- cypherpunks - lists.cpunks.org

Re: [Cryptography] What if Responsible Encryption Back-Doors Were Possible?
by grarpamp 07 Dec '18

07 Dec '18

On 12/6/18, Bill Cox <waywardgeek(a)gmail.com> wrote: > As for responsible encryption policies, I believe: > > 1) It is possible, but _hard_ and _expensive_ to build it securely. > 2) No one wants to be in a position where a mass murderer has encrypted > data that cannot be revealed to law enforcement. > 3) Governments will always over-reach and go for mass-surveylence that > violates everyone's privacy. > > I wont go into tech details, but if Bitcoin can protect billions in online > value, there are systems that can unlock back-doors without too many > failures to make the system a bad idea. Check out what Oasis Labs is up > to, for some good ideas (that remain to be proven). The problem is that > while the public wants tech companies to help law enforcement in extreme > cases, no one wants to simply let governments around the world spy on > absolutely everything we do. > > IMO, the only acceptable solutions to this problem will require distributed > trust (like Bitcoin), such that users' devices can participate in decisions > on how their data is used, distributed widely enough that no single entity > can unilaterally decrypt a user's data Data policies will need to be > automated, like smart-contracts on something better than the total-crap > Ethereum VM. When a backdoor is used (or used too often), it should make > the news, because a bunch of different interested folks would notice the > transaction(s) on the blockchain. Secret mass surveylence should be > impossible, as a key requirement for the system design. Publicly visible > mass surveylence should be prohibited by the smart contracts, and the > public should hold governments accountable for overreach. > > If the public can monitor the access policy and frequencey of use of these > backdoors, then the tech companies will have a way out of the ethical > delema law enforcement always tries to put them in: secretly snooping on > users for the government (like we saw with Yahoo). > > Anyway, I feel very strongly that folks out there should start thinking > along these lines. We'll have to cooperate to make it happen. Please tell us when you develop or find such a distributed backdoored cryptosystem that you feel is strong enough to protect *your own secrets* from access by others... all the salacious messages pics and videos of that BDSM affair you had, all the edits you've made to your resume, the source and fact of your last weed order because the PTSD from your stint as a secret CIA torturer has you about to lose it, all the crap you nicked, your bank accounts, your speech and politik, that weird thing you do with the stuffed groundhog, your kids, your health, etc. Or the fact that you're a complete nothing with nothing to say if that's the case. You'd have a better chance of eliminating Government Surveillance through Anarchism than you would finding such a cryptosystem. > the only acceptable solutions to this problem Stalemate status quo is an acceptable solution, no change to implement backdoors needed... People have been using codes since thousands of years, as relatively strong and without backdoors in their day back then, as they are now today, and society has done just fine all along. If you want distributed for yourself, use secret sharing system. Trying to develop and force that upon others will just come back upon you and you know it. Strong crypto is a tool, not the problem. Melting down the tool isn't going to help. It just reverts you to former centuries. Backdoors are stupid. Get over it. > the public should hold governments accountable for overreach. Never in the history of all Governments past has that ever worked, therefore any apparent working today is extremely likely to fail. Kings will Govern and Force their backdoors in your backdoor until you depose them. Next time that happens, do the one thing that hasn't been tried in history... don't prop them up in the first place. The change in thinking needed to do that will likely eliminate most of the extant problems you seek to "fix" with backdoors. > moderators Lol, bcc'd.

1 0

Re: [tor-talk] Most Security Assertions Dangerous [Re: YouTube via Onion Services]
by grarpamp 07 Dec '18

07 Dec '18

> Tutanota open sourced their client. You could use the source and run your > own version of the Tutanota client if that's your threat model. It's true > the email provider could serve different users different versions of the app > and there is no possible way to audit it in real time A standalone app can give at least some distance and pinnable code. And a bit more if served up from a "neutral" third party like github, f-droid, or allowing tor or vpn to get it in some masked user fashion. > 2) You are running unknown code every day. Do you trust the vendors? Probably not wise until the world changes some more towards those hashtags. Shall we add #SharedAudit . > It's unfair [...] They're trying to > solve a complicated problem, inside a web browser, with no easy solution :-/ Yes of course, they're at least trying something new, that's important, so kudos. > It's unfair [...] to call [out] encrypted email providers But is it... just look at most of their own front page advertising statements that often go like... "Secure Encrypted Email in your Browser" Without weasel words, those statements can end up being fake. Does what net benefit the service may have for [most] users offset potential damage arising from such statements? There's a bunch of front page statements here too that also have more holes than a block of Swiss Cheese... https://www.torproject.org/ Who is parsing and calling them out, and or proffering page updates that use suitably accurate weasel words? > inside a web browser, with no easy solution :-/ If the world is still stupidly insisting on the derelict spy exploited relic of SMTP transport, instead of say fully encrypted P2P overlay transports with legacy SMTP / POP / IMAP frontends for the old timey feels, they should at least be directly extending browser functionality to load and exec user selected third party provided and fourth party audited message crypting code modules from local disk. Or should be using actual properly stood at a distance tools like GPG, Enigmail, Mailpile, NeoMutt, whatever, while replacement distributed P2P messaging and storage systems gain marketshare. If user can locally compile and use Tutanota from Github with no blobs, that's interesting, perhaps consider dropping them some coin if so.

