July 2021 - cypherpunks - lists.cpunks.org

Public crypto audit report: lurch/OMEMO
by ROOT＠HardenedVault 07 Jul '21

07 Jul '21

Dear Cypherpunks, We're glad to kill off some 0days for open source crypto implementations. Here's public crypto audit report: lurch/OMEMO https://hardenedvault.net/files/lurch-audit.pdf Cheers, regards R@HardenedVault

3 2

Re: Ross Ulbricht got 2xLife+40 for a Harmless Website
by coderman 07 Jul '21

07 Jul '21

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Wednesday, July 7th, 2021 at 2:23 PM, Punk-BatSoup-Stasi 2.0 punks(a)tfwno.gf wrote: > On Wed, 07 Jul 2021 21:18:20 +0000 > > coderman coderman(a)protonmail.com wrote: > >> look to china for the future: > > Did I ever mention that 'coderman' and 'grarpamp' are sockpuppets of the same turd? russia is in second place, but they could overtake china as authoritarian avant garde. (why focus on internet? because controlling internet access is how you control access to information in this modern future...) https://time.com/5951834/russia-control-internet/ How Russia Is Stepping Up Its Campaign to Control the Internet [Russias President Vladimir Putin is seen in his office in Novo-Ogaryovo during a video-conference meeting of Russias Council for Interethnic Relations on March 30, 2021.] Russias President Vladimir Putin is seen in his office in Novo-Ogaryovo during a video-conference meeting of Russias Council for Interethnic Relations on March 30, 2021. Alexei Druzhinin —TASS via Getty Images By [Madeline Roache](https://time.com/author/madeline-roache/) April 1, 2021 11:57 AM EDT On March 10, photos and videos on Twitter were loading more slowly than usual for users in Russia. It was not a network fault or server error but a deliberate move by Russia’s state internet regulator Roskomnadzor to limit traffic to the social media site, in what experts say was the first public use of controversial new technology that the Russian authorities introduced after 2019. The regulator throttled the U.S. platform in retaliation for what it described as a failure to remove thousands of posts that “encourage underage suicide and contain child pornography as well as information about drug use.” The action came after Russian authorities had accused Twitter and other social networks in January of failing to delete posts urging children to take part in anti-government protests. In January and February, Russia’s Anti-Corruption Foundation organized protests in dozens of cities on Facebook and Russian social network VKontakte against the arrest of its head, Alexei Navalny. Tens of thousands of people [protested](https://time.com/5932550/russia-protests-navalny/) in more than 100 cities across the country demanding the release of the opposition figure whose [YouTube investigation](https://time.com/5934092/navalny-putin-palace-investigation/) into alleged corruption by President Vladimir Putin received tens of millions of views upon its release. Navalny was sentenced on Feb. 2 to two years and eight months in prison for violating parole from an embezzlement case dating back to 2014 that he says was fabricated. In response to the slowdown, Twitter said it did not support any “unlawful behaviour” and was “deeply concerned” by the regulator’s attempts to block online public conversation. But on March 16 Roskomnadzor gave a fresh warning that if Twitter [refused to comply](https://www.kommersant.ru/doc/4730504)with its removal requests within a month, the regulator will consider blocking access to the social network in Russia outright. Roskomnadzor, a federal executive body founded in 2008, is responsible for ensuring the media and communications follow Russian laws, and issuing warnings to media sources that violate these laws. Twitter has only 700,000 monthly active users in Russia, a fraction of the [68.7 million in the U.S](https://www.businessofapps.com/data/twitter-statistics/). Despite its use by opposition politicians and journalists the Kremlin doesn’t consider it “the most dangerous” platform, says Andrei Soldatov, a Russian cyber expert. Experts say that the authorities used the Twitter slowdown to test technology that could be used to disrupt other, more popular social networks like Facebook, which has an [estimated](https://webindex.mediascope.net/report?byGeo=1&byDevice=3&byDevi… million active monthly users in Russia. The manner in which Twitter was throttled opens up a new front in the war between the government of Russian President Vladimir Putin and the open internet. For a decade now, the Kremlin has sought to control online information by censoring or removing content and blocking mobile Internet access completely. Now, authorities are aggressively taking the fight to social media platforms, which are dominated by American-owned companies. The government passed a law in December to [increase](https://www.reuters.com/article/us-russia-internet-lawmakers-fine… fines on online platforms and Internet providers for failing to remove material calling for extremist activity, information about recreational drugs and child sex abuse; companies can now be fined between 10% to 20% of their yearly turnover in Russia for repeatedly failing to remove content. A law passed the same month gave Roskomnadzor the power to restrict or fully block websites that, according to officials, discriminate against Russian state media. The widespread anti-government rallies earlier this year seem to have crossed a line for Putin. In recent months, the President has [said](https://time.com/5933666/putin-davos-agenda-speech/) tech companies are “competing with states” and that “society will collapse from the inside” if the Internet does not [obey](https://www.reuters.com/article/us-russia-internet-idUSKCN2AW2D4)legal rules and society’s moral laws. As the government has ramped up its efforts to control what citizens can access online it also has