- cypherpunks - lists.cpunks.org

Re: Tor, the pentagon's cyberweapon
by Punk-BatSoup-Stasi 2.0 15 Oct '20

15 Oct '20

On Tue, 13 Oct 2020 15:01:03 -0400 Karl <gmkarl(a)gmail.com> wrote: > Yay, anonymity networks. > > On 10/13/20, Punk-BatSoup-Stasi 2.0 <punks(a)tfwno.gf> wrote: > > On Tue, 13 Oct 2020 14:32:53 -0400 > > Karl <gmkarl(a)gmail.com> wrote: > > > >> We were, actually, looking at the ABCs of Tor, or what do you mean? > > > > > > I mean the facts that 1) tor is pretty useless for actual anonimity 2) tor > > 1) welllll it makes you completely invisible to your neighbors and > your isp, and very identifiable to federal agents as having something > to hide you are always invisible to your neighbors unless your neighbors own your ISP. And you're not 'invisible' to your ISP anyway, see the 'fingerprinting' attacks on tor. So even at that level tor doesn't work as advertised. > > is a cyberweapon created and controlled by the pentagon. That's the ABC of > > the mobile phone is a way bigger cyberweapon than tor. agree? disagree? agreed. Although retardphones are not advertised as 'anonymous', so somehow there's less fraud involved. > > > tor and you certainly WON'T learn that looking at the source code. > > So, below you say > > > if you want to know how good tor is 'technically' wise then listen to the > > criminals who write the code > > > > https://github.com/mikeperry-tor/vanguards/blob/master/README_SECURITY.md > > > > "Tor has only basic defenses against traffic analysis at the moment." > > Really, we're possibly getting at the same things. Tor froze after > mike perry wrote that. It was never addressed, and they now have a > policy against addressing it. right, and that 'policy' has been in place since the day tor was created. > We could just address it. It seems like obviously the thing to do, if > you're a bored computer programmer, is to steal the good parts of the > tor code, remove all the parts designed to make the naive governments > trackable by the sneaky governments or whatever, and replace them with > something transparent that welcomes improvement, no? and interestingly nobody has done it so far. Granted, it's not that easy. > > > signed mike perry - uh oh. > > The information in the quote you posted is incredibly well known by > tor users, as far as I understand. The information is unknown to the vast majority of tor users, including all the tor users who use tor in 'dark markets' and end up in jail. Since day 0 tor has been fraudulently pushed as an 'anonymous' network while the tor developer mafia admited in their inner circles that their 'product' was shit. And when somebody like appelbaum stopped fully toeing the party line he became a 'rapist'. Yes, that's how crass these people are.

