September 2015 - cypherpunks - lists.cpunks.org

Recommended Movie: "Sebastian" 1968.
by jim bell 17 Sep '15

17 Sep '15

Since people seem to be recommending things, I recommend the movie "Sebastian". Dirk Bogarde, Susannah York.https://www.youtube.com/watch?v=bIK3OYnD9MY Out of date even when it was made, I think it really represents the cryptography situation as of the 1930's. Jim Bell

4 6

JYA and Cryptome Passphrase Are Secure
by John Young 17 Sep '15

17 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 JYA and Cryptome passphrases are secure. Plaintext discovered not related to Cryptome, with alternative to decrypt: original not scrubbed. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wsFVAwUBVfqf1UkY+k7YfUNsAQiovg/7BxJIAHhEUL65hjh4XsvwJlS91R1jE0zw LYBiut1uLPga1TZDH8L3NQP7Vq0y18yvsmch5n6Gy5AhQWbSZ7sJ2xP+ULc6uK+b MNpdaaCIgBVH4e83DVhyEh68r8qJ1fOhElW6WaLxXiPvDA/8WGKAhkpfR1/ghNpe SdbaY8PKIYzGYnXaESNhTKfsaiykO6FlaGMSYfyCe5Z4iEzB5HgCYLH1Nb+G91Q6 C2gcQSf6vBCzoPK99FxSAmqEahlECI1tNKJg5pH7uY3otzbuV7CcJ9Yn27MbrQvk dXJBIr1oMekz4d8Dp3b0hAvL394stKWsP5GfbZ4vvgltBKL0lVOwYMOFuHDXGTmb nANIUXvgbiIRUdX0u3uqk7I1NiChEGGwtA+7g4wTIqUy6SfviA0nTCu5Elka4T+j 32NLlxDpmLIM1KZ6t5YELz7CYVv2JYMNiOWkyAJOXbCglrJvpyvbyRLMuOEMgieD eICPHknwiHAdzI40eWVLpPaet0VKyqOvNb1cnjcA+NBUpH+idmcosNEBpvZVbZb0 99/4ii68qqz26N3xeIPxvmoSx9iXXRMUip4Iku4pQrbac64D/X3pck0ryd6yCaxU 8TldVI0oQVozp8H8VrP0ZICG+Y1vg//GYNorSJkoL3P3svwDfm/3WdcblWUrxhFw XVyThcbWdxQ= =XoD0 -----END PGP SIGNATURE-----

3 3

Re: [cryptography] a little help with cookies please
by grarpamp 17 Sep '15

17 Sep '15

What is of more crypto / security interest is not bandwidth use or even domain or path restrictions, but failure of webdevs to seed and restrict sensitive cookies (like your authenticated session id's) from and to TLS only sessions. Well known top100 sites that still have a legacy http mode fail to do this properly... banks, social, govt, etc. Even sites that immediately 302 your first hit (or other hits) over to https thereafter can be found doing it wrong. Ripe for wifi or wire monitoring based session stealing.

1 0

Fwd: [tor-talk] victory at kilton library
by grarpamp 17 Sep '15

17 Sep '15

https://freestateproject.org/blogs/historic-win-internet-freedom-nh-tor-nod… http://www.npr.org/2015/09/16/440914105/n-h-public-library-reconsiders-supp… ---------- Forwarded message ---------- From: Alison Macrina <macrina(a)riseup.net> Date: Wed, Sep 16, 2015 at 8:19 AM Subject: Re: [tor-talk] victory at kilton library To: tor-talk(a)lists.torproject.org > i just want to share the news that all of the hard work that has gone > into the library freedom project paid off today at kilton library. > despite pressure from the us federal government, which pulled out every > card to sell fear that they had in their hat, the local community > refused to accept it and thought on a global level to support the > library's choice to offer a tor relay to the public. > > this is truly a monumental moment. libraries in the usa have often been > the target of hostile actions that threaten the first amendment of the > us constitution and the privacy rights of people. through a long string > of legal battles, libraries have earned an extraordinary position that > provides them with the ability to offer services that could land other > people in significant legal battles which become both legally and > politically difficult to close down. > > i'd just like to say thank you to everyone involved in the library > freedom project who came up with the idea and didn't run away from the > fight. this is an excellent beginning. > > if you can, please send your support to the library freedom project. > https://libraryfreedomproject.org/donate > > this is a great victory for today. Thank you! I think I can speak for both mrphs and myself when I say that we are thrilled with the outcome. What we saw last night was an incredible display of community support for free speech and Tor, and an unequivocal rejection of unlawful government intrusion and FUD. The Lebanon Libraries staff and community did something historic; I've been an activist for a long time and I've never been a part of a direct action quite like that. This is what happens when communities come together to resist. Please keep an eye out for more news coverage. The local news in NH has already put something up with a few great quotes from community members present: http://www.vnews.com/home/18620952-95/library-joins-privacy-network If you're on twitter, say hi to @leblibraries or @nhleblibraries -- the second one is library director Sean Fleming, and I know he'd be moved to hear from folks in the Tor community about what his library community did last night. Thanks all for your support. We just had the world's first Tor protest, and it was a wild success. Imagine all the library exit relays we're gonna get now. :) Alison (director of Library Freedom Project) -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

