- cypherpunks - lists.cpunks.org

Re: [tor-talk] tor project website change
by grarpamp 12 Apr '19

12 Apr '19

> global adversaries > "they don't likely exist, or if they do, they're our friends" Highly capable Global Adversaries are well known to exist. TOP SECRET friends may perhaps be the friends of few, often end up generally corruptive, less than stellar, an uncertainty, etc... thus really shouldn't be kept or created. Seek out better ways. > implementing one of the newer designs seems unlikely. > Given that potential volunteers are working on Tor. That's another problem with large projects, like corporate and government monopolies, they can suck up all the air in the room... needed and valuable diversity, competition, and evolution gets starved out, groupthink herd monoculture etc sets in generations. In the space of critical use case anonymity, privacy, messaging tools, crypto utility application overlay networks, cryptocurrency, etc... a space too new to have enough breadth and depth of research paths dreamed up and exhausted so as to begin to see what works, to advise with confidence, or not... that would not be good at all. Tor... circuit based encrypted onion routing tcp with quasi decentral human roots of authority... is a done architecture model since 20 years, its wholesale novel development research covered in its early whitepapers. Researchers hoping for big architecture breakthroughs against adversaries, should probably investigate other potential and new solutions elsewhere. Even if only filling in currently uncovered use cases, on up to addressing current and expected evolution in adversaries, there is a lot of fun work to do out there beyond Tor. As for Tor, there is much left... tickets, UI, Web, Phone, optimization, obfuscation, their own "community", waging part in the overall pro privacy freedom speech crypto war, all sorts of research, improvements, and publication on how its network architecture is doing in vivo, where it's useful and not, ongoing operations... the long tail of Tor, same as any project. Tor gets so much money some said Tor could throw a bunch of it into an independant overlay competition fund. But since such parent child separation is not achievable, it is the donors who would need to start that up on their own, and the newer diverse projects who can consider accepting it. Like any other project, Tor is great at what it does well, yet those areas are *not* unlimited. This is not Kansas, it's Overlay Land, a land known to be considered for use by those with more critical / different needs than say, simply browsing the web. [Even then...] Tor users should see more disclaimer and fair honest analysis, and less blanket use case superlative coming from Tor. Indeed sad to whatever extent that does not happen.

1 0

Extortion against Wikileaks.
by Punk 12 Apr '19

12 Apr '19

" Suspects are being investigated in Spain for having tried to extort €3 million from WikiLeaks in exchange for a huge cache of documents and surveillance videos of Assange inside Ecuador’s London embassy, including with his doctors and lawyers" https://consortiumnews.com/2019/04/10/spanish-police-probe-extortion-scheme…

1 0

Cryptocurrency: Crypto Privacy, DEX, Overlay Integration, and Security Needed (ex: Silk Road)
by grarpamp 12 Apr '19

12 Apr '19

> opsec Though not impossible, it's ridiculously hard for people to manage all sorts of endeavours securely. Not least since today's widely used overlay networks are all still subject to Traffic Analysis and Sybil. Regardless, they are meant to provide end to end encryption and other abstractions that are helpful to privacy. People have a hard time keeping even their central Fiat bankcorp accounts secure on their phones. And while they can choose central FiatCoin cryptocurrencies, same problem there. Then there are all the bugs in even opensource wallets. And lack of UI, training, etc. However reasonable security is possible. It will be interesting to see what fraction of people choose the distributed "be your own bank" and mining model of real cryptocurrencies. That is up to you teaching and showing them the way. Otherwise there is no point, just stay with FiatCoin. > tumble the coins Those exist. Yet one area that still hasn't seen any significant entrants in the network overlays are non-fiat cryptocurrency exchanges. At least until true DEX's hit the scene, and though they would be central points, there could easily be be any number of such exchanges running there. They actually serve good and very legitimate purposes... So that spending cash for a can of soup doesn't disclose other purchases, clothing, fuel, gifts, etc, or your financial positions to others, not least to protect you from becoming a theft target. True privacy coins will take that function over from weaker methods. And for simple exchanges where needed, just as tourists do today at any corner market, Yen to Euros to a nice dinner. This function will always be needed, and should be just as private. All coins that do not utilize cryptographically strong privacy are lesser in function and adoption potential and utility than even the Metals and Fiat cash humanity has used since time began. They are an affront, an oversight, a mistake. Today with ZK Proofs, strong coin mixes, overlays, TLS, etc, coins that fail to implement at least some privacy methods, even if default on with selectable off, start to look really suspect and totally irresponsible to their users... they're offering less than Metals or Cash do... thus are shitcoins, and should be publicly called out for it. Privacy is a basic human right for all, required for humanity as we know it to function. These services and privacy coin capabilities need to be created and widely adopted throughout the cryptocurrency space as soon as possible. Without it, you'll lose the historic chance you've been given, and be stuck with FiatCoin forever. It should be obvious how badly that would suck.

