May 2015 - cypherpunks - lists.cpunks.org

Fwd: [messaging] Benchmarking client side cryptography
by grarpamp 31 May '15

31 May '15

---------- Forwarded message ---------- https://diafygi.github.io/webcrypto-examples/ > On Sat, May 23, 2015 at 2:48 PM, franta polach wrote: > > Some might be interested in benchmarks I did for javascript, java, > > objective-C on different platforms. > > Here is a brief writeup https://frrp.github.io/ and here are the data > > https://docs.google.com/spreadsheets/d/1RVK9ixIf2bUeUTxVxqMTpE4iC4gsr6ssfAV… ----------

1 0

Re: Threat model: Parents
by Barton Gellman 31 May '15

31 May '15

Honestly, people, some of these suggestions are like a parody of geek advice to civilians ;-) The kid will soon hit upon the same practical solution that his or her peers all use: the smartphone (preferably with a VPN like Freedome), plus browsing at a friend's house. Wiping, Linuxing and LUKSing a family PC will escalate the real-life threat, and the kid's defenses will fall quickly to the parental equivalent of that XKCD password cartoon. If the kid has a need for full size keyboard and screen, and has a few more technical chops than most, there are some alternatives: * Boot up Tails in Windows camouflage mode. Choose More Options at boot. Shoulder surfing will probably bust him/her anyway, sooner or later. * Make one of those WinPE Windows USB drives, if real Windows is required. Last time I looked this wasn't that easy. * Get a small, fast external drive and install the OS of choice. If the host is a Mac, use Carbon Copy Cloner (or dd) to copy an existing machine to the external drive, or do a fresh installation there. For Linux, choose your flavor. * Get a Raspberry Pi and hook it to the keyboard and screen, at times when you don't expect interruption. * A virtual machine may be possible on the monitored host, if the required drivers are already present. Probably not. See http://www.vbox.me/. If anyone knows a VM that works without admin rights, speak up. Bart Barton Gellman @bartongellman bartongellman.con On May 31, 2015, at 12:00 PM, cypherpunks-request(a)cpunks.org wrote: >>> On 31 May 2015 03:24:45 GMT+01:00, Gadit Bielman <thetransintransgenic(a)gmail.com> wrote: >>> Hi. >>> >>> I'm trying to help (probably badly, but..) a friend deal with parents >>> that >>> they expect are spying on them.

3 3

Karl Rove's confusion about capacity of NSA's Utah data center.
by jim bell 31 May '15

