections and transactions of different users behind the same NAT. We also show that a natural countermeasure of using Tor or other anonymity services can be cut-off by abusing anti-DoS countermeasures of the bitcoin network. Our attacks require only a few machines and have been experimentally verified. We propose several countermeasures to mitigate these new attacks.

1 0

Re: [Cryptography] Blogpost: CITAS, a new FBI security program proposal
by grarpamp 26 Nov '14

26 Nov '14

>>> http://www.metzdowd.com/pipermail/cryptography/2014-November/023693.html >>> http://dillingers.com/blog/2014/11/24/citas-threat-assessment-system/ >> let alone biased LE >> Heads up to Tor people, and cpunks to carve it up further. > This isn't the usual LE proposal Following on some related and technical comments... While my analogy and definition of security may not have been best suited, nor is this reply, the point remains that there is nothing special here for you as a corp. Anything you say that LE can provide for *you* with honeypots can also be sourced internally or from the open market and your subsequent call to LE to mop up upon discovery of badness therein. What is unique here is that LE will be classifying things learned from the HP's as gov't secrets. That's a hard problem. As opposed to telling you all of what you need to know to secure your own net under internal policies and vendor contracts that you would otherwise remain in control of. Further, technically, parking an HP on your net only tells you about what happens regarding via that HP, nothing else. And since you must distrust this other party HP [1], then all you've got is a cracked HP outside your trust zone, no different than any other box on the internet. It's limited vantage point and bogus security metrics argument. Sure, the US gov't might be able, on the whole from this, to correlate and expose more nation-state/international crime sources against the US and embarrass some foreign diplomats. That's always a good and fun thing [2]. And the services of LE are indeed valuable. However do not make the mistake of thinking that *you yourself* will benefit *directly* from this program, that's not what it's designed for or capable of. In fact, you will be left out as dog food in case of 'national security priorities/secrets' arise. The responsibility for securing your net still rests with you and you alone as always. The better way to be more secure is to ignore these silly sales schemes and look same effort at your own processes, weaknesses, code, OS/hardware, compartmentalization, etc. Maybe <=1% of that ends up being the use of HP's. Improve those own things overall and you'll be far better off. > This arrangement also strikes me as problematic in that it would also > allow the FBI to set up a huge pool of Tor, Gnutella, Bittorrent, etc, > nodes truly indistinguishable to users from genuine nodes run by people > who support anonymity, uncensored journalism, whistleblowers, and free > speech. Last, what if one day *you* _need_ to use a freedom network and they've sybil'd up their nodes *against you*? Be careful what you ask for and invite into your home in the name of security, you might just get it... applied against you in time of need. > economic output if it didn't cost so damn much to keep MS boxes > secure Well then the solution there is clear... get rid of the MS boxes, and those who sold and administer them. Like HP's, nothing special about MS either. Time limited I maybe not reply further. [1] For reasons of both sanity and legal insufficiency of any indemnity offered. [2] Note that some megacorps follow their own allegience... claiming the flag of whichever market suits them best at the moment.

2 1

Sign of New Order: US police kill boy, 12, carrying replica gun
by Georgi Guninski 26 Nov '14

26 Nov '14

http://www.bbc.com/news/world-us-canada-30172433 A 12-year-old boy has died after being shot by police in the US city of Cleveland, after carrying what turned out to be a replica gun in a playground.

1 0

Re: [Cryptography] Blogpost: CITAS, a new FBI security program proposal
by grarpamp 25 Nov '14

