June 2015 - cypherpunks - lists.cpunks.org

Hearn vs Bitcoin-over-Tor / anonets?
by grarpamp 18 Jun '15

18 Jun '15

Wasn't there a group of folks or posts that were suggesting colored coins / relay censorship or some other type things as a good idea? Hearing people dismiss particular use cases of anonymity networks as moot, even though such uses are possible and being done (without need for much code or protocol development), or suggesting lesser alternatives, well... doesn't seem like words of support for those users, their principles and needs... and seems possibly against them. Of course the interpretation should really be left to others more closely following these few specific issues than I. https://www.youtube.com/watch?v=8JmvkyQyD8w&t=24m00s Recall that bitcoin-core added support for Tor and I2P a few years back thus helping to affirm the use case of anonets by [users of] digital currencies. And that those running traditional government currencies usually wish neither privacy or independant currencies, unless it's for and by themselves. IBM of course has a digital currency partnership proposition. Similar issues would apply there as well.

1 0

Matryoshka (fill traffic in networks?) [was: Are TOR holes intentional?]
by grarpamp 18 Jun '15

18 Jun '15

On Thu, Jun 18, 2015 at 12:51 AM, Roger Dingledine <arma(a)mit.edu> wrote: > but it sure looks like another case of somebody not understanding the > research field, and thinking that solving the traffic confirmation > attack is easy, without actually thinking through the engineering side, > the scaling side, or the statistics side. There's certainly no easy solution to all problems. Though there could be value in those that put more odds in your favor, even though they do not yield 100% solution or protection. If you rarely tx but then emit something [unique or timely] that pops out at some [rare] destination, you're done for. I think we've seen posts from some people who slow crawl the web 24x7 when their client is running just to add cover at their end for their interspersed real web activity. By the way, does metrics report the saturation level of the net as a whole in terms of bandwidth and processing load for exit and non exit relays as both one [and two] summed aggregate group[s]? > But even full scale padding, ignoring the practical side of how to get a > Tor network that can afford to waste so much bandwidth Waste is an incorrect, negative term for designed in padding (fixed set of lengths) or fill (empty links) or chaff (ratio) or whatever this is. A design where fill traffic gets out of the way when real data is being sent might have periods of congestion or underutilization of the link depending on the distance in hops the fill is managed over, and the speed of the sensing and feedback controls. Seems that might need to be as fast as you could initiate a first packet across, unless you inhibit that packet until ready. Yes, an individual relay or end node may be subject to various billing policies (transfer vs bitrate), but see thread in reply to Titov here... https://lists.torproject.org/pipermail/tor-talk/2015-May/037987.html https://lists.torproject.org/pipermail/tor-talk/2015-June/038027.html > doesn't provide > protection in the face of active attacks where you induce a gap on one > side and then observe the gap on the other side. And it might even be > the case that these gaps happen naturally by themselves, due to network > congestion and so on, so maybe passive observers will be winners even > against a design that does full padding. I've said that fill seems useful against passives, not actives. However a design may actually be possible such that any disturbance or deficiency in fill might be possible to make up from other sources. In other words, if I knock you off the net, the remaining path your data would have taken to your endpoint will still be filled so as not to expose the far end as being tied to you (if the fill management scope of the network is finer grained than just the end nodes negotiating end-to-end with each other (ie: I think the entire net will need to negotiate their own mesh of fill peers as an underlying management layer, with possible cues from above)). You get knocked off, your former peers sense this and recalc their fill sources and sinks. > Also, to make it really work in practice, all users are going to need > to pad not just while fetching their web page or iso or whatever, but > sufficiently before and after that too, else an attacker can match up > start times and end times: > http://freehaven.net/anonbib/#murdoch-pet2007 Well duh, that's necessary :) > tl;dr the whole premise of this person's blog post is flawed, since > their design likely does not work as they think it does. While someone's design may be insufficient to solve some problem, it does add value in the form of talk of possible solutions and trialing them. Thereby others can try different / related avenues to a solution. > For background see e.g. > http://freehaven.net/anonbib/#danezis:pet2004 > This is a great area for further research: > http://freehaven.net/anonbib/#ShWa-Timing06 > http://freehaven.net/anonbib/#active-pet2010 I don't mean that Tor specifically needs to investigate or implement fill, but that since the research area is probably not complete, and that no operational net is trying it, it's worth continued work. If anyone knows a good list that does or would serve as home for such work, please say so as I'm unaware of any. [Bcc'd to matryoshka as FYI]