5 28

Setting up PGP
by Karl 15 Oct '20

15 Oct '20

Let's enumerate a few steps for setting up PGP. What's PGP? PGP is an old tool that makes it really irritating for government agents to change messages in transit. [s/Nobody uses pgp anymore because we've all either been beat up by corporate goonies for using it or had our networks and systems hacked to remove its use, and we can fix that./Everybody uses pgp in every message they send on the internet!/] I generally use gpg, gnupg, and pgp as interchangeable terms. PGP is irritating to set up, because to do it really right you need an airgapped computer to store your personal identifier on. Airgapped means it is disconnected from the normal internet. Otherwise your key is stolen when somebody breaks into the computer using it. Believe it or not, and this is pretty wellknown, systems are regularly broken into in massive worldwide droves as new vulnerabilities are discovered and revealed: these new vulnerabilities are called "0-days", and you can be pretty sure that anybody who doesn't use that term isn't a hacker. There's another issue: some people take new devices out of the mail, and break into them in advance, possibly even adding new communication hardware, then stealthily put them back in the mail before they are received. [s/Kind and caring corrupt federal people are well known to be forced to do this and have even leaked this to victims of it./Obviously if anybody actually did this they would feel so bad they would stop, but we still want to respect our use of pgp enough to consider it./] The risk seems small, but when you use PGP the integrity of the messages you exchange with everyone else is at stake, so it's good to take proper precautions. So, it's best to acquire your device for airgapping from a local reservoir of them, like a popular store that [s/<it's hard for me to talk about or encourage cash purchases because i've been tortured by enforcement goonies>/takes friendly cash that keeps everyone's identity more safe/]. This way you get the same set of system compromises and vulnerabilities that everybody else at the store gets, which means those compromises are not going to be placed specifically against your use as an airgapped security device. A lot of people will say worrying about this is paranoid. This is a way to tell that they are not hackers, either. Hackers who can actually reliably communicate with their peers consider paranoia to be good, and make it their business to act on it. When considering a device, you'll ideally want one that doesn't have any wireless networking hardware in it. Otherwise you'll ideally want to remove or disable all the wireless networking hardware, which [s/is pretty much impossible if your hands shake all day from being tortured for being an anarchist/is lots of fun to learn to do at a local urban makerspace where you can get lots of help on the kinds of things I'm posting about from people passionate about helping/]. If you happen to live in the usa near randall munroe, one of the many areas where a lot of open source hackers used to live, you could probably buy a small board without a wifi chip called a "pi zero" from a store called "microcenter". Another approach could be to repurpose something like an OLPC XO and remove the wifi board, which is very easy to do. After finding a good candidate airgapped device, you'll want to be careful with how you use it. Remember, whenever a new vulnerability is found, trojans cover the world taking advantage of it, and then try to find a way to hide inside the corners of all the systems they find. So, any drive you put in your new device, anything you plug into it, any update you apply, could be filled with computer-measles that would find a way to trick it into giving remote control to them. Keep it isolated until you have things set up for use. The next step after getting a reasonable airgapped device, maybe a pi zero, and ideally keeping it isolated, would be to install gnupg on it. Maybe in a forthcoming email!

5 19

Cryptocurrency: John McAfee Arrested in Spain per US Extradition
by grarpamp 14 Oct '20

14 Oct '20

https://www.reuters.com/article/us-sec-mcafee/u-s-indicts-anti-virus-softwa… https://www.reuters.com/article/us-sec-mcafee/u-s-sec-sues-john-mcafee-over… https://mobile.twitter.com/officialmcafee https://mobile.twitter.com/theemrsmcafee

2 1

Re: [tor-relays] BadExit: Rerouting exit relays detected (1) 45.63.11.98
by grarpamp 14 Oct '20

14 Oct '20

On 10/12/20, Dr Gerard Bulger <gerard(a)bulger.co.uk> wrote: > Torrc allows you to exit from a different IP. I thought it a good idea to > stop arbitrary blocking of the advertised Tor exit IP, the captchas and > blacklists that tor users suffer. Relay operators are free to do that for those reasons. Any overlay network that has an exit function should have some percentage of its exits unpublished, else there is zero chance for its users to route around that form of censorship. NAT, VPN, tunnels, etc also allow to do the same thing without torrc. > When IPv6 implemented fully we have a wide > range of IPs to send from on each server. > > Perhaps it is not considered good form to do so as the internet should know > who is using Tor. The internet should not know who is using tor. Nor should Tor particularly subjugate itself to the random wishes of the internet, much of which and the global powers that be, would love to have tor (and all the other overlay networks, cryptocurrency, encryption) simply comply themselves off the internet according to such wishes. The internet already has ability to enumerate all the exit nodes. Whether internet does so to satisfy its own wishes or not is not tor's problem. Making tor easy to block only makes the censors job easier. > So what is the problems for TOR security when exits set up to send from a > different IP? Is it that we do not know what the second IP is up to in > dealing with the IP4 traffic from the exit? There is no tech "security" problem herein, only a "political" problem. Paths to actual freedom always see political spin and action against them. Fight back, more in the political they use, less in falling to complying the tech. -- The Tor lists, blog, etc are all actively censored. Your messages for people to read may not be permitted by the Tor Project censors, and Tor Project censors may prevent you from reading peoples messages.

1 0

Police Raided German Spyware Company FinFisher Offices
by Stefan Claas 14 Oct '20

14 Oct '20

https://thehackernews.com/2020/10/finfisher-spyware-raid.html Regards Stefan -- NaClbox: cc5c5f846c661343745772156a7751a5eb34d3e83d84b7d6884e507e105fd675 The computer helps us to solve problems, we did not have without him.