1 0

Internet Archive Labeled Terrorist, Political Takedown Pending
by grarpamp 12 Apr '19

12 Apr '19

https://www.techdirt.com/articles/20181212/17531141214/if-youre-worried-abo… https://www.techdirt.com/articles/20190408/22123841955/european-parliament-… https://www.techdirt.com/articles/20190410/14580641973/eu-tells-internet-ar… http://blog.archive.org/2019/04/10/official-eu-agencies-falsely-report-more… We've been trying to explain for the past few months just how absolutely insane the new EU Terrorist Content Regulation will be for the internet. Among many other bad provisions, the big one is that it would require content removal within one hour as long as any "competent authority" within the EU sends a notice of content being designated as "terrorist" content. The law is set for a vote in the EU Parliament just next week. And as if they were attempting to show just how absolutely insane the law would be for the internet, multiple European agencies (we can debate if they're "competent") decided to send over 500 totally bogus takedown demands to the Internet Archive last week, claiming it was hosting terrorist propaganda content. [...] And just in case you think that maybe the requests are somehow legit, they are so obviously bogus that anyone with a browser would know they are bogus. Included in the list of takedown demands are a bunch of the Archive's "collection pages" including the entire Project Gutenberg page of public domain texts, it's collection of over 15 million freely downloadable texts, the famed Prelinger Archive of public domain films and the Archive's massive Grateful Dead collection. Oh yeah, also a page of CSPAN recordings. So much terrorist content! https://techcrunch.com/2019/04/11/much-to-oracles-chagrin-pentagon-names-mi…

3 2

Silk Road 2 Founder Dread Pirate Roberts 2 Caught, Jailed for 5 Years
by coderman 12 Apr '19

