February 2015 - cypherpunks - lists.cpunks.org

REAL-ID Phone Access Coming Soon
by grarpamp 04 Mar '15

04 Mar '15

http://mobile.slashdot.org/story/15/02/24/0537219/pakistanis-must-provide-f… http://www.washingtonpost.com/world/asia_pacific/pakistanis-face-a-deadline… First it was your name, face, age, height, weight, address, SSN, phone and email, birth location, parents names, ages, etc... just for Internet Access, now it's your fingerprints for Phone Access. And by the way, also your DNA for Access to prove your innocence... http://www.nytimes.com/2013/06/04/us/supreme-court-says-police-can-take-dna… More things coming soon. What are you going to do? In other news... http://motherboard.vice.com/read/looking-up-symptoms-online-these-companies… Pissed off yet? Or still a sheeple?

5 6

The Reading Room hidden service
by Crypto 02 Mar '15

02 Mar '15

Hello Everyone! About once a week I go in search of TOR hidden services that may be of interest to me. I found one this morning that I think is really great! I purchased a Ebook reader a couple of weeks ago and have been looking for sites to download books on the cheap (free). I found The Reading Room this morning at http://do2j6w3zf2esv4ko.onion/_catalog/ I don't usually promote ANY website but I think whoever did this site deserves a pat on the back (or a donation). I downloaded several Ebooks with no problems. Pardon my posting this if you are offended but I'm SO happy to find a website that will help feed my Ebook addiction! -- Crypto https://lastpass.com/f?3921926

6 9

Re: Dollar Value of a Datamined "Free" Service User?
by Snehan Kekre 27 Feb '15

27 Feb '15

-------- Original Message -------- Subject: cypherpunks Digest, Vol 20, Issue 36 Time (GMT): Feb 26 2015 17:05:36 From: cypherpunks-request(a)cpunks.org To: cypherpunks(a)cpunks.org When replying, please edit your Subject line so it is more specific than "Re: Contents of cypherpunks digest..." Today's Topics: 1. Re: Dollar Value of a Datamined "Free" Service User? (Ryan Carboni) ---------------------------------------------------------------------- Message: 1 Date: Thu, 26 Feb 2015 04:18:51 -0800 From: Ryan Carboni To: cpunks Subject: Re: Dollar Value of a Datamined "Free" Service User? Message-ID: Content-Type: text/plain; charset="utf-8" The marginal cost of providing an additional account to the average user is pretty cheap. It is my understanding that the business models of most "cloud" companies is to provide a little free service to get users accustomed to their UIs, so that they would purchase a business license or equivalent. Dropbox does not make it's money through data mining or advertising. Correct me if I'm wrong.

1 0

Democratic judiciaries and internet protocols both embed racial profiling
by Nicolas Bourbaki 26 Feb '15

