July 2016 - cypherpunks - lists.cpunks.org

The Laws (was the principles) of secure information systems design
by Peter Fairbrother 13 Jul '16

13 Jul '16

I've been revising the principles, and came up with this. It's an early version. As ever, corrections and suggestions are welcome. Calling them Laws is perhaps a bit overreaching - but on reflection I thought that's mostly what they are, break them and the system won't be secure. I will put the Laws up on the 'net shortly, hopefully with a link for suggestions and comments. The Laws of secure information systems design: Law 0: It's all about who is in control Law 1: Someone else is after your data Law 2: If it isn't stored it can't be stolen Law 3: Only those you trust can betray you Law 4: Attack methods are many, varied, ever-changing and eternal Law 5: The entire system is subject to attack Law 6: A more complex system has more places to attack Law 7: Holes for good guys are holes for bad guys too Law 8: Kerckhoffs's Principle rulez! - usually... Law 9: A system which is hard to use will be abused or unused law 10: Design for future threats Law 11: Security is a Boolean Law 12: People offering the impossible are lying Law 13: Nothing ever really goes away Law 15: "Schneier's law c" [1] holds illimitable dominion over all... including these laws -- Peter Fairbrother [1] " a: Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break. It's not even hard. b: What is hard is creating an algorithm that no one else can break, even after years of analysis. c: And the only way to prove that is to subject the algorithm to years of analysis by the best cryptographers around."

2 2

The Moon landing again - Fw: Neil Armstrong's Boots
by Zenaan Harkness 13 Jul '16

13 Jul '16

Sound like rather compelling questions to me. But I'm not a physicist, and I never worked for Nike or a boot maker, so I couldn't begin to say how ripple soles got left behind on the Moon. Bah humbug ... prolly someone conspired to think of a theory. ----- Forwarded message from Gil May <gilmay97(a)gmail.com> ----- From: Gil May <gilmay97(a)gmail.com> Date: Tue, 12 Jul 2016 09:21:54 +1000 Subject: Neil Armstrong's Boots No one has answered my simple question, instead of providing an answer they want to call me names and say I am a conspirator--I am not, I am just asking a fair question. When Neil Armstrong stepped onto the lunar surface he left a deep footprint in the dust showing a *ripple soled imprint, *the photo was shown all around the world. The landing module was about 3 meters in diameter and the thrust rocket central: from “NASA Launch Vehicle/Spacecraft Key Facts <http://history.nasa.gov/SP-4029/Apollo_18-13_Launch_Vehicle-Spacecraft_Key_…>, LM descent stage maximum rated thrust = 9,870 lbf (43,904 N)”. This massive thrust would have blown the dust away from the landing area creating a massive dust cloud, so why was thick dust still on the ground and no massive dust cloud? Please explain NASA. [image: Inline image 3] In July, 46 years to the day after the first moon walk, the *Smithsonian's National Air and Space Museum* in Washington, D.C., started its first Kickstarter campaign, asking for money to preserve the spacesuit Neil Armstrong wore when he stepped off Apollo 11 onto the moon in 1969. Oct 15, 2015 How the Smithsonian Will Save Neil Armstrong's Spacesuit <http://www.popularmechanics.com/space/moon-mars/a17583/neil-armstrong-space…> *www.popularmechanics.com/ <http://www.popularmechanics.com/>space/moon-mars/a17583/neil-armstrong-spacesuit* [image: Inline image 2] [image: Inline image 1] NASA verified this was the actual space suit worn by Neil Armstrong, interesting to see the boots have no ripple sole. Please explain NASA. My father often said “Do not ask difficult questions you upset folk and get called names”. Oh Dear! Cheers

6 6

Fwd: [Cryptography] Putin goes full Stasi; wants encryption keys for the Internet
by grarpamp 13 Jul '16

