- cypherpunks - lists.cpunks.org

Fwd: [Cryptography] Putin goes full Stasi; wants encryption keys for the Internet
by grarpamp 12 Jul '16

12 Jul '16

Long live p2p? ---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Fri, 08 Jul 2016 07:15:46 -0700 Subject: [Cryptography] Putin goes full Stasi; wants encryption keys for the Internet To: cryptography(a)metzdowd.com FYI -- https://meduza.io/en/news/2016/07/07/putin-gives-federal-security-agents-tw… Putin gives federal security agents two weeks to produce 'encryption keys' for the Internet 13:28, 7 july 2016 After signing controversial anti-terrorist legislation earlier today, President Putin ordered the Federal Security Service (the FSB, the post-Soviet successor to the KGB) to produce encryption keys to decrypt all data on the Internet. According to the executive order, the FSB has two weeks to do it. Responsibility for carrying out Putin's instructions falls on Alexander Bortnikov, the head of the FSB. The new "anti-terrorist" laws require all "organizers of information distribution" that add "additional coding" to transmitted electronic messages to provide the FSB with any information necessary to decrypt those messages. It's still unclear what information exactly online resources are expected to turn over, given that all data on the Internet is encoded, one way or another, and in many instances encryption keys for encrypted information simply don't exist. https://meduza.io/en/feature/2016/06/27/the-duma-s-new-big-brother-legislat… The Duma's new 'Big-Brother' legislation kills Russia's Internet companies and hurts ordinary Web users. Here's how. 16:06, 27 june 2016 Last week, lawmakers in the State Duma approved what Edward Snowden has called "Russia's new Big-Brother law." A major part of this legislation creates new regulations on the Internet. According to the amendments, telecom providers and the "organizers of information distribution" will need to store copies of nearly all information they transmit. They can't delete this information until it's six months old. This applies to recordings of phone calls, as well as the contents of text messages. And they have to keep copies of metadata of these communications (the information about when and between whom messages occurred, but not the actual content of the messages) for a whopping three years. Companies will additionally be required to help Russia's Federal Security Service (the modern-day successor to the Soviet KGB) decrypt all the data. The largest Internet companies in Russia--Mail.ru and Yandex--oppose the bill, as do the industry groups the Russian Association for Electronic Communications and the Regional Center for Internet Technologies, and even the "Communications and IT" working group within the Russian government. Meduza looks at why this legislation isn't just impractical, but will also harm ordinary Internet users and Internet companies alike. It's expensive The legislation requires telecom providers and "organizers of information distribution" (which could be literally any website on the Internet, as determined by Russia's state censor) to store all data sent by its users or visitors. This is a gigantic amount of data: Russia would need every data-storage manufacturer in the world working for seven years straight, before the country had the infrastructure necessary to accommodate so much storage and processing. And there's another problem: the electrical grid in central Russia simply isn't powerful enough to fuel the still-unbuilt data centers that will be required by the new legislation. The equipment and materials needed to build these data centers, moreover, isn't produced in Russia, so companies will be forced to buy imported goods. Experts say the costs of building this infrastructure will be more than 5 trillion rubles (roughly $77 billion). For comparison, the federal government's total revenues in 2015 totaled 13.7 trillion rubles (about $210 billion). The legislation says implementing the new statutes won't require any state subsidies, but that's untrue: at the very least, government agencies will need to upgrade the country's data cables (given that Russia's existing network of cables is too weak to cope with the higher volume of transmitted information created by the new regulations). The government also risks losing income from Russia's Internet companies, which currently pay taxes on their profits. The new legislation could make many businesses unprofitable, after they're forced to spend tens if not millions of rubles on new data-storage equipment. It's dumb The new legislation requires all "organizers of information distribution" that add "additional coding" to transmitted electronic messages to provide the Federal Security Service (FSB) with any information necessary to decrypt those messages. What lawmakers seem not to understand is that virtually all information transmitted over the Internet is "encoded." Any text or image sent over email using Simple Mail Transfer Protocol (SMTP) is in something called Multipurpose Internet Mail Extensions (MIME) format. Will "organizers" need to send the FSB information about how MIME works? If we're talking about encryption, we're talking about almost half the traffic on the Internet--and the volume is only growing. In most cases, incidentally, the "organizers of information distribution" don't have the keys to decrypt their own data. (That is precisely how Internet privacy works.) For example, it's not even technically possible to store encryption keys when using the HTTPS protocol, which is used by an enormous number of websites, including the one you're reading now, and even Gosuslugi.ru, the Russian government's official portal where citizens can contact the state about public services. In other words, the legislation bans the state's own website for contact with ordinary citizens. How this legislation is supposed to regulate financial systems is also unclear. The SWIFT network that links the world's financial institutions doesn't use Russian cryptographic algorithms, but nearly all the world's banks--including banks in Russia--use SWIFT. The world's payment systems, moreover, are required to comply with the Payment Card Industry Data Security Standard (PCI DSS), a proprietary information security standard that doesn't disclose its encryption keys. In order to comply with the legislation, programmers will need to come up with new encryption methods that must simultaneously work with existing encryption methods, given that foreign companies won't support these new technologies (which don't currently exist, anyway). But even if Russia manages to create some kind of center to house all encryption keys, the concentration of data would make the center extremely attractive, and therefore very vulnerable, to hackers. By breaking into this hypothetical data center, after all, it would be possible to decrypt any message sent inside Russia. The new legislation also violates Russian citizens' right to the privacy of correspondence, which is enshrined in Article 23 of the Constitution. In order to deprive Russians of this right, police need a court order. The "Yarovaya legislation," however, grants law-enforcement agencies access to everyone's messages without any judicial oversight. Today, most messaging apps use encryption. In fact, encryption is one of their most important competitive advantages, as users often seek out the safest and most secure communications available. The new law will make any Russian online service less competitive. It's unclear what foreign companies will do. Some might simply walk away from the Russian market. This text is based on statements by the Russian Internet companies Yandex and Mail.ru (which are considered "organizers of information distribution"), the industry groups the Russian Association for Electronic Communications and the Regional Center for Internet Technologies (which position themselves as links between the state and the Internet), and the "Communications and IT" working group within the Russian government. --------------- Theresa May, James Comey, Cyrus Vance, et al, can't wait to go full Stasi, as well. 'Putin-in-the-middle' attacks, anyone? _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