26 Feb '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A packet sent by an American or European should be given no greater privileges then a packet sent by someone from the middle east. Those holding dual citizenry (one being of their locale and the other a product of the internet' stateless generation) will not find this question odd. But to end racial profiling in the protocol (example [1]) questioning the rationale of stateful civil liberties is also required. Initially this argument will seem a moral one but there are practical reasons to consider. The increasingly globalised society is doing little to stem the threat of terrorism while at the same time increasing the call for more equal rights. Together this warrants questioning the justification and benefits of discriminatory rights. ## Justification A primary tool for the arbitration of discriminatory surveillance policies are secret courts. One justification for secret courts is the protection of sources and methods. Any investigation into an on-going threat requires some form of secrecy. Terrorism is one such threat. But this is not the only on-going threat that courts handle. We should consider whether the vanilla judicial systems cannot already handle this requirement. Existing courts must also handle on-going threats and have to do so while considering how the utilisation of secrecy for greater security, and perhaps more efficient investigation, balances against the risk to social contracts that define liberties and rights. With each justification for protection of methods when investigation terrorism threats we can ask if these were any different for investigations into the racketeering ring of, say, Al Capone. Clearly such investigations would be more efficient when perpetrators can be swept off into secret prisons on the signature of a secret judge. Existing courts already provide some room for discretionary secrecy. The prosecution can determine which evidence they disclose to the courts or wider public. In many nations there is also room for disclosure only to the judge while avoiding exposure to the wider public record. Finally parallel construction [2] is a questionable but often used method for protecting both sources and methods. Further, some exposure of methods provides an early feedback to individuals that they can get caught. Whereas when the means to find criminals are unknown and the criminals themselves are whisked off into secrecy this benefit is completely lost. Another justification for secret courts may be risk of spys within the court itself. With intent to obtain influence or at least advanced warning of investigative activity. But are our judiciaries less equipped to handle this threat than when it comes from state sponsored intelligence agencies? If anything the threat is diminished because the architecture and premise of terrorist institutions is much more decentralised than state intelligence. Terrorist institutions are one partly of memetics. The violent form of "grumpy cat" [3]. Within societies threatened by their ideologies the appeal reaches only a few in like mind. Unlike your 3-letter-agency-of-choice they lack the appeal to mount sufficient infiltration of any local judiciary. Further, the centralisation of all terrorist based investigation in the form of a handful of secret courts may be one of the few reasons left consider the threat of infiltration. Whereas if public courts were used this threat would be diffused as is the case with investigations into other national or international on-going threats. Therefore... **The justification for nationalist or racial rights may be efficiency alone. But at what cost?** ## Benefits and Cost For most the foundational documents of their country of origin are held in almost religious regard. As in religion these documents are subject to interpretation even though the indoctrinated claim they are timelessly impervious to it. They are social contracts. The cost benefit analysis weighed tacitly by judges when permitting secrecy is a consideration of the social contract a given case may effect. They collectively change that contract through their actions. This subjectivity is both a risk and a necessity. I once asked a rabbi why kosher laws do not allow Jews to eat a chicken and cheese sandwich? What the Bible forbids is boiling a "kid" in its mothers milk. I've rarely enjoyed boiled sandwiches and never heard of chicken milk. The Rabbi explained something to the effect "God gave the law to man for the rabbinate to change and interpret. The kosher laws are as much about how behaviour is perceived as it is about what God commands. Someone on the other side of the room may just see you eating meat and cheese together. This would encourage the wrong understanding of that law." Interpretation is a slippery slope. Yet, at least Judaic law acknowledges the social contract and that perception is important. Where as our governments, through secrecy, negate even the possibility or interpretation or consideration of perception. With our collective identity and social threats becoming ever globalised the result of enforcing an absolute interpretation is ignorance of sovereignty (see drone warfare) and increasing rejection of equal rights. With these acts the state in turning from a conduit that fosters individuality into one that reinforces homogeneity. With the risk that the meme will increasingly hold more weight than the rationale. I have been lucky enough to have lived in countries that know how much they suck at war so the Americanism "War on ..." always seems strange. Yet the "War on Drugs" or "War on Poverty" are efforts that this society perceives as a collective will because of shared equality. If we want the War on Terror to be perceived as a collective issue globally we will need to start with endowing the "other" with equality. Those that frame this debate in the context "Liberty versus Security"... **It is easy to confuse Privilege for Liberty.** ## Racial Profiling I'm certain there is reason to question these arguments yet I believe they give some reason for debate. (i) The public judiciary already has many of the tools required to handle current threats. (ii) Centralization into secret courts creates its own vulnerability and its own justification. (iii) Necessity for efficiency ignores the cost to social contracts in a globalised context. (iv) Secrecy makes impossible consideration of equal rights in a global context and removes the possibility to account for perception. (v) Secrecy removes a feedback that informs civil behaviour in societies. Along with the judiciary there is a parallel of discriminatory profiling within the field of engineering. Our protocols have been built for such profiling. I do not feel alone in questioning whether the current stewards of the internet shouldn't be replaced with those of government agency from which the internet was born. Balkanisation is increasingly being seen as a solution, not the threat. Yet we protest while boringly waiting for some form of acknowledgement of responsibility from the IETF to change the protocols. In our digital world the concern for how protocols support and make discrimination possible will seem less distant. Rather than congratulate ourselves for dejecting a member of the NSA from the Crypto Forum Research Group we should be more disturbed by the inability of the IETF to acknowledge any responsibility for the ethics in the protocols. - -- 1. "GeoIP is a threat to democracy" https://cpunks.org/pipermail/cypherpunks/2014-July/005037.html 2. https://en.wikipedia.org/wiki/Parallel_construction 3. https://startpage.com/do/search?cat=pics&query=grumpy+cat -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJU75vTAAoJEHi6xtksL8/uwC8P/0PkrdsbZzo4qcosdVeNC9Ei sroo0ohyICt34uxeEpTisdWxv0GKPVFGqSDBAYfvRwc1+Ko6YnEeDlqb3+TNktTE GIzZAwslb3LJx09IERh6xMbdMkkXl2iw9qkRmvDK56Txk5B9HNY3bR/xBFN9oi4x mzOx8uN39xLxnUAff8071wkAzepZXVT6TC1gIq/95Vqrt8cP8C5oP+q04jHnxSev X+B18+3ytQvlbbRMVu3BPfDd8/PBdga6jdvnDIaVclM6Olagw1hwHv5IgXIA6edP 5UGc5v+uadYknVabDN/bQXqo9rYLAbwgAJgbaGPemdFLOl6mnsIaGiQCrKa/C2wm m1GX6D/kna3bUVHm6pZ+W0A7c9ERMLgDjItrCApUdXGgU2c770shxkQZVyWwUY5g G4fhpk9PgEeouZVRtHVjSw2cAhhsTNVaWWotJ3UPL9n6Soxtu68wNV/hQUhsEAHO NPCTV6LZVjaN11jZi+2JhLVe2w+4d6GNQjSkm1C1cs7XHqZ2P0Z4R6oigU8n6PIx aEZGvvhRct3PUodshOqQUwV1Ml4nUTEn6diJvDkHxW5YN2XHfJIv3zLo4tMQ6fF8 DV+uUSBl+arNKe/ehmxN+G550JVoQnOLUOcihNeCqFqWBCtlsWnP4vgRFFfl79iH EyI9rZP34J/yJMOJK/h/ =rYE3 -----END PGP SIGNATURE-----

