- cypherpunks - lists.cpunks.org

Craig Wright is Satoshi Nakamoto
by grarpamp 02 May '16

02 May '16

http://www.bbc.co.uk/news/technology-36168863 Australian entrepreneur Craig Wright has publicly identified himself as Bitcoin creator Satoshi Nakamoto.

3 2

Fw: new message
by Jens.Stomber＠gmx.de 02 May '16

02 May '16

Hello! You have a new message, please read <http://myphamchatluong.info/tell.php?r9> Jens.Stomber(a)gmx.de

1 0

Do we have backup plan if this list disappears?
by Georgi Guninski 01 May '16

01 May '16

Do we have backup plan if this list disappears? Two public security lists I have been on degraded to the point I unsubscribed (on the second they filtered me at SMTP). Generalization: Do we have backup plan if the interwebz lose a lot of connectivity? (maybe some kind of radio communications). Probably revealing the plans to adversaries is not good idea, not sure.

3 2

Cryptography being defended on social media and YouTube. This is on the front page of reddit right now
by grarpamp 01 May '16

01 May '16

On 4/14/16, Erik Granger <erikgranger(a)gmail.com> wrote: > CGPGrey - Should all locks have keys? Phones, Castles, Encryption, and You. > > https://www.youtube.com/watch?v=VPBH1eW28mo > > I like this video for a few reasons, it explains why cryptography is > important and why backdoors are bad in layman terms without actually going > into how cryptography works. I'm happy to see a lot of discussion on > cryptography taking place all over the internet, and that young people are > very interested in the technology. "...digital locks protect the contents of our minds..."

2 1

Somebody logged into Telegram accounts of some Russian opposition activists
by Anton Nesterov 29 Apr '16

29 Apr '16

Russian activists Georgy Alburov (member of Anti-corruption Foundation) and Oleg Kozlovsky (member of Solidarnost movement) found their Telegram accounts accessed from same NY IP address 162.247.72.27 (which is Tor exit relay running by The Calyx Institute https://globe.torproject.org/#/relay/6C143720FFF8469EF6A5C5B4066366340CF6C0… ) using telegram-cli. They did not have two-factor authentication enabled (Telegram by default uses one-time passwords received by SMS, but you can also enable "two-factor authentication" which is asking a password when you try to login with new device) and they didn't received the SMS message, so it's looks like SS7 attack. Russian government known for it's exploiting SS7 vulnerabilities (and those are not really vulnerabilities which can be easily fixed, those vuls exists because SS7 was designed that way). MTS, telecom provider used by Alburov and Kozlovsky, commented that SMS receiving was disabled on their accounts for some time. I also have some evidence that Russian authorities uses same method for logging into Facebook accounts (Facebook also have a feature called "one-time password" https://www.facebook.com/help/447046021986895 which allows to send SMS with text "otp" to Facebook number and receive a code which is enough to login into Facebook). SS7 designed such way so this is not required for attacked to be in same country as you. It's not required for your telecom provider to cooperate. All you need is an access to SS7. Security services have it, private spies have it, and you can have it: there is plenty of companies selling SS7 access. So if you use Telegram, enable two-factor authentification. If you use Facebook, turn on login approvals https://www.facebook.com/help/148233965247823 If you using any service which allows you to login just with code received by SMS, find out a way to turn off this or stop using this service. If you thinking about such feature in your service, please don't do so. See also: News report https://meduza.io/news/2016/04/29/aktivisty-oppozitsii-pozhalovalis-na-vzlo… (in Russian) Kozlovsky's post with details received from MTS https://www.facebook.com/kozlovsky/posts/10208948934790884 (in Russian) The Critical Hole at the Heart of Our Cell Phone Networks https://www.wired.com/2016/04/the-critical-hole-at-the-heart-of-cell-phone-… which covers some previous SS7 attacks by Russian govt and SS7 design SS7: Locate. Track. Manipulate https://www.youtube.com/watch?v=lQ0I5tl0YLY great talk by Tobias Engel on 31c3 about SS7 SS7map https://ss7map.p1sec.com map covering SS7 issues -- https://nesterov.pw GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 https://keybase.io/komachi/key.asc

1 0

US Case: Infinite Jail Contempt for Disk Crypto, 5th Amndmnt, All Writs, FileVault, Freenet CHKs
by grarpamp 29 Apr '16

