- cypherpunks - lists.cpunks.org

Is Making a Murderer a real documentary?
by Ryan Carboni 17 Oct '18

17 Oct '18

The key part to recognizing or analyzing improper situations is noticing out of character interactions. Making a Murderer has dramatic elements. When the defense attorney was questioning the FBI agent on the stand, the defense attorney’s approach was not unlike badgering. That sort of a approach only happens on television. This is strange since it isn’t a reenactment. So who was the audience at the time? Steven Avery?

1 0

Re: Public Shielded Room Work
by John Young 16 Oct '18

16 Oct '18

Several years of Tempest (EMR-shielded) documentation (1985-2014): https://cryptome.org/nsa-tempest.htm Tempest timeline (1700s-2001) https://cryptome.org/tempest-time.htm Full compromising radiation protection is extremely hard to accomplish, maybe impossible, and the topmost is highly classified. Just about anything transmits radiation to a greater or lesser extent, bodies, clothing, air, feces, sweat, et al. Most protection systems transmit while seeming to block, in that way leaky like crypto. Crypto emanates. Your best friends and lovers and cohorts emanate, like GitHub. Perhaps join NSA, best of all one of its wizard contractors, or, if you get pretty good, USG or another spy agency they will grab you with an irresistable offer. Just don't succumb to Julian Assange's or Cody Wilson's tempestation. Semen may emanate above all others, shield it. At 10:00 AM 10/15/2018, you wrote: >Thanks so much for your replies. > >On 10/14/2018 09:07 PM, grarpamp wrote: > > Consider utilizing a github / wiki somewhere for this project, > > People can join together to generate the motivations and goals, > > outline areas of research, hacking and acquisitions needed, > > develop workplans, reproducible test setups, progress, results, > > costs, etc. Perhaps also some form of makerspace later on. > >Okay. I made these: > >- gitlab wiki: https://gitlab.com/xloem/openemissions/wikis/FAQ-and-Discussion >- chat: #openemissions:matrix.org on matrix and #openemissions on freenode >- loomio decision-making group: >https://www.loomio.org/g/MYQFl2dC/open-emissions > >I struggle with organization and would really appreciate any work to >make things more organized. > >If anybody is interested in collaborating actively on this right now, >chat is most convenient for me at the moment. > >On 10/14/18, CANNON <cannon(a)cannon-ciota.info> wrote: > > Any power going into such a room should use a UPS battery to prevent data > > leakage through power lines/usage. > > (Would power lines become an antennae for electro-magnetic frequency > > leakage?) Would a UPS be sufficient enough for > > security? > >Your use of 'UPS' seems a little ambiguous here. I have been thinking >of keeping a 12V battery inside the room, and using only DC power. AC >power seems like just another source of emissions to track, to me. > >My understanding is that filters are placed on lines to prevent any >but acceptable frequencies being carried on them. The field of >electromagnetic compatibility covers this a lot, I think. Power lines >completely behave as antennae, and couple nearby signals from one end, >to the other, by receiving them and then re-radiating them. > >Filtered AC power could be plugged straight into the mains, but I >don't at this time have the experience to trust the filters, and it >complicates construction of the room to make an additional penetration >for the wiring. > > > And if network connectivity is needed, to prevent network cables from being > > a carrier of EMF leakage, perhaps fiber optic line? > >As above, I think sneakernet is the way to go for highest security. > >With regard to fiberoptic transmissions, it seems to me the gold >standard would be open-source transcievers that are shielded to >decrease the utility of compromising them, and a way to sniff the >fiber-optic line to verify it does not carry unexpected data. > >Karl

2 1

Re: Let's not keep rehashing the past, it's dead already... (Was: Fishy MegaCorpsArchy)
by grarpamp 16 Oct '18