25 Nov '14

> genuinely seems likely to support rather than subvert security Security is not bringing more people onto your net or with you as partners, let alone biased LE. Do you let cops sleep in your house to protect you? What about that little dimebag you like to toke on Fridays? Besides, if they want the service, corps don't need LE to do what they can already do together neutrally on their own, or by subscribing to equivalent commercial honeypot services. What is this, infraguard 2.0? Clipper? Dept of redundancy? Big brother? TIA? Also, latency/TTL detection of remote hosting.. Heads up to Tor people, and cpunks to carve it up further. On Mon, Nov 24, 2014 at 8:24 PM, Ray Dillinger <bear(a)sonic.net> wrote: > Note to list participants: check the CC line of the original message > before responding. We are aware that this list is always monitored, but > this time I have explicitly invoked monitoring and explicitly invite > response. Hello Agent Chesson; feel free to join the (list and) > discussion if you have something to add or correct. It's a moderated > and usually very polite list, although events in the last couple of > years have caused some resentment and a great deal of distrust here > toward American Three-Letter agencies. > > Brief: The FBI is proposing a security service to assist American > companies in achieving network security. It is called CITAS, for > "Computer Intrusion Threat Assessment System." It is not an active > program yet; My impression that it is the proposal and brainchild of > special agent John B. Chesson and that he is actively trying to raise > support for it both within the agency and among its potential clients. > > This is one of very few proposals I have seen from any US agency that > genuinely seems likely to support rather than subvert security, in the > strict sense of owners retaining control of the assets they own. It > does not require backdoors, it does not require keeping insecure > plaintext traffic on the network, and it does not propose to compel > participation. > > What it proposes is that companies who join the service allocate an IP > address on their company's subnet for the use of the FBI, and the FBI > can then set up a honeypot at that IP address. Routers and switches in > the company's DMZ would direct traffic to the honeypot just as though it > were a company machine, leaving no clues to the contrary in route traces > or DNS, but the traffic would tunnel over some other channel, probably a > VPN, to a location controlled by the FBI. > > The honeypot would be physically located at and controlled by an FBI > data center. This does not imply that the FBI gets any > "behind-the-firewall" view of a company's network; the company's > firewall can distrust the honeypot just as much as it distrusts unknown > IP addresses out in the wild. > > The FBI would monitor the honeypots in real time for threats and > attacks, and when any "significant" threat or breach is detected, share > the information immediately with the subscribing company. > > Less briefly: > http://dillingers.com/blog/2014/11/24/citas-threat-assessment-system/ ‎ > > This arrangement strikes me as likely to be highly effective in terms of > security, because the FBI could leverage manpower and monitoring effort > across a huge pool of honeypots truly indistinguishable to attackers > from genuine targets. Effort spent by an FBI agent to understand and > script a log checker for a new threat would instantly apply to thousands > of companies via the honeypots sharing software, where the equivalent > effort spent by anyone else takes weeks to months to achieve wide > adoption, and never achieves wide adoption until after it is redone for > the nth time by many open-source volunteers. > > This arrangement also strikes me as problematic in that it would also > allow the FBI to set up a huge pool of Tor, Gnutella, Bittorrent, etc, > nodes truly indistinguishable to users from genuine nodes run by people > who support anonymity, uncensored journalism, whistleblowers, and free > speech. The data would, of course, be shared across all the usual > law-enforcement, espionage, and security agencies of the US. Although to > be honest, these services are already so heavily monitored that there is > little left to lose. > > Although Agent Chesson, whose presentation I attended, did not mention > these other uses, I would expect widespread adoption of this system to > mean effectively the death of "anonymous" P2P services such as Tor, due > to the simple fact of most of the gateway nodes being FBI-operated > sockpuppets. While Tor or something like it remains the only way in > most of the world to use the Internet for uncensored journalism or > whistleblowing, the FBI cannot possibly ignore that as a channel it is > also used by criminals. > > There is also some risk to the companies involved in the existence of > machines which they do not control but which have addresses publicly on > record as belonging to that company's subnet. They could experience > adverse public perception if a honeypot became publicly known as > someplace where an unsavory or criminal activity were happening and its > address were traced back to the company's IP block. > > > Ray "Bear" Dillinger > > > > > _______________________________________________ > The cryptography mailing list > cryptography(a)metzdowd.com > http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

Re: [tor-talk] Propsal for decentralization of the Tor network
by grarpamp 24 Nov '14

24 Nov '14

> prove decentralization creates vulnerability to a larger degree > than centralization Maybe the centralization issue should revolve around things other than such two sided math proofs should neither side win... 1) There's expectation that some TPO-like entity will blackball known bad nodes, a non-human distributed authority (be it DHT or otherwise) doesn't permit that. Which is actually a non issue because users can simply subscribe to whichever trusted blackball source they desire. Onionland may still be providing some of these bad node listing services. AFAIK, that's the only real service Tor authorities provide today. The rest is under the hood of the *only protocol* in (3) below. 2) The network simply cannot run if some or all of the nine authorities are taken offline. Even users passing around their descriptors file and continuing to run can't be done because the code doesn't support that. So the network dies. Tor right now is like the centralized 'illegal' filesharing traffic model ie: Napster... every single central sharing service that had human figureheads in control of the network got shutdown. When the heat comes to Tor, it will get shut down if its fixed human authorities can't stand the heat. There are not an endless number of figureheads, but there are an endless number of users. For which, as with DHT torrenting and bitcoin, the responsibility for those networks is so distributed that it's pointless to try taking them down. Phantom, I2P, and a number of others are also distributed and seem to be working fine as well. 3) Bitcoin and torrent also work as protoools because all users agree that the protocol is *the one and only true protocol*, they are at risk if they change, so a self maintaining gravity is both present and natural. If there are forks, they don't last because users figure it out and abandon them or at least stop until the network figures itself out. This is why Tor bootstrapping isn't an issue either... you're unlikely to bootstrap yourself into a bogus network for very long, especially if you do reasonable research in the network socialnet beforehand. Self host the repository, ship with signed recent descriptor and bad nodes subscription lists, bootstrap into that, and let network dynamics and user choice run from there. At least that's the model of some other networks. Tor is probably central today as a result of inheriting a central design model. Thereafter if not remaining so from simple gravity then from either: A) waiting for a chance to stand up with its authorities for the sake of proving out fundamental privacy/speech geopolitics. B) putting them in the position of standing as test fodder. C) trending nefarious. Tor is a US entity which has certain benefits and weaknesses. And the international support structure of (A) should be analyzed and stress tested to determine its strength bfore relying on it. All the while noting and incorporating similarities to the WL, Snowden, filesharing, and crypto battles, etc. Curiously, whenever all is said, it's still useful to have both centralized and decentralized networks surviving under pressure. Yet is centralization actually *required*, say to achieve something specific beyond that, or which cannot be modeled decentrally with some decision elements pushed out to the user.