13 Jul '16

Long live p2p? ---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Fri, 08 Jul 2016 07:15:46 -0700 Subject: [Cryptography] Putin goes full Stasi; wants encryption keys for the Internet To: cryptography(a)metzdowd.com FYI -- https://meduza.io/en/news/2016/07/07/putin-gives-federal-security-agents-tw… Putin gives federal security agents two weeks to produce 'encryption keys' for the Internet 13:28, 7 july 2016 After signing controversial anti-terrorist legislation earlier today, President Putin ordered the Federal Security Service (the FSB, the post-Soviet successor to the KGB) to produce encryption keys to decrypt all data on the Internet. According to the executive order, the FSB has two weeks to do it. Responsibility for carrying out Putin's instructions falls on Alexander Bortnikov, the head of the FSB. The new "anti-terrorist" laws require all "organizers of information distribution" that add "additional coding" to transmitted electronic messages to provide the FSB with any information necessary to decrypt those messages. It's still unclear what information exactly online resources are expected to turn over, given that all data on the Internet is encoded, one way or another, and in many instances encryption keys for encrypted information simply don't exist. https://meduza.io/en/feature/2016/06/27/the-duma-s-new-big-brother-legislat… The Duma's new 'Big-Brother' legislation kills Russia's Internet companies and hurts ordinary Web users. Here's how. 16:06, 27 june 2016 Last week, lawmakers in the State Duma approved what Edward Snowden has called "Russia's new Big-Brother law." A major part of this legislation creates new regulations on the Internet. According to the amendments, telecom providers and the "organizers of information distribution" will need to store copies of nearly all information they transmit. They can't delete this information until it's six months old. This applies to recordings of phone calls, as well as the contents of text messages. And they have to keep copies of metadata of these communications (the information about when and between whom messages occurred, but not the actual content of the messages) for a whopping three years. Companies will additionally be required to help Russia's Federal Security Service (the modern-day successor to the Soviet KGB) decrypt all the data. The largest Internet companies in Russia--Mail.ru and Yandex--oppose the bill, as do the industry groups the Russian Association for Electronic Communications and the Regional Center for Internet Technologies, and even the "Communications and IT" working group within the Russian government. Meduza looks at why this legislation isn't just impractical, but will also harm ordinary Internet users and Internet companies alike. It's expensive The legislation requires telecom providers and "organizers of information distribution" (which could be literally any website on the Internet, as determined by Russia's state censor) to store all data sent by its users or visitors. This is a gigantic amount of data: Russia would need every data-storage manufacturer in the world working for seven years straight, before the country had the infrastructure necessary to accommodate so much storage and processing. And there's another problem: the electrical grid in central Russia simply isn't powerful enough to fuel the still-unbuilt data centers that will be required by the new legislation. The equipment and materials needed to build these data centers, moreover, isn't produced in Russia, so companies will be forced to buy imported goods. Experts say the costs of building this infrastructure will be more than 5 trillion rubles (roughly $77 billion). For comparison, the federal government's total revenues in 2015 totaled 13.7 trillion rubles (about $210 billion). The legislation says implementing the new statutes won't require any state subsidies, but that's untrue: at the very least, government agencies will need to upgrade the country's data cables (given that Russia's existing network of cables is too weak to cope with the higher volume of transmitted information created by the new regulations). The government also risks losing income from Russia's Internet companies, which currently pay taxes on their profits. The new legislation could make many businesses unprofitable, after they're forced to spend tens if not millions of rubles on new data-storage equipment. It's dumb The new legislation requires all "organizers of information distribution" that add "additional coding" to transmitted electronic messages to provide the Federal Security Service (FSB) with any information necessary to decrypt those messages. What lawmakers seem not to understand is that virtually all information transmitted over the Internet is "encoded." Any text or image sent over email using Simple Mail Transfer Protocol (SMTP) is in something called Multipurpose Internet Mail Extensions (MIME) format. Will "organizers" need to send the FSB information about how MIME works? If we're talking about encryption, we're talking about almost half the traffic on the Internet--and the volume is only growing. In most cases, incidentally, the "organizers of information distribution" don't have the keys to decrypt their own data. (That is precisely how Internet privacy works.) For example, it's not even technically possible to store encryption keys when using the HTTPS protocol, which is used by an enormous number of websites, including the one you're reading now, and even Gosuslugi.ru, the Russian government's official portal where citizens can contact the state about public services. In other words, the legislation bans the state's own website for contact with ordinary citizens. How this legislation is supposed to regulate financial systems is also unclear. The SWIFT network that links the world's financial institutions doesn't use Russian cryptographic algorithms, but nearly all the world's banks--including banks in Russia--use SWIFT. The world's payment systems, moreover, are required to comply with the Payment Card Industry Data Security Standard (PCI DSS), a proprietary information security standard that doesn't disclose its encryption keys. In order to comply with the legislation, programmers will need to come up with new encryption methods that must simultaneously work with existing encryption methods, given that foreign companies won't support these new technologies (which don't currently exist, anyway). But even if Russia manages to create some kind of center to house all encryption keys, the concentration of data would make the center extremely attractive, and therefore very vulnerable, to hackers. By breaking into this hypothetical data center, after all, it would be possible to decrypt any message sent inside Russia. The new legislation also violates Russian citizens' right to the privacy of correspondence, which is enshrined in Article 23 of the Constitution. In order to deprive Russians of this right, police need a court order. The "Yarovaya legislation," however, grants law-enforcement agencies access to everyone's messages without any judicial oversight. Today, most messaging apps use encryption. In fact, encryption is one of their most important competitive advantages, as users often seek out the safest and most secure communications available. The new law will make any Russian online service less competitive. It's unclear what foreign companies will do. Some might simply walk away from the Russian market. This text is based on statements by the Russian Internet companies Yandex and Mail.ru (which are considered "organizers of information distribution"), the industry groups the Russian Association for Electronic Communications and the Regional Center for Internet Technologies (which position themselves as links between the state and the Internet), and the "Communications and IT" working group within the Russian government. --------------- Theresa May, James Comey, Cyrus Vance, et al, can't wait to go full Stasi, as well. 'Putin-in-the-middle' attacks, anyone? _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

