- cypherpunks - lists.cpunks.org

Loki.network, Crypto Network HW Links, Anti Vampire and Sybil Nets, Actors Everywhere
by grarpamp 02 Apr '19

02 Apr '19

> I am personally convinced that a flat traffic shape will only dare > attackers to cut links between parts of the network, effectively > making an even larger traffic shape to corrilate with. Today if play the cut links game, eventually a toggled link will expose the traffic you seek, because there's no fill between nodes that automatically takes its place. Your global monitor sees a respective signal slump among the nodes making up the subject path, each node distinguishable by time deltas. Such signal the adversary was probably clocking into it themselves for easier recognition anyway... fetch 1MB, fetch 1MB, fetch 1MB, fetch 1MB... oh noes. Tor's hidden services are total sitting ducks because of this. Same for likely all current overlay networks in production regardless of whatever service they provide... from traffic, messaging, storage, cryptocurrency, and so on. There are surely better links from the bib space, yet here are some concepts on generated buckets, retiming, how they can contain full time "empty" fill that yields to wheat demand on the line, traffic contracts, etc therein... https://en.wikipedia.org/wiki/Generic_cell_rate_algorithm If all the nodes are independantly maintaining independant traffic contracts between their physical and/or logical peers, cut links won't do hardly as much impact if anything at all... A \ B + -----> M -----> { U V W X Y Z } C + D / If nodes ABCD on the left are trafficing through M cloud fanning out to the right mesh towards UVWXYZ, then adversary cutout of D is not visible beyond M if M makes up for D's packet slack on its left contract by continuing to emit the same amount as fill to fulfill its right contract. M could variously blackball A for non contractual suspect misbehaviour... weird rates, timing anomalies, uptimes, etc. M could signal BC that they can now renegotiate upwards with M since M now has more rate free on its left. If M is cut out, the left renegotiates with some L or N nodes via new northern or southern arc routes. The "shape" or "bitrate" of the contracts could be negotiated as need be, "flat" might not be necessary, so long as the contract is upheld and policed by all participants to it. Contracts could be one to one, one to many, many to many, physical next IP hop to hop, logical overlay address to address, multiplex, simplex, tunneled, shared, etc. And pertain to bitrates, timing, uptime, any sort of constraints, metadata, etc. This also makes Sybil's life more difficult... it must now own the full path or it will lose sight due to contracts with non Sybil nodes in the path who are also meshed and contracted out to other non Sybils around ot. Sybil must also uphold all its own contracts or get dropped by other nodes. > I am not convinced low latency systems can be immune to traffic shape > corrilation and hence that being said Copper, Fiber, Radio, etc.. so long as it's quality line rate hardware that can keep up with its advertised rate, their time to transfer data is dependant only on distance, not on how full the line is. Such network hardware is agnostic... fill, wheat... it all gets there in the same time. When people say "X latency network overlay", they're really referring to the cost of software processing their overlay design on their crappy stack of PC / Phone CPU hardware. And in their transport protocols running on the same... TCP, UDP, etc... all the way down the stack until it hits the real network hardware, which will either happily accept and ship the packet, or drop it. When people cry about "bandwidth", all they need to do in a fill model is allocate whatever bitrate to it they like and forget it. They're not going to get more bitrate from their ISP than they paid for, and they'll probably contract to the overlay under that so they can do other things with their line. And they're not going to get more wheat bytes across the overlay than a 100% wheat ratio (fill yields to wheat demand) within their contract to the overlay, even if they do disconnect from their byte transfer based ISP / Phone afterwards. Research would need done into routing models needed to transit traffic across the overlay. ie: TCP can readily jam more yet slower circuits through a full pipe, UDP mix gets dropped routed or reserved for. Raw IP becomes interesting. As a network HW project for defense in depth... If hardware makers would add line rate encryption and fill silicon to every physical port on every switch, router, and NIC... mandatory on by default per physical link... that would kill off a lot of vampires. An open IETF RFC spec for that would cost under $1 per port to integrate into existing silicon port fab worldwide, plus electricity to drive the port which would be estimated as part of the RFC process. Modular agility would not cost much more at scale. Assuming line rate hardware, there's no latency impact here either. > I think state actors are out > of scope of the current threat model of llarp. If any network application involves free speech, politics, money aka cryptocurrency, business, journalism, industry, messaging, personal affairs, data storage and transfer, basically anything at all... you can be absolutely certain that many State and Other Actors have a serious continuum of interest in it. Is it the responsibility of each application to develop their own solutions to the threat? No... probably not when many such apps ride on, aggregate muddily over, and depend on networks. All apps can contribute to the development of a diversity sound number of strongly resistant networks that they can then utilize and endorse as they would their own. Be they overlays on top of the internet, enhancements to the internet, or new guerrilla physical plant... That process of people contributing to original and ongoing development of new strong networks that are not susceptible to such Basic Bitch Adversaries as Global Vampires, is something more should consider. Same for likely figuring out how to get the deployment Social aspects right so you can circle the network wagons against Sybil. > This may or may not change. Pity the fool who changes even one satoshi based on the worthless drivel herein :)

