- cypherpunks - lists.cpunks.org

Re: [Cryptography] Tempest and limits on receiving
by grarpamp 05 Apr '17

05 Apr '17

> That law was adopted in the US for consumer privacy reasons back when > cell service was analog and unencrypted, and cellular conversations > could be listened to with an off-the-shelf scanner. It is less > relevant today, but still on the books. AMPS is long dead in the US, but you don't see that now irrelavant and useless thing being removed from "law" do you. (Well, more applicably, "cordless household phones", which have also evolved somewhat beyond a simple fixed 800MHz carrier. Regulate Technology vs. Act, stupid govt's.)

1 0

Re: [Cryptography] Regulations of Tempest protections of buildings
by grarpamp 05 Apr '17

05 Apr '17

> Leichter wrote: >> Sorry but if you can't see the written law, promulgated regulation, or >> included by reference junk, even as an indigent for lols, then it doesn't >> exist, you don't have to comply with it, and can't be prosecuted for it. >> There is a very famous guy (can't find link) who goes around suing >> FOIA / States / Jurisdictions over this bullshit secret law proprietary >> copyright trademark access fee crap, and winning. > You're thinking of Carl Malamud ... who as it happens just *lost* a case in US District Court against Georgia, whose full official laws, in hardcopy, were only available to him from LexisNexis for $1,207.02. See https://arstechnica.com/tech-policy/2017/03/public-records-activist-violate… > > There are many state laws a regulations that "include by reference" standards published by various organizations who sell them for large amounts of money. Yes, you are legally responsible for working within the standards. If people want to be apologists for the Secret Arbitrary Control Profit State, they exactly deserve what they get, and such things do and will affect you eventually. oh, are you going to praise the $1000 it costs you do buy the driver / tax / employment / marriage "law". If you can't see, read, debate, contest and ply to modify the entirety of the law, freely, even as a $broke bum on the street, it's not a law. This is absolutely fundamental principle and requirement of working "democracy", among other memes. Otherwise you're a subject of tyranny of elites who don't give a fuck about you. Nobody cares it you take the public body of law, *add* your own annotations, work, etc, and resell that product... that is *not* law. Of course Malamud will lose that. However that's entirely different than the law public itself, including all "included by references", etc. If it is work product of Legislative, Judicial, Executive branches, it must be free and freely available, and so must all such deliberated included's... this is fundamental here. If you have to pay to see that which you must comply with, it isn't law, and you have a rock solid case to ignore it, unless of course too many apologists have made that slippery slope happen, for which you're doomed. You're a complete fool to comply with a "law" you cannot freely read for free. Show me the law, I'll make my own damn "annotations".

1 0

Re: [Cryptography] Does anyone here know PAM?
by grarpamp 05 Apr '17

05 Apr '17

On Tue, Apr 4, 2017 at 10:04 AM, Phillip Hallam-Baker <phill(a)hallambaker.com> wrote: > This is a call for technical assistance with a crypto project. Hopefully it > will be of wider benefit if successful. > > The Mathematical Mesh has the goal of making computers easier to use by You mean http://www.prismproof.org/ > making them more secure. Note the order. While there are some times that it > is appropriate for a cryptographic key to require the user to enter a PIN or > the like to use it, that cannot be the default requirement, nor is it > acceptable to just leave private keys sitting on disk unencrypted. > > Windows and OSX both provide features that cause private keys and other > credentials to be unlocked automatically using the user's password as a PIN. > I want to achieve the same on Ubuntu. I am happy if the solution can also be > carried across to other Linux and FreeBSD but don't have resources to cover > anything else. Various tools / ports / projects in both Linux and BSD do exist that will get you magical login encrypted homedirs. OSX also has it. Now that per dataset crypto keying is in ZFS, you might expect to see some uniform use of it spread across everything except Windows. http://open-zfs.org/wiki/ZFS-Native_Encryption https://youtu.be/frnLiXclAMo https://drive.google.com/file/d/0B5hUzsxe4cdmU3ZTRXNxa2JIaDQ/view?usp=shari… http://pefs.io/ https://github.com/glk/pefs https://wiki.freebsd.org/PEFS http://glebkurtsou.blogspot.com/search/label/pefs You could find other implementations, FUSE, PAM, login, etc here... https://www.freebsd.org/ports/categories-grouped.html Linux does bunch of things with FUSE / PAM / dmcrypt. Even the old NFS crypto loopback still exists. > The authentication mechanism is PAM. So far, the only documentation I have > found has been of the barely more comprehensible than the code variety. https://en.wikipedia.org/wiki/OpenPAM http://www.openpam.org/ https://www.freebsd.org/cgi/man.cgi?apropos=1&query=pam https://www.freebsd.org/cgi/man.cgi?query=pam.conf > * Is hooking PAM the way to go Probably, or quite commonly. More tricky is defining and detecting whatever is considered to be a logout state, timeout, loss of human user, etc. > or should I try to make use of an encrypted > directory mechanism instead? If that is what you want as part of an outcome, then yes. > * If PAM is the way to go, where might I find a working example for using > the login password to unlock a private keystore? See above links. Other people will probably post others. > * Has someone already done this for GPG Agent? Probably. > In addition, one of the layered applications, Mesh/Confirm offers two factor > authentication (among other things) so an example showing how to integrate a > network authentication mechanism would be useful. > > The architecture I am thinking of would be: > > 1) User logs in with password. > > 2) Password is passed to the unlock keys mechanism which uses it to unlock a > master key. > > 3) Processes running under the master key account can request unlocking of > profile data stored under it. > > Of course, it is quite possible that the magic required to bridge the gap > between 2 and 3 means effectively recreating GPGAgent.

