April 2014 - cypherpunks - lists.cpunks.org

reminder of mays manifesto
by Cari Machet 06 Apr '14

06 Apr '14

i post this here as a reminder of anarchist models and how they can be utilized in fascist occasions and are anti facsist but also are anti capitalist - anarchist models are found in every sector that i know of ideas of autonomy and horizontality - direct democracy but there is an overwhelming desire of some to subvert these tendencies - look for them in yourself... ++++++++++++++++++++ The Crypto Anarchist Manifesto Timothy C. May<ftp://soda.berkeley.edu/pub/cypherpunks/people/tcmay.html>< tcmay(a)netcom.com> A specter is haunting the modern world, the specter of crypto anarchy. Computer technology is on the verge of providing the ability for individuals and groups to communicate and interact with each other in a totally anonymous manner. Two persons may exchange messages, conduct business, and negotiate electronic contracts without ever knowing the True Name, or legal identity, of the other. Interactions over networks will be untraceable, via extensive re- routing of encrypted packets and tamper-proof boxes which implement cryptographic protocols with nearly perfect assurance against any tampering. Reputations will be of central importance, far more important in dealings than even the credit ratings of today. These developments will alter completely the nature of government regulation, the ability to tax and control economic interactions, the ability to keep information secret, and will even alter the nature of trust and reputation. The technology for this revolution--and it surely will be both a social and economic revolution--has existed in theory for the past decade. The methods are based upon public-key encryption, zero-knowledge interactive proof systems, and various software protocols for interaction, authentication, and verification. The focus has until now been on academic conferences in Europe and the U.S., conferences monitored closely by the National Security Agency. But only recently have computer networks and personal computers attained sufficient speed to make the ideas practically realizable. And the next ten years will bring enough additional speed to make the ideas economically feasible and essentially unstoppable. High-speed networks, ISDN, tamper-proof boxes, smart cards, satellites, Ku-band transmitters, multi-MIPS personal computers, and encryption chips now under development will be some of the enabling technologies. The State will of course try to slow or halt the spread of this technology, citing national security concerns, use of the technology by drug dealers and tax evaders, and fears of societal disintegration. Many of these concerns will be valid; crypto anarchy will allow national secrets to be trade freely and will allow illicit and stolen materials to be traded. An anonymous computerized market will even make possible abhorrent markets for assassinations and extortion. Various criminal and foreign elements will be active users of CryptoNet. But this will not halt the spread of crypto anarchy. Just as the technology of printing altered and reduced the power of medieval guilds and the social power structure, so too will cryptologic methods fundamentally alter the nature of corporations and of government interference in economic transactions. Combined with emerging information markets, crypto anarchy will create a liquid market for any and all material which can be put into words and pictures. And just as a seemingly minor invention like barbed wire made possible the fencing-off of vast ranches and farms, thus altering forever the concepts of land and property rights in the frontier West, so too will the seemingly minor discovery out of an arcane branch of mathematics come to be the wire clippers which dismantle the barbed wire around intellectual property. Arise, you have nothing to lose but your barbed wire fences! -- Cari Machet NYC 646-436-7795 carimachet(a)gmail.com AIM carismachet Syria +963-099 277 3243 Amman +962 077 636 9407 Berlin +49 152 11779219 Reykjavik +354 894 8650 Twitter: @carimachet <https://twitter.com/carimachet> 7035 690E 5E47 41D4 B0E5 B3D1 AF90 49D6 BE09 2187 Ruh-roh, this is now necessary: This email is intended only for the addressee(s) and may contain confidential information. If you are not the intended recipient, you are hereby notified that any use of this information, dissemination, distribution, or copying of this email without permission is strictly prohibited.

