February 2015 - cypherpunks - lists.cpunks.org

Tox.im
by Cathal Garvey 03 Feb '15

03 Feb '15

Anyone looked this over? I only just discovered it, but it seems nice: * P2P * Encrypted * Voice/Video/Chat/Files * GPL'd https://github.com/irungentoo/toxcore It's written mostly in C(++) with a dash of assembly, which worries me security wise.. -- T: @onetruecathal, @IndieBBDNA P: +353876363185 W: http://indiebiotech.com

9 15

China backdoors
by MrBiTs 03 Feb '15

03 Feb '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Not sure if somebody posted it, but: http://spectrum.ieee.org/tech-talk/telecom/security/chinas-new-rules-ask-te… CheerS - -- echo 920680245503158263821824753325972325831728150312428342077412537729420364909318736253880971145983128276953696631956862757408858710644955909208239222408534030331747172248238293509539472164571738870818862971439246497991147436431430964603600458631758354381402352368220521740203494788796697543569807851284795072334480481413675418412856581412376640379241258356436205061541557366641602992820546646995466P | dc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJU0QjeAAoJEG7IGPwrPKWrB4MH/137/TFnO1J0TiSDsDNdtUcO 6S8qRZFxZBTEu66STW58JJD9pzQQVulAQRZvUD+pPOXYlw8JMvLVcfthYMCXcA7q 2WokokB5IsGj9/clsy+uFZcImwWGKjikTqB2Kt6X+CU+O3fqklmIO7SrPBE6Qeao IPd597JoQcuOMLLfVzRIty44vYmvNRsgXi8aiHCJjtw3eMTzGFILzRyteTsD5Q3r 78FJyZY50b74yIc/3N47ho19im9JCXOsTm4uzO6bujHxAM7wFwxjXcrQUuG2nJ3l 5rPDWN/M2SJphVnNMWU3V0+sY/In6qAmbc9rZXyvYj6RgQu8rfELVz9dVP6x6Ck= =/tiP -----END PGP SIGNATURE-----

1 0

Wickr vs stef's seven rules of thumb to detect snakeoil
by Seth 02 Feb '15

02 Feb '15

Searched the cpunk archives and was surprised to find no mention of wickr yet. I thought I'd run it through stef's seven rules of thumb to detect snakeoil so here goes: * not free software - Closed source (although audited by Veracode) * runs in a browser - no * runs on a smartphone - yes * the user doesn't generate, or exclusively own the private encryption keys - unsure (displays a message about 'securing your phone using military grade encryption' during first app launch/sign-in, believe local keys are generated during this step.) * there is no threat model - (claims to be 'last messaging app standing with no 0days to date', claims nation threat attacks were expected from day one, claims zero knowledge company infrastructure server configuration) * uses marketing-terminology like "cyber", "military-grade" - displays message 'securing your phone using military grade encryption' during app setup * neglects general sad state of host security - unsure Additional notes: - Offers desktop app for Win/OSX/Linux since 2014/12 - https://wickr.com/ appears to require javascript to view - Founder Nico Sell is long time Def-Con organizer, founded Def-Con for kids (now called Rootz Asylum) in 2010 - Wickr company infrastructure security audited by iSecPartners

4 6

PSA: Archive of cypherpunks@toad.com
by Mirimir 02 Feb '15

02 Feb '15

See <http://diswww.mit.edu/menelaus/cpunks/N> for 0<N<122556. It seems complete, covering 1993-04-27 through 2002-08-17. Search would be sweet. Google with "site:http://diswww.mit.edu/menelaus/cpunks/" works, but the indexing is iffy, with no substring hits.

1 0

Re: Spies LEVITATE infohounds, filesharers, and Glee watchers
by Ryan Carboni 02 Feb '15

02 Feb '15

> > NSA knows this. Bayes’ Theorem is elementary common knowledge. I wouldn't be so sure about that. The NSA must have developed some advanced math that we don't know about.

