August 2016 - cypherpunks - lists.cpunks.org

MotherJones: My Four Months As A Private Prison Guard
by grarpamp 21 Aug '16

21 Aug '16

http://www.motherjones.com/politics/2016/06/cca-private-prisons-corrections… ...One of the other inmates on suicide watch, who's been silent until now, starts yelling through his food slot. "World war!" he shouts. "I got some niggas who need to tell the CIA something, since they already got their eye in the sky, the satellite orbiting in space processing global information." His voice has a demonic quality to it and he occasionally hits the plexiglass to punctuate his sentences. The CO sitting directly across from him twiddles his thumbs and gazes ahead blankly...

2 2

Fwd: [Cryptography] UK report on "Bulk Powers Review" of GCHQ interception
by grarpamp 21 Aug '16

21 Aug '16

---------- Forwarded message ---------- From: John Gilmore <gnu(a)toad.com> Date: Sat, 20 Aug 2016 11:47:48 -0700 Subject: [Cryptography] UK report on "Bulk Powers Review" of GCHQ interception To: cryptography(a)metzdowd.com, gnu(a)toad.com BBC news - Britain's spies should be allowed to continue harvesting large amounts of data from emails, the government's reviewer of terror legislation has said. http://www.bbc.co.uk/news/uk-politics-37130455 UK Government report: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/5… John _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

Fwd: [tor-talk] Did Australian Authorities hack (US) computers with Tor's help?
by grarpamp 21 Aug '16

21 Aug '16

---------- Forwarded message ---------- From: Chris <tmail299(a)errtech.com> Date: Sat, 20 Aug 2016 21:06:12 -0400 Subject: Re: [tor-talk] Did Australian Authorities hack (US) computers with Tor's help? To: tor-talk(a)lists.torproject.org On 2016-08-20 06:54 PM, tortalk(a)arcor.de wrote: > Hi! > > I found two articles which may have something in common. 1. Some Tor > users (29.000) got deanonymized by authorities while up/downloading > childporn. 2. Someone claims that "Tor suddenly dump over 30 > megabloats of steaming faeces onto a file system on exit". > 1. Is it just a question of time when other deanonymisations will come > public? > https://motherboard.vice.com/read/australian-authorities-hacked-computers-i… > "Australian Authorities Hacked Computers in the US > Written by Joseph Cox Contributor > August 15, 2016 // 10:10 AM EST > ... > By the very virtue of the investigation, Australian authorities likely > would not have known where the computer they wanted to hack was > located; indeed, that was the exact problem that the Tor network > presented. > > Whether the Australian authorities hacked computers in other > countries remains unclear. > > It is unclear on what authority Australian law enforcement obtained a > warrant, or whether one was obtained at all to gather IP addresses > from Piccolo and others in the US. Task Force Argos declined to answer > any questions or comment for this story. > ... > Whether using a hacking tool to grab the real IP address of a Tor user > constitutes a search in a legal sense has recently become a > contentious issue in the US. Several judges have said that suspects do > not have a reasonable expectation of privacy around their IP address > when using the Tor network, meaning that it is not protected by the > Fourth Amendment, and a hack grabbing it would not require a warrant. > The Electronic Frontier Foundation, as well as some courts, have > argued otherwise. The article seems to suggest that those taking proper security precautions would not have been impacted by this exploit. Users are warned that opening external files can compromise their security. In this case it was apparently a video file. If Tails has been designed properly this should not have been a problem for Tails users. I have not recently examined Tails, but from my understanding, in the past all traffic was routed through Tor. This would have included the video player. Most likely in that scenario if the exploit worked on Tails it would have only provided an IP address of a Tor exit node [which is not a privacy threat]. That was changed in a later version of Tails to drop traffic instead because it posed a security risk [maybe, I think most users would probably have been fine behind a NAT network assuming Tails is designed well]. This attack vector would not have worked in Tails for that reason. Now it also most likely would not have worked because the exploit almost certainly targets Microsoft's media player. The exploit (if you can call it that, given it's not designed to be privacy friendly and doesn't open up the media player or system to remote access, etc) is either a known problem that has never been fixed (not entirely sure it is an issue from a security perspective, though it is from a privacy perspective) or a new problem that should have been on the radar of any developer designing a secure privacy friendly operating system [which Microsoft Windows is not]. Microsoft Windows is a threat to your security. All proprietary software is a threat. Intel and AMD are a threat to your security. There is remote control functionality built into every Intel and AMD CPU since 2009 and 2013. It would naive to think that US companies AMD and Intel have not been ordered to insert a backdor. Intel and AMD will not release the code and have signed these components such that even if they were reversed engineered the user can't load a backdoor free version of the software. The answer to the problem is in crowd funding a new standard that has been in the works for years that modularizes critical components into a 'computer card'. By doing this it gives computer designers a less expensive way to design backdoor-free computing devices. It also lets us utilize non-Intel/AMD designed CPUs from Chinese companies. Now this is not to say China isn't a threat to users privacy and security. We know about backdoors in homegrown Chinese designed laptops. The difference is the backdoors were inserted in keyboard controller firmwares and were dependent on an OS level component to work. By modularizing the design it was possible to produce a laptop (the first ever) that we can be reasonably confident is NSA/Chinese/Russian/etc backdoor free. The keyboard and LCD controller is based off work for which we have the complete set of source code. The equivalent microcode/firmware for CPU related components are available. There is no BIOS and the bootloader and other critical driver related components we have the complete set of source code for. There are only five days left of the campaign. It is important that people contribute to it. The concept needs to succeed if we want to eventually have devices that we can be reasonably confident are secure from government(s) and other criminal elements. Here is that crowd funding campaign: https://www.crowdsupply.com/eoma68 * The people behind the project are more trustworthy than the people behind some other crowd supply campaigns. The FSF has worked with Luke (lead engineer) on ensuring the complete set of code is available. It's also the case that all code is available unlike past RYF laptops (for which there has been valid criticisms, particularly from a security stand point). Now this doesn't make this device secure in and of itself. There is a lot that has to happen. This is only going to result in a base that can be used build truly secure and privacy friendly devices. More work needs to be done at porting key software to ARM, increasing the user base to a point where fingerprinting is less effective, etc. There are significant hurdles to overcome. > " > 2. The author embedded a list of his findings in his article. > http://rixstep.com/2/2/20160817,00.shtml > "Tor 6.0.4 > ... > Why does Tor suddenly dump over 30 megabloats of steaming faeces onto > a file system on exit? > ... > Most of the junk left behind comes from an EFF extension, but this > extension has been used all along, and it serves no purpose to copy > the data out to yet another location. If this is caused by an error at > EFF, why hasn't this been corrected?" If I had to guess it's probably a bug causing some component (the plug-in) to crash. It's not abnormal for reports to be generated after a crash and written to disk. There are good reasons users whom are at serious risk should run Tails and not the Tor Browser Bundle. Tails is designed to ensure nothing gets recorded to disk (especially unencrypted). The only exception I'm aware of is related to storing data on Tor entry nodes to thwart certain types of attack (it's possible other exceptions exist). Other data can be saved to encrypted partitions. -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

