- cypherpunks - lists.cpunks.org

Fwd: [Cryptography] [ANNOUNCE] HashCash Digital Cash
by grarpamp 30 Jun '17

30 Jun '17

---------- Forwarded message ---------- From: Ashish Gulhati <crypto(a)ashish.neomailbox.com> Date: Wed, Jun 21, 2017 at 2:06 AM Subject: [Cryptography] [ANNOUNCE] HashCash Digital Cash To: cryptography(a)metzdowd.com An untraceable, permissionless digital cash system based on blind signatures. Screenshots, FAQ, and executables for some platforms are at: http://www.hashcash.com/ HashCash is free software, written in Perl and published under the Artistic License 2.0. Source can be downloaded from CPAN. On Unix-ish systems it should also be possible to download and install the package with: cpan Crypt::HashCash (note different capitalization from Adam's Hashcash) HashCash is a lightweight Chaumian blind-signature based digital cash system, designed to work without the need for user registration or accounts. The current implementation is a minimal usable version. It is experimental and released for beta testing. HashCash can operate with various blind signature algorithms and value bases. The initial version includes support for blind RSA and ECDSA signatures, and a vault based on Bitcoin. HashCash coins are bearer tokens of specific denominations, blind-signed by a vault, representing a quantity of some value (precious metals / Bitcoin / altcoins / fiat / whatever) stored by the vault. Users can export coins from their wallets and send them directly to anyone else using any communication medium. Coins can be encrypted when exported, and the encryption passphrase sent to the recipient using an alternate communication method, to protect coins in transit. For in-person transactions, recipients can just scan coins as QR codes from payers' devices. The wallet can work with multiple independent vaults, just as an email client might connect to multiple email accounts on different servers. With the free vault software and fairly modest hardware and bandwidth requirements, operating a HashCash vault is within the capabilities of most people with basic computer skills, facilitating decentralizaton based on a diversity of competing private vaults. Independent automated reliability and reputation tracking of vaults could help users select reliable vaults to use. Coin minting and verification fees can be set independently by each vault, and are built into each interaction with a vault, which enables vaults to operate without the need for user accounts. A vault's private keys can be kept completely offline at all times, by running the vault on machines air-gapped from the Internet and communicating with them over serial links. The HashCash protocol is designed to facilitate air-gapped vaults, as well as completely offline yet fully functional wallets, which can provide a high level of security for naive users. Offline mode for the wallet is included in current implementation. I'm still fine-tuning the support for air-gapped vaults. It works and has been well tested, just needs to be cleaned up. Support for air-gapped vaults should be included in an upcoming release soon, and an experimental live air-gapped vault should also be online shortly. In the meantime, you can get a feel for the system by running a vault locally. More details on that on the Download page: http://www.hashcash.com/download.html Comments, bug reports, code, translation assistance, etc. most welcome and greatly appreciated. Hash http://www.hashcash.com _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

4 6

[WAR] Israel now targetting Palestinians, Syrian military and civilians
by Zenaan Harkness 29 Jun '17

29 Jun '17

Israel knows no restraint, and no amount of middle eastern land shall ever be enough - from the great Pyramid to the Euphrates river, Israel shall continue to conduct their ISIS operations and land grab expansionist policy, at least until a little international unity against Israel is witnessed on the world front. No wonder Saudi Arabia's got balls - with USA and Israel behind them. Note also how at the bottom the tweeter calls Israeli-occupied Western Syria "northen Israel". http://theduran.com/breaking-israel-attacks-syrian-arab-army-from-the-occup… BREAKING: Israel attacks Syrian Arab Army from the occupied Golan Heights

1 3

Fwd: [ PFIR ] Idiots on Canadian Supreme Court demand right of GLOBAL Google censorship!
by Cecilia Tanaka 29 Jun '17

29 Jun '17

I didn't delete Lauren's comments because they're the best part of the message, haha!! ;D (I know, it's tragic, not funny.) ---------- Forwarded message ---------- From: "PFIR (People For Internet Responsibility) Announcement List" Idiots on Canadian Supreme Court demand right of GLOBAL Google censorship! Google Must Delete Search Results Worldwide, Supreme Court of Canada Rules http://fortune.com/2017/06/28/canada-supreme-court-google/ The Supreme Court of Canada ruled against Google on Wednesday in a closely-watched intellectual property case over whether judges can apply their own country's laws to all of the Internet. In a 7-2 decision, the court agreed a British Columbia judge had the power to issue an injunction forcing Google to scrub search results about pirated products not just in Canada, but everywhere else in the world too. - - - What a complete batch of power-grabbing idiots on the Canadian Supreme Court. My God, they demand the right to impose GLOBAL censorship? What total asses. Beyond stupid. More dangerous than President Chump when it comes to speech rights. Because the EU wants to do the same thing with their nightmare "Right To Be Forgotten." And China too. And Russia. And France. And more. And there are vile, sick politicians here in the USA who would do this same thing if they could figure out how to get it past the First Amendment. It's a race to the lowest common denominator censorship bottom. My view is that Google should consider cutting off all services to countries that make such demands. Period. Otherwise, one day Google Search results pages will be nothing but a big white empty space. --Lauren--