31 May '15

On Fox News 5/22/2015, Karl Rove displayed his ignorance about the data capacity of the NSA's data center, which he said was intended to store telephone metadata, not the actual audio data from phone calls or (perhaps) the content of emails. http://www.foxnews.com/transcript/2015/05/22/rove-critics-dont-understand-n… Rove said: "What it does is, it keeps a record of a phone number that is being called from to a phone number being called to and the date and time. So, unless the Tsarnaev brothers talked to somebody abroad to talked to the phone number of somebody who is identified as a possible terror suspect, they wouldn't -- they wouldn't have been caught by this program whatsoever.And, again, I repeat, why is it that the opponents of Section 215 feel compelled to exaggerate by saying, oh, they're listening to our conversations?""Senator Paul on the floor of the Senate said, oh, they're listening in to thousands -- I mean, to millions of conversations. I mean, if we have to build a gigantic center in Utah to keep track of these phone numbers, how big a center would we need to have in order to keep the digital tapes of everybody who is having a telephone conversation? It simply does not happen." [end of quote by Rove]Rove is clearly assuming that the size of the data center in Utah is necessary to hold the metadata alone. The article http://en.wikipedia.org/wiki/Utah_Data_Center states:"An article by Forbes estimates the storage capacity as between 3 and 12 exabytes in the near term, based on analysis of unclassified blueprints, but mentions Moore's Law, meaning that advances in technology could be expected to increase the capacity by orders of magnitude in the coming years." [3 and 12 exabytes is 3,000-12,000 petabytes, or 3 million-12 million terabytes.]https://www.techdirt.com/articles/20130621/03390823552/how-much-… There are about 900 billion telephone calls made in America per year. If it took 100 bytes to store the needed metadata per call, that would be 90 terabytes of information needed. The capacity of the center is, therefore, 33,000x to 131,000x larger than would be needed to store that data for the US alone for one year. The data stored in a single call could probably be compressed to 8,000 bits per second, so every second would require 80 times as much data to be stored as just the metadata alone. If the average phone call is 120 seconds, that would require about 9600x the data size, well within even the lower estimate above of 33,000x.So, the answer to Rove's question, "I mean, if we have to build a gigantic center in Utah to keep track of these phone numbers, how big a center would we need to have in order to keep the digital tapes of everybody who is having a telephone conversation? It simply does not happen." is simple: "No, Karl, The center is just about the right size to store not only the metadata, but in fact the audio to all phone calls made in America in one year. And in fact, a good deal larger, probably enough to store the audio of every phone call made in Europe as well, and most of Asia." Would Rove be surprised to hear THAT?!? Well, he'd probably claim to be surprised. I suspect he'd defend himself by raising a newly-found fact that at the time that data center in Utah was proposed, hard drives were probably 1000x smaller in capacity than today. In 2000, as I recall, a typical large hard drive was 2 gigabytes. Today, the largest I've heard of is 8 terabytes, 4,000x larger. http://techcrunch.com/2014/08/26/seagate-ships-an-8-terabyte-hard-drive-per… Jim Bell

