- cypherpunks - lists.cpunks.org

Re: [tor-dev] Freenet + Onioncat: Is the traffic welcome?
by grarpamp 25 Jun '16

25 Jun '16

On 6/24/16, konstant(a)mail2tor.com <konstant(a)mail2tor.com> wrote: > Chinese users can reach Freenet again with Tor. China blocks Freenet with > DPI for a long time. This use case is nice to hear. Compared to other networks and attack vectors it's not the best at, Tor has put good effort into and is rather strong at getting around DPI type censorship. Other nets can probably learn something from tor re this. >> As Roger suggested, we should be aware of how much load this project adds >> to the Tor network. > Easy. The Tor seednodes can track unique addresses they see. Yes any unix packet filter can count this by IPv6 netblock. (Different example, to count tor / i2p clearnet, that needs done by UID.)

1 0

Re: How is Phantom coming along?
by grarpamp 25 Jun '16

25 Jun '16

On 6/24/16, behnam rousta <behnam.roustaei(a)gmail.com> wrote: > Excuse me. > I need a table of comparison between phantom, tor, and i2p. > their differences like routing algorithm, communication protocol, connection > type and more like this. > if anyone can help please do me a favor and show me a table or something to > make me understood their differences. > Thank you guys. There was a hidden wiki at one point, don't know if still there. I2P may be harder for some to understand than tor and phantom. For phantom just review these, and ask list if any questions... http://www.magnusbrading.com/phantom/phantom-design-paper.pdf http://www.magnusbrading.com/phantom/phantom-implementation-paper.pdf https://www.youtube.com/watch?v=dYM_zog5Su4 Let the mailing list know if you port the code to your platform.

2 1

a view of Japan from rebellious author - What Japanese Media Doesn’t Want You to Say!
by Zenaan Harkness 25 Jun '16

25 Jun '16

This started reading like an MSM style "Japan suffering US imperialist military subjugation" op-ed. Refrishingly, did not turn out that way... trigger warning: if you are Japanese, or a Japanese apologist, you may well find this embarrassing to the point of confront. What Japanese Media Doesn’t Want You to Say! 22.06.2016 Author: Andre Vltchek http://journal-neo.org/2016/06/22/what-japanese-media-doesnt-want-you-to-sa… My intention is - we must confront how various people actually are (at least as far as we can determine the general nature of a people based on historical facts). Whether this op-ed delivers on that is a purely personal matter of course. Half way through, can't stop reading... enjoy.

1 0

Tor is anti-censorship software
by Spencer 25 Jun '16

25 Jun '16

Hi, > > Александр: > I tried to subscribe to the Tor list > (you know, this "anti-censorship" software list :D). > Got a message that i am banned. censored. > Like you, Juan, Zen, and a few others. > Banning people under the guise of 'Topic' is not going to shift the focus away from Tor's lack of assurances. Juan's comments, in particular, have been most valuable in pointing out the network's shortcomings in this area. These great people provide much of the value of this particular list; at least we still have grarpamp and Lara (: Wordlife, Spencer

2 2

Re: [tor-talk] Reminder to stay on-topic
by Zenaan Harkness 24 Jun '16

24 Jun '16

On Thu, Jun 23, 2016 at 11:37:08PM -0400, Griffin Boyce wrote: > I've been fairly surprised that the response has been almost entirely > positive. The 45-post thread on cypherpunks where Zenaan Harkness called me > a "fake man" (classy) notwithstanding. Taking out of context an "expressed suspicion" as a fact of name calling, won't do you any favours. > And is Zenaan banned? No. Is grarpamp or most of the other people who > posted in support of Jacob Appelbaum banned? No. And is Jacob Appelbaum > himself on the ban list? No. So please let us dispense with the idea that > the handful of people banned from this list are being persecuted for their > beliefs. > > There are thousands of people on this mailing list who receive *every* > message -- this is not a forum where off-topic posts can be deleted before > being seen. And quite frankly, three weeks of unbridled posting seems like > plenty to me. "We gave you enough rope to hang yourself, and those who went slightly overboard by my personal definition (at least until next week or whenever I change the rules again) are now banned, without even a single individual warning/ request to keep on topic, being given to said individuals. Classy. List administration at its best there Boyce. Not. "Arbitrary justice", which you might like to inform yourself regarding, is where "the rules" are not known in advance, and no concession is made to those who break the rules, WHEN THEY DON'T KNOW THOSE RULES. Your choice to allow "three weeks of unbridled posting" created in many of our minds, a rule which we all thought we were following - ja.talk kept reposting media crap, we had a right to respond (or so we thought). Your executive choice to ban certain individuals who "broke" your rule (because they went three weeks and ONE EXTRA DAY (let's say)), when you NEVER STATED to us your rule about "three weeks is OK, but three weeks + one day and THEN you will be banned with no right to recourse nor even any right to request me personally to change my mind" is EXTREMELY arbitrary. You have told us by your actions as well as your words (besides a few other things about yourself) that you WILL exercise arbitrary power over real humans attempting to communicate their truth, their soul, their pain, their attempts to find resultion on at least one of the normally -most- challenging and difficult conversations we Westerners have to confront, rape. Aren't you a bloody hero now?!! Three claps for Boyce, dispensing justice and facilitating community. Clap, clap, clap. > Tor is a software project, not a telenovela. Please keep posts > on-topic in the future. "And those who broke my rule in the past, are now kill filed by me, and even if you genuinely want to join and participate and abide by my rules, well who gives a flying f*** about you, this is MY list, and I AM the administrator, and I SET THE RULES!" Three cheers for Boyce, bringing real empathy and humanity to the Tor project, making the world a better place, cleaning up unsavoury posters. "Boyce, doing the Right Thing (cause he said so)." > There are endless opportunities to express an opinion > online, and everyone is free to seek them out. Of course. As I too have said. And we are now clear on your choice to exercise your predatorial right to arbitrary exercise of power. Fascism in action. How very American (hat tip to Juan)... Zenaan