2 1

Bitcoin: It's all about the Kolions...
by grarpamp 18 Jun '15

18 Jun '15

http://qz.com/429536/the-absurd-trial-of-a-russian-farmer-who-invented-his-… At the local court in Yegorevsk, a town outside Moscow, the case of local farmer Mikhail Shlyapnikov is being heard. Shlyapnikov is accused of creating his own alternative currency, which he calls “kolions,” in honor of the village of Kolionovo, where his farm is located. Shlyapnikov maintains that kolions simply assist a form of barter between him and his friends. The Central Bank and tax inspectorate both claim that Shlyapnikov has violated the constitution, several tax and civic legal codes, and a host of federal laws. Meduza’s special correspondent, Andrei Kozenko, was present at a rather unusual court hearing. “I don’t understand what’s going on here,” Shlyapnikov complains to the circle of TV journalists assembled, “Where is this all heading? This is my first time in court in my whole life. Clearly something’s gotten the prosecutor worked up and he’s brought this case.” ...

2 1

Terrist Favorite Messaging App SureSpot Under Govt Duress
by grarpamp 17 Jun '15

17 Jun '15

https://antipolygraph.org/blog/2015/06/07/developers-silence-raises-concern… http://www.csmonitor.com/World/Passcode/Passcode-Voices/2015/0617/Opinion-I… https://www.surespot.me/documents/how_surespot_works.html https://www.surespot.me/documents/threat.html https://github.com/surespot https://www.eff.org/secure-messaging-scorecard Note that as with most new projects, SureSpot is unaudited, centralized, run by relative unknowns, nor is it known whether anyone is publicly validating the supposed source code to the distributed binaries and server protocols with each version.

1 0

Darknet Citizens Crowdfund Sekrit Rockit Programz To Shoot Down Pesky Spy Platforms
by grarpamp 17 Jun '15

17 Jun '15

http://qz.com/429946/these-are-the-first-full-color-hd-videos-of-earth-from… http://f9xr874n.........onion/giveBTC/

1 0

links - Assange now to be questioned - some choice comments at yank dot for giggles
by Zenaan Harkness 17 Jun '15

17 Jun '15

With plenty of references to our 'favourite' three letter agencies no less :) The, ahem, cypherpunks amongst us may enjoy this, just a little: http://yro.slashdot.org/story/15/06/15/2211259/julian-assange-to-be-intervi… But hey, don't let me spoil the CIA's parade.

3 2

Droning and Surveillance are Unnatural and Debilitating
by grarpamp 17 Jun '15

17 Jun '15

http://www.nytimes.com/2015/06/17/us/as-stress-drives-off-drone-operators-a… http://www.salon.com/2015/03/06/a_chilling_new_post_traumatic_stress_disord…

1 0

Re: cypherpunks Digest, Vol 24, Issue 33
by Softy 17 Jun '15

17 Jun '15

> Surely, you understand why they did this? There is a perfectly good > rationale for running these kind of operations. It's just that you're > miffed about the fact that you're not able to do anything about it. > > So if you're part of some impotent government that does not know how to, > or wants to project power, instantly you're at the mercy of institutions > of governments that can. No amount of tree-hugging or moral high ground > is going to save you from extinction. > > And it's not all that bad. It's mostly power-play and politics really. > > > > > > https://en.wikipedia.org/wiki/CIA_involvement_in_Contra_cocaine_trafficking > > > > "Once you set up a covert operation to supply arms and money, it's > > very difficult to separate it from the kind of people who are involved > Do you claim to understand why the Reagan administration "did this" operation which eventually came to be known as Iran-Contra? If so, then you can explain how "blocking the fall of [soviet] dominoes" directly correlates to the distribution of drugs in specific Black-American communities. You can in hindsight claim to agree with the end goal of "blocking Communism" however, in hindsight, you would be lambasted as failing to see through the Administration's propaganda. Still claiming to support the means to that end, squarely puts you in the realm of the Abusers of Power. Abuse because the voting population never had any chance to understand what was being done in their name. This is the cycle of Power Abuse which has many in the world turned against the US (and increasingly its people not just government). As long as the (secret) three-letter agencies conduct (secret) operations using (secret) means and continue to be governed with (secret) mandates driven by an administration's (secret) beliefs without Transparent and Democratic oversight this trend will continue until its logical conclusion. Sadly.

