December 2019 - cypherpunks - lists.cpunks.org

tor stinks, take #376029
by Punk-Stasi 2.0 02 Dec '19

02 Dec '19

https://www.freehaven.net/anonbib/cache/active-pet2010.pdf "Suppose the adversary runs just two routers. If we take into account the way Tor chooses circuits, the size of the network ], and the number of users observed on Tor in one day , we expect the adversary to compromise 15 users at least once in that day. If the adversary provides the top two routers by bandwidth, the expected number of compromised users increases to 9464.1 Thus, the system provides poor anonymity against a wide variety of realistic opponents, such as governments, ISPs," that comes directly from supreme scum-master syverson himself. What's really astounding is that at the same time syverson and the rest of tor shitbags advertise tor as a means for people to "protect themselves against traffic analysis". "

2 3

Zerostash: Zero-metadata object store
by grarpamp 02 Dec '19

02 Dec '19

https://github.com/rsdy/zerostash Zerostash is a deduplicated, encrypted data store that provides native versioning capabilities, and was designed to secure all metadata related to the files, including the exact size of the data that is stored in the containers. Use cases Versioned backups in the cloud, or external hard drives Encrypt and store entire workspaces for fast sync between computer Easily sync & wipe data & encryption programs while travelling Storage and sync backend for offsite backups Threat model Protect data confidentiality, integrity and authenticity The exact size of data should not be known Individual user data shouldn't be attributable on shared storage Once a data is shared, it is no longer secure. Deleting data from the storage should be possible Access to only the key and raw data should not be sufficient for full data compromise

1 0

Cryptocurrency: Anonymous to Invest $75M of Crypto to Develop Privacy Coins and Anon Tech
by grarpamp 02 Dec '19

02 Dec '19

> Is there a location at which these proposals have been published? They are not currently publishing the applications by default because they currently view that as harming potential startups. Though you can send them project press releases for publishing to: chris_unknown_fund(a)protonmail.com There are probably no third party locations because most proposals are likely to be from typical "startup" space that is usually trying to secretly extract money from each other and the market, than giving good things to the world. > Has anyone proposed what we propose doing, building > an anonymization network... done-right? Unknown. But if you're serious about doing anything with them you need to get at least some kind of hello application in now because they have a lot of apps in the pipeline, and they say applications are closed. So it'll have to be something good to bypass the rest. As to some recently mentioned ones... 1) A new general purpose secure *PA resistant internet overlay transport network built from good current and new research, including use of pluggable RF module tech. Many apps can ride. And it should be designed to be a factor stronger than tor, i2p, and all the rest are today. 2) An OpenAudited OpenFab building OpenHW (including CPU, GPU, ASIC, RF, Phones), to run all the OpenSW on. 3) There should be an application for strictly a cryptocurrency... distributed, privacy in protocol by default, cpu transaction mined, no 100GB's of blockchain history only a UTXO state db, and strictly serving only the "currency / money / cash" function, fast lightweight hard, no premine, no support for tokens, contracts, data, or any other bloatware at all, just a plain old fashioned single purpose cash. Maybe multisig and timelock for safer holding, but that's it, the less the better will yield recognition as purely money and reach primary goal of cryptocurrency adoption faster therein. It must be capable of running over anonymous overlay networks. 4) And an application for a genuine fully distributed cross-chain DEX (CCDEX) is a remaining tech that is desperately needed to help complete the cryptocurrency function space. It must be capable of running over anonymous overlay networks. Few want to do 1, 3, or 4, because when done right, there's no profit or control over other people for them to have, and that's how it should be. Though 2 can profit once it gets running, it would be better if it spent its profit to seed independant redundant copies of itself and or other needed projects. So far most of the online chatter seems to be about getting yet more pointless shitcoins off the ground than working on fundamental underlying tech the fund, or at least some of us, would like to see. I'd even help review some of the apps but I'm not in that loop. https://www.unknown.fund/ https://twitter.com/fund_unknown anon_fund(a)protonmail.com chris_unknown_fund(a)protonmail.com

3 3

Nextgen G* Traffic Analysis Resistant Overlay Networks (re Tor stinks)
by grarpamp 02 Dec '19