3 4

Github Pages now supports SSL
by Eric Mill 06 Apr '14

06 Apr '14

I know most of the people on here have transcended the earthbound, maudlin Certificate Authority system, but as services-adopting-SSL-news goes, I'm particular excited about Github Pages<https://twitter.com/benbalter/status/444555263195217920>, which started quietly supporting SSL for *.github.io domains a few weeks back. I'm excited because Github Pages is powerful, verrrrry flexible, and totally free. AFAIK, it's the only major blog/web host that gives you free SSL, backed by a high quality CDN (since everything is static files). To promote the occasion and nudge Github to take it further, I wrote up my own experience, and a little how-to for forcing redirects via Jekyll: https://konklone.com/post/github-pages-now-supports-https-so-use-it Along with Cloudflare's 2014 plan to offer SSL termination for free, and their stated plan to double SSL on the Internet by end of year, the barrier to HTTPS everywhere is dropping rapidly. -- Eric -- konklone.com | @konklone <https://twitter.com/konklone>

7 7

Frankencert - Adversarial Testing of Certificate Validation in SSL/TLS Implementations
by coderman 06 Apr '14

06 Apr '14

https://github.com/sumanj/frankencert Frankencert - Adversarial Testing of Certificate Validation in SSL/TLS Implementations What are frankencerts? Frankencerts are specially crafted SSL certificates for testing certificate validation code in SSL/TLS implementations. The technique is described in detail in the 2014 IEEE Symposium on Security and Privacy (Oakland) paper - Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations by Chad Brubaker, Suman Jana, Baishakhi Ray, Sarfraz Khurshid, and Vitaly Shmatikov. Why is frankencert generator useful? Frankencert generator is essentially a smart fuzzer for testing SSL/TLS certificate validation code. If you are a developer who is implementing any sort of SSL/TLS certificate validation code (either as part of an SSL/TLS library or an application), you can use the frankencert generator to auto-generate different test certificates involving complex corner cases. We have successfully used frankencerts to find serious vulnerabilities in GnuTLS, PolarSSL, CyaSSL, and MatrixSSL as described in our Oakland 2014 paper. We also found several discrepancies between how different SSL/TLS implementations report errors back to the user. For example, when presented with an expired, self-signed certificate, NSS, Chrome on Linux, and Safari report that the certificate has expired but not that the issuer is invalid. How do frankencerts work? The basic idea of frankencerts is to take a bunch of certificates as seeds and use random mutations on different fields and extensions to create new test certificates (frankencerts). Using frankencerts as server-side inputs into an SSL/TLS handshake can help systematically test correctness of the certificate validation code. Installation and Usage Install OpenSSL libraries and utilities if you don't have them already. The frankencert generator needs a modified version of PyOpenSSL. We have included the source for our modified version of PyOpenSSL. You will need to install it in order to use the frankencert generator. First, uninstall any other version of PyOpenSSL that you may have installed on your computer. Go to the pyOpenSSL-0.13 directory and build/install PyOpenSSL by issuing sudo python setup.py install. Once you have the patched pyOpenSSL set up, to generate frankencerts, use the franken_generate.py script: python franken_generate.py seed_certs_dir ca_cert output_dir count [config_file]. The arguments are explained below. seed_certs_dir: Frankencert generator needs a set of seed certificates. Any SSL cert in PEM fromat can act as a seed cert. seed_certs_dir can be any directory containing the seed certs stored as PEM files. You can either use tools like ZMap (https://zmap.io/) to collect SSL seed certificates, or use some of the SSL certs available from https://www.eff.org/observatory. Please note that these are not our tools and repositories - you may want to contact their respective developers and maintainers to ensure that your usage of the certificates they collected is compatible with the intended purpose. You do not need access to the corresponding private keys to use the certs as seeds. For your convenience, we have included a tarball containing around 1000 seed certificates in utils/sample_seed_certs.tar.gz. ca_cert: You will also need to create a self-signed CA certificate to sign the frankencerts. You can either use the included sample CA certificate utils/rootCA_key_cert.pem or use the utils/create_new_ca.sh script to create your own root CA. For any root CA that you use for frankencert generation, make sure that your SSL certificate validation code treats its certificate as a trusted root certificate. VERY IMPORTANT: this root certificate should be trusted ONLY during testing. If you accidentally or intentionally deploy SSL/TLS with this certificate still among the trusted root certificates, your SSL/TLS connections may be vulnerable to server impersonation and man-in-the-middle attacks. Be sure to REMOVE this certificate from your trusted root certificates once the testing is finished. output_dir: It will contain the generated frankencerts. The frankencerts will be named as frankencert-<number>.pem. count: Number of frankencerts to be generated. config_file: An optional argument to tune the frankencert generation process. Take a look at the utils/sample_franken.conf for a sample config file. To test your SSL/TLS client with the generated frankencerts, you should use the utils/test_ssl_server.py script to set up an SSL server that can present the generated frankencerts as part of the SSL handshake. Project structure The frankengen directory contains the frankencert generator code Our patched version of pyOpenSSL is inside pyOpenSSL-0.13 directory Several useful tools are included in utils cert_print.py: a tool for printing frankencerts. It requires OpenSSL to be installed and present in the path. rootCA_key_cert.pem: private key and self-signed cert of a sample CA that can be used for signing frankencerts. create_new_ca.sh: a script for creating new CA with a self-signed cert. It creates the output cert and private key in rootCA.pem (requires OpenSSL). test_ssl_server.py: a sample SSL/TLS server for presenting frankencerts to SSL/TLS clients sample_seed_certs.tar.gz: Some sample certs that may be used as seeds for frankencert generation. sample_franken.conf: A sample config file that can be used to tune different parameters of the frankencert generation process.

