June 2016 - cypherpunks - lists.cpunks.org

MUA 'new email' User-Agent email header field - suggestions and questions
by Zenaan Harkness 09 Jun '16

09 Jun '16

I know, I know, this is wildly off topic for this list, but I dare to ask: Dear Dolly, I note that many punky punks round these parts use their MUA du journk, yet happily advertise (of course falsely) their MUA User-Agent name and version (due to the default header config which does as much). Of course everyone round these parts is perfectly aware of such matters and has long ago manually modified such string to discretely lead any would be infiltrator astray. Such significant information so many people give away, "presently company excluded" of course... :) So, can anyone tell me of known spam filters or "outright rejection" filters in any known mail server configurations/ setups, which would reject an email header such as: User-Agent: Could be mutt but fucked if I'm telling you. Is it better to simply not include such a header? Or is it better to do the sly "make it look genuine but it's not" number? Better is a purely objective assessment of course with no rune for alternative threat models or other subjective quasi quagmires... Confused, Z P.S. Thank you my gracious and all knowing lords of the crypto best practices paddfock. May we romp in freedom with daisies to save the world, as I've heard love and light is all powerful and will save us all.

4 5

Re: [tor-talk] Freedom of the Press Foundation - Statement on Jacob Appelbaum
by Александр 09 Jun '16

09 Jun '16

> > https://freedom.press/blog/2016/06/statement-jacob-appelbaum > In light of the allegations that have been made, Jacob Appelbaum is no > longer a member of our outside volunteer technical advisory board. We hope > that the serious accusations made against him, and his denial of them, are > resolved as fairly and as expeditiously as possible.... > yeah. and in the meantime, we will treat Appelbaum as if he IS ALREADY convicted.... as if he IS ALREADY a serial rapist -> and throw him from his position = reject him from our community, this way showing everybody our "neutrality/objectivity" (not talking about showing Appelbaum himself, a respectful member, some kind of "support", before proven otherwise!) Yeap, lets show one more time that a man can work all his life to build his reputation and to help the world in so many ways... and some f*ckers can ruin it in one week, by creating an amateur smear campaign with anonymous and saaad stories. Well done, puppets.

1 0

Fwd: [offlist trollbait] Re: cryptographically-provable anonymity
by Rayzer 09 Jun '16

09 Jun '16

-------- Forwarded Message -------- Subject: Re: cryptographically-provable anonymity Date: Tue, 7 Jun 2016 15:49:04 -0300 From: juan <juan.g71(a)gmail.com> To: rayzer(a)riseup.net > come on rayzer, be 'transparent' like your buddies from the > pentagon and publish your gov't sourced income Juan... I gave you MORE than enough metainfo about me to figure out who or what I am. You've got my approximate age (teen in the 60s) The city I was in in the late 60s The damning fact that the NYPD stalked me and went after my dad's security clearance! That alone ought to be enough to get my jacket out of cold storage. On 06/07/2016 11:46 AM, juan wrote: > Sure. Because a marxist clown like you says so. You pegged me Juan... I'm a Groucho Marxist, and a John Lennonist

