January 2015 - cypherpunks - lists.cpunks.org

Cryptome banned from DocumentCloud.org and Amazon.com
by coderman 28 Jan '15

28 Jan '15

""" Bans of Cryptome by DocumentCloud.org and Amazon.com while both publish Snowden's documents reveals corruption of profitable and NGO media. Amazon says it canceled offering of Cryptome Archive due to ban on publishing government documents. Prohibited: https://sellercentral.amazon.com/gp/help/200685320 """ banned library? banned librarian?

2 1

Re: [Cryptography] traffic analysis
by grarpamp 27 Jan '15

27 Jan '15

On Tue, Jan 27, 2015 at 3:23 PM, Ben Laurie <benl(a)google.com> wrote: > Yeah, but ... who can realistically afford that bandwidth? One can afford what they wish to give to and thus expect to get from the network in return, no more, no less, as always. (Be it literally from the physical NIC network, or the logical networks created by their applications riding over and within the physical.) > To every possible recipient? Clearly you have to make a tradeoff. Full meshing of chaff addressed to all participants seems unnecessary. > grarpamp wrote: > Is there so much (possibly far less than correct) thought out there > that fill bandwidth is evil, untolerable, unmanageable, and blocking > of usability such that these networks are moot to even try coding > for general deployment? On Tue, Jan 27, 2015 at 1:35 PM, Jerry Leichter <leichter(a)lrw.com> wrote: > Google Fiber offers 1Gb/second - but how many customers running all > out will overload any possible backbone behind the single link from the > house to the concentrator? > > If everyone starts sending constant cover traffic, links will be quickly > overloaded all over the place. At which point the providers will start > charging [...] nobody will be happy That's the simple man's kneejerk response when initially contemplating chaffed networks. > There's room to do much better. For one thing, you don't need to saturate your link with cover traffic - you need to send enough cover traffic so that a listener can't tell the difference between cover and real traffic. This depends on if you're network is a low latency one, or if it uses a store and forward model. Even that is tricky due to needs to hide the size of data each endpoint exchanges from passive adversaries. It begins to approach constant higher rate the more you data wish to pass securely. > If your cover traffic rate equals your average rate over some period of time, > you're not adding more traffic - you're simply replacing some of your cover > messages with real messages. But ... what happens when you have a > peak demand way above your average? Then you must wait until you can pass your wheat. Or plan your needs according to the give and get model. > As Stealthmonger has commented concerning anonymity, if you want > security against traffic analysis, you have to accept delays: Set your > cover traffic rate somewhat higher than your average rate, and you'll > *eventually* catch up with peaks (though as with any queueing system, > the delays can grow without bound - requiring unbounded memory > *somewhere*). Delays (trading latency) are not the only way to achieve security. You may also elect to trade available throughput bandwidth in a wheat/chaff system. > I'm not aware of any open research on these kinds of questions - though > it may well be out there. What's the optimum cover traffic rate under > various assumptions about the real traffic rate and distribution? When > is it safe to use the traffic other users present as cover for your own? > Clearly if there's only one other user sending traffic, you can't use him > for cover as *he* can tell which of the packets are yours. But is there a > way to mix traffic from multiple users in a way that requires large numbers > of them to conspire to reveal anything? The mixmaster stuff looks at this > specifically from the point of view of a store-and-forward node - is there > some suitable useful analogue on a single link? Can we somehow get > the same guarantees without storage inside the network? There were some research references posted in the threads below. > we're now going to have to change our attitudes toward traffic analysis. Yes, a lot of oppurtunity exists to create new working networks in this area that utilize fill traffic and/or delay. You may want to review the recent guardian-dev and tor-dev side threads below on this exact subject of link padding, latency and analysis. Relavent papers and talk have been posted. https://lists.mayfirst.org/pipermail/guardian-dev/2014-November/004040.html https://lists.mayfirst.org/pipermail/guardian-dev/2014-November/004069.html https://lists.torproject.org/pipermail/tor-dev/2014-November/007741.html https://lists.torproject.org/pipermail/tor-dev/2014-December/007934.html https://lists.torproject.org/pipermail/tor-dev/2015-January/008039.html http://www.metzdowd.com/pipermail/cryptography/2015-January/024479.html https://lists.torproject.org/pipermail/tor-dev/2015-January/008099.html [Copied a few places simply to include these ongoing links as reference for anyone interested.]

