February 2015 - cypherpunks - lists.cpunks.org

What the fark is "TFC"
by rysiek 05 Feb '15

05 Feb '15

Hi there, my brain is fried and I can't get any sane result in my attempts to decipher the "TFC" acronym. And "TCB", that shows up around it. PLZ2ENLIGHTEN KTHXBAI. -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

7 9

q: time & crypto
by brian carroll 05 Feb '15

05 Feb '15

observation, i have been intrigued by the idea of future mechanical watches built using nanoelectronics and micromechanical timing mechanisms that could be scaled to very tiny watch movements that perhaps could be hybrid analog (mechanical) computer-on-a-chip devices, so that a watch would have an electronics interface (LCD screen, other indicators) along with mechanical hands and timing, potentially. that said, today the Swiss technology seems thoroughly operating at the old scale (at least to outside views) in their watching, yet this scaling-down of watch movements seems a natural next step in the technological progression, perhaps a mechanical moore's law of some sort relating to physics tools enabling clockwork modeling at ever smaller scales, & also circuitry. so what if what today exists as a half-dollar (USD) medallion sized watch 'movement' tomorrow could be equivalent to the realm occupied by fabled smart dust, where the mechanism itself nearly disappears by comparison, say down to a centimeter if not a few millimeters for a mechanical movement that could rotate minutes and seconds hands on a watch display, that through magnification via lens could then appear at a normal watch scale for readability, etc. such that additional power would not be needed to gear a motor to drive larger scaled watch hands, or perhaps that would even be possible, given future energy options. the point here being the idea of mechanical timing operating at a lower scale, though also with increased timing precision. one way to consider it would be to have such a system synced with GPS for accuracy, and then adjust the mechanical watch hands to a synchronized time regimen. another way to consider it would be that something new is possible in this realm, including both mechanically, where a mechanical cantilever can be set to vibrate at a natural harmonic frequency (much like a quartz crystal used in timing circuits) if not mistaken, (these things used as frequency-combs for spectroscopy) [0], thus if consistent timing were achievable, perhaps this vibrational energy could be the basis for moving a clockwork mechanism, ratcheted gear by interconnected gear, to produce 'time' as it were. at the nanoelectronic side of things, [1] it would seem that at whatever the smallest scale of charged particle flow could be harnessed into circuits, that this then would build-up the electronics side of the watch, to interact with a mechanical circuit via additional info or data (communications, software, etc) though potentially also timing regulation, or smoothing out input or whatever may be possible. so perhaps the 'electronics' could be part of the timing circuit or exist beside it, functioning independently in parallel. or that the accuracy of the timing could be generated via electronics (say a more accurate crystal frequency or resolution for the timing circuit, that either adjusts or corrects it or drives it). so thinking about extremes and what-ifs, the idea here is to consider what may be possible if reaching such a capacity for a watchmaking and what might change as a result of this kind of technological advancement, especially in terms of time. needless to say, today mechanical hybrid watches and "smartwatches" have comparably low resolution timing accuracy when compared to the most accurate atomic clocks in use for standardized time keeping. so too, the idea of network 'timestamps' appears to propagate as a way of maintaining time on network-reachable watches, such that an Internet Time Server relays a time signal to a device which then sets its clock to that remote standard, perhaps not unlike issues of web serves and routers and how time is maintained and used to coordinate and route event data. and it is to question this existing scenario (in particular electronic and computer-based watches and devices) as this relates to issues like encryption and random-numbers and hashing functions, if the "time" of a device is managed remotely and in some major sense, inaccurate at a local level, or not unique to a particular space-time and instead managed by a centralized though inaccurate timekeeping system which is never actually synchronized. in that there are huge gaps and losses of resolution (which may be a matter of perspective, in that 'time' may be viewed a construct) and yet, what if this has fundamental relation to how crypto functions, could function, or cannot function as a result. this consideration led to my observation of how having an atomic clock as a wristwatch movement would likely be possible in the above MEMs and nanoelectronics scenario. and what would that mean, if super-resolution timekeeping were available at a local level of interaction, where gravity or nano-fractional differences in time may be leveraged for unique non-reproducible running number sequencing that could generate hashes or be used for randomization or encryption of unique point-to-point timing where the keys are correlated to the unique timing of independent atomic watches. In that, consider GPS satellites that send out a time signal to a device and in their miniscule differences in arrival, location can be determined. what if the same is true of wristwatches, where each watch is like that, with relativism or the gap, instead of being a dead-area or deficit, becomes a basis for knowledge and a barrier or wall to outside peering into the connection, if a secure channel between watches could be established, and thus not 'tapped' into without a certain running timing sequence to discombobulate the merged streams as harmonized. It is just wondered if such atomic wristwatches could feasibly change the game for point to point or one-to-many communications in a secure communications protocol. or perhaps such timing mechanisms per device, as applicable, in terms of security (phone, bankcard, etc). it just seems that timing and encryption could go hand-in-hand in that their dynamics are potentially highly complimentary though also, the lack of such timing coherence then could allow negative relativistic dynamics in their place, where exploits could be based on inaccurate homogenous timing regimens that remove timing as part of a security measure or defense. 0. http://en.wikipedia.org/wiki/Force_spectroscopy http://en.wikipedia.org/wiki/Atomic_force_microscopy 1. http://en.wikipedia.org/wiki/Nanoelectronics

