- cypherpunks - lists.cpunks.org

Privacy has never been “an absolute right”
by coderman 04 Nov '14

04 Nov '14

“To those of us who have to tackle the depressing end of intelligence community behaviour on the internet, it can seem that all governments, telcos, and computing companies are in denial about its misuse." [ paraphrased for relevance ] - http://www.theguardian.com/uk-news/2014/nov/03/privacy-gchq-spying-robert-h… --- GCHQ chief accuses US tech giants of becoming terrorists' 'networks of choice' New director of UK eavesdropping agency accuses US tech firms of becoming ‘networks of choice’ for terrorists Privacy has never been “an absolute right”, according to the new director of GCHQ, who has used his first public intervention since taking over at the helm of Britain’s surveillance agency to accuse US technology companies of becoming “the command and control networks of choice” for terrorists. Robert Hannigan said a new generation of freely available technology has helped groups like Islamic State (Isis) to hide from the security services and accuses major tech firms of being “in denial”, going further than his predecessor in seeking to claim that the leaks of Edward Snowden have aided terror networks. GCHQ and sister agencies including MI5 cannot tackle those challenges without greater support from the private sector, “including the largest US technology companies which dominate the web”, Hannigan argued in an opinion piece written for the Financial Times just days into his new job. Arguing that GCHQ needed to enter into the debate about privacy, Hannigan said: “I think we have a good story to tell. We need to show how we are accountable for the data we use to protect people, just as the private sector is increasingly under pressure to show how it filters and sells its customers’ data. “GCHQ is happy to be part of a mature debate on privacy in the digital age. But privacy has never been an absolute right and the debate about this should not become a reason for postponing urgent and difficult decisions.” Hannigan, who was born in Gloucestershire, not far from GCHQ’s base, has advised the prime minister on counter-terrorism, intelligence and security policy, goes on to take aim at the role of major technology companies. A senior Foreign Office official, Hannigan succeeded Sir Iain Lobban at the Cheltenham-based surveillance agency. While not naming any company in particular, the GCHQ director writes: “To those of us who have to tackle the depressing end of human behaviour on the internet, it can seem that some technology companies are in denial about its misuse. “I suspect most ordinary users of the internet are ahead of them: they have strong views on the ethics of companies, whether on taxation, child protection or privacy; they do not want the media platforms they use with their friends and families to facilitate murder or child abuse.” Hannigan asserts that the members of the public “know” the internet grew out of the values of western democracy and insists that customers of the technology firms he criticises would be “comfortable with a better, more sustainable relationship between the agencies and the technology companies.” Heading towards the 25th anniversary of the creation of the world wide web, he calls for a “new deal” between democratic governments and the technology companies in the area of protecting citizens. “It should be a deal rooted in the democratic values we share. That means addressing some uncomfortable truths. Better to do it now than in the aftermath of greater violence.” In the same piece, Hannigan says Isis differs from its predecessors in the security of its communications, presenting an even greater challenge to the security services. He writes: “Terrorists have always found ways of hiding their operations. But today mobile technology and smartphones have increased the options available exponentially. “Techniques for encrypting messages or making them anonymous which were once the preserve of the most sophisticated criminals or nation states now come as standard. These are supplemented by freely available programs and apps adding extra layers of security, many of them proudly advertising that they are ‘Snowden approved’. There is no doubt that young foreign fighters have learnt and benefited from the leaks of the past two years.” Among the advocates of privacy protection who reacted to Hannigan’s comments, the deputy director of Privacy International, Eric King, said: “It’s disappointing to see GCHQ’s new director refer to the internet – the greatest tool for innovation, access to education and communication humankind has ever known – as a command-and-control network for terrorists.” King added: “Before he condemns the efforts of companies to protect the privacy of their users, perhaps he should reflect on why there has been so much criticism of GCHQ in the aftermath of the Snowden revelations. GCHQ’s dirty games – forcing companies to handover their customers’ data under secret orders, then secretly tapping the private fibre optic cables between the same companies’ data centres anyway – have lost GCHQ the trust of the public, and of the companies who services we use. Robert Hannigan is right, GCHQ does need to enter the public debate about privacy - but attacking the internet isn’t the right way to do it.” The Electronic Frontier Foundation (EFF) meanwhile rejected the notion that an agreement between companies and governments was needed. Jillian York, director of international free expression at EFF said: “A special “deal” between governments and companies isn’t necessary - law enforcement can conduct open source intelligence on publicly-posted content on social networks, and can already place legal requests with respect to users. Allowing governments special access to private content is not only a violation of privacy, it may also serve to drive terrorists underground, making the job of law enforcement even more difficult.” Welcoming Hannigan’s participation in the public debate, the Labour Party MP Tom Watson said it helped to map out where we should draw the line on privacy and helps the same agencies “to rebuild their legitimacy post-Snowden”. But he added: “I hope they do not confuse the use of public propaganda through social media by extremists with the use of the covert communications. It is illogical to say that because Isis use Twitter, all our metadata should be collected without warrant.” Hannigan’s comments come after the director of the FBI, James Comey, called for “a regulatory or legislative fix” for technology companies’ expanding use of encryption to protect user privacy. Reacting last month to the introduction of strong default encryption by Apple and Google on their latest mobile operating systems, Comey said “the post-Snowden pendulum has swung too far in one direction - in a direction of fear and mistrust.” “Justice may be denied because of a locked phone or an encrypted hard drive,” said Comey. Without a compromise, “homicide cases could be stalled, suspects could walk free, and child exploitation victims might not be identified or recovered.”

