May 2014 - cypherpunks - lists.cpunks.org

Harvard and MIT Students Launch ‘NSA-Proof’ Email Service | Betabeat
by J.R. Jones 27 May '14

27 May '14

Have you guys seen this? What say ye? http://betabeat.com/2014/05/harvard-and-mit-students-launch-nsa-proof-email…

11 18

House Passes Curbs on NSA Phone Surveillance
by jim bell 24 May '14

24 May '14

http://news.yahoo.com/house-passes-curbs-nsa-phone-surveillance-221025685--… WASHINGTON (AP) — In an overwhelming vote, the House moved the U.S. closer to ending the National Security Agency's bulk collection of Americans' phone records Thursday, the most significant demonstration to date of leaker Edward Snowden's impact on the debate over privacy versus security. But the final version of the legislation, "watered down" in the words of one supporter, also showed the limits of that impact. The bill was severely weakened to mollify U.S. intelligence agencies, which insisted that the surveillance programs that shocked many Americans are a critical bulwark against terror plots. The bill was approved 303-121, which means that most House members can now say they voted to end what many critics consider the most troubling practice Snowden disclosed — the collection and storage of U.S. calling data by the secretive intelligence agency. But almost no other major provision designed to restrict NSA surveillance, including limits on the secret court that grants warrants to search the data, survived the negotiations to get the bill to the House floor. And even the prohibition on bulk collection of Americans' communications records has been called into question by some activists who say a last-minute change in wording diminished what was sold as a ban. "People will say, 'We did something, and isn't something enough,'" said Steven Aftergood, who tracks intelligence issues for the Federation of American Scientists. "But this bill doesn't fundamentally resolve the uncertainties that generated the whole controversy." Though some privacy activists continued to back the bill, others withdrew support, as did technology companies such as Google and Facebook. View gallery Rep. Mike Rogers of Michigan, the Republican chairman of the House Intelligence Committee, said, "I believe this is a workable compromise that protects the core function of a counterterrorism program we know has saved lives around the world." The measure now heads to the Senate, where Majority Leader Harry Reid, D-Nev., told reporters Thursday that "we must do something." The USA Freedom Act would codify a proposal made in January by President Barack Obama, who said he wanted to end the NSA's practice of collecting and storing the "to and from" records of nearly every American landline telephone call under a program that searched the data for connections to terrorist plots abroad. The phone records program was revealed though the leaks last year by Snowden, who used his job as a computer network administrator to remove tens of thousands of secret documents from an NSA facility in Hawaii. Snowden fled first to China, then Russia where he is avoiding an extradition order to face criminal charges for revealing classified information. The phone companies create and store those billing records, and the legislation still would give the NSA authority to request batches of data from the companies to search in terrorism investigations in response to a judicial order. Law enforcement agents routinely obtain such records in criminal investigations. HOUSE VOTES TO CURB NSA DATA COLLECTION The USA Freedom Act started its life as the idea of those who wanted to clamp down on NSA surveillance, but it was "watered down," as Rep. Jan Schakowsky, D-Ill., acknowledged, shedding a series of provisions favored by civil liberties activists. Some activists continued to back the bill, including the American Civil Liberties Union, whose Washington legislative director, Laura Murphy, called it an imperfect but "unambiguous statement of congressional intent to rein in the out-of-control NSA." Technology companies such as Google and Facebook said they were most concerned with a last-minute definition change that they fear will allow the government to collect huge volumes of records — including, for example, records of all the phone calls made from a particular U.S. city during a certain period, or all the internet data associated with a particular commercial router. The bill's original text limited the government's data requests to those associated with specific people, entities or accounts. The approved version says the government may use any "specific selection term" to set the parameters of its search, including a type of device or an address. The new language appears to allow much broader data requests. "The new version deliberately contains ambiguity in a very critical area," said Harley Geiger, senior counsel for the Center for Democracy and Technology. "We've learned about the government track record of exploiting ambiguity in the law to broaden its surveillance activity." Rep. Adam Schiff, D-Calif., a member of the House Intelligence Committee, said the vagueness was designed to protect the government's surveillance methods, not to facilitate secret bulk collection. Other provisions that were dropped from the bill included requirements to estimate the number of Americans whose records were captured under the program, and the creation of a public advocate to challenge the government's legal arguments before the secret surveillance court. NSA officials were pleased with the bill for another reason: The new arrangement will give them access to mobile calling records they did not have under the old program.

