October 2018 - cypherpunks - lists.cpunks.org

Re: Let's not keep rehashing the past, it's dead already... (Was: Fishy MegaCorpsArchy)
by grarpamp 16 Oct '18

16 Oct '18

> "the possibility of change" Of course, corporations and people can and do change all the time. Corps, often when bought / sold, or with top level staff changeover. People, whenever upon some new thought process / info / situation. And they often change back as well. > To a good approximation, literally *zero* percent of the organisations > which will benefit from "Opportunistic Onions" have ever used Onion > Services until now And they're not really involved with them under CF plan either. So they might be missing out on some oppurtunities to directly learn and participate in some neat things about tor / philosophies. > However literally 100% of the websites who can benefit from "Opportunistic > Onions" are Cloudflare customers by choice, who choose to trust Cloudflare > with their traffic, and I respect the choices of the website owners to > select different ways of scaling their services and of keeping their > systems safe from being DDoS'ed. Perhaps it is fully informed choices that should be respected. Not necessarily degress of blind ones presented by want to be saviours that might trend saying say "Tor bad" to sell product. > The people who *use* those websites can and should make their feelings > known to the website owners; but the opinions they feed back should be > balanced and considered and up-to-date and fair. > it's amazing what a little engagement and mutual respect will achieve. True. > Yes, there is much to criticise of Cloudflare's past approach towards Tor > (including tweets by the CEO) Is the suggested accepted gone-ness of that phase now qualified by its current censorship actions. > Facebook [...] blocked a large number of Tor exit nodes > The civil society & reddit communities started commenting at speed, flaming > for "censorship" Is it not good that there is now such a global rapid response awareness and capability forming to tackle censorship, privacy, human rights, and other abuses by States, Religion, and Corporations as they happen in real time. > it apparently caused nothing but vitriol and bad headlines. Which mistakes are ultimately rightly resolved as oops with no lasting effect. At least the capability is excercised peacefully without physical force, no one dies. Unlike murder and other things by the trio above, and even just peoples too. > launching facebookcorewwwi [...] three years later the New York > Times launched its own onion site. > without constructive engagement we would > probably not be where we are today Right, and the above two stories are wins for both the sites and users, and many tech toolsets, and philosophy. However that's still rare, the historical pattern remains... 1) Users of site X notice or want something and say so openly in constructive engagement, or at least initial friendly query. 2) Site X ignores them, many times because they have no protocol to even talk with users, no interfacers, it's not in their biz plan / vision, or manageable, cut expenses, clam up. 3) Users escalate. Many of us have been deep in enough Site X's to know that (2) is the hard problem. There is a curious divide between vision / profit, and users. Maybe this blockchain thingy enables micro share and stake holding, and governance, to bridge it. Who knows. > with Onion SSL Certificates Not sure that letsencrypt does this yet, if not, they should. > an official ".onion" top-level domain Yes Jacob Appelbaum et al's work resulting in RFC7686 was good. Too bad a number of other efforts got jammed / quit, because I2P and other overlay networks are a thing now too. draft-grothoff-iesg-special-use-p2p-names-04 draft-grothoff-iesg-special-use-p2p-bit draft-grothoff-iesg-special-use-p2p-exit-00 draft-grothoff-iesg-special-use-p2p-gns-00 draft-grothoff-iesg-special-use-p2p-i2p-00 Too bad CJDNS is still improperly overloading upon address space that IANA has explicitly allocated for other purposes, causing collisions and general non-interoperability. Least they could do if they can't get an allocation, or could have done, is camped on some unallocated, and unlikely to ever be used, space instead. So there's always things userland [projects] can do better to play nice. (Well above was mostly technical example.) > an increasing number of "respectable" onion websites which > are putting the lie to the "Dark Web" mythos. Onionland has always been respectable from day one, only the nonrespectable disrespected it. And dark web has never been a lie, or a myth, though perhaps indeed a legendary thing. Even at its supposed worst maybe driving change in the face for good. > Tor, and Onion Networking, is just the "More Secure Web" Other overlay networks are More Secure Web too. Unless that too is trademarked and sic'd upon. > grow it by giving people and companies the opportunities and > space to engage ... so that they can offer value to others. Those open spaces exist, things compete in it, so capitalize above it and win. > rehashing old debates and historical enmities. Recounting things can be useful, not because they note any particular actors in example, but because they note the sort of things any person or entity might want to look out for before letting something new, and similarly afflicted, grow bigger without first being fixed. Arbitrarily killing speech, when there's [almost] nowhere left for speakers to speak, is pretty fucking lame. CF did that, so now others are too, seemingly spurred. And speech around the world suffers. Perhaps a fair number here like free speech zones and social credit scores too. Perhaps they've just not seen enough postings decrying that to change their minds otherwise. Perhaps such postings were chilled and censored. What seems a big CF onion celebration here could easily have unanalyzed pitfalls, whether currently, or upon change of mind later on... Here's a couple... a) Analysis / Attack 1) Grand excuse and cover for floating the immense number of nodes needed on the hashring... very convenient for analysis and exploit attacks, including by their NSA CIA LE and / or other unknown partners / researchers. 2) Terminating colossal numbers of circuits into their AS and or administrative realm for observation / similar. 3) Even unwittingly creating easy locus for GPA / GAA. b) Key material 1) Holding onion names hostage in [non] custodial / contractual form, whether they give subscribers the [offline] crypto keys, or sell / rent / extort them, portability, multihoming. 2) Security aganst keytheft breach and subsequent impersonation of the sites from behind 7 proxies, phishing, etc. Compensation for site and user losses. Consideration of (a) alone should chill this party out a bit.