several projects in the pipeline that experts say is part of a strategy to push foreign tech companies out of the Russian market completely. From April 1, Roskomnadzor [requires](https://www.raamoprusland.nl/dossiers/media/1829-can-russia-s-craving-for-digital-sovereignty-succeed) tech companies selling smartphones in Russia to prompt users to download government-approved apps, including search engines, maps and payment systems. The state “likely wants to see, and allow dissemination of, information that only reflects the official government point of view,” says Mike Tretyak, a partner with the Digital Rights Center law firm and expert with Roskomsvoboda, an NGO dedicated to digital rights. Could it be getting closer to succeeding? Ten years of attempting to take control For activists, this year looks like history repeating itself. Since mass demonstrations against electoral fraud began a decade ago—also organized by opposition figures using Facebook and VKontakte—the state has been developing a legal and technological toolkit to regulate online information, introducing content filters, block lists and fining or even jailing people for what they post online. In 2012, Russia began [blacklisting and forcing offline websites](https://www.bbc.com/news/technology-20096274) with the purported goal of protecting minors from harmful sites, including those that give details about how to commit suicide. In 2014 a law allowed Roskomnadzor to block access to media that calls for mass riots, extremist activities, or participation in unsanctioned mass public events. Government critics have been targeted; Navalny’s Live Journal blog, which published investigations about corruption in Russian politics, and other political [opposition sites](https://www.bbc.co.uk/news/technology-26578264) were blocked. (Roskomnadzor said they were banned for calling on people to illegally participate in mass events). More recently, Russia has initiated regional network blackouts. In October 2018, the Russian government [cut mobile data service](https://www.reuters.com/article/us-russia-protests-internet/russia… in the Ingushetia region in southwestern Russia during political protests—the first such Internet outage in the country. In August 2019, the government blocked mobile Internet during protests in Moscow in what the Internet Protection Society, a digital rights group, said was the [first](https://www.themoscowtimes.com/2019/08/07/authorities-jammed-moscows… shutdown of this kind in the capital. Then, in November 2019, the Kremlin made its most controversial move yet toward controlling the country’s Internet infrastructure with the so-called “sovereign Internet” law. A series of amendments to existing laws theoretically enabled the Russian authorities to isolate “RuNet”—the unofficial name for websites hosted in Russia and sites on Russian domain names— from the global web in vaguely defined times of crisis, giving the Russian authorities control over flows of data coming in and out of the country. In an explanatory [note](http://duma.gov.ru/news/44551/) about the new law, the Russian legislature said that it was created in light of the “aggressive nature of the U.S. National Cyber [Security Strategy](https://trumpwhitehouse.archives.gov/wp-content/uploads/2018/09/N…, in which the U.S. threatened to punish countries including Russia, China, Iran and North Korea if they used cyber tools to “undermine” its economy and democracy, and steal its intellectual property. The Russia legislature claimed that Russia needs to take “protective measures to ensure the long term and stable operation of the Internet in Russia, and to increase the reliability of Russian internet resources.” The “sovereign Internet” law required Internet Service Providers (ISPs) to install Deep Packet Inspection (DPI) equipment, which has been used by some countries, like China, for censorship. DPI equipment enables Russia to circumvent providers, automatically block content the government has banned and reroute internet traffic. Russia’s major ISPs have now installed DPI equipment, according to Alena Epifanova, a researcher at the German Council on Foreign Relations. But no one knows if or when Russia will be able to cut off its Internet from the global web. “The information about its implementation process and its scope is kept under wraps,” says Treyak. What’s certain is that Russia does not yet have the technological capacity to create a Chinese-style Great Firewall. Unlike China, which brought ISPs under state control early on, Russia is deeply integrated in the global web having enjoyed a largely free Internet for decades. As the government has attempted to control information emerging from Russia, so has it tried to limit what is accessible in Russia from abroad. It has required search engines, including Google, to delete some results and social networks to store their user data on servers within Russia. Roskomnadzor hit Google with a [fine](http://themoscowtimes.com/2020/12/17/russia-fines-google-for-failing-… of three million rubles ($41,000) for not removing content banned by the authorities in 2020. Roskomnadzor [blocked LinkedIn in 2016](https://www.bbc.co.uk/news/technology-38014501)and fined Twitter and Facebook 4 million rubles ($53,000) in 2020 for failing to store user data in Russia. Although these fines are pocket change to these huge corporations, some have buckled under Roskomnadzor’s threats to block them if they don’t comply with censorship orders. In 2018, Facebook-owned Instagram, which has 54 million users in Russia, complied with the regulator’s requests to remove posts connected to corruption allegations by Navalny. In a [tweet](https://twitter.com/navalny/status/964107913831899137)Navalny accused Instagram of submitting to “illegal censorship orders”. “Shame on you Instagram!” he wrote. YouTube, where Navalny and his group post most