2 5

The cheap low risk node majority attack, pki, geoip, etc
by grarpamp 09 Jun '16

09 Jun '16

On 6/6/16, Steve Kinney <admin(a)pilobilus.net> wrote: > Since nobody asked, here's a description of why neither TOR nor any > other existing or presently planned anonymizing protocol I know of can > be relied on to conceal a user's identity from the Five Eyes or any of > several other hostile actors. I surface this concept every year or > so, but so far nobody seems interested in discussing it. Maybe it's > just too discouraging to think about. No matter who created it or > why, TOR and similar mix networks are at best security theater, > relative to top tier State adversaries. > > what if an effectively unlimited number of compromised routers, > subject to realtime observation and internal manipulation, were > available to hostile actors? Game over, I think. > > About 15 years ago I used online traceroute utilities and whois > lookups to determine (roughly) where all the high performing Mixmaster > remailers were physically located. Over half of them, including most > with "exotic sounding" TLDs, were apparently in the state of Texas. > > Then I used my data to construct "hard to compromise" chains, routing > Mixmaster messages through national jurisdictions not likely to have > comprehensive data sharing between their security services, and > started sending test messages. None of these test messages ever made > it back to me. > > So I concluded that, despite its major technical superiority to other > anonymized networking protocols, the Mixmaster network was most likely > compromised by passive observation (one owner for a majority of > reliable remailers) and active intervention (traffic between > uncontrolled remailers interrupted in transit). > > Owning enough of the routers in an anonymizing network to negate its > security is largely a question of money: How much budget to you have, > how certain do you want to be that nobody is really anonymous? While money can buy shill humans to stand in, as below, it's costly, and casual human interactions by multiple signers reviewing them may expose them to risk. > proxy hosts could be machines owned by "friendly" actors, rooted > consumer grade routers, purpose built appliances, conventional Windows > botnets or some combination of these. Govt seems to have no issue doing such illegal / unethical things. And they certainly can use their own network, tor, to do it. > The only defense I can think of is to assure that message traffic > passes back and forth between mutually hostile national jurisdictions > before delivery. This is suggested often on tor-talk. And tor devs continually pass on it. > This would be a bit of a hairball to implement Not really. Tor already loads GeoIP. So 20 or so lines of code and you've got a separate country for each hop. A few more lines to define groups like FVEY / BRICS, hemispheres, regions, AS, etc. Users could isolate on whatever they wanted. And a bunch more lines to include attributes as to "verified to be a human node operator in person" pki web of trust into the consensus. At least that way it raises the cost and risk to adversaries who today just use their Govt credit card to order up VPS nodes all over the world. Does it benefit? Tor devs say trust the random node selection. Others say at least some subset of users know the / their environment better and could use such tools to advantage. Tor still refuses to do it. So like mixmaster, you have to do it yourself. That sucks. It could stand to be talked over a bit more. > have to be taken into account. But this approach could increase the > cost and reduce the reliability of Hydra attacks against anonymizing > Long story short: If you want to be /really/ anonymous in the > presence of hostile State sponsored actors, do not rely on a > software-only approach: Use physical security measures to conceal > your identity from the physical router that connects you to the > Internet > No "airtight" security protocol has ever survived contact > with end users. password:12345, lol.

6 19

Re: [private] Re: [tor-talk] http://jacobappelbaum.net/
by Александр 08 Jun '16

08 Jun '16

Unambiguous and comprehensive response from Jacob Appelbaum himself to all this dirty slander toward him! If this kind of response "does not enough" for you, people, - just go fuck yourself. http://www.twitlonger.com/show/n_1soorlp Jacob Appelbaum · @ioerror 6th Jun 2016 from TwitLonger Berlin, June 6, 2016 In the past few days, a calculated and targeted attack has been launched to spread vicious and spurious allegations against me. Given the way these accusations have been handled, I had little choice but to resign from my position as an advocate at the Tor Project and devote my full attention to completing my doctoral work on cryptography at the Technical University of Eindhoven. Vague rumors and smear campaigns against me are nothing new. As a longtime public advocate for free speech and a secure internet, there have been plenty of attempts to undermine my work over the years. Now, however, these unsubstantiated and unfounded attacks have become so aggressive that I feel it’s necessary to set the record straight. Not only have I been the target of a fake website in my name that has falsely accused me of serious crimes, but I have also received death threats (including a Twitter handle entitled ‘TimeToDieJake’). I think it’s extremely damaging to the community that these character-assassination tactics are being deployed, especially given their ugly history of being used against fellow members of the LGBT community. It pains me to watch the community to which I’ve dedicated so much of my life engage in such self-destructive behavior. Nonetheless, I am prepared to use legal channels, if necessary, to defend my reputation from these libelous accusations. I want to be clear: the accusations of criminal sexual misconduct against me are entirely false. Inevitably, there may have been moments in my professional or private life when I may have inadvertently hurt or offended others’ feelings. Whenever I was aware of these instances, I have, and will continue to, apologize to the friends and colleagues in question and to continually learn how to be a better person. Though the damage to my reputation caused by these allegations alone is impossible to undo, I nonetheless take the concerns of the Tor community seriously. To dispel any further rumors, to the best of my knowledge, the Tor network is not ‘compromised.’ I’ve dedicated my life as a journalist, activist, and longtime member of the Tor Project to advocating for the transparency of public processes and to speaking out about the necessity of privacy, security, and anonymity. These are ideals that I will continue to uphold, despite the vicious campaign that is currently being waged against me. Jacob Appelbaum · @ioerror