9 44

Re: Threat Model: Parents
by John Young 31 May '15

31 May '15

Now you're talking vulture capital capabilities, if you can answer these questions millions of dollars and users await your products, thanks to Edward Snowden. Consider asking the coach, pastor, BFF, mentor, online advisor (no offense Gadit but you fit the predator profile) to take you home to use his/hers/trans computer which will have the latest cloaking tools, including those which block, divert, trash, evade, deep six, anon-legionize, the most devilish meddlers promoting villainous affairs to advance their villainous careers, aka kiddie porn watchdogs tutored by natsec spooks. Prepare to be stripped naked in the sauna, like Jake Appelbaum, like beloved overseers of all stripes, phones into the lead-lined chest, to guard against you being a babe to entrap the beloved wizened overseer (sorry Bart, no offense but you fit Jake's profile). Cpunk archivist popped up when this topic tripped its sensor to say hear ye, this is the 4,096th time the helpless kid bait has been set here. Undercover careers begin with tapping into online fora to test homebrewed mousetraps, the most common being a kid with troubled parents, next most Tempest signals being emanated by latest, most compulsive child bewitched by the awesome freedom of personal devices, next ex-spies with unbelievable stuff to shatter the empire of those who know shit shoveling into into those whose diet is limited to shinola. If you advise the kid to stay away from personal devices connected to the rest of the world, that will get you a visit from connection authorities accusing you of treason. Show your credentials by yelling accessible encryption. At 01:17 PM 5/31/2015, you wrote: >On Sat, May 30, 2015 at 10:24 PM, Gadit Bielman ><<mailto:thetransintransgenic@gmail.com>thetransintransgenic(a)gmail.com> wrote: >Hi. > >I'm trying to help (probably badly, but..) a >friend deal with parents that they expect are spying on them. >I know that in general, it's impossible to >secure a computer that you can't trust and don't >necessarily have administrator privileges to. > >But their parents are not exactly the NSA -- any >spying that's happening is almost definitely >some sort of product, plus basic things like >maybe looking through their history. (I don't >know much about they're situation -- maybe they >know more, so >well-if-you-know-they-do-this-then-you-could-do-this >type advice would still be helpful.) > >Would antivirus be able to detect >spy-on-your-kids products? Would they be able to >scan their computer with like Immunet or >something, even if they didn't have administrator privileges? > >Tor would probably help -- unless the monitoring >was looking at the RAM or something for website >names, which would be way overkill on a >commercial product, no? Or (more likely) if it >was taking screenshots at regular intervals, >which would also break running a VM or >something. (Is there any way to detect taking screenshots?) > >I know probably the best thing would be running >TAILS as a LiveCD -- the problem with that is >that it's REALLY obvious over-the-shoulder. > > >Um, thoughts about any of those? >Any other things about parents as a threat model in general? > >I know this is pretty far from what is usually >discussed on here, but I'm really interested in >what you think/it would potentially help a lot of people. > > >Okay so I've gotten a few responses to this, so just to clear a few things up: > >-- I don't know this person IRL -- I'm giving >them advice over online, so can't look at their >computer, give them anything, etc. >-- I don't know what spyware program is being >used, that is one of the "can someone/how can >someone do this" questions I am asking > >And one major thing, which forgive me for >getting kind of annoyed but literally everyone >has either directly suggested this or ignored the issue: >Parents monitoring/spying on their kids is VERY >OFTEN part of an abusive or nearly abusive relationship. >If "Just talk to them" was an option, I can >GUARANTEE they would already have taken it to the best of their ability. >"Just talk to them and install linux -winkyface-" is NOT a workable answer. >Parents have a HUGE amount of coercive power and are NOT shy about using it.