April 2014 - cypherpunks - lists.cpunks.org

Meanwhile as the internet reboots...
by grarpamp 08 Apr '14

08 Apr '14

Depending on your looking glass, at around 20:30UTC one particular system (the Tor network, ~5300 nodes) had a cumulative uptime of about 14.05Gsec. It's dropped by about 6.5% so far. This bug should make for some interesting infrastructure analysis across a variety of systems. http://heartbleed.com/

1 0

Re: [cryptography] Github Pages now supports SSL
by Eric Mill 08 Apr '14

08 Apr '14

For what it's worth, I think CloudFlare dropping the price of SSL is going to force other companies to follow suit, so hopefully their move creates competition that both reduces CloudFlare dependency and increases the amount of encrypted traffic on the web. For example, today I learned that Amazon CloudFront finally dropped the price of SSL in front of S3 for custom domains from $600/month(!!) to $0/month: http://aws.amazon.com/cloudfront/custom-ssl-domains (As long as you're comfortable using SNI, which excludes users on Windows XP.) CloudFlare is hopefully just one part of the tip of the spear. On Mon, Apr 7, 2014 at 4:05 AM, ITechGeek <itg(a)itechgeek.com> wrote: > For the 3 co-founders, they appear to provide the exact same info as when > the Wayback Machine first captured the people page in 2010. > > > http://web.archive.org/web/20101015060142/http://www.cloudflare.com/people.… > > http://www.linkedin.com/in/mprince > http://www.linkedin.com/pub/michelle-zatlyn/9/b19/17b?trk=pub-pbmap > http://www.linkedin.com/pub/lee-holloway/0/152/159 > > I don't see any indication of connections to the US Intel Community based > on looking them up online. I see connections to Law Enforcement for > Matthew Prince, but connections to law enforcement != connections to Intel > community. > > I'm not debating the idea Cloudflare could receive an NSL which is true > for any US company (although I think most countries have some equiv). > > You are telling us to do our homework. Since we don't seem to be seeing > the same information that you are, can you point us at some sites? Maybe > the search engine you are using is pointing you in a different direction > than Google is pointing me or maybe you know better search terms. > > > > ----------------------------------------------------------------------------------------------- > -ITG (ITechGeek) > ITG(a)ITechGeek.Com > https://itg.nu/ > GPG Keys: https://itg.nu/contact/gpg-key > Preferred GPG Key: Fingerprint: AB46B7E363DA7E04ABFA57852AA9910A DCB1191A > Google Voice: +1-703-493-0128 / Twitter: ITechGeek / Facebook: > http://fb.me/Jbwa.Net > > > On Sun, Apr 6, 2014 at 5:28 PM, Ryan Carboni <ryacko(a)gmail.com> wrote: > >> oh dear. >> He helped the government combat crime and nuisance style offenses. >> Clearly in collusion. >> >> >> On Sun, Apr 6, 2014 at 12:20 PM, <tpb-crypto(a)laposte.net> wrote: >> >>> > Message du 06/04/14 17:41 >>> > De : "staticsafe" >>> > On 4/6/2014 10:40, tpb-crypto(a)laposte.net wrote: >>> > >> Message du 04/04/14 20:09 >>> > >> De : "Eric Mill" >>> > >> Along with Cloudflare's 2014 plan to offer SSL termination for >>> free, and >>> > >> their stated plan to double SSL on the Internet by end of year, the >>> barrier >>> > >> to HTTPS everywhere is dropping rapidly. >>> > >> >>> > > >>> > > I agree that putting https everywhere is great, but Cloudflare's >>> founders are tightly linked with the US-intelligence community. That fact >>> alone kind of kills any claims they make about data security within their >>> service. >>> > >>> > Source for this please? >>> > >>> >>> Is it so painful to do your own homework? >>> >>> "Matthew Prince, Lee Holloway, and Michelle Zatlyn created CloudFlare in >>> 2009.[1][2] They previously worked on Project Honey Pot." - >>> http://en.wikipedia.org/wiki/CloudFlare >>> >>> "[...] the project organizers also help various law enforcement agencies >>> combat private and commercial unsolicited bulk mailing offenses and overall >>> work to help reduce the amount of spam being sent [...]" - >>> http://en.wikipedia.org/wiki/Project_Honey_Pot >>> >>> That's just for starters, you can dig more and find more. It is >>> interesting that the history of the founders themselves is no longer >>> exhibited in cloudflare.com website as it was years ago. >>> >>> >>> As an American company, there is nothing preventing Cloudflare from >>> receiving NSLs and having to shut up about them. What use is a system that >>> you can't trust like this? >>> >>> You can say "oh, but they go after the bad guys, spammers". But that >>> doesn't limit it to spammers neither do we know who are the so called bad >>> guys, since that is decided by American secret laws, made by secret courts, >>> that issue secret orders. >>> >>> No trust to American companies, less even trust to American companies >>> that promise any kind of data security. Better no security than a false >>> sense of it. >>> >>> Sorry. >>> _______________________________________________ >>> cryptography mailing list >>> cryptography(a)randombit.net >>> http://lists.randombit.net/mailman/listinfo/cryptography >>> >> >> >> _______________________________________________ >> cryptography mailing list >> cryptography(a)randombit.net >> http://lists.randombit.net/mailman/listinfo/cryptography >> >> > > _______________________________________________ > cryptography mailing list > cryptography(a)randombit.net > http://lists.randombit.net/mailman/listinfo/cryptography > > -- konklone.com | @konklone <https://twitter.com/konklone>

