- cypherpunks - lists.cpunks.org

Crypto Network HW Links, Anti Vampire and Sybil Nets, Actors Everywhere
by grarpamp 03 Apr '19

03 Apr '19

> If the state is out to get you I'd just assume that everything arround you > is rooted and a wire tap and act accordingly. Doesn't have to be anyone doing anything wrong. Anyone following geopolitics knows that surveillors can reap just aggregate spying and turn that into realtime influence messaging to their own purpose. "Looks like a lot of overlay users are visiting a node known for artwork. Let's craft on that." "Cryptocurrency rising... Let's craft that." "Here's todays daily statistical and Markov report... Craft it." > assume that everything arround you is rooted and a wire tap Is this not entirely possible for all users of technology around the globe today? Snowden and everyone else before and since told you that you're all being tapped, datamined, controlled, and used. But most still don't believe it, or do anything to directly end it, all you do is drop some tools, while leaving all the taps, entities, activities, policies, still in place. Oops. Recall that you have all still started up exactly ZERO projects that are combining all these elements... #OpenFabs , #OpenHW , #OpenSW , #OpenDev , #OpenBiz , #OpenAudits , etc So you still clearly have zero knowledge of what's actually in your CPU's, your NIC's, your storage, your networks, or any reason to explicitly trust them. You're all April's Fools still stupidly placing faith in secrets [1] even after endless stream of their lies exposed by exploits, be they cataloged by CVE or even network TV news. [1] Be they commercial, [geo]political, etc. >> Be they overlays on top of the internet, >> enhancements to the internet, >> or new guerrilla physical plant... >> >> That process of people contributing to >> original and ongoing development of new >> strong networks that are not susceptible to such >> Basic Bitch Adversaries as Global Vampires, >> is something more should consider. > Indeed, we'll get there eventually. > I am just a guy that made a thing because I thought it was cool. Yes. Hopefully more will see the need to make cool and different things that can all be competed, evaluated, merged together, and even happily and graciously abandoned and joined up for the next where needed, in order to help get everyone there. This applies outside the Tubes as well. >> Same for likely figuring out how to get >> the deployment Social aspects right so >> you can circle the network wagons against Sybil. > Let the record show that I am not the one making the sybil resistance claims > it's the coin team that is. I doubt them as well but I am open to being > surprised. I orignally had another model in mind for mitigating bad actors > on the network that I still plan on implementing (eventually) > Effectively it's a f2f mesh connectivity layer to help hide traffic shape. There's certainly no lack of pure f2f, or p2p dht, or central, or hybrid tools out there in history. Models, threats, and use cases all being tested and mashed together is good, and fun to do :) Sybil is extremely hard to protect against and root out, since all Sybil needs is Money, and an Excuse to be there. As noted in tor lists since years, the solution to Sybil might not be as complete with only "in network" methods. It will more likely require at least some in real life Web of Trust, Humans asserting over the nodes they run, the software analysing that web, making node selections based on that metadata. "I know her, she works at the store, he's at my meetup group, they're a local company, etc...", and so on, a mesh of persons to persons, running nodes and fiber, all around the planet. You're probably going to need to force Sybil to become a verifiable IRL Human Being... because right now all she needs is money, and her bags are full of it. In a 1 million node network, if half of the nodes are from WoT verified humans, each human runs 10 nodes, and only 50% the users prefer to make exclusive use of the WoT... that's 25k unique logical nodes now showing themselves as being more than just a completely anonymous potentially adversarial [point] source of money renting out boxes around the globe. Can 2.5% of the nodes making up any of todays transport, cryptocurrency, or application network overlays be said to be sufficiently trusted? Do any even need to be? In addition to signing human WoT data in the network layers, you could also start pushing analysis of node metadata into subscribable routing metrics... where are the nodes located, OS, uptime patterns, spec conformance, degrees of WoT such as non IRL nyms, and how strong each asserters verification and assertion policy framework is, etc. All of this and more could raise Sybil's cost and exposure risk qute significantly, perhaps to futility. Everytime the Sybil WoT subject hits the lists it's met with abject silence [or "Johnny can't..."] Is this due to fear of associating with a node (or trying to protect the node by not associating) such that if the node is taken down the operator can walk away or redeploy anon elsewhere? Is that not what Zero Knowledge is for, to allow everyone immunity to say "It's just bits, we have no knowledge or control"? Are advancements toward solving Vampire and Sybil really thought that horrifically "unusable" and "costly"? Or that some won't find them perfectly acceptable? Are the elevated levels of technical, philosophical, educational, and operational participation potentially required all nodes and any solutions thought to be impossible to achieve? Is it easier to just skate by on the odds and continue throwing the victims under the bridge as acceptable losses? > I am not arrogant enough to claim to be able to repell state actors from > sqaure one. Not meaning to have refer to Loki, or any project, but to all nets... We know that, other than routine protocol, code, and human exploits (those three all still being quite sufficient at times), adversaries remaining credible tools against Overlay Networks themselves seem to be Vampire and Sybil. And fake Law, no? It's not only State Actors... any global, regional, or even local tier-n ISP can be an adversary partner Vampire... all you need is to be, or have access to, some pipes... and a willingness to be, or be friendly to, some power, or to wish to gain from your own Vamping. And any NGO or person can be a Sybil... all that takes is money, and in many cases, amusingly little. When head down in code and ops, a bit of talk on the metas is good now and then. Mine should of course be disregarded entirely.