1 0

Re: [Cryptography] Barrett Brown allocution statement in court today
by John Young 27 Jan '15

27 Jan '15

At 10:25 PM 1/24/2015, Mahlon Theobald wrote: >Well what happened? 5 years 3 months sentence. Time served of 2.5 years to be credited. Possible parole in 1 year. http://cryptome.org/2015/01/brown-145-104.pdf Defiant statement after sentencing: "Mission now to report on FU prison system after reporting on FU cyber system."

2 2

What happened to Snowden 2.0?
by Archivists 26 Jan '15

26 Jan '15

After the reported arrest there has been absolutely zero media activity. NDA in effect?

2 2

Illinois School Password Controversy, What the Mainstream News Is Getting Wrong
by Polity News 24 Jan '15

24 Jan '15

There are a lot of news stories about the law which allows Illinois schools to demand students' passwords. Many of the stories incorrectly implicate a new anti-cyberbullying law. The law which allows schools to demand student passwords is a different law that was passed in 2013. http://piratetimes.net/exclusive-illinois-law-allows-schools-to-spy-on-stud…

1 0

Barrett Brown allocution statement in court today
by John Young 22 Jan '15

22 Jan '15

Barrett Brown allocution statement in court today just released http://cryptome.org/2015/01/BB_allocution.pdf http://cryptome.org/2015/01/BB_allocution.doc

1 0

RedPhone Removed from Google Play Store
by Badbiosvictim 22 Jan '15

22 Jan '15

>From: Cathal Garvey <cathalgarvey(a)cathalgarvey.me> As far as "where to get it", here's a copy: >https://ngrok.com:61924/owncloud/public.php?service=files&t=264659e23e8733b… > >Cert is self-signed: >SHA1: 63:9B:E2:FA:D8:A9:66:DE:46:B7:E4:C2:18:47:73:04:C0:12:FE:1F >SHA256: >CF:D2:82:0D:C8:65:CE:EB:2E:3F:36:EC:DA:9E:82:4E:2E:BD:51:19:6A:7E:11:65:50:40:57:9E:B8:79:8D:A2 I apologize for belatedly thanking you for TextSecure download link. Two days ago, I downloaded it despite the browser warning the certificate was not valid: "ngrok.com:61924 uses an invalid security certificate. The certificate is not trusted because it is self-signed. The certificate is only valid for isadora-amd64 (Error code: sec_error_unknown_issuer)" I installed TextSecure on my Droid 3 which does have a cellular account. TextSecure works if airplane mode is not on. Turning airplane mode on and wifi on, TextSecure does not work. Yet, description of TextSecure is that it works over wifi, data and/or SMS. I installed TextSecure on my Motorola droid 4. I use Droid 4 as a PDA. No cellular account. How can I get TextSecure to work over wifi? Thanks. Badbiosvictim, formerly bluelotus

5 8

Press release: Barrett Brown will finally be sentenced tomorrow
by John Young 21 Jan '15

21 Jan '15

http://tumblr.freebarrettbrown.org/post/108769779474/press-release-barrett-…

1 0

NSA: We're in YOUR BOTNET (Snowden)
by Georgi Guninski 21 Jan '15

21 Jan '15

journos: NSA: We're in YOUR BOTNET http://www.theregister.co.uk/2015/01/19/nsa_steals_malware/ > The NSA quietly commandeered a botnet targeting US Defence agencies to > attack other victims including Chinese and Vietnamese dissidents, > Snowden documents reveal. Allegedly snowden doc from TFA: http://www.spiegel.de/media/media-35689.pdf --- Questions: I read some botnets use crypto to CC. > 1. How the NSA broke the crypto? > 2. Which browser the dear NSA used used > in the alleged Snowden screenshots? (maybe firefux)

1 0

FBI To Hack (and Radar Raid) You If Connected To TOR Or a VPN
by grarpamp 20 Jan '15

20 Jan '15

http://yro.slashdot.org/story/15/01/20/1540241/fbi-seeks-to-legally-hack-yo… http://hardware.slashdot.org/story/15/01/20/1746241/police-nation-wide-use-…

1 0