1 0

Re: www.nsa-observer.net
by John Young 01 Feb '15

01 Feb '15

A sample 1-page PDF by Adobe with over 500 metadata visible under "Properties" "Additional Metadata" "Advanced" http://cryptome.org/adobe-acrobat-xi-scan-paper-to-pdf-and-apply-ocr-tutori… Acrobat needed to see the Additional Metadata, Reader does not show. Curious 464 metadata under "xmpMM:History (bag container)". And many more hidden but perusable with text scrutiny of the PDF.

3 2

Confidant Mail, a new cryptographic mail system
by Mike Ingle 01 Feb '15

01 Feb '15

Confidant Mail is an open-source non-SMTP cryptographic email system optimized for large file attachments. It has its own client, server, and protocol. It uses GNU Privacy Guard (GPG) for content encryption and authentication, and TLS 1.2 with ephemeral keys for transport encryption. It supports unlimited attachments (>4GB) and forwarding with signature intact. Kademlia or DNS is used for key lookup. TOR and I2P anonymity is optional. Servers operate in replicated pairs. You can use your existing email address and GPG key. There is a Windows installer and automatic client configuration, so a Windows user can be online in under five minutes. Linux and MacOS users will have to install some prerequisites. The site has a test server pair online so you can try the system out. http://www.confidantmail.org Mike Ingle <mike(a)confidantmail.org> d2b89e6f95e72e26e0c917d02d1847dfecfcd0c2

1 0

Re: [Cryptography] How the CIA Made Google
by grarpamp 01 Feb '15

01 Feb '15

Previously: >>> They aren't handing data to NSA? Show us, how? The executive >>> doesn't take their agenda from 'Highlands Forum' ? Show us, that >>> you don't. The pipes between data centers are encrypted by keys >>> that aren't being leaked -- where's the evidence? Your CSO doesn't >>> have a phone in his shoe? Let’s see! >> Hmmm… proving negatives. Does that have something to do with >> quantum entanglement? No, it has to do with good old fashioned integrity, openness and honesty with the public. People can spot that, or lack thereof, from miles away. On Sat, Jan 31, 2015 at 3:51 PM, Tom Mitchell <mitch(a)niftyegg.com> wrote: > I might also note that there has not been (yet?) a Snowden event disclosing > bad behaviour initiated by Google. Consensus is that the very first Snodwn release, the PRISM slides and language therein, indicated some form of bilateral partnership with a large number of internet companies. Plus the AT&T tap room thing, and other known early parts of the storyline. It is unreasonable to assume that there is a strictly arms length, Judge signed, per transaction basis going on there. Where you have any relationship at all, loose buddy relationships develop to various degrees. > The international nature of Google puts them in a much harder > place than a TLA as serious blunders could roll up the business > and give them no place to hide. Google is an American company. Companies and govts don't generally wish or extend their secret jewels to offshore risk. Though occaisionally embassies and corps do get caught off guard or are bound by certain rules. > The reality I suspect is: Google protects its data with more > care than most federal agencies. Data protection regimen is separate from what you elect to do with that data. Good regimen makes it easier to control and manage your plans, ie: classification. This is not to say these things are true, but that there is less and/or unconvincing evidence that they are not, and at least resonable cause to consider that they are. On innocence... Why are the Boards, CEO's, Officers and staff of these companies not speaking up and saying they had and have no non judicially forced role in the spying of Snowdens revelations? On resistance... QWEST (Nacchio) tried to stand up, for a few minutes at least till resigning and later jailed. Replaced by, AT&T's (Notebaert). Lavabit (Levison) stood up, and closed. We're now seeing some companies doing "good things" in this space. But that doesn't address the original question of innocence or guilt. On guilt... Or maybe they're not speaking up because... like the US refuses to disclose any of the credible terror plots and bad guys they claim to be rolling up as mass spying result... maybe its because they have a bit of a problem with their story there. Who knows. But if you're clean and can back it, and are in the middle of a hot mess, keeping silent is a pretty dumb thing to do for your reputation. Needs more openness.

1 0