2 1

Re: Russia and China crack Snowden Cache
by JS733NknRj6J 17 Jun '15

17 Jun '15

Sent from [ProtonMail](https://protonmail.ch), encrypted email based in Switzerland. -------- Original Message -------- Subject: Re: Russia and China crack Snowden Cache Time (GMT): Jun 17 2015 12:53:55 From: tim(a)diffalt.com To: cypherpunks(a)cpunks.org To summarize the problem: the CIA is has about 20.000 employees. Which is substantially bigger then in the 1950s where they had maybe about 4-5.000. They are an intelligence office. They started out gathering intelligence, gained intelligence gathering capabilities and now have capabilities to operate independently to some extent for some years. It's a somewhat minor point that I believe only supports your main argument, but this is not speaking strictly correct. From its inception in 1947, CIA has had at least two official missions: 1, the collection of intelligence (under what was first called "Office of Special Operations"); 2, "action" (under what was first called "Office of Policy Coordination," & has changed and mutated several times since), the definition and limits of which have always been a huge problem. Essentially, or at least arguably, #2 allows for military action outside the military chain of command, though not inside the territorial US. This in itself is a holdover from the OSS and other earlier orgs, all of whom had similar mandates, and even from the personnel who were part of those earlier orgs and wanted to continue their fun & games. In many ways it is #2 that is the real problem, though one could argue that the need for intelligence collection outside the military chain of command is itself debatable (MI6, the "british equivalent" of CIA in most brief descriptions, is part of the British military). At any rate, their official mandate has always been much larger than intelligence gathering. See https://en.wikipedia.org/wiki/History_of_the_Central_Intelligence_Agency

1 0

Free Advice for FBI/OPM/NSA/DOE: full-disclosure hardware
by Troy Benjegerdes 17 Jun '15

17 Jun '15

Okay, so apparently the CIA pulled a fast one on you, and now everyone with a security clearance is (probably) getting doxed[1]. "Outsiders must be deputized to audit the systems, brutally assess their failings, and put together an aggressive plan to both find existing breaches (who knows what’s still lurking in OPM’s systems right now?) and prevent further ones. Every government agency should be subject to an outside cybersecurity audit, and I include the NSA in that" So since I'm a nice guy (or maybe just a guy with an open-source hardware business plan) the first thing I want to audit is the PCB layout of the server(s) that got hacked. I'll even do it for free if you publish the schematic and board layout under a license compatible with the Debian Free Software guidelines. Now, on the other hand, if your hardware vendor is going to whine like a child who got caught with their hand in the candy jar about 'IP' and such, I will be happy to start reviewing how broken Intel/AMD/etc chips and motherboards are with a confidentiality agreement if you agree to pay my retainer. (which is approximately the amount I need to buy some farmland and wind turbines.) [1] http://www.slate.com/articles/technology/future_tense/2015/06/opm_hack_it_s… So if anyone is actually serious about security, then I'll know because there will be more than just me talking about why we need full-disclosure hardware that you can X-ray and compare to an image signed and hosted by multiple independent and competing nation-state or multinational-corporate level security agencies. If your Intel motherboard matches the image signed by IBM, China Telcom, and Iran, than it's probably safe for Democrats to use, and good for Republicans if Saudi Arabia signs it. Any politician using an image signed only by an agency they supervise should be immediately impeached.

4 3