2 1

what kind of psychologist would write this?
by Ryan Carboni 29 Jun '17

29 Jun '17

https://cryptome.org/2012/07/gent-forum-spies.htm I pointed this out before, but I have gravely overestimated all of you somehow. That letter seems to appeal to the biases of schizophrenics and aims to make them more odious.

1 0

Appelbaum in Cairo
by grarpamp 29 Jun '17

29 Jun '17

Appelbaum in Cairo https://www.youtube.com/watch?v=nl88J8KOLlY https://www.youtube.com/watch?v=bIvt9snFQig https://www.youtube.com/watch?v=0qa8SRN86V8 Principled balls of steel. We need this voice among the voices.

2 1

Fwd: Re: Barrett Brown: 'new framework for mass online collaboration' Reddit
by John Young 29 Jun '17

29 Jun '17

Translators are top spy targets. Topmost is porn, universal lingo, not just kiddie porn obsessively gazed by LE and IT pervs. More malware implanted on porn than anywhere else. Crypto, anonymizing, AV, cybersec, leak sites, the internet, 0-day implants essential features since day one. >There are translation apps with local databases :)

1 0

Barrett Brown: 'new framework for mass online collaboration' Reddit
by Razer 29 Jun '17

29 Jun '17

> My name is Barrett Brown; I recently finished a four-year prison > sentence stemming from my work in support of Wikileaks. I'll soon be > rolling out a new framework for mass online collaboration, > crowd-sourced journalism, and robust opposition to criminalized > institutions. Learn about it here. > > https://www.reddit.com/r/WikiLeaks/comments/6jxv8f/my_name_is_barrett_brown… > And here: https://pursuanceproject.org/ (DigitalOcean) 'Rr

7 9

Facializing: World Behaviour and Social Control... Deployed and Coming To You ASAP
by grarpamp 27 Jun '17

27 Jun '17

https://www.wsj.com/articles/the-all-seeing-surveillance-state-feared-in-th… https://www.axios.com/chinas-big-brother-reality-2448660234.html https://yro.slashdot.org/story/16/11/30/1527257/china-pilots-a-system-that-… China's government is using facial-recognition technology to help promote good behavior and catch lawbreakers, reports the WSJ. From the article: Facial-recognition technology, once a specter of dystopian science fiction, is becoming a feature of daily life in China, where authorities are using it on streets, in subway stations, at airports and at border crossings in a vast experiment in social engineering (alternative source). Their goal: to influence behavior and identify lawbreakers. Ms. Gan, 31 years old, had been caught on camera crossing illegally here once before, allowing the system to match her two images. Text displayed on the crosswalk screens identified her as a repeat offender. "I won't ever run a red light again," she said. China is rushing to deploy new technologies to monitor its people in ways that would spook many in the U.S. and the West. Unfettered by privacy concerns or public debate, Beijing's authoritarian leaders are installing iris scanners at security checkpoints in troubled regions and using sophisticated software to monitor ramblings on social media. By 2020, the government hopes to implement a national "social credit" system that would assign every citizen a rating based on how they behave at work, in public venues and in their financial dealings.

1 0

Fwd: [NATURAL_DEFENCE] NSA Uses Trick to Spy On USAmericans
by grarpamp 27 Jun '17

