October 2015 - cypherpunks - lists.cpunks.org

Re: [cryptome] Re: Why cryptome sold web logs to their paying customers?
by Shelley 11 Oct '15

11 Oct '15

On October 11, 2015 10:05:29 AM lucas power <power.lucas(a)gmail.com> wrote: > Also seems to be geared toward individuals monetizing blogs and such, which > to my thinking are just scraps from Big Data's table. I'm more interested > in understanding how something like me using gmail provides google with a > product to sell on to a corp or govt actor. How are valuations reached, how > are transactions structured? Not Google specifically, but here is one example of the highly invasive tracking of much, much more than web logs: https://www.propublica.org/article/verizons-zombie-cookie-gets-new-life "Verizon is giving a new mission to its controversial identifier that tracks users that tracks users of mobile devices. Verizon said in a little noticed announcement that it will soon begin sharing the profiles with AOL's ad network, which in turn monitors users across a large swath of the Internet. That means AOL's ad network will be able to match millions of Internet users to their real-world details gathered by Verizon, including "your gender, age range and interests." AOL's network is on 40 percent of websites, including on ProPublica. AOL will also be able to use data from Verizon's identifier to track the apps that mobile users open, what sites they visit, and for how long. Verizon purchased AOL earlier this year." More at the link, plus previous reports on the Verizon zombie cookie. -Shelley > On Sun, Oct 11, 2015 at 12:39 PM, Michael Best <themikebest(a)gmail.com> > wrote: > > > That site doesn't mention anything about web logs or IP addresses. =( > > > > On Sun, Oct 11, 2015 at 12:46 PM, John Young <jya(a)pipeline.com> wrote: > > > >> Maybe try Google with this search phrase: > >> > >> "How to monetize your website" for 400,000 hits. > >> > >> Omit the quotes for 5 million hits. > >> > >> Quick overview: > >> > >> 33 Ways To Monetize your Website > >> > >> http://websitesetup.org/33-ways-to-monetize-website/ > >> > >> The best way is to have your filthy rich relative buy your solution > >> to immortality. > >> > >> > >> > >> > >

1 0

Why not P2P yet, Iceland, and "legal shit" [and: Cryptome's Diapers Leaking :-]
by grarpamp 11 Oct '15

11 Oct '15

On Fri, Oct 9, 2015 at 2:57 AM, Cari Machet <carimachet(a)gmail.com> wrote: > Agreed but we do still have pirate bay TPB is a long since sold and sold out third party joke of what it once was. Moreover, Iceland, Sweden, whatever for TPB itself... it never protected users, because torrenting protocol the clearnet cannot protect users. For that, torrenters MUST rehome themselves exclusively to the darknets. I2P and Phantom and even Tor and so forth would work reasonably well for that against corporate MAFIAA attacks. But torrenters are stupid. And it is the role of cpunks to provide designs for such capable darknets. > and the drug pushing parasites Yes, on I2P and Tor, lol. But note, save maybe openbazaar P2P alikes, people are vain, so real P2P is not popular for them to do as it removes their fame and control via their would be central sevices. This is why real P2P hasn't taken off. Imagine a truly P2P Uber / Lyft... it doesn't exist because everyone who thinks it up wants a cut, at which point they are middlemen and not true [anon] P2P. > Icelandic servers have a base of security because of the structure of law Blah blah blah. How many and which treaties and partnerships, both front and backdoor and silent, are Iceland's Government and country party to? How strong is your adversary? Oh, now you have a problem once you strip off the Iceland publicity bullshit. If Iceland were something special you'd see them openly advertising forbidden hosting, not necessarily for themselves, but for foreigners. And if it were a free country internally, they'd advertise it for themselves. Silly laws, and mores. Ain't no bases there. > Legal shit has ramifications Real independant legal shit is seriously fucking hard to achieve. >> > > John's replies appear weird to me. >> > i find that understanding of John's replies is best achieved through a >> > structured series of mind altering substances ingested, inhaled, or Cryptome is a unique character worthy of respect and dialogue should you have the chance. An honor it would be in fact. While the technicals of cryptome.org and its parentage could perhaps make use of review. On the other hand, they are uniquely Cryptome. >> https://www.youtube.com/watch?v=8r-e2NDSTuE Lol.

