June 2016 - cypherpunks - lists.cpunks.org

message from tor brownshirt griffin boyce
by juan 24 Jun '16

24 Jun '16

Begin forwarded message: Date: Wed, 22 Jun 2016 15:46:05 -0400 From: Griffin Boyce <griffin(a)cryptolab.net> To: undisclosed-recipients:; Subject: tor-talk subscription update -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 To whom it may concern, You have been removed from the tor-talk mailing list for persistent off-topic posts and I encourage you to spend your time elsewhere. Do not re-subscribe to the list. best of luck, Griffin - -- “We have to create; it is the only thing louder than destruction.” ~ Andrea Gibson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJXaup/AAoJEAPPSgqzx5pjRBAH/jtlRw70yVDL9d62mgHPA3uo fiab3QDDjw04tKMbEGqwGEEHpOKn3nP6bynxGiwUi2Xsp7f3HHi1UD7c79n9cFsp RHqRNpYvLP81eABIpcany0Z2mmI9uVZs0ccirVMcq3YK10ADtG7zYujl6KBgCDWl M6FGWnmLEFa8vw24ia+6lEukARJ2nXTIFMrDisfbQ7bkJFSHaGGsenuy66yde2zS uECH1C/98f5RtZDv7NJJtTebbAPZMSnBQVYU3//ossTG7OFI60EPYAPH3xPdpS3/ zuocWagHiL1KYvqkoxCm3qWv7k9c7CvUhEJXgy4dhGQEljDdu3UsVsV8PPheDcM= =lKWK -----END PGP SIGNATURE-----

6 13

US Federal Court: The Fourth Amendment Does Not Protect Your Home Computer
by grarpamp 24 Jun '16

24 Jun '16

https://www.eff.org/deeplinks/2016/06/federal-court-fourth-amendment-does-n… https://www.eff.org/files/2016/06/23/matish_suppression_edva.pdf https://yro.slashdot.org/story/16/06/23/2040255/federal-court-the-fourth-am… The EFF reports that a federal court in Virginia today ruled that a criminal defendant has no "reasonable expectation of privacy" in his personal computer (PDF), located inside his home. The court says the federal government does not need a warrant to hack into an individual's computer. EFF reports: "The implications for the decision, if upheld, are staggering: law enforcement would be free to remotely search and seize information from your computer, without a warrant, without probable cause, or without any suspicion at all. To say the least, the decision is bad news for privacy. But it's also incorrect as a matter of law, and we expect there is little chance it would hold up on appeal. (It also was not the central component of the judge's decision, which also diminishes the likelihood that it will become reliable precedent.) But the decision underscores a broader trend in these cases: courts across the country, faced with unfamiliar technology and unsympathetic defendants, are issuing decisions that threaten everyone's rights.

1 0

Salty 4.0 released 40 years to the day after Diffie-Hellman algorithm invented
by Carlos Rodriguez 24 Jun '16