1 0

on list moderation of great justice [was: [oss-security] list policy (Re: Truly scary SSL 3.0 vuln to be revealed soon:) ]
by coderman 04 Nov '14

04 Nov '14

> On Tue, Oct 14, 2014 at 10:48:00PM -0700, Walter Parker wrote: >> What is this list's policy on Full Disclosure? >... as one who enjoys a significant moderation delay on Full-Disclosure, i feel qualified to pontificate on this subject. [0] per the monthly statistics summarized at http://seclists.org/fulldisclosure/ one can easily see how the careful pruning of noise on this channel has resulted in double digit density goodness, e.g. Aug 2014 at 89 posts; a new record of brevity and decorum! i for one gladly await the day a more properly, more aggressively moderated full-disclosure reaches single digits and utmost conciseness. you can do it, Fyodor! On 10/15/14, Solar Designer <solar(a)openwall.com> wrote: > Looks like I need to comment on the specific questions on list policy: > ... > Whatever is sent to the list, if on-topic and otherwise appropriate > ... is posted with no artificial delay... the only difference from the > Full-Disclosure mailing list (as far as I understand how it's run) is > that oss-security is limited to / focused on Open Source. i for one agree with Full-Disclosure's policy that active monkey-in-the-middle attacks are of zero interest. spectrum hi jinx? how cross site... [ "The Internet Threat Model" finds your privacy not cost effective. sorry! ] given such undeniable logic, i must fully support the ongoing total moderation with infinite delay of coderman(a)gmail.com on the full-disclosure list. never again from coderman is too soon! finally, regarding other aspects of full-disclosure, i must disclose that i have nothing further to say on the conspiracy in the information security industry to assist various intelligence agencies, including Attrition.org collaboration with NSA TAO [1] and Fyodor's relationship with GCHQ's HACIENDA scanner [2]. best regards, 0. see "RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4" - moderated on F-D since Sept. , also "Preferred Roaming List Zero Intercept Attack [was: DEF CON nostalgia [before that: going double cryptome at DEF CON 22]][still confusing]" moderated days to Aug 4 post send on 1st. 1. "Tailored Access Operations ... Details on a program titled QUANTUMSQUIRREL indicate NSA ability to masquerade as any routable IPv4 or IPv6 host." - https://en.wikipedia.org/wiki/Tailored_Access_Operations#Virtual_locations 2. "GCHQ project HACIENDA [...] uses [nmap] port scanning to find vulnerable systems for Five Eyes intelligence agencies." - https://en.wikipedia.org/wiki/TCP_Stealth

1 0

RC4 still sucks in the year 2014 - A Practical Attack Against the HIVE Hidden Volume Encryption System
by coderman 03 Nov '14

