September 2014 - cypherpunks - lists.cpunks.org

[Cryptography] stories from the real life MITM book
by Eugen Leitl 04 Sep '14

04 Sep '14

----- Forwarded message from ianG <iang(a)iang.org> ----- Date: Wed, 03 Sep 2014 09:57:16 +0100 From: ianG <iang(a)iang.org> To: Cryptography Mailing List <cryptography(a)metzdowd.com> Subject: [Cryptography] stories from the real life MITM book Message-ID: <5406D7EC.2030603(a)iang.org> User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 Evidence of MITMs is so rare it has to be trumpeted. Snippets only. http://www.popsci.com/article/technology/mysterious-phony-cell-towers-could… http://venturebeat.com/2014/09/02/who-is-putting-up-interceptor-cell-towers… To show what the CryptoPhone can do that less expensive competitors cannot, he points me to a map that he and his customers have created, indicating 17 different phony cell towers known as “interceptors,” detected by the CryptoPhone 500 around the United States during the month of July alone. (The map below is from August.) Interceptors look to a typical phone like an ordinary tower. Once the phone connects with the interceptor, a variety of “over-the-air” attacks become possible, from eavesdropping on calls and texts to pushing spyware to the device. http://venturebeat.com/2014/09/02/who-is-putting-up-interceptor-cell-towers… Who is putting up ‘interceptor’ cell towers? The mystery deepens The discovery “appears to confirm real-world use of techniques that have been highlighted by researchers for years,” said Stephen Ellis, manager of cyber threat intelligence at security firm iSIGHT Partners. While noting that his company “cannot confirm the accuracy of this reporting without further information,” Ellis told us that iSIGHT is “highly confident that we have observed real-world use of this technique in support of another of its uses – cyber crime [for] financial gain.” “We have observed and reported on cases in other parts of the world where actors are known to have set up fake base stations to send spoofed SMS messages,” Ellis said, “possibly to send spam or to direct unsuspecting victims to malicious websites.” The Federal Communications Commission (FCC) announced last month that it is launching an investigation into the use of cell network interceptors by criminal gangs and foreign intelligence. We asked Goldsmith if he could be mistaken about the towers. Perhaps they are just commercial ones that seem unusual? “We can definitely tell” that they’re non-network towers, he said, by analysis of the infrastructure. These phony towers, without names as normal towers have, insist to your phone that they must handle the call and then trick the phone into turning off its normal encryption. Such a tower tells you that “none of your towers are currently available,” Goldsmith told us. It says, “‘I’m your tower.’ “If you wanted to listen to a phone call,” he said, “this would be the easy way.” _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message -----

1 0

"Godfather of Anonymity" David Chaum on BBC
by John Young 03 Sep '14

03 Sep '14

"Horizon: The defenders of anonymity on the internet" http://www.bbc.com/news/technology-29032399

