June 2014 - cypherpunks - lists.cpunks.org

Re: Encryption Works - Off Topic
by coderman 11 Jun '14

11 Jun '14

On Tue, Jun 10, 2014 at 9:15 PM, Mark Thomas <mark00thomas(a)me.com> wrote: > I sent this email to John since he is the only one who answered the question > I asked about your statement. > > Do you care to respond? i'm not sure what you expect me to say. Encryption Works - usually against the interests of its users! as we have seen from the current leaks and past history, encryption tells you where the interesting data and networks are, and also where not to bother attacking. encryption provides cover for backdoors and side channels you don't know are there. encryption with broken keys provides false confidence leading to greater losses. encryption with poor usability fails catastrophically, undoing the privacy of all prior exchanges in a single fatal swoop. encryption's specialized nature leads to centralized authorities and experts easily compromised unwittingly, or wittingly. (or both at once!) you see where this is going... is it useless? i think not. (blanket, passive surveillance always worthwhile to thwart) but it's no where near sufficient as a privacy enhancing technology itself.

1 0

Article on TLS, Transport Layer Security
by jim bell 10 Jun '14

10 Jun '14

(Note: I, Jim Bell, am cross posting this article from Yahoo, not because I believe it to be 'accurate' (I have no opinion on that), but because I believe that we need to not merely hear 'The Truth', but also 'The Story', specifically the story (stories) that the Internet-based news media is telling the public.) https://www.yahoo.com/tech/explained-how-tls-keeps-your-email-secure-883102… From its start in 1971, Internet-based email has not been known for its high security. As security researcher Bruce Schneier wrote in a 1995 essay for Macworld on the privacy perils of email: “It’s like a postcard that anyone can read along the way.” That unfortunate fact is finally fracturing. Email is getting safer for you — provided that your mail service and your correspondent’s both use a standard called “TLS,” short for Transport Layer Security. Finally, Google and other providers are starting to turn on TLS for the public. Read more: 4 Ways Your Email Provider Can Encrypt Your Messages TLS, then and now The move to the use of TLS could have happened more than five years ago: A 1.0 version of the TLS specification emerged only four years after Schneier’s essay, and the current 1.2 version dates to 2008. But even as mail services secured people’s log-ins, they did not take the extra step of scrambling their messages while in transit. Those who knew this would commonly comfort themselves with the lost-in-the-crowd theory of security: With some 183 billion messages a daysent back and forth, who would possibly have the time to look for one in particular? Then one year ago, Edward Snowden began giving a crash course in National Security Agency surveillance, which had the policy and, for the first time in history, the technology to collect everything first and index it later. After a few weeks of Snowden’s revelations, CNET’s Declan McCullagh made a simple observation: Gmail supported TLS, but other major email services did not, meaning that a huge chunk of the world’s email could be inspected by the NSA and its ilk, because for TLS to work, both sides of an email conversation have to support it. To make it more difficult for the NSA to simply absorb the world’s email, more tech companies took an active interest in TLS, including Yahoo Tech’s publisher, Yahoo, which had lagged in its support for encryption, according to the Washington Post. Progress and confusion With the growing use of TLS, the odds are now lower that your email is going out on a postcard. In mid-May, a study by Facebook found that 58 percent of the social network’s email notifications to members were going out encrypted. And last week, Google posted similar numbers: 71 percent of messages from Gmail to elsewhere went out encrypted, while 50 percent of those received by Gmail also arrived locked. There’s your good news: We’ve fixed a core defect in email and reduced the capability of well-meaning friends, family, and business partners to inadvertently risk your privacy by sending sensitive data about you in their own email. And with TLS, you don’t have to install any software or change any settings to get its advantage. The bad news: It’s hard to figure out if your own provider has done its part. Google’s regularly updated transparency report now includes a section on “encryption in transit” that lets you check to see if other large mail services do TLS. But it can yield confusing results, and smaller systems (say, your employer’s) don’t show up. You can also check for TLS use on any site at STARTTLS.info. Should you switch? If you spend any time experimenting with STARTTLS.info, you’ll quickly see how badly many consumer Internet providers’ mail services lag behind webmail. Comcast is turning on TLS one provider at a time, and CenturyLink already supports it. But Time Warner Cable, Verizon, and Cox have not announced plans to enable TLS. Among webmail companies, Yahoo followed Gmail by turning on TLS in the first quarter of this year, AOL has done the same, and Microsoft is “currently rolling out TLS,” a spokesperson said. Checks of Apple’s services show patchy support, and the company did not answer a request for clarification. There are good reasons to separate your email from your ISP — starting with not having to worry about running out of online storage or having to send hundreds of change-of-address notices if you switch providers. But webmail has its own privacy issue: Most of these services are paid for by ads that target the words in your messages. The price to evade the NSA’s eyes doesn’t have to include subjecting your email to your provider’s advertising robots. Among the four big webmail services that now use TLS, Microsoft and Yahoo let you pay to clean the ads from your account ( $19.95 a year at Microsoft, $49.99 a year at Yahoo), while Google will open a new, $50/year ad-free Google Apps account for you at the domain name of your choice. But how many of you have exercised any of those ad-free options? Email Rob at rob(a)robpegoraro.com; follow him on Twitter at@robpegoraro.