1 0

1984: Philippines Enters Homes to Force All Residents Into National Tracking, Permission, Social Scoring, Biometric ID Database
by grarpamp 14 Oct '20

14 Oct '20

https://asia.nikkei.com/Politics/Philippines-starts-registering-millions-fo… You are next. The Philippines began Monday registering millions of citizens for its national identification system, hoping to promote electronic payments and make it easier for low-income earners without bank accounts to access financial services. From a report: All Philippine citizens and resident foreigners are required to register such information as name, sex, date of birth, place of birth, blood type, address and nationality. Biometric data -- fingerprints, facial photos and iris scans -- also will be stored. The country's current system, in which different agencies issue their own numbers, has been criticized as inconvenient. The new system will grant each person a unique number that can be used across agencies. The government hopes to make financial services more accessible to low-income workers who lack bank accounts as well as facilitate delivery of government services. Officials from the Philippine statistics agency will visit homes to collect the personal information, completing the process before President Rodrigo Duterte's term ends in June 2022. The system is scheduled to begin operation in the second half of 2021 for services such as visa issuances. A survey found 73% public support for the new ID system, suggesting that little concern exists over the collection of personal information by the government. Karl Kendrick Chua, acting secretary of the National Economic and Development Authority, said the ID system will accelerate growth of the digital economy. He expressed hope that the national system will spark widespread use of electronic payments. Partnerships with the private sector also appear to be on the table. https://www.wired.com/story/amazon-drone-camera-go-palm-data-privacy/

1 0

Cryptocurrency: Central Interest Rates Toward Zero, Poisons, Distastes, #DrainTheSwamp
by grarpamp 14 Oct '20

14 Oct '20

> You know, it really appears that the Fed was very much on the side of Obama, and later it was very much against Trump. Almost as if it was trying to SABOTAGE the economic recovery. The Fed doesn't like parties (say the Republican Tea Party) and people (Ron Paul, Cryptos) that might go against it. Playing Sabotage and Saviour are self preservation tools. https://en.wikipedia.org/wiki/Tea_Party_movement Media, Democrats, and Deep State all trying to sabotage Trump too. Could it be because Trump's campaign promise to... #DrainTheSwamp ... tends to go against all four of their existance... https://pbs.twimg.com/media/DrWCnAOVsAANqPh.jpg #MAGA RWR Kinda need to drain the worst systems of pervasive breadth and depth entrenchment (Democrat Socialists Communists) out the way before anyone could hope to come fill the new space with say Libertarian Voluntary Anarchy. And/or develop an AP poison pill that might encourage space to free up more quickly across the board instead of slow progress along the authority-freedom number line. Cryptocurrency pill already started up. Consider... that Trump as a business may also harbor decades of quiet distaste for all the above, regulations, non-free markets, etc. Multiple fronts of action toward more freedom. > "President Donald Trump now wants the Federal Reserve to lower interest rates to zero or below." > https://www.barrons.com/articles/trump-ignores-the-downsides-of-negative-in… Year old article though still relevant. Excluding all other factors and mechanisms which are still unfortunately very much in effect therein, such as plain old money printing... A forever zero interest rate would mean neither side profits, nor the middleman known as the Fed, thus Fed eventually bankrupts itself from costs of being a pointless passthrough operation. Won't happen. Sweet spot for American economy has been around 2-5% or so over recent decades. That may not remain true going forward, and can be hard to reach smoothly. Admins should be careful since markets tend to dissent against application of extreme external conditions and rates of change. Keynes is a rather extreme propostion. Not the sweet spot data, but a chart on history... https://www.visualcapitalist.com/the-history-of-interest-rates-over-670-yea… Were the "recovery" talking heads to think... Much of worlds economy is still intact re Corona, immediate issue there is people forcefully unemployed by retarded government lockdowns. Easily addressible for a few more carryover months by world shaving some billions off its military budgets and distributing based on need. Thus no new debt, and smaller war machine. It's policy, thus not really Libertarian, but probably faster in interim than refunding tax theft till treasuries depleted, and teaching humanity to give directly to local charity, roads, etc instead. Debt seems to remain the chosen way, not least until spectacular implosion sometime, somewhere, as usual. Cryptocurrency pill has been predicted by cryptos to nullify debt policy in favor of humanity... so could gold, and chickens... were humans to adopt any suitable mix of them over Fiat, and see about avoiding implosions.