16 Oct '18

> "the possibility of change" Of course, corporations and people can and do change all the time. Corps, often when bought / sold, or with top level staff changeover. People, whenever upon some new thought process / info / situation. And they often change back as well. > To a good approximation, literally *zero* percent of the organisations > which will benefit from "Opportunistic Onions" have ever used Onion > Services until now And they're not really involved with them under CF plan either. So they might be missing out on some oppurtunities to directly learn and participate in some neat things about tor / philosophies. > However literally 100% of the websites who can benefit from "Opportunistic > Onions" are Cloudflare customers by choice, who choose to trust Cloudflare > with their traffic, and I respect the choices of the website owners to > select different ways of scaling their services and of keeping their > systems safe from being DDoS'ed. Perhaps it is fully informed choices that should be respected. Not necessarily degress of blind ones presented by want to be saviours that might trend saying say "Tor bad" to sell product. > The people who *use* those websites can and should make their feelings > known to the website owners; but the opinions they feed back should be > balanced and considered and up-to-date and fair. > it's amazing what a little engagement and mutual respect will achieve. True. > Yes, there is much to criticise of Cloudflare's past approach towards Tor > (including tweets by the CEO) Is the suggested accepted gone-ness of that phase now qualified by its current censorship actions. > Facebook [...] blocked a large number of Tor exit nodes > The civil society & reddit communities started commenting at speed, flaming > for "censorship" Is it not good that there is now such a global rapid response awareness and capability forming to tackle censorship, privacy, human rights, and other abuses by States, Religion, and Corporations as they happen in real time. > it apparently caused nothing but vitriol and bad headlines. Which mistakes are ultimately rightly resolved as oops with no lasting effect. At least the capability is excercised peacefully without physical force, no one dies. Unlike murder and other things by the trio above, and even just peoples too. > launching facebookcorewwwi [...] three years later the New York > Times launched its own onion site. > without constructive engagement we would > probably not be where we are today Right, and the above two stories are wins for both the sites and users, and many tech toolsets, and philosophy. However that's still rare, the historical pattern remains... 1) Users of site X notice or want something and say so openly in constructive engagement, or at least initial friendly query. 2) Site X ignores them, many times because they have no protocol to even talk with users, no interfacers, it's not in their biz plan / vision, or manageable, cut expenses, clam up. 3) Users escalate. Many of us have been deep in enough Site X's to know that (2) is the hard problem. There is a curious divide between vision / profit, and users. Maybe this blockchain thingy enables micro share and stake holding, and governance, to bridge it. Who knows. > with Onion SSL Certificates Not sure that letsencrypt does this yet, if not, they should. > an official ".onion" top-level domain Yes Jacob Appelbaum et al's work resulting in RFC7686 was good. Too bad a number of other efforts got jammed / quit, because I2P and other overlay networks are a thing now too. draft-grothoff-iesg-special-use-p2p-names-04 draft-grothoff-iesg-special-use-p2p-bit draft-grothoff-iesg-special-use-p2p-exit-00 draft-grothoff-iesg-special-use-p2p-gns-00 draft-grothoff-iesg-special-use-p2p-i2p-00 Too bad CJDNS is still improperly overloading upon address space that IANA has explicitly allocated for other purposes, causing collisions and general non-interoperability. Least they could do if they can't get an allocation, or could have done, is camped on some unallocated, and unlikely to ever be used, space instead. So there's always things userland [projects] can do better to play nice. (Well above was mostly technical example.) > an increasing number of "respectable" onion websites which > are putting the lie to the "Dark Web" mythos. Onionland has always been respectable from day one, only the nonrespectable disrespected it. And dark web has never been a lie, or a myth, though perhaps indeed a legendary thing. Even at its supposed worst maybe driving change in the face for good. > Tor, and Onion Networking, is just the "More Secure Web" Other overlay networks are More Secure Web too. Unless that too is trademarked and sic'd upon. > grow it by giving people and companies the opportunities and > space to engage ... so that they can offer value to others. Those open spaces exist, things compete in it, so capitalize above it and win. > rehashing old debates and historical enmities. Recounting things can be useful, not because they note any particular actors in example, but because they note the sort of things any person or entity might want to look out for before letting something new, and similarly afflicted, grow bigger without first being fixed. Arbitrarily killing speech, when there's [almost] nowhere left for speakers to speak, is pretty fucking lame. CF did that, so now others are too, seemingly spurred. And speech around the world suffers. Perhaps a fair number here like free speech zones and social credit scores too. Perhaps they've just not seen enough postings decrying that to change their minds otherwise. Perhaps such postings were chilled and censored. What seems a big CF onion celebration here could easily have unanalyzed pitfalls, whether currently, or upon change of mind later on... Here's a couple... a) Analysis / Attack 1) Grand excuse and cover for floating the immense number of nodes needed on the hashring... very convenient for analysis and exploit attacks, including by their NSA CIA LE and / or other unknown partners / researchers. 2) Terminating colossal numbers of circuits into their AS and or administrative realm for observation / similar. 3) Even unwittingly creating easy locus for GPA / GAA. b) Key material 1) Holding onion names hostage in [non] custodial / contractual form, whether they give subscribers the [offline] crypto keys, or sell / rent / extort them, portability, multihoming. 2) Security aganst keytheft breach and subsequent impersonation of the sites from behind 7 proxies, phishing, etc. Compensation for site and user losses. Consideration of (a) alone should chill this party out a bit.