12 Apr '19

see you in five, Cthulhu! :0 (in the US this would have been a *much* longer sentence...) --- https://motherboard.vice.com/en_us/article/9kx59a/silk-road-2-founder-dread… by [Joseph Cox](https://motherboard.vice.com/en_us/contributor/joseph-cox) Apr 12 2019, 1:04pm Silk Road 2 Founder Dread Pirate Roberts 2 Caught, Jailed for 5 Years For years, the arrest and case has been kept under-wraps. Friday, a court sentenced Thomas White to 5 years and 4 months for his role in running a huge dark web drug marketplace. In 2015, WIRED published a list of the ‘dark web drug lords who got away.’ That list included the Dread Pirate Roberts 2 (DPR2), the creator of the second Silk Road site, which launched almost immediately after the FBI ended the first with the famous arrest of founder Ross Ulbricht. Under DPR2, Silk Road 2 went on to rake in hundreds of thousands of dollars a day. The FBI shut that one down too and arrested its remaining administrator. By that time, DPR2 had already passed ownership of the site on and, publicly, it looked like he had evaded prosecution. But today, a court in Liverpool, England, sentenced Thomas White, a technologist and privacy activist, for crimes committed in part while running Silk Road 2 under the DPR2 persona, among other crimes committed under another persona. White pleaded guilty to drug trafficking, money laundering, as well as making indecent images of children, and was sentenced to a total of 5 years and 4 months in prison. White’s arrest took place in November 2014, but the case has remained largely under-wraps because of the UK’s strict court reporting rules, which prohibit journalists from covering some cases before their conclusion. This is to stop suspects facing "trial by media," and in order to let cases run their course. Paul Chowles, an investigator from the National Crime Agency (NCA) who worked on the case, told Motherboard in a phone call one piece of evidence included the private encryption key belonging to DPR2 on one of White’s computers. If someone possesses the private part of a PGP key, which is used to decrypt and sign messages, it can be a good indicator that they are behind a particular online identity. White has been out of prison on bail since his arrest in 2014, and became reasonably well-known in security circles under his real name in the time between his arrest and sentencing. After working on the Silk Road 2, White adopted the handle ‘The Cthulhu,.’ a moniker that may be familiar to those who follow technology news. On Twitter he mused about security and privacy topics, and has appeared under his own name in articles in Motherboard, Forbes, and more as an expert on Tor and other subjects. He previously ran a website archiving large data breaches that anyone could download, including the MySpace breach, data from hacked affairs website Ashley Madison, and customer information from a Muslim-focused dating site called ‘Muslim Match.’ White wrote blog posts on his own website, including a guide on how to securely setup a Tor hidden service, and he also ran a number of nodes for the volunteer-driven Tor anonymity network. White declined to speak to Motherboard on the record about his case. White deleted his Cthulhu Twitter account on Thursday. ComputersWhite's computer equipment seized by the NCA. Image: NCA *** After the FBI took down the original Silk Road site in 2013 and arrested Ulbricht, a small cabal of Silk Road veterans banded together to create its replacement. Those included moderators of the first site, and “StExo,” White’s persona which he used to offer money laundering services. White spear-headed that effort, and told others he would drop StExo and take on the mantle of DPR2, according to Chowles from the NCA. The Dread Pirate Roberts is a reference to the character from the book and film The Princess Bride, in which the title trickles down from successor to successor. “DPR2, aka Thomas White, was the boss. He was the controlling mind in all of this, and he was the one driving it forward,” Chowles added. Got a tip? You can contact this reporter securely on Signal on +44 20 8133 5190, OTR chat on jfcox(a)jabber.ccc.de, or email joseph.cox(a)vice.com. One Silk Road moderator that White directed went by the handle “Cirrus.” As Motherboard showed in 2014, Cirrus was an undercover law enforcement official who captured chat logs detailing White’s transition from StExo to DPR2. “He was able to capture that; that kind of transition,” Chowles said, referring to Jared Der-Yeghiayan, the US Department of Homeland Security (DHS) agent who controlled the Cirrus account. Chat logs US authorities recovered from the computer of Blake Benthall, Silk Road 2’s co-administrator, reflected much the same thing, Chowles added. In a longform 2016 profile, DPR2 told Motherboard what it was like to create the second Silk Road. “Once you hit that enter button, you've just launched something that you know there is going to be an absolutely fucking huge manhunt after you,” he said. In December 2013, when law enforcement agencies arrested a number of the original moderators, DPR2 stepped back from public view. When the FBI launched Operation Onymous the following year, which took down Silk Road 2, UK authorities arrested White. “This [wouldn’t] have been achieved without the significant assistance we’ve had from the [Department of] Homeland Security and the FBI and the Department of Justice,” Garry Tancock, a second NCA investigator who worked on the case, told Motherboard in a phone call. "He was the controlling mind in all of this, and he was the one driving it forward." The NCA investigators linked White first to the StExo identity in part by following financial and bitcoin transactions in the early days of the account’s creation. “We effectively got him from his day one, week one, of activity on Silk Road,” Chowles said. Chowles explained that included tracing a loan from payday loan company Wonga in White’s name, which was then sent to cryptocurrency exchange Mt. Gox, which then transferred bitcoin funds to the StExo account on Silk Road and paid for some items on the site. Other evidence included receipts for items seized from other Silk Road vendors addressed to White, and White being in possession of bitcoin wallets associated with DPR2. John Williams from the Crown Prosecution Service (CPS) told Motherboard in a statement that White "received an income that allowed lavish spending with no credible explanation." The case has not been straightforward, however. Chowles said the NCA had challenges with White’s use of encryption. The agency was eventually successful, in part because of gaining access to a password manager which contained the unlock phrase for one of White’s encrypted laptops. The whole process has also taken years. According to a source familiar with the case, the investigation data didn’t arrive in the UK until June 2016, and the FBI didn’t provide full copies until December 2018. Motherboard granted the source anonymity to speak more openly about a criminal case. White’s motivation was a mix of financial gain and power, Chowles believes. Chat logs between White and Benthall said White planned to start a paid-for child pornography site to make money, Charles said. White would tell Benthall to work on a UK timezone and write in a particular way, the investigator added. “Might set a forum up in onion land to bring together people who run hidden services to share knowledge? What do you think?” White tweeted in 2015. This piece has been updated to include comment from the CPS.