1 0

Re: thick gaps
by coderman 05 Feb '15

05 Feb '15

On 2/3/15, dan(a)geer.org <dan(a)geer.org> wrote: > ... > John, you know this I'm sure, but for the record the highest > security places use sacrificial machines to receive e-mail and > the like, to print said transmissions to paper, and then those > (sacrificial) machines are sacrificed, which is to say they > are reloaded/rebooted. Per message. The printed forms then > cross an air gap and those are scanned before transmission to > a final destination on networks of a highly controlled sort. > I suspect, but do not know, that the sacrificial machines are > thoroughly instrumented in the countermeasure sense. this is defense to depths layered through hard experience lessons ;) > ... For the > entities of which I speak, the avoidance of silent failure is > taken seriously -- which brings us 'round to your (and my) > core belief: The sine qua non goal of security engineering is > "No Silent Failure." there was an interesting thread here last year on instrumenting runtimes to appear stock (vulnerable) but which fail in obvious ways when subversion is attempted. (after all, being able to observe an attack is the first step in defending against such a class...) "hack it first yourself, before your attacker does..."

4 3

One more way to track you: via mouse
by Georgi Guninski 05 Feb '15

05 Feb '15

http://www.theregister.co.uk/2015/02/03/behaviour_based_biometrics_darpa_us… DARPA: We KNOW WHO YOU ARE... by the WAY you MOVE your MOUSE For me one more reason to avoid js whenever possible...

2 2

Re: www.nsa-observer.net
by John Young 04 Feb '15

04 Feb '15

Swell initiatives by all the Snowden distributors. Except most fall prey to PDF manipulation of tagging, implanting, tracking, by willful intent or by technical ignorance. It is virtually impossible to sanitize PDFs due to Adobe's inherent design to meticulously spy on use of its products as well as deluded user attempts to hide who, when, what, how by users from creation to modification to wiping to stego to signing to forging to stinging. Image or accessible-text or other PDF formats, locked, redacted, watermarked, et al. Well behind and below the metadata Adobe allows users and abusers to see, lurks Adobe's advanced persistent meta-meta to aim for NSA/Tor-multi-level obscurantism by which accessible meta is used to hide inaccessible. Below dark is darker, ever darkening as new tools are developed to pry farther into the less visible and off-oscilloscopic spectrum. DoD issued today a short directive on the Center for Countermeasures and Counter-Countermeasures (including cyberweapons like PDFs). Presume NSA, aided by Adobe, has tracked, will track, Snowden's material in all its iterations from the time he snatched it to the latest distributor, consumer and secret archiver in Oahu, Maryland, Hong Kong, Berlin, Rio, NYC, DC, online and off. PDFs (and DOCs) are more treacherous than log files, backdoors, 0-days, APTs, what have you due to their popularity. HTM and TXT are much safer. Courier fonts are safer than other fonts, especially those promoted by Adobe and others who use fonts to spy (all rationalized as protection of IP -- ie, comparable to natsec). At 09:29 PM 1/30/2015, you wrote: >On 1/30/15, grarpamp <grarpamp(a)gmail.com> wrote: > > https://www.nsa-observer.net/ > > https://github.com/nsa-observer/ > > > > fyi, coderman et al. > > >thanks, checking them out. one thing i don't see mentioned is how the >OCR was performed. same as Reuters DocumentCloud service, or open >source tool, or ? > >next bigsun update will demonstrate this challenge better, as i am >using a handful of techniques for text extraction, character >recognition, and annotation, as well. in a sense, this is how the >sausage making gets started... > >(i will see if there is a convenient way i can feed back out again, >like to nsa-observer, since bigsun is intended to be operated entirely >within hidden services - no public services, especially not github or >document cloud) > > >best regards,

