May 2016 - cypherpunks - lists.cpunks.org

Russia's "eye-watering" military toys
by Zenaan Harkness 11 Jul '17

11 Jul '17

http://journal-neo.org/2015/11/16/do-we-really-want-a-new-world-war-with-ru… Enjoyable read. Reminds me of that immortal line in the Putin documentary where the Russian navy chief points at a radar screen saying something like 'look at that, I've never seen [a destroyer class battleship] do this figure-8 move before' as the USS Donald Cook first enters then hightails out of Crimean waters. International military sparring at its best :) Z

3 5

Russia bans purchase of foreign non-niche software in Russian state agencies
by Zenaan Harkness 08 Jul '17

08 Jul '17

Import substitution applied to software... http://fortruss.blogspot.ru/2015/11/medvedev-bans-use-of-foreign-made.html Medvedev bans the use of foreign-made software in Russian state agencies Translated by Ollie Richardson for Fort Russ 20th November, 2015 novayagazeta.ru The Prime Minister of Russia, Dmitry Medevdev, has signed a decree prohibiting from 1 January 2016 the purchase of foreign-made software for state needs, reports the press service of the Cabinet. According to the document, customers will now be obliged to buy Russian-produced software. It notes that the initiative is a method of import substitution. The exception is when software has the necessary functional, technical or operational characteristics absent in Russia. To place an order on, for example Microsoft Windows, officials will have to justify the need for this operating system. As reported to "Kommersant" earlier, the official, who asked to remain anonymous, said that a German IT company began to discuss with the Ministry of economic development the possibility of a partial transfer of software production to Russia, in order thus to be able to sell it on government orders. A draft resolution was prepared and submitted by the Ministry of communications and mass communications of the Russian Federation. It was presented to Medvedev earlier in April.

4 6

Recent Numbers Station Activity COLLAPSE (GnuRadio SDR)
by grarpamp 20 Oct '16

20 Oct '16

https://www.reddit.com/r/conspiracy/comments/3oswdt/unusual_happenings_with… On SKYKING (8992 or 11175 kHz USB) a call sign called "COLLAPSE" which has not been heard since 2001 has just broadcasted 4 messages to numbered stations/units in the last few minutes. "FUXEBOX" and "Reykjavik," have also broadcast in the last few days and they haven't been heard since 1991 (collapse of the Soviet Union). "COLLAPSE" has sent 3 messages in the last few minutes. COLLAPSE message one: http://vocaroo.com/i/s1hGyA2GR6HI Collapse message Two: http://vocaroo.com/i/s1ETZ3l9fp0G Collapse message Three: http://vocaroo.com/i/s03ZI6ui70LY Message Four from "FLATTOP!" (ANOTHER STATION NOT HEARD IN YEARS!): http://vocaroo.com/i/s01smhgkyNDL We do not know what these codes mean, but it considered These are alerts to "All Stations" before the codes are sent. I did my best to record all these but missed recording "the alert phrase" where they said "All stations, all stations." This has all happened in the last half hour (0230-0304 EST). I didn't record these or write this up btw, this was a thread from 4chan that popped up on /pol/ Edit: Go here for updates http://www.defconwarningsystem.com/phpBB3/viewtopic.php?f=22&t=3269&start=30

4 4

Re: "Blackphone" said to be "a super-secure nsa-proof"
by Ulex Europae 14 Oct '16

14 Oct '16

At 05:25 AM 1/17/2014, Jim Bell forwarded: ><<http:///>http://www.yahoo.com/tech/startup-launching-a-super-secure-nsa-proof-735110…> It's been long enough, has anyone acquired one of these and tested it? Ulex

10 13

Re: [Cryptography] Bruce Schneier has gotten seriously spooked
by Eugen Leitl 07 Sep '16