24 Jun '16

Salty is a nodejs-powered CLI-based alternative to PGP/GPG using NaCl instead of RSA/DSA. There is a GUI in progress. Commits and tags in the Salty repo (and this announcement) are signed with GPG key 5FBB 2F98 3862 1AFF. Features • NO 3rd parties (peerio), NO p2p network (PRISM-safe, usable on airgapped machines), NO browser js (it’s not safe!), NO exotic/compiled deps (goodbye openssl vulns), no Comodo SSL (CloudFlare), and NO shady corporations (Virgil Sec). PERIOD. • general purpose CLI, lightweight library attached • audited, bundled dependencies - no install scripts or backdoors • supports anonymous-sender or signed/verified messaging • sharable pubkey string that can fit in a single tweet • does NOT use your ssh keys, pgp keys, or anything RSA • encrypt public key is always ephemeral - does NOT leak metadata • sender identity is deniable, unless they explicitly commit to sign the message • file length hidden with padding • public signing/verifying with detached signatures • binary or “ascii armor” PEM output • import/export your wallet folder - PEM encoded and secretboxed with Scrypt KDF • (new in 3.1) can use anonymous private Github gists to remotely store salty messages • (new in 3.1) full tar/gz support for encrypting/decrypting directories (supports symmetric or asymmetric cipher) • MIT-licensed — How is this better than PGP? This is a step-by-step rebuttal to [secushare](http://secushare.org/PGP)'s arguments against the PGP model, and how [Salty](https://s8f.org/salty.html) tries to make things right again. ### 1. Downgrade Attack: The risk of using it wrong. Unlike PGP, Salty does not "integrate" into your browser, email client, or other sensitive software. Therefore, usability shortcomings of integration UIs will not raise security issues. It is up to the user to safeguard the connection (i.e. their email account) which Salty can't control, and is not interested in controlling. "Doing it wrong" is barely possible since there are so few modes of use, and all parameters are hard-coded into the software, so no critical choices are necessary on the part of the user. ### 2. The OpenPGP Format: You might aswell run around the city naked. Salty does not include the sender or recipient's public key in plaintext. By default it encrypts using an ephemeral key and nonce, obscures the message length with padding, encrypts the real message length, and encrypts the info for verifying authenticity and integrity (hmac, public keys, and signature). Signature is opt-in. ### 3. Transaction Data: Mallory knows who you are talking to. Fully anonymized traffic seems like a pipe dream, and (despite the existence of the Tor project) will probably not be possible in the near future. However, for what it's worth: In theory, the idea of a "mixing service" from Bitcoin for psuedo-anonymizing transactions is possible using Salty files. Since a Salty file can only be made sense of by one who posesses the receiver's private key, a secure "drop box" could be set up where everyone dumps to the same folder, and everyone reads every file, trying to decrypt everything until decryptable files are found. ### 4. No Forward Secrecy: It makes sense to collect it all. Salty solves this problem in two ways: 1. With Salty it's easy to refresh keys: just regenerate your decryption key, and tweet the resulting pubkey string. Destroying your encryption key effectively renders your previously received messages unreadable and useless to collect. 2. Recovering the 32-byte key used to encrypt a message will not allow decryption of all Alice<->Bob messages, since each message has a unique key as the result of Diffie-Hellman with Alice using an ephemeral key. ### 5. Cryptogeddon: Time to upgrade cryptography itself? Salty throws out RSA and NIST-approved curves entirely, using the independently developed, peer-reviewed, battle tested, public domain NaCl crypto suite. ### 6. Federation: Get off the inter-server super-highway. Salty is not a network protocol, but it's recommended to use the most secure channel possible to trade Salty messages. The same goes for any sensitive information transferred between two parties. ### 7. Discovery: A Web of Trust you can't trust. Salty does not prescribe a web-of-trust model. Keyservers are optional and if one has a Twitter account, not necessary at all. End of story! ### 8. PGP conflates non-repudiation and authentication. Salty allows the sender to decide whether to sign the message, revealing to the receiver (via HMAC) that they in fact constructed it with their known identity. By default, only message integrity is ensured, protecting the sender's privacy if they desire it. ### 9. Statistical Analysis: Guessing on the size of messages. Salty does some random-padding to help obscure the message size. ### 10. Workflow: Group messaging with PGP is impractical. This is still true. Group messaging is better done by a network protocol. — Code on Github: https://github.com/carlos8f/salty Cheers, Carlos

1 0

Re: Hi, Boyce! (was Fwd: tor-talk subscription update)
by Александр 24 Jun '16

24 Jun '16

> > He is a bad actor and not much smart. The lies about banned people using > threats to subscribe again were stranger than his disgusting offenses about > rape apology. Sick guy, really disturbing, eeck! :-/ > Well, Cecilia, you said it all here. Zen writes: > Alexander,I didn't realize that you'd also been banned. So I didn't ask > Boyce. But likewise, I don't recall that you've made as many off-topic > posts as I have. So I'm suspicious. > > I'm suspicious too. But... they had to crucify few random victims to shut all the others/to teach a lesson all the rest of the people with good heart, mind and soul. that' a common tactic among scumbags.

