March 2020 - cypherpunks - lists.cpunks.org

WhatsApp security flaw: 1000s of links to groups incl. 'Closed Groups' easily found
by Razer 07 Mar '20

07 Mar '20

"A DW journalist recently discovered WhatsApp links that lead to closed groups could be found with a simple Google search." "WhatsApp links that lead to closed groups can be found with a simple Google search — a major security flaw revealed by DW last week (link). Following social media outrage, the links were removed from Google’s search results. Despite the removal, however, publicly-available internet archives are still storing the information, as security researcher Lav Kumar has found out. He gathered and organized over 60,000 unique links, which can still be found on multiple websites. Of the 1,000 randomly selected links DW tested, 427 were active chat links. Even without actively joining a group, its title, description, image and creator's phone number are available for all. However, upon entering a group, it is possible to also see the phone numbers of up to 256 participants, as well as other information, and adding these numbers to one's contacts can reveal their names in the app. "We show all numbers in groups for people's safety that way they know who will receive their messages," WhatsApp told DW in response. Real-life danger Using this information, DW gained access to a group described as "Ministry of finance civil servants" in Indonesia, revealing the phone numbers of all 14 members. Several other groups appeared to be official support groups for the campaign of Brazilian President Jair Bolsonaro. Among the 427 active links DW examined, there were groups described to be for school classes, medical trainees, political campaigns, businesses, pornography and sex workers. Some groups included members with particularly sensitive identities, such as one chat with hundreds of members clearly labeled as an LGBTQ+ group in a Latin American country with high rates of homophobic murders. In some cases, the group image looked like amateur pornography or had titles such as "ex-wives leaked videos," raising questions of consent. (screenshot)" Also listed were potential terrorist groups and groups advertised as for sharing footage of "extreme" sexual content, including rape. A small number indicated that they were for child pornography. WhatsApp told DW that the company has a zero-tolerance policy around child sexual abuse and bans users immediately if they are found sharing content that exploits or endangers children. The platform also claims to ban approximately 250,000 accounts each month suspected of sharing exploitative images of children and relies on user reports and all unencrypted information to do so. 'Useful for terrorism chats' In response to the revelations, some Twitter users pointed out that this information could be used by authorities to track down illegal content without WhatsApp offering an official "backdoor" to encrypted content. "Of course there is a possibility that they left it open to search for problem groups," Jake Moore, a cybersecurity specialist and former Head of Digital Forensics at a British police force, told DW, "they aren’t always too keen to help law enforcement, so might have found it beneficial to offer it out to law enforcement and not openly mention it." On whether law enforcement would use this proactively to identify crime, Moore said: "Most police forces aren’t that proactive, [but] rather reactive. However, I would imagine it would be useful for terrorism chats, yet I doubt they use WhatsApp." However, investigations into far-right terrorism in Germany show that organizations have used Whatsapp to introduce members to each other. Read more: German far-right extremists met on WhatsApp, planned mosque attacks" More links: https://www.dw.com/en/whatsapp-security-flaw-over-60000-groups-still-access…

1 0

Re: cypherpunks Digest, Vol 81, Issue 14
by Philipp Angele 07 Mar '20

07 Mar '20

True. "Pure" randomness will always be preferred to provide a maximum security. If you need a key that you feel could keep your data encrypted for 50 years, geokeys would not be a good choice. However if it is short term use like with bitcoin you can do a trade of between level of key security and risk of losing the key. You would not have to make sure the encryption lasts for 50 years but only as long as you want to keep this key. > Am 06.03.2020 um 14:17 schrieb cypherpunks-request(a)lists.cpunks.org: > > > Even though it would be hard to guess a secret key, this technique reduces the security provided by a secret key made of pure random bits. > true? > >> Please try the POC and share your thoughts: https://github.com/oscar-davids/geokeytool <https://github.com/oscar-davids/geokeytool> >> >> Geokeys for Bitcoin and Ether and other killer apps like pgp, ssh

1 0

The Verge: A major new Intel processor flaw could defeat encryption and DRM protections
by jim bell 07 Mar '20

07 Mar '20

The Verge: A major new Intel processor flaw could defeat encryption and DRM protections. https://www.theverge.com/2020/3/6/21167782/intel-processor-flaw-root-of-tru…

3 3

War on Crypto: EARN-IT Act to Destroy End-to-End Crypto, Establish Internet Overlords, Kill Free and Private Speech
by grarpamp 06 Mar '20