of their investigative videos, refused to comply. But now, Russia has upped the stakes. After Roskomnadzor [threatened](https://vk.com/rkn?w=wall-76229642_232671) to prosecute social media sites for encouraging minors to join the January protests, the regulator [said](https://vk.com/rkn?w=wall-76229642_233129) TikTok deleted 38% of its related content, while YouTube and Russian social media site VKontakte removed half. This was not enough for the authorities. Earlier this month, Russia filed a [lawsuit](https://www.reuters.com/article/us-russia-politics-social-media-fi… against Twitter and four other tech companies for allegedly failing to delete enough of such posts. Twitter, Google, Facebook each have three cases against them and for each violation they face a fine of up to 4 million roubles ($54,000). Cases have also been filed against TikTok and Telegram. Russian apps for Russian Internet users The authorities are now moving not just to reduce the influence of foreign tech companies but also to force them to promote Russian services — as with the new regulation mandating government-approved apps on all new smartphones. Apple has agreed to this, the first time the company will offer users the ability to install outside software on its devices at setup. Tretyak, of the Roskomsvoboda digital rights group, says Apple’s compliance is understandable, a “mild” policy to protect Russian apps that are already used by the majority of Russians. But Soldatov says the idea is to discourage Russians from using foreign social networks such as TikTok, which many Russians were nudged into using during the Navalny protests. “It’s all about numbers. If you have 200,000 politically active people sharing videos about Navalny, that’s nothing. But if you have millions of ordinary Russians joining it, that’s a threat,” he says. That helps to explains why Russian companies are building alternatives to foreign services, he says. Gazprom Media Holding, a subsidiary of state-energy giant Gazprom, is building an[app](https://www.themoscowtimes.com/2020/12/23/russia-to-launch-own-tikt… similar to TikTok. A [Russian Wikipedia](https://www.themoscowtimes.com/2019/10/09/russia-plans-its-own-v… is expected to launch in 2023 to ensure Russians have access to more “detailed and reliable” information about their country. There is “a fine line between compliance with mild protectionist policies,” such as Apple listing Russian apps, and “compliance with removal of sensitive materials such as corruption allegations,” says Tretyak. “My belief is that each company should select its own behavioral strategy upon being approached by any government — not only the Russian one – possibly, according to its own internal moral code,” he says. The government is also working on a bill that aims to give Russian security services total access to communications over encrypted connections and the ability to see what sites people visit. Epifanova says that it’s very likely the law will be passed, but it’s unlikely that tech companies will comply with the measure. They have [rejected calls](https://www.wired.com/story/the-time-tim-cook-stood-his-ground-again… from law enforcement agencies around the world to provide access to encrypted information to assist in certain criminal investigations. The move is part of a “strategy to push out foreign tech companies while promoting Russian companies,” says Epifanova. How digital rights activists are fighting back Ordinary citizens in Russia are increasingly looking for ways to shrug off state Internet controls. The Moscow-based Roskomsvoboda and the Internet Protection Center are among the digital rights groups and activists dedicating resources to helping Russians get around new restrictions. Roskomsvoboda’s [website](https://reestr.rublacklist.net/) features a list of all the online resources blocked in Russia, instructions on how to get around online bans, and news about the country’s Internet regulation. The group also [keeps a public list](https://vpnlove.me/)of reliable Virtual Private Networks (VPNs), which allow users to gain access to blocked websites. However, the government has also required some popular providers to block[access](https://www.themoscowtimes.com/2017/11/01/russian-law-banning… to blacklisted websites. Individual activists offer advice too; Vladislav Zdolnikov, an IT specialist, runs a Telegram channel that explains the latest developments in Russia’s internet regulation and recommends circumvention tools. Free Internet activists also continue exploring new ways to democratize technology. On March 21 and 22, Roskomsvoboda ran a “hackathon,” Demhack 2, for 15 teams of developers across Russia. Their aim was “to find technical solutions aimed at protecting the rights and realizing the interests of citizens in the digital environment,” says Natalia Malysheva, the hackathon’s producer and Roskomsvoboda’s press secretary. There is no shortage of ideas. Roskomsvoboba says it receives about 100 proposals for each hackathon. The judging panel of digital experts chose two winners on March 22 for prizes that included the chance to put their projects in front of investors. The first winner was Security Addon, an app that can prevent information on a device from being accessed if it is hacked or stolen. The second, the Deep Silent app, helps users download information to their phones even if the signal is limited, making it a useful resource if the internet is restricted. As well as helping developers to build their technical solutions, Roskomsvoboda are building their own tools. Last year, they launched Censor Tracker, an extension for Google Chrome, that can help users to detect and bypass internet restrictions. In launching the extension tool, the group made it clear how high they believe the stakes now are. “We’re getting ready to confront the approaching sovereign Runet,” they wrote.