5 4

the Great Filter of private communication
by coderman 24 May '14

24 May '14

we have the maths! we have the technology! ... yet actual robust, private communications remain elusive. where the "Great Filter" thwarting our privacy codes? is it usability; anything more than invisibly automatic a failure? is it cost; anything more than zero too much to bear in the market? is it correctness; anything less than a single mode always secure, broken? perhaps all of these above, each a requisite element of robustness, further compounding the difficulty of realizing an ideal.

5 11

Re: [liberationtech] PBS Frontline: United States of Secrets ( 2 part series )
by Gregory Foster 24 May '14

24 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Had intended to xpost. gf - -------- Original Message -------- Subject: Re: [liberationtech] PBS Frontline: United States of Secrets ( 2 part series ) Date: Fri, 23 May 2014 23:04:43 -0500 From: Gregory Foster To: liberationtech <liberationtech(a)lists.stanford.edu> CC: warrants-for-surveillance-tx(a)googlegroups.com, effaustin-discuss(a)lists.effaustin.org, rt4atx-list(a)cryptoglass.us On Wednesday, May 14, 2014 7:07 PM, Nicholas Merrill wrote: > United States of Secrets (Part One) > > "How did the government come to spy on millions of Americans? In > United States of Secrets, FRONTLINE goes behind the headlines to > reveal the dramatic inside story of the U.S. government's massive > and controversial secret surveillance program -- and the lengths > it went to try to keep it hidden from the public." > > http://www.pbs.org/wgbh/pages/frontline/united-states-of-secrets/ > http://video.pbs.org/video/2365245528/ > > Part 2 airs May 20th > > -Nick > > Nicholas Merrill, Executive Director, The Calyx Institute On Wednesday, May 14, 2014 7:15 PM PDT, James S. Tyre wrote: > Requires Flash, but pretty good even for those of us who've been > involved directly for A Very Long Time, likely much better for > those not intimately familiar. > > James S. Tyre, Law Offices of James S. Tyre Special Counsel, > Electronic Frontier Foundation https://www.eff.org Part 2 was broadcast on May 20th and is available at the FRONTLINE website linked above. Also available at ThoughtMaybe: http://thoughtmaybe.com/the-united-states-of-secrets/ Well weaves together The Story of The Program, and its unraveling. Of great importance, please take a look. gf - -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJTgDXCAAoJEMaAACmjGtgjzuEQAI/btKhtWLzJA6enMa37K0WB /5BsLgHTQfhCljemIEsi+Ifr7HMtfVrSC2TTjr1teGhZ3l1AF3jQIP9yxepB9dMo 3ykbQagJnVEYwd1hwYV9UxKb5VruoY2nI7L8vTIFlM6pagNnqSB/7KmlfWaIkTXF jD3rYuXlchSPJXLm+Rd/Q3742sC+F0rZ9CJiSeUUcnN2LtrN0Efe6n+kMRcifnw1 BBJ4dsF7kyZBKojVlbzVtKQw9Alh665MkECso9umElpuQg8J+QHMGR/kDAOA9IyM RsjC6Ai2x+aSyliVyPFOL9bWDh0p/sX2mvqndFQ/X5ITRGMURm/Nmh6YeUL41x5u YqDO414CmaxwdNLfz4or/m2HmU5EU4TQBmIgOZZP3UhfqNrB6H6dt4/jVl71GU5D N1zHcOEypvSen4koDj6l6y2m9DJ/iYANkqGZf5BCZyTRcgxwagC4IQ3VjNU6FT81 cMizMTVZzNYEua3vL8n4aOXHk8cn1G68PYCuRC5UwOLez0OsCvYl5QkS+uGSLrUf uz55VWgbZQ9hniLDarA6cJTCASYO7fbz3uwJID8T/3VFFWei6uumI2sxRtQJtc5z MhTLGQIcJJ7ptFCCulwTGsicIU52X5ixPcN+VnEbFrFb74uqZQLVj6FN19e82r4l OQ8xhZxFQUwCc8g+MqoA =YSpn -----END PGP SIGNATURE-----