07 Sep '16

----- Forwarded message from Brian Gladman <brg(a)gladman.plus.com> ----- Date: Sat, 07 Sep 2013 09:33:28 +0100 From: Brian Gladman <brg(a)gladman.plus.com> To: Cryptography Mailing List <cryptography(a)metzdowd.com> Subject: Re: [Cryptography] Bruce Schneier has gotten seriously spooked User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 On 07/09/2013 01:48, Chris Palmer wrote: >> Q: "Could the NSA be intercepting downloads of open-source encryption software and silently replacing these with their own versions?" > > Why would they perform the attack only for encryption software? They > could compromise people's laptops by spiking any popular app. Because NSA and GCHQ are much more interested in attacking communictions in transit rather than attacking endpoints. Endpoint attacks cost more to undertake, only give access to a limited amount of data and involve much greater risks that their attack will either be discovered or their means of attack will leave evidence of what they have done and how they have done it. The internal bueaucratic costs of gaining approval for (adverarial) endpoint attacks also makes it a more costly process than the use of network based interception. There is significant use of open source encryption software in end to end encryption solutions, in file archivers, in wifi and network routers, and in protecing the communications used to manage and control such components when at remote locations. The open source software is provided in source code form and is compiled from source in a huge number of applications and this means that the ability to covertly substitute broken source code could provide access to a huge amount of traffic without the risks involved in endpoint attacks. I stress that I am NOT suggesting that this has happened (or is happening), simply that it has attractions from an NSA/GCHQ viewpoint. Fortunately, I think it is a difficult attack to mount covertly (that is, without the acqiecience of the author(s) of the software in question). On the more general debate here, in my view, 'security for the masses' through the deployment of encryption is a 'pipe dream' that isn't going to happen. Functionality (and the complexity that comes with it) is the enemy of security and it is very clear that the public places a much higher value on functionality than it does on security (or privacy). Every time a new device comes onto the market, it starts with limited functionality and some hope of decent security but rapidly evolves to be a high functionality product in which the prospect of decent security declines rapidly to zero. Raspberry Pis look interesting _now_ but I would be willing to bet that they won't buck the trend of increasing funtionality and declining security simply because this is what the majority in even this limited user community will want. To buck this trend we need an effort like the Raspberry Pi effort but one driven by our community with a strong commitment to simplicty and deliberately limited functionality in both hardware and software. Brian Gladman _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