1 0

Re: [tor-talk] comparison of Tor and Kovri in regards to deanonymization attacks
by grarpamp 07 Dec '18

07 Dec '18

> - I2P can be attacked with far less resources than Tor; Moot when $10k is probably enough to Sybil at least some small fraction of either of them. > - Tor is deeply researched and various attack types and problems have > already been solved; So if Tor is done, why don't you start writing grants to reseach, advance, and solve some of the undone, equally applicable, and necessary problem space of mixnets and other potential designs, instead of continuing to throw [government] money at Tor's curve of diminishing returns. > - Tor is larger as a network with more capacity, and more diversity; Start advertising, using, analysing other types of networks then. > They also have different purposes so they cannot be directly compared on > absolutely every feature Why do so many reviews keep implying this copout, "B network doesn't have X feature therefore B sucks"... of course networks are different, unique features are not detractions they're just incomparable items, go compare and analyse the similar features then. Both Tor and I2P generally claim their non-exit modes to be anonymous advanced designs resistant to attack. Go compare and analyze that. If you don't like the results, go start new designs. Reviews can even conform features... users can actually torrent internally over both, and exit over both... analyze that. Many orthagonal features are modular ideas embeddable in any decent network anyway, so they're not necessarily unique, only a matter of doing it, if sensible of course. > - I2P is more oriented for traffic inside the I2P network (e.g. you > cannot browse cnn.com anonymously via I2P). Yes you can, you just have to find or be an exit outproxy service and configure it manually. >> I would summaries the success of Tor over I2P with these points: Government: Initialed the Tor design, put in Decades of $Millions of controlling interest funding, and programmed Marketing. Throw those kind of resources at I2P or any other network and they would be relatively equal contenders too. Throw Voluntary versions of those kinds of resources at any network, and it might be a bit more novel and free to go up against the backer of the "successful" one above. >> - Tor has a modified browser which is a fork of firefox-esr called Tor >> Browser Bundle which is easy to click and run with Tor. I2P until now >> there is no official browser supporting it and user needs to do the >> configurations manually. So stuff I2P inside TBB's work and call it IBB.

1 1

Re: [tor-talk] comparison of Tor and Kovri in regards to deanonymization attacks
by grarpamp 07 Dec '18

07 Dec '18

>> I was curious for Monero dev's rationale to pick I2P over Tor >> Whatever I've seen online doesn't strike me as particularly convincing. Same could be asked of Zcash strong cryptographic ZKP style currencies users often using Tor. As well as a handful of other cryptocurrencies explicitly advertised and designed to use with Tor. >> Whatever I've seen online doesn't strike me as particularly convincing. >> Is there published research in regards to deanonymization attacks against >> both Tor and I2P Some are here, some are in sites of other messaging systems... https://www.freehaven.net/anonbib All overlay networks currently in production are massively vulnerable to at least two classes of attack by sufficiently interested and capable adversaries... 1) Sybil a) This requires people to actually use PKI to make and use assertions and identities and to punt the results they get from their deep social anal probing of each other in real life as operator peers worldwide... into the consensus, DHT, or whatever mechanism each network uses for node approval and selection. b) Also requires complete ongoing analysis of all known physical and logical metadata and behaviour of the nodes themselves. 2) Global Passive Monitoring The US NSA, Global and Regional Telecom Corporations, and other Entities Worldwide, acting both separately and together, have a complete passive and active view of the internet from at minimum the Global Tier-1 ISP Level, including significant analysis and recording capabilities therein. Yet everyone still stupidly fails to execute at least a few of the seemingly available and reasonable countermeasures... a) Encrypt Everything. Automatic, on by default, strong crypto suites, forward secrecy, tofu, psk, rekeying, whatever works best, etc... both... 1) By and between end to end users, same for server to server... 2) On all physical network links worldwide, every port automagic and independant... fiber, copper, radio, etc... embedded in the network hardware itself via RFC, IEEE, etc b) Deploy fulltime network fill traffic aka chaff, to fill the committed capacity that each node provisioned itself into the [overlay] network with, dynamically yielding room for and upon native traffic. This applies both to, logical nets 2a1, and physical nets 2a2, above. c) Politics, Anarchism, Cryptocurrency Crowdfunding, and whatever else works to uproot and route around persistant known bad actors. 3) Etc Nobody seems to want to do much on the above, to actually shape those into effective global project efforts, to deploy any sufficient mitigation finally therein, therefore the vulnerabilities shall remain. #OpenFabs , #OpenHW , #OpenSW , #OpenDev , #OpenBiz , #CryptoCurrency , #Anarchism , #SybilBusters , #EncryptEverything , #FillEverything ... the list gets longer. Anyone can launch rockets these days. So there is no reason any of the above and more can't be done. Go build and launch some rockets.