1 0

fuck ALL obscene systems of covert compromise and corruption [was: Geoff Stone, Obama's Review Group]
by coderman 07 Apr '14

07 Apr '14

the entire "Legislative Laundry of FBI+CIA+NSA+DIA Collusion" and their enablers need to die in a fire. sole focus on NSA a smoke screen... On Wed, Apr 2, 2014 at 7:56 PM, <dan(a)geer.org> wrote: >... > From the outset, I approached my responsibilities as a member > of the Review Group with great skepticism about the NSA. I am > a long-time civil libertarian, a member of the National Advisory > Council of the ACLU, and a former Chair of the Board of the > American Constitution Society. To say I was skeptical about > the NSA is, in truth, an understatement. > > I came away from my work on the Review Group with a view of > the NSA that I found quite surprising. Not only did I find > that the NSA had helped to thwart numerous terrorist plots > against the United States and its allies in the years since > 9/11, but I also found that it is an organization that operates > with a high degree of integrity and a deep commitment to the > rule of law. my greatest fears are not about what the NSA has intended, but what the NSA has built with the best intentions, which in turn will fall into malicious hands. history tells us this is but a matter of time. as an attacker, i see the capabilities so developed as nothing short of abhorrent. they should not exist, they should not be pursued. they are means that are unethical no matter the end. > ... The Review Group found that many of > the programs undertaken by the NSA were highly problematic and > much in need of reform. But the responsibility for directing > the NSA to carry out those programs rests not with the NSA, > but with the Executive Branch, the Congress, and the Foreign > Intelligence Surveillance Court, which authorized those programs see also, the "Legislative Laundry of FBI+CIA+NSA+DIA Collusion" to focus on NSA is to miss the underlying patterns of control at work... > It gradually became apparent to me that in the months after > Edward Snowden began releasing information about the government's > foreign intelligence surveillance activities, the NSA was being > severely -- and unfairly -- demonized by its critics. conflating NSA as an institutional entity, NSA tasking, and NSA staff. NSA tasking is bad and should feel bad. NSA institutional culture is less bad, yet needs correction. NSA employees individually? they have been deceived and demoralized themselves! this group is the least culpable, in my eyes. i have friends in IC and i can tell you they feel no less sucker punched by these revelations. make no mistake, they've been similarly mislead by "legal weasel words" and "exceptionally compartmentalized deceptions", etc. there are heads at the top that need severing from bodies. [wait, they've admitted that is too kind. life support in keep-away for centuries!!!!] > Of course, "I was only following orders" is not always an > excuse. But in no instance was the NSA implementing a program > that was so clearly illegal or unconstitutional that it would > have been justified in refusing to perform the functions > assigned to it by Congress, the President, and the Judiciary. see also "compartmentalization". i have a story to tell here about physical encryption systems in surveillance satellites. you think NSA staff even knew what they were working on? that's the exception, rather than the rule. your "big data science to optimize in memory representation of sparse lattices" is just an innocuous cog in a machine cracking weak crypto to target drones to metadata targets that resulted in the loss of innocent life in some third world backwater you've never given thought to. [and tomorrow's domestic oppression of opportunity unleashed through the best intentions. if only we knew back then... if only...] > Although the Review Group found that many of those programs > need serious re-examination and reform, none of them was so > clearly unlawful that it would have been appropriate for the > NSA to refuse to fulfill its responsibilities. you think that's an accident? this is precision engineering! see also, the "Legislative Laundry of FBI+CIA+NSA+DIA Collusion" > Moreover, to the NSA's credit, it was always willing to engage > the Review Group in serious and candid discussions about the > merits of its programs, their deficiencies, and the ways in > which those programs could be improved. Unlike some other > entities in the intelligence community and in Congress, the > leaders of the NSA were not reflexively defensive, but were > forthright, engaged, and open to often sharp questions about > the nature and implementation of its programs. this means they're the least useful to question. when does CIA/DIA scrutiny begin? > In short, I found, to my surprise, that the NSA deserves the > respect and appreciation of the American people. But it should > never, ever, be trusted. NSA used like a tool, just like the sysadmin and cryptographer "tools" they exploited and used so effectively...