1 0

peer to peer hypermedia protocol
by Michael Best 16 Sep '15

16 Sep '15

Tried to send this last week. but apparently I'd been unsubscribed from the list. Some interesting possibilities here, especially when combined with extra layers of encryption. "IPFS is a distributed file system that seeks to connect all computing devices with the same system of files. In some ways, this is similar to the original aims of the Web, but IPFS is actually more similar to a single bittorrent swarm exchanging git objects. IPFS could become a new major subsystem of the internet. If built right, it could complement or replace HTTP. It could complement or replace even more. It sounds crazy. It is crazy." Main page: http://ipfs.io/ Overview:https://github.com/ipfs/papers/raw/master/ipfs-cap2pfs/ipfs-p2p-fi… Git: https://github.com/ipfs/ipfs/ Alpha demo: https://www.youtube.com/watch?v=8CMxDNuuAiQ Why we must distribute the web: https://youtu.be/skMTdSEaCtA

1 0

Fwd: [tor-talk] victory at kilton library
by grarpamp 16 Sep '15

16 Sep '15

https://twitter.com/flexlibris https://twitter.com/libraryfreedom https://twitter.com/nhleblibraries https://twitter.com/LebLibraries ---------- Forwarded message ---------- From: Tempest <tempest(a)bitmessage.ch> Date: Tue, Sep 15, 2015 at 10:30 PM Subject: [tor-talk] victory at kilton library To: tor-talk(a)lists.torproject.org i just want to share the news that all of the hard work that has gone into the library freedom project paid off today at kilton library. despite pressure from the us federal government, which pulled out every card to sell fear that they had in their hat, the local community refused to accept it and thought on a global level to support the library's choice to offer a tor relay to the public. this is truly a monumental moment. libraries in the usa have often been the target of hostile actions that threaten the first amendment of the us constitution and the privacy rights of people. through a long string of legal battles, libraries have earned an extraordinary position that provides them with the ability to offer services that could land other people in significant legal battles which become both legally and politically difficult to close down. i'd just like to say thank you to everyone involved in the library freedom project who came up with the idea and didn't run away from the fight. this is an excellent beginning. if you can, please send your support to the library freedom project. https://libraryfreedomproject.org/donate this is a great victory for today. -- gpg key - 0x2A49578A7291BB34 fingerprint - 63C4 E106 AC6A 5F2F DDB2 3840 2A49 578A 7291 BB34 -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

2 1

Re: [Cryptography] [cryptography] JYA and Cryptome Keys Compromised
by John Young 15 Sep '15