2 1

[tor-talk] Tor Weekly News — September 3rd, 2014
by Eugen Leitl 03 Sep '14

03 Sep '14

----- Forwarded message from harmony <harmony01(a)riseup.net> ----- Date: Wed, 3 Sep 2014 14:06:36 +0000 From: harmony <harmony01(a)riseup.net> To: tor-news(a)lists.torproject.org, tor-talk(a)lists.torproject.org Subject: [tor-talk] Tor Weekly News — September 3rd, 2014 Message-ID: <20140903140636.03c38791(a)riseup.net> X-Mailer: Claws Mail 3.8.1 (GTK+ 2.24.10; i486-pc-linux-gnu) Reply-To: tor-talk(a)lists.torproject.org ======================================================================== Tor Weekly News September 3rd, 2014 ======================================================================== Welcome to the thirty-fifth issue of Tor Weekly News in 2014, the weekly newsletter that covers what is happening in the Tor community. Tor Browser 3.6.5 and 4.0-alpha-2 are out ----------------------------------------- The Tor Browser team put out two new releases of the privacy-preserving web browser. Among the major changes, version 3.6.5 upgrades Firefox to 24.8.0esr, and includes an improved prompt to help users defend against HTML5 canvas image fingerprinting [1], following a patch by Isis Lovecruft [2]. Version 4.0-alpha-2 additionally includes the code for the forthcoming Tor Browser auto-updater (switched off by default) and “better hardening for Windows and Linux builds” [3]. As ever, you can download the new releases along with their signature files from the Tor Project’s distribution directory [4]. Please upgrade as soon as you can. [1]: https://lists.torproject.org/pipermail/tor-talk/2014-July/033969.html [2]: https://bugs.torproject.org/12684 [3]: https://lists.torproject.org/pipermail/tor-qa/2014-September/000458.html [4]: https://www.torproject.org/dist/torbrowser/ Tails 1.1.1 is out ------------------ The Tails team released [5] version 1.1.1 of the Debian- and Tor-based live operating system. As well as upgrading key components like Tor, Iceweasel, and Linux, this release disables I2P by default when Tails is booted, in response to the vulnerability recently disclosed by Exodus Intelligence [6]. Like Truecrypt, “i2p” must now be specified as a parameter on booting by users who wish to use it. A number of other security fixes and routine improvements make this an important update for all Tails users. See the full changelog in the team’s announcement, then update from a running copy of Tails 1.1 if you have one, or head to the download page [7] if you don’t. [5]: https://tails.boum.org/news/version_1.1.1/ [6]: https://tails.boum.org/security/Security_hole_in_I2P_0.9.13/ [7]: https://tails.boum.org/download/ Helping Internet services accept anonymous users ------------------------------------------------ Without a large and diverse network, run by thousands of dedicated volunteers, Tor would be nowhere near as useful or popular as it currently is. Although the current situation might at times seem fragile, there are still many places where it is feasible to host Tor exit nodes. However, Tor would become much less attractive to users if they found themselves unable to reach or interact with their favorite websites while using it, a situation that is unfortunately growing more common as site administrators and engineers react negatively to instances of abusive Tor traffic by banning anonymous connections outright. Tor users and developers, as well as members of other online communities (such as Wikimedia [8]), have tried to address the issue before, but real progress has yet to be made. Roger Dingledine wrote a “call to arms” [9] explaining the problem in detail and exploring possible paths to a solution: “Step one is to enumerate the set of websites and other Internet services that handle Tor connections differently from normal connections […]. Step two is to sort the problem websites based on how amenable they would be to our help”. Since the problem involves humans as much as it does machines, anyone working on it will have to be both “technical” but also ”good at activism”. If you fit that description, OTF has expressed interest in funding work on this issue through their Information Controls Fellowship Program [10]. Please read Roger’s blog post in full for more details. [8]: https://meta.wikimedia.org/wiki/Grants:IdeaLab/Partnership_between_Wikimedi… [9]: https://blog.torproject.org/blog/call-arms-helping-internet-services-accept… [10]: https://www.opentechfund.org/labs/fellowships Monthly status reports for August 2014 -------------------------------------- The wave of regular monthly reports from Tor project members for the month of August has begun. Damian Johnson released his report first [11], followed by reports from Georg Koppen [12], Sherief Alaa [13], Noel Torres [14], Kevin P Dyer [15], Nick Mathewson [16], Lunar [17], Arthur D. Edelstein [18], Karsten Loesing [19], Andrew Lewman [20], Arlo Breault [21], Pearl Crescent [22], and Michael Schloh von Bennewitz [23]. Lunar also reported on behalf of the help desk [24], and Mike Perry did the same for the Tor Browser team [25]. [11]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000626.html [12]: https://lists.torproject.org/pipermail/tor-reports/2014-August/000627.html [13]: https://lists.torproject.org/pipermail/tor-reports/2014-September/000628.ht… [14]: https://lists.torproject.org/pipermail/tor-reports/2014-September/000629.ht… [15]: https://lists.torproject.org/pipermail/tor-reports/2014-September/000630.ht… [16]: https://lists.torproject.org/pipermail/tor-reports/2014-September/000633.ht… [17]: https://lists.torproject.org/pipermail/tor-reports/2014-September/000635.ht… [18]: https://lists.torproject.org/pipermail/tor-reports/2014-September/000636.ht… [19]: https://lists.torproject.org/pipermail/tor-reports/2014-September/000637.ht… [20]: https://lists.torproject.org/pipermail/tor-reports/2014-September/000638.ht… [21]: https://lists.torproject.org/pipermail/tor-reports/2014-September/000639.ht… [22]: https://lists.torproject.org/pipermail/tor-reports/2014-September/000640.ht… [23]: https://lists.torproject.org/pipermail/tor-reports/2014-September/000641.ht… [24]: https://lists.torproject.org/pipermail/tor-reports/2014-September/000634.ht… [25]: https://lists.torproject.org/pipermail/tor-reports/2014-September/000642.ht… Miscellaneous news ------------------ Yawning Angel released [26] a new set of experimental Tor Browser builds containing the proposed obfs4 pluggable transport, along with a changelog; “questions, comments, feedback” are welcome on the email thread or