6 7

Strangecoin
by Bryan Bishop 07 Apr '14

07 Apr '14

No proposed implementation but here's some fun ideas: http://digitalinterface.blogspot.com/2014/03/strangecoin-proposal-for-nonli… """ What's unique about Strangecoin? - Strangecoin transactions can be *nonzero sum*. A Strangecoin transaction might result in *both* parties having more Strangecoin. - Strangecoin transactions can be *one-sided* and can be conducted entirely by only one party to the transaction. - The rate of change of one's Strangecoin balance is a more important indicator of economic influence than the balance itself. - Optimal investment strategy in Strangecoin aims to *stabilize* one's balance of Strangecoin. - A universal account provides all users a basic Strangecoin income, effectively unlimited wealth, and direct feedback on the overall prosperity of the network. .... As the example suggests, the dynamics of Strangecoin might be usefully thought of in terms of a "reputation system" rather than a strictly financial tool, even though the basic mechanics involve the regular method of exchanging currency for goods perceived by both parties to be of equal value. Because of the nonlinear relationships among Strangecoin users, each user effectively draws on a network of support in each economic transaction, coupling its activity to the successes (and failures) of the that network of activity. The result is a model of the complex interdependencies within a community of economic agents, and the dynamics by which those networks develop and decay. For this reason, Strangecoin might have implications for quantifying the role of individual choices and responsibility in the context of corporate action, and for resolving other difficult issues in the management and ethics of collective economic action. """ https://news.ycombinator.com/item?id=7494709 """ Other comments suggest that this can be implemented with existing tools, which I take as a virtue of the proposal. In any case, John von Neumann proved a long time ago that any nonzero sum game with n players can be modeled as a zero sum game with n+1 players, where the n+1 player represents the global state. TUA is simply an implementation of this proof. http://en.wikipedia.org/wiki/Zero-sum_game#Extensions I tried to explain inhibition in another comment in this thread. https://news.ycombinator.com/item?id=7496858 I give an an analogy in the proposal of the popularity of a celebrity couple being a nonlinear relationship to the popularity of each celebrity individually. I think our intuitive understanding of our social relationships is nonlinear in this way generally, and I think Strangecoin can model those nonlinear relationships well. So, for instance, I'm imagining a family, spouses, close friends, and so on entering into extended coupling transactions, so that as a community their prosperity rises and falls together. I might also enter into such transactions with certain business with whom I want to couple my activities, and these coupling transactions might serve in lieu of direct billing or payment. A coupling relationship with a business is effectively a contract, but with traditional currency you need the whole legal framework of contracts to support the transaction, and with Strangecoin the transaction is built directly into the currency, and the interface looks almost exactly like a point-of-sale cash transaction. And I can enter into less serious relationships of varying degrees with other parties. The effect is a way of managing not just financial transactions, but also reputation, investment, and other dynamics social constraints on the economy via the currency itself. Money is memory ( http://www.minneapolisfed.org/research/sr/sr218.pdf) but our existing currencies only represent some aspects of our economic activity, and therefore put limits on the memory stored in the economy. A nonlinear coin like Strangecoin can embed that social knowledge in the currency itself, providing a more robust memory framework on which we can conduct our economic transactions. I only hint at this in the proposal, but I suspect a system like this is required to resolve the twisted legal artifice the corporate veil, because it quantifies explicitly the role individuals have in collective economic activity, and thereby gives a method for explicitly holding persons proportionally responsible (in both credit and blame) for their contributions to that activity. But I think that's a much more radical proposal than the one I've offered for Strangecoin, and I should probably only be defending that here. =) """ - Bryan http://heybryan.org/ 1 512 203 0507