5 4

NZ Jacindamania
by grarpamp 12 Apr '19

12 Apr '19

https://twitter.com/MeanStreet5/status/1107547366624616448 https://twitter.com/Katos06396925/status/1108680659566891013 https://pbs.twimg.com/media/D37SaP3U8AIr-zY.jpg Blair, Clinton, Podesta, Arden, NZ Target

1 0

VA Guardsman Slips Monitor Sneaks to Iraq For Bomb Cheeseburger
by grarpamp 11 Apr '19

11 Apr '19

https://www.nydailynews.com/news/crime/ny-news-national-guard-officer-resea… https://www.armytimes.com/news/your-army/2019/03/14/officer-accused-of-stea… https://wtvr.com/2019/03/12/joshua-yabut-iraq/ He could probably use some help... " https://twitter.com/movrcx/status/1090274355873861633 "liberated kurdistan" https://pbs.twimg.com/media/DyFub-0X4AAnqaz.jpg https://pbs.twimg.com/media/DyFub-wW0AY-SOq.jpg https://pbs.twimg.com/media/DyFub-wXcAASsuV.jpg https://pbs.twimg.com/media/DyFub_KUcAIF844.jpg RICHMOND, Va. -- The Virginia National Guardsman accused of stealing an armored military vehicle from Fort Pickett and driving 60 miles to Richmond last year recently took another trip that he should not have made, according to investigators. Court records obtained by CBS 6 showed that Joshua Yabut was able to fly from Norfolk to Iraq two months ago. The trip violated the conditions of his bond following his June 2018 joyride. An employee of the Richmond Commonwealth’s Attorney’s Office called the Virginia Fusion Center on January 31, to report a suspicious situation involving Yabut, according to a report in his case file. Yabut, who has been wearing an electronic ankle device, is being monitored by the Richmond Circuit Court Mental Health Docket. On or about January 22, investigators said Yabut used his military ID to board a plane at Naval Station Norfolk and fly to the naval air station in Jacksonville, Florida. Related Story Soldier, charged with driving on drugs, appears to have been tweeting from stolen military vehicle Court documents showed Yabut later took a commercial flight to Charlotte, before flying to Toronto, and then on to Keflavik, Iceland. >From there, Yabut flew to Berlin, and then to Istanbul, before ultimately ending up in Iraq on January 26. He flew back to Norfolk two days later, according to investigators. Crime Insider sources tell CBS 6 that Yabut's ankle monitor was attached when he boarded the flight to Jacksonville, but at some point during the trip it was taken off. Virginia National Guard Soldier Joshua Philip Yabut “It’s both amazing and concerning,” said Blackstone Mayor Billy Coleburn, who lives near Fort Pickett. “Not only did he fly, but he took a military flight…. you would think in the military alone you should be on a no-fly list.” Coleburn, who is also the editor of the Courier-Record newspaper, first learned about Yabut’s trip to Iraq last month. That was around the time that Nottoway County Commonwealth’s Attorney Terry Royall filed a motion to revoke Yabut’s bond and put him back behind bars. In that motion, Royall referenced the unauthorized trip, and also said that Yabut’s “recent online activity reveals research into bomb making.” In addition to pictures posted on Twitter that showed Yabut at an airport in Iraq, court documents stated that investigators had found photos that “indicated Yabut had been looking into prices of having Denatonium Benzoate shipped from China.” liberated kurdistan pic.twitter.com/0BPvfmxUEQ — جوش (@movrcx) January 29, 2019 Denatonium Benzoate is a bitter substance commonly found in household cleaners and automotive products. One court document also stated that Yabut’s Twitter page featured postings and information related to Open Source Jihad and Al Qaeda, specifically, magazine articles that discuss how to make pressure cooker