April 2020 - cypherpunks - lists.cpunks.org

About Love... <3
by Cecilia Tanaka 09 Apr '20

09 Apr '20

My loved friends, I need to thank you all sharing the good news. Thanks to this awesome list, I've found my true love. <3 Juan is the man of my life. I am completely in love and this strong passion burns my heart and soul. <3 My mom is very happy because they have the same taste for anime and he understands Japanese much better than me. Both think Evangelion is boring, meh! :(( My dad is satisfied because Juan loves meat and daddy thinks he will be a really good influence for me. My father hates vegans... :P So, my lovely friends, wish you all the best... Happiness, laugh, music, and much love! <3 Ceci

5 14

Diplomat suffered memory loss while stationed in China.
by jim bell 09 Apr '20

09 Apr '20

Anyone with an Android smartphone should be able to download an audio spectrum analyzer app to detect various sonic events. Further, I believe that USB-connected SDR's (Software-Defined Radios) which can implement cheap spectrum analyzers are cheaply available. https://www.walmart.com/ip/100KHz-1-7GHz-Full-Band-UV-HF-RTL-SDR-USB-Tuner-… $25.31, in kit form.Although, this specific one is limited to 100Khz-1 GHz. Anything reasonably usable to go to at least 3 GHz. Jim Bell BY BOB SALSBERG, Associated Press BOSTON (AP) — A U.S. diplomat who said he suffered headaches and memory loss under mysterious circumstances while stationed in China pledged Friday to donate his brain to head injury researchers. Mark Lenzi, 44, is an unusual addition to the several thousand others, including many former NFL players who suffered concussions during their careers, who previously signed agreements to have their brains studied after they die by the CTE Center at Boston University. A security engineer for the U.S. State Department, Lenzi was among a number of diplomats who were brought home last year from the U.S. Consulate in Guangzhou, China, after reporting as-yet-unexplained symptoms. The State Department has drawn no link between those diplomats and 26 workers at the U.S. Embassy in Cuba who were withdrawn in 2017 after reporting symptoms, including those consistent with minor traumatic brain injury, or concussion. "The engineer in me wants to get to the bottom of this type of concussion and exactly what happened to me," Lenzi said while signing the pledge in Boston with representatives of the Concussion Legacy Foundation, an organization that collaborates with the BU researchers by recruiting donors and publicizing the dangers associated with head trauma. Chris Nowinski, co-founder and chief executive of the foundation, said the brain injury community must continue research to find answers for head trauma. "There are patients out there that need answers from the scientific community," he said. Lenzi now works at a State Department passport office in his native New Hampshire. He said he and his wife began hearing strange noises in their apartment in 2017, and later developed symptoms consistent with concussion. In an interview with the AP, he said he initially did not associate the noises with the symptoms, believing the headaches may have been triggered by smog. Lenzi has not been identified by U.S. officials as someone suffering from injuries similar to those suffered by diplomats in Cuba. The State Department said Friday that out of 15 diplomats or family members from China who underwent additional medical evaluation in the U.S., 14 were found not to have symptoms like those from Cuba and the other case had not been determined. [end of partial quote]

4 3

Organ Harvesting - "good business practice" - China's evil underbelly - [PEACE]
by Zenaan Harkness 09 Apr '20

09 Apr '20

Business - "take advantage" (in Chinese) - "good Chinese business practice" where if someone's on death row, why not make good use of their organs? And if someone with an organ you need, is not on death's row, perhaps they're involved in an illegal religion and can be 'disappeared' with state support... Aka, why we should disengage from China, why we should not buy Chinese, why we should hold ourselves to higher standards than the very Jewish slave and organ harvesting trades. Robert Kaplan lays out a simple parable to make this even easier to understand. The Moral Case For Decoupling From China https://www.zerohedge.com/geopolitical/moral-case-decoupling-china https://www.americanthinker.com/articles/2019/12/the_moral_case_for_decoupl… http://www.youtube.com/watch?v=w-2cArChw5M ~290MiB with -F18 ... The whole 68-minute interview is interesting but where he is a thought leader is in his parable of the delicatessen, transcribed below: "Suppose you lived on 86th st and at the local delicatessen with fine produce, at the front of the shop were all these goodies. But if you went to the very back of the shop there were sort of vats which were kept just above freezing which had freshly harvested kidneys and livers and hearts and all the things which are used at this moment. … People are being killed so their organs can be used for transplants. Many of which go to the very elderly Chinese leadership or their children. The son of one of the recent leaders of China has had cancer and he has had many organs replaced. Well, what would you say about this shop. Would you say, well, I think I’ll just shop in the front of the shop and I won’t pay any attention to the fact that there are all these living human organs, God knows where they came from, that are in the back. What you would say is ‘What the heck is this shop doing in America?’ You can’t decouple these things. This is one integral system. And that is one of the reasons we have to quarantine China economically. A rationalisation for saying ‘Well yes it’s true that there is some question with what Hitler is doing with the gypsies and the Jews but Leica still makes a hell of a good camera.” ...