9 24

Re: [tor-talk] Has anyone HEARD from IOError since his last tweet?
by grarpamp 08 Jun '16

08 Jun '16

On 6/6/16, juan <juan.g71(a)gmail.com> wrote: > The accussations are false, yet he leaves the oh so amazing tor > project, AND his own bosses throw him under the bus? > > https://blog.torproject.org/blogs/ssteele > > Something doesn't add up. Perhaps the adversary grew weary / wary of its useful idiot. Perhaps the useful idiot was too pure / against the system, which itself just went through a change of its own guard. Perhaps the useful idiot discovered a secret. The system is mind control. Yet within the mindless babble of idiots lies a certain insight. Listen to them.

2 2

Re: [tor-talk] CULT OF THE DEAD COW Statement on Jacob Appelbaum / ioerror
by grarpamp 08 Jun '16

08 Jun '16

On 6/7/16, juan <juan.g71(a)gmail.com> wrote: > > cult of the clown cow vomited : >> [chunks] > Just in case somebody out there hasn't yet realized what kind > of 'collective' fraud the 'hacker' 'community' is. > > The 'hacker' 'community' is actually a bunch of posseurs and > intellectual frauds, slightly more knowledgable than script > kiddies and fully aligned with the US establishment. > > >> We understand the >> complicated relationship we all have with law enforcement, > > as in, "we are a bunch of sell outs" Sellouts, rats, and snakeoil... LoL... now that's closer ontopic cpunk than all this ioerror interpersonal bs... With Tangent, Ratte, L0pht as grand IPO brokers and VC money. DEFCON's coming up, better buy your tickets. And wear your shades. > If the most extreme >> of these allegations are true, they should be addressed in a court of >> law, and dealt with appropriately. Word.

1 0

GNU's "anonymous-but-taxable electronic payments system" Heh.
by Robert Hettinga 06 Jun '16

06 Jun '16

<http://www.theregister.co.uk/2016/06/06/gnu_cryptocurrency_aims_at_the_main…> The Register GNU cryptocurrency aims at 'the mainstream economy not the black market' GNU and an outfit called “Inria” have released Alpha code – version 0.0.0 to be precise – of an anonymous-but-taxable electronic payments system they say is “a currency for the mainstream economy, and not the black market.” “Taler”, as the effort is dubbed, looks to be an attempt to build on the concepts behind Bitcoin. So while Taler lets you use encrypted “coins” as a means of exchange, it is explicitly not a new currency. Instead, it “... uses an electronic exchange holding financial reserves in existing currencies.” “This means that Taler is not a new currency with the inherent currency fluctuation risks, but instead the cryptographic coins correspond to existing currencies, such as US Dollars, Euros or even BitCoins.” The technology is also designed to be open enough that governments can peer inside, levy “sales, value-added or income taxes”. As a GNU project, the code is of course freely-available. For now, the effort is in its very early stages. GNU even warns, in the announcement of the project's debut, that “There is no auditor, and hence components do not properly support auditors either. As a result, a dishonest exchange could embezzle funds.” There's also no real-world integration at present, “so only toy currencies are available for now.” If you're interested regardless of those foibles, the 0.0.0 code does include “key components providing logic for running a bank, exchange, merchant and wallet.” That code is described as follows: • Exchange implements the full Taler protocol, but does not integrate with traditional banking systems (only with Taler's own "bank"). • Wallet can withdraw and spend coins, but does not yet handle refreshing, refunding, synchronizing, or export of cryptographic proofs. Some error handling may be insufficient. The wallet was only tested with Chrome/Chromium. • Merchant backend can generate contracts and handle payments, but does not yet offer full back-office support for tracking payments received. Frontend examples are available in Python and PHP. • The bank can manage accounts, allows the wallet to withdraw funds and can receive payments from the exchange. Inria and GNU hope to have more advanced versions of Taler to share by year's end. When they do, it may well be game on in the cryptocurrency space: Taler's already used fighting words with its “mainstream, not black market” talk. Bitcoin's many admirers may take offence at that kind of language and point to strong adoption. Sceptics can point to security woes among Bitcoin exchanges, governance woes and the cryptocurrency's volatility as evidence that different approaches to electronic currencies probably won't hurt their evolution. ®

