August 2014 - cypherpunks - lists.cpunks.org

Re: "Blackphone" said to be "a super-secure nsa-proof"
by Ulex Europae 14 Oct '16

14 Oct '16

At 05:25 AM 1/17/2014, Jim Bell forwarded: ><<http:///>http://www.yahoo.com/tech/startup-launching-a-super-secure-nsa-proof-735110…> It's been long enough, has anyone acquired one of these and tested it? Ulex

10 13

Re: [Cryptography] Bruce Schneier has gotten seriously spooked
by Eugen Leitl 07 Sep '16

07 Sep '16

----- Forwarded message from Brian Gladman <brg(a)gladman.plus.com> ----- Date: Sat, 07 Sep 2013 09:33:28 +0100 From: Brian Gladman <brg(a)gladman.plus.com> To: Cryptography Mailing List <cryptography(a)metzdowd.com> Subject: Re: [Cryptography] Bruce Schneier has gotten seriously spooked User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 On 07/09/2013 01:48, Chris Palmer wrote: >> Q: "Could the NSA be intercepting downloads of open-source encryption software and silently replacing these with their own versions?" > > Why would they perform the attack only for encryption software? They > could compromise people's laptops by spiking any popular app. Because NSA and GCHQ are much more interested in attacking communictions in transit rather than attacking endpoints. Endpoint attacks cost more to undertake, only give access to a limited amount of data and involve much greater risks that their attack will either be discovered or their means of attack will leave evidence of what they have done and how they have done it. The internal bueaucratic costs of gaining approval for (adverarial) endpoint attacks also makes it a more costly process than the use of network based interception. There is significant use of open source encryption software in end to end encryption solutions, in file archivers, in wifi and network routers, and in protecing the communications used to manage and control such components when at remote locations. The open source software is provided in source code form and is compiled from source in a huge number of applications and this means that the ability to covertly substitute broken source code could provide access to a huge amount of traffic without the risks involved in endpoint attacks. I stress that I am NOT suggesting that this has happened (or is happening), simply that it has attractions from an NSA/GCHQ viewpoint. Fortunately, I think it is a difficult attack to mount covertly (that is, without the acqiecience of the author(s) of the software in question). On the more general debate here, in my view, 'security for the masses' through the deployment of encryption is a 'pipe dream' that isn't going to happen. Functionality (and the complexity that comes with it) is the enemy of security and it is very clear that the public places a much higher value on functionality than it does on security (or privacy). Every time a new device comes onto the market, it starts with limited functionality and some hope of decent security but rapidly evolves to be a high functionality product in which the prospect of decent security declines rapidly to zero. Raspberry Pis look interesting _now_ but I would be willing to bet that they won't buck the trend of increasing funtionality and declining security simply because this is what the majority in even this limited user community will want. To buck this trend we need an effort like the Raspberry Pi effort but one driven by our community with a strong commitment to simplicty and deliberately limited functionality in both hardware and software. Brian Gladman _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

