March 2016 - cypherpunks - lists.cpunks.org

Re: [Cryptography] Two more Apple amicus briefs
by grarpamp 04 Mar '16

04 Mar '16

On 3/3/16, Allen <allenpmd(a)gmail.com> wrote: > On Thu, Mar 3, 2016 at 9:19 PM, Henry Baker <hbaker1(a)pipeline.com> wrote: >> https://assets.documentcloud.org/documents/2746620/Apple-Amicus-Brief-by-Ai… >> https://assets.documentcloud.org/documents/2746626/Apple-Amicus-Brief-From-… >> >> > Someone should file an amicus brief that basically says the FBI violated > federal contracting rules by not putting the hacking work out to > competitive bid through the RFP process, and therefore it's request to > force Apple to do this work violates federal law and should be struck down > as against public policy. I'm not actually familiar enough with the > federal contracting process to know if that is true or not, but it seems > plausible, and it also seems there are many companies that would like to > have a crack at doing this work instead of being forced to do it. At > minimum, the FBI would find out through the RFP process if what it seeks > might be available through another channel and therefore Apple's assistance > is not required. And in the meantime RFP and results are out in the open giving makers more time to roll out and get embedded in society per and for customer interest, impenetrable crypto schemes. Embedding crypto to, for, and in conscience of society as a private and personal tool... is a race condition. And one you want to win. So do it... nao !!!

1 0

Two more Apple amicus briefs
by grarpamp 04 Mar '16

04 Mar '16

---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Thu, 03 Mar 2016 18:19:23 -0800 Subject: [Cryptography] Two more Apple amicus briefs To: cryptography(a)metzdowd.com -- a whole bunch of tech companies: https://assets.documentcloud.org/documents/2746620/Apple-Amicus-Brief-by-Ai… -- ATT: https://assets.documentcloud.org/documents/2746626/Apple-Amicus-Brief-From-… _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 1

Fwd: Returned post for oss-security@lists.openwall.com
by Georgi Guninski 03 Mar '16

03 Mar '16

----- Forwarded message from oss-security-admin(a)lists.openwall.com ----- Date: 3 Mar 2016 13:49:09 -0000 From: oss-security-admin(a)lists.openwall.com To: guninski(a)guninski.com Subject: Returned post for oss-security(a)lists.openwall.com us-ascii Hi! This is the ezmlm program. I'm managing the oss-security(a)lists.openwall.com mailing list. I'm working for my owner, who can be reached at oss-security-owner at lists.openwall.com. I'm sorry, your message (enclosed) was not accepted by the moderator. If the moderator has made any comments, they are shown below. >>>>> -------------------- >>>>> If you ever have anything valuable to share, like software bugs you used to find 10+ years ago, please feel free. Other than that, please consider the kind of content you've been posting lately unwelcome on oss-security. We also have a policy to discourage CC'ing other lists on oss-security postings (because this attracts less-relevant postings from other lists), but of course you didn't know nor care. (And the CC's were not particularly bad in this case, I admit. It's worse when someone CC's LKML.) /sd <<<<< ----------------- On Thu, Mar 03, 2016 at 10:28:09AM +0000, Cord Beermann wrote: > Hallo! Du (Adam D. Barratt) hast geschrieben: > > > If you want an answer from those who deal with lists, you have to ask them. > > debian-legal@ is just another mailing list. > > The file has been removed. > > Yours, > Cord, Debian Listmaster of the day Many thanks. You fixed the _entire_ messy issue with a single `rm`. btw, didn't your marketoid debian overlords taught you to hypocritically say `thanks' in issues like this? Goodbye oss-security-unsubscribe@ and debia ----- End forwarded message -----

1 0

Re: [oss-security] According to www.virustotal.com, lists.debian.org are hosting attachment .DOC virus
by Georgi Guninski 03 Mar '16

03 Mar '16

On Thu, Mar 03, 2016 at 10:28:09AM +0000, Cord Beermann wrote: > Hallo! Du (Adam D. Barratt) hast geschrieben: > > > If you want an answer from those who deal with lists, you have to ask them. > > debian-legal@ is just another mailing list. > > The file has been removed. > > Yours, > Cord, Debian Listmaster of the day Many thanks. You fixed the _entire_ messy issue with a single `rm`. btw, didn't your marketoid debian overlords taught you to hypocritically say `thanks' in issues like this? Goodbye oss-security-unsubscribe@ and debian-legal@