1 0

Re: [tor-talk] Linux kernel transproxy packet leak (w/ repro case + workaround)
by coderman 06 Apr '14

06 Apr '14

On Wed, Apr 2, 2014 at 10:59 AM, Rusty Bird <rustybird(a)openmailbox.org> wrote: > ... > Maybe it can be boiled down to this: When redirecting *and* filtering, > the filtering should be done in OUTPUT (instead of INPUT), ... this is where defense in depth at the multiple-virtual machine / routing layer fails safe in ways that a single / monolithic Tor setup cannot, when applied with care. what i mean by "applied with care" is that forwarding through Tor only is the default. Anything unexpected / unsupported gets the bit bucket. the best target is actually TARPIT, not DROP, but that's another discussion... [this advice to default drop and isolate at routing level applies to Tails, Whonix, Qubes TorVM, and whoever else allows a transparent proxy model, IMHO] best regards,

1 0

DILKE-ALLEN Award
by coderman 06 Apr '14

06 Apr '14

what is the history?

1 0

Anarchism and Capitalism [was: reminder of mays manifesto]
by coderman 06 Apr '14

06 Apr '14

On Sat, Apr 5, 2014 at 5:02 AM, Cari Machet <carimachet(a)gmail.com> wrote: > i post this here as a reminder of anarchist models and how they can be > utilized in fascist occasions and are anti facsist but also are anti > capitalist anarchistic theories as anti-capitalist? the best markets are fully decentralized, with pervasive information: anarchistic to their core! the fact that nearly all systems of capitalist claim in current day are absurd perversion of an ideal does not imply the concept itself is invalid... best regards,

1 0

Re: Investigating the Investigators
by jim bell 06 Apr '14

06 Apr '14

On Tue, Apr 1, 2014, at 08:02 PM, jim bell wrote: > Group of people who burgled the FBI in 1971 > https://movies.yahoo.com/blogs/movie-news/trailer--fbi-whistleblowers-revea… >Thanks for posting this. It's so timely and historically important. >Can't wait to see it. >Hey Jim, what happened with the Yahoo account you were locked out of? >Did you ever get the lost emails and contacts restored? >-Shelley Haven't got back on jamesdbell8(a)yahoo.com. I'm convinced that Yahoo is a bunch of crooks. Bleeding-heart, do-gooder liberal crooks. Anybody who looks at Yahoo's news sees this. Jim Bell

3 4

RAND study on "Markets for Cybercrime Tools and Stolen Data"
by Gregory Foster 06 Apr '14