02 Dec '19

Various wrote: > "seconds of traffic" refers to the global buffer space > and time required for *PA find a solution within it. > I've wondered whether it's just that they need lots of users for cover > traffic. That _was_ a major factor in opening Tor to the public, instead > of restricting it to government users. But that seems unlikely, now, > given that the NSA etc could easily run enough bots on hacked servers. > My guess is that the main reason for them to get as many users as they can is to justify funding. Hell, maybe they even get a percentage of funding directly proportional to number of users/network size. > The Tor rationale for requiring low latency was to make it more > user-friendly and also thereby increase (innocent) traffic. > Unfortunately that came at the cost of easier traffic analysis, as only > the traffic passed within the last 4-5 seconds need be considered. They > tried to balance that out - more traffic plus greater usability vs > easier analysis > Initially the main reason was to increase traffic, in order to make traffic analysis harder. https://metrics.torproject.org/ Tor doesn't use traffic fill, many seem to talk about that from "omg bandwidth" rather than how it could potentially be used. A net that uses fill doesn't necessarily have to be full of 10k-10M+ whatever many users to achieve TA resistance. And even a fill net of just 100 nodes could work well for whatever users it does or doesn't have. The tor network can be quite sparse with voids of low traffic / users. Tor did traffic weighting probabilities to try to counter some of the single user paths that would obviously otherwise be created by pure random routing through such voids. However adversaries can still describe analysis and attacks against users passing strictly through only the most saturated of nodes, it's a bit harder, with fewer options, but still doable. Interestingly, such a weighting system is a gravity well... "more users" just distribute themselves into its available density slots... thus adding "more users" to the network doesn't necessarily make that type of network more secure, they just increase the physical size of the blackhole. Whether the net has 1k or 1M users, they're all going to be within some standard deviation of density that they themselves create among the well... from 1.0 when links are saturated in the singularity, out to 0.0 in voidspace. Users have no real guarantee they will fall into some feelgood safety slot, say around >=0.85, nor does it matter since as above, adversaries can still attack 1.0. A fill network can more readily use random routing, and its smaller volunteer node operators are happier since they have a more equal chance to carry traffic. Fill or non fill, random or not, your path is still subject to both the worst, and the sum of, all the headroom capacities and latencies it traverses... unless you start getting into distributing signalling for that around the network, which is probably a complex task. Tor allows users to pick empty paths if they don't care about voids. Any next generation network should have some user facing path selection knobs to handle censorship and anti-Sybil subscriptions. Also, if they know their endpoints (a local: chat friend, exit website, hidden server), a fill network might allow users to better play off jurisdictional spy buffers and performance bets by selecting local nodes only... whereas a non fill gravity network might leave voids in their region, that the less advanced adversaries in their region might otherwise more easily exploit, thus prohibiting use of local selections to achieve better latency performance, ie: for messaging during a regional / local protest, or for much faster local / guerrilla links for filesharing, etc. This notion of potentially staying local under a fill network, versus being forced to go path out through the gravity well, may also reduce load over virtual intercontinental paths, ie: the network might begin to naturally emulate backbone tiering but with no additional spy buffer risk due to the entire network fill. The Phantom network had some free thinking into developing for users to make such selections metrics over its node set. Tor still blankets users who ask about selecting nodes... with "no", and they secret up anti-Sybil bad-relay ops under "yep tor has that" "dirauths are trusted" "no worries" advertising that tend to keep independant user based efforts to do such things from starting up.

1 0

As Venezuela’s economy plunges, citizens turn to hacking and cybercrime for easy money
by Steven Schear 02 Dec '19

02 Dec '19

https://www.ehackingnews.com/2019/11/as-venezuelas-economy-plunges-citizens…

9 17

Not Even a $10 Million Reward Can Get Anyone to Come Forward About Cartel Leader's Whereabouts: Absent the AP system, why should they?
by jim bell 02 Dec '19