1 0

Re: [Cryptography] LibreSSL unaffected by DROWN
by grarpamp 03 Mar '16

03 Mar '16

On 3/2/16, Viktor Dukhovni <cryptography(a)dukhovni.org> wrote: > OpenSSL 1.1.0 (days away from beta), which does break compatibility > with 1.0.x, also removes SSLv2, and has many improvements that > LibreSSL does not. Neither is strictly better, there are surely > things that are better in LibreSSL than in OpenSSL 1.1.0. > > Theo is an avid marketer, the reality is a bit more complex. So then where is the link to an independant website which stays current and puts say Libre 2.2.[x] and Open 1.0.2[x] side by side in a feature / protocol / api review table?

2 1

Re: [Cryptography] iPhone hardware attacks
by grarpamp 03 Mar '16

03 Mar '16

On 3/2/16, Perry E. Metzger <perry(a)piermont.com> wrote: > I keep wondering what the odds are that the NSA has no method > available to decap the chips within an iPhone and extract secret > keying material. I suspect they must be able to do that, even from one > of the more modern iPhones with hardware based security modules. If IBM can image and arrange single atoms, you can bet the NSA can do something as simple as ablate them. Got the shakes and cook a few extra along the way... no problem, chips still have much larger features. https://en.wikipedia.org/wiki/IBM_(atoms) > The techniques for doing this sort of thing are both well known and in > the open literature. Even skilled amateurs manage such feats on older > hardware quite routinely -- I've personally witnessed chips being > decapped and put into university grade equipment for analysis. Given > the NSA's budget and mission, it seems highly, highly unlikely that > such methods are unavailable to them. > > This brings up another question. FBI officials have testified under > oath that there is no government agency that can extract such > information on their behalf. Is that very careful spin, willful > ignorance, or simple perjury? Doesn't matter, they just contract out to their good ole boys at IBM or their favorite university.

2 1

fun with Tor
by Mirimir 02 Mar '16

02 Mar '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just for fun, but maybe useful: Onion SSH Hosts for Login Chaining https://www.ivpn.net/privacy-guides/onion-ssh-hosts-for-login-chaining You too can chain multiple onion SSH logins, isolated by intervening multihop VPN links. Lots of latency and jitter, to annoy watchers. It hogs relays, I admit. But at least, there are no exit nodes involved. OpenVPN Onion VPS for Evading Discrimination Against Tor https://dbshmc5frbchaum2.onion/OpenVPN-Onion-VPS.html You look like typical VPN users. They get banned too. But you can easily change VPS. They're inexpensive. And again, there are no Tor exit nodes involved. Maybe there's a commercial opportunity here. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJW13IqAAoJEGINZVEXwuQ+aIoH/2eSqk9cDKqpkpdAgB0nx5Jt rptP3tkKxBjG9cZY8Pidy01vgtRGPx87/6nB7e8SABUugIrfct0uB6xaqfwjbfq6 bon3UsqImmd/jKZmOseGT4Z7nPweo7gk+cBrzCN/Wh8SCHv+bTe3EHU/au6hKs34 Xhm/ZWkERVl6+xWVny4OuIHn9qIpInilD09Sxm/KHCXa+cX5YfuLTN2l3WqJy4VP 03X3CeT7QVQEZZD85n5gjrmOOHY7DJ98NMikVygYvOqUeCxMhI0T9elrA3/akZ59 N/xMYXdhxJcgBx8zy7IQksYJpTIdB2QdvTnhuEpeMOrIcYh4vv1+h6X8DK+o/c4= =ezP3 -----END PGP SIGNATURE-----

1 0

zeronet.io
by grarpamp 02 Mar '16

02 Mar '16

https://www.reddit.com/r/trackers/comments/48d41h/play_worlds_first_serverl…

1 0

Fwd: NSW. New cycling laws: One of the first bike riders hit with $319 fine for not wearing a helmet.
by Zenaan Harkness 02 Mar '16

