June 2014 - cypherpunks - lists.cpunks.org

Intersection of Projects [Illegal Activity As Security and Anonymity Metric]
by grarpamp 30 Jun '14

30 Jun '14

In a long thread starting here: https://lists.torproject.org/pipermail/tor-talk/2014-June/033406.html On Mon, Jun 30, 2014 at 3:22 PM, Morgan Smith <tor-exit0(a)intersafeit.com> wrote: > On 6/28/2014 10:01 AM, Mark McCarron wrote: >> Anyway, we have a simple solution to this global view and hidden services. We just implement a distributed hosting solution within the Tor system and end-to-end visibility is gone. > I'm nowhere near done sifting through this thread however Freenet may > may already provide this kind of functionality. In the spirit of > software doing one only and doing it well then perhaps it is good to be > handled by a separate project. If I recall correctly, this subthread was about people getting shuttered because their Apache etc was insecure, and that somehow creating [paid] hosting services for them within relatively general purpose nets like Tor was the solution. News: those services are still open to the same exploits, and still use the same HS mechanism that has potential whitepaper exploits too. Further, he [or whoever OP'd the subthread] did not define what they meant by "distributed' or "removing 'visibility' of one end". Stepping back from the above specific, and re: Freenet... I think someone else mentioned or hinted at layering to enhance things. Yes, interestingly you can in fact layer some systems upon general anonymous transports, especially if they offer IP transport. ie: Use Tor/I2P with onioncat, cjdns, phantom... layer tahoe+lafs, freenet, messaging, Bitcoin, torrent, etc on top. Gnunet, MaidSafe and others I missed probably fit somewhere too. Mash it up however you like. (Excepting where they did not coordinate their collision spaces, such as in IPv6 addressing). It tends to be complex, slow and fraught with timeouts, but some combinations work ok. At some point you must regularly sit back from your own project or usage and take time to categorize all the systems out there, what they are good and bad at, and then admit to yourself (or as a user) whether layering is valid... or more importantly, whether you should merge forces with other projects to, up to and including, scrapping old and writing new projects that provide both user utility and resistance against attacks of interest. Or is your usage the best it can be? Can you in fact create an all in one tool? Or can you create a well defined intersection amongst projects / tools such that their layered sum equals coverage against all attack classes, or the subset you're interested in or subject to. And can you create a similar intersection matrix for the services offered (web, messaging, storage) by such networks. Can you coordinate research, structure and promote projects in such a way as to cooperatively and formally provide a complete set of resistance and services?

1 0

Search History Skeptic
by Troy Benjegerdes 30 Jun '14

30 Jun '14

This is close to the tinfoil hat terrority, but what if: * hack target's corporate email * hack target's facebook * observe them (via webcams, etc) * generate psychological profile * plant search results https://www.google.com/search?q=hot+car+death+search * distract target with emails from the boss and facebook posts * target leaves kid in a hot car * target goes to jail. Much cleaner than drones or assassination. But where's the 'profit' part? There's got to be profit here somewhere... What, if any, defense is there to this kind of social engineering attack? * this message copyright 2014 Troy Benjegerdes, License fee for lawyers using this message in a criminal defense case is to donate 1% of legal fees to be split between the EFF and ACLU * (yes, I am shamelessly copyrighting this shit for profit, just like all the so called 'news' outlets are) -- ---------------------------------------------------------------------------- Troy Benjegerdes 'da hozer' hozer(a)hozed.org 7 elements earth::water::air::fire::mind::spirit::soul grid.coop Never pick a fight with someone who buys ink by the barrel, nor try buy a hacker who makes money by the megahash