2 2

[wrong][spam][bugs] git behaviors
by Karl 07 Jul '21

07 Jul '21

K. Slow trog. Right now I have a git repository checked out with a worktree open to a remote branch. The worktree head is a week out of date. The branch has been updated upstream, but when I type `git pull` it doesn't merge anything new. I'll try to make a terminal log. ... It's now 8:37a (-0400). Started this email at 7:12a . I'm having trouble directing my behavior. https://asciinema.org/a/C1jPRlmN5Nl582EaTPTk5s8sW

2 5

Ross Ulbricht got 2xLife+40 for a Harmless Website
by grarpamp 07 Jul '21

07 Jul '21

While other people get less than 25y for Murder, Rape, etc, and nothing for War, Torture, Infinite Detention, Global Organized Theft, etc. Any questions? #FreeRoss #RIPJohnHurley #McAfeeDidntKillHimself BTW: People actually could buy, did buy, still can buy, and indeed should consider buying... a cannon. Or at least 3D-Print one :)

8 40

cock.li USED BY THE KGB! - Infinitely idiotic lies....from the US govt. Shocking.
by Punk-BatSoup-Stasi 2.0 07 Jul '21

07 Jul '21

https://www.vice.com/en/article/dyv87z/cockli-admin-russian-intelligence-sv… "U.S. TURDS have blamed stalin and co. for the wide-spanning SolarWinds supply chain hack. That report said that the SVR makes use of a specific anonymous email service called cock.li." you can't make this shit up. For people who are not aware, cock.li is broken 95% of the time. Poor KGB couldn't afford anything better though!!!