1 0

Need a grass roots or war time "civil" movement - White Helments at your $60M service!
by Zenaan Harkness 24 Jun '16

24 Jun '16

Some people will hopefully even be surprised, in the "oh, my, god, the US govt/media/mil complex is serving me propaganda" way... one can only hope. https://southfront.org/dramatic-rescue-man-kid-runs-towards-camera-44-stage… “Dramatic Rescue! Man With Kid Runs Towards Camera!” – 44 Staged Pictures

1 0

Re: [tor-talk] Reminder to stay on-topic
by Zenaan Harkness 24 Jun '16

24 Jun '16

On Thu, Jun 23, 2016 at 04:14:02PM -0000, Ben wrote: > > Rules or policies should be enforced equally in an unbiased way. Even > > moderated forums allow certain "unpermitted" discussions while deleting > > / closing others immediately. +100 And, any individual to be banned, when their posts are not outright in violation of law or list policy, MUST be given at least ONE chance to agree to "stop posting offtopic". Surely? How can doing what was done, with no warning other than the general/ public "Careful now, we're discussing whether to start a new moderated mailing list!" statement. Seriously? This was an appropriate warning to all those who got banned? And do those wielding this authority seriously think this will be conducive to empathy with the tor-project, to a sense of "community" on tor-talk list etc??? > As much as I (and presumably everyone else) was getting sick of updates > on the topic coming into my inbox, there's definitely an argument, given > the position Jacob held, that it is/was at the very least Tor Project > related - so tangentially on topic, And as noted, there are plenty of > other discussions in the past that have wandered far, far off course. ACK! > But, for my 2 cents, it's some of the bans I have an issue with. Even if > we agree that the stuff related to Jacob was off-topic, for me > personally, it still doesn't sit right. > > ja.talk was spamming the list with reposts - sure, chuck them a ban. Even then I'd suggest at the least, ONE warning and therefore ONE opportunity for the poster to comply with the demand thereafter. > But some of those responding (described as "ludicrous rape > apologetics".... nice, classy....) were responding to say they felt the > evidence doesn't weigh up. It's an emotive topic for many, so of course > people are going to respond to repeated posts that colour someone elses > character - especially early on when the evidence was best described as > anecdotal and flimsy, and particularly if they happen to know the guy > and believe (for whatever reason) that the allegations are false. > > Put it another way, regardless of forum, if you saw someone you knew > being (to your mind) libelled and labelled a rapist, would you sit back > or would you respond? IMO a warning would have sufficed - assuming there > isn't other stuff that's happened in the background When someone brings their heart to a conversation, in this example: - a woman - who knew intimately the accused - who says she found it difficult to stop crying at the allegations that kept pouring out from ja.talk postings - who spoke from her own experiences - who is an actual rape victim - who demonstrated a level of inner strength and courage to speak up in the face of an avalanche of public opinion (a literal lynch mob, whether founded on true facts or not) And is treated in response with: - not even a SINGLE warning or request re her own posts - an accusation that she is a rape apologist - no right of reply/ response to the ban (the tor-talk list administrator personally kill-filed her) - no "thanks for your courage and empathy, but this is just too offtopic for tor-talk" WTF? She was raped ffs, and she brought genuineness, her own reality/ soul/ truth, and Tor treats her this way?! Are the administrators out of their firetrucking minds? Seriously, this is really, really messed up. Except that somehow this tor-talk "community" clean itself up, or I'm out of here - at the moment, your record is shameful, and damn, it speaks for itself! > At the end of the day though it's the Tor Project's call. I'm not going > to miss the JA related threads, though I may miss some of the input of > some of those who've been banned. When a Juan brings his brash words, at least he has the heart to shout out! When Cecilia brings her words, at least she brought her courage to speak out! When Alex spoke out in support of Cecilia, and bared his soul, at least he had the guts to speak his truth! The rest of us? Must of us? Fucking corwards! Folks can create and run and administrate and moderate as many private, semi public, and "public" private clubs as they do, with whatever rules they choose. Take notice, how you treat those who bring their hearts and bare their souls, determines the so-called "community" you are creating by your actions. It is good to have technical forums, where non-technical discussions are off topic. But my expectation that Tor Inc was a direct supporter of freedom of speech, open communication, whistleblowers, tolerance, "community" etc, is dashed in the face of not even one list supported by Tor Inc, where those who feel the need to speak their piece, can do so. Zenaan