15 Sep '15

Correct analysis. First was get out a prompt notice to wave off users, then proceed with other authentications. Toughest problem is how to avoid another compromise of new keys since so many ways to do that have arisen and/or suspected over the life of PGP and other systems. WoT is problematic too, as are key signing parties, and so on. Other systems claim to be better, and we are using some of them, waiting and watching and suspecting are the lessons learned from stalwart testbed PGP in all its guises and disguises. We likely would not have discovered the compromises if not for those lessons. Nor do we mind starting from scratch, perhaps a bit more often than 11 years. Tornados do happen out side alleys of easy prediction (this is not a cyphersec sales motto). At 04:22 PM 9/15/2015, Paul Wouters wrote: >On Tue, 15 Sep 2015, John Young wrote: > -----BEGIN PGP SIGNED >MESSAGE----- by unknown key. > I have learned today that all PGP >public keys of John Young > <jya(a)pipeline.com> and Cryptome ><cryptome(a)earthlink.net> have been > compromised. > The keys have >been revoked today. Revocation could have been done by the person >who stole the keys too. That in itself is not good enough. > Two new >keys have been generated today: > > John Young 15-0915 ><jya(a)pipeline.com> 0xD87D436C > Cryptome 15-0915 ><cryptome(a)earthlink.net> 0x8CD47BD5 Which I cannot find on either >pgp.mit.edu or pgp.surfnet.nl. I did find them on keyserver.pgp.com, >but I don't know who runs it and with the additional captcha >software, no idea if that is compromised :P It is announced using >short keyids, not to be trusted, and no finger prints although we >can get those from the key used to sign this message I guess. $ gpg >--list-sigs D87D436C pub 4096R/D87D436C 2015-09-15 >uid John Young 15-0915 <jya(a)pipeline.com> >sig N D87D436C 2015-09-15 John Young 15-0915 ><jya(a)pipeline.com> sig CA57AD7C 2015-09-15 [User ID not >found] sub 4096R/79F82F3B 2015-09-15 sig D87D436C >2015-09-15 John Young 15-0915 <jya(a)pipeline.com> $ gpg --list-sigs >8CD47BD5 pub 4096R/8CD47BD5 2015-09-15 >uid Cryptome 15-0915 <cryptome(a)earthlink.net> >sig N 8CD47BD5 2015-09-15 Cryptome 15-0915 ><cryptome(a)earthlink.net> sig CA57AD7C 2015-09-15 [User ID >not found] sub 4096R/27BCF5FB 2015-09-15 sig 8CD47BD5 >2015-09-15 Cryptome 15-0915 <cryptome(a)earthlink.net> The keys are >both announced but not signed by each other? I fetched CA57AD7C >which has 6863 signatures on it. It seems to be some PGP global >directory key, signed by a few people I know, but still seems to be >only proof that it came from the keyserver, not that the key >actually belongs to you. > This message is signed by the first. But >is that first key signed by the old keys? (which of course could >also have been done by the attacker, so you need to re-start a web >of trust with some of your personal confidants. > -----BEGIN PGP >SIGNATURE----- from an unknown key - with no direct signatures of >any known trustable key run by a human. Paul >_______________________________________________ The cryptography >mailing list cryptography(a)metzdowd.com >http://www.metzdowd.com/mailman/listinfo/cryptography

2 1

JYA and Cryptome Keys Compromised
by John Young 15 Sep '15

15 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 15 September 2015 I have learned today that all PGP public keys of John Young <jya(a)pipeline.com> and Cryptome <cryptome(a)earthlink.net> have been compromised. The keys have been revoked today. Two new keys have been generated today: John Young 15-0915 <jya(a)pipeline.com> 0xD87D436C Cryptome 15-0915 <cryptome(a)earthlink.net> 0x8CD47BD5 This message is signed by the first. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wsFVAwUBVfhrXUkY+k7YfUNsAQgyeQ/+PA604lj8ZrZq9qnRMsbA86DdGPUyrdub IWlQSpp5wyMMQG4VegjG7iwXBt6GftKQFLKuW527wGxaxIBJj1n2GhCMkn7mko1s u107yQ5WVfJUTOHgazi2viuw8v3ixmJ/GcdvEeGCL23ErgGwvI6+JilmkP7vonmu 73ckavqrs6VvUJjjwzoIbgvXxsp+oqKT5EgZqfroQOaaz3e4AjipxwMav2VMqVTl xZdHlp/QGab8Cet17NnDsNmN38YWT5t4pU1tL+0aN9jf7Vy+Jzx5g8nMk0e7ogzz vg8ioWs3EkxJbjQaWK5/COjoYLjIZn6H5zUJgIBRtqsnbfNUcQisCNbwx1fNRGwq DItG/jeHp65q6eDxFVWGkptDuZKUH4fGuiiRMxIySrj1CA1+9M5Q+m2TxnL/SFNU AIfupcGWhtXXa1ZN70LT3fnIu9y9B5mQLSshn14eekD3t0nb+OkL+XEC0nJqnfVD xOOqAjHQj1ytEfHSKb+i+/tHTCCTOKeaHM3JGE6qIawrn+aRfKsnGK9t+JiVEtyx 1d+L0gHwtcUd5MWQJdCMHoM10ri5cgx0A6su+lYnLgOcXYD3uHSVIdp1cSf3Wzwb 3MrO2BqqhL5y1Ip3Cfv+h+eXaZWWMr5w97kjSOYD/lwb61iA1tpWLkgiuUGBGrFb 32VkU7sMt4E= =Q9BO -----END PGP SIGNATURE-----

2 2

John McAfee Runs For US President In 2016 Under Cyber Party
by grarpamp 15 Sep '15

15 Sep '15

https://mcafee16.com/ http://cyberparty.org/ https://en.wikipedia.org/wiki/John_McAfee http://www.whoismcafee.com/ http://www.futuretensecentral.com/ https://twitter.com/officialmcafee https://twitter.com/JohnMcAfeeStory http://johnmcafeestory.com/

8 23

More neighbours make more fences [Economist]
by Ben Mezger 15 Sep '15

15 Sep '15

Oh the irony ;-) http://www.economist.com/blogs/graphicdetail/2015/09/daily-chart-10? Hey cpunks, what year are we? - 1940 for sure. -- Sent with my mu4e

1 0