3 2

FAKE Indian TROLL ALERT!!(cari machet warning!)
by Anonymous Remailer (austria) 07 Apr '14

07 Apr '14

On Apr 5, 2014, at 3:26 AM, Cari Machet <carimachet(a)gmail.com> wrote: > capitalist AND You BITCH are a thieving Looter Time to DOX you and turn over all to the passport authorities/NSA!! FUCK you Cari Machet - fake indian

3 2

hello my fellow future bug splats
by coderman 07 Apr '14

07 Apr '14

the incidence of civilian casualties during drone strikes implies that they're intentionally focused on larger degree social congregations rather than laser specific solitary strikes. presumably this ensures that not just a target, but target collaborators are also consumed in a strike. ... except when the strikes are mis-targeted, and the amplified social circle pulls in women and children. yet still no blacklash? why do drone strikes continue? what the fuck? http://notabugsplat.com/

5 4

Re: hello my fellow future bug splats
by John Young 07 Apr '14

07 Apr '14

Still, despite the slight irritation about drone killings, there have been, AFAIK, no protests at the CIA HQ gates against the agency's drone pilots, sensors and weapons launchers located at temporary huts at both sides of spies' pig sty dining hall. Nor at the drone pilots, sensors and weapons launchers training base at Indian Wells AFB, Nevada. Nor at the homes of spy and mil drone operators, sensors and weapons launchers. (Apparently none have yet been doxed although DoD droners have been named in news reports and DoD PR media when medals are awarded.) Nor at the contractors who build and staff drones, training and deployment. Nor at the homes of the USG three-branch members who support the drone murders. Nor at the several universities where students are trained to operate drones in expectation of well-paying jobs in a booming (no pun) industry. DoD recruits by touting the swell future for droners trained by DoD for later civilian employment. As well as touting the role of drone contractors (CIA does too but more discreetly). Nor any sabotage of drone systems. Oops, that criminal, don't do it. So it is not clear what opponents of drone kilings are willing to do beyond risk-free bitching, strutting, mail bombing and petitioning. All of which is a good start but not likely to have much effect until opposition is well beyond verbal puking. Does this remind of the way crypto is handled by deft verbal puking about the industry while quietly working within it, hoping the pukers will continue helping draw attention to the need for a duplicitious practice to combat enemies of the industry.

1 0

active beam steering to camouflage transmission [was: How safe is smartphones today?]
by coderman 07 Apr '14

07 Apr '14

On Sun, Apr 6, 2014 at 12:14 PM, grarpamp <grarpamp(a)gmail.com> wrote: >... > Agreed near-unlimited-width SDR has fun potential, and for cpunks > some equally hard to identify/jam/locate encrypted comms that don't > interfere with traditional narrow comms. past experiments with direction finding gear has shown it very dependent on key assumptions. use of beam steering to thwart direction finding and triangulation a world of fun. relevant references solicited!