1 0

Lé Guardian "Jealous AF on CNN", clinches Fake News Cup -
by Zenaan Harkness 07 Dec '18

07 Dec '18

[PEACE] Reply-To: In-Reply-To: <20181130125754.p7kro4odxzr2b2jg(a)eye.freedbms.net> On Fri, Nov 30, 2018 at 11:57:54PM +1100, Zenaan Harkness wrote: > On Fri, Nov 30, 2018 at 12:07:04PM +1100, Zenaan Harkness wrote: > > On Thu, Nov 29, 2018 at 05:48:02AM +0000, jim bell wrote: > > > https://www.politico.com/magazine/story/2018/11/28/assange-wikileaks-prosec… > > > Philip Agee. > > > > Entirely apropos and an interesting story to boot. > > > > Just as the Jews have their spyware and flashmob "counter > > anti-semitic" apps: > > > > The software, called the Anti-Semitism Cyber Monitoring System, or > > ACMS, is "the most advanced development in the world for monitoring > > anti-Semitism in real time," the ministry said... > > https://www.timesofisrael.com/diaspora-ministry-unveils-system-for-tracking… > > > > https://electronicintifada.net/blogs/asa-winstanley/israel-running-campaign… > > > > https://www.haaretz.com/israel-news/.premium-israeli-spyware-was-used-to-tr… > > https://www.timesofisrael.com/israeli-spyware-used-against-saudi-arabian-di… > > https://www.mintpressnews.com/saudi-arabia-secretly-purchased-250m-spy-pack… > > > > > > in this day and age a CIA-agent (and NSA, FBI etc) identification app > > would be relatively easy to create - turbo charging what Agee did in > > the '70s. > > > > For example one obvious group are the legacy stream media plants, > > Luke Harding and or Dan Collyns (is that a real name, Collyns?) for > > two face planting manipulator examples to start with: > > > > > > The Guardian Faceplants As Manafort's Passport Stamps Don't > > Match "Fabricated" Assange Story > > https://www.zerohedge.com/news/2018-11-29/guardian-faceplants-manaforts-pas… > > > > …WikiLeaks immediately fired back at The Guardian - betting the > > paper "a million dollars and its editor's head that Manafort > > never met Assange." > > > > This is going to be one of the most infamous news disasters > > since Stern published the "Hitler Diaries". > > — WikiLeaks (@wikileaks) November 27, 2018 > > > > > > It is evident that those who proclaim "Russia hacked the USA's 2016 > > elections" are compromised, idiots, (CIA or Hitlery) agents, or some > > combination. > > > > A problem with human "annotations" if you like is the problem of > > "the tyranny of the mob" which it times of stress descends into witch > > hunting lynch mobs - so empower that at your peril, > > > > yet on the other hand, evil only thrives in secrecy and the Satanists > > seem to corral an extraordinary large number of humans into the "eff > > the optics of the Butcher of Benghazi and her oral lynching of a 12 > > year old (at the time) rapee, I'm With Her" - this level of mass > > programming is truly impressive, shocking, etc. - evidently many > > folk simply don't think, they are CNNPCs, MSNPCs, as in literally. > > > > Exposure, transparency, truth and facts must be the fundament of any > > sane "community or tribal grouping" (politics), and so from this > > foundation, turbocharging publishing of empire-embarrassing facts as > > Agee and Assange have done, and the trasparency that a "CIA and other > > agent crowd sourced identification" app would bring to the table, > > despite any possible, or even probable, problems, are necessary and > > important, with the benefits far outweighing those potential > > problems. > > > > Besides, the hypocrisy of Western "democracy" ought be utterly > > exposed and crushed into the dark halls of history - as humans at > > least trying to think about things (and to whatever limited the > > degree we actually achieve something resembling "thought"), we owe it > > to ourselves and future "try to think"ers to clean out the rot. > > > Chapter 2 of Assange, Luke Harding and Dan Collyns of MI6, sorry I > mean The Guardian, and the neurotic moronic revenge charges being > concocted to Send A Message in the style of CNN's "offers your can't > refuse" - impressive in its chutzpah, brazen disregard for all > decency and even any remote hint of righteousness: > > > PCR Fumes "There Is No Case Against Assange, > So Lies Replace Evidence" > https://www.zerohedge.com/news/2018-11-29/pcr-fumes-there-no-case-against-a… Oh ... yeah. You know you love it! The Guardian's Reputation In Tatters After Forger Revealed To Have Co-Authored Assange Smear https://www.zerohedge.com/news/2018-12-06/guardians-reputation-tatters-afte… Names to remember, folks: Luke Harding/CIA Fernando Villavicencio/CIA MSM Is Getting Weirder, More Frantic, And More Desperate By The Pussy^BDay https://www.zerohedge.com/news/2018-12-06/msm-getting-weirder-more-frantic-…