2 1

Loki.network, Crypto Network HW Links, Anti Vampire and Sybil Nets, Actors Everywhere
by grarpamp 03 Apr '19

03 Apr '19

> I am personally convinced that a flat traffic shape will only dare > attackers to cut links between parts of the network, effectively > making an even larger traffic shape to corrilate with. Today if play the cut links game, eventually a toggled link will expose the traffic you seek, because there's no fill between nodes that automatically takes its place. Your global monitor sees a respective signal slump among the nodes making up the subject path, each node distinguishable by time deltas. Such signal the adversary was probably clocking into it themselves for easier recognition anyway... fetch 1MB, fetch 1MB, fetch 1MB, fetch 1MB... oh noes. Tor's hidden services are total sitting ducks because of this. Same for likely all current overlay networks in production regardless of whatever service they provide... from traffic, messaging, storage, cryptocurrency, and so on. There are surely better links from the bib space, yet here are some concepts on generated buckets, retiming, how they can contain full time "empty" fill that yields to wheat demand on the line, traffic contracts, etc therein... https://en.wikipedia.org/wiki/Generic_cell_rate_algorithm If all the nodes are independantly maintaining independant traffic contracts between their physical and/or logical peers, cut links won't do hardly as much impact if anything at all... A \ B + -----> M -----> { U V W X Y Z } C + D / If nodes ABCD on the left are trafficing through M cloud fanning out to the right mesh towards UVWXYZ, then adversary cutout of D is not visible beyond M if M makes up for D's packet slack on its left contract by continuing to emit the same amount as fill to fulfill its right contract. M could variously blackball A for non contractual suspect misbehaviour... weird rates, timing anomalies, uptimes, etc. M could signal BC that they can now renegotiate upwards with M since M now has more rate free on its left. If M is cut out, the left renegotiates with some L or N nodes via new northern or southern arc routes. The "shape" or "bitrate" of the contracts could be negotiated as need be, "flat" might not be necessary, so long as the contract is upheld and policed by all participants to it. Contracts could be one to one, one to many, many to many, physical next IP hop to hop, logical overlay address to address, multiplex, simplex, tunneled, shared, etc. And pertain to bitrates, timing, uptime, any sort of constraints, metadata, etc. This also makes Sybil's life more difficult... it must now own the full path or it will lose sight due to contracts with non Sybil nodes in the path who are also meshed and contracted out to other non Sybils around ot. Sybil must also uphold all its own contracts or get dropped by other nodes. > I am not convinced low latency systems can be immune to traffic shape > corrilation and hence that being said Copper, Fiber, Radio, etc.. so long as it's quality line rate hardware that can keep up with its advertised rate, their time to transfer data is dependant only on distance, not on how full the line is. Such network hardware is agnostic... fill, wheat... it all gets there in the same time. When people say "X latency network overlay", they're really referring to the cost of software processing their overlay design on their crappy stack of PC / Phone CPU hardware. And in their transport protocols running on the same... TCP, UDP, etc... all the way down the stack until it hits the real network hardware, which will either happily accept and ship the packet, or drop it. When people cry about "bandwidth", all they need to do in a fill model is allocate whatever bitrate to it they like and forget it. They're not going to get more bitrate from their ISP than they paid for, and they'll probably contract to the overlay under that so they can do other things with their line. And they're not going to get more wheat bytes across the overlay than a 100% wheat ratio (fill yields to wheat demand) within their contract to the overlay, even if they do disconnect from their byte transfer based ISP / Phone afterwards. Research would need done into routing models needed to transit traffic across the overlay. ie: TCP can readily jam more yet slower circuits through a full pipe, UDP mix gets dropped routed or reserved for. Raw IP becomes interesting. As a network HW project for defense in depth... If hardware makers would add line rate encryption and fill silicon to every physical port on every switch, router, and NIC... mandatory on by default per physical link... that would kill off a lot of vampires. An open IETF RFC spec for that would cost under $1 per port to integrate into existing silicon port fab worldwide, plus electricity to drive the port which would be estimated as part of the RFC process. Modular agility would not cost much more at scale. Assuming line rate hardware, there's no latency impact here either. > I think state actors are out > of scope of the current threat model of llarp. If any network application involves free speech, politics, money aka cryptocurrency, business, journalism, industry, messaging, personal affairs, data storage and transfer, basically anything at all... you can be absolutely certain that many State and Other Actors have a serious continuum of interest in it. Is it the responsibility of each application to develop their own solutions to the threat? No... probably not when many such apps ride on, aggregate muddily over, and depend on networks. All apps can contribute to the development of a diversity sound number of strongly resistant networks that they can then utilize and endorse as they would their own. Be they overlays on top of the internet, enhancements to the internet, or new guerrilla physical plant... That process of people contributing to original and ongoing development of new strong networks that are not susceptible to such Basic Bitch Adversaries as Global Vampires, is something more should consider. Same for likely figuring out how to get the deployment Social aspects right so you can circle the network wagons against Sybil. > This may or may not change. Pity the fool who changes even one satoshi based on the worthless drivel herein :)