03 Nov '14

""" A Practical Attack Against the HIVE Hidden Volume Encryption System Kenneth G. Paterson and Mario Strefler Abstract: The HIVE hidden volume encryption system was proposed by Blass et al. at ACM-CCS 2014. Even though HIVE has a security proof, this paper demonstrates an attack on its implementation that breaks the main security property claimed for the system by its authors, namely plausible hiding against arbitrary-access adversaries. Our attack is possible because of HIVE's reliance on the RC4 stream cipher to fill unused blocks with pseudorandom data. While the attack can be easily eliminated by using a better pseudorandom generator, it serves as an example of why RC4 should be avoided in all new applications and a reminder that one has to be careful when instantiating primitives. """ - http://eprint.iacr.org/2014/901

1 0

are USB floppies toxic?
by Eugen Leitl 03 Nov '14

03 Nov '14

We know USB flash is is Biosafety 4, what about other sneaker-net suitable storage media? USB floppies are still around, as well as media, which are write-protectable. How easy to hop the air gap with these?

9 10

Brain decoder can eavesdrop on your inner voice
by Eugen Leitl 03 Nov '14

03 Nov '14

http://www.newscientist.com/article/mg22429934.000-brain-decoder-can-eavesd… Brain decoder can eavesdrop on your inner voice 29 October 2014 by Helen Thomson Magazine issue 2993. Subscribe and save For similar stories, visit the The Human Brain Topic Guide As you read this, your neurons are firing – that brain activity can now be decoded to reveal the silent words in your head TALKING to yourself used to be a strictly private pastime. That's no longer the case – researchers have eavesdropped on our internal monologue for the first time. The achievement is a step towards helping people who cannot physically speak communicate with the outside world. "If you're reading text in a newspaper or a book, you hear a voice in your own head," says Brian Pasley at the University of California, Berkeley. "We're trying to decode the brain activity related to that voice to create a medical prosthesis that can allow someone who is paralysed or locked in to speak." When you hear someone speak, sound waves activate sensory neurons in your inner ear. These neurons pass information to areas of the brain where different aspects of the sound are extracted and interpreted as words. In a previous study, Pasley and his colleagues recorded brain activity in people who already had electrodes implanted in their brain to treat epilepsy, while they listened to speech. The team found that certain neurons in the brain's temporal lobe were only active in response to certain aspects of sound, such as a specific frequency. One set of neurons might only react to sound waves that had a frequency of 1000 hertz, for example, while another set only cares about those at 2000 hertz. Armed with this knowledge, the team built an algorithm that could decode the words heard based on neural activity aloneMovie Camera (PLoS Biology, doi.org/fzv269) The team hypothesised that hearing speech and thinking to oneself might spark some of the same neural signatures in the brain. They supposed that an algorithm trained to identify speech heard out loud might also be able to identify words that are thought. Mind-reading To test the idea, they recorded brain activity in another seven people undergoing epilepsy surgery, while they looked at a screen that displayed text from either the Gettysburg Address, John F. Kennedy's inaugural address or the nursery rhyme Humpty Dumpty. Each participant was asked to read the text aloud, read it silently in their head and then do nothing. While they read the text out loud, the team worked out which neurons were reacting to what aspects of speech and generated a personalised decoder to interpret this information. The decoder was used to create a spectrogram – a visual representation of the different frequencies of sound waves heard over time. As each frequency correlates to specific sounds in each word spoken, the spectrogram can be used to recreate what had been said. They then applied the decoder to the brain activity that occurred while the participants read the passages silently to themselves (see diagram). Despite the neural activity from imagined or actual speech differing slightly, the decoder was able to reconstruct which words several of the volunteers were thinking, using neural activity alone (Frontiers in Neuroengineering, doi.org/whb) The algorithm isn't perfect, says Stephanie Martin, who worked on the study with Pasley. "We got significant results but it's not good enough yet to build a device." In practice, if the decoder is to be used by people who are unable to speak it would have to be trained on what they hear rather than their own speech. "We don't think it would be an issue to train the decoder on heard speech because they share overlapping brain areas," says Martin. The team is now fine-tuning their algorithms, by looking at the neural activity associated with speaking rate and different pronunciations of the same word, for example. "The bar is very high," says Pasley. "Its preliminary data, and we're still working on making it better." The team have also turned their hand to predicting what songs a person is listening to by playing lots of Pink Floyd to volunteers, and then working out which neurons respond to what aspects of the music. "Sound is sound," says Pasley. "It all helps us understand different aspects of how the brain processes it." "Ultimately, if we understand covert speech well enough, we'll be able to create a medical prosthesis that could help someone who is paralysed, or locked in and can't speak," he says. Several other researchers are also investigating ways to read the human mind. Some can tell what pictures a person is looking at, others have worked out what neural activity represents certain concepts in the brain, and one team has even produced crude reproductions of movie clips that someone is watching just by analysing their brain activity. So is it possible to put it all together to create one multisensory mind-reading device? In theory, yes, says Martin, but it would be extraordinarily complicated. She says you would need a huge amount of data for each thing you are trying to predict. "It would be really interesting to look into. It would allow us to predict what people are doing or thinking," she says. "But we need individual decoders that work really well before combining different senses." This article appeared in print under the headline "Hearing our inner voice"