8 14

Re: [liberationtech] Interesting things in keyservers
by Eugen Leitl 17 Aug '16

17 Aug '16

----- Forwarded message from micah <micah(a)riseup.net> ----- Date: Sat, 20 Jul 2013 10:05:42 -0400 From: micah <micah(a)riseup.net> To: Micah Lee <micahflee(a)riseup.net>, 'liberationtech' <liberationtech(a)lists.stanford.edu> Subject: Re: [liberationtech] Interesting things in keyservers User-Agent: Notmuch/0.15.2 (http://notmuchmail.org) Emacs/24.3.1 (x86_64-pc-linux-gnu) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> Hi Micah! Micah Lee <micahflee(a)riseup.net> writes: > I'm working on a talk for OHM2013 about PGP. Can anyone send me examples > of interesting keys in key servers that you know of? Since you are preparing a talk about the subject, I'm going to be pedantic and correct your usage of "PGP", because it is important to get your terminology straight when giving a talk. I presume you aren't giving a talk about the commercial software, but instead you are actually giving a talk about OpenPGP which is the standard specified by RFC4880 that different programs like GnuPG, Seahorse, MacGPG, and PGP etc. all implement. If that is true, then you should refer to it as OpenPGP, and not PGP. I dont know what your talk will consist of, besides the funny enigmail XSS and goatse.cx stuff (thanks for that! always good to have some goatse early in the morning), but I would like to point out a few things that might be useful to mention. One is a wiki page that I created with some people: https://we.riseup.net/riseuplabs+paow/openpgp-best-practices - it contains some useful hints about using OpenPGP, maintaining a good key and some general good practices that people often dont know about (such as the importance of keeping your keys updated to get critical revocation and expiration extension certifications!) One thing mentioned on that page that I wanted to highlight, because you used pgp.mit.edu links in your original email, is that the keyserver pgp.mit.edu is not a good one to use/promote. Everyone uses it as their 'goto' keyserver, but it is a really bad idea! As a keyserver, it has been broken for years. For a long time it was just dropping revocations, subkey updates and expirations on the floor. That is *really* bad. Eventually, they upgraded their keyserver software, but it is *still* running an older version of SKS, a version that fails to handle 16-digit subkeyid lookups (among other failings). So, please don't rely on pgp.mit.edu for your security, and please don't include them in your slides! If you are looking for one to use, I highly recommend using the SKS pool address (hkp://pool.sks-keyservers.net or http://hkps.pool.sks-keyservers.net/ - or if you want a more close geographical pool, have a look at http://sks-keyservers.net/overview-of-pools.php) Finally, there seems to be some amazing misconceptions about keyservers, keys and the web of trust. In particular this http://cryptome.org/2013/07/mining-pgp-keyservers.htm circulated recently and it pained me to see because it suggested various wreckless conclusions that were dangerously off the mark[0] (and used pgp.mit.edu, hah). While it is true that we've jokingly called the OpenPGP web of trust "the original social network" because of the exposed social relational graphing that can be done by querying keyservers, and it is for this reason that many activists I know do not want to have signatures uploaded to keyservers (and instead use the bulky local-only signature work-around)... ... but for some reason people seem to think that if it is on a keyserver, is true, or it means something that it doesn't. People don't realize critical things, such as the fact that I can create a key with the UID Nadim Kobeissi and upload it to the keyservers[1]. That doesn't mean that is the real Nadim's key (this is what exchanging key fingerprints and doing certifications is for, so you can know, with a certain degree of certainty, that this person is the person who controls that secret key material). Or people think that because I signed your key and that signature is on the keyserver that indicates: I trust you; we met in person at that date; we know each other; we are involved in a criminal conspiracy with each other; or many other wrong assumptions about what that certification means. I can sign Edward Snowden's key and send that to the keyservers[1]. Hell, I can sign Snowden's key with my fake Nadim Kobeissi key[1] and then send it to the keyservers. Does that mean that Nadim and Snowden have met in person?! No, it does not at all. Anyways, I can keep going... but I dont know what the focus of your OHM talk is about, so going on like this isn't particularly useful to you and your talk... however, I'd be happy to provide more feedback about your talk if you would like![2] After all, we Micahs need to stick together, micah 0. "the cryptome article just sounds like impenetrable bullshit from someone with no interest in actually understandning what's happening" - I'm not saying who said this... 1. no, I didn't do that, nor did I upload the edward snowden or bradly manning keys. -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

4 3

US drug policy -> maintains the class divide
by Zenaan Harkness 16 Aug '16

16 Aug '16

>From a comment on slashdot - I'm not American, but this sounds quite plausible to me: http://news.slashdot.org/story/15/11/27/1343243/lsd-microdosing-gaining-pop… " If you're a $100k/yr engineer (Score:4, Insightful) by rsilvergun (571051) on Friday November 27, 2015 @10:52AM (#51013395) such things don't apply. In America we have a multi-tiered justice system. It's pretty well documented. Wealthy and educated people get treatment programs, while poor (and let's face it, black) people get jail. It's because what we're really using our drug policy for is to keep the poors in check. Think of it this way. If your poor chances are you or one of your friends is using drugs to cope with poverty. Now, our drug laws, in particular our asset forfeiture laws are basically guilt by association. Combine that with juries that are inherently conservative (since you generally have to be well off to be able to afford to server on a jury for any length of time). So when poor people show up in wealthy neighborhoods they not only stick out like a swore thumb, but odds are good the cops can bust them for the drugs at least one of them is carrying. This keeps poor people out of wealthy school districts and parks, and lets the wealthy enjoy their (much, much better) public services. Basically, our drug policy is central to maintaining our class divide... "