2 1

zero days - should they be sent somewhere?
by Zenaan Harkness 12 Jul '16

12 Jul '16

Wondering if zero days spam should be sent somewhere, or just ignored?

2 1

Re: The Moon landing again - Fw: Neil Armstrong's Boots
by Bastiani Fortress 12 Jul '16

12 Jul '16

12.07.2016, 16:48, "Tom" <tom(a)vondein.org>: >> This massive thrust would have blown the dust away from the landing area >> creating a massive dust cloud, so why was thick dust still on the ground >> and no massive dust cloud? Please explain NASA. > > No atmosphere, no blowing. > > - Tom He's talking about the module thrusters, you don't need atmosphere to blow particles on the ground.

3 3

Fwd: An open letter to security researchers and practitioners
by John 12 Jul '16

12 Jul '16

-------- Original Message -------- From: Jeremy Gillula <jeremy(a)eff.org> Sent: July 8, 2016 7:35:21 PM EDT To: nanog(a)nanog.org Subject: An open letter to security researchers and practitioners An open letter to security researchers and practitioners: We need you to take a stand to protect security researchers who report defects in browsers, before it's too late. Earlier this month, the World Wide Web Consortium's Encrypted Media Extensions (EME) spec progressed to Draft Recommendation phase. This is a controversial standard for transmitting DRM-encumbered videos, and it marks the very first time that the W3C has attempted to standardize a DRM system. This means that for the first time, W3C standards for browsers will fall under laws like the DMCA (and its international equivalents, which the US Trade Representative has spread all over the world). These laws allow companies to threaten security researchers who disclose vulnerabilities in DRM systems, on the grounds that these disclosures make it easier to figure out how to bypass the DRM. Last summer, the Copyright Office heard from security researchers about the effect that DRM has on their work; those filings detail showstopper bugs in consumer devices, cars, agricultural equipment, medical implants, and voting machines that researchers felt they couldn't readily publish about, lest they face punitive lawsuits from the companies they embarrassed. EFF has asked the W3C to take a minimal step to insulate their stakeholders from the legal fallout from the inclusion of DRM in their standards. Our proposal asks the W3C to bind its members to legal promises not to use the DMCA or laws like it against security researchers or implementers. https://www.eff.org/deeplinks/2016/06/w3c-eme-and-eff-frequently-asked-ques… So far, the W3C executive has failed to act on this proposal, despite diverse support from a number of W3C members. We are hosting an open letter from security, privacy and technology experts to the W3C's director, Tim Berners-Lee; and its CEO, Jeff Jaffe, asking them to make any further work on EME contingent on adopting rules to protect the open web from these bad laws. https://www.eff.org/deeplinks/2016/03/security-researchers-tell-w3c-protect… Will you sign this letter? Some of security's leading lights have already put their names to it. We can't afford to make widely used tools like browsers off-limits to security research and disclosure, especially not as HTML5 is being positioned as a UI environment to replace apps as the primary way of interacting with sensors, actuators, embedded systems and the whole Internet of Things. If you're willing to sign on, please send an email to cory(a)eff.org with your country of residence and your institutional affiliation (if any). Thank you, Cory Doctorow Apollo 1201 Project Electronic Frontier Foundation