2 1

zero days - should they be sent somewhere?
by Zenaan Harkness 13 Jul '16

13 Jul '16

Wondering if zero days spam should be sent somewhere, or just ignored?

2 1

Re: The Moon landing again - Fw: Neil Armstrong's Boots
by Bastiani Fortress 12 Jul '16

12 Jul '16

12.07.2016, 16:48, "Tom" <tom(a)vondein.org>: >> This massive thrust would have blown the dust away from the landing area >> creating a massive dust cloud, so why was thick dust still on the ground >> and no massive dust cloud? Please explain NASA. > > No atmosphere, no blowing. > > - Tom He's talking about the module thrusters, you don't need atmosphere to blow particles on the ground.

3 3

Fwd: An open letter to security researchers and practitioners
by John 12 Jul '16

12 Jul '16

-------- Original Message -------- From: Jeremy Gillula <jeremy(a)eff.org> Sent: July 8, 2016 7:35:21 PM EDT To: nanog(a)nanog.org Subject: An open letter to security researchers and practitioners An open letter to security researchers and practitioners: We need you to take a stand to protect security researchers who report defects in browsers, before it's too late. Earlier this month, the World Wide Web Consortium's Encrypted Media Extensions (EME) spec progressed to Draft Recommendation phase. This is a controversial standard for transmitting DRM-encumbered videos, and it marks the very first time that the W3C has attempted to standardize a DRM system. This means that for the first time, W3C standards for browsers will fall under laws like the DMCA (and its international equivalents, which the US Trade Representative has spread all over the world). These laws allow companies to threaten security researchers who disclose vulnerabilities in DRM systems, on the grounds that these disclosures make it easier to figure out how to bypass the DRM. Last summer, the Copyright Office heard from security researchers about the effect that DRM has on their work; those filings detail showstopper bugs in consumer devices, cars, agricultural equipment, medical implants, and voting machines that researchers felt they couldn't readily publish about, lest they face punitive lawsuits from the companies they embarrassed. EFF has asked the W3C to take a minimal step to insulate their stakeholders from the legal fallout from the inclusion of DRM in their standards. Our proposal asks the W3C to bind its members to legal promises not to use the DMCA or laws like it against security researchers or implementers. https://www.eff.org/deeplinks/2016/06/w3c-eme-and-eff-frequently-asked-ques… So far, the W3C executive has failed to act on this proposal, despite diverse support from a number of W3C members. We are hosting an open letter from security, privacy and technology experts to the W3C's director, Tim Berners-Lee; and its CEO, Jeff Jaffe, asking them to make any further work on EME contingent on adopting rules to protect the open web from these bad laws. https://www.eff.org/deeplinks/2016/03/security-researchers-tell-w3c-protect… Will you sign this letter? Some of security's leading lights have already put their names to it. We can't afford to make widely used tools like browsers off-limits to security research and disclosure, especially not as HTML5 is being positioned as a UI environment to replace apps as the primary way of interacting with sensors, actuators, embedded systems and the whole Internet of Things. If you're willing to sign on, please send an email to cory(a)eff.org with your country of residence and your institutional affiliation (if any). Thank you, Cory Doctorow Apollo 1201 Project Electronic Frontier Foundation

