- cypherpunks - lists.cpunks.org

Encryption Experts and Snake Oilers Quacking Like Governments
by John Young 30 Nov '14

30 Nov '14

Capitalizing on the comsec frenzy, several sites, probably many, are offering to encrypt for those who do not want install programs or find them too difficult to use. All appear to promise that no records, private and public keys, email addresses or content will be kept. Trust them. For example, here's one used to send encrypted messages: https://www.igolder.com/pgp/encryption/ This approach suggests that the renewed crypto wars have again bred a new round of opportunities to beguile those who yearn for comsec but do not know how to get it, nor how to evaluate the offerings, in particular those provided by US producers which they doubt are free of government manipulation. But they also doubt that any cryptosystem is free of that, thanks to the NSA revelations of global cooperation among nations to do what NSA does, and the failure of crypto experts and firms to fully disclose their aid to governments, before and after Snowden's revelations. So the downside of Snowden's revelations is that there is considerable suspicion that all crypto is compromised, and, worse, that snake oil is not really different from the good stuff for the ordinary user who lacks the technical skills to distinguish them. And that comsec experts are in league with authorities to dupe the public by excessive warning of snake oil to peddle their own offerings, that is, experts and snake oilers are doing what governments do. Trust Snowden, trust experts, trust governments, but distrust snake oil. Wait, users say, how can we tell the difference when they all quack like ducks.

1 0

POTUS jammin'
by coderman 30 Nov '14

30 Nov '14

https://twitter.com/mattblaze/status/529055344191111169 Fired up a spectrum analyzer as POTUS motorcade went by. Definitely wideband jamming from lead WHCA vehicle. (& it unpaired my BT headset) I had been skeptical of reports that they routinely use jammers, but there was strong wideband noise from abt 700mhz to beyond 2.5 GHz. VHF was quite clean, which is where most sec svc traffic is. ... it seemed to be about half a block. --- ultra-wide-band SDR to the rescue? (60Ghz MIMO or bust!)

10 18

Re: [tor-talk] [Cryptography] Blogpost: CITAS, a new FBI security program proposal
by Ryan Carboni 30 Nov '14

30 Nov '14

While my analogy and definition of security may not have been best suited, nor is this reply, the point remains that there is nothing special here for you as a corp. Anything you say that LE can provide for *you* with honeypots can also be sourced internally or from the open market and your subsequent call to LE to mop up upon discovery of badness therein. Revolutionary concept... but businesses could work together on their own initiative. It's how inter-bank checking began.

1 0

ODNI Jammin' (Shill Kooks)
by Wilfred Guerin 30 Nov '14

30 Nov '14

> > DNI Alexander W. Joel CLPO formerly General Counsel of CIA (yes, those > torture authorizations) is first cousin of notorious belly-dancer Jill > Kelley of Tampa who 'did' CIA Petraeus "out with a bang" by way of his > uncle FBI GC Patrick W Kelley (brother David Kelley of NSA Ft Gordon 1988, > Y2K & disa, ncs) and grandfather Clarence M Kelley (FBI Nixon) and cousin > Sean M Joyce the black money 9/11 FBI guy .. 6/745 terrorist thugs >

1 1

WhisperSystems + WhatsApp
by rysiek 29 Nov '14

29 Nov '14

Well, I didn't see THAT coming: https://whispersystems.org/blog/whatsapp/ -- Pozdr rysiek

7 12

What Is Good Encryption Software?
by John Young 28 Nov '14

28 Nov '14

Reader asks: What Is Good Encryption Software? http://cryptome.org/2014/11/what-is-good-crypto.htm I have contacted you asking about certain security questions. After reading a few of the Snowden leaked documents, I have started to be more aware of my privacy being at risk. I have a few questions concerning certain programs and safety tips. First, I've recently started to doubt about my encryption software. Is Symantec's "PGP Endpoint" a good hard drive encryption software? In other words, is it trustworthy since it is an American company. And if not, what encryption software is the best for Mac. Second, is "ProtonMail" as secure as they say it is? If not, what email provider doesen't let the NSA see into my account. Third, is Jetico inc's "Bestcrypt Container Encryption" trustworthy? If not, what could be an alternative. Fourth, are these encryption types good? Blowfish, Gost & AES - 256bit. And which encryption type remains the best above all? Last, is Kaspersky a good anti-virus software? If not, which one is the best for Mac. ----- Important, difficult questions, likely to produce a range of answers. We will publish for answers.