Â > >And for that matter, "wipe it and install linux" >is really unlikely to work either. Rubberhose >Cryptoanalysis is in full play here -- a PRIMARY >goal is "hide it from your parents as much as >possible", because confiscating your computer >for arbitrary periods of time is ALWAYS AN >OPTION. If they find something password >protected, they are totally capable of just >saying "haha, stop playing around, you're >grounded and we're confiscating the computer >until you stop being unreasonable and give us the password". >Also, an arbitrary kid at home isn't gonna be >able to just install Linux. Linux requires you >to /know what you're doing on Linux/, and these >kids have their hands full dealing will >everything else their parents overbear already. > > >Thought outline:: >-- Find out or narrow down the ways their parent >might be monitoring them software-wise >---- Is there Spyware installed on the computer itself? >------ detecting: is there a list they can look >through "My Programs" to see if any matches? >Would doing a full scan with a free antivirus >detect them as spyware, or would there be "this >is a commercial product for parents" exception to the lists? >------ assessing: if they can find which spyware >is being use they can just look up the >capabilities. But if they can't? What >capabilities do most child-spyware products >have? Is it possible to narrow down by price-range for what they can afford? >---- Is there spyware running on the network? Traffic monitoring and stuff? >------ That's harder to find, but using the Tor >Browser should completely negate that >---- bypassing softwarewise-things: >------ depends entirely on the capabilities. At >the most simple, they can be bypassed by just >not using the normal browser. More complicated >and I can totally imagine a Superfish-like-thing >monitoring all internet traffic -- even HTTPS -- >for keywords. Is constant screencapture a common >feature that we need to worry about? >-- Non-software-based things: >---- Manually looking through browser history: >again, Tor Browser doesn't keep history >---- Demanding access to email account: use one >for school/parent-friendly stuff, and create a secret one. >---- What else is there? > > >e.g.: Here's the parental controls/monitoring >built into Windows 8:Â ><http://windows.microsoft.com/en-us/windows-8/monitor-child-pc-activity>http://windows.microsoft.com/en-us/windows-8/monitor-child-pc-activity >(For the specific case that I'm asking about, I >don't think they have Windows 8, but other >versions of Windows probably have similar capabilities) >And here's a top-ten comparison for child-spying >software:Â ><http://parental-software-review.toptenreviews.com/>http://parental-software-review.toptenreviews.com/ > >Would that be able to track the websites visited by the Tor Browser? > >So specific questions to start: >What if any free antivirus, running with user >permissions, would detect commercial spy-on-your-child-ware? > >If they're running a LiveCD/LiveUSB (you're >right, probably USB -- faster, more common, >easier to excuse for, and persistence), how well >can it be disguised as the original operating >system? How much of that work can be done by >people who aren't the child, so that the child >can have as much of a plug-and-play experience as possible? > >Besides actively taking screenshots, are there >any other potential issues for the Tor Browser? >e.g. is looking at RAM (unlikely for a >commercial parent-spy software?), scanning >throughout the entire filesystem looking for >bookmarks (Also seems over the top if the Tor >Browser is kept in a not-completely-obvious location?), other capabilities? > > > >Again, I don't know them at all IRL, so I can't >look at their machine, help them install/inspect things, etc. > >And in general, I think it would be really >valuable if we can create >will-work-for-70+%-of-people tactics that a >kid/teen online can take to get around their >parents, so it would be great if we mapped out >more a general threat model for parents, and possible responses to that. > >Thanks.