the bug ticket tracking the deployment of obfs4 [27]. [26]: https://lists.torproject.org/pipermail/tor-dev/2014-August/007420.html [27]: https://bugs.torproject.org/12130 Arturo Filastò announced [28] the release of version 1.1.0 of oonibackend, the tool “used by ooniprobe to discover the addresses of test helpers (via the bouncer) to submit reports to (via the collector) and to perform some measurements that require a backend system to talk to (via test helpers)” [29]. [28]: https://lists.torproject.org/pipermail/tor-dev/2014-September/007450.html [29]: https://pypi.python.org/pypi/oonibackend meejah posted [30] a list of tasks to be completed in order to bring Tor Weather to a deployable state, following the recent rewrite effort and the Google Summer of Code project by Sreenatha Bhatlapenumarthi. [30]: https://lists.torproject.org/pipermail/tor-dev/2014-August/007426.html Israel Leiva submitted a summary [31] of work completed as part of the “Revamp GetTor” Google Summer of Code project: “The plan for now is to keep doing tests and deploy it asap (hopefully during September).” [31]: https://lists.torproject.org/pipermail/tor-dev/2014-August/007427.html Mike Perry posted [32] an updated version [33] of the proposal for website fingerprinting countermeasures which he co-authored with Marc Juarez as part of the latter’s Google Summer of Code project. [32]: https://lists.torproject.org/pipermail/tor-dev/2014-August/007417.html [33]: https://gitweb.torproject.org/user/mikeperry/torspec.git/blob/refs/heads/mu… Lunar gave a talk [34] at this year’s DebConf on the effort to build Debian packages deterministically, which is inspired in large part by Tor Browser’s use of the same technology [35]. Major progress was achieved during the conference [36]. [34]: http://meetings-archive.debian.net/pub/debian-meetings/2014/debconf14/webm/… [35]: https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and… [36]: http://lists.alioth.debian.org/pipermail/reproducible-builds/Week-of-Mon-20… David Fifield submitted a breakdown [37] of the costs incurred by the infrastructure that supports the meek pluggable transport [38] since its introduction. The total to date from both the Google App Engine and Amazon AWS front domains? $6.56. [37]: https://lists.torproject.org/pipermail/tor-dev/2014-August/007429.html [38]: https://trac.torproject.org/projects/tor/wiki/doc/meek Thanks to P D [39] and Daniel Pajonzeck [40] for running mirrors of the Tor Project website and software! [39]: https://lists.torproject.org/pipermail/tor-mirrors/2014-August/000653.html [40]: https://lists.torproject.org/pipermail/tor-mirrors/2014-August/000673.html Also on the subject of mirrors, Roger Dingledine alerted [41] the tor-mirrors mailing list to the fact that the Tor Project website (specifically the distribution directory) will shortly be increasing in size to eight or nine gigabytes, as a result of the soon-to-be-implemented Tor Browser updater [42]. Mirror operators will need to ensure that they can provide enough disk space to accommodate the change. [41]: https://lists.torproject.org/pipermail/tor-mirrors/2014-September/000675.ht… [42]: https://bugs.torproject.org/4234 whonixqubes announced [43] the release of an integrated version of the Whonix and Qubes operating systems: “I look forward to helping make Qubes + Whonix integration even tighter and more seamless throughout the future.” [43]: https://lists.torproject.org/pipermail/tor-talk/2014-August/034562.html Tor help desk roundup --------------------- The help desk has been asked if Tor can make a website visit appear to come from China. Tor connections appear to originate from the country where the exit relay in use is located; since Tor is blocked in China, there are zero exit relays in China. A visualization of the different country-locations of exit relays can be found on Tor’s metrics page [44]. [44]: https://metrics.torproject.org/bubbles.html#country-exits-only News from Tor StackExchange --------------------------- Anony Mouse wanted to know why Facebook shows the location of the user’s last login over Tor as Baghdad or Dhaka [45], instead of the real location of the exit relay. qbi posted a screenshot showing this issue [46]. According to Facebook, this information is based on an approximation, but this approximation locates all Tor exit relays either in Baghdad or in Dhaka. [45]: https://tor.stackexchange.com/q/3364/88 [46]: https://twitter.com/qbi/status/506550322308055040 user3500 wants to contribute to Tor and asks how this can be done as an inexperienced developer [47]. Jens Kubieziel replied with several possibilities, including reading the volunteer page and Tor Weekly News: in particular, the section containing easy development tasks might be a good start. Roya pointed out that any contribution is better than no contribution, and encouraged user3500 to just get started. Umut Seven recommended writing unit tests. [47]: https://tor.stackexchange.com/q/3961/88 Kras wants to use FoxyProxy in connection with Tor Browser Bundle and asks if it is safe to do so [48]. At the moment, there is only an answer saying “yes”, without any explanation. What is your experience? Is it safe for a user to install and use FoxyProxy? [48]: https://tor.stackexchange.com/q/3239/88 Upcoming events --------------- Sep 03 13:30 UTC | little-t tor development meeting | #tor-dev, irc.oftc.net | Sep 03 19:00 UTC | Tails contributors meeting | #tails-dev, irc.indymedia.org / h7gf2ha3hefoj5ls.onion | https://mailman.boum.org/pipermail/tails-project/2014-August/000016.html | Sep 05 15:00 UTC | OONI development meeting | #ooni, irc.oftc.net | https://lists.torproject.org/pipermail/ooni-dev/2014-August/000151.html | Sep 08 18:00 UTC | Tor Browser online meeting | #tor-dev, irc.oftc.net | Sep 12 19:00 UTC | Tails low hanging fruit session | #tails-dev, irc.indymedia.org / h7gf2ha3hefoj5ls.onion | https://mailman.boum.org/pipermail/tails-project/2014-August/000024.html This issue of Tor Weekly News has been assembled by harmony, Matt Pagan, Lunar, qbi, and Arlo Breault. Want to continue reading TWN? Please help us create this newsletter. We still need more volunteers to watch the Tor community and report important news. Please see the project page [49], write down your name and subscribe to the team mailing list [50] if you want to get involved! [49]: https://trac.torproject.org/projects/tor/wiki/TorWeeklyNews [50]: https://lists.torproject.org/cgi-bin/mailman/listinfo/news-team -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message -----