3 5

Re: concealed carry: man tries to kidnap 5yo girl, mom pulls a gun, man runs from department store into mall
by Zenaan Harkness 03 Apr '19

03 Apr '19

Apparently into the abyss - who knows what gives. Sometimes there's a probably not really mystical just looks that way from the outside, black hole. Cest la vie. On Wed, Apr 03, 2019 at 10:31:35AM +1100, Zenaan Harkness wrote: > Feel good story of the week courtesy Zerowedgie: > > A Man Tried To Kidnap A 5-Year-Old Girl. Then Mom Pulls A Gun... > https://www.zerohedge.com/news/2019-04-02/man-tried-kidnap-5-year-old-girl-…

1 0

Updating Crypto and Software, Users Role, Flag Days (re: Cryptocurrency, ex: ElGamal)
by grarpamp 02 Apr '19

02 Apr '19

> ElGamal.. Not endorsing or suggesting just noting for whoever that Tor has been updating a lot of its former crypto, here's one example... https://gitweb.torproject.org/torspec.git/tree/proposals/270-newhope-hybrid… Indeed a lot of projects have been and are updating their crypto for various reasons... brokenness, modularity, performance, simplicity, maintenance, quantum... the list goes on. https://neopg.io/ https://boringssl.googlesource.com/boringssl/ ... innumerable examples elided... It's always good to look around and see what's the latest going on in other projects. Many are perfectly good for their use cases, and relatively future proof, thus having no need to update. Others are a public shambles needing wholesale rewrite, fork, abandoned. >> Bad: I2P uses old cryptography, specially 2048 bit ElGamal using non >> standard primes. The use of ElGamal is so pervasive throughout the I2P >> protocol stack that it exists at every level of it. Removing it is a >> massive task that is taking a long LONG time. To the extent the below applies to any project... Projects should not hesitate to utilize flag days where useful. Many projects focus way too much on making seamless transitions. Users are part of projects too, and have responsibilities therein. Let them know this, and they will understand. Cryptocurrencies have been able to make rapid advances, in part because their very first announcements and ongoing processes make very clear that there will be flag days, required software updates, and things users have to do. Setting those expectations, enabling users to take part and pride in playing that role, can allow you to swiftly adapt and update as needed. Much faster than any other project, or adversary, on the market. Instead of being mired in "no changes, no downtime", legacy codebases, lacking features, whatever holds you back, etc.

1 0

Loki-network LLARP I2Pd Torrent Cryptocurrency
by grarpamp 02 Apr '19

02 Apr '19

https://loki.network/ https://github.com/majestrate/torrent.ano http://anodex.oniichanylo2tsi4.onion/ https://i2pd.website/ https://github.com/loki-project/loki-network/blob/master/docs/high-level.txt https://www.reddit.com/r/i2p/

5 9

NSA cybersecurity protection
by grarpamp 02 Apr '19

02 Apr '19

On 4/1/19, Ryan Carboni <33389(a)protonmail.com> wrote: > What is the NSA good for anyway It's TOP SECRET, good or bad, you'll never know, right ;) Known history of such TLA's of the world is not exactly good. Use the wikipedia links for that. Here's some recent news... https://www.reuters.com/investigates/special-report/usa-raven-media/ The American operatives worked for Project Raven, a secret Emirati intelligence program that spied on dissidents, militants and political opponents of the UAE monarchy. It surveilled a British activist and several unnamed U.S. journalists. Key players in the cyber wars of other nations. https://www.usatoday.com/story/news/nation/2019/03/28/ex-nsa-contractor-ple… No indication Martin ever shared the stolen secrets. His defense attorneys say he simply hoarded the information... One of his lawyers previously described Martin as a "compulsive hoarder" who took home work documents > are they just watching American websites get hacked? Yes. Well, that and a whole lot of dick pics... https://www.youtube.com/watch?v=XEVlyP4_11M Among other things... https://www.zdnet.com/article/over-13k-iscsi-storage-clusters-left-exposed-…