2 1

Re: [tor-talk] How safe is smartphones today?
by coderman 07 Apr '14

07 Apr '14

On Thu, Apr 3, 2014 at 3:10 AM, <antispam06(a)sent.at> wrote: > ... > That made me wonder. What are the risks involved using a Tails PC and > getting online through a 3G clean Android smartphone with no apps > installed or Google accounts activated tethered through USB? as long as you assume the 3G link is as trustworthy as your neighborhood open wifi, you're fine. i can tell you that i've had malware sent down a 3G pipe to a tethered target just as you might except on any other hostile network. incidentally, this tethered mode is how i prefer to communicate: 1. a front-end sacrificial/signalling device to indicate a threat level and carry traffic. (hotspot puck, 3G phone, CPE router, etc.) 2. a packet inspecting host to passively monitor for anomalies and respond to emergencies. (emergency zeroisation+filtering) 3. the actual communicating device containing keys and terminating sessions. further hardened by defense in depth. for any decent attacker, mobile platforms are just fucked. sorry! this is true until you can implement an entire isolated SDR stack; even opaque wifi blobs are fail. [i've stated my preference for various software defined radio setups before, omitted.] > Or better yet: who can see what? > > I read the hardware is rigged (Samsungs), you wrote about the software > being rigged (the ability to remotely install apps), and surely the > phone company can do a lot of tricks from the early days of GSM. So is > it crazy to route Tor traffic through such a gateway? it's fine to route traffic over such a device as long as you assume the attacker is also watching and able to inject into your traffic over said gateway :) this means you run Tor on a different device, not the phone itself. last but not least, regarding the "Mission Impossible: Hardening Android for Security and Privacy" https://blog.torproject.org/blog/mission-impossible-hardening-android-secur… i have found the following techniques useful in the past against advanced attackers: 0.) rootkit Android kernel to trap and notify|block syscall use by user-id and process-id. anomalous calls by a privileged processes or users is a great signal of compromise. 1.) monkey patch Android API in every dalvik runtime for specific calls of interests that should not be granted. this caught the "Android Master key" vuln in practice as an updated app was behaving way out of permission and expected profile. 2.) deploy camouflage guacamole to feign vulnerability to various techniques and then use exploit attempts to signal presence of an adversary of identified capabilities. doing the above on a reference Nexus 7 platform left as exercise for the reader, *grin* best regards,