2 1

Re: <unlike-us> news on the alternative social media front
by rysiek 03 Nov '14

03 Nov '14

Hi there, Dnia poniedziałek, 3 listopada 2014 11:24:28 carlo von lynX pisze: > The problem is that interoperability is not solving any real problem. I disagree. The small number of users and the confusion of which network to use is a real problem, related to the network effect aka Metcalfe's law: http://en.wikipedia.org/wiki/Metcalfe%27s_law The same problem exists with truly distributed social networks, like SocialSwarm, MaidSafe, Twister et al. How should a user decide which one they should use? Let's make that step easier by at least making an attempt at interoperability. > As if any of those platforms was scalable, functional and sexy enough > to attract a relevant number of people away from the cloud-based systems. > If one of them was so cool, we wouldn't really need the other ones, so > interoperability is unnecessary. To some extent you're right. > Interoperability is something you should ask from competing proprietary > systems, but it is irrelevant for free software systems. I don't agree. These systems already have tens of thousands of users, and getting these users together on a single network is one of the challanges. > So after eleven years working on free "federated" social web thingies all we > got is some platforms that can talk to each other although they can't scale > to real world relevant numbers or hide their data from government > authorities. How do you know they can't scale? I see Diaspora scaling pretty well so far. And as far as hiding data from governments is concerned -- sure I'd prefer everybody to jump into RetroShare, but that's not gonna happen. And a decentralized system is much better, privacy-wise, than a centralized one, even if it's not perfect. > (...) > > >> Most "evil" services we use, just need a decent easy to use functional > > >> alternative. > > > > > > That's the crux, right after getting a common protocol implemented > > > across > > > different federated social networks. Also consider: > > > http://rys.io/en/88 > > That document mentions SocialSwarm, with a link to > http://wiki.socialswarm.net/Beyond_the_federation > which I think explains pretty well how federation will never take off. Fair enough. But it already has hundreds of thousands of users. For me, the endgame is indeed complete decentralisation and peer-to-peer social networking, a'la SocialSwarm, RetroShare and Twister. None of these are ready yet, though, the way Diaspora or Friendica are ready and usable today. So I'd rather help people switch to Diaspora or Friendica today rather than have them wait unspecified amount of time fort the Golden Age of Social Networking. Because once we have them on the free software, decentralised, federated sid, we can write bridges/gateways, and have SocialSwarm connect with userbase on The Federation. That's not possibble with *any* walled garden. > Then it says this, as an excuse for dismissing SocialSwarm: > > The problem with FreedomBox and SocialSwarm I see is that they are trying > > to make two hard transitions at once: from centralised to de-centralised, > > and from third-party-hosted to self-hosted. I believe this is a tad too > > an ambitious plan and it should be split into two separate steps. > > However, if we did Step 0 and Step 1 right, they both would have at least > > a part of their work done for them. > And that again is wrong because if you have identified the two or > three crucial problems, trying to fix just one while maintaining > all the mess of the other two problems is years of efforts for > little gain: you and your nerd friends are having their own little > social network, still fully visible to the NSA, while the people > that you would like to spend more time with you have all logical > reasons on their side to stick to Facebook etc. > ( See the examples at the end of > http://wiki.socialswarm.net/Beyond_the_federation ) But my girfriend doesn't have to use *my* server, she can choose any of the tens of pods worldwide. > So now you have interoperability which doesn't solve any of the > three problems: > - scalability > - social graph protection > - end-to-end encryption (the reason why your significant other > will not be free to talk about you while using your server) So, this is interesting: https://joindiaspora.com/posts/5069036#b894222043d8013279201a960f0f49a1 RedMatrix