02 Dec '19

https://www.nbcbayarea.com/news/california/cartel-dea-10-Million-Reward-Eff… "A reward of up to $10 million for information that results in the arrest of the leader of Mexico's most violent and largest drug cartel has so far gone unclaimed, according to the U.S. Drug Enforcement Administration's Los Angeles Division.Nemesio Oseguera-Cervantes of the Cartel de Jalisco Nueva Generacion was indicted on federal drug trafficking charges in 2014 and again in 2017, said Nicole Nishida of the DEA. "This is the largest reward ever approved for the Narcotics Rewards Program," Nishida said. Oseguera-Cervantes, also known as "El Mencho," in his mid-50s, 5 feet 7 inches tall, weighs about 150 pounds, and has black hair and brown eyes." Jim Bell's comments follow: Do they understand WHY nobody has stepped forward with this information? Could it be that those with this information fear beging identified and killed if they identified themselves? Ask yourself: If you had this information, and were given two options: 1. A reward of $10 million, with the strong likelihood that you would be identified, and later killed. OR 2. A reward of $1 million, but with perfect secrecy, so that nobody other than yourself would know who provided the information. Which would you choose? I think most people would choose the latter. Most people don't want to quickly die, Nearly 25 years ago, I began writing the AP essay, https://cryptome.org/ap.htm. I described a possible future where people are rewarded for "predicting" the date of death of hated people, primarily (initially) government employees. I anticipated, and explained, that such a system would work much better if such predictors could make those predictions in such a way so as to be completely guaranteed anonymity. Nobody, including the taxman, would be any wiser about such a payment. Yet, all donors would be guaranteed that their donations would go to the actual predictor, and nobody else. If the US Government is inclined to offer $10 million for such information, wouldn't you think that they'd have anticipated the usefulness, and even the need, for such a system to allow people to provide such information in an anonymous fashion, guaranteed that they would never be identified, even to the US Government itself? As we all imagine, such information would almost certainly leak, and the provider of that information will likely be killed. If such a system were available, they'd be able to offer much smaller rewards, because the informants wouldn't have to trust the government to keep their identities secret. Worse, consider what would happen if someone with that information contacted the US Government, and provided that information. Would the USG actually pay the reward? It might if the world was eventually going to find out that the USG welshed on its offer, but is that likely to happen? How would the information-provider prove, to the public, that he was responsible for the information leaked? And how would he prove that, without identifying himself, and thus essentially destroying the anonymity that he logically wanted to have? Would the public ever learn what had actually happened? The USG could simply refuse to pay, secure in the knowledge that nobody would find out, for sure, that the information was given by that specific person, and that the USG didn't pay what it promised. In 2003, the USG began to promote a proposed system, "PAM", which was quickly dubbed by the clueless and biased news media as being "terrorism futures". Google ' "pam" "prediction" "terrorism futures" '. One result: https://www.jstor.org/stable/30026644?seq=1 by Robin Hansen. When that proposal was made, I was in USP Atwater prison, Apparently the fellow prisoners knew enough of my history to know about AP, and before I'd even become aware of PAM, some of they approached me, saying things like, 'It looks like the government is implementing your system, Bell!!'. Not exactly, of course, but close enough so that many chuckles were heard. I was surprised, on many levels. I was surprised that they would dare to implement a system that would actually WORK. It would certainly do what they intended to accomplish, but it would also prove that my AP idea was convincing, and practical, and effective. Why would they risk that? Not surprisingly, however, the PAM idea died within about a day, being dubbed "terrorism futures". How clueless the news media was! So, why would they even bother paying the informant? If future potential informants didn't know that this specific informant got stiffed, wouldn't they proceed as expected, and provide more information? Or, much more likely, they would see that nobody really knows if that informant actually was rewarded, and therefore conclude that without such proof, they shouldn't expect to see any money. I concluded the latter. That is precisely why I decided, when I wrote my AP essay, that there ought to be included a mechanism to ensure that everyone participating in that system, whether as mere 'donor', 'predictor', or merely a member of the public, is guaranteed that the system 'plays fair', and that anyone who participates gets whatever rewards he was offered. He is guaranteed that if he makes a donation, it would certainly be paid to the person who correctly predicted the date of death of the target, and would not be paid if that prediction never arrived. Jim Bell

2 3

Re: Virgil Griffith - Crypto Advocate and Educator Arrested at LAX from DPRK
by grarpamp 02 Dec '19

02 Dec '19

> no case number yet, will check SDNY PACER at end of day... Case Number: 19-mj-10987

3 3

Not Even a $10 Million Reward Can Get Anyone to Come Forward About Cartel Leader's Whereabouts
by Ryan Carboni 02 Dec '19

02 Dec '19

9/11 was being planned for a very long time. The best form of terrorism futures is shorting airlines prior to a terrorist attack. Some of which was from a "single U.S.-based institutional investor with no conceivable ties to al Qaeda." That is a very good declaration of innocence.

1 0

NSA can't break tor (roaring laughter as background)
by Punk-Stasi 2.0 01 Dec '19

01 Dec '19

https://www.freehaven.net/anonbib/cache/raptor-sec2015.pdf "Among others, the NSA has a program called Marina which stores meta information about user communications for up to a year [15], while the GCHQ has a program called Tempora that stores meta-information for 30 days and buffers data for three days [36]. Also, and maybe more importantly, it has been shown that Tor was targeted by such adversaries in collusion with ASes [10, 12, 11]. In this paper, we present Raptor, a suite of novel traffic analysis attacks that deanonymize Tor users more effectively than previously thought possible. To do so, and unlike previous studies on AS-level adversaries [28, 26,40], Raptor leverages the dynamic aspects of the Internet routing protocol, i.e. the Border Gateway Protocol (BGP)."

1 0

Not Even a $10 Million Reward Can Get Anyone to Come Forward About Cartel Leader's Whereabouts
by Ryan Carboni 01 Dec '19

01 Dec '19

$10 million for the whereabouts of a cartel leader? Mass surveillance is an amazing thing, all the high value targets are apparently lost in the noise. Besides all the multi-billion dollar contracts that the government gives out for better... services and technical consulting, $10 million seems pretty small. At the end of the day what solves the case is a fake informant and siphoning off the $10 million reward to your own holdings. No matter the technology, some things never change.

1 0