1 0

Public Shielded Room Work
by Karl 16 Oct '18

16 Oct '18

Hi, My name is Karl Semich and I have a desire to make available to everyone highly secure shielded rooms / SCIFs, for privacy and security in this modern age. I was wondering if anybody else was pursuing this, or if anybody knew of anybody pursuing this, that I might stay in contact with them or support them. Or even if anybody had some experience with this concept, and might mentor me, it would be incredible. I don't have any formal training and have developed some cognitive issues, resulting in slow progress, but this is all I am spending my free time on. I do not work a job, being supported for now by a trust. I'm currently residing in Green Bank, WV, where emissions are regulated for a radio observatory. I am trying to develop some relatively simple software using the rtl-sdr to measure the power of a noise source independent of background traffic, so as to quickly and repeatedly measure shielding effectiveness. I then plan to try to measure a variety of setups ranging from homemade aluminum foil & iron paint to soldered copper and welded or bolted stainless steel, to identify ways for everyday people to cheaply create shielded environments that are actually effective. I would like to find a way people can use off-the-shelf supplies to make environments that are isolated from DC to light, if desired. If anybody else is working on something like this, I would love to support you in any way available. I can donate money, I can get drinks and run errands, I can read books and pursue a degree if needed, I can mode hardware around and even develop and debug software. Please let me know, Karl

6 8

Re: [tor-talk] Does Facebook .onion work?
by grarpamp 16 Oct '18

16 Oct '18

> have to enter my phone and receive a code. > upload a photo that clearly shows your face. > Fair enough. Nope, fuck facebook. >> We use this photo to help us check that this account belongs to you. > We'll delete the photo once we've done this As with their [ab]use of the phone number, this is all flowery feelgood bullshit meant to satisfy and pacify the billions of sheeple that... "People just submitted it. I don't know why. They 'trust me'. Dumb fucks." -Mark Zuckerberg Even if the photo itself is somehow deleted and overwritten from all their media and backups... you should assume that the fuzzy signature of it (you) that they're using to "check" whatever... is still very much there and in use forever. You could probably test that by opening two separate accounts maybe a week apart, using the same "deleted" test picture. Else their "check" would be just another sheeply lie too. Perhaps change is meant to help kill "fake news" via enable more censorship knobs over notorious free speech. Speak on, faceless, numberless, anons.

1 0

Security Firm reminds police not to look at iPhones equipped with Face ID.
by jim bell 16 Oct '18

16 Oct '18

https://bgr.com/2018/10/15/security-firm-reminds-police-not-to-look-at-ipho… "Now that the FBI and other law enforcement agencies have started forcing suspects to unlock their iPhones with Face ID, a forensics company is warning authorities that they would be well advised not to look at Face ID-equipped iPhones. The reason? An iPhone X device, after a number of unsuccessful face scans, can only be unlocked via a passcode. This is a key distinction because a number of courts have ruled that requiring a suspect to tell authorities his passcode constitutes a violation of the 5th amendment. In contrast, having a suspect simply look at his device to unlock is perfectly fine. "Originally brought to light by Motherboard, Elcomsoft — a forensics firm based out of Moscow — recently delivered a presentation highlighting how authorities can inadvertently force an iPhone X or XS to disable Face ID and subsequently require a passcode. "In a slide obtained by Motherboard, Elcomsoft warns: “don’t look at the screen, or else… the same thing will occur as happened on Apple’s event.” [end of partial quote] If merely having a photograph of a face was sufficient to unlock the phone. , that would clearly be an inadequate security measure. Perhaps an additional security practice would be to have the phone 'learn' the face with some easy modification present, like the tongue stuck out, the tongue aimed up (or down) over the lip, or one lip over the other. Or, maybe with eyes crossed. Future phones should probably have two cameras, so that a face would be seen in stereo. Jim Bell

2 1

Re: [tor-talk] Questions about Directory Authority Servers
by grarpamp 15 Oct '18