1 0

Re: Dollar Value of a Datamined "Free" Service User?
by Ryan Carboni 26 Feb '15

26 Feb '15

The marginal cost of providing an additional account to the average user is pretty cheap. It is my understanding that the business models of most "cloud" companies is to provide a little free service to get users accustomed to their UIs, so that they would purchase a business license or equivalent. Dropbox does not make it's money through data mining or advertising. Correct me if I'm wrong.

2 1

Belarus just banned Tor and other censorship circumvention tools
by Anton Nesterov 25 Feb '15

25 Feb '15

"11. If government inspection find Internet resources or anonymity tools (proxy servers, anonymous networks like Tor, and so on), which can be used to get access for Internet resources with limited access, they should add identifier of that Internet resources or anonymity tools to the list of limited access." http://pravo.by/main.aspx?guid=12551&p0=T21503059&p1=1&p5=0 text (Russian) -- https://nesterov.pw GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 https://keybase.io/komachi/key.asc

1 0

Re: [Cryptography] trojans in the firmware
by grarpamp 25 Feb '15

25 Feb '15

On Tue, Feb 24, 2015 at 8:53 PM, Jerry Leichter <leichter(a)lrw.com> wrote: > On Feb 24, 2015, at 2:24 AM, Ryan Carboni <ryacko(a)gmail.com> wrote: >> Fighting against a nation state using equipment you cannot design >> yourself or anyone you know could design... don't. > But in fact you can't design or manufacture *everything*. Do you > need control of your chips all the way back to mining the sand? Aren't there really only a couple ways to solve this? A) Somewhat similar to the IAEA, everyone pick their own trusted and knowledgeable people, then assemble everyone's people together with orders: 1) Respect whatever soverign secrets you see [profits, design advantages, etc] 2) Just tell us what we want to know [do the chips that come out of the fab equal the designs that went into it, and are those designs free of trust issues] This is complicated by needing to insert yourself into those legacy areas, as well as verify essentially that of B below. B) Contact your favorite billionaires and pitch the case for a truly open fab. And yes, that could include starting from ... > Do you need control of your chips all the way back to mining the > sand? [...] build a computer out of [...] simple logic gates > JK-flipflops Since that tech is already discovered, it would just be an open rapid physical rebuild of history from transistor to today. Maybe that would take 10 years of dedicated work to create a trusted fab that matches todays tech and can replicate itself. And if you think about it, it could be a profitable venture because if you did it right, you'd be able to openly and certifiably create trusted Orange Book / CC style hardware... something governments, large entities and even users have always wanted but haven't been able to obtain in affordable quantites and purposes. This may be easier because there's no legacy to remediate. And there's no reason you couldn't manufacture private chips too, the only restriction being that terms that would compromise the fab are not allowed. https://en.wikipedia.org/wiki/International_Atomic_Energy_Agency https://en.wikipedia.org/wiki/Trusted_Computer_System_Evaluation_Criteria https://en.wikipedia.org/wiki/Trusted_computing_base http://cm.bell-labs.com/who/ken/trust.html https://en.wikipedia.org/wiki/Backdoor_(computing) https://en.wikipedia.org/wiki/Open-source_hardware