1 0

[war][peace] Fake News Report
by Karl 07 Jul '21

07 Jul '21

It's 2021 and our news outlets are still claiming to everyone that everything they have been told is true, and that things that aren't reported didn't happen. What's changed, is that people are trying to talk about it. A bunch of rebellious news organisations have sprung up, making it incredibly clear that their news is also totally ridiculous, and that people are believing it in droves. The mainstream media finally noticed. They're embarrassed that smaller, faker, even more "mainstream" media outlets, have gotten so much better and more grandious at spreading fake news than they are. They have coping skills they use when this happens. They publish news articles. https://apnews.com/article/ap-fact-check-europe-coronavirus-pandemic-scienc… It's the same old thing helping people get back to reality by pretending that fake news is meritless. It's certainly upsetting and false, if not merciless. It likely makes for a great way to cover anything up. Publish fake news on something similar. The mainstream media will make sure nobody believes it. Meanwhile, computers can out-write us by leagues, and most smart software devs can think of how to build a world-saving or world-dominating AGI by now, and are thinking about how best to use their old age for their values. It is very easy to have a computer write a news article for you now, and nobody knows what is true. We need rational, clear, noncontroversial, helpful information like water in a desert. I'll try to translate a little of the apnews weekly update. A roundup of some of the most popular but completely untrue stories and visuals of the week. None of these are legit, even though they were shared widely on social media. The Associated Press checked them out. Here are the facts: Karl's comment: - "We can totally say this stuff is untrue. Nobody hurts us when we do. It is totally safe to say this stuff is untrue. You should tell your friends how safe this." - "The things spreading on social media are not true. Come to mainstream news outlets to learn what is true. We can discern what is true and false so long as the powers that get angry from it have enemies with a lot of money." Posts mislead on delta variant data - "We can say these posts are misleading. Nobody hurts us when we do. Some day we may even be able to say that our own news reporting is misleading, too." CLAIM: Data from the U.K.’s public health agency confirms that those who have been vaccinated against COVID-19 are anywhere from two times to six times more likely to die from the delta variant than the unvaccinated. - "Although this may be mathematically true in a very limited context, people think it means that vaccination can make you sick, or that it indicates in any way that getting vaccinated could harm you. Maybe vaccinations do harm people sometimes, but this study does not indicate that at all, and I could be fired for saying that. Whoever posted this stuff is obviously trying to get everyone to contract covid-19, and we need to do something about that." - "I'm going to repeatedly state that these incredibly dangerous posts are false because all you guys seem to understand is that you should get passionately upset by what you read." THE FACTS: Public Health England’s report did not show evidence that those who are - "Here I am, stating clearly that the dangerous claims are false. You're already primed by the very fake news I'm debunking, to be ready to be upset at false stuff!" vaccinated are more susceptible to dying from the coronavirus delta variant. Rather, the data, - "It is obviously false that this would be the case, but the study did show that there is a weird set involving very elderly people where it is a little true, even though it was blindingly false everywhere else. I'll have to make sure to use weasel words less than the fake news people do, so that you believe me." which was published June 18, shows the Pfizer and AstraZeneca vaccines are highly effective against hospitalization from the variant. An - "This is the most important thing for people at risk of going to a hospital to know. We need to say this first, and it was criminal for the outlets that are better at distributing fake news than our investors are, to not make this clear up front. These fake news outlets are directly responsible for millions of people dying." Instagram post falsely claimed the health - "false! You need to understand how false this is!" agency’s data showed vaccinated people were twice as likely to die from the delta variant than unvaccinated people. Another falsely claimed - "The people who wrote the fake news didn't know the difference between numbers they put together creatively, and statistical measurements of what is actually likely. It's an incredibly common thing to do." vaccinated people were “six times more likely to die from a circulating ‘variant’ like ‘Delta’ than are unvaccinated people.” One post used a table from the report to share the false claim, but the post misrepresented the table’s data. While the table does address delta variant deaths, it shows that among 60,624 confirmed cases of the variant between Feb. 1 and June 14, recorded deaths included 37 vaccinated people and 34 unvaccinated. Furthermore, the - "My job is to debunk this. The posters did not understand this table. I do not understand this table either. None of my readers understand this table. But I can ask somebody who does understand the table, what I might say to convince people." - "These numbers are tiny. Does that matter? Does it matter if numbers are big or small?" table does not state the age group of those who died and whether they suffered from any additional illnesses. Experts say that means - "The expert said the study was about a different thing than the posts said it was, and that made it clear the posts were ridiculous. How is that related? Should I include the table? Most wouldn't want to get fired for accidentally showing statistics that aren't in support of major corporations, but I can figure this out." --- That's it for me. I'll believe somebody who can say that opposing views have truth and form conclusions from that, but stick by what they care about, and clearly that's not many professional writers who can write things that reach me. I'm not even sure it's myself anymore. Still, this AP news stuff seems cool. Found them on the web. Below is the rest of the attempt to bring people closer to reality that they made: conclusions cannot be drawn about the role of vaccines in those deaths. “Unless you account for these differences in age and population, you really can’t make the argument that vaccination confers a higher risk of death,” said Dr. Nasia Safdar, an infectious disease physician at the University of Wisconsin’s School of Medicine and Public Health. The report notes that follow up is needed when examining the data on delta variant deaths because “it is too early to provide a formal assessment of the case fatality of delta, stratified by age, compared to other variants.” The public health agency issued another report on June 25 that showed that no deaths had been recorded of patients under 50 who were infected with the delta variant and had received both doses of vaccine. The data from the agency shows that two doses of the vaccines made by Pfizer or AstraZeneca are highly effective against hospitalization from the delta