27 Jun '17

---------- Forwarded message ---------- From: ECOTERRA Intl. <office(a)ecoterra-international.org> Date: Tue, Jun 27, 2017 at 4:54 AM Subject: [NATURAL_DEFENCE] NSA Uses Trick to Spy On USAmericans - waking up while collapsing? NSA Uses Trick to Spy On USAmericans By Washington's Blog - June 26, 2017 The government is spying on most USAmericans through our computers, phones, cars, buses, streetlights, at airports and on the street, via mobile scanners and drones, through our credit cards and smart meters, televisions, dolls, and in many other ways. This week, ZDNet reported that the NSA uses a trick to get around the few flimsy USAmerican laws on spying … they shuttle internet traffic overseas so they can pretend they’re monitoring foreign communications: A new analysis of documents leaked by whistleblower Edward Snowden details a highly classified technique that allows the National Security Agency to “deliberately divert” US internet traffic, normally safeguarded by constitutional protections, overseas in order to conduct unrestrained data collection on USAmericans. According to the new analysis, the NSA has clandestine means of “diverting portions of the river of internet traffic that travels on global communications cables,” which allows it to bypass protections put into place by Congress to prevent domestic surveillance on USAmericans. One leaked top secret document from 2007 details a technique that allows the intelligence agency to exploit the global flow of internet data by tricking internet traffic into traveling through a set and specific route, such as undersea fiber cables that the agency actively monitors PICTURE: TRAFFIC-SHAPING Leaked NSA document from 2007. (Image: source document) The document’s example noted Yemen, a hotspot for terrorism and extremist activity. It is difficult to monitor because the NSA has almost no way to passively monitor internet traffic from the cables that run in and out of the country. By shaping the traffic, the agency can trick internet data to pass through undersea cables that are located on friendlier territory. Goldberg’s research takes that logic and focuses it on US citizens, whose data and communications is out of bounds for the intelligence agencies without a valid warrant from the surveillance court. The government only has to divert their internet data outside of the US to use the powers of the executive order to legally collect the data as though it was an overseas communication. Two USAmericans can send an email through Gmail, for example, but because their email is sent through or backed up in a foreign data center, the contents of that message can become “incidentally collected” under the executive order’s surveillance powers. Thomas Drake – one of the top NSA executives, and Senior Change Leader within the NSA – blew the whistle on this deceptive practice more than a decade ago. For his troubles, Drake was prosecuted under the Espionage Act and literally framed by the government. Postscript: Drake also notes that the government is storing for the long-term just about everything they’re collecting. But don’t worry … the government would never think of doing anything bad with the information. ------- Embedded links https://tcf.org/content/report/surveillance-without-borders-the-traffic-sha… https://www.documentcloud.org/documents/3871807-Network-Shaping-NSA-documen… http://www.zdnet.com/article/legal-loopholes-unrestrained-nsa-surveillance-… http://zdnet2.cbsistatic.com/hub/i/r/2017/06/22/70cc25e0-6194-4704-9e40-013… https://www.documentcloud.org/documents/3871807-Network-Shaping-NSA-documen… https://twitter.com/Thomas_Drake1/status/877877256496050176 http://www.washingtonsblog.com/2014/06/senior-nsa-manager-police-state-wors… http://www.washingtonsblog.com/2014/06/senior-nsa-manager-course-theyre-col… http://www.washingtonsblog.com/2014/07/nsa-blackmailing-world.html http://www.washingtonsblog.com/2014/06/spying-different-time.html http://www.washingtonsblog.com/2017/04/67361.html http://www.washingtonsblog.com/2013/09/the-government-is-spying-on-us-throu… http://www.washingtonsblog.com/2015/02/tyler-durdens-picture-slippery-slope… http://www.washingtonsblog.com/2015/02/big-barbie-watching-meet-wifi-connec… http://www.washingtonsblog.com/2017/03/cia-documents-reveal-agency-spying-u…