1 0

Fwd: [cryptography] JackPair Voice Encryption Dongle
by grarpamp 03 Sep '14

03 Sep '14

---------- Forwarded message ---------- From: Tom Ritter <tom(a)ritter.vg> Date: Mon, Aug 18, 2014 at 9:58 AM Subject: [cryptography] JackPair Voice Encryption Dongle To: Randombit List <cryptography(a)randombit.net> https://www.kickstarter.com/projects/620001568/jackpair-safeguard-your-phon… https://www.youtube.com/watch?v=rh6yF79FkAA DH with a 'Pairing Code' (ala ZRTP) to prevent MITM. Light on exact details, but they say it will be open source. "we think 10-12 digits [for a pairing code] is probably good enough, and more friendly for human reading" "We are using Diffie-Hellman at this point, and working on Elliptic curve Diffie-Hellman." "Synchronous stream cipher is used, with XOR'ed key-stream resulted from pseudo random number generator using OTSK as seed, and periodic marker flag for re-synchronization." "JackPair uses audio codec from Codec2, which has reasonable good sound quality at 1.2kbps. We have tested JackPair on top of GSM AMR 4.75 (Adaptive Multi-Rate, 4.75kbps) and HR (Half-Rate, 6.5kbps)." "Unlike traditional fax-modem technologies, our modem is designed from scratch to fight off the optimization done by GSM codec, including memory-less codec, voice activity detection (VAD)., automatic gain control (AGC) etc.. Basically we have to use synthesized voice to make mobile phones & media servers believe our signal is human voice, not just modulated waves." -tom _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography

