August 2016 - cypherpunks - lists.cpunks.org

Re: [liberationtech] Interesting things in keyservers
by Eugen Leitl 17 Aug '16

17 Aug '16

----- Forwarded message from micah <micah(a)riseup.net> ----- Date: Sat, 20 Jul 2013 10:05:42 -0400 From: micah <micah(a)riseup.net> To: Micah Lee <micahflee(a)riseup.net>, 'liberationtech' <liberationtech(a)lists.stanford.edu> Subject: Re: [liberationtech] Interesting things in keyservers User-Agent: Notmuch/0.15.2 (http://notmuchmail.org) Emacs/24.3.1 (x86_64-pc-linux-gnu) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> Hi Micah! Micah Lee <micahflee(a)riseup.net> writes: > I'm working on a talk for OHM2013 about PGP. Can anyone send me examples > of interesting keys in key servers that you know of? Since you are preparing a talk about the subject, I'm going to be pedantic and correct your usage of "PGP", because it is important to get your terminology straight when giving a talk. I presume you aren't giving a talk about the commercial software, but instead you are actually giving a talk about OpenPGP which is the standard specified by RFC4880 that different programs like GnuPG, Seahorse, MacGPG, and PGP etc. all implement. If that is true, then you should refer to it as OpenPGP, and not PGP. I dont know what your talk will consist of, besides the funny enigmail XSS and goatse.cx stuff (thanks for that! always good to have some goatse early in the morning), but I would like to point out a few things that might be useful to mention. One is a wiki page that I created with some people: https://we.riseup.net/riseuplabs+paow/openpgp-best-practices - it contains some useful hints about using OpenPGP, maintaining a good key and some general good practices that people often dont know about (such as the importance of keeping your keys updated to get critical revocation and expiration extension certifications!) One thing mentioned on that page that I wanted to highlight, because you used pgp.mit.edu links in your original email, is that the keyserver pgp.mit.edu is not a good one to use/promote. Everyone uses it as their 'goto' keyserver, but it is a really bad idea! As a keyserver, it has been broken for years. For a long time it was just dropping revocations, subkey updates and expirations on the floor. That is *really* bad. Eventually, they upgraded their keyserver software, but it is *still* running an older version of SKS, a version that fails to handle 16-digit subkeyid lookups (among other failings). So, please don't rely on pgp.mit.edu for your security, and please don't include them in your slides! If you are looking for one to use, I highly recommend using the SKS pool address (hkp://pool.sks-keyservers.net or http://hkps.pool.sks-keyservers.net/ - or if you want a more close geographical pool, have a look at http://sks-keyservers.net/overview-of-pools.php) Finally, there seems to be some amazing misconceptions about keyservers, keys and the web of trust. In particular this http://cryptome.org/2013/07/mining-pgp-keyservers.htm circulated recently and it pained me to see because it suggested various wreckless conclusions that were dangerously off the mark[0] (and used pgp.mit.edu, hah). While it is true that we've jokingly called the OpenPGP web of trust "the original social network" because of the exposed social relational graphing that can be done by querying keyservers, and it is for this reason that many activists I know do not want to have signatures uploaded to keyservers (and instead use the bulky local-only signature work-around)... ... but for some reason people seem to think that if it is on a keyserver, is true, or it means something that it doesn't. People don't realize critical things, such as the fact that I can create a key with the UID Nadim Kobeissi and upload it to the keyservers[1]. That doesn't mean that is the real Nadim's key (this is what exchanging key fingerprints and doing certifications is for, so you can know, with a certain degree of certainty, that this person is the person who controls that secret key material). Or people think that because I signed your key and that signature is on the keyserver that indicates: I trust you; we met in person at that date; we know each other; we are involved in a criminal conspiracy with each other; or many other wrong assumptions about what that certification means. I can sign Edward Snowden's key and send that to the keyservers[1]. Hell, I can sign Snowden's key with my fake Nadim Kobeissi key[1] and then send it to the keyservers. Does that mean that Nadim and Snowden have met in person?! No, it does not at all. Anyways, I can keep going... but I dont know what the focus of your OHM talk is about, so going on like this isn't particularly useful to you and your talk... however, I'd be happy to provide more feedback about your talk if you would like![2] After all, we Micahs need to stick together, micah 0. "the cryptome article just sounds like impenetrable bullshit from someone with no interest in actually understandning what's happening" - I'm not saying who said this... 1. no, I didn't do that, nor did I upload the edward snowden or bradly manning keys. -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