5 10

Re: Undelivered Mail Returned to Sender
by coderman 13 Oct '20

13 Oct '20

hey Zeenan, getting bounces but not going to jump through the "report false positive" rube goldberg. your subjects and diatribes might be generating lots of bounces? :) best regards, ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Tuesday, October 13, 2020 4:20 PM, <MAILER-DAEMON(a)protonmail.com> wrote: > This is the mail system at ProtonMail. > > I'm sorry to have to inform you that your message could not > be delivered to one or more recipients. It's attached below. > > For further assistance, please forward this email to support(a)protonmail.com. > > If you do so, you can delete your own text from the attached returned message. > > zen(a)freedbms.net: host smtp.secureserver.net[72.167.238.29] said: 552 5.2.0 > > SN2ikUplYK4O0 - SN2ikUplYK4O0SN2kkdSlH This message has been rejected due > to content judged to be spam by the internet community IB212 - If you feel > this is in error, please submit a request using the following page. > <https://checkspam.secureserver.net/?sid=SN2ikUplYK4O0&mid=SN2ikUplYK4O0SN2k…> > > (in reply to end of DATA command) > > > message/delivery-status > > ------------------------ > > Reporting-MTA: dns; mail-40130.protonmail.ch > X-Postfix-Queue-ID: 25862200007A > X-Postfix-Sender: rfc822; coderman(a)protonmail.com > Arrival-Date: Tue, 13 Oct 2020 16:20:44 +0000 (UTC) > > Final-Recipient: rfc822; zen(a)freedbms.net > Original-Recipient: rfc822;zen(a)freedbms.net > Action: failed > Status: 5.2.0 > Remote-MTA: dns; smtp.secureserver.net > Diagnostic-Code: smtp; 552 5.2.0 SN2ikUplYK4O0 - SN2ikUplYK4O0SN2kkdSlH This > message has been rejected due to content judged to be spam by the internet > community IB212 - If you feel this is in error, please submit a request > using the following page. > https://checkspam.secureserver.net/?sid=SN2ikUplYK4O0&mid=SN2ikUplYK4O0SN2k… > > text/rfc822-headers > > -------------------- > > Return-Path: coderman(a)protonmail.com > Date: Tue, 13 Oct 2020 16:20:34 +0000 > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; > s=protonmail; t=1602606044; > bh=cl7obA6eXOU68hyuGF2wLCjjfr2nn2SaRASp/FUst8c=; > h=Date:To:From:Cc:Reply-To:Subject:In-Reply-To:References:From; > b=KWpyfTKbcdB7iSiGNOcq8nXxpoI7eHMNu/TesKG1ndWZgt7vQrKLQy3Tw2npMm2DU > vpG/QRTO42mPi+jc9yQZeVyZwa2fUDibH1DY2LeGZp3NGykpdC2qY4QkNAWPBq4+Oz > 3JFHM3vpEG5eyjQP1dImw3ZcrQ6YJfaUVvwrl9wQ= > To: Karl gmkarl(a)gmail.com > From: coderman coderman(a)protonmail.com > Cc: Zenaan Harkness zen(a)freedbms.net, "cypherpunks(a)lists.cpunks.org" cypherpunks(a)lists.cpunks.org > Reply-To: coderman coderman(a)protonmail.com > Subject: Re: Cryptocurrency: Central Interest Rates Toward Zero, Poisons, Distastes, #DrainTheSwamp > Message-ID: qUDigGL0HJmgqKozM1EyXlWBWuP50VOiKW06CTzz8Az9fehAWDdtqxSfZ49Thc9Xh1elyLEgYdP8wistECVwg7M_nANfiBw_CFbK92MTMgs=(a)protonmail.com > In-Reply-To: CALL-=e7FErx8G3h+b9KyghmP3Dj8yFMk37YiB=+9A5N9-nZ+kQ(a)mail.gmail.com > References: CAD2Ti28_3WTy5qMvgOakABMca-v=Hix2wSfseyv_42SqxmOYsw(a)mail.gmail.com 20201013075054.0769B11C02D3(a)pglaf.org 20201013102124.GF1718346(a)eye.freedbms.net CALL-=e7FErx8G3h+b9KyghmP3Dj8yFMk37YiB=+9A5N9-nZ+kQ(a)mail.gmail.com > MIME-Version: 1.0 > Content-Type: multipart/alternative; > boundary="b1_2qhQKx6tIm5fcnCk1PUFU1xNZPs7dO6SjMa5TGXQc" > X-Spam-Status: No, score=-1.2 required=10.0 tests=ALL_TRUSTED,DKIM_SIGNED, > DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,HTML_MESSAGE, > LOTS_OF_MONEY,T_KAM_HTML_FONT_INVALID shortcircuit=no > autolearn=disabled version=3.4.4 > X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on > mailout.protonmail.ch