02 Mar '16

Finally! For those who pine for the cozy safety of a modern democratic socialist nation, yes Australia is here for you. Razer (I think), your concerns about cycling safety have been answered in abundance, and are being enforced :D As folks round here already know, the government's right to legislate is absolute. At least now we'll bring appropriate pressure on all those irresponsible parents who fail to clip a helmet to their poor defenseless child as they hurtle off round the neighbourhood. Please, who will think of the children? The Australian government, that's who. And for those who have yet to experience the smallest of peaceful civil dissent or disobedience or peaceful political protest, and it's consequences, your protest will almost always be couched by the government solicitors as something like "The zero tolerance cycling safety laws are valid. They serve a legitimate object of government power, that is, the safety of its citizens." And so they strive, almost always successfully, to couch your case, not in terms of the rights you believe are unalienable, but in terms of the validity of their pathetic whining little bastard children of legislation making, the god almighty Statute Laws though shalt obey and praise the state! This "validity of the law" position that the govt takes is entirely deceptive: unless you really go into the depths of the invalidity of the government itself, the Australian states have given themselves catch-all power of "the power to pass any law for the good governance of the people." A loud and bombastic, indeed theatrical "OBJECTION!" is advised in such moments as the validity of the law is being raised and or pounded into your posterior... However! Hark, there is hope! The common law right has almost never been removed, and must be explicitly removed by an act for that common law right to be taken to be removed - the mere affirmation of a legislative power (e.g. for a concern of safety), in the guise of an almighty statute, does -not- by itself remove that common law right. Yes you heard me right. At least in Australia although the citation is forgotten just at the moment, this is the position of the High Court of Australia (HCA), comparable to SCOTUS. It's an intellectual deception the govt invariably runs against you and your dirty, dirty human rights, but you need to master this particular deception if you wish to prevail in the Australian courts on a common law civil liberties/ common law right legal ground. Oh, and you might also have to be willing to shoot up to the High Court on appeal. Which, unless you are bold enough to stand in front of the bench and speak your right by yourself, that is without a lawyer, barrister, solicitor or queens counsel (if you have a spare $80K lying around...), might be costly and/ or intimidating. And for those who -do- have the $80k just lying around, TAKE NOTICE: most legal representatives in -this- country will phrase -your- defence of the government's charge(s) against you (in your peaceful political protest), in terms of the validity of the law, thereby selling you out before you even get near enough to the HCA to realise you've been sold out because yes, "your" lawyer/barrister/etc asked the wrong damn question from the start, applying at each level of appeal, all the way to High Court where you case is resoundingly dismissed since "We find that this particular law is valid..." At that point it's too late to say wtf! Good luck, Zenaan ---------- Forwarded message ---------- From: Jim <jim.sovereign(a)optusnet.com.au> Date: Wed, 2 Mar 2016 19:17:01 +1100 Subject: NSW. New cycling laws: One of the first bike riders hit with $319 fine for not wearing a helmet. NSW's finest dropkick politicians have lost the plot again by imposing ridiculous fines against cyclists for victimless "offences." If stupidity was a criminal offence most Aussie politicians should be doing life in prison for multiple offences. Jim New cycling laws: One of the first bike riders hit with $319 fine for not wearing a helmet news.com.au Jim O’Rourke and Miles Godfrey, The Daily Telegraph March 2, 2016 Cyclist Ben Ackerley was fined for not wearing a helmet while riding his bike on the first day new cycling laws came into effect. Picture: Ross Schultz New cycling laws come into play Opinion: ‘New bike laws are a joke’ DESPITE the threat of the massive new fines for running red lights, not wearing helmets and riding dangerously, The Daily Telegraph witnessed cyclists continuing to flout the road rules. Ben Ackerley, who recently moved to Sydney from the United States, became possibly the first rider to be booked under the new fine regime. The restaurant manager from Darlinghurst was riding on Oxford St just before midday and was not wearing a helmet. Ben Ackerley was upset over being fined $319 for not wearing a helmet while riding his bike. Picture: Ross SchultzSource:News Corp Australia A police Highway Patrol officer on a motorcycle pulled Mr Ackerley over and hit him with the new $319 fine – up from just $71. “I’d just picked the bike up from the bike shop after getting it fixed,” he said. “It got wrecked in an accident with a