1 0

tools for enrollment
by Zenaan Harkness 24 Jun '16

24 Jun '16

Trigger warning and Punk anarchist apostasy alert: the following question may be considered entirely blasphemous to punk tradition! Prior attempts to put the following concept have been downright clumsy, thus the following: 1) A significant portion of the adult humans in America might be considered part of the so-called "bible belt". 2) One foundation of any sane community is the right of a human to grow his own food and any other plant, for medicinal or other purposes (personal enjoyment, to trade with others, etc) 3) A document called the King James Bible (one random example), speaks to this fundamental human right, in a way which certain adult humans can receive as, well let's just call it "the gospel truth." The question: Ought we reject outright all passages in such a document on any grounds of personal preferred vehemence such as including but not limited to the grounds of superstition, historical abuse, unnecessary externalization of authority, or any and other such grounds, or ought we, for the purposes of communicating with certain of our fellow adult humans regarding such a fundamental human right (which right must be upheld for any community or society to call itself just, righteous, sane and etc) ought we highlight those particular passages in said document, in support of said fundamental human right? (If the latter, humorous slogans give rise to themselves such as for example "Be truly punk, get down and rock it with the King James Bible!")

4 3

Fwd: Re: Hi, Boyce! (was Fwd: tor-talk subscription update)
by Cecilia Tanaka 22 Jun '16

22 Jun '16

Boyce blocked my address in his private e-mail. I've sent a message to another e-mail address. I was banned and can't subscribe again. Phew, hard times... :-/ ---------- Forwarded message ---------- From: "Cecilia Tanaka" <cecilia.tanaka(a)gmail.com> Date: Jun 22, 2016 7:12 PM Subject: Fwd: Re: Hi, Boyce! (was Fwd: tor-talk subscription update) To: <tor-talk-owner(a)lists.torproject.org> Hi Boyce. I can't subscribe again. I was talking seriously about being on topic. If you search in my messages, you find references about my rapes. Sorry, I am receiving lots of messages talking about rape me again. And again. And again. I won't go to a Python meeting because my presence was public and two persons that mention the rape are surely Brazilian. Some of my friends are trying to discover their identities and I am being more cautelous than usual. Sorry, don't you think it was a bit injust call me a "rape apologetics"? Being sincere, it was disgusting enough for making me crying until now. Cecilia ---------- Forwarded message ---------- From: "Cecilia Tanaka" <cecilia.tanaka(a)gmail.com> Date: Jun 22, 2016 6:59 PM Subject: Re: Hi, Boyce! (was Fwd: tor-talk subscription update) To: "Griffin Boyce" <griffin(a)cryptolab.net> Cc: "cpunks" <cypherpunks(a)cpunks.org> Hi again, Boyce. I will re-subscribe and be on topic now. You can moderate my messages to be sure I will be strictly on topic, if you want. I am humbly asking to return because there are some interesting subjects there, about Tor Project in general. Sorry for being deeply sincere, but mentioning "ludicrous rape apologetics" makes really clear your beliefs and preferences. Hope to be accepted again. Cecilia On Jun 22, 2016 6:23 PM, "Cecilia Tanaka" <cecilia.tanaka(a)gmail.com> wrote: > Boyce, > > I asked to Roger about the tor-talk moderation rules weeks ago and did not > receive any answer. I can send the message in private to you, if you don't > believe. > > ** I was already raped twice and I do have deep physical and emotional > scars. Do you really think I loved my experiences and I deserve to be > called "ludicrous rape apologetics"? ** > > I was talking about truth and lies, about judgements without proofs. I > was a real victim in the past, I didn't tell lies. I know in my own burned > skin what is being a victim of rape. Please, you can offend my > intelligence, but it is really injust and pretty sick to call me "rape > apologetics". > > I bet you will leave ja.group post lies in tor-talk list, Boyce. How > about being *fair*, please? I can create a fake account just for reading > tor-talk list, but I prefer to use my own name and be transparent, expose > myself when talking about lies. So, the ja.group or any person can contact > me if they really want to talk about the truth. > > Thanks for the answer, but you were unfair and really disgusting. > > Cecilia > On Jun 22, 2016 6:03 PM, "Griffin Boyce" <griffin(a)cryptolab.net> wrote: > >> Cecilia Tanaka wrote: >> >>> Boyce, please, just pro-Jake people were banned or it was just a >>> lovely coincidence? How about a bit of transparency, please? >>> >> >> Hello Cecilia, >> >> This is the relevant thread on tor-project: >> https://lists.torproject.org/pipermail/tor-project/2016-June/000459.html >> >> As you can see, the emphasis is on off-topic posts and not the members' >> personal beliefs. Though having my inbox overrun with more than 300 >> messages filled with the most ludicrous rape apologetics was certainly a >> factor in my decision to ask for the ability to remove subscribers. >> >> juan wrote: >> >>> > I'm obviously re-subscribing right now. The fuck is wrong >>>> > with you. >>>> >>>> You're banned. Go elsewhere. >>>> >>> >>> so you work for the department of defense, eh shitbag? Too >>> stupid and coward to even admit it =) >>> >> >> Senpai isn't going to notice you bro. >> >