supports end-to-end encryption. > > > Also, please join us at The Federation Assembly at #31C3: > > > https://events.ccc.de/congress/2014/wiki/Assembly:The_Federation > > Great! Server federation! Keep promoting bad ideas! > Federation does not solve the problem that SERVERS AREN'T SAFE! No, they're not. Still, many federating servers controlled by different people is much better than a single, centrally controlled network. Somewhere there's a video of Bruce Schneier talking about how 10000 different small and medium e-mail providers is so much better a situation, than 10 large ones. That's exactly my point here. > Servers should not be confided with the social graph of humanity, > not even if we pay 8 euros a month for them - because their > virtual memory is easily automatically reapable by authorities. It is indeed. But if they have to do it on 10000 different servers, that's a different ball game than when they have to do it on 10 or 100. > Even if the FSW solved the problem of efficient distribution, > which of course it hasn't even properly addressed, it still > lets the agencies have the entire cake and eat it. As above. > How can you guys dare to go to the 31C3 and act as if > Snowden didn't happen? You know what? At this point let me say from the depth of my heart: fuck you. Don't you dare lecture me on Snowden and privacy. The fact that I have different take-away from these revelations (e.g. "done now is better than perfect in a decade") doesn't give you the right to be a condescending little prick, smirking with contempt from your high horse of theoretical technical superiority with not much to show for it but a few texts critical of projects that work *here and now*. Where's the code? Where are the tools? How can I get involved? Can I test anything, apart from your ability to throw tantrums? Please don't tell me that's all you've got in the pipeline since 28C3! Here are some news for you: FreedomBox is not yet usable. SocialSwarm is not yet usable. I'd love them to be, but they're simply not. And while you berate others about how they act as if "Snowden didn't happen", these others are getting people off of Facebook at least, today. That's not perfect, but it's a *step*. A step you can either try to build upon, or a step you can try to undermine. Guess which has a higher chance of eventually solving most or all of the problems you mentioned? Here, have a read: https://medium.com/message/81e5f33a24e1 Especially the "In the end, it’s culture that’s broken" part. Come back when you do. > It's annoying that the things we said in 2011 on > http://secushare.org/2011-FSW-Scalability-Paranoia > still apply. No progress at all. Had the "federated > social web" crowd understood and invested half the > energy in a P2P/onion-relay/multicast kind of "GNU > Internet" infrastructure, instead of insisting on a > broken model, we would now have a distributed social > network that works AND respects basic civil rights. Had my grandmother had mustache, she would be my grandfather, as we say in Poland. Cry me a fucking river. Also, had you spend the time you have spent writing this e-mail on development work, you'd be a few steps closer to your goal. So, there's that. > Thank you, low-hanging-fruit people, for keeping so many brilliant > developers off the important projects and distracting even public > financing with the undead federation rhethoric. What, now it's my fault that people that are completely unrelated to me and that make their own decisions are working on project A instead of project B which you tend to prefer? How sad is your world, how filled with bile must you be that your pet project is not my pet project, or Friendica/Diaspora/Red developers' pet project! Go out, talk, explain, reach out and convince people it's worthwhile to invest their time and effort in your idea. Heck, convince me that's worthwhile and that it will get people off of Facebook sooner than in a decade, and I might start helping you out! Hint: blaming me for your own problems with communication and having a fit over other people taking different paths than yours is not the perfect strategy for that. > There's nothing as strong as a bad idea whose time has come. > > Terrible to see we haven't made much progress since I said > that at unlike-us 2012. Ever thought that might somehow be related to how you go about introducing people to your ideas, maybe? -- Pozdr rysiek