1 0

Public Shielded Room Work
by Karl 16 Oct '18

16 Oct '18

Hi, My name is Karl Semich and I have a desire to make available to everyone highly secure shielded rooms / SCIFs, for privacy and security in this modern age. I was wondering if anybody else was pursuing this, or if anybody knew of anybody pursuing this, that I might stay in contact with them or support them. Or even if anybody had some experience with this concept, and might mentor me, it would be incredible. I don't have any formal training and have developed some cognitive issues, resulting in slow progress, but this is all I am spending my free time on. I do not work a job, being supported for now by a trust. I'm currently residing in Green Bank, WV, where emissions are regulated for a radio observatory. I am trying to develop some relatively simple software using the rtl-sdr to measure the power of a noise source independent of background traffic, so as to quickly and repeatedly measure shielding effectiveness. I then plan to try to measure a variety of setups ranging from homemade aluminum foil & iron paint to soldered copper and welded or bolted stainless steel, to identify ways for everyday people to cheaply create shielded environments that are actually effective. I would like to find a way people can use off-the-shelf supplies to make environments that are isolated from DC to light, if desired. If anybody else is working on something like this, I would love to support you in any way available. I can donate money, I can get drinks and run errands, I can read books and pursue a degree if needed, I can mode hardware around and even develop and debug software. Please let me know, Karl

6 8

Re: [tor-talk] Does Facebook .onion work?
by grarpamp 16 Oct '18

16 Oct '18

> have to enter my phone and receive a code. > upload a photo that clearly shows your face. > Fair enough. Nope, fuck facebook. >> We use this photo to help us check that this account belongs to you. > We'll delete the photo once we've done this As with their [ab]use of the phone number, this is all flowery feelgood bullshit meant to satisfy and pacify the billions of sheeple that... "People just submitted it. I don't know why. They 'trust me'. Dumb fucks." -Mark Zuckerberg Even if the photo itself is somehow deleted and overwritten from all their media and backups... you should assume that the fuzzy signature of it (you) that they're using to "check" whatever... is still very much there and in use forever. You could probably test that by opening two separate accounts maybe a week apart, using the same "deleted" test picture. Else their "check" would be just another sheeply lie too. Perhaps change is meant to help kill "fake news" via enable more censorship knobs over notorious free speech. Speak on, faceless, numberless, anons.

1 0

Security Firm reminds police not to look at iPhones equipped with Face ID.
by jim bell 16 Oct '18

16 Oct '18

https://bgr.com/2018/10/15/security-firm-reminds-police-not-to-look-at-ipho… "Now that the FBI and other law enforcement agencies have started forcing suspects to unlock their iPhones with Face ID, a forensics company is warning authorities that they would be well advised not to look at Face ID-equipped iPhones. The reason? An iPhone X device, after a number of unsuccessful face scans, can only be unlocked via a passcode. This is a key distinction because a number of courts have ruled that requiring a suspect to tell authorities his passcode constitutes a violation of the 5th amendment. In contrast, having a suspect simply look at his device to unlock is perfectly fine. "Originally brought to light by Motherboard, Elcomsoft — a forensics firm based out of Moscow — recently delivered a presentation highlighting how authorities can inadvertently force an iPhone X or XS to disable Face ID and subsequently require a passcode. "In a slide obtained by Motherboard, Elcomsoft warns: “don’t look at the screen, or else… the same thing will occur as happened on Apple’s event.” [end of partial quote] If merely having a photograph of a face was sufficient to unlock the phone. , that would clearly be an inadequate security measure. Perhaps an additional security practice would be to have the phone 'learn' the face with some easy modification present, like the tongue stuck out, the tongue aimed up (or down) over the lip, or one lip over the other. Or, maybe with eyes crossed. Future phones should probably have two cameras, so that a face would be seen in stereo. Jim Bell