1 0

Re: "What does GCHQ know about our devices that we don't?"
by coderman 24 May '14

24 May '14

per discussion at https://www.privacyinternational.org/blog/what-does-gchq-know-about-our-dev… , there were a number of chips destroyed during the GCHQ zeroisation debacle. - keyboard controller chip - trackpad controller chip - inverting converter chip this is the type of covert implant hardware you would request destroyed rather than leave in the hands of an adversary. to be clear, this was not about reclaiming storage on secondary devices on a system, but about covering the tracks left on already compromised systems.

1 0

Re: Going to jail nowadays for owning a book, wtf?
by tpb-crypto＠laposte.net 22 May '14

22 May '14

A friend of ours sent me this very intredasting link which I didn't know existed. But since cross-posting is a no-no, I take the liberty to post the information which is obviously very pertinent in our discussion: > > Things like that remember me that google once did not have the capacity to > > exclude links from its systems, but because of pedophiles, they finally > > built that capacity. The next day the copyright industry was knocking at > > their door to take down content they previously couldn't because of the > > lack of technical capacity. > > > > "Now Google don't have excuses." - I remember seeing that phrase in a New > > York magazine. > > ”Child pornography is great,” the speaker at the podium declared > enthusiastically. ”It is great because politicians understand child > pornography. By playing that card, we can get them to act, and start blocking > sites. And once they have done that, we can get them to start blocking file > sharing sites”. > -- http://christianengstrom.wordpress.com/2010/04/27/ifpis-child-porn-strategy/ >

1 0

Fwd: Secrets, lies and Snowden's email: why I was forced to shut down Lavabit
by Ulex Europae 21 May '14

21 May '14

Secrets, lies and Snowden's email: why I was forced to shut down Lavabit For the first time, the founder of an encrypted email startup that was supposed to insure privacy for all reveals how the FBI and the US legal system made sure we don't have the right to much privacy in the first place By Ladar Levison May 20 2014 <http://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-shut-d…> My legal saga started last summer with a knock at the door, behind which stood two federal agents ready to to serve me with a court order requiring the installation of surveillance equipment on my company's network. My company, Lavabit, provided email services to 410,000 people including Edward Snowden, according to news reports and thrived by offering features specifically designed to protect the privacy and security of its customers. I had no choice but to consent to the installation of their device, which would hand the US government access to all of the messages to and from all of my customers as they travelled between their email accounts other providers on the Internet. But that wasn't enough. The federal agents then claimed that their court order required me to surrender my company's private encryption keys, and I balked. What they said they needed were customer passwords which were sent securely so that they could access the plain-text versions of messages from customers using my company's encrypted storage feature. (The government would later claim they only made this demand because of my "noncompliance".) Bothered by what the agents were saying, I informed them that I would first need to read the order they had just delivered and then consult with an attorney. The feds seemed surprised by my hesitation. What ensued was a flurry of legal proceedings that would last 38 days, ending not only my startup but also destroying, bit by bit, the very principle upon which I founded it that we all have a right to personal privacy. In the first two weeks, I was served legal papers a total of seven times and was in contact with the FBI every other day. (This was the period a prosecutor would later characterize as my "period of silence".) It took a week for me to identify an attorney who could adequately represent me, given the complex technological and legal issues involved and we were in contact for less than a day when agents served me with a summons ordering me to appear in a Virginia courtroom, over 1,000 miles from my home. Two days later, I was served the first subpoena for the encryption keys. With such short notice, my first attorney was unable to appear alongside me in court. Because the whole case was under seal, I couldn't even admit to anyone who wasn't an attorney that I needed a lawyer, let alone why. In the days before my appearance, I would spend hours repeating the facts of the case to a dozen attorneys, as I sought someone else that was qualified to represent me. I also discovered that as a third party in a federal criminal indictment, I had no right to counsel. After all, only my property was in jeopardy not my liberty. Finally, I was forced to choose between appearing alone or facing a bench warrant for my arrest. In Virginia, the government replaced its encryption key subpoena with a search warrant and a new court date. I retained a small, local law firm before I went back to my home state, which was then forced to assemble a legal strategy and file briefs in just a few short days. The court barred them from consulting outside experts about either the statutes or the technology involved in the case. The court didn't even deliver transcripts of my first appearance to my own lawyers for two months, and forced them to proceed without access to the information they needed. Then, a federal judge entered an order of contempt against me without even so much as a hearing. [snip]