2 2

Re: [nfsv4] TLS Fingerprint Pinning Needed
by grarpamp 09 Apr '20

09 Apr '20

> There is a general encryption proponent mandate RFC... One might also try full text RFC search for "fingerprint" references in context of "TLS" (or the older "SSL"). The following incomplete list all in manner of spirit do generally give rise and encourage the offering and enablement of such security option sets in apps / protocols utilizing TLS... Recommendations for Secure Use of Transport Layer Security (TLS) https://tools.ietf.org/html/rfc7525 Pervasive Monitoring Is an Attack https://tools.ietf.org/html/rfc7258 Privacy Considerations for Internet Protocols https://tools.ietf.org/html/rfc6973 Certificate Transparency https://tools.ietf.org/html/rfc6962 Strong Security Requirements for Internet Engineering Task Force Standard Protocols https://tools.ietf.org/html/rfc3365 Guidelines for Writing RFC Text on Security Considerations https://tools.ietf.org/html/rfc3552 IETF Policy on Wiretapping https://tools.ietf.org/html/rfc2804 IAB and IESG Statement on Cryptographic Technology and the Internet https://tools.ietf.org/html/rfc1984 "It is the consensus of the IETF that IETF standard protocols MUST make use of appropriate strong security mechanisms." Privacy Requirements for IETF Protocols https://tools.ietf.org/html/draft-cooper-ietf-privacy-requirements-01 It is the consensus of the IETF that our protocols be designed to avoid privacy violations to the extent possible. Handling Pervasive Monitoring in the IETF (perpass) (WG) https://www.ietf.org/proceedings/88/perpass.html https://www.ietf.org/mailman/listinfo/perpass Not requiring app (NFS) spec implementations to have some options for some of the previously noted modes of fingerprint checking to help avoid some TLS MITM attacks, would seem to be in conflict with all above.

1 0

Covid19: US FBI Launches Physical Fitness Spy Tracking App, GoogleCIA Flexes FitBit, Surveillance Valley on Virus
by grarpamp 09 Apr '20

09 Apr '20

https://twitter.com/EFF/status/1243335750696833024 The FBI is prompting you to download a home workout app during the quarantine. Looks like it's not free of third party analytics libraries: mobile company AppCelerator can tell when you're using the app, and what screen you're on. https://twitter.com/FBI/status/1242058787160313857 #MondayMotivation Are you looking for tips for indoor workouts? Download the #FBI’s Physical Fitness Test app to learn proper form for exercises you can do at home like pushups and situps. http://ow.ly/6y3f50yQeHj https://www.eff.org/deeplinks/2020/04/google-fitbit-merger-would-cement-goo… https://wikileaks.org/google-is-not-what-it-seems/ Yasha Levine, “Surveillance Valley has put a billion bugs in a billion pockets,” Pando Daily, 7 February 2014, archive.today/TA7sq https://theintercept.com/2017/11/24/staggering-variety-of-clandestine-track… Researchers at Yale Privacy Lab and French nonprofit Exodus Privacy have documented the proliferation of tracking software on smartphones, finding that weather, flashlight, ride-sharing, and dating apps, among others, are infested with dozens of different types of trackers collecting vast amounts of information to better target advertising. Exodus security researchers identified 44 trackers in more than 300 apps for Google’s Android smartphone operating system. The apps, collectively, have been downloaded billions of times. Yale Privacy Lab, within the university’s law school, is working to replicate the Exodus findings and has already released reports on 25 of the trackers. Yale Privacy Lab researchers have only been able to analyze Android apps but believe many of the trackers also exist on iOS, since companies often distribute for both platforms. To find trackers, the Exodus researchers built a custom auditing platform for Android apps, which searched through the apps for digital “signatures” distilled from known trackers. A signature might be a telltale set of keywords or string of bytes found in an app file, or a mathematically derived “hash” summary of the file. The findings underscore the pervasiveness of tracking despite a permissions system on Android that supposedly puts users in control of their own data. They also highlight how a large and varied set of firms are working to enable tracking.