1 0

Fed proposal for Virginia cellphone data sharing network
by Gregory Foster 23 Nov '14

23 Nov '14

United States Attorney’s Office in the Eastern District of Virginia (~2011) - "A Proposal for the Creation of the Hampton Roads Telephone Intercept Sharing Network (HRTISN)" by Investigative Analyst Paul B. Swartz: https://www.documentcloud.org/documents/1364622-hampton-roads-usatty.html via arstechnica (Nov 21) - "Feds proposed the secret phone database used by local Virginia cops" by @cfarivar: http://arstechnica.com/tech-policy/2014/11/feds-proposed-the-secret-phone-d… gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

1 1

Liars and "justice for all"
by Georgi Guninski 22 Nov '14

22 Nov '14

Saw this on local news, probably the search terms are "Ricky Jackson" + <something about justice> According to: https://www.themarshallproject.org/2014/11/21/the-corrections > In Ohio, Ricky Jackson and Wiley Bridgeman were freed hours > ago, 39 years after they were wrongfully convicted of murder > – during the Ford administration. ... > because the principal witness against them, a boy of 12 at the time, > now says he lied when he identified Jackson, Bridgeman, and a third > man as murderers. “Everything was a lie,” said the witness, Eddie > Vernon. “They were all lies.”

1 0

Top Obama Admin DOJ Official to Apple, Google: Encryption Will Lead to Dead Kids
by Zenaan Harkness 22 Nov '14