2 1

Re: Delivery Status Notification (Failure)
by coderman 28 Nov '14

28 Nov '14

On 11/28/14, Mail Delivery Subsystem <mailer-daemon(a)googlemail.com> wrote: > Delivery to the following recipient failed permanently: > > cryptography(a)metzdowd.com speaking of failures, nothing expresses my contempt for email like a gmail account :) happy plain text holidays!

1 0

Re: [Cryptography] STARTTLS, was IAB Statement on Internet Confidentiality
by grarpamp 28 Nov '14

28 Nov '14

On Tue, Nov 18, 2014 at 11:29 PM, John Gilmore <gnu(a)toad.com> wrote: > Censorship of customer communications is always a "best practice" > according to some people. Blocking communications based on the port > number in use? Today some people on this list tried to tell me that 'Port 25 is SMTP'. That's funny because I use it for SSH. > That seems to many people to be heinous, > "picking winners and losers", discriminating against > traffic based on what the endpoint services are, etc. Wasn't > Network Neutrality supposed to outlaw all such discrimination? Yes it was. > Or, is it a catchphrase for "only the politically correct people > are allowed to censor or discriminate against traffic"? It's doublespeak now, said political promises vanish once elected. If the discriminators get their way you better hope you have real estate in the Balkans. > The fact that some ISPs covertly built that censorship into a > supposedly transparent network must be why I never get any spam these > days. But it doesn't matter to zealots whether their methods actually > work or not. They're mad at spammers, and "Hulk smash" is their main > response. Reason, principle, protocols, and respect all went out the > window. > > Anti-spammers have done far more damage to the Internet than spammers. > Now they are claiming that we can't be permitted to encrypt our > Internet connections because then their censorship scheme would stop > working? Yes they are. You better encrypt the net now before they're able to inject that power twist into arguments of political arms. > I don't see any spammers claiming that end users should not > be permitted to encrypt their emails nor any other traffic. To take > the privacy of our communications into our own hands, it is the > anti-spammers who stand in our way, not the spammers. Just like AdBlockPlus, user's mail clients should be shipped and extensible with simple local filtering spam/virus/malware processing engines. Users, having no such simple plugin tools available to them in early days, complained of spam which drove provider/anti filtering more than providers separate ability to handle the traffic load did. All the anti position did for providers was shift their cost from disk spool storing it to cpu rejecting it. And users got censorship tools developed and deployed against them in return. Failure! Users need to do their own filtering and encrypt now. >> Here, for example, is a >> recommendation on the topic that MAAWG published in 2005: >> >> https://www.maawg.org/sites/maawg/files/news/MAAWG_Port25rec0511.pdf > > Exactly -- an anti-spammer group, the "Messaging, Malware and Mobile > Anti-Abuse Working Group", MAAWG. Hmm, there seem to be more M's in > there than in their domain name. Perhaps once they started advocating > censorship for one reason ("Messaging"), they found all sorts of > other reasons for it, too. When you have a censorship hammer, every > problem looks like a need for censorship. > > John Gilmore > (who regularly, daily, gets his personally typed emails - just > like this one -- censored without recourse, by the ISPs of > recipients who rely on unreliable third party censorship > blacklists.)

2 1

Microsoft Root Certificate Bundle, where?
by grarpamp 28 Nov '14

28 Nov '14

MS root cert docs indicate they switched at vista from manual/auto downloadable updates to some form of OS online on the fly only auto update system. Where link at microsoft can one still download a file containing their entire current root cert bundle in some parseable format? It has to be somewhere near here but I'm dense today... http://social.technet.microsoft.com/wiki/contents/articles/3281.introductio… ex: mozilla is here https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/b…

4 6

Deanonymisation of clients in Bitcoin P2P network
by grarpamp 27 Nov '14

27 Nov '14

http://orbilu.uni.lu/handle/10993/18679 Biryukov, Khovratovich, Pustogarov Nov-2014 Bitcoin is a digital currency which relies on a distributed set of miners to mint coins and on a peer-to-peer network to broadcast transactions. The identities of Bitcoin users are hidden behind pseudonyms (public keys) which are recommended to be changed frequently in order to increase transaction unlinkability. We present an efficient method to deanonymize Bitcoin users, which allows to link user pseudonyms to the IP addresses where the transactions are generated. Our techniques work for the most common and the most challenging scenario when users are behind NATs or firewalls of their ISPs. They allow to link transactions of a user behind a NAT and to distinguish connections and transactions of different users behind the same NAT. We also show that a natural countermeasure of using Tor or other anonymity services can be cut-off by abusing anti-DoS countermeasures of the bitcoin network. Our attacks require only a few machines and have been experimentally verified. We propose several countermeasures to mitigate these new attacks.

1 0