1 0

Facebook’s internal documents show its ruthlessness
by jim bell 07 Dec '18

07 Dec '18

https://www.engadget.com/2018/12/05/facebook-internal-emails-documents-mark… [partial quote follows] As expected, the UK Parliament has released a set of internal Facebook emails that were seized as part of its investigation into the company's data-privacy practices. The 250-page document, which includes conversations between Facebook CEO Mark Zuckerberg and other high-level executives, is a window into the social media giant's ruthless thinking from 2012 to 2015 -- a period of time when it was growing (and collecting user data) at an unstoppable rate. While Facebook was white-listing companies like Airbnb, Lyft and Netflix to get special access to people's information in 2013, it went out of its way to block competitors such as Vine from using its tools. When Twitter launched Vine, the app had access to Facebook's Friends API, which let Vine users see which of their Facebook friends were using the then-new app. But after approval from Zuckerberg himself, that access was cut off. "Unless anyone raises objections, we will shut down their [Vine's] Friends API access today. We've prepared reactive PR, and I will let Jana know our decision," Justin Osofsky, Facebook's vice president of global operations and media partnerships, said in an email at the time. Zuckerberg replied, "Yup, go for it." [end of partial quote] Jim Bell

2 1

snowden and the billionaire monkeys on our back
by John Newman 06 Dec '18

06 Dec '18

Long interview with guy who just wrote a book about faux-philanthropic leaders of the new gilded age (or something ;) https://www.truthdig.com/articles/silicon-billionaires-are-the-lethal-monke… Interesting part where he described Snowden talking to a bunch of these people, this "clash of ideals" - " [... snip ...] I mean, you have an amazing scene where they’re listening to Edward Snowden on some Transatlantic communication; he was also listened to at the TED Talk and so forth. And at one point, they think hey, he’s one of us. And he tries to set them correct, no, I’m not out to rip people off, I’m out to help their freedom. AG: I went on a cruise ship called Summit at Sea for 3,000 or so entrepreneurs who believe they are changing the world. I was interested in what happens when you have this kind of density of people who are convinced that they’re making the world a better place, and that growing their businesses is how you make the world better, and you make the world better by growing their businesses. This total idea of the win-win. And one of the events was the talk by Edward Snowden via videoconference from Russia. Chris Sacca, a venture capitalist in Silicon Valley who’s been very, very successful, was his interlocutor. So Chris kind of stood on stage looking up at this big screen asking Edward Snowden questions. And this hasn’t really been reported ever, so it’s kind of new in the book. And the scene where Snowden is talking and explaining this kind of powerful vision of why he did what he did–he kind of gave an explanation of it that I hadn’t heard before, which is that he is convinced that the opportunity to dissent, to call out something untrue in a society, that that act requires a certain freedom to think thoughts, exchange ideas with others that are not visible to the government. If we live in a world in which every communication is surveilled and interdicted, potentially interdicted by government, we’re going to live in a world in which change becomes very hard to make. Because as soon as someone has a truly heretical idea, they’ll be neutered; if not in the United States, then certainly in many countries. It was a very interesting vision, and as he started describing, well, the way I’m going to do that is I’m going to build all these tools that would allow dissidents to actually operate more freely. A communication tool so you can message without getting caught, a Facebook “like” tool so you can socially network without losing your privacy, some kind of tokenized identity so you can make clear to different websites that you’re the same person without revealing which person you are–various things. Snowden was describing the creation of all these things because he wanted to live in a world in which dissent of the kind that he made is possible, in which it’s possible to go up against power and not be interrupted in that quest; that’s his motivation, his goal. And what was so fascinating to me, given the cultural collision between this man who deeply believed, whether you like him or not, in sacrifice and in taking a risk for what he felt to be the greater good, who believed in fighting the power structure–he was standing there talking to these 3,000, or you know, however many were in the room–kind of entrepreneur types, whose biggest goal is to, like, make $1 billion in a way that serves humanity. And it’s like they couldn’t process him; they couldn’t process his set of motivations. And so Chris Sacca says, wow, you sound like you’re designing a lot of tools that, they sound like apps, or startup–do you want to build a startup? I mean, there’s a lot of people here who would like to be your investor. Snowden just looked at him, puzzled, like–what are you talking about? I’m talking about freedom and heresy and truth, and being a dissident, and how a society corrects itself from manifest injustices through allowing people who have an uncomfortable truth to tell it. And you’re talking about startups? And it was just this wonderful collision between someone who believes in real changes, and these people who kind of believe in the pseudo-change that lines their own pockets." -- GPG fingerprint: 17FD 615A D20D AFE8 B3E4 C9D2 E324 20BE D47A 78C7

