November 2019 - cypherpunks - lists.cpunks.org

Forced Decrypt: 5th Amndt Does Forbid says US State PA Supreme Court
by grarpamp 22 Nov '19

22 Nov '19

https://www.eff.org/deeplinks/2019/11/victory-pennsylvania-supreme-court-ru… https://www.eff.org/files/2019/11/20/commonwealth_v._davis_-_majority_opini… https://www.eff.org/files/2019/11/20/commonwealth_v_davis_-_amicus_brief_00… https://www.eff.org/document/state-v-andrews-eff-aclu-aclu-nj-amicus https://www.eff.org/deeplinks/2019/02/highest-court-indiana-set-decide-if-y… https://www.eff.org/files/2019/02/01/brief.pdf The Pennsylvania Supreme Court issued a forceful opinion today holding that the Fifth Amendment to the U.S. Constitution protects individuals from being forced to disclose the passcode to their devices to the police. In a 4-3 decision in Commonwealth v. Davis, the court found that disclosing a password is “testimony” protected by the Fifth Amendment’s privilege against self-incrimination. EFF filed an amicus brief in Davis, and we were gratified that the court’s opinion closely parallels our arguments. The Fifth Amendment privilege prohibits the government from coercing a confession or forcing a suspect to lead police to incriminating evidence. We argue that unlocking and decrypting a smartphone or computer is the modern equivalent of these forms of self-incrimination. Crucially, the court held that the narrow “foregone conclusion exception” to the Fifth Amendment does not apply to disclosing passcodes. As described in our brief, this exception applies only when an individual is forced to comply with a subpoena for business records and only when complying with the subpoena does not reveal the “contents of his mind,” as the U.S. Supreme Court put it. (For more on the foregone conclusion exception, see this post on a similar case currently pending in the Indiana Supreme Court.) The Pennsylvania Supreme Court agreed with EFF. It wrote: "Requiring the Commonwealth to do the heavy lifting, indeed, to shoulder the entire load, in building and bringing a criminal case without a defendant’s assistance may be inconvenient and even difficult; yet, to apply the foregone conclusion rationale in these circumstances would allow the exception to swallow the constitutional privilege. Nevertheless, this constitutional right is firmly grounded in the “realization that the privilege, while sometimes a shelter to the guilty, is often a protection to the innocent.” This ruling is vital because courts must account for how constitutional rights are affected by changes in technology. We store a wealth of deeply personal information on our electronic devices. The government simply should not put individuals in the no-win situation of choosing between disclosing a password—and turning over everything on these devices—or instead defying a court order to do so. At least two other state supreme courts, in Indiana and New Jersey, are considering similar cases. EFF is participating in both of those cases as amicus along with the ACLU. With the victory in Pennsylvania, and several other courts set to weigh in, there’s a significant chance the U.S. Supreme Court will have the last word. We hope that like the Pennsylvania court, the Supreme Court recognizes just how fundamental the Fifth Amendment right is.

3 2

Re: Re[2]: Losers of Epstein Systeml
by Ryan Carboni 22 Nov '19

22 Nov '19

On Wed, Nov 20, 2019 at 7:04 PM СЕРГЕЙ МАЛЬЦЕВ <msnmalser(a)mail.ru> wrote: > > > 265268 > > Среда, 20 ноября 2019, 20:30 +03:00 от Ryan Carboni <ryacko(a)gmail.com>: > > In the future, when foreigners buy out American democracy, they will > make sure the politician will appoint people who are competent or > won't try to start the next world war as a scorched earth tactic. > > > Also, these series of emails can't be used in evidence in a court case > for odd reasons. > > > > -- Un > СЕ� ГЕЙ МАЛЬЦЕВ I wonder what is the economic value of all this. Trillions of dollars? Tens of trillions of dollars? I wasn't aware that allowing someone to assert their constitutional rights was something so contentious. If it was I guess our civics classes ought to be updated. I am unclear what is the minimum effort or force to even accomplish these very limited aims. The amazing thing is that with all the allegations about Epstein and for how long they persisted, I guess Epstein is a ... load-bearing Jew?