3 2

Looking at the tor daemon source code
by Karl 13 Oct '20

13 Oct '20

``` tor]$ grep -r 'main(' src/app src/app/config/or_options_st.h: int LogMessageDomains; /**< Boolean: Should we log the domain(s) in which src/app/main/main.c:/* Main entry point for the Tor process. Called from tor_main(), and by src/app/main/main.c:tor_run_main(const tor_main_configuration_t *tor_cfg) src/app/main/ntmain.c:static void nt_service_main(void); src/app/main/ntmain.c:nt_service_main(void) src/app/main/ntmain.c: * from those given to main() function. src/app/main/ntmain.c: nt_service_main(); src/app/main/tor_main.c: * \brief Stub module containing a main() function. src/app/main/tor_main.c: * tests, which have their own main()s, can link against main.c. src/app/main/tor_main.c:int tor_main(int argc, char *argv[]); src/app/main/tor_main.c:/** We keep main() in a separate file so that our unit tests can use src/app/main/tor_main.c:main(int argc, char *argv[]) src/app/main/tor_main.c: r = tor_main(argc, argv); $ cat src/app/main/tor_main.c ... ``` This is likely the main entry code for Tor. (Hey, tell me when it's time to shut up, if you're a hacker.) These files are like the genes of tor: they make it all work when you finally 'conceive' the tor process by running it, the kernel having electronic sex (I'm a prude myself) with the harddrive, sending its data regions through the various processes of the system loader, until the kernel process grows into a confused little application. And they were handmade by software developers like the famous Jacob Appelbaum, who is unfortunately the same age as me! He doesn't have _that_ big a beard, but he does have glasses, so his beard is big enough to be a coder. ``` /* Copyright 2001-2004 Roger Dingledine. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. * Copyright (c) 2007-2020, The Tor Project, Inc. */ /* See LICENSE for licensing information */ ``` This stuff people put at the top of their source code to support various lawyer heroes they know. Often richard stallman gets a big chunk up here. Tor is kind and refers us to another file for details rather than making us scroll past it all. ``` #include "orconfig.h" #ifdef ENABLE_RESTART_DEBUGGING #include <stdlib.h> #endif ``` Header files. orconfig.h looks like some of that system-specific stuff that `./configure` might have generated. The #ifdef/#endif's basically indicate that ./configure can enable or disable the region between them. "stdlib" is used for a wide variety of functions. ``` /** * \file tor_main.c * \brief Stub module containing a main() function. * * We keep the main function in a separate module so that the unit * tests, which have their own main()s, can link against main.c. **/ int tor_main(int argc, char *argv[]); ``` This is a very clear description of the file we are looking at. The commenting style is well-accepted, and quite easy for developers to look at it, because it is so normal. The comment implies that the _real_ guts are going to be in main.c . We can look at that file after this one. ``` /** We keep main() in a separate file so that our unit tests can use * functions from main.c. */ int main(int argc, char *argv[]) ``` Here they said a very similar thing, but put the comment on the main function instead of the tor_main function. This is because programmers can get very confused after spending their lives staring at blinking rectangles instead of talking to other people. It's possible a software developer would only see the thing they are looking for, and not the things around it! Additionally, software developers learn to be very obsessive compulsive about rigorous consistency in the structures they design, because if they don't do that when working inside a computer the computer can develop a bad issue of smoke leaving its cpu. Comments don't affect the cpu. ``` { int r; ``` This defines a variable "r", saying it is an integer, and that nobody knows what it will be used for quite yet. ``` #ifdef ENABLE_RESTART_DEBUGGING int restart_count = getenv("TOR_DEBUG_RESTART") ? 