3 3

gnupg-agent stores pass phrases until power-off
by Steve Kinney 04 Apr '17

04 Apr '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/04/2017 01:44 PM, grarpamp wrote: > On Tue, Apr 4, 2017 at 10:04 AM, Phillip Hallam-Baker > <phill(a)hallambaker.com> wrote: >> * Has someone already done this for GPG Agent? > > Probably. gnupg-agent is in serious need of some bugfixes, at least the version that makes it into Mint. Once it sees a pass phrase, gnupg-agent retains it until the system is shut down; stored pass phrases persist through user logout/login. This behavior is supposed to be controlled by a config file where a timeout can be set, but none is present in the default installations I have seen on Mint, and creating a new gpg-agent.conf as directed in the man page for gnupg-agent does exactly nothing to alter its behavior. The Debian devs say this is a non-issue. Their excuse: "Physical access is game over." How's that for convenient? Never mind that broken gnupg-agent means physical access by any unskilled snooper gives that person the ability to read and copy encrypted documents and files, or apply your signature to anything, while your back is turned. Not an issue. The presence of your pass phrase in system memory, as/when a non-persistent exploit checks to see if pass phrases for the secring keys it just sent to its owner are available in memory is not a potential issue, either. My work-arounds for this BS: http://pilobilus.net/gnupg-agent_work_around_for_linux_mint.html :o) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJY4/dcAAoJEECU6c5XzmuqRZsH/j+n/25kHvoGh67IslBPrw1B 19Bkv4iSTTFf+t7dSNK10r91MzE4Li+m4p1jh2jYmz0Irle+le5gVmKFklDJXj4S UKVzmK89uhYTdUbWIuld+oAX3TIPfCNz88wwAqAl+YljTOrd1hS6hw8YKj62QElg dPRY/og3qsSTUU8mi5d57pae4yqaHQ5Gq9qZkxMIKByz5ZiOsxUoRslwhkWwaMp9 6Bcm2p7BAyKXOE9ZSWUp/0GjyB0BSwuMLgQtj2R4FJDcqIJ4/YLc5SI7OgFSwYjx u3Yy9+XAeF3+nQaVH8woFMPr7MiKHexDpdzQtsAZ1FcF+LF04vJcaFJF11gzvdo= =rTK8 -----END PGP SIGNATURE-----

