December 2014 - cypherpunks - lists.cpunks.org

little gift
by stef 24 Dec '14

24 Dec '14

https://www.ctrlc.hu/~stef/cognitive_biases_-_layer8_security_advisories.ep… happy festivus. -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

1 0

consent and trust? Oh... but we are ABOVE the law
by Александр 24 Dec '14

24 Dec '14

https://www.schneier.com/blog/archives/2014/12/the_limits_of_p.html - "The next time you call for assistance because the Internet service in > your home is not working, the 'technician' who comes to your door may > actually be an undercover government agent. He will have secretly > disconnected the service, knowing that you will naturally call for help and > -- when he shows up at your door, impersonating a technician -- let him > in. He will walk through each room of your house, claiming to diagnose the > problem. Actually, he will be videotaping everything (and everyone) inside. > He will have no reason to suspect you have broken the law, much less > probable cause to obtain a search warrant. But that makes no difference, > because by letting him in, you will have 'consented' to an intrusive search > of your home" >

4 3

Re: [Cryptography] 78716A
by Ryan Carboni 23 Dec '14

23 Dec '14

That's true. But they do in fact do research into malware, and it is infact my right to request information for "personal noncommercial use" which includes attempting to secure my computer. If the government produced records on how to best design a tree house, I am still allowed to request records on how to build a tree house. I cannot force them to create new records, but for records they have already produced, they have the duty and obligation to make a reasonable search. On Mon, Dec 22, 2014 at 10:48 AM, Jerry Leichter <leichter(a)lrw.com> wrote: > On Dec 18, 2014, at 5:22 PM, Ryan Carboni <ryacko(a)gmail.com> wrote: > > Common Americans are no longer considered worth protecting as part of > national security. > That's a silly conclusion. I would not have expected it ever to be part > of the NSA's mission to protect your home network. It's about like > expecting the Army to provide you with guidance and tools to protect your > home from foreign invaders. > > Let's get real here. There are levels of attack and protection. The Army > is supposed to protect *American society as a whole* against foreign > attacks. The NSA is supposed to primarily protect the communications of > the US government, and secondarily the communications of the Americans in > the aggregate. They haven't been doing much of a job at that - too busy > listening in on everyone - but that at least is arguably their mission. > Protecting you, personally ... no. (And frankly, would you real *want* > them to have that responsibility? With responsibility necessarily comes > power.) > > Hell, it's been confirmed by the courts that municipalities and their > police forces don't even have any specific duty to protect individuals: If > you call the cops to say someone is breaking in to your house but they > don't get there in time to protect you - well, it's sad, but they have no > *particularized* responsibility to protect *you*, and you have no recourse. > > -- Jerry > > >

1 0

Re: [Cryptography] Fwd: 78716A
by Lodewijk andré de la porte 22 Dec '14

22 Dec '14

On Dec 19, 2014 1:03 AM, <dj(a)deadhat.com> wrote: > > > That organization advised that the request, as worded, is overly broad. > > 'Overly broad' is not the limiting factor. > > I made an FOIA request that they tell me where I've traveled (I don't have > records, but I know the government does and they want me to fill in where > I've been on a form). > > It couldn't be less broad. > > I'm still waiting for a response 6 months later. Good request though.

2 1

SpaceX Will Announce Micro-Satellites For Low Cost Internet Within Three Months
by Eugen Leitl 22 Dec '14

22 Dec '14

http://techcrunch.com/2014/11/10/spacex-will-announce-micro-satellites-for-…

2 1

Latest Belarusian censorship law & censorship actions
by Anton Nesterov 22 Dec '14

22 Dec '14

Today President of Belarus signed a law which provides heavy regulation to freedom of speech. Basically, it makes any website media and forbids "information aimed at the propaganda of the war, extremist activities, or the calls for such activities, pornography, violence, cruelty, and any other informations which distribution can harm national interest of the Republic of Belarus, or forbidden by this law, or by any other legislative act of the Republic of Belarus". It also force owners of websites to moderate user-generated content. Any website which violate this will be blocked. Also the law forbids any media with more than 20% of foreign investors. The law was passed really fast, only on 17st it came info parliament, and today, 21st, it's already signed by president. Nobody ever heard that such law are coming, even in the rumors. The law will came into force on 1st January. Yesterday domain name onliner.by, which hosted Belarusian media portal, was seized. They moved to onliner.ru. Media portal 21.by was also blocked. Two days ago some media was blocked, including charter97.org (they was already blocked for years for some users), belaruspartisan.org, gazetaby.com, zautra.by, udf.by, naviny.by, belapan.com, belapan.by. Minister of Information Liliya Ananich asked media to use only official sources and write articles in the national interest of the country. Besides media censorship, there is some financial problems because of Russian financial crisis. So the govt blocked 13 online markets which posted prices in US dollars, also 3 websites (deal.by, migom.by, kufar.by) was warned as they had ads on goods with price in $. prokopovi.ch, p2p currency exchange, was also blocked. http://www.pravo.by/main.aspx?guid=12551&p0=H11400213&p1=1 — text of the law (Russian) http://www.belaruspartisan.org/politic/289548/ (Russian) http://belapan.by/archive/2014/12/21/748603/ (Russian) http://www.belaruspartisan.org/politic/289548/ (Russian) http://www.belaruspartisan.org/politic/290031/ (Russian) -- https://nesterov.pw GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 https://keybase.io/komachi/key.asc