4 3

US drug policy -> maintains the class divide
by Zenaan Harkness 16 Aug '16

16 Aug '16

>From a comment on slashdot - I'm not American, but this sounds quite plausible to me: http://news.slashdot.org/story/15/11/27/1343243/lsd-microdosing-gaining-pop… " If you're a $100k/yr engineer (Score:4, Insightful) by rsilvergun (571051) on Friday November 27, 2015 @10:52AM (#51013395) such things don't apply. In America we have a multi-tiered justice system. It's pretty well documented. Wealthy and educated people get treatment programs, while poor (and let's face it, black) people get jail. It's because what we're really using our drug policy for is to keep the poors in check. Think of it this way. If your poor chances are you or one of your friends is using drugs to cope with poverty. Now, our drug laws, in particular our asset forfeiture laws are basically guilt by association. Combine that with juries that are inherently conservative (since you generally have to be well off to be able to afford to server on a jury for any length of time). So when poor people show up in wealthy neighborhoods they not only stick out like a swore thumb, but odds are good the cops can bust them for the drugs at least one of them is carrying. This keeps poor people out of wealthy school districts and parks, and lets the wealthy enjoy their (much, much better) public services. Basically, our drug policy is central to maintaining our class divide... "

3 3

Exchange / Trading / Analysis Software [re: Zenbot3 BTC/ETH/LTC bot]
by grarpamp 16 Aug '16

16 Aug '16

On 8/16/16, Carlos Rodriguez <carlos(a)s8f.org> wrote: > zenbot is an automated cryptocurrency trading bot. It runs on node.js and > MongoDB and is fully open-sourced. A plugin architecture is included that > allows any exchange, trade strategy, or currency pair to be supported. > > • Default support for GDAX is included, so if you have a GDAX account, > • Default support for other exchanges is ongoing. > instead of trading on GDAX, you could trade on a different exchange > > More: https://s8f.org/zenbot.html https://github.com/carlos8f/zenbot As far as opensource goes... - There's the above sort of thing on the user side that interfaces with an existing exchange to place orders, etc. - There are some tradedesk like things for analysis of market feeds and history from an exchange. Those two are sometimes blended together in one tool. Then the third component is... What software is out there that implements an exchange itself? Be it for currency pairs, stocks, or commodity trade floor. Currency pairs being the primary example above. List software for centralized models... List software for distributed models... Note that a distributed "marketplace" where users buy and sell "things", is not really an exchange engine itself, though it may serve similar end purpose. Whereas an ethereum program might be considered a true engine, an API, perhaps collecting, advertising and executing buy / sell orders, without need for user to see or deal individually with all the other users making up the liquidity.

1 0

[liberationtech] Tor Browser 6.0.4 is ready for testing
by vroom＠mail2tor.com 16 Aug '16

16 Aug '16

> Rayzer: > run off thumbdrive > leave no trace > wipes memory This incorrect. Such system write over data. Trace on *all* flash. Can be recovered. Read hacks.

3 2

[liberationtech] Tor Browser 6.0.4 is ready for testing
by theyralfeds＠mail2tor.com 16 Aug '16

16 Aug '16

> Rayzer: > cached in hardware Hack self and see all. > darkweb kiddieporn How dare, sir. > tor or tails They are all feds. So is you, seems.

1 0

Re: US drug policy -> maintains the class divide
by John Newman 16 Aug '16

16 Aug '16

On Tue, 2016-08-16 at 11:07 -0400, John Newman wrote: US drug laws, the ridiculous sentencing guidelines and mandatory > minimums, the blatantly racist enforcement (and extra-judicial > killings), and the resulting American gulag (highest per-capita > incarceration rate in the world) are just a little twist on slavery, > which "ended" during the Civil War.... > > John > Hmm.. new mail client, mail sorted backwards, I just realized I responded to a thread from last year :) ... but the point stands,.heh.. John