3 4

[cryptome] Re: [cryptome]
by Michael Best 11 Oct '15

11 Oct '15

> > If that's true, JYA was being either unimaginably stupid, or > unimaginably weird. Still, there was no need to publish the logs just to > make a point. Redacted excerpts and hashes of the files would have been > enough, no? True and documented, and as I said in my last email - I DID REDACT THEM. John *still* denied they were real and accused me of faking them. On Fri, Oct 9, 2015 at 10:25 PM, <cypherpunks-request(a)cpunks.org> wrote: > Send cypherpunks mailing list submissions to > cypherpunks(a)cpunks.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://cpunks.org/mailman/listinfo/cypherpunks > or, via email, send a message with subject or body 'help' to > cypherpunks-request(a)cpunks.org > > You can reach the person managing the list at > cypherpunks-owner(a)cpunks.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of cypherpunks digest..." > > > Today's Topics: > > 1. Re: [cryptome] Cryptome has been leaking its user logs for > over a year (coderman) > 2. Re: [cryptome] Re: [cryptome] (Shelley) > 3. Re: [cryptome] Re: [cryptome] Yay: [cryptome] (coderman) > 4. Re: [cryptome] Cryptome has been leaking its user logs for > over a year (Mirimir) > 5. Re: [cryptome] Re: [cryptome] (Mirimir) > 6. [cryptome] Re: [cryptome] (Michael Best) > 7. Re: [cryptome] Re: [cryptome] (Shelley) > 8. Re: [cryptome] Re: [cryptome] (Mirimir) > 9. Re: [cryptome] Re: [cryptome] (Michael Best) > 10. Re: [cryptome] Re: [cryptome] (Mirimir) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 9 Oct 2015 16:28:42 -0700 > From: coderman <coderman(a)gmail.com> > To: Michael Best <themikebest(a)gmail.com> > Cc: cypherpunks(a)cpunks.org > Subject: Re: [cryptome] Cryptome has been leaking its user logs for > over a year > Message-ID: > < > CAJVRA1RoJBTn4OaOXYKcHtyS7LwxGThpqMr5Tud4KwHUEPvFdw(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > On 10/9/15, coderman <coderman(a)gmail.com> wrote: > > ... > > 0eb8551d977dde4f4193b3a16dedcd18f01e854e371e96623d33dd5b9519e413 > USB-1.rar > > > see attached. then xref with Tor exit db :P > > > best regards, >

6 12

Cryptome has been leaking its user logs for over a year
by Michael Best 11 Oct '15

11 Oct '15

16 44

Re: Why cryptome sold web logs to their paying customers?
by Michael Best 11 Oct '15

11 Oct '15

> > If Mike had uploaded them without full inspection, no problem. But, as I > understand the narrative, he knowingly uploaded them. I found them after uploading them, as I and the Daily Dot article said. He discovered the files when he uploaded the contents of the sticks to the > Internet Archive, Best told the Daily Dot in a Twitter message. “Scrolling > down through the list, I found about a hundred awstats log files listed in > a row,” he said, referring to Cryptome analytics data. On Sat, Oct 10, 2015 at 5:10 PM, Michael Best <themikebest(a)gmail.com> wrote: > To prove the GCHQ slide could've been fake, getting John to fix the leak > and stop calling me a liar. Same as I've said all along. How is that > implausible? > > On Sat, Oct 10, 2015 at 5:08 PM, Razer <Rayzer(a)riseup.net> wrote: > >> Got it. Totally altruistic motivation... >> >> >> On 10/10/2015 01:46 PM, Michael Best wrote: >> >> "Any money" is still more than I'll make off this. My only compensation >> is a headache from ridiculous accusations. >> >> Any chance you hold this same standard to Snowden and consider his press >> coverage as >> "an ongoing for-profit commercial motivation as redistributor" for the >> NSA docs? >> >> Sent from my iPhone >> >> On Oct 10, 2015, at 16:39, Razer <Rayzer(a)riseup.net> wrote: >> >> >> >> On 10/10/2015 01:35 PM, Michael Best wrote: >> >> Nope, laughing at someone who has no idea how little a media mention is >> worth in terms of money. >> >> Sent from my iPhone >> >> >> Yes I do and it depends on how much money you consider 'money'... For >> some, paying the rent is enough. Ask any artist or musician. >> >> RR >> >> >> >> On Oct 10, 2015, at 16:33, Razer < <Rayzer(a)riseup.net>Rayzer(a)riseup.net> >> wrote: >> >> Nervous laugh... >> >> On 10/10/2015 01:32 PM, Michael Best wrote: >> >> I say Best's name's appearance in DailyDot or >>> any other media constitutes an ongoing for-profit commercial motivation >>> as redistributor. >> >> >> HAHAHAHAHAHAHAHAHAHAHA. >> >> >> >> >> >

2 2

Why cryptome sold web logs to their paying customers?
by Georgi Guninski 10 Oct '15

10 Oct '15

The main question is: 1. Why cryptome sold web logs to their paying customers? Related questions: 2. Did they do it on purpose? 3. Did LEAs already had the logs via sniffing (at that time cryptome.org didn't have SSL AFAIK)? 4. Is it likely that the web server (and likely all internet connected machines of cryptome operators) was compromised? In other news JYA talks in nearly prose: http://www.dailydot.com/politics/cryptome-ip-leak-john-young-michael-best/

4 6

Why cryptome sold web logs to their paying customers?
by Michael Best 10 Oct '15

10 Oct '15

> > I say Best's name's appearance in DailyDot or > any other media constitutes an ongoing for-profit commercial motivation > as redistributor. HAHAHAHAHAHAHAHAHAHAHA.

