December 2014 - cypherpunks - lists.cpunks.org

Firechat's Amazon S3 instance got blocked in Russia
by Anton Nesterov 10 Jan '15

10 Jan '15

So firechat.s3.amazonaws.com with IPs 54.231.13.81, 54.231.13.89, 54.231.2.105, 54.231.32.137, 54.231.8.89, 54.231.9.17, 54.231.96.161 was blocked in Russia by order 27-27-2014/Ид4349-14 of General Prosecutor. That instance was used by Firechat to over-the-internet chats. Firechat became very popular in Russia in last days (it's got to the top of Apple's App Store) because of it's mesh-chat function and because of planned rallies in support of Alexei Navalny. Rally was planned on 15 Jan, but as court yesterday decide to move the date of sentence to 30 Dec, it happened today. Alexei Navalny got 3.5 years of suspended sentence, and his brother, Oleg, was jailed for 3.5 years. This is the first time when some service got blocked that way, before that there was only websites. It's not a big deal because of mesh chat. Both firech.at & opengarden.com/firechat wasn't blocked and still works, downloads from App Store & Google Play are fine too. Due to how ISPs block things (IP blocking mainly), Russian users also got a problems with many services which use S3. https://meduza.io/news/2014/12/30/tehnicheskiy-domen-messendzhera-firechat-… (Russian) http://www.theguardian.com/world/2014/dec/30/kremlin-critic-navalny-given-s… (English) -- https://nesterov.pw GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 https://keybase.io/komachi/key.asc

2 3

Re: [cryptography] NSA Attacks on VPN, SSL, TLS, SSH, Tor
by John Young 10 Jan '15

10 Jan '15

Cryptome does not pretend to provide illusory security, that is security. It is a vile, rotten, corrupt endeavor, like life. Chuckle. Visitors, readers, consumers must be skeptical of security, and not rely upon security promoters, their followers and investors who exploit dependency by fear uncertainty and doubt. Skepticism of security claims and methods is one of the purposes of these lists. Perhaps the main purpose, although it is commonplace for these lists to be used for soliciting befuddled consumers to hop aboard the gravy train. Now and then skeptcism of the security arises but is usually suppressed during times of crisis when incentive is rich to promote poor products and services. Governments, commerce, orgs, experts cooperate to foster crises under guise of opposition. This applies to all forms of security, safety, protection, defense, hygienic pharma. Still, Cryptome endorses the continuing struggle to improve citizen protection, not only as a job, career, industry, but as citizens' obligation to bear responsibility for the commonweal against its inside and outside enemies, if you will, common math against the deadly germs. One way to do that is to not oversell it, tone down the threats, reduce drumbeating, avoid hyperbole for and against, forego advertising, gang-bang hectoring, circle jerk conferencing, TEDing, prize bestowing, to quietly invent, improve, critique, test, apply, re-test often, expect to be deceived by colleagues witting or unwitting, especially by sales, politicians, authoritarians -- the persistent germs. At 02:50 AM 12/30/2014, you wrote: >john likes to be poetic as a wall - dear john please listen to the >smart people and have a small bit of humility - it will make you >better at your job and we need EVERYONE to step up and be better at their jobs > >On Tue, Dec 30, 2014 at 7:38 AM, grarpamp ><<mailto:grarpamp@gmail.com>grarpamp(a)gmail.com> wrote: >On Mon, Dec 29, 2014 at 8:20 AM, John Young ><<mailto:jya@pipeline.com>jya(a)pipeline.com> wrote: > > Hash this motherfucker, said math to germ. > >JYA, you, as the original publisher of various and valued datasets... >the responsibility to calculate, sign, and publish said hashes rests with >you alone. Please consult with any trusted parties should you need >assistance in such matters. A future of archivers, disseminators, and >analysts will thank you. > > > > >-- >Cari Machet >NYC 646-436-7795 ><mailto:carimachet@gmail.com>carimachet(a)gmail.com >AIM carismachet >Syria +963-099 277 3243 >Amman +962 077 636 9407 >Berlin +49 152 11779219 >Reykjavik +354 894 8650 >Twitter: @carimachet ><<https://twitter.com/carimachet>https://twitter.com/carimachet> > >7035 690E 5E47 41D4 B0E5 B3D1 AF90 49D6 BE09 2187 > >Ruh-roh, this is now necessary: This email is intended only for the >addressee(s) and may contain confidential information. If you are not the >intended recipient, you are hereby notified that any use of this >information, dissemination, distribution, or copying of this email without >permission is strictly prohibited. >

