April 2017 - cypherpunks - lists.cpunks.org

WhatsApp Jacked
by grarpamp 30 Apr '17

30 Apr '17

https://it.slashdot.org/story/17/04/29/1617257/encrypted-whatsapp-message-r… A terrorist's WhatsApp message has been decrypted "using techniques that 'cannot be disclosed for security reasons', though 'sources said they now have the technical expertise to repeat the process in future.'" The Economic Times reports: U.K. security services have managed to decode the last message sent out by Khalid Masood before he rammed his high-speed car into pedestrians on Westminster Bridge and stabbed to death a police officer at the gates of Parliament on March 22. The access to Masood's message was achieved by what has been described by security sources as a use of "human and technical intelligence"... The issue of WhatsApp's encrypted service, which is closed to anyone besides the sender and recipient, had come under criticism soon after the attack. "It's completely unacceptable. There should be no place for terrorists to hide. We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don't provide a secret place for terrorists to communicate with each other," U.K. home secretary Amber Rudd had said. Security sources say the message showed the victim's motive was military action in Muslim countries, while the article adds that though ISIS claimed responsibility for the attack, "no evidence has emerged to back this up."

1 0

PKI Song
by Jan Dušátko 29 Apr '17

29 Apr '17

Dear, song about Public Key Infrastructure. May you can like it: https://youtu.be/Qp9JriLfH1w Regards Jan -- Jan Dušátko Phone: +420 602 427 840 e-mail: jan(a)dusatko.org SkypeID: darmodej GPG: http://www.dusatko.org/downloads/jdusatko.asc

1 0

Compromise recovery on Qubes OS
by Mirimir 29 Apr '17

29 Apr '17

| Occasionally fuckups happen, even with Qubes (although not as | often as some think). | | What should we – users or admins – do in such a situation? | Patch, obviously. But is that really enough? What good is | patching your system if it might have already been compromised | a week earlier, before the patch was released, when an | adversary may have learned of the bug and exploited it? https://www.qubes-os.org/news/2017/04/26/qubes-compromise-recovery/

1 0

history: Tatu Ylonen announced SSH to cypherpunks in 1995
by Mirimir 28 Apr '17

28 Apr '17

| At 5:51pm on July 12, 1995, I sent an announcement about | SSH (Secure Shell) to the cypherpunks(a)toad.com mailing list. https://www.ssh.com/ssh/port Funny, no?

3 5

Chomsky and Dore: USA = Laughing Stock, Elections, Leaks, Russia, CIA, Overthrows, Spying, Etc
by grarpamp 28 Apr '17

28 Apr '17

https://www.youtube.com/watch?v=9MRQlC9wnok https://www.youtube.com/watch?v=AOz1-5do49o Full interview with Noam Chomsky on Democracy Now! talking about Donald Trump’s first 75 days in the White House and much more.

2 1

The Federal Bureau of Prisons has kidnapped Barrett Brown...
by Razer 28 Apr '17

28 Apr '17

B/c PBS. https://theintercept.com/2017/04/27/formerly-imprisoned-journalist-barrett-… https://twitter.com/FreeBarrett_/status/857649629533315073 https://twitter.com/barryeisler/status/857628730029555714

1 0

You can have my calculator...when you pry it out of my cold, dead hands.
by jim bell 27 Apr '17

27 Apr '17

http://www.autoblog.com/2017/04/26/oregon-fines-man-500-for-using-math-to-f… × Oregon fines man $500 for using math to challenge red-light cameras It's a free-speech issue. And math is math, Oregon! Few things in this world are as universally despised as traffic cameras. After his wife received a ticket for tripping a red-light camera, Oregon resident Mats Järlström openly criticized the Orwellian devices and the mathematical formulas these cameras use. It seems Big Brother doesn't take too kindly to dissenters, as according to the Institute for Justice Järlström was fined $500 for violating a law that prohibits mathematical criticism without a license. Free speech is a term that's often misconstrued. It's not some blanket to hide behind while spouting ridicule and hate to anyone and everyone. In the US, what free speech does protect is the right of a person to openly criticize the government, as Järlström was doing when he argued that the equation which governs the traffic light timers was out of date. After being fined, Järlström filed a lawsuit against the ban on mathematical debate. The Institute for Justice says the actual fine was for Järlström calling himself a "professional engineer." The thing is, Järlström does have a degree in electrical engineering, though he doesn't carry a state license. In Oregon's eyes, that doesn't make him a real engineer. Järlström's initial issue was that the green-yellow-red progression was too short for lights with a left or right turn. Using his engineering expertise, he began to criticize the math equation that governs this timing, hence the fine. Järlström and the Institute for Justice claim these licensing boards violate free speech by fining those who criticize both the boards and the government agencies behind things like traffic cameras. A lawyer for the Institute for Justice makes the point that you don't need to be a licensed lawyer to write an article disagreeing with a Supreme Court decision. Free speech, whether used to challenge Supreme Court decisions or traffic cameras, is a fundamental freedom granted by US Constitution. And it's also no stretch to say that using mathematics is a fundamental human right - part of what actually makes us human. No law can take away our math. [end of quote] Jim Bell

3 2

C programming/debugging mailing list?
by Zenaan Harkness 27 Apr '17

27 Apr '17

The detox program doesn't work quite right, so I'm trying to learn C to fix it, and part of the code looks like a bug to me. Any recommendations for appropriate mailing list to post questions? E.g. debian-devel or perhaps something lower volume? ( This particular example: repo: https://anonscm.debian.org/cgit/collab-maint/detox.git file: src/clean_string.c line: from 545: if (new_value == -1) { continue; } This is dealing with malformed unicode chars in UTF-8, and I'm pretty sure the above should actually be: if (new_value == -1) { input_walk++; continue; } otherwise, if the method actually gets a malformed UTF-8 encoded unicode character, it looks like it will loop endlessly. The bug I'm looking for is a different bug again... ) Thanks in advance, Z

2 1

AntBleed and ASICBOOST: Your Miners, Now With More Free Stuff
by grarpamp 27 Apr '17

27 Apr '17

http://www.antbleed.com/ https://www.asicboost.com/ https://www.reddit.com/r/Bitcoin/comments/67qwqv/antbleed_exposing_the_mali… https://www.reddit.com/r/btc/comments/67qzsn/antbleed_exposing_the_maliciou…

2 1

iOS' hidden surveillance system
by cpunklist＠danwin1210.me 26 Apr '17

26 Apr '17

https://gist.github.com/iosecure/357e724811fe04167332ef54e736670d I came across this github gist about surveillance on iOS and macOS. Given certain Snowden documents and other leaks, it is quite clear agencies worldwide are interested in linking unique device identifiers to real people and their activities in real time, so I consider the point about Apple's forced UDID/UUID activation system even on non-cellular devices valid. Also the point on Apple's activation server being hosted on Akamai is definitely interesting, especially given CloudFlare's recent "CloudBleed" bug (https://news.ycombinator.com/item?id=13718752; https://bugs.chromium.org/p/project-zero/issues/detail?id=1139) Akamai is of course probably already legally backdoored by multiple agencies worldwide, but given their scale you have to wonder what issues are hiding in there, especially since you also have to factor in potential security issues caused by Akamai's third party partners (Akamai subhosts on ISP/IXP peering partner servers). I'm not affiliated with the author, but just thought I'd share.

1 0