1 0

US Congress Grabbing More PATRIOT Ass
by grarpamp 12 Jul '16

12 Jul '16

http://rare.us/story/congress-is-going-to-try-to-expand-the-patriot-act-ton… http://www.majorityleader.gov/floor/ http://docs.house.gov/billsthisweek/20160711/HR5606.pdf https://www.law.cornell.edu/uscode/text/18/1956 https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://www.sec.gov/about/offices/ocie/aml2007/fincen-314afactsheet.pdf https://www.fincen.gov/statutes_regs/patriot/index.html?r=1&id=314#314 Congress is going to try to expand the Patriot Act tonight and hopes no one will notice July 11, 2016 2:42 pm In the wake of recent mass shootings, Monday night the U.S. House of Representatives is scheduled to vote on an expansion of the Patriot Act, which significantly broadened government surveillance powers after 9/11. The proposed bill, H.R. 5606, expands Section 314 of the Patriot Act to cover non-terrorism or money laundering related investigations. Critics claim that the bill is a threat to the privacy of innocent Americans and is being rammed through Congress without debate.

1 2

[OT] Fwd: Re: [liberationtech] Need some advice re: online secure communications platform for a survivors group
by Cecilia Tanaka 12 Jul '16

12 Jul '16

My dear Juan, Boyce was stupid and very injust, but he is not a bad person. I was talking about this kind of thing, testardo... :) Kisses and kicks! Take care! :* Ceci ---------- Forwarded message ---------- From: "Lina Srivastava" <lina(a)linasrivastava.com> Date: Jul 10, 2016 9:30 PM Subject: Re: [liberationtech] Need some advice re: online secure communications platform for a survivors group To: "Griffin Boyce" <griffin(a)cryptolab.net> Cc: "Lina Srivastava" <lina(a)linasrivastava.com>, "liberationtech" < liberationtech(a)lists.stanford.edu> Dear Griffin, Thank you very much! I will pass this information along. Best regards, Lina > Hi Lina, > > While the content isn't encrypted for most of their apps, I would > recommend Sandstorm as a good hosted option for forums and other > collaborative apps. It's free for up to 5 apps (called "grains") and up > to 200MB storage. For more, it's $9 a month: https://sandstorm.io/ > > For encrypted communication, Ricochet.im is pretty great and doesn't > require a lot of work to set up. It has sane defaults (requires Tor to > run). > > best, > Griffin > > > Lina Srivastava wrote: >> Hello all, >> >> A new support group for survivors of campus sexual assault is looking >> for a secure online communications platform. The group is not one of >> my clients, nor am I a member of or advisor to the group -- I am >> passing this request along as a favor -- so I have relatively little >> information about membership numbers, etc. I do believe everyone who >> is in the group is located in the U.S. or Canada. And they are looking >> for high security levels, giving survivors the ability to seek support >> from other members and to collectively organize for changes to policy >> and legislation on rape and assault. They are hoping to have >> password-protected login, private messaging, group forums, file share, >> all encrypted. >> >> Do any of you have advice for an existing platform that would provide >> this that is relatively affordable? >> >> Thanks in advance, >> Lina > > -- > Accept what you cannot change, and change what you cannot accept. > PGP: 0x03cf4a0ab3c79a63 > -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

5 5

Message from the front lines
by Rayzer 11 Jul '16

11 Jul '16

DeRay Mckesson, one of ‪#‎BlackLivesMatter‬ ideological main men has been arrested in ‪#‎BatonRouge‬ during an ‪#‎AltonSterling‬ ‪#‎PoliceMurder‬ protest for "Walking".. It's also his BIRTHDAY! Congrats Deray! Join the "I spent my birthday in jail for the cause" club. I spent my 18th in the Tombs, 100 Centre St. Manhattan Criminal court, for an anti-Vietnam war demo in 1971. https://twitter.com/StylistComplete/status/751978156123238400