taxi on Market St about three weeks ago. I knew about the no helmet laws but I was just riding about a mile and a half (1.6km) home. “I’ve just come from living in New York City. The cops there have got better things to do than worry about this sort of stuff.” Mr Ackerley said he may appeal for leniency. As part changes to cycling laws beginning Tuesday, fines for five offences have increased by up to 500 per cent. The $319 fine which Mr Ackerley said he may appeal, asking for leniency. Source: News Corp Australia As well as new fines for no wearing helmets, cyclists risk $425 fines for running a red light; riding dangerously and; not stopping at pedestrian crossings. Motorists who do not leave a 1m buffer between their vehicle and a bike when travelling up to 60km/h can be hit with a $319 fine and lose two demerit points. Those travelling more than 60km/h must leave a 1.5m space. During today’s morning peak, The Daily Telegraph saw riders shooting through on the red light at busy intersections along Oxford St, between Taylor Square at Darlinghurst and College St in the CBD. While the vast majority of cyclists kept to the left lane, some riders weaved among the traffic, coming less than a metre from vehicles moving slowly through the rush hour traffic. At the intersections with Flinders, Crown and Riley streets, a number of cyclists pushed to the front of the traffic queues stopped at red lights, leading to some distance issues between cars and bikes when the lights turned green. In Randwick, a number of cyclists were spotted riding in the middle lane of the three city-bound lanes, on Alison Rd. Ben Ackerley poses with his bike and his $319 fine. Picture: Ross Schultz Source: News Corp Australia Several weaved among the traffic even though a shared cycle/pedestrian path runs along the northern side of the road. On King St at Newtown, a rider, without a helmet, insisted on riding on the footpath. Along busy Bondi Rd at Bondi, several riders darted between vehicles slowing moving towards the city. Police could not confirm any other incidents of vehicle drivers being fined for not giving enough space to cyclists. On Monday, Traffic and Highway Patrol Commander John Hartley said his officers would use their discretion, but would book those who were obviously breaking the new laws. A spokesman for the police Highway Patrol said it had not scheduled a specific enforcement operation targeting cyclists to coincide with the first morning of the new laws. “Police, including our Motorcycle Response Teams, were undertaking their regular duties this morning,” the spokesman said. The government’s Transport Management Centre said it had not recorded any incidents involving cyclists during the morning peak. Bicycle NSW CEO Ray Rice said the majority of cyclists are keen to do the right thing and obey all road rules. While he strongly supports the new minimum passing distance rule, because it offers extra protection to riders, the cycling community is opposed to the increased fines and mandatory photo ID for bicycle riders. In the lead up to the law changes, Bicycle NSW handed a petition containing 10,000 signatures to the state government demanding the government immediately rescind the fine increases and photo ID sections of the legislation. Mr Rice said last month that regulation should be a last resort and described NSW as fast becoming Australia’s nanny state. Mr Rice said no other state has fines this high - and no other state will be introducing mandatory photo identification for bicycle riders. “These two measures do nothing to help the government achieve their aim of doubling the number of riders using bikes for transport,” he said. Mr Rice urged the government to mount a stronger and more sustained public education campaign to inform all road users of how the distance laws work. “We are just not getting the cut through required,” Mr Rice said. “But we know police are not going to be out there with a tape measure trying to work out the distance between cars and bikes.” The NRMA today said it supports the increase in fines. “We support the argument that cyclists should have to carry ID because what we know is that the overwhelming majority of cyclists do the right thing and this is targeting the ones who don’t,” spokesman Peter Khoury said. “They are putting their lives at risk and we don’t want that.” City of Sydney Liberal councillor Christine Forster said cyclists are road users so should be expected to obey the rules. “That should, I imagine, foster mutual respect among cyclists and drivers,” Ms Forster said. Originally published as The first cyclist hit with tough new laws http://www.news.com.au/national/nsw-act/news/new-cycling-laws-one-of-the-fi… -------------------------------------------------------------------------------- What the bell? New fines for cyclists a bloody joke news.com.au Matthew Dunn March 2, 2016 8:51am OPINION FOR as long as I can remember, I have been using a bicycle as my main source of transport. I love the feeling of doing something good for the environment and vastly improving my health and fitness levels at the same time. However, more than anything I love how much