October 2018 - cypherpunks - lists.cpunks.org

Public Shielded Room Work
by Karl 16 Oct '18

16 Oct '18

Hi, My name is Karl Semich and I have a desire to make available to everyone highly secure shielded rooms / SCIFs, for privacy and security in this modern age. I was wondering if anybody else was pursuing this, or if anybody knew of anybody pursuing this, that I might stay in contact with them or support them. Or even if anybody had some experience with this concept, and might mentor me, it would be incredible. I don't have any formal training and have developed some cognitive issues, resulting in slow progress, but this is all I am spending my free time on. I do not work a job, being supported for now by a trust. I'm currently residing in Green Bank, WV, where emissions are regulated for a radio observatory. I am trying to develop some relatively simple software using the rtl-sdr to measure the power of a noise source independent of background traffic, so as to quickly and repeatedly measure shielding effectiveness. I then plan to try to measure a variety of setups ranging from homemade aluminum foil & iron paint to soldered copper and welded or bolted stainless steel, to identify ways for everyday people to cheaply create shielded environments that are actually effective. I would like to find a way people can use off-the-shelf supplies to make environments that are isolated from DC to light, if desired. If anybody else is working on something like this, I would love to support you in any way available. I can donate money, I can get drinks and run errands, I can read books and pursue a degree if needed, I can mode hardware around and even develop and debug software. Please let me know, Karl

6 8

Re: [tor-talk] Does Facebook .onion work?
by grarpamp 16 Oct '18

16 Oct '18

> have to enter my phone and receive a code. > upload a photo that clearly shows your face. > Fair enough. Nope, fuck facebook. >> We use this photo to help us check that this account belongs to you. > We'll delete the photo once we've done this As with their [ab]use of the phone number, this is all flowery feelgood bullshit meant to satisfy and pacify the billions of sheeple that... "People just submitted it. I don't know why. They 'trust me'. Dumb fucks." -Mark Zuckerberg Even if the photo itself is somehow deleted and overwritten from all their media and backups... you should assume that the fuzzy signature of it (you) that they're using to "check" whatever... is still very much there and in use forever. You could probably test that by opening two separate accounts maybe a week apart, using the same "deleted" test picture. Else their "check" would be just another sheeply lie too. Perhaps change is meant to help kill "fake news" via enable more censorship knobs over notorious free speech. Speak on, faceless, numberless, anons.

1 0

Security Firm reminds police not to look at iPhones equipped with Face ID.
by jim bell 16 Oct '18

16 Oct '18

https://bgr.com/2018/10/15/security-firm-reminds-police-not-to-look-at-ipho… "Now that the FBI and other law enforcement agencies have started forcing suspects to unlock their iPhones with Face ID, a forensics company is warning authorities that they would be well advised not to look at Face ID-equipped iPhones. The reason? An iPhone X device, after a number of unsuccessful face scans, can only be unlocked via a passcode. This is a key distinction because a number of courts have ruled that requiring a suspect to tell authorities his passcode constitutes a violation of the 5th amendment. In contrast, having a suspect simply look at his device to unlock is perfectly fine. "Originally brought to light by Motherboard, Elcomsoft — a forensics firm based out of Moscow — recently delivered a presentation highlighting how authorities can inadvertently force an iPhone X or XS to disable Face ID and subsequently require a passcode. "In a slide obtained by Motherboard, Elcomsoft warns: “don’t look at the screen, or else… the same thing will occur as happened on Apple’s event.” [end of partial quote] If merely having a photograph of a face was sufficient to unlock the phone. , that would clearly be an inadequate security measure. Perhaps an additional security practice would be to have the phone 'learn' the face with some easy modification present, like the tongue stuck out, the tongue aimed up (or down) over the lip, or one lip over the other. Or, maybe with eyes crossed. Future phones should probably have two cameras, so that a face would be seen in stereo. Jim Bell

2 1

Re: [tor-talk] Questions about Directory Authority Servers
by grarpamp 15 Oct '18