1 0

US Congress Grabbing More PATRIOT Ass
by grarpamp 12 Jul '16

12 Jul '16

http://rare.us/story/congress-is-going-to-try-to-expand-the-patriot-act-ton… http://www.majorityleader.gov/floor/ http://docs.house.gov/billsthisweek/20160711/HR5606.pdf https://www.law.cornell.edu/uscode/text/18/1956 https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://www.sec.gov/about/offices/ocie/aml2007/fincen-314afactsheet.pdf https://www.fincen.gov/statutes_regs/patriot/index.html?r=1&id=314#314 Congress is going to try to expand the Patriot Act tonight and hopes no one will notice July 11, 2016 2:42 pm In the wake of recent mass shootings, Monday night the U.S. House of Representatives is scheduled to vote on an expansion of the Patriot Act, which significantly broadened government surveillance powers after 9/11. The proposed bill, H.R. 5606, expands Section 314 of the Patriot Act to cover non-terrorism or money laundering related investigations. Critics claim that the bill is a threat to the privacy of innocent Americans and is being rammed through Congress without debate.

1 2

[OT] Fwd: Re: [liberationtech] Need some advice re: online secure communications platform for a survivors group
by Cecilia Tanaka 12 Jul '16

12 Jul '16

My dear Juan, Boyce was stupid and very injust, but he is not a bad person. I was talking about this kind of thing, testardo... :) Kisses and kicks! Take care! :* Ceci ---------- Forwarded message ---------- From: "Lina Srivastava" <lina(a)linasrivastava.com> Date: Jul 10, 2016 9:30 PM Subject: Re: [liberationtech] Need some advice re: online secure communications platform for a survivors group To: "Griffin Boyce" <griffin(a)cryptolab.net> Cc: "Lina Srivastava" <lina(a)linasrivastava.com>, "liberationtech" < liberationtech(a)lists.stanford.edu> Dear Griffin, Thank you very much! I will pass this information along. Best regards, Lina > Hi Lina, > > While the content isn't encrypted for most of their apps, I would > recommend Sandstorm as a good hosted option for forums and other > collaborative apps. It's free for up to 5 apps (called "grains") and up > to 200MB storage. For more, it's $9 a month: https://sandstorm.io/ > > For encrypted communication, Ricochet.im is pretty great and doesn't > require a lot of work to set up. It has sane defaults (requires Tor to > run). > > best, > Griffin > > > Lina Srivastava wrote: >> Hello all, >> >> A new support group for survivors of campus sexual assault is looking >> for a secure online communications platform. The group is not one of >> my clients, nor am I a member of or advisor to the group -- I am >> passing this request along as a favor -- so I have relatively little >> information about membership numbers, etc. I do believe everyone who >> is in the group is located in the U.S. or Canada. And they are looking >> for high security levels, giving survivors the ability to seek support >> from other members and to collectively organize for changes to policy >> and legislation on rape and assault. They are hoping to have >> password-protected login, private messaging, group forums, file share, >> all encrypted. >> >> Do any of you have advice for an existing platform that would provide >> this that is relatively affordable? >> >> Thanks in advance, >> Lina > > -- > Accept what you cannot change, and change what you cannot accept. > PGP: 0x03cf4a0ab3c79a63 > -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

5 5

Message from the front lines
by Rayzer 12 Jul '16

12 Jul '16

DeRay Mckesson, one of ‪#‎BlackLivesMatter‬ ideological main men has been arrested in ‪#‎BatonRouge‬ during an ‪#‎AltonSterling‬ ‪#‎PoliceMurder‬ protest for "Walking".. It's also his BIRTHDAY! Congrats Deray! Join the "I spent my birthday in jail for the cause" club. I spent my 18th in the Tombs, 100 Centre St. Manhattan Criminal court, for an anti-Vietnam war demo in 1971. https://twitter.com/StylistComplete/status/751978156123238400

7 15

Stuxnet the movie
by John Newman 11 Jul '16

11 Jul '16

1 0