12 21

What the hell can be done with this trinity?
by Badbiosvictim 06 Jan '15

06 Jan '15

USPS interdiction of routers, computers, packages and mail has little over sight. USPS attempted to censor report of failure to follow safeguards. https://politico.com/story/2014/06/snail-mail-snopping-safeguards-not-follo… >From: " Александр " <afalex169(a)gmail.com> >From the "Spiegel" article > >If all else fails, the NSA and its allies resort to brute force: >> 1. They hack their target's computers/ >> 2. >> >> They hack Internet routers to get to the secret encryption/ >> 3. T >> >> hey intercept computers on the way to their targets, open them and >insert >> spy gear before they even reach their destination. > > >Ok. Nothing new. > >But what the hell can be done with this trinity? >

3 4

John Gilmore: Cryptography list is censoring my emails
by John Young 05 Jan '15

05 Jan '15

http://cryptome.org/2014/12/gilmore-crypto-censored.htm

4 3

Snowden docs show none are originals of spies
by John Young 31 Dec '14

31 Dec '14

PDF properties of Snowden docs show none are originals of spies. Likely sanitized-redacted by Snowden/outlets, originals need open scrutiny.

2 1

Snowden Paywalled
by John Young 31 Dec '14

31 Dec '14

Free: 577,131 documents (millions of pages) informing public debate: https://www.documentcloud.org/public/search/ Paywalled: Snowden: 3,361 pp of 58K-1.7M files: http://cryptome.org/2013/11/snowden-tally.htm

2 1

Over 80 Percent of Dark-Web Visits Relate to Pedophilia, Study Finds
by Jordi Salvia 31 Dec '14

31 Dec '14

http://www.wired.com/2014/12/80-percent-dark-web-visits-relate-pedophilia-s… *---Jordi Salvia Cuadras* Vilafranca del Penedès *XMPP: *jsalvia(a)jabber.ccc.de <jsalvia(a)riseup.net> *PGP Key:* 0xBF9E5208

2 1

<JYA> Hash this motherfucker, said math to germ.
by coderman 31 Dec '14

31 Dec '14

On 12/29/14, John Young <jya(a)pipeline.com> wrote: > From discussion on these lists and elsewhere tampering with > data can, does, occur at every software and hardware hand-off, > with each self-serving iteration having hidden and vulnerable hardware > and software undisclosed malignity, no matter the security ostentatiously > applied said another way: there are risks known, and known unknown, and unknown unknown, in such a calculated cache - digital and present harm alike and unto the soul-deep sickness a dragon Smaug, imbued as dark greed, unto sea of coin and wealth unseen in any other age... the risk visible, or not. fathomable, or not. but risk all the same. --- "This is a trap, witting and unwitting. Do not use it or use at own risk. Source and this host is out to pwon and phuck you in complicity with global Internet authorities. Signed Batshit Cryptome and Host, 9 July 2014, 12:16ET." - https://cpunks.org//pipermail/cypherpunks/2014-July/005020.html still true, as always! ... as practical matter, content in such an archive is more actionable in a criminal or civil sense, in some locales, simply by nature of the contention around the content. or loaded with malware. or honeytoken to the void, or ruse of attention sink, or misleading intentionally compartment of confusion, or generator markov awry, or ... --- FY2014 corpora is coming, like cryptome-jul2014 reply to receive early distribution. - cryptome, web, other selected volumes - sha256 short sums, selected signatures - annotated search-able formats, where available - coder's annotations and subsets [to explain later] - Xapian stores by domain for custom aggregation or scope

2 1

Re: 78716A
by Badbiosvictim 30 Dec '14

30 Dec '14

Glad to hear there is legal assistance and a database without being charged attorney hourly fees. I will sign up with MuckRock. >From: Gregory Foster <gfoster(a)entersection.org> >Consider using MuckRock to file your FOIA request, track the response >schedule, and automatically post responsive documents publicly: >https://www.muckrock.com/agency/united-states-of-america-10/national-securi… > >You can review successful requests to the NSA to discern ways to >encourage timely responses, or use them as templates. The MuckRock >folks are doing important work to provide an environment for FOIA >requestors to avoid duplicative efforts, automate the tedium, and >create >a powerful new community. You can follow interesting requests to be >notified when there are status changes and get the docs immediately. > >gf

1 0

List Administrivia
by grarpamp 30 Dec '14

30 Dec '14

I believe google may be offering to transmit a better combination than RC4-SHA. Please check configs on your receive end. Received: from antiproton.jfet.org (antiproton.jfet.org. [209.141.47.85]) by mx.google.com with ESMTPS id bar (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128) 30 Dec 2014 Received: from google.com (google.com [a.b.c.d]) by antiproton.jfet.org (8.14.4/8.14.4/Debian-4.1) with ESMTP id foo (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <cypherpunks(a)cpunks.org> 30 Dec 2014

2 1