15 Oct '18

On 10/15/18, panoramix.druida <panoramix.druida(a)protonmail.com> wrote: > Hi, > From my understanding when a Tor proxy is started it downloads a list of > relays from one of the ten Directory Authority Servers listed here: > https://metrics.torproject.org/rs.html#search/flag:authority > > Am I right? There's a second helper layer to the DA's known as fallback servers. However the DA's are still the root gatekeepers of the live network. And the DA's are also subject to higher layers that reside outside the live network... > If so who run these servers and how the people running them are chosen? I > would like to know a bit on the governance on how this authority servers are > chosen. Assuming more of analysis than operation question... Observatories appear to show the servers as being distributed around the world in various jurisdictions. They're run by whoever they appear to be run by. Both have a variety of potential attacks. The "how chosen / removed" part is informal but does have some written guidlines in torspec repo. The existance of DA design function under humans vs say distributed DHT, blockchain, AI, users clients, whatever... is thought to have certan strengths. Ultimately the fingerprints and IP's of the DA's are hardcoded and commited into the source code, which exists in repositories controlled by The Tor Project Inc, a corporation headquartered in, and on the books of, the United States of America, ran on continuum from open to closed fashion in various areas of governance, participation, etc. There's a lot more that goes into that. All of which various parts of the overall community (corp, dev, users, operators, funders, etc) also hold various opinions on (re DA's), no different than any other project. In overall re: design / subject of DA's... it's thought by most around Tor, a reasonably sound and working model, resistant to at least casual attack en masse, at least so far as any attack is publicly known to have occurred. Also keep in mind that design of Tor / DA is roughly 20 years old, thus having elements of both wisdom and legacy. > What could go wrong if one or more of these servers are compromise? Worst case? Full discovery of end to end physical locations, with concurrent compromise of traffic content. General network disruption including complete shutdown. Technical talk has been made over the years on if / should, and how, the DA's might be eliminated from the design. If the DA system is thought to be weak to various threats and attack models, or there's preference for a fully independant, distributed, and autonomous live network... people might want to review some of those talks, or draft design changes, or new overlay networks, or implement ones that are still in whitepaper form [waiting for a dev team]. The Anonbib is one good source for research reading, as are the materials and communities of other overlay networks. Note also that most things "who, where, threat models" regarding the DA's also apply to all the relays. And there is not necessarily any PKI WoT, comms, or in person relations between any given whole or subset[s] of them. Perhaps there should be, or not, or in part, and why / how... And that such subject questions, and their many fine and possible answers surely both here and before from many folks, are not unique to Tor... all the open overlay networks exhibit at least some similar elements. The code and networks are still active so... ignoring unknown conspirators, malactors, Sybils, GPA / GAA, [quantum] cryptanalysis, parallel constructions, etc... perhaps things in the space are thought good enough. Or not. One should never rest, because your adversaries will not. It's a big space, there's always room for new ideas, [better] solutions to old, hard, and new threats, incorporating new tools and strategies that didn't exist before, etc. Have fun :)

1 0

Cryptocurrency: $6k Wall, Privcoins
by grarpamp 15 Oct '18

15 Oct '18

https://old.reddit.com/r/Bitcoin/comments/9oabqq/feeling_good/ https://qph.fs.quoracdn.net/main-qimg-fc580cb0ec3a20ca831710fc9073e690 https://www.cnbc.com/2018/10/15/fidelity-launches-trade-execution-and-custo… https://old.reddit.com/r/Bitcoin/comments/9o8sb9/bitcoin_alltime_price_grap… https://www.reddit.com/r/CryptoCurrency/comments/9kkhho/monthly_skeptics_di… https://pirate.black/

1 0

Project Zero, *box, Unix, Licenses
by grarpamp 15 Oct '18

15 Oct '18

On 10/15/18, Ryan Carboni <ryacko(a)gmail.com> wrote: > Many Zerodium prices have increased by ten thousand last month. > Decrementing public Project Zero bug index IDs reveals that for this year, > there has been an average of ten bugs per month. > > Project Zero has revealed itself. The price for hacking should be $100,000 > for servers, and $10,000 for SOHO. Even at $1k each, would need a much bigger pot to find all the bugs. Automation is helping a lot. > Although I have only one complaint: Project Zero hasn’t examined busybox or > toybox, as far as I can tell. Or the crunchgen (ie: /rescue, etc) system of at least FreeBSD, which is full, unlike busybox / toybox somewhat reduced functionality versions, and implemented before busybox first release. https://www.freebsd.org/cgi/man.cgi?query=crunchgen https://cvsweb.openbsd.org/src/share/misc/license.template?rev=HEAD https://landley.net/toybox/license.html https://landley.net/toybox/about.html https://www.freebsd.org/cgi/man.cgi?query=build

1 0

Project Zero Priced Out of the Market?
by Ryan Carboni 15 Oct '18

15 Oct '18

Many Zerodium prices have increased by ten thousand last month. Decrementing public Project Zero bug index IDs reveals that for this year, there has been an average of ten bugs per month. Project Zero has revealed itself. The price for hacking should be $100,000 for servers, and $10,000 for SOHO. Although I have only one complaint: Project Zero hasn’t examined busybox or toybox, as far as I can tell.

1 0