1 0

'Stuxnet' attempt against North Korea.
by jim bell 30 May '15

30 May '15

>From Reuters World | Fri May 29, 2015 2:59pm EDTEclusive: U.S. tried Stuxnet-style campaign against North Korea but failed - sourcesSAN FRANCISCO | BY JOSEPH MENNThe United States tried to deploy a version of the Stuxnet computer virus to attack North Korea's nuclear weapons program five years ago but ultimately failed, according to people familiar with the covert campaign.The operation began in tandem with the now-famous Stuxnet attack that sabotaged Iran's nuclear program in 2009 and 2010 by destroying a thousand or more centrifuges that were enriching uranium. Reuters and others have reported that the Iran attack was a joint effort by U.S. and Israeli forces.According to one U.S. intelligence source, Stuxnet's developers produced a related virus that would be activated when it encountered Korean-language settings on an infected machine.But U.S. agents could not access the core machines that ran Pyongyang's nuclear weapons program, said another source, a former high-ranking intelligence official who was briefed on the program.The official said the National Security Agency-led campaign was stymied by North Korea's utter secrecy, as well as the extreme isolation of its communications systems. A third source, also previously with U.S. intelligence, said he had heard about the failed cyber attack but did not know details.North Korea has some of the most isolated communications networks in the world. Just owning a computer requires police permission, and the open Internet is unknown except to a tiny elite. The country has one main conduit for Internet connections to the outside world, through China.In contrast, Iranians surfed the Net broadly and had interactions with companies from around the globe.A spokeswoman for the NSA declined to comment for this story. The spy agency has previously declined to comment on the Stuxnet attack against Iran.The United States has launched many cyber espionage campaigns, but North Korea is only the second country, after Iran, that the NSA is now known to have targeted with software designed to destroy equipment.Washington has long expressed concerns about Pyongyang's nuclear program, which it says breaches international agreements. North Korea has been hit with sanctions because of its nuclear and missile tests, moves that Pyongyang sees as an attack on its sovereign right to defend itself.U.S. Secretary of State John Kerry said last week that Washington and Beijing were discussing imposing further sanctions on North Korea, which he said was "not even close" to taking steps to end its nuclear program.SIEMENS SOFTWAREExperts in nuclear programs said there are similarities between North Korea and Iran's operations, and the two countries continue to collaborate on military technology.Both countries use a system with P-2 centrifuges, obtained by Pakistani nuclear scientist A.Q. Khan, who is regarded as the father of Islamabad's nuclear bomb, they said.Like Iran, North Korea probably directs its centrifuges with control software developed by Siemens AG that runs on Microsoft Corp's Windows operating system, the experts said. Stuxnet took advantage of vulnerabilities in both the Siemens and Microsoft programs.Because of the overlap between North Korea and Iran's nuclear programs, the NSA would not have had to tinker much with Stuxnet to make it capable of destroying centrifuges in North Korea, if it could be deployed there.Despite modest differences between the programs, "Stuxnet can deal with both of them. But you still need to get it in," said Olli Heinonen, senior fellow at Harvard University's Belfer Center for Science and International Affairs and former deputy director general of the International Atomic Energy Agency.NSA Director Keith Alexander said North Korea's strict limitations on Internet access and human travel make it one of a few nations "who can race out and do damage with relative impunity" since reprisals in cyberspace are so challenging.When asked about Stuxnet, Alexander said he could not comment on any offensive actions taken during his time at the spy agency.David Albright, founder of the Institute for Science and International Security and an authority on North Korea's nuclear program, said U.S. cyber agents probably tried to get toNorth Korea by compromising technology suppliers from Iran, Pakistan or China."There was likely an attempt" to sabotage the North Korean program with software, said Albright, who has frequently written and testified on the country's nuclear ambitions.OLYMPIC GAMESThe Stuxnet campaign against Iran, code-named Olympic Games, was discovered in 2010. It remains unclear how the virus was introduced to the Iranian nuclear facility in Natanz, which was not connected to the Internet.According to cybersecurity experts, Stuxnet was found inside industrial companies in Iranthat were tied to the nuclear effort. As for how Stuxnet got there, a leading theory is that it was deposited by a sophisticated espionage program developed by a team closely allied to Stuxnet's authors, dubbed the Equation Group by researchers at Kaspersky Lab.The U.S. effort got that far in North Korea as well. Though no versions of Stuxnet have been reported as being discovered in local computers, Kaspersky Lab analyst Costin Raiu said that a piece of software related to Stuxnet had turned up in North Korea.Kaspersky had previously reported that the software, digitally signed with one of the same stolen certificates that had been used to install Stuxnet, had been submitted to malware analysis site VirusTotal from an electronic address in China. But Raiu told Reuters his contacts had assured him that it originated in North Korea, where it infected a computer in March or April 2010.Some experts said that even if a Stuxnet attack against North Korea had succeeded, it might not have had that big an impact on its nuclear weapons program. Iran's nuclear sites were well known, whereas North Korea probably has at least one other facility beyond the known Yongbyon nuclear complex, former officials and inspectors said.In addition, North Korea likely has plutonium, which does not require a cumbersome enrichment process depending on the cascading centrifuges that were a fat target for Stuxnet, they said.Jim Lewis, an advisor to the U.S. government on cybersecurity issues and a senior fellow at the Center for Strategic and International Studies, said there are limitations to cyber offense.A cyber attack "is not something you can release and be sure of the results," Lewis said.[end of quote]