22 Nov '14

http://www.dailytech.com/Top+Obama+Admin+DOJ+Official+to+Apple+Google+Encry… Top Obama Admin DOJ Official to Apple, Google: Encryption Will Lead to Dead Kids Jason Mick (Blog) - November 20, 2014 12:34 PM Agency feels it's best to give up freedoms, privacy to "keep the kids safe", Apple and Google say "yea, right" According to a report in The Wall Street Journal, James Michael Cole, the Deputy Attorney General of the United States (DAG-US), last month met with high-ranking Apple, Inc. (AAPL) executives to discuss their plans to allows consumers to encrypt their personal data on their smartphones. During the meeting he expressed strong disdain for the company's privacy protections and lofted a wild argument that his critics complained was inflammatory hyperbole. I. "Won't Somebody, PLEASE Think of the Children!" The report states that DAG Cole, the second highest-ranking official at the U.S. Department of Justice, claimed that children would die if Apple carried out the scheme. James Cole Deputy AG James Cole claims encryption will result in children dying. [Image Source: WND] His argument reportedly boiled down to that law enforcement might be able to find details in a missing child case on a suspect's phone, but be stymied by encryption, leading to a delay in finding the child. Such a delay, he argued could allow a child to die. Apple executives weren't buying into the DOJ official's hypotheticals. The WSJ report states: The meeting last month ended in a standoff. Apple executives thought the dead-child scenario was inflammatory. They told the government officials law enforcement could obtain the same kind of information elsewhere, including from operators of telecommunications networks and from backup computers and other phones, according to the people who attended. Both Apple and Google Inc. (GOOG) in recent months adopted features that allow users to fully encrypt their pictures, video, messages, and other data on their mobile device. As mentioned above, while the data on the device is encrypted, data stored in the cloud by Apple or Google is still vulnerable to court ordered data grabs. Likewise, data stored locally on the user's PC associated with the device may be less secure, depending on their level of encryption on that computer. Both Apple and Google have been very cooperative with detecting and reporting child abuse material detected in their messaging and cloud storage services. In fact, they've been so proactive that they've actually come under fire from some users who claim the companies shouldn't be inspect user data for signs of child abuse. Android and iOS encryption Both Apple and Google have rejected requests by the federal government to remove encryption from their consumer smartphone platforms. [Image Source: Google/Apple] Ironically, even as some users criticize Google and Apple for "violating their privacy" by inspect the data users willingly give them, federal law enforcement agency are attacking on a polar opposite grounds, claiming Google and Apple aren't doing enough to assist law enforcement. Thus far the U.S. Federal Bureau of Investigation's director, James Brien Comey, Jr., has been the leading voice of criticism against smartphone encryption. In a recent interview, he admitted that the FBI had abused the public's trust in the past with investigations against civil rights activists and other abusive actions. And he admitted that his agency operates relatively non-transparently so the public has no real way of knowing if those kinds of abuses have stopped. But he argued that the public should take the FBI's word that it's since improved. FBI director FBI Director James Comey claims encryption allows users to break the law. He wants the privacy protection banned from America. [Image Source: AP] Director Comey argued that by giving users tools to protect their privacy, American tech firms would "allow people to place themselves beyond the law." Congress recently rejected Director Comey's calls for legislative action banning consumer encryption. They said the FBI Director's requests were out of touch with reality and would allow Americans to fall victim to criminals. The majority in both the House and Senate argued that banning encryption was overreaching and inappropriate. II. 1984 In the Real World, Three Decades Later This criticism was echoed by his colleague at Britain's Orwellian spy agency, the Government Communications Headquarters (GCHQ), recently condemned the privacy protections. In a recent op-ed in The Financial Times (UK), he wrote: [Google and Apple's smartphone platforms] have become the command-and-control networks of choice for terrorists and criminals, who find their services as transformational as the rest of us. The GCHQ works hand-in-hand with the U.S. National Security Agency (NSA) to spy on hundreds of millions of law abiding citizens in the U.S. and Britain, saddling taxpayers with annual costs in the tens of billions of dollars to finance this unprecedented police state. The NSA and GCHQ have reportedly worked together to sabotage encryption standards. While that expensive effort damages both countries' national security by creating vulnerabilities that can be exploited by criminals or hostile nation states, the intelligence agencies feel it is worth it, if citizens can be stripped of protections and monitored at all times. The DOJ, for its part, seemed to take a more ambiguous stance. Departing Attorney General Eric Holder in a recent speech seemed at times to praise the American tech leaders, and at other times to come close to echoing Director Comey's stern commentary. Behind closed doors, though, the Justice Department's comments were apparently less vague. Apple and Google show little signs of budging on the issue, though. At an October global technology conference sponsored by The Wall Street Journal, Apple CEO Timothy Cook stated: Look, if law enforcement wants something, they should go to the user and get it. It’s not for me to do that. American business leaders complain that the government's overreaching surveillance efforts are damaging their reputation, particularly overseas, where many regions are boycotting American tech products due to security concerns. III. AT&T Files Suit to Block "Enormous" Volume of Data Request Targeting Law-Abiding Americans Even at the telecom level, there's increasing pushback, as companies like AT&T, Inc. (T) believe that mass surveillance programs are damaging consumer confidence. AT&T on Monday filed an appeal seeking to stop the current volume of requests for customer data and phone records under the 2001 USA PATRIOT Act (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act). Obama spying Under the last two presidents, the federal government has used techniques borrowed from imperialist Britain to spy on hundreds of millions of law-abiding Americans. [Image Source: Reuters] Due to the secrecy provisions in the act, AT&T cannot say precisely how many requests it has received, but reportedly the NSA and other agencies are collecting data on hundreds of millions of Americans using PATRIOT Act general warrants issued by the FISA court. These general warrants are a wholly new development in the American legal system, that borrow from similar provisions the imperial British used in the mid-1700s in an attempt to suppress colonial freedoms. AT&T says these general warrants and the data grabs they order are poorly justified judicially using 1970s Supreme Court decision regarding landline telephones. They say those decisions "apply poorly" to the world of modern digital communications, a world in which many more Americans are connected to communications networks and a world in which data is far easier to grab in bulk. AT&T could only legally say that the volume of consumer request by the American federal government was "enormous". AT&T Data Wide [Image Source: AT&T/CNET] AT&T's bid to block the American government from spying on millions of law-abiding citizens will be heard by the U.S. Court of Appeals for the 11th Circuit, in Atlanta, Georgia. In the meantime, the conflict will continue to play out on a different level as smartphone platform providers battle their country's government over whether Americans have the right to privacy. Source: WSJ http://online.wsj.com/articles/apple-and-others-encrypt-phones-fueling-gove…

4 3