1 0

Fwd: [tor-talk] Tor ban discussion at Russian state Duma
by grarpamp 27 Jun '17

27 Jun '17

https://translate.google.com/ ---------- Forwarded message ---------- From: Leonid Evdokimov <leon(a)darkk.net.ru> Date: Tue, Jun 27, 2017 at 7:37 AM Subject: [tor-talk] Tor ban discussion at Russian state Duma To: tor-talk(a)lists.torproject.org As-salamu alaykum! TL/DR: Tor ban is currently discussed in Russian state Duma, first draft of proposed bill was approved the 23th of June, there will be two more drafts (second draft should be ready for discussion at the parliament by the 2nd of July[DU]), there is ~120 days gap after 3rd draft approval before Tor being outlawed. [DU] http://asozd2.duma.gov.ru/main.nsf/%28SpravkaNew%29?OpenAgent&RN=195446-7&02 [DU] https://archive.li/8GxKD ~1300 words more: On 15th of June in the morning there was an open invitation[Oi] published by Leonid Levin, chairman of State Duma (Russian parliament) committee on information politics, information technologies and telecommunication towards representatives of anonymisers to discuss proposed bill that regulates services that may be used to gain access to outlawed information: VPN services, anonymisers, etc. One of the declared purposes of the invitation was to "gather opinions to make the bill more technological from the point of view of the bill goals". [Oi] http://www.komitet5.km.duma.gov.ru/Novosti-Komiteta/item/522019/ [Oi] https://archive.li/dyepC [Oi] https://geektimes.ru/post/290109/ ^^ all three links are in Russian, sorry. Couple of weeks before this invitation there was significant number of outages going on in the Russian segment of the internet. But I should give some context on blocklist used by Russian ISPs before describing the outages: Roskomnadzor[RKN] curates blocklist of IP addresses, domains and URLs that contain links to illegal information that should be blocked. The list is composed of two parts: the list of illegal information that should be blocked[BL] and the registry of illegal information[EAIS]. The second list may contain links that cause too much collateral damage in case of blocking, e.g. https youtube link[YT] that you can verify via [EAIS] that it's both illegal and officially NOT blocked despite the "spirit" of law. Enforced blocklist[BL] is unofficially public as it's distributed to thousands of ISPs, so it leaks to github[ZI] at speed of 24 commits a day. [RKN] https://en.wikipedia.org/wiki/Roskomnadzor [BL] http://blocklist.rkn.gov.ru/ [EAIS] https://eais.rkn.gov.ru/ [YT] https://www.youtube.com/watch?v=nEL_JOXGRu4 [ZI] https://github.com/zapret-info/z-i/ In 2012 when the blocklist was first introduced to protect all children from 0 to 120 years old against extremist content one of the very first bans was zhurnal.lib.ru (Samizdat library that is currently reachable with http://samlib.ru) There were almost no smart filters deployed in ISP networks back in those days, so Maxim Moshkov pointed DNS A records for zhurnal.lib.ru to IP addresses of minjust.ru, website of Ministry of Justice of Russia. I don't know if he did that as a protest or just for fun, but minjust.ru was unreachable via some ISPs. So the sort of trolling pointing A records of blacklisted domains to something fun was quite old. In the beginning of the June 2017 it was back: people across several medias (blogs, Telegram channels, etc.) were publicly suggesting to use expired domains grepped from from zapret-info lists, register these domains and point them to google, yandex, VK, telegram and other popular services. It caused significant amount of media buzz, including bloomberg[BLOOM] as there is significant amount of ISPs doing filtering of HTTPS links based on plain TCP/IP blocking. Someone also pointed one of domains to peering IP addresses of MSK IX and it caused significant traffic dip[MSKIX]. Maybe it was just a coincidence, but I've found several looking glasses showing that routers had /32 routes for blacklisted IPs pointing to some non-default route[OR,RT,TTK] [BLOOM] https://www.bloomberg.com/view/articles/2017-06-13/how-the-russian-internet… [MSKIX] http://darkk.net.ru/garbage/2017.06-Tor-VPN-and-Duma/msk_ix_2017-06-08_16-5… [OR] https://archive.li/i66ic [RT] https://archive.li/8nK6U [TTK] https://archive.li/JM5If I remember TCAM 512k internet hiccup[TC1,TC2] so I was quite afraid of possible attack causing TCAM overflow. Also there were rumors that some Allot DPI equipment deployed at some ISPs had troubles when the blocklist outgrew 64k entries. Every domain in the blocklist can send ~4000 obsolete IPv4 addresses as a response for single `A` DNS query and ~2300 modern IP addresses for `AAAA` query. There are 623 domains in the blocklist controlled by single entity -- grani.ru[GRN], so this entity has possibility to inject enough routes to consume ~5'357'800 TCAM entries (one per IPv4 and two per modern IP) that's ~10 times larger that current "Internet routing table" size (~630'000 for IPv4). So I registered some of these expired domains, conducted a safe experiment using RIPE Atlas trying to verify that IP addresses for alike domains containing thousands of A and AAAA records are really added to routing tables and published intermediate results[RUFW] on ~midnight of 15th of June (10 hours before the open invitation). I also hope to publish full results in English within couple of weeks. Results were not shocking, but they clearly showed that the risk of TCAM overflow attack against backbone ISPs is non-zero. The thing that really disappointed me was that there were almost no discussion about possibility of this attack among ISPs engineers during Russian internet hiccups on early-June 2017. [TC1] https://bgpmon.net/what-caused-todays-internet-hiccup/ [TC2] https://arstechnica.com/security/2014/08/internet-routers-hitting-512k-limi… [GRN] https://ru.wikipedia.org/wiki/%D0%93%D1%80%D0%B0%D0%BD%D0%B8.