3 5

Re: concealed carry: man tries to kidnap 5yo girl, mom pulls a gun, man runs from department store into mall
by Zenaan Harkness 02 Apr '19

02 Apr '19

Apparently into the abyss - who knows what gives. Sometimes there's a probably not really mystical just looks that way from the outside, black hole. Cest la vie. On Wed, Apr 03, 2019 at 10:31:35AM +1100, Zenaan Harkness wrote: > Feel good story of the week courtesy Zerowedgie: > > A Man Tried To Kidnap A 5-Year-Old Girl. Then Mom Pulls A Gun... > https://www.zerohedge.com/news/2019-04-02/man-tried-kidnap-5-year-old-girl-…

1 0

Updating Crypto and Software, Users Role, Flag Days (re: Cryptocurrency, ex: ElGamal)
by grarpamp 02 Apr '19

02 Apr '19

> ElGamal.. Not endorsing or suggesting just noting for whoever that Tor has been updating a lot of its former crypto, here's one example... https://gitweb.torproject.org/torspec.git/tree/proposals/270-newhope-hybrid… Indeed a lot of projects have been and are updating their crypto for various reasons... brokenness, modularity, performance, simplicity, maintenance, quantum... the list goes on. https://neopg.io/ https://boringssl.googlesource.com/boringssl/ ... innumerable examples elided... It's always good to look around and see what's the latest going on in other projects. Many are perfectly good for their use cases, and relatively future proof, thus having no need to update. Others are a public shambles needing wholesale rewrite, fork, abandoned. >> Bad: I2P uses old cryptography, specially 2048 bit ElGamal using non >> standard primes. The use of ElGamal is so pervasive throughout the I2P >> protocol stack that it exists at every level of it. Removing it is a >> massive task that is taking a long LONG time. To the extent the below applies to any project... Projects should not hesitate to utilize flag days where useful. Many projects focus way too much on making seamless transitions. Users are part of projects too, and have responsibilities therein. Let them know this, and they will understand. Cryptocurrencies have been able to make rapid advances, in part because their very first announcements and ongoing processes make very clear that there will be flag days, required software updates, and things users have to do. Setting those expectations, enabling users to take part and pride in playing that role, can allow you to swiftly adapt and update as needed. Much faster than any other project, or adversary, on the market. Instead of being mired in "no changes, no downtime", legacy codebases, lacking features, whatever holds you back, etc.

1 0

Loki-network LLARP I2Pd Torrent Cryptocurrency
by grarpamp 02 Apr '19

02 Apr '19

https://loki.network/ https://github.com/majestrate/torrent.ano http://anodex.oniichanylo2tsi4.onion/ https://i2pd.website/ https://github.com/loki-project/loki-network/blob/master/docs/high-level.txt https://www.reddit.com/r/i2p/

5 9

NSA cybersecurity protection
by grarpamp 01 Apr '19

01 Apr '19

On 4/1/19, Ryan Carboni <33389(a)protonmail.com> wrote: > What is the NSA good for anyway It's TOP SECRET, good or bad, you'll never know, right ;) Known history of such TLA's of the world is not exactly good. Use the wikipedia links for that. Here's some recent news... https://www.reuters.com/investigates/special-report/usa-raven-media/ The American operatives worked for Project Raven, a secret Emirati intelligence program that spied on dissidents, militants and political opponents of the UAE monarchy. It surveilled a British activist and several unnamed U.S. journalists. Key players in the cyber wars of other nations. https://www.usatoday.com/story/news/nation/2019/03/28/ex-nsa-contractor-ple… No indication Martin ever shared the stolen secrets. His defense attorneys say he simply hoarded the information... One of his lawyers previously described Martin as a "compulsive hoarder" who took home work documents > are they just watching American websites get hacked? Yes. Well, that and a whole lot of dick pics... https://www.youtube.com/watch?v=XEVlyP4_11M Among other things... https://www.zdnet.com/article/over-13k-iscsi-storage-clusters-left-exposed-…

1 0

Re: GoldBug Messenger, SpotOn Crypto, etc (Re: Syncing bookmarks)
by grarpamp 01 Apr '19