1 0

Re: [Cryptography] Help investigate cell phone snooping by police nationwide
by John Young 10 Jun '14

10 Jun '14

Tinfoil is not sufficent any more due to increased sensitivy of interceptors. False protection left in place as ploy. False TEMPEST protection is especially effective, the best remains classified in a rolling fashion: more leaked to delude the more unleaked of what works. Inadvertent emanations are increasingly inadvertent as research in those waves leaps by giant bounds. Not news to this crafty gaggle of uncontrollably paranoidic deceptors braying about faults, patches, new faults, new paths, rolling thunder to panic herds of panic-herders, pardon, infiltrated standards setters. Jim, you may be the only experienced expert here in betrayal by trustees inside and outside the penal colony, pardon, West of the Pecos justice rigged-comsec industry. All hail MIT, industry leader of techno-rigging. BTW, are you at liberty to reveal the secrets of bio-chemical TEMPEST? The inadvertent body odor is somewhat more reliable than facial and corporeal. Rumor of testing on the bio-chem harvesting in prisons, separation of sexes into their many varieties of posturing, impostering, hybridity and crossings. After 9/11 batteries of full sprectrum bio-chem sensors were set up in NYC transporation nodes, pretending to be about snffing for bombs but actually about varieties of human emanations. Later transformed and cloaked into the Microsoft-NYPD Domain Awareness program which pretended to be about data-gathering and infiltrating suspected terrorist conclaves, vaunted by resucitated HUMINT, but about, well, that's not for the inexperienced emanator to know. >Why not wrap the phone in a couple of layers of aluminum >foil? (Although, it won't shield against audio if that's being >recorded even while an RF contact does not exist...) > Jim Bell

6 6

Re: [Cryptography] Help investigate cell phone snooping by police nationwide
by grarpamp 10 Jun '14

10 Jun '14

>>>> (or as Snowden demonstrated, put in a fridge to avoid scrutiny and >>>> audio capture the best idea. non-serial tower associations are an >>>> anomaly alerted and acted upon.) Faraday cages concept really depend on the freqs they are designed to inhibit, pressure, sound, radio, optic, etc. Given wide enough freqs, one cage does not service all. A fridge has plastec and magnetic gaskets, over maybe 2cm variant gap, so not a complete EM seal (at whichever specifical freqs). And grounding issue. But good at human sound deading. Microwave door shield is closer to cell phone freq shield. If you cannot simply remove the battery preferably, that is. As always, test first. And is easy to find phones to test all phone bands with. TEMPEST.

4 4

"Ephemeral" Biometrics
by Gregory Foster 09 Jun '14

09 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Federal Business Opportunities (Jun 4) - "Ephemeral Biometrics: An Alternative to Traditional, Event-based Authentication" by Sandia National Laboratories: https://www.fbo.gov/index?s=opportunity&mode=form&id=06e9abca57bdd9dac64902… > Sandia National Laboratories is engaged in ongoing research and > development into transformational upgrades in the area of cyber > identity management as well as Insider Threat Monitoring by using > Ephemeral Biometrics (EB). EB is unique because individual > identities are tied to living biometric data that is active and > continuous. The purpose of the research is to derive convenient > authentication techniques (e.g., alternatives to passwords) that > are both active and continuous while at the same time significantly > improving authenticity and integrity of cyber identities. "Ephemeral Biometrics: What are they and what do they solve?" by Sung Choi and David Zage of Sandia National Laboratories (2013): https://www.cs.purdue.edu/homes/zagedj/docs/iccst2013.pdf I'm not really sure what's ephemeral about redefining authentication to mean continuous monitoring. This work directly targets insider threat concerns raised post-Snowden, and provides further evidence that entities obsessed with secrecy will destroy their own effectiveness in pursuit of an improbable if not impossible definition of "security" which attempts to hermetically seal systems that include human beings. Good luck with that! gf - -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJTkgW/AAoJEMaAACmjGtgjxLIQALl48hrZKW1sWVWyIKcsb7hu 0ZPYm/FRrYnNHwAeAN/vWdVxrUyhRLKBCs+2H8v5C7Na2df1AqInZ1H9AGD1j84M iwZtHWMVkFvkcVDW+NMINRoHSjUdrPqIh+RP0KseMZTPTaelSD+tVEmUedSzOLgV km/OZ5URefIRSFjP3p6pA+YxZoZOU8UlwSxJFv9o4Vs/k1lwLDE+BYErabTXrFoe MWJhKhQWpisLD6QGBq+LRcTq+P+fpJlu6pRJFQR8mUIWsgZwr4OtQvXxjXFDO16K jaBVBSB0bdgQV4d8HLJE1dJek3fe1q9i9YEYBL2p91voTTKmPwkDIcmj9X9ZfNR1 lO5AXZh1H+rhO1OAfqlkvI0VYxAzO7AerKS+tPwh0lw3VSZYiBZawtJb3t/2snF9 R/02NRXfKZOFqKUQUH1bRkrFuKDRudmhtomafCek1MShVgR9BlAjFHcMjFa0gXBy FUo1D8ouzWYfwAM/0eVwDX9YAMX3tr3vl0KopFTEyFzolIapg9wbDeesIn4mu24P 8zDJUew+5wcHTc9ZPFZhdh6xGC9SoLvAPaqVTTSx3tTcxbdIouiIWyaQUOXNdteb KM9FEa+e9j5TggnaxuNuDpbBXVlKlou9oee/vge7OdS0EHqStPthckt3Vhp0Lv59 HzJ56AjJ0zh2iRLX/9Wt =KZuq -----END PGP SIGNATURE-----