4 13

Re: Assange's Persecution
by Jacob Appelbaum 07 Jul '21

07 Jul '21

Hello, On 7/7/21, David Barrett <dbarrett(a)expensify.com> wrote: > It wasn't dropped: > > https://www.bbc.com/news/world-europe-48253343 > You are mistaken. It is as understandable as it is deniable spreading of FUD: "the case" has been closed and reopened more times than most people realize. Your article is dated 13 May 2019. As of Tue 19 Nov 2019 the Guardian reported that the case was indeed dropped yet again: https://www.theguardian.com/media/2019/nov/19/sweden-drops-julian-assange-i… Note that "the case" being reopened wasn't for all of the original accusations as some had expired due to statue of limitations. As of the summer of 2020, it is my understanding that the statute of limitations for all of the Swedish accusations has passed. In any case, the prosecutor said that memory had faded, and so ended the case. The "Swedish case" as such is officially closed. The Swedish and UK authorities are still resisting freedom of information requests about the case. I highly recommend following the litigation by investigative journalist Stefania Maurizi: https://twitter.com/smaurizi/ - she has uncovered some very interesting documents relating to Julian's situation in the UK, Sweden, and the United States. An example from three years ago of some of what she has uncovered: https://www.repubblica.it/esteri/2018/02/13/news/few_documents_many_mysteri… It may be unclear to some readers that Julian sought and received asylum, a basic and fundamental human right. Later, the UN found in his favor against the UK several times in an adversarial judicial process. The UK lost, part of losing was the finding of their behavior as persecution and yet, they continue to persecute him. He is now being held in a maximum security prison without even the pretext of being convicted of a crime, merely the possible extradition which was even denied on humanitarian grounds. It is an outrageous injustice that he is not free. > They did temporarily while he was hiding in the embassy (again, he was > hiding from Sweden, not the US -- Obama didn't try to arrest him, Sweden > did, and Assange ran), but now that he's out of hiding, it's reopened. > You describe his residence at the Ecuadorian Embassy as "hiding" when in fact his residence, like his grant of asylum, was well known. He was then subjected to illegal surveillance for his stay in the embassy which is currently being litigated about in Spain. In addition to the UN rulings in Julian's favor https://justice4assange.com/UN-Working-Group-Decision.html there is also the Inter-American court https://justice4assange.com/IMG/pdf/Inter-American_Court_Advisory_Opinion_O… ruling in Julian's favor. Furthermore, what you're saying about the Obama admin and about the US government generally over the last decade is highly misleading and essentially false. I'll tell you about my own situation to give others a sense of how incorrect you are about your broad assertions. I was first detained in 2010 regarding WikiLeaks and threatened by the US military on US soil as a natural born US citizen. I was flagged, detained, held incommunicado, questioned about my politics, manhandled, groped, and threatened on a regular, systematic basis. I left the United States of America after the unending harassment continued well into 2013, so I went to continue my journalistic work in Europe. All of that was done under the Obama administration and it always centered around Julian. I have met many Obama and Trump admin bureaucrats or elected politicians in Europe during the last decade working as a journalist and I have challenged as many of them about the WikiLeaks issue as often as was possible. A couple of years ago ( https://netzpolitik.org/2019/wikileaks-the-us-is-indeed-investigating-assan… ), my lawyers were contacted by the prosecutors from the Alexandria, Virginia office of the Department of Justice leading the prosecution against Julian. This is the same kind of overly political, outrageous threat that many people have faced since 2010, and in 2021, it is still continuing! They made an offer of immunity from prosecution, similar to the others they've offered over the last ten years to nearly everyone near Julian. They did offer me so-called "full immunity" rather than the normal "qualified immunity" offer they seem to normally toss on the table which was noteworthy. Ultimately such an offer is not very compelling to anyone who cares about anything other than themselves. The DoJ made it clear that in exchange for testimony against my journalistic colleague Julian, I could return home from exile and live a "happy" life. They also expressed that they knew I'd like to return to the country of my birth, and tried to pull on my emotional strings. They characterized the offer as the "easy way" and implied that the "hard way" was inevitable: They threatened to extradite me from Europe without immunity from prosecution if I refused their "easy way" offer. I refused their offer and informed them that I would rather die on foreign soil than allow them to get their hands on me. They have attempted to follow up on the "hard way" but lucky for the world, the European authorities actually care about national and international law, by comparison to the UK and the US. The US DoJ attempts to pressure me into testifying have so far been thwarted and I am not alone in my political grand jury resistance. Manning and Hammond also successfully resisted, and I am extremely inspired by their political actions. It's really striking at first that the UK declined to send him to America on humanitarian grounds. It seems like a brutal condemnation of American justice: even the British object! The problem is that they're part of the entire ruse as has been remarked in the recent book by former UK minister Alan Duncan. The UK is simply dragging out his situation as long as is possible. Mexico has now offered Julian asylum https://www.independent.co.uk/news/world/mexico-julian-assange-asylum-us-b1… to settle the matter, and we can be fairly certain of the course that will be chosen by the UK: whatever drags out the situation longer, whatever makes Julian's situation more intolerable. I suggest all readers who are interested in the details visit https://justice4assange.com/ and consider picking up the book "The Trial of Julian Assange" by Nils Melzer, UN Special Rapporteur on Torture, when it is released: https://www.penguinrandomhouse.com/books/697240/the-trial-of-julian-assange… This interview with Nils Melzer is worth reading even though it misses the developments of 2021: https://www.exberliner.com/features/julian-assange-trial-2020/nils-melzer-a… This is and has always been a political persecution by governments against regular people working to uncover truths about our world. To attempt or to force alleged sources or journalists to testify against Julian for matters concerning journalistic work is an outrageous attack on press freedom. This is a fact that nearly all major news paper editors in the US and the world agree with when consulted - the attack on Julian and on WikiLeaks is an attack on the free press of the entire world, the United States included. The politically motivated surveillance, targeting, harassment, and threats are a bipartisan issue in the US among authoritarian-leaning warmongers. Obama's DoJ did not *charge* Julian, and rather they built the groundwork of the case with the obviously unconstitutional charges that the Trump administration brought to the UK. Without Obama's DoJ going after my twitter https://www.nytimes.com/2011/11/11/technology/twitter-ordered-to-yield-data… account, would Trump's DoJ had the same list of people to target? Doubtful! It's a rare case of bipartisan agreement that should make everyone sick, except for the few who wish to be on the side of the would-be executioner. The Biden administration should cease spying on, harassing, arresting, jailing, and exiling people *associated* with WikiLeaks. The Biden administration should drop the case against Julian Assange and the case against WikiLeaks. A luta continua, Jacob Appelbaum