1 0

Forced Decrypt: 5th Amndt Does Forbid says US State PA Supreme Court
by grarpamp 22 Nov '19

22 Nov '19

https://www.eff.org/deeplinks/2019/11/victory-pennsylvania-supreme-court-ru… https://www.eff.org/files/2019/11/20/commonwealth_v._davis_-_majority_opini… https://www.eff.org/files/2019/11/20/commonwealth_v_davis_-_amicus_brief_00… https://www.eff.org/document/state-v-andrews-eff-aclu-aclu-nj-amicus https://www.eff.org/deeplinks/2019/02/highest-court-indiana-set-decide-if-y… https://www.eff.org/files/2019/02/01/brief.pdf The Pennsylvania Supreme Court issued a forceful opinion today holding that the Fifth Amendment to the U.S. Constitution protects individuals from being forced to disclose the passcode to their devices to the police. In a 4-3 decision in Commonwealth v. Davis, the court found that disclosing a password is “testimony” protected by the Fifth Amendment’s privilege against self-incrimination. EFF filed an amicus brief in Davis, and we were gratified that the court’s opinion closely parallels our arguments. The Fifth Amendment privilege prohibits the government from coercing a confession or forcing a suspect to lead police to incriminating evidence. We argue that unlocking and decrypting a smartphone or computer is the modern equivalent of these forms of self-incrimination. Crucially, the court held that the narrow “foregone conclusion exception” to the Fifth Amendment does not apply to disclosing passcodes. As described in our brief, this exception applies only when an individual is forced to comply with a subpoena for business records and only when complying with the subpoena does not reveal the “contents of his mind,” as the U.S. Supreme Court put it. (For more on the foregone conclusion exception, see this post on a similar case currently pending in the Indiana Supreme Court.) The Pennsylvania Supreme Court agreed with EFF. It wrote: "Requiring the Commonwealth to do the heavy lifting, indeed, to shoulder the entire load, in building and bringing a criminal case without a defendant’s assistance may be inconvenient and even difficult; yet, to apply the foregone conclusion rationale in these circumstances would allow the exception to swallow the constitutional privilege. Nevertheless, this constitutional right is firmly grounded in the “realization that the privilege, while sometimes a shelter to the guilty, is often a protection to the innocent.” This ruling is vital because courts must account for how constitutional rights are affected by changes in technology. We store a wealth of deeply personal information on our electronic devices. The government simply should not put individuals in the no-win situation of choosing between disclosing a password—and turning over everything on these devices—or instead defying a court order to do so. At least two other state supreme courts, in Indiana and New Jersey, are considering similar cases. EFF is participating in both of those cases as amicus along with the ACLU. With the victory in Pennsylvania, and several other courts set to weigh in, there’s a significant chance the U.S. Supreme Court will have the last word. We hope that like the Pennsylvania court, the Supreme Court recognizes just how fundamental the Fifth Amendment right is.

1 0

MicroSoft/GitHub takes down Catalonian-run organizing tool repository, b/c Nonviolent Terrorism
by Razer 22 Nov '19

22 Nov '19

Favors owed for that massive cloud contract from the Pentagram no doubt... >From Mastodon.social. "#Spain forced Github to take down the repository used by people in #Catalonia to (d)ownload apps to organize demonstrations. In a pending process the Spanish government is trying to label Tsunami Democràtic as a terrorist organisation. The organisation calls for non-violent protests." https://mamot.fr/@felix/103170351401726054 Techcrunch: https://techcrunch.com/2019/10/30/github-removes-tsunami-democratics-apk-af… Rr Sent from my darling, DebbiAnn. Fuck you if you don't like my 'brevity'.