8 10

Re: www.nsa-observer.net is on clear web, don't use clear web.
by coderman 04 Feb '15

04 Feb '15

On 2/4/15, grarpamp <grarpamp(a)gmail.com> wrote: > ... > Moving 10G/day/node to or from clearnet is possible. Posting in the > darknet might find you parallel armies of sympathetic nodes willing > to help with task. don't use clear-web, not even once. not even one-way. it is DEF CON wireless; pre-pwned and malicious since many years. this includes: - don't use DNS - don't use HTTP over public IPv4 or IPv6 - don't use HTTPS over public IPv4 or IPv6 - don't use TCP over public IPv4 of IPv6 - do use UDP VPN at least past first last-mile ISP, most likely to be onery and RST'ery. - do use Tor bridges to avoid like UDP VPN above, with even better cover. - must use resume capable HTTP/1.1 range based capable client with secure digest verification! (multiple reports of cryptome.org streams of Cfour.7z getting RST inline, or otherwise frequent and frustrating failures before complete on some specific provider networks; bonus points for RST inject filtering, but not all OS support it.) for array of onion hosts (location hidden mirrors) - 5 x connections, to 5 of 9 onions, max two conns per host - 18 x connections to 9 onions, two conns per host [ e.g. aria2c --piece-length=1M --min-split-size=1M --split=18 --max-connection-per-server=3 --max-concurrent-downloads=18 ... aria2c does sha256 for free ] => 1.8MByte/sec to 3.5MByte/sec sustained over 50G archive in whole over various rounds of testing the fy2014 dist. add randomized filling, and you can stack parallel instances with multiple Tor clients for added capacity. ... anything more seems limited by client side, even in best of circumstances ... hey look, latter is simpler! two things to solve it. ;) best regards,

1 2

www.nsa-observer.net
by grarpamp 04 Feb '15

04 Feb '15

https://www.nsa-observer.net/ https://github.com/nsa-observer/ fyi, coderman et al.

6 9

get chipped at your local tattoo parlor
by brian carroll 04 Feb '15

04 Feb '15

Swedish office gets under employees' skin with RFID microchips; Forget your office door key? Can't remember the code for the photocopier? No need to worry if you happen to have a microchip implanted in your hand. // (2.3.2015), 2 min. video http://www.cnet.com/news/swedish-office-gets-under-employees-skin-with-rfid… in-article reference, (9.12.2014): The rise of the Swedish cyborgs By Jane Wakefield Technology reporter http://www.bbc.com/news/technology-30144072 '"The idea is to become a community that is why they get implants done together," [Mr Sjoblad] says.'