06 Mar '20

https://act.eff.org/action/protect-our-speech-and-security-online-reject-th… https://www.eff.org/deeplinks/2020/01/congress-must-stop-graham-blumenthal-… https://www.privateinternetaccess.com/blog/2020/02/the-earn-it-act-is-the-l… https://www.wired.com/story/earn-it-act-sneak-attack-on-encryption/ https://arstechnica.com/tech-policy/2020/03/proposed-us-law-is-trojan-horse… https://reason.com/2020/01/31/lindsey-graham-wants-to-use-mistrust-of-big-t… https://libertarianhub.com/2020/01/31/congress-must-stop-the-graham-blument… https://www.wsws.org/en/articles/2020/02/08/encr-f08.html https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-ban-end-end-encr… https://gizmodo.com/lindsey-graham-is-quietly-preparing-a-mess-of-a-bill-tr… https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-ban-end-end-encr… https://www.lawfareblog.com/earn-it-act-raises-good-questions-about-end-end… https://www.missingkids.org/blog/2019/post-update/end-to-end-encryption https://www.missingkids.org/blog/2020/earn-it-act-2020 https://www.judiciary.senate.gov/press/rep/releases/graham-blumenthal-hawle… https://www.justice.gov/opa/pr/department-justice-hold-workshop-section-230… https://www.insurancejournal.com/news/national/2019/07/10/531688.htm https://blog.ericgoldman.org/archives/2020/02/the-earn-it-act-is-another-te… https://blog.cryptographyengineering.com/2020/03/06/earn-it-is-an-attack-on… https://netchoice.org/netchoice-announces-opposition-to-sen-grahams-earn-it… https://www.newamerica.org/oti/press-releases/oti-strongly-opposes-earn-it-… https://old.reddit.com/r/Libertarian/comments/f015qn/holding_section_230_ho… https://old.reddit.com/r/technology/comments/f0g6g9/holding_section_230_hos… https://www.schneier.com/blog/archives/2019/12/reforming_cda_2.html https://www.schneier.com/blog/archives/2019/01/alex_stamos_on_.html https://www.schneier.com/blog/archives/2019/12/scaring_people_.html https://www.theverge.com/2020/1/31/21116788/earn-it-act-section-230-lindsey… https://www.theverge.com/2020/3/5/21162983/congress-senate-earn-it-act-lind… https://www.cato.org/blog/holding-230-hostage-sen-graham-demands-platforms-… https://www.techdirt.com/articles/20200131/11252343832/lindsey-grahams-snea… https://www.engadget.com/2020/01/31/earn-it-act-bill-would-limit-encryption/ https://cdt.org/insights/privacy-free-expression-and-security-threatened-by… https://cdt.org/press/earn-it-act-threatens-encryption-free-expression-and-… https://news.ycombinator.com/item?id=22505302 "The argument from those in power against encryption is mind-bogglingly stupid, and I don't know if it is due to an extreme ignorance, or because of a lust for the power and leverage that mass surveillance grants a governing entity, I suppose it could be both" "Sounds more like an end-run on the US Constitution. There isn't any difference in my mind between the government executing unconstitutional searches and the government requiring companies to conduct searches that if conducted by the government would be unconstitutional. Warrant-less searches by the federal government are unconstitutional; getting a warrant requires having probable cause. Without probable cause and a warrant, requiring a company to conduct searches on behalf of the government is unconstitutional as well." "Yes. That's what end-to-end encryption is, a new language that only those two systems know how to speak. I'll be the asshat marked troll for saying this too, but sorry kids. Child exploitation is a scourge on our society, but stopping isn't isn't worth the price of losing our rights to privacy to talk amongst each other. It's just not. There. Said it. The ends don't justify the means in this case. We can't end every freedom we've fought for in the name of ending child exploitation." "This is about controlling the rest of us. Criminals, as we and the government know, are perfectly capable of using strong encryption. I've seen over and over these weak excuses, these pathetic fig leaves Congress-critters use. They don't provide them because they believe them or because the goats will accept them. They provide them for the purposes of the propaganda, the fodder they and they owned media put out for the sheep." "It's the same nonsense you hear over here in Europe when it comes to surveillance. No matter how many liberties they take away and how much they spy on people by putting everyone under the blanket of suspicioun, it's never seems to be enough. Shit still happens and even appears to be getting worse if we look at the current racist extremism in Germany for example. Now there's an entirely new thing to be afraid of - a large dark figure of far-right extremism that has somehow gone unnoticed and is growing despite all the domestic spying that is already done. So what's to be done about that? Their answer appears to be always along the same lines: we're not spying enough. More will fix this. Hence I'd expect that would be a dangerous step to satisfy one's curiosity as things are not likely to change that much except that the erosion of freedoms progressed one step further to widespread acceptance." "Personally if it comes down to a choice between weaker security for everyone or letting bad guys go free (be they someone who wants to rob the local liquor store and steal a few bucks and a bottle of Jack Daniels, someone who wants to shoot up the local church because the church doesn't believe in the right god, someone who jacks off to photos of 5 year old kids or someone who wants to fly a plane full of people into the side of a building, I will take the strong security over catching the bad guys." "If we ask tech companies to fix ancient societal ills that are now reflected online with moderation, then we will end up with huge, democratically-unaccountable organizations controlling our lives in ways we never intended. And those ills will still exist below the surface."