1 0

UWB Time Domain SDR Radio
by grarpamp 03 Sep '14

03 Sep '14

On Tue, Aug 19, 2014 at 10:50 AM, Troy Benjegerdes <hozer(a)hozed.org> wrote: > On Tue, Aug 19, 2014 at 02:37:35PM +0200, Eugen Leitl wrote: >> > > In unrelated vein, I've recently read that it was the spooks >> > > that killed the digital pulse radio star, by limiting licensend >> > > power to toy levels. Apparently they were very unhappy with a >> > > radio that's hard to look for. >> http://www.cringely.com/2014/05/15/nsa-help-kill-uwb/ " Rather than using specific frequencies UWB transmitted on all frequencies at the same time. The key was knowing when and where in the frequency band to expect a bit to appear. Two parties with synchronized clocks and codebooks could agree that at 10 nanoseconds after the hour at a certain frequency or range of frequencies a bit would appear if one was intended. The presence of that signal at that time and place was a 1 and the absence was a 0. But if you didn’t know when to listen where — if you weren’t a part of the conversation — it all looked just like noise." > UWB is a great idea in theory, until you build an antenna, or you > avoid the antenna and the UWB noise floor ends up as a DDOS attack > on all your existing communications channels. I'm interested in further links to papers regarding this ultra wide band UWB, pulse position modulation PPM, time domain TD scheme as it applies to radio spectrum. Especially any links to hack work being done under software defined radio SDR.

1 0

Re: ‘Fake’ cellphone towers found in U.S.
by coderman 02 Sep '14

02 Sep '14

On 9/2/14, Cathal Garvey <cathalgarvey(a)cathalgarvey.me> wrote: > ... > Also, that nameless towers are assumed to be government intercepts. I > can imagine (though I don't know much, if I'm honest) situations in > which backup towers brought in for events (concerts, public gatherings, > etc.) might be contracted from third parties and present apparently > aberrant nomenclature, if any. These backup cells might be brought into > otherwise quiet areas for normal maintenance, or to back up faulty > towers, etc.; a legitimate roaming association when out of normal coverage areas is different from what could be called an "intercept attack". that is to say, actively placing an intercept channel in front of a station when that station is able to associate with legitimate carrier towers is an active attack against carrier networks, while a roaming association when out of range of carrier is a desired function and not malicious. to complicate matters, a number of years back i reported on active MitM attacks on 4G networks by interfering with existing associations to force a roaming hand-off to attacker endpoint. thus a determination of what is "normal" perspective to carrier towers requires a span of time combined with local observation. (snapshots not sufficient) also, the new broadband back-haul'ed femtocells that some carriers are distributing may or may not appear as an impersonating interceptor, exhibiting the usual properties of a rogue tower while actually being carrier provisioned capacity. > ... on the other hand, why would the > US feds need to roll out a nationwide cell tower network to spy on > everyone when..they already have one? :) this is an interesting question. presumably there are two reasons: a) that the usual intercepts require judicial approval and logistic delays, and b) manipulating the local link and signaling channel affords deep "enabling" of the target via means not cleared to transit untrusted networks. fun questions, encourage more research! :P

2 1

Privacy Law [Hiibel, Terry, ID, etc] [was: Run Bitcoin, be concerned/prepared]
by grarpamp 02 Sep '14

02 Sep '14

On Tue, Sep 2, 2014 at 7:57 AM, coderman <coderman(a)gmail.com> wrote: > is anyone pursuing this in any other states? the ACLU seems to list > just Hiibel. .. I don't know, someone could write ACLU and ask. https://www.aclu.org/technology-and-liberty/hiibel-v-sixth-judicial-distric… > those are better. thanks :) Now with Nevada, number 38876... http://caseinfo.nvsupremecourt.us/public/caseView.do?csIID=4764 Oral args multimedia... http://www.oyez.org/cases/2000-2009/2003/2003_03_5554 Epic flavor... http://epic.org/privacy/hiibel/ Cornell 'legal resources' section is pretty good. http://www.law.cornell.edu/ https://www.aclu.org/organization-news-and-highlights/supreme-court-ends-te… [Subject updated, gmail dethreaded, refer back for earlier links.]