6 5

Fwd: [tor-talk] Possible upcoming attempts to disable the Tor network
by coderman 21 Dec '14

21 Dec '14

---------- Forwarded message ---------- From: Roger Dingledine <arma(a)mit.edu> Date: Fri, 19 Dec 2014 17:19:05 -0500 Subject: [tor-talk] Possible upcoming attempts to disable the Tor network To: tor-talk(a)lists.torproject.org The Tor Project has learned that there may be an attempt to incapacitate our network in the next few days through the seizure of specialized servers in the network called directory authorities. (Directory authorities help Tor clients learn the list of relays that make up the Tor network.) We are taking steps now to ensure the safety of our users, and our system is already built to be redundant so that users maintain anonymity even if the network is attacked. Tor remains safe to use. https://blog.torproject.org/blog/possible-upcoming-attempts-disable-tor-net… --Roger -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

4 6

Re: [Cryptography] GHCQ Penetration of Belgacom
by grarpamp 20 Dec '14

20 Dec '14

On Sat, Dec 20, 2014 at 12:31 PM, hbaker1 <hbaker1(a)pipeline.com> wrote: >>From: dan(a)geer.org >> >> | I think it would be very hard to find a backdoor suggested by >> | Norm Hardy. Modify the CPU to detect when two specific floating >> | point numbers are multiplied. When they are, execute the next >> | instruction in privileged mode. >> >>It's my second-hand understanding that it would take perhaps 3,000 >>gates to implement intentional sensitivity to a pre-designed kill >>packet. The addition of 3,000 gates to any current chipset will >>never be found in current hardware, e.g., the iPhone 6 has two >>billion transistors on the system chip. >> >>Others more knowledgeable welcome to correct my understanding. > > So Intel&Apple have provided PRC with netlists for their processor > chips? > > Of course, PRC shouldn't believe them, unless they could also > manufacture their own chips from the netlists. It doesn't matter what a chipmaker provides and claims as truth today. Anyone, spy or not, anywhere in the chain from design to fab could insert anything, there are probably not enough internal control and validation programs in place to find it. And if something untrustworthy is sucessfully implanted or simply produced TOP SECRET approved, who on the outside is going to find it? No one publicly open, external, and disinterested is sampling these chips off the shelves and decapping them, or exhausting all possible input data against expected output, or has eyes in the fabs. Until the world has truly open fabs, you might as well assume it's game over. Similarly, we can't even get rid of default firmware passwords, baseband, bad crypto, closed source, vPro, and all the other examples of potentially backdoorish things possibly against the user... including NSA style spying and corporate datamining tagged with your name. Can you apply enough pressure to get rid of closed fabs, and the elements within governments and corporations that think up, perform and produce this kind of stuff?

1 0

Bitcoin networks surpasses 2^80 hashes per week
by Ryan Carboni 17 Dec '14

17 Dec '14

https://blockexplorer.com/q/hashestowin log(171833398380382098659*24*60*7)/log(2) Gives context to the obsolescence of 80-bit block ciphers (it only takes ten million dollars of dedicated hardware to crack an 80-bit cipher). And context to the NSA's design of Skipjack. Naturally even a 2^64 collision attack requires implausible amounts of storage, so properly designed hash functions should be secure for the indefinite future.

5 5

Re: [Cryptography] Toxic Combination
by Alfie John 15 Dec '14

15 Dec '14

On Mon, Dec 1, 2014, at 08:55 AM, Guido Witmond wrote: > I'm starting to consider the combination of current best practice with > server certificates and password to be a Toxic Combination. > > The general issue is twofold: > > People need to validate the authenticity of a site before typing in > their password; > > The password gets transmitted to the other party. And this is taken advantage of every day by phishing attacks. However although your solution of setting up DNSSEC and DANE is the _correct_ solution, it's just too complex and hard to get right for a lot of system admins so it's not going to get uptake - just look at how PGP is also the _correct solution_ for encrypting messages and yet has not had the uptake since 1991! I think a better solution would be something like implementing Digest Authentication (RFC 2069, but replacing MD5 with something like AES-256 and allow it to be upgradable) in the browser. The password field value would then be replaced with the value from the DA call and no secrets would be leaked. This solution would get way faster adoption. Alfie > Most people assume that if it looks like their bank and the address bar > is green then it should be safe. Regrettably, it’s not. Criminals obtain > valid certificates using stolen creditcards and passports. The true > method for authenticating a site requires verification of server > certificate fingerprints. And if you don’t know what that means, you > have to spot the spelling errors, the differences in layout and other > mistakes to detect the scammers. Good luck! > > The second part is just as problematic: The password must remain secret, > yet it must be transmitted to the other side to log in. > > This is the Toxic Combination. One failure to detect a scammer’s site > and the password is compromised. The scammers can do everything that you > can do with the password. > > > [promo] > > For more information, please see: > > http://eccentric-authentication.org/blog/2014/11/30/spot-the-differences.ht… > > http://eccentric-authentication.org/Usable-Security.pdf > > [/promo] -- Alfie John alfiej(a)fastmail.fm

3 2