1 0

Schulte Trial Update
by John Young 06 Mar '20

06 Mar '20

Joshua Schulte trial jury "aligned on two counts," impasse on remaining eight counts, may be considered a loss for the prosecution, to continue on Monday. Via http://www.innercitypress.com/sdnylive26schulte030620.html

1 0

Sorry for calling you old Jim
by rooty 06 Mar '20

06 Mar '20

Hi Jim I wanted to apologise for calling you old. At 81 years young Viagra has given new life - Your friend rooty

1 0

Trump tells Republicans he wont' extend surveillance law without significant reform.
by jim bell 06 Mar '20

06 Mar '20

https://www.nationalreview.com/news/trump-tells-republicans-he-wont-extend-… Good if it happens, but.... Jim Bell

1 0

"Earn it" act is sneak attack on encryption.
by jim bell 06 Mar '20

06 Mar '20

https://www.wired.com/story/earn-it-act-sneak-attack-on-encryption/

1 0

Mali GPU open source drivers
by Zenaan Harkness 06 Mar '20

06 Mar '20

Noting this: https://www.collabora.com/news-and-blog/blog/2019/12/20/opening-up-mali-t72… brings to mind the following thoughts: - open source gets to parity, it just take s a while when reverse engineering is required - once parity is met, superiority in performance, cross platform support and stability, are all close on the heels - once this is achieved, closed source drivers are no longer competitive - at this point, corporations have various incentives/motives to use the floss drivers, rather than the old, deficient proprietary drivers (no more development/test/etc cost per se) and finally: - so those who cock blocked release of specs (thereby requiring said reverse engineering) ought be publicly named and shamed, for the great cost they effectively imposed upon the community of floss developers

1 0

"There are FIVE variants of coronavirus. Only ONE showed up in China..." and...
by Razer 06 Mar '20

06 Mar '20

Wait for it... "There are FIVE variants of coronavirus. Only ONE showed up in China..." and the deadliest variety seems to have landed in... wait for it... Iran. Pepe Escobar: "I had already referenced the crucial Global Times report - but this brings it to a whole new level, incorporating Chinese, Japanese and Taiwanese scientific analysis. The killer paragraphs are these: "The geographical location with the greatest diversity of virus strains must be the original source because a single strain cannot emerge from nothing. He demonstrated that only the US has all the five known strains of the virus (while Wuhan and most of China have only one, as do Taiwan and South Korea, Thailand and Vietnam, Singapore, and England, Belgium and Germany), constituting a thesis that the haplotypes in other nations may have originated in the US. Korea and Taiwan have a different haplotype of the virus than China, perhaps more infective but much less deadly, which would account for a death rate only 1/3 that of China. Neither Iran nor Italy were included in the above tests, but both countries have now deciphered the locally prevalent genome and have declared them of different varieties from those in China, which means they did not originate in China but were of necessity introduced from another source. It is worth noting that the variety in Italy has approximately the same fatality rate as that of China, three times as great as other nations, while the haplotype in Iran appears to be the deadliest with a fatality rate of between 10% and 25%. (7) (8) (9)" So to recap: there are FIVE variants of coronavirus. Only ONE showed up in China - as well as in South Korea and Taiwan. Less deadly variant in S. Korea than in China. Variants in Italy and Iran DID NOT originate in China. Deadliest variant is in Iran. If all that is confirmed beyond a shadow of a doubt, imagine the repercussions." https://www.globalresearch.ca/china-coronavirus-shocking-update/5705196 Rr

2 1