29 Apr '16

https://yro.slashdot.org/story/16/04/27/2357253/child-porn-suspect-jailed-i… http://thehackernews.com/2016/04/decrypt-hard-drive.html https://www.scribd.com/doc/310741233/Francis-Rawls-Case http://arstechnica.com/tech-policy/2016/04/child-porn-suspect-jailed-for-7-… Amici Curiae by EFF and ACLU A Philadelphia man suspected of possessing child pornography has been in jail for seven months and counting after being found in contempt of a court order demanding that he decrypt two password-protected hard drives. The suspect, a former Philadelphia Police Department sergeant, has not been charged with any child porn crimes. Instead, he remains indefinitely imprisoned in Philadelphia's Federal Detention Center for refusing to unlock two drives encrypted with Apple's FileVault software in a case that once again highlights the extent to which the authorities are going to crack encrypted devices. The man is to remain jailed "until such time that he fully complies" with the decryption order. The government successfully cited a 1789 law known as the All Writs Act to compel (PDF) the suspect to decrypt two hard drives it believes contain child pornography. The All Writs Act was the same law the Justice Department asserted in its legal battle with Apple.

3 3

Re: [tor-talk] Supreme Court Gives FBI More Hacking Power
by grarpamp 29 Apr '16

29 Apr '16

On 4/28/16, krishna e bera <keb(a)cyblings.on.ca> wrote: > https://theintercept.com/2016/04/28/supreme-court-gives-fbi-more-hacking-po… > http://www.supremecourt.gov/orders/courtorders/frcr16_8mad.pdf https://www.justsecurity.org/15018/justice-department-proposal-massive-expa… Among others commenting on the lists... Rule 41(b)(6) "a magistrate judge with authority in *any* district where activities related to a crime *may* have occurred has authority to issue a warrant..." Note *emphasis*. Perhaps missing from the article is that, similar to FISC / DC situation, this seems to allow LEA / Prosecutors to now cozy all these requests up to the friendliest court they can find (if they speculate, when concealed, that the activities *may* in fact be in that district [1]), rather than forcing distribution of requests randomly across them all (similar to the old principle of local jurisdiction... crimes originate randomly, are dealt with locally). That would be bad... bad precedents, much stuff under seal ex parte en camera rubberstamp etc. [1] Without such speculation, while still concealed, they would probably end up being lodged by location of lead investigative entity (even FBI HQ), or by other elements of the case, such as victim location. https://www.accessnow.org/cms/assets/uploads/archive/docs/Rule41botnettesti… Rule 41(b)(6)(B) 18 USC 1030(a)(5) And remote access of hacked protected computers... that's huge procedural change, and likely to be very sloppy and outright abused for ages. https://en.wikipedia.org/wiki/United_States_federal_judicial_district

1 0

Sci-Hub: Who's Downloading Pirated Papers? EVERYONE.
by grarpamp 29 Apr '16

29 Apr '16

http://www.sciencemag.org/news/2016/04/whos-downloading-pirated-papers-ever… To protect the privacy of Sci-Hub users, we agreed that she would first aggregate users’ geographic locations to the nearest city using data from Google Maps... http://scihub22266oqcxt.onion/

1 0

jamming spread spectrum
by juan 27 Apr '16

27 Apr '16

http://digitalcommons.calpoly.edu/cgi/viewcontent.cgi?article=1160&context=… http://digitalcommons.calpoly.edu/cgi/viewcontent.cgi?article=1234&context=… feel free to add practical tips/relevant information/etc

1 0

A complete guide to the new 'Crypto Wars'
by grarpamp 27 Apr '16

27 Apr '16

http://www.dailydot.com/politics/encryption-crypto-wars-backdoors-timeline-… The computer-science professors, cryptographers, and digital-rights advocates who had beaten back similar demands in the 1990s experienced deja vu. That series of fights, which they called the “Crypto Wars,” had only been the first round of a prolonged conflict. Now it was time to settle in for Crypto Wars, Round 2. But where and when did this new phase began? Pinpointing that exact moment may be impossible, but the timeline below provides a relatively comprehensive overview of the different fights that constitute the new Crypto War, from the early months after the Sept. 11, 2001, terrorist attacks to the present day. [Not so complete... leaves out rise / spread of crypto, encrypted / anonymous applications, networks, and activities, digital currencies, international aspects. Someone should create and curate a better timeline, a wiki...]

1 0