1 0

Cypherpunks list planned downtime
by Greg Newby 08 Apr '20

08 Apr '20

I will be upgrading the main pglaf.org server starting the morning of Saturday, April 11 (by around 10am Eastern Daylight Time). During this time, the Cypherpunks list and archives will be unavailable: https://lists.cpunks.org No email will be sent out. Incoming email will be queued or deferred. Let me know if you have any questions about what will be unavailable. This upgrade should not impact any of the behaviors of the services, once they are restored. - Greg

1 0

Watch this space: "Rhode Island National Guard to Conduct House-To-House Searches to Hunt Down New Yorkers"
by Zenaan Harkness 08 Apr '20

08 Apr '20

Interesting times - watch this space: INSANITY: Rhode Island National Guard to Conduct House-To-House Searches to Hunt Down New Yorkers https://www.anti-empire.com/insanity-rhode-island-national-guard-to-conduct… Rhode Island police began stopping cars with New York plates Friday. On Saturday, the National Guard will help them conduct house-to-house searches to find people who traveled from New York and demand 14 days of self-quarantine. .. Many New Yorkers have summer houses in Rhode Island, especially in tony Newport, and the governor said the authorities would be checking there. “Yesterday I announced and today I reiterated: Anyone coming to Rhode Island in any way from New York must be quarantined,” the governor said. “By order. Will be enforced. Enforceable by law.” Raimondo signed an executive order Thursday that applies to anyone who has been in New York during the past two weeks and through at least April 25. It doesn’t apply to public health, public safety, or health-care workers. National Guard members will be stationed at the T.F. Green airport, Amtrak train stations and at bus stops. The citizen-soldiers will be following up with people at local residences. The maximum penalty for not complying: a fine of $500 and 90 days in prison. The local chapter of the American Civil Liberties Union blasted the new rules, objecting to the collection of motorists’ contact information in particular. ..

3 4

ZDNet: DarkHotel hackers use VPN zero-day to breach Chinese government agencies
by jim bell 08 Apr '20

08 Apr '20

ZDNet: DarkHotel hackers use VPN zero-day to breach Chinese government agencies. https://www.zdnet.com/article/darkhotel-hackers-use-vpn-zero-day-to-comprom…

2 1

Re: [tor-talk] Jitsi Meet over Tor
by grarpamp 08 Apr '20

08 Apr '20

> Yes, VoIP via UDP works very well through Tor with OnionCat. However, > both endpoints must be running Tor and OnionCat. Basically, all devices > running Tor and OnionCat have IPv6 addresses in the same /48 subnet. So > any such device can connect with any other. > But _not_ with any other IPv6 (or IPv4) address. It's entirely possible to have some comms peers on clearnet in same chatscreen panel mashup at the same time with peers on onioncat/48, i2p.etc. It all depends on the routing horizons, and or hub selections, users setup and maintain in such conferences. > Yes, you can route VPNs through Tor. However, I don't recommend doing > that except in Whonix. Whonix is quite reasonable interesting isolation idea over Tails. Be sure to evaluate the two in own usage models. > You could use a commercial VPN service, or run your own VPN server in a > VPS. But either way, you'd need to do everything ~anonymously through > Tor. Or in other words, your anonymity using the VPN via Tor will be > limited by how anonymously you paid for the VPN service or VPS. So that > means well-mixed Bitcoin, or better perhaps Monero. Imagine an overlay network that offered VPN termination services to clearnet from the overlay... even cryptocurrency supported ones, such as cryptocurrency data storage networks do today... the models exist, explore them. Note also, Zcash style zero-knowledge is still quite equally valid to this day, among other competing privacy crypto models such as Monero. Explore the entirety of onchain privacy, it is evolving nicely, early days. > All things considered, it'd be simpler, and arguably more anonymous, if > you can force Jitsi to use TCP via plain Tor. Not against State Associated Agents, such as say LE conjoined with Top Secret entities Parallel Constructing, or other generic Sybil trolls, perhaps, as in the subject Snowden and other slides and public docs, this hardly in fact true, tor being no exception, witness myriad published tor network exploits, same as any other current overlay network. Against random wannabe's, such as say an employer, or some website, sure, reasonably well. Those two, and others, are still a good thing, accomplished by any fairly rudimentary overlay measures. That covers many users, but not all those rightfully, justly, and naturally, freedom and privacy oriented. Also, Tor Project Inc snowflakes are censoring this post by forcing it to go to mandatory "moderation" first, while others are free to post entirely unmoderated, including, shamefully, said self appointed TPIs. Think of the ramifications before you accept such censorship regimes in your life. Move to distributed messaging, social, and multimedia to ensure your freedom of speech and consumption against such censors like TPO, Youtube, Reddit, Facebook, Instagram, etc... ASAP!

1 0

Google Apple Aim to Entrench Broken Hijackable SMS 2FA
by grarpamp 08 Apr '20

08 Apr '20

https://www.zdnet.com/article/google-backs-apples-sms-otp-standard-proposal/

1 0