15 Oct '18

On 10/15/18, panoramix.druida <panoramix.druida(a)protonmail.com> wrote: > Hi, > From my understanding when a Tor proxy is started it downloads a list of > relays from one of the ten Directory Authority Servers listed here: > https://metrics.torproject.org/rs.html#search/flag:authority > > Am I right? There's a second helper layer to the DA's known as fallback servers. However the DA's are still the root gatekeepers of the live network. And the DA's are also subject to higher layers that reside outside the live network... > If so who run these servers and how the people running them are chosen? I > would like to know a bit on the governance on how this authority servers are > chosen. Assuming more of analysis than operation question... Observatories appear to show the servers as being distributed around the world in various jurisdictions. They're run by whoever they appear to be run by. Both have a variety of potential attacks. The "how chosen / removed" part is informal but does have some written guidlines in torspec repo. The existance of DA design function under humans vs say distributed DHT, blockchain, AI, users clients, whatever... is thought to have certan strengths. Ultimately the fingerprints and IP's of the DA's are hardcoded and commited into the source code, which exists in repositories controlled by The Tor Project Inc, a corporation headquartered in, and on the books of, the United States of America, ran on continuum from open to closed fashion in various areas of governance, participation, etc. There's a lot more that goes into that. All of which various parts of the overall community (corp, dev, users, operators, funders, etc) also hold various opinions on (re DA's), no different than any other project. In overall re: design / subject of DA's... it's thought by most around Tor, a reasonably sound and working model, resistant to at least casual attack en masse, at least so far as any attack is publicly known to have occurred. Also keep in mind that design of Tor / DA is roughly 20 years old, thus having elements of both wisdom and legacy. > What could go wrong if one or more of these servers are compromise? Worst case? Full discovery of end to end physical locations, with concurrent compromise of traffic content. General network disruption including complete shutdown. Technical talk has been made over the years on if / should, and how, the DA's might be eliminated from the design. If the DA system is thought to be weak to various threats and attack models, or there's preference for a fully independant, distributed, and autonomous live network... people might want to review some of those talks, or draft design changes, or new overlay networks, or implement ones that are still in whitepaper form [waiting for a dev team]. The Anonbib is one good source for research reading, as are the materials and communities of other overlay networks. Note also that most things "who, where, threat models" regarding the DA's also apply to all the relays. And there is not necessarily any PKI WoT, comms, or in person relations between any given whole or subset[s] of them. Perhaps there should be, or not, or in part, and why / how... And that such subject questions, and their many fine and possible answers surely both here and before from many folks, are not unique to Tor... all the open overlay networks exhibit at least some similar elements. The code and networks are still active so... ignoring unknown conspirators, malactors, Sybils, GPA / GAA, [quantum] cryptanalysis, parallel constructions, etc... perhaps things in the space are thought good enough. Or not. One should never rest, because your adversaries will not. It's a big space, there's always room for new ideas, [better] solutions to old, hard, and new threats, incorporating new tools and strategies that didn't exist before, etc. Have fun :)

1 0

Cryptocurrency: $6k Wall, Privcoins
by grarpamp 15 Oct '18

15 Oct '18

https://old.reddit.com/r/Bitcoin/comments/9oabqq/feeling_good/ https://qph.fs.quoracdn.net/main-qimg-fc580cb0ec3a20ca831710fc9073e690 https://www.cnbc.com/2018/10/15/fidelity-launches-trade-execution-and-custo… https://old.reddit.com/r/Bitcoin/comments/9o8sb9/bitcoin_alltime_price_grap… https://www.reddit.com/r/CryptoCurrency/comments/9kkhho/monthly_skeptics_di… https://pirate.black/

1 0

Project Zero, *box, Unix, Licenses
by grarpamp 15 Oct '18

15 Oct '18

On 10/15/18, Ryan Carboni <ryacko(a)gmail.com> wrote: > Many Zerodium prices have increased by ten thousand last month. > Decrementing public Project Zero bug index IDs reveals that for this year, > there has been an average of ten bugs per month. > > Project Zero has revealed itself. The price for hacking should be $100,000 > for servers, and $10,000 for SOHO. Even at $1k each, would need a much bigger pot to find all the bugs. Automation is helping a lot. > Although I have only one complaint: Project Zero hasn’t examined busybox or > toybox, as far as I can tell. Or the crunchgen (ie: /rescue, etc) system of at least FreeBSD, which is full, unlike busybox / toybox somewhat reduced functionality versions, and implemented before busybox first release. https://www.freebsd.org/cgi/man.cgi?query=crunchgen https://cvsweb.openbsd.org/src/share/misc/license.template?rev=HEAD https://landley.net/toybox/license.html https://landley.net/toybox/about.html https://www.freebsd.org/cgi/man.cgi?query=build