%D1%80%D1%83 [RUFW] https://habrahabr.ru/post/330934/ It was obvious to me that round table discussion of the bill unlikely changes anything in terms of anonymisers regulation, but I decided to use the round table discussion as an opportunity to mention the risks produced by the blocklist that is so inaccurately managed: TCAM overflow attack, DPI overload attack and I also wanted to mention compromised DPI equipment that we already observed in Egypt in autumn of 2016[BADPORN]. Extending the blocklist with IP addresses of large networks controlled by people that are often presented as internet anarchists sounded like too risky action to me. IMHO the minimal pre-requirement for alike bill is building of technological framework that mitigates these risks, passing the bill without the framework looks like carelessness to me. The interesting points about the proposed bill are clear copyright lobby behind it[COLOB] and the mantra "we don't ban VPNs and anonymisers that are going to enforce Russian blocklists for Russian customers" repeated over and over again. I still consider the mantra "we don't fight anonymity today" a sort of hypocrisy, but I don't want to discuss ethical & political parts of the matter. [BADPORN] https://ooni.torproject.org/post/egypt-network-interference/#third-party-to… [COLOB] http://komitet5.km.duma.gov.ru/Novosti-Komiteta/item/513823 So I joined round table as an unofficial, technological Tor Project representative and brought five points to the discussion: 1. TCAM overflow attack risk, 2. DPI overload attack risk (routing traffic to DPI with IP injection), 3. Egypt case when filtering equipment "waz hax0d" 4. VPN-over-VPN and inability to deduce if the client is Russian even for __complying__ VPN providers if the client tunnels one VPN connection through another one. 5. Inability to pass a marker "Client is Russian" through chain of tor nodes as it affects anonymity of the client, that likely means that Tor will be unable to comply with the law without sacrificing its goals. There were some fun news and interesting datapoints presented during the round table. A representative of backbone internet provides also complained that current size of Russian segment of the internet in terms of routes is ~40'000 routes and blacklist already adds ~60'000 routes to that, so there is 1.5x times more memory spent to serve blacklist than to serve actual Russian traffic :) DPI deployments for one of backbone ISPs already costs ~1e9 USD according to MTSC delegate. I consider this datapoint being really interesting as MCX:MTSS market cap is 7.8e9 USD. The chairman is, probably, a troll as he encourages to develop something like Tor with parental (governmental) control. I just ignored the suggestion but it may be an interesting case for stubborn lawyer and developer in theory: e.g. Tor Browser showing a nag screen while visiting https://bada-boom.club saying something like "This Website is banned in Barbaristan and United Cities of Barbaria. We don't track you so we don't know your country. Please, proceed only if you're not a citizen of these countries". Technically it reminds me of safe browsing nag screens. I doubt that alike nag screen may be really used as an valid argument in the court during an attempt to "unban" Tor, but it sounds like an interesting fantasy to me, so I mention it here (assuming that everyone loves legal trolling). The bill also mentions that search engine operators have to fetch blocklist and remove links to blacklisted websites from search engine result pages with fine of 12k$ USD if they don't. Obviously search engines have same issue while trying to determine "residence" of the user. Nearby mail thread about Ukrainian users & Tor clearly demonstrates the complexity of the issue :) The following week was also interesting. www.google.com was officially banned for couple of hours on 22nd of June and Leonid Levin said that it was some sort of warning[WAT] for internet companies. The first draft of aforementioned bill was accepted on 23rd, saying that various TORs (sic!) should be regulated and MUST NOT route traffic from users of global network (internet) towards to the banned websites. There were also some bills on messengers discussed and there was a open-letter fighting between Durov from Telegram (that may be banned in Russia this week), Zharov from Roskomnadzor, with comments from Bortnikov from FSB and aforementioned Levin, but that was too much legalese for me and it's not that much relevant to tor-talk@ ML, so I'm putting that part aside :) [WAT] https://rg.ru/2017/06/22/v-gosdume-nazvali-blokirovku-google-predosterezhen… [WAT] http://komitet5.km.duma.gov.ru/Novosti-Komiteta/item/551685/ [WAT] https://archive.li/VxkwR & https://archive.li/MZ1Hu [TORZ] https://youtu.be/a9ZJq4bIiHE?t=1m55s Dear reader! Thank you for your time reading this! Sincerely yours, Acting Gonzo[*] Developer. [*] http://darkk.net.ru/garbage/2017.06-Tor-VPN-and-Duma/Levin-anonymisers-3785… -- WBRBW, Leonid Evdokimov, xmpp:leon@darkk.net.ru http://darkk.net.ru tel:+79816800702 PGP: 6691 DE6B 4CCD C1C1 76A0 0D4A E1F2 A980 7F50 FAB2 P.S.: And I'm sorry for links mostly in Russian. -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

1 0