money I save using pedal power. Well, that was until New South Wales premier Mike Baird decided popping me $106 dollars for not having a bell on my bike was a good idea. This is just one of the many ridiculous new fines introduced today by the NSW Government, which appear to be a blatant attempt at revenue raising. Sorry, I shouldn’t be so cynical. Roads Minister Duncan Gay said the new laws were not targeting cyclists; they were targeting “risky behaviour”. Sh*t, I know not having a bell or horn on my bicycle is putting endless lives at risk. Without a bell, how would I ever be able to warn other pedestrians and road users that I am nearby? I should be ashamed at myself for acting with such reckless abandon. Please forgive me, Mr Gay. Oh wait, that’s right. I have this thing called a voice. You know that sound produced in a person’s larynx and uttered through the mouth, as speech or song. Yeah, that thing. NSW Police are making the world a better place catching this ruthless criminal riding with no bike helmet. Anyway, I am just sounding bitter. Surely there is a need to raise the fine for not wearing a helmet from $71 to $319, in order to match the penalty given to motorcyclists breaking the same law. It makes complete sense because we all know I am able to maintain the speed limits, while riding in the middle of heavy traffic. Oh, that’s right. It’s virtually impossible for me to match the power and speeds of a motorbike, even in the safe confines of a bicycle lane. Based on this justification, I am guessing there are some people in the NSW government that must have some powerful legs. Maybe they should sign up for the Commonwealth Games instead of worrying about making these changes to reduce “risky behaviours”. The next increase will see the fine for running a red light jumping from $71 to $425, so that it is equivalent to the penalty given to car drivers for the same offence. Seems fair, given a bicycle causes as much damage to the road infrastructure and emits as much pollution as a two-tonne vehicle. Plus, there is also the small fact that at many intersections bicycles are unable to trigger the traffic signal. It’s fine though, we will just sit there until a car comes up, so we can safely ride on. Don’t want to be partaking in “risky behaviour”. You boys were riding dangerously. Do you know what that means? No? Neither do we. There are also the dubious fines for “riding dangerously” which have increased from $71 to $425. What I want to know is precisely what constitutes “riding dangerously”. If I am facing fines of $425, it would be nice to know exactly what actions I need to avoid. In hoping to clear things up, I headed to the NSW Road Safety website for more information. Unfortunately, there are no specifics listed. I guess I just have to rely on the individual interpretations of police for what they define as riding dangerously. Seems really fair and totally justifiable. Oh, wait. This isn’t even to mention the heavy police presence expected to crack down on these laws. Don’t worry about solving crimes that are a real risk to community, you just put our tax payer money to good use and get dozens of police on the streets solving big issues, like people riding without bells. Why not let people take the risk themselves instead of babying them? And if you do need to fine people, surely there is no need to go to these extents. You should be implementing measures to get people to use alternate modes of transport, not making them scared to even leave the house. Wake up to yourself, NSW Government and get with the times. Continue the discussion on Twitter @mattydunn11 http://www.news.com.au/technology/innovation/motoring/nsw-has-introduced-ne… --------------------------------------------------------------------------------

1 0

Chertoff Group's new 28-page report on Encryption
by grarpamp 01 Mar '16

01 Mar '16

https://www.youtube.com/watch?v=6HNnVcp6NYA ---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Tue, 01 Mar 2016 12:11:18 -0800 To: cryptography(a)metzdowd.com FYI -- "The Ground Truth About Encryption, and The Consequences of Extraordinary Access" http://chertoffgroup.com/cms-assets/documents/238024-282765.groundtruth.pdf Abstract: U.S. policy makers are currently engaged in a debate regarding the merits of mandating a means of “extraordinary access” to encrypted data for U.S. law enforcement, what is sometimes referred to as an encryption “backdoor.” This paper examines modern encryption technologies, the feasibility of providing law enforcement with extraordinary access, the impact that encryption technology is currently having on U.S. law enforcement (which some have referred to as “going dark”), and the likely impacts that an extraordinary access requirement would have on U.S. national security, the technology sector, and continued innovation in the security field. We conclude that an extraordinary access requirement is likely to have a negative impact on technological development, the United States’ international standing, and the competitiveness of the U.S. economy and will have adverse long-term effects on the security, privacy, and civil liberties of citizens.

1 0