1 0

Project Zero Priced Out of the Market?
by Ryan Carboni 15 Oct '18

15 Oct '18

Many Zerodium prices have increased by ten thousand last month. Decrementing public Project Zero bug index IDs reveals that for this year, there has been an average of ten bugs per month. Project Zero has revealed itself. The price for hacking should be $100,000 for servers, and $10,000 for SOHO. Although I have only one complaint: Project Zero hasn’t examined busybox or toybox, as far as I can tell.

1 0

Public Shielded Room Work
by Ryan Carboni 15 Oct '18

15 Oct '18

Work in a basement where you don’t have cell phone reception. You’ll be shielded from everything except what is directly above you, which is good enough for most people.

1 0

off the charts - “Multiracial White Supremacy” storming America - massive Alt-Huwaite influx into Proud Boys, Kanye peace trains the Oval, ++ - [PEACE]
by Zenaan Harkness 15 Oct '18

15 Oct '18

Woah! Like, duuuude! The non-Huwaite hordes are so tired and fed up with the shitlibs and Jews that they're joining the Proud Boys, Patriot Prayer and other alt-right clubs in droves, literally calling to make "Western chauvanism" great again and spouting memes and sheeeit. All outta words on this one ... “The Rise of Multiracial White Supremacy” https://dailystormer.name/lolwat-the-rise-of-multiracial-white-supremacy/ … They represent the new face of the far right that some scholars term “multiracial white supremacy.” Daily Beast direct: https://www.thedailybeast.com/why-young-men-of-color-are-joining-white-supr… Validation by the Truck Load - White Supremacist Leader Kanye Rants Against NPCs, Trickster Jews Who Stole His Music https://dailystormer.name/white-supremacist-leader-kanye-rants-against-npcs… Anglin: “As far as this being a black guy and me being an alleged white supremacist – what of it? No, I don’t think it is possible for whites and blacks to live together in peace in a system of “equality.” No one with any sense can look at America or South Africa and think that such a situation can ever result in anything other than wide-scale violence. And no, I don’t generally like black people or think that black people have very much to contribute to society. However, that doesn’t mean that if a black person comes out with something that is obviously true, I’m going to deny that it is true simply because a black person said it. Kanye doesn’t lie. His breakdown of the way the current (Jewish) social order is designed to crush creativity and the ability of the individual to make his own decisions about what is true and what is not is simply factually accurate. As were his statements in the White House with regards to the campaign of Hillary Clinton being an attack on masculinity. There are plenty of reasons to dislike black people as a group. One black guy saying something that is true doesn’t make those reasons disappear. However, denying that a single black person is capable of saying something true – and in this case, saying it to millions of people – is simply inaccurate. ” Kanye West is a Genius. We ❤ U, Kanye!! Andrew Anglin Daily Stormer October 11, 2018 https://dailystormer.name/kanye-west-is-a-genius-we-❤-u-kanye/ Posted by Kanye: The Century of the Self - Part 1: "Happiness Machines" https://www.youtube.com/watch?v=DnPmg0R1M04 (-f webm is ~300MiB) Parts 2, 3 and 4: https://www.youtube.com/watch?v=fEsPOt8MG7E https://www.youtube.com/watch?v=ub2LB2MaGoM https://www.youtube.com/watch?v=VouaAz5mQAs Media Freaking the Hell Out Over Kanye Summit…! https://dailystormer.name/media-freaking-the-hell-out-over-kanye-summit/ The Daily Stormer - #1 Kanye West Fan Site

1 0

Cryptocurrency: Music
by grarpamp 15 Oct '18

15 Oct '18

1 0