1 : 0; again: #endif ``` Here's that mysterious use of `<stdlib.h>`! `getenv` is a function from stdlib that gets a variable from the environment. If this feature is enabled, the user can set `TOR_DEBUG_RESTART` to control the value of restart_count, _without changing or recompiling any code_! Miraculous! ``` r = tor_main(argc, argv); ``` This hands off control of the system to the tor_main function and is the _only thing_ actually being done here. There's no need to look any more at this file. It's basically saying that `tor_main` is the real `main`, over and over again. ``` tor]$ grep -r 'tor_main(' . ./ChangeLog: return from the tor_main() function, rather than calling the ./ReleaseNotes: return from the tor_main() function, rather than calling the ./src/app/main/main.c:/* Main entry point for the Tor process. Called from tor_main(), and by ./src/app/main/tor_main.c:int tor_main(int argc, char *argv[]); ./src/app/main/tor_main.c: r = tor_main(argc, argv); ./src/feature/api/tor_api.c:tor_main(int argc, char *argv[]) ./src/feature/api/tor_api.h:int tor_main(int argc, char **argv); ``` `tor_main` appears to be in tor_api.c . If you want to memorize the basics of how tor works, that's the next file to look in. That's all for now, folks!

2 3

Trying to Connect with a Hacker Online
by Karl 13 Oct '20

13 Oct '20

So, every hacker [s/is slowly forgetting due to global gaslighting and abuse/knows firmly/] that plaintext, unsigned communications are pointless because all the political influences between you and the person you're communicating with will alter your communications. In order to connect we have to find each other on networks that are more reliable than e-mail. A clue to finding these networks, people, and other exotic information, is weird strings of numbers and letters that seem like random gobbledygook, almost as if we were copy and pasting computer glitches to each other. No, these confusing strings of characters are the words of computer hackers: especially if the alphabetic characters never exceed 'f' in the alphabet, which does not stand for 'fuck this is confusing', but rather for 'we made computers highly efficient by braking them into powers of two'. It's called hexadecimal. > On 10/12/20, Stefan Claas <sac(a)300baud.de> wrote: [snip...] >> Regards >> Stefan >> >> >> -- >> NaClbox: cc5c5f846c661343745772156a7751a5eb34d3e83d84b7d6884e507e105fd675 >> The computer helps us to solve problems, we did not have without him. Here, we have a hexadecimal string associated with the phrase 'NaClbox'. 'NaCl' is a stupid-people-who-use-computers word for encryption and verification. 'box' is the same for computer. Let's search for it and see i we can find this random string of hexadecimal! This time, I'm going to [s/heal my injured spine/wise up to the manipulative marketing AIs/] just a smidge, and use a search engine other than google. Even better would be _asking a human being_, but we're not quite that smart yet. I'll try duckduckgo. I typed 'naclbox' into duckduckgo and the first hit is ... https://www.naclbox.com/ ! This has to be it, right? It has the right domain name! A computer game thing! This hacker must have been asking us to play computer games with them, how friendly! Let's do some wizardry called a 'dns lookup' on that url. There's a way, given _any url_, to get information on who purchased it and stuff like that. If [s/you're actually part of a major corporate conspiracy and are frequently hired to kill people who look into the origins of coverups/you have schizophrenia from too many dns lookups/] you may have trouble doing this important research, but it's not very hard to do. Searching the internet for "lookup dns purchase command line", I see a way to copy the term that [s/gives me severe traumatic flashbacks/i haven't learned to use yet/]: "whois". My system doesn't have "whois" installed because I'm a normal person, not a mumbo-jumbo computer wizard, but I can install it like any other package, and run it on www.naclbox.com: ``` $ whois naclbox.com Domain Name: NACLBOX.COM Registry Domain ID: 1653881042_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.gandi.net Registrar URL: http://www.gandi.net Updated Date: 2020-03-27T19:42:08Z Creation Date: 2011-05-01T15:51:02Z Registry Expiry Date: 2021-05-01T15:51:02Z Registrar: Gandi SAS Registrar IANA ID: 81 Registrar Abuse Contact Email: abuse(a)support.gandi.net Registrar