1 0

Re: [Cryptography] Dark Web should really be called the Twilight Web
by grarpamp 30 May '15

30 May '15

On Thu, May 28, 2015 at 3:13 PM, Phillip Hallam-Baker <phill(a)hallambaker.com> wrote: > Fill is very expensive at the network layer but (almost) trivially cheap at > the link layer. The cost comes in having to think about how much data is > disclosed in the link layer framing. This is not necessarily a performance > issue but can certainly be an architectural constraint. What example do you mean "how much data is disclosed in the link layer framing"? I thought it was decided months back that encryption would be needed to prevent disclosure to anyone other than the two link partners. (And that encrypting the hardware link layer is trivially cheap in silicon.)

1 0

Re: [tor-talk] [Cryptography] Dark Web should really be called the Twilight Web
by grarpamp 30 May '15

30 May '15

On Fri, May 29, 2015 at 7:02 PM, Ryan Carboni <ryacko(a)gmail.com> wrote: >> >> That's only if you choose to attempt a padding-across-the-net >> management scope, which is also going to be hard and slow to >> manage and respond to bandwidth and other net dynamics. >> (Though this was about GPA, it's probably also vulnerable to >> endpoint interruption attacks that monitor your stream, unless >> someone is there making up the padding slack at the far end.) >> A wide scope seems hard in a low latency demand based net. >> I'd suggest examining some form of next-hop, next-peer, or link >> local padding scope negotiated with such peers. If you or your >> peers get hit with demand, your negotiation distance is shorter. >> > > That would still leak additional information, to a lesser extent. Passive adversaries see only encrypted traffic, not internal wheat/chaff ratios. (If considering active adversaries, which this is not meant to defend against, to be involved in ratios they would have to run enough nodes to be over half the full path, no worse than basic entry to exit correlation today.) > Regardless, I don't think the TOR network has the bandwidth or Internet access is generally provisioned and billed as... choose the max bandwidth you want, pay for it whether you use it or not. Therefore if you have idle capacity within your max at some moment, you have the bandwidth to dynamically fill it with padding at no additional cost. It's not a question of buying more to use as fill, it's about intelligently filling what you've already comfortably paid for. The problem of observing when endpoints are sitting idle, or rx/tx, and how much, often, etc... applies to any network today, not just tor. > computational capacity for padding. It doesn't take a supercomputer to calculate this regarding your logical link to your next hop node... 100Mbps cap - 63Mbps used = 37Mbps fill > It'd require more bookkeeping. That's head in sand talk, of course nothing is free. Mostly bookkeeping autonomously on and by the local node. Maybe some circuit signaling / publishing to DHT. Seems to get more complex if you try to scope it across the net instead of just to your next hops. There were threads on the subject of fill traffic a few months back that might be worth reading... "high latency hidden services" "traffic analysis" "traffic analysis -> let's write an RFC?"

1 0

Darryl W. Perry Calls for Ross Ulbrich to be Pardoned.
by jim bell 29 May '15

29 May '15

From: http://www.independentpoliticalreport.com/2015/05/darryl-w-perry-calls-for-… Darryl W. Perry Calls for Ross Ulbricht to Be Pardoned Ross UlbrichtFrom Darryl W. Perry’s 2016 presidential campaign website:In 2013 Ross Ulbricht was arrested for allegedly operating the black market website Silk Road. In early 2015 he was found convicted in what was essentially a kangaroo trial, where his attorney was prevented from presenting evidence of government corruption in the case, because of an ongoing investigation. Two of the federal agents investigating the case have since been arrested for fraud and money laundering.Ulbricht’s lead defense attorney Joshua Dratel wrote in a court filing, “In contrast to the government’s portrayal of the Silk Road web site as a more dangerous version of a traditional drug marketplace, in fact the Silk Road web site was in many respects the most responsible such marketplace in history, and consciously and deliberately included recognized harm reduction measures, including access to physician counseling. In addition, transactions on the Silk Road web site were significantly safer than traditional illegal drug purchases, and included quality control and accountability features that made purchasers substantially safer than they were when purchasing drugs in a conventional manner.”Meghan Ralston, a former harm reduction manager for the Drug Policy Alliance says Silk Roadwas “a peaceable alternative to the often deadly violence so commonly associated with the global drug war, and street drug transactions, in particular.”Despite the improprieties in the investigation and the trial, and despite the fact that Ross Ulbricht actually made the black market safer, he will be in prison for a minimum of 20 years. The Ulbricht family has said they plan to appeal the conviction, however they shouldn’t need to do so. Ross Ulbricht should be pardoned, as should all non-violent drug offenders![end of quote]

1 0

the revolution
by Juan 29 May '15

29 May '15

https://blog.xapo.com/announcing-xapos-advisory-board/ (just in case, yes, the subject is pure sarcasm)

1 0

Re: [cryptome] US World Political Jurisdiction
by Александр 29 May '15

29 May '15

> > http://cryptome.org/2015/05/putin-us-fifa-assange-snowden.htm > On the "FIFA CASE", Douglas Rankine wrote some very important words: > > As international law develops throughout the world, the power of a global > arrest warrant will increase and its jurisdiction and extent and use will > also increase. One awaits the day when it will be used against Russia, > China or India. Switzerland is a small country and although having many > rich and powerful institutions, is falling far behind the big players on > the world scene. Assange, and wiki leaks and reporters and journalists and > whistleblowers all over the world, beware, this doctrine applies not only > to terrorists, child molesters and criminals. Big brother is not only > watching you, but he is recording your every move, and whenever or wherever > you get in his way, he will get you... > It relates to many people on this list. Be aware. Or should I say "be careful"? .

2 1