1 0

gnupg-agent stores pass phrases until power-off
by Steve Kinney 04 Apr '17

04 Apr '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/04/2017 01:44 PM, grarpamp wrote: > On Tue, Apr 4, 2017 at 10:04 AM, Phillip Hallam-Baker > <phill(a)hallambaker.com> wrote: >> * Has someone already done this for GPG Agent? > > Probably. gnupg-agent is in serious need of some bugfixes, at least the version that makes it into Mint. Once it sees a pass phrase, gnupg-agent retains it until the system is shut down; stored pass phrases persist through user logout/login. This behavior is supposed to be controlled by a config file where a timeout can be set, but none is present in the default installations I have seen on Mint, and creating a new gpg-agent.conf as directed in the man page for gnupg-agent does exactly nothing to alter its behavior. The Debian devs say this is a non-issue. Their excuse: "Physical access is game over." How's that for convenient? Never mind that broken gnupg-agent means physical access by any unskilled snooper gives that person the ability to read and copy encrypted documents and files, or apply your signature to anything, while your back is turned. Not an issue. The presence of your pass phrase in system memory, as/when a non-persistent exploit checks to see if pass phrases for the secring keys it just sent to its owner are available in memory is not a potential issue, either. My work-arounds for this BS: http://pilobilus.net/gnupg-agent_work_around_for_linux_mint.html :o) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJY4/aFAAoJEECU6c5XzmuqfqkIAKEccOp/KQbJ5AFyK0/Npsbn pwVRaiAokE+WqkclDsLmUmB5vqBu+eg4YJIhj0c2gig/55slyCn74kp8Eu0GlOHF 2/qDddjnu6yz91uQs3uoIffYzKvNTXz06THXSn8DQ/nzQVIdy2g67pO2/OqxVp7j cIex0XA02U2ThQGjMMVpg7EIFRrnmzFx9k+BH5wWI2tiHjPWFz/ISaEfq0xx/RwM FVJTQNGLMmKyHwmo1Nez8ZiM+4eZz3Oz9BdaH4yHnOQpI1z9nYY5jeYlOMuaEs6o TZ1+4XTj4tX6sa3PJj8Z57bBWkyFeZzgRC2aipelssT9ui3+J7Qi1ciEAtbfBRg= =j/Vm -----END PGP SIGNATURE-----

1 0

Re: [Cryptography] Regulations of Tempest protections of buildings
by grarpamp 04 Apr '17

04 Apr '17

On Sun, Apr 2, 2017 at 9:17 PM, Harlan Lieberman-Berg <hlieberman(a)setec.io> wrote: > One thing that may be true (this will vary highly with jurisdictions) is > that buildings which block the effective use of radio bands used by the > fire service may be required to install a repeater. This isn't a /ban/ > on such constructions, but rather an additional requirement for those > who do. Not all jurisdictions will require this, but some will: NYC, > for example, it's section 917.1.2 of the NYc building Code and FC511 of > the New York City Fire Code. > > (Nationally and internationally, the model codes are in Annex O of the > NFPA 1 and IBC 915 / IFC 510. Reviewing these may be difficult; > unfortunately, building codes are proprietary in most jurisdictions.) Sorry but if you can't see the written law, promulgated regulation, or included by reference junk, even as an indigent for lols, then it doesn't exist, you don't have to comply with it, and can't be prosecuted for it. There is a very famous guy (can't find link) who goes around suing FOIA / States / Jurisdictions over this bullshit secret law proprietary copyright trademark access fee crap, and winning. He's also going after inhouse crap like PACER, and farmed out junk like LexisNexis. And prople are trying to go after FISC/FISA/PATRIOT too.

1 0

The ideal IoT gift for beauties
by Georgi Guninski 04 Apr '17

04 Apr '17

The ideal IoT gift for beauties: http://www.theregister.co.uk/2017/04/04/intimate_adult_toy_fails_penetratio… Wi-Fi sex toy with built-in camera fails penetration test

1 0

Susan Rice: "I know nothing!"
by jim bell 03 Apr '17

03 Apr '17

https://www.youtube.com/watch?v=UmzsWxPLIOo Sgt Schulz This kind of news makes Mondays worthwhile! Jim Bell ×

1 0

Mirimir Hacked 8ch.net
by HotwheelsGTA 03 Apr '17

03 Apr '17

∞chan is saving all poster IPs indefinitely. This is the code that matters: [code] event_handler('post-after', function($post) { global $board; $post['ip'] = $_SERVER['REMOTE_ADDR']; $data = json_encode(array('ip' => $post['ip'], 'body' => $post['body_nomarkup'])); for ($i = 0; $i bindValue(':board', $board['uri']); $query->bindValue(':id', $post['id']); $query->bindValue(':data', $crypted); $query->execute()or error(db_error($query)); // Failure is never an option, except when it is. }); Upon review of the vichan source code, I found that the "event_handler" function adds a callback function which is run when the corresponding "event" function is called. For example, event_handler('post-after') runs when event('post-after') is called, which it is called at the end of post.php. Line by line, this function makes JSON of our IPs and our post text. It then puts 10 random bytes at the end of the JSON. It then uses a file called "/srv/sunshine.pem" as a public key to encrypt the JSON with the PHP function "openssl_public_encrypt". It then inserts the JSON, along with the board being posted on and the ID of the post, into a table called "sunshine". The board and ID of post are in the clear, only the post content and IP are crypted in that JSON array. This gives McRonald and Jim the ability to look up the IP of any post they want even if the post is no longer live on the public site.

1 0

Mirimir Hacked 8ch.net
by HotwheelsGTA 03 Apr '17

03 Apr '17

8chans fucked [code]

1 0