2 1

Cryptocurrency: Globatio
by grarpamp 22 Nov '19

22 Nov '19

https://github.com/globatio/wiki/wiki/Whitepaper jawp

1 0

Breaking and (Partially) Fixing Provably Secure Onion Routing
by grarpamp 22 Nov '19

22 Nov '19

https://arxiv.org/abs/1910.13772 After several years of research on onion routing, Camenisch and Lysyanskaya, in an attempt at rigorous analysis, defined an ideal functionality in the universal composability model, together with properties that protocols have to meet to achieve provable security. A whole family of systems based their security proofs on this work. However, analyzing HORNET and Sphinx, two instances from this family, we show that this proof strategy is broken. We discover a previously unknown vulnerability that breaks anonymity completely, and explain a known one. Both should not exist if privacy is proven correctly. In this work, we analyze and fix the proof strategy used for this family of systems. After proving the efficacy of the ideal functionality, we show how the original properties are flawed and suggest improved, effective properties in their place. Finally, we discover another common mistake in the proofs. We demonstrate how to avoid it by showing our improved properties for one protocol, thus partially fixing the family of provably secure onion routing protocols.

1 0

RFC 1984
by grarpamp 22 Nov '19

22 Nov '19

https://tools.ietf.org/html/rfc1984 23 years later and still no security or privacy. IAB and IESG Statement on Cryptographic Technology and the Internet July 24, 1996 The Internet Architecture Board (IAB) and the Internet Engineering Steering Group (IESG), the bodies which oversee architecture and standards for the Internet, are concerned by the need for increased protection of international commercial transactions on the Internet, and by the need to offer all Internet users an adequate degree of privacy. Security mechanisms being developed in the Internet Engineering Task Force to meet these needs require and depend on the international use of adequate cryptographic technology. Ready access to such technology is therefore a key factor in the future growth of the Internet as a motor for international commerce and communication. The IAB and IESG are therefore disturbed to note that various governments have actual or proposed policies on access to cryptographic technology that either: (a) impose restrictions by implementing export controls; and/or (b) restrict commercial and private users to weak and inadequate mechanisms such as short cryptographic keys; and/or (c) mandate that private decryption keys should be in the hands of the government or of some other third party; and/or (d) prohibit the use of cryptology entirely, or permit it only to specially authorized organizations. We believe that such policies are against the interests of consumers and the business community, are largely irrelevant to issues of military security, and provide only a marginal or illusory benefit to law enforcement agencies, as discussed below. The IAB and IESG would like to encourage policies that allow ready access to uniform strong cryptographic technology for all Internet users in all countries. The IAB and IESG claim: The Internet is becoming the predominant vehicle for electronic commerce and information exchange. It is essential that the support structure for these activities can be trusted. Encryption is not a secret technology monopolized by any one country, such that export controls can hope to contain its deployment. Any hobbyist can program a PC to do powerful encryption. Many algorithms are well documented, some with source code available in textbooks. Export controls on encryption place companies in that country at a competitive disadvantage. Their competitors from countries without export restrictions can sell systems whose only design constraint is being secure, and easy to use. Usage controls on encryption will also place companies in that country at a competitive disadvantage because these companies cannot securely and easily engage in electronic commerce. Escrow mechanisms inevitably weaken the security of the overall cryptographic system, by creating new points of vulnerability that can and will be attacked. Export controls and usage controls are slowing the deployment of security at the same time as the Internet is exponentially increasing in size and attackers are increasing in sophistication. This puts users in a dangerous position as they are forced to rely on insecure electronic communication. TECHNICAL ANALYSIS KEY SIZE It is not acceptable to restrict the use or export of cryptosystems based on their key size. Systems that are breakable by one country will be breakable by others, possibly unfriendly ones. Large corporations and even criminal enterprises have the resources to break many cryptosystems. Furthermore, conversations often need to be protected for years to come; as computers increase in speed, key sizes that were once out of reach of cryptanalysis will become insecure. PUBLIC KEY INFRASTRUCTURE Use of public key cryptography often requires the existence of a "certification authority". That is, some third party must sign a string containing the user's identity and public key. In turn, the third party's key is often signed by a higher-level certification authority. Such a structure is legitimate and necessary. Indeed, many governments will and should run their own CAs, if only to protect