2 1

Re: [tor-talk] Questions about Directory Authority Servers
by grarpamp 15 Oct '18

15 Oct '18

On 10/15/18, panoramix.druida <panoramix.druida(a)protonmail.com> wrote: > Hi, > From my understanding when a Tor proxy is started it downloads a list of > relays from one of the ten Directory Authority Servers listed here: > https://metrics.torproject.org/rs.html#search/flag:authority > > Am I right? There's a second helper layer to the DA's known as fallback servers. However the DA's are still the root gatekeepers of the live network. And the DA's are also subject to higher layers that reside outside the live network... > If so who run these servers and how the people running them are chosen? I > would like to know a bit on the governance on how this authority servers are > chosen. Assuming more of analysis than operation question... Observatories appear to show the servers as being distributed around the world in various jurisdictions. They're run by whoever they appear to be run by. Both have a variety of potential attacks. The "how chosen / removed" part is informal but does have some written guidlines in torspec repo. The existance of DA design function under humans vs say distributed DHT, blockchain, AI, users clients, whatever... is thought to have certan strengths. Ultimately the fingerprints and IP's of the DA's are hardcoded and commited into the source code, which exists in repositories controlled by The Tor Project Inc, a corporation headquartered in, and on the books of, the United States of America, ran on continuum from open to closed fashion in various areas of governance, participation, etc. There's a lot more that goes into that. All of which various parts of the overall community (corp, dev, users, operators, funders, etc) also hold various opinions on (re DA's), no different than any other project. In overall re: design / subject of DA's... it's thought by most around Tor, a reasonably sound and working model, resistant to at least casual attack en masse, at least so far as any attack is publicly known to have occurred. Also keep in mind that design of Tor / DA is roughly 20 years old, thus having elements of both wisdom and legacy. > What could go wrong if one or more of these servers are compromise? Worst case? Full discovery of end to end physical locations, with concurrent compromise of traffic content. General network disruption including complete shutdown. Technical talk has been made over the years on if / should, and how, the DA's might be eliminated from the design. If the DA system is thought to be weak to various threats and attack models, or there's preference for a fully independant, distributed, and autonomous live network... people might want to review some of those talks, or draft design changes, or new overlay networks, or implement ones that are still in whitepaper form [waiting for a dev team]. The Anonbib is one good source for research reading, as are the materials and communities of other overlay networks. Note also that most things "who, where, threat models" regarding the DA's also apply to all the relays. And there is not necessarily any PKI WoT, comms, or in person relations between any given whole or subset[s] of them. Perhaps there should be, or not, or in part, and why / how... And that such subject questions, and their many fine and possible answers surely both here and before from many folks, are not unique to Tor... all the open overlay networks exhibit at least some similar elements. The code and networks are still active so... ignoring unknown conspirators, malactors, Sybils, GPA / GAA, [quantum] cryptanalysis, parallel constructions, etc... perhaps things in the space are thought good enough. Or not. One should never rest, because your adversaries will not. It's a big space, there's always room for new ideas, [better] solutions to old, hard, and new threats, incorporating new tools and strategies that didn't exist before, etc. Have fun :)

1 0

Cryptocurrency: $6k Wall, Privcoins
by grarpamp 15 Oct '18

15 Oct '18

https://old.reddit.com/r/Bitcoin/comments/9oabqq/feeling_good/ https://qph.fs.quoracdn.net/main-qimg-fc580cb0ec3a20ca831710fc9073e690 https://www.cnbc.com/2018/10/15/fidelity-launches-trade-execution-and-custo… https://old.reddit.com/r/Bitcoin/comments/9o8sb9/bitcoin_alltime_price_grap… https://www.reddit.com/r/CryptoCurrency/comments/9kkhho/monthly_skeptics_di… https://pirate.black/