1 0

Re: [Cryptography] trojans in the firmware
by grarpamp 25 Feb '15

25 Feb '15

On Tue, Feb 24, 2015 at 10:48 AM, Kay Rydyger <kay.rydyger(a)yahoo.co.uk> wrote: > > The question was [... firmware spies] > The answer is [...] to encrypt data. No, reading bits from platters or the bus is a partial analysis of the whole firmware question. It's already been suggested in links how firmware can hook the users unencrypted boot binaries through to the users kernel. For that matter, a modified boot chain could be stored in the service area. A user would have to use SecureBoot, TPM, IOMMU, TXT, GELI and perhaps other things, all of them properly, having no holes, together, right now, at least three of which they are unlikely to have ubiquitous access to until a couple hardware generations or personal refresh cycles into the future. An ideal full solution for which is yet to come. Not to mention needing to install it all cleanly (from BTW, an install image which has no reproducible build and no cryptographic chain back to the insecure unsigned source repo anyways). But yeah, let's talk circular instead of about possible actually coding defense in depth such as maybe blocking the most common easiest path a malicious opcode will likely take to irrepairably infect clean hardware in the first place... through the drivers ... > There is no threat to freebsd ... because at least Unix is said to be immune to threat... http://www.freebsd.org/security/advisories.html http://www.openbsd.org/errata56.html http://web.nvd.nist.gov/view/vuln/search-results?query=linux+kernel&search_… > Weaknesses of this measure are remote and highly costly for the > attacker. If one is such a person of interest It's already been talked how this tech will be integrated into everyday run of the mill malware. And how users will be subject to infected drives via second purchase, inheritance (both from other people and from other operating systems), use of hosting services, trading, booting CD's, etc. Persistant malware in users boot chains is nasty, users don't have to be of interest or be targeted, the code doesn't care, grandma's surfbox could get it. Please learn to email... trim the original to the minimum needed for context, reply inline below, and stop copying 400 line digests with meaningless digest subject lines out to everyone on the list. On whenever, someone else wrote: > Since the chip holding the firmware has > leads through which it is loaded with the firmware, > is it not possible to disable or burn (with laser) or cut > just the leads through which the chip is WRITTEN to > (in order to re-program it)? Depends on the design. The hacking links or docs from the drive/chip vendors would be more helpful there.

1 0

Fwd: [Cryptography] Why the Internet could be the next “failed state”
by grarpamp 25 Feb '15

25 Feb '15

---------- Forwarded message ---------- From: Paul Ferguson <fergdawgster(a)mykolab.com> Date: Tue, Feb 24, 2015 at 9:58 PM Subject: [Cryptography] Why the Internet could be the next “failed state” To: Cryptography Mailing List <cryptography(a)metzdowd.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I encourage you to read this very thought-provoking article on the "state of the Internet" insofar as security, inclusiveness, and usability is concerned. Well worth the read. And also very interesting opinion (apropos?) as to where we are as a society right now in the evolution of the Internet, a crossroads where our daily personal & professional lives meet: "If you think the Internet can go on being just like it is, here's some bad news." "...the Internet might soon look less like 1970s New York and more like 1990s Mogadishu: warring factions destroying the most fundamental of services, 'security zones' reducing or eliminating free movement, and security costs making it prohibitive for anyone but the most well-funded operations to do business without becoming a 'soft target' for political or economic gain." http://arstechnica.com/information-technology/2015/02/fear-in-the-digital-c… - - ferg - -- Paul Ferguson VP Threat Intelligence, IID PGP Public Key ID: 0x54DC85B2 Key fingerprint: 19EC 2945 FEE8 D6C8 58A1 CE53 2896 AC75 54DC 85B2 "I am tormented with an everlasting itch for things remote. I love to sail forbidden seas." - Herman Melville -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlTtOkQACgkQKJasdVTchbIdpwEAkmxxKO0Buzun3yW6k7SRDXPr 2/ENJW5l07th7f/adwAA/j7wodKw29nHFTW4EUARSbyZBiNfAGNTAfstFrT5oV3h =75sd -----END PGP SIGNATURE----- _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

I Spy With My Little Eye
by grarpamp 25 Feb '15

25 Feb '15

https://www.youtube.com/watch?v=U0HDxoTmQe4 https://www.youtube.com/watch?v=_o2djiZOxyA

2 2