Abuse Contact Phone: +33.170377661 Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Name Server: NS-1219.AWSDNS-24.ORG Name Server: NS-1965.AWSDNS-53.CO.UK Name Server: NS-259.AWSDNS-32.COM Name Server: NS-544.AWSDNS-04.NET DNSSEC: unsigned URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/ >>> Last update of whois database: 2020-10-12T13:36:17Z <<< ``` This record claims that the domain was purchased on 2011 and expires 2021. It's been a really long time since I've done this, but I was expecting to see some information on e.g. a technical contact or something: a real human being associated with the website. Maybe I have too look somewhere else. I tried this: ``` $ whois -h whois.gandhi.net naclbox.com ``` which just sits there and hangs. Anyway, it sounds like the _cryptographic_ nacl project would be able to purchase this domain in 2021 if they wanted. Farther down the duckduckgo results is a more promising link, that leads to https://pkg.go.dev/golang.org/x/crypto/nacl/box . Unfortunately, this project now calls itself "package box", not "nacl box", which is discouraging. Still, we can look it over. Woohoo! "package box" says it is a generic frontend for NaCl encryption, which implies that it's possible that the signature we found is a public key for sending somebody private messages in a reliable manner, and that any tool that does this NaCl encryption can communicate with him. "package box" links to a central nacl website: https://nacl.cr.yp.to/box.html . A great way to check if we interpreted these letters-and-numbers-mumbo-jumbo correctly is to try to use them. We'll try to send this guy ... what's their name? >> NaClbox: cc5c5f846c661343745772156a7751a5eb34d3e83d84b7d6884e507e105fd675 We'll try to send cc5c5f846c661343745772156a7751a5eb34d3e83d84b7d6884e507e105fd675 a message ! This might mean learning to use nacl. The page I found is a c++ interface, so I'll just use that since [s/my fingers and eyes spazz out uncontrollably when i use the web now/it's a good exercise for me to write a small C++ program/]. ``` $ sudo yum install nacl-devel # nacl is a software development library for secure communication that's been available on linux systems for some time now ... ``` If you've been through [s/an abusive enslavement experience where you suffered severe injuries and learned to dissociate from your memories as way of life/a corporate or government training program/] you may have difficulty forming encrypted communications with a hacker online, but rest assured everything is fine: since the worldwide digital coronavirus has thoroughly filled your device with malware, all the corporate goonies can make sure everything is okay, and since this guy is an experienced enough hacker to communicate with letters and numbers, they'll be able to tell that you aren't one of them. That doesn't mean they'll be able to keep themselves safe from your oppressive surveillance and control situations! It's your job to [s/manage those by communicating with your contacts/mourn your wake of dead hackers after the fact/]. So please make a record of what you do so that others can learn from it after somebody new [s/dies horrifically or gets forcibly enslaved by a criminal corporate dictator/gets bored and ignores the rest of us/]! First we need to generate a naclbox of our own, to send the communication from. It's just a set of small personal letters and numbers. The website has this in it: ``` #include "crypto_box.h" std::string pk; std::string sk; pk = crypto_box_keypair(&sk); ``` > The crypto_box_keypair function randomly generates a secret key and a corresponding public key. It puts the secret key into sk and returns the public key. It guarantees that sk has crypto_box_SECRETKEYBYTES bytes and that pk has crypto_box_PUBLICKEYBYTES bytes. The secret key is like your brainstem and your heart. You don't let anybody else even get a whiff of them, _certainly_ never touch them or see them, or you could get hurt. Since [s/I'm a corporate slave/this is just an example/], I'll be storing my brainstem on the malware that's infesting the system I am typing this on. On my system, I'll have to mutate the example from the website just a tiny bit, to get it to compile. ``` // nacl-generate.cpp #include <nacl/crypto_box.h> #include <fstream> #include <iostream> int main(int argc, char **argv) { if (argc != 2) { std::cerr << "Error: provide new delicate brainstem file as first argument." << std::endl; return -1; } std::string pk; std::string sk; pk = crypto_box_keypair(&sk); std::string brainstem = argv[1]; std::ofstream delicate_precious_guts_we_are_going_to_figure_out_how_to_protect(brainstem.c_str()); delicate_precious_guts_we_are_going_to_figure_out_how_to_protect << sk; // this is a c++ way to convert from computer innards to hexadecimal letters and numbers std::cout << brainstem << "'s name is: " << std::hex; for (char const * byte = pk.data(); byte != pk.data() + pk.size(); ++ byte) { std::cout << ((*byte) & 0xff); } std::cout << std::endl; std::cout << "Don't lose track of it or nobody will be able to find 'em!" << std::endl; } ``` I actually had to work with it quite a bit while handling my issues. ``` $ g++ nacl-generate.cpp -o nacl-generate -l nacl $ ./nacl-generate delicate delicate's name is: 1934067c6303d231b897152a989bd905fe82b5130de209a1ddb61e118e7a477 Don't lose track of it or nobody will be able to find 'em! $ mv delicate 1934067c6303d231b897152a989bd905fe82b5130de209a1ddb61e118e7a477 `` This file of letters and numbers is now _our_ identity. We can make similar programs to send and receive messages with them. There are likely tools out there already to do this automatically, and if not it would be a problem to be solved. Here's some code to receive messages with the file we made: ``` // nacl-receive.cpp #include <nacl/crypto_box.h> #include <fstream> #include <iostream> #include <sstream> std::string binary2hex(std::string binary) { std::stringstream ss; ss << std::hex; for (char const * byte = binary.data(); byte != binary.data() + binary.size(); ++ byte) { ss << ((*byte) & 0xff); } return ss.str(); } int main(int argc, char **argv) { if (argc != 2) { std::cerr << "Error: provide delicate private file as first argument." << std::endl; return -1; } std::string pk, pkhex; std::string sk; std::string n, nhex; std::string c, chex; std::string m; std::ifstream skfile(argv[1]); skfile >> sk; std::cerr << argv[0] << " receiving." << std::endl; // Although hackers like to share things in confusing ways, for example by // cramming the public key, the nonce, and the ciphertext all together, // we're separating them out here to ease my learning this new system. // When sending the greeting to the hacker, we may want to jam all the data // together, offering it as either a reasonably-confusing puzzle or a guess // as to having already put the time in to learn the system, so that we // speak their language more. Hackers tend to assume that everybody has as // much free time as they do, and might misinterpret things if somebody // didn't act as if they also did. This assumption would be easy to change by // playing their hacking games with them or preferably simply talking // clearly and directly and publically, rather than [s/fucking up their open // source people and projects/waiting for them to notice/]. But obviously // we can't do that, since we're [s/a bunch of people who want to help, // not the people in charge/too busy to get personally involved/]. std::cerr << "Enter public key of sender: " << std::flush; std::cin >> pkhex; pk = binary2hex(pkhex); std::cerr << "Enter nonce: " << std::flush; std::cin >> nhex; n = binary2hex(nhex); std::cerr << "Enter cyphertext: " << std::flush; std::cin >> chex; c = binary2hex(chex); m = crypto_box_open(c,n,pk,sk); /*The crypto_box_open function verifies and decrypts a ciphertext c using the receiver's secret key sk, the sender's public key pk, and a nonce n. The crypto_box_open function returns the resulting plaintext m.*/ std::cout << m << std::endl; } ``` In the next possible episode, we would either make a sourcefile to send a message to the hacker by again copying from that same website, or find a pre-existing tool that already does so, and then try sending a message to see if we even interpreted their signature at all correctly. We might also make an embarrassed reply, asking what their signature means, or search the archives of the list to find a clear explanation of it sitting there.

3 26