4 6

message from tor brownshirt griffin boyce
by juan 24 Jun '16

24 Jun '16

Begin forwarded message: Date: Wed, 22 Jun 2016 15:46:05 -0400 From: Griffin Boyce <griffin(a)cryptolab.net> To: undisclosed-recipients:; Subject: tor-talk subscription update -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 To whom it may concern, You have been removed from the tor-talk mailing list for persistent off-topic posts and I encourage you to spend your time elsewhere. Do not re-subscribe to the list. best of luck, Griffin - -- “We have to create; it is the only thing louder than destruction.” ~ Andrea Gibson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJXaup/AAoJEAPPSgqzx5pjRBAH/jtlRw70yVDL9d62mgHPA3uo fiab3QDDjw04tKMbEGqwGEEHpOKn3nP6bynxGiwUi2Xsp7f3HHi1UD7c79n9cFsp RHqRNpYvLP81eABIpcany0Z2mmI9uVZs0ccirVMcq3YK10ADtG7zYujl6KBgCDWl M6FGWnmLEFa8vw24ia+6lEukARJ2nXTIFMrDisfbQ7bkJFSHaGGsenuy66yde2zS uECH1C/98f5RtZDv7NJJtTebbAPZMSnBQVYU3//ossTG7OFI60EPYAPH3xPdpS3/ zuocWagHiL1KYvqkoxCm3qWv7k9c7CvUhEJXgy4dhGQEljDdu3UsVsV8PPheDcM= =lKWK -----END PGP SIGNATURE-----

6 13

US Federal Court: The Fourth Amendment Does Not Protect Your Home Computer
by grarpamp 24 Jun '16

24 Jun '16

https://www.eff.org/deeplinks/2016/06/federal-court-fourth-amendment-does-n… https://www.eff.org/files/2016/06/23/matish_suppression_edva.pdf https://yro.slashdot.org/story/16/06/23/2040255/federal-court-the-fourth-am… The EFF reports that a federal court in Virginia today ruled that a criminal defendant has no "reasonable expectation of privacy" in his personal computer (PDF), located inside his home. The court says the federal government does not need a warrant to hack into an individual's computer. EFF reports: "The implications for the decision, if upheld, are staggering: law enforcement would be free to remotely search and seize information from your computer, without a warrant, without probable cause, or without any suspicion at all. To say the least, the decision is bad news for privacy. But it's also incorrect as a matter of law, and we expect there is little chance it would hold up on appeal. (It also was not the central component of the judge's decision, which also diminishes the likelihood that it will become reliable precedent.) But the decision underscores a broader trend in these cases: courts across the country, faced with unfamiliar technology and unsympathetic defendants, are issuing decisions that threaten everyone's rights.

1 0

Salty 4.0 released 40 years to the day after Diffie-Hellman algorithm invented
by Carlos Rodriguez 24 Jun '16