8 14

Re: [liberationtech] Interesting things in keyservers
by Eugen Leitl 17 Aug '16

17 Aug '16

----- Forwarded message from micah <micah(a)riseup.net> ----- Date: Sat, 20 Jul 2013 10:05:42 -0400 From: micah <micah(a)riseup.net> To: Micah Lee <micahflee(a)riseup.net>, 'liberationtech' <liberationtech(a)lists.stanford.edu> Subject: Re: [liberationtech] Interesting things in keyservers User-Agent: Notmuch/0.15.2 (http://notmuchmail.org) Emacs/24.3.1 (x86_64-pc-linux-gnu) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> Hi Micah! Micah Lee <micahflee(a)riseup.net> writes: > I'm working on a talk for OHM2013 about PGP. Can anyone send me examples > of interesting keys in key servers that you know of? Since you are preparing a talk about the subject, I'm going to be pedantic and correct your usage of "PGP", because it is important to get your terminology straight when giving a talk. I presume you aren't giving a talk about the commercial software, but instead you are actually giving a talk about OpenPGP which is the standard specified by RFC4880 that different programs like GnuPG, Seahorse, MacGPG, and PGP etc. all implement. If that is true, then you should refer to it as OpenPGP, and not PGP. I dont know what your talk will consist of, besides the funny enigmail XSS and goatse.cx stuff (thanks for that! always good to have some goatse early in the morning), but I would like to point out a few things that might be useful to mention. One is a wiki page that I created with some people: https://we.riseup.net/riseuplabs+paow/openpgp-best-practices - it contains some useful hints about using OpenPGP, maintaining a good key and some general good practices that people often dont know about (such as the importance of keeping your keys updated to get critical revocation and expiration extension certifications!) One thing mentioned on that page that I wanted to highlight, because you used pgp.mit.edu links in your original email, is that the keyserver pgp.mit.edu is not a good one to use/promote. Everyone uses it as their 'goto' keyserver, but it is a really bad idea! As a keyserver, it has been broken for years. For a long time it was just dropping revocations, subkey updates and expirations on the floor. That is *really* bad. Eventually, they upgraded their keyserver software, but it is *still* running an older version of SKS, a version that fails to handle 16-digit subkeyid lookups (among other failings). So, please don't rely on pgp.mit.edu for your security, and please don't include them in your slides! If you are looking for one to use, I highly recommend using the SKS pool address (hkp://pool.sks-keyservers.net or http://hkps.pool.sks-keyservers.net/ - or if you want a more close geographical pool, have a look at http://sks-keyservers.net/overview-of-pools.php) Finally, there seems to be some amazing misconceptions about keyservers, keys and the web of trust. In particular this http://cryptome.org/2013/07/mining-pgp-keyservers.htm circulated recently and it pained me to see because it suggested various wreckless conclusions that were dangerously off the mark[0] (and used pgp.mit.edu, hah). While it is true that we've jokingly called the OpenPGP web of trust "the original social network" because of the exposed social relational graphing that can be done by querying keyservers, and it is for this reason that many activists I know do not want to have signatures uploaded to keyservers (and instead use the bulky local-only signature work-around)... ... but for some reason people seem to think that if it is on a keyserver, is true, or it means something that it doesn't. People don't realize critical things, such as the fact that I can create a key with the UID Nadim Kobeissi and upload it to the keyservers[1]. That doesn't mean that is the real Nadim's key (this is what exchanging key fingerprints and doing certifications is for, so you can know, with a certain degree of certainty, that this person is the person who controls that secret key material). Or people think that because I signed your key and that signature is on the keyserver that indicates: I trust you; we met in person at that date; we know each other; we are involved in a criminal conspiracy with each other; or many other wrong assumptions about what that certification means. I can sign Edward Snowden's key and send that to the keyservers[1]. Hell, I can sign Snowden's key with my fake Nadim Kobeissi key[1] and then send it to the keyservers. Does that mean that Nadim and Snowden have met in person?! No, it does not at all. Anyways, I can keep going... but I dont know what the focus of your OHM talk is about, so going on like this isn't particularly useful to you and your talk... however, I'd be happy to provide more feedback about your talk if you would like![2] After all, we Micahs need to stick together, micah 0. "the cryptome article just sounds like impenetrable bullshit from someone with no interest in actually understandning what's happening" - I'm not saying who said this... 1. no, I didn't do that, nor did I upload the edward snowden or bradly manning keys. -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

4 3

HavenCo - Rebirth?
by grarpamp 07 Apr '15

07 Apr '15

Highly doubt Ryan, Avi or any cpunks are involved, or that much of anything will actually be in SeaLand. Seems like a news driven oppurtunistic biz to cover tower operation and maintenance costs. Anyone have any facts? Such as who's behind it and why? http://www.sealandgov.org/sealand-news-1/HavenCo http://www.havenco.com/

2 1

Tox.im
by Cathal Garvey 03 Feb '15

03 Feb '15

Anyone looked this over? I only just discovered it, but it seems nice: * P2P * Encrypted * Voice/Video/Chat/Files * GPL'd https://github.com/irungentoo/toxcore It's written mostly in C(++) with a dash of assembly, which worries me security wise.. -- T: @onetruecathal, @IndieBBDNA P: +353876363185 W: http://indiebiotech.com

9 15

How come search engines don't crawl the list and I can't find 'robots.txt'?
by Georgi Guninski 13 Jan '15

13 Jan '15

AFAICT the list archives don't show in search engines and in addition don't see /robots.txt. How so?