1 0

If you ran a Bitcoin related service before the thing hit $100 you prolly ought to be somewhat concerned and/or prepared
by Eugen Leitl 02 Sep '14

02 Sep '14

http://www.thedrinkingrecord.com/2014/08/25/a-law-enforcement-encounter-if-… A Law Enforcement Encounter: If you ran a Bitcoin related service before the thing hit $100 you prolly ought to be somewhat concerned and/or prepared Posted on August 25, 2014 So this afternoon I was roused from my day slumber by vigorous knocking at my front door. Under the impression the two gentlemen at my door step might be some sort of process servers or collections agents visiting about my substantial student loan debt I begrudgingly inquire as to what is going on. They inquire as to who I am, and I inquire as to who they are. 1 When they show badges I offer confirmation that I am indeed the person referred to frequently by the slave name2 they used. Their inquiry was laser focused on any information I might have about connections between BTCPak and The Silk Road3 of which I have none that can't be discovered by scraping public information off of the public web. BTCPak was this thing that accepted Bitcoin and provided prepaid codes you could load on to shitty Debit cards. I was new and didn't know any better so I had some of the most costly eatings and drinkings of my life. BTCPak was one of the more expensive ways to turn Bitcoin into US Dollars, but its advantage was it was fast and had a great reputation for working. If there weren't any codes to be had, the site wouldn't take Bitcoin. If you sent it Bitcoin it gave you the code in six confirmations. There was no market I knew of to feed the codes the other direction. The entire venture didn't even really seem to be a business. It just seemed to be a machine DBordello built to acquire Bitcoin in an automated fashion which as far as I can tell was turned off, because the future he was buying all of the cheap coins for finally arrived. A notable thing that kept coming up was an incredulity on the part of the investigators was that there was much of anything happening in early Bitcoin that wasn't shady and related to Black Market drugs. In reality a lot of stuff was happening on the plaintext Internet without the slightest shade of illegality. I mentioned the Devcoin4 thing that was my first source of any actual amount of Bitcoin. Devcoin was/is this arrangement where by dumping text into a wiki you earned coins on an altchain. You could then take the coins to this shitty exchange called Vircurex where you could dump them for BTC. As astounding as it seems at the time when I started doing this devcoin thing dumping a few thousand words in their wiki was probably worth a two digit number of BTC in the first month I got paid. Fuck me for having been so shortsighted and having not quite stumbled into what actual people were writing about Bitcoin. As astoundingly stupid as the premise sounds much of early Bitcoin involved people throwing coins around for appallingly, dumbfoundingly, stupid reasons in the name of "supporting Bitcoin" and "getting the ecosystem moving." Many stupid and lucrative things were scams of the Pirateat40 and GLBSE sort,5 I instead did the writing for Devcoins thing because I like sleeping soundly at night. What you, dear reader can take from this encounter is that if you were involved with Bitcoin before Coindesk6 became a thing and live in the United States, you too might be questioned by agents of two separate federal law enforcement agencies at the same time. If they are asking about BTCPak now, who knows how long the backlog of sites and ventures they are working through is. It's something to prepare for. When the agents suggested that I probably never expected they'd find me, they seemed a little shock when I replied that I kind of expected this attention eventually. I don't exactly keep the connections between my self and my slave name incredibly well guarded secrets, at least not on the scale of Silk Road users and administrators. This old Boy Scout would like to remind everyone of the motto: "Be Prepared". The reason for this is in my jurisdiction failure to identify yourself in a law enforcement encounter is a crime of questionable constitutional provenance, while having a conversation with a debt collector or process server that consists of nothing on your part other than intoning "Fuck You" a myriad of different was is great justice for all and legally sound. ↩ This odd thing happens when use a screen name long enough and act with established, credible pseudononymity in a space long enough, especially one with such an effective Web of Trust surrounding it. The layperson Toby gets asked about the learned amateur Bingo's hobby and suddenly you find yourself in an IRL encounter where you feel like you are wearing a person suit. Welcome to the future, its a weird fucking place. ↩ That thing I've avoided and wrote about on this blog before. ↩ Even though devcoin has dropped twenty times in value from ~200 satoshis per to ~10 satoshis per now, holding it would still have booked a dollar denominated gain over the time. But no, holding Devcoin would be stupid. ↩ Well so it would have seemed at least to the people running them. Running such a thing though doesn't fit my acceptable risk profile in the same way The Silk Road never fit my acceptable risk profile. ↩ Yes, the FBI agent name dropped Coindesk as a thing he reads as well as admitting to having a small amount of Bitcoin. ↩ This entry was posted in Bitcoin, Commentary, Disclosures, News. Bookmark the permalink.