4 3

Gizmodo: Texas Power Companies Are Remotely Raising Temperatures on Residents' Smart Thermostats
by jim bell 07 Jul '21

07 Jul '21

Gizmodo: Texas Power Companies Are Remotely Raising Temperatures on Residents' Smart Thermostats. https://gizmodo.com/texas-power-companies-are-remotely-raising-temperatures…

2 1

VaultHSM report: The way to confirm whether the Smart Card (J3H145) supports RFC-6979 ECDSA implementation
by coderman 07 Jul '21

07 Jul '21

https://hardenedvault.net/2021/07/07/vaulthsm_ecdsa-rfc6979.html VaultHSM report: The way to confirm whether the Smart Card (J3H145) supports RFC-6979 ECDSA implementation Vault Labs, HardenedVault Limited Background The original implementation of DSA-type signature algorithm (including ECDSA) needs a random number which belongs to the same mathematical object of the private key (an element of GF(p), in which p is a prime number). This random number should also have these three property below: 1. Randomness: It should be unable to calculate from the data being signed (called "payload" below) and the resulted signature. 2. Confidentiality: It should not be leaked outside the signing process. 3. Uniqueness: It should be different for different payloads. Otherwise, an attacker may calculate the private key from payloads and signatures. If the random number comes from a flawed RNG, its randomness and uniqueness will become difficult to guarantee, for the attacker may find the pattern of the flawed RNG by collecting enough payload-signature pairs, and then calculate the private key. The industry think “we can take bear of this” until [LadderLeak](https://eprint.iacr.org/2020/615) was being made public. The biggest problem here is: 1) Neither can’t keep the k-value secret nor “maliciously” repeat it 2) In worst-case, the attacker only cost 300k USD for P-224: It doesn’t make sense to ignore this issue especially in post-LadderLeak era. One of the methods to solve this problem is to derive the “random number” deterministically from the hash value of private key and payload with irreversible algorithm (such as hash or message authentication code algorithm): The participation of private key in the derivation process guarantees property 1 and 3, if only the private key is not leaked. This method has been standardized as [RFC 6979](https://tools.ietf.org/html/rfc6979), and applied to the (EC)DSA implementation of libgcrypt by default. In addition, EdDSA does not use RNG anymore. The “random number” used internally is completely and deterministically derived from the hash value of private key and payload. GnuPG 2 makes use of libgcrypt, so its implementation of (EC)DSA should conform to RFC 6979, but GnuPG completely uses the implementation within libgcrypt only when using private key stored on disk; if the private key is stored in an OpenPGP Card, operations related to private key are done inside the card, unrelated to libgcrypt. If the RNG can not be guaranteed to be flawless, any (EC)DSA implementation not conforming to RFC 6979 may leak private keys via the issue mentioned above. Thus, we should use an (EC)DSA implementation provided by a smartcard only when it certainly conforms to RFC 6979. Testing process and result gpg has an option –faked-system-time to assign the timestamp of signature. (${TIMESTAMP} should not exceed the life time of the sub key to use) $ gpg -u ${SUBKEY_ID}! -bo payload.sig --faked-system-time ${TIMESTAMP} payload If an algorithm is completely deterministic (all of its input is user-controllable, and the output is uniquely determined by inputs) , the resulted signature should be identical when timestamp, payload and private key are all unchanged. Thus, if an (EC)DSA implementation outputs different signature even if timestamp, payload and private key are unchanged, such implementation could not conform to RFC 6979. The target to test is an [NXP JCOP3 J3H145](https://www.javacardos.com/store/products/10029) running [SmartPGP](https://github.com/ANSSI-FR/SmartPGP). Due to some limits, switching the type of private key slots may need a method similar to what is done by [this script](https://github.com/ANSSI-FR/SmartPGP/blob/master/bin/example-set-mi…. Private keys with type brainpoolP512r1 and rsa2048 (as control group) are imported to the signing key slot in succession, paired