4 7

Russia want completely ban Bitcoin and other cryptocurrencies
by Anton Nesterov 27 Dec '14

27 Dec '14

Ministry of Finance of Russia drafted a bill to ban cryptocurrencies with administrative or criminal penalty for mining and other operation. Also they want to censor bitcoin-related websites. This will come into force in 2015. http://top.rbc.ru/economics/01/08/2014/940521.shtml (in Russian)

7 17

Does a society of sheep deserve a government of wolves?
by Georgi Guninski 06 Dec '14

06 Dec '14

The question is: === Does a society of sheep deserve a government of wolves? === Some rants: Obama is protecting the NSA and is probably claiming "I am elected by the sheep, so the sheep are protecting the NSA". If it weren't Obama only the names will change. The majority of sheep are economically enslaved and/or brainwashed IMO.

10 13

Hal Finney cryopreserved
by Eugen Leitl 10 Sep '14

10 Sep '14

http://lists.extropy.org/pipermail/extropy-chat/2014-August/082585.html Max More max at maxmore.com Thu Aug 28 18:41:54 UTC 2014 Previous message: [ExI] It's alive? Next message: [ExI] Hal Finney being cryopreserved now Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] I am both sad and happy to tell you that long-time Extropy Institute/Extropy magazine/Extropy chat list member -- and honored cypherpunk and Bitcoin pioneer – was declared clinically dead this morning and is now being cryopreserved. Hal was diagnosed with ALS five years ago. He made it clear that once he lost the ability to communicate, he did not want his vital functions supported any further but should be allowed to cease functioning and promptly be cryopreserved. Hal and Fran Finney arrived in Scottsdale, Arizona on Tuesday where he was checked into ICU of a hospital near Alcor. After administration of drugs to ensure no consciousness, his ventilator was removed. Although the doctors expected all breathing to cease within an hour, Hal’s body kept going until shortly before 9:00 am this morning, August 28, 2014. Immediately after pronouncement of legal death, Alcor’s standby team went into action, restoring circulation, ventilation, administering an array of medications, and initiating external cooling. Surgery is currently underway to enable us to replace Hal’s blood and interstitial fluids with cryoprotectant. Once perfusion is finished we will be able to plunge Hal’s temperature down past the freezing point without any significant ice formation. Once he is down to around -110 degC we will slow cooling and take a couple more days to reach the final storage temperature of -196 degC. After that, Hal will be placed in long-term storage and cared for until the day when repair and revival may be possible. Hal’s wife, Fran (also an Alcor member) has stayed by Hal’s side throughout and is observing our procedures firsthand. Since Hal is open about his Alcor membership and said that he would be happy for us to tell people about his choice if it might be good for cryonics, we will be issuing a press release, as well as writing something more extensive for *Cryonics* magazine and elsewhere. If you have thoughts on Hal and his life and work, please send them to me. Hal, I know I speak for many when I say that I look forward to speaking to you again sometime in the future and to throwing a party in honor of your revival. --Max -- Max More, PhD Strategic Philosopher Co-editor, *The Transhumanist Reader* http://www.amazon.com/Transhumanist-Reader-Contemporary-Technology-Philosop… President & CEO, Alcor Life Extension Foundation

2 1

If you ran a Bitcoin related service before the thing hit $100 you prolly ought to be somewhat concerned and/or prepared
by Eugen Leitl 02 Sep '14