5 7

Tinfoil Chat
by oottela 09 Jun '14

09 Jun '14

I'd like to share a project I came up with back in spring 2012 and begun working after the Snowden leaks started. Highlights are -OTP encryption for perfect secrecy -OTP encrypted Keccak HMACs to prevent undetectable message tampering -HW TRNG to generate truly random keys (Von Neumann whitened) -HW Data diodes to provide immunity against message exfiltration attacks originating from network. Source code and links to whitepaper and manual are available from https://github.com/maqp/tfc/ Regards, Markus

2 1

Going to jail nowadays for owning a book, wtf?
by Georgi Guninski 08 Jun '14

08 Jun '14

AFAICT someone might go to jail for owning a book (not sure if paper or electronic): >From wikipedia (old revision): https://en.wikipedia.org/w/index.php?title=Abu_Hamza_al-Masri&oldid=6095135… --- Guilty of one charge of "possessing a document containing information likely to be useful to a person committing or preparing an act of terrorism"[31] under the Terrorism Act 2000, s58. This charge under the Terrorism Act of 2000 related to his possession of an Encyclopedia of Afghan Jihad, an Al Qaeda Handbook and other propaganda materials produced by Abu Hamza.[32] ---

5 10

New vulnerability in OpenSSL
by jim bell 08 Jun '14

08 Jun '14

https://www.yahoo.com/tech/here-we-go-again-new-vulnerability-discovered-in… BOSTON — Security researchers have uncovered new bugs in the Web encryption software that caused the pernicious “Heartbleed” Internet threat that surfaced in April. Experts said the newly discovered vulnerabilities in OpenSSL, which could allow hackers to spy on communications, do not appear to be as serious a threat as Heartbleed. The new bugs were disclosed on Thursday as the group responsible for developing that software released an OpenSSL update that contains seven security fixes. Experts said that websites and technology firms that use OpenSSL technology should install the update on their systems as quickly as possible. Still, they said that could take several days or weeks because companies need to first test systems to make sure they are compatible with the update. "They are going to have to patch. This will take some time," said Lee Weiner, senior vice president with cybersecurity software maker Rapid7. OpenSSL technology is used on about two-thirds of all websites, including ones run by Amazon.com, Facebook, Google, and Yahoo. It is also incorporated into thousands of technology products from companies, including Cisco Systems, Hewlett-Packard, IBM, Intel, and Oracle. The widespread Heartbleed bug surfaced in April when it was disclosed that the flaw potentially exposed users of those websites and technologies to attack by hackers who could steal large quantities of data without leaving a trace. That prompted fear that attackers may have compromised large numbers of networks without their knowledge. Security experts said Thursday that the newly discovered bugs are more difficult to exploit than Heartbleed, making those vulnerabilities less of a threat. Still, until users of the technology update their systems, “there is a window of opportunity” for sophisticated hackers to launch attacks and exploit the newly uncovered vulnerabilities, said Tal Klein, vice president of strategy with cloud security firm Adallom.

3 2

US Army research into quantum teleportation of data
by Gregory Foster 08 Jun '14

08 Jun '14

Defense Systems (May 30) - "Teleporting information sets stage for ‘cyber secure’ communications": http://defensesystems.com/Articles/2014/05/30/ARL-Teleportation.aspx Lots of challenges to overcome, but the advantages are sufficiently self-evident and seductive to likely warrant substantial funding. A use case not mentioned: remotely piloted aircraft (drones) without network lag. gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

2 1

Re: [Cryptography] Help investigate cell phone snooping by police nationwide
by grarpamp 08 Jun '14

08 Jun '14

On Sat, Jun 7, 2014 at 11:45 PM, Sidney Markowitz <sidney(a)sidney.com> wrote: > I don't know what would make me feel safer - putting the phones in a microwave > oven with the chance that the door could easily be left ajar, or getting the > acoustic insulation and masking hum of a refrigerator. Trust the microwave you tested, right, because you do not know what quality DSP is pricessing your remaining 5dB audio over your entire conversation. Or put microwave in fridge ;) aka: remove battery / crush/displace phone... be happy.

1 0