06 Apr '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 RAND National Security Research Division (2014) - "Markets for Cybercrime Tools and Stolen Data: Hackers' Bazaar" by Lillian Ablon, Martin C. Libicki, Andrea A. Golay: http://www.rand.org/content/dam/rand/pubs/research_reports/RR600/RR610/RAND… HT Cyber Security Law and Policy Blog (Apr 2): http://blog.cybersecuritylaw.us/2014/04/02/rand-corporation-releases-report… gf - -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJTPqwjAAoJEMaAACmjGtgj4z8P/3AD6XfqlqAUKDCJ1fyAqy16 gEHylffMmt7IVjUTahi9onYDDpyI2tVEsPuJCANnqEfu/70LTLSOZimSl7uwNP1x nPMc8JjgztotWoU9jPD/r99PIp5qSmeN0VSaryVYEgihpsmZqit9/oIqKLx8xltf a+wNwn4EFAgzTsZpTxXGt/6Aki29f6MEnU1bZjpzaudN5PwXZ97gX2MZtZXOBM54 OlNW/J0E3VWXAyJ8Sx9Au5gTOOGCS3EebwAJSBeHbqwCvmcHW9rgpB1Fbny1XU8K QiM5GFM9oTEmAzdFeTvOZtwHP7hQ6/gO4dI3y3u9Vc0hgK6wycjU4wlOn8ab0SxP yAD/1UI+iXHGYbGDCHwNFAZFXae+SAJI0DxToaTPVQMVkyjW5CwoM1jlijAXxrg7 41YwZTDOLV3txNBD83MVToeAfpjBoU6MDm43rHKYfowTqykuFkATlCERxrT5igGJ 5N3RFLJMFUgrn/2MxaMRRswynHRGabq/H0T0DPwVN4s74X9A+oI5sOWCtsvgO44W FqkKq9LEOCARbobF87jGNSAph5DXQ6MZmGfUrp+IRQQrMIKLBevo+6oHfpwrjZ+t pL5/2BtPJXErl8wvnjmXRmm1R4JEeC21baTwdUXu7u7QGBTmo7lij9UkjTJk5jC/ r/tw1VwX6Ex9yemiitLV =rLdn -----END PGP SIGNATURE-----

2 1

Re: [tor-talk] How safe is smartphones today?
by grarpamp 06 Apr '14

06 Apr '14

>> For example, I want to talk to political activists, I would like to >> discuss with them, no matter if I share their views or not. This could >> easily make you interesting for certain people. Sometimes just talking >> to certain people could make you suspicious. > > If you are concerned with protecting the social graph of who you are > communicating with, there is *maybe* exactly one communication system > that exists today that can protect this information from a dedicated > adversary with resources on the order of a drug cartel. Excepting that we're in anti-graph tor-talk forum... Why are people so sure to give primary fear to letting our graph be known? Where are the people screaming that content is the worse leak? Maybe you know a lot of Muslim terrist sympathizers, but are really calling to see about dinner plans, maybe you sell pens to all sorts of specialist doctors, and document services to criminal defense attorneys, condoms to whores, and pagers to drug dealers, wearcams to activists, etc. Contact graphs can usually be dual use and rarely used directly against you. Content is usually single use and is often used against you. A link to another secure phone voice/msg app, redphone/textsecure... https://whispersystems.org/‎ Now if we can just have an android phone app/ROM do encrypted voice (by somehow hooking into the mic/speaker codec/pcm/modem path) over the cell voice network (voice minutes plan, usable everywhere) instead of: - the wifi-ip network (free, if you are near an AP, which you usually aren't) - the cell data-ip network (requires a data/ip plan) then I can see a huge number of people installing that app/ROM. I don't know of anyone working on this though :( [The pricing of [un]limited cell minutes/data/sms vs. your usage of same is in some regions more attractive/available without a data plan. Thus making this voice app/ROM more universally useful.] [You still have to trust the integrated baseband processor, till that hardware gets opened up.]

1 0

FAKE Indian Cari Machet Posts RANT by WELL KNOWN Capitalist TC May..
by Anonymous Remailer (austria) 05 Apr '14

05 Apr '14

U have to be the most IGNORANT fake Indian on this list.. TC May is a WELL Known Libertarian Capitalist/Randist.. Cari you are such a fucking soft headed Moron!! what a fucking rube anon time to post more DOX on Cari Machet!!

1 0