1 0

Re: GoldBug Messenger, SpotOn Crypto, etc (Re: Syncing bookmarks)
by grarpamp 01 Apr '19

01 Apr '19

On 4/1/19, Tom A. <thomasasta(a)googlemail.com> wrote: > Hi Grar > like to help you with questions that one can answer, just ask, trying to > share some testings and learnings. > you have a certain view, there is no goal, just telling others who seek > info about sharing good practice experience. > Regards and have a great week Other than your handful of shills, after years there's still apparently no userbase of users on the internet, and certainly zero even remotely trusted voices, that are "sharing their experience" with such supposedly great things as GoldBug Messenger, etc. So instead of writing me... Your gang can "just try" to start by publicly answering the questions people have repeatedly asked you on public lists about your fishy projects. Good luck.

1 0

Brazil's Top Election Court Catches Google Manipulating Search Results to Point to Negative Entries on Bolsonaro ...Just Like They Do with Conservatives in America
by jim bell 01 Apr '19

01 Apr '19

Brazil's Top Election Court Catches Google Manipulating Search Results to Point to Negative Entries on Bolsonaro ...Just Like They Do with Conservatives in America. https://tiny.iavian.net/s25s

2 1

GoldBug Messenger, SpotOn Crypto, etc (Re: Syncing bookmarks)
by grarpamp 01 Apr '19

01 Apr '19

On 4/1/19, Tom A. <thomasasta(a)googlemail.com> wrote: > Subject: Re: [tor-talk] Syncing bookmarks > Message-ID: CAPHRpdXQnYY_FoBVx9ojsp=szvr6aenDu2B1p8yR2FmGKCUBhA(a)mail.gmail.com > ISBN-10: 3749435065 , ISBN-13: 978-3749435067 > Spot-On Encryption Suite: Democratization of Multiple & Exponential Encryption > Scott Edwards > Hi Anan, there is a p2p URL storage and sharing tool, which is based on > either a SQLite or PostgreSQL DB; > the function is to save your URLs (by RSS or crawler or manual entry), > inkluding the website text and a search engine, which is searching within > your encrypted content of your database: the database is encrypted and so > are the URL transfers from node to another node or DB. Ideal to create an > index of Onion Urls and Websites. Even with revisions for the webesite, in > case two times spidered. See the manual for further details_ > https://www.amazon.com/Spot-Encryption-Suite-Democratization-Exponential/dp… > The database is symmetrical encrypted, that means with a path DB->Python > (because it has AES encryption) -> Apache -> php/Javascript eith > encryption, one can even bring the URLs to a web interface. That way Tor > URLs can be brought to a web search engine even with content - to refresh > the Website one then need of course to have Tor. This might be part of your > evaluation to store your URLs in a Database, as it is encrypted and > provides options to be searched and brought to your website. > Regards Tom Still at it aren't you Tom? Ever get those reproducible builds of your binaries done? Ever stop censoring and closing your Sourceforge forums when people critique your work? Ever quit the shill press releases out to trashy tech link farms trying to game credibility engines? How about claiming working with or the EFF endorsed you, that didn't work so well did it? Ever submit any legit papers to legit crypto and network forums for open peer review... ever do any of that beyond spamming them with gibberish announcements and dubious follow on's like the above? Ever provide any direct and real answers to any of the above people have asked you since inception years ago? No? But hey, you got yourselves a link on Amazon, that's impressive. It must be April Fools Day. Maybe you'll make the NYT Bestseller List and pay your way into a legit audit. Or not. Lol. Bitcoin was anon too, but they did it right, none of the above games, and it passed. Unfortunately your methods are still preceding your products regardless of whether they're any good or not. Could be, but who is going to bother given that to date, April's Fools? Seems like that's your goal. Prove differently.

1 0

All cybersecurity is really consumer protection
by Ryan Carboni 01 Apr '19

01 Apr '19

All cybersecurity is really consumer protection. What is going on is atrocious, banks and telecoms are subject to more regulation than major tech companies. Slot machines are subject to better regulations than voting machines. If you are deliberately negligent, you’d be liable. A Chinese electronics manufacturer was sued under the FTC Act by the US government. A recent check of haveibeenpwned is just depressing to me. What is the NSA good for anyway, are they just watching American websites get hacked? Sent from ProtonMail Mobile

1 0