1 0

AboveTheLaw - Tor hacks: The FBI Can Keep Its Code, Or Its Criminal, Not Both
by Rayzer 22 Jun '16

22 Jun '16

U.S. District Judge Robert Bryan ordered the FBI to produce the full code of its malware. The government refused. I’m not making that up. A federal judge told the government to do something and the FBI essentially said, “How you gonna make me?” This is not good. I thought Apple had a really solid argument for refusing to help the government hack into one of their phones that was used by the San Bernardino shooter. The government eventually figured out how to do it without Apple’s help, but I don’t think a company should be forced to break its own system. Same goes for the government. I don’t think the government should be compelled to reveal its code for catching criminals. Don’t get me wrong, I do think the government should be compelled to reveal that it has a code or a hack or some malware that allows it to spy on us. I think they should have to explain in plain English how it works, and I think we should be able to have a national, public conversation about whether or not we want to the government to have this kind of power. But I see limited upside in forcing the government to reveal the actual code for its software, if it doesn’t want to and reasonably believes that revealing the code would do real harm. However, there are consequences to that position. If the government obtains evidence against you, you have the right to know how they did it. If the government doesn’t want to reveal that to you, well, then you get to take a walk. That might sound “unfair” to the vast majority of Americans who would trade seemingly all their liberties for a little enhanced security, but the Fourth Amendment is there to protect you from the government even when you don’t know you need protecting. All of these competing interests are coming to a head in a Washington case involving an alleged child pornographer. The FBI obtained evidence against Jay Michaud, a local teacher, by placing malware on a Tor site frequented by “dark web” users. Michaud’s attorneys would like to see the code used by the government to gather evidence against their client. Normally, that’s a pretty standard and reasonable request. Unfortunately, other dark web users would also really like to know how the FBI is catching them. Getting their hands on the code would be huge. Even if the code is produced in “sealed” documents, we can’t pretend that we live in a leak-free world. U.S. District Judge Robert Bryan ordered the FBI to produce the full code of its malware. The government refused. I’m not making that up. A federal judge told the government to do something and the FBI essentially said, “How you gonna make me?” This is not good. This is a borderline constitutional crisis. In response, Judge Bryan tossed the evidence against Michaud obtained by the malware, but allowed the case to continue. On Simple Justice, Scott Greenfield has written passionately about how Judge Bryan caved to pressure from the executive branch. (Judge Kneels And Welcomes His Governmental Overlords link) I don’t think the FBI should be compelled to release its code. I’m reminded of when the Allies broke the Enigma code, a story recently popularized in the movie The Imitation Game. Once we broke the German code, we didn’t stop every attack we knew was coming. Preserving the hack was more important than preventing individual losses. People died because we didn’t want to reveal what we had. There were consequences to our decision. Here, Judge Bryan should have tossed the whole case against Michaud. That should be the consequence of the FBI’s decision. Yes, that means one alleged child pornographer and teacher goes free. Yes, that is unfortunate. But if the FBI really wants to protect its code, then they should be willing to give up this one guy for all of the information they are getting through using this hack. It’s a difficult decision, but if the FBI and Judge Bryan don’t want to make it, they should get into the cupcake business and leave the balancing of liberty and security to sterner men and women. Prosecute the alleged criminal under the agreed upon rules that are there to protect all of us, or do not. There is no try. With links onsite: http://www.atlredline.com/the-fbi-can-keep-its-code-or-its-criminal-not-bot…