3 3

Re: [onioncat] Onioncat v2
by grarpamp 16 Aug '16

16 Aug '16

On 3/8/16, Bernhard R. Fischer <bf(a)abenteuerland.at> wrote: > "Do we want to keep this nice automatic IPv6/Onion-ID translation feature?" > > If NO: > There's no problem. Everybody can setup his own hosts-file for the > translation. > > If YES: > Independent of the final solution there is a need for a > lookup-database/service of any kind. This goes to two things... - the usage models you expect - the usage models you want to enable Let's keep in mind that the fundamental strengths of onioncat and reason that it exists are... - tor and other anonymous overlay networks often do not support full IP semantics, with tor it's TCP only, which cripples or eliminates certain apps. - anonymous overlay networks often do not support interfaces to the traditional IP stack of OS's, with tor it's onion only, which you can't bind(2) to, except via hack within the tor daemon... which only does tcp, which doesn't route, or packet filter, or VM, or... "NO" ... well, that's fine for individual people who meetup elsewhere and personally agree to exchange keys and addresses (or find such listed on the web, etc) in order to communicate. It scales only to the extent one can personally manage it, and it is not oppurtunistic as far as making random new introductions. "YES"... this is where the real potential lies. Lots of apps are p2p, or at least rely on central servers to tell them of their peers in real time. Bitcoin and bittorrent are purely p2p with peers coming in via the network itself at random. VOIP could be thought to be central yet random. This list of non-manual config apps is really long. Then evaluate which are popular in the opensource space whereby they're possibly not run by popular centrals like facebook, but by community (XMPP), or strictly p2p. It seems that NO would still serve a purpose and thus would be a call to making an onioncat v2. And that YES would be a very interesting project that needs to look at many potential solutions some of which people post ideas about on list. > IMO we should use an existing database and we should not try to Yes if it is available, or willing to be developed and integrated by the overlays for such use. > establish a new system because this depends always on people willing to > run these. For example, it may be possible that the [transmission] bittorrent, and cryptocoin, communities might see a reason to run something separate if it gave them p2p access to anonymous transport layers. > I do not know about the userbase of OnionCat but we should > assume that it is small, hence, not (yet) able to keep enough Onioncats > up for running a DB (DHT or whatever). Public usage is all in supply, demand, and advertising. Private usage has seen some successful onion/i2p like what.cd [nee i2p/onion] membership. Evaluating the needs of some VOIP and messaging protocols re IPv6 UDP and tun interface might be useful. We already know bittorrent needs udp and trackerless p2p to be efficient. Another way to think is... can the overall utility of anonymous overlay networks ever grow if they continue to be restricted to, say, TCP and their own proprietary addressing stacks? Are there RFC type proposals to interoperate / expand that among the community of overlay networks? And is onioncat a good place to enable that if either are no?

2 2

What happened to Pond?
by grarpamp 10 Aug '16

10 Aug '16

"*Pond is in stasis*, and has been for several years. I hope that some of the ideas prove useful in the future, but people should use something [better polished and reviewed](https://whispersystems.org). I've no plans to shutdown down the default server, but **new users should look elsewhere**." -- agl@github

5 8

Fwd: [ PFIR ] The "Sharing Economy" Is the Problem
by Zenaan Harkness 22 Jul '16

22 Jul '16

Perhaps this is worth discussion. Are AirBnB, Uber and Homejoy examples of political anarchism (degenerate or otherwise)? Are we seeing the ultimate in self responsibility (I would say self responsibility is a good thing)? How might we embrace such self responsibility, whilst also manifesting collective empathy/ shared 'responsibility' (perhaps there's a better term here)? Is Lauren Weinstein with his indenting style actually Juan in disguise? Or is it in actual fact the other way around? Z ---------- Forwarded message ---------- From: "PFIR (People For Internet Responsibility) Announcement List" <pfir(a)pfir.org> Date: Wed, 9 Dec 2015 09:48:40 -0800 Subject: [ PFIR ] The "Sharing Economy" Is the Problem To: pfir-list(a)pfir.org The "Sharing Economy" Is the Problem http://www.truth-out.org/opinion/item/33720-the-sharing-economy-is-the-prob… It's unfortunate then that these companies and the misnamed "sharing economy" are really just fronts for millionaires and billionaires to opportunistically ride off the backs of everyday people, while also exacerbating many economic inequalities. Avi Asher-Schapiro explains the truth in Jacobin: The premise is seductive in its simplicity: people have skills, and customers want services. Silicon Valley plays matchmaker, churning out apps that pair workers with work. Now, anyone can rent out an apartment with AirBnB, become a cabbie through Uber, or clean houses using Homejoy. But under the guise of innovation and progress, companies are stripping away worker protections, pushing down wages, and flouting government regulations. At its core, the sharing economy is a scheme to shift risk from companies to workers, discourage labor organizing, and ensure that capitalists can reap huge profits with low fixed costs.

6 5