3 5

Re: going double cryptome at DEF CON 22
by coderman 02 Sep '14

02 Sep '14

On 7/30/14, Eugen Leitl <eugen(a)leitl.org> wrote: > ... > Can you keep up the docs for a while? I forgot to mirror them. plans to provide a mirror of the DEF CON media archive indefinitely delayed. also redundant now that media.defcon.org is populated... in case you did not hear already, they canceled drive #3 from the media set, which was to include the cryptome mirror. alas, my copies also corrupted for the two volumes that were provided. perhaps prominently labeling them "GAY PR()N vol 0x0A:", and "... 0x0B" causing unintended consequence? . . . at any rate, the onion mirrors will be up for another month, but maybe not much longer... best regards,

1 0

Re: [Cryptography] cryptography Digest, Vol 16, Issue 26
by grarpamp 01 Sep '14

01 Sep '14

On Wed, Aug 27, 2014 at 3:21 PM, Peter Trei <petertrei(a)gmail.com> wrote: > On 26 Aug 2014 21:28:49 -0000 "John Levine" <johnl(a)iecc.com> wrote: > > Subject: Re: [Cryptography] toll bills, was Encryption opinion > >>> I've not been on any of those > ?>roads, but I've gotten three e-mailed bills in the last two weeks >>>that to the unskeptical eye look fully legitimate, which also >>>indicates that the phishers know that my geolocation makes driving >>>such roads plausible. > >> It's not geolocation, everyone is getting E-ZPass spam this month. I >> have an E-ZPass account, and can report that it looks nothing like the >> real mail they send, which just tells you to look at their web site >> for a statement or other message. This is aimed at the same kinds of >> suckers who fall for 419. > >> I also got an actual e-mail this month from an actual toll road >> telling me about an actual charge due to actually driving on it. It >> was the 407 in Toronto, not E-ZPass, and I knew they'd be billing me >> so I set up an account so they'd e-mail me instead of the default >> paper bill, but still ... > >> John > >> PS: So is there any crypto on toll transponders, or could I >> skim them from the side of the road and make clones? > > Apparently some do, most don't. EZ Passes are made by > Kapsch (Kapsch.net) which has data sheets available, and has > made their protocols open source. > > You can easily modify one to inform you of when its queried: > http://www.popsci.com/article/diy/ezpass-hack-covert-scanning " Bear <bear(a)sonic.net> Aug 28 (4 days ago) I've got one. It's an envelope lined with copper foil. I get the pass out when approaching a toll booth, and put it back (and put the 'chip clip' back on the envelope to ensure that the foil makes good electrical contact) as I pull away from the toll booth. A toggle switch would be nice, but we can be fairly confident that a Faraday cage is working as designed. Bear. " > ...and it turns out they're queried all over the place, not just at > tolls. There have been proposals for a 'kill switch' which would > allow you to disable it except when approaching a toll, but I > haven't seen that. > > But its moot, anyway. Transponders are being replaced by > license plate scanning. This is yet another case where we > accepted something (permanently visible LPs) on the basis > that no one could track every plate, everywhere, all the time. > Technology moved on, and invalidated that promise of > privacy-unless-they-really-really-need-to-violate-it. So you need active defense of plate masks/obfuscation mechanichs... flip down blanking devices, character cards, mask films on a loop roll motor, OLED plates. DIY 007. Drive masked, reveal as needed. Worst case, you don't notice the cop car near you and get a paper ticket for no plate or a hacked random nonspec plate. $100+... better than daily loss of privacy to intersection/roadside cams, google robot cars, etc. Next battle... killing all the manufacturer supplied transponders in your car... Then your cell phone.

1 0