3 3

scrypt and ASICs
by coderman 16 May '14

16 May '14

the other thread mentioned the "ASIC-able" ness of scrypt. what techniques may be used to make scrypt even harder to put on die? (is this an arms race between transistor count and algorithm tuneables?)

3 2

Observation re gmail/google cookies
by grarpamp 16 May '14

16 May '14

Is used to be such that only the mail.google.com:GX cookie was required to access webgmail (even if it added a number of other cookies post that access, they could be reasonably narrowed down and blocked to just mail.google.com, if I recall). Now within the past many months that has changed to include, at minimum, myriad cookies in google.com. (I've not tested which are the minimum set). These will potentially cross with ads and other tracking things. While great for google integration, it's bad for user privacy regarding domain/usage segregation. Do not trust the google in your browser anymore. As if, ever, obviously.

4 3

Re: "SIGINT tradecraftis very hands-on (li terally!)"
by John Young 15 May '14

15 May '14

There is a good chance the documents are covertly marked as you suggest, the ostentatious classification markings a ruse for untutored yokels to fancy are genuine. Covert markings have been in use for a long time, as well as ostentatious markings. On paper as well as digital and other forms of electronic. And certainly packets carry unique markings in a variety of overt and covert types. Some of the techniques fall under the inadvertent emanations rubric associated with Tempest -- which has blossomed well beyond the FOIA releases from the late 1990s. TSCM is a marvel of duplicity and ruse. At 08:16 PM 5/13/2014, you wrote: >From: Black Fox <fox(a)vbfox.net> >On Tue, May 13, 2014 at 2:58 PM, coderman ><<mailto:coderman@gmail.com>coderman(a)gmail.com> wrote: > > On Tue, May 13, 2014 at 1:00 AM, John Young > <<mailto:jya@pipeline.com>jya(a)pipeline.com> wrote: > >> > We've seen the Greenwald book No Place to Hide, where are the > >> > promised gush of Snowden documents available? His publisher > >> > doesn't show a source. Surely not another marketing tease. > >> great question; let us know if you find them! > ><http://glenngreenwald.net/pdf/NoPlaceToHide-Documents-Compressed.p > df>http://glenngreenwald.net/pdf/NoPlaceToHide-Documents-Compressed.pdf > >If I were the telephone company from which the records were >requested, I'd note that the records were requested in "electronic" >format. Then, I'd ask a programmer to write a program to write a >program to generate pdf files with embedded "captcha"-type >text: Images that are quite apparent to the human eye, but are very >difficult for any computer to make any sense of. All the phone >records would be there (in no particular order), and they'd all be >very readable to humans, but... > Jim Bell >

3 2