7 15

Stuxnet the movie
by John Newman 11 Jul '16

11 Jul '16

1 0

"The West" - an absolute disgrace to Humanity!
by Александр 11 Jul '16

11 Jul '16

Sending it from Zenaan. His ISP plays with him... ---------- Пересылаемое сообщение ---------- From: Mail Delivery System <MAILER-DAEMON@x220-a02> To: zen(a)freedbms.net Cc: Date: Fri, 8 Jul 2016 22:47:51 +1000 (AEST) Subject: Undelivered Mail Returned to Sender This is the mail system at host x220a02. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <cypherpunks(a)cpunks.org>: host mail.bigpond.com[61.9.189.249] said: 552 5.2.0 GCpv1t0052DXzPg01CpwnU Suspected spam message rejected. OB702 (in reply to end of DATA command) Final-Recipient: rfc822; cypherpunks(a)cpunks.org Action: failed Status: 5.2.0 Remote-MTA: dns; mail.bigpond.com Diagnostic-Code: smtp; 552 5.2.0 GCpv1t0052DXzPg01CpwnU Suspected spam message rejected. OB702 ---------- Пересылаемое сообщение ---------- From: Zenaan Harkness <zen(a)freedbms.net> To: cypherpunks <cypherpunks(a)cpunks.org> Cc: Date: Fri, 8 Jul 2016 22:47:48 +1000 Subject: walking in another's shoes Assertions of fact which I presume are not in dispute except perhaps by schooled (and not educated) North Americans: - North America/ the USA, has NO righteous authority to be the "policeman of the world"! - The only authority the the USA has to be "the policeman of the world" is the predatorial right, the predatorial authority. - The United States of America government is ethically bankrupt. - The government of the USA has been co-opted by the North American (and western world oligarch controlled) Military Industrial Complex. - The hegemonic intention of the government of the USA and the "neo conservatives" or war mongers of "the West", is a predatorial manifestion of the desire for empire, the desire to control the world. The hegemonic USA must end. That said, here is what might be termed a human perspective of what an average Russian living in Russia or perhaps the Donbas today, might actually be experiencing, feeling and thinking, and why (historical memories etc) - a somewhat moving piece for those so inclined: --- "Why People Never Believe That War Is Coming – Until It Is Too Late" In Russian: http://www.apn-spb.ru/opinions/article23999.htm In English: http://russia-insider.com/en/politics/why-people-never-believe-war-coming-t… --- A thought: The "terrorists" in Syria, aka IS or ISIS or ISIL, go into town, villages and cities, forcing "conversion" or death upon those families who live there. The so called "terrorists" of eastern Ukraine in the Donbas/ Novorossia, are families fighting for their lives against the Ukraine state army who are coming to "subdue" them, to "encourage" them to accept the new Ukrainian coup government with its laws saying the Russian language is no longer official, and no longer allowed to be taught in their local schools, and many more abominations to "European values"! Oh, but it's all just "Russian aggression". FFS, wake up European nations! wake up North Americans! Absolutely the Ukrainian army must stop shooting and bombing its own people! Absolutely the eastern Ukrainian people have a right to defend themselves against "their own" army shooting at them, their own "president" Poroshenko "Donbas Children Will Sit in Cellars, “Ours” Will Go to School": Amazing Poroshenko Video: Keep Donbas Children "Holed Up" in ... http://russia-insider.com/en/node/1122 http://sputniknews.com/europe/20141114/1014748940.html https://dninews.com/article/doctor-liza-will-evacuate-13-children-moscow-do… (well at least Poroshenko said it in a civilized setting - the Odessa Opera House.) Poroshenko: “we [in Ukraine] will have work they – [in the Donbas] won’t. We will have pensions – they won’t. We will care for our children and pensioners – they won’t. Our children will go to school, to kindergartens – their children will sit in cellars. They don’t know how to organize or do anything. This, ultimately, is how we will win this war.” https://southfront.org/its-like-a-textbook-for-torture-why-the-donbass-will… (this article is too intense, I can't finish reading it) https://www.rt.com/news/163288-seven-children-wounded-unicef/ A boy holds a placard reading "Save Donbas children. Please stop ATO!" (anti-terrorists operation) in the southern Ukrainian city of Odessa on June 1, 2014 (AFP Photo) / AFP (This one's a bit easier to read.) https://en.wikipedia.org/wiki/Humanitarian_situation_during_the_war_in_Donb… http://www.phillip-butler.com/when-will-we-the-people-stop-the-killing-in-d… "Someone explain to me so I can understand. How is it that Russia is somehow negligent in influencing pro-Russian separatists in east Ukraine, when the Kiev junta’s forces are the ones shelling civilians daily? Does Germany’s Angela Merkel see something the world cannot? God only knows." All hail Ukraine! Home of the direct second and third generation Nazis! We, the collective "West" are an absolute disgrace on this planet!!!!! So YES if I were the USA president I would do better! The only real challenge is doing better as USA president, and stopping yourself from being killed for cleaning up the endless shit that is North American foreign policy! "The West", an absolute disgrace to humanity..

8 20

UN's WHO instructing Syrians to stop smoking
by Zenaan Harkness 11 Jul '16

11 Jul '16

Won't someone please think of the Syrians.. "I can see the problem. While fleeing from air strikes, mass graves and ethnic cleansing, Syrians have just got to resist the temptation of a quick gasper to calm their nerves. Your home may be in flames, your family enslaved, your torturers itching to pull out your fingernails – but above all you've got to ignore the pretty ciggy packet in your pocket." The UN has failed to protect Syrians from war and hunger. Now it’s telling them to stop smoking http://www.independent.co.uk/voices/un-failing-syrians-war-hunger-conflict-…

2 1