3 4

Reversing Stealthy Dopant-Level Circuits
by stef 30 Jun '14

30 Jun '14

http://eprint.iacr.org/2014/508 > Abstract: A successful detection of the stealthy dopant-level circuit > (trojan), proposed by Becker et al. at CHES 2013, is reported. Contrary to > an assumption made by Becker et al., dopant types in active region are > visible with either scanning electron microscopy (SEM) or focused ion beam > (FIB) imaging. The successful measurement is explained by an LSI failure > analysis technique called the passive voltage contrast. The experiments are > conducted by measuring a dedicated chip. The chip uses the diffusion > programmable device: an anti-reverse-engineering technique by the same > principle as the stealthy dopant-level trojan. The chip is delayered down > to the contact layer, and images are taken with (1) an optical microscope, > (2) SEM, and (3) FIB. As a result, the four possible dopant-well > combinations, namely (i) p+/n-well, (ii) p+/p-well, (iii) n+/n-well and > (iv) n+/p-well are distinguishable in the SEM images. Partial but > sufficient detection is also achieved with FIB. Although the stealthy > dopant-level circuits are visible, however, they potentially make a > detection harder. That is because the contact layer should be measured. We > show that imaging the contact layer is at most 16-times expensive than that > of a metal layer in terms of the number of images -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

1 0

cypherpunks, see what you've done! :( [was Fwd: titcoin]
by coderman 30 Jun '14

30 Jun '14

dikcoin next? ---------- Forwarded message ---------- Date: Fri, Jun 27, 2014 at 6:44 AM Subject: titcoin Introducing Titcoin – the first digital currency aimed at the porn industry, announced by PornHub. Many cryptocurrencies have come and gone since Bitcoin’s <http://www.pcr-online.biz/news/read/bitcoin-making-a-virtual-mint/032266> boom in popularity, but none have been aimed at a specific industry in the same way Titcoin is. Speaking to Vice <http://www.vice.com/en_uk/read/titcoin-is-a-brand-new-cryptocurrency-for-po…>, one of the currency’s founders, Edward Mansfield, explained that due to the popularity of Bitcoin, porn users may want to use another type of private currency: “In the future, you might have a Bitcoin account with your spouse. You may not want them to see you purchasing products or subscriptions on adult sites, so having an industry-specific coin has certain advantages for consumers.” Rather confusingly, a video explaining Titcoin has been uploaded to YouTube, which implies that it’s a scheme that lets women pay for goods by flashing their own goods at shop assistants. It turns out this was actually an entry for a contest to become Pornhub’s creative director, and Titcoin is in fact a normal cryptocurrency that works just like the others. Once all have been mined, there will be a total of 69 million Titcoins in circulation (of course), but while the likes of Dogecoin and Litecoin have managed to carve out their own section of the market – which currently has over 275 trading cryptocurrencies – only time will tell if this one goes tits up like many others have before it. Other digital currencies that have failed to truly take off include Nyancoin <http://www.pcr-online.biz/news/read/nyan-cat-latest-meme-to-get-its-own-cry…> and Flappycoin. <http://www.pcr-online.biz/news/read/flappy-bird-spawns-two-flappycoin-curre…> While these two might be struggling, they are still around. Meanwhile, Kanye West made sure that Coinye <http://www.pcr-online.biz/news/read/coinye-is-dead-you-win-kanye/032953> well and truly died after he got his lawyers on the case… Introducing Titcoin – the first digital currency aimed at the porn industry. Many cryptocurrencies have come and gone since Bitcoin’s <http://www.pcr-online.biz/news/read/bitcoin-making-a-virtual-mint/032266> boom in popularity, but none have been aimed at a specific industry in the same way Titcoin is. Speaking to Vice <http://www.vice.com/en_uk/read/titcoin-is-a-brand-new-cryptocurrency-for-po…>, one of the currency’s founders, Edward Mansfield, explained that due to the popularity of Bitcoin, porn users may want to use another type of private currency: “In the future, you might have a Bitcoin account with your spouse. You may not want them to see you purchasing products or subscriptions on adult sites, so having an industry-specific coin has certain advantages for consumers.” Rather confusingly, a video explaining Titcoin has been uploaded to YouTube, which implies that it’s a scheme that lets women pay for goods by flashing their own goods at shop assistants. It turns out this was actually an entry for a contest to become Pornhub’s creative director, and Titcoin is in fact a normal cryptocurrency that works just like the others. Once all have been mined, there will be a total of 69 million Titcoins in circulation (of course), but while the likes of Dogecoin and Litecoin have managed to carve out their own section of the market – which currently has over 275 trading cryptocurrencies – only time will tell if this one goes tits up like many others have before it. Other digital currencies that have failed to truly take off include Nyancoin <http://www.pcr-online.biz/news/read/nyan-cat-latest-meme-to-get-its-own-cry…> and Flappycoin. <http://www.pcr-online.biz/news/read/flappy-bird-spawns-two-flappycoin-curre…> While these two might be struggling, they are still around. Meanwhile, Kanye West made sure that Coinye <http://www.pcr-online.biz/news/read/coinye-is-dead-you-win-kanye/032953> well and truly died after he got his lawyers on the case… ========================================== Website: http://www.prurient.com Contact: titcoin [at] prurient.com Social: @OfficialTitcoin @titcoinpool Pools: titcoinpool.com