3 2

Re: www.nsa-observer.net
by John Young 04 Feb '15

04 Feb '15

Forensics of paper docs, by, say, FBI, examined paper constituents (ecology of trees, soil, tree-cutters, haulers, pulp mill, paper mill, coating mill, shipping containers, distributors, sellers, buyers, lenders), inks and their constituents, human and machine handling and using and transmitting detritus, attempts to camouflage, divert and hoax. Forensics of digital docs do all this and much more from creation to transceiving, forging, hoaxing, tracking, calling home, so forth. Coupled with the Internet and commodiously ID'd digital processing devices from manufacturers of programs and devices to the poor user blocked from seeing the galore of peeping toms, diverted by promises of privacy and comsec from, sad to say, promoted by orgs receiving funds from the.manufacturers to play that very user narcosis role, what can be done? If a bio-hazard suit promises protection from ecological hazards, what digital-hazard suit is available not contaminated with data siphoning of the wearer like products tagged for sale to end of world believers. Crypto is trap- and back-doored and corrupt, so it is warned by those offering an NSA career in the womb of Rosemary's Baby, privacy is delusionary, so it is preached by those inviting into OTR communities filled with Google-SM-informants and XXers, openness worse deception than official secrecy, so blind-justice visionaries reveal and beckon to get off the grid and underground deep and dark far away from the electromagnetic spectrum -- quanta-land, teleportation nirvana, across rivernet of Styx Stux. Remember when cpunk seers cautioned commodiously of sinister authorities and their vilainous contractors, and encouraged heroically to assassinate them anonymously? Remember the gradual hiring of those seers to remain in place while aiding and abetting the authorities as contractors to invent and promise comsec and privacy and anonymity, generously trap- and back-doored and trojaned and Call Homed tracing the arc of Snowden and gobs of others requiring forenics to counter and counter-counter forensics of fora like this, like Post-Snowden journalism enthralled with the adopting of secure drop boxes, leak sites, secure comms, PK swaps and signings, to camouflage long-standing lunches and briefings with officials to agree on what can be slipped into public perception of acceptable corruption to hide the unacceptable. Adobe brags PDFs can simulate paper docs exactly. Indeed, and much more forensically easy. At 02:16 AM 2/1/2015, you wrote: >On 1/31/15, Jason McVetta <jason.mcvetta(a)gmail.com> wrote: > > ... > > For Ubuntu users: > > > > sudo apt-get install libimage-exiftool-perl > > exiftool -a -G1 > > adobe-acrobat-xi-scan-paper-to-pdf-and-apply-ocr-tutorial-ue.pdf | less -S > > >per the python PDF tools, (with varied options), > or reduced option command line pdf2txt, or pdftotext, or > also: > >strings --bytes=$varlength ... with varying --encoding= ... , for as >John mentioned, all the metadatas and annotations typically unseen, > > >consider that the specific "configuration and input parsing" as a >"profile" for a given "input document" identified by "self certifying >identifier" for all of the above results in collaborative simplified >text paragraphs as a working base. > >so sha256(generated corpora) == sha256(sha256(doc) ^ sha256(config of >parse opts) ^ sha256(parse-product) ) > >if i use a convenient generated slang, ... > >this means at least a dozen "to text" engines with configuration, >(parse opts and parse products) per input document as a working state. > >and ten to twenty times the input pages as simplified output text >paragraphs (common base) collected from the useful parts of the best >transformations, used for subsequent text based natural language >processing. > >in a sense, this is devops come to document processing, where the >process itself is embodied in version controlled and complete archives >with self certifying integrity. this means boring, and also done >decades ago, more or less, in varying contexts. everything old is new >again ;P > >there are a whole field of customer parser and data sets and scrapers >all dedicated to variations on this theme, although sadly they don't >live public lives, for the most part. > > >best regards,

2 1

[OT] pre-Snowden movie involving the dear NSA: "Travelling Salesman"
by Georgi Guninski 04 Feb '15

04 Feb '15

Off-topic, FIY, 2012 movie involving NSA: "Travelling Salesman": http://www.imdb.com/title/tt1801123/ >From the above trivia: > The film was made for under $10,000. > Principal photography was accomplished in just 10 days. > The film won 3 Awards at the 2012 Silicon Valley Film Festival > including Best Feature Film, Best Lead Actor, and Best Editing.

2 1