5 7

Scientific American: Is the U.S. Lagging in the Quest for Quantum Computing?
by jim bell 06 Dec '18

06 Dec '18

Scientific American: Is the U.S. Lagging in the Quest for Quantum Computing?. https://www.scientificamerican.com/article/is-the-u-s-lagging-in-the-quest-…

3 3

Hand over encrypted data.
by jim bell 06 Dec '18

06 Dec '18

Australia poised to force tech firms to hand over encrypted data https://finance.yahoo.com/news/australia-poised-force-tech-firms-hand-over-…

5 4

Most Security Assertions Dangerous [Re: YouTube via Onion Services]
by grarpamp 06 Dec '18

06 Dec '18

In a thread... https://lists.torproject.org/pipermail/tor-talk/2018-December/044709.html on... > http://kgg2m7yk5aybusll.onion/ > http://axqzx4s6s54s32yentfqojs3x5i7faxza6xo3ehd4bzzsg2ii4fv2iid.onion (noting that all onions can be physically located by determined adversaries, thus failing another commonly sold security assertion) > https://github.com/omarroth/invidious > - Its free software and the code is available for install/checkup. That assertion is irrelevant in the security context of the thread so far, and it's dangerous advice. As with protonmail and all the other fakeass encrypted email websites... the JS code is loaded by the browser from the web service itself, there is currently NO trusted way for the user to independantly audit that the code they end up executing in real time *from* the service matches the code *in* any repo, or for the user to choose to ignore the service code and load and execute any repo code of their choosing instead. > Youtube is made by a dick company to humanity called Google, which is > funding their services by stealing/collecting users data. So the JS The current code load model is a nasty exploit waiting to happen, does happen (Hushmail, NIT's, etc), and simply should not be trusted, no more than GOOG and FB the dicks, themselves, indeed. Or Java, ActiveX, Flash, and whatever other "secure" crap some scam tries to push into your pathetically insecure and untrusted exec platform. Sure Invidious Onion is fun, probably has some merits and use cases, and even simple html could be an exploit, and users can run it all in a sandbox, etc. But let's not say there's any trusted link between the running and repo codes, nor that any sufficient set of people have looked at, and signed over, most codes, or are even allowed to... [1]. Also, clicking on any video listed on the onion frontpage index initiates at least three connections straight to google instead of the proxy onion. That's not clean. > Plus you can watch the videos without the need to allow any JS. > this particular YouTube frontend/proxy seems to be > more focused on offering an alternative viewing experience rather than > privacy. https://github.com/mps-youtube/mps-youtube https://github.com/rg3/youtube-dl ... those and a few others readers can find and post here. [1] You can't even say those for the release iso's of OpenBSD, FreeBSD, the Linux's, etc... back to their claimed source code repos... because either those repos have no internal cryptographic roots or hashes to sign over or with in the first place, or some process in the path from there to the iso's is not reproducible or cryptographically chained. Same goes for Apple, Microsoft, Intel, AMD, ARM, Government, etc... You're all still woefully fucked therein because you keep buying the Kool-Aid, and refusing to demand, fix, ignore, or eliminate them and their issues. #OpenFabs , #OpenHW , #OpenSW , #OpenDev , #OpenBiz , #CryptoCurrency , #Anarchism The list of requisites to even get close to improving the situation grows...

2 1