4 3

Re: [onioncat] Onioncat v2
by grarpamp 16 Aug '16

16 Aug '16

On 3/8/16, Bernhard R. Fischer <bf(a)abenteuerland.at> wrote: > "Do we want to keep this nice automatic IPv6/Onion-ID translation feature?" > > If NO: > There's no problem. Everybody can setup his own hosts-file for the > translation. > > If YES: > Independent of the final solution there is a need for a > lookup-database/service of any kind. This goes to two things... - the usage models you expect - the usage models you want to enable Let's keep in mind that the fundamental strengths of onioncat and reason that it exists are... - tor and other anonymous overlay networks often do not support full IP semantics, with tor it's TCP only, which cripples or eliminates certain apps. - anonymous overlay networks often do not support interfaces to the traditional IP stack of OS's, with tor it's onion only, which you can't bind(2) to, except via hack within the tor daemon... which only does tcp, which doesn't route, or packet filter, or VM, or... "NO" ... well, that's fine for individual people who meetup elsewhere and personally agree to exchange keys and addresses (or find such listed on the web, etc) in order to communicate. It scales only to the extent one can personally manage it, and it is not oppurtunistic as far as making random new introductions. "YES"... this is where the real potential lies. Lots of apps are p2p, or at least rely on central servers to tell them of their peers in real time. Bitcoin and bittorrent are purely p2p with peers coming in via the network itself at random. VOIP could be thought to be central yet random. This list of non-manual config apps is really long. Then evaluate which are popular in the opensource space whereby they're possibly not run by popular centrals like facebook, but by community (XMPP), or strictly p2p. It seems that NO would still serve a purpose and thus would be a call to making an onioncat v2. And that YES would be a very interesting project that needs to look at many potential solutions some of which people post ideas about on list. > IMO we should use an existing database and we should not try to Yes if it is available, or willing to be developed and integrated by the overlays for such use. > establish a new system because this depends always on people willing to > run these. For example, it may be possible that the [transmission] bittorrent, and cryptocoin, communities might see a reason to run something separate if it gave them p2p access to anonymous transport layers. > I do not know about the userbase of OnionCat but we should > assume that it is small, hence, not (yet) able to keep enough Onioncats > up for running a DB (DHT or whatever). Public usage is all in supply, demand, and advertising. Private usage has seen some successful onion/i2p like what.cd [nee i2p/onion] membership. Evaluating the needs of some VOIP and messaging protocols re IPv6 UDP and tun interface might be useful. We already know bittorrent needs udp and trackerless p2p to be efficient. Another way to think is... can the overall utility of anonymous overlay networks ever grow if they continue to be restricted to, say, TCP and their own proprietary addressing stacks? Are there RFC type proposals to interoperate / expand that among the community of overlay networks? And is onioncat a good place to enable that if either are no?

2 2

DCCC Internal Docs on Primaries in Florida
by Georgi Guninski 16 Aug '16

16 Aug '16

DCCC Internal Docs on Primaries in Florida https://guccifer2.wordpress.com/2016/08/15/dccc-internal-docs-on-primaries-… ==== Here are the DCCC docs on Florida: reports, memos, briefings, dossiers, etc. You can have a look at who you are going to elect now. It may seem the congressional primaries are also becoming a farce. ==== Released on the same day as the alleged NSA sploits.

3 3

NSA Hacked? Really?
by Crypto 16 Aug '16

16 Aug '16

Reddit is going nutz over articles like this... http://motherboard.vice.com/read/hackers-hack-nsa-linked-equation-group -- Crypto

5 4

Announcing Zenbot 3, your new BTC/ETH/LTC trading bot, now with live candlestick graph and plugin-based architecture
by Carlos Rodriguez 16 Aug '16

16 Aug '16

zenbot is an automated cryptocurrency trading bot. It runs on node.js and MongoDB and is fully open-sourced. A plugin architecture is included that allows any exchange, trade strategy, or currency pair to be supported. • Out of the box, zenbot is an AI-powered trade advisor (gives you buy or sell signals while watching live data). • Default support for GDAX is included, so if you have a GDAX account, enable bot trades by simply putting your GDAX API key in config.js and setting what currency pair to trade. • Default support for other exchanges is ongoing. • Trade strategy is fully exposed in the config file. This allows you to have full control over the bot’s actions and logic. For example, instead of trading on GDAX, you could trade on a different exchange or currency pair by implementing a few lines of JavaScript. • A live candlestick graph is provided via a built-in HTTP server. More: https://s8f.org/zenbot.html

2 1