4 10

Introduce randommess in keypress timings
by Michael Nelson 10 Oct '15

10 Oct '15

> It is surprising to know that Javascript is fast enough not to have an impact on system performance when monitoring the keystroke timing! Well it does have an impact, but not enough to ruin things. Of course it's not just js itself, but the browser, which swaps things in and out to do lots of things whenever it feels like it. As requested, here are some details. This is more technical than political, but may be of interest. This concerns keystroke dynamics on a phrase known by the auth server, not the general background stuff. So we are not really talking about the passive spying/monitoring here, but rather a potential product. So after I wrote my keystroke dynamics proof-of-concept I discovered that the statistical technique had been patented 25 years before (the patent had expired), which validated my approach... Mine had some extra twizzlers though. At Web browser-based initialization, the user sets a reference challenge word, say, "foobar". She must then enter some samples. For each sample, a vector of 12 time values is created, one for each keyDown and keyUp event. Some subtlety is needed in the programming, as keyUp on F might occur before keyDown on O on one sample, but after on the next. We would like to compare apples to apples. So we have a sample from the population of vectors as generated by the human. When authentication is checked, we must measure the distance of our trial vector, from the population. For this I used the Mahalanobis distance. Mahalanobis was a well-known Indian statistician who in the 1930s designed a test in order to help anthropologists decide whether skull fragments found in caves matched each other. This test measures the distance between each pair of entries in a vector. So F-down and F-up are compared, and also F-down and A-down are compared. Crucially, the distributions for each pair are normalized. The vectors can have any numerical data in the components. It can be used in botany with leaf area, weight, rainfall, etc. It works beautifully for typing patterns. Notice that we don't need to extract "dwell" times for keys, but all the same info is there in the more primitive array. I set a configurable threshold of 20 for the distance triggering secondary authentication. If I typed with proper focus, I would get distance of say around 4. If someone else typed they would get say 70 or 150. These are just typical examples. It worked fine. Here are some things I learned. 1. It's very hard to test objectively to make a business case. Why? Well if you go around the cubicles asking people to try it, you might get some people testing it on a laptop they don't normally use, or using some sort of random typing, on a string that they don't have an established pattern for. I realized that KD is not magic. Just as you would not expect to type a normal password "123456" by mashing the keys randomly, you have to consciously type in your official pattern for KD to work. It is well-known that the best words for KD are things like your own name, for which you have a well-established pattern. Now you see one of the reasons that this stuff has not taken off. You might assiduously set the samples (or have passive background capturing working) on your usual desktop. Then it will fail when you hunt-and-peck on your laptop. 2. I had a mobile developer add in touchscreen events for an iPhone test. This uses character and time, and also x and y co-ordinates for both press and release (there is some drag). The future will bring force. The beauty of Mahalanobis is that these just go right in and work immediately. Well, the stats does. Dealing with these big fat vectors is not trivial. I proved that it would work (actually it could not fail), but did not complete the mobile version. 3. I hacked the stats out in C. Interestingly, for me it was harder getting the online demo going with the Web page, jQuery, PHP, and MySQL, than implementing the actual Mahalanobis test. Maybe I should set the demo up for folks to try. 4. Twizzlers. One is that I allowed arbitrary shifty characters in my phrase. So in fact our user could simply tap her favorite rhythm on the Ctrl key, for her authentication factor. Worked fine. 5. Hope the above was of interest... mn

4 5

[cryptome] Re: [cryptome]
by Michael Best 10 Oct '15

10 Oct '15

In a version uploaded by coderman, which someone else posted as a torrent to the Pirate Bay. ATM, I'm not 100% clear whether he made it into a torrent or not. *Juan* juan.g71(a)gmail.com <juan.g71%40gmail.com?Subject=Re%3A%20%5Bcryptome%5D%20Re%3A%20%5Bcryptome%5D&In-Reply-To=%3C561971e5.e31f8c0a.f0dba.fffff987%40mx.google.com%3E> > > *Sat Oct 10 16:21:14 EDT 2015*On Sat, 10 Oct 2015 05:03:13 -0400 > Michael Best <themikebest(a)gmail.com> wrote: > >* But what's terribly wrong is that I reported > *>* it - *not* that John leaked it or lied it about it when he kept > *>* denying it or anything else. [/sarcasm] > * > Yes, you getting blamed is pretty ridiculous. The stuff was > also *published* in a *public* torrent by coderman??

1 0

The GCHQ Cryptome slide could be a mockup/disinfo
by Michael Best 10 Oct '15

10 Oct '15

Did you see the first one where I asked for help verifying the information in redacted form, specifically from John Young/Cryptome but in no way excluding the list? Or that after I posted the redacted version of the logs, and before John Young first denied they were real (before denying it again then admitting it again), he sent me an email saying ""Keep at it." Or my general request on Twitter, which wasn't limited to the list and occurred after the list had been alerted to the matter? https://twitter.com/NatSecGeek/status/651760609189568512 > Ok i read it all see no fucking ask of this community for help on the > matter

2 2