02 Sep '14

http://www.thedrinkingrecord.com/2014/08/25/a-law-enforcement-encounter-if-… A Law Enforcement Encounter: If you ran a Bitcoin related service before the thing hit $100 you prolly ought to be somewhat concerned and/or prepared Posted on August 25, 2014 So this afternoon I was roused from my day slumber by vigorous knocking at my front door. Under the impression the two gentlemen at my door step might be some sort of process servers or collections agents visiting about my substantial student loan debt I begrudgingly inquire as to what is going on. They inquire as to who I am, and I inquire as to who they are. 1 When they show badges I offer confirmation that I am indeed the person referred to frequently by the slave name2 they used. Their inquiry was laser focused on any information I might have about connections between BTCPak and The Silk Road3 of which I have none that can't be discovered by scraping public information off of the public web. BTCPak was this thing that accepted Bitcoin and provided prepaid codes you could load on to shitty Debit cards. I was new and didn't know any better so I had some of the most costly eatings and drinkings of my life. BTCPak was one of the more expensive ways to turn Bitcoin into US Dollars, but its advantage was it was fast and had a great reputation for working. If there weren't any codes to be had, the site wouldn't take Bitcoin. If you sent it Bitcoin it gave you the code in six confirmations. There was no market I knew of to feed the codes the other direction. The entire venture didn't even really seem to be a business. It just seemed to be a machine DBordello built to acquire Bitcoin in an automated fashion which as far as I can tell was turned off, because the future he was buying all of the cheap coins for finally arrived. A notable thing that kept coming up was an incredulity on the part of the investigators was that there was much of anything happening in early Bitcoin that wasn't shady and related to Black Market drugs. In reality a lot of stuff was happening on the plaintext Internet without the slightest shade of illegality. I mentioned the Devcoin4 thing that was my first source of any actual amount of Bitcoin. Devcoin was/is this arrangement where by dumping text into a wiki you earned coins on an altchain. You could then take the coins to this shitty exchange called Vircurex where you could dump them for BTC. As astounding as it seems at the time when I started doing this devcoin thing dumping a few thousand words in their wiki was probably worth a two digit number of BTC in the first month I got paid. Fuck me for having been so shortsighted and having not quite stumbled into what actual people were writing about Bitcoin. As astoundingly stupid as the premise sounds much of early Bitcoin involved people throwing coins around for appallingly, dumbfoundingly, stupid reasons in the name of "supporting Bitcoin" and "getting the ecosystem moving." Many stupid and lucrative things were scams of the Pirateat40 and GLBSE sort,5 I instead did the writing for Devcoins thing because I like sleeping soundly at night. What you, dear reader can take from this encounter is that if you were involved with Bitcoin before Coindesk6 became a thing and live in the United States, you too might be questioned by agents of two separate federal law enforcement agencies at the same time. If they are asking about BTCPak now, who knows how long the backlog of sites and ventures they are working through is. It's something to prepare for. When the agents suggested that I probably never expected they'd find me, they seemed a little shock when I replied that I kind of expected this attention eventually. I don't exactly keep the connections between my self and my slave name incredibly well guarded secrets, at least not on the scale of Silk Road users and administrators. This old Boy Scout would like to remind everyone of the motto: "Be Prepared". The reason for this is in my jurisdiction failure to identify yourself in a law enforcement encounter is a crime of questionable constitutional provenance, while having a conversation with a debt collector or process server that consists of nothing on your part other than intoning "Fuck You" a myriad of different was is great justice for all and legally sound. ↩ This odd thing happens when use a screen name long enough and act with established, credible pseudononymity in a space long enough, especially one with such an effective Web of Trust surrounding it. The layperson Toby gets asked about the learned amateur Bingo's hobby and suddenly you find yourself in an IRL encounter where you feel like you are wearing a person suit. Welcome to the future, its a weird fucking place. ↩ That thing I've avoided and wrote about on this blog before. ↩ Even though devcoin has dropped twenty times in value from ~200 satoshis per to ~10 satoshis per now, holding it would still have booked a dollar denominated gain over the time. But no, holding Devcoin would be stupid. ↩ Well so it would have seemed at least to the people running them. Running such a thing though doesn't fit my acceptable risk profile in the same way The Silk Road never fit my acceptable risk profile. ↩ Yes, the FBI agent name dropped Coindesk as a thing he reads as well as admitting to having a small amount of Bitcoin. ↩ This entry was posted in Bitcoin, Commentary, Disclosures, News. Bookmark the permalink.

3 5