1 0

Re: [tor-talk] Facebook brute forcing hidden services
by tigrutigru＠gmail.com 02 Nov '14

02 Nov '14

I've been to FSCONS today session: "Blurry line between private service and public infrastructure" covering a problem with decentralised, federated services and platforms which can be used as an alternative to FB. There are many (Diaspora, Frendica, GNU social etc) , but use incompatible protocols, making it hard for users to choose, and fragmenting the community, making it look weak and small. Another problem is that most of them don't have client API's and do have a sorry-looking interface. However, if those platforms would be compatible and talk to each other - in a session it was called "The Federation", this problem of fragmentation and poor user database is solved. So far is the most promising solution I heard which can help to get people of Facebook hook, or at least use it when absolutely necessary, not to post your entire life on it. Most "evil" services we use, just need a decent easy to use functional alternative. In the actual lecture the federation of decentralised social networks is described from the 28th minute https://m.youtube.com/watch?v=R_uvYp3fog4 > On 1 Nov 2014, at 17:00, cypherpunks-request(a)cpunks.org wrote: > > Re: [tor-talk] Facebook brute forcing hidden services

5 9

https://facebookcorewwwi.onion/
by rysiek 02 Nov '14

02 Nov '14

Hi all, so, you've probably seen this: http://venturebeat.com/2014/10/31/facebook-announced-it-is-now-providing-di… Apart from being torn about the move (good on Facebook to support TOR, but I don't really feel like praising Facebook for anything I guess), there are two WTFs here: https://facebookcorewwwi.onion/ 1. HTTPS to TOR Hidden Service? Why? /that's the smaller one/ 2. How did they get to control 15 characters (I assume the "i" was random) in the .onion address? That's a *LOT* of number crunching. If they are able to do this, it means they are able (or are very close to) bascially spoof *any* .onion address. Am I missing something? -- Pozdr rysiek

8 10

IPv5 is a laser
by coderman 02 Nov '14

02 Nov '14

http://phenoelit.org/stuff/CSLI.pdf

1 0

Re: GamerGate
by John Young 02 Nov '14

02 Nov '14

I had not followed GamerGate until today's New York Times article about it. Nor followed games, so the controversy is new to me. But not the issues involved, which are prevalent online and off. Particularly in testosterone-rich enterprises like military, spies, armaments, sports, weapons, ideology, religion, education, society, civilization, humanity, existence itself. In all of these, the stronger violently dominate the weaker and do so with the psychotic belief that this is the way it should be, natural. In war and peace, in human exploitation of animal and earthly domains, in climate degradation, in force-feeding "democracy," in cruel treatment of women's bodies and neglect of children, in just about every aspect of torturous "advancements in civilized peoples" in the course of inventing and applying ever greater and more vicious ways to kill, maim, starve and over-populate earthlings by male rape in all guises of wargames. Games are a reflection of the this much greater conceit of male dominance in all institutions, all of them, even those which spout diversity and affirmative action and grant minimal access to privileged male sanctuaries -- no matter the skin color, ethnicity, faith, location on earth. It is argued that male aggression inherent and can at best be somewhat controlled by law and social compact. That is a comfortable apologia by male supremacists in law and social compacts dominated by them with intellectual and economic arrogance. All institutions measure accomplishment by male-derived standards to tip the balance in favor of those rigged games. GameGate is too limited in scope, so much that it should be seen as a male-dominated diversion, a game, to avoid addressing the origin and sustaining influence of male way of thinking, doing, making, competing, surviving, by lying, cheating, killing, ruling in all aspects of existence, simulated in games, trained for in games, monetized by games designers and producers, applauded and lauded in halls of power and control, in prizes and awards, in cemetaries and statues, in art and science, in accumulation concentration and monopolization of wealth. No game this larger world, this wargame of "ballsy" potentates in military, policy, spying, media, sports, taxation, playing obsessively the "law of men enforced by lawmen." At 12:10 PM 10/25/2014, you wrote: >Hello >John, what do you think about GamerGate? > >cheers, >George.

13 15