01 Apr '19

On 4/1/19, Tom A. <thomasasta(a)googlemail.com> wrote: > Hi Grar > like to help you with questions that one can answer, just ask, trying to > share some testings and learnings. > you have a certain view, there is no goal, just telling others who seek > info about sharing good practice experience. > Regards and have a great week Other than your handful of shills, after years there's still apparently no userbase of users on the internet, and certainly zero even remotely trusted voices, that are "sharing their experience" with such supposedly great things as GoldBug Messenger, etc. So instead of writing me... Your gang can "just try" to start by publicly answering the questions people have repeatedly asked you on public lists about your fishy projects. Good luck.

1 0

Brazil's Top Election Court Catches Google Manipulating Search Results to Point to Negative Entries on Bolsonaro ...Just Like They Do with Conservatives in America
by jim bell 01 Apr '19

01 Apr '19

Brazil's Top Election Court Catches Google Manipulating Search Results to Point to Negative Entries on Bolsonaro ...Just Like They Do with Conservatives in America. https://tiny.iavian.net/s25s

2 1

GoldBug Messenger, SpotOn Crypto, etc (Re: Syncing bookmarks)
by grarpamp 01 Apr '19

01 Apr '19

On 4/1/19, Tom A. <thomasasta(a)googlemail.com> wrote: > Subject: Re: [tor-talk] Syncing bookmarks > Message-ID: CAPHRpdXQnYY_FoBVx9ojsp=szvr6aenDu2B1p8yR2FmGKCUBhA(a)mail.gmail.com > ISBN-10: 3749435065 , ISBN-13: 978-3749435067 > Spot-On Encryption Suite: Democratization of Multiple & Exponential Encryption > Scott Edwards > Hi Anan, there is a p2p URL storage and sharing tool, which is based on > either a SQLite or PostgreSQL DB; > the function is to save your URLs (by RSS or crawler or manual entry), > inkluding the website text and a search engine, which is searching within > your encrypted content of your database: the database is encrypted and so > are the URL transfers from node to another node or DB. Ideal to create an > index of Onion Urls and Websites. Even with revisions for the webesite, in > case two times spidered. See the manual for further details_ > https://www.amazon.com/Spot-Encryption-Suite-Democratization-Exponential/dp… > The database is symmetrical encrypted, that means with a path DB->Python > (because it has AES encryption) -> Apache -> php/Javascript eith > encryption, one can even bring the URLs to a web interface. That way Tor > URLs can be brought to a web search engine even with content - to refresh > the Website one then need of course to have Tor. This might be part of your > evaluation to store your URLs in a Database, as it is encrypted and > provides options to be searched and brought to your website. > Regards Tom Still at it aren't you Tom? Ever get those reproducible builds of your binaries done? Ever stop censoring and closing your Sourceforge forums when people critique your work? Ever quit the shill press releases out to trashy tech link farms trying to game credibility engines? How about claiming working with or the EFF endorsed you, that didn't work so well did it? Ever submit any legit papers to legit crypto and network forums for open peer review... ever do any of that beyond spamming them with gibberish announcements and dubious follow on's like the above? Ever provide any direct and real answers to any of the above people have asked you since inception years ago? No? But hey, you got yourselves a link on Amazon, that's impressive. It must be April Fools Day. Maybe you'll make the NYT Bestseller List and pay your way into a legit audit. Or not. Lol. Bitcoin was anon too, but they did it right, none of the above games, and it passed. Unfortunately your methods are still preceding your products regardless of whether they're any good or not. Could be, but who is going to bother given that to date, April's Fools? Seems like that's your goal. Prove differently.

1 0

All cybersecurity is really consumer protection
by Ryan Carboni 01 Apr '19

01 Apr '19

All cybersecurity is really consumer protection. What is going on is atrocious, banks and telecoms are subject to more regulation than major tech companies. Slot machines are subject to better regulations than voting machines. If you are deliberately negligent, you’d be liable. A Chinese electronics manufacturer was sued under the FTC Act by the US government. A recent check of haveibeenpwned is just depressing to me. What is the NSA good for anyway, are they just watching American websites get hacked? Sent from ProtonMail Mobile

1 0

CNBC: Zuckerberg backs stronger Internet privacy and election laws: 'We need a more active role for governments'
by jim bell 01 Apr '19

01 Apr '19

CNBC: Zuckerberg backs stronger Internet privacy and election laws: 'We need a more active role for governments'. https://www.cnbc.com/2019/03/30/mark-zuckerberg-calls-for-tighter-internet-…

4 3