1 0

Project Zero, *box, Unix, Licenses
by grarpamp 15 Oct '18

15 Oct '18

On 10/15/18, Ryan Carboni <ryacko(a)gmail.com> wrote: > Many Zerodium prices have increased by ten thousand last month. > Decrementing public Project Zero bug index IDs reveals that for this year, > there has been an average of ten bugs per month. > > Project Zero has revealed itself. The price for hacking should be $100,000 > for servers, and $10,000 for SOHO. Even at $1k each, would need a much bigger pot to find all the bugs. Automation is helping a lot. > Although I have only one complaint: Project Zero hasn’t examined busybox or > toybox, as far as I can tell. Or the crunchgen (ie: /rescue, etc) system of at least FreeBSD, which is full, unlike busybox / toybox somewhat reduced functionality versions, and implemented before busybox first release. https://www.freebsd.org/cgi/man.cgi?query=crunchgen https://cvsweb.openbsd.org/src/share/misc/license.template?rev=HEAD https://landley.net/toybox/license.html https://landley.net/toybox/about.html https://www.freebsd.org/cgi/man.cgi?query=build

1 0

Project Zero Priced Out of the Market?
by Ryan Carboni 15 Oct '18

15 Oct '18

Many Zerodium prices have increased by ten thousand last month. Decrementing public Project Zero bug index IDs reveals that for this year, there has been an average of ten bugs per month. Project Zero has revealed itself. The price for hacking should be $100,000 for servers, and $10,000 for SOHO. Although I have only one complaint: Project Zero hasn’t examined busybox or toybox, as far as I can tell.

1 0

Public Shielded Room Work
by Ryan Carboni 15 Oct '18

15 Oct '18

Work in a basement where you don’t have cell phone reception. You’ll be shielded from everything except what is directly above you, which is good enough for most people.

1 0

off the charts - “Multiracial White Supremacy” storming America - massive Alt-Huwaite influx into Proud Boys, Kanye peace trains the Oval, ++ - [PEACE]
by Zenaan Harkness 15 Oct '18

15 Oct '18

Woah! Like, duuuude! The non-Huwaite hordes are so tired and fed up with the shitlibs and Jews that they're joining the Proud Boys, Patriot Prayer and other alt-right clubs in droves, literally calling to make "Western chauvanism" great again and spouting memes and sheeeit. All outta words on this one ... “The Rise of Multiracial White Supremacy” https://dailystormer.name/lolwat-the-rise-of-multiracial-white-supremacy/ … They represent the new face of the far right that some scholars term “multiracial white supremacy.” Daily Beast direct: https://www.thedailybeast.com/why-young-men-of-color-are-joining-white-supr… Validation by the Truck Load - White Supremacist Leader Kanye Rants Against NPCs, Trickster Jews Who Stole His Music https://dailystormer.name/white-supremacist-leader-kanye-rants-against-npcs… Anglin: “As far as this being a black guy and me being an alleged white supremacist – what of it? No, I don’t think it is possible for whites and blacks to live together in peace in a system of “equality.” No one with any sense can look at America or South Africa and think that such a situation can ever result in anything other than wide-scale violence. And no, I don’t generally like black people or think that black people have very much to contribute to society. However, that doesn’t mean that if a black person comes out with something that is obviously true, I’m going to deny that it is true simply because a black person said it. Kanye doesn’t lie. His breakdown of the way the current (Jewish) social order is designed to crush creativity and the ability of the individual to make his own decisions about what is true and what is not is simply factually accurate. As were his statements in the White House with regards to the campaign of Hillary Clinton being an attack on masculinity. There are plenty of reasons to dislike black people as a group. One black guy saying something that is true doesn’t make those reasons disappear. However, denying that a single black person is capable of saying something true – and in this case, saying it to millions of people – is simply inaccurate. ” Kanye West is a Genius. We ❤ U, Kanye!! Andrew Anglin Daily Stormer October 11, 2018 https://dailystormer.name/kanye-west-is-a-genius-we-❤-u-kanye/ Posted by Kanye: The Century of the Self - Part 1: "Happiness Machines" https://www.youtube.com/watch?v=DnPmg0R1M04 (-f webm is ~300MiB) Parts 2, 3 and 4: https://www.youtube.com/watch?v=fEsPOt8MG7E https://www.youtube.com/watch?v=ub2LB2MaGoM https://www.youtube.com/watch?v=VouaAz5mQAs Media Freaking the Hell Out Over Kanye Summit…! https://dailystormer.name/media-freaking-the-hell-out-over-kanye-summit/ The Daily Stormer - #1 Kanye West Fan Site

1 0