1 0

Re: [tor-dev] Freenet + Onioncat: Is the traffic welcome?
by grarpamp 22 Jun '16

22 Jun '16

On 6/22/16, konstant(a)mail2tor.com <konstant(a)mail2tor.com> wrote: > I posted steps on how to connect Freenet nodes over Onioncat and Garlicat > for Tor/I2P. I am looking to scale it into an Opennet inside Tor with a > lot of peers: > > https://emu.freenetproject.org/pipermail/devl/2016-June/039056.html > https://emu.freenetproject.org/pipermail/devl/2016-June/039059.html Cool. You may want to review two recent threads regarding # bittorrent https://lists.torproject.org/pipermail/tor-talk/2016-June/041355.html # onioncat https://lists.torproject.org/pipermail/tor-dev/2016-April/010847.html (Some portion of these threads are on tor-talk, tor-dev, cypherpunks, etc so you'll need to search those for full context. They may span multiple months so you'll have to dig those out. And note that torproject's archives destroy useful things like cc, attachments, crypto sigs. Cypherpunks is intact.) > Is the extra traffic desirable in Tor? Reading asn's comment, I was under > the impression that you are interested in adding higher latency traffic > such as Freenet or mixnets for better anonymity: > https://blog.torproject.org/blog/crowdfunding-future-hidden-services >From the operations and UX side, as opposed to theory and design side... Some [officials] within torproject will decry traffic, and have even gone so far as to suggest they'll deploy coded countermeasures (which since the traffic is anonymous, and the code is opensource, doesn't work and kills someone else's good as well). In the end, just like video on clearnet, users and their traffic will come, and utilize whatever capacity and features they can, nothing you can do about it. A more qualified thought... I find ongoing intentional exclusive use of exits so people can basically get their trivial entertainment LOL's using filesharing apps such as bittorrent (or any other use that is known to tax networks)... to be rather immature to unethical. However I do see fine use in performing initial import of clearnet datasets via exits (if maintaining anonymity of such import action is necessary), provided they then cut their clients over to run exclusively within the anonymous networks. (In the case of bittorrent, that means disconnecting the split horizon network path to clearnet, swapping out clearnet trackers for trackers within the anonymous overlay networks, using PEX / DHT within those nets, and possibly managing running two instances over various datasets.) ie: Someone might import the latest opensource unix iso's via clearnet without use of exits, then cut and seed exclusively via anon overlay nets. Same person might need to import the latest political leaks and civil rights videos via exits, then cut and seed similarly. > Using both projects in tandem can finally realize the vision of FreeHaven. > You are the best at firewall circumvention, performance and accessing the > web, Freenet supplies users with censorship resistant publishing and p2p > services. There is a HotPETs 16 paper co-authored by George Danezis on > renewing interest in anonymous storage networks: > > http://www0.cs.ucl.ac.uk/staff/M.Isaakidis/p/isaakidis-p2pstorageservices-h… I agree that linking the various overlays, features, services, and users together is generally a good thing. I tend to argue IPv6 for that since so many of todays apps and users speak that. However there's certainly other shims, proxies, and addressing stacks people can dream and code up, particularly for asynchronous / non-real-time messaging and file like storage services. Users also need to research and think clearly about any security and privacy impact using such links may have on them.

1 0