March 2016 - cypherpunks - lists.cpunks.org

blockchain startup
by dan＠geer.org 18 Mar '16

18 Mar '16

Good team... Freemit (New York City, NY) http://www.freemit.com Freemit is creating an alternative to current remittance and currency exchange systems. It uses the blockchain and a local currency in/local currency out service, along with a phone app and virtual credit card, to simplify and streamline cross-border money transfers.

3 2

Apple GovtOS/FBiOS & Proof of Work
by grarpamp 18 Mar '16

18 Mar '16

---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Thu, 17 Mar 2016 17:39:22 -0700 Subject: [Cryptography] Apple GovtOS/FBiOS & Proof of Work To: cryptography(a)metzdowd.com If Apple is willing to put some serious Proof of Work into constructing *every* firmware update, then it could achieve some level of privacy: When constructing a firmware update, the SHA512 (or better still, some Apple proprietary) hash of the update has to have some preset number of '0' bits. So Apple will have to brute force fiddle with bits in the firmware load to achieve an appropriate hash. The work involved should grow exponentially in the # of '0' bits required. Most companies operate on a fixed update schedule, so Apple would have to plan every release far enough in advance to give Apple enough time to compute such a firmware load. The reason for an Apple proprietary hash is so any attacker would have to build their own custom chips to be able to beat Apple at this Proof of Work game. Note also, that Apple can *change* the hash function on every firmware update, so said custom chip would be useful for only one firmware release. The firmware loader of course refuses to load any firmware whose hash doesn't have the appropriate number of '0' bits (along with the standard Apple signing key checks, etc.). The hash also incorporates the previous firmware load a la Merkle, so if your firmware is ever compromised, your iPhone is forever bricked. The hardware loading code refuses to load the first block of the new firmware anywhere but right on top of the user's file encryption key. So the *default* for the firmware flasher is to always *forget* this key, unless very special arrangements are made to save this key in other places. This key is further encrypted and broken into many pieces prior to moving it out of the way of the firmware loader (including into the CPU's volatile register memory, so any power disruption will destroy some of this key). Of course, much like a password hashing function, such Apple hash functions would be designed specifically to be *slow*, so GPU's and gate-arrays would be of no particular value. With a proper PoW system, any attacker would have to spend at least as much time as Apple themselves to create a loadable firmware, and that time might be as long as 6-12 months. A scalable way for Apple to dominate any attacker (including most nation-states) is to utilize the *entire installed base* of Apple products (estimated by Tim Cook to be >1 billion devices) in a distributed calculation. Thus, Apple could use its "herd" itself to provide for "herd immunity" to firmware update attacks. iPhone users would notice if Apple were attempting to compute >1 firmware update PoW at any given time! A 6-12 month lead time (during which the PoW for GovtOS is being computed) would give Apple plenty of time to respond to any legal issues and warn other Apple customers of an impending breach-of-trust in the firmware update chain. If Apple is issued an NSL and can't talk about it, 6-12 months would still be a long enough delay to deter all but the most persistent of govts. Even Napoleon refused to look at any messages until they were at least 3 days old; he found out that 99% of these messages resolved themselves without any action on his part -- e.g., "please pardon my son; he is to be executed in the morning". If Apple speeded up or slowed down its pre-announced firmware update schedule, that change itself would provide an excellent "warrant canary". <Apple: please reference this public email in your patent applications. Thx! -- Henry Baker> _______________________________________________ http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

Re: [tor-talk] Latency Spike
by grarpamp 18 Mar '16

18 Mar '16

On 3/17/16, poly <poly(a)darkdepths.net> wrote: > Could anyone please explain the reason behind this spike [0] to me? > > [0] https://metrics.torproject.org/torperf.png?start=2015-12-18&end=201 > 6-03-17&source=all&filesize=50kb That's the NSA giving you the finger...

1 0

Philosohpical - Reading between the lines: the Great War of Continents, information wars, and multipolarity
by Zenaan Harkness 17 Mar '16

17 Mar '16

Speaking of agendas, of course we each tend to see the world, the struggles of the day, through particular lenses, preferences, agendas etc. This philosophical piece has an image which could make a great desktop background - but more importantly may help remind some (such as I) to take note of the breadth of viewpoints/ agendas from which we may couch any events of the day. Perhaps you might enjoy it too. http://fortruss.blogspot.ru/2015/11/reading-between-lines-great-war-of.html Regards, Zenaan

2 2

Ladar Levison Describes USG Abuses in USG v. Lavabit
by John Young 17 Mar '16

17 Mar '16

Ladar Levison Describes USG Abuses in USG v. Lavabit http://www.metzdowd.com/pipermail/cryptography/2016-March/028669.html Precursor to USG-Apple abuses.

1 0

Re: [Cryptography] Govt Can't Let Smartphones Be 'Black Boxes, ' Obama Say
by grarpamp 17 Mar '16

17 Mar '16

On 3/15/16, Phillip Hallam-Baker <phill(a)hallambaker.com> wrote: > On Sat, Mar 12, 2016 at 8:23 PM, Ray Dillinger <bear(a)sonic.net> wrote: > >> It would be a damned sight easier to take a view that allowed >> exceptional access with warrants, etc, if in the past the USG >> had abided by the notion that such access is in fact exceptional >> rather than routine, and needs to be provided for with warrants, >> etc. > > PRISM and the mass surveillance program violated our norms, no > question. But these were not a surprise to anyone who had been paying > attention. The big surprise for me was the Abu Ghraib photographs. Any > way you consider them, the photographs demonstrate a total collapse of > the moral fabric of the US military. And to this day, nobody has been > punished for committing the torture. The only jail sentences handing > down was for taking the photographs which led to the program being > exposed. Governments always absolve and immunize themselves (and their partners), particularly at the highest levels. Torture, Murder, Surveillance, Drone Kills, Cops Killing, Political Lies, Too Big To Fail, Generally Fucking Shit Up, etc... all typical. The only time they're stopped, indicted, prosecuted, and jailed is when they're failed / overthrown, invaded, or both. In the meantime till people wake up... they've come up with this cool thing called elections to make you forget and think the guard has changed... it hasn't... the same old game. Don't believe it? Ask History. Some history and deja vu... https://en.wikipedia.org/wiki/Church_Committee#Results_of_the_investigation https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Cabinet_noir http://history.howstuffworks.com/historical-events/10-long-lived-empires.ht…

2 2

USG v. Lavabit-Snowden Files Unsealed
by John Young 17 Mar '16

17 Mar '16

USG v. Lavabit-Snowden Files Unsealed: https://cryptome.org/2016/03/usg-lavabit-unsealed.pdf (560 pp, 140MB) Precursor to USG v. Apple.

1 0

Re: [Cryptography] Lavabit's and Snowden's Solos
by John Young 16 Mar '16

16 Mar '16

Ladar Levison challenges USG misuse of Lavabit case: https://www.facebook.com/KingLadar/posts/10156714933135038

2 1

Apple Reply to USG Opposition to Vacate Decrypt
by John Young 16 Mar '16

16 Mar '16

Apple Reply to USG Opposition to Vacate Decrypt, March 15, 2016 https://cryptome.org/2016/03/usg-apple-177.pdf (351 pp, 22MB)

1 0

Intelius opt-out
by Michael Best 15 Mar '16

15 Mar '16

Should make it harder to find you by searching, at least in the U.S. https://www.intelius.com/optout If you trust them. FWIW. -- Veritas aequitas liberabit vos Veri universum vici That 1 Archive <http://that1archive.neocities.org/> @NatSecGeek <https://twitter.com/NatSecGeek>

3 2