1 0

Re: Revolt Against Tor Over Rape Claims, Process, Board, Etc
by Zenaan Harkness 21 Aug '16

21 Aug '16

On Sat, Aug 20, 2016 at 07:27:48PM -0400, S wrote offlist: > Doesn't it prove that Tor is awesome when state level entities are > using Tor for their comms and hiding among the traffic. Not sure how > that is a bad thing as it shows how good the Tor network is at what it > does not the other way around. Everyone has their own agendas. Let to > each their own. Tor, as Juan has pointed out so many times, is developed on only so far as the USA govt can still maintain a GPA ability. This means that technically, for some things we can "hide amongst the traffic" but only if our own chosen speech is not objected to by the USA state. Or, unless our personal op-sec is really really good. And so Tor network as it stands today is one sided - in favour of the USA government, at least in respect of certain types of speech which are very important to a sane world. In other words, the rot/crap needs to be improved, and the "community cathartic experience" of the breakdown happening in Tor community and Tor Inc is a very good thing - because, it is only the really important free speech which matters in the long term (think survival of the species etc). Accepting fundamental compromises to our principles is not the punk way - at least, it's not my way. HTH ..

1 0

Tor being forked.
by xxyyzz＠tuta.io 20 Aug '16

20 Aug '16

For those who have suggested it there's already plans and a roadmap for the fork of Tor. Two concurrent networks which are compatible with a singular browser would greatly diversify the ecosystem and give users more choice. At this point this is the only way forward imo. More info: https://rotorbrowser.com

7 11

Global warming/climate change
by everythingisscience 20 Aug '16

20 Aug '16

> Tom: > not [cpunks] Cryptography isn't limited to computers. > not scientists Science isn't limited to approved funding and certification.