3 2

Re: [tor-talk] Has anyone HEARD from IOError since his last tweet?
by Александр 06 Jun '16

06 Jun '16

Unambiguous and comprehensive response from Jacob Appelbaum himself to all this dirty slander toward him! If this kind of response "does not enough" for you, people, - just go fuck yourself. http://www.twitlonger.com/show/n_1soorlp Jacob Appelbaum · @ioerror 6th Jun 2016 from TwitLonger Berlin, June 6, 2016 In the past few days, a calculated and targeted attack has been launched to spread vicious and spurious allegations against me. Given the way these accusations have been handled, I had little choice but to resign from my position as an advocate at the Tor Project and devote my full attention to completing my doctoral work on cryptography at the Technical University of Eindhoven. Vague rumors and smear campaigns against me are nothing new. As a longtime public advocate for free speech and a secure internet, there have been plenty of attempts to undermine my work over the years. Now, however, these unsubstantiated and unfounded attacks have become so aggressive that I feel it’s necessary to set the record straight. Not only have I been the target of a fake website in my name that has falsely accused me of serious crimes, but I have also received death threats (including a Twitter handle entitled ‘TimeToDieJake’). I think it’s extremely damaging to the community that these character-assassination tactics are being deployed, especially given their ugly history of being used against fellow members of the LGBT community. It pains me to watch the community to which I’ve dedicated so much of my life engage in such self-destructive behavior. Nonetheless, I am prepared to use legal channels, if necessary, to defend my reputation from these libelous accusations. I want to be clear: the accusations of criminal sexual misconduct against me are entirely false. Inevitably, there may have been moments in my professional or private life when I may have inadvertently hurt or offended others’ feelings. Whenever I was aware of these instances, I have, and will continue to, apologize to the friends and colleagues in question and to continually learn how to be a better person. Though the damage to my reputation caused by these allegations alone is impossible to undo, I nonetheless take the concerns of the Tor community seriously. To dispel any further rumors, to the best of my knowledge, the Tor network is not ‘compromised.’ I’ve dedicated my life as a journalist, activist, and longtime member of the Tor Project to advocating for the transparency of public processes and to speaking out about the necessity of privacy, security, and anonymity. These are ideals that I will continue to uphold, despite the vicious campaign that is currently being waged against me. Jacob Appelbaum · @ioerror

2 1

Re: [tor-talk] A possible solution to traffic correlation attacks,
by grarpamp 05 Jun '16

05 Jun '16

On 6/5/16, Not Friendly <notfriendly(a)riseup.net> wrote: > After about an hour of brain storming I may of found a way to stop traffic > correlation attacks. The idea is to add an artificial delay of a few > randomized ms (two separate delays, one to the tor exit and another deal on > traffic exiting the network) and add an extra chunk of randomized data (just > a small random amount of KB that never exits the network). It would make > traffic harder to correlate. What are your thoughts on this? Doesn't work. "never exits" - GPA's don't necessarily need to correlate any internal flows. They can look only at the endpoints. The minute you insert traffic that lights up some other endpoint, in an otherwise sufficiently quiet network, or distinguishable way (bytes / latency [pump], which is made even easier for them if they reign over an endpoint), you're done. You need fulltime regulated fill traffic, within which, your traffic resides.

1 0