2 1

Re: Tor and proxy bypass
by coderman 30 Jun '14

30 Jun '14

On Sun, Jun 29, 2014 at 11:40 PM, Odinn Cyberguerrilla <odinn.cyberguerrilla(a)riseup.net> wrote: > ... > Here are some tidbits which may be relevant to the Tor-as-tool discussion > and what to be aware of:... > https://www.torproject.org/docs/faq#WarningsAboutSOCKSandDNSInformationLeaks > ... > https://lilithlela.cyberguerrilla.org/?p=5794 on the subject, the recently published state of proxy bypass on mobile: "The problem behind mobile Tor browsers' ip disclosure" http://xordern.net/ip-leakage-of-mobile-tor-browsers.html note how defense in depth as far as transparent proxy via root privs nulls this one, but opens other privacy risks... everything old is new again, [ if it was my favorites on repeat, i'd be less cranky ;) .] best regards,

1 0

Frontline: US of Secrets: Diane Roark
by grarpamp 30 Jun '14

30 Jun '14

http://www.pbs.org/wgbh/pages/frontline/government-elections-politics/unite… https://www.youtube.com/watch?v=AMIrmt9sZyY https://en.wikipedia.org/wiki/Trailblazer_Project

1 0

[liberationtech] Nsa-observer: organising nsa leaks by attack vector
by Todd Weiler 29 Jun '14

29 Jun '14

A brilliant site was quietly launched a while back: https://www.nsa-observer.net/ It classifies the recent NSA revelations by Programs, Attack Vectors, and Compartments, even providing the database in JSON format. The dataset could feed some interesting research. Cordially, Todd -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

3 2

Re: Jabber
by John Young 29 Jun '14

29 Jun '14

At 10:20 AM 6/29/2014, you wrote: >any add. info on 'compromised jabber'? >Got some hints as well - nothing clear. "Compromised" is the time's opportunistic word for ever more anti-NSA comsec, mom. Cisco Jabber Client (scroll down): http://www.dailykos.com/story/2014/04/11/1291357/-NSA-Kept-You-Unsecure-It-… " Linked In Microsoft Office + Jabber Listed in Spy Program Specialty" (scroll down) https://www.techdirt.com/articles/20130617/13482623512/discovering-names-se… US Secret Service reportedly rigged access to Jabber to take down Silk Road and others. Can't find reference. Allegations also made against Chaos Computer Club being "compromised." No question that all these could be disinfo ops to distrust the services, discourage use and drive users to less trustworthy servcies. However, the post-Snowden rise in "secure drop boxes," "NSA-proof email," and the bountiful other snake oils by the comsec industry and peculiarly opportunistic do-gooders suggests there are willing and unwilling cooperators with the spooks industry, and not least, the thriving anti-spooks industry consulting the spooks on what can be done "without harming national security." Cypherpunks laid the foundation for this, no question, and a few have gone on to do rather well at working both sides of comsec, that is what comsec has always been: duplicitous, sneaky, treacherous, lying, cheating, why not tell it snakily, downright upright-humans raping the planet and beyond the blob, the stars. Examine speaker bureau offerings for who is traveling the blob peddling prime snake fracking.

1 0

readysim prepaid gsm - privacy focused marketing?
by grarpamp 28 Jun '14

28 Jun '14

A curious positioning among phone providers... https://www.readysim.com/who-its-for.html https://www.torproject.org/about/torusers.html.en http://arstechnica.com/business/2013/03/ready-sim-offers-cheap-short-term-a…

3 2

What do you think about it: <<www.unseen.is>> - a service that provides privacy and security for messaging, email and calling
by Александр 27 Jun '14

27 Jun '14

2 1