bombs and house to construct “train derailment devices.” "I don't think there's any question to that, he presents a level of threat," said Col. Matt Bristol, a retired Staff Judge Advocate for the United States Air Force. “It's hard to say if he's detached from reality." Bristol, who is unconnected to the investigation, also expressed concern about Yabut being able to leave the state, and the country. “I’m surprised that he was able to board a military aircraft at Norfolk Naval Air Station, not withstanding he was wearing an ankle bracelet," Bristol said. When reached for comment, a spokesman for the United States Air Mobility Command said that they were aware that Yabut had flown out of the Norfolk NAS terminal, but said that no investigation was necessary, because military personnel and their dependents are allowed to fly on Department of Defense planes that have available space. CBS 6 also asked whether Yabut's ankle monitor should have been detected by security before he boarded the flight. "We don't discuss or disclose security procedures for the protection of our missions and safety of all passengers," said Capt. Kenneth Hicks, USAF, the deputy chief of media operations. Yabut's military ID card was valid at the time of his flight. That is no longer the case. "First Lt. Yabut maintained his military identification card in order to access his benefits to include potential medical care," said A.A. "Cotton" Puryear, the state public affairs office for the Virginia National Guard. "His chain of command has since retrieved his military ID card based on his recently being charged with violating the conditions of his bond." Puryear also said that the military won't take disciplinary action against Yabut until the case has been adjudicated in the state court system. "Once those civilian actions are complete, the VNG will determine the appropriate course of action in regard to his military status," said Puryear. Yabut made national headlines in June, when investigators said he stole an armored personnel carrier from Fort Pickett and drove it more than 60 miles to Richmond. The chase came to an end on Broad Street near City Hall. Yabut was taken into custody after climbing out of the vehicle. He was later taken to Central State Hospital, where he was held for more than two months so that his mental condition could be evaluated. He was released in September. Yabut is currently locked up in Richmond, where he’s charged with felony eluding police. He’s set to go on trial in Nottoway in May for unauthorized use of a motor vehicle. "

1 0

Ars Technica: Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords
by jim bell 11 Apr '19

11 Apr '19

Ars Technica: Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords. https://arstechnica.com/information-technology/2019/04/serious-flaws-leave-…

1 0

Censorship: Linus Torvalds Comes Out Blatant Censor's Advocate, Anti Privacy/Anonymity
by grarpamp 11 Apr '19

11 Apr '19

https://www.linuxjournal.com/content/25-years-later-interview-linus-torvalds "Social Media... Add in anonymity, and it's just disgusting. When you don't even put your real name on your garbage (or the garbage you share or like), it really doesn't help. I'm actually one of those people who thinks that anonymity is overrated. Some people confuse privacy and anonymity and think they go hand in hand, and that protecting privacy means that you need to protect anonymity. I think that's wrong. Anonymity is important if you're a whistle-blower, but if you cannot prove your identity, your crazy rant on some social-media platform shouldn't be visible, and you shouldn't be able to share it or like it."

5 9

AnarchoPunk Update
by grarpamp 11 Apr '19

11 Apr '19

6 13