24 Jun '16

Salty is a nodejs-powered CLI-based alternative to PGP/GPG using NaCl instead of RSA/DSA. There is a GUI in progress. Commits and tags in the Salty repo (and this announcement) are signed with GPG key 5FBB 2F98 3862 1AFF. Features • NO 3rd parties (peerio), NO p2p network (PRISM-safe, usable on airgapped machines), NO browser js (it’s not safe!), NO exotic/compiled deps (goodbye openssl vulns), no Comodo SSL (CloudFlare), and NO shady corporations (Virgil Sec). PERIOD. • general purpose CLI, lightweight library attached • audited, bundled dependencies - no install scripts or backdoors • supports anonymous-sender or signed/verified messaging • sharable pubkey string that can fit in a single tweet • does NOT use your ssh keys, pgp keys, or anything RSA • encrypt public key is always ephemeral - does NOT leak metadata • sender identity is deniable, unless they explicitly commit to sign the message • file length hidden with padding • public signing/verifying with detached signatures • binary or “ascii armor” PEM output • import/export your wallet folder - PEM encoded and secretboxed with Scrypt KDF • (new in 3.1) can use anonymous private Github gists to remotely store salty messages • (new in 3.1) full tar/gz support for encrypting/decrypting directories (supports symmetric or asymmetric cipher) • MIT-licensed — How is this better than PGP? This is a step-by-step rebuttal to [secushare](http://secushare.org/PGP)'s arguments against the PGP model, and how [Salty](https://s8f.org/salty.html) tries to make things right again. ### 1. Downgrade Attack: The risk of using it wrong. Unlike PGP, Salty does not "integrate" into your browser, email client, or other sensitive software. Therefore, usability shortcomings of integration UIs will not raise security issues. It is up to the user to safeguard the connection (i.e. their email account) which Salty can't control, and is not interested in controlling. "Doing it wrong" is barely possible since there are so few modes of use, and all parameters are hard-coded into the software, so no critical choices are necessary on the part of the user. ### 2. The OpenPGP Format: You might aswell run around the city naked. Salty does not include the sender or recipient's public key in plaintext. By default it encrypts using an ephemeral key and nonce, obscures the message length with padding, encrypts the real message length, and encrypts the info for verifying authenticity and integrity (hmac, public keys, and signature). Signature is opt-in. ### 3. Transaction Data: Mallory knows who you are talking to. Fully anonymized traffic seems like a pipe dream, and (despite the existence of the Tor project) will probably not be possible in the near future. However, for what it's worth: In theory, the idea of a "mixing service" from Bitcoin for psuedo-anonymizing transactions is possible using Salty files. Since a Salty file can only be made sense of by one who posesses the receiver's private key, a secure "drop box" could be set up where everyone dumps to the same folder, and everyone reads every file, trying to decrypt everything until decryptable files are found. ### 4. No Forward Secrecy: It makes sense to collect it all. Salty solves this problem in two ways: 1. With Salty it's easy to refresh keys: just regenerate your decryption key, and tweet the resulting pubkey string. Destroying your encryption key effectively renders your previously received messages unreadable and useless to collect. 2. Recovering the 32-byte key used to encrypt a message will not allow decryption of all Alice<->Bob messages, since each message has a unique key as the result of Diffie-Hellman with Alice using an ephemeral key. ### 5. Cryptogeddon: Time to upgrade cryptography itself? Salty throws out RSA and NIST-approved curves entirely, using the independently developed, peer-reviewed, battle tested, public domain NaCl crypto suite. ### 6. Federation: Get off the inter-server super-highway. Salty is not a network protocol, but it's recommended to use the most secure channel possible to trade Salty messages. The same goes for any sensitive information transferred between two parties. ### 7. Discovery: A Web of Trust you can't trust. Salty does not prescribe a web-of-trust model. Keyservers are optional and if one has a Twitter account, not necessary at all. End of story! ### 8. PGP conflates non-repudiation and authentication. Salty allows the sender to decide whether to sign the message, revealing to the receiver (via HMAC) that they in fact constructed it with their known identity. By default, only message integrity is ensured, protecting the sender's privacy if they desire it. ### 9. Statistical Analysis: Guessing on the size of messages. Salty does some random-padding to help obscure the message size. ### 10. Workflow: Group messaging with PGP is impractical. This is still true. Group messaging is better done by a network protocol. — Code on Github: https://github.com/carlos8f/salty Cheers, Carlos

1 0

Re: Hi, Boyce! (was Fwd: tor-talk subscription update)
by Александр 24 Jun '16

24 Jun '16

> > He is a bad actor and not much smart. The lies about banned people using > threats to subscribe again were stranger than his disgusting offenses about > rape apology. Sick guy, really disturbing, eeck! :-/ > Well, Cecilia, you said it all here. Zen writes: > Alexander,I didn't realize that you'd also been banned. So I didn't ask > Boyce. But likewise, I don't recall that you've made as many off-topic > posts as I have. So I'm suspicious. > > I'm suspicious too. But... they had to crucify few random victims to shut all the others/to teach a lesson all the rest of the people with good heart, mind and soul. that' a common tactic among scumbags.

1 0

Need a grass roots or war time "civil" movement - White Helments at your $60M service!
by Zenaan Harkness 24 Jun '16

24 Jun '16

Some people will hopefully even be surprised, in the "oh, my, god, the US govt/media/mil complex is serving me propaganda" way... one can only hope. https://southfront.org/dramatic-rescue-man-kid-runs-towards-camera-44-stage… “Dramatic Rescue! Man With Kid Runs Towards Camera!” – 44 Staged Pictures

1 0