1 0

Re: [tor-talk-owner@lists.torproject.org: Your message to tor-talk awaits moderator approval]
by Zenaan Harkness 19 Aug '16

19 Aug '16

On Fri, Aug 19, 2016 at 11:21:57AM -0400, John wrote: > >https://lists.torproject.org/cgi-bin/mailman/confirm/tor-talk/9f11153f5ef43… > > This whole thing is hilarious... (And depressing!!) > > I wouldn't send the actual private mailman link to the whole list tho... Any lurker can now cancel your post. Well, either someone cancelled it, or it got cancelled by the moderators. Either way, it's a sign of the state of the "community". My other two emails (there were three next to each other) got cancelled/ banned as well and as far as I am concerned they were more benign, so evidently what I have to say is no longer welcome to be said on the tor-talk mailing list.

1 0

"Smart" electrical outlets stealing passwords, 'helping the Russians' botnet the DNC
by Razer 19 Aug '16

19 Aug '16

ROTF! IMAGINE if the IoT didn't like Demoncrats! "An anonymous reader writes from a report via Softpedia: > There is an insecure IoT smart electrical socket on the market that leaks your Wi-Fi password, your email credentials (if configured), and is also poorly coded, allowing attackers to hijack the device via a simple command injection in the password field. Researchers say that because of the nature of the flaws, attackers can overwrite its firmware and add the device to a botnet, possibly using it for DDoS attacks, among other things. Bitdefender didn't reveal the device's manufacturer but said the vendor is working on a fix, which will be released in late Q3 2016. Problems with the device include a lack of encryption for device communications and the lack of any basic input sanitization for the password field "Up until now most IoT vulnerabilities could be exploited only in the proximity of the smart home they were serving, however, this flaw allows hackers to control devices over the internet and bypass the limitations of the network address translation," says Alexandru Balan, Chief Security Researcher at Bitdefender. "This is a serious vulnerability, we could see botnets made up of these power outlets." Links etc: https://news.slashdot.org/story/16/08/18/2231244/smart-electrical-socket-le…

1 0

[tor-talk-owner@lists.torproject.org: Your message to tor-talk awaits moderator approval]
by Zenaan Harkness 19 Aug '16

19 Aug '16

Official "moderation". Well, let's see if any of my recent messages to tor-talk get through :) I guess they don't want to be seen to be banning folks from the list - bit of a PR blowback perhaps? We'll see... ----- Forwarded message from tor-talk-owner(a)lists.torproject.org ----- Delivered-To: zenaan(a)gmail.com Delivered-To: zen(a)freedbms.net Date: Fri, 19 Aug 2016 08:05:06 +0000 From: tor-talk-owner(a)lists.torproject.org To: zen(a)freedbms.net List-Id: "all discussion about theory, design, and development of Onion Routing" <tor-talk.lists.torproject.org> Subject: Your message to tor-talk awaits moderator approval Your mail to 'tor-talk' with the subject Re: [tor-talk] Revolt Against Tor Over Rape Claims, Process, Board, Etc Is being held until the list moderator can review it for approval. The reason it is being held: Post to moderated list Either the message will get posted to the list, or you will receive notification of the moderator's decision. If you would like to cancel this posting, please visit the following URL: https://lists.torproject.org/cgi-bin/mailman/confirm/tor-talk/9f11153f5ef43… ----- End forwarded message -----

2 1

Re: [tor-talk] Revolt Against Tor Over Rape Claims, Process, Board, Etc
by Zenaan Harkness 19 Aug '16

19 Aug '16

On Thu, Aug 18, 2016 at 08:07:17PM +0200, Sebastian G. <bastik.tor> wrote: > At first I didn't not think the intro would make any sense in regard to > all this here, but maybe it does. Aye. > BTW, a revolt would make more noise, wouldn't it? Sure, as long as you can get your call to arms past the censors. The war is on folks - time to play hard. The seats of power are usually claimed by those with desire for power, rather than those with desire to live their lives in creativity, humility and righteousness. As a consequence, in Tor Inc as well as any other corporation and demoncratic governments around the world, sociopathic individuals predominate. And we wonder why the world is "going to shit"? Time to participate folks. Every one. Play your best moves. Do your best. Be your best. May righteousness be in your heart, Zenaan

2 1