with private keys stored on disk. Two signatures are generated against each one type of private key, with fixed timestamp. Generated signatures are examined with hash. The results are shown below: $ sha256sum payload* 94d89559a996659d5220e630d7af057db8cd7e5dd61d7959139a68fc72fa80c8 payload 54885e606a52f6e80af21766568ab840ee1b5e4a8c84898a6ee551c98f31f36e payload.ecdsa.c0.sig f36c492c25ec794a30e68d0c08687b6afc14b28ec19bbd4b52bc57930b1c3eaf payload.ecdsa.c1.sig b6e0a45b5da47171472f970fcf4decdb92ec8050fcd094f05ddf0a3af8d65e90 payload.ecdsa.d0.sig b6e0a45b5da47171472f970fcf4decdb92ec8050fcd094f05ddf0a3af8d65e90 payload.ecdsa.d1.sig 31b83302f6397a8ae9676b484507ee4585e65999e24e9d9e0f1e25a0a3149e4e payload.rsa.c0.sig 31b83302f6397a8ae9676b484507ee4585e65999e24e9d9e0f1e25a0a3149e4e payload.rsa.c1.sig fd31c92c884ae26cc5efbd58c6ebbb080ee3755ea3de6b6b3474bf3f9b713f76 payload.rsa.d0.sig fd31c92c884ae26cc5efbd58c6ebbb080ee3755ea3de6b6b3474bf3f9b713f76 payload.rsa.d1.sig payload is randomly generated data; Signature labeled with letter c are signed with keys in card; Signature labeled with letter d are signed with keys stored on disk. It can be seen that, with timestamp fixed, no matter rsa keys in card or on disk are used, identical signature are generated with the same timestamp, payload and private key, confirming the validity of this method of judgment from the side. Identical signatures could also be generated with the ecdsa private key on disk, but different signatures come out when using the ecdsa private key on card with the same timestamp, payload and private key, which means when using the ecdsa private key on disk, the ECDSA implementation used by gpg is deterministic, while the implementation on card is not. Prospect If the on-card (EC)DSA implementation is confirmed to be deterministic, whether it conforms to RFC 6979 should be further checked. The method may be to sign the same payload with same timestamp and same key, once on disk while once on card. If the implementation on card conforms to RFC 6979, the resulted signature in these two process should be identical. It is omitted in this article, though. Conclusion Because at present EdDSA has not been popularized among smart cards, we had better use (EC)DSA for signature only on smartcards whose implementation is confirmed to conform to RFC 6979, otherwise, the RSA algorithm should be used for signature, for it does not have the issue like what presents in indeterministic (EC)DSA algorithm. The conclusion above only applies to signature. If your smart card supports ECC, Using EC key pairs for encryption is okay. In such situation, the assymmetric part of the algorithm will be performed in the manner of [ECIES](https://en.wikipedia.org/wiki/Integrated_Encryption_Scheme), and comparing to RSA, it will be enhanced with the [probabilisity](https://en.wikipedia.org/wiki/Probabilistic_encryption) of DH, making chosen-plaintext attack much less effective. In systems with DH applied, probabilisity is a problem for signature algorithm, and if it is not handled well, private key may be leaked, but for encryption, probabilisity can provide extra advantage. Proposed approach for defense The long-term solution is waiting for the standardization of EdDSA in FIPS-186-5. One the practical side, the deterministic ECDSA implementation didn’t go well in open source project like OpenSSL: The current situation doesn’t leave us much options but go through the short-term solution: - Make sure all of your certificates are using >= P-256 or RSA( another problematic component) - Don’t miss the spots without internet connection Appendix In order to avoid the interference of testing process with local ~/.gnupg/ directory, it is suggested that a tmpfs dedicated for test be mounted here: $ killall gpg-agent $ su root # mount tmpfs ${YOUR_HOME}/.gnupg/ -t tmpfs -o nodev,nosuid,noexec,mode=0700 # chown ${YOUR_USERNAME}:${YOUR_GROUP} ${YOUR_HOME}/.gnupg/ After that, keys could be generated according to standard GnuPG usage and used for test. After test is complete, the tmpfs could be unmounted after its contents being shredded. $ killall gpg-agent $ find ~/.gnupg -type f -exec shred -v {} \; $ su root # umount ${YOUR_HOME}/.gnupg/

1 0

Assange's Prosecution
by jim bell 07 Jul '21

07 Jul '21

https://youtu.be/ufRpvfeUkak

6 12