citizens' transactions with their governments. But certification authorities should not be confused with escrow centers. Escrow centers are repositories for private keys, while certification authorities deal with public keys. Indeed, sound cryptographic practice dictates that users never reveal their private keys to anyone, even the certification authority. KEYS SHOULD NOT BE REVEALABLE The security of a modern cryptosystem rests entirely on the secrecy of the keys. Accordingly, it is a major principle of system design that to the extent possible, secret keys should never leave their user's secure environment. Key escrow implies that keys must be disclosed in some fashion, a flat-out contradiction of this principle. Any such disclosure weakens the total security of the system. DATA RECOVERY Sometimes escrow systems are touted as being good for the customer because they allow data recovery in the case of lost keys. However, it should be up to the customer to decide whether they would prefer the more secure system in which lost keys mean lost data, or one in which keys are escrowed to be recovered when necessary. Similarly, keys used only for conversations (as opposed to file storage) need never be escrowed. And a system in which the secret key is stored by a government and not by the data owner is certainly not practical for data recovery. SIGNATURE KEYS Keys used for signatures and authentication must never be escrowed. Any third party with access to such keys could impersonate the legitimate owner, creating new opportunities for fraud and deceit. Indeed, a user who wished to repudiate a transaction could claim that his or her escrowed key was used, putting the onus on that party. If a government escrowed the keys, a defendant could claim that the evidence had been forged by the government, thereby making prosecution much more difficult. For electronic commerce, non- repudiation is one of the most important uses for cryptography; and non-repudiation depends on the assumption that only the user has access to the private key. PROTECTION OF THE EXISTING INFRASTRUCTURE In some cases, it is technically feasible to use cryptographic operations that do not involve secrecy. While this may suffice in some cases, much of the existing technical and commercial infrastructure cannot be protected in this way. For example, conventional passwords, credit card numbers, and the like must be protected by strong encryption, even though some day more sophisticated techniques may replace them. Encryption can be added on quite easily; wholesale changes to diverse systems cannot. CONFLICTING INTERNATIONAL POLICIES Conflicting restrictions on encryption often force an international company to use a weak encryption system, in order to satisfy legal requirements in two or more different countries. Ironically, in such cases either nation might consider the other an adversary against whom commercial enterprises should use strong cryptography. Clearly, key escrow is not a suitable compromise, since neither country would want to disclose keys to the other. MULTIPLE ENCRYPTION Even if escrowed encryption schemes are used, there is nothing to prevent someone from using another encryption scheme first. Certainly, any serious malefactors would do this; the outer encryption layer, which would use an escrowed scheme, would be used to divert suspicion. ESCROW OF PRIVATE KEYS WON'T NECESSARILY ALLOW DATA DECRYPTION A major threat to users of cryptographic systems is the theft of long-term keys (perhaps by a hacker), either before or after a sensitive conversation. To counter this threat, schemes with "perfect forward secrecy" are often employed. If PFS is used, the attacker must be in control of the machine during the actual conversation. But PFS is generally incompatible with schemes involving escrow of private keys. (This is an oversimplification, but a full analysis would be too lengthy for this document.) CONCLUSIONS As more and more companies connect to the Internet, and as more and more commerce takes place there, security is becoming more and more critical. Cryptography is the most powerful single tool that users can use to secure the Internet. Knowingly making that tool weaker threatens their ability to do so, and has no proven benefit.

1 0

tor stinks, take #376030
by Punk-Stasi 2.0 21 Nov '19

21 Nov '19

"All low-latency systems as currently designed and deployed are essentially broken against The Man" signed : scum-master syverson, supreme leader of the tor mafia. https://www.freehaven.net/anonbib/cache/entropist.pdf (Oh of course, 'all low latency systems' includes tor.) But now listen to the little piece of lying shit, US military agent snowflake, aka edward snwoden : "EGOTISTICALGIRAFFE was an NSA program intended to exploit a vulnerability in certain Web browsers running Tor, since they couldn’t break Tor itself" The NSA couldn't break tor itself? =) Yeah right.

1 0

All anyone could hope for
by Ryan Carboni 21 Nov '19

21 Nov '19

All anyone could hope for is solving world hunger, solving for world peace, and solving world poverty. Maybe best two out of three. Maybe just for half the world. Certainly it is worth some kind of shot.

1 0

advertising - linux phone
by Punk-Stasi 2.0 21 Nov '19

21 Nov '19

https://store.pine64.org/?product=pinephone-braveheart-limited-edition-linu… the ARM SoC is chinese which doesn't seem too encouraging, but philips(used by purism) may be just as bad.

1 0