3 5

intelligence community leadership: patriarchal dicks
by coderman 07 Apr '14

07 Apr '14

"if the intelligence community thinks that the controversy over our legacy of torture is just the result of some silly girlish feelings, then we haven't even begun to deal with the consequences of those years." --- http://www.newyorker.com/online/blogs/closeread/2014/04/dianne-feinstein-em… Who's "Emotional"-- Feinstein or the C.I.A.? Who gets "emotional" about torture--or, rather, what is the proper emotional response to a history of torture and lies? On Fox News, on Sunday morning, Chris Wallace asked Michael Hayden, the former director of the C.I.A., about a report by the Senate Select Committee on Intelligence, sixty-three hundred pages long, that "says the C.I.A. misled the public about the severity and the success of the enhanced interrogation program." Hayden's first response was to talk about the feelings of Dianne Feinstein, the chair of the committee, citing an article by David Ignatius: "He said Senator Feinstein wanted a report so scathing that it would 'ensure that an un-American brutal program of detention and interrogation would never again be considered or permitted.' " Now, that sentence, that motivation for the report, Chris, may show deep emotional feeling on part of the senator. But I don't think it leads you to an objective report. "Deep emotional feelings," on the part of a woman like Feinstein, are apparently dizzying, especially when it comes to things like our integrity as a nation. But are Hayden and his former colleagues at the C.I.A., in touch with their own emotions on this one? The Senate voted on Thursday to submit the report for declassification; this process may take a while, because the White House and the C.I.A. will be involved, and the agency has fought the report. It has made its objections known feelingly, in a rebuttal that is also classified, in testimony, and in leaks to reporters about how the Senate just doesn't understand what it was like--doesn't get it, doesn't care about what bad days its agents had. Not that the C.I.A. wants to tell. When John Brennan, the current head of the C.I.A., realized that the Senate investigators had some of the agency's notes to itself--the so-called Panetta papers, in which, according to Senator Feinstein, the agency conceded points it is now denying--he had a bit of a fit. Feinstein said that the committee got the Panetta papers from the C.I.A. in a document dump; the agency said that even if it did, the committee ought to have known that those notes were private. It apparently searched the Senate's computers and tried to get a criminal investigation started. Calling the cops is, admittedly, a common fantasy when an teen-ager realizes that his journal has been read, but it's a bit unworthy of an intelligence agency when dealing with its congressional overseers. Now, not that there's anything wrong with wanting a scathing report in torture that will shock the conscience, but it's probably worth noting that the Ignatius line Hayden cited took a Feinstein quote slightly out of context. (Though the layering of emotionalism is on Hayden.) Ignatius wrote that Feinstein "wanted a report so tough that it would 'ensure that an un-American, brutal program of detention and interrogation will never again be considered or permitted,' as she put it." She had actually presented this as the reason to make the report public: If the Senate can declassify this report, we will be able to ensure that an un-American, brutal program of detention and interrogation will never again be considered or permitted. Emphasis added. It's a fine distinction, but an important one: whatever her "motivation" was, it didn't shape the writing of the report, but her feelings about who ought to get to read it. (On Saturday, Trevor Timm, of the Press Freedom Foundation, put out a "general plea" for a leak.) There are really two issues here. One is the reflexive tendency to disparage or dismiss a woman in politics (or in business, or anywhere) with a remark about her supposed susceptibility to emotion. The other is the way a certain femininity--the wilting kind--is ascribed to those who doubt that torture is good for America. The cartoon is of the clear-headed torturer who has put tenderness aside for the sake of country, against the squeamish, sensitive, can't-handle-the-truth doubters. The supposed contrast is between focussed, rational realism and a tendency to faint. (Men and women can be put in either role, as in "Zero Dark Thirty.") But fear and a desire to punish, which disabled the judgments of many in the government after 9/11, are emotions, too, and even harder to control than, say, mercy. So is a fascination with one's own power to protect or, less charitably, one's self-imagined ruthlessness. So is a tendency to be charmed by dark sides. One can argue that those who turn to the law or a moral code, in moments of crisis, can be the least flushed by feeling. That is not to make a case against inserting feeling into politics: righteous indignation and kindness can anchor, rather than discombobulate. It might be most accurate to say that various emotions serve us differently. They wake us up, and, when they do, in what can be an outraged, bleary-eyed moment, we should be careful about what we reach for. And if the intelligence community thinks that the controversy over our legacy of torture is just the result of some silly girlish feelings, then we haven't even begun to deal with the consequences of those years. There is another powerful emotion that may be at work here: shame. One source of C.I.A.'s anxiety about the Senate report is that it apparently casts a cold eye on the effectiveness of torture. It didn't do us much good, apparently. Perhaps it is painful to have compromised one's principles and not brought back anything good. But that psychological exploration should not take place entirely in classified quarters. About the same time that Hayden was on Fox News, Nancy Pelosi was on CNN, talking to Candy Crowley about the same report. Crowley asked if she blamed senior C.I.A. officials for the "misrepresentations" about torture; Pelosi went a level higher, to make a point about institutional culture, and one of our more fundamental emotions--the desire for praise. "Many people in the C.I.A. are so patriotic, they--they protect our country in a way to avoid conflict and--and, uh, violence, etc. But the attitude that was there was very--I think, it came from Dick Cheney. That's what I believe," she said. Did Cheney's shamelessness